Samirbous 1a5e64ce13 [New Rule] T1543.003 - Unsigned DLL Loaded by Svchost (#2477) ...

* Create persistence_service_dll_unsigned.toml

* Update non-ecs-schema.json

* Update persistence_service_dll_unsigned.toml

* Update rules/windows/persistence_service_dll_unsigned.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update detection_rules/etc/non-ecs-schema.json

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update persistence_service_dll_unsigned.toml

* Update persistence_service_dll_unsigned.toml

* Update non-ecs-schema.json

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

2023-01-25 17:11:38 +00:00

..

etc

[New Rule] T1543.003 - Unsigned DLL Loaded by Svchost (#2477)

2023-01-25 17:11:38 +00:00

schemas

[New Rule] Multiple Alerts Involving a User (#2401)

2023-01-03 12:25:40 -03:00

__init__.py

Update package and install process (#1948)

2022-12-08 15:49:49 -05:00

__main__.py

Move Rule into a dataclass (#1029)

2021-03-24 10:24:32 -06:00

attack.py

Update package and install process (#1948)

2022-12-08 15:49:49 -05:00

beats.py

Move etc under detection_rules (#1885)

2022-05-02 10:11:21 -04:00

cli_utils.py

Add index as a required field to rule_prompt (#1595)

2021-11-14 17:05:42 -09:00

devtools.py

[Bug] Adjust Kibana Path for File System Rules (#2397)

2023-01-03 14:54:24 -05:00

docs.py

Generate ATT&CK navigator layer files and links (#1787)

2022-03-04 08:20:44 -09:00

ecs.py

Cleanup rule survey code (#1923)

2022-09-06 15:53:47 -06:00

endgame.py

add support for additional endgame field types (#2372)

2022-10-19 11:11:09 -04:00

eswrap.py

Adds commands to manage ATT&CK mappings (#2343)

2022-11-01 13:14:40 -06:00

ghwrap.py

Update package and install process (#1948)

2022-12-08 15:49:49 -05:00

integrations.py

adding initial solution (#2448)

2023-01-04 12:28:34 -05:00

kbwrap.py

Adds commands to manage ATT&CK mappings (#2343)

2022-11-01 13:14:40 -06:00

main.py

[Bug] Convert config to pathlib.Path (#2377)

2022-11-01 10:43:32 -04:00

mappings.py

Release ER Production RTAs to DR (#2270)

2022-09-08 12:50:39 -04:00

misc.py

Cleanup rule survey code (#1923)

2022-09-06 15:53:47 -06:00

mixins.py

Add support for restricted fields (#2053)

2022-06-27 10:02:15 -05:00

ml.py

Refactor experimental ML CLI and code (#1218)

2021-06-02 20:37:12 -08:00

navigator.py

Replace * in navigator filenames (#1813)

2022-03-04 08:45:55 -09:00

packaging.py

[Bug] resolves bug in Rule version methods (#2021)

2022-06-07 15:40:46 -08:00

rule_formatter.py

[Bug] Fix toml-lint ordering of Mitre metadata #1249 (#1774)

2022-02-22 13:57:49 -05:00

rule_loader.py

[Rule Tuning] adjust duplicate ssh brute force rule names and add unit test (#2321)

2022-09-26 10:04:38 -04:00

rule_validators.py

[FR] Add endgame schema validation to detection-rule query (#2257)

2022-10-19 09:54:47 -04:00

rule.py

[FR] Add Endpoint, APM and Windows Integration Tags to Rules and Supportability (#2429)

2023-01-04 09:30:07 -05:00

semver.py

Update package and install process (#1948)

2022-12-08 15:49:49 -05:00

utils.py

Adds commands to manage ATT&CK mappings (#2343)

2022-11-01 13:14:40 -06:00

version_lock.py

[FR] Support forked rules with 100 version buffer space (#1946)

2022-10-14 14:45:28 -04:00