Swachchhanda Shrawan Poudel f54972108f Merge PR #5538 from @swachchhanda000 - feat: potential spear-phishing through svg files ...

new: Suspicious File Created in Outlook Temporary Directory
remove: .RDP File Created by Outlook Process - deprecate in favour of fabb0e80-030c-4e3e-a104-d09676991ac3
update: Suspicious Double Extension Files - add .svg extension
---------

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
Co-authored-by: frack113 <62423083+frack113@users.noreply.github.com>

2025-07-29 10:30:55 +02:00

..

file_event_win_adsi_cache_creation_by_uncommon_tool.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_advanced_ip_scanner.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_anydesk_artefact.yml

Merge PR #5477 from @phantinuss - chore: update MITRE tag t1219 to t1219.002

2025-06-13 10:00:52 +02:00

file_event_win_anydesk_writing_susp_binaries.yml

Merge PR #5477 from @phantinuss - chore: update MITRE tag t1219 to t1219.002

2025-06-13 10:00:52 +02:00

file_event_win_aspnet_temp_files.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_bloodhound_collection.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_create_evtx_non_common_locations.yml

Merge PR #5177 from @nasbench - promote older rules status from experimental to test

2025-02-03 18:23:12 +01:00

file_event_win_create_non_existent_dlls.yml

Merge PR #5418 from @frack113 - chore: 🧹 Update MITRE V17 DLL tags

2025-05-15 12:17:10 +02:00

file_event_win_creation_deno.yml

Merge PR #5407 from @joshnck - Suspicious Deno File Written from Remote Source

2025-05-27 09:49:30 +02:00

file_event_win_creation_new_shim_database.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_creation_scr_binary_file.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_creation_system_dll_files.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_creation_system_file.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_creation_unquoted_service_path.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_cred_dump_tools_dropped_files.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_cscript_wscript_dropper.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_csexec_service.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_csharp_compile_artefact.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_dcom_iertutil_dll_hijack.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_dll_sideloading_space_path.yml

Merge PR #5418 from @frack113 - chore: 🧹 Update MITRE V17 DLL tags

2025-05-15 12:17:10 +02:00

file_event_win_dump_file_susp_creation.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_errorhandler_persistence.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_exchange_webshell_drop_suspicious.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_exchange_webshell_drop.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_gotoopener_artefact.yml

Merge PR #5477 from @phantinuss - chore: update MITRE tag t1219 to t1219.002

2025-06-13 10:00:52 +02:00

file_event_win_hktl_crackmapexec_indicators.yml

Merge PR #5397 from @nasbench - Promote older rules status from experimental to test

2025-05-20 22:58:46 +02:00

file_event_win_hktl_dumpert.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_hktl_hivenightmare_file_exports.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_hktl_inveigh_artefacts.yml

Merge PR #5477 from @phantinuss - chore: update MITRE tag t1219 to t1219.002

2025-06-13 10:00:52 +02:00

file_event_win_hktl_krbrelay_remote_ioc.yml

Merge PR #5477 from @phantinuss - chore: update MITRE tag t1219 to t1219.002

2025-06-13 10:00:52 +02:00

file_event_win_hktl_mimikatz_files.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_hktl_nppspy.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_hktl_powerup_dllhijacking.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_hktl_quarkspw_filedump.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_hktl_remote_cred_dump.yml

Merge PR #5451 from @frack113 - chore: cleanup metadata

2025-06-04 13:33:36 +02:00

file_event_win_hktl_safetykatz.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_impacket_file_indicators.yml

Merge PR#5425 from @tsale - New Rule: Impacket File Indicators

2025-05-27 09:45:15 +02:00

file_event_win_initial_access_dll_search_order_hijacking.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_install_teamviewer_desktop.yml

Merge PR #5477 from @phantinuss - chore: update MITRE tag t1219 to t1219.002

2025-06-13 10:00:52 +02:00

file_event_win_iphlpapi_dll_sideloading.yml

Merge PR #5418 from @frack113 - chore: 🧹 Update MITRE V17 DLL tags

2025-05-15 12:17:10 +02:00

file_event_win_iso_file_mount.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_iso_file_recent.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_lolbin_gather_network_info_script_output.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_lsass_default_dump_file_names.yml

Merge PR #5038 from @Neo23x0 - Update LSASS Process Memory Dump Files

2024-10-08 21:57:25 +02:00

file_event_win_lsass_shtinkering.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_lsass_werfault_dump.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_mal_adwind.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_mal_octopus_scanner.yml

