0592cbb67a
Added UUIDs to rules
2019-11-12 23:12:27 +01:00
05cc7e455d
atc review
2019-03-06 05:25:12 +01:00
40241c1fdf
Fix 4 rules
2019-03-06 01:56:05 +03:00
3ef930b094
Escaped '\*' to '\\*' where required
2019-02-03 00:24:57 +01:00
8944be1efd
Update sysmon_susp_driver_load.yml
2018-07-13 18:36:12 -05:00
24d2d0b258
Fixed typo
2018-07-10 09:14:37 -05:00
a0047f7c67
Sysmon as 'service' of product 'windows'
2017-03-13 09:23:08 +01:00
8559837aab
Removed Sysmon EventLog from selection > via 'logsource'
2017-03-02 11:06:20 +01:00
52d04e52ac
Removed lists from log source section
2017-02-19 11:08:40 +01:00
166f207dc0
Sysmon rules 'logsource' change
2017-02-19 09:19:06 +01:00
cd6e24c5ff
Added "logsource" sections and new rule
2017-02-19 00:31:59 +01:00
18fd63f6b7
Levels to low, medium, high, critical
2017-02-16 18:06:22 +01:00
88270fcf2d
Rule review and cleanup
...
* removed unnecessary one element lists from definitions
* converted some lists of one element maps to maps because the resulting
OR linkage would cause wrong result.
2017-02-15 23:53:08 +01:00
04ea201817
New rules and cleanup
2017-02-12 15:50:39 +01:00
Thomas Patzke