security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[Rule Tuning] Added Kubernetes Data Source Tag (#4831)

Browse Source
This commit is contained in:
Ruben Groenewoud
2025-06-24 13:18:58 +02:00
committed by GitHub
parent 4b20d69c03
commit e666cabb3d
4 changed files with 8 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/linux/credential_access_kubernetes_service_account_secret_access.toml
+2 -1
View File
@@ -2,7 +2,7 @@
creation_date = "2025/06/17"
integration = ["endpoint"]
maturity = "production"
updated_date = "2025/06/17"
updated_date = "2025/06/19"
[rule]
author = ["Elastic"]
@@ -49,6 +49,7 @@ severity = "medium"
tags = [
"Domain: Endpoint",
"Domain: Container",
"Domain: Kubernetes",
"OS: Linux",
"Use Case: Threat Detection",
"Tactic: Credential Access",
rules/linux/discovery_kubeconfig_file_discovery.toml
+2 -1
View File
@@ -2,7 +2,7 @@
creation_date = "2025/06/17"
integration = ["endpoint"]
maturity = "production"
updated_date = "2025/06/17"
updated_date = "2025/06/19"
[rule]
author = ["Elastic"]
@@ -56,6 +56,7 @@ severity = "low"
tags = [
"Domain: Endpoint",
"Domain: Container",
"Domain: Kubernetes",
"OS: Linux",
"Use Case: Threat Detection",
"Tactic: Discovery",
rules/linux/discovery_kubectl_permission_discovery.toml
+2 -1
View File
@@ -2,7 +2,7 @@
creation_date = "2025/06/17"
integration = ["endpoint"]
maturity = "production"
updated_date = "2025/06/17"
updated_date = "2025/06/19"
[rule]
author = ["Elastic"]
@@ -52,6 +52,7 @@ severity = "low"
tags = [
"Domain: Endpoint",
"Domain: Container",
"Domain: Kubernetes",
"OS: Linux",
"Use Case: Threat Detection",
"Tactic: Discovery",
rules/linux/lateral_movement_kubeconfig_file_activity.toml
+2 -1
View File
@@ -2,7 +2,7 @@
creation_date = "2025/06/17"
integration = ["endpoint"]
maturity = "production"
updated_date = "2025/06/17"
updated_date = "2025/06/19"
[rule]
author = ["Elastic"]
@@ -53,6 +53,7 @@ severity = "medium"
tags = [
"Domain: Endpoint",
"Domain: Container",
"Domain: Kubernetes",
"OS: Linux",
"Use Case: Threat Detection",
"Tactic: Lateral Movement",