2 Commits

Author	SHA1	Message	Date
Ruben Groenewoud	ba6952c242	[Rule Tuning] 3 tunings to reduce FPs (#3058) ... * [Rule Tuning] 2 tunings to reduce FPs back to 0 * Added one more tune for community issue #3041 * Update rules/linux/execution_abnormal_process_id_file_created.toml * Update rules/linux/execution_abnormal_process_id_file_created.toml (cherry picked from commit 3588600d57)	2023-08-31 15:22:59 +00:00
Ruben Groenewoud	18c2214956	[New Rule] Sudo Command Enumeration Detected (#2946) ... * [New Rule] Sudo Command Enumeration Detected * Update discovery_sudo_allowed_command_enumeration.toml * revert endgame support due to unit testing fail * Update discovery_sudo_allowed_command_enumeration.toml * Update discovery_sudo_allowed_command_enumeration.toml * Update rules/linux/discovery_sudo_allowed_command_enumeration.toml Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com> * Update rules/linux/discovery_sudo_allowed_command_enumeration.toml Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com> --------- Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>	2023-08-03 09:39:16 +02:00