8 Commits

Author	SHA1	Message	Date
Remco Hofman	48c5f2ed09	Update to sysmon_cve-2020-1048 ... Added .com executables to detection Second TargetObject should have been Details	2020-05-26 11:20:21 +02:00
Florian Roth	34006d0794	refactor: simplified and extended expression in CVE-2020-1048 rule	2020-05-23 09:16:19 +02:00
Florian Roth	57c8e63acd	refactore: split up rule for CVE-2020-1048 into 2 rules	2020-05-23 09:09:58 +02:00
Maxime Lamothe-Brassard	25d3a5a893	Remove "condition" from global rule. ... The condition field in this rule was in the global section which overwrote the condition in sub-rules and generated FPs. For example, once Sigma read the rule, the bottom sub-rule's "condition" was overwritten with "1 of them".	2020-05-17 12:44:57 -07:00
Florian Roth	a46e357874	Merge branch 'master' into rule-devel	2020-05-16 08:59:34 +02:00
Florian Roth	d5e7d4e302	fix: missing condition in CVE-2020-1048 rule	2020-05-16 08:59:05 +02:00
ecco	0575fa8d81	fix CVE 2020-1048 rule	2020-05-15 07:25:05 -04:00
Florian Roth	8e7caf0e4d	rule: CVE-2020-1048	2020-05-15 12:08:31 +02:00