Florian Roth 0fb1295157 fix: FPs noticed with Aurora

2022-11-13 20:26:03 +01:00

..

proc_access_win_cmstp_execution_by_access.yml

Order yaml field

2022-10-26 09:42:26 +02:00

proc_access_win_cobaltstrike_bof_injection_pattern.yml

old experimental rule promotion

2022-10-09 16:54:04 +02:00

proc_access_win_cred_dump_lsass_access.yml

fix: FPs noticed with Aurora

2022-11-13 20:26:03 +01:00

proc_access_win_direct_syscall_ntopenprocess.yml

Order yaml field

2022-10-26 09:42:26 +02:00

proc_access_win_hack_sysmonente.yml

Order yaml field

2022-10-26 09:42:26 +02:00

proc_access_win_handlekatz_lsass_access.yml

Order yaml field

2022-10-26 09:42:26 +02:00

proc_access_win_in_memory_assembly_execution.yml

Update proc_access_win_in_memory_assembly_execution.yml

2022-11-03 11:19:09 +01:00

proc_access_win_invoke_phantom.yml

Fix FP

2022-11-01 01:05:42 +01:00

proc_access_win_lazagne_cred_dump_lsass_access.yml

Order yaml field

2022-10-26 09:42:26 +02:00

proc_access_win_littlecorporal_generated_maldoc.yml

Order yaml field

2022-10-26 09:42:26 +02:00

proc_access_win_load_undocumented_autoelevated_com_interface.yml

Order yaml field

2022-10-26 09:42:26 +02:00

proc_access_win_lsass_dump_comsvcs_dll.yml

old experimental rule promotion

2022-10-09 16:54:04 +02:00

proc_access_win_lsass_memdump_evasion.yml

Order yaml field

2022-10-26 09:42:26 +02:00

proc_access_win_lsass_memdump_indicators.yml

Order yaml field

2022-10-26 09:42:26 +02:00

proc_access_win_lsass_memdump.yml

Order yaml field

2022-10-26 09:42:26 +02:00

proc_access_win_lsass_werfault.yml

old experimental rule promotion

2022-10-09 16:54:04 +02:00

proc_access_win_malware_verclsid_shellcode.yml

Order yaml field

2022-10-26 09:42:26 +02:00

proc_access_win_mimikatz_trough_winrm.yml

Order yaml field

2022-10-26 09:42:26 +02:00

proc_access_win_pypykatz_cred_dump_lsass_access.yml

old experimental rule promotion

2022-10-09 16:54:04 +02:00

proc_access_win_rare_proc_access_lsass.yml

fix: FPs noticed with Aurora

2022-11-13 20:26:03 +01:00

proc_access_win_susp_proc_access_lsass_susp_source.yml

Fix FP

2022-11-01 01:05:42 +01:00

proc_access_win_susp_proc_access_lsass.yml

Order yaml field

2022-10-26 09:42:26 +02:00

proc_access_win_svchost_cred_dump.yml

old experimental rule promotion

2022-10-09 16:54:04 +02:00

proc_access_win_uac_bypass_wow64_logger.yml

old experimental rule promotion

2022-10-09 16:54:04 +02:00

process_access_win_shellcode_inject_msf_empire.yml

Fix FP

2022-11-01 01:05:42 +01:00

process_access_win_susp_seclogon.yml

Order yaml field

2022-10-26 09:42:26 +02:00