Lucas Vega

Rule Does Not Meet Current Sigma Capabilities

1

For rule f6de9536-0441-4b3f-a646-f4e00f300ffd "Weak Encryption Enabled and Kerberoast", the values specified will never detect on Windows Security Event Logs (At least from what I can see; I do not have...

False-Negative: Netsh Firewall Discovery With Full Command Path

1

### Rule UUID 0e4164da-94bc-450d-a7be-a4b176179f1f ### Example EventLog EventCode=4688 ... Message=A new process has been created. ... Creator Subject: ... Target Subject: ... Process Information: New Process ID: 0xBEEF New Process...

Add Definition to Auditd susp_activity

1

I'd like to suggest adding a definition field to an Auditd rule that requires specific rules to be applied.   I see that the reference and description of the...