mcdave2k1 dc4456fc0f Merge PR #4619 from @mcdave2k1 - Tune false positives with IMAP & SMTP ports ...

fix: Suspicious Office Outbound Connections - Enhanced the filter by adding new ports that cause FP with SMTP and IMAP communications 
---------

Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>

2023-12-18 11:19:13 +01:00

..

builtin

Merge PR #4611 from @nasbench - Promote Older Rules Status From experimental To test

2023-12-01 12:50:36 +01:00

create_remote_thread

Merge PR #4564 from @nasbench - Fix Further FPs Found In Testing

2023-11-15 15:35:43 +01:00

create_stream_hash

Merge PR #4482 From @nasbench - Add New Automation Workflows

2023-10-18 11:53:44 +02:00

dns_query

Merge PR #4604 from @AaronHoffmannRL - Add external IP lookup API hostnames

2023-12-01 15:08:53 +01:00

driver_load

Merge PR #4482 From @nasbench - Add New Automation Workflows

2023-10-18 11:53:44 +02:00

file

Merge PR #4611 from @nasbench - Promote Older Rules Status From experimental To test

2023-12-01 12:50:36 +01:00

image_load

Merge PR #4611 from @nasbench - Promote Older Rules Status From experimental To test

2023-12-01 12:50:36 +01:00

network_connection

Merge PR #4619 from @mcdave2k1 - Tune false positives with IMAP & SMTP ports

2023-12-18 11:19:13 +01:00

pipe_created

Merge PR #4591 from @frack113 - Update tests to pySigma 0.10.9

2023-11-27 09:08:01 +01:00

powershell

Merge PR #4529 from @swachchhanda000 - Add New Rules Related To WinPwn Execution

2023-12-04 14:24:19 +01:00

process_access

Merge PR #4597 from @nasbench - Update Process Access Rules

2023-12-04 01:14:15 +01:00

process_creation

Merge PR #4627 from @phantinuss - Add additional filters to cover both program file folders

2023-12-14 19:50:25 +01:00

process_tampering

Merge PR #4597 from @nasbench - Update Process Access Rules

2023-12-04 01:14:15 +01:00

raw_access_thread

Merge PR #4597 from @nasbench - Update Process Access Rules

2023-12-04 01:14:15 +01:00

registry

Merge PR #4611 from @nasbench - Promote Older Rules Status From experimental To test

2023-12-01 12:50:36 +01:00

sysmon

Merge PR #4482 From @nasbench - Add New Automation Workflows

2023-10-18 11:53:44 +02:00

wmi_event

Merge PR #4482 From @nasbench - Add New Automation Workflows

2023-10-18 11:53:44 +02:00