Florian Roth c4021267ec Merge pull request #3193 from SigmaHQ/rule-devel ...

Multiple changes, new rule, some docs

2022-07-03 16:30:36 +02:00

..

net_connection_susp_win_binary_no_cmdline.yml

rule: suspicious network connections no cmdline

2022-07-03 15:58:54 +02:00

net_connection_win_binary_github_com.yml

fix: more falsepositives harmonization

2022-03-16 14:57:06 +01:00

net_connection_win_binary_susp_com.yml

refactor: more domains

2022-07-03 15:58:36 +02:00

net_connection_win_crypto_mining.yml

Name Normalization

2022-02-27 10:58:14 +01:00

net_connection_win_dllhost_net_connections.yml

fix: FPs found in win2022 domain controller baseline

2022-04-21 10:48:59 +02:00

net_connection_win_eqnedt.yml

feat: Add rule for equation editor network connections

2022-04-14 10:50:10 +02:00

net_connection_win_excel_outbound_network_connection.yml

Comparison conflict found between selection and filtere. In favor of selection

2022-06-27 21:03:36 +00:00

net_connection_win_imewdbld.yml

Name Normalization

2022-02-27 10:58:14 +01:00

net_connection_win_malware_backconnect_ports.yml

fix: unknown --> Unknown

2022-03-16 13:43:54 +01:00

net_connection_win_mega_nz.yml

Name Normalization

2022-02-27 10:58:14 +01:00

net_connection_win_msiexec.yml

Name Normalization

2022-02-27 10:58:14 +01:00

net_connection_win_notepad_network_connection.yml

fix: none --> Unknown

2022-03-16 14:19:21 +01:00

net_connection_win_powershell_network_connection.yml

Name Normalization

2022-02-27 10:58:14 +01:00

net_connection_win_python.yml

Name Normalization

2022-02-27 10:58:14 +01:00

net_connection_win_rdp_reverse_tunnel.yml

fix: unknown --> Unknown

2022-03-16 13:43:54 +01:00

net_connection_win_rdp_to_http.yml

rule: RDP to 80/tcp or 443/tcp

2022-04-29 12:03:07 +02:00

net_connection_win_regsvr32_network_activity.yml

fix: unknown --> Unknown

2022-03-16 13:43:54 +01:00

net_connection_win_remote_powershell_session_network.yml

fix: FPs

2022-06-20 12:52:23 +02:00

net_connection_win_rundll32_net_connections.yml

fix: FPs noticed with Aurora

2022-05-02 16:25:33 +02:00

net_connection_win_silenttrinity_stager_msbuild_activity.yml

fix: unknown --> Unknown

2022-03-16 13:43:54 +01:00

net_connection_win_susp_dropbox_api.yml

fix: missing filter

2022-04-21 07:54:58 +02:00

net_connection_win_susp_outbound_kerberos_connection.yml

Renamed suspicious in filenames to susp

2022-05-19 09:37:04 +02:00

net_connection_win_susp_outbound_mobsync_connection.yml

Add "\" to "Image|endswith" modifier

2022-06-02 13:39:07 +01:00

net_connection_win_susp_outbound_smtp_connections.yml

Name Normalization

2022-02-27 10:58:14 +01:00

net_connection_win_susp_prog_location_network_connection.yml

Adjusting condition

2022-05-26 18:39:22 +00:00

net_connection_win_susp_rdp.yml

fix: FPs found in testing environment

2022-06-20 16:17:54 +02:00

net_connection_win_wuauclt_network_connection.yml

Name Normalization

2022-02-27 10:58:14 +01:00