security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,787 Commits 1 Branch 0 Tags
10f00a3f887ed7dd115598ab9833fbd3abbe2c5e
Commit Graph

1787 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Colson Wilhoit 10f00a3f88 Create new_meta.md (#3305) 
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>
 2023-12-08 14:39:02 -06:00
Mika Ayenson 7514c0a206 [FR] Add Support for ES|QL Rule Type and Remote Validation (#3281) 
* add suuport for esql type
* add unit tests
* set clients in RemoteConnector from auth methods
* thread remote rules; add engine test
* Add versions to remote validation results

---------

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: brokensound77 <brokensound77@users.noreply.github.com>
Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>
 2023-12-08 12:46:28 -07:00
Jonhnathan aeb1f91320 [Security Content] Introduce Investigate Plugin in Investigation Guides (#3080) 
* [Security Content] Introduce Investigate Plugin in Investigation Guides
* Add compatibility note
* Update Transform format
* update transform unit tests for investigate
* updated docs with transform

---------

Co-authored-by: brokensound77 <brokensound77@users.noreply.github.com>
Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>
 2023-12-08 11:54:40 -07:00
Jonhnathan eb7c5f6717 [Security Content] Add Windows Investigation Guides (#3095) 
* [Security Content] Add Windows Investigation Guides

* Update defense_evasion_rundll32_no_arguments.toml

* Update persistence_suspicious_image_load_scheduled_task_ms_office.toml

* Update privilege_escalation_posh_token_impersonation.toml

* Apply suggestions from code review

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

* Update execution_ms_office_written_file.toml

* Update persistence_suspicious_image_load_scheduled_task_ms_office.toml

* Update rules/windows/defense_evasion_rundll32_no_arguments.toml

Co-authored-by: Benjamin Ironside Goldstein <91905639+benironside@users.noreply.github.com>

* Update rules/windows/defense_evasion_wsl_enabled_via_dism.toml

Co-authored-by: Benjamin Ironside Goldstein <91905639+benironside@users.noreply.github.com>

* Update rules/windows/defense_evasion_wsl_enabled_via_dism.toml

Co-authored-by: Benjamin Ironside Goldstein <91905639+benironside@users.noreply.github.com>

* Update rules/windows/defense_evasion_wsl_registry_modification.toml

Co-authored-by: Benjamin Ironside Goldstein <91905639+benironside@users.noreply.github.com>

* Update rules/windows/defense_evasion_wsl_registry_modification.toml

Co-authored-by: Benjamin Ironside Goldstein <91905639+benironside@users.noreply.github.com>

* Update rules/windows/execution_ms_office_written_file.toml

Co-authored-by: Benjamin Ironside Goldstein <91905639+benironside@users.noreply.github.com>

* Update rules/windows/persistence_suspicious_image_load_scheduled_task_ms_office.toml

Co-authored-by: Benjamin Ironside Goldstein <91905639+benironside@users.noreply.github.com>

* Update rules/windows/persistence_suspicious_image_load_scheduled_task_ms_office.toml

Co-authored-by: Benjamin Ironside Goldstein <91905639+benironside@users.noreply.github.com>

* Update rules/windows/persistence_via_wmi_stdregprov_run_services.toml

Co-authored-by: Benjamin Ironside Goldstein <91905639+benironside@users.noreply.github.com>

* Update privilege_escalation_posh_token_impersonation.toml

---------

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
Co-authored-by: Benjamin Ironside Goldstein <91905639+benironside@users.noreply.github.com>
 2023-12-08 11:31:16 -03:00
Ruben Groenewoud 840958d117 [New Rule] Suspicious File Creation via Kworker (#3237) 
* [New Rule] Suspicious File Creation via Kworker

* Update rules/linux/persistence_kworker_file_creation.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

---------

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
 2023-12-07 23:02:00 +01:00
Ruben Groenewoud 490fa0e1d2 [New Rule] Out-Of-Tree Kernel Module Load (#3233) 
* [New Rule] Out-Of-Tree Kernel Module Load

* Update rules_building_block/persistence_tainted_kernel_module_out_of_tree_load.toml

