Nasreddine Bencherchali a13a5efd47 More FP tuning

2022-10-20 11:51:06 +02:00

..

proc_access_win_cmstp_execution_by_access.yml

Name Normalization

2022-02-27 10:58:14 +01:00

proc_access_win_cobaltstrike_bof_injection_pattern.yml

old experimental rule promotion

2022-10-09 16:54:04 +02:00

proc_access_win_cred_dump_lsass_access.yml

fix: FPs noticed in THOR testing

2022-09-29 13:41:20 +02:00

proc_access_win_direct_syscall_ntopenprocess.yml

fix: FPs noticed in testing env

2022-10-05 12:22:42 +02:00

proc_access_win_hack_sysmonente.yml

fix: FP with windows defender

2022-09-09 13:51:53 +02:00

proc_access_win_handlekatz_lsass_access.yml

New + Update

2022-08-26 15:38:43 +01:00

proc_access_win_in_memory_assembly_execution.yml

chore: test rules: reactivate single value list check

2022-05-10 17:13:04 +02:00

proc_access_win_invoke_phantom.yml

fix: unknown --> Unknown

2022-03-16 13:43:54 +01:00

proc_access_win_lazagne_cred_dump_lsass_access.yml

Update backslash

2022-08-13 09:59:31 +02:00

proc_access_win_littlecorporal_generated_maldoc.yml

Add "\" to "Image|endswith" modifier

2022-06-02 13:39:07 +01:00

proc_access_win_load_undocumented_autoelevated_com_interface.yml

fix: unknown --> Unknown

2022-03-16 13:43:54 +01:00

proc_access_win_lsass_dump_comsvcs_dll.yml

old experimental rule promotion

2022-10-09 16:54:04 +02:00

proc_access_win_lsass_memdump_evasion.yml

Update Ref+Selection

2022-07-11 14:11:53 +01:00

proc_access_win_lsass_memdump_indicators.yml

Update Ref+Selection

2022-07-11 14:11:53 +01:00

proc_access_win_lsass_memdump.yml

fix: FPs noticed with THOR

2022-09-29 13:51:09 +02:00

proc_access_win_lsass_werfault.yml

old experimental rule promotion

2022-10-09 16:54:04 +02:00

proc_access_win_malware_verclsid_shellcode.yml

fix: unknown --> Unknown

2022-03-16 13:43:54 +01:00

proc_access_win_mimikatz_trough_winrm.yml

chore: test rules: capitalization on FP list entries

2022-05-09 16:07:44 +02:00

proc_access_win_pypykatz_cred_dump_lsass_access.yml

old experimental rule promotion

2022-10-09 16:54:04 +02:00

proc_access_win_rare_proc_access_lsass.yml

fix: FPs on test system

2022-10-19 15:44:00 +02:00

proc_access_win_susp_proc_access_lsass_susp_source.yml

fix: FPs noticed in testing env

2022-10-05 12:22:42 +02:00

proc_access_win_susp_proc_access_lsass.yml

Update Ref+Selection

2022-07-11 14:11:53 +01:00

proc_access_win_svchost_cred_dump.yml

old experimental rule promotion

2022-10-09 16:54:04 +02:00

proc_access_win_uac_bypass_wow64_logger.yml

old experimental rule promotion

2022-10-09 16:54:04 +02:00

process_access_win_shellcode_inject_msf_empire.yml

More FP tuning

2022-10-20 11:51:06 +02:00

process_access_win_susp_seclogon.yml

New Rules

2022-07-01 16:56:45 +01:00