sigma-rules

Author	SHA1	Message	Date
Mika Ayenson	fe8c81d762	[FR] Generate investigation guides (#4358 )	2025-01-22 11:17:38 -06:00
shashank-elastic	63e91c2f12	Back-porting Version Trimming (#3704 )	2024-05-23 00:45:10 +05:30
Mika Ayenson	2c3dbfc039	Revert "Back-porting Version Trimming (#3681 )" This reverts commit `71d2c59b5c`.	2024-05-22 13:51:46 -05:00
shashank-elastic	71d2c59b5c	Back-porting Version Trimming (#3681 )	2024-05-23 00:11:50 +05:30
Jonhnathan	b47b91b9ec	[Rule Tuning] Tighten up Indexes of Elastic Defend Windows Rules (#3549 ) * [Rule Tuning] Tighten up Indexes of Elastic Defend Windows Rules * Delete test.pkl --------- Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>	2024-04-01 20:45:12 -03:00
sbousseaden	853e18950f	[Tuning] Tuning Windows - 3 Rules (#3388 ) * Update privilege_escalation_newcreds_logon_rare_process.toml * Update privilege_escalation_make_token_local.toml * Update privilege_escalation_make_token_local.toml * Update privilege_escalation_create_process_with_token_unpriv.toml --------- Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com> Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>	2024-02-20 15:56:28 +00:00
Samirbous	7488c60090	[New] Process Created with a Duplicated Token (#3152 ) * [New] Process Created with a Duplicated Token using `process.Ext.effective_parent.executable` to detect impersonation using token duplicates from windows native binaries to run common lolbins or recently dropped unsigned ones : * Update privilege_escalation_create_process_with_token_unpriv.toml * Update privilege_escalation_create_process_with_token_unpriv.toml * Update rules/windows/privilege_escalation_create_process_with_token_unpriv.toml Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> * Update privilege_escalation_create_process_with_token_unpriv.toml --------- Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>	2023-12-07 08:20:30 -03:00

7 Commits