File tree Expand file tree Collapse file tree
Expand file tree Collapse file tree Original file line number Diff line number Diff line change 354354 <DestinationHostname condition =" end with" >.microsoft.com</DestinationHostname > <!-- Microsoft:Update delivery-->
355355 <DestinationHostname condition =" end with" >microsoft.com.akadns.net</DestinationHostname > <!-- Microsoft:Update delivery-->
356356 <DestinationHostname condition =" end with" >microsoft.com.nsatc.net</DestinationHostname > <!-- Microsoft:Update delivery-->
357+ <!-- Section: Loopback Addresses-->
358+ <DestinationIp condition =" is" >127.0.0.1</DestinationIp > <!-- Credit @ITProPaul-->
359+ <DestinationIp condition =" begin with" >fe80:0:0:0</DestinationIp > <!-- Credit @ITProPaul-->
357360 </NetworkConnect >
358361 </RuleGroup >
359362
470473 <TargetFilename condition =" end with" >.cmd</TargetFilename > <!-- Batch scripting: Batch scripts can also use the .cmd extension | Credit: @mmazanec -->
471474 <TargetFilename condition =" end with" >.cmdline</TargetFilename > <!-- Microsoft:dotNet: Executed by cvtres.exe-->
472475 <TargetFilename name =" T1176" condition =" end with" >.crx</TargetFilename > <!-- Chrome extension-->
476+ <TargetFilename condition =" end with" >.dmp</TargetFilename > <!-- Process dumps [ (fr) http://blog.gentilkiwi.com/securite/mimikatz/minidump ] -->
473477 <TargetFilename condition =" end with" >.docm</TargetFilename > <!-- Microsoft:Office:Word: Macro-->
474478 <TargetFilename name =" DLL" condition =" end with" >.dll</TargetFilename > <!-- Microsoft:Office:Word: Macro-->
475479 <TargetFilename name =" EXE" condition =" end with" >.exe</TargetFilename > <!-- Executable-->
You can’t perform that action at this time.
0 commit comments