Lock versions for 0.13.1 package
This commit is contained in:
Ross Wolf
+102
-82
@@ -111,8 +111,8 @@
|
||||
},
|
||||
"0b29cab4-dbbd-4a3f-9e8e-1287c7c11ae5": {
|
||||
"rule_name": "Anomalous Windows Process Creation",
|
||||
"sha256": "b23bb13b7dd326ec1974177f034b66193fe903b19d5da1431f558abfce3cdb97",
|
||||
"version": 4
|
||||
"sha256": "9e82b05aeb4575a98f709abc32dedcd6597e85d952b0f635e6e3efa77c34eea1",
|
||||
"version": 5
|
||||
},
|
||||
"0c7ca5c2-728d-4ad9-b1c5-bbba83ecb1f4": {
|
||||
"rule_name": "Peripheral Device Discovery",
|
||||
@@ -201,8 +201,8 @@
|
||||
},
|
||||
"143cb236-0956-4f42-a706-814bcaa0cf5a": {
|
||||
"rule_name": "RPC (Remote Procedure Call) from the Internet",
|
||||
"sha256": "6e62c6664dea80ac996968a0a7bbc02303f4bd4df96ff39881f6a1fa036289dd",
|
||||
"version": 8
|
||||
"sha256": "7451263e28396036b27ed324111bcec3e9c69fe87505c05b284e835ede9c5ca8",
|
||||
"version": 9
|
||||
},
|
||||
"14ed1aa9-ebfd-4cf9-a463-0ac59ec55204": {
|
||||
"rule_name": "Potential Persistence via Time Provider Modification",
|
||||
@@ -236,13 +236,13 @@
|
||||
},
|
||||
"16a52c14-7883-47af-8745-9357803f0d4c": {
|
||||
"rule_name": "Component Object Model Hijacking",
|
||||
"sha256": "58327576782adbc39e99e774604472036ec95eed3c5e324fc19288e7d635c8b3",
|
||||
"version": 3
|
||||
"sha256": "210931fff44cff26ff1c6fbb8d16c525ce7956382fb200a989335df36b12c628",
|
||||
"version": 4
|
||||
},
|
||||
"1781d055-5c66-4adf-9c59-fc0fa58336a5": {
|
||||
"rule_name": "Unusual Windows Username",
|
||||
"sha256": "e2e225e21975e985f3b317b2acab96e077fa87cf7e8904354bf8eae3d852b12e",
|
||||
"version": 5
|
||||
"sha256": "fb66f7a21c332b953f8b720d7d2eecff7fd8a3cc54ae26ec09ae2a2231105462",
|
||||
"version": 6
|
||||
},
|
||||
"1781d055-5c66-4adf-9c71-fc0fa58338c7": {
|
||||
"rule_name": "Unusual Windows Service",
|
||||
@@ -306,8 +306,8 @@
|
||||
},
|
||||
"1b21abcc-4d9f-4b08-a7f5-316f5f94b973": {
|
||||
"rule_name": "Connection to Internal Network via Telnet",
|
||||
"sha256": "82e4e45d80664b9115f0a2e0f4b1e2a43ccb0ec7283e64bc2bdbd70311c54256",
|
||||
"version": 5
|
||||
"sha256": "a6045befcf940787d6b44aca3ba847602c79275a601616a8cb50d66f621907f4",
|
||||
"version": 6
|
||||
},
|
||||
"1c6a8c7a-5cb6-4a82-ba27-d5a5b8a40a38": {
|
||||
"rule_name": "Possible Consent Grant Attack via Azure-Registered Application",
|
||||
@@ -351,8 +351,8 @@
|
||||
},
|
||||
"1faec04b-d902-4f89-8aff-92cd9043c16f": {
|
||||
"rule_name": "Unusual Linux User Calling the Metadata Service",
|
||||
"sha256": "3c8fba418050d2079a9f223c58298de759b56c0949e7ec330a256ffa6fed65d1",
|
||||
"version": 2
|
||||
"sha256": "d8647d38ddacdcf88500083f0009fe8c6bf67cbfa193518c40becdf8c8120be3",
