blue-team-tools

proc_creation_win_7zip_exfil_dmp_files.yml

feat: more updates

2023-03-10 23:32:32 +01:00

proc_creation_win_7zip_password_compression.yml

fix: add missing modified

2023-03-13 10:49:29 +01:00

proc_creation_win_7zip_password_extraction.yml

fix: add missing modifier

2023-03-11 18:32:33 +01:00

proc_creation_win_at_interactive_execution.yml

feat: more updates

2023-03-10 23:32:32 +01:00

proc_creation_win_attrib_hiding_files.yml

feat: attrib rules updates

2023-03-14 01:50:30 +01:00

proc_creation_win_attrib_system_susp_paths.yml

feat: attrib rules updates

2023-03-14 01:50:30 +01:00

proc_creation_win_attrib_system.yml

feat: attrib rules updates

2023-03-14 01:50:30 +01:00

proc_creation_win_auditpol_nt_resource_kit_usage.yml

fix: apply suggestions from code review

2023-03-13 10:48:08 +01:00

proc_creation_win_auditpol_susp_execution.yml

fix: apply suggestions from code review

2023-03-13 10:48:08 +01:00

proc_creation_win_bcdedit_boot_conf_tamper.yml

feat: update bitsadmin rules and other

2023-02-15 19:55:40 +01:00

proc_creation_win_bcdedit_susp_execution.yml

fix: broken selection

2023-02-15 19:58:48 +01:00

proc_creation_win_bitsadmin_download_direct_ip.yml

feat: update bitsadmin rules and other

2023-02-15 19:55:40 +01:00

proc_creation_win_bitsadmin_download_file_sharing_domains.yml

feat: update bitsadmin rules and other

2023-02-15 19:55:40 +01:00

proc_creation_win_bitsadmin_download_susp_extensions.yml

feat: rule and tests update

2023-05-31 13:46:13 +02:00

proc_creation_win_bitsadmin_download_susp_targetfolder.yml

feat: rule and tests update

2023-05-31 13:46:13 +02:00

proc_creation_win_bitsadmin_download_uncommon_targetfolder.yml

feat: update bitsadmin rules and other

2023-02-15 19:55:40 +01:00

proc_creation_win_bitsadmin_download.yml

fix: remove unrelated bitsadmin selection

2023-02-15 21:18:38 +01:00

proc_creation_win_bitsadmin_potential_persistence.yml

feat: rule and tests update

2023-05-31 13:46:13 +02:00

proc_creation_win_browsers_chromium_headless_debugging.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_browsers_chromium_headless_file_download.yml

feat: new rules, updates and goofy guineapig stuff (#4229 )

2023-05-15 15:53:39 +02:00

proc_creation_win_browsers_chromium_susp_load_extension.yml

fix: typos/wording

2023-05-03 09:01:29 +02:00

proc_creation_win_browsers_msedge_arbitrary_download.yml

fix: typos

2023-04-14 11:54:04 +02:00

proc_creation_win_browsers_remote_debugging.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_browsers_tor_execution.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_certmgr_certificate_installation.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_certoc_load_dll_susp_locations.yml

fix: apply suggestions from code review

2023-02-16 11:06:57 +01:00

proc_creation_win_certoc_load_dll.yml

feat: update bitsadmin rules and other

2023-02-15 19:55:40 +01:00

proc_creation_win_certutil_certificate_installation.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_certutil_decode.yml

fix: apply suggestions from code review

2023-02-16 11:06:57 +01:00

proc_creation_win_certutil_download_direct_ip.yml

feat: update certutil rules

2023-02-15 19:55:39 +01:00

proc_creation_win_certutil_download_file_sharing_domains.yml

feat: update certutil rules

2023-02-15 19:55:39 +01:00

proc_creation_win_certutil_download.yml

feat: update certutil rules

2023-02-15 19:55:39 +01:00

proc_creation_win_certutil_encode_susp_extensions.yml

fix: typo in 'related' field

2023-06-07 12:02:43 +02:00

proc_creation_win_certutil_encode_susp_location.yml

fix: typo in 'related' field

2023-06-07 12:02:43 +02:00

proc_creation_win_certutil_encode.yml

feat: multiple updates and new rules (#4242 )

2023-05-17 17:21:59 +02:00

proc_creation_win_certutil_export_pfx.yml

fix: add missing modified

2023-02-20 17:08:48 +01:00

proc_creation_win_certutil_ntlm_coercion.yml

feat: update certutil rules

2023-02-15 19:55:39 +01:00

proc_creation_win_chcp_codepage_lookup.yml

fix: fp found in testing

2023-05-05 12:24:54 +02:00

proc_creation_win_chcp_codepage_switch.yml

fix: add missing modified date

2023-03-07 17:50:14 +01:00

proc_creation_win_cipher_overwrite_deleted_data.yml

fix: typo

2023-02-22 12:16:49 +01:00

proc_creation_win_citrix_trolleyexpress_procdump.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_clip_execution.yml

fix: apply suggestions from 2nd code review

2023-02-22 12:15:49 +01:00

proc_creation_win_cloudflared_tunnel_cleanup.yml

feat: add new rules related to cloudflared usage (#4243 )

2023-05-17 17:21:23 +02:00

proc_creation_win_cloudflared_tunnel_run.yml

feat: add new rules related to cloudflared usage (#4243 )

2023-05-17 17:21:23 +02:00

proc_creation_win_cmd_assoc_execution.yml

feat: update cmd based rules

2023-03-07 14:13:57 +01:00

proc_creation_win_cmd_assoc_tamper_exe_file_association.yml

feat: update cmd based rules

2023-03-07 14:13:57 +01:00

proc_creation_win_cmd_copy_dmp_from_share.yml

fix: test errors

2023-03-07 14:23:44 +01:00

proc_creation_win_cmd_curl_download_exec_combo.yml

feat: update cmd based rules

2023-03-07 14:13:57 +01:00

proc_creation_win_cmd_del_execution.yml

fix: add missing modified date

2023-03-07 17:50:14 +01:00

proc_creation_win_cmd_del_greedy_deletion.yml

feat: update cmd based rules

2023-03-07 14:13:57 +01:00

proc_creation_win_cmd_dir_execution.yml

feat: update cmd based rules

2023-03-07 14:13:57 +01:00

proc_creation_win_cmd_dosfuscation.yml

feat: update cmd based rules

2023-03-07 14:13:57 +01:00

proc_creation_win_cmd_http_appdata.yml

feat: update cmd based rules

2023-03-07 14:13:57 +01:00

proc_creation_win_cmd_mklink_osk_cmd.yml

feat: update cmd based rules

2023-03-07 14:13:57 +01:00

proc_creation_win_cmd_mklink_shadow_copies_access_symlink.yml

feat: update cmd based rules

2023-03-07 14:13:57 +01:00

proc_creation_win_cmd_net_use_and_exec_combo.yml

feat: update cmd based rules

2023-03-07 14:13:57 +01:00

proc_creation_win_cmd_no_space_execution.yml

feat: update cmd based rules

2023-03-07 14:13:57 +01:00

proc_creation_win_cmd_ntdllpipe_redirect.yml

fix: apply suggestions from code review

2023-03-07 17:07:12 +01:00

proc_creation_win_cmd_path_traversal.yml

feat: update cmd based rules

2023-03-07 14:13:57 +01:00

proc_creation_win_cmd_ping_del_combined_execution.yml

feat: update cmd based rules

2023-03-07 14:13:57 +01:00

proc_creation_win_cmd_redirect.yml

feat: update cmd based rules

2023-03-07 14:13:57 +01:00

proc_creation_win_cmd_redirection_susp_folder.yml

feat: multiple updates and new rules (#4242 )

2023-05-17 17:21:59 +02:00

proc_creation_win_cmd_rmdir_execution.yml

fix: add missing modified date

2023-03-07 17:50:14 +01:00

proc_creation_win_cmd_shadowcopy_access.yml

feat: update cmd based rules

2023-03-07 14:13:57 +01:00

proc_creation_win_cmd_stdin_redirect.yml

feat: update cmd based rules

2023-03-07 14:13:57 +01:00

proc_creation_win_cmd_sticky_key_like_backdoor_execution.yml

fix: add missing modified date

2023-03-07 17:50:14 +01:00

proc_creation_win_cmd_sticky_keys_replace.yml

feat: update cmd based rules

2023-03-07 14:13:57 +01:00

proc_creation_win_cmd_unusual_parent.yml

feat: update cmd based rules

2023-03-07 14:13:57 +01:00

proc_creation_win_cmdkey_adding_generic_creds.yml

fix: multiple typos

2023-02-06 12:28:45 +01:00

proc_creation_win_cmdkey_recon.yml

feat: even more updates

2023-02-03 20:17:09 +01:00

proc_creation_win_cmstp_execution_by_creation.yml

…

proc_creation_win_conhost_legacy_option.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_conhost_path_traversal.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_conhost_susp_child_process.yml

feat: more updates

2023-06-01 23:22:35 +02:00

proc_creation_win_conhost_uncommon_parent.yml

feat: new rules, updates and fp fixes (#4162 )

2023-04-11 13:04:22 +02:00

proc_creation_win_control_panel_item.yml

Remove mitre url

2023-01-10 18:24:22 +01:00

proc_creation_win_createdump_lolbin_execution.yml

feat: rule updates

2023-04-12 02:57:44 +02:00

proc_creation_win_csc_susp_folder.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_csc_susp_parent.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_csi_execution.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_csi_use_of_csharp_console.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_csvde_export.yml

fix: apply suggestions from code review

2023-03-15 19:27:57 +01:00

proc_creation_win_curl_download_susp_file_sharing_domains.yml

fix: apply suggestions from code review

2023-05-09 16:04:24 +02:00

proc_creation_win_curl_susp_download.yml

feat: multiple updates and new rules (#4242 )

2023-05-17 17:21:59 +02:00

proc_creation_win_desktopimgdownldr_remote_file_download.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_desktopimgdownldr_susp_execution.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_deviceenroller_dll_sideloading.yml

feat: more fixes and updates

2023-02-05 21:46:22 +01:00

proc_creation_win_devinit_lolbin_usage.yml

fix: typos

2023-04-14 11:54:04 +02:00

proc_creation_win_dfsvc_suspicious_child_processes.yml

feat: update clickonce rules

2023-06-12 23:52:40 +02:00

proc_creation_win_dirlister_execution.yml

fix: multiple typos

2023-02-06 12:28:45 +01:00

proc_creation_win_dll_sideload_vmware_xfer.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_dllhost_no_cli_execution.yml

feat: new rules, updates and goofy guineapig stuff (#4229 )

