12 Commits

Author	SHA1	Message	Date
Florian Roth	f80cf52982	Expired happens too often ... Back then when we created this rule, we noticed that "logon attempt with expired account" happens pretty often, so we decided to not include it. All event codes in this rule did not appear in a 30 day time period and therefore the rule's "level" was set to "high".	2019-03-02 07:20:59 +01:00
Vasiliy Burov	7bebedbac1	Update win_susp_failed_logon_reasons.yml ... Added descriptions for logon failure statuses and new logon failure status that may indicate suspicious logon.	2019-03-01 18:18:39 +03:00
Florian Roth	f560e83886	Added modified date	2019-03-01 12:07:31 +01:00
Florian Roth	fc683ac7ee	Added error code for denied logon type	2019-03-01 12:06:54 +01:00
David Spautz	e275d44462	Add tags to windows builtin rules	2018-07-24 07:50:32 +02:00
Thomas Patzke	6a3fcdc68c	Unified 0x values with other rules	2018-05-13 22:28:43 +02:00
Florian Roth	aad892c834	Windows Built-In rules > LogSource definition	2017-03-05 23:55:52 +01:00
Florian Roth	52d04e52ac	Removed lists from log source section	2017-02-19 11:08:40 +01:00
Florian Roth	cd6e24c5ff	Added "logsource" sections and new rule	2017-02-19 00:31:59 +01:00
Florian Roth	18fd63f6b7	Levels to low, medium, high, critical	2017-02-16 18:06:22 +01:00
Thomas Patzke	88270fcf2d	Rule review and cleanup ... * removed unnecessary one element lists from definitions * converted some lists of one element maps to maps because the resulting OR linkage would cause wrong result.	2017-02-15 23:53:08 +01:00
Florian Roth	a2adb1ddb5	Renamed rule files, new rules	2017-02-10 19:17:02 +01:00