|
||||
"version": 3
|
||||
},
|
||||
"1fe3b299-fbb5-4657-a937-1d746f2c711a": {
|
||||
"rule_name": "Unusual Network Activity from a Windows System Binary",
|
||||
@@ -426,8 +426,8 @@
|
||||
},
|
||||
"26f68dba-ce29-497b-8e13-b4fde1db5a2d": {
|
||||
"rule_name": "Attempts to Brute Force a Microsoft 365 User Account",
|
||||
"sha256": "542aade4dc8e6268eee81fb3f4974e882255636a433f7d784d71d1545896fb14",
|
||||
"version": 3
|
||||
"sha256": "4509c990b6afc653b5ce7ee74cd0866f17caf580091b972f31ceca58a26901d8",
|
||||
"version": 4
|
||||
},
|
||||
"272a6484-2663-46db-a532-ef734bf9a796": {
|
||||
"rule_name": "Microsoft 365 Exchange Transport Rule Modification",
|
||||
@@ -536,8 +536,8 @@
|
||||
},
|
||||
"32923416-763a-4531-bb35-f33b9232ecdb": {
|
||||
"rule_name": "RPC (Remote Procedure Call) to the Internet",
|
||||
"sha256": "04f44bb08ddbb0604f2f8a295fa3ab9107711bf25719957c4b12322148c00be5",
|
||||
"version": 8
|
||||
"sha256": "290eff512616935ff53c5fec73bddbcfb8a68c5cfaa6f403c4de8cbdc732f5b6",
|
||||
"version": 9
|
||||
},
|
||||
"32c5cf9c-2ef8-4e87-819e-5ccb7cd18b14": {
|
||||
"rule_name": "Program Files Directory Masquerading",
|
||||
@@ -581,8 +581,8 @@
|
||||
},
|
||||
"35f86980-1fb1-4dff-b311-3be941549c8d": {
|
||||
"rule_name": "Network Traffic to Rare Destination Country",
|
||||
"sha256": "cc78adc072f0c2c615cf9a3897eeda60bc19fd83e315ebcafbc73eaf9d7f7e0c",
|
||||
"version": 1
|
||||
"sha256": "154eabb2a4e70a6d0e7d51575de9ec07c7eb10055af37c36a9fec5645b76151a",
|
||||
"version": 2
|
||||
},
|
||||
"36a8e048-d888-4f61-a8b9-0f9e2e40f317": {
|
||||
"rule_name": "Suspicious ImagePath Service Creation",
|
||||
@@ -616,8 +616,8 @@
|
||||
},
|
||||
"3838e0e3-1850-4850-a411-2e8c5ba40ba8": {
|
||||
"rule_name": "Network Connection via Certutil",
|
||||
"sha256": "8036da9336f11b5e4c6381a89a1aca0fbe65d0159b529ca83bc2c985004f4994",
|
||||
"version": 5
|
||||
"sha256": "80cae6ba9f36885936ddc3bfc37d180db9ec37f430b853af1fe21a14311027a0",
|
||||
"version": 6
|
||||
},
|
||||
"38948d29-3d5d-42e3-8aec-be832aaaf8eb": {
|
||||
"rule_name": "Prompt for Credentials with OSASCRIPT",
|
||||
@@ -651,8 +651,8 @@
|
||||
},
|
||||
"3ad49c61-7adc-42c1-b788-732eda2f5abf": {
|
||||
"rule_name": "VNC (Virtual Network Computing) to the Internet",
|
||||
"sha256": "c8ef7b71bb1059379c1654dd566587b2d9a4611272692fda545242591e2ab456",
|
||||
"version": 8
|
||||
"sha256": "38600c025a0aab30c26b5eb880d9b9e0d1a6e66c9adc6c48361cd0988b1eee30",
|
||||
"version": 9
|
||||
},
|
||||
"3b382770-efbb-44f4-beed-f5e0a051b895": {
|
||||
"rule_name": "Malware - Prevented - Elastic Endgame",
|
||||
@@ -671,8 +671,8 @@
|
||||
},
|
||||
"3c7e32e6-6104-46d9-a06e-da0f8b5795a0": {