2023-05-15 15:53:39 +02:00

proc_creation_win_dns_exfiltration_tools_execution.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_dns_susp_child_process.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_dnscmd_discovery.yml

fix: multiple typos

2023-02-06 12:28:45 +01:00

proc_creation_win_dnscmd_install_new_server_level_plugin_dll.yml

fix: multiple typos

2023-02-06 12:28:45 +01:00

proc_creation_win_driverquery_recon.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_driverquery_usage.yml

feat: more fixes and updates

2023-02-05 21:46:22 +01:00

proc_creation_win_dsacls_abuse_permissions.yml

fix: multiple typos

2023-02-06 12:28:45 +01:00

proc_creation_win_dsacls_password_spray.yml

feat: more fixes and updates

2023-02-05 21:46:22 +01:00

proc_creation_win_dsim_remove.yml

…

proc_creation_win_dsquery_domain_trust_discovery.yml

feat: multiple updates and fixes

2023-02-03 02:22:28 +01:00

proc_creation_win_dtrace_kernel_dump.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_dumpminitool_execution.yml

feat: add new flags

2023-04-12 03:40:38 +02:00

proc_creation_win_dumpminitool_susp_execution.yml

feat: add new flags

2023-04-12 03:40:38 +02:00

proc_creation_win_esentutl_params.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_esentutl_sensitive_file_copy.yml

fix: shorten filenames

2023-03-06 00:55:03 +01:00

proc_creation_win_esentutl_webcache.yml

…

proc_creation_win_exfiltration_and_tunneling_tools_execution.yml

…

proc_creation_win_expand_cabinet_files.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_explorer_break_process_tree.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_explorer_lolbin_execution.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_explorer_nouaccheck.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_findstr_gpp_passwords.yml

feat: update cmd based rules

2023-03-07 14:13:57 +01:00

proc_creation_win_findstr_lnk.yml

feat: update cmd based rules

2023-03-07 14:13:57 +01:00

proc_creation_win_findstr_lsass.yml

fix: test errors

2023-03-07 14:23:44 +01:00

proc_creation_win_findstr_recon_everyone.yml

fix: apply suggestions from code review

2023-03-07 17:07:12 +01:00

proc_creation_win_findstr_sysmon_discovery_via_default_altitude.yml

feat: update cmd based rules

2023-03-07 14:13:57 +01:00

proc_creation_win_finger_usage.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_fltmc_unload_driver_sysmon.yml

fix: apply suggestions from code review

2023-02-16 10:46:29 +01:00

proc_creation_win_fltmc_unload_driver.yml

fix: fp found in testing

2023-03-14 23:58:04 +01:00

proc_creation_win_fsutil_drive_enumeration.yml

Remove mitre url

2023-01-10 18:09:04 +01:00

proc_creation_win_fsutil_symlinkevaluation.yml

fix: update broken selection

2023-01-19 21:33:29 +01:00

proc_creation_win_fsutil_usage.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_git_susp_clone.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_googleupdate_susp_child_process.yml

Update proc_creation_win_googleupdate_susp_child_process.yml

2023-05-30 19:18:23 +02:00

proc_creation_win_gpg4win_susp_usage.yml

chore: author update

2023-04-12 16:11:58 +02:00

proc_creation_win_gpresult_execution.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_gup_arbitrary_binary_execution.yml

chore: renames with new sigma convention

2023-03-03 00:21:25 +01:00

proc_creation_win_gup_download.yml

chore: renames with new sigma convention

2023-03-03 00:21:25 +01:00

proc_creation_win_gup_suspicious_execution.yml

chore: renames with new sigma convention

2023-03-03 00:21:25 +01:00

proc_creation_win_hh_chm_execution.yml

feat: update hh.exe related rules

2023-04-12 16:12:33 +02:00

proc_creation_win_hh_chm_remote_download_or_execution.yml

feat: update hh.exe related rules

2023-04-12 16:12:33 +02:00

proc_creation_win_hh_html_help_susp_child_process.yml

feat: update hh.exe related rules

2023-04-12 16:12:33 +02:00

proc_creation_win_hh_susp_execution.yml

feat: update hh.exe related rules

2023-04-12 16:12:33 +02:00

proc_creation_win_hktl_adcspwn.yml

feat: additional updates and fixes

2023-02-04 21:06:47 +01:00

proc_creation_win_hktl_bloodhound_sharphound.yml

feat: additional updates and fixes

2023-02-04 21:06:47 +01:00

proc_creation_win_hktl_c3_rundll32_pattern.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_hktl_certify.yml

fix: can be end-of-commandline

2023-04-25 11:27:21 +02:00

proc_creation_win_hktl_certipy.yml

feat: update pr related hktl rules

2023-04-21 11:06:03 +02:00

proc_creation_win_hktl_cobaltstrike_bloopers_cmd.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_hktl_cobaltstrike_bloopers_modules.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_hktl_cobaltstrike_load_by_rundll32.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_hktl_cobaltstrike_process_patterns.yml

feat: new rules, updates and fp fixes (#4136 )

2023-04-03 12:06:14 +02:00

proc_creation_win_hktl_covenant.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_hktl_crackmapexec_execution_patterns.yml

Update proc_creation_win_hktl_crackmapexec_execution_patterns.yml

2023-02-22 17:13:02 +01:00

proc_creation_win_hktl_crackmapexec_execution.yml

feat: update and fixes

2023-03-09 22:10:42 +01:00

proc_creation_win_hktl_crackmapexec_patterns.yml

feat: updates and enhancements

2023-02-14 00:51:20 +01:00

proc_creation_win_hktl_crackmapexec_powershell_obfuscation.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_hktl_createminidump.yml

feat: additional updates and fixes

2023-02-04 21:06:47 +01:00

proc_creation_win_hktl_dinjector.yml

feat: more fixes and updates

2023-02-05 21:46:22 +01:00

proc_creation_win_hktl_dumpert.yml

feat: additional updates and fixes

2023-02-04 21:06:47 +01:00

proc_creation_win_hktl_empire_powershell_launch.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_hktl_empire_powershell_uac_bypass.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_hktl_evil_winrm.yml

feat: updates and enhancements

2023-02-14 00:51:20 +01:00

proc_creation_win_hktl_execution_via_imphashes.yml

feat: additional updates and fixes

2023-02-04 21:06:47 +01:00

proc_creation_win_hktl_execution_via_pe_metadata.yml

fix: multiple typos

2023-02-06 12:28:45 +01:00

proc_creation_win_hktl_gmer.yml

feat: updates and enhancements

2023-02-14 00:51:20 +01:00

proc_creation_win_hktl_handlekatz.yml

Update proc_creation_win_hktl_handlekatz.yml

2023-02-04 22:50:54 +01:00

proc_creation_win_hktl_hashcat.yml

feat: additional updates and fixes

2023-02-04 21:06:47 +01:00

proc_creation_win_hktl_htran_or_natbypass.yml

feat: additional updates and fixes

2023-02-04 21:06:47 +01:00

proc_creation_win_hktl_hydra.yml

feat: additional updates and fixes

2023-02-04 21:06:47 +01:00

proc_creation_win_hktl_impacket_lateral_movement.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_hktl_impacket_tools.yml

feat: more updates

2023-02-07 17:12:26 +01:00

proc_creation_win_hktl_impersonate.yml

feat: more updates

2023-02-08 22:08:47 +01:00

proc_creation_win_hktl_inveigh.yml

feat: additional updates and fixes

2023-02-04 21:06:47 +01:00

proc_creation_win_hktl_invoke_obfuscation_clip.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_hktl_invoke_obfuscation_obfuscated_iex_commandline.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_hktl_invoke_obfuscation_stdin.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_hktl_invoke_obfuscation_var.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_hktl_invoke_obfuscation_via_compress.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_hktl_invoke_obfuscation_via_stdin.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_hktl_invoke_obfuscation_via_use_clip.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_hktl_invoke_obfuscation_via_use_mhsta.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_hktl_invoke_obfuscation_via_var.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_hktl_jlaive_batch_execution.yml

Update proc_creation_win_hktl_jlaive_batch_execution.yml

2023-02-22 17:13:48 +01:00

proc_creation_win_hktl_koadic.yml

feat: add missing OriginalFileName field

2023-02-11 23:04:18 +05:00

proc_creation_win_hktl_krbrelay.yml

feat: additional updates and fixes

2023-02-04 21:06:47 +01:00

proc_creation_win_hktl_krbrelayup.yml

feat: additional updates and fixes

2023-02-04 21:06:47 +01:00

proc_creation_win_hktl_localpotato.yml

feat: add localpotato binary rule

2023-02-14 19:57:26 +01:00

proc_creation_win_hktl_meterpreter_getsystem.yml

fix: shorten filenames

2023-03-06 00:55:03 +01:00

proc_creation_win_hktl_mimikatz_command_line.yml

fix: apply suggestions from code review

2023-02-22 11:05:50 +01:00

proc_creation_win_hktl_pchunter.yml

feat: updates and enhancements

2023-02-14 00:51:20 +01:00

proc_creation_win_hktl_powersploit_empire_default_schtasks.yml

fix: update rules/windows/process_creation/proc_creation_win_hktl_powersploit_empire_default_schtasks.yml

2023-03-07 17:49:21 +01:00

proc_creation_win_hktl_powertool.yml

feat: additional updates and fixes

2023-02-04 21:06:47 +01:00

proc_creation_win_hktl_purplesharp_indicators.yml

feat: more fixes and updates

2023-02-05 21:46:22 +01:00

proc_creation_win_hktl_pypykatz.yml

fix: multiple typos

2023-02-06 12:28:45 +01:00

proc_creation_win_hktl_quarks_pwdump.yml

feat: more fixes and updates

2023-02-05 21:46:22 +01:00

proc_creation_win_hktl_redmimicry_winnti_playbook.yml

chore: renames with new sigma convention

2023-03-03 00:21:25 +01:00

proc_creation_win_hktl_relay_attacks_tools.yml

feat: updates and enhancements

2023-02-14 00:51:20 +01:00

proc_creation_win_hktl_rubeus.yml

feat: new rule for Rubeus in pwsh scriptblock log

2023-04-27 16:39:17 +02:00

proc_creation_win_hktl_safetykatz.yml

feat: additional updates and fixes

2023-02-04 21:06:47 +01:00

proc_creation_win_hktl_secutyxploded.yml

feat: additional updates and fixes

2023-02-04 21:06:47 +01:00

proc_creation_win_hktl_selectmyparent.yml

fix: add missing modified date

2023-03-07 17:50:14 +01:00

proc_creation_win_hktl_sharp_chisel.yml

feat: updates and enhancements

2023-02-14 00:51:20 +01:00

proc_creation_win_hktl_sharp_impersonation.yml

feat: updates and enhancements

2023-02-14 00:51:20 +01:00

proc_creation_win_hktl_sharp_ldap_monitor.yml

fix: add missing modified date

2023-02-14 01:11:42 +01:00

proc_creation_win_hktl_sharpersist.yml

feat: additional updates and fixes

2023-02-04 21:06:47 +01:00

proc_creation_win_hktl_sharpevtmute.yml

fix: apply suggestions from code review

2023-02-20 12:06:37 +01:00

proc_creation_win_hktl_sharpldapwhoami.yml

fix: multiple typos

2023-02-06 12:28:45 +01:00

proc_creation_win_hktl_sharpup.yml

feat: updates and enhancements

2023-02-14 00:51:20 +01:00

proc_creation_win_hktl_sharpview.yml

feat: updates and enhancements

2023-02-14 00:51:20 +01:00

proc_creation_win_hktl_silenttrinity_stager.yml

feat: updates and fixes

2023-02-17 17:51:44 +01:00

proc_creation_win_hktl_sliver_c2_execution_pattern.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_hktl_stracciatella_execution.yml

feat: update pr related hktl rules

2023-04-21 11:06:03 +02:00

proc_creation_win_hktl_sysmoneop.yml

feat: additional updates and fixes

2023-02-04 21:06:47 +01:00

proc_creation_win_hktl_trufflesnout.yml

fix: apply suggestions from code review

2023-02-16 10:46:29 +01:00

proc_creation_win_hktl_uacme.yml

feat: more rules updates

2023-02-14 19:30:18 +01:00

proc_creation_win_hktl_wce.yml

feat: additional updates and fixes

2023-02-04 21:06:47 +01:00

proc_creation_win_hktl_winpeas.yml

chg author

2023-03-23 20:07:09 +01:00

proc_creation_win_hktl_wmiexec_default_powershell.yml

fix: apply suggestions from code review

2023-03-13 10:48:08 +01:00

proc_creation_win_hktl_xordump.yml

feat: more updates

2023-02-08 22:08:47 +01:00

proc_creation_win_hktl_zipexec.yml

chore: renames with new sigma convention

2023-03-03 00:21:25 +01:00

proc_creation_win_homoglyph_cyrillic_lookalikes.yml

feat: add new rule for Potential Homoglyph Attack (#4223 )

