security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
645a0cd67b97866a8f54ddda216d3ddad58e136e
sigma-rules/rules/macos
T
History
Justin Ibarra 645a0cd67b [Rule Tuning] Add timestamp_override to all query and non-sequence EQL rules (#945) 
* [Rule Tuning] Add timestamp_override field to rules
* add tests for lookback and timestamp_override
* fix dates and add test to ensure updated > creation
2021-02-17 19:49:58 -09:00
..
credential_access_access_to_browser_credentials_procargs.toml
[Rule Tuning] Add timestamp_override to all query and non-sequence EQL rules (#945)
2021-02-17 19:49:58 -09:00
credential_access_credentials_keychains.toml
Merge remote-tracking branch 'upstream/7.11' into merge-7.11-to-7.12
2021-02-17 14:11:50 -09:00
credential_access_dumping_hashes_bi_cmds.toml
[Rule Tuning] Add timestamp_override to all query and non-sequence EQL rules (#945)
2021-02-17 19:49:58 -09:00
credential_access_dumping_keychain_security.toml
[Rule Tuning] Add timestamp_override to all query and non-sequence EQL rules (#945)
2021-02-17 19:49:58 -09:00
credential_access_kerberosdump_kcc.toml
[Rule Tuning] Remove timestamp_override for endgame-* promotion rules (#951)
2021-02-17 13:48:57 -09:00
credential_access_keychain_pwd_retrieval_security_cmd.toml
[Rule Tuning] Add timestamp_override to all query and non-sequence EQL rules (#945)
2021-02-17 19:49:58 -09:00
credential_access_mitm_localhost_webproxy.toml
[Rule Tuning] Add timestamp_override to all query and non-sequence EQL rules (#945)
2021-02-17 19:49:58 -09:00
credential_access_potential_ssh_bruteforce.toml
[New Rule] Potential SSH Bruteforce Detected (#538)
2020-12-04 17:18:03 +01:00
credential_access_promt_for_pwd_via_osascript.toml
Merge remote-tracking branch 'upstream/7.11' into merge-7.11-to-7.12
2021-02-17 14:11:50 -09:00
credential_access_systemkey_dumping.toml
[Rule Tuning] Add timestamp_override to all query and non-sequence EQL rules (#945)
2021-02-17 19:49:58 -09:00
defense_evasion_apple_softupdates_modification.toml
[Rule Tuning] Add timestamp_override to all query and non-sequence EQL rules (#945)
2021-02-17 19:49:58 -09:00
defense_evasion_attempt_del_quarantine_attrib.toml
Merge remote-tracking branch 'upstream/7.11' into merge-7.11-to-7.12
2021-02-17 14:11:50 -09:00
defense_evasion_attempt_to_disable_gatekeeper.toml
[Rule Tuning] Add timestamp_override to all query and non-sequence EQL rules (#945)
2021-02-17 19:49:58 -09:00
defense_evasion_install_root_certificate.toml
[Rule Tuning] Add timestamp_override to all query and non-sequence EQL rules (#945)
2021-02-17 19:49:58 -09:00
defense_evasion_modify_environment_launchctl.toml
[Rule Tuning] Add timestamp_override to all query and non-sequence EQL rules (#945)
2021-02-17 19:49:58 -09:00
defense_evasion_privacy_controls_tcc_database_modification.toml
[Rule Tuning] Add timestamp_override to all query and non-sequence EQL rules (#945)
2021-02-17 19:49:58 -09:00
defense_evasion_privilege_escalation_privacy_pref_sshd_fulldiskaccess.toml
[Rule Tuning] Add timestamp_override to all query and non-sequence EQL rules (#945)
2021-02-17 19:49:58 -09:00
defense_evasion_safari_config_change.toml
[Rule Tuning] Add timestamp_override to all query and non-sequence EQL rules (#945)
2021-02-17 19:49:58 -09:00
defense_evasion_sandboxed_office_app_suspicious_zip_file.toml
[Rule Tuning] Add timestamp_override to all query and non-sequence EQL rules (#945)
2021-02-17 19:49:58 -09:00
defense_evasion_tcc_bypass_mounted_apfs_access.toml
[Rule Tuning] Add timestamp_override to all query and non-sequence EQL rules (#945)
2021-02-17 19:49:58 -09:00
defense_evasion_unload_endpointsecurity_kext.toml
[Rule Tuning] Add timestamp_override to all query and non-sequence EQL rules (#945)
2021-02-17 19:49:58 -09:00
discovery_users_domain_built_in_commands.toml
[Rule Tuning] Add timestamp_override to all query and non-sequence EQL rules (#945)
2021-02-17 19:49:58 -09:00
execution_defense_evasion_electron_app_childproc_node_js.toml
[Rule Tuning] Add timestamp_override to all query and non-sequence EQL rules (#945)
2021-02-17 19:49:58 -09:00
execution_initial_access_suspicious_browser_childproc.toml
[Rule Tuning] Add timestamp_override to all query and non-sequence EQL rules (#945)
2021-02-17 19:49:58 -09:00
execution_script_via_automator_workflows.toml
[New Rule] Script Execution via Automator Workflows (#763)
2021-01-26 09:07:39 +01:00
execution_scripting_osascript_exec_followed_by_netcon.toml
[New Rule] Apple Script Execution followed by Network Connection (#681)
2020-12-08 12:25:03 +01:00
execution_shell_execution_via_apple_scripting.toml
[New Rule] Shell Execution via Apple Scripting (#687)
2020-12-08 11:45:39 +01:00
initial_access_suspicious_mac_ms_office_child_process.toml
