11 Commits

Author	SHA1	Message	Date
Jonhnathan	1c06c9e166	Update win_admin_share_access.yml ... Getting rid of '*' use	2020-10-15 15:03:31 -03:00
Yugoslavskiy Daniil	42c4079ed8	att&ck tags review: windows/builtin, windows/driver_load, windows/file_event, windows/image_load, windows/other	2020-08-25 01:09:17 +02:00
Ivan Kirillov	0fbfcc6ba9	Initial round of subtechnique updates	2020-06-16 14:46:08 -06:00
Florian Roth	e79e99c4aa	fix: fixed missing date fields in remaining files	2020-01-30 16:07:37 +01:00
Thomas Patzke	0592cbb67a	Added UUIDs to rules	2019-11-12 23:12:27 +01:00
Sherif Eldeeb	23eddafb39	Replace "logsource: description" with "definition" to match the specs	2018-11-15 09:00:06 +03:00
David Spautz	e275d44462	Add tags to windows builtin rules	2018-07-24 07:50:32 +02:00
Florian Roth	e23cdafb85	Rule: Fixed missing description	2018-06-13 00:08:46 +02:00
Thomas Patzke	a3e02ea70f	Various rule fixes ... * Field name: LogonProcess -> LogonProcessName * Field name: Message -> AuditPolicyChanges * Field name: ProcessCommandLine -> CommandLine * Removed Type match in Kerberos RC4 encryption rule Problematic because text representation not unified and audit failures are possibly interesting events * Removed field 'Severity' from rules (Redundant) * Rule decomposition of win_susp_failed_logons_single_source) because of different field names * Field name: SubjectAccountName -> SubjectUserName * Field name: TargetProcess -> TargetImage * Field name: TicketEncryption -> TicketEncryptionType * Field name: TargetFileName -> TargetFilename	2018-03-27 14:35:49 +02:00
Florian Roth	7ce958a3ed	Bugfixes and improvements	2017-03-21 10:24:20 +01:00
Florian Roth	dd558e941c	Rule: Access to ADMIN$ share	2017-03-14 14:53:03 +01:00