Terrance DeJesus d5350ae6e0 [New Rule] Commonly Abused Remote Access Tool Downloaded (New Terms) (#2685) ...

* adding initial rule

* changed new terms to host.id

* removed windows integration tag

* removed windows integration tag

* changed rule to be process started related

* rule linted

* updating description

* Update rules/windows/command_and_control_new_terms_commonly_abused_rat_execution.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* Update rules/windows/command_and_control_new_terms_commonly_abused_rat_execution.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* Update rules/windows/command_and_control_new_terms_commonly_abused_rat_execution.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/windows/command_and_control_new_terms_commonly_abused_rat_execution.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/windows/command_and_control_new_terms_commonly_abused_rat_execution.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/windows/command_and_control_new_terms_commonly_abused_rat_execution.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/windows/command_and_control_new_terms_commonly_abused_rat_execution.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/windows/command_and_control_new_terms_commonly_abused_rat_execution.toml

* added process.name.caseless to non-ecs.json

* removed host type related to #2761

* added host.os.type

---------

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>

2023-05-02 23:09:17 -04:00

..

etc

[New Rule] Commonly Abused Remote Access Tool Downloaded (New Terms) (#2685)

2023-05-02 23:09:17 -04:00

schemas

[Bug] Add Cloud Defend to definitions.NON_DATASET_PACKAGES (#2764)

2023-04-28 11:23:48 -04:00

__init__.py

Update package and install process (#1948)

2022-12-08 15:49:49 -05:00

__main__.py

Move Rule into a dataclass (#1029)

2021-03-24 10:24:32 -06:00

attack.py

[FR] Adapt PyPi semver Library and Remove Custom (#2503)

2023-02-07 14:26:29 -05:00

beats.py

[FR] Adapt PyPi semver Library and Remove Custom (#2503)

2023-02-07 14:26:29 -05:00

cli_utils.py

Add index as a required field to rule_prompt (#1595)

2021-11-14 17:05:42 -09:00

devtools.py

[FR] Add release-docs workflow and automation (#2745)

2023-04-27 11:44:05 -04:00

docs.py

[FR] Add release-docs workflow and automation (#2745)

2023-04-27 11:44:05 -04:00

ecs.py

[FR] Adapt PyPi semver Library and Remove Custom (#2503)

2023-02-07 14:26:29 -05:00

endgame.py

add support for additional endgame field types (#2372)

2022-10-19 11:11:09 -04:00

eswrap.py

Adds commands to manage ATT&CK mappings (#2343)

2022-11-01 13:14:40 -06:00

ghwrap.py

Update package and install process (#1948)

2022-12-08 15:49:49 -05:00

integrations.py

[FR] Generate Historical Rule Files in Build Release Packages (#2715)

2023-04-21 11:03:29 -04:00

kbwrap.py

Adds commands to manage ATT&CK mappings (#2343)

2022-11-01 13:14:40 -06:00

main.py

[Bug] Convert config to pathlib.Path (#2377)

2022-11-01 10:43:32 -04:00

mappings.py

Release ER Production RTAs to DR (#2270)

2022-09-08 12:50:39 -04:00

misc.py

Cleanup rule survey code (#1923)

2022-09-06 15:53:47 -06:00

mixins.py

[FR] Adapt PyPi semver Library and Remove Custom (#2503)

2023-02-07 14:26:29 -05:00

ml.py

Refactor experimental ML CLI and code (#1218)

2021-06-02 20:37:12 -08:00

navigator.py

Update layer version to 4.4 (#2676)

2023-03-30 12:29:17 -04:00

packaging.py

[FR] Generate Historical Rule Files in Build Release Packages (#2715)

2023-04-21 11:03:29 -04:00

rule_formatter.py

Validate markdown plugin fields (#2602)

2023-03-28 09:17:50 -04:00

rule_loader.py

[Rule Tuning] adjust duplicate ssh brute force rule names and add unit test (#2321)

2022-09-26 10:04:38 -04:00

rule_validators.py

Patch to allow integration validation if ECS/beats fails (#2701)

2023-04-18 15:43:35 -04:00

rule.py

Make call to TOMLRuleContents.to_dict from TOMLRuleContents.to_api_format (#2742)

2023-04-25 12:33:43 -04:00

utils.py

Validate markdown plugin fields (#2602)

2023-03-28 09:17:50 -04:00

version_lock.py

[Bug][FR] Remove Rule Type Change Restriction and Fix Version Lock Bug (#2769)

2023-05-02 11:00:36 -04:00