Florian Roth d88f6b2208 Merge pull request #2459 from SigmaHQ/aurora-false-positive-fixing ...

fix: FPs noticed with Aurora

2021-12-16 20:34:30 +01:00

..

silenttrinity_stager_msbuild_activity.yml

Change status for old rules

2021-11-27 11:33:14 +01:00

sysmon_dllhost_net_connections.yml

style: new best practice filter condition

2021-12-07 20:58:03 +01:00

sysmon_excel_outbound_network_connection.yml

Update sysmon_excel_outbound_network_connection.yml

2021-11-11 21:57:44 -05:00

sysmon_malware_backconnect_ports.yml

Change status for old rules

2021-11-27 11:33:14 +01:00

sysmon_notepad_network_connection.yml

Change status for old rules

2021-11-27 11:33:14 +01:00

sysmon_powershell_network_connection.yml

Fixing conflict where both selection and filter have the same value.

2021-12-01 17:29:00 +00:00

sysmon_rdp_reverse_tunnel.yml

Correct cast-sensitive Key "DestinationIp"

2021-05-11 10:49:10 +02:00

sysmon_regsvr32_network_activity.yml

Remove unneeded EventID

2021-10-04 21:25:57 +02:00

sysmon_remote_powershell_session_network.yml

Change status for old rules

2021-11-27 11:33:14 +01:00

sysmon_rundll32_net_connections.yml

fix: FPs noticed with Aurora

2021-12-16 19:54:22 +01:00

sysmon_susp_prog_location_network_connection.yml

Change status for old rules

2021-11-27 11:33:14 +01:00

sysmon_susp_rdp.yml

Change status for old rules

2021-11-27 11:33:14 +01:00

sysmon_suspicious_outbound_kerberos_connection.yml

adding tomcat8 to allowed kerberos outbound.

2021-12-02 14:55:12 +00:00

sysmon_win_binary_github_com.yml

Change status for old rules

2021-11-27 11:33:14 +01:00

sysmon_win_binary_susp_com.yml

Change status for old rules

2021-11-27 11:33:14 +01:00

sysmon_wuauclt_network_connection.yml

Change status for old rules

2021-11-27 11:33:14 +01:00

win_net_crypto_mining.yml

add missing MITRE Techniques

2021-11-20 12:26:01 +01:00

win_net_mega_nz.yml

rule: Communication To Mega.nz

2021-12-06 18:35:04 +01:00

win_net_python.yml

Add windows t1046 rules

2021-12-10 16:31:16 +01:00