security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update Minstack versions for SentinelOne rules (#3777)

Browse Source
This commit is contained in:
shashank-elastic
2024-06-11 18:58:26 +05:30
committed by GitHub
parent 8baf5dc2d8
commit 0a69c19c83
20 changed files with 60 additions and 61 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/collection_email_powershell_exchange_mailbox.toml
+3 -3
View File
@@ -2,9 +2,9 @@
creation_date = "2020/12/15"
integration = ["endpoint", "windows", "system", "sentinel_one_cloud_funnel"]
maturity = "production"
min_stack_comments = "SentinelOne integration package minimum version for validation."
min_stack_version = "8.11.0"
updated_date = "2024/05/16"
min_stack_comments = "Breaking change at 8.13.0 for SentinelOne Integration."
min_stack_version = "8.13.0"
updated_date = "2024/06/11"
[rule]
author = ["Elastic"]
rules/windows/command_and_control_port_forwarding_added_registry.toml
+3 -3
View File
@@ -2,9 +2,9 @@
creation_date = "2020/11/25"
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel"]
maturity = "production"
min_stack_comments = "SentinelOne integration package minimum version for validation."
min_stack_version = "8.11.0"
updated_date = "2024/05/16"
min_stack_comments = "Breaking change at 8.13.0 for SentinelOne Integration."
min_stack_version = "8.13.0"
updated_date = "2024/06/11"
[rule]
author = ["Elastic"]
rules/windows/command_and_control_rdp_tunnel_plink.toml
+3 -3
View File
@@ -2,9 +2,9 @@
creation_date = "2020/10/14"
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel"]
maturity = "production"
min_stack_comments = "SentinelOne integration package minimum version for validation."
min_stack_version = "8.11.0"
updated_date = "2024/05/16"
min_stack_comments = "Breaking change at 8.13.0 for SentinelOne Integration."
min_stack_version = "8.13.0"
updated_date = "2024/06/11"
[rule]
author = ["Elastic"]
rules/windows/command_and_control_screenconnect_childproc.toml
+3 -4
View File
@@ -2,10 +2,9 @@
creation_date = "2024/03/27"
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel"]
maturity = "production"
min_stack_comments = "SentinelOne integration package minimum version for validation."
min_stack_version = "8.11.0"
updated_date = "2024/05/16"
min_stack_comments = "Breaking change at 8.13.0 for SentinelOne Integration."
min_stack_version = "8.13.0"
updated_date = "2024/06/11"
[rule]
author = ["Elastic"]
rules/windows/credential_access_domain_backup_dpapi_private_keys.toml
+3 -3
View File
@@ -2,9 +2,9 @@
creation_date = "2020/08/13"
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel"]
maturity = "production"
min_stack_comments = "SentinelOne integration package minimum version for validation."
min_stack_version = "8.11.0"
updated_date = "2024/05/16"
min_stack_comments = "Breaking change at 8.13.0 for SentinelOne Integration."
min_stack_version = "8.13.0"
updated_date = "2024/06/11"
[rule]
author = ["Elastic"]
rules/windows/credential_access_kirbi_file.toml
+3 -3
View File
@@ -2,9 +2,9 @@
creation_date = "2023/08/23"
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel"]
maturity = "production"
min_stack_comments = "SentinelOne integration package minimum version for validation."
min_stack_version = "8.11.0"
updated_date = "2024/05/16"
min_stack_comments = "Breaking change at 8.13.0 for SentinelOne Integration."
min_stack_version = "8.13.0"
updated_date = "2024/06/11"
[rule]
author = ["Elastic"]
rules/windows/credential_access_mimikatz_memssp_default_logs.toml
+3 -3
View File
@@ -2,9 +2,9 @@
creation_date = "2020/08/31"
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel"]
maturity = "production"
min_stack_comments = "SentinelOne integration package minimum version for validation."
min_stack_version = "8.11.0"
updated_date = "2024/05/16"
min_stack_comments = "Breaking change at 8.13.0 for SentinelOne Integration."
min_stack_version = "8.13.0"
updated_date = "2024/06/11"
[rule]
author = ["Elastic"]
rules/windows/defense_evasion_amsi_bypass_dllhijack.toml
+3 -3
View File
@@ -2,9 +2,9 @@
creation_date = "2023/01/17"
integration = ["windows", "endpoint", "sentinel_one_cloud_funnel"]
maturity = "production"
min_stack_comments = "SentinelOne integration package minimum version for validation."
min_stack_version = "8.11.0"
updated_date = "2024/05/16"
min_stack_comments = "Breaking change at 8.13.0 for SentinelOne Integration."
min_stack_version = "8.13.0"
updated_date = "2024/06/11"
[transform]
[[transform.osquery]]
rules/windows/defense_evasion_hide_encoded_executable_registry.toml
+3 -3
View File
@@ -2,9 +2,9 @@
creation_date = "2020/11/25"
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel"]
maturity = "production"
min_stack_comments = "SentinelOne integration package minimum version for validation."
min_stack_version = "8.11.0"
updated_date = "2024/05/16"
min_stack_comments = "Breaking change at 8.13.0 for SentinelOne Integration."
min_stack_version = "8.13.0"
updated_date = "2024/06/11"
[rule]
author = ["Elastic"]
rules/windows/defense_evasion_masquerading_suspicious_werfault_childproc.toml
+3 -3
View File
@@ -2,9 +2,9 @@
creation_date = "2020/08/24"
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel"]
maturity = "production"
min_stack_comments = "SentinelOne integration package minimum version for validation."
min_stack_version = "8.11.0"
updated_date = "2024/05/16"
min_stack_comments = "Breaking change at 8.13.0 for SentinelOne Integration."