2023-05-09 01:35:52 +02:00

proc_creation_win_hostname_execution.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_hwp_exploits.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_hxtsr_masquerading.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_icacls_deny.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_iis_appcmd_http_logging.yml

feat: updates and new rules

2023-01-22 23:31:02 +01:00

proc_creation_win_iis_appcmd_service_account_password_dumped.yml

feat: updates and new rules

2023-01-22 23:31:02 +01:00

proc_creation_win_iis_appcmd_susp_module_install.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_iis_appcmd_susp_rewrite_rule.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_iis_connection_strings_decryption.yml

Fix invalid field cast or name (#3841 )

2022-12-30 11:46:21 +01:00

proc_creation_win_iis_susp_module_registration.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_imagingdevices_unusual_parents.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_infdefaultinstall_execute_sct_scripts.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_instalutil_no_log_execution.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_java_keytool_susp_child_process.yml

chore: renames with new sigma convention

2023-03-03 00:21:25 +01:00

proc_creation_win_java_remote_debugging.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_java_susp_child_process_2.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_java_susp_child_process.yml

chore: renames with new sigma convention

2023-03-03 00:21:25 +01:00

proc_creation_win_java_sysaidserver_susp_child_process.yml

feat: more apt rules updates

2023-03-10 16:50:29 +01:00

proc_creation_win_kd_execution.yml

feat: multiple updates and new rules (#4242 )

2023-05-17 17:21:59 +02:00

proc_creation_win_ksetup_password_change_computer.yml

fix: remove duplicate uuid

2023-04-12 03:11:21 +02:00

proc_creation_win_ksetup_password_change_user.yml

fix: remove duplicate uuid

2023-04-12 03:11:21 +02:00

proc_creation_win_ldifde_export.yml

fix: apply suggestions from code review

2023-03-15 19:27:57 +01:00

proc_creation_win_ldifde_file_load.yml

fix: apply suggestions from code review

2023-03-15 19:27:57 +01:00

proc_creation_win_logman_disable_eventlog.yml

fix: apply suggestions from 2nd code review

2023-02-22 12:15:49 +01:00

proc_creation_win_lolbin_adplus.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_lolbin_agentexecutor_susp_usage.yml

fix: typos in multiple rules (#4011 )

2023-02-06 13:53:23 +01:00

proc_creation_win_lolbin_agentexecutor.yml

fix: typos in multiple rules (#4011 )

2023-02-06 13:53:23 +01:00

proc_creation_win_lolbin_appvlp.yml

fix: broken selection

2022-12-30 10:30:15 +01:00

proc_creation_win_lolbin_aspnet_compiler.yml

Promotion rules (#3821 )

2022-12-27 12:29:10 +01:00

proc_creation_win_lolbin_bash.yml

…

proc_creation_win_lolbin_bginfo.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_lolbin_cdb.yml

feat: updates and enhancements

2023-01-04 17:49:32 +01:00

proc_creation_win_lolbin_certoc_download.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_lolbin_cl_invocation.yml

feat: updates and enhancements

2023-01-11 01:03:52 +01:00

proc_creation_win_lolbin_cl_loadassembly.yml

…

proc_creation_win_lolbin_cl_mutexverifiers.yml

…

proc_creation_win_lolbin_class_exec_xwizard.yml

…

proc_creation_win_lolbin_cmdl32.yml

…

proc_creation_win_lolbin_configsecuritypolicy.yml

…

proc_creation_win_lolbin_customshellhost.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_lolbin_data_exfiltration_by_using_datasvcutil.yml

…

proc_creation_win_lolbin_dctask64_proc_inject.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_lolbin_defaultpack.yml

Last lolbin (#3845 )

2022-12-31 19:53:44 +01:00

proc_creation_win_lolbin_device_credential_deployment.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_lolbin_devtoolslauncher.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_lolbin_diantz_ads.yml

fix: remove unneeded backslash escape in character class.

2022-12-31 00:33:00 +09:00

proc_creation_win_lolbin_diantz_remote_cab.yml

…

proc_creation_win_lolbin_diskshadow.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_lolbin_dll_sideload_xwizard.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_lolbin_dnx.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_lolbin_dotnet_dump.yml

feat: new rules related to dotnet-dump

2023-03-14 01:43:14 +01:00

proc_creation_win_lolbin_dotnet.yml

feat: more fixes and updates

2023-02-05 21:46:22 +01:00

proc_creation_win_lolbin_dump64.yml

fix: typo in command line argument (#4140 )

2023-03-24 15:46:46 +01:00

proc_creation_win_lolbin_extexport.yml

…

proc_creation_win_lolbin_extrac32_ads.yml

fix: add missing modified date

2022-12-30 20:56:21 +01:00

proc_creation_win_lolbin_extrac32.yml

…

proc_creation_win_lolbin_findstr.yml

…

proc_creation_win_lolbin_forfiles.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_lolbin_format.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_lolbin_fsharp_interpreters.yml

…

proc_creation_win_lolbin_ftp.yml

…

proc_creation_win_lolbin_gather_network_info.yml

fix: yaml error

2023-02-08 19:14:18 +01:00

proc_creation_win_lolbin_gfxdownloadwrapper_file_download.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_lolbin_gpscript.yml

Fix svchost FP

2023-06-14 11:33:58 +02:00

proc_creation_win_lolbin_ie4uinit.yml

feat: more updates and fixes

2023-02-28 15:22:25 +01:00

proc_creation_win_lolbin_ieexec_download.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_lolbin_ilasm.yml

…

proc_creation_win_lolbin_installutil_download.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_lolbin_jsc.yml

…

proc_creation_win_lolbin_kavremover.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_lolbin_launch_vsdevshell.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_lolbin_manage_bde.yml

fix: add missing modified and small fixes to selections

2023-02-04 11:44:33 +01:00

proc_creation_win_lolbin_mavinject_process_injection.yml

…

proc_creation_win_lolbin_mftrace.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_lolbin_mpiexec.yml

chore: renames with new sigma convention

2023-03-03 00:21:25 +01:00

proc_creation_win_lolbin_msdeploy.yml

feat: even more updates

2023-02-03 20:17:09 +01:00

proc_creation_win_lolbin_msdt_answer_file.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_lolbin_msohtmed_download.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_lolbin_mspub_download.yml

feat: updates and enhancements

2023-02-08 19:12:35 +01:00

proc_creation_win_lolbin_not_from_c_drive.yml

fix: update selection naming

2023-04-12 14:48:36 +02:00

proc_creation_win_lolbin_office.yml

fix: multiple typos

2023-02-06 12:28:45 +01:00

proc_creation_win_lolbin_offlinescannershell.yml

change status to test

2023-01-27 06:48:34 +01:00

proc_creation_win_lolbin_openconsole.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_lolbin_openwith.yml

chore: renames with new sigma convention

2023-03-03 00:21:25 +01:00

proc_creation_win_lolbin_pcalua.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_lolbin_pcwrun_follina.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_lolbin_pcwrun.yml

…

proc_creation_win_lolbin_pcwutl.yml

feat: add missing OriginalFileName field (#4026 )

2023-02-09 15:09:23 +01:00

proc_creation_win_lolbin_pester_1.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_lolbin_pester.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_lolbin_pktmon.yml

Update proc_creation_win_lolbin_pktmon.yml

2023-01-31 13:41:54 +01:00

proc_creation_win_lolbin_presentationhost_download.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_lolbin_presentationhost.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_lolbin_printbrm.yml

…

proc_creation_win_lolbin_protocolhandler_download.yml

Last lolbin (#3845 )

2022-12-31 19:53:44 +01:00

proc_creation_win_lolbin_pubprn.yml

…

proc_creation_win_lolbin_rasautou_dll_execution.yml

…

proc_creation_win_lolbin_regasm.yml

feat: updates and enhancements

2023-02-14 00:51:20 +01:00

proc_creation_win_lolbin_register_app.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_lolbin_remote.yml

…

proc_creation_win_lolbin_replace.yml

…

proc_creation_win_lolbin_rundll32_installscreensaver.yml

feat: add missing OriginalFileName field (#4026 )

2023-02-09 15:09:23 +01:00

proc_creation_win_lolbin_runexehelper.yml

Add missing lolbin OSBinaries (#3835 )

2022-12-29 14:36:33 +01:00

proc_creation_win_lolbin_runscripthelper.yml

chore: renames with new sigma convention

2023-03-03 00:21:25 +01:00

proc_creation_win_lolbin_scriptrunner.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_lolbin_setres.yml

Update proc_creation_win_lolbin_setres.yml

2022-12-12 17:09:26 -05:00

proc_creation_win_lolbin_settingsynchost.yml

…

proc_creation_win_lolbin_sftp.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_lolbin_sideload_link_binary.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_lolbin_sigverif.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_lolbin_squirrel.yml

fix: fp found in testing

2023-03-22 20:31:33 +01:00

proc_creation_win_lolbin_ssh.yml

feat: updates and fixes

2023-01-26 22:42:56 +01:00

proc_creation_win_lolbin_susp_acccheckconsole.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_lolbin_susp_atbroker.yml

…

proc_creation_win_lolbin_susp_certreq_download.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_lolbin_susp_driver_installed_by_pnputil.yml

…

proc_creation_win_lolbin_susp_dxcap.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_lolbin_susp_grpconv.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_lolbin_susp_mpcmdrun_download.yml

…

proc_creation_win_lolbin_susp_sqldumper_activity.yml

…

proc_creation_win_lolbin_syncappvpublishingserver_execute_psh.yml

…

proc_creation_win_lolbin_syncappvpublishingserver_vbs_execute_psh.yml

…

proc_creation_win_lolbin_tracker.yml

feat: updates and enhancements

2023-01-10 00:13:37 +01:00

proc_creation_win_lolbin_ttdinject.yml

…

proc_creation_win_lolbin_tttracer_mod_load.yml

…

proc_creation_win_lolbin_type.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_lolbin_unregmp2.yml

Add missing lolbin OSBinaries (#3835 )

2022-12-29 14:36:33 +01:00

proc_creation_win_lolbin_utilityfunctions.yml

…

proc_creation_win_lolbin_visual_basic_compiler.yml

…

proc_creation_win_lolbin_visualuiaverifynative.yml

…

proc_creation_win_lolbin_vsiisexelauncher.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_lolbin_wfc.yml

…

proc_creation_win_lolbin_wlrmdr.yml

…

proc_creation_win_lolbin_workflow_compiler.yml

feat: even more updates

2023-02-03 20:17:09 +01:00

proc_creation_win_lolbin_wuauclt.yml

feat: updates and enhancements

2023-02-14 00:51:20 +01:00

proc_creation_win_lolscript_register_app.yml

feat: apply suggestions from code review

2023-05-30 11:17:52 +02:00

proc_creation_win_malware_conti_shadowcopy.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_malware_script_dropper.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_mmc_mmc20_lateral_movement.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_mmc_susp_child_process.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_mofcomp_execution.yml

feat: new rules, updates and fp fixes (#4162 )

2023-04-11 13:04:22 +02:00

proc_creation_win_mpcmdrun_dll_sideload_defender.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_mpcmdrun_remove_windows_defender_definition.yml

feat: more updates

2023-02-03 19:03:51 +01:00

proc_creation_win_msbuild_susp_parent_process.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_msdt_arbitrary_command_execution.yml

fix: add missing modified and new selection

2023-02-08 10:37:24 +01:00

proc_creation_win_msdt_susp_cab_options.yml

feat: update and enhancements

2023-02-07 13:55:14 +01:00

proc_creation_win_msdt_susp_parent.yml

feat: update and enhancements

2023-02-07 13:55:14 +01:00

proc_creation_win_mshta_http.yml

feat: update and enhancements

2023-02-07 13:55:14 +01:00

proc_creation_win_mshta_inline_vbscript.yml

feat: multiple updates and new rules (#4242 )

