mirror of
https://github.com/valitydev/SigmaHQ.git
synced 2024-11-07 01:45:21 +00:00
6f05e33feb
Correct a number of rules where message or keyword were incorrectly used as field names in events (typically windows event logs). However, neither field actually exists and as such these strings could never match. |
||
|---|---|---|
| .. | ||
| lnx_auditd_alter_bash_profile.yml | ||
| lnx_auditd_auditing_config_change.yml | ||
| lnx_auditd_binary_padding.yml | ||
| lnx_auditd_change_file_time_attr.yml | ||
| lnx_auditd_chattr_immutable_removal.yml | ||
| lnx_auditd_create_account.yml | ||
| lnx_auditd_cve_2021_3156_sudo_buffer_overflow.yml | ||
| lnx_auditd_dd_delete_file.yml | ||
| lnx_auditd_file_or_folder_permissions.yml | ||
| lnx_auditd_find_cred_in_files.yml | ||
| lnx_auditd_ld_so_preload_mod.yml | ||
| lnx_auditd_logging_config_change.yml | ||
| lnx_auditd_masquerading_crond.yml | ||
| lnx_auditd_password_policy_discovery.yml | ||
| lnx_auditd_pers_systemd_reload.yml | ||
| lnx_auditd_split_file_into_pieces.yml | ||
| lnx_auditd_susp_C2_commands.yml | ||
| lnx_auditd_susp_cmds.yml | ||
| lnx_auditd_susp_exe_folders.yml | ||
| lnx_auditd_susp_histfile_operations.yml | ||
| lnx_auditd_system_shutdown_reboot.yml | ||
| lnx_auditd_user_discovery.yml | ||
| lnx_auditd_web_rce.yml | ||
| lnx_data_compressed.yml | ||
| lnx_network_sniffing.yml | ||