5 Commits

Author	SHA1	Message	Date
Thomas Patzke	f51e918a2e	Small rule change	2019-05-09 23:57:55 +02:00
MadsRC	41b4d800c5	Update net_susp_dns_txt_exec_strings.yml ... Fixed my botched YAML syntax...	2019-04-04 08:35:37 +02:00
MadsRC	d0d51b6601	Update net_susp_dns_txt_exec_strings.yml ... The references indicate that this rule should apply to TXT records, but without specifying that the "record_type" must be "TXT" there's the potential for a lot of false positives. "record_type" was chosen as that fits with Splunks "Network Resolution (DNS)" datamodel.	2019-04-03 20:31:31 +02:00
Thomas Patzke	58afccb2f3	Fixed ATT&CK tagging	2018-08-08 15:58:19 +02:00
yt0ng	e44b4f450e	DNS TXT Answer with possible execution strings ... https://twitter.com/stvemillertime/status/1024707932447854592	2018-08-08 15:51:56 +02:00