2023-05-17 17:21:59 +02:00

proc_creation_win_mshta_javascript.yml

fix: apply suggestions from code review

2023-02-07 18:44:26 +01:00

proc_creation_win_mshta_lethalhta_technique.yml

fix: apply suggestions from code review

2023-02-07 18:44:26 +01:00

proc_creation_win_mshta_susp_child_processes.yml

fix: typos and improve wording

2023-02-08 10:29:48 +01:00

proc_creation_win_mshta_susp_execution.yml

fix: apply suggestions from 2nd code review

2023-02-22 12:15:49 +01:00

proc_creation_win_mshta_susp_pattern.yml

fix: apply suggestions from code review

2023-02-22 11:05:50 +01:00

proc_creation_win_msiexec_dll.yml

Update proc_creation_win_msiexec_dll.yml

2023-02-22 06:34:02 +01:00

proc_creation_win_msiexec_embedding.yml

…

proc_creation_win_msiexec_execute_dll.yml

fix: syntax error, additional comma

2022-12-08 17:34:56 +01:00

proc_creation_win_msiexec_install_quiet.yml

feat: new rules, updates and fp fixes (#4136 )

2023-04-03 12:06:14 +02:00

proc_creation_win_msiexec_install_remote.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_msiexec_masquerading.yml

fix: apply suggestions from 2nd code review

2023-02-22 12:15:49 +01:00

proc_creation_win_msiexec_web_install.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_msra_process_injection.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_mssql_sqlps_susp_execution.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_mssql_sqltoolsps_susp_execution.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_mssql_susp_child_process.yml

fix: apply suggestions from code review

2023-05-09 16:04:24 +02:00

proc_creation_win_mssql_veaam_susp_child_processes.yml

fix: apply suggestions from code review

2023-05-09 16:04:24 +02:00

proc_creation_win_mstsc_rdp_hijack_shadowing.yml

feat: more fixes and updates

2023-02-05 21:46:22 +01:00

proc_creation_win_mstsc_remote_connection.yml

feat: update multiple rules

2023-04-18 18:08:08 +02:00

proc_creation_win_mstsc_run_local_rdp_file_susp_location.yml

fix: delete value-modifier in Search-Identifier (#4210 )

2023-04-30 21:54:24 +02:00

proc_creation_win_mstsc_run_local_rdp_file.yml

fix: delete value-modifier in Search-Identifier (#4210 )

2023-04-30 21:54:24 +02:00

proc_creation_win_mstsc_run_local_rpd_file_susp_parent.yml

feat: add rules related to rogue rdp

2023-04-18 22:13:30 +02:00

proc_creation_win_net_default_accounts_manipulation.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_net_groups_and_accounts_recon.yml

chore: renames with new sigma convention

2023-03-03 00:21:25 +01:00

proc_creation_win_net_network_connections_discovery.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_net_share_and_sessions_enum.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_net_share_unmount.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_net_start_service.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_net_stop_service.yml

fix: apply suggestions from code review

2023-03-07 17:07:12 +01:00

proc_creation_win_net_susp_execution.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_net_use_mount_admin_share.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_net_use_mount_internet_share.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_net_use_mount_share.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_net_use_password_plaintext.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_net_user_add_never_expire.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_net_user_add.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_netsh_fw_add_rule.yml

fix: apply suggestions from code review

2023-02-16 10:46:29 +01:00

proc_creation_win_netsh_fw_allow_program_in_susp_location.yml

fix: apply suggestions from code review

2023-02-16 10:46:29 +01:00

proc_creation_win_netsh_fw_allow_rdp.yml

fix: apply suggestions from code review

2023-02-16 10:46:29 +01:00

proc_creation_win_netsh_fw_delete_rule.yml

feat: updates and enhancements

2023-02-14 00:51:20 +01:00

proc_creation_win_netsh_fw_disable.yml

feat: updates and enhancements

2023-02-14 00:51:20 +01:00

proc_creation_win_netsh_fw_enable_group_rule.yml

fix: add missing modified date

2023-02-14 01:11:42 +01:00

proc_creation_win_netsh_fw_rules_discovery.yml

fix: add missing modified date

2023-02-14 01:11:42 +01:00

proc_creation_win_netsh_helper_dll_persistence.yml

fix: apply suggestions from code review

2023-02-16 10:46:29 +01:00

proc_creation_win_netsh_packet_capture.yml

feat: updates and enhancements

2023-02-14 00:51:20 +01:00

proc_creation_win_netsh_port_forwarding_3389.yml

fix: apply suggestions from code review

2023-02-16 10:46:29 +01:00

proc_creation_win_netsh_port_forwarding.yml

fix: minor

2023-04-20 12:11:22 +02:00

proc_creation_win_netsh_wifi_credential_harvesting.yml

feat: updates and enhancements

2023-02-14 00:51:20 +01:00

proc_creation_win_network_sniffing.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_nltest_execution.yml

fix: remove typo dash

2023-02-03 20:20:31 +01:00

proc_creation_win_nltest_recon.yml

fix: add missing modified and small fixes to selections

2023-02-04 11:44:33 +01:00

proc_creation_win_node_abuse.yml

fix: typos in multiple rules (#4011 )

2023-02-06 13:53:23 +01:00

proc_creation_win_node_adobe_creative_cloud_abuse.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_nslookup_domain_discovery.yml

chore: renames with new sigma convention

2023-03-03 00:21:25 +01:00

proc_creation_win_nslookup_poweshell_download.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_ntdsutil_susp_usage.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_ntdsutil_usage.yml

…

proc_creation_win_odbcconf_driver_install_susp.yml

feat: add/update rules related to odbcconf (#4228 )

2023-05-23 14:08:56 +02:00

proc_creation_win_odbcconf_driver_install.yml

feat: add/update rules related to odbcconf (#4228 )

2023-05-23 14:08:56 +02:00

proc_creation_win_odbcconf_exec_susp_locations.yml

feat: update more regsvr32

2023-05-26 15:59:30 +02:00

proc_creation_win_odbcconf_register_dll_regsvr_susp.yml

feat: add/update rules related to odbcconf (#4228 )

2023-05-23 14:08:56 +02:00

proc_creation_win_odbcconf_register_dll_regsvr.yml

feat: add/update rules related to odbcconf (#4228 )

2023-05-23 14:08:56 +02:00

proc_creation_win_odbcconf_response_file_susp.yml

feat: rule and tests update

2023-05-31 13:46:13 +02:00

proc_creation_win_odbcconf_response_file.yml

feat: add/update rules related to odbcconf (#4228 )

2023-05-23 14:08:56 +02:00

proc_creation_win_odbcconf_uncommon_child_process.yml

feat: add/update rules related to odbcconf (#4228 )

2023-05-23 14:08:56 +02:00

proc_creation_win_office_arbitrary_cli_download.yml

feat: rule updates

2023-04-12 02:57:44 +02:00

proc_creation_win_office_onenote_susp_child_processes.yml

fix: apply suggestions from code review

2023-02-10 10:38:45 +01:00

proc_creation_win_office_outlook_enable_unsafe_client_mail_rules.yml

fix: duplicate titles

2023-02-09 16:06:09 +01:00

proc_creation_win_office_outlook_execution_from_temp.yml

chore: renames with new sigma convention

2023-03-03 00:21:25 +01:00

proc_creation_win_office_outlook_susp_child_processes_remote.yml

fix: apply suggestions from code review

2023-02-10 10:38:45 +01:00

proc_creation_win_office_outlook_susp_child_processes.yml

fix: resolves #4014

2023-02-09 15:48:13 +01:00

proc_creation_win_office_spawn_exe_from_users_directory.yml

fix: multiple typos

2023-02-06 12:28:45 +01:00

proc_creation_win_office_susp_child_processes.yml

feat: small updates

2023-04-24 23:23:38 +02:00

proc_creation_win_office_svchost_parent.yml

fix: multiple typos

2023-02-06 12:28:45 +01:00

proc_creation_win_office_winword_dll_load.yml

feat: new rules, updates and fp fixes (#4136 )

2023-04-03 12:06:14 +02:00

proc_creation_win_pdqdeploy_execution.yml

feat: additional updates and fixes

2023-02-04 21:06:47 +01:00

proc_creation_win_pdqdeploy_runner_susp_children.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_perl_inline_command_execution.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_php_inline_command_execution.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_ping_hex_ip.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_plink_port_forwarding.yml

feat: more fixes and updates

2023-02-05 21:46:22 +01:00

proc_creation_win_plink_susp_tunneling.yml

feat: more fixes and updates

2023-02-05 21:46:22 +01:00

proc_creation_win_powercfg_execution.yml

chore: renames with new sigma convention

2023-03-03 00:21:25 +01:00

proc_creation_win_powershell_aadinternals_cmdlets_execution.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_powershell_active_directory_module_dll_import.yml

feat: update pwsh ad module rules

2023-01-22 20:07:42 +01:00

proc_creation_win_powershell_add_windows_capability.yml

feat: new rules, updates and goofy guineapig stuff (#4229 )

2023-05-15 15:53:39 +02:00

proc_creation_win_powershell_amsi_init_failed_bypass.yml

fix: add missing modified and small fixes to selections

2023-02-04 11:44:33 +01:00

proc_creation_win_powershell_amsi_null_bits_bypass.yml

feat: new rules, updates and goofy guineapig stuff (#4229 )

2023-05-15 15:53:39 +02:00

proc_creation_win_powershell_audio_capture.yml

feat: new rules, updates and fp fixes (#4162 )

2023-04-11 13:04:22 +02:00

proc_creation_win_powershell_base64_encoded_cmd.yml

feat: new rules, updates and fp fixes (#4162 )

2023-04-11 13:04:22 +02:00

proc_creation_win_powershell_base64_frombase64string.yml

feat: new rules, updates and fp fixes (#4162 )

2023-04-11 13:04:22 +02:00

proc_creation_win_powershell_base64_iex.yml

feat: new rules, updates and fp fixes (#4162 )

2023-04-11 13:04:22 +02:00

proc_creation_win_powershell_base64_invoke.yml

feat: new rules, updates and fp fixes (#4162 )

2023-04-11 13:04:22 +02:00

proc_creation_win_powershell_base64_mppreference.yml

feat: new rules, updates and fp fixes (#4162 )

2023-04-11 13:04:22 +02:00

proc_creation_win_powershell_base64_reflection_assembly_load_obfusc.yml

feat: new rules, updates and fp fixes (#4162 )

2023-04-11 13:04:22 +02:00

proc_creation_win_powershell_base64_reflection_assembly_load.yml

feat: new rules, updates and fp fixes (#4162 )

2023-04-11 13:04:22 +02:00

proc_creation_win_powershell_base64_wmi_classes.yml

feat: new rules, updates and fp fixes (#4162 )

2023-04-11 13:04:22 +02:00

proc_creation_win_powershell_cmdline_convertto_securestring.yml

feat: more updates

2023-02-02 00:24:35 +01:00

proc_creation_win_powershell_cmdline_reversed_strings.yml

feat: fix issues and fp filters

2023-05-31 17:10:24 +02:00

proc_creation_win_powershell_cmdline_special_characters.yml

feat: new rules, updates and fp fixes (#4162 )

2023-04-11 13:04:22 +02:00

proc_creation_win_powershell_computer_discovery_get_adcomputer.yml

feat: updates and enhancements

2023-02-14 00:51:20 +01:00

proc_creation_win_powershell_create_service.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_powershell_decode_gzip.yml

feat: new rules related to ZScaler blog - OneNote: A Growing Threat for Malware Distribution (#4111 )

