frack113 ffcb5855f5 Merge PR #4309 from @frack113 - New Rules & Update Related To Electron Apps Abuse ...

new: Potentially Suspicious Electron Application CommandLine
update: Suspicious Electron Application Child Processes - Increase coverage

---------

Signed-off-by: frack113 <62423083+frack113@users.noreply.github.com>
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com>

2023-09-06 15:11:19 +02:00

..

builtin

Merge PR #4392 from @tjgeorgen - Update MITRE Tags

2023-08-28 16:53:27 +02:00

create_remote_thread

feat: more updates

2023-07-28 14:32:57 +02:00

create_stream_hash

feat: update cl diag script rules

2023-08-17 19:26:21 +02:00

dns_query

feat: typo fix and remote access software rule update (#4313)

2023-06-15 11:18:20 +02:00

driver_load

feat: rules update

2023-08-07 16:09:21 +02:00

file

Merge PR #4419 from @frack113 - New Rules Related To Zone.Identifier ADS Deletion

2023-09-06 11:44:39 +02:00

image_load

fix: apply suggestions from code review

2023-08-18 15:15:26 +02:00

network_connection

Merge PR #4392 from @tjgeorgen - Update MITRE Tags

2023-08-28 16:53:27 +02:00

pipe_created

fix: typos

2023-08-08 11:06:37 +02:00

powershell

Merge PR #4392 from @tjgeorgen - Update MITRE Tags

2023-08-28 16:53:27 +02:00

process_access

fix:F multiple 404 links in references (#4332)

2023-06-26 10:10:04 +01:00

process_creation

Merge PR #4309 from @frack113 - New Rules & Update Related To Electron Apps Abuse

2023-09-06 15:11:19 +02:00

raw_access_thread

feat: new rules, updates and goofy guineapig stuff (#4229)

2023-05-15 15:53:39 +02:00

registry

Merge PR #4400 from @phantinuss - FP with visio.exe

2023-08-28 11:23:40 +02:00

sysmon

Apply suggestions from code review

2023-07-20 15:47:14 +02:00

wmi_event

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00