Josh b7ea91278e Merge PR #4719 from @joshnck - Update Rules Related To RunHTMLApplication Abuse ...

update: Mshtml.DLL RunHTMLApplication Suspicious Usage - Merge overlapping rules and enhance logic to account for new reported bypass
remove: Rundll32 JS RunHTMLApplication Pattern
remove: Suspicious Rundll32 Script in CommandLine 
---------

Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>

2024-02-26 11:37:37 +01:00

..

builtin

Merge PR #4702 from @nasbench - Rule tuning and updates

2024-02-12 12:29:36 +01:00

create_remote_thread

Merge PR #4684 from @phantinuss - Multiple FP fixes & rule updates

2024-01-23 12:15:04 +01:00

create_stream_hash

Merge PR #4702 from @nasbench - Rule tuning and updates

2024-02-12 12:29:36 +01:00

dns_query

Merge PR #4710 from @xiangchen96 - Add ipconfig.io domain

2024-02-08 16:16:02 +01:00

driver_load

Merge PR #4681 from @nasbench - Add Missing Ref & Tags

2024-01-29 13:37:20 +01:00

file

Merge PR #4692 from @jstnk9 - Add new rules related to IExpress abuse

2024-02-08 16:57:23 +01:00

image_load

Merge PR #4700 from @nasbench - Promote older rules status from experimental to test

2024-02-01 02:09:31 +01:00

network_connection

Merge PR #4702 from @nasbench - Rule tuning and updates

2024-02-12 12:29:36 +01:00

pipe_created

Merge PR #4690 from @tr0mb1r - filter Websense named pipe

2024-01-29 11:50:59 +01:00

powershell

Merge PR #4700 from @nasbench - Promote older rules status from experimental to test

2024-02-01 02:09:31 +01:00

process_access

Merge PR #4681 from @nasbench - Add Missing Ref & Tags

2024-01-29 13:37:20 +01:00

process_creation

Merge PR #4719 from @joshnck - Update Rules Related To RunHTMLApplication Abuse

2024-02-26 11:37:37 +01:00

process_tampering

Merge PR #4597 from @nasbench - Update Process Access Rules

2023-12-04 01:14:15 +01:00

raw_access_thread

Merge PR #4597 from @nasbench - Update Process Access Rules

2023-12-04 01:14:15 +01:00

registry

Merge PR #4702 from @nasbench - Rule tuning and updates

2024-02-12 12:29:36 +01:00

sysmon

Merge PR #4482 From @nasbench - Add New Automation Workflows

2023-10-18 11:53:44 +02:00

wmi_event

Merge PR #4681 from @nasbench - Add Missing Ref & Tags

2024-01-29 13:37:20 +01:00