4631d0c482
remove invalid tag
2022-01-19 18:23:30 +01:00
01dc930c17
Change status for old rules
2021-11-27 11:33:14 +01:00
aeb3218dfb
Update net_susp_dns_txt_exec_strings.yml
2020-10-15 23:11:16 -03:00
1ddba05eb2
Second round
2020-09-15 07:02:30 -06:00
880b10cce1
att&ck tags review: windows/process_creation part 1, network
2020-08-27 20:43:47 +03:00
0fbfcc6ba9
Initial round of subtechnique updates
2020-06-16 14:46:08 -06:00
d42e87edd7
fix: fixed casing and long rule titles
2020-01-30 17:26:09 +01:00
0592cbb67a
Added UUIDs to rules
2019-11-12 23:12:27 +01:00
f51e918a2e
Small rule change
2019-05-09 23:57:55 +02:00
41b4d800c5
Update net_susp_dns_txt_exec_strings.yml
...
Fixed my botched YAML syntax...
2019-04-04 08:35:37 +02:00
d0d51b6601
Update net_susp_dns_txt_exec_strings.yml
...
The references indicate that this rule should apply to TXT records, but without specifying that the "record_type" must be "TXT" there's the potential for a lot of false positives.
"record_type" was chosen as that fits with Splunks "Network Resolution (DNS)" datamodel.
2019-04-03 20:31:31 +02:00
58afccb2f3
Fixed ATT&CK tagging
2018-08-08 15:58:19 +02:00
e44b4f450e
DNS TXT Answer with possible execution strings
...
https://twitter.com/stvemillertime/status/1024707932447854592
2018-08-08 15:51:56 +02:00
frack113