Jonhnathan 5dc8bf81db [New Rules] SPN Spoofing / Coercion Rules (#4815) ...

* [New Rules] SPN Spoofing / Coercion Rules

* Apply suggestions from code review

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* Update rules/windows/credential_access_kerberos_coerce.toml

* Update rules/windows/credential_access_kerberos_coerce_dns.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* Update rules/windows/credential_access_kerberos_coerce.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* .

* Update rules/windows/credential_access_kerberos_coerce_dns.toml

* Update rules/windows/credential_access_kerberos_coerce_dns.toml

* Update pyproject.toml

* missing tag

---------

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

(cherry picked from commit 1f71191c85)

2025-06-17 21:54:40 +00:00

..

etc

[New Rules] SPN Spoofing / Coercion Rules (#4815)

2025-06-17 21:54:40 +00:00

schemas

[New Rule] Threat Intel Email Indicator Match (#4598)

2025-04-22 15:20:05 +00:00

__init__.py

chore: Removing RTAs (#4437)

2025-03-05 12:35:57 +01:00

__main__.py

[FR] Update utility path computation to use pathlib (#3699)

2024-05-23 17:36:51 -04:00

action_connector.py

[DaC] Beta Release (#3889)

2024-08-06 18:07:12 -04:00

action.py

[DaC] Beta Release (#3889)

2024-08-06 18:07:12 -04:00

attack.py

[FR] Update utility path computation to use pathlib (#3699)

2024-05-23 17:36:51 -04:00

beats.py

Account for CCS '::' index pattern (#4258)

2024-11-13 11:17:08 +05:30

cli_utils.py

[Bug] Update Schema Prompt to include new_terms_fields (#4567)

2025-04-17 14:50:19 +00:00

config.py

Feature exclude tactic name (#4593)

2025-04-16 20:06:57 +00:00

custom_rules.py

[Bug] Update Custom Rules Markdown Location (#4565)

2025-03-26 14:06:22 +00:00

custom_schemas.py

[FR] [DAC] Add Support for Known Types to Auto-generated Schemas (#3985)

2024-08-28 10:48:00 -04:00

devtools.py

[FR] Add check-version-lock dev command (#4650)

2025-05-06 17:31:03 +00:00

docs.py

chore: use docs-dev instead of docs dir for docs (#4522)

2025-03-07 14:34:51 +01:00

ecs.py

Account for CCS '::' index pattern (#4258)

2024-11-13 11:17:08 +05:30

endgame.py

[FR] Update utility path computation to use pathlib (#3699)

2024-05-23 17:36:51 -04:00

eswrap.py

Deprecate Experimental ML command (#4669)

2025-05-02 15:36:09 +00:00

exception.py

[DaC] Beta Release (#3889)

2024-08-06 18:07:12 -04:00

generic_loader.py

[DaC] Beta Release (#3889)

2024-08-06 18:07:12 -04:00

ghwrap.py

Update package and install process (#1948)

2022-12-08 15:49:49 -05:00

integrations.py

Refresh ecs, beats, integration manifests & schemas (#4699)

2025-05-05 17:41:00 +00:00

kbwrap.py

[FR] Add Ability to Filter Rule Exports from Kibana (#4783)

2025-06-09 16:26:49 +00:00

main.py

[FR] Add Support for Local Dates Flag (#4582)

2025-04-16 19:45:32 +00:00

misc.py

fix: removing outdated code in Kibana client auth (#4495)

2025-03-24 11:33:50 +00:00

mixins.py

[DaC] Beta Release (#3889)

2024-08-06 18:07:12 -04:00

ml.py

Deprecate Experimental ML command (#4669)

2025-05-02 15:36:09 +00:00

navigator.py

[DaC] Beta Release (#3889)

2024-08-06 18:07:12 -04:00

packaging.py

Bringing back "fix: Cleaning up the hashable content for the rule" (#4621) (#4668)

2025-04-28 16:34:25 +00:00

remote_validation.py

fix: removing outdated code in Kibana client auth (#4495)

2025-03-24 11:33:50 +00:00

rule_formatter.py

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

rule_loader.py

fix: Fixing leftover references to sha256 method (#4690)

2025-04-30 18:38:17 +00:00

rule_validators.py

Enhance Readability of KQL validation check failures (#4329)

2025-01-06 22:18:05 +05:30

rule.py

Bringing back "fix: Cleaning up the hashable content for the rule" (#4621) (#4668)

2025-04-28 16:34:25 +00:00

utils.py

Resolve datetime.utcfromtimestamp deprecation (#4719)

2025-05-19 16:09:54 +00:00

version_lock.py

[DaC] Beta Release (#3889)

2024-08-06 18:07:12 -04:00