security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
226 Commits 1 Branch 0 Tags
2e422f715913774b101f581dbfc3fbaf9bddca86
Commit Graph

4 Commits

Author SHA1 Message Date
Justin Ibarra a212008f8c [Rule Tuning] Remove event.module from rules for compatibility with agent integrations (#342) 2020-09-30 09:41:33 -08:00
Brent Murphy 95877f7879 [Rule Tuning] Update event.category for Azure rules (#335) 
* update event.category for azure rules

* update updated_date field

* update name to include Azure

* Update persistence_user_added_as_owner_for_azure_service_principal.toml
 2020-09-24 12:45:25 -04:00
Justin Ibarra 065bcd8018 Refresh ATT&CK data to v7.2 and expand threat validation (#330) 
* refresh to latest ATT&CK 7.2
* add new unit test to further validate threat mappings
* updated threat mappings in rules to reflect changes
* new func to download and refresh mitre data based on version
 2020-09-23 22:03:29 -08:00
Brent Murphy b4a15960cb [New Rule] Azure Command Execution on Virtual Machine (#155) 
* Create execution_command_virtual_machine.toml

* Update execution_command_virtual_machine.toml

Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com>
 2020-09-03 17:09:40 -04:00