 Jonhnathan
|
dec4243db0
|
[Rule Tuning] Update rules based on docs review (#1778)
* Update rules based on docs review
* trivial change to trigger CLA
* undo changes from triggering build
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
|
2022-02-16 07:42:06 -09:00 |
|
|
Jonhnathan
|
49854aaae2
|
[Rule Tuning] Add Investigation Guides, Config/Logging Policy to PowerShell merged rules (#1610)
* Add Investigation Guide and config to Suspicious Portable Executable Encoded in Powershell Script
* Add Investigation Guide and config to "PowerShell Suspicious Discovery Related Windows API Functions" rule
* Add Investigation Guide and Config to "PowerShell MiniDump Script" rule
* Add logging policy reference
* Add Investigation Guide/Config to "PowerShell Suspicious Script with Audio Capture Capabilities"
* Add Related Rules GUIDs
* Add Investigation Guide/config for "Potential Process Injection via PowerShell"
* Adjust Response and remediation
* Add Investigation Guide/config for "PowerShell Keylogging Script"
* bump updated_date
* Apply suggestions from Samir
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
* Apply suggestions
* Revise line from investigation guides
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
|
2022-01-20 08:56:53 -03:00 |
|
|
Jonhnathan
|
851c566730
|
[Rule Tuning] Replaces event.code with event.category on PowerShell ScriptBlock Rules (#1620)
* Replaces event.code with event.category
* bump updated_date
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
|
2021-12-07 21:32:39 -09:00 |
|
|
Justin Ibarra
|
14c46f50b9
|
[Rule Tuning] updates from documentation review for 7.16 (#1645)
|
2021-12-07 15:42:58 -09:00 |
|
|
Jonhnathan
|
f50fb1d61b
|
[New Rule] Suspicious Portable Executable Encoded in Powershell Script (#1562)
* Create execution_posh_portable_executable.toml
* Add wildcard
* Remove the wildcard
* Update rules/windows/execution_posh_portable_executable.toml
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
|
2021-10-18 17:50:16 -03:00 |
|