b13afcdeaa
[Rule Tuning] Linux DR Tuning - 8 ( #5505 )
...
* [Rule Tuning] Linux DR Tuning - 8
* Revise investigation guide for THC tool downloads
Updated investigation guide to reflect THC tool instead of SSH-IT worm. Enhanced description for clarity.
* Update exfiltration_unusual_file_transfer_utility_launched.toml
* Refine ESQL query for brute force malware detection
Updated the query to include additional fields and modified the conditions for filtering events.
---------
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com >
2026-01-08 10:01:11 +01:00
0268daa17d
[Rule Tuning] Tighten Up Elastic Defend Indexes - Linux ( #4446 )
2025-02-05 15:25:45 -03:00
fe8c81d762
[FR] Generate investigation guides ( #4358 )
2025-01-22 11:17:38 -06:00
63e91c2f12
Back-porting Version Trimming ( #3704 )
2024-05-23 00:45:10 +05:30
2c3dbfc039
Revert "Back-porting Version Trimming ( #3681 )"
...
This reverts commit 71d2c59b5c
2024-05-22 13:51:46 -05:00
71d2c59b5c
Back-porting Version Trimming ( #3681 )
2024-05-23 00:11:50 +05:30
458e67918a
[Security Content] Small tweaks on the setup guides ( #3308 )
...
* [Security Content] Small tweaks on the setup guides
* Additional Fixes
* Avoid touching deprecated rules
2024-03-11 09:09:40 -03:00
d52546eee5
Enhance Setup Guide information ( #3256 )
2023-11-03 19:05:29 +05:30
7254c582c5
Move Setup information into setup filed ( #3206 )
2023-10-23 19:28:18 +05:30
5a98208b53
Setup information for Linux Rules - Set6 ( #3189 )
2023-10-17 19:33:07 +05:30
4233fef238
[Security Content] Include "Data Source: Elastic Defend" tag ( #3002 )
...
* win folder
* Other folders
* Update test_all_rules.py
* .
* updated missing elastic defend tags
---------
Co-authored-by: terrancedejesus <terrance.dejesus@elastic.co >
2023-09-05 14:22:01 -04:00
7a1f376a34
[New Rules] Conversion of deprecated ERs over to DRs ( #2877 )
...
* [Conversion] Data Encrypted via OpenSSL
* [Conversion] sus funzip extraction/decompression
* [Conversion] LD_PRELOAD env var process injection
* fix unit testing failure
* suspecting endgame incompatibility
* fixed typo
* added LD_LIBRARY_PATH
* Update defense_evasion_ld_preload_env_variable_process_injection.toml
* Update defense_evasion_ld_preload_env_variable_process_injection.toml
* Added exclusions for FPs
* Update rules/linux/defense_evasion_ld_preload_env_variable_process_injection.toml
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com >
* Update rules/linux/impact_data_encrypted_via_openssl.toml
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com >
---------
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com >
2023-07-02 10:39:44 +02:00
Ruben Groenewoud