2 Commits

Author	SHA1	Message	Date
Justin Ibarra	97ee8cc9ac	Refresh beats and ecs schemas and default to use latest to validate (#570) ... * Refresh beats and ecs schemas and default to use latest to validate * remove incorrect ecs_version from zoom rule * remove stale ecs_version from rules	2020-12-01 13:24:20 -09:00
Samirbous	14ef24e9dd	[New Rule] Command shell activity started via rundll32 (#391) ... * [New Rule] Command shell activity started via rundll32 * added tag * adjusted parent args for performance avoid leading wildcard * filtered a common FP * Update execution_command_shell_via_rundll32.toml * Update rules/windows/execution_command_shell_via_rundll32.toml Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com> * Update rules/windows/execution_command_shell_via_rundll32.toml Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com> * Update rules/windows/execution_command_shell_via_rundll32.toml Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com> * Update rules/windows/execution_command_shell_via_rundll32.toml Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com> * Update rules/windows/execution_command_shell_via_rundll32.toml Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com> Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com> Co-authored-by: Ross Wolf <31489089+rw-access@users.noreply.github.com> Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com> Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>	2020-11-30 21:02:57 +01:00