Files
blue-team-tools/rules/windows/file_event
Nasreddine Bencherchali dcf236fede Quick Updates and Fixes
- Added "Invoke-EventViewer.ps1" script to the rule "file_event_win_powershell_exploit_scripts"
- Added "OriginalFileName" to "proc_creation_win_susp_taskkill"
- Created rule for "winword" being used as a LOLBIN to download and load arbitrary DLLs
2022-05-18 12:50:59 +01:00
..
2022-02-27 07:39:46 +01:00
2022-04-23 18:35:23 +02:00