SomeOne 295054dcbe Replace old mitre techniques by new one

2021-08-22 13:57:56 +02:00

..

auditd

fix: Correct incorrect message / keyword usage

2021-08-12 16:28:07 +02:00

modsecurity

Fixed my git issue

2020-09-13 22:03:04 -06:00

at_command.yml

Update at_command.yml

2020-10-16 22:49:40 +03:00

lnx_apt_equationgroup_lnx.yml

Fixed my git issue

2020-09-13 22:03:04 -06:00

lnx_base64_decode.yml

Renamed ProcessName field to Image for the process_creation category.

2021-02-25 01:57:26 +03:00

lnx_buffer_overflows.yml

fixed various spelling errors all over rules and source code

2021-02-24 14:43:13 +00:00

lnx_clamav.yml

restore original rule

2020-11-30 01:31:00 +01:00

lnx_clear_logs.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

lnx_file_and_directory_discovery.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

lnx_file_copy.yml

fix: Correct broken rules, add documentation

2021-08-13 15:46:30 +02:00

lnx_file_deletion.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

lnx_install_root_certificate.yml

Renamed ProcessName field to Image for the process_creation category.

2021-02-25 01:57:26 +03:00

lnx_ldso_preload_injection.yml

new rule detecting ld.so preload persistence by keyword

2021-05-05 15:12:07 +02:00

lnx_local_account.yml

Renamed ProcessName field to Image for the process_creation category.

2021-02-25 01:57:26 +03:00

lnx_local_groups.yml

Renamed ProcessName field to Image for the process_creation category.

2021-02-25 01:57:26 +03:00

lnx_network_service_scanning.yml

Renamed ProcessName field to Image for the process_creation category.

2021-02-25 01:57:26 +03:00

lnx_process_discovery.yml

Fix selection with only 1 element

2021-08-14 09:54:27 +02:00

lnx_proxy_connection.yml

restore original rule

2020-11-30 01:32:06 +01:00

lnx_remote_system_discovery.yml

Renamed ProcessName field to Image for the process_creation category.

2021-02-25 01:57:26 +03:00

lnx_schedule_task_job_cron.yml

Renamed ProcessName field to Image for the process_creation category.

2021-02-25 01:57:26 +03:00

lnx_security_software_discovery.yml

Renamed ProcessName field to Image for the process_creation category.

2021-02-25 01:57:26 +03:00

lnx_security_tools_disabling.yml

Replace old mitre techniques by new one

2021-08-22 13:57:56 +02:00

lnx_setgid_setuid.yml

restore the rule

2020-11-28 18:53:13 +01:00

lnx_shell_clear_cmd_history.yml

Updated ART reference links from .yaml

2021-07-06 17:39:25 +08:00

lnx_shell_priv_esc_prep.yml

Fixed my git issue

2020-09-13 22:03:04 -06:00

lnx_shell_susp_commands.yml

Fixed my git issue

2020-09-13 22:03:04 -06:00

lnx_shell_susp_log_entries.yml

Fixed my git issue

2020-09-13 22:03:04 -06:00

lnx_shell_susp_rev_shells.yml

fixed various spelling errors all over rules and source code

2021-02-24 14:43:13 +00:00

lnx_shellshock.yml

refactor: extended shellshock rule

2021-04-28 11:47:24 +02:00

lnx_space_after_filename_.yml

Fixed my git issue

2020-09-13 22:03:04 -06:00

lnx_ssh_cve_2018_15473.yml

Fixed my git issue

2020-09-13 22:03:04 -06:00

lnx_sudo_cve_2019_14287.yml

Replace old mitre techniques by new one

2021-08-22 13:57:56 +02:00

lnx_susp_failed_logons_single_source.yml

Fixed my git issue

2020-09-13 22:03:04 -06:00

lnx_susp_guacamole.yml

Fixed my git issue

2020-09-13 22:03:04 -06:00

lnx_susp_jexboss.yml

Fixed my git issue

2020-09-13 22:03:04 -06:00

lnx_susp_named.yml

Update lnx_susp_named.yml

2020-11-29 21:31:54 +01:00

lnx_susp_ssh.yml

restore the original file

2020-11-29 21:30:50 +01:00

lnx_susp_vsftp.yml

Fixed my git issue

2020-09-13 22:03:04 -06:00

lnx_symlink_etc_passwd.yml

fix: linux keywords rule

2021-05-05 12:56:24 +02:00

lnx_system_info_discovery.yml

Fix auditd is a service

2021-05-30 08:58:25 +02:00

lnx_system_network_connections_discovery.yml

Renamed ProcessName field to Image for the process_creation category.

2021-02-25 01:57:26 +03:00

lnx_system_network_discovery.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

macos_applescript.yml

Renamed ProcessName field to Image for the process_creation category.

2021-02-25 01:57:26 +03:00

macos_base64_decode.yml

Renamed ProcessName field to Image for the process_creation category.

2021-02-25 01:57:26 +03:00

macos_binary_padding.yml

Renamed ProcessName field to Image for the process_creation category.

2021-02-25 01:57:26 +03:00

macos_change_file_time_attr.yml

fix: duplicate UUIDs

2021-05-27 10:29:21 +02:00

macos_clear_system_logs.yml

Fix selection with only 1 element

2021-08-14 09:54:27 +02:00

macos_create_account.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

macos_create_hidden_account.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

macos_creds_from_keychain.yml

Changed selections and condition

2020-11-27 19:23:31 +01:00

macos_disable_security_tools.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

macos_emond_launch_daemon.yml

Sigma rule

2020-10-23 10:16:59 +02:00

macos_file_and_directory_discovery.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

macos_find_cred_in_files.yml

fix: duplicate UUIDs

2021-05-27 10:29:21 +02:00

macos_gui_input_capture.yml

Renamed ProcessName field to Image for the process_creation category.

2021-02-25 01:57:26 +03:00

macos_local_account.yml

Renamed ProcessName field to Image for the process_creation category.

2021-02-25 01:57:26 +03:00

macos_local_groups.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

macos_network_service_scanning.yml

Renamed ProcessName field to Image for the process_creation category.

2021-02-25 01:57:26 +03:00

macos_network_sniffing.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

macos_remote_system_discovery.yml

fix: duplicate UUIDs

2021-05-27 10:29:21 +02:00

macos_schedule_task_job_cron.yml

Renamed ProcessName field to Image for the process_creation category.

2021-02-25 01:57:26 +03:00

macos_screencapture.yml

Renamed ProcessName field to Image for the process_creation category.

2021-02-25 01:57:26 +03:00

macos_security_software_discovery.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

macos_split_file_into_pieces.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

macos_startup_items.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

macos_susp_histfile_operations.yml

added fish to macos rule

2020-10-17 02:37:21 +03:00

macos_system_network_connections_discovery.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

macos_system_network_discovery.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

macos_system_shutdown_reboot.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

macos_xattr_gatekeeper_bypass.yml

Renamed ProcessName field to Image for the process_creation category.

2021-02-25 01:57:26 +03:00