Florian Roth a05b3e50e5 refactor and new: lsass process dumping rules

2022-02-10 09:17:25 +01:00

..

sysmon_cmstp_execution_by_access.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

sysmon_cobaltstrike_bof_injection_pattern.yml

Various fixes

2021-09-07 23:38:07 +02:00

sysmon_cred_dump_lsass_access.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

sysmon_direct_syscall_ntopenprocess.yml

Spelling Errors on Rules

2021-08-18 18:58:20 +00:00

sysmon_in_memory_assembly_execution.yml

fix: remove new line

2022-02-03 21:54:16 +01:00

sysmon_invoke_phantom.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

sysmon_lazagne_cred_dump_lsass_access.yml

Change double quote to quote

2022-01-06 14:02:35 +01:00

sysmon_littlecorporal_generated_maldoc.yml

Spelling Errors on Rules

2021-08-18 18:58:20 +00:00

sysmon_load_undocumented_autoelevated_com_interface.yml

Change status for old rules

2021-11-27 11:33:14 +01:00

sysmon_lsass_dump_comsvcs_dll.yml

Merging upstream updates

2021-07-01 12:18:30 +05:45

sysmon_lsass_memdump_evasion.yml

refactor and new: lsass process dumping rules

2022-02-10 09:17:25 +01:00

sysmon_lsass_memdump_indicators.yml

refactor and new: lsass process dumping rules

2022-02-10 09:17:25 +01:00

sysmon_lsass_memdump.yml

fix: FP notices with Aurora

2022-02-05 21:40:03 +01:00

sysmon_malware_verclsid_shellcode.yml

Change status for old rules

2021-11-27 11:33:14 +01:00

sysmon_mimikatz_trough_winrm.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

sysmon_pypykatz_cred_dump_lsass_access.yml

Change double quote to quote

2022-01-06 14:02:35 +01:00

sysmon_svchost_cred_dump.yml

Missing status in rules (#2284)

2021-11-19 22:32:26 +01:00

sysmon_uac_bypass_wow64_logger.yml

bulk of new rules to match working UACMe UAC bypasses

2021-08-31 12:51:21 +02:00

win_susp_proc_access_lsass_susp_source.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

win_susp_proc_access_lsass.yml

fix: FPs noticed with Aurora

2022-02-01 15:57:44 +01:00