3 Commits

Author	SHA1	Message	Date
Justin Ibarra	3311168e28	Expand timestamp override tests (#1907) ... * Expand timestamp_override tests * removed timestamp_override from eql sequence rules * add config entry for eql rules with beats index and t_o * add timestamp_override to missing fields Removed changes from: - rules/cross-platform/impact_hosts_file_modified.toml - rules/windows/credential_access_lsass_memdump_file_created.toml - rules/windows/defense_evasion_adding_the_hidden_file_attribute_with_via_attribexe.toml - rules/windows/defense_evasion_execution_lolbas_wuauclt.toml - rules/windows/defense_evasion_suspicious_certutil_commands.toml - rules/windows/execution_command_shell_started_by_svchost.toml (selectively cherry picked from commit 6bdfddac8e)	2022-04-01 23:29:22 +00:00
Justin Ibarra	14c46f50b9	[Rule Tuning] updates from documentation review for 7.16 (#1645)	2021-12-07 15:42:58 -09:00
Austin Songer	cf2b3ee753	[New Rule] DNS-over-HTTPS Enabled by Registry (#1379) ... * Create defense_evasion_dns_over_https_enabled.toml * Update defense_evasion_dns_over_https_enabled.toml * Update defense_evasion_dns_over_https_enabled.toml * Update defense_evasion_dns_over_https_enabled.toml * Update defense_evasion_dns_over_https_enabled.toml * Update defense_evasion_dns_over_https_enabled.toml * Update rules/windows/defense_evasion_dns_over_https_enabled.toml Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com> * Update rules/windows/defense_evasion_dns_over_https_enabled.toml Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com> * Update rules/windows/defense_evasion_dns_over_https_enabled.toml Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com> * Update rules/windows/defense_evasion_dns_over_https_enabled.toml Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com> * Update defense_evasion_dns_over_https_enabled.toml Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com> Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com> Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>	2021-10-15 23:25:12 -03:00