frack113 f9c0e21323 Refactor regex

2022-03-07 19:08:30 +01:00

..

win_apt_carbonpaper_turla.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

win_apt_chafer_mar18_system.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

win_apt_stonedrill.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

win_apt_turla_service_png.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

win_cobaltstrike_service_installs.yml

Order rules

2021-12-04 10:07:07 +01:00

win_hack_smbexec.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

win_invoke_obfuscation_clip_services.yml

refactor: more regex avoidance

2022-02-03 20:05:10 +01:00

win_invoke_obfuscation_obfuscated_iex_services.yml

Change double quote to quote

2022-01-06 14:02:35 +01:00

win_invoke_obfuscation_stdin_services.yml

Order rules

2021-12-04 10:07:07 +01:00

win_invoke_obfuscation_var_services.yml

Order rules

2021-12-04 10:07:07 +01:00

win_invoke_obfuscation_via_compress_services.yml

Fix contains

2022-03-06 20:50:19 +01:00

win_invoke_obfuscation_via_rundll_services.yml

Refactor regex

2022-03-07 19:08:30 +01:00

win_invoke_obfuscation_via_stdin_services.yml

Order rules

2021-12-04 10:07:07 +01:00

win_invoke_obfuscation_via_use_clip_services.yml

Order rules

2021-12-04 10:07:07 +01:00

win_invoke_obfuscation_via_use_mshta_services.yml

refactor regex

2022-03-06 20:15:32 +01:00

win_invoke_obfuscation_via_use_rundll32_services.yml

Refactor regex

2022-03-07 19:08:30 +01:00

win_invoke_obfuscation_via_var_services.yml

Order rules

2021-12-04 10:07:07 +01:00

win_mal_creddumper.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

win_meterpreter_or_cobaltstrike_getsystem_service_installation.yml

fix: unescaped double back slashes

2022-02-01 15:57:15 +01:00

win_moriya_rootkit.yml

Order rules

2021-12-04 10:07:07 +01:00

win_ntfs_vuln_exploit.yml

Order rules

2021-12-04 10:07:07 +01:00

win_pcap_drivers.yml

Order rules

2021-12-04 10:07:07 +01:00

win_possible_zerologon_exploitation_using_wellknown_tools.yml

Order rules

2021-12-04 10:07:07 +01:00

win_powershell_script_installed_as_service.yml

Order rules

2021-12-04 10:07:07 +01:00

win_quarkspwdump_clearing_hive_access_history.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

win_rare_service_installs.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

win_rdp_potential_cve_2019_0708.yml

fix: FPs noticed with Aurora

2022-02-21 18:43:18 +01:00

win_susp_dhcp_config_failed.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

win_susp_dhcp_config.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

win_susp_proceshacker.yml

Order rules

2021-12-04 10:07:07 +01:00

win_susp_sam_dump.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

win_susp_system_update_error.yml

add win_susp_system_update_error rule

2021-12-04 13:02:12 +01:00

win_system_defender_disabled.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

win_system_susp_eventlog_cleared.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

win_tap_driver_installation.yml

Order rules

2021-12-04 10:07:07 +01:00

win_tool_psexec.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

win_volume_shadow_copy_mount.yml

fix: FPs noticed with Aurora

2022-01-08 15:12:17 +01:00

win_vul_cve_2020_1472.yml

Order rules

2021-12-04 10:07:07 +01:00

win_vul_cve_2021_42278_or_cve_2021_42287.yml

docs: removed tracking info from reference link

2021-12-27 11:52:16 +01:00