17 Commits

Author	SHA1	Message	Date
zikyhd	e91822e070	Fix win_etw_trace_evasion rule	2021-03-15 15:02:18 +01:00
Jonhnathan	8f6ad7df6b	Update win_etw_trace_evasion.yml	2020-10-15 09:22:13 -03:00
Jonhnathan	043033c1b7	Update win_etw_trace_evasion.yml	2020-10-13 22:59:06 -03:00
Jonhnathan	ac1a6927ad	Update win_etw_trace_evasion.yml	2020-10-13 22:55:13 -03:00
Jonhnathan	e3446b873a	Correct duplicated selection	2020-10-13 22:54:30 -03:00
Jonhnathan	b1c9871b74	Add Additional detections for other techniques	2020-10-13 22:51:48 -03:00
Jonhnathan	a01c08f617	Removed reference to deprecated rule and improve logic	2020-10-13 17:45:35 -03:00
Yugoslavskiy Daniil	1fc202fe5d	fix typos, update tags	2020-09-13 15:46:45 +02:00
aw350m3	da766a245f	att&ck tags review: windows/process_creation part 2	2020-08-29 04:39:30 +00:00
Florian Roth	80f4b4ec71	fix: rules with duplicate tags	2020-07-27 11:44:47 +02:00
Florian Roth	58b68758b4	fix: wrong MITRE ATT&CK ids used in the beta version	2020-07-14 17:53:32 +02:00
Ivan Kirillov	0fbfcc6ba9	Initial round of subtechnique updates	2020-06-16 14:46:08 -06:00
j91321	98a633e54c	Add missing status and falsepositives	2020-03-24 19:53:41 +01:00
Thomas Patzke	0592cbb67a	Added UUIDs to rules	2019-11-12 23:12:27 +01:00
Michael Wade	f70549ec54	First Pass	2019-06-13 23:15:38 -05:00
Thomas Patzke	15a4c7e477	Fixed rule	2019-05-10 00:02:20 +02:00
Nate Guagenti	60c4fed2e0	Create win_etw_trace_evasion.yml ... there are two versions of clear and two variations of set that can be used with something like wevtutil `wevtutil cl | wevtutil clear-log | wevtutil sl | wevtutil set-log ` Also, I am adding a `*` match at the end, because there are other parameters that could be placed on the end -- so unless this was used on a general search on a text/analyzed field then the `*` is necessary. example `wevtutil set-log Microsoft-Windows-WMI-Activity/Trace /e:disable /q:true`	2019-03-22 11:36:55 -04:00