blue-team-tools

net_connection_susp_win_binary_no_cmdline.yml

rule: suspicious network connections no cmdline

2022-07-03 15:58:54 +02:00

net_connection_win_binary_github_com.yml

fix: more falsepositives harmonization

2022-03-16 14:57:06 +01:00

net_connection_win_binary_susp_com.yml

refactor: added transfer.sh domain

2022-08-24 16:51:26 +02:00

net_connection_win_certutil.yml

Update net_connection_win_certutil.yml

2022-09-05 11:59:15 +02:00

net_connection_win_crypto_mining.yml

Name Normalization

2022-02-27 10:58:14 +01:00

net_connection_win_dead_drop_resolvers.yml

Update net_connection_win_dead_drop_resolvers.yml

2022-08-30 08:22:10 +02:00

net_connection_win_dllhost_net_connections.yml

Update Ref+Selection

2022-07-11 14:11:53 +01:00

net_connection_win_eqnedt.yml

feat: Add rule for equation editor network connections

2022-04-14 10:50:10 +02:00

net_connection_win_excel_outbound_network_connection.yml

Update net_connection_win_excel_outbound_network_connection.yml

2022-08-29 07:21:47 +02:00

net_connection_win_imewdbld.yml

Update Ref+Selection

2022-07-11 14:11:53 +01:00

net_connection_win_malware_backconnect_ports.yml

fix: unknown --> Unknown

2022-03-16 13:43:54 +01:00

net_connection_win_mega_nz.yml

Name Normalization

2022-02-27 10:58:14 +01:00

net_connection_win_msiexec.yml

Update Ref+Selection

2022-07-11 14:11:53 +01:00

net_connection_win_ngrok_io.yml

rule: communication to ngrok.io

2022-07-16 08:15:32 +02:00

net_connection_win_notepad_network_connection.yml

fix: none --> Unknown

2022-03-16 14:19:21 +01:00

net_connection_win_powershell_network_connection.yml

New Rules + Update

2022-07-14 17:35:50 +01:00

net_connection_win_python.yml

Update net_connection_win_python.yml

2022-09-21 12:16:15 +02:00

net_connection_win_rdp_reverse_tunnel.yml

fix: unknown --> Unknown

2022-03-16 13:43:54 +01:00

net_connection_win_rdp_to_http.yml

New Rules + Update

2022-07-14 17:35:50 +01:00

net_connection_win_regsvr32_network_activity.yml

Update Ref+Selection

2022-07-11 14:11:53 +01:00

net_connection_win_remote_powershell_session_network.yml

fix backend bool conversion errors

2022-08-24 09:23:35 +09:00

net_connection_win_rundll32_net_connections.yml

fix: FPs noticed with Aurora

2022-05-02 16:25:33 +02:00

net_connection_win_script_wan.yml

refactor: add IPv6 addresses

2022-08-28 19:31:14 +02:00

net_connection_win_script.yml

Update net_connection_win_script.yml

2022-08-28 11:35:03 +02:00

net_connection_win_silenttrinity_stager_msbuild_activity.yml

fix: unknown --> Unknown

2022-03-16 13:43:54 +01:00

net_connection_win_susp_cmstp.yml

Update net_connection_win_susp_cmstp.yml

2022-08-31 09:46:18 +02:00

net_connection_win_susp_dropbox_api.yml

rule: myjino github repo compromise

2022-08-03 08:34:28 +02:00

net_connection_win_susp_outbound_kerberos_connection.yml

Renamed suspicious in filenames to susp

2022-05-19 09:37:04 +02:00

net_connection_win_susp_outbound_mobsync_connection.yml

Add "\" to "Image|endswith" modifier

2022-06-02 13:39:07 +01:00

net_connection_win_susp_outbound_smtp_connections.yml

Fix more FP in testing

2022-09-21 11:53:39 +02:00

net_connection_win_susp_prog_location_network_connection.yml

Update rules

2022-09-13 10:02:32 +02:00

net_connection_win_susp_rdp.yml

fix: FPs noticed with Aurora

2022-09-02 16:57:23 +02:00

net_connection_win_susps_epmap.yml

False positive from amazon ssm agent updater connecting to local ip address on this port

2022-07-18 19:51:00 +00:00

net_connection_win_wuauclt_network_connection.yml

Name Normalization

2022-02-27 10:58:14 +01:00