sigma-rules

Files

T

Terrance DeJesus 4997f95300 [Rule Tuning] Link Elastic Security Labs content to compatible rules (#2388 )

* added elastic security labs URL references

* Update rules/macos/credential_access_keychain_pwd_retrieval_security_cmd.toml

Is not compatible with Windows blog.

* Update rules/macos/credential_access_keychain_pwd_retrieval_security_cmd.toml

Is not compatible with Windows blog. Reverting updated date.

* Update rules/macos/credential_access_access_to_browser_credentials_procargs.toml

Is not compatible with Windows blog. Reverting updated date.

* Update rules/macos/credential_access_access_to_browser_credentials_procargs.toml

Is not compatible with Windows blog.

* Update rules/ml/execution_ml_windows_anomalous_script.toml

Is not compatible with Windows blog. Reverting updated date.

* Update rules/linux/credential_access_collection_sensitive_files.toml

Not compatible with Windows blog. Reverting updated date.

* Update rules/linux/credential_access_collection_sensitive_files.toml

Not compatible with Windows blog.

* added credential access URL for mimikatz rules

* updated version ml windows anomalous script rule

* removed change to macOS rule since no blog correlation

2022-11-07 15:17:49 -05:00

command_and_control_accepted_default_telnet_port_connection.toml

[Rule Tuning] Tune "Telnet Port Activity" Rule for Accepted Connections Only (#2374 )

2022-11-07 14:00:25 -05:00

command_and_control_cobalt_strike_beacon.toml

[Rule Tuning] Link Elastic Security Labs content to compatible rules (#2388 )

2022-11-07 15:17:49 -05:00

command_and_control_cobalt_strike_default_teamserver_cert.toml

[Rule Tuning] Link Elastic Security Labs content to compatible rules (#2388 )

2022-11-07 15:17:49 -05:00

command_and_control_download_rar_powershell_from_internet.toml

min_stack all rules to 8.3 (#2259 )