* [Rule Tuning] Add timestamp_override field to rules
* add tests for lookback and timestamp_override
* fix dates and add test to ensure updated > creation
* [New Rule] Lateral Executable Transfer Over SMB
* adjusted maxspan, address and extensions
* changed rule name
* Update rules/windows/lateral_movement_executable_tool_transfer_smb.toml
Co-authored-by: Ross Wolf <31489089+rw-access@users.noreply.github.com>
* eql syntax
* ecs_version
Co-authored-by: Ross Wolf <31489089+rw-access@users.noreply.github.com>
Justin Ibarra