|
||||
"rule_name": "Unusual Linux Network Port Activity",
|
||||
"sha256": "5cc8ad5cd8645964e6128824ebac5c3adbaf8248845a61e423a8d8700e461d3d",
|
||||
"version": 4
|
||||
"sha256": "812b60afbec769e09def857ab8078ccd803d393f5f2fdd30ab043a95574a9df6",
|
||||
"version": 5
|
||||
},
|
||||
"3e002465-876f-4f04-b016-84ef48ce7e5d": {
|
||||
"rule_name": "AWS CloudTrail Log Updated",
|
||||
@@ -731,8 +731,8 @@
|
||||
},
|
||||
"445a342e-03fb-42d0-8656-0367eb2dead5": {
|
||||
"rule_name": "Unusual Windows Path Activity",
|
||||
"sha256": "20166dce2b7f66d82826f7ee93173a1166fbd36a5e32c73dbc6ca24bddba566f",
|
||||
"version": 4
|
||||
"sha256": "845885ac400eacce386fbf5040713ed065a66b447e5ddf8f450e0939c64bab9a",
|
||||
"version": 5
|
||||
},
|
||||
"453f659e-0429-40b1-bfdb-b6957286e04b": {
|
||||
"rule_name": "Permission Theft - Prevented - Elastic Endgame",
|
||||
@@ -756,8 +756,8 @@
|
||||
},
|
||||
"46f804f5-b289-43d6-a881-9387cf594f75": {
|
||||
"rule_name": "Unusual Process For a Linux Host",
|
||||
"sha256": "25aef314e7ab742c617ec902978be738afda5d8aeab82edb2072e77ff9f4cae6",
|
||||
"version": 5
|
||||
"sha256": "9a02d2b846f42825b80d06ad5019d0ce19295b546cb1172d033d045345b7182d",
|
||||
"version": 6
|
||||
},
|
||||
"47f09343-8d1f-4bb5-8bb0-00c9d18f5010": {
|
||||
"rule_name": "Execution via Regsvcs/Regasm",
|
||||
@@ -766,8 +766,8 @@
|
||||
},
|
||||
"47f76567-d58a-4fed-b32b-21f571e28910": {
|
||||
"rule_name": "Apple Script Execution followed by Network Connection",
|
||||
"sha256": "72865db7bc50525258024cbd485983b15e70529f488290fdc041b3b7f3dc6701",
|
||||
"version": 2
|
||||
"sha256": "34086f00f7c81d099a3adb242947eb40dbe6ad2debdf1accf86d786204506af4",
|
||||
"version": 3
|
||||
},
|
||||
"483c4daf-b0c6-49e0-adf3-0bfa93231d6b": {
|
||||
"rule_name": "Microsoft Exchange Server UM Spawning Suspicious Processes",
|
||||
@@ -846,8 +846,8 @@
|
||||
},
|
||||
"52aaab7b-b51c-441a-89ce-4387b3aea886": {
|
||||
"rule_name": "Unusual Network Connection via RunDLL32",
|
||||
"sha256": "7ff0bcfa3881f85e17c3a55b1a9f87403aeda1da00447412024e69307cbae7e8",
|
||||
"version": 9
|
||||
"sha256": "33e7314dd4b45b521415255a0c6fc075f77dba01dac56340b885f8befad43b9b",
|
||||
"version": 10
|
||||
},
|
||||
"52afbdc5-db15-485e-bc24-f5707f820c4b": {
|
||||
"rule_name": "Unusual Linux Network Activity",
|
||||
@@ -911,8 +911,8 @@
|
||||
},
|
||||
"5700cb81-df44-46aa-a5d7-337798f53eb8": {
|
||||
"rule_name": "VNC (Virtual Network Computing) from the Internet",
|
||||
"sha256": "9c364d024d1238ca509316cb5936f0ed20dd86be940e7ec8902bc1bfc3c112f1",
|
||||
"version": 8
|
||||
"sha256": "8575892e76f9b091979957bb6e78ba24b0d230753a3d74f5c8e0e6f99113ab1b",
|
||||
