 Jonhnathan
|
109e8a85a5
|
[Rule Tuning] BBR Rule Tuning 1 - Tighten Indexes Edition (#3576)
* [Rule Tuning] BBR Rule Tuning 1 - Tighten Indexes Edition
* Apply suggestions from code review
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
* Update defense_evasion_msdt_suspicious_diagcab.toml
* Update defense_evasion_suspicious_msiexec_execution.toml
* Update discovery_security_software_wmic.toml
* Update rules_building_block/discovery_security_software_wmic.toml
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
* Endgame tag
---------
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
|
2024-04-08 08:57:33 -03:00 |
|
|
Jonhnathan
|
1a8271db2f
|
[Rule Tuning] Windows BBR Tuning - 4 (#3384)
* [Rule Tuning] Windows BBR Tuning - 4
* Update discovery_system_time_discovery.toml
|
2024-02-14 14:21:07 -03:00 |
|
|
Jonhnathan
|
f584fb6e31
|
[Security Content] Adjust Mitre Att&ck Mappings - Windows Rules (#3165)
* [Security Content] Adjust Mitre Att&ck Mappings - Windows Rules
* Fix dates
* Fix unit test errors
* updated tags and fixed branch conflicts
updated tags and fixed branch conflicts
* description nit
* Reverting unintended changes
* Update initial_access_suspicious_ms_office_child_process.toml
---------
Co-authored-by: imays11 <59296946+imays11@users.noreply.github.com>
|
2023-10-15 18:12:20 -03:00 |
|
|
Ruben Groenewoud
|
c2822e175c
|
[Tuning] Windows Execution Rule Tuning for UEBA (#3107)
* Update defense_evasion_execution_msbuild_started_by_script.toml
* Mostly updated Execution tags, also new_terms conv
* removed index
* Removed index
* WMIPrvSE tuning
* Additional tuning
* Tuning & changes
* Additional tuning
* Applied unit test optimization
* Addressed feedback
* Update rules/windows/execution_command_shell_started_by_svchost.toml
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
* caseless unit testing fix
* fixed caseless executable unit test
* unit testing fix
* Update rules/windows/execution_suspicious_powershell_imgload.toml
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
* Update execution_ms_office_written_file.toml
* Update rules/windows/defense_evasion_execution_msbuild_started_by_script.toml
* Update rules/windows/defense_evasion_execution_msbuild_started_unusal_process.toml
* Added user ids to new terms
* Update rules/windows/execution_suspicious_powershell_imgload.toml
Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>
* Update rules_building_block/execution_unsigned_service_executable.toml
Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>
* Update execution_unsigned_service_executable.toml
---------
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>
|
2023-10-11 10:15:29 +02:00 |
|
|
Jonhnathan
|
4233fef238
|
[Security Content] Include "Data Source: Elastic Defend" tag (#3002)
* win folder
* Other folders
* Update test_all_rules.py
* .
* updated missing elastic defend tags
---------
Co-authored-by: terrancedejesus <terrance.dejesus@elastic.co>
|
2023-09-05 14:22:01 -04:00 |
|
|
Jonhnathan
|
6966a6df09
|
[New Rule] Building Block Rules - Part 3 (#2924)
* [New Rule] Building Block Rules - Part 3
* Update defense_evasion_generic_deletion.toml
* Update defense_evasion_generic_deletion.toml
* Update defense_evasion_generic_deletion.toml
* Apply suggestions from code review
* Update rules_building_block/discovery_generic_account_groups.toml
* Apply suggestions from code review
---------
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
|
2023-07-31 10:28:25 -03:00 |
|