security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[Rule Tuning] Add technique T1005 to 2 rules (#1405)

Browse Source 
(cherry picked from commit 8099e1c733)
This commit is contained in:
Justin Ibarra
2021-08-20 00:19:11 -08:00
committed by github-actions[bot]
parent 632a322431
commit cc75f645b6
2 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/collection_email_powershell_exchange_mailbox.toml
+5
View File
@@ -39,6 +39,11 @@ id = "T1114"
name = "Email Collection"
reference = "https://attack.mitre.org/techniques/T1114/"
[[rule.threat.technique]]
reference = "https://attack.mitre.org/techniques/T1005/"
id = "T1005"
name = "Data from Local System"
[rule.threat.tactic]
id = "TA0009"
rules/windows/collection_persistence_powershell_exch_mailbox_activesync_add_device.toml
+5
View File
@@ -39,6 +39,11 @@ id = "T1114"
name = "Email Collection"
reference = "https://attack.mitre.org/techniques/T1114/"
[[rule.threat.technique]]
reference = "https://attack.mitre.org/techniques/T1005/"
id = "T1005"
name = "Data from Local System"
[rule.threat.tactic]
id = "TA0009"