8 Commits

Author	SHA1	Message	Date
Florian Roth	73dfc847fc	rule: changed lsass process dump to level high	2020-02-18 10:03:25 +01:00
Florian Roth	da05c9bb82	fix: line break in description	2019-11-18 15:26:55 +01:00
Thomas Patzke	0592cbb67a	Added UUIDs to rules	2019-11-12 23:12:27 +01:00
2d4d	cf5d7f11ad	remove .exe from lsass	2019-10-14 17:26:33 +02:00
Florian Roth	5583684efd	rule: extended suspicious procdump rule	2019-10-14 16:21:37 +02:00
Michael Wade	f70549ec54	First Pass	2019-06-13 23:15:38 -05:00
Thomas Patzke	7602309138	Increased indentation to 4 ... * Converted (to generic sigma) rules * Converter outputs by default with indentation 4	2019-03-02 00:14:20 +01:00
Thomas Patzke	96eb460944	Converted Sysmon/1 and Security/4688 to generic process creation rules	2019-01-16 23:36:31 +01:00