Respository - Sharing BIOC Rules for Import

[RFeyertag]

Hello dear community, 

does someone of you know, where we can find a respository for extended bioc rules to import them? 

One was mentioned here:

https://github.com/Data-Equipment-AS/CortexXDR-BIOC

Maybe some of you want to share their bioc rules? Me personally would be interested in event_id, like create a new account etc. 

BR

Rob

[bbarmanroy]

Great idea @RFeyertag ! 
How about you create a few PR's for the repo you mentioned with a few use cases? I am sure the community can come up with use cases!

*Note* : Do remember not to include any sensitive info like hashes, paths that provide more information about your environment.

E.g. replace a path "C:\ProgramFiles\MajorBank\abc.exe" with "C:\ProgramFiles\<insertPathHere>\abc.exe".