Samirbous acdfe5ddab [New Rule] Process Creation via Secondary Logon (#2282) ...

* [New Rule] Process Creation via Secondary Logon

https://github.com/elastic/detection-rules/issues/2164

Create process using alternate creds (i.g. runas) :

* Update privilege_escalation_create_process_as_different_user.toml

* Update privilege_escalation_create_process_as_different_user.toml

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>

2022-09-19 13:04:08 -05:00

..

api_schemas

Prep for 8.5 branch (#2220)

2022-08-09 17:14:42 -04:00

beats_schemas

Prep for 8.5 branch (#2220)

2022-08-09 17:14:42 -04:00

ecs_schemas

Prep for 8.5 branch (#2220)

2022-08-09 17:14:42 -04:00

attack-crosswalk.json

Move etc under detection_rules (#1885)

2022-05-02 10:11:21 -04:00

attack-technique-redirects.json

Move etc under detection_rules (#1885)

2022-05-02 10:11:21 -04:00

attack-v11.3.json.gz

[Rule Tuning] Missing MITRE ATT&CK Mappings (#2073)

2022-07-22 14:30:34 -04:00

commit-and-push.sh

break out the logic to a script and manual workflow (#1908)

2022-09-16 13:34:04 -04:00

deprecated_rules.json

Lock versions for releases: 7.16,8.0,8.1,8.2,8.3,8.4 (#2261)

2022-08-24 13:26:35 -04:00

integration-manifests.json.gz

Prep for 8.5 branch (#2220)

2022-08-09 17:14:42 -04:00

lock-multiple.sh

Move etc under detection_rules (#1885)

2022-05-02 10:11:21 -04:00

non-ecs-schema.json

[New Rule] Process Creation via Secondary Logon (#2282)

2022-09-19 13:04:08 -05:00

packages.yml

Prep for 8.5 branch (#2220)

2022-08-09 17:14:42 -04:00

rule_template_typosquatting_domain.json

Move etc under detection_rules (#1885)

2022-05-02 10:11:21 -04:00

rule-mapping.yml

Move etc under detection_rules (#1885)

2022-05-02 10:11:21 -04:00

security-logo-color-64px.svg

Move etc under detection_rules (#1885)

2022-05-02 10:11:21 -04:00

stack-schema-map.yaml

Prep for 8.5 branch (#2220)

2022-08-09 17:14:42 -04:00

test_toml.json

Move etc under detection_rules (#1885)

2022-05-02 10:11:21 -04:00

version.lock.json

Add test command to verify version collisions do not occur (#2272)

2022-09-19 09:53:30 -06:00