security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Minstack endpoint rules with process.group.id fields (#4294)

Browse Source
This commit is contained in:
shashank-elastic
2024-12-10 21:03:32 +05:30
committed by GitHub
parent e6012b1db6
commit f0291b440a
2 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/linux/privilege_escalation_potential_suid_sgid_exploitation.toml
+3 -1
View File
@@ -2,7 +2,9 @@
creation_date = "2024/06/17"
integration = ["endpoint"]
maturity = "production"
updated_date = "2024/10/17"
min_stack_version = "8.16.0"
min_stack_comments = "Breaking change at 8.16.0 for the Endpoint Integration with respect to ecs field process.group.id"
updated_date = "2024/12/10"
[rule]
author = ["Elastic"]
rules/linux/privilege_escalation_sudo_token_via_process_injection.toml
+3 -1
View File
@@ -2,7 +2,9 @@
creation_date = "2023/07/31"
integration = ["endpoint"]
maturity = "production"
updated_date = "2024/05/21"
min_stack_version = "8.16.0"
min_stack_comments = "Breaking change at 8.16.0 for the Endpoint Integration with respect to ecs field process.group.id"
updated_date = "2024/12/10"
[rule]
author = ["Elastic"]