* Update rules_building_block/persistence_tainted_kernel_module_out_of_tree_load.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules_building_block/persistence_tainted_kernel_module_out_of_tree_load.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules_building_block/persistence_tainted_kernel_module_out_of_tree_load.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

---------

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
 2023-12-07 22:53:21 +01:00
Ruben Groenewoud 07b1cab919 [New BBR] Pot. Persistence Through Systemd-udevd (#3235) 
* [New BBR] Persistence Through Systemd-udevd

* Formatting change

* Update rules_building_block/persistence_udev_rule_creation.toml

* Update rules_building_block/persistence_udev_rule_creation.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules_building_block/persistence_udev_rule_creation.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

---------

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
 2023-12-07 22:42:29 +01:00
Ruben Groenewoud 9c61231dc6 [New Rule] UID Elevation from Unknown Executable (#3239) 
* [New Rule] UID Elevation from Unknown Executable

* type change

* bump min stack

* Added additional exclusions

* Update rules/linux/privilege_escalation_uid_elevation_from_unknown_executable.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/linux/privilege_escalation_uid_elevation_from_unknown_executable.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/linux/privilege_escalation_uid_elevation_from_unknown_executable.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

---------

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
 2023-12-07 22:25:01 +01:00
Ruben Groenewoud 1071b12f00 [New Rule] Suspicious Kworker UID Elevation (#3238) 
* [New Rule] Suspicious Kworker UID Elevation

* Update privilege_escalation_kworker_uid_elevation.toml

---------

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
 2023-12-07 20:59:07 +01:00
Samirbous 7070eb3b34 [New] Rare SMB Connection to the Internet (#3300) 
* Create exfiltration_smb_rare_destination.toml

* Update exfiltration_smb_rare_destination.toml

* Update exfiltration_smb_rare_destination.toml

---------

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
 2023-12-07 13:10:20 -03:00
Ruben Groenewoud 1647a16fab [Rule Tuning] UEBA new_terms process_executable (#3268) 
* [Rule Tuning] UEBA new_terms process_executable

* Update rules/windows/discovery_signal_unusual_discovery_signal_proc_executable.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

---------

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
 2023-12-07 16:38:08 +01:00
Ruben Groenewoud 38862b89e9 [Tuning] Small Linux DR Tuning (#3287) 2023-12-07 12:45:24 +01:00
Samirbous 7488c60090 [New] Process Created with a Duplicated Token (#3152) 
* [New] Process Created with a Duplicated Token

using `process.Ext.effective_parent.executable` to detect impersonation using token duplicates from windows native binaries to run common lolbins or recently dropped unsigned ones :

* Update privilege_escalation_create_process_with_token_unpriv.toml

* Update privilege_escalation_create_process_with_token_unpriv.toml

* Update rules/windows/privilege_escalation_create_process_with_token_unpriv.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update privilege_escalation_create_process_with_token_unpriv.toml

---------

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
 2023-12-07 08:20:30 -03:00
Eric a4ad0b6a24 Fix syntax error in query (#3285) 
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
 2023-12-07 07:49:18 -03:00
Terrance DeJesus 5e1546c57c [Rule Tuning] Multiple Users with the Same Okta Device Token Hash (#3304) 
* tuning rule; adding investigation guide

* updated MITRE ATT&CK

* updated file name

* Updating description

* updated investigation guide

* fixed ATT&CK mappings; updated tags
 2023-12-06 10:35:46 -05:00
Jonhnathan e5d676797e [Rule Tuning] Windows DR Tuning - 5 (#3229) 
* [Rule Tuning] Windows DR Tuning - 5

* .

* Revert changes BehaviorOnFailedVerify

---------

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
 2023-12-05 19:20:40 -03:00
Samirbous e6df245ff3 [New] Interactive Logon by an Unusual Process (#3299) 
* Create privilege_escalation_make_token_local.toml

* Update privilege_escalation_make_token_local.toml

* Update privilege_escalation_make_token_local.toml
 2023-12-05 17:34:10 +00:00
Terrance DeJesus 5358361754 Adjust ESQLRuleData to Inherit QueryRuleData Dataclass (#3297) 
* adjusting inheritance of ESQL rule data

