sigma-rules

Files

T

Samirbous fbcc7433ad [New Rule] Windows Service Installed via an Unusual Client (#1759 )

* [New Rule] Windows Service Installed via an Unusual Client

https://www.x86matthew.com/view_post?id=create_svc_rpc

* Update non-ecs-schema.json

* Update rules/windows/privilege_escalation_windows_service_via_unusual_client.toml

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>

* Update rules/windows/privilege_escalation_windows_service_via_unusual_client.toml

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>

* Add ```s

* Update privilege_escalation_windows_service_via_unusual_client.toml

* add missing comma to schema

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

(cherry picked from commit 326aa64ff6)

2022-02-11 20:59:20 +00:00

api_schemas

Prep for creation of 8.2 branch (#1762 )

2022-02-09 03:46:26 +00:00

beats_schemas

(manually cherry picked from commit 2e78da5c9a)

2022-01-25 18:49:15 -09:00

ecs_schemas

(manually cherry picked from commit 2e78da5c9a)

2022-01-25 18:49:15 -09:00

attack-crosswalk.json

[Rule Tuning] Update ATT&CK threat mappings to reflect changes (#706 )