13 Commits

Author	SHA1	Message	Date
Yugoslavskiy Daniil	05cc7e455d	atc review	2019-03-06 05:25:12 +01:00
mikhail	40241c1fdf	Fix 4 rules	2019-03-06 01:56:05 +03:00
Thomas Patzke	3ef930b094	Escaped '\*' to '\\*' where required	2019-02-03 00:24:57 +01:00
megan201296	8944be1efd	Update sysmon_susp_driver_load.yml	2018-07-13 18:36:12 -05:00
megan201296	24d2d0b258	Fixed typo	2018-07-10 09:14:37 -05:00
Florian Roth	a0047f7c67	Sysmon as 'service' of product 'windows'	2017-03-13 09:23:08 +01:00
Florian Roth	8559837aab	Removed Sysmon EventLog from selection > via 'logsource'	2017-03-02 11:06:20 +01:00
Florian Roth	52d04e52ac	Removed lists from log source section	2017-02-19 11:08:40 +01:00
Florian Roth	166f207dc0	Sysmon rules 'logsource' change	2017-02-19 09:19:06 +01:00
Florian Roth	cd6e24c5ff	Added "logsource" sections and new rule	2017-02-19 00:31:59 +01:00
Florian Roth	18fd63f6b7	Levels to low, medium, high, critical	2017-02-16 18:06:22 +01:00
Thomas Patzke	88270fcf2d	Rule review and cleanup ... * removed unnecessary one element lists from definitions * converted some lists of one element maps to maps because the resulting OR linkage would cause wrong result.	2017-02-15 23:53:08 +01:00
Florian Roth	04ea201817	New rules and cleanup	2017-02-12 15:50:39 +01:00