security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[Rule Tuning] Tighten Up Elastic Defend Indexes - Linux (#4446)

Browse Source
This commit is contained in:
Jonhnathan
2025-02-05 15:25:45 -03:00
committed by GitHub
parent ab89dfb98d
commit 0268daa17d
146 changed files with 292 additions and 292 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/linux/execution_shell_evasion_linux_binary.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2022/05/06"
integration = ["endpoint"]
maturity = "production"
updated_date = "2025/01/17"
updated_date = "2025/02/04"
[rule]
author = ["Elastic"]
@@ -12,7 +12,7 @@ system shell. The activity of spawning a shell from a binary is not common behav
and may indicate an attempt to evade detection, increase capabilities or enhance the stability of an adversary.
"""
from = "now-9m"
index = ["logs-endpoint.events.*"]
index = ["logs-endpoint.events.process*"]
language = "eql"
license = "Elastic License v2"
name = "Linux Restricted Shell Breakout via Linux Binary(s)"