phantinuss 32169dbc33 chore: harmonization of generic 'nt system' user checks ...

also a simple (non-commprehensive) test case to find
usages of localized user names

2022-05-27 15:16:31 +02:00

..

net_connection_win_binary_github_com.yml

fix: more falsepositives harmonization

2022-03-16 14:57:06 +01:00

net_connection_win_binary_susp_com.yml

fix: more falsepositives harmonization

2022-03-16 14:57:06 +01:00

net_connection_win_crypto_mining.yml

Name Normalization

2022-02-27 10:58:14 +01:00

net_connection_win_dllhost_net_connections.yml

fix: FPs found in win2022 domain controller baseline

2022-04-21 10:48:59 +02:00

net_connection_win_eqnedt.yml

feat: Add rule for equation editor network connections

2022-04-14 10:50:10 +02:00

net_connection_win_excel_outbound_network_connection.yml

Name Normalization

2022-02-27 10:58:14 +01:00

net_connection_win_imewdbld.yml

Name Normalization

2022-02-27 10:58:14 +01:00

net_connection_win_malware_backconnect_ports.yml

fix: unknown --> Unknown

2022-03-16 13:43:54 +01:00

net_connection_win_mega_nz.yml

Name Normalization

2022-02-27 10:58:14 +01:00

net_connection_win_msiexec.yml

Name Normalization

2022-02-27 10:58:14 +01:00

net_connection_win_notepad_network_connection.yml

fix: none --> Unknown

2022-03-16 14:19:21 +01:00

net_connection_win_powershell_network_connection.yml

Name Normalization

2022-02-27 10:58:14 +01:00

net_connection_win_python.yml

Name Normalization

2022-02-27 10:58:14 +01:00

net_connection_win_rdp_reverse_tunnel.yml

fix: unknown --> Unknown

2022-03-16 13:43:54 +01:00

net_connection_win_rdp_to_http.yml

rule: RDP to 80/tcp or 443/tcp

2022-04-29 12:03:07 +02:00

net_connection_win_regsvr32_network_activity.yml

fix: unknown --> Unknown

2022-03-16 13:43:54 +01:00

net_connection_win_remote_powershell_session_network.yml

chore: harmonization of generic 'nt system' user checks

2022-05-27 15:16:31 +02:00

net_connection_win_rundll32_net_connections.yml

fix: FPs noticed with Aurora

2022-05-02 16:25:33 +02:00

net_connection_win_silenttrinity_stager_msbuild_activity.yml

fix: unknown --> Unknown

2022-03-16 13:43:54 +01:00

net_connection_win_susp_dropbox_api.yml

fix: missing filter

2022-04-21 07:54:58 +02:00

net_connection_win_susp_outbound_kerberos_connection.yml

Renamed suspicious in filenames to susp

2022-05-19 09:37:04 +02:00

net_connection_win_susp_outbound_mobsync_connection.yml

Renamed suspicious in filenames to susp

2022-05-19 09:37:04 +02:00

net_connection_win_susp_outbound_smtp_connections.yml

Name Normalization

2022-02-27 10:58:14 +01:00

net_connection_win_susp_prog_location_network_connection.yml

Adjusting condition

2022-05-26 18:39:22 +00:00

net_connection_win_susp_rdp.yml

chore: test rules: capitalization on FP list entries

2022-05-09 16:07:44 +02:00

net_connection_win_wuauclt_network_connection.yml

Name Normalization

2022-02-27 10:58:14 +01:00