File tree Expand file tree Collapse file tree 1 file changed +4
-0
lines changed Expand file tree Collapse file tree 1 file changed +4
-0
lines changed Original file line number Diff line number Diff line change 354
354
<DestinationHostname condition =" end with" >.microsoft.com</DestinationHostname > <!-- Microsoft:Update delivery-->
355
355
<DestinationHostname condition =" end with" >microsoft.com.akadns.net</DestinationHostname > <!-- Microsoft:Update delivery-->
356
356
<DestinationHostname condition =" end with" >microsoft.com.nsatc.net</DestinationHostname > <!-- Microsoft:Update delivery-->
357
+ <!-- Section: Loopback Addresses-->
358
+ <DestinationIp condition =" is" >127.0.0.1</DestinationIp > <!-- Credit @ITProPaul-->
359
+ <DestinationIp condition =" begin with" >fe80:0:0:0</DestinationIp > <!-- Credit @ITProPaul-->
357
360
</NetworkConnect >
358
361
</RuleGroup >
359
362
470
473
<TargetFilename condition =" end with" >.cmd</TargetFilename > <!-- Batch scripting: Batch scripts can also use the .cmd extension | Credit: @mmazanec -->
471
474
<TargetFilename condition =" end with" >.cmdline</TargetFilename > <!-- Microsoft:dotNet: Executed by cvtres.exe-->
472
475
<TargetFilename name =" T1176" condition =" end with" >.crx</TargetFilename > <!-- Chrome extension-->
476
+ <TargetFilename condition =" end with" >.dmp</TargetFilename > <!-- Process dumps [ (fr) http://blog.gentilkiwi.com/securite/mimikatz/minidump ] -->
473
477
<TargetFilename condition =" end with" >.docm</TargetFilename > <!-- Microsoft:Office:Word: Macro-->
474
478
<TargetFilename name =" DLL" condition =" end with" >.dll</TargetFilename > <!-- Microsoft:Office:Word: Macro-->
475
479
<TargetFilename name =" EXE" condition =" end with" >.exe</TargetFilename > <!-- Executable-->
You can’t perform that action at this time.
0 commit comments