14 Commits

Author	SHA1	Message	Date
Thomas Patzke	3ef930b094	Escaped '\*' to '\\*' where required	2019-02-03 00:24:57 +01:00
James Dickenson	5fc118dcac	added a few mitre attack tags to windows sysmon rules	2018-07-26 21:15:07 -07:00
Thomas Patzke	dacc6ae3d3	Fieldname case: Commandline -> CommandLine	2018-03-25 23:08:28 +02:00
Florian Roth	af8be8f064	Several rule updates	2018-03-19 16:36:15 +01:00
Thomas Patzke	84645f4e59	Simplified rule conditions with new condition constructs	2018-03-06 23:14:43 +01:00
SherifEldeeb	48441962cc	Change All "str" references to be "list"to mach schema update	2018-01-28 02:24:16 +03:00
SherifEldeeb	112a0939d7	Change "reference" to "references" to match new schema	2018-01-28 02:12:19 +03:00
Thomas Patzke	986c9ff9b7	Added field names to first rules	2017-09-12 23:54:04 +02:00
secman-pl	9768f275d0	Update sysmon_susp_regsvr32_anomalies ... Rule to detect COM scriptlet invocation when wscript.exe is spawned from regsvr32.exe. example: https://www.hybrid-analysis.com/sample/f34da6d84a9663928606894fbc494cd9bf2f03c98cf0c775462802558d3a50ef?environmentId=100 SCT script code: var objShell = new ActiveXObject("WScript.shell");	2017-08-29 12:21:47 +02:00
Florian Roth	f3f2c14b3a	Added reference to regsvr32 rule	2017-08-29 08:45:29 +02:00
Florian Roth	371b41acd9	Improved regsvr32.exe whitelisting bypass rule ... thanks to Nick Carr https://twitter.com/ItsReallyNick/status/872409920938946560	2017-06-07 13:46:36 +02:00
Florian Roth	e5ad1b2f84	Improved regsvr32 whitelisting bypass rule	2017-06-07 12:02:55 +02:00
Florian Roth	1fd7a92e87	Regsvr32.exe anomalies (bugfix and new selection)	2017-06-07 11:43:25 +02:00
Florian Roth	a5c3f424c1	regsvr32 Anomalies	2017-04-16 12:02:29 +02:00