Closed johnk3r closed 11 months ago
Rule to detect the use of the "SetTcpEntry" API, commonly used by TA to disable EDR.
please rename to set-tcp-connection-state.yml then good to merge
set-tcp-connection-state.yml
Rule to detect the use of the "SetTcpEntry" API, commonly used by TA to disable EDR.