Prep main for 9.1 (#4555)
* Prep for Release 9.1 * Update Patch Version * Update Patch version * Update Patch version
This commit is contained in:
@@ -2,9 +2,7 @@
|
||||
creation_date = "2020/11/18"
|
||||
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel"]
|
||||
maturity = "production"
|
||||
updated_date = "2025/02/03"
|
||||
min_stack_version = "8.14.0"
|
||||
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
|
||||
updated_date = "2025/03/20"
|
||||
|
||||
[transform]
|
||||
[[transform.osquery]]
|
||||
@@ -39,7 +37,14 @@ Identifies script engines creating files in the Startup folder, or the creation
|
||||
Adversaries may abuse this technique to maintain persistence in an environment.
|
||||
"""
|
||||
from = "now-9m"
|
||||
index = ["winlogbeat-*", "logs-endpoint.events.file-*", "logs-windows.sysmon_operational-*", "endgame-*", "logs-m365_defender.event-*", "logs-sentinel_one_cloud_funnel.*"]
|
||||
index = [
|
||||
"winlogbeat-*",
|
||||
"logs-endpoint.events.file-*",
|
||||
"logs-windows.sysmon_operational-*",
|
||||
"endgame-*",
|
||||
"logs-m365_defender.event-*",
|
||||
"logs-sentinel_one_cloud_funnel.*",
|
||||
]
|
||||
language = "eql"
|
||||
license = "Elastic License v2"
|
||||
name = "Persistent Scripts in the Startup Directory"
|
||||
|
||||
Reference in New Issue
Block a user