 Thomas Patzke
|
0592cbb67a
|
Added UUIDs to rules
|
2019-11-12 23:12:27 +01:00 |
|
|
Thomas Patzke
|
d14f5c3436
|
Merge pull request #371 from savvyspoon/issue285
CAR tagging
|
2019-06-19 23:21:43 +02:00 |
|
|
Michael Wade
|
f70549ec54
|
First Pass
|
2019-06-13 23:15:38 -05:00 |
|
|
Sherif Eldeeb
|
2d22a3fe02
|
Add detection for recent Mimikatz versions
GrantedAccess is 0x1010 not 0x1410 in recent versions of mimikatz.
This modification should address both
|
2019-06-12 12:13:31 +03:00 |
|
|
Yugoslavskiy Daniil
|
05cc7e455d
|
atc review
|
2019-03-06 05:25:12 +01:00 |
|
|
Thomas Patzke
|
81515b530c
|
ATT&CK tagging QA
|
2018-09-20 12:44:44 +02:00 |
|
|
James Dickenson
|
5fc118dcac
|
added a few mitre attack tags to windows sysmon rules
|
2018-07-26 21:15:07 -07:00 |
|
|
SherifEldeeb
|
48441962cc
|
Change All "str" references to be "list"to mach schema update
|
2018-01-28 02:24:16 +03:00 |
|
|
SherifEldeeb
|
112a0939d7
|
Change "reference" to "references" to match new schema
|
2018-01-28 02:12:19 +03:00 |
|
|
Thomas Patzke
|
d7c659128c
|
Removed unneeded array
|
2017-10-18 15:12:29 +02:00 |
|
|
Florian Roth
|
a0047f7c67
|
Sysmon as 'service' of product 'windows'
|
2017-03-13 09:23:08 +01:00 |
|
|
Florian Roth
|
8559837aab
|
Removed Sysmon EventLog from selection > via 'logsource'
|
2017-03-02 11:06:20 +01:00 |
|
|
Florian Roth
|
52d04e52ac
|
Removed lists from log source section
|
2017-02-19 11:08:40 +01:00 |
|
|
Florian Roth
|
166f207dc0
|
Sysmon rules 'logsource' change
|
2017-02-19 09:19:06 +01:00 |
|
|
Florian Roth
|
cd6e24c5ff
|
Added "logsource" sections and new rule
|
2017-02-19 00:31:59 +01:00 |
|
|
Florian Roth
|
18fd63f6b7
|
Levels to low, medium, high, critical
|
2017-02-16 18:06:22 +01:00 |
|