Florian Roth 35e43db7a7 fix: converted CRLF line break to LF

2020-03-25 14:36:34 +01:00

..

sysmon_ads_executable.yml

…

sysmon_alternate_powershell_hosts_moduleload.yml

fix: changed titles to avoid duplicates

2020-02-25 11:12:47 +01:00

sysmon_alternate_powershell_hosts_pipe.yml

fix: changed titles to avoid duplicates

2020-02-25 11:12:47 +01:00

sysmon_apt_oceanlotus_registry.yml

sysmon registry events fix

2020-03-09 12:02:04 -04:00

sysmon_apt_pandemic.yml

fix sysmon registry rules with HKLM/HKU format as used since 02/2017 in sysmon

2020-03-04 12:47:42 -05:00

sysmon_apt_turla_namedpipes.yml

…

sysmon_asep_reg_keys_modification.yml

…

sysmon_cactustorch.yml

…

sysmon_cmstp_execution.yml

…

sysmon_cobaltstrike_process_injection.yml

…

sysmon_createremotethread_loadlibrary.yml

…

sysmon_cred_dump_lsass_access.yml

…

sysmon_cred_dump_tools_dropped_files.yml

Update sysmon_cred_dump_tools_dropped_files.yml

2020-02-28 15:16:18 +01:00

sysmon_cred_dump_tools_named_pipes.yml

…

sysmon_dhcp_calloutdll.yml

…

sysmon_disable_security_events_logging_adding_reg_key_minint.yml

sysmon registry events fix

2020-03-09 12:02:04 -04:00

sysmon_dns_serverlevelplugindll.yml

…

sysmon_ghostpack_safetykatz.yml

…

sysmon_hack_dumpert.yml

…

sysmon_hack_wce.yml

…

sysmon_in_memory_assembly_execution.yml

…

sysmon_in_memory_powershell.yml

…

sysmon_invoke_phantom.yml

…

sysmon_logon_scripts_userinitmprlogonscript.yml

…

sysmon_lsass_memdump.yml

…

sysmon_lsass_memory_dump_file_creation.yml

…

sysmon_mal_namedpipes.yml

…

sysmon_malware_backconnect_ports.yml

…

sysmon_malware_verclsid_shellcode.yml

…

sysmon_mimikatz_inmemory_detection.yml

…

sysmon_mimikatz_trough_winrm.yml

…

sysmon_minidumwritedump_lsass.yml

…

sysmon_narrator_feedback_persistance.yml

…

sysmon_new_dll_added_to_appcertdlls_registry_key.yml

sysmon registry events fix

2020-03-09 12:02:04 -04:00

sysmon_new_dll_added_to_appinit_dlls_registry_key.yml

sysmon registry events fix

2020-03-09 12:02:04 -04:00

sysmon_password_dumper_lsass.yml

…

sysmon_possible_dns_rebinding.yml

…

sysmon_possible_privilege_escalation_via_service_registry_permissions_weakness.yml

…

sysmon_powershell_execution_moduleload.yml

…

sysmon_powershell_exploit_scripts.yml

…

sysmon_powershell_network_connection.yml

…

sysmon_quarkspw_filedump.yml

…

sysmon_raw_disk_access_using_illegitimate_tools.yml

…

sysmon_rdp_registry_modification.yml

…

sysmon_rdp_reverse_tunnel.yml

…

sysmon_rdp_settings_hijack.yml

…

sysmon_registry_persistence_key_linking.yml

sysmon registry events fix

2020-03-09 12:02:04 -04:00

sysmon_registry_trust_record_modification.yml

fix: converted CRLF line break to LF

2020-03-25 14:36:34 +01:00

sysmon_regsvr32_network_activity.yml

…

sysmon_remote_powershell_session_network.yml

…

sysmon_renamed_jusched.yml

fix: converted CRLF line break to LF

2020-03-25 14:36:34 +01:00

sysmon_renamed_powershell.yml

…

sysmon_renamed_procdump.yml

…

sysmon_renamed_psexec.yml

…

sysmon_rundll32_net_connections.yml

…

sysmon_ssp_added_lsa_config.yml

…

sysmon_stickykey_like_backdoor.yml

…

sysmon_susp_download_run_key.yml

…

sysmon_susp_driver_load.yml

…

sysmon_susp_file_characteristics.yml

…

sysmon_susp_image_load.yml

…

sysmon_susp_lsass_dll_load.yml

…

sysmon_susp_office_dotnet_assembly_dll_load.yml

fix: converted CRLF line break to LF

2020-03-25 14:36:34 +01:00

sysmon_susp_office_dotnet_clr_dll_load.yml

fix: converted CRLF line break to LF

2020-03-25 14:36:34 +01:00

sysmon_susp_office_dotnet_gac_dll_load.yml

fix: converted CRLF line break to LF

2020-03-25 14:36:34 +01:00

sysmon_susp_office_dsparse_dll_load.yml

fix: converted CRLF line break to LF

2020-03-25 14:36:34 +01:00

sysmon_susp_office_kerberos_dll_load.yml

fix: converted CRLF line break to LF

2020-03-25 14:36:34 +01:00

sysmon_susp_powershell_rundll32.yml

…

sysmon_susp_prog_location_network_connection.yml

…

sysmon_susp_rdp.yml

…

sysmon_susp_reg_persist_explorer_run.yml

sysmon registry events fix

2020-03-09 12:02:04 -04:00

sysmon_susp_run_key_img_folder.yml

fix: broader exclusion for rule - OneDrive false positives

2020-02-26 18:31:58 +01:00

sysmon_susp_winword_vbadll_load.yml

fix: converted CRLF line break to LF

2020-03-25 14:36:34 +01:00

sysmon_susp_winword_wmidll_load.yml

…

sysmon_suspicious_keyboard_layout_load.yml

sysmon registry events fix

2020-03-09 12:02:04 -04:00

sysmon_suspicious_outbound_kerberos_connection.yml

…

sysmon_suspicious_remote_thread.yml

fixing false positives

2020-02-26 09:33:55 +01:00

sysmon_svchost_dll_search_order_hijack.yml

…

sysmon_sysinternals_eula_accepted.yml

…

sysmon_tsclient_filewrite_startup.yml

…

sysmon_uac_bypass_eventvwr.yml

fix sysmon registry rules with HKLM/HKU format as used since 02/2017 in sysmon

2020-03-04 12:47:42 -05:00

sysmon_uac_bypass_sdclt.yml

sysmon registry events fix

2020-03-09 12:02:04 -04:00

sysmon_unsigned_image_loaded_into_lsass.yml

…

sysmon_webshell_creation_detect.yml

fix: wrong identifier

2020-03-03 11:25:02 +01:00

sysmon_win_binary_github_com.yml

…

sysmon_win_binary_susp_com.yml

…

sysmon_win_reg_persistence.yml

…

sysmon_wmi_event_subscription.yml

…

sysmon_wmi_module_load.yml

…

sysmon_wmi_persistence_commandline_event_consumer.yml

…

sysmon_wmi_persistence_script_event_consumer_write.yml

…

sysmon_wmi_susp_scripting.yml

…