Ruben Groenewoud 9cc4b0e348 [New BBR] Potential Suspicious File Edit (#2960) ...

* [New BBR] Potential Suspicious File Edit

* Added a few more interesting files

---------

Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com>

2023-07-26 15:22:56 +02:00

..

.gitkeep

[FR] Add support for building block rules (BBR) (#2822)

2023-06-20 09:00:30 -04:00

collection_archive_data_zip_imageload.toml

[New Rule] Building Block Rules - Part 1 (#2912)

2023-07-18 20:01:43 -03:00

collection_posh_compression.toml

[New Rule] Building Block Rules - Part 1 (#2912)

2023-07-18 20:01:43 -03:00

command_and_control_non_standard_http_port.toml

New Linux BBR Rules (#2917)

2023-07-19 20:12:59 +05:30

defense_evasion_masquerading_communication_apps.toml

[New Rule] Building Block Rules - Part 1 (#2912)

2023-07-18 20:01:43 -03:00

defense_evasion_powershell_clear_logs_script.toml

[New Rule] Building Block Rules - Part 1 (#2912)

2023-07-18 20:01:43 -03:00

discovery_hosts_file_access.toml

New Cross Platform BBR Rules (#2920)

2023-07-19 21:27:23 +05:30

discovery_linux_system_information_discovery.toml

New Linux BBR Rules (#2917)

2023-07-19 20:12:59 +05:30

discovery_linux_system_owner_user_discovery.toml

New Linux BBR Rules (#2917)

2023-07-19 20:12:59 +05:30

discovery_of_accounts_or_groups_via_builtin_tools.toml

New Cross Platform BBR Rules (#2920)

2023-07-19 21:27:23 +05:30

discovery_posh_generic.toml

[New Rule] Building Block Rules - Part 1 (#2912)

2023-07-18 20:01:43 -03:00

discovery_process_discovery_via_builtin_tools.toml

New Cross Platform BBR Rules (#2920)

2023-07-19 21:27:23 +05:30

discovery_system_network_connections.toml

New Cross Platform BBR Rules (#2920)

2023-07-19 21:27:23 +05:30

discovery_windows_system_information_discovery.toml

[New Rule] Building Block Rules - Part 1 (#2912)

2023-07-18 20:01:43 -03:00

initial_access_cross_site_scripting.toml

Potential Cross Site Scripting ( XSS ) (#2922)

2023-07-20 19:12:00 +05:30

persistence_suspicious_file_opened_through_editor.toml

[New BBR] Potential Suspicious File Edit (#2960)

2023-07-26 15:22:56 +02:00

privilege_escalation_expired_driver_loaded.toml

[New Rule] [BBR] Expired or Revoked Driver Loaded (#2880)

2023-06-27 09:18:35 -03:00