* update tests to handle missing index from QueryRuleData

* removed test es|ql rule

---------

Co-authored-by: brokensound77 <brokensound77@users.noreply.github.com>
 2023-11-30 09:06:34 -05:00
Mika Ayenson f7b9a1f8df Update QueryRuleData (#3294) 2023-11-29 09:43:04 -06:00
Mika Ayenson bc39c20eaf FR] Add Core Support for ES|QL Rule Type (#3292) 2023-11-28 13:03:09 -06:00
github-actions[bot] ba7b2722c2 Lock versions for releases: 8.3,8.4,8.5,8.6,8.7,8.8,8.9,8.10,8.11 (#3291) 
* Locked versions for releases: 8.3,8.4,8.5,8.6,8.7,8.8,8.9,8.10,8.11

* Update detection_rules/etc/version.lock.json

---------

Co-authored-by: terrancedejesus <terrancedejesus@users.noreply.github.com>
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
 2023-11-28 12:30:55 -05:00
Austin Songer 1f47e3c1a9 [New Rule] Okta FastPass Phishing (#2782) 
* Create initial_access_fastpass_phishing.toml

* Rename initial_access_fastpass_phishing.toml to initial_access_okta_fastpass_phishing.toml

* Update initial_access_okta_fastpass_phishing.toml

* Update initial_access_okta_fastpass_phishing.toml

* Update initial_access_okta_fastpass_phishing.toml

* Update initial_access_okta_fastpass_phishing.toml

* Update initial_access_okta_fastpass_phishing.toml

* Update initial_access_okta_fastpass_phishing.toml

* Update initial_access_okta_fastpass_phishing.toml

* Update initial_access_okta_fastpass_phishing.toml

* Update initial_access_okta_fastpass_phishing.toml

* Update initial_access_okta_fastpass_phishing.toml

* Update initial_access_okta_fastpass_phishing.toml

* Update initial_access_okta_fastpass_phishing.toml

* Update rules/integrations/okta/initial_access_okta_fastpass_phishing.toml

* Update rules/integrations/okta/initial_access_okta_fastpass_phishing.toml

* Update rules/integrations/okta/initial_access_okta_fastpass_phishing.toml

* Update rules/integrations/okta/initial_access_okta_fastpass_phishing.toml

* Update rules/integrations/okta/initial_access_okta_fastpass_phishing.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

---------

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
 2023-11-28 09:26:16 -05:00
Terrance DeJesus e6fef85899 [New Rule] Okta MFA Bombing Attempt (#3278) 
* new rule 'Potential Okta MFA Bombing via Push Notifications'

* updated naming

* TOML lint

* adjusted duplicate rule ID

* added event category override; added until sequence statement

* added verify authentication success

* moved setup to separate field

* enhanced query optimization
 2023-11-28 09:16:20 -05:00
Terrance DeJesus 69cb2f6fc6 [New Rule] Adding Detection for Multiple Okta Users with the Same Device Token Hash (#3267) 
* added new rule 'Multiple Okta Users with the Same Device Token Hash'

* moved rule to okta integration folder

* adjusted query to be optimized

* added false positive comment

* Update rules/integrations/okta/initial_access_multiple_active_users_from_single_device.toml
 2023-11-27 19:23:38 -05:00
Terrance DeJesus 0578bd4caa [New Rule] Threshold Detections for Okta User Sessions and Client Addresses (#3263) 
* new Okta threshold rules for client addresses and sessions

* adjusting references

* Update rules/integrations/okta/initial_access_multiple_client_addresses_with_single_okta_session.toml

* Update rules/integrations/okta/initial_access_multiple_client_addresses_with_single_okta_session.toml

* Update rules/integrations/okta/lateral_movement_multiple_sessions_for_single_user.toml

* Update rules/integrations/okta/initial_access_multiple_client_addresses_with_single_okta_session.toml

* Update rules/integrations/okta/lateral_movement_multiple_sessions_for_single_user.toml

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

* Update rules/integrations/okta/initial_access_multiple_client_addresses_with_single_okta_session.toml

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

* Update rules/integrations/okta/initial_access_multiple_client_addresses_with_single_okta_session.toml

* Update rules/integrations/okta/lateral_movement_multiple_sessions_for_single_user.toml

* Update rules/integrations/okta/initial_access_multiple_client_addresses_with_single_okta_session.toml

