frack113 8de0027ca3 refactor condition

2022-06-03 15:35:24 +02:00

..

zeek_dce_rpc_domain_user_enumeration.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

zeek_dce_rpc_mitre_bzar_execution.yml

fix: more falsepositives harmonization

2022-03-16 14:57:06 +01:00

zeek_dce_rpc_mitre_bzar_persistence.yml

fix: more falsepositives harmonization

2022-03-16 14:57:06 +01:00

zeek_dce_rpc_potential_petit_potam_efs_rpc_call.yml

refactor condition

2022-06-03 15:35:24 +02:00

zeek_dce_rpc_printnightmare_print_driver_install.yml

refactor condition

2022-06-03 15:35:24 +02:00

zeek_dce_rpc_smb_spoolss_named_pipe.yml

Missing status in rules (#2284)

2021-11-19 22:32:26 +01:00

zeek_default_cobalt_strike_certificate.yml

fix: none --> Unknown

2022-03-16 14:19:21 +01:00

zeek_dns_mining_pools.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

zeek_dns_nkn.yml

chore: test rules: capitalization on FP list entries

2022-05-09 16:07:44 +02:00

zeek_dns_susp_zbit_flag.yml

Renamed suspicious in filenames to susp

2022-05-19 09:37:04 +02:00

zeek_dns_torproxy.yml

Change double quote to quote

2022-01-06 14:02:35 +01:00

zeek_http_executable_download_from_webdav.yml

fix: unknown --> Unknown

2022-03-16 13:43:54 +01:00

zeek_http_omigod_no_auth_rce.yml

Change double quote to quote

2022-01-06 14:02:35 +01:00

zeek_http_webdav_put_request.yml

fix: unknown --> Unknown

2022-03-16 13:43:54 +01:00

zeek_rdp_public_listener.yml

unifying detection

2022-05-11 14:30:14 +00:00

zeek_smb_converted_win_atsvc_task.yml

fix: unknown --> Unknown

2022-03-16 13:43:54 +01:00

zeek_smb_converted_win_impacket_secretdump.yml

fix: remove penetration test as valid false positive reason

2022-03-16 14:33:18 +01:00

zeek_smb_converted_win_lm_namedpipe.yml

chore: test rules: capitalization on FP list entries

2022-05-09 16:07:44 +02:00

zeek_smb_converted_win_susp_psexec.yml

fix: more falsepositives harmonization

2022-03-16 14:57:06 +01:00

zeek_smb_converted_win_susp_raccess_sensitive_fext.yml

chore: test rules: warn on errors or invalid FP reasons

2022-05-09 16:07:55 +02:00

zeek_smb_converted_win_transferring_files_with_credential_data.yml

remove invalid tag

2022-01-19 18:23:30 +01:00

zeek_susp_kerberos_rc4.yml

chore: test rules: capitalization on FP list entries

2022-05-09 16:07:44 +02:00