frack113 becf3baeb4 Merge pull request #2813 from phantinuss/master ...

Changes to falsepositives metadata

2022-03-17 14:31:27 +01:00

..

posh_pm_alternate_powershell_hosts.yml

fix: more Aurora FP fixes

2022-02-16 17:16:50 +01:00

posh_pm_bad_opsec_artifacts.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

posh_pm_clear_powershell_history.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

posh_pm_decompress_commands.yml

fix: unknown --> Unknown

2022-03-16 13:43:54 +01:00

posh_pm_get_addbaccount.yml

rule: remote thread creation, get-addbaccount

2022-03-16 15:21:01 +01:00

posh_pm_get_clipboard.yml

fix: unknown --> Unknown

2022-03-16 13:43:54 +01:00

posh_pm_invoke_obfuscation_clip.yml

Rename powershell_module

2022-01-15 10:38:27 +01:00

posh_pm_invoke_obfuscation_obfuscated_iex.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

posh_pm_invoke_obfuscation_stdin.yml

Rename powershell_module

2022-01-15 10:38:27 +01:00

posh_pm_invoke_obfuscation_var.yml

Rename powershell_module

2022-01-15 10:38:27 +01:00

posh_pm_invoke_obfuscation_via_compress.yml

fix: unknown --> Unknown

2022-03-16 13:43:54 +01:00

posh_pm_invoke_obfuscation_via_rundll.yml

Refactor regex

2022-03-08 19:07:37 +01:00

posh_pm_invoke_obfuscation_via_stdin.yml

Rename powershell_module

2022-01-15 10:38:27 +01:00

posh_pm_invoke_obfuscation_via_use_clip.yml

Rename powershell_module

2022-01-15 10:38:27 +01:00

posh_pm_invoke_obfuscation_via_use_mhsta.yml

Refactor regex

2022-03-07 19:08:30 +01:00

posh_pm_invoke_obfuscation_via_use_rundll32.yml

Refactor regex

2022-03-08 19:07:37 +01:00

posh_pm_invoke_obfuscation_via_var.yml

Rename powershell_module

2022-01-15 10:38:27 +01:00

posh_pm_powercat.yml

Rename powershell_module

2022-01-15 10:38:27 +01:00

posh_pm_remote_powershell_session.yml

FP on valid remote call of Powershell Archive.psm1, maybe beneficial to filter all powershell modules in future

2022-03-14 22:23:06 +00:00

posh_pm_susp_athremotefxvgpudisablementcommand.yml

Rename powershell_module

2022-01-15 10:38:27 +01:00

posh_pm_susp_get_nettcpconnection.yml

Rename powershell_module

2022-01-15 10:38:27 +01:00

posh_pm_susp_zip_compress.yml

Rename powershell_module

2022-01-15 10:38:27 +01:00

posh_pm_suspicious_ad_group_reco.yml

fix: more falsepositives harmonization

2022-03-16 14:57:06 +01:00

posh_pm_suspicious_download.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

posh_pm_suspicious_invocation_generic.yml

fix: remove penetration test as valid false positive reason

2022-03-16 14:33:18 +01:00

posh_pm_suspicious_invocation_specific.yml

fix: remove penetration test as valid false positive reason

2022-03-16 14:33:18 +01:00

posh_pm_suspicious_local_group_reco.yml

fix: more falsepositives harmonization

2022-03-16 14:57:06 +01:00

posh_pm_suspicious_reset_computermachinepassword.yml

add posh_pm_suspicious_reset_computermachinepassword

2022-02-22 13:44:51 +01:00

posh_pm_suspicious_smb_share_reco.yml

fix: more falsepositives harmonization

2022-03-16 14:57:06 +01:00

posh_pm_syncappvpublishingserver_exe.yml

Rename powershell_module

2022-01-15 10:38:27 +01:00