Qasim Qlf 908b25bccb fix: One value of imagePath was wrong ...

it was "clip" that is already covered by "clipboard]::".

Real value is "&&" .

Reference: 
Sigma Rule Id: 4edf51e1-cb83-4e1a-bc39-800e396068e3
Link: https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_invoke_obfuscation_clip_services_security.yml

2023-02-20 20:49:52 +05:00

..

win_system_application_sysmon_crash.yml

Order yaml field

2022-10-25 11:08:51 +02:00

win_system_apt_carbonpaper_turla.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

win_system_apt_chafer_mar18_system.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

win_system_apt_stonedrill.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

win_system_apt_turla_service_png.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

win_system_cobaltstrike_service_installs.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

win_system_defender_disabled.yml

Order yaml field

2022-10-25 11:08:51 +02:00

win_system_eventlog_cleared.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

win_system_hack_smbexec.yml

Order yaml field

2022-10-25 11:08:51 +02:00

win_system_invoke_obfuscation_clip_services.yml

fix: One value of imagePath was wrong

2023-02-20 20:49:52 +05:00

win_system_invoke_obfuscation_obfuscated_iex_services.yml

Update Title (#3733)

2022-11-28 06:43:17 +01:00

win_system_invoke_obfuscation_stdin_services.yml

fix: rename links from old repo to SigmaHQ

2022-12-27 21:05:16 +01:00

win_system_invoke_obfuscation_var_services.yml

fix: rename links from old repo to SigmaHQ

2022-12-27 21:05:16 +01:00

win_system_invoke_obfuscation_via_compress_services.yml

fix: rename links from old repo to SigmaHQ

2022-12-27 21:05:16 +01:00

win_system_invoke_obfuscation_via_rundll_services.yml

fix: rename links from old repo to SigmaHQ

2022-12-27 21:05:16 +01:00

win_system_invoke_obfuscation_via_stdin_services.yml

fix: Windows Defender detection

2022-12-28 20:52:53 +01:00

win_system_invoke_obfuscation_via_use_clip_services.yml

fix: rename links from old repo to SigmaHQ

2022-12-27 21:05:16 +01:00

win_system_invoke_obfuscation_via_use_mshta_services.yml

fix: rename links from old repo to SigmaHQ

2022-12-27 21:05:16 +01:00

win_system_invoke_obfuscation_via_use_rundll32_services.yml

fix: rename links from old repo to SigmaHQ

2022-12-27 21:05:16 +01:00

win_system_invoke_obfuscation_via_var_services.yml

fix: rename links from old repo to SigmaHQ

2022-12-27 21:05:16 +01:00

win_system_kdcsvc_rc4_downgrade.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

win_system_krbrelayup_service_installation.yml

revert: changes in krbrelay service rule

2022-11-09 09:33:37 +01:00

win_system_lpe_indicators_tabtip.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

win_system_lsasrv_ntlmv1.yml

Order yaml field

2022-10-25 11:08:51 +02:00

win_system_mal_creddumper.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

win_system_meterpreter_or_cobaltstrike_getsystem_service_installation.yml

Update Title (#3739)

2022-11-30 11:44:15 +01:00

win_system_moriya_rootkit.yml

Update Title (#3739)

2022-11-30 11:44:15 +01:00

win_system_ntfs_vuln_exploit.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

win_system_pcap_drivers.yml

feat: filename test enhancements (#3812)

2022-12-23 09:25:16 +01:00

win_system_possible_zerologon_exploitation_using_wellknown_tools.yml

Rename system rules

2022-10-14 09:04:45 +02:00

win_system_powershell_script_installed_as_service.yml

Promotion rules (#3821)

2022-12-27 12:29:10 +01:00

win_system_quarkspwdump_clearing_hive_access_history.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

win_system_rare_service_installs.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

win_system_rdp_potential_cve_2019_0708.yml

Promotion rules (#3821)

2022-12-27 12:29:10 +01:00

win_system_service_install_anydesk.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

win_system_service_install_hacktools.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

win_system_service_install_mesh_agent.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

win_system_service_install_netsupport_manager.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

win_system_service_install_paexec.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

win_system_service_install_pdqdeploy_runner.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

win_system_service_install_pdqdeploy.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

win_system_service_install_psexec.yml

Rename Service Install Rules

2022-10-26 23:17:02 +02:00

win_system_service_install_remote_access_software.yml

fix: exclude teamviewer fp & reduce severity

2022-12-23 20:50:38 +01:00

win_system_service_install_remote_utilities.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

win_system_service_install_sliver.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

win_system_service_install_susp_double_ampersand.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

win_system_service_install_tacticalrmm.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

win_system_susp_dhcp_config_failed.yml

Promotion rules (#3821)

2022-12-27 12:29:10 +01:00

win_system_susp_dhcp_config.yml

Promotion rules (#3821)

2022-12-27 12:29:10 +01:00

win_system_susp_eventlog_cleared.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

win_system_susp_proceshacker.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

win_system_susp_rtcore64_service_install.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

win_system_susp_sam_dump.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

win_system_susp_service_installation_folder_pattern.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

win_system_susp_service_installation_folder.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

win_system_susp_service_installation_script.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

win_system_susp_service_installation.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

win_system_susp_system_update_error.yml

Promotion rules (#3821)

2022-12-27 12:29:10 +01:00

win_system_susp_vuln_cve_2022_21919_or_cve_2021_34484.yml

Order yaml field

2022-10-25 11:08:51 +02:00

win_system_system_service_installation_by_unusal_client.yml

update logsource

2023-01-04 18:52:24 +01:00

win_system_tap_driver_installation.yml

Promotion rules (#3821)

2022-12-27 12:29:10 +01:00

win_system_volume_shadow_copy_mount.yml

Promotion rules (#3821)

2022-12-27 12:29:10 +01:00

win_system_vul_cve_2020_1472.yml

Promotion rules (#3821)

2022-12-27 12:29:10 +01:00

win_system_vul_cve_2021_42278_or_cve_2021_42287.yml

Promotion rules (#3821)

2022-12-27 12:29:10 +01:00