sigma-rules

Files

T

Samirbous 6f30bf3f7f [New Rule] Potential Lsass Memory Dump via MirrorDump (#1504 )

* [New Rule] Potential Lsass Memory Dump via MirrorDump

* added tactic

* switched to kql

* added sysmon process access non ecs types

* Update rules/windows/credential_access_potential_lsa_memdump_via_mirrordump.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update rules/windows/credential_access_potential_lsa_memdump_via_mirrordump.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* rule.name as suggested by Justin and converted to EQL to add comments

* Update rules/windows/credential_access_potential_lsa_memdump_via_mirrordump.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update rules/windows/credential_access_potential_lsa_memdump_via_mirrordump.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

(cherry picked from commit 521e4dc8f1)

2021-09-30 08:17:42 +00:00

api_schemas

[Bug] CLI Fixes (#1073 )

2021-09-10 18:07:10 +00:00

beats_schemas

Pull latest ECS+beats schemas and update schema-map (#1417 )

2021-08-12 21:10:22 +00:00

ecs_schemas

Pull latest ECS+beats schemas and update schema-map (#1417 )

2021-08-12 21:10:22 +00:00

attack-crosswalk.json

[Rule Tuning] Update ATT&CK threat mappings to reflect changes (#706 )