admin/SigmaHQ-sigma
1
0
Fork 0
mirror of https://github.com/SigmaHQ/sigma synced 2026-06-08 12:34:14 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
809f7abbb89ea1de7f0d81407d5bc2d974ef5107
SigmaHQ-sigma/rules/windows/powershell/powershell_module
T
History
phantinuss 809f7abbb8 fix: several FPs against a fresh installed Windows with example applications and basic user interaction 3
2022-02-11 16:38:52 +01:00
..
posh_pm_alternate_powershell_hosts.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
posh_pm_bad_opsec_artifacts.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
posh_pm_clear_powershell_history.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
posh_pm_decompress_commands.yml
Rename powershell_module
2022-01-15 10:38:27 +01:00
posh_pm_get_clipboard.yml
Rename powershell_module
2022-01-15 10:38:27 +01:00
posh_pm_invoke_obfuscation_clip.yml
Rename powershell_module
2022-01-15 10:38:27 +01:00
posh_pm_invoke_obfuscation_obfuscated_iex.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
posh_pm_invoke_obfuscation_stdin.yml
Rename powershell_module
2022-01-15 10:38:27 +01:00
posh_pm_invoke_obfuscation_var.yml
Rename powershell_module
2022-01-15 10:38:27 +01:00
posh_pm_invoke_obfuscation_via_compress.yml
Rename powershell_module
2022-01-15 10:38:27 +01:00
posh_pm_invoke_obfuscation_via_rundll.yml
Rename powershell_module
2022-01-15 10:38:27 +01:00
posh_pm_invoke_obfuscation_via_stdin.yml
Rename powershell_module
2022-01-15 10:38:27 +01:00
posh_pm_invoke_obfuscation_via_use_clip.yml
Rename powershell_module
2022-01-15 10:38:27 +01:00
posh_pm_invoke_obfuscation_via_use_mhsta.yml
Rename powershell_module
2022-01-15 10:38:27 +01:00
posh_pm_invoke_obfuscation_via_use_rundll32.yml
Rename powershell_module
2022-01-15 10:38:27 +01:00
posh_pm_invoke_obfuscation_via_var.yml
Rename powershell_module
2022-01-15 10:38:27 +01:00
posh_pm_powercat.yml
Rename powershell_module
2022-01-15 10:38:27 +01:00
posh_pm_remote_powershell_session.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
posh_pm_susp_athremotefxvgpudisablementcommand.yml
Rename powershell_module
2022-01-15 10:38:27 +01:00
posh_pm_susp_get_nettcpconnection.yml
Rename powershell_module
2022-01-15 10:38:27 +01:00
posh_pm_susp_zip_compress.yml
Rename powershell_module
2022-01-15 10:38:27 +01:00
posh_pm_suspicious_ad_group_reco.yml
Rename powershell_module
2022-01-15 10:38:27 +01:00
posh_pm_suspicious_download.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
posh_pm_suspicious_invocation_generic.yml
remove invalid tag
2022-01-19 18:23:30 +01:00
posh_pm_suspicious_invocation_specific.yml
fix: several FPs against a fresh installed Windows with example applications and basic user interaction 3
2022-02-11 16:38:52 +01:00
posh_pm_suspicious_local_group_reco.yml
Rename powershell_module
2022-01-15 10:38:27 +01:00
posh_pm_suspicious_smb_share_reco.yml
Rename powershell_module
2022-01-15 10:38:27 +01:00
posh_pm_syncappvpublishingserver_exe.yml
Rename powershell_module
2022-01-15 10:38:27 +01:00