admin/SigmaHQ-sigma
1
0
Fork 0
mirror of https://github.com/SigmaHQ/sigma synced 2026-06-08 12:34:14 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
c2045d6a9155bc5df706dca520156fc4ea448144
SigmaHQ-sigma/rules/windows/process_access
T
History
frack113 a3eed2b760 Order yaml field
2022-10-26 09:42:26 +02:00
..
proc_access_win_cmstp_execution_by_access.yml
Order yaml field
2022-10-26 09:42:26 +02:00
proc_access_win_cobaltstrike_bof_injection_pattern.yml
old experimental rule promotion
2022-10-09 16:54:04 +02:00
proc_access_win_cred_dump_lsass_access.yml
Order yaml field
2022-10-26 09:42:26 +02:00
proc_access_win_direct_syscall_ntopenprocess.yml
Order yaml field
2022-10-26 09:42:26 +02:00
proc_access_win_hack_sysmonente.yml
Order yaml field
2022-10-26 09:42:26 +02:00
proc_access_win_handlekatz_lsass_access.yml
Order yaml field
2022-10-26 09:42:26 +02:00
proc_access_win_in_memory_assembly_execution.yml
Order yaml field
2022-10-26 09:42:26 +02:00
proc_access_win_invoke_phantom.yml
Order yaml field
2022-10-26 09:42:26 +02:00
proc_access_win_lazagne_cred_dump_lsass_access.yml
Order yaml field
2022-10-26 09:42:26 +02:00
proc_access_win_littlecorporal_generated_maldoc.yml
Order yaml field
2022-10-26 09:42:26 +02:00
proc_access_win_load_undocumented_autoelevated_com_interface.yml
Order yaml field
2022-10-26 09:42:26 +02:00
proc_access_win_lsass_dump_comsvcs_dll.yml
old experimental rule promotion
2022-10-09 16:54:04 +02:00
proc_access_win_lsass_memdump_evasion.yml
Order yaml field
2022-10-26 09:42:26 +02:00
proc_access_win_lsass_memdump_indicators.yml
Order yaml field
2022-10-26 09:42:26 +02:00
proc_access_win_lsass_memdump.yml
Order yaml field
2022-10-26 09:42:26 +02:00
proc_access_win_lsass_werfault.yml
old experimental rule promotion
2022-10-09 16:54:04 +02:00
proc_access_win_malware_verclsid_shellcode.yml
Order yaml field
2022-10-26 09:42:26 +02:00
proc_access_win_mimikatz_trough_winrm.yml
Order yaml field
2022-10-26 09:42:26 +02:00
proc_access_win_pypykatz_cred_dump_lsass_access.yml
old experimental rule promotion
2022-10-09 16:54:04 +02:00
proc_access_win_rare_proc_access_lsass.yml
Order yaml field
2022-10-26 09:42:26 +02:00
proc_access_win_susp_proc_access_lsass_susp_source.yml
Order yaml field
2022-10-26 09:42:26 +02:00
proc_access_win_susp_proc_access_lsass.yml
Order yaml field
2022-10-26 09:42:26 +02:00
proc_access_win_svchost_cred_dump.yml
old experimental rule promotion
2022-10-09 16:54:04 +02:00
proc_access_win_uac_bypass_wow64_logger.yml
old experimental rule promotion
2022-10-09 16:54:04 +02:00
process_access_win_shellcode_inject_msf_empire.yml
More FP tuning
2022-10-20 11:51:06 +02:00
process_access_win_susp_seclogon.yml
Order yaml field
2022-10-26 09:42:26 +02:00