15 Commits

Author	SHA1	Message	Date
SherifEldeeb	48441962cc	Change All "str" references to be "list"to mach schema update	2018-01-28 02:24:16 +03:00
SherifEldeeb	112a0939d7	Change "reference" to "references" to match new schema	2018-01-28 02:12:19 +03:00
Florian Roth	aca70e57ec	Massive Title Cleanup	2018-01-27 10:57:30 +01:00
Thomas Patzke	720c992573	Dropped within keyword ... Covered by timeframe attribute. Fixes issue #26.	2017-10-30 00:25:56 +01:00
Thomas Patzke	03985288f6	Removed 'last' from timeframe	2017-08-05 00:32:24 +02:00
Thomas Patzke	5706361464	Parsing of "near ... within" aggregation operator ... * Operator is only parsed. No processing or passing of parsed data to backends. * Changed rule sysmon_mimikatz_inmemory_detection.yml accordingly.	2017-08-03 00:05:48 +02:00
Florian Roth	a0047f7c67	Sysmon as 'service' of product 'windows'	2017-03-13 09:23:08 +01:00
Florian Roth	8559837aab	Removed Sysmon EventLog from selection > via 'logsource'	2017-03-02 11:06:20 +01:00
Florian Roth	b4f2a74371	Proposed changes to mimimkatz-inmemory aggregation	2017-03-01 10:16:43 +01:00
Florian Roth	52d04e52ac	Removed lists from log source section	2017-02-19 11:08:40 +01:00
Florian Roth	166f207dc0	Sysmon rules 'logsource' change	2017-02-19 09:19:06 +01:00
Florian Roth	cd6e24c5ff	Added "logsource" sections and new rule	2017-02-19 00:31:59 +01:00
Florian Roth	18fd63f6b7	Levels to low, medium, high, critical	2017-02-16 18:06:22 +01:00
Thomas Patzke	88270fcf2d	Rule review and cleanup ... * removed unnecessary one element lists from definitions * converted some lists of one element maps to maps because the resulting OR linkage would cause wrong result.	2017-02-15 23:53:08 +01:00
Florian Roth	a2adb1ddb5	Renamed rule files, new rules	2017-02-10 19:17:02 +01:00