Jonhnathan
|
c20bce4a77
|
Update win_susp_msmpeng_crash.yml
|
2020-11-19 22:30:48 -03:00 |
|
Jonhnathan
|
9b8817f489
|
Update win_susp_msmpeng_crash.yml
|
2020-10-15 15:50:01 -03:00 |
|
Yugoslavskiy Daniil
|
42c4079ed8
|
att&ck tags review: windows/builtin, windows/driver_load, windows/file_event, windows/image_load, windows/other
|
2020-08-25 01:09:17 +02:00 |
|
Ivan Kirillov
|
0fbfcc6ba9
|
Initial round of subtechnique updates
|
2020-06-16 14:46:08 -06:00 |
|
Thomas Patzke
|
0592cbb67a
|
Added UUIDs to rules
|
2019-11-12 23:12:27 +01:00 |
|
Karneades
|
68fd20cb66
|
fix: bound windows event log rules to message field
Fixed rules
- rules/windows/builtin/win_susp_msmpeng_crash.yml
- rules/windows/builtin/win_alert_active_directory_user_control.yml
- rules/windows/builtin/win_av_relevant_match.yml
- rules/windows/builtin/win_mal_creddumper.yml
- rules/windows/builtin/win_susp_sam_dump.yml
- rules/windows/builtin/win_alert_mimikatz_keywords.yml
- rules/windows/builtin/win_alert_enable_weak_encryption.yml
|
2019-11-02 11:25:29 +01:00 |
|
Florian Roth
|
3c240be8a8
|
fix: more duplicate 'tag' keys in rules
|
2018-09-04 16:15:02 +02:00 |
|
Thomas Patzke
|
0d8bc922a3
|
Merge branch 'master' into master
|
2018-07-24 08:23:37 +02:00 |
|
David Spautz
|
e275d44462
|
Add tags to windows builtin rules
|
2018-07-24 07:50:32 +02:00 |
|
James Dickenson
|
c4edc26267
|
windows builtin mitre attack tags
|
2018-07-23 21:34:20 -07:00 |
|
scherma
|
19ba5df207
|
False positive circumstance
|
2018-06-27 21:14:38 +01:00 |
|
Thomas Patzke
|
84645f4e59
|
Simplified rule conditions with new condition constructs
|
2018-03-06 23:14:43 +01:00 |
|
SherifEldeeb
|
348728bdd9
|
Cleaning up empty list items
|
2018-01-28 02:36:39 +03:00 |
|
SherifEldeeb
|
48441962cc
|
Change All "str" references to be "list"to mach schema update
|
2018-01-28 02:24:16 +03:00 |
|
SherifEldeeb
|
112a0939d7
|
Change "reference" to "references" to match new schema
|
2018-01-28 02:12:19 +03:00 |
|
Thomas Patzke
|
300dbe8f3e
|
Fixed condition
AND has higher precedence than OR.
|
2017-05-09 23:12:02 +02:00 |
|
Florian Roth
|
565c51e5be
|
Removed "1 of" expression (no bug, but cleaner)
|
2017-05-09 22:58:42 +02:00 |
|
Florian Roth
|
a6678e199b
|
Microsoft Malware Protection Engine Crash - ref CVE-2017-0290
|
2017-05-09 22:46:57 +02:00 |
|