* [Rule Tuning] Add timestamp_override field to rules
* add tests for lookback and timestamp_override
* fix dates and add test to ensure updated > creation
* [New Rule] Access to Browsers Credential Files
* removed Thunderbird from list
out of browsers context, may go into a different rule with other mail clients
* adjusted Safari cookies path
to include for folder access, file access is covered by Cookies.binarycookies check
* excluded a noisy arg
* Update credential_access_access_to_browser_credentials_procargs.toml
* Update rules/macos/credential_access_access_to_browser_credentials_procargs.toml
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
* Update rules/macos/credential_access_access_to_browser_credentials_procargs.toml
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
* relinted
* Update rules/macos/credential_access_access_to_browser_credentials_procargs.toml
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
Justin Ibarra