SigmaHQ/rules/windows
2020-08-25 00:53:09 +00:00
..
builtin fix modified field 2020-08-25 01:29:57 +02:00
deprecated fix: buggy rule 2020-05-23 18:32:02 +02:00
driver_load att&ck tags review: windows/builtin, windows/driver_load, windows/file_event, windows/image_load, windows/other 2020-08-25 01:09:17 +02:00
file_event att&ck tags review: windows/builtin, windows/driver_load, windows/file_event, windows/image_load, windows/other 2020-08-25 01:09:17 +02:00
image_load att&ck tags review: windows/builtin, windows/driver_load, windows/file_event, windows/image_load, windows/other 2020-08-25 01:09:17 +02:00
malware Further subtechnique updates 2020-06-17 11:31:40 -06:00
network_connection att&ck tags review: windows/powershell, windows/process_access, windows/network_connection 2020-08-24 23:31:26 +00:00
other fix modified field 2020-08-25 01:29:57 +02:00
powershell fix duplication of key "modified" in mapping 2020-08-25 00:53:09 +00:00
process_access att&ck tags review: windows/powershell, windows/process_access, windows/network_connection 2020-08-24 23:31:26 +00:00
process_creation Update win_susp_rasdial_activity.yml 2020-08-18 14:40:37 +02:00
registry_event remove false positives in Windows being too broad and add specific keys looked at + add keys from wow64 2020-08-18 05:28:37 -04:00
sysmon Merge pull request #928 from duzvik/master 2020-08-12 17:15:27 +02:00