frack113 271f972468 Merge PR #4538 from @frack113 - Add Sigma CLI Configuration File ...

chore: add sigma-cli configuration file
fix: Suspicious Non-Browser Network Communication With Google API - Fix escaped wildcard issue and Update modifiers
fix: Uncommon PowerShell Hosts - Fix escaped wildcard issue
fix: Potential Active Directory Reconnaissance/Enumeration Via LDAP - Update logsource

---------

Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>

2023-11-03 16:59:53 +01:00

..

posh_pc_abuse_nslookup_with_dns_records.yml

Merge PR #4519 from @fukusuket - Update PowerShell Classic Rule To Use Data Field

2023-10-28 12:43:58 +02:00

posh_pc_alternate_powershell_hosts.yml

Merge PR #4538 from @frack113 - Add Sigma CLI Configuration File

2023-11-03 16:59:53 +01:00

posh_pc_delete_volume_shadow_copies.yml

Merge PR #4519 from @fukusuket - Update PowerShell Classic Rule To Use Data Field

2023-10-28 12:43:58 +02:00

posh_pc_downgrade_attack.yml

Merge PR #4519 from @fukusuket - Update PowerShell Classic Rule To Use Data Field

2023-10-28 12:43:58 +02:00

posh_pc_exe_calling_ps.yml

Merge PR #4519 from @fukusuket - Update PowerShell Classic Rule To Use Data Field

2023-10-28 12:43:58 +02:00

posh_pc_powercat.yml

Merge PR #4519 from @fukusuket - Update PowerShell Classic Rule To Use Data Field

2023-10-28 12:43:58 +02:00

posh_pc_remote_powershell_session.yml

Merge PR #4519 from @fukusuket - Update PowerShell Classic Rule To Use Data Field

2023-10-28 12:43:58 +02:00

posh_pc_remotefxvgpudisablement_abuse.yml

feat: new rules, updates and goofy guineapig stuff (#4229)

2023-05-15 15:53:39 +02:00

posh_pc_renamed_powershell.yml

Merge PR #4519 from @fukusuket - Update PowerShell Classic Rule To Use Data Field

2023-10-28 12:43:58 +02:00

posh_pc_susp_download.yml

Merge PR #4519 from @fukusuket - Update PowerShell Classic Rule To Use Data Field

2023-10-28 12:43:58 +02:00

posh_pc_susp_get_nettcpconnection.yml

Merge PR #4519 from @fukusuket - Update PowerShell Classic Rule To Use Data Field

2023-10-28 12:43:58 +02:00

posh_pc_susp_zip_compress.yml

Merge PR #4519 from @fukusuket - Update PowerShell Classic Rule To Use Data Field

2023-10-28 12:43:58 +02:00

posh_pc_tamper_windows_defender_set_mp.yml

Merge PR #4519 from @fukusuket - Update PowerShell Classic Rule To Use Data Field

2023-10-28 12:43:58 +02:00

posh_pc_wsman_com_provider_no_powershell.yml

Merge PR #4519 from @fukusuket - Update PowerShell Classic Rule To Use Data Field

2023-10-28 12:43:58 +02:00

posh_pc_xor_commandline.yml

Merge PR #4519 from @fukusuket - Update PowerShell Classic Rule To Use Data Field

2023-10-28 12:43:58 +02:00