frack113 c64ece9f68 More generic

2022-06-29 19:33:50 +02:00

..

registry_event_add_local_hidden_user.yml

Add "\" to "Image|endswith" modifier

2022-06-02 13:39:07 +01:00

registry_event_apt_chafer_mar18.yml

Order registry

2022-04-04 15:45:32 +02:00

registry_event_apt_leviathan.yml

Order registry

2022-04-04 15:45:32 +02:00

registry_event_apt_oceanlotus_registry.yml

refactor condition

2022-06-03 15:35:24 +02:00

registry_event_apt_pandemic.yml

Order registry

2022-04-04 15:45:32 +02:00

registry_event_bypass_via_wsreset.yml

chore: test rules: reactivate single value list check

2022-05-10 17:13:04 +02:00

registry_event_cmstp_execution_by_registry.yml

Order registry

2022-04-04 15:45:32 +02:00

registry_event_crashdump_disabled.yml

Order registry

2022-04-04 15:45:32 +02:00

registry_event_cve_2021_31979_cve_2021_33771_exploits.yml

More generic

2022-06-29 19:33:50 +02:00

registry_event_disable_security_events_logging_adding_reg_key_minint.yml

Order registry

2022-04-04 15:45:32 +02:00

registry_event_disable_wdigest_credential_guard.yml

refactor: rule level adjustments - critical to high

2022-06-18 17:43:22 +02:00

registry_event_dns_serverlevelplugindll.yml

refactor condition

2022-06-03 15:35:24 +02:00

registry_event_esentutl_volume_shadow_copy_service_keys.yml

Order registry

2022-04-04 15:45:32 +02:00

registry_event_hack_wce_reg.yml

Order registry

2022-04-04 15:45:32 +02:00

registry_event_hybridconnectionmgr_svc_installation.yml

Order registry

2022-04-04 15:45:32 +02:00

registry_event_mal_azorult.yml

Order registry

2022-04-04 15:45:32 +02:00

registry_event_mal_flowcloud.yml

Order registry

2022-04-04 15:45:32 +02:00

registry_event_mimikatz_printernightmare.yml

Order registry

2022-04-04 15:45:32 +02:00

registry_event_modify_screensaver_binary_path.yml

Order registry

2022-04-04 15:45:32 +02:00

registry_event_narrator_feedback_persistance.yml

Order registry

2022-04-04 15:45:32 +02:00

registry_event_net_ntlm_downgrade.yml

refactor: rule level adjustments - critical to high

2022-06-18 17:43:22 +02:00

registry_event_new_dll_added_to_appcertdlls_registry_key.yml

Order registry

2022-04-04 15:45:32 +02:00

registry_event_new_dll_added_to_appinit_dlls_registry_key.yml

Order registry

2022-04-04 15:45:32 +02:00

registry_event_office_test_regadd.yml

Order registry

2022-04-04 15:45:32 +02:00

registry_event_persistence_recycle_bin.yml

refactor: rule level adjustments - critical to high

2022-06-18 17:43:22 +02:00

registry_event_portproxy_registry_key.yml

Order registry

2022-04-04 15:45:32 +02:00

registry_event_redmimicry_winnti_reg.yml

Order registry

2022-04-04 15:45:32 +02:00

registry_event_runkey_winekey.yml

chore: test rules: reactivate single value list check

2022-05-10 17:13:04 +02:00

registry_event_runonce_persistence.yml

fix: FPs from fresh Windows install

2022-04-06 16:09:53 +02:00

registry_event_shell_open_keys_manipulation.yml

Order registry

2022-04-04 15:45:32 +02:00

registry_event_silentprocessexit_lsass.yml

Order registry

2022-04-04 15:45:32 +02:00

registry_event_ssp_added_lsa_config.yml

Order registry

2022-04-04 15:45:32 +02:00

registry_event_stickykey_like_backdoor.yml

Order registry

2022-04-04 15:45:32 +02:00

registry_event_susp_atbroker_change.yml

Order registry

2022-04-04 15:45:32 +02:00

registry_event_susp_download_run_key.yml

Order registry

2022-04-04 15:45:32 +02:00

registry_event_susp_lsass_dll_load.yml

fix: FPs found in win2022 domain controller baseline

2022-04-21 10:48:59 +02:00

registry_event_susp_mic_cam_access.yml

Order registry

2022-04-04 15:45:32 +02:00

registry_event_trust_record_modification.yml

Order registry

2022-04-04 15:45:32 +02:00