Files
sigma-rules/rules/windows
Jonhnathan 5a263b253d [Security Content] Add Investigation Guides - 2 (#1822)
* Add Investigation Guides for Windows Rules - First half

* + 1/2

* Update impact_volume_shadow_copy_deletion_or_resized_via_vssadmin.toml

* Update credential_access_mod_wdigest_security_provider.toml

* Apply suggestions from code review

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

* Update defense_evasion_amsienable_key_mod.toml

* Update defense_evasion_amsienable_key_mod.toml

* Apply suggestions from code review

Co-authored-by: benironside <91905639+benironside@users.noreply.github.com>

* Update command_and_control_certutil_network_connection.toml

* Apply suggestions from code review

Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com>
Co-authored-by: Joe Peeples <joe.peeples@elastic.co>
Co-authored-by: benironside <91905639+benironside@users.noreply.github.com>

* Update collection_winrar_encryption.toml

* Apply suggestions from code review

Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com>

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>
Co-authored-by: benironside <91905639+benironside@users.noreply.github.com>
Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com>
Co-authored-by: Joe Peeples <joe.peeples@elastic.co>

(cherry picked from commit a3d7427d29)
2022-03-30 17:46:02 +00:00
..