Swachchhanda Shrawan Poudel fa27f1bc54 Merge PR #5224 from @swachchhanda000 - Fix Multiple FPs ...

update: Elevated System Shell Spawned - Add `powershell_ise`
fix: Potential Binary Or Script Dropper Via PowerShell - Add filter for `C:\Windows\SystemTemp\`
fix: Python Initiated Connection - Enhance python filter
fix: Conhost Spawned By Uncommon Parent Process - Add filter for `'-k wusvcs -p -s WaaSMedicSvc`
update: Elevated System Shell Spawned From Uncommon Parent Location - Add `powershell_ise`
fix: Potential WinAPI Calls Via CommandLine - Add new filter for `CompatTelRunner`
fix: Windows Processes Suspicious Parent Directory - Add new filter for empty parent
fix: Whoami.EXE Execution Anomaly - Add new filter for empty parent
---------

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>

2025-04-07 11:05:53 +02:00

..

file_event_win_adsi_cache_creation_by_uncommon_tool.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_advanced_ip_scanner.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_anydesk_artefact.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_anydesk_writing_susp_binaries.yml

Merge PR #5207 from @swachchhanda000 - Updated Anydesk related rules

2025-03-05 00:19:19 +01:00

file_event_win_aspnet_temp_files.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_bloodhound_collection.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_create_evtx_non_common_locations.yml

Merge PR #5177 from @nasbench - promote older rules status from experimental to test

2025-02-03 18:23:12 +01:00

file_event_win_create_non_existent_dlls.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_creation_new_shim_database.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_creation_scr_binary_file.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_creation_system_dll_files.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_creation_system_file.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_creation_unquoted_service_path.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_cred_dump_tools_dropped_files.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_cscript_wscript_dropper.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_csexec_service.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_csharp_compile_artefact.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_dcom_iertutil_dll_hijack.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_dll_sideloading_space_path.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_dump_file_susp_creation.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_errorhandler_persistence.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_exchange_webshell_drop_suspicious.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_exchange_webshell_drop.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_gotoopener_artefact.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_hktl_crackmapexec_indicators.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_hktl_dumpert.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_hktl_hivenightmare_file_exports.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_hktl_inveigh_artefacts.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_hktl_krbrelay_remote_ioc.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_hktl_mimikatz_files.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_hktl_nppspy.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_hktl_powerup_dllhijacking.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_hktl_quarkspw_filedump.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_hktl_remote_cred_dump.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_hktl_safetykatz.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_initial_access_dll_search_order_hijacking.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_install_teamviewer_desktop.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_iphlpapi_dll_sideloading.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_iso_file_mount.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_iso_file_recent.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_lolbin_gather_network_info_script_output.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_lsass_default_dump_file_names.yml

Merge PR #5038 from @Neo23x0 - Update LSASS Process Memory Dump Files

2024-10-08 21:57:25 +02:00

file_event_win_lsass_shtinkering.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_lsass_werfault_dump.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_mal_adwind.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_mal_octopus_scanner.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_msdt_susp_directories.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_mysqld_uncommon_file_creation.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_net_cli_artefact.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_new_files_in_uncommon_appdata_folder.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_new_scr_file.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_notepad_plus_plus_persistence.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_ntds_dit_creation.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_ntds_dit_uncommon_parent_process.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_ntds_dit_uncommon_process.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_ntds_exfil_tools.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_office_addin_persistence.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_office_macro_files_created.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_office_macro_files_downloaded.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_office_macro_files_from_susp_process.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_office_onenote_files_in_susp_locations.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_office_onenote_susp_dropped_files.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_office_outlook_macro_creation.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_office_outlook_newform.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_office_outlook_rdp_file_creation.yml

Merge PR #5070 from @Neo23x0 - Update .RDP File Created by Outlook Process

2024-11-04 11:25:05 +01:00

file_event_win_office_outlook_susp_macro_creation.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_office_publisher_files_in_susp_locations.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_office_startup_persistence.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_office_susp_file_extension.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_office_uncommon_file_startup.yml

Merge PR #5065 from @nasbench - Promote older rules status from experimental to test

2024-11-01 10:21:04 +01:00

file_event_win_pcre_net_temp_file.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_perflogs_susp_files.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_powershell_drop_binary_or_script.yml

Merge PR #5224 from @swachchhanda000 - Fix Multiple FPs

2025-04-07 11:05:53 +02:00

file_event_win_powershell_drop_powershell.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_powershell_exploit_scripts.yml

Merge PR #5204 from @swachchhanda000 - Update Malicious PowerShell Scripts and Cmdlets Rules

2025-03-05 00:21:08 +01:00

file_event_win_powershell_module_creation.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_powershell_module_susp_creation.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_powershell_module_uncommon_creation.yml

Merge PR #4991 from @nasbench - Promote older rules status from experimental to test

2024-09-02 10:01:36 +02:00

file_event_win_powershell_startup_shortcuts.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_ps_script_policy_test_creation_by_uncommon_process.yml

Merge PR #5065 from @nasbench - Promote older rules status from experimental to test

