elastic-detection-rules

mirror of https://github.com/elastic/detection-rules synced 2026-06-08 14:00:08 +00:00

Files

T

Samirbous 521e4dc8f1 [New Rule] Potential Lsass Memory Dump via MirrorDump (#1504 )

* [New Rule] Potential Lsass Memory Dump via MirrorDump

* added tactic

* switched to kql

* added sysmon process access non ecs types

* Update rules/windows/credential_access_potential_lsa_memdump_via_mirrordump.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update rules/windows/credential_access_potential_lsa_memdump_via_mirrordump.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* rule.name as suggested by Justin and converted to EQL to add comments

* Update rules/windows/credential_access_potential_lsa_memdump_via_mirrordump.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update rules/windows/credential_access_potential_lsa_memdump_via_mirrordump.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

2021-09-30 10:16:36 +02:00

api_schemas

[Bug] CLI Fixes (#1073 )

2021-09-10 10:06:04 -08:00

beats_schemas

Pull latest ECS+beats schemas and update schema-map (#1417 )

2021-08-12 13:08:12 -08:00

ecs_schemas

Pull latest ECS+beats schemas and update schema-map (#1417 )

2021-08-12 13:08:12 -08:00

attack-crosswalk.json

[Rule Tuning] Update ATT&CK threat mappings to reflect changes (#706 )