42c4079ed8
att&ck tags review: windows/builtin, windows/driver_load, windows/file_event, windows/image_load, windows/other
2020-08-25 01:09:17 +02:00
80f4b4ec71
fix: rules with duplicate tags
2020-07-27 11:44:47 +02:00
58b68758b4
fix: wrong MITRE ATT&CK ids used in the beta version
2020-07-14 17:53:32 +02:00
0fbfcc6ba9
Initial round of subtechnique updates
2020-06-16 14:46:08 -06:00
e79e99c4aa
fix: fixed missing date fields in remaining files
2020-01-30 16:07:37 +01:00
0592cbb67a
Added UUIDs to rules
2019-11-12 23:12:27 +01:00
f70549ec54
First Pass
2019-06-13 23:15:38 -05:00
8e854b06f6
Specified source to prevent EventID collisions
...
Issue #263
2019-04-01 23:45:55 +02:00
2e3a2b9ba6
Merged 'Eventlog Cleared' and 'Eventlog Cleared Experimental'
2019-02-18 21:03:53 +03:00
e275d44462
Add tags to windows builtin rules
2018-07-24 07:50:32 +02:00
48441962cc
Change All "str" references to be "list"to mach schema update
2018-01-28 02:24:16 +03:00
112a0939d7
Change "reference" to "references" to match new schema
2018-01-28 02:12:19 +03:00
aad892c834
Windows Built-In rules > LogSource definition
2017-03-05 23:55:52 +01:00
52d04e52ac
Removed lists from log source section
2017-02-19 11:08:40 +01:00
cd6e24c5ff
Added "logsource" sections and new rule
2017-02-19 00:31:59 +01:00
18fd63f6b7
Levels to low, medium, high, critical
2017-02-16 18:06:22 +01:00
88270fcf2d
Rule review and cleanup
...
* removed unnecessary one element lists from definitions
* converted some lists of one element maps to maps because the resulting
OR linkage would cause wrong result.
2017-02-15 23:53:08 +01:00
a2adb1ddb5
Renamed rule files, new rules
2017-02-10 19:17:02 +01:00
Yugoslavskiy Daniil