 Jonhnathan
|
ac01718bb6
|
[Rule Tuning] Add tags to flag Sysmon-only rules & Modify Investigation Guide-related tag (#2352)
* [Rule Tuning] Add tags to flag Sysmon-only rules
* Modify tags
* Revert "Modify tags"
This reverts commit 3d9267d171a41f727bb499501d71d5c4db4f0434.
* Modify tags
* Update test_all_rules.py
* Update test_all_rules.py
* Update test_all_rules.py
* Update test_all_rules.py
* Update test_all_rules.py
|
2022-11-18 12:32:27 -03:00 |
|
|
Jonhnathan
|
6055d0db60
|
[Security Content] Introduce Osquery Markdown Plugin Queries in Investigation Guides (#2387)
* [Security Content] Introduce Osquery Markdown Plugin Queries in Investigation Guides
* Remove min_stack and add Note
* Fix Typo and preffix
* Update command_and_control_certutil_network_connection.toml
* Add unit test to check Note about Osquery Markdown plugin and Version limitations
* Update test_all_rules.py
* Update test_all_rules.py
* Change Note Verbiage
|
2022-11-17 18:38:34 -03:00 |
|
|
Jonhnathan
|
f02ffbbe13
|
[Security Content] Add Investigation Guides - 8.5 (#2305)
* [Security Content] Add Investigation Guides - 8.5
* Update persistence_run_key_and_startup_broad.toml
* Apply suggestions from security-docs review review
* Update execution_suspicious_jar_child_process.toml
* Apply suggestions from review
|
2022-09-23 18:44:24 -03:00 |
|
|
Jonhnathan
|
ec04a39413
|
[Security Content] Tag rules with robust Investigation Guides (#2297)
|
2022-09-23 14:20:32 -03:00 |
|
|
Justin Ibarra
|
46d5e37b76
|
min_stack all rules to 8.3 (#2259)
* min_stack all rules to 8.3
* bump date
Co-authored-by: Mika Ayenson <mika.ayenson@elastic.co>
|
2022-08-24 10:38:49 -06:00 |
|
|
Jonhnathan
|
817b97f428
|
[Security Content] Refactor Existing Investigation Guides (#1959)
* Initial commit
* Update Investigation guides - security-docs review
* Update command_and_control_dns_tunneling_nslookup.toml
* Update defense_evasion_amsienable_key_mod.toml
* Apply security-docs review
* Remove dot
* Update rules/windows/command_and_control_rdp_tunnel_plink.toml
Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com>
* Apply changes from review
* Apply the suggestion
Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com>
|
2022-05-18 12:59:39 -03:00 |
|
|
Jonhnathan
|
258418785f
|
MInor changes from Investigation Guides Review (#1927)
|
2022-04-13 16:53:29 -08:00 |
|
|
Jonhnathan
|
290763d9bb
|
[Security Content] Add Investigation Guides - 4 (#1871)
* [Security Content] Add Investigation Guides - 4
* Apply suggestions from code review
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
* Update rules/windows/initial_access_script_executing_powershell.toml
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
* lint
* Update persistence_user_account_creation.toml
* Apply suggestions from code review
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
* Apply suggestions from code review
Co-authored-by: benironside <91905639+benironside@users.noreply.github.com>
Co-authored-by: Joe Peeples <joe.peeples@elastic.co>
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
* .
* Fixes and lint
* .
* .
* revert modifications
* Apply suggestions from code review
Co-authored-by: Joe Peeples <joe.peeples@elastic.co>
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>
* Update impact_stop_process_service_threshold.toml
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: benironside <91905639+benironside@users.noreply.github.com>
Co-authored-by: Joe Peeples <joe.peeples@elastic.co>
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>
|
2022-04-10 15:37:06 -03:00 |
|
|
Jonhnathan
|
cc241c0b5e
|
[Rule Tuning] Update network.direction (#1547)
* Update network.direction
* bump updated_date
|
2021-10-13 21:46:36 -03:00 |
|
|
Justin Ibarra
|
3fc34b86f2
|
Update License to Elastic v2 (#944)
|
2021-03-03 22:12:11 -09:00 |
|
|
Brent Murphy
|
64366218c7
|
adjust risk score (#938)
|
2021-02-08 13:15:42 -05:00 |
|
|
Justin Ibarra
|
a0e86e20d6
|
[Rule Tuning] Add windows integration index to rules (#923)
|
2021-01-28 20:53:57 -09:00 |
|
|
Samirbous
|
6dc78c4703
|
[New Rule] Remote File Download via Scripting (#647)
* [New Rule] Remote File Download via Scripting
* Update rules/windows/command_and_control_remote_file_copy_scripts.toml
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
* Update rules/windows/command_and_control_remote_file_copy_scripts.toml
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
* eql syntax
* ecs_version
* Update rules/windows/command_and_control_remote_file_copy_scripts.toml
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
* relinted
* deleted ecs_version
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
|
2020-12-08 12:37:51 +01:00 |
|