min_stack_version = "8.13.0"
updated_date = "2024/06/11"
[rule]
author = ["Elastic"]
rules/windows/defense_evasion_persistence_account_tokenfilterpolicy.toml
+3 -3
View File
@@ -2,9 +2,9 @@
creation_date = "2022/11/01"
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel"]
maturity = "production"
min_stack_comments = "SentinelOne integration package minimum version for validation."
min_stack_version = "8.11.0"
updated_date = "2024/05/16"
min_stack_comments = "Breaking change at 8.13.0 for SentinelOne Integration."
min_stack_version = "8.13.0"
updated_date = "2024/06/11"
[rule]
author = ["Elastic"]
rules/windows/defense_evasion_suspicious_zoom_child_process.toml
+3 -3
View File
@@ -2,9 +2,9 @@
creation_date = "2020/09/03"
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel"]
maturity = "production"
min_stack_comments = "SentinelOne integration package minimum version for validation."
min_stack_version = "8.11.0"
updated_date = "2024/05/16"
min_stack_comments = "Breaking change at 8.13.0 for SentinelOne Integration."
min_stack_version = "8.13.0"
updated_date = "2024/06/11"
[transform]
[[transform.osquery]]
rules/windows/execution_command_shell_started_by_unusual_process.toml
+3 -3
View File
@@ -2,9 +2,9 @@
creation_date = "2020/08/21"
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel"]
maturity = "production"
min_stack_comments = "SentinelOne integration package minimum version for validation."
min_stack_version = "8.11.0"
updated_date = "2024/05/16"
min_stack_comments = "Breaking change at 8.13.0 for SentinelOne Integration."
min_stack_version = "8.13.0"
updated_date = "2024/06/11"
[rule]
author = ["Elastic"]
rules/windows/initial_access_suspicious_ms_outlook_child_process.toml
+3 -3
View File
@@ -2,9 +2,9 @@
creation_date = "2020/02/18"
integration = ["endpoint", "windows", "system", "sentinel_one_cloud_funnel"]
maturity = "production"
min_stack_comments = "SentinelOne integration package minimum version for validation."
min_stack_version = "8.11.0"
updated_date = "2024/05/16"
min_stack_comments = "Breaking change at 8.13.0 for SentinelOne Integration."
min_stack_version = "8.13.0"
updated_date = "2024/06/11"
[rule]
author = ["Elastic"]
rules/windows/persistence_adobe_hijack_persistence.toml
+3 -3
View File
@@ -2,9 +2,9 @@
creation_date = "2020/02/18"
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel"]
maturity = "production"
min_stack_comments = "SentinelOne integration package minimum version for validation."
min_stack_version = "8.11.0"
updated_date = "2024/05/16"
min_stack_comments = "Breaking change at 8.13.0 for SentinelOne Integration."
min_stack_version = "8.13.0"
updated_date = "2024/06/11"
[transform]
[[transform.osquery]]
rules/windows/persistence_appcertdlls_registry.toml
+3 -3
View File
@@ -2,9 +2,9 @@
creation_date = "2020/11/18"
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel"]
maturity = "production"
min_stack_comments = "SentinelOne integration package minimum version for validation."
min_stack_version = "8.11.0"
updated_date = "2024/05/16"
min_stack_comments = "Breaking change at 8.13.0 for SentinelOne Integration."
min_stack_version = "8.13.0"
updated_date = "2024/06/11"
[rule]
author = ["Elastic"]
rules/windows/persistence_local_scheduled_job_creation.toml
+3 -3
View File
@@ -2,9 +2,9 @@
creation_date = "2021/03/15"
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel"]
maturity = "production"
min_stack_comments = "SentinelOne integration package minimum version for validation."
min_stack_version = "8.11.0"
updated_date = "2024/05/16"
min_stack_comments = "Breaking change at 8.13.0 for SentinelOne Integration."
min_stack_version = "8.13.0"
updated_date = "2024/06/11"
[rule]
author = ["Elastic"]
rules/windows/persistence_system_shells_via_services.toml
+3 -3
View File
@@ -2,9 +2,9 @@
creation_date = "2020/02/18"
integration = ["endpoint", "windows", "system", "sentinel_one_cloud_funnel"]
maturity = "production"
min_stack_comments = "SentinelOne integration package minimum version for validation."
min_stack_version = "8.11.0"
updated_date = "2024/05/16"
min_stack_comments = "Breaking change at 8.13.0 for SentinelOne Integration."
min_stack_version = "8.13.0"
updated_date = "2024/06/11"
[transform]
[[transform.osquery]]
rules/windows/persistence_via_bits_job_notify_command.toml
+3 -3
View File
@@ -2,9 +2,9 @@
creation_date = "2021/12/04"
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel"]
maturity = "production"
min_stack_comments = "SentinelOne integration package minimum version for validation."
min_stack_version = "8.11.0"
updated_date = "2024/05/16"
min_stack_comments = "Breaking change at 8.13.0 for SentinelOne Integration."
min_stack_version = "8.13.0"
updated_date = "2024/06/11"
[rule]
author = ["Elastic"]
rules/windows/persistence_webshell_detection.toml
+3 -3
View File
@@ -2,9 +2,9 @@
creation_date = "2021/08/24"
integration = ["endpoint", "windows", "system", "sentinel_one_cloud_funnel"]
maturity = "production"
min_stack_comments = "SentinelOne integration package minimum version for validation."
min_stack_version = "8.11.0"
updated_date = "2024/05/16"
min_stack_comments = "Breaking change at 8.13.0 for SentinelOne Integration."
min_stack_version = "8.13.0"
updated_date = "2024/06/11"
[rule]
author = ["Elastic"]