security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[Rule Tuning] Update LMD Rules Min-Stack to 8.5 (#3142)

Browse Source 
* updating min-stack to 8.5

* updated min stack comments

(cherry picked from commit 8650b26002)
This commit is contained in:
Terrance DeJesus
2023-09-27 16:17:52 -04:00
committed by github-actions[bot]
parent 116a7de890
commit fadd7fe320
13 changed files with 39 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/integrations/lmd/lateral_movement_malicious_remote_file_creation.toml
+3 -3
View File
@@ -2,9 +2,9 @@
creation_date = "2023/09/13"
integration = ["lmd","endpoint"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/09/21"
min_stack_comments = "LMD first package ga available in 8.5.0"
min_stack_version = "8.5.0"
updated_date = "2023/09/27"
[rule]
author = ["Elastic"]
rules/integrations/lmd/lateral_movement_ml_high_mean_rdp_process_args.toml
+3 -3
View File
@@ -2,9 +2,9 @@
creation_date = "2023/09/13"
integration = ["lmd"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/09/21"
min_stack_comments = "LMD first package ga available in 8.5.0"
min_stack_version = "8.5.0"
updated_date = "2023/09/27"
[rule]
anomaly_threshold = 70
rules/integrations/lmd/lateral_movement_ml_high_mean_rdp_session_duration.toml
+3 -3
View File
@@ -2,9 +2,9 @@
creation_date = "2023/09/12"
integration = ["lmd"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/09/21"
min_stack_comments = "LMD first package ga available in 8.5.0"
min_stack_version = "8.5.0"
updated_date = "2023/09/27"
[rule]
anomaly_threshold = 70
rules/integrations/lmd/lateral_movement_ml_high_remote_file_size.toml
+3 -3
View File
@@ -2,9 +2,9 @@
creation_date = "2023/09/13"
integration = ["lmd"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/09/21"
min_stack_comments = "LMD first package ga available in 8.5.0"
min_stack_version = "8.5.0"
updated_date = "2023/09/27"
[rule]
anomaly_threshold = 70
rules/integrations/lmd/lateral_movement_ml_high_variance_rdp_session_duration.toml
+3 -3
View File
@@ -2,9 +2,9 @@
creation_date = "2023/09/13"
integration = ["lmd"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/09/21"
min_stack_comments = "LMD first package ga available in 8.5.0"
min_stack_version = "8.5.0"
updated_date = "2023/09/27"
[rule]
anomaly_threshold = 70
rules/integrations/lmd/lateral_movement_ml_rare_remote_file_directory.toml
+3 -3
View File
@@ -2,9 +2,9 @@
creation_date = "2023/09/12"
integration = ["lmd"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/09/21"
min_stack_comments = "LMD first package ga available in 8.5.0"
min_stack_version = "8.5.0"
updated_date = "2023/09/27"
[rule]
anomaly_threshold = 70
rules/integrations/lmd/lateral_movement_ml_rare_remote_file_extension.toml
+3 -3
View File
@@ -2,9 +2,9 @@
creation_date = "2023/09/13"
integration = ["lmd"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/09/21"
min_stack_comments = "LMD first package ga available in 8.5.0"
min_stack_version = "8.5.0"
updated_date = "2023/09/27"
[rule]
anomaly_threshold = 70
rules/integrations/lmd/lateral_movement_ml_spike_in_connections_from_a_source_ip.toml
+3 -3
View File
@@ -2,9 +2,9 @@
creation_date = "2023/09/13"
integration = ["lmd"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/09/21"
min_stack_comments = "LMD first package ga available in 8.5.0"
min_stack_version = "8.5.0"
updated_date = "2023/09/27"
[rule]
anomaly_threshold = 70
rules/integrations/lmd/lateral_movement_ml_spike_in_connections_to_a_destination_ip.toml
+3 -3
View File
@@ -2,9 +2,9 @@
creation_date = "2023/09/13"
integration = ["lmd"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/09/21"
min_stack_comments = "LMD first package ga available in 8.5.0"
min_stack_version = "8.5.0"
updated_date = "2023/09/27"
[rule]
anomaly_threshold = 70
rules/integrations/lmd/lateral_movement_ml_spike_in_rdp_processes.toml
+3 -3
View File
@@ -2,9 +2,9 @@
creation_date = "2023/09/12"
integration = ["lmd"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/09/21"
min_stack_comments = "LMD first package ga available in 8.5.0"
min_stack_version = "8.5.0"
updated_date = "2023/09/27"
[rule]
anomaly_threshold = 70
rules/integrations/lmd/lateral_movement_ml_spike_in_remote_file_transfers.toml
+3 -3
View File
@@ -2,9 +2,9 @@
creation_date = "2023/09/13"
integration = ["lmd"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/09/21"
min_stack_comments = "LMD first package ga available in 8.5.0"
min_stack_version = "8.5.0"
updated_date = "2023/09/27"
[rule]
anomaly_threshold = 70
rules/integrations/lmd/lateral_movement_ml_unusual_time_for_an_rdp_session.toml
+3 -3
View File
@@ -2,9 +2,9 @@
creation_date = "2023/09/13"
integration = ["lmd"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/09/21"
min_stack_comments = "LMD first package ga available in 8.5.0"
min_stack_version = "8.5.0"
updated_date = "2023/09/27"
[rule]
anomaly_threshold = 70
rules/integrations/lmd/lateral_movement_remote_file_creation_in_sensitive_directory.toml
+3 -3
View File
@@ -2,9 +2,9 @@
creation_date = "2023/09/13"
integration = ["lmd","endpoint"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/09/21"
min_stack_comments = "LMD first package ga available in 8.5.0"
min_stack_version = "8.5.0"
updated_date = "2023/09/27"
[rule]
author = ["Elastic"]