"version": 9
|
||||
},
|
||||
"571afc56-5ed9-465d-a2a9-045f099f6e7e": {
|
||||
"rule_name": "Credential Dumping - Detected - Elastic Endgame",
|
||||
@@ -1046,13 +1046,13 @@
|
||||
},
|
||||
"63e65ec3-43b1-45b0-8f2d-45b34291dc44": {
|
||||
"rule_name": "Network Connection via Signed Binary",
|
||||
"sha256": "fe36d773c522704ff2482572c21539cd38821bc22794dbdc12f9bc016145f498",
|
||||
"version": 7
|
||||
"sha256": "ef677da1d6e146d9608c74c535a574cde65a061bdf6949d119c91faea44f90ac",
|
||||
"version": 8
|
||||
},
|
||||
"647fc812-7996-4795-8869-9c4ea595fe88": {
|
||||
"rule_name": "Anomalous Process For a Linux Population",
|
||||
"sha256": "37b73c63d5ac1950496a55b1a66b8fa30f97c7c519632bb5a884962a22a18ffb",
|
||||
"version": 5
|
||||
"sha256": "861f9d3c0e4efc09b144f3f76f6d42e4b80fe2cddbf18ae15577dae6a6654f02",
|
||||
"version": 6
|
||||
},
|
||||
"6482255d-f468-45ea-a5b3-d3a7de1331ae": {
|
||||
"rule_name": "Modification of Safari Settings via Defaults Command",
|
||||
@@ -1166,13 +1166,13 @@
|
||||
},
|
||||
"6d448b96-c922-4adb-b51c-b767f1ea5b76": {
|
||||
"rule_name": "Unusual Process For a Windows Host",
|
||||
"sha256": "1b02664b15fd31520aca0ef9dae59735d6c260e17aa898a5ed1effdab5f77eb5",
|
||||
"version": 5
|
||||
"sha256": "dae4cd561de5c466bef0df104337dd06946c5cc4cdf3b9a2d64aa0f76b5cd5d4",
|
||||
"version": 6
|
||||
},
|
||||
"6e40d56f-5c0e-4ac6-aece-bee96645b172": {
|
||||
"rule_name": "Anomalous Process For a Windows Population",
|
||||
"sha256": "8c532d5331badf82eb8460f78b9c9743623961cbd11b41ebabc7a040f16e39a4",
|
||||
"version": 5
|
||||
"sha256": "0bfe01e9c90bf2cd3860c241bce55caf5defb909834492b09380bdd05ede5891",
|
||||
"version": 6
|
||||
},
|
||||
"6e9b351e-a531-4bdc-b73e-7034d6eed7ff": {
|
||||
"rule_name": "Enumeration of Users or Groups via Built-in Commands",
|
||||
@@ -1191,8 +1191,8 @@
|
||||
},
|
||||
"6ea71ff0-9e95-475b-9506-2580d1ce6154": {
|
||||
"rule_name": "DNS Activity to the Internet",
|
||||
"sha256": "e17fad5ebc0ca46c5a6d353543b8c3a7ec77d4f37afe29ccd6c1262fd0a3d317",
|
||||
"version": 8
|
||||
"sha256": "b6eaf970237f2fd397a64c592f8d01ede1038f2f3c0d68b7d2ffffcadc7129f3",
|
||||
"version": 9
|
||||
},
|
||||
"6f1500bc-62d7-4eb9-8601-7485e87da2f4": {
|
||||
"rule_name": "SSH (Secure Shell) to the Internet",
|
||||
@@ -1411,8 +1411,8 @@
|
||||
},
|
||||
"89f9a4b0-9f8f-4ee0-8823-c4751a6d6696": {
|
||||
"rule_name": "Command Prompt Network Connection",
|
||||
"sha256": "8b6406885b7bb2e8a1b923ce1cad697d9b124fbbde62d1f6e8a9d52a87632a1e",
|
||||
"version": 6
|
||||
"sha256": "59a5d1e0d72c62b3fc7912a7067eaaca424cbc50b4e63c75f51fc4ffb4421007",
|
||||
"version": 7
|
||||
},
|
||||
"89fa6cb7-6b53-4de2-b604-648488841ab8": {
