Mladia 25d7fb85d4 Update lnx_auditd_masquerading_crond.yml ...

Adapting the rule so it corresponds to the linked atomic red scenario.

2023-08-01 12:35:34 +02:00

..

lnx_auditd_audio_capture.yml

Remove mitre url

2023-01-10 18:09:04 +01:00

lnx_auditd_auditing_config_change.yml

Order yaml field

2022-10-25 08:53:44 +02:00

lnx_auditd_binary_padding.yml

Update lnx_auditd_binary_padding.yml

2023-05-03 01:09:55 +02:00

lnx_auditd_bpfdoor_file_accessed.yml

Order yaml field

2022-10-25 08:53:44 +02:00

lnx_auditd_bpfdoor_port_redirect.yml

Order yaml field

2022-10-25 08:53:44 +02:00

lnx_auditd_capabilities_discovery.yml

Promotion rules (#3821)

2022-12-27 12:29:10 +01:00

lnx_auditd_change_file_time_attr.yml

Update title (#3734)

2022-11-29 07:36:45 +01:00

lnx_auditd_chattr_immutable_removal.yml

Update Title (#3731)

2022-11-27 19:19:27 +01:00

lnx_auditd_clipboard_collection.yml

Remove mitre url

2023-01-10 18:09:04 +01:00

lnx_auditd_clipboard_image_collection.yml

Remove mitre url

2023-01-10 18:09:04 +01:00

lnx_auditd_coinminer.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

lnx_auditd_create_account.yml

fix: typo in comment

2022-12-20 22:28:49 +01:00

lnx_auditd_data_compressed.yml

feat: more updates

2023-07-28 14:32:57 +02:00

lnx_auditd_data_exfil_wget.yml

fix: remove tactic links

2023-01-10 19:20:31 +01:00

lnx_auditd_dd_delete_file.yml

Order yaml field

2022-10-25 08:53:44 +02:00

lnx_auditd_disable_system_firewall.yml

change status to test

2023-01-27 06:48:34 +01:00

lnx_auditd_file_or_folder_permissions.yml

Order yaml field

2022-10-25 08:53:44 +02:00

lnx_auditd_find_cred_in_files.yml

refactor: use '|all' instead of using all of for a single selector.

2023-04-30 21:49:32 +09:00

lnx_auditd_hidden_binary_execution.yml

Hidden Linux Binary Execution (#3108)

2022-12-31 08:27:32 +01:00

lnx_auditd_hidden_files_directories.yml

Remove mitre url

2023-01-10 18:09:04 +01:00

lnx_auditd_hidden_zip_files_steganography.yml

Remove mitre url

2023-01-10 18:09:04 +01:00

lnx_auditd_keylogging_with_pam_d.yml

Remove mitre url

2023-01-10 18:09:04 +01:00

lnx_auditd_ld_so_preload_mod.yml

Order yaml field

2022-10-25 08:53:44 +02:00

lnx_auditd_load_module_insmod.yml

Remove mitre url

2023-01-10 18:09:04 +01:00

lnx_auditd_logging_config_change.yml

Order yaml field

2022-10-25 08:53:44 +02:00

lnx_auditd_masquerading_crond.yml

Update lnx_auditd_masquerading_crond.yml

2023-08-01 12:35:34 +02:00

lnx_auditd_modify_system_firewall.yml

feat: new linux rules #4095)

2023-03-27 13:17:54 +02:00

lnx_auditd_network_service_scanning.yml

Update Title (#3731)

2022-11-27 19:19:27 +01:00

lnx_auditd_network_sniffing.yml

Refractor (#3794)

2022-12-18 21:00:14 +01:00

lnx_auditd_omigod_scx_runasprovider_executeshellcommand.yml

Update Title (#3731)

2022-11-27 19:19:27 +01:00

lnx_auditd_password_policy_discovery.yml

Remove mitre url

2023-01-10 18:09:04 +01:00

lnx_auditd_pers_systemd_reload.yml

Remove mitre url

2023-01-10 18:09:04 +01:00

lnx_auditd_screencapture_import.yml

Remove mitre url

2023-01-10 18:09:04 +01:00

lnx_auditd_screencaputre_xwd.yml

Remove mitre url

2023-01-10 18:09:04 +01:00

lnx_auditd_split_file_into_pieces.yml

Update title (#3734)

2022-11-29 07:36:45 +01:00

lnx_auditd_steghide_embed_steganography.yml

Remove mitre url

2023-01-10 18:09:04 +01:00

lnx_auditd_steghide_extract_steganography.yml

Remove mitre url

2023-01-10 18:09:04 +01:00

lnx_auditd_susp_c2_commands.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

lnx_auditd_susp_cmds.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

lnx_auditd_susp_exe_folders.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

lnx_auditd_susp_histfile_operations.yml

Update title (#3734)

2022-11-29 07:36:45 +01:00

lnx_auditd_system_info_discovery2.yml

Update Title (#3731)

2022-11-27 19:19:27 +01:00

lnx_auditd_system_info_discovery.yml

feat: new linux rules #4095)

2023-03-27 13:17:54 +02:00

lnx_auditd_system_shutdown_reboot.yml

Update Title (#3731)

2022-11-27 19:19:27 +01:00

lnx_auditd_systemd_service_creation.yml

change status to test

2023-01-27 06:48:34 +01:00

lnx_auditd_unix_shell_configuration_modification.yml

feat: new linux rules #4095)

2023-03-27 13:17:54 +02:00

lnx_auditd_unzip_hidden_zip_files_steganography.yml

Remove mitre url

2023-01-10 18:09:04 +01:00

lnx_auditd_user_discovery.yml

Order yaml field

2022-10-25 08:53:44 +02:00

lnx_auditd_web_rce.yml

Promotion rules (#3821)

2022-12-27 12:29:10 +01:00