2 Commits

Author	SHA1	Message	Date
Jonhnathan	b47b91b9ec	[Rule Tuning] Tighten up Indexes of Elastic Defend Windows Rules (#3549) ... * [Rule Tuning] Tighten up Indexes of Elastic Defend Windows Rules * Delete test.pkl --------- Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>	2024-04-01 20:45:12 -03:00
Samirbous	d7aff43621	[New] Suspicious Execution via ScreenConnect (#3541) ... * [New] Suspicious Execution via ScreenConnect - Suspicious ScreenConnect Client Child Process (limited to known suspicious patterns) - ScreenConnect Server Spawning Suspicious Processes (webshell access via ScreenConnect server) * Update command_and_control_screenconnect_childproc.toml * Update rules/windows/initial_access_webshell_screenconnect_server.toml * Update rules/windows/command_and_control_screenconnect_childproc.toml * Update rules/windows/command_and_control_screenconnect_childproc.toml Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> * Update command_and_control_screenconnect_childproc.toml * Update command_and_control_screenconnect_childproc.toml --------- Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>	2024-03-27 11:52:47 +00:00