security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
3,633 Commits 1 Branch 0 Tags
main
Commit Graph

3 Commits

Author SHA1 Message Date
Terrance DeJesus deab1c0161 [Rule Tuning] Change event.dataset to data_stream.dataset (#5943) 
* [Rule Tuning] Change event.dataset to data_stream.dataset

* updating ESQL field names
 2026-04-10 12:27:52 -04:00
Ruben Groenewoud a973da1a6b [Rule Tuning] Linux DR Tuning - 9 (#5508) 
* [Rule Tuning] Linux DR Tuning - 9

* Update rules/linux/persistence_apt_package_manager_file_creation.toml

* Fix formatting in persistence_boot_file_copy.toml

* Update persistence_chkconfig_service_add.toml

* Change user.id values to string format in TOML

* Fix condition for Java process working directory

* Fix logical operator in OpenSSL passwd hash rule

* Fix syntax for working_directory check

* Fix condition for original file name check

* Update persistence_web_server_unusual_command_execution.toml

* Add cloud CLI tools to persistence rules

---------

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
 2026-01-07 16:18:38 +01:00
Ruben Groenewoud 18dd9cb04a [New Rule] Suspicious Usage of bpf_probe_write_user Helper (#4426) 
* [New Rule] Suspicious Usage of bpf_probe_write_user Helper

* Update persistence_bpf_probe_write_user.toml
 2025-01-29 11:46:40 +01:00