Nasreddine Bencherchali dd9987527a fix: final fp

2023-01-19 00:49:32 +01:00

..

win_system_application_sysmon_crash.yml

Order yaml field

2022-10-25 11:08:51 +02:00

win_system_apt_carbonpaper_turla.yml

Order yaml field

2022-10-25 11:08:51 +02:00

win_system_apt_chafer_mar18_system.yml

Update Title (#3733)

2022-11-28 06:43:17 +01:00

win_system_apt_stonedrill.yml

Order yaml field

2022-10-25 11:08:51 +02:00

win_system_apt_turla_service_png.yml

Order yaml field

2022-10-25 11:08:51 +02:00

win_system_cobaltstrike_service_installs.yml

Update Title (#3733)

2022-11-28 06:43:17 +01:00

win_system_defender_disabled.yml

Order yaml field

2022-10-25 11:08:51 +02:00

win_system_eventlog_cleared.yml

fix: final fp

2023-01-19 00:49:32 +01:00

win_system_hack_smbexec.yml

Order yaml field

2022-10-25 11:08:51 +02:00

win_system_invoke_obfuscation_clip_services.yml

fix: rename links from old repo to SigmaHQ

2022-12-27 21:05:16 +01:00

win_system_invoke_obfuscation_obfuscated_iex_services.yml

Update Title (#3733)

2022-11-28 06:43:17 +01:00

win_system_invoke_obfuscation_stdin_services.yml

fix: rename links from old repo to SigmaHQ

2022-12-27 21:05:16 +01:00

win_system_invoke_obfuscation_var_services.yml

fix: rename links from old repo to SigmaHQ

2022-12-27 21:05:16 +01:00

win_system_invoke_obfuscation_via_compress_services.yml

fix: rename links from old repo to SigmaHQ

2022-12-27 21:05:16 +01:00

win_system_invoke_obfuscation_via_rundll_services.yml

fix: rename links from old repo to SigmaHQ

2022-12-27 21:05:16 +01:00

win_system_invoke_obfuscation_via_stdin_services.yml

fix: Windows Defender detection

2022-12-28 20:52:53 +01:00

win_system_invoke_obfuscation_via_use_clip_services.yml

fix: rename links from old repo to SigmaHQ

2022-12-27 21:05:16 +01:00

win_system_invoke_obfuscation_via_use_mshta_services.yml

fix: rename links from old repo to SigmaHQ

2022-12-27 21:05:16 +01:00

win_system_invoke_obfuscation_via_use_rundll32_services.yml

fix: rename links from old repo to SigmaHQ

2022-12-27 21:05:16 +01:00

win_system_invoke_obfuscation_via_var_services.yml

fix: rename links from old repo to SigmaHQ

2022-12-27 21:05:16 +01:00

win_system_kdcsvc_rc4_downgrade.yml

rule: kerberos rc4 rule

2022-11-09 09:31:31 +01:00

win_system_krbrelayup_service_installation.yml

revert: changes in krbrelay service rule

2022-11-09 09:33:37 +01:00

win_system_lpe_indicators_tabtip.yml

Fix workflow warning

2022-12-04 15:29:08 +01:00

win_system_lsasrv_ntlmv1.yml

Order yaml field

2022-10-25 11:08:51 +02:00

win_system_mal_creddumper.yml

Update Title (#3739)

2022-11-30 11:44:15 +01:00

win_system_meterpreter_or_cobaltstrike_getsystem_service_installation.yml

Update Title (#3739)

2022-11-30 11:44:15 +01:00

win_system_moriya_rootkit.yml

Update Title (#3739)

2022-11-30 11:44:15 +01:00

win_system_ntfs_vuln_exploit.yml

Promotion rules (#3821)

2022-12-27 12:29:10 +01:00

win_system_pcap_drivers.yml

feat: filename test enhancements (#3812)

2022-12-23 09:25:16 +01:00

win_system_possible_zerologon_exploitation_using_wellknown_tools.yml

Rename system rules

2022-10-14 09:04:45 +02:00

win_system_powershell_script_installed_as_service.yml

Promotion rules (#3821)

