sigma-rules

Files

T

Samirbous 2e6b353f5e [New Rule] Potential Reverse Shell Activity via Terminal (#821 )

* [New Rule] Potential Reverse Shell Activity via Terminal

* extra reference

* adjusted process.args for coverage resilience

* Update execution_revershell_via_shell_cmd.toml

* Update rules/cross-platform/execution_revershell_via_shell_cmd.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update rules/cross-platform/execution_revershell_via_shell_cmd.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* encoded ref url

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

2021-02-08 22:57:55 +01:00

credential_access_cookies_chromium_browsers_debugging.toml

[Rule Tuning] Add windows integration index to rules (#923 )

2021-01-28 20:53:57 -09:00

defense_evasion_deleting_websvr_access_logs.toml

[Rule Tuning] Add windows integration index to rules (#923 )

2021-01-28 20:53:57 -09:00

discovery_security_software_grep.toml

[New Rule] Security Software Discovery using Grep (#743 )

2021-01-26 19:57:26 +01:00

execution_pentest_eggshell_remote_admin_tool.toml

[New Rule] EggShell Backdoor Execution (#845 )