sigma-rules

Files

T

Samirbous 9b9bebbd27 [New Rule] Parent Process PID Spoofing (#1338 )

* [New Rule] Parent Process PID Spoofing

* excluding sihost FPs

* Update rules/windows/defense_evasion_parent_process_pid_spoofing.toml

Co-authored-by: Ross Wolf <31489089+rw-access@users.noreply.github.com>

* relinted and added 2 non ecs fields

* Update rules/windows/defense_evasion_parent_process_pid_spoofing.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update rules/windows/defense_evasion_parent_process_pid_spoofing.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update rules/windows/defense_evasion_parent_process_pid_spoofing.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

Co-authored-by: Ross Wolf <31489089+rw-access@users.noreply.github.com>
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

(cherry picked from commit 81ab43898c)

2021-07-15 20:56:39 +00:00

api_schemas

Port historical schemas to jsonschema (#1084 )

2021-05-13 14:27:32 -06:00

beats_schemas

Add new ECS and beats schemas (#1303 )

2021-06-23 14:08:23 -08:00

ecs_schemas

Add new ECS and beats schemas (#1303 )

2021-06-23 14:08:23 -08:00

attack-crosswalk.json

[Rule Tuning] Update ATT&CK threat mappings to reflect changes (#706 )