security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Move Setup information into setup filed (#3206)

Browse Source
This commit is contained in:
shashank-elastic
2023-10-23 19:28:18 +05:30
committed by GitHub
parent 3ab57fb8a7
commit 7254c582c5
108 changed files with 589 additions and 577 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/linux/execution_shell_via_java_revshell_linux.toml
+6 -6
View File
@@ -17,7 +17,12 @@ index = ["logs-endpoint.events.*"]
language = "eql"
license = "Elastic License v2"
name = "Potential Reverse Shell via Java"
note = """## Setup
references = [
"https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md"
]
risk_score = 47
rule_id = "5a3d5447-31c9-409a-aed1-72f9921594fd"
setup = """
This rule requires data coming in from Elastic Defend.
@@ -44,11 +49,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
"""
references = [
"https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md"
]
risk_score = 47
rule_id = "5a3d5447-31c9-409a-aed1-72f9921594fd"
severity = "medium"
tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Execution", "Data Source: Elastic Defend"]
type = "eql"