Nasreddine Bencherchali 97856b562a Add "\" to "Image|endswith" modifier ...

- Added the "\\" (backslash) for the "(Parent)Image|endswith" modifiers to avoid possible confusion.
- The modification were mostly done on  default windows binaries to avoid changing logic of other rules.

2022-06-02 13:39:07 +01:00

..

zeek

No filetype or bodyMagic in zeek http log field

2021-11-14 09:24:34 +01:00

driver_load_invoke_obfuscation_clip+_services.yml

change to unsupported status

2021-10-29 06:53:24 +02:00

driver_load_invoke_obfuscation_obfuscated_iex_services.yml

change to unsupported status

2021-10-29 06:53:24 +02:00

driver_load_invoke_obfuscation_stdin+_services.yml

change to unsupported status

2021-10-29 06:53:24 +02:00

driver_load_invoke_obfuscation_var+_services.yml

change to unsupported status

2021-10-29 06:53:24 +02:00

driver_load_invoke_obfuscation_via_compress_services.yml

fix: unknown --> Unknown

2022-03-16 13:43:54 +01:00

driver_load_invoke_obfuscation_via_rundll_services.yml

Refactor regex

2022-03-08 19:07:37 +01:00

driver_load_invoke_obfuscation_via_stdin_services.yml

change to unsupported status

2021-10-29 06:53:24 +02:00

driver_load_invoke_obfuscation_via_use_clip_services.yml

some fixes and refactoring

2022-04-26 15:32:56 +02:00

driver_load_invoke_obfuscation_via_use_mshta_services.yml

Refactor regex

2022-03-08 19:07:37 +01:00

driver_load_invoke_obfuscation_via_use_rundll32_services.yml

Refactor regex

2022-03-08 19:07:37 +01:00

driver_load_invoke_obfuscation_via_var++_services.yml

change to unsupported status

2021-10-29 06:53:24 +02:00

driver_load_tap_driver_installation.yml

change to unsupported status

2021-10-29 06:53:24 +02:00

file_event_executable_and_script_creation_by_office_using_file_ext.yml

Add "\" to "Image|endswith" modifier

2022-06-02 13:39:07 +01:00

lnx_auditd_omigod_scx_runasprovider_executescript.yml

Fix auditd field name

2021-11-11 10:13:48 +01:00

net_dns_high_subdomain_rate.yml

change to unsupported status

2021-10-29 06:53:24 +02:00

net_dns_large_domain_name.yml

change to unsupported status

2021-10-29 06:53:24 +02:00

net_possible_dns_rebinding.yml

change to unsupported status

2021-10-29 06:53:24 +02:00

sysmon_always_install_elevated_msi_spawned_cmd_and_powershell_spawned_processes.yml

fix: remove penetration test as valid false positive reason

2022-03-16 14:33:18 +01:00

sysmon_always_install_elevated_parent_child_correlated.yml

fix: remove penetration test as valid false positive reason

2022-03-16 14:33:18 +01:00

sysmon_non_priv_program_files_move.yml

Integrity do not exist in file_event

2021-11-10 19:51:01 +01:00

sysmon_process_reimaging.yml

fix: unknown --> Unknown

2022-03-16 13:43:54 +01:00

win_access_fake_files_with_stored_credentials.yml

change to unsupported status

2021-10-29 06:53:24 +02:00

win_apt_apt29_tor.yml

fix: Service Installation 7045 field confusion

2022-03-21 11:10:03 +01:00

win_dumping_ntdsdit_via_dcsync.yml

change to unsupported status

2021-10-29 06:53:24 +02:00

win_dumping_ntdsdit_via_netsync.yml

change to unsupported status

2021-10-29 06:53:24 +02:00

win_kernel_and_3rd_party_drivers_exploits_token_stealing.yml

change to unsupported status

2021-10-29 06:53:24 +02:00

win_mal_service_installs.yml

fix: Service Installation 7045 field confusion

2022-03-21 11:10:03 +01:00

win_metasploit_or_impacket_smb_psexec_service_install.yml

fix: Service Installation 7045 field confusion

2022-03-21 11:10:03 +01:00

win_possible_privilege_escalation_using_rotten_potato.yml

change to unsupported status

2021-10-29 06:53:24 +02:00

win_remote_schtask.yml

change to unsupported status

2021-10-29 06:53:24 +02:00

win_remote_service.yml

change to unsupported status

2021-10-29 06:53:24 +02:00

win_suspicious_werfault_connection_outbound.yml

ParentImage do not exist in network_connection

2021-11-10 19:38:05 +01:00