2023-03-17 13:00:57 +01:00

proc_creation_win_powershell_defender_disable_feature.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_powershell_defender_exclusion.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_powershell_disable_defender_av_security_monitoring.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_powershell_disable_firewall.yml

feat: updates and enhancements

2023-02-14 00:51:20 +01:00

proc_creation_win_powershell_disable_ie_features.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_powershell_dll_execution.yml

feat: updates and fixes

2023-01-26 22:42:56 +01:00

proc_creation_win_powershell_downgrade_attack.yml

feat: updates and enhancements

2023-01-04 17:49:32 +01:00

proc_creation_win_powershell_download_com_cradles.yml

feat: more updates

2023-02-08 22:08:47 +01:00

proc_creation_win_powershell_download_cradles.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_powershell_download_dll.yml

feat: new rules related to ZScaler blog - OneNote: A Growing Threat for Malware Distribution (#4111 )

2023-03-17 13:00:57 +01:00

proc_creation_win_powershell_download_iex.yml

fix: apply suggestions from code review

2023-05-09 16:04:24 +02:00

proc_creation_win_powershell_download_patterns.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_powershell_email_exfil.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_powershell_enable_susp_windows_optional_feature.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_powershell_encode.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_powershell_encoded_cmd_patterns.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_powershell_encoded_obfusc.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_powershell_encoding_patterns.yml

feat: updates and fixes

2023-01-26 22:42:56 +01:00

proc_creation_win_powershell_exec_data_file.yml

feat: more updates

2023-02-08 22:08:47 +01:00

proc_creation_win_powershell_export_certificate.yml

feat: update metadata and add process creation version

2023-05-18 23:45:48 +02:00

proc_creation_win_powershell_frombase64string_archive.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_powershell_frombase64string.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_powershell_get_clipboard.yml

fix: resolves #4015

2023-02-07 14:33:56 +01:00

proc_creation_win_powershell_get_localgroup_member_recon.yml

feat: updates and enhancements

2023-02-14 00:51:20 +01:00

proc_creation_win_powershell_getprocess_lsass.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_powershell_hidden_b64_cmd.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_powershell_hide_services_via_set_service.yml

feat: more rules updates

2023-02-14 19:30:18 +01:00

proc_creation_win_powershell_iex_patterns.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_powershell_import_cert_susp_locations.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_powershell_import_module_susp_dirs.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_powershell_install_unsigned_appx_packages.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_powershell_invocation_specific.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_powershell_invoke_webrequest_direct_ip.yml

fix: minor

2023-04-24 09:10:47 +02:00

proc_creation_win_powershell_invoke_webrequest_download.yml

feat: add iwr related rules

2023-04-23 15:42:02 +02:00

proc_creation_win_powershell_mailboxexport_share.yml

feat: multiple updates and fixes

2023-02-03 02:22:28 +01:00

proc_creation_win_powershell_malicious_cmdlets.yml

chore: order list

2023-04-21 11:14:55 +02:00

proc_creation_win_powershell_msexchange_transport_agent.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_powershell_non_interactive_execution.yml

feat: new rules, updates and goofy guineapig stuff (#4229 )

2023-05-15 15:53:39 +02:00

proc_creation_win_powershell_obfuscation_via_utf8.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_powershell_public_folder.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_powershell_remotefxvgpudisablement_abuse.yml

feat: new rules, updates and goofy guineapig stuff (#4229 )

2023-05-15 15:53:39 +02:00

proc_creation_win_powershell_reverse_shell_connection.yml

feat: new rules, updates and fp fixes (#4162 )

2023-04-11 13:04:22 +02:00

proc_creation_win_powershell_run_script_from_ads.yml

feat: more updates

2023-02-03 19:03:51 +01:00

proc_creation_win_powershell_run_script_from_input_stream.yml

feat: more updates

2023-02-03 19:03:51 +01:00

proc_creation_win_powershell_sam_access.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_powershell_script_engine_parent.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_powershell_service_dacl_modification_set_service.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_powershell_set_policies_to_unsecure_level.yml

chore: renames with new sigma convention

2023-03-03 00:21:25 +01:00

proc_creation_win_powershell_set_service_disabled.yml

fix: apply suggestions from code review

2023-03-07 17:07:12 +01:00

proc_creation_win_powershell_shadowcopy_deletion.yml

chore: renames with new sigma convention

2023-03-03 00:21:25 +01:00

proc_creation_win_powershell_snapins_hafnium.yml

fix: FPs found in testing environment

2023-03-24 10:41:21 +01:00

proc_creation_win_powershell_stop_service.yml

fix: apply suggestions from code review

2023-03-07 17:07:12 +01:00

proc_creation_win_powershell_susp_child_processes.yml

feat: apply suggestions from code review

2023-06-05 10:54:18 +02:00

proc_creation_win_powershell_susp_download_patterns.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_powershell_susp_parameter_variation.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_powershell_susp_parent_process.yml

fix: typos in multiple rules (#4011 )

2023-02-06 13:53:23 +01:00

proc_creation_win_powershell_susp_ps_appdata.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_powershell_susp_ps_downloadfile.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_powershell_tamper_defender_remove_mppreference.yml

feat: rename rules for conventions

2023-02-24 19:33:24 +01:00

proc_creation_win_powershell_token_obfuscation.yml

fix regex escape

2022-12-30 00:11:52 +09:00

proc_creation_win_powershell_user_discovery_get_aduser.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_powershell_webclient_casing.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_powershell_x509enrollment.yml

feat: more rules updates

2023-02-14 19:30:18 +01:00

proc_creation_win_powershell_xor_commandline.yml

feat: multiple updates and enhancements

2023-01-30 20:02:45 +01:00

proc_creation_win_powershell_zip_compress.yml

chore: renames with new sigma convention

2023-03-03 00:21:25 +01:00

proc_creation_win_pressanykey_lolbin_execution.yml

fix: typos

2023-04-14 11:54:04 +02:00

proc_creation_win_print_remote_file_copy.yml

chore: renames with new sigma convention

2023-03-03 00:21:25 +01:00

proc_creation_win_psr_capture_screenshots.yml

chore: renames with new sigma convention

2023-03-03 00:21:25 +01:00

proc_creation_win_pua_3proxy_execution.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_pua_adfind_enumeration.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_pua_adfind_susp_usage.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_pua_advanced_ip_scanner.yml

feat: updates and enhancements

2023-02-14 00:51:20 +01:00

proc_creation_win_pua_advanced_port_scanner.yml

feat: updates and enhancements

2023-02-14 00:51:20 +01:00

proc_creation_win_pua_advancedrun_priv_user.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_pua_advancedrun.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_pua_chisel.yml

feat: updates and enhancements

2023-02-14 00:51:20 +01:00

proc_creation_win_pua_cleanwipe.yml

fix: add missing modified date

2023-02-14 01:11:42 +01:00

proc_creation_win_pua_crassus.yml

feat: update pr related hktl rules

2023-04-21 11:06:03 +02:00

proc_creation_win_pua_csexec.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_pua_defendercheck.yml

feat: additional updates and fixes

2023-02-04 21:06:47 +01:00

proc_creation_win_pua_ditsnap.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_pua_frp.yml

feat: additional updates and fixes

2023-02-04 21:06:47 +01:00

proc_creation_win_pua_iox.yml

feat: more updates

2023-02-08 22:08:47 +01:00

proc_creation_win_pua_mouselock_execution.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_pua_netcat.yml

fix: add missing modified

2023-02-08 22:10:05 +01:00

proc_creation_win_pua_ngrok.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_pua_nimgrab.yml

feat: updates and enhancements

2023-02-14 00:51:20 +01:00

proc_creation_win_pua_nircmd_as_system.yml

feat: updates and enhancements

2023-02-14 00:51:20 +01:00

proc_creation_win_pua_nircmd.yml

feat: updates and enhancements

2023-02-14 00:51:20 +01:00

proc_creation_win_pua_nmap_zenmap.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_pua_nps.yml

fix: multiple typos

2023-02-06 12:28:45 +01:00

proc_creation_win_pua_nsudo.yml

feat: updates and enhancements

2023-02-14 00:51:20 +01:00

proc_creation_win_pua_process_hacker.yml

feat: new rules, updates and goofy guineapig stuff (#4229 )

2023-05-15 15:53:39 +02:00

proc_creation_win_pua_radmin.yml

feat: updates and enhancements

2023-02-14 00:51:20 +01:00

proc_creation_win_pua_rcedit_execution.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_pua_rclone_execution.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_pua_runxcmd.yml

fix: apply suggestions from code review

2023-02-14 13:24:09 +01:00

proc_creation_win_pua_seatbelt.yml

feat: additional updates and fixes

2023-02-04 21:06:47 +01:00

proc_creation_win_pua_system_informer.yml

feat: new rules, updates and goofy guineapig stuff (#4229 )

2023-05-15 15:53:39 +02:00

proc_creation_win_pua_webbrowserpassview.yml

fix: yaml error in description

2023-02-16 11:15:06 +01:00

proc_creation_win_pua_wsudo_susp_execution.yml

feat: updates and enhancements

2023-02-14 00:51:20 +01:00

proc_creation_win_python_adidnsdump.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_python_inline_command_execution.yml

fix: add missing modified

2023-02-17 22:52:09 +01:00

proc_creation_win_python_pty_spawn.yml

Update rules/windows/process_creation/proc_creation_win_python_pty_spawn.yml

2023-02-04 11:08:46 +05:00

proc_creation_win_query_session_exfil.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_rar_compress_data.yml

fix: multiple typos

2023-02-06 12:28:45 +01:00

proc_creation_win_rar_compression_with_password.yml

chore: renames with new sigma convention

2023-03-03 00:21:25 +01:00

proc_creation_win_rar_susp_greedy_compression.yml

chore: author update

2023-04-12 16:11:58 +02:00

proc_creation_win_rasdial_execution.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_rdrleakdiag_process_dumping.yml

fix: merge rules and update detection

2023-04-24 19:24:19 +02:00

proc_creation_win_reg_add_run_key.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_reg_add_safeboot.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_reg_bitlocker.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_reg_credential_access_via_password_filter.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_reg_defender_exclusion.yml

fix: typos

2023-02-09 13:09:46 +01:00

proc_creation_win_reg_delete_safeboot.yml

feat: additional updates and fixes

2023-02-04 21:06:47 +01:00

proc_creation_win_reg_delete_services.yml

feat: additional updates and fixes

2023-02-04 21:06:47 +01:00

proc_creation_win_reg_direct_asep_registry_keys_modification.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_reg_disable_sec_services.yml

fix: wording

2023-06-05 13:09:30 +02:00

proc_creation_win_reg_dumping_sensitive_hives.yml

feat: update and enhancements

2023-02-07 13:55:14 +01:00

proc_creation_win_reg_enumeration_for_credentials_in_registry.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_reg_import_from_suspicious_paths.yml

feat: more fixes and updates

2023-02-05 21:46:22 +01:00

proc_creation_win_reg_lsa_disable_restricted_admin.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_reg_lsa_ppl_protection_disabled.yml

Fix detection

2023-03-26 16:55:09 +02:00

proc_creation_win_reg_machineguid.yml

chore: renames with new sigma convention

2023-03-03 00:21:25 +01:00

proc_creation_win_reg_modify_group_policy_settings.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_reg_open_command.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_reg_query_registry.yml

fix: multiple typos

2023-02-06 12:28:45 +01:00

proc_creation_win_reg_rdp_keys_tamper.yml

fix: multiple typos

2023-02-06 12:28:45 +01:00

proc_creation_win_reg_screensaver.yml

chore: renames with new sigma convention

2023-03-03 00:21:25 +01:00

proc_creation_win_reg_service_imagepath_change.yml

fix: multiple typos

2023-02-06 12:28:45 +01:00

proc_creation_win_reg_software_discovery.yml

chore: renames with new sigma convention

2023-03-03 00:21:25 +01:00

proc_creation_win_reg_susp_paths.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_reg_volsnap_disable.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_reg_windows_defender_tamper.yml

fix: wording

2023-06-05 13:09:30 +02:00

proc_creation_win_reg_write_protect_for_storage_disabled.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_regedit_export_critical_keys.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_regedit_export_keys.yml

fix: condition

2023-02-03 15:56:19 +05:00

proc_creation_win_regedit_import_keys_ads.yml

Update rules/windows/process_creation/proc_creation_win_regedit_import_keys_ads.yml

