ninadgowdru 9b81293a81 rule: graduate four rules from nursery ...

Fixes #1178 by moving the .NET time delay and three thread pool injection rules out of the nursery.

2026-08-31 19:30:33 +05:30

..

bootloader

Update manipulate-boot-configuration.yml (#1026)

2025-03-16 09:15:10 -06:00

cli

fix call/thread scopes manually

2023-11-24 11:35:00 +01:00

clipboard

use "span of calls" scope (#973)

2025-01-29 10:27:13 +01:00

console

use "span of calls" scope (#973)

2025-01-29 10:27:13 +01:00

driver

fix: escape "." that are not expected to be dot operators (#1028)

2025-03-18 15:01:39 -06:00

environment-variable

use "span of calls" scope (#973)

2025-01-29 10:27:13 +01:00

file-system

reference-absolute-stream-path-on-windows: remove negative lookbehind

2026-06-12 15:09:53 +02:00

filter

Update enumerate-minifilter-drivers.yml (#1075)

2025-09-03 10:08:36 -06:00

firewall/modify

use "span of calls" scope (#973)

2025-01-29 10:27:13 +01:00

gui

reduce scopes to remove _find-taskbar_ fps

2025-03-14 16:11:53 -06:00

hardware

get-number-of-processors: add GetSystemInfo method (#1190)

2026-08-14 14:54:27 -06:00

log

use "span of calls" scope (#973)

2025-01-29 10:27:13 +01:00

memory

upgrade rules using updated script

2023-11-24 11:34:28 +01:00

mutex

add APIs to "check mutex on windows" and "create or open mutex on windows" to reduce FNs (#1031)

2025-03-20 09:00:29 -06:00

network

add rule for GetIsNetworkAvailable (#1155)

2026-05-15 12:22:25 -06:00

os

use "span of calls" scope (#973)

2025-01-29 10:27:13 +01:00

powershell

Add disable-powershell-transcription.yml and access-powershell-lockdo… (#1065)

2025-08-20 10:04:29 -06:00

process

rule: graduate four rules from nursery

2026-08-31 19:30:33 +05:30

recycle-bin

upgrade rules using updated script

2023-11-24 11:34:28 +01:00

registry

fix: add example offsets to a few rules

2026-05-07 12:13:02 +02:00

service

update create-service to detect sc.exe usage

2026-02-23 22:50:55 +05:30

session

use "span of calls" scope (#973)

2025-01-29 10:27:13 +01:00

software

upgrade rules using updated script

2023-11-24 11:34:28 +01:00

thread

use "span of calls" scope (#973)

2025-01-29 10:27:13 +01:00

uac/bypass

use "span of calls" scope (#973)

2025-01-29 10:27:13 +01:00

user

Move impersonate user from nursery (#1072)

2025-09-03 10:27:04 -06:00

wmi

move WMI persistence rule to WMI usage detection rule

2024-11-22 16:12:11 +01:00