|
||||
"rule_name": "Persistence via DirectoryService Plugin Modification",
|
||||
@@ -1424,6 +1424,11 @@
|
||||
"sha256": "d97ec49f15814bfde2f3f6b0603a9cf03bc171cffb3a6004202db2c71153461c",
|
||||
"version": 8
|
||||
},
|
||||
"8a1d4831-3ce6-4859-9891-28931fa6101d": {
|
||||
"rule_name": "Suspicious Execution from a Mounted Device",
|
||||
"sha256": "e88541a1a011cfb788e031595a6452d932dfb34adde8fb0adb6a87f91abf9c1e",
|
||||
"version": 1
|
||||
},
|
||||
"8a5c1e5f-ad63-481e-b53a-ef959230f7f1": {
|
||||
"rule_name": "Attempt to Deactivate an Okta Network Zone",
|
||||
"sha256": "39d70757faa0cbb8300bcfe88690a5ab67ac0efe7d33ac72e5975902b1e1b2a4",
|
||||
@@ -1441,8 +1446,8 @@
|
||||
},
|
||||
"8c1bdde8-4204-45c0-9e0c-c85ca3902488": {
|
||||
"rule_name": "RDP (Remote Desktop Protocol) from the Internet",
|
||||
"sha256": "c332f69b3d3ebd232a3993fbbf6e9433dfb9d5393f91f60e13ecf8821ec69c8e",
|
||||
"version": 8
|
||||
"sha256": "4d93ac2658ab5f45d146f08374be7a656986c2f8b23869ba686cd7ea3380eb34",
|
||||
"version": 9
|
||||
},
|
||||
"8c37dc0e-e3ac-4c97-8aa0-cf6a9122de45": {
|
||||
"rule_name": "Unusual Child Process of dns.exe",
|
||||
@@ -1616,8 +1621,8 @@
|
||||
},
|
||||
"99239e7d-b0d4-46e3-8609-acafcf99f68c": {
|
||||
"rule_name": "macOS Installer Spawns Network Event",
|
||||
"sha256": "984cad1381dd9afa09106634c1dbe9b53fe5827b48812999a26b779a5ebab44b",
|
||||
"version": 1
|
||||
"sha256": "9c685eb3133fc81f65b95648e73cf483f68d8c33378b9af971fdd78349e4d048",
|
||||
"version": 2
|
||||
},
|
||||
"9a1a2dae-0b5f-4c3d-8305-a268d404c306": {
|
||||
"rule_name": "Endpoint Security",
|
||||
@@ -1691,8 +1696,8 @@
|
||||
},
|
||||
"9d302377-d226-4e12-b54c-1906b5aec4f6": {
|
||||
"rule_name": "Unusual Linux Process Calling the Metadata Service",
|
||||
"sha256": "99083f476f27c715e48e8664229115c61b61b1652bd1be73a0e95b65b31a879a",
|
||||
"version": 2
|
||||
"sha256": "939fb37f3245d63c1e25753987fcf1b542e5e60e2f84d4dc26226d40be958420",
|
||||
"version": 3
|
||||
},
|
||||
"9f1c4ca3-44b5-481d-ba42-32dc215a2769": {
|
||||
"rule_name": "Potential Protocol Tunneling via EarthWorm",
|
||||
@@ -1826,8 +1831,8 @@
|
||||
},
|
||||
"abae61a8-c560-4dbd-acca-1e1438bff36b": {
|
||||
"rule_name": "Unusual Windows Process Calling the Metadata Service",
|
||||
"sha256": "d47b8762b1d507f3284720ed4081af8bbd7b798e8487c130de597dc6ef7b7527",
|
||||
"version": 2
|
||||
"sha256": "c8bab792d5a0d3d62e1447a105d4446258611cda4cb8a9e4b694a0d514c93728",
|
||||
"version": 3
|
||||
},
|
||||
"ac412404-57a5-476f-858f-4e8fbb4f48d8": {
|
||||
"rule_name": "Potential Persistence via Login Hook",
|
||||
@@ -1906,8 +1911,8 @@
|
||||
},
|
||||
"b240bfb8-26b7-4e5e-924e-218144a3fa71": {