Merge PR #5452 from @david-syk - Update the MITRE ATT&CK tags for multiple rules

2025-06-04 14:39:25 +02:00

file_event_win_msdt_susp_directories.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_mysqld_uncommon_file_creation.yml

Merge PR #5249 from @nasbench - Promote older rules status from experimental to test

2025-04-17 00:41:35 +02:00

file_event_win_net_cli_artefact.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_new_files_in_uncommon_appdata_folder.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_new_scr_file.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_notepad_plus_plus_persistence.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_ntds_dit_creation.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_ntds_dit_uncommon_parent_process.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_ntds_dit_uncommon_process.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_ntds_exfil_tools.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_office_addin_persistence.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_office_macro_files_created.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_office_macro_files_downloaded.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_office_macro_files_from_susp_process.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_office_onenote_files_in_susp_locations.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_office_onenote_susp_dropped_files.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_office_outlook_macro_creation.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_office_outlook_newform.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_office_outlook_susp_file_creation_in_temp_dir.yml

Merge PR #5538 from @swachchhanda000 - feat: potential spear-phishing through svg files

2025-07-29 10:30:55 +02:00

file_event_win_office_outlook_susp_macro_creation.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_office_publisher_files_in_susp_locations.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_office_startup_persistence.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_office_susp_file_extension.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_office_uncommon_file_startup.yml

Merge PR #5065 from @nasbench - Promote older rules status from experimental to test

2024-11-01 10:21:04 +01:00

file_event_win_pcre_net_temp_file.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_perflogs_susp_files.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_powershell_drop_binary_or_script.yml

Merge PR #5513 from @swachchhanda000 - fix FPs observed via Aurora

2025-07-08 10:29:01 +02:00

file_event_win_powershell_drop_powershell.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_powershell_exploit_scripts.yml

Merge PR #5515 from @X-Junior - coverage for Invoke-PowerDPAPI

2025-07-07 12:19:55 +02:00

file_event_win_powershell_module_creation.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_powershell_module_susp_creation.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_powershell_module_uncommon_creation.yml

Merge PR #4991 from @nasbench - Promote older rules status from experimental to test

2024-09-02 10:01:36 +02:00

file_event_win_powershell_startup_shortcuts.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_ps_script_policy_test_creation_by_uncommon_process.yml

Merge PR #5065 from @nasbench - Promote older rules status from experimental to test

2024-11-01 10:21:04 +01:00

file_event_win_rclone_config_files.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_rdp_file_susp_creation.yml

Merge PR #5063 from @Neo23x0 - Add & Update rules related to the suspicious creation of ".rdp" files

2024-11-01 10:47:36 +01:00

file_event_win_redmimicry_winnti_filedrop.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_regedit_print_as_pdf.yml

Merge PR #5448 from @nasbench - Promote older rules status from experimental to test

2025-06-02 13:29:48 +02:00

file_event_win_remcom_service.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_remote_access_tools_screenconnect_artefact.yml

Merge PR #5477 from @phantinuss - chore: update MITRE tag t1219 to t1219.002

2025-06-13 10:00:52 +02:00

file_event_win_remote_access_tools_screenconnect_remote_file.yml

Merge PR #4991 from @nasbench - Promote older rules status from experimental to test

2024-09-02 10:01:36 +02:00

file_event_win_ripzip_attack.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_sam_dump.yml

Merge PR #5007 from @fukusuket - Fix unreachable GitHub URL references

2024-09-13 11:14:11 +02:00

file_event_win_sed_file_creation.yml

Merge PR #5101 from @nasbench - Promote older rules status from experimental to test

2024-12-01 13:40:32 +01:00

file_event_win_shell_write_susp_directory.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_shell_write_susp_files_extensions.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_startup_folder_file_write.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_susp_colorcpl.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_susp_creation_by_mobsync.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_susp_default_gpo_dir_write.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_susp_desktop_ini.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_susp_desktop_txt.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_susp_desktopimgdownldr_file.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_susp_diagcab.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_susp_double_extension.yml

Merge PR #5538 from @swachchhanda000 - feat: potential spear-phishing through svg files

2025-07-29 10:30:55 +02:00

file_event_win_susp_dpapi_backup_and_cert_export_ioc.yml

Merge PR #5452 from @david-syk - Update the MITRE ATT&CK tags for multiple rules

2025-06-04 14:39:25 +02:00

file_event_win_susp_exchange_aspx_write.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_susp_executable_creation.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_susp_filewrite_in_sharepoint_layouts_dir.yml

