Florian Roth
aefd50f049
fix: avoid FPs with HTool string
2021-07-28 14:23:54 +02:00
Anton Kutepov
3f45269296
Merge branch 'oscd'
...
B
B
B
B
A
2021-03-02 22:58:41 +03:00
Arnim Rupp
d5de3fe5f9
more AV event and suspicious commands
...
some of the AV events are duplicates to win_av_relevant_match.yml, should we clean that up or include the strings in both?
2021-01-07 17:54:19 +01:00
Jonhnathan
777e49b76c
Update win_av_relevant_match.yml
2020-10-15 15:17:33 -03:00
Florian Roth
e79e99c4aa
fix: fixed missing date fields in remaining files
2020-01-30 16:07:37 +01:00
Thomas Patzke
0592cbb67a
Added UUIDs to rules
2019-11-12 23:12:27 +01:00
Karneades
68fd20cb66
fix: bound windows event log rules to message field
...
Fixed rules
- rules/windows/builtin/win_susp_msmpeng_crash.yml
- rules/windows/builtin/win_alert_active_directory_user_control.yml
- rules/windows/builtin/win_av_relevant_match.yml
- rules/windows/builtin/win_mal_creddumper.yml
- rules/windows/builtin/win_susp_sam_dump.yml
- rules/windows/builtin/win_alert_mimikatz_keywords.yml
- rules/windows/builtin/win_alert_enable_weak_encryption.yml
2019-11-02 11:25:29 +01:00
Florian Roth
aad892c834
Windows Built-In rules > LogSource definition
2017-03-05 23:55:52 +01:00
Florian Roth
52d04e52ac
Removed lists from log source section
2017-02-19 11:08:40 +01:00
Florian Roth
cd6e24c5ff
Added "logsource" sections and new rule
2017-02-19 00:31:59 +01:00
Thomas Patzke
9a38d6543f
Fixed type of condition
2017-02-16 23:49:34 +01:00
Florian Roth
18fd63f6b7
Levels to low, medium, high, critical
2017-02-16 18:06:22 +01:00
Thomas Patzke
88270fcf2d
Rule review and cleanup
...
* removed unnecessary one element lists from definitions
* converted some lists of one element maps to maps because the resulting
OR linkage would cause wrong result.
2017-02-15 23:53:08 +01:00
Florian Roth
a2adb1ddb5
Renamed rule files, new rules
2017-02-10 19:17:02 +01:00
