Add NetworkScanner Compound Target Rule and Modifications to SANS_Triage and FTPClients Target Rules #1002
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Following on from #999 I decided to create a NetworkScanner compound rule. Additionally, added Robo-FTP to the FTP Clients compound rule and added both NetworkScanner and FTPClients to SANS_Triage due to these being mentioned in the FOR528 Ransomware and Cyber Extortion Poster here
Checklist:
Please replace every instance of
[ ]
with[X]
OR click on the checkboxes after you submit your PRGUID
for my Target(s)/Module(s)Misc
folder or created a relevant subfolder with justification--tlist
/--mlist
and corrected any errorsN/A
underneath the Documentation headerIf your submission involves an SQLite database, have you considered making an SQLECmd Map for the SQLite database? If you make a Map, please add the SQLite database to the SQLiteDatabases.tkape Compound Target.
Thank you for your submission and for contributing to the DFIR community!