[Rule Tuning] Add timestamp_override to all query and non-sequence EQL rules (#945)
2021-02-17 19:49:58 -09:00
lateral_movement_credential_access_kerberos_bifrostconsole.toml
[Rule Tuning] Add timestamp_override to all query and non-sequence EQL rules (#945)
2021-02-17 19:49:58 -09:00
lateral_movement_mounting_smb_share.toml
[Rule Tuning] Add timestamp_override to all query and non-sequence EQL rules (#945)
2021-02-17 19:49:58 -09:00
lateral_movement_remote_ssh_login_enabled.toml
Merge remote-tracking branch 'upstream/7.11' into merge-7.11-to-7.12
2021-02-17 14:11:50 -09:00
lateral_movement_vpn_connection_attempt.toml
[Rule Tuning] Add timestamp_override to all query and non-sequence EQL rules (#945)
2021-02-17 19:49:58 -09:00
persistence_account_creation_hide_at_logon.toml
[Rule Tuning] Add timestamp_override to all query and non-sequence EQL rules (#945)
2021-02-17 19:49:58 -09:00
persistence_creation_change_launch_agents_file.toml
[Rule Tuning] Update ATT&CK threat mappings to reflect changes (#706)
2020-12-18 12:46:16 -09:00
persistence_creation_hidden_login_item_osascript.toml
[Rule Tuning] Add timestamp_override to all query and non-sequence EQL rules (#945)
2021-02-17 19:49:58 -09:00
persistence_creation_modif_launch_deamon_sequence.toml
[New Rule] LaunchDaemon Creation or Modification followed by Loading (#698)
2020-12-08 16:04:34 +01:00
persistence_credential_access_authorization_plugin_creation.toml
[Rule Tuning] Add timestamp_override to all query and non-sequence EQL rules (#945)
2021-02-17 19:49:58 -09:00
persistence_defense_evasion_hidden_launch_agent_deamon_logonitem_process.toml
[Rule Tuning] Add timestamp_override to all query and non-sequence EQL rules (#945)
2021-02-17 19:49:58 -09:00
persistence_directory_services_plugins_modification.toml
[Rule Tuning] Add timestamp_override to all query and non-sequence EQL rules (#945)
2021-02-17 19:49:58 -09:00
persistence_docker_shortcuts_plist_modification.toml
[Rule Tuning] Add timestamp_override to all query and non-sequence EQL rules (#945)
2021-02-17 19:49:58 -09:00
persistence_emond_rules_file_creation.toml
[Rule Tuning] Add timestamp_override to all query and non-sequence EQL rules (#945)
2021-02-17 19:49:58 -09:00
persistence_emond_rules_process_execution.toml
[Rule Tuning] Add timestamp_override to all query and non-sequence EQL rules (#945)
2021-02-17 19:49:58 -09:00
persistence_enable_root_account.toml
[Rule Tuning] Add timestamp_override to all query and non-sequence EQL rules (#945)
2021-02-17 19:49:58 -09:00
persistence_evasion_hidden_launch_agent_deamon_creation.toml
[Rule Tuning] Add timestamp_override to all query and non-sequence EQL rules (#945)
2021-02-17 19:49:58 -09:00
persistence_finder_sync_plugin_pluginkit.toml
[New Rule] Finder Sync Plugin Enabled (#735)
2021-02-08 23:08:49 +01:00
persistence_folder_action_scripts_runtime.toml
[New Rule] Persistence via Folder Action Script (#685)
2020-12-08 11:51:52 +01:00
persistence_login_logout_hooks_defaults.toml
[Rule Tuning] Remove timestamp_override for endgame-* promotion rules (#951)
2021-02-17 13:48:57 -09:00
persistence_loginwindow_plist_modification.toml
[Rule Tuning] Add timestamp_override to all query and non-sequence EQL rules (#945)
2021-02-17 19:49:58 -09:00
persistence_modification_sublime_app_plugin_or_script.toml
[Rule Tuning] Add timestamp_override to all query and non-sequence EQL rules (#945)
2021-02-17 19:49:58 -09:00
persistence_periodic_tasks_file_mdofiy.toml
[Rule Tuning] Add timestamp_override to all query and non-sequence EQL rules (#945)
2021-02-17 19:49:58 -09:00
persistence_suspicious_calendar_modification.toml
[Rule Tuning] Add timestamp_override to all query and non-sequence EQL rules (#945)
2021-02-17 19:49:58 -09:00
persistence_via_atom_init_file_modification.toml
[Rule Tuning] Add timestamp_override to all query and non-sequence EQL rules (#945)
2021-02-17 19:49:58 -09:00
privilege_escalation_applescript_with_admin_privs.toml
[Rule Tuning] Add timestamp_override to all query and non-sequence EQL rules (#945)
2021-02-17 19:49:58 -09:00
privilege_escalation_explicit_creds_via_scripting.toml
[Rule Tuning] Add timestamp_override to all query and non-sequence EQL rules (#945)
2021-02-17 19:49:58 -09:00
privilege_escalation_exploit_adobe_acrobat_updater.toml
[Rule Tuning] Add timestamp_override to all query and non-sequence EQL rules (#945)
2021-02-17 19:49:58 -09:00
privilege_escalation_local_user_added_to_admin.toml
[Rule Tuning] Add timestamp_override to all query and non-sequence EQL rules (#945)
2021-02-17 19:49:58 -09:00
privilege_escalation_root_crontab_filemod.toml
[Rule Tuning] Add timestamp_override to all query and non-sequence EQL rules (#945)
2021-02-17 19:49:58 -09:00