cbf0798646
[Rule Tuning] Change Rules to use Source.ip instead of source.address ( #1704 )
...
* Replace source.address to source.ip for compatibility
* Change query
* Missing and condition
2022-01-13 16:40:10 -03:00
cc241c0b5e
[Rule Tuning] Update network.direction ( #1547 )
...
* Update network.direction
* bump updated_date
2021-10-13 21:46:36 -03:00
61afb1c1c0
[Rule Tuning] Update threat mappings for Windows rules ( #1497 )
...
* Windows Rules Att&ck Mapping review
* Bump updated_date and fix reference URLs
* Fix subtechnique
* Fix test errors
2021-09-23 12:08:38 -05:00
3fc34b86f2
Update License to Elastic v2 ( #944 )
2021-03-03 22:12:11 -09:00
645a0cd67b
[Rule Tuning] Add timestamp_override to all query and non-sequence EQL rules ( #945 )
...
* [Rule Tuning] Add timestamp_override field to rules
* add tests for lookback and timestamp_override
* fix dates and add test to ensure updated > creation
2021-02-17 19:49:58 -09:00
a0e86e20d6
[Rule Tuning] Add windows integration index to rules ( #923 )
2021-01-28 20:53:57 -09:00
181bbcb8c9
[New Rule] Incoming DCOM Lateral Movement with ShellBrowserWindow or ShellWindow ( #486 )
...
* [New Rule] Remote Execution via DCOM - ShellBrowserWindow or ShellWindows
* adjusted rule description and name
* Update rules/windows/lateral_movement_dcom_shellwindow_shellbrowserwindow.toml
Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com >
* filtering localhost
* Update lateral_movement_dcom_shellwindow_shellbrowserwindow.toml
* eql syntax
* ecs_version
* Update rules/windows/lateral_movement_dcom_shellwindow_shellbrowserwindow.toml
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com >
* relinted and del ecs_vers
* re-linted
* deleted ecs_version
Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com >
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com >
2020-12-04 17:37:31 +01:00
Jonhnathan