security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
46d6bc69a2ccfc2378e4f79333b910f57e8cbc81
sigma-rules/rules/macos
T
History
Samirbous c76439923b [New Rule] Attempt to Remove File Quarantine Attribute (#674) 
* [New Rule] Attempt to Remove File Quarantine Attribute

* Update rules/macos/defense_evasion_attempt_del_quarantine_attrib.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* relinted

* Update rules/macos/defense_evasion_attempt_del_quarantine_attrib.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
2020-12-08 12:27:03 +01:00
..
credential_access_compress_credentials_keychains.toml
Refresh beats and ecs schemas and default to use latest to validate (#570)
2020-12-01 13:24:20 -09:00
credential_access_kerberosdump_kcc.toml
Refresh beats and ecs schemas and default to use latest to validate (#570)
2020-12-01 13:24:20 -09:00
credential_access_potential_ssh_bruteforce.toml
[New Rule] Potential SSH Bruteforce Detected (#538)
2020-12-04 17:18:03 +01:00
credential_access_promt_for_pwd_via_osascript.toml
Refresh beats and ecs schemas and default to use latest to validate (#570)
2020-12-01 13:24:20 -09:00
defense_evasion_attempt_del_quarantine_attrib.toml
[New Rule] Attempt to Remove File Quarantine Attribute (#674)
2020-12-08 12:27:03 +01:00
execution_scripting_osascript_exec_followed_by_netcon.toml
[New Rule] Apple Script Execution followed by Network Connection (#681)
2020-12-08 12:25:03 +01:00
execution_shell_execution_via_apple_scripting.toml
[New Rule] Shell Execution via Apple Scripting (#687)
2020-12-08 11:45:39 +01:00
lateral_movement_remote_ssh_login_enabled.toml
Refresh beats and ecs schemas and default to use latest to validate (#570)
2020-12-01 13:24:20 -09:00
persistence_folder_action_scripts_runtime.toml
[New Rule] Persistence via Folder Action Script (#685)
2020-12-08 11:51:52 +01:00
persistence_login_logout_hooks_defaults.toml
[New Rule] Persistence via Login and/or Logout Hooks (#683)
2020-12-08 12:09:36 +01:00
privilege_escalation_explicit_creds_via_apple_scripting.toml
[New Rule] Execution with Explicit Credentials via Apple Scripting (#689)
2020-12-08 11:57:52 +01:00