frack113 e8a36ace96 move to other

2021-11-09 13:32:22 +01:00

..

auditd

Update lnx_auditd_load_module_insmod.yml

2021-11-02 17:16:59 +01:00

builtin

move to builtin

2021-11-09 13:27:20 +01:00

file_create

Rule for Cron activity - file creation

2021-10-16 02:33:01 -04:00

modsecurity

add missing tags

2021-09-07 18:16:46 +02:00

network_connection

rules: crypto coin mining

2021-10-26 08:52:07 +02:00

other

move to other

2021-11-09 13:32:22 +01:00

process_creation

Move to correct directory

2021-10-27 14:38:51 +02:00

macos_applescript.yml

Renamed ProcessName field to Image for the process_creation category.

2021-02-25 01:57:26 +03:00

macos_base64_decode.yml

Renamed ProcessName field to Image for the process_creation category.

2021-02-25 01:57:26 +03:00

macos_binary_padding.yml

Renamed ProcessName field to Image for the process_creation category.

2021-02-25 01:57:26 +03:00

macos_change_file_time_attr.yml

fix: duplicate UUIDs

2021-05-27 10:29:21 +02:00

macos_clear_system_logs.yml

Fix selection with only 1 element

2021-08-14 09:54:27 +02:00

macos_create_account.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

macos_create_hidden_account.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

macos_creds_from_keychain.yml

Changed selections and condition

2020-11-27 19:23:31 +01:00

macos_disable_security_tools.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

macos_emond_launch_daemon.yml

Sigma rule

2020-10-23 10:16:59 +02:00

macos_file_and_directory_discovery.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

macos_find_cred_in_files.yml

fix: duplicate UUIDs

2021-05-27 10:29:21 +02:00

macos_gui_input_capture.yml

Renamed ProcessName field to Image for the process_creation category.

2021-02-25 01:57:26 +03:00

macos_local_account.yml

Renamed ProcessName field to Image for the process_creation category.

2021-02-25 01:57:26 +03:00

macos_local_groups.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

macos_network_service_scanning.yml

Renamed ProcessName field to Image for the process_creation category.

2021-02-25 01:57:26 +03:00

macos_network_sniffing.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

macos_remote_system_discovery.yml

fix: duplicate UUIDs

2021-05-27 10:29:21 +02:00

macos_schedule_task_job_cron.yml

Renamed ProcessName field to Image for the process_creation category.

2021-02-25 01:57:26 +03:00

macos_screencapture.yml

Renamed ProcessName field to Image for the process_creation category.

2021-02-25 01:57:26 +03:00

macos_security_software_discovery.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

macos_split_file_into_pieces.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

macos_startup_items.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

macos_susp_histfile_operations.yml

added fish to macos rule

2020-10-17 02:37:21 +03:00

macos_suspicious_macos_firmware_activity.yml

Create macos_suspicious_macos_firmware_activity.yml

2021-09-30 18:47:15 -05:00

macos_system_network_connections_discovery.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

macos_system_network_discovery.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

macos_system_shutdown_reboot.yml

Fixes and improvements

2021-04-03 00:08:55 +02:00

macos_xattr_gatekeeper_bypass.yml

Renamed ProcessName field to Image for the process_creation category.

2021-02-25 01:57:26 +03:00