security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
3,314 Commits 1 Branch 0 Tags
1ce072a4e58238d94deae33ff8de25458ac129d5
Commit Graph

7 Commits

Author SHA1 Message Date
Ruben Groenewoud d968f62a5a [Rule Tuning] Linux DR Tuning - 10 (#5510) 
* [Rule Tuning] Linux DR Tuning - 10

* Update persistence_udev_rule_creation.toml

* Refactor ESQL query for Linux process events

* Refactor query in persistence_web_server_sus_command_execution rule

Removed unnecessary fields from the query and added new fields for event dataset and data stream namespace.

* Update persistence_systemd_netcon.toml

* Update persistence_web_server_sus_child_spawned.toml

* Refactor process.parent.name conditions in TOML file

* Update persistence_web_server_unusual_command_execution.toml

* Update persistence_web_server_unusual_command_execution.toml

---------

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
 2026-01-08 09:32:57 +01:00
Jonhnathan 0268daa17d [Rule Tuning] Tighten Up Elastic Defend Indexes - Linux (#4446) 2025-02-05 15:25:45 -03:00
Ruben Groenewoud 6b84542093 [Rule Tuning] Linux DR Tuning - Part 5 (#4422) 
* [Rule Tuning] Linux DR Tuning - Part 5

* Update rules/linux/persistence_xdg_autostart_netcon.toml
 2025-02-03 13:53:53 +01:00
Mika Ayenson fe8c81d762 [FR] Generate investigation guides (#4358) 2025-01-22 11:17:38 -06:00
Mika Ayenson b80d8342d6 [Docs | Rule Tuning] Add blog references to rules (#4097) 
* [Docs | Rule Tuning] Add blog references to rules

* Apply suggestions from code review

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* Apply suggestions from code review

* Update google_workspace blog references

* add okta blog references

* Update dates

---------

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
 2024-09-25 15:19:20 -05:00
Ruben Groenewoud a71bbe0cf8 [Rule Tuning] Misc. DR Rule Tuning - Part 2 (#3905) 
* [Rule Tuning] Misc. DR Rule Tuning - Part 2

* ++

* Update privilege_escalation_suspicious_uid_guid_elevation.toml

* Update rules/linux/persistence_systemd_service_creation.toml

---------

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
 2024-07-19 15:21:35 +02:00
Ruben Groenewoud 29bb52d2fb [New Rule] Netcon through XDG Autostart Entry (#3741) 
* [New Rule] Netcon through XDG Autostart Entry

* Update rules/linux/persistence_xdg_autostart_netcon.toml

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

* Update persistence_xdg_autostart_netcon.toml

* Update persistence_xdg_autostart_netcon.toml

---------

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
 2024-06-10 10:17:09 +02:00