Florian Roth 85c298c43c Bugfix in rule

2017-03-13 15:09:48 +01:00

..

sysmon_bitsadmin_download.yml

Sysmon as 'service' of product 'windows'

2017-03-13 09:23:08 +01:00

sysmon_certutil_decode.yml

Sysmon as 'service' of product 'windows'

2017-03-13 09:23:08 +01:00

sysmon_malware_verclsid_shellcode.yml

Sysmon as 'service' of product 'windows'

2017-03-13 09:23:08 +01:00

sysmon_mimikatz_detection_lsass.yml

Sysmon as 'service' of product 'windows'

2017-03-13 09:23:08 +01:00

sysmon_mimikatz_inmemory_detection.yml

Sysmon as 'service' of product 'windows'

2017-03-13 09:23:08 +01:00

sysmon_mshta_spawn_shell.yml

Sysmon as 'service' of product 'windows'

2017-03-13 09:23:08 +01:00

sysmon_office_macro_cmd.yml

Sysmon as 'service' of product 'windows'

2017-03-13 09:23:08 +01:00

sysmon_office_shell.yml

Sysmon as 'service' of product 'windows'

2017-03-13 09:23:08 +01:00

sysmon_password_dumper_lsass.yml

Sysmon as 'service' of product 'windows'

2017-03-13 09:23:08 +01:00

sysmon_powershell_download.yml

Sysmon as 'service' of product 'windows'

2017-03-13 09:23:08 +01:00

sysmon_powershell_network_connection.yml

Rule: PowerShell with network connections

2017-03-13 13:57:41 +01:00

sysmon_powershell_suspicious_parameter_combo.yml

Bugfix in rule

2017-03-13 15:09:48 +01:00

sysmon_susp_driver_load.yml

Sysmon as 'service' of product 'windows'

2017-03-13 09:23:08 +01:00

sysmon_susp_file_execution.yml

Sysmon as 'service' of product 'windows'

2017-03-13 09:23:08 +01:00

sysmon_susp_mmc_source.yml

Sysmon as 'service' of product 'windows'

2017-03-13 09:23:08 +01:00

sysmon_vssadmin_delete.yml

Sysmon as 'service' of product 'windows'

2017-03-13 09:23:08 +01:00

sysmon_vul_java_remote_debugging.yml

Sysmon as 'service' of product 'windows'

2017-03-13 09:23:08 +01:00

sysmon_webshell_detection.yml

Sysmon as 'service' of product 'windows'

2017-03-13 09:23:08 +01:00

sysmon_webshell_spawn.yml

Sysmon as 'service' of product 'windows'

2017-03-13 09:23:08 +01:00