fix(rules): Tune false positives - #660

Merged

rabbitstack merged 22 commits into

masterfrom

tune-rule-false-positives

Aug 8, 2026

Commits on Jul 27, 2026

fix(rules): Reduce Suspicious access to Windows Credential Manager files FPs
rabbitstack
committed
019615b

Commits on Aug 8, 2026

fix(rules): Reduce Suspicious access to the hosts file FPs
rabbitstack
committed
75b27d1
fix(rules): Reduce Suspicious protected process execution FPs
rabbitstack
committed
eaebedc
fix(rules): Reduce Suspicious child process integrity level FPs
rabbitstack
committed
4b73c44
fix(rules): Reduce Suspicious Vault client DLL load FPs
rabbitstack
committed
931edca
fix(rules): Reduce Potential process injection via tainted memory section FPs
rabbitstack
committed
84e9cdb
fix(rules): Reduce CldApi DLL loaded by an unusual process FPs
rabbitstack
committed
959eb13
fix(rules): Reduce Direct disk device access FPs
rabbitstack
committed
8343d1b
fix(rules): Reduce BindFlt DLL loaded by an unusual process FPs
rabbitstack
committed
7ca8be0
fix(rules): Reduce NET assembly loaded by unmanaged process FPs
rabbitstack
committed
fb0165d
fix(rules): Reduce Activation Context memory section hijacking FPs
rabbitstack
committed
c64051b
fix(rules): Reduce Process execution from hollowed memory section FPs
rabbitstack
committed
a84941f
fix(rules): Check process parent args in Clickfix phishing via browser dialog box
rabbitstack
committed
96dd14c
fix(rules): Reduce Hidden registry key creation FPs
rabbitstack
committed
ae827bd
fix(rules): Reduce Process execution from a self-deleting binary FPs
rabbitstack
committed
ab4fecf
fix(rules): Reduce Suspicious LSASS process access FPs
rabbitstack
committed
a3ead80
fix(rules): Reduce Embedded script execution via shortcut file FPs
rabbitstack
committed
8ef8bce
fix(rules): Reduce Registry access to SAM database FPs
rabbitstack
committed
ac2a615
fix(rules): Reduce File access to SAM database FPs
rabbitstack
committed
6386b72
fix(rules): Reduce Potential privilege elevation via arbitrary section creation FPs
rabbitstack
committed
30a54b8
fix(rules): Fix smss.exe typo in callstack summary
rabbitstack
committed
556b7f6
fix(rules): Remove open_file event predicate
rabbitstack
committed
9d54650

Navigation Menu

Uh oh!

fix(rules): Tune false positives - #660

fix(rules): Tune false positives#660
rabbitstack merged 22 commits into
masterfrom
tune-rule-false-positives

Commits on Jul 27, 2026

fix(rules): Reduce Suspicious access to Windows Credential Manager files FPs

Commits on Aug 8, 2026

fix(rules): Reduce Suspicious access to the hosts file FPs

fix(rules): Reduce Suspicious protected process execution FPs

fix(rules): Reduce Suspicious child process integrity level FPs

fix(rules): Reduce Suspicious Vault client DLL load FPs

fix(rules): Reduce Potential process injection via tainted memory section FPs

fix(rules): Reduce CldApi DLL loaded by an unusual process FPs

fix(rules): Reduce Direct disk device access FPs

fix(rules): Reduce BindFlt DLL loaded by an unusual process FPs

fix(rules): Reduce NET assembly loaded by unmanaged process FPs

fix(rules): Reduce Activation Context memory section hijacking FPs

fix(rules): Reduce Process execution from hollowed memory section FPs

fix(rules): Check process parent args in Clickfix phishing via browser dialog box

fix(rules): Reduce Hidden registry key creation FPs

fix(rules): Reduce Process execution from a self-deleting binary FPs

fix(rules): Reduce Suspicious LSASS process access FPs

fix(rules): Reduce Embedded script execution via shortcut file FPs

fix(rules): Reduce Registry access to SAM database FPs

fix(rules): Reduce File access to SAM database FPs

fix(rules): Reduce Potential privilege elevation via arbitrary section creation FPs

fix(rules): Fix smss.exe typo in callstack summary

fix(rules): Remove open_file event predicate