2023-02-03 19:12:36 +05:00

proc_creation_win_regedit_import_keys.yml

Update proc_creation_win_regedit_import_keys.yml

2023-02-03 15:54:59 +05:00

proc_creation_win_regedit_trustedinstaller.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_regini_ads.yml

feat: more updates

2023-02-08 22:08:47 +01:00

proc_creation_win_regini_execution.yml

feat: more updates

2023-02-08 22:08:47 +01:00

proc_creation_win_registry_cimprovider_dll_load.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_registry_enumeration_for_credentials_cli.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_registry_install_reg_debugger_backdoor.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_registry_logon_script.yml

feat: update logon script rules

2023-06-09 12:09:35 +02:00

proc_creation_win_registry_new_network_provider.yml

chore: renames with new sigma convention

2023-03-03 00:21:25 +01:00

proc_creation_win_registry_privilege_escalation_via_service_key.yml

fix: shorten filenames

2023-03-06 00:55:03 +01:00

proc_creation_win_registry_set_unsecure_powershell_policy.yml

chore: renames with new sigma convention

2023-03-03 00:21:25 +01:00

proc_creation_win_registry_typed_paths_persistence.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_regsvr32_flags_anomaly.yml

feat: update more regsvr32

2023-05-26 15:59:30 +02:00

proc_creation_win_regsvr32_http_ip_pattern.yml

feat: update more regsvr32

2023-05-26 15:59:30 +02:00

proc_creation_win_regsvr32_network_pattern.yml

feat: update more regsvr32

2023-05-26 15:59:30 +02:00

proc_creation_win_regsvr32_remote_share.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_regsvr32_susp_child_process.yml

fix: issue to pass the tests

2023-05-26 16:10:46 +02:00

proc_creation_win_regsvr32_susp_exec_path_1.yml

feat: apply suggestions from code review

2023-05-30 11:17:52 +02:00

proc_creation_win_regsvr32_susp_exec_path_2.yml

Update proc_creation_win_regsvr32_susp_exec_path_2.yml

2023-05-26 18:37:52 +02:00

proc_creation_win_regsvr32_susp_extensions.yml

feat: update more regsvr32

2023-05-26 15:59:30 +02:00

proc_creation_win_regsvr32_susp_parent.yml

feat: apply suggestions from code review

2023-05-30 11:17:52 +02:00

proc_creation_win_regsvr32_uncommon_extension.yml

feat: apply suggestions from code review

2023-05-30 11:17:52 +02:00

proc_creation_win_remote_access_software_ultraviewer.yml

feat: update and fixes

2023-03-09 22:10:42 +01:00

proc_creation_win_remote_access_tools_anydesk_piped_password_via_cli.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_remote_access_tools_anydesk_silent_install.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_remote_access_tools_anydesk_susp_exec.yml

fix: shorten filenames

2023-03-06 00:55:03 +01:00

proc_creation_win_remote_access_tools_anydesk.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_remote_access_tools_gotoopener.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_remote_access_tools_logmein.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_remote_access_tools_netsupport_susp_exec.yml

fix: shorten filenames

2023-03-06 00:55:03 +01:00

proc_creation_win_remote_access_tools_netsupport.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_remote_access_tools_rurat_non_default_location.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_remote_access_tools_screenconnect_access.yml

fix: shorten filenames

2023-03-06 00:55:03 +01:00

proc_creation_win_remote_access_tools_screenconnect_anomaly.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_remote_access_tools_screenconnect.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_remote_time_discovery.yml

…

proc_creation_win_renamed_adfind.yml

feat: updates and enhancements

2023-02-14 00:51:20 +01:00

proc_creation_win_renamed_autohotkey.yml

fix: add missing modified and new selection

2023-02-08 10:37:24 +01:00

proc_creation_win_renamed_autoit.yml

feat: add new rule "Renamed AutoIt Execution" (#4286 )

2023-06-05 10:53:42 +02:00

proc_creation_win_renamed_binary_highly_relevant.yml

Merge branch 'SigmaHQ:master' into nasbench-rule-devel

2023-03-01 19:10:50 +01:00

proc_creation_win_renamed_binary.yml

feat: rename rules for conventions

2023-02-24 19:33:24 +01:00

proc_creation_win_renamed_browsercore.yml

feat: more updates

2023-02-03 19:03:51 +01:00

proc_creation_win_renamed_createdump.yml

feat: updates and enhancements

2023-02-14 00:51:20 +01:00

proc_creation_win_renamed_dctask64.yml

feat: updates and enhancements

2023-02-14 00:51:20 +01:00

proc_creation_win_renamed_ftp.yml

feat: more updates

2023-02-07 17:12:26 +01:00

proc_creation_win_renamed_jusched.yml

fix: multiple typos

2023-02-06 12:28:45 +01:00

proc_creation_win_renamed_mavinject.yml

feat: more updates

2023-02-07 17:12:26 +01:00

proc_creation_win_renamed_megasync.yml

fix: multiple typos

2023-02-06 12:28:45 +01:00

proc_creation_win_renamed_msdt.yml

feat: more updates

2023-02-07 17:12:26 +01:00

proc_creation_win_renamed_netsupport_rat.yml

fix: multiple typos

2023-02-06 12:28:45 +01:00

proc_creation_win_renamed_office_processes.yml

feat: additional updates and fixes

2023-02-04 21:06:47 +01:00

proc_creation_win_renamed_paexec.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_renamed_plink.yml

feat: more updates

2023-02-03 19:03:51 +01:00

proc_creation_win_renamed_pressanykey.yml

fix: update filter

2023-04-14 12:00:22 +02:00

proc_creation_win_renamed_rundll32_dllregisterserver.yml

feat: more updates

2023-02-03 19:03:51 +01:00

proc_creation_win_renamed_rurat.yml

feat: more updates

2023-02-03 19:03:51 +01:00

proc_creation_win_renamed_sysinternals_debugview.yml

feat: rename rules for conventions

2023-02-24 19:33:24 +01:00

proc_creation_win_renamed_sysinternals_procdump.yml

feat: rename rules for conventions

2023-02-24 19:33:24 +01:00

proc_creation_win_renamed_sysinternals_psexec_service.yml

feat: more renames

2023-02-27 13:01:52 +01:00

proc_creation_win_renamed_sysinternals_sdelete.yml

feat: rename rules for conventions

2023-02-24 19:33:24 +01:00

proc_creation_win_renamed_vmnat.yml

fix: remove unnecessary filter

2023-02-06 12:36:41 +01:00

proc_creation_win_renamed_whoami.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_rpcping_credential_capture.yml

chore: renames with new sigma convention

2023-03-03 00:21:25 +01:00

proc_creation_win_ruby_inline_command_execution.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_rundll32_ads_stored_dll_execution.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_rundll32_advpack_obfuscated_ordinal_call.yml

feat: multiple updates and new rules (#4242 )

2023-05-17 17:21:59 +02:00

proc_creation_win_rundll32_by_ordinal.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_rundll32_executable_invalid_extension.yml

feat: update multiple rules

2023-04-18 18:08:08 +02:00

proc_creation_win_rundll32_inline_vbs.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_rundll32_js_runhtmlapplication.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_rundll32_keymgr.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_rundll32_mshtml_runhtmlapplication.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_rundll32_no_params.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_rundll32_ntlmrelay.yml

chore: renames with new sigma convention

2023-03-03 00:21:25 +01:00

proc_creation_win_rundll32_obfuscated_ordinal_call.yml

feat: multiple updates and new rules (#4242 )

2023-05-17 17:21:59 +02:00

proc_creation_win_rundll32_parent_explorer.yml

feat: add missing OriginalFileName field (#4026 )

2023-02-09 15:09:23 +01:00

proc_creation_win_rundll32_process_dump_via_comsvcs.yml

feat: multiple updates and new rules (#4242 )

2023-05-17 17:21:59 +02:00

proc_creation_win_rundll32_registered_com_objects.yml

feat: add missing OriginalFileName field (#4026 )

2023-02-09 15:09:23 +01:00

proc_creation_win_rundll32_run_locations.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_rundll32_script_run.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_rundll32_setupapi_installhinfsection.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_rundll32_shell32_susp_execution.yml

chore: renames with new sigma convention

2023-03-03 00:21:25 +01:00

proc_creation_win_rundll32_spawn_explorer.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_rundll32_susp_activity.yml

feat: multiple updates and new rules (#4242 )

2023-05-17 17:21:59 +02:00

proc_creation_win_rundll32_susp_control_dll_load.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_rundll32_susp_execution_with_image_extension.yml

feat: new rules related to ZScaler blog - OneNote: A Growing Threat for Malware Distribution (#4111 )

2023-03-17 13:00:57 +01:00

proc_creation_win_rundll32_susp_shellexec_execution.yml

chore: renames with new sigma convention

2023-03-03 00:21:25 +01:00

proc_creation_win_rundll32_susp_shimcache_flush.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_rundll32_sys.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_rundll32_unc_path.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_rundll32_user32_dll.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_rundll32_webdav_client_execution.yml

Update proc_creation_win_rundll32_webdav_client_execution.yml

2023-03-16 19:23:05 +01:00

proc_creation_win_rundll32_webdav_client_susp_execution.yml

feat: new rules, updates and fp fixes (#4162 )

2023-04-11 13:04:22 +02:00

proc_creation_win_rundll32_without_parameters.yml

feat: add new rules related to CVE-2023-23397

2023-03-16 19:17:48 +01:00

proc_creation_win_runonce_execution.yml

chore: renames with new sigma convention

2023-03-03 00:21:25 +01:00

proc_creation_win_sc_change_sevice_image_path_by_non_admin.yml

feat: more rules updates

2023-02-14 19:30:18 +01:00

proc_creation_win_sc_create_service.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_sc_disable_service.yml

fix: apply suggestions from code review

2023-03-07 17:07:12 +01:00

proc_creation_win_sc_new_kernel_driver.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_sc_query.yml

feat: more updates and fixes

2023-02-28 15:22:25 +01:00

proc_creation_win_sc_sdset_allow_service_changes.yml

fix: apply typo fix suggestions from code review

2023-02-28 16:55:40 +01:00

proc_creation_win_sc_sdset_deny_service_access.yml

fix: apply typo fix suggestions from code review

2023-02-28 16:55:40 +01:00

proc_creation_win_sc_sdset_hide_sevices.yml

fix: issues with CICD

2023-02-28 15:59:13 +01:00

proc_creation_win_sc_sdset_modification.yml

fix: apply typo fix suggestions from code review

2023-02-28 16:55:40 +01:00

proc_creation_win_sc_service_path_modification.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_sc_service_tamper_for_persistence.yml

fix: multiple typos

2023-02-06 12:28:45 +01:00

proc_creation_win_sc_stop_service.yml

fix: apply suggestions from code review

2023-03-07 17:07:12 +01:00

proc_creation_win_schtasks_appdata_local_system.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_schtasks_change.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_schtasks_creation_temp_folder.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_schtasks_creation.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_schtasks_delete_all.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_schtasks_delete.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_schtasks_disable.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_schtasks_env_folder.yml

fix: fp found in testing

2023-03-14 23:58:04 +01:00

proc_creation_win_schtasks_folder_combos.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_schtasks_guid_task_name.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_schtasks_one_time_only_midnight_task.yml

feat: multiple updates and fixes

2023-02-03 02:22:28 +01:00

proc_creation_win_schtasks_parent.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_schtasks_persistence_windows_telemetry.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_schtasks_powershell_persistence.yml

feat: more updates

2023-02-03 19:03:51 +01:00

proc_creation_win_schtasks_reg_loader.yml

fix: add missing modified and small fixes to selections

2023-02-04 11:44:33 +01:00

proc_creation_win_schtasks_schedule_type_system.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_schtasks_schedule_type.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_schtasks_schedule_via_masqueraded_xml_file.yml

fix: update structure and metadata

2023-04-21 11:38:13 +02:00

proc_creation_win_schtasks_susp_pattern.yml

feat: multiple updates and new rules (#4242 )

