7 Commits

Author	SHA1	Message	Date
Thomas Patzke	986c9ff9b7	Added field names to first rules	2017-09-12 23:54:04 +02:00
Florian Roth	59821d1bcb	Office Shell: Reference added to new entry	2017-08-22 10:04:22 +02:00
Florian Roth	8f4a780c3b	Added regsvr32.exe to suspicious child processes	2017-08-20 23:14:41 +02:00
Florian Roth	edb52e098a	Extended hh.exe in Office Shell detection ... https://www.hybrid-analysis.com/sample/6abc2b63f1865a847ff7f5a9d49bb944397b36f5503b9718d6f91f93d60f7cd7?environmentId=100	2017-08-04 09:18:55 +02:00
Florian Roth	c2ed7bd9df	MSHTA Rule v1	2017-04-13 01:08:37 +02:00
Florian Roth	a0047f7c67	Sysmon as 'service' of product 'windows'	2017-03-13 09:23:08 +01:00
Michael Haag	1317fe9df2	Modifications ... + Added Sysmon detection of Office binaries spawning Windows shells + Additional web servers added for webshell detection	2017-03-04 14:22:44 -08:00