6 Commits

Author	SHA1	Message	Date
frack113	417da3ac95	use same trick as Invoke-Obfuscation Obfuscated IEX Invocation	2021-05-27 09:28:06 +02:00
Steven	8301b9c221	Fix selection vs selection_1 in rule files	2021-04-15 02:41:04 +02:00
Steven	ecbd730dad	Fix syntax errors in some rules	2021-04-15 02:07:43 +02:00
Steven	d263b937b4	Clean-up service: sysmon as it will be replaced by filling the category	2021-04-15 02:02:25 +02:00
OpalSec	ca09ae5039	Modification of search logic per advice from @zinint ... Edited suggested searches to improve performance: VAR+ 16ms: .*cmd.*(?:\/c|\/r).*set.*(?:\{\d\}){1,}\\\"\s+?\-f(?:.*\)){1,}.*\" 6ms: .*cmd.{0,5}(?:\/c|\/r)(?:\s|)\"set\s[a-zA-Z]{3,6}.*(?:\{\d\}){1,}\\\"\s+?\-f(?:.*\)){1,}.*\" STDIN+ 7ms: .*cmd.*(?:\/c|\/r).*powershell.+(?:\$\{?input}?|noexit).*\" 3ms: .*cmd.{0,5}(?:\/c|\/r).+powershell.+(?:\$\{?input\}?|noexit).+\" CLIP+ 28ms: .*cmd.*(?:\/c|\/r).*\|.*clip(?:\.exe)?.*&&.*clipboard]::\(\s\\\"\{\d\}.*\-f.*\" 11ms: .*cmd.{0,5}(?:\/c|\/r).+clip(?:\.exe)?.{0,4}&&.+clipboard]::\(\s\\\"\{\d\}.+\-f.+\"	2020-10-18 21:15:43 +11:00
OpalSec	ffbcb402e3	Creation of Rules for Task 24 - Invoke-Obfuscation VAR+ Launcher	2020-10-15 21:36:27 +11:00