* Update rules/integrations/okta/initial_access_multiple_client_addresses_with_single_okta_session.toml

* Update rules/integrations/okta/lateral_movement_multiple_sessions_for_single_user.toml

* Update rules/integrations/okta/initial_access_multiple_client_addresses_with_single_okta_session.toml

* Update rules/integrations/okta/initial_access_multiple_client_addresses_with_single_okta_session.toml

* Update rules/integrations/okta/lateral_movement_multiple_sessions_for_single_user.toml

---------

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
 2023-11-27 19:03:06 -05:00
Terrance DeJesus 8eeb95f545 [New Rule] Detection for Okta Sign-In Events via Third-Party IdP (#3259) 
* adding new rule 'Okta Sign-In Events via Third-Party IdP'

* fix creation date

* fixed query efficiency

* added investigation guide

* Update rules/integrations/okta/initial_access_sign_in_events_via_third_party_idp.toml

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

---------

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
 2023-11-27 18:31:27 -05:00
Terrance DeJesus 73288af642 adding new rule 'New Okta Identity Provider (IdP) Added by Admin' (#3258) 2023-11-27 18:06:54 -05:00
Terrance DeJesus 8321cfe018 [New Rule] Adding Detection for First Occurrence of Okta User Session Started via Proxy (#3261) 
* new rule 'First Occurrence of Okta User Session Started via Proxy'

* Update rules/integrations/okta/initial_access_first_occurrence_user_session_started_via_proxy.toml

* Update rules/integrations/okta/initial_access_first_occurrence_user_session_started_via_proxy.toml

* Update rules/integrations/okta/initial_access_first_occurrence_user_session_started_via_proxy.toml

* Update rules/integrations/okta/initial_access_first_occurrence_user_session_started_via_proxy.toml
 2023-11-27 17:50:13 -05:00
Terrance DeJesus f19506f3a2 [New Rule] Adding Detection for New Okta Authentication Behavior (#3260) 
* new rule 'New Okta Authentication Behavior Detected'

* Update rules/integrations/okta/initial_access_new_authentication_behavior_detection.toml

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

---------

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
 2023-11-27 17:39:10 -05:00
Samirbous 88f752bf8b [New] First Time Seen NewCredentials Lgon Process (#3276) 
* Create privilege_escalation_newcreds_logon_rare_process.toml

* Update privilege_escalation_newcreds_logon_rare_process.toml

* Update privilege_escalation_newcreds_logon_rare_process.toml

* Update privilege_escalation_newcreds_logon_rare_process.toml

* Update rules/windows/privilege_escalation_newcreds_logon_rare_process.toml

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

---------

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
 2023-11-27 18:37:15 +00:00
shashank-elastic 7854081cc0 Setup Guide information for MacOS rules (#3274) 2023-11-22 20:18:22 +05:30
Terrance DeJesus 832ee02aed [New Rule] Adding Detection Logic for Okta User Sessions Started from Different Geolocations (#3279) 
* new rule 'Okta User Sessions Started from Different Geolocations'

* Update rules/integrations/okta/initial_access_okta_user_sessions_started_from_different_geolocations.toml
 2023-11-21 17:32:09 -05:00
Mika Ayenson 93ad4b0959 Add UEBA Tag (#3277) 2023-11-20 13:51:13 -06:00
Eric Forte 66c1d7f3b4 [Bug] Fix typo in downgrade_contents_from_rule (#3272) 
* Fix missing to_dict()

* Update pyproject.toml
 2023-11-14 23:06:04 -05:00
Jonhnathan f53f46efd5 [Rule Tuning] Fix Menasec Expired Links (#3271) 2023-11-14 10:18:34 -03:00
github-actions[bot] 9195eedb9c Lock versions for releases: 8.3,8.4,8.5,8.6,8.7,8.8,8.9,8.10,8.11 (#3270) 
* Locked versions for releases: 8.3,8.4,8.5,8.6,8.7,8.8,8.9,8.10,8.11

