Merge pull request #2589 from frack113/discussions_2584

Browse Source

Move windows internal services to builtin

...

This commit is contained in:

frack113

2022-01-21 18:39:32 +01:00

committed by GitHub

parent 7dabe5e7a8 7053d42e43

commit 5f71d21dc0

30 changed files with 0 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

rules/windows/other/applocker/win_applocker_file_was_not_allowed_to_run.yml → rules/windows/builtin/applocker/win_applocker_file_was_not_allowed_to_run.yml

rules/windows/other/code_integrity/win_codeintegrity_failed_driver_load.yml → rules/windows/builtin/code_integrity/win_codeintegrity_failed_driver_load.yml

rules/windows/other/dns_server/win_apt_gallium.yml → rules/windows/builtin/dns_server/win_apt_gallium.yml

rules/windows/other/dns_server/win_susp_dns_config.yml → rules/windows/builtin/dns_server/win_susp_dns_config.yml

rules/windows/other/driverframeworks/win_usb_device_plugged.yml → rules/windows/builtin/driverframeworks/win_usb_device_plugged.yml

rules/windows/other/ldap/win_ldap_recon.yml → rules/windows/builtin/ldap/win_ldap_recon.yml

rules/windows/other/msexchange/win_exchange_cve_2021_42321.yml → rules/windows/builtin/msexchange/win_exchange_cve_2021_42321.yml

rules/windows/other/msexchange/win_exchange_proxylogon_oabvirtualdir.yml → rules/windows/builtin/msexchange/win_exchange_proxylogon_oabvirtualdir.yml

rules/windows/other/msexchange/win_exchange_proxyshell_certificate_generation.yml → rules/windows/builtin/msexchange/win_exchange_proxyshell_certificate_generation.yml

rules/windows/other/msexchange/win_exchange_proxyshell_mailbox_export.yml → rules/windows/builtin/msexchange/win_exchange_proxyshell_mailbox_export.yml

rules/windows/other/msexchange/win_exchange_proxyshell_remove_mailbox_export.yml → rules/windows/builtin/msexchange/win_exchange_proxyshell_remove_mailbox_export.yml

rules/windows/other/msexchange/win_exchange_transportagent.yml → rules/windows/builtin/msexchange/win_exchange_transportagent.yml

rules/windows/other/msexchange/win_exchange_transportagent_failed.yml → rules/windows/builtin/msexchange/win_exchange_transportagent_failed.yml

rules/windows/other/msexchange/win_set_oabvirtualdirectory_externalurl.yml → rules/windows/builtin/msexchange/win_set_oabvirtualdirectory_externalurl.yml

rules/windows/other/ntlm/win_susp_ntlm_auth.yml → rules/windows/builtin/ntlm/win_susp_ntlm_auth.yml

rules/windows/other/ntlm/win_susp_ntlm_rdp.yml → rules/windows/builtin/ntlm/win_susp_ntlm_rdp.yml

rules/windows/other/printservice/win_exploit_cve_2021_1675_printspooler.yml → rules/windows/builtin/printservice/win_exploit_cve_2021_1675_printspooler.yml

rules/windows/other/printservice/win_exploit_cve_2021_1675_printspooler_operational.yml → rules/windows/builtin/printservice/win_exploit_cve_2021_1675_printspooler_operational.yml

rules/windows/other/servicebus/win_hybridconnectionmgr_svc_running.yml → rules/windows/builtin/servicebus/win_hybridconnectionmgr_svc_running.yml

rules/windows/other/smbclient/win_susp_failed_guest_logon.yml → rules/windows/builtin/smbclient/win_susp_failed_guest_logon.yml

rules/windows/other/taskscheduler/win_rare_schtask_creation.yml → rules/windows/builtin/taskscheduler/win_rare_schtask_creation.yml

rules/windows/other/windefend/win_alert_lsass_access.yml → rules/windows/builtin/windefend/win_alert_lsass_access.yml

rules/windows/other/windefend/win_defender_amsi_trigger.yml → rules/windows/builtin/windefend/win_defender_amsi_trigger.yml

rules/windows/other/windefend/win_defender_disabled.yml → rules/windows/builtin/windefend/win_defender_disabled.yml

rules/windows/other/windefend/win_defender_exclusions.yml → rules/windows/builtin/windefend/win_defender_exclusions.yml

rules/windows/other/windefend/win_defender_history_delete.yml → rules/windows/builtin/windefend/win_defender_history_delete.yml

rules/windows/other/windefend/win_defender_psexec_wmi_asr.yml → rules/windows/builtin/windefend/win_defender_psexec_wmi_asr.yml

rules/windows/other/windefend/win_defender_tamper_protection_trigger.yml → rules/windows/builtin/windefend/win_defender_tamper_protection_trigger.yml

rules/windows/other/windefend/win_defender_threat.yml → rules/windows/builtin/windefend/win_defender_threat.yml

rules/windows/other/wmi/win_wmi_persistence.yml → rules/windows/builtin/wmi/win_wmi_persistence.yml