admin/SigmaHQ-sigma
1
0
Fork 0
mirror of https://github.com/SigmaHQ/sigma synced 2026-06-08 12:34:14 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
7f83008e9ee84ce0e2bcb1474dc002b41cdfe8a5
SigmaHQ-sigma/rules/windows
T
History
Mohamed Ashraf 7f83008e9e Merge PR #5173 from @X-Junior - New rule additions and some fixes 
new: Clfs.SYS Loaded By Process Located In a Potential Suspicious Location
fix: Python Initiated Connection - Add filter for `pip install`
fix: Python Inline Command Execution - Add filter for whl package installations
---------

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
2025-02-22 23:57:41 +01:00
..
builtin
Merge PR #5176 from @GtUGtHGtNDtEUaE - Update rules covering EventID 4660
2025-01-31 18:08:59 +01:00
create_remote_thread
Merge PR #5101 from @nasbench - Promote older rules status from experimental to test
2024-12-01 13:40:32 +01:00
create_stream_hash
Merge PR #5088 from @frack113 - Remove custom dedicated hash fields from sigmac
2024-11-25 09:30:14 +01:00
dns_query
Merge PR #5149 from @nasbench - Promote older rules status from experimental to test
2025-01-06 15:36:19 +01:00
driver_load
Merge PR #5088 from @frack113 - Remove custom dedicated hash fields from sigmac
2024-11-25 09:30:14 +01:00
file
Merge PR #5189 from @X-Junior - Add Potentially Suspicious WDAC Policy File Creation
2025-02-17 12:46:16 +01:00
image_load
Merge PR #5173 from @X-Junior - New rule additions and some fixes
2025-02-22 23:57:41 +01:00
network_connection
Merge PR #5173 from @X-Junior - New rule additions and some fixes
2025-02-22 23:57:41 +01:00
pipe_created
Merge PR #5065 from @nasbench - Promote older rules status from experimental to test
2024-11-01 10:21:04 +01:00
powershell
Merge PR #5186 from @swachchhanda000 - Increase coverage of AADinternals rules
2025-02-17 12:11:55 +01:00
process_access
Merge PR #5149 from @nasbench - Promote older rules status from experimental to test
2025-01-06 15:36:19 +01:00
process_creation
Merge PR #5173 from @X-Junior - New rule additions and some fixes
2025-02-22 23:57:41 +01:00
process_tampering
Merge PR #5027 from @nasbench - Promote older rules status from experimental to test
2024-10-01 14:56:09 +02:00
raw_access_thread
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
registry
Merge PR #5182 from @Koifman - Update Windows Event Log Access Tampering Via Registry
2025-02-17 12:49:00 +01:00
sysmon
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00
wmi_event
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12 12:02:50 +02:00