|
||||
"rule_name": "Spike in Network Traffic",
|
||||
"sha256": "9b4c9eeb5b8b2bceefe216fe315f33c7680b1f19cd1bbff8ed2bc1fcd381c045",
|
||||
"version": 1
|
||||
"sha256": "6ffe245992cf7f7abbd461e915ccffd1dc815fe1d9933bb2e885eb6fa3d0cb3c",
|
||||
"version": 2
|
||||
},
|
||||
"b25a7df2-120a-4db2-bd3f-3e4b86b24bee": {
|
||||
"rule_name": "Remote File Copy via TeamViewer",
|
||||
@@ -1916,13 +1921,13 @@
|
||||
},
|
||||
"b29ee2be-bf99-446c-ab1a-2dc0183394b8": {
|
||||
"rule_name": "Network Connection via Compiled HTML File",
|
||||
"sha256": "019133bd004a19b16a85b00dc9cf843ec062679b58d784a3d08ca99fb63ab292",
|
||||
"version": 7
|
||||
"sha256": "5bd892d8ebcb429a2b8a9396f2cefbe7a02a3472326fa95b774f4c4b1a53ab2a",
|
||||
"version": 8
|
||||
},
|
||||
"b347b919-665f-4aac-b9e8-68369bf2340c": {
|
||||
"rule_name": "Unusual Linux Username",
|
||||
"sha256": "8d3fc06101f76d3625158c866245c82c55efaeea5aa68a7998d5f4c2f55b0074",
|
||||
"version": 5
|
||||
"sha256": "0ce8a8c9a7d0c6d52fb5a46182bb04c604688b0ffd63d3bb3ce25e44a3a613dc",
|
||||
"version": 6
|
||||
},
|
||||
"b41a13c6-ba45-4bab-a534-df53d0cfed6a": {
|
||||
"rule_name": "Suspicious Endpoint Security Parent Process",
|
||||
@@ -1971,8 +1976,8 @@
|
||||
},
|
||||
"b86afe07-0d98-4738-b15d-8d7465f95ff5": {
|
||||
"rule_name": "Network Connection via MsXsl",
|
||||
"sha256": "269ffb5fde08edde888f42bebe0a0954e7f0a82188ae6990f305c33b0a7cc044",
|
||||
"version": 6
|
||||
"sha256": "6569c4c09b7707943f2abd68297581a9b96cda43f2749734235e476c970787d4",
|
||||
"version": 7
|
||||
},
|
||||
"b90cdde7-7e0d-4359-8bf0-2c112ce2008a": {
|
||||
"rule_name": "UAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface",
|
||||
@@ -1991,8 +1996,8 @@
|
||||
},
|
||||
"ba342eb2-583c-439f-b04d-1fdd7c1417cc": {
|
||||
"rule_name": "Unusual Windows Network Activity",
|
||||
"sha256": "5b1caa506744552a652673d21edc0a4715dd0a771e3ae9b85b6727892cdf35c1",
|
||||
"version": 5
|
||||
"sha256": "a1f661b5265219da28a5be3c55ce6d710c54e00419ac86c23fb891c9bf0fcbc6",
|
||||
"version": 6
|
||||
},
|
||||
"baa5d22c-5e1c-4f33-bfc9-efa73bb53022": {
|
||||
"rule_name": "Suspicious Image Load (taskschd.dll) from MS Office",
|
||||
@@ -2051,8 +2056,8 @@
|
||||
},
|
||||
"bfeaf89b-a2a7-48a3-817f-e41829dc61ee": {
|
||||
"rule_name": "Suspicious DLL Loaded for Persistence or Privilege Escalation",
|
||||
"sha256": "fdf46a65e1d59ef2f2929dace2b97e19784e242565d236456411e53f87c6d774",
|
||||
"version": 1
|
||||
"sha256": "2e2cc6d275afd2b0ad2082fc64d16ff251c7b91b0ad5370583bc7fb460166ee5",
|
||||
"version": 2
|
||||
},
|
||||
"c02c8b9f-5e1d-463c-a1b0-04edcdfe1a3d": {
|
||||
"rule_name": "Potential Privacy Control Bypass via Localhost Secure Copy",
