Samirbous 440a7fbdee [New Rule] SSH Authorized Keys File Modification (#754) ...

* [New Rule] SSH Authorized Keys File Modification

* excluded some noisy procs

* Update rules/cross-platform/persistence_ssh_authorized_keys_modification.toml

Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com>

* Update rules/cross-platform/persistence_ssh_authorized_keys_modification.toml

Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com>

* Update persistence_ssh_authorized_keys_modification.toml

* Update rules/cross-platform/persistence_ssh_authorized_keys_modification.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com>
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

2021-01-26 08:45:38 +01:00

..

credential_access_cookies_chromium_browsers_debugging.toml

[New Rule] Potential Cookies Theft via Browser Debugging (#741)

2021-01-26 08:21:45 +01:00

defense_evasion_deleting_websvr_access_logs.toml

Refresh beats and ecs schemas and default to use latest to validate (#570)

2020-12-01 13:24:20 -09:00

impact_hosts_file_modified.toml

Refresh beats and ecs schemas and default to use latest to validate (#570)

2020-12-01 13:24:20 -09:00

initial_access_zoom_meeting_with_no_passcode.toml

Refresh beats and ecs schemas and default to use latest to validate (#570)

2020-12-01 13:24:20 -09:00

persistence_ssh_authorized_keys_modification.toml

[New Rule] SSH Authorized Keys File Modification (#754)

2021-01-26 08:45:38 +01:00