security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
a573a8e1bca11d7e04ff3fcfddb86a684c013b65
blue-team-tools/rules/macos/process_creation
T
History
jstnk9 a573a8e1bc Title modified in several rules (#3728)
2022-11-25 15:34:38 +01:00
..
proc_creation_macos_applescript.yml
Order yaml field 4 (#3628)
2022-10-25 09:30:05 +02:00
proc_creation_macos_base64_decode.yml
Order yaml field 4 (#3628)
2022-10-25 09:30:05 +02:00
proc_creation_macos_binary_padding.yml
Order yaml field 4 (#3628)
2022-10-25 09:30:05 +02:00
proc_creation_macos_change_file_time_attr.yml
Order yaml field 4 (#3628)
2022-10-25 09:30:05 +02:00
proc_creation_macos_clear_system_logs.yml
Order yaml field 4 (#3628)
2022-10-25 09:30:05 +02:00
proc_creation_macos_create_account.yml
Order yaml field 4 (#3628)
2022-10-25 09:30:05 +02:00
proc_creation_macos_create_hidden_account.yml
Order yaml field 4 (#3628)
2022-10-25 09:30:05 +02:00
proc_creation_macos_creds_from_keychain.yml
Order yaml field 4 (#3628)
2022-10-25 09:30:05 +02:00
proc_creation_macos_disable_security_tools.yml
Order yaml field 4 (#3628)
2022-10-25 09:30:05 +02:00
proc_creation_macos_file_and_directory_discovery.yml
Title modified in several rules (#3728)
2022-11-25 15:34:38 +01:00
proc_creation_macos_find_cred_in_files.yml
Order yaml field 4 (#3628)
2022-10-25 09:30:05 +02:00
proc_creation_macos_gui_input_capture.yml
Order yaml field 4 (#3628)
2022-10-25 09:30:05 +02:00
proc_creation_macos_local_account.yml
Order yaml field 4 (#3628)
2022-10-25 09:30:05 +02:00
proc_creation_macos_local_groups.yml
Order yaml field 4 (#3628)
2022-10-25 09:30:05 +02:00
proc_creation_macos_network_service_scanning.yml
Order yaml field 4 (#3628)
2022-10-25 09:30:05 +02:00
proc_creation_macos_network_sniffing.yml
Order yaml field 4 (#3628)
2022-10-25 09:30:05 +02:00
proc_creation_macos_payload_decoded_and_decrypted.yml
new rules: Sigma rules based on Elastic rules (#3632)
2022-10-28 10:13:44 +02:00
proc_creation_macos_remote_system_discovery.yml
Order yaml field 4 (#3628)
2022-10-25 09:30:05 +02:00
proc_creation_macos_schedule_task_job_cron.yml
Order yaml field 4 (#3628)
2022-10-25 09:30:05 +02:00
proc_creation_macos_screencapture.yml
Order yaml field 4 (#3628)
2022-10-25 09:30:05 +02:00
proc_creation_macos_security_software_discovery.yml
Order yaml field 4 (#3628)
2022-10-25 09:30:05 +02:00
proc_creation_macos_space_after_filename.yml
Order yaml field 4 (#3628)
2022-10-25 09:30:05 +02:00
proc_creation_macos_split_file_into_pieces.yml
Order yaml field 4 (#3628)
2022-10-25 09:30:05 +02:00
proc_creation_macos_susp_execution_macos_script_editor.yml
Rule Dev
2022-11-18 11:15:28 +01:00
proc_creation_macos_susp_histfile_operations.yml
Order yaml field 4 (#3628)
2022-10-25 09:30:05 +02:00
proc_creation_macos_susp_macos_firmware_activity.yml
old experimental rule promotion
2022-10-09 16:54:04 +02:00
proc_creation_macos_system_network_connections_discovery.yml
Order yaml field 4 (#3628)
2022-10-25 09:30:05 +02:00
proc_creation_macos_system_network_discovery.yml
Order yaml field 4 (#3628)
2022-10-25 09:30:05 +02:00
proc_creation_macos_system_shutdown_reboot.yml
Order yaml field 4 (#3628)
2022-10-25 09:30:05 +02:00
proc_creation_macos_wizardupdate_malware_infection.yml
new rules: Sigma rules based on Elastic rules (#3632)
2022-10-28 10:13:44 +02:00
proc_creation_macos_xattr_gatekeeper_bypass.yml
Order yaml field 4 (#3628)
2022-10-25 09:30:05 +02:00
proc_creation_macos_xcsset_malware_infection.yml
new rules: Sigma rules based on Elastic rules (#3632)
2022-10-28 10:13:44 +02:00