Commit Graph

5 Commits

Author SHA1 Message Date
Ruben Groenewoud d968f62a5a [Rule Tuning] Linux DR Tuning - 10 (#5510)
* [Rule Tuning] Linux DR Tuning - 10

* Update persistence_udev_rule_creation.toml

* Refactor ESQL query for Linux process events

* Refactor query in persistence_web_server_sus_command_execution rule

Removed unnecessary fields from the query and added new fields for event dataset and data stream namespace.

* Update persistence_systemd_netcon.toml

* Update persistence_web_server_sus_child_spawned.toml

* Refactor process.parent.name conditions in TOML file

* Update persistence_web_server_unusual_command_execution.toml

* Update persistence_web_server_unusual_command_execution.toml

---------

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
2026-01-08 09:32:57 +01:00
Ruben Groenewoud 37e18af7a5 [Rule Tuning] Adds Crowdstrike Compatibility to Linux Process Rules (#5232)
* First batch

* Second batch

* Batch 2
2025-11-10 16:03:39 +01:00
Ruben Groenewoud 6b84542093 [Rule Tuning] Linux DR Tuning - Part 5 (#4422)
* [Rule Tuning] Linux DR Tuning - Part 5

* Update rules/linux/persistence_xdg_autostart_netcon.toml
2025-02-03 13:53:53 +01:00
Mika Ayenson fe8c81d762 [FR] Generate investigation guides (#4358) 2025-01-22 11:17:38 -06:00
Ruben Groenewoud c9c8e3501e [New Rule] Unusual SSHD Child Process (#4303)
* [New Rule] Unusual SSHD Child Process

* Update persistence_unusual_sshd_child_process.toml
2025-01-03 14:50:43 +01:00