Arnim Rupp d5de3fe5f9 more AV event and suspicious commands ... some of the AV events are duplicates to win_av_relevant_match.yml, should we clean that up or include the strings in both?		2021-01-07 17:54:19 +01:00
..
av_exploiting.yml	Merge pull request #492 from booberry46/master	2020-01-30 14:27:30 +01:00
av_password_dumper.yml	more AV event and suspicious commands	2021-01-07 17:54:19 +01:00
av_relevant_files.yml	Add scriptlets	2019-11-14 22:26:22 +01:00
av_webshell.yml	more AV event and suspicious commands	2021-01-07 17:54:19 +01:00
mal_azorult_reg.yml	Changed level to ciritcal	2020-05-11 10:40:23 +02:00
win_mal_blue_mockingbird.yml	fix: condition location	2020-05-15 12:06:34 +02:00
win_mal_flowcloud.yml	Fix rules with incorrect escaping of wildcars	2020-06-15 13:38:18 -04:00
win_mal_octopus_scanner.yml	Further subtechnique updates	2020-06-17 11:31:40 -06:00
win_mal_ryuk.yml	Added UUIDs to rules	2019-11-12 23:12:27 +01:00
win_mal_ursnif.yml	Added UUIDs to rules	2019-11-12 23:12:27 +01:00