Isai 09ea35f33a [New Rule] AWS STS AssumeRole with New MFA Device [Rule Tuning] AWS IAM Deactivation of MFA Device (#4210) ...

* [New Rule] [Rule Tuning] AWS STS AssumeRole with New MFA Device, AWS IAM Deactivation of MFA Device

New terms rule for new MFA device with AssumeRole action. Rule tuning to add MITRE technique to "AWS IAM Deactivation of MFA Device"

* add serialNumber to non-ecs schema file

* fixed misspelled toml file name

* Update rules/integrations/aws/persistence_sts_assume_role_with_new_mfa.toml

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

---------

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

2024-11-05 02:09:05 -05:00

..

etc

[New Rule] AWS STS AssumeRole with New MFA Device [Rule Tuning] AWS IAM Deactivation of MFA Device (#4210)

2024-11-05 02:09:05 -05:00

schemas

[Rule Tuning] 3rd Party EDR - Add Crowdstrike FDR support - 1 (#4220)

2024-11-04 11:32:22 -03:00

__init__.py

[DaC] Beta Release (#3889)

2024-08-06 18:07:12 -04:00

__main__.py

[FR] Update utility path computation to use pathlib (#3699)

2024-05-23 17:36:51 -04:00

action_connector.py

[DaC] Beta Release (#3889)

2024-08-06 18:07:12 -04:00

action.py

[DaC] Beta Release (#3889)

2024-08-06 18:07:12 -04:00

attack.py

[FR] Update utility path computation to use pathlib (#3699)

2024-05-23 17:36:51 -04:00

beats.py

[DaC] Beta Release (#3889)

2024-08-06 18:07:12 -04:00

cli_utils.py

[FR] Add Alert Suppression for Addtional Rule Types (#3986)

2024-08-15 15:03:45 -05:00

config.py

[FR] Add Better Error Handling for CUSTOM_RULES_DIR (#3990)

2024-08-28 10:30:45 -04:00

custom_rules.py

[DaC] Beta Release (#3889)

2024-08-06 18:07:12 -04:00

custom_schemas.py

[FR] [DAC] Add Support for Known Types to Auto-generated Schemas (#3985)

2024-08-28 10:48:00 -04:00

devtools.py

Add flag to update the docs/ATT&CK-coverage.md with markdown URL(s) (#4077)

2024-09-19 23:12:01 +05:30

docs.py

Skip Development Rules from Security Docs (#4073)

2024-09-13 19:57:00 +05:30

ecs.py

[FR] [DAC] Add Support for Known Types to Auto-generated Schemas (#3985)

2024-08-28 10:48:00 -04:00

endgame.py

[FR] Update utility path computation to use pathlib (#3699)

2024-05-23 17:36:51 -04:00

eswrap.py

[DaC] Beta Release (#3889)

2024-08-06 18:07:12 -04:00

exception.py

[DaC] Beta Release (#3889)

2024-08-06 18:07:12 -04:00

generic_loader.py

[DaC] Beta Release (#3889)

2024-08-06 18:07:12 -04:00

ghwrap.py

Update package and install process (#1948)

2022-12-08 15:49:49 -05:00

integrations.py

[Bug] Add historical Rules as Default when Build Package (#4003)

2024-08-21 18:00:02 -04:00

kbwrap.py

[FR][DAC] Import Rules Verbose Message (#4093)

2024-10-09 17:19:59 -04:00

main.py

Update import rules to repo help text. (#4013)

2024-08-26 10:20:32 -04:00

mappings.py

[FR] Update utility path computation to use pathlib (#3699)

2024-05-23 17:36:51 -04:00

misc.py

[DaC] Beta Release (#3889)

2024-08-06 18:07:12 -04:00

mixins.py

[DaC] Beta Release (#3889)

2024-08-06 18:07:12 -04:00

ml.py

[FR] Update utility path computation to use pathlib (#3699)

2024-05-23 17:36:51 -04:00

navigator.py

[DaC] Beta Release (#3889)

2024-08-06 18:07:12 -04:00

packaging.py

[Bug] Add historical Rules as Default when Build Package (#4003)

2024-08-21 18:00:02 -04:00

remote_validation.py

[DaC] Beta Release (#3889)

2024-08-06 18:07:12 -04:00

rule_formatter.py

[Bug] Handle formatting empty list (#4086)

2024-09-17 13:25:17 -05:00

rule_loader.py

[DaC] Beta Release (#3889)

2024-08-06 18:07:12 -04:00

rule_validators.py

[FR] [DAC] Add Support for Known Types to Auto-generated Schemas (#3985)

2024-08-28 10:48:00 -04:00

rule.py

[Rule Tuning] Add KEEP Command to all ES|QL Rules (#4146)

2024-10-09 21:08:38 -04:00

utils.py

[DaC] Beta Release (#3889)

2024-08-06 18:07:12 -04:00

version_lock.py

[DaC] Beta Release (#3889)

2024-08-06 18:07:12 -04:00