 Ruben Groenewoud
|
473df70fbb
|
[Rule Tuning] Linux DR Tuning - 5 (#5494)
* [Rule Tuning] Linux DR Tuning - 5
* Fix query syntax for shared object detection rule
* Update defense_evasion_kernel_module_removal.toml
* Fix condition for process working directory check
* Refactor query in defense_evasion_symlink_binary rule
---------
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
|
2026-01-07 15:55:06 +01:00 |
|
|
shashank-elastic
|
e4856d3c2c
|
Refresh ecs, beats, integration manifests & schemas (#4699)
|
2025-05-05 23:06:40 +05:30 |
|
|
Mika Ayenson
|
fe8c81d762
|
[FR] Generate investigation guides (#4358)
|
2025-01-22 11:17:38 -06:00 |
|
|
Ruben Groenewoud
|
79b26085f5
|
[New Rule] Potential Process Name Stomping with Prctl (#4352)
* [New Rule] Potential Process Name Stomping with Prctl
* Update defense_evasion_prctl_process_name_tampering.toml
|
2025-01-13 16:35:40 +01:00 |
|