* Update detection_rules/etc/version.lock.json

---------

Co-authored-by: terrancedejesus <terrancedejesus@users.noreply.github.com>
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
 2023-11-13 14:45:58 -05:00
shashank-elastic d52546eee5 Enhance Setup Guide information (#3256) 2023-11-03 19:05:29 +05:30
Terrance DeJesus 829f5ea885 [Bug] Add Integration Schema Validation to NewTermsRuleData.validate Method (#3227) 
* adjusted validation method to include integration schema checks

* fixed linting errors

* re-factored NewTermsRuleData and added unit testing
 2023-11-02 16:52:18 -04:00
Ruben Groenewoud dff4633dd4 [New BBR] Segfault Detected (#3240) 
* [New BBR] Segfault Detected

* Update rules_building_block/execution_linux_segfault.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules_building_block/execution_linux_segfault.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

---------

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
 2023-11-02 09:40:50 +01:00
Ruben Groenewoud 967f6a4c89 [New BBR] Kernel Driver Load (#3236) 
* [New BBR] Kernel Driver Load

* added event.dataset to the query

---------

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
 2023-11-02 09:32:38 +01:00
Terrance DeJesus cdeb398ab3 [FR] Adjust Prebuilt Rules Packaging to Use Elastic Package v3 (#3252) 
* Adding support for elastic package version 3

* replaced OS with Pathlib where applicable

* added sub-dataclasses for V3

* fixed flake errors

* adjusted registry dataclasses to inherit base
 2023-11-01 12:47:40 -04:00
Mika Ayenson d0b0216362 [FR] Support missing events (#3153) 2023-10-31 16:20:52 -05:00
Mika Ayenson 5722257119 Pin python packages (#3249) 2023-10-30 12:53:26 -05:00
shashank-elastic 5c5d1b214b Setup information for Linux Rules - Set8 (#3200) 2023-10-30 20:58:40 +05:30
Apoorva Joshi a4f9cf4616 [New Rule] Adding Beaconing Rules from Advanced Analytic Beaconing Package (#3128) 
* Adding beaconing rules

* Update rules/integrations/beaconing/command_and_control_beaconing_high_confidence.toml

Co-authored-by: Kirti Sodhi <109447885+sodhikirti07@users.noreply.github.com>

* Update rules/integrations/beaconing/command_and_control_beaconing.toml

Co-authored-by: Kirti Sodhi <109447885+sodhikirti07@users.noreply.github.com>

* Updating min stack version

* added beaconing to manifests and schemas; updated rules

---------

Co-authored-by: Kirti Sodhi <109447885+sodhikirti07@users.noreply.github.com>
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: terrancedejesus <terrance.dejesus@elastic.co>
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
 2023-10-30 10:05:24 -04:00
shashank-elastic a568c56bc1 Move Config Guides for Pre-Built Detection Rules to Setup Field - Windows, MacOS, BBR and Cross Platform (#3157) 2023-10-30 16:53:04 +05:30
Ruben Groenewoud ad25c922fd [Rule Tuning] Tainted Kernel Module Load (#3234) 
* [Rule Tuning] Tainted kernel module load

* Update persistence_tainted_kernel_module_load.toml

* Update rules_building_block/persistence_tainted_kernel_module_load.toml

---------

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
 2023-10-30 09:49:20 +01:00
Ruben Groenewoud 618a1dbe06 [New Rule] Attempt to Clear Kernel Ring Buffer (#3217) 
* [New Rule] Attempt to Clear Kernel Ring Buffer

* Update defense_evasion_clear_kernel_ring_buffer.toml

---------

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
 2023-10-30 09:37:11 +01:00
Colson Wilhoit 6400bb3237 [Tuning] Access to Stored Browser Credentials (#3066) 
* Exclude FPs

* Update rules/macos/credential_access_access_to_browser_credentials_procargs.toml

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

---------

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
 2023-10-27 15:10:09 -05:00
Terrance DeJesus e7db39a492 [Rule Tuning] Review and Tune Potential Malicious File Downloaded from Google Drive (#3197) 
* added tuning to remove signed binaries and benign processes

* Update rules/cross-platform/command_and_control_google_drive_malicious_file_download.toml

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

* Update rules/cross-platform/command_and_control_google_drive_malicious_file_download.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/cross-platform/command_and_control_google_drive_malicious_file_download.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

---------

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
 2023-10-27 14:12:55 -04:00