D4rkCiph3r c965a8dca0 Update proc_creation_macos_binary_padding.yml ...

Updated the modified field
reference link is same, I have a PR in ART Repo for the same, which is yet to be verified, maybe if it's allowed the man pages of "truncate" and "dd" can be referenced
Discarding the filter, there should either be "of="(output file) or a redirection or append symbol

2023-02-17 23:16:28 +05:30

..

proc_creation_macos_applescript.yml

Update from review

2023-02-01 18:30:45 +01:00

proc_creation_macos_base64_decode.yml

Update Title (#3731)

2022-11-27 19:19:27 +01:00

proc_creation_macos_binary_padding.yml

Update proc_creation_macos_binary_padding.yml

2023-02-17 23:16:28 +05:30

proc_creation_macos_change_file_time_attr.yml

feat: updates multiple mitre tech/sub-tech/tactics (#3913)

2023-01-12 17:04:38 +01:00

proc_creation_macos_clear_system_logs.yml

Order yaml field 4 (#3628)

2022-10-25 09:30:05 +02:00

proc_creation_macos_clipboard_data_via_osascript.yml

New Rule for T1115 macOS (#3988)

2023-01-31 14:32:08 +01:00

proc_creation_macos_create_account.yml

Order yaml field 4 (#3628)

2022-10-25 09:30:05 +02:00

proc_creation_macos_create_hidden_account.yml

Order yaml field 4 (#3628)

2022-10-25 09:30:05 +02:00

proc_creation_macos_creds_from_keychain.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_macos_disable_security_tools.yml

Order yaml field 4 (#3628)

2022-10-25 09:30:05 +02:00

proc_creation_macos_file_and_directory_discovery.yml

Title modified in several rules (#3728)

2022-11-25 15:34:38 +01:00

proc_creation_macos_find_cred_in_files.yml

Order yaml field 4 (#3628)

2022-10-25 09:30:05 +02:00

proc_creation_macos_gui_input_capture.yml

Promotion rules (#3821)

2022-12-27 12:29:10 +01:00

proc_creation_macos_jxa_in_memory_execution.yml

fix: filename

2023-01-31 12:53:04 +01:00

proc_creation_macos_local_account.yml

Update Title (#3733)

2022-11-28 06:43:17 +01:00

proc_creation_macos_local_groups.yml

Update Title (#3733)

2022-11-28 06:43:17 +01:00

proc_creation_macos_network_service_scanning.yml

Order yaml field 4 (#3628)

2022-10-25 09:30:05 +02:00

proc_creation_macos_network_sniffing.yml

Update Title (#3731)

2022-11-27 19:19:27 +01:00

proc_creation_macos_office_susp_child_processes.yml

feat: additional updates and fixes

2023-02-04 21:06:47 +01:00

proc_creation_macos_osacompile_runonly_execution.yml

fix: add ref and update description

2023-02-01 17:23:36 +01:00

proc_creation_macos_payload_decoded_and_decrypted.yml

new rules: Sigma rules based on Elastic rules (#3632)

2022-10-28 10:13:44 +02:00

proc_creation_macos_remote_system_discovery.yml

Order yaml field 4 (#3628)

2022-10-25 09:30:05 +02:00

proc_creation_macos_schedule_task_job_cron.yml

Update Title (#3733)

2022-11-28 06:43:17 +01:00

proc_creation_macos_screencapture.yml

Order yaml field 4 (#3628)

2022-10-25 09:30:05 +02:00

proc_creation_macos_security_software_discovery.yml

Update Title (#3733)

2022-11-28 06:43:17 +01:00

proc_creation_macos_space_after_filename.yml

update logsource

2023-01-04 18:52:24 +01:00

proc_creation_macos_split_file_into_pieces.yml

Order yaml field 4 (#3628)

2022-10-25 09:30:05 +02:00

proc_creation_macos_susp_execution_macos_script_editor.yml

feat: add new linux rules

2022-12-29 11:17:42 +01:00

proc_creation_macos_susp_find_execution.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_macos_susp_histfile_operations.yml

Order yaml field 4 (#3628)

2022-10-25 09:30:05 +02:00

proc_creation_macos_susp_macos_firmware_activity.yml

old experimental rule promotion

2022-10-09 16:54:04 +02:00

proc_creation_macos_system_network_connections_discovery.yml

feat: add new linux rules

2022-12-29 11:17:42 +01:00

proc_creation_macos_system_network_discovery.yml

fix: remove folder start

2022-12-29 11:32:37 +01:00

proc_creation_macos_system_shutdown_reboot.yml

Update Title (#3731)

2022-11-27 19:19:27 +01:00

proc_creation_macos_wizardupdate_malware_infection.yml

new rules: Sigma rules based on Elastic rules (#3632)

2022-10-28 10:13:44 +02:00

proc_creation_macos_xattr_gatekeeper_bypass.yml

Order yaml field 4 (#3628)

2022-10-25 09:30:05 +02:00

proc_creation_macos_xcsset_malware_infection.yml

new rules: Sigma rules based on Elastic rules (#3632)

2022-10-28 10:13:44 +02:00