security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[Rule Tuning] UEBA new_terms process_executable (#3268)

Browse Source 
* [Rule Tuning] UEBA new_terms process_executable

* Update rules/windows/discovery_signal_unusual_discovery_signal_proc_executable.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

---------

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

(cherry picked from commit 1647a16fab)
This commit is contained in:
Ruben Groenewoud
2023-12-07 16:38:08 +01:00
committed by github-actions[bot]
parent 7ab6b29c66
commit d528af6bdb
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/discovery_signal_unusual_discovery_signal_proc_executable.toml
+3 -3
View File
@@ -3,13 +3,13 @@ creation_date = "2023/09/22"
maturity = "production"
min_stack_comments = "Multiple field support in the New Terms rule type was added in Elastic 8.6"
min_stack_version = "8.6.0"
updated_date = "2023/09/22"
updated_date = "2023/11/13"
[rule]
author = ["Elastic"]
description = """
This rule leverages alert data from various Discovery building block rules to alert on signals with unusual unique
host.id, user.id and process.executable entries.
This rule leverages Discovery building block rule alert data to alert on signals with unusual unique host.id, user.id
and process.executable entries.
"""
from = "now-9m"
index = [".alerts-security.*"]