Samirbous 36369ebf96 [New Rule] Registry Hive File Creation via SMB (#1779) ...

* [New Rule] Registry Hive File Creation via SMB

Identifies the creation or modification of a medium size registry hive file via the SMB protocol :

* Update credential_access_moving_registry_hive_via_smb.toml

* Update etc/non-ecs-schema.json

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

(cherry picked from commit f48144c6b3)

2022-03-02 09:14:52 +00:00

..

api_schemas

Prep for creation of 8.2 branch (#1762)

2022-02-09 03:46:26 +00:00

beats_schemas

(manually cherry picked from commit 2e78da5c9a)

2022-01-25 18:49:15 -09:00

ecs_schemas

(manually cherry picked from commit 2e78da5c9a)

2022-01-25 18:49:15 -09:00

attack-crosswalk.json

[Rule Tuning] Update ATT&CK threat mappings to reflect changes (#706)

2020-12-18 12:46:16 -09:00

attack-technique-redirects.json

[Rule Tuning] Update ATT&CK threat mappings to reflect changes (#706)

2020-12-18 12:46:16 -09:00

attack-v10.1.json.gz

Refresh ATT&CK to v10.1 (#1791)

2022-02-25 01:40:49 +00:00

deprecated_rules.json

Lock versions for releases: 7.13,7.14,7.15,7.16,8.0 (#1732)

2022-01-26 22:56:32 +00:00

lock-multiple.sh

[CI] Add GitHub actions workflow to lock versions across branches (#1456)

2021-08-26 14:17:34 -06:00

non-ecs-schema.json

[New Rule] Registry Hive File Creation via SMB (#1779)

2022-03-02 09:14:52 +00:00

packages.yml

Update registry data to reflect "ga" for release (#1482)

2021-11-15 21:44:21 -09:00

rule_template_typosquatting_domain.json

Generate detection rule to alert on traffic to typosquatting/homonym domains (#1199)

2021-09-03 13:35:59 -07:00

rule-mapping.yml

[New Rule] AWS EC2 Snapshot Activity

2020-07-07 15:10:06 -06:00

security-logo-color-64px.svg

[Fleet] Update template and packaging code for fleet packages (#1280)

2021-06-15 07:54:50 -06:00

stack-schema-map.yaml

Prep for creation of 8.2 branch (#1762)

2022-02-09 03:46:26 +00:00

test_toml.json

[Bug] Fix toml-lint ordering of Mitre metadata #1249 (#1774)

2022-02-22 19:00:16 +00:00

version.lock.json

Lock versions for releases: 7.13,7.14,7.15,7.16,8.0,8.1 (#1781)

2022-02-16 17:27:58 +00:00