2024-11-01 10:21:04 +01:00

file_event_win_rclone_config_files.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_rdp_file_susp_creation.yml

Merge PR #5063 from @Neo23x0 - Add & Update rules related to the suspicious creation of ".rdp" files

2024-11-01 10:47:36 +01:00

file_event_win_redmimicry_winnti_filedrop.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_regedit_print_as_pdf.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_remcom_service.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_remote_access_tools_screenconnect_artefact.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_remote_access_tools_screenconnect_remote_file.yml

Merge PR #4991 from @nasbench - Promote older rules status from experimental to test

2024-09-02 10:01:36 +02:00

file_event_win_ripzip_attack.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_sam_dump.yml

Merge PR #5007 from @fukusuket - Fix unreachable GitHub URL references

2024-09-13 11:14:11 +02:00

file_event_win_sed_file_creation.yml

Merge PR #5101 from @nasbench - Promote older rules status from experimental to test

2024-12-01 13:40:32 +01:00

file_event_win_shell_write_susp_directory.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_shell_write_susp_files_extensions.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_startup_folder_file_write.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_susp_colorcpl.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_susp_creation_by_mobsync.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_susp_default_gpo_dir_write.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_susp_desktop_ini.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_susp_desktop_txt.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_susp_desktopimgdownldr_file.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_susp_diagcab.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_susp_double_extension.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_susp_dpapi_backup_and_cert_export_ioc.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_susp_exchange_aspx_write.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_susp_executable_creation.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_susp_get_variable.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_susp_hidden_dir_index_allocation.yml

Merge PR #4991 from @nasbench - Promote older rules status from experimental to test

2024-09-02 10:01:36 +02:00

file_event_win_susp_homoglyph_filename.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_susp_legitimate_app_dropping_archive.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_susp_legitimate_app_dropping_exe.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_susp_legitimate_app_dropping_script.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_susp_lnk_double_extension.yml

Merge PR #4991 from @nasbench - Promote older rules status from experimental to test

2024-09-02 10:01:36 +02:00

file_event_win_susp_pfx_file_creation.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_susp_powershell_profile.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_susp_procexplorer_driver_created_in_tmp_folder.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_susp_public_folder_extension.yml

Merge PR #5174 from @tsale - Add Suspicious Binaries and Scripts in Public Folder

2025-01-30 21:13:42 +01:00

file_event_win_susp_recycle_bin_fake_exec.yml

Merge PR #5065 from @nasbench - Promote older rules status from experimental to test

2024-11-01 10:21:04 +01:00

file_event_win_susp_right_to_left_override_extension_spoofing.yml

Merge PR #5081 from @cod3nym - Add Potential File Extension Spoofing Using Right-to-Left Override

2024-11-18 22:43:01 +01:00

file_event_win_susp_spool_drivers_color_drop.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_susp_startup_folder_persistence.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_susp_system_interactive_powershell.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_susp_task_write.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_susp_teamviewer_remote_session.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_susp_vscode_powershell_profile.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_susp_wdac_policy_creation.yml

Merge PR #5189 from @X-Junior - Add Potentially Suspicious WDAC Policy File Creation

2025-02-17 12:46:16 +01:00

file_event_win_susp_windows_terminal_profile.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_susp_winsxs_binary_creation.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_sysinternals_livekd_default_dump_name.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_sysinternals_livekd_driver_susp_creation.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_sysinternals_livekd_driver.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_sysinternals_procexp_driver_susp_creation.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_sysinternals_procmon_driver_susp_creation.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_sysinternals_psexec_service_key.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_sysinternals_psexec_service.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_system32_local_folder_privilege_escalation.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_taskmgr_lsass_dump.yml

Merge PR #4991 from @nasbench - Promote older rules status from experimental to test

2024-09-02 10:01:36 +02:00

file_event_win_tsclient_filewrite_startup.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_uac_bypass_consent_comctl32.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_uac_bypass_dotnet_profiler.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_uac_bypass_eventvwr.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_uac_bypass_idiagnostic_profile.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_uac_bypass_ieinstal.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_uac_bypass_msconfig_gui.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_uac_bypass_ntfs_reparse_point.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_uac_bypass_winsat.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_uac_bypass_wmp.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_vhd_download_via_browsers.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_vscode_tunnel_remote_creation_artefacts.yml

Merge PR #4991 from @nasbench - Promote older rules status from experimental to test

2024-09-02 10:01:36 +02:00

file_event_win_vscode_tunnel_renamed_execution.yml

Merge PR #4991 from @nasbench - Promote older rules status from experimental to test

2024-09-02 10:01:36 +02:00

file_event_win_webshell_creation_detect.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_werfault_dll_hijacking.yml

Merge PR #5093 from @Neo23x0 - Fix Creation of WerFault.exe/Wer.dll in Unusual Folder

2024-11-29 13:06:11 +01:00

file_event_win_winrm_awl_bypass.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_wmi_persistence_script_event_consumer_write.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_wmiexec_default_filename.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_wmiprvse_wbemcomn_dll_hijack.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_wpbbin_persistence.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

file_event_win_writing_local_admin_share.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00