security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[Rule Tuning] min_stack New Rules that use the S1 Integration (#4079)

Browse Source 
* [Rule Tuning] min_stack New Rules that use the S1 Integration

* Update execution_windows_powershell_susp_args.toml

* Update execution_initial_access_foxmail_exploit.toml
This commit is contained in:
Jonhnathan
2024-09-16 11:02:46 -03:00
committed by GitHub
parent 31ca246ea7
commit 7c78e4081f
6 changed files with 18 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/defense_evasion_msiexec_child_proc_netcon.toml
+3 -1
View File
@@ -2,7 +2,9 @@
creation_date = "2024/09/09"
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2024/09/09"
min_stack_comments = "Breaking change at 8.13.0 for SentinelOne Integration."
min_stack_version = "8.13.0"
updated_date = "2024/09/16"
[rule]
author = ["Elastic"]
rules/windows/execution_initial_access_foxmail_exploit.toml
+3 -1
View File
@@ -2,7 +2,9 @@
creation_date = "2024/08/29"
integration = ["endpoint", "windows", "system", "sentinel_one_cloud_funnel", "m365_defender"]
maturity = "production"
updated_date = "2024/09/16"
min_stack_comments = "Breaking change at 8.13.0 for SentinelOne Integration."
min_stack_version = "8.13.0"
updated_date = "2024/09/17"
[rule]
author = ["Elastic"]
rules/windows/execution_powershell_susp_args_via_winscript.toml
+3 -1
View File
@@ -2,7 +2,9 @@
creation_date = "2024/09/09"
integration = ["windows", "system", "sentinel_one_cloud_funnel", "m365_defender"]
maturity = "production"
updated_date = "2024/09/09"
min_stack_comments = "Breaking change at 8.13.0 for SentinelOne Integration."
min_stack_version = "8.13.0"
updated_date = "2024/09/16"
[rule]
author = ["Elastic"]
rules/windows/execution_windows_cmd_shell_susp_args.toml
+3 -1
View File
@@ -2,7 +2,9 @@
creation_date = "2024/09/06"
integration = ["windows", "system", "sentinel_one_cloud_funnel", "m365_defender"]
maturity = "production"
updated_date = "2024/09/06"
min_stack_comments = "Breaking change at 8.13.0 for SentinelOne Integration."
min_stack_version = "8.13.0"
updated_date = "2024/09/16"
[rule]
author = ["Elastic"]
rules/windows/execution_windows_powershell_susp_args.toml
+3 -1
View File
@@ -2,7 +2,9 @@
creation_date = "2024/09/06"
integration = ["windows", "system", "sentinel_one_cloud_funnel", "m365_defender"]
maturity = "production"
updated_date = "2024/09/06"
min_stack_comments = "Breaking change at 8.13.0 for SentinelOne Integration."
min_stack_version = "8.13.0"
updated_date = "2024/09/16"
[rule]
author = ["Elastic"]
rules/windows/privilege_escalation_msi_repair_via_mshelp_link.toml
+3 -1
View File
@@ -2,7 +2,9 @@
creation_date = "2024/09/12"
integration = ["endpoint", "sentinel_one_cloud_funnel", "m365_defender"]
maturity = "production"
updated_date = "2024/09/12"
min_stack_comments = "Breaking change at 8.13.0 for SentinelOne Integration."
min_stack_version = "8.13.0"
updated_date = "2024/09/16"
[rule]
author = ["Elastic"]