Mohamed Ashraf 75b51c76b5 Merge PR #5195 from @X-Junior - Fix Schtasks Creation Or Modification With SYSTEM Privileges ...

fix: Schtasks Creation Or Modification With SYSTEM Privileges - Add new filter of office scheduled task

2025-02-17 12:04:28 +01:00

..

builtin

Merge PR #5176 from @GtUGtHGtNDtEUaE - Update rules covering EventID 4660

2025-01-31 18:08:59 +01:00

create_remote_thread

Merge PR #5101 from @nasbench - Promote older rules status from experimental to test

2024-12-01 13:40:32 +01:00

create_stream_hash

Merge PR #5088 from @frack113 - Remove custom dedicated hash fields from sigmac

2024-11-25 09:30:14 +01:00

dns_query

Merge PR #5149 from @nasbench - Promote older rules status from experimental to test

2025-01-06 15:36:19 +01:00

driver_load

Merge PR #5088 from @frack113 - Remove custom dedicated hash fields from sigmac

2024-11-25 09:30:14 +01:00

file

Merge PR #5177 from @nasbench - promote older rules status from experimental to test

2025-02-03 18:23:12 +01:00

image_load

Merge PR #5152 from @Ti-R - Fix Potentially Suspicious Volume Shadow Copy Vsstrace.dll Load

2025-01-19 22:02:29 +01:00

network_connection

Merge PR #5177 from @nasbench - promote older rules status from experimental to test

2025-02-03 18:23:12 +01:00

pipe_created

Merge PR #5065 from @nasbench - Promote older rules status from experimental to test

2024-11-01 10:21:04 +01:00

powershell

Merge PR #5167 from @djlukic - Fix multiple false positives found in the wild

2025-01-30 21:15:39 +01:00

process_access

Merge PR #5149 from @nasbench - Promote older rules status from experimental to test

2025-01-06 15:36:19 +01:00

process_creation

Merge PR #5195 from @X-Junior - Fix Schtasks Creation Or Modification With SYSTEM Privileges

2025-02-17 12:04:28 +01:00

process_tampering

Merge PR #5027 from @nasbench - Promote older rules status from experimental to test

2024-10-01 14:56:09 +02:00

raw_access_thread

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry

Merge PR #5177 from @nasbench - promote older rules status from experimental to test

2025-02-03 18:23:12 +01:00

sysmon

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

wmi_event

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00