David Bertho a47edba68d Merge PR #4941 from @dbertho - Update Outlook Persistence related rules / Specula ...

update: Potential Persistence Via Outlook Home Page - Update the logic to account for additional sub keys.
update: Potential Persistence Via Outlook Today Page - Update the logic to account for the "URL" value. 

---------

Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>

2024-08-07 13:49:59 +02:00

..

builtin

Merge PR #4945 from @GtUGtHGtNDtEUaE - Fix typo in field name for rules leveraging EID 5145

2024-08-01 22:46:23 +02:00

create_remote_thread

Merge PR #4933 from @fornotes - Add Remote Thread Created In Shell Application

2024-07-29 22:48:11 +02:00

create_stream_hash

Merge PR #4841 from @nasbench - Promote older rules status from experimental to test

2024-05-02 10:34:25 +02:00

dns_query

Merge PR #4942 from @nasbench - promote older rules status from experimental to test

2024-08-01 10:26:14 +02:00

driver_load

Merge PR #4791 from @nasbench - Promote older rules status from experimental to test

2024-04-01 15:14:10 +02:00

file

Merge PR #4942 from @nasbench - promote older rules status from experimental to test

2024-08-01 10:26:14 +02:00

image_load

Merge PR #4952 from @joshnck - Fix Potential DLL Sideloading Of DbgModel.DLL

2024-08-07 10:25:18 +02:00

network_connection

Merge PR #4942 from @nasbench - promote older rules status from experimental to test

2024-08-01 10:26:14 +02:00

pipe_created

Merge PR #4942 from @nasbench - promote older rules status from experimental to test

2024-08-01 10:26:14 +02:00

powershell

Merge PR #4888 from @nasbench - Add multiple new rules, updates and fixes

2024-07-17 11:04:05 +02:00

process_access

Merge PR #4940 from @fukusuket - Update unreachable references blog.menasec[.]net

2024-07-31 10:16:56 +02:00

process_creation

Merge PR #4946 from @swachchhanda000 - Add Suspicious Process Masquerading As SvcHost.EXE

2024-08-07 10:48:12 +02:00

process_tampering

Merge PR #4597 from @nasbench - Update Process Access Rules

2023-12-04 01:14:15 +01:00

raw_access_thread

Merge PR #4597 from @nasbench - Update Process Access Rules

2023-12-04 01:14:15 +01:00

registry

Merge PR #4941 from @dbertho - Update Outlook Persistence related rules / Specula

2024-08-07 13:49:59 +02:00

sysmon

Merge PR #4942 from @nasbench - promote older rules status from experimental to test

2024-08-01 10:26:14 +02:00

wmi_event

Merge PR #4942 from @nasbench - promote older rules status from experimental to test

2024-08-01 10:26:14 +02:00