Skip to content

Commit bdd6343

Browse files
feat: add aurora process creation custom fields (#46)
* feat: add aurora process creation custom fields * update version
1 parent 7bf7b62 commit bdd6343

1 file changed

Lines changed: 9 additions & 2 deletions

File tree

tools/sigmahq_taxonomy.json

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"title": "Sigma taxonomy",
3-
"version": "20250613",
3+
"version": "20250825",
44
"taxonomy": {
55
"aws_none_cloudtrail": {
66
"logsource": {
@@ -2574,11 +2574,18 @@
25742574
"User"
25752575
],
25762576
"custom": [
2577+
"FileAge",
2578+
"FileCreationDate",
25772579
"GrandparentCommandLine",
2580+
"GrandparentImage",
2581+
"GrandparentProcessId",
25782582
"Imphash",
25792583
"md5",
2584+
"ParentSpoofed",
2585+
"ProcessTree",
25802586
"sha1",
2581-
"sha256"
2587+
"sha256",
2588+
"Winversion"
25822589
],
25832590
"redundant": ["Channel","EventID"]
25842591
}

0 commit comments

Comments
 (0)