 Jonhnathan
|
8b74ba7136
|
[Rule Tuning] Remove host.os.type Unit Test Exception (#5317)
|
2025-11-14 08:46:24 -08:00 |
|
|
shashank-elastic
|
9b292b97ea
|
Prep 8.19/9.1 (#4869)
* Prep 8.19/9.1 Release
* Download Beats Schema
* Download API Schema
* Download 8.18.3 Beats Schema
* Download Latest Integrations manifest and schema
* Comment old schemas
* Update Patch version
|
2025-07-07 11:27:48 -04:00 |
|
|
Jonhnathan
|
e11fe78846
|
[Rule Tuning] Suspicious WMI Event Subscription Created (#4618)
* [Rule Tuning] Suspicious Execution via Scheduled Task
* [Rule Tuning] Suspicious WMI Event Subscription Created
|
2025-04-16 10:05:20 -03:00 |
|
|
Mika Ayenson
|
fe8c81d762
|
[FR] Generate investigation guides (#4358)
|
2025-01-22 11:17:38 -06:00 |
|
|
Samirbous
|
419e5c1ad3
|
[Tuning] Suspicious WMI Event Subscription Created (#4327)
* Update persistence_sysmon_wmi_event_subscription.toml
* Update non-ecs-schema.json
* Update persistence_sysmon_wmi_event_subscription.toml
* Update detection_rules/etc/non-ecs-schema.json
* Update pyproject.toml
---------
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
|
2025-01-06 09:40:26 -03:00 |
|
|
Jonhnathan
|
2c07e88c07
|
[Rule Tuning] Fix double bumps caused by Windows Integration Update (#4156)
|
2024-10-15 23:57:44 +05:30 |
|
|
shashank-elastic
|
63e91c2f12
|
Back-porting Version Trimming (#3704)
|
2024-05-23 00:45:10 +05:30 |
|
|
Mika Ayenson
|
2c3dbfc039
|
Revert "Back-porting Version Trimming (#3681)"
This reverts commit 71d2c59b5c.
|
2024-05-22 13:51:46 -05:00 |
|
|
shashank-elastic
|
71d2c59b5c
|
Back-porting Version Trimming (#3681)
|
2024-05-23 00:11:50 +05:30 |
|
|
Jonhnathan
|
f5254f3b5e
|
[Rule Tuning] Improve Compatibility in WIndows Detection Rules - Part 1 (#3501)
* Initial commit
* Date bump
|
2024-03-13 10:27:44 -03:00 |
|
|
Terrance DeJesus
|
8d2b730bc5
|
adjusting minimum stack version for version control (#3154)
|
2023-10-03 13:36:06 -04:00 |
|
|
Jonhnathan
|
6d7df50d78
|
[New Rule] Suspicious WMI Event Subscription Created (#1860)
* Suspicious WMI Event Subscription Initial rule
* Use EQL sequence
* Update non-ecs-schema
* Update persistence_sysmon_wmi_event_subscription.toml
* update description
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
* update query too look for even code 21 only
* update to case sensitive compare
* Update rules/windows/persistence_sysmon_wmi_event_subscription.toml
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>
* Update persistence_sysmon_wmi_event_subscription.toml
* Update non-ecs-schema.json
* Update rules/windows/persistence_sysmon_wmi_event_subscription.toml
* Update non-ecs-schema.json
* Update persistence_sysmon_wmi_event_subscription.toml
---------
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
|
2023-08-29 16:42:19 -03:00 |
|