Nasreddine Bencherchali
f61f66e745
fix: Office Macro File Download - Reduce level to low due to FPs spotted via VT. fix: Suspicious CustomShellHost Execution - Increased level to high due to low FP rate spotted via VT. fix: Explorer Process Tree Break - Fix incorrect usage of windash with the all modifier, that broke the logic. fix: MSDT Execution Via Answer File - Rename rule as well as introduce usage of windash for increased coverage. fix: Capture Credentials with Rpcping.exe - Fix incorrect usage of windash with the all modifier, that broke the logic. fix: Wlrmdr.EXE Uncommon Argument Or Child Process - Fix incorrect usage of windash with the all modifier, that broke the logic. --------- Co-authored-by: Swachchhanda Shrawan Poudel <87493836+swachchhanda000@users.noreply.github.com>
42 lines
1.1 KiB
YAML
42 lines
1.1 KiB
YAML
Rules:
|
|
- 'deprecated/**/*'
|
|
- 'rules/**/*'
|
|
- 'rules-compliance/**/*'
|
|
- 'rules-dfir/**/*'
|
|
- 'rules-emerging-threats/**/*'
|
|
- 'rules-placeholder/**/*'
|
|
- 'rules-threat-hunting/**/*'
|
|
Emerging-Threats:
|
|
- 'rules-emerging-threats/**/*'
|
|
Threat-Hunting:
|
|
- 'rules-threat-hunting/**/*'
|
|
MacOS:
|
|
- 'rules/macos/**/*'
|
|
- 'rules-compliance/macos/**/*'
|
|
- 'rules-dfir/macos/**/*'
|
|
- 'rules-emerging-threats/macos/**/*'
|
|
- 'rules-placeholder/macos/**/*'
|
|
- 'rules-threat-hunting/macos/**/*'
|
|
Windows:
|
|
- 'rules/windows/**/*'
|
|
- 'rules-compliance/windows/**/*'
|
|
- 'rules-dfir/windows/**/*'
|
|
- 'rules-emerging-threats/windows/**/*'
|
|
- 'rules-placeholder/windows/**/*'
|
|
- 'rules-threat-hunting/windows/**/*'
|
|
Linux:
|
|
- 'rules/linux/**/*'
|
|
- 'rules-compliance/linux/**/*'
|
|
- 'rules-dfir/linux/**/*'
|
|
- 'rules-emerging-threats/linux/**/*'
|
|
- 'rules-placeholder/linux/**/*'
|
|
- 'rules-threat-hunting/linux/**/*'
|
|
Maintenance:
|
|
- 'documentation/**/*'
|
|
- 'tests/**/*'
|
|
- '.github/**/*'
|
|
- 'README.md'
|
|
- 'Releases.md'
|
|
Review Needed:
|
|
- '**/*'
|