80ee91b0f2
[Rule Tuning] Linux DR Tuning - 11 ( #5511 )
...
* [Rule Tuning] Linux DR Tuning - 11
* Update privilege_escalation_potential_suid_sgid_exploitation.toml
* Update rules/linux/privilege_escalation_suspicious_uid_guid_elevation.toml
* Update privilege_escalation_docker_escape_via_nsenter.toml
---------
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com >
2026-01-07 16:31:13 +01:00
0268daa17d
[Rule Tuning] Tighten Up Elastic Defend Indexes - Linux ( #4446 )
2025-02-05 15:25:45 -03:00
14c648598e
[Rule Tuning] Linux DR Tuning - Part 6 ( #4423 )
...
* [Rule Tuning] Linux DR Tuning - Part 6
* Update privilege_escalation_ld_preload_shared_object_modif.toml
* Update privilege_escalation_ld_preload_shared_object_modif.toml
2025-02-03 14:05:26 +01:00
fe8c81d762
[FR] Generate investigation guides ( #4358 )
2025-01-22 11:17:38 -06:00
d2502c7394
Prep for Release 8.17 ( #4256 )
2024-11-07 23:53:04 +05:30
ac6a49eeea
[Rule Tuning] Q2 Linux DR Tuning - Part 6 ( #4167 )
2024-10-18 16:25:54 +02:00
a71bbe0cf8
[Rule Tuning] Misc. DR Rule Tuning - Part 2 ( #3905 )
...
* [Rule Tuning] Misc. DR Rule Tuning - Part 2
* ++
* Update privilege_escalation_suspicious_uid_guid_elevation.toml
* Update rules/linux/persistence_systemd_service_creation.toml
---------
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com >
2024-07-19 15:21:35 +02:00
9f8638a004
[Tuning] event.action and event.type change ( #3495 )
...
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com >
2024-03-13 10:11:21 +01:00
458e67918a
[Security Content] Small tweaks on the setup guides ( #3308 )
...
* [Security Content] Small tweaks on the setup guides
* Additional Fixes
* Avoid touching deprecated rules
2024-03-11 09:09:40 -03:00
1a2ef4b867
Linux Process Capabilities Enrichment Detection Rules ( #3366 )
...
Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com
2024-01-18 22:49:43 +05:30
Ruben Groenewoud