sigma-rules

Author	SHA1	Message	Date
Ruben Groenewoud	d968f62a5a	[Rule Tuning] Linux DR Tuning - 10 (#5510 ) * [Rule Tuning] Linux DR Tuning - 10 * Update persistence_udev_rule_creation.toml * Refactor ESQL query for Linux process events * Refactor query in persistence_web_server_sus_command_execution rule Removed unnecessary fields from the query and added new fields for event dataset and data stream namespace. * Update persistence_systemd_netcon.toml * Update persistence_web_server_sus_child_spawned.toml * Refactor process.parent.name conditions in TOML file * Update persistence_web_server_unusual_command_execution.toml * Update persistence_web_server_unusual_command_execution.toml --------- Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>	2026-01-08 09:32:57 +01:00
Samirbous	b996a29451	[Tuning] Diverse Rules Tuning (#5482 ) * [Tuning] Diverse Rules Tuning * Update persistence_shell_profile_modification.toml * Update defense_evasion_ml_suspicious_windows_event_low_probability.toml * Update defense_evasion_ml_suspicious_windows_event_high_probability.toml * Update defense_evasion_ml_suspicious_windows_event_high_probability.toml * ++ * Update persistence_suspicious_ssh_execution_xzbackdoor.toml * Update persistence_suspicious_ssh_execution_xzbackdoor.toml * Update credential_access_potential_linux_ssh_bruteforce_internal.toml * Update persistence_shell_profile_modification.toml * Revert "Update credential_access_potential_linux_ssh_bruteforce_internal.toml" This reverts commit bad889a30d3f4a028de2b6624307f75b279a205b. * Update persistence_web_server_sus_destination_port.toml * Update defense_evasion_ml_suspicious_windows_event_high_probability.toml * Update defense_evasion_ml_suspicious_windows_event_low_probability.toml --------- Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>	2025-12-18 15:30:12 +00:00
shashank-elastic	3966981dae	Add investigation guides (#4600 )	2025-04-07 20:55:39 +05:30
Ruben Groenewoud	561ab703de	[New Rule] Uncommon Destination Port Connection by Web Server (#4515 )	2025-03-06 22:01:33 +05:30

4 Commits