6 Commits

Author	SHA1	Message	Date
Sherif Eldeeb	23eddafb39	Replace "logsource: description" with "definition" to match the specs	2018-11-15 09:00:06 +03:00
David Spautz	e275d44462	Add tags to windows builtin rules	2018-07-24 07:50:32 +02:00
Florian Roth	e23cdafb85	Rule: Fixed missing description	2018-06-13 00:08:46 +02:00
Thomas Patzke	a3e02ea70f	Various rule fixes ... * Field name: LogonProcess -> LogonProcessName * Field name: Message -> AuditPolicyChanges * Field name: ProcessCommandLine -> CommandLine * Removed Type match in Kerberos RC4 encryption rule Problematic because text representation not unified and audit failures are possibly interesting events * Removed field 'Severity' from rules (Redundant) * Rule decomposition of win_susp_failed_logons_single_source) because of different field names * Field name: SubjectAccountName -> SubjectUserName * Field name: TargetProcess -> TargetImage * Field name: TicketEncryption -> TicketEncryptionType * Field name: TargetFileName -> TargetFilename	2018-03-27 14:35:49 +02:00
Florian Roth	7ce958a3ed	Bugfixes and improvements	2017-03-21 10:24:20 +01:00
Florian Roth	dd558e941c	Rule: Access to ADMIN$ share	2017-03-14 14:53:03 +01:00