2023-05-17 17:21:59 +02:00

proc_creation_win_schtasks_system.yml

fix: broken condition

2023-03-15 00:06:29 +01:00

proc_creation_win_scrcons_susp_child_process.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_sdbinst_shim_persistence.yml

…

proc_creation_win_sdclt_child_process.yml

fix: resolves #4015

2023-02-07 14:33:56 +01:00

proc_creation_win_sdiagnhost_susp_child.yml

…

proc_creation_win_secedit_execution.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_servu_susp_child_process.yml

chore: renames with new sigma convention

2023-03-03 00:21:25 +01:00

proc_creation_win_setspn_spn_enumeration.yml

fix: apply suggestions from code review

2023-02-16 10:46:29 +01:00

proc_creation_win_shutdown_execution.yml

chore: renames with new sigma convention

2023-03-03 00:21:25 +01:00

proc_creation_win_shutdown_logoff.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_sndvol_susp_child_processes.yml

chore: update description

2023-06-12 10:15:23 +02:00

proc_creation_win_soundrecorder_audio_capture.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_splwow64_cli_anomaly.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_spoolsv_susp_child_processes.yml

chore: renames with new sigma convention

2023-03-03 00:21:25 +01:00

proc_creation_win_sqlcmd_veeam_db_recon.yml

fix: apply suggestions from code review

2023-05-09 16:04:24 +02:00

proc_creation_win_sqlcmd_veeam_dump.yml

feat: updates and enhancements

2023-02-14 00:51:20 +01:00

proc_creation_win_sqlite_chromium_profile_data.yml

fix: update description

2023-01-20 09:51:26 +01:00

proc_creation_win_sqlite_firefox_gecko_profile_data.yml

Update proc_creation_win_sqlite_firefox_gecko_profile_data.yml

2023-01-20 09:57:09 +01:00

proc_creation_win_ssh_port_forward.yml

fix: resolves #4005

2023-02-03 19:15:26 +01:00

proc_creation_win_ssh_rdp_tunneling.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_stordiag_susp_child_process.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_susp_16bit_application.yml

…

proc_creation_win_susp_abusing_debug_privilege.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_susp_add_user_local_admin_group.yml

chore: renames with new sigma convention

2023-03-03 00:21:25 +01:00

proc_creation_win_susp_add_user_remote_desktop_group.yml

chore: renames with new sigma convention

2023-03-03 00:21:25 +01:00

proc_creation_win_susp_alternate_data_streams.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_susp_always_install_elevated_windows_installer.yml

feat: new rules, updates and fp fixes (#4136 )

2023-04-03 12:06:14 +02:00

proc_creation_win_susp_appx_execution.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_susp_arbitrary_shell_execution_via_settingcontent.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_susp_archiver_iso_phishing.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_susp_automated_collection.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_susp_bad_opsec_sacrificial_processes.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_susp_calc.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_susp_child_process_as_system_.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_susp_cli_obfuscation_escape_char.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_susp_cli_obfuscation_unicode.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_susp_commandline_path_traversal_evasion.yml

feat: new rules, updates and fp fixes (#4136 )

2023-04-03 12:06:14 +02:00

proc_creation_win_susp_compression_params.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_susp_copy_browser_data.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_susp_copy_lateral_movement.yml

fix: add missing modified and small fixes to selections

2023-02-04 11:44:33 +01:00

proc_creation_win_susp_copy_system32.yml

feat: more updates

2023-02-02 00:24:35 +01:00

proc_creation_win_susp_crypto_mining_monero.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_susp_data_exfiltration_via_cli.yml

feat: more updates

2023-02-07 17:12:26 +01:00

proc_creation_win_susp_disable_raccine.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_susp_double_extension_parent.yml

fix: update modifiers

2023-02-28 18:27:41 +01:00

proc_creation_win_susp_double_extension.yml

fix: update modifiers

2023-02-28 18:27:41 +01:00

proc_creation_win_susp_download_office_domain.yml

feat: more updates and fixes

2023-02-28 15:22:25 +01:00

proc_creation_win_susp_dumpstack_log_evasion.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_susp_elavated_msi_spawned_shell.yml

fix: shorten filenames

2023-03-06 00:55:03 +01:00

proc_creation_win_susp_electron_app_children.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_susp_elevated_system_shell.yml

fix: FPs found in different environments

2023-04-20 09:48:47 +02:00

proc_creation_win_susp_embed_exe_lnk.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_susp_etw_modification_cmdline.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_susp_etw_trace_evasion.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_susp_eventlog_clear.yml

feat: fix issues and fp filters

2023-05-31 17:10:24 +02:00

proc_creation_win_susp_execution_from_guid_folder_names.yml

fix: apply suggestions from code review

2023-03-07 17:07:12 +01:00

proc_creation_win_susp_execution_from_public_folder_as_parent.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_susp_execution_path_webserver.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_susp_execution_path.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_susp_file_characteristics.yml

…

proc_creation_win_susp_file_permission_modifications.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_susp_gather_network_info_execution.yml

fix: remove duplicate title

2023-02-08 20:04:46 +01:00

proc_creation_win_susp_hiding_malware_in_fonts_folder.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_susp_image_missing.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_susp_inline_base64_mz_header.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_susp_inline_win_api_access.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_susp_local_system_owner_account_discovery.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_susp_lolbin_non_c_drive.yml

feat: update cmd based rules

2023-03-07 14:13:57 +01:00

proc_creation_win_susp_lsass_clone.yml

chore: renames with new sigma convention

2023-03-03 00:21:25 +01:00

proc_creation_win_susp_lsass_dump.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_susp_manageengine_pattern.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_susp_network_command.yml

…

proc_creation_win_susp_network_scan_loop.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_susp_non_exe_image.yml

fix: exclude files that are marked for deletion

2023-06-07 10:24:51 +02:00

proc_creation_win_susp_non_priv_reg_or_ps.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_susp_ntds.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_susp_ntfs_short_name_path_use_cli.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_susp_ntfs_short_name_path_use_image.yml

fix: fp found in testing

2023-03-21 16:32:46 +01:00

proc_creation_win_susp_ntfs_short_name_use_cli.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_susp_ntfs_short_name_use_image.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_susp_obfuscated_ip_download.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_susp_obfuscated_ip_via_cli.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_susp_office_token_search.yml

chore: renames with new sigma convention

2023-03-03 00:21:25 +01:00

proc_creation_win_susp_parents.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_susp_priv_escalation_via_named_pipe.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_susp_private_keys_recon.yml

feat: update author and selection

2023-05-05 18:25:07 +02:00

proc_creation_win_susp_privilege_escalation_cli_patterns.yml

fix: shorten filenames

2023-03-06 00:55:03 +01:00

proc_creation_win_susp_proc_wrong_parent.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_susp_progname.yml

Merge branch 'master' into rule-devel

2023-05-05 10:10:24 +02:00

proc_creation_win_susp_recon.yml

feat: logic update to multiple rules

2023-01-19 16:37:10 +01:00

proc_creation_win_susp_redirect_local_admin_share.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_susp_remote_desktop_tunneling.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_susp_right_to_left_override.yml

fix: add missing space

2023-02-16 01:40:01 +01:00

proc_creation_win_susp_script_exec_from_env_folder.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_susp_script_exec_from_temp.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_susp_service_creation.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_susp_service_dir.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_susp_service_tamper.yml

fix: apply suggestions from code review

2023-03-07 17:07:12 +01:00

proc_creation_win_susp_shadow_copies_creation.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_susp_shadow_copies_deletion.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_susp_shell_spawn_susp_program.yml

fix: FPs in testing environment

2023-05-23 12:24:01 +02:00

proc_creation_win_susp_sysnative.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_susp_system_exe_anomaly.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_susp_system_user_anomaly.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_susp_sysvol_access.yml

…

proc_creation_win_susp_task_folder_evasion.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_susp_use_of_te_bin.yml

…

proc_creation_win_susp_use_of_vsjitdebugger_bin.yml

…

proc_creation_win_susp_userinit_child.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_susp_weak_or_abused_passwords.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_susp_web_request_cmd_and_cmdlets.yml

feat: new rules, updates and goofy guineapig stuff (#4229 )

2023-05-15 15:53:39 +02:00

proc_creation_win_susp_whoami_as_param.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_susp_workfolders.yml

feat: updates and enhancements

2023-02-14 00:51:20 +01:00

proc_creation_win_svchost_execution_with_no_cli_flags.yml

chore: renames with new sigma convention

2023-03-03 00:21:25 +01:00

proc_creation_win_svchost_susp_parent_process.yml

chore: renames with new sigma convention

2023-03-03 00:21:25 +01:00

proc_creation_win_svchost_termserv_proc_spawn.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_sysinternals_accesschk_check_permissions.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_sysinternals_adexplorer_execution.yml

feat: new rules and update

2023-03-14 20:07:44 +01:00

proc_creation_win_sysinternals_adexplorer_susp_execution.yml

fix: apply suggestions from code review

2023-03-15 19:27:57 +01:00

proc_creation_win_sysinternals_eula_accepted.yml

feat: new rules and update

2023-03-14 20:07:44 +01:00

proc_creation_win_sysinternals_livekd_execution.yml

feat: multiple updates and new rules (#4242 )

2023-05-17 17:21:59 +02:00

proc_creation_win_sysinternals_livekd_kernel_memory_dump.yml

feat: multiple updates and new rules (#4242 )

2023-05-17 17:21:59 +02:00

proc_creation_win_sysinternals_procdump_evasion.yml

feat: new rules, updates and goofy guineapig stuff (#4229 )

2023-05-15 15:53:39 +02:00

proc_creation_win_sysinternals_procdump_lsass.yml

feat: new rules, updates and goofy guineapig stuff (#4229 )

2023-05-15 15:53:39 +02:00

proc_creation_win_sysinternals_procdump.yml

feat: more updates and fixes

2023-02-28 15:22:25 +01:00

proc_creation_win_sysinternals_psexec_execution.yml

feat: more updates and fixes

2023-02-28 15:22:25 +01:00

proc_creation_win_sysinternals_psexec_paexec_escalate_system.yml

fix: add missing modified

2023-02-28 15:44:37 +01:00

proc_creation_win_sysinternals_psexec_remote_execution.yml

feat: more updates and fixes

2023-02-28 15:22:25 +01:00

proc_creation_win_sysinternals_psexesvc_as_system.yml

fix: add missing modified

2023-02-28 15:44:37 +01:00

proc_creation_win_sysinternals_psexesvc.yml

feat: more updates and fixes

2023-02-28 15:22:25 +01:00

proc_creation_win_sysinternals_psloglist.yml

feat: rename rules for conventions

2023-02-24 19:33:24 +01:00

proc_creation_win_sysinternals_psservice.yml

feat: rename rules for conventions

2023-02-24 19:33:24 +01:00

proc_creation_win_sysinternals_pssuspend_execution.yml

feat: new rules, updates and fp fixes (#4136 )

2023-04-03 12:06:14 +02:00

proc_creation_win_sysinternals_pssuspend_susp_execution.yml

feat: new rules, updates and fp fixes (#4136 )

