Florian Roth 323a7313fd FP adjustments ... We have checked the False Positive rate in different environments and noticed these event IDs in cases in which systems had bad network connections / we accessed via VPN. Therefore we reduced the level to "high" and added that note to the "False Positives" list.		2019-05-27 08:54:18 +02:00
..
builtin	FP adjustments	2019-05-27 08:54:18 +02:00
malware	Update win_mal_ursnif.yml	2019-04-14 11:51:13 -05:00
other	Converted to use the new process_creation data source	2019-03-09 20:57:59 +03:00
powershell	Added missing tags and some minor improvements	2019-03-05 23:25:49 +01:00
process_creation	fix: fixed reference list, otherwise it's not valid string list	2019-05-10 10:37:12 +02:00
sysmon	Rule: applying recommendation	2019-05-23 09:44:25 +02:00