Florian Roth 921d46ca79 fix: FPs noticed with Aurora

2022-02-21 18:43:18 +01:00

..

silenttrinity_stager_msbuild_activity.yml

Change status for old rules

2021-11-27 11:33:14 +01:00

sysmon_dllhost_net_connections.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

sysmon_excel_outbound_network_connection.yml

Update sysmon_excel_outbound_network_connection.yml

2021-11-11 21:57:44 -05:00

sysmon_malware_backconnect_ports.yml

fix: condition in malware back connect rule

2022-02-02 13:48:56 +01:00

sysmon_notepad_network_connection.yml

Change status for old rules

2021-11-27 11:33:14 +01:00

sysmon_powershell_network_connection.yml

fix: several FPs against a fresh installed Windows with example applications and basic user interaction

2022-02-09 17:47:22 +01:00

sysmon_rdp_reverse_tunnel.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

sysmon_regsvr32_network_activity.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

sysmon_remote_powershell_session_network.yml

fix: FPs noticed with Aurora

2022-02-16 17:00:27 +01:00

sysmon_rundll32_net_connections.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

sysmon_susp_prog_location_network_connection.yml

Change status for old rules

2021-11-27 11:33:14 +01:00

sysmon_susp_rdp.yml

fix: FPs noticed with Aurora

2022-02-21 18:43:18 +01:00

sysmon_suspicious_outbound_kerberos_connection.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

sysmon_win_binary_github_com.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

sysmon_win_binary_susp_com.yml

Change status for old rules

2021-11-27 11:33:14 +01:00

sysmon_wuauclt_network_connection.yml

Change status for old rules

2021-11-27 11:33:14 +01:00

win_nc_imewdbld.yml

Redcannary windows test

2022-01-23 11:37:01 +01:00

win_nc_msiexec.yml

Windows Redcannary

2022-01-16 14:47:56 +01:00

win_nc_susp_outbound_smtp_connections.yml

fix: bugs in rules

2022-02-16 17:26:57 +01:00

win_net_crypto_mining.yml

add missing MITRE Techniques

2021-11-20 12:26:01 +01:00

win_net_mega_nz.yml

rule: Communication To Mega.nz

2021-12-06 18:35:04 +01:00

win_net_python.yml

Add windows t1046 rules

2021-12-10 16:31:16 +01:00