sigma-rules

Author SHA1 Message Date

Author	SHA1	Message	Date
Jonhnathan	063386829c	[Security Content] Include "Data Source: Elastic Defend" tag (#3002 ) * win folder * Other folders * Update test_all_rules.py * . * updated missing elastic defend tags --------- Co-authored-by: terrancedejesus <terrance.dejesus@elastic.co> (cherry picked from commit `4233fef238`)	2023-09-05 18:28:40 +00:00
Ruben Groenewoud	ba6952c242	[Rule Tuning] 3 tunings to reduce FPs (#3058 ) * [Rule Tuning] 2 tunings to reduce FPs back to 0 * Added one more tune for community issue #3041 * Update rules/linux/execution_abnormal_process_id_file_created.toml * Update rules/linux/execution_abnormal_process_id_file_created.toml (cherry picked from commit `3588600d57`)	2023-08-31 15:22:59 +00:00
Ruben Groenewoud	4bcec3397c	[New Rule] Potential Suspicious DebugFS Root Device Access (#2982 ) * [New Rule] Potential DebugFS Privilege Escalation * Changed rule name * Update rules/linux/privilege_escalation_sda_disk_mount_non_root.toml --------- Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>	2023-08-03 16:13:34 +02:00

Jonhnathan

063386829c

[Security Content] Include "Data Source: Elastic Defend" tag (#3002 )

* win folder

* Other folders

* Update test_all_rules.py

* .

* updated missing elastic defend tags

---------

Co-authored-by: terrancedejesus <terrance.dejesus@elastic.co>

(cherry picked from commit 4233fef238)

2023-09-05 18:28:40 +00:00

Ruben Groenewoud

ba6952c242

[Rule Tuning] 3 tunings to reduce FPs (#3058 )

* [Rule Tuning] 2 tunings to reduce FPs back to 0

* Added one more tune for community issue #3041

* Update rules/linux/execution_abnormal_process_id_file_created.toml

* Update rules/linux/execution_abnormal_process_id_file_created.toml

(cherry picked from commit 3588600d57)

2023-08-31 15:22:59 +00:00

Ruben Groenewoud

4bcec3397c

[New Rule] Potential Suspicious DebugFS Root Device Access (#2982 )

* [New Rule] Potential DebugFS Privilege Escalation

* Changed rule name

* Update rules/linux/privilege_escalation_sda_disk_mount_non_root.toml

---------

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>

2023-08-03 16:13:34 +02:00

3 Commits