SigmaHQ/rules/network/zeek
Nate Guagenti 4152199073
add netbios port exclusion
netbios - every defenders nightmare and reality of FPs
2021-05-04 18:27:05 -04:00
..
zeek_dce_rpc_mitre_bzar_execution.yml docs: MITRE ATT&CK(R) trademark references removed or adjusted 2020-09-30 08:53:52 +02:00
zeek_dce_rpc_mitre_bzar_persistence.yml docs: MITRE ATT&CK(R) trademark references removed or adjusted 2020-09-30 08:53:52 +02:00
zeek_dce_rpc_smb_spoolss_named_pipe.yml 13 Rules from THP - Backlog Rules (old) 2020-10-13 03:33:55 -04:00
zeek_dns_suspicious_zbit_flag.yml add netbios port exclusion 2021-05-04 18:27:05 -04:00
zeek_http_executable_download_from_webdav.yml Update zeek_http_executable_download_from_webdav.yml 2020-10-15 23:13:20 -03:00
zeek_http_exfiltration_compressed_files.yml Fixes&improvements 2021-04-08 01:06:40 +02:00
zeek_http_webdav_put_request.yml Fixes&improvements 2021-04-08 01:06:40 +02:00
zeek_rdp_public_listener.yml att&ck tags review: web, network/zeek 2020-09-03 17:06:37 +03:00
zeek_smb_converted_win_atsvc_task.yml att&ck tags review: web, network/zeek 2020-09-03 17:06:37 +03:00
zeek_smb_converted_win_impacket_secretdump.yml Update zeek_smb_converted_win_impacket_secretdump.yml 2020-11-28 19:02:53 +01:00
zeek_smb_converted_win_lm_namedpipe.yml att&ck tags review: web, network/zeek 2020-09-03 17:06:37 +03:00
zeek_smb_converted_win_susp_psexec.yml Update zeek_smb_converted_win_susp_psexec.yml 2020-11-28 19:05:22 +01:00
zeek_smb_converted_win_susp_raccess_sensitive_fext.yml Update zeek_smb_converted_win_susp_raccess_sensitive_fext.yml 2020-10-15 23:14:34 -03:00
zeek_smb_converted_win_transferring_files_with_credential_data.yml att&ck tags review: web, network/zeek 2020-09-03 17:06:37 +03:00
zeek_susp_kerberos_rc4.yml Update zeek_susp_kerberos_rc4.yml 2020-10-15 23:15:23 -03:00
zeek-dce_rpc_domain_user_enumeration.yml att&ck tags review: web, network/zeek 2020-09-03 17:06:37 +03:00