8 Commits

Author	SHA1	Message	Date
Thomas Patzke	3ef930b094	Escaped '\*' to '\\*' where required	2019-02-03 00:24:57 +01:00
megan201296	440b0ddffe	Update sysmon_susp_powershell_parent_combo.yml	2018-10-09 19:11:17 -05:00
SherifEldeeb	48441962cc	Change All "str" references to be "list"to mach schema update	2018-01-28 02:24:16 +03:00
SherifEldeeb	112a0939d7	Change "reference" to "references" to match new schema	2018-01-28 02:12:19 +03:00
Thomas Patzke	986c9ff9b7	Added field names to first rules	2017-09-12 23:54:04 +02:00
Thomas Patzke	f768bf3d61	Fixed parse errors	2017-08-02 22:49:15 +02:00
Florian Roth	e6a81623a8	PowerShell Combo - False Positive with MOM	2017-03-29 22:10:28 +02:00
Florian Roth	140141b7a2	Rule: Suspicious PowerShell parent image combination	2017-03-16 18:58:59 +01:00