Florian Roth e8a6894eca Merge PR #5132 from @Neo23x0 - Update DNS Query To Remote Access Software Domain From Non-Browser App ...

update: DNS Query To Remote Access Software Domain From Non-Browser App - Add `getscreen.me`

---------

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>

2024-12-19 20:38:44 +01:00

..

builtin

Merge PR #5041 from @Koifman - Update tags for Register new Logon Process by Rubeus

2024-12-19 18:41:14 +01:00

create_remote_thread

Merge PR #5101 from @nasbench - Promote older rules status from experimental to test

2024-12-01 13:40:32 +01:00

create_stream_hash

Merge PR #5088 from @frack113 - Remove custom dedicated hash fields from sigmac

2024-11-25 09:30:14 +01:00

dns_query

Merge PR #5132 from @Neo23x0 - Update DNS Query To Remote Access Software Domain From Non-Browser App

2024-12-19 20:38:44 +01:00

driver_load

Merge PR #5088 from @frack113 - Remove custom dedicated hash fields from sigmac

2024-11-25 09:30:14 +01:00

file

Merge PR #5101 from @nasbench - Promote older rules status from experimental to test

2024-12-01 13:40:32 +01:00

image_load

Merge PR #5101 from @nasbench - Promote older rules status from experimental to test

2024-12-01 13:40:32 +01:00

network_connection

Merge PR #5101 from @nasbench - Promote older rules status from experimental to test

2024-12-01 13:40:32 +01:00

pipe_created

Merge PR #5065 from @nasbench - Promote older rules status from experimental to test

2024-11-01 10:21:04 +01:00

powershell

Merge PR #5122 from @djlukic - Fix bXOR Operator Usage In PowerShell Command Line - PowerShell Classic

2024-12-14 22:55:02 +02:00

process_access

Merge PR #5065 from @nasbench - Promote older rules status from experimental to test

2024-11-01 10:21:04 +01:00

process_creation

Merge PR #5095 from @faisalusuf - Add new rules related to QuickAssist usage

2024-12-19 18:07:19 +01:00

process_tampering

Merge PR #5027 from @nasbench - Promote older rules status from experimental to test

2024-10-01 14:56:09 +02:00

raw_access_thread

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry

Merge PR #5126 from @MalGamy12 - Update COM Object Hijacking Via Modification Of Default System CLSID Default Value

2024-12-14 21:09:33 +02:00

sysmon

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

wmi_event

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00