security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
cb85a35e7a95fed4c5141c487cf63b2b29a4d27d
sigma-rules/etc
T
History
Samirbous 7d806b4d3c [New Rule] Potential Credential Access via LSASS Memory Dump (#1533) 
* [New Rule] Potential Credential Access via LSASS Memory Dump

* Update credential_access_suspicious_lsass_access_memdump.toml

* fix typo in calltrace and event.code type

* Update rules/windows/credential_access_suspicious_lsass_access_memdump.toml

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>

* Update credential_access_suspicious_lsass_access_memdump.toml

* added TargetImage to non ecs schema

* Update non-ecs-schema.json

* format

* Update credential_access_suspicious_lsass_access_memdump.toml

* Update credential_access_suspicious_lsass_access_memdump.toml

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>

(cherry picked from commit c18c08a976)
2021-11-17 07:37:33 +00:00
..
api_schemas
Prepare for creation of 7.16 release branch (#1611)
2021-11-15 18:40:36 +00:00
beats_schemas
Refresh ECS (1.12.1) and beats (7.15.1) schemas (#1584)
2021-10-28 16:25:33 +00:00
ecs_schemas
Refresh ECS (1.12.1) and beats (7.15.1) schemas (#1584)
2021-10-28 16:25:33 +00:00
attack-crosswalk.json
[Rule Tuning] Update ATT&CK threat mappings to reflect changes (#706)
2020-12-18 12:46:16 -09:00
attack-technique-redirects.json
[Rule Tuning] Update ATT&CK threat mappings to reflect changes (#706)
2020-12-18 12:46:16 -09:00
attack-v9.0.json.gz
Refresh ATT&CK mappings to v9.0 (#1401)
2021-08-04 22:17:11 +00:00
deprecated_rules.json
Lock versions for releases: 7.13,7.14,7.15,7.16 (#1619)
2021-11-16 09:32:29 +00:00
lock-multiple.sh
[CI] Add GitHub actions workflow to lock versions across branches (#1456)
2021-08-26 20:18:34 +00:00
non-ecs-schema.json
[New Rule] Potential Credential Access via LSASS Memory Dump (#1533)
2021-11-17 07:37:33 +00:00
packages.yml
Update registry release from beta to ga
2021-11-15 21:48:46 -09:00
rule_template_typosquatting_domain.json
Generate detection rule to alert on traffic to typosquatting/homonym domains (#1199)
2021-09-03 20:36:52 +00:00
rule-mapping.yml
[New Rule] AWS EC2 Snapshot Activity
2020-07-07 15:10:06 -06:00
security-logo-color-64px.svg
[Fleet] Update template and packaging code for fleet packages (#1280)
2021-06-15 07:54:50 -06:00
stack-schema-map.yaml
Prepare for creation of 7.16 release branch (#1611)
2021-11-15 18:40:36 +00:00
test_toml.json
Add rule loader and dependencies
2020-06-29 23:17:42 -06:00
version.lock.json
Lock versions for releases: 7.13,7.14,7.15,7.16 (#1619)
2021-11-16 09:32:29 +00:00