security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
b4e1bd1659fd1cd6b88c22a3c55a7cc658ad31aa
blue-team-tools/rules/windows
T
History
Florian Roth b4e1bd1659 Update proc_creation_win_susp_non_exe_image.yml
2022-10-14 12:25:48 +02:00
..
builtin
Merge pull request #3580 from DCSO/rule_mssql_maggie
2022-10-12 18:03:10 +02:00
create_remote_thread
fix: filter definition
2022-09-29 14:07:38 +02:00
create_stream_hash
refactor: JuicyPotatoNG imphashes
2022-10-06 08:30:48 +02:00
dns_query
Fix related
2022-10-09 17:28:05 +02:00
driver_load
Update drivers list
2022-10-10 13:03:56 +02:00
file_access
Fix FP In Testing
2022-10-07 13:26:33 +02:00
file_change
Updated some rules after review
2022-10-11 16:31:56 +02:00
file_delete
Updated some rules after review
2022-10-11 16:31:56 +02:00
file_event
Merge branch 'master' into master
2022-10-10 00:27:48 +02:00
file_rename
Add definition
2022-10-11 11:07:37 +02:00
image_load
Merge pull request #3587 from nasbench/fix-false-positives
2022-10-14 10:22:24 +02:00
network_connection
old experimental rule promotion
2022-10-09 16:54:04 +02:00
pipe_created
Fix FP Found In Testing
2022-10-10 17:33:14 +02:00
powershell
Merge pull request #3587 from nasbench/fix-false-positives
2022-10-14 10:22:24 +02:00
process_access
old experimental rule promotion
2022-10-09 16:54:04 +02:00
process_creation
Update proc_creation_win_susp_non_exe_image.yml
2022-10-14 12:25:48 +02:00
raw_access_thread
fix: FPs with THOR
2022-03-15 18:05:42 +01:00
registry
Fix FP from testing on Win7
2022-10-11 14:04:28 +02:00
sysmon
old experimental rule promotion
2022-10-09 16:54:04 +02:00
wmi_event
old experimental rule promotion
2022-10-09 16:54:04 +02:00