sigma-rules

pkexec_cve20214034

Release ER Production RTAs to DR (#2270 )

2022-09-08 12:50:39 -04:00

__init__.py

Release ER Production RTAs to DR (#2270 )

2022-09-08 12:50:39 -04:00

BadTasks.csproj

Populate RTA directory.

2020-06-29 23:07:18 -06:00

beacon.hta

Populate RTA directory.

2020-06-29 23:07:18 -06:00

cmd_from_iso.iso

[New RTA] Endpoint Rules (#2788 )

2023-06-23 16:58:30 +01:00

com.apple.ditto_and_spawn_arm

[FR] Add new macOS RTAs for Endpoint Rules (#2632 )

2023-03-24 16:53:37 -04:00

com.apple.ditto_and_spawn_intel

[FR] Add new macOS RTAs for Endpoint Rules (#2632 )

2023-03-24 16:53:37 -04:00

com.apple.sleep_arm

Release ER Production RTAs to DR (#2270 )

2022-09-08 12:50:39 -04:00

com.apple.sleep_intel

Release ER Production RTAs to DR (#2270 )

2022-09-08 12:50:39 -04:00

create_file.elf

react_sync_rta_updates_3575 (#3762 )

2024-06-06 18:45:36 +00:00

cscript.xsl

Populate RTA directory.

2020-06-29 23:07:18 -06:00

customers.xml

Populate RTA directory.

2020-06-29 23:07:18 -06:00

DoublePersist.exe

Release ER Production RTAs to DR (#2270 )

2022-09-08 12:50:39 -04:00

ExecFromISOFile.ps1

[New RTA] Endpoint Rules (#2788 )

2023-06-23 16:58:30 +01:00

faultrep.dll

[New RTA] Endpoint Rules (#2788 )

2023-06-23 16:58:30 +01:00

highentropy.txt

Release ER Production RTAs to DR (#2270 )

2022-09-08 12:50:39 -04:00

inject_arm.dylib

[FR] Add new macOS RTAs for Endpoint Rules (#2632 )

2023-03-24 16:53:37 -04:00

inject_intel.dylib

[FR] Add new macOS RTAs for Endpoint Rules (#2632 )

2023-03-24 16:53:37 -04:00

Installer.msi

Populate RTA directory.

2020-06-29 23:07:18 -06:00

Invoke-ImageLoad.ps1

Release ER Production RTAs to DR (#2270 )

2022-09-08 12:50:39 -04:00

linux.ditto_and_spawn

Release ER Production RTAs to DR (#2270 )

2022-09-08 12:50:39 -04:00

lnk_from_iso_rundll.iso

[New RTA] Endpoint Rules (#2788 )

2023-06-23 16:58:30 +01:00

LoadLib-Callback64.exe

[New RTA] Endpoint Rules (#2788 )

2023-06-23 16:58:30 +01:00

myapp_x64.exe

Populate RTA directory.

2020-06-29 23:07:18 -06:00

myapp.exe

Populate RTA directory.

2020-06-29 23:07:18 -06:00

mydll_x64.dll

Populate RTA directory.

2020-06-29 23:07:18 -06:00

mydll.dll

Populate RTA directory.

2020-06-29 23:07:18 -06:00

mydotnet.exe

Populate RTA directory.

2020-06-29 23:07:18 -06:00

mydotnet.tlb

Populate RTA directory.

2020-06-29 23:07:18 -06:00

myservice32.dll

Populate RTA directory.

2020-06-29 23:07:18 -06:00

myservice64.dll

Populate RTA directory.

2020-06-29 23:07:18 -06:00

netcon_exec_chain.elf

[New ER RTA] Potential Linux Rev Shell via Java (#2897 )

2023-06-30 14:21:06 +02:00

notepad_launch.inf

Release ER Production RTAs to DR (#2270 )

2022-09-08 12:50:39 -04:00

notepad.sct

Populate RTA directory.

2020-06-29 23:07:18 -06:00

persistent_script.vbs

Populate RTA directory.

2020-06-29 23:07:18 -06:00

ping_dns_from_iso.iso

[New RTA] Endpoint Rules (#2788 )

2023-06-23 16:58:30 +01:00

privkey.pem

Populate RTA directory.

2020-06-29 23:07:18 -06:00

PsRunner_LICENSE

Rename PsRunner_License to PsRunner_LICENSE

2020-06-30 10:04:11 -06:00

PsRunner.exe

Populate RTA directory.

2020-06-29 23:07:18 -06:00

rcedit-x64.exe

Release ER Production RTAs to DR (#2270 )

2022-09-08 12:50:39 -04:00

regsvr32.exe

Release ER Production RTAs to DR (#2270 )

2022-09-08 12:50:39 -04:00

renamed_posh.exe

Release ER Production RTAs to DR (#2270 )

2022-09-08 12:50:39 -04:00

renamed.exe

Release ER Production RTAs to DR (#2270 )

2022-09-08 12:50:39 -04:00

rta_unhook_ldrload.exe

[New RTA] Endpoint Rules (#2788 )

2023-06-23 16:58:30 +01:00

script_launch.inf

Populate RTA directory.

2020-06-29 23:07:18 -06:00

thread_injector_arm

Release ER Production RTAs to DR (#2270 )

2022-09-08 12:50:39 -04:00

thread_injector_intel

Release ER Production RTAs to DR (#2270 )

2022-09-08 12:50:39 -04:00

TrustProvider32.dll

Populate RTA directory.

2020-06-29 23:07:18 -06:00

TrustProvider64.dll

Populate RTA directory.

2020-06-29 23:07:18 -06:00

trustprovider_LICENSE

Populate RTA directory.

2020-06-29 23:07:18 -06:00

werfault_iso.iso

[New RTA] Endpoint Rules (#2788 )

2023-06-23 16:58:30 +01:00