|
||||
@@ -2144,6 +2149,11 @@
|
||||
"sha256": "897b7cf567d45aebb4daaaba655d2627aac02b5c883882dad6f9cd26c1243975",
|
||||
"version": 4
|
||||
},
|
||||
"c7894234-7814-44c2-92a9-f7d851ea246a": {
|
||||
"rule_name": "Unusual Network Connection via DllHost",
|
||||
"sha256": "3e28a8bb55979694d9772245c4b8a44aeb04b4b6ea95f171ba58752e77a128c8",
|
||||
"version": 1
|
||||
},
|
||||
"c7ce36c0-32ff-4f9a-bfc2-dcb242bf99f9": {
|
||||
"rule_name": "Unusual File Modification by dns.exe",
|
||||
"sha256": "28d8ceeeae367d91ddfcc5654ea7a2a4f188e3914886461d1379da1a9e2a4e48",
|
||||
@@ -2151,8 +2161,8 @@
|
||||
},
|
||||
"c7db5533-ca2a-41f6-a8b0-ee98abe0f573": {
|
||||
"rule_name": "Spike in Network Traffic To a Country",
|
||||
"sha256": "6774d8dd42a2fb4f9e99da7b446f5cb28437e10cb1d775b9c55d0fbb38e0a10b",
|
||||
"version": 1
|
||||
"sha256": "2e908b7e338192c06491e1fe991b6eae62a1d164a4bc80084ea828f31430f38f",
|
||||
"version": 2
|
||||
},
|
||||
"c81cefcb-82b9-4408-a533-3c3df549e62d": {
|
||||
"rule_name": "Persistence via Docker Shortcut Modification",
|
||||
@@ -2431,8 +2441,8 @@
|
||||
},
|
||||
"df197323-72a8-46a9-a08e-3f5b04a4a97a": {
|
||||
"rule_name": "Unusual Windows User Calling the Metadata Service",
|
||||
"sha256": "da2ba9b91b45c96faf8b5007dc0ec15693e269318a6203fa90ba2d043f85d3a2",
|
||||
"version": 2
|
||||
"sha256": "40ac13cc950b6d31bbf8793ae0941af4edbaf36dc40070df6f4173775298c968",
|
||||
"version": 3
|
||||
},
|
||||
"df26fd74-1baa-4479-b42e-48da84642330": {
|
||||
"rule_name": "Azure Automation Account Created",
|
||||
@@ -2451,8 +2461,8 @@
|
||||
},
|
||||
"e08ccd49-0380-4b2b-8d71-8000377d6e49": {
|
||||
"rule_name": "Attempts to Brute Force an Okta User Account",
|
||||
"sha256": "d3a19e30b74d6b53aaae15b0678ea25c922302228cea85dde5aed39d9db25bd3",
|
||||
"version": 4
|
||||
"sha256": "0e7206d6334ee10726bbbf513659b98a614a9b5ab2e916603e598d530ff31e70",
|
||||
"version": 5
|
||||
},
|
||||
"e0f36de1-0342-453d-95a9-a068b257b053": {
|
||||
"rule_name": "Azure Event Hub Deletion",
|
||||
@@ -2466,8 +2476,8 @@
|
||||
},
|
||||
"e19e64ee-130e-4c07-961f-8a339f0b8362": {
|
||||
"rule_name": "Connection to External Network via Telnet",
|
||||
"sha256": "f1af1671f7dcae7e1678122ed09e278ba84f64df0a6652f3edaf91187117c4ff",
|
||||
"version": 5
|
||||
"sha256": "a45edaf4d918bf73f99e232fcd351f941cfa4f924fd8e1178dc914370f3c706a",
|
||||
"version": 6
|
||||
},
|
||||
"e2a67480-3b79-403d-96e3-fdd2992c50ef": {
|
||||
"rule_name": "AWS Management Console Root Login",
|
||||
@@ -2556,8 +2566,13 @@
|
||||
},
|
||||
"e90ee3af-45fc-432e-a850-4a58cf14a457": {
|
||||
"rule_name": "High Number of Okta User Password Reset or Unlock Attempts",
