secDre4mer 46559388e0 Merge PR #4750 from @secDre4mer - Fix false positive with Potential Credential Dumping Activity Via LSASS rule ...

fix: Potential Credential Dumping Activity Via LSASS - remove legitimate access mask

2024-03-02 02:28:29 +01:00

..

proc_access_win_cmstp_execution_by_access.yml

Merge PR #4597 from @nasbench - Update Process Access Rules

2023-12-04 01:14:15 +01:00

proc_access_win_hktl_cobaltstrike_bof_injection_pattern.yml

Merge PR #4597 from @nasbench - Update Process Access Rules

2023-12-04 01:14:15 +01:00

proc_access_win_hktl_generic_access.yml

Merge PR #4597 from @nasbench - Update Process Access Rules

2023-12-04 01:14:15 +01:00

proc_access_win_hktl_handlekatz_lsass_access.yml

Merge PR #4597 from @nasbench - Update Process Access Rules

2023-12-04 01:14:15 +01:00

proc_access_win_hktl_littlecorporal_generated_maldoc.yml

Merge PR #4597 from @nasbench - Update Process Access Rules

2023-12-04 01:14:15 +01:00

proc_access_win_hktl_sysmonente.yml

Merge PR #4597 from @nasbench - Update Process Access Rules

2023-12-04 01:14:15 +01:00

proc_access_win_lsass_dump_comsvcs_dll.yml

Merge PR #4597 from @nasbench - Update Process Access Rules

2023-12-04 01:14:15 +01:00

proc_access_win_lsass_dump_keyword_image.yml

Merge PR #4597 from @nasbench - Update Process Access Rules

2023-12-04 01:14:15 +01:00

proc_access_win_lsass_memdump.yml

Merge PR #4750 from @secDre4mer - Fix false positive with Potential Credential Dumping Activity Via LSASS rule

2024-03-02 02:28:29 +01:00

proc_access_win_lsass_python_based_tool.yml

Merge PR #4597 from @nasbench - Update Process Access Rules

2023-12-04 01:14:15 +01:00

proc_access_win_lsass_remote_access_trough_winrm.yml

Merge PR #4597 from @nasbench - Update Process Access Rules

2023-12-04 01:14:15 +01:00

proc_access_win_lsass_seclogon_access.yml

Merge PR #4597 from @nasbench - Update Process Access Rules

2023-12-04 01:14:15 +01:00

proc_access_win_lsass_susp_access_flag.yml

Merge PR #4597 from @nasbench - Update Process Access Rules

2023-12-04 01:14:15 +01:00

proc_access_win_lsass_werfault.yml

Merge PR #4597 from @nasbench - Update Process Access Rules

2023-12-04 01:14:15 +01:00

proc_access_win_lsass_whitelisted_process_names.yml

Merge PR #4597 from @nasbench - Update Process Access Rules

2023-12-04 01:14:15 +01:00

proc_access_win_susp_direct_ntopenprocess_call.yml

Merge PR #4577 from @nasbench - Multiple Fixes & Updates

2023-12-21 21:04:18 +01:00

proc_access_win_susp_invoke_patchingapi.yml

Merge PR #4597 from @nasbench - Update Process Access Rules

2023-12-04 01:14:15 +01:00

proc_access_win_susp_shellcode_injection.yml

Merge PR #4681 from @nasbench - Add Missing Ref & Tags

2024-01-29 13:37:20 +01:00

proc_access_win_svchost_credential_dumping.yml

Merge PR #4597 from @nasbench - Update Process Access Rules

2023-12-04 01:14:15 +01:00

proc_access_win_svchost_susp_access_request.yml

Merge PR #4597 from @nasbench - Update Process Access Rules

2023-12-04 01:14:15 +01:00

proc_access_win_uac_bypass_editionupgrademanagerobj.yml

Merge PR #4597 from @nasbench - Update Process Access Rules

2023-12-04 01:14:15 +01:00

proc_access_win_uac_bypass_wow64_logger.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00