sigma-rules

Files

T

Samirbous a6582351b5 [New Rule] Potential Remote Credential Access via Registry (#1804 )

* [New Rule] Potential Remote Credential Access via Registry

4624 logon followed by hive file creation by regsvc svchost.exe by same user.name and host.id. This matches on secretdsdump and other similar implementations. require to correlation Elastic endpoint file events with System integration logs (4624).

Example of data :

* Delete workspace.xml

* Update credential_access_remote_sam_secretsdump.toml

* Update credential_access_remote_sam_secretsdump.toml

* add non ecs field

* Update non-ecs-schema.json

* Update credential_access_remote_sam_secretsdump.toml

* Update rules/windows/credential_access_remote_sam_secretsdump.toml

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>

* Update rules/windows/credential_access_remote_sam_secretsdump.toml

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>

* Update rules/windows/credential_access_remote_sam_secretsdump.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

2022-03-03 16:28:03 +01:00

api_schemas

Prep for creation of 8.2 branch (#1762 )

2022-02-08 18:43:55 -09:00

beats_schemas

Prepare for creation of 8.1 branch (#1700 )

2022-01-25 18:11:59 -09:00

ecs_schemas

Prepare for creation of 8.1 branch (#1700 )

2022-01-25 18:11:59 -09:00

attack-crosswalk.json

[Rule Tuning] Update ATT&CK threat mappings to reflect changes (#706 )