Merge PR #5543 from @ swachchhanda000 - update toolshell related rules

2025-07-28 14:22:06 +02:00

file_event_win_susp_get_variable.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_susp_hidden_dir_index_allocation.yml

Merge PR #4991 from @nasbench - Promote older rules status from experimental to test

2024-09-02 10:01:36 +02:00

file_event_win_susp_homoglyph_filename.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_susp_legitimate_app_dropping_archive.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_susp_legitimate_app_dropping_exe.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_susp_legitimate_app_dropping_script.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_susp_lnk_double_extension.yml

Merge PR #4991 from @nasbench - Promote older rules status from experimental to test

2024-09-02 10:01:36 +02:00

file_event_win_susp_pfx_file_creation.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_susp_powershell_profile.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_susp_procexplorer_driver_created_in_tmp_folder.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_susp_public_folder_extension.yml

Merge PR #5174 from @tsale - Add Suspicious Binaries and Scripts in Public Folder

2025-01-30 21:13:42 +01:00

file_event_win_susp_recycle_bin_fake_exec.yml

Merge PR #5065 from @nasbench - Promote older rules status from experimental to test

2024-11-01 10:21:04 +01:00

file_event_win_susp_right_to_left_override_extension_spoofing.yml

Merge PR #5081 from @cod3nym - Add Potential File Extension Spoofing Using Right-to-Left Override

2024-11-18 22:43:01 +01:00

file_event_win_susp_spool_drivers_color_drop.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_susp_startup_folder_persistence.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_susp_system_interactive_powershell.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_susp_task_write.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_susp_teamviewer_remote_session.yml

Merge PR #5477 from @phantinuss - chore: update MITRE tag t1219 to t1219.002

2025-06-13 10:00:52 +02:00

file_event_win_susp_vscode_powershell_profile.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_susp_wdac_policy_creation.yml

Merge PR #5378 from @X-Junior - fix: FP related to Potentially Suspicious WDAC Policy File Creation

2025-05-12 13:31:38 +02:00

file_event_win_susp_windows_terminal_profile.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_susp_winsxs_binary_creation.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_sysinternals_adexplorer_dump_written.yml

Merge PR #5518 from @ruppde - new rule and updates for ADExplorer

2025-07-14 12:02:18 +02:00

file_event_win_sysinternals_livekd_default_dump_name.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_sysinternals_livekd_driver_susp_creation.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_sysinternals_livekd_driver.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_sysinternals_procexp_driver_susp_creation.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_sysinternals_procmon_driver_susp_creation.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_sysinternals_psexec_service_key.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_sysinternals_psexec_service.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_system32_local_folder_privilege_escalation.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_taskmgr_lsass_dump.yml

Merge PR #4991 from @nasbench - Promote older rules status from experimental to test

2024-09-02 10:01:36 +02:00

file_event_win_tsclient_filewrite_startup.yml

Merge PR #5477 from @phantinuss - chore: update MITRE tag t1219 to t1219.002

2025-06-13 10:00:52 +02:00

file_event_win_uac_bypass_consent_comctl32.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_uac_bypass_dotnet_profiler.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_uac_bypass_eventvwr.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_uac_bypass_idiagnostic_profile.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_uac_bypass_ieinstal.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_uac_bypass_msconfig_gui.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_uac_bypass_ntfs_reparse_point.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_uac_bypass_winsat.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_uac_bypass_wmp.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_vhd_download_via_browsers.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_vscode_tunnel_remote_creation_artefacts.yml

Merge PR #4991 from @nasbench - Promote older rules status from experimental to test

2024-09-02 10:01:36 +02:00

file_event_win_vscode_tunnel_renamed_execution.yml

Merge PR #4991 from @nasbench - Promote older rules status from experimental to test

2024-09-02 10:01:36 +02:00

file_event_win_webshell_creation_detect.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_werfault_dll_hijacking.yml

Merge PR #5093 from @Neo23x0 - Fix Creation of WerFault.exe/Wer.dll in Unusual Folder

2024-11-29 13:06:11 +01:00

file_event_win_winrm_awl_bypass.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_wmi_persistence_script_event_consumer_write.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_wmiexec_default_filename.yml

Merge PR #5452 from @david-syk - Update the MITRE ATT&CK tags for multiple rules

2025-06-04 14:39:25 +02:00

file_event_win_wmiprvse_wbemcomn_dll_hijack.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_wpbbin_persistence.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_writing_local_admin_share.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00