frack113 30979206a4 Merge PR #4435 from @frack113 - Update Fsutil Suspicious Invocation ...

update: Fsutil Suspicious Invocation - add "setZeroData" coverage

---------

Signed-off-by: frack113 <62423083+frack113@users.noreply.github.com>
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>

2023-09-11 00:30:24 +02:00

..

builtin

Merge PR #4434 from @wagga40 - Update/Fix Rule Logic

2023-09-11 00:14:25 +02:00

create_remote_thread

feat: more updates

2023-07-28 14:32:57 +02:00

create_stream_hash

feat: update cl diag script rules

2023-08-17 19:26:21 +02:00

dns_query

feat: typo fix and remote access software rule update (#4313)

2023-06-15 11:18:20 +02:00

driver_load

feat: rules update

2023-08-07 16:09:21 +02:00

file

Merge PR #4406 from @nasbench - Multiple Updates & Additions

2023-09-07 11:42:15 +02:00

image_load

Merge PR #4406 from @nasbench - Multiple Updates & Additions

2023-09-07 11:42:15 +02:00

network_connection

Merge PR #4431 from @phantinuss - Fix False Positives Found In Testing

2023-09-08 11:31:22 +02:00

pipe_created

fix: typos

2023-08-08 11:06:37 +02:00

powershell

Merge PR #4392 from @tjgeorgen - Update MITRE Tags

2023-08-28 16:53:27 +02:00

process_access

fix:F multiple 404 links in references (#4332)

2023-06-26 10:10:04 +01:00

process_creation

Merge PR #4435 from @frack113 - Update Fsutil Suspicious Invocation

2023-09-11 00:30:24 +02:00

raw_access_thread

feat: new rules, updates and goofy guineapig stuff (#4229)

2023-05-15 15:53:39 +02:00

registry

Merge PR #4406 from @nasbench - Multiple Updates & Additions

2023-09-07 11:42:15 +02:00

sysmon

Apply suggestions from code review

2023-07-20 15:47:14 +02:00

wmi_event

Merge PR #4434 from @wagga40 - Update/Fix Rule Logic

2023-09-11 00:14:25 +02:00