sigma-rules

Files

T

Samirbous c5fa838d30 [New Rule] Windows Service Installed via an Unusual Client (#1759 )

* [New Rule] Windows Service Installed via an Unusual Client

https://www.x86matthew.com/view_post?id=create_svc_rpc

* Update non-ecs-schema.json

* Update rules/windows/privilege_escalation_windows_service_via_unusual_client.toml

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>

* Update rules/windows/privilege_escalation_windows_service_via_unusual_client.toml

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>

* Add ```s

* Update privilege_escalation_windows_service_via_unusual_client.toml

* add missing comma to schema

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

(cherry picked from commit 326aa64ff6)

2022-02-11 20:58:51 +00:00

api_schemas

Prep for creation of 8.2 branch (#1762 )

2022-02-09 03:45:54 +00:00

beats_schemas

Prepare for creation of 8.1 branch (#1700 )

2022-01-26 03:14:04 +00:00

ecs_schemas

Prepare for creation of 8.1 branch (#1700 )

2022-01-26 03:14:04 +00:00

attack-crosswalk.json

[Rule Tuning] Update ATT&CK threat mappings to reflect changes (#706 )