2 Commits

Author	SHA1	Message	Date
Ruben Groenewoud	b13afcdeaa	[Rule Tuning] Linux DR Tuning - 8 (#5505) ... * [Rule Tuning] Linux DR Tuning - 8 * Revise investigation guide for THC tool downloads Updated investigation guide to reflect THC tool instead of SSH-IT worm. Enhanced description for clarity. * Update exfiltration_unusual_file_transfer_utility_launched.toml * Refine ESQL query for brute force malware detection Updated the query to include additional fields and modified the conditions for filtering events. --------- Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>	2026-01-08 10:01:11 +01:00
Ruben Groenewoud	3b1f780435	[D4C Conversion] Converting Compatible D4C Rules to DR (#4532) ... * [D4C Conversion] Converting Compatible D4C Rules to DR * added host.os.type * Rename * Update rules/linux/execution_container_management_binary_launched_inside_container.toml Co-authored-by: Isai <59296946+imays11@users.noreply.github.com> * Update rules/linux/privilege_escalation_debugfs_launched_inside_container.toml Co-authored-by: Isai <59296946+imays11@users.noreply.github.com> * Update rules/linux/privilege_escalation_debugfs_launched_inside_container.toml Co-authored-by: Isai <59296946+imays11@users.noreply.github.com> * Update rules/linux/privilege_escalation_mount_launched_inside_container.toml Co-authored-by: Isai <59296946+imays11@users.noreply.github.com> * Update rules/linux/privilege_escalation_mount_launched_inside_container.toml Co-authored-by: Isai <59296946+imays11@users.noreply.github.com> --------- Co-authored-by: Isai <59296946+imays11@users.noreply.github.com> Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com> Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>	2025-04-10 14:26:40 +02:00