15 Commits

Author	SHA1	Message	Date
Tareq AlKhatib	ecffe28933	Correct MITRE tag	2019-01-22 21:26:07 +03:00
Tareq AlKhatib	925ffae9b8	Removed Outlook detection which is a subset of the Office one	2019-01-02 07:47:44 +03:00
yt0ng	16160dfc80	added additional binaries and attack tactics/techniques	2018-07-23 15:47:56 +02:00
Florian Roth	d8bbf26f2c	Added msiexec to rule in order to cover new threats ... https://twitter.com/DissectMalware/status/984252467474026497	2018-04-12 09:12:50 +02:00
Florian Roth	e53826e167	Extended Sysmon Office Shell rule	2018-04-09 08:37:30 +02:00
SherifEldeeb	48441962cc	Change All "str" references to be "list"to mach schema update	2018-01-28 02:24:16 +03:00
SherifEldeeb	112a0939d7	Change "reference" to "references" to match new schema	2018-01-28 02:12:19 +03:00
Florian Roth	b7e8000ccb	Improved Office Shell rule > added 'schtasks.exe'	2017-10-25 23:53:45 +02:00
Thomas Patzke	986c9ff9b7	Added field names to first rules	2017-09-12 23:54:04 +02:00
Florian Roth	59821d1bcb	Office Shell: Reference added to new entry	2017-08-22 10:04:22 +02:00
Florian Roth	8f4a780c3b	Added regsvr32.exe to suspicious child processes	2017-08-20 23:14:41 +02:00
Florian Roth	edb52e098a	Extended hh.exe in Office Shell detection ... https://www.hybrid-analysis.com/sample/6abc2b63f1865a847ff7f5a9d49bb944397b36f5503b9718d6f91f93d60f7cd7?environmentId=100	2017-08-04 09:18:55 +02:00
Florian Roth	c2ed7bd9df	MSHTA Rule v1	2017-04-13 01:08:37 +02:00
Florian Roth	a0047f7c67	Sysmon as 'service' of product 'windows'	2017-03-13 09:23:08 +01:00
Michael Haag	1317fe9df2	Modifications ... + Added Sysmon detection of Office binaries spawning Windows shells + Additional web servers added for webshell detection	2017-03-04 14:22:44 -08:00