Thomas Patzke a3e02ea70f Various rule fixes ... * Field name: LogonProcess -> LogonProcessName * Field name: Message -> AuditPolicyChanges * Field name: ProcessCommandLine -> CommandLine * Removed Type match in Kerberos RC4 encryption rule Problematic because text representation not unified and audit failures are possibly interesting events * Removed field 'Severity' from rules (Redundant) * Rule decomposition of win_susp_failed_logons_single_source) because of different field names * Field name: SubjectAccountName -> SubjectUserName * Field name: TargetProcess -> TargetImage * Field name: TicketEncryption -> TicketEncryptionType * Field name: TargetFileName -> TargetFilename		2018-03-27 14:35:49 +02:00
..
sysmon_malware_notpetya.yml	Simplified rule conditions with new condition constructs	2018-03-06 23:14:43 +01:00
sysmon_malware_wannacry.yml	Simplified rule conditions with new condition constructs	2018-03-06 23:14:43 +01:00
win_mal_adwind.yml	Various rule fixes	2018-03-27 14:35:49 +02:00
win_mal_wannacry.yml	Simplified rule conditions with new condition constructs	2018-03-06 23:14:43 +01:00