sigma-rules

Files

T

Samirbous 326aa64ff6 [New Rule] Windows Service Installed via an Unusual Client (#1759 )

* [New Rule] Windows Service Installed via an Unusual Client

https://www.x86matthew.com/view_post?id=create_svc_rpc

* Update non-ecs-schema.json

* Update rules/windows/privilege_escalation_windows_service_via_unusual_client.toml

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>

* Update rules/windows/privilege_escalation_windows_service_via_unusual_client.toml

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>

* Add ```s

* Update privilege_escalation_windows_service_via_unusual_client.toml

* add missing comma to schema

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

2022-02-11 21:56:59 +01:00

api_schemas

Prep for creation of 8.2 branch (#1762 )

2022-02-08 18:43:55 -09:00

beats_schemas

Prepare for creation of 8.1 branch (#1700 )

2022-01-25 18:11:59 -09:00

ecs_schemas

Prepare for creation of 8.1 branch (#1700 )

2022-01-25 18:11:59 -09:00

attack-crosswalk.json

[Rule Tuning] Update ATT&CK threat mappings to reflect changes (#706 )