|
||||
"sha256": "16c391783d2d3d04c29a353d392764a8aec830daf68db15d29649bb9c067ba12",
|
||||
"version": 4
|
||||
"sha256": "a3589119873fe764082ca62c45709fecf67be62df872d4dc816e0bebc64b5429",
|
||||
"version": 5
|
||||
},
|
||||
"e919611d-6b6f-493b-8314-7ed6ac2e413b": {
|
||||
"rule_name": "AWS EC2 VM Export Failure",
|
||||
"sha256": "b84ca0431b650ae06a30ff5b647c5b67526c1b234a93c8e85d30a26d7d4c1446",
|
||||
"version": 1
|
||||
},
|
||||
"e94262f2-c1e9-4d3f-a907-aeab16712e1a": {
|
||||
"rule_name": "Unusual Executable File Creation by a System Critical Process",
|
||||
@@ -2586,8 +2601,8 @@
|
||||
},
|
||||
"eaa77d63-9679-4ce3-be25-3ba8b795e5fa": {
|
||||
"rule_name": "Spike in Firewall Denies",
|
||||
"sha256": "65ba8a3c5cb671c8c0f365caf5c11450c484b61eb9ee92645bf4229b10ff2ff2",
|
||||
"version": 1
|
||||
"sha256": "f388ca2c8b8c928235c3197913210b2230cf556ec9fd8573106701a3fb5d07b5",
|
||||
"version": 2
|
||||
},
|
||||
"eb079c62-4481-4d6e-9643-3ca499df7aaa": {
|
||||
"rule_name": "External Alerts",
|
||||
@@ -2744,6 +2759,11 @@
|
||||
"sha256": "a1fab020030d01dfba1dc1c38293f9c6f11877acef2296e84bd9934cb13f0b29",
|
||||
"version": 1
|
||||
},
|
||||
"f874315d-5188-4b4a-8521-d1c73093a7e4": {
|
||||
"rule_name": "Modification of AmsiEnable Registry Key",
|
||||
"sha256": "b493f546991997e0e6091c99211f7bc4ffd8aa4827ec8c4e75ffa1ae45a0e142",
|
||||
"version": 1
|
||||
},
|
||||
"f9590f47-6bd5-4a49-bd49-a2f886476fb9": {
|
||||
"rule_name": "Unusual Linux System Network Configuration Discovery",
|
||||
"sha256": "e0d27723f14bfc1f2d57f46507f432ac8447aeedaa48ac60222193653c4ea2a8",
|
||||
@@ -2761,8 +2781,8 @@
|
||||
},
|
||||
"fb02b8d3-71ee-4af1-bacd-215d23f17efa": {
|
||||
"rule_name": "Network Connection via Registration Utility",
|
||||
"sha256": "55b97f236823525ebcdff6607f3ce89dccea9b4d7acc813986d8a35ff65094c7",
|
||||
"version": 8
|
||||
"sha256": "3d038f9ff917769a14a4b725d0b29f1c7cb63e552144f2969e4dff1c77089b75",
|
||||
"version": 9
|
||||
},
|
||||
"fb9937ce-7e21-46bf-831d-1ad96eac674d": {
|
||||
"rule_name": "Auditd Max Failed Login Attempts",
|
||||
@@ -2796,8 +2816,8 @@
|
||||
},
|
||||
"ff013cb4-274d-434a-96bb-fe15ddd3ae92": {
|
||||
"rule_name": "Roshal Archive (RAR) or PowerShell File Downloaded from the Internet",
|
||||
"sha256": "fcb59813bb82c4a09e274f7748df5c9dc10d89f50b7466d9f96819dae17b0177",
|
||||
"version": 4
|
||||
"sha256": "b0766c2b5081f2da958a910b2935bf0773cef1af695c072f059551a4a1fee871",
|
||||
"version": 5
|
||||
},
|
||||
"ff4dd44a-0ac6-44c4-8609-3f81bc820f02": {
|
||||
"rule_name": "Microsoft 365 Exchange Transport Rule Creation",
|
||||
|
||||
Reference in New Issue
Block a user