2023-04-03 12:06:14 +02:00

proc_creation_win_sysinternals_sdelete.yml

feat: more updates and fixes

2023-02-28 15:22:25 +01:00

proc_creation_win_sysinternals_susp_psexec_paexec_flags_.yml

fix: apply typo fix suggestions from code review

2023-02-28 16:55:40 +01:00

proc_creation_win_sysinternals_sysmon_config_update.yml

fix: apply suggestions from code review

2023-03-13 10:48:08 +01:00

proc_creation_win_sysinternals_sysmon_uninstall.yml

fix: apply suggestions from code review

2023-03-13 10:48:08 +01:00

proc_creation_win_sysinternals_tools_masquerading.yml

feat: more updates and fixes

2023-02-28 15:22:25 +01:00

proc_creation_win_sysprep_appdata.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_systeminfo_execution.yml

chore: renames with new sigma convention

2023-03-03 00:21:25 +01:00

proc_creation_win_systemsettingsadminflows_turn_on_dev_features.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_takeown_recursive_own.yml

chore: renames with new sigma convention

2023-03-03 00:21:25 +01:00

proc_creation_win_tapinstall_execution.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_taskkill_execution.yml

chore: renames with new sigma convention

2023-03-03 00:21:25 +01:00

proc_creation_win_taskkill_sep.yml

fix: apply suggestions from code review

2023-02-16 10:46:29 +01:00

proc_creation_win_tasklist_basic_execution.yml

feat: multiple fixes and updates

2023-02-21 22:15:30 +01:00

proc_creation_win_taskmgr_localsystem.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_taskmgr_susp_child_process.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_teams_suspicious_command_line_cred_access.yml

fix: typos in multiple rules (#4011 )

2023-02-06 13:53:23 +01:00

proc_creation_win_tscon_localsystem.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_tscon_rdp_redirect.yml

feat: multiple updates and new rules (#4242 )

2023-05-17 17:21:59 +02:00

proc_creation_win_tscon_rdp_session_hijacking.yml

feat: more fixes and updates

2023-02-05 21:46:22 +01:00

proc_creation_win_uac_bypass_changepk_slui.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_uac_bypass_cleanmgr.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_uac_bypass_cmstp_com_object_access.yml

feat: new rules, updates and fp fixes (#4162 )

2023-04-11 13:04:22 +02:00

proc_creation_win_uac_bypass_cmstp.yml

…

proc_creation_win_uac_bypass_computerdefaults.yml

feat: updates and enhancements

2023-02-14 00:51:20 +01:00

proc_creation_win_uac_bypass_consent_comctl32.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_uac_bypass_dismhost.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_uac_bypass_eventvwr_recentviews.yml

feat: updates and enhancements

2023-02-14 00:51:20 +01:00

proc_creation_win_uac_bypass_eventvwr.yml

fix: add missing modified date

2023-02-14 01:11:42 +01:00

proc_creation_win_uac_bypass_fodhelper.yml

…

proc_creation_win_uac_bypass_hijacking_firwall_snap_in.yml

…

proc_creation_win_uac_bypass_icmluautil.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_uac_bypass_idiagnostic_profile.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_uac_bypass_ieinstal.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_uac_bypass_msconfig_gui.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_uac_bypass_ntfs_reparse_point.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_uac_bypass_pkgmgr_dism.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_uac_bypass_sdclt.yml

feat: more updates

2023-02-14 01:08:25 +01:00

proc_creation_win_uac_bypass_trustedpath.yml

feat: more rules updates

2023-02-14 19:30:18 +01:00

proc_creation_win_uac_bypass_winsat.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_uac_bypass_wmp.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_uac_bypass_wsreset_integrity_level.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_uac_bypass_wsreset.yml

…

proc_creation_win_ultravnc_susp_execution.yml

feat: update and fixes

2023-03-09 22:10:42 +01:00

proc_creation_win_ultravnc.yml

…

proc_creation_win_uninstall_crowdstrike_falcon.yml

feat: update and fixes

2023-03-09 22:10:42 +01:00

proc_creation_win_userinit_uncommon_child_processes.yml

fix: wording

2023-06-09 12:14:16 +02:00

proc_creation_win_vaultcmd_list_creds.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_verclsid_runs_com.yml

…

proc_creation_win_virtualbox_execution.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_virtualbox_vboxdrvinst_execution.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_vmware_vmtoolsd_susp_child_process.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_vscode_child_processes_anomalies.yml

fix: typos in multiple rules (#4011 )

2023-02-06 13:53:23 +01:00

proc_creation_win_vslsagent_agentextensionpath_load.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_w32tm.yml

…

proc_creation_win_wab_execution_from_non_default_location.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_wab_unusual_parents.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_wbadmin_delete_systemstatebackup.yml

feat: more fixes and updates

2023-02-05 21:46:22 +01:00

proc_creation_win_webshell_chopper.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_webshell_detection.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_webshell_hacking.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_webshell_recon_detection.yml

…

proc_creation_win_webshell_spawn.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_win_werfault_lsass_shtinkering.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_wermgr_susp_child_process.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_wevtutil_recon.yml

fix: typos in multiple rules (#4011 )

2023-02-06 13:53:23 +01:00

proc_creation_win_where_browser_data_recon.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_whoami_execution_from_high_priv_process.yml

fix: apply typo fix suggestions from code review

2023-02-28 16:55:40 +01:00

proc_creation_win_whoami_execution.yml

fix: apply typo fix suggestions from code review

2023-02-28 16:55:40 +01:00

proc_creation_win_whoami_groups_discovery.yml

fix: apply typo fix suggestions from code review

2023-02-28 16:55:40 +01:00

proc_creation_win_whoami_parent_anomaly.yml

fix: apply typo fix suggestions from code review

2023-02-28 16:55:40 +01:00

proc_creation_win_whoami_priv_discovery.yml

fix: apply typo fix suggestions from code review

2023-02-28 16:55:40 +01:00

proc_creation_win_whoami_susp_flags.yml

feat: more updates and fixes

2023-02-28 15:22:25 +01:00

proc_creation_win_windows_terminal_susp_children.yml

feat: more rules updates

2023-02-14 19:30:18 +01:00

proc_creation_win_winget_add_custom_source.yml

feat: more winget updates

2023-04-18 03:35:42 +02:00

proc_creation_win_winget_add_insecure_custom_source.yml

fix: apply suggestions from code review

2023-04-19 15:50:29 +02:00

proc_creation_win_winget_add_susp_custom_source.yml

feat: more winget updates

2023-04-18 03:35:42 +02:00

proc_creation_win_winget_local_install_via_manifest.yml

fix: apply suggestions from code review

2023-04-19 15:50:29 +02:00

proc_creation_win_winrar_dmp.yml

feat: more updates

2023-03-10 23:32:32 +01:00

proc_creation_win_winrar_execution.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_winrm_awl_bypass.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_winrm_execution_via_scripting_api_winrm_vbs.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_winrm_remote_powershell_session_process.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_winrm_susp_child_process.yml

chore: renames with new sigma convention

2023-03-03 00:21:25 +01:00

proc_creation_win_winzip_password_compression.yml

chore: renames with new sigma convention

2023-03-03 00:21:25 +01:00

proc_creation_win_wmi_backdoor_exchange_transport_agent.yml

fix: FP found in prod environment

2023-02-08 17:58:35 +01:00

proc_creation_win_wmi_persistence_script_event_consumer.yml

…

proc_creation_win_wmic_eventconsumer_creation.yml

fix: apply suggestions from code review

2023-02-16 11:05:38 +01:00

proc_creation_win_wmic_namespace_defender.yml

feat: update wmic rules

2023-02-14 19:30:18 +01:00

proc_creation_win_wmic_process_creation.yml

fix: apply suggestions from code review

2023-02-16 11:05:38 +01:00

proc_creation_win_wmic_recon_computersystem.yml

fix: apply suggestions from code review

2023-02-16 11:05:38 +01:00

proc_creation_win_wmic_recon_csproduct.yml

fix: apply suggestions from code review

2023-02-16 11:05:38 +01:00

proc_creation_win_wmic_recon_group.yml

feat: update wmic rules

2023-02-14 19:30:18 +01:00

proc_creation_win_wmic_recon_hotfix.yml

fix: apply suggestions from code review

2023-02-16 11:05:38 +01:00

proc_creation_win_wmic_recon_process.yml

fix: apply suggestions from code review

2023-02-16 11:05:38 +01:00

proc_creation_win_wmic_recon_product_class.yml

fix: test errors

2023-03-07 14:23:44 +01:00

proc_creation_win_wmic_recon_product.yml

feat: update cmd based rules

2023-03-07 14:13:57 +01:00

proc_creation_win_wmic_recon_service.yml

fix: apply suggestions from code review

2023-02-16 11:05:38 +01:00

proc_creation_win_wmic_recon_system_info_discovery.yml

feat: update author and selection

2023-05-05 18:25:07 +02:00

proc_creation_win_wmic_recon_unquoted_service_search.yml

fix: apply suggestions from code review

2023-02-16 11:05:38 +01:00

proc_creation_win_wmic_remote_execution.yml

fix: apply suggestions from code review

2023-02-16 11:05:38 +01:00

proc_creation_win_wmic_service_manipulation.yml

feat: update wmic rules

2023-02-14 19:30:18 +01:00

proc_creation_win_wmic_squiblytwo_bypass.yml

feat: update more regsvr32

2023-05-26 15:59:30 +02:00

proc_creation_win_wmic_susp_execution_via_office_process.yml

feat: update wmic rules

2023-02-14 19:30:18 +01:00

proc_creation_win_wmic_susp_process_creation.yml

fix: apply suggestions from code review

2023-02-16 11:05:38 +01:00

proc_creation_win_wmic_uninstall_application.yml

fix: typo in related field

2023-02-14 19:43:20 +01:00

proc_creation_win_wmic_uninstall_security_products.yml

feat: update wmic rules

2023-02-14 19:30:18 +01:00

proc_creation_win_wmic_xsl_script_processing.yml

Added support for when flag is called another way while executing xsl file from wmic

2023-04-21 18:47:15 +05:45

proc_creation_win_wmiprvse_spawning_process.yml

feat: new rules, updates and fp fixes (#4136 )

2023-04-03 12:06:14 +02:00

proc_creation_win_wmiprvse_spawns_powershell.yml

feat: new rules, updates and fp fixes (#4136 )

2023-04-03 12:06:14 +02:00

proc_creation_win_wmiprvse_susp_child_processes.yml

chore: move more rules

2023-04-21 15:00:36 +02:00

proc_creation_win_wpbbin_potential_persistence.yml

feat: more updates

2023-03-06 00:39:26 +01:00

proc_creation_win_wscript_cscript_script_exec.yml

feat: multiple updates and new rules (#4242 )

2023-05-17 17:21:59 +02:00

proc_creation_win_wscript_cscript_susp_child_processes.yml

feat: multiple updates and new rules (#4242 )

2023-05-17 17:21:59 +02:00

proc_creation_win_wscript_cscript_uncommon_extension_exec.yml

feat: multiple updates and new rules (#4242 )

2023-05-17 17:21:59 +02:00

proc_creation_win_wsl_child_processes_anomalies.yml

feat: more rules updates

2023-02-14 19:30:18 +01:00

proc_creation_win_wsl_lolbin_execution.yml

feat: rule updates

2023-04-12 02:57:44 +02:00

proc_creation_win_wsl_windows_binaries_execution.yml

fix: apply suggestions from code review

2023-02-16 11:05:38 +01:00

proc_creation_win_wuauclt_execution.yml

chore: renames with new sigma convention

2023-03-03 00:21:25 +01:00

proc_creation_win_wuauclt_no_cli_flags_execution.yml

chore: renames with new sigma convention

2023-03-03 00:21:25 +01:00

proc_creation_win_wusa_cab_files_extraction_from_susp_paths.yml

feat: more rules updates

2023-02-14 19:30:18 +01:00

proc_creation_win_wusa_cab_files_extraction.yml

feat: more rules updates

2023-02-14 19:30:18 +01:00