e1698890a4
[Rule Tuning] Linux DR Tuning - 7 ( #5504 )
...
* [Rule Tuning] Linux DR Tuning - 7
* Update execution_egress_connection_from_entrypoint_in_container.toml
* Update execution_kubernetes_direct_api_request_via_curl_or_wget.toml
* Update rules/linux/execution_perl_tty_shell.toml
* Update execution_perl_tty_shell.toml
* Update rules/linux/execution_unix_socket_communication.toml
* Update execution_file_made_executable_via_chmod_inside_container.toml
* Remove duplicate Crowdstrike data source entry
---------
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com >
2026-01-08 11:10:46 +01:00
1c98a0d64c
[Rule Tuning] Linux DR Tuning - Part 3 ( #4420 )
...
* Initial set
* [Rule Tuning] Linux DR - Part 3
* ++
* Update execution_unusual_path_invocation_from_command_line.toml
* Update execution_unusual_path_invocation_from_command_line.toml
2025-02-03 13:17:00 +01:00
fe8c81d762
[FR] Generate investigation guides ( #4358 )
2025-01-22 11:17:38 -06:00
b80d8342d6
[Docs | Rule Tuning] Add blog references to rules ( #4097 )
...
* [Docs | Rule Tuning] Add blog references to rules
* Apply suggestions from code review
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com >
* Apply suggestions from code review
* Update google_workspace blog references
* add okta blog references
* Update dates
---------
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com >
2024-09-25 15:19:20 -05:00
76fdd549a3
[Rule Tuning] Misc. DR Rule Tuning ( #3904 )
...
* [Rule Tuning] Misc. DR Rule Tuning
* Update execution_unknown_rwx_mem_region_binary_executed.toml
* Update command_and_control_suspicious_network_activity_from_unknown_executable.toml
* I love KQL validation
2024-07-19 15:13:42 +02:00
63e91c2f12
Back-porting Version Trimming ( #3704 )
2024-05-23 00:45:10 +05:30
2c3dbfc039
Revert "Back-porting Version Trimming ( #3681 )"
...
This reverts commit 71d2c59b5c
2024-05-22 13:51:46 -05:00
71d2c59b5c
Back-porting Version Trimming ( #3681 )
2024-05-23 00:11:50 +05:30
4179180fcb
[New Rules] mprotect() RWX Binary Execution ( #3507 )
...
* [New Rules] mprotect() RWX Binary Execution
* Added rule names
* Update execution_netcon_from_rwx_mem_region_binary.toml
* Update execution_unknown_rwx_mem_region_binary_executed.toml
* Update execution_unknown_rwx_mem_region_binary_executed.toml
* Update execution_netcon_from_rwx_mem_region_binary.toml
* Update execution_netcon_from_rwx_mem_region_binary.toml
2024-03-13 22:11:44 +01:00
Ruben Groenewoud