2022-12-27 12:29:10 +01:00

win_system_quarkspwdump_clearing_hive_access_history.yml

Order yaml field

2022-10-25 11:08:51 +02:00

win_system_rare_service_installs.yml

Order yaml field

2022-10-25 11:08:51 +02:00

win_system_rdp_potential_cve_2019_0708.yml

Promotion rules (#3821)

2022-12-27 12:29:10 +01:00

win_system_service_install_anydesk.yml

feat: new rules related to service creation

2022-11-28 12:09:00 +01:00

win_system_service_install_hacktools.yml

fix: broken single item lists

2022-12-08 16:23:58 +01:00

win_system_service_install_mesh_agent.yml

feat: new rules related to service creation

2022-11-28 12:09:00 +01:00

win_system_service_install_netsupport_manager.yml

New Rules

2022-10-31 20:59:33 +01:00

win_system_service_install_paexec.yml

Fix typo in selection

2022-10-27 00:12:58 +02:00

win_system_service_install_pdqdeploy_runner.yml

Order yaml field

2022-10-25 11:08:51 +02:00

win_system_service_install_pdqdeploy.yml

Order yaml field

2022-10-25 11:08:51 +02:00

win_system_service_install_psexec.yml

Rename Service Install Rules

2022-10-26 23:17:02 +02:00

win_system_service_install_remote_access_software.yml

fix: exclude teamviewer fp & reduce severity

2022-12-23 20:50:38 +01:00

win_system_service_install_remote_utilities.yml

New Rules

2022-10-31 20:59:33 +01:00

win_system_service_install_sliver.yml

Rename Service Install Rules

2022-10-26 23:17:02 +02:00

win_system_service_install_susp_double_ampersand.yml

Order yaml field

2022-10-25 11:08:51 +02:00

win_system_service_install_tacticalrmm.yml

feat: new rules related to service creation

2022-11-28 12:09:00 +01:00

win_system_susp_dhcp_config_failed.yml

Promotion rules (#3821)

2022-12-27 12:29:10 +01:00

win_system_susp_dhcp_config.yml

Promotion rules (#3821)

2022-12-27 12:29:10 +01:00

win_system_susp_eventlog_cleared.yml

fix: final fp

2023-01-19 00:49:32 +01:00

win_system_susp_proceshacker.yml

Promotion rules (#3821)

2022-12-27 12:29:10 +01:00

win_system_susp_rtcore64_service_install.yml

Order yaml field

2022-10-25 11:08:51 +02:00

win_system_susp_sam_dump.yml

Order yaml field

2022-10-25 11:08:51 +02:00

win_system_susp_service_installation_folder_pattern.yml

Order yaml field

2022-10-25 11:08:51 +02:00

win_system_susp_service_installation_folder.yml

Order yaml field

2022-10-25 11:08:51 +02:00

win_system_susp_service_installation_script.yml

feat: add missing /r to cmd

2022-11-18 13:45:01 +01:00

win_system_susp_service_installation.yml

fix: FPs in testing environment

2022-11-14 08:54:47 +01:00

win_system_susp_system_update_error.yml

Promotion rules (#3821)

2022-12-27 12:29:10 +01:00

win_system_susp_vuln_cve_2022_21919_or_cve_2021_34484.yml

Order yaml field

2022-10-25 11:08:51 +02:00

win_system_system_service_installation_by_unusal_client.yml

update logsource

2023-01-04 18:52:24 +01:00

win_system_tap_driver_installation.yml

Promotion rules (#3821)

2022-12-27 12:29:10 +01:00

win_system_volume_shadow_copy_mount.yml

Promotion rules (#3821)

2022-12-27 12:29:10 +01:00

win_system_vul_cve_2020_1472.yml

Promotion rules (#3821)

2022-12-27 12:29:10 +01:00

win_system_vul_cve_2021_42278_or_cve_2021_42287.yml

Promotion rules (#3821)

2022-12-27 12:29:10 +01:00