Brent Murphy 0b568e5740 [New Rule] Suspicious JAR Child Process (#887) ...

* Create execution_suspicious_jar_child_process.toml

* pr review feedback and moved to cross platform

* spacing

* Add FP section

2021-02-08 09:48:48 -05:00

..

credential_access_cookies_chromium_browsers_debugging.toml

[Rule Tuning] Add windows integration index to rules (#923)

2021-01-28 20:53:57 -09:00

defense_evasion_deleting_websvr_access_logs.toml

[Rule Tuning] Add windows integration index to rules (#923)

2021-01-28 20:53:57 -09:00

discovery_security_software_grep.toml

[New Rule] Security Software Discovery using Grep (#743)

2021-01-26 19:57:26 +01:00

execution_suspicious_jar_child_process.toml

[New Rule] Suspicious JAR Child Process (#887)

2021-02-08 09:48:48 -05:00

impact_hosts_file_modified.toml

[Rule Tuning] Add windows integration index to rules (#923)

2021-01-28 20:53:57 -09:00

initial_access_zoom_meeting_with_no_passcode.toml

Refresh beats and ecs schemas and default to use latest to validate (#570)

2020-12-01 13:24:20 -09:00

persistence_credential_access_modify_auth_module_or_config.toml

[New Rule] Modification of Standard Authentication Module or Configuration (#745)

2021-02-05 21:23:58 +01:00

persistence_ssh_authorized_keys_modification.toml

[New Rule] SSH Authorized Keys File Modification (#754)

2021-01-26 08:45:38 +01:00

privilege_escalation_setuid_setgid_bit_set_via_chmod.toml

[Rule Tuning] Setuid Bit Set via chmod and Setgid Bit Set via chmod (#875)

2021-02-04 16:29:53 +01:00

privilege_escalation_sudoers_file_mod.toml

[Rule Tuning] Sudoers File Modification (#873)

2021-02-03 17:57:40 +01:00