Commits

Branch selector

 master

User selector

All users

Datepicker

All time

Commit History

Commits on Dec 3, 2024

• fix: FPs with NetNTLM downgrade attack (#5108)

  

  Neo23x0

  and

  nasbench

  authored
  6fd57da

• Merge PR #5107 from @mgreen27 - Update Potential Defense Evasion Via Rename Of Highly Relevant Binaries

  mgreen27

  authored
  2a0c9b5

Commits on Dec 1, 2024

• Merge PR #5106 from @nasbench - Add SID version of integrity levels

  nasbench

  authored
  6048be5

• Merge PR #5046 from @frack113 - Add Setup16.EXE Execution With Custom .Lst File

  

  frack113

  and

  nasbench

  authored
  6e71f6a

• Merge PR #5082 from @swachchhanda000 - Add Suspicious ShellExec_RunDLL Call Via Ordinal

  

  4 peopleauthored
  f39c9ac

• Merge PR #5102 from @CheraghiMilad - Update Password Policy Discovery - Linux

  

  CheraghiMilad

  and

  nasbench

  authored
  aac4335

• Merge PR #5091 from @CheraghiMilad - Update File and Directory Discovery - Linux

  

  3 peopleauthored
  c8e1d66

• Merge PR #5097 from @CheraghiMilad - Update System Owner or User Discovery - Linux

  

  CheraghiMilad

  and

  nasbench

  authored
  af41386

• Merge PR #5084 from @MalGamy12 - Update COM Object Hijacking Via Modification Of Default System CLSID Default Value

  

  MalGamy12

  and

  nasbench

  authored
  995dac1

• Merge PR #5101 from @nasbench - Promote older rules status from experimental to test

  

  github-actions[bot]

  and

  nasbench

  authored
  9367349

• Merge PR #5101 from @nasbench - Archive new rule references and update cache file

  

  github-actions[bot]

  and

  nasbench

  authored
  4075c50

Commits on Nov 29, 2024

• Merge PR #5093 from @Neo23x0 - Fix Creation of WerFault.exe/Wer.dll in Unusual Folder

  

  Neo23x0

  and

  nasbench

  authored
  374f003

Commits on Nov 25, 2024

• Merge PR #5088 from @frack113 - Remove custom dedicated hash fields from sigmac

  

  frack113

  and

  nasbench

  authored
  d804e9c

Commits on Nov 20, 2024

• Merge PR #5086 from @AlbinoGazelle - Update ESXCLI reference docs after Broadcom acquisition of VMWare

  AlbinoGazelle

  authored
  d0e4e78

• Merge PR #5054 from @gregorywychowaniec-zt - Update App Assigned To Azure RBAC/Microsoft Entra Role

  

  gregorywychowaniec-zt

  and

  nasbench

  authored
  6f4c6d7

Commits on Nov 18, 2024

• Merge PR #5081 from @cod3nym - Add Potential File Extension Spoofing Using Right-to-Left Override

  

  3 peopleauthored
  41a5914

Commits on Nov 17, 2024

• Merge PR #5061 from @dan21san - Update Mail Forwarding/Redirecting Activity In O365

  

  dan21san

  and

  nasbench

  authored
  4e9ef00

• Merge PR #5075 from @MalGamy12 - Update Potentially Suspicious Cabinet File Expansion

  

  MalGamy12

  and

  nasbench

  authored
  5aa8994

• Merge PR #5077 from @IsaacDunham - Add Potentially Suspicious Azure Front Door Connection

  

  IsaacDunham

  and

  nasbench

  authored
  503bd67

• Merge PR #5080 from @nasbench - Archive new rule references and update cache file

  

  github-actions[bot]

  and

  nasbench

  authored
  4ec3e69

Commits on Nov 13, 2024

• Merge PR #5076 from @Neo23x0 - Fix Suspicious SYSTEM User Process Creation

  Neo23x0

  authored
  5d1cf4b

Commits on Nov 4, 2024

• Merge PR #5042 from @wieso-itzi - Update Python PTY rules

  

  wieso-itzi

  and

  nasbench

  authored
  4f4ef7a

• Merge PR #5068 from @ruppde - Update rules in the Antivirus category with additional strings and signature names

  

  ruppde

  and

  nasbench

  authored
  243003c

• Merge PR #5064 from @Koifman - Add missing ATT&CK tag to Monero Crypto Coin Mining Pool Lookup

  Koifman

  authored
  cfa6d8a

• Merge PR #5070 from @Neo23x0 - Update .RDP File Created by Outlook Process

  

  Neo23x0

  and

  nasbench

  authored
  fe999a5

Commits on Nov 1, 2024

• Merge PR #5067 from @nasbench - Add missing reference links

  nasbench

  authored
  e1787da

• Merge PR #5058 from @ahmedfarou22 - Add new rules related to command execution via run dialogue

  

  ahmedfarou22

  and

  nasbench

  authored
  14ce104

• Merge PR #5051 from @nasbench - Archive new rule references and update cache file

  

  github-actions[bot]

  and

  nasbench

  authored
  04df2e4

• Merge PR #5063 from @Neo23x0 - Add & Update rules related to the suspicious creation of ".rdp" files

  

  Neo23x0

  and

  nasbench

  authored
  0cb8d0e

• Merge PR #5065 from @nasbench - Promote older rules status from experimental to test

  

  github-actions[bot]

  and

  nasbench

  authored
  f533350

• Merge PR #5052 from @dan21san - Update Potential Data Exfiltration Over SMTP Via Send-MailMessage Cmdlet

  

  3 peopleauthored
  05a4963

Commits on Oct 28, 2024

• Merge PR #5057 from @Koifman - Add Access To Browser Credential Files By Uncommon Applications - Security

  

  3 peopleauthored
  44176f0

• Merge PR #5060 from @MalGamy12 - Update Schedule Task Creation From Env Variable Or Potentially Suspicious Path Via Schtasks.EXE

  

  MalGamy12

  and

  nasbench

  authored
  ad8ab49

• Merge PR #5062 from @defensivedepth - Update README.md

  defensivedepth

  authored
  f4e563a

Commits on Oct 25, 2024

• feat: update multiple rules (#5055)

  

  X-Junior

  and

  nasbench

  authored
  7e4748e

Pagination

PreviousNext