Jonhnathan
b7dcbbae72
* PowerShell Suspicious Discovery Related Windows API Functions Initial Rule * Update severity * Lint Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
27 lines
631 B
JSON
27 lines
631 B
JSON
{
|
|
"endgame-*": {
|
|
"endgame": {
|
|
"metadata": {
|
|
"type": "keyword"
|
|
},
|
|
"event_subtype_full": "keyword"
|
|
}
|
|
},
|
|
"winlogbeat-*": {
|
|
"winlog.event_data.OriginalFileName": "keyword",
|
|
"winlog.event_data.GrantedAccess": "keyword",
|
|
"winlog.event_data.CallTrace": "keyword",
|
|
"powershell.file.script_block_text": "text"
|
|
},
|
|
"filebeat-*": {
|
|
"o365.audit.NewValue": "keyword"
|
|
},
|
|
"logs-endpoint.events.*": {
|
|
"process.Ext.token.integrity_level_name": "keyword",
|
|
"process.parent.Ext.real.pid": "long"
|
|
},
|
|
"logs-windows.*": {
|
|
"powershell.file.script_block_text": "text"
|
|
}
|
|
}
|