3 Commits

Author	SHA1	Message	Date
Jonhnathan	c5ff8511a9	[Rule Tuning] Abnormal Process ID or Lock File Created (#2113) ... * [Rule Tuning] Abnormal Process ID or Lock File Created * Update rules/linux/execution_abnormal_process_id_file_created.toml * Update execution_abnormal_process_id_file_created.toml Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>	2022-08-23 09:59:31 -03:00
Jonhnathan	6e2d20362a	[Rule Tuning] Standardizing Risk Score according to Severity (#2242)	2022-08-21 22:29:39 -03:00
Terrance DeJesus	1704924f7b	[New Rule] Abnormal Process ID File Creation (#1964) ... * adding rule detection * changed Rule ID * Update rules/linux/execution_abnormal_process_id_file_created.toml Adding reboot extension as well. Reference: https://exatrack.com/public/Tricephalic_Hellkeeper.pdf * Update rules/linux/execution_abnormal_process_id_file_created.toml Adding reboot to description. Reference: https://exatrack.com/public/Tricephalic_Hellkeeper.pdf * Update rules/linux/execution_abnormal_process_id_file_created.toml Added additional reference to similar threat. * Update rules/linux/execution_abnormal_process_id_file_created.toml Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com> * Update rules/linux/execution_abnormal_process_id_file_created.toml Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com> * added rule for a process starting where the executable's name represented a PID file * Adjusted user.id value from integer to string * Added simple investigation notes and osquery coverage * TOML linting * Updated date to reflect recent changes Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com> Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>	2022-05-12 10:38:27 -04:00