yugoslavskiy d5722979ea add rules by Daniel Bohannon

2019-11-27 00:02:45 +01:00

..

powershell_alternate_powershell_hosts.yml

added:

2019-10-24 15:48:38 +02:00

powershell_clear_powershell_history.yml

ilyas ochkov contribution

2019-10-29 03:44:22 +03:00

powershell_data_compressed.yml

Added UUIDs to rules

2019-11-12 23:12:27 +01:00

powershell_dnscat_execution.yml

add tieto dns exfil rules

2019-11-10 20:27:21 +03:00

powershell_downgrade_attack.yml

Added UUIDs to rules

2019-11-12 23:12:27 +01:00

powershell_exe_calling_ps.yml

Added UUIDs to rules

2019-11-12 23:12:27 +01:00

powershell_invoke_obfuscation_obfuscated_iex.yml

add rules by Daniel Bohannon

2019-11-27 00:02:45 +01:00

powershell_malicious_commandlets.yml

Added UUIDs to rules

2019-11-12 23:12:27 +01:00

powershell_malicious_keywords.yml

Added UUIDs to rules

2019-11-12 23:12:27 +01:00

powershell_ntfs_ads_access.yml

Added UUIDs to rules

2019-11-12 23:12:27 +01:00

powershell_prompt_credentials.yml

Added UUIDs to rules

2019-11-12 23:12:27 +01:00

powershell_psattack.yml

Added UUIDs to rules

2019-11-12 23:12:27 +01:00

powershell_remote_powershell_session.yml

oscd task #6 done.

2019-11-10 18:43:41 +03:00

powershell_shellcode_b64.yml

Added UUIDs to rules

2019-11-12 23:12:27 +01:00

powershell_suspicious_download.yml

Added UUIDs to rules

2019-11-12 23:12:27 +01:00

powershell_suspicious_invocation_generic.yml

Added UUIDs to rules

2019-11-12 23:12:27 +01:00

powershell_suspicious_invocation_specific.yml

Added UUIDs to rules

2019-11-12 23:12:27 +01:00

powershell_suspicious_keywords.yml

resolve conflicts with rule IDs; restored and deprecated sysmon_mimikatz_detection_lsass.yml

2019-11-19 02:11:19 +01:00

powershell_winlogon_helper_dll.yml

Added UUIDs to rules

2019-11-12 23:12:27 +01:00