frack113 12f0d6dfab Windows Redcannary

2022-01-16 14:47:56 +01:00

..

silenttrinity_stager_msbuild_activity.yml

Change status for old rules

2021-11-27 11:33:14 +01:00

sysmon_dllhost_net_connections.yml

style: new best practice filter condition

2021-12-07 20:58:03 +01:00

sysmon_excel_outbound_network_connection.yml

Update sysmon_excel_outbound_network_connection.yml

2021-11-11 21:57:44 -05:00

sysmon_malware_backconnect_ports.yml

Change status for old rules

2021-11-27 11:33:14 +01:00

sysmon_notepad_network_connection.yml

Change status for old rules

2021-11-27 11:33:14 +01:00

sysmon_powershell_network_connection.yml

Fixing conflict where both selection and filter have the same value.

2021-12-01 17:29:00 +00:00

sysmon_rdp_reverse_tunnel.yml

Correct cast-sensitive Key "DestinationIp"

2021-05-11 10:49:10 +02:00

sysmon_regsvr32_network_activity.yml

Remove unneeded EventID

2021-10-04 21:25:57 +02:00

sysmon_remote_powershell_session_network.yml

Change status for old rules

2021-11-27 11:33:14 +01:00

sysmon_rundll32_net_connections.yml

fix: filter FPs with Microsoft cloud

2021-12-27 19:47:32 +01:00

sysmon_susp_prog_location_network_connection.yml

Change status for old rules

2021-11-27 11:33:14 +01:00

sysmon_susp_rdp.yml

Allows PasswordState to initiate rdp connections, per feature "Passwordstate Remote Session Launcher" https://www.clickstudios.com.au/downloads/version9/Passwordstate_Remote_Session_Launcher_Gateway_Install_Guide.pdf

2021-12-29 14:27:22 +00:00

sysmon_suspicious_outbound_kerberos_connection.yml

adding tomcat8 to allowed kerberos outbound.

2021-12-02 14:55:12 +00:00

sysmon_win_binary_github_com.yml

Change status for old rules

2021-11-27 11:33:14 +01:00

sysmon_win_binary_susp_com.yml

Change status for old rules

2021-11-27 11:33:14 +01:00

sysmon_wuauclt_network_connection.yml

Change status for old rules

2021-11-27 11:33:14 +01:00

win_nc_msiexec.yml

Windows Redcannary

2022-01-16 14:47:56 +01:00

win_nc_susp_outbound_smtp_connections.yml

Windows Redcannary

2022-01-08 09:17:56 +01:00

win_net_crypto_mining.yml

add missing MITRE Techniques

2021-11-20 12:26:01 +01:00

win_net_mega_nz.yml

rule: Communication To Mega.nz

2021-12-06 18:35:04 +01:00

win_net_python.yml

Add windows t1046 rules

2021-12-10 16:31:16 +01:00