2 Commits

Author	SHA1	Message	Date
Justin Ibarra	c1a0438f45	[Rule Tuning] Update ATT&CK threat mappings to reflect changes (#706) ... * replaced/removed all revoked/deprecated techniques * tests will fail on revoked (changed) techniques * tests will fail on deprecated techniques * tests will fail when techniques are mapped to an invalid tactic	2020-12-18 12:46:16 -09:00
Samirbous	97fa6c62cd	[New Rule] Remote File Download via Powershell (#660) ... * [New Rule] Remote File Download via Powershell * new line * eql syntax * ecs_version * added google related FPs * Update rules/windows/command_and_control_remote_file_copy_powershell.toml Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com> * Update rules/windows/command_and_control_remote_file_copy_powershell.toml Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com> * Update rules/windows/command_and_control_remote_file_copy_powershell.toml Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com> * Update rules/windows/command_and_control_remote_file_copy_powershell.toml Co-authored-by: seth-goodwin <58222969+seth-goodwin@users.noreply.github.com> * Update rules/windows/command_and_control_remote_file_copy_powershell.toml Co-authored-by: seth-goodwin <58222969+seth-goodwin@users.noreply.github.com> * relint * ecs_version removed * replaced path with name to avoid FPs for users temp folder Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com> Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com> Co-authored-by: seth-goodwin <58222969+seth-goodwin@users.noreply.github.com>	2020-12-08 21:28:28 +01:00