515ee158fb
[New BBR] Segfault Detected ( #3240 )
...
* [New BBR] Segfault Detected
* Update rules_building_block/execution_linux_segfault.toml
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com >
* Update rules_building_block/execution_linux_segfault.toml
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com >
---------
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com >
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com >
(cherry picked from commit dff4633dd4
2023-11-02 08:46:22 +00:00
13c6fbbcea
[New BBR] Kernel Driver Load ( #3236 )
...
* [New BBR] Kernel Driver Load
* added event.dataset to the query
---------
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com >
(cherry picked from commit 967f6a4c89
2023-11-02 08:38:32 +00:00
029c826043
[FR] Adjust Prebuilt Rules Packaging to Use Elastic Package v3 ( #3252 )
...
* Adding support for elastic package version 3
* replaced OS with Pathlib where applicable
* added sub-dataclasses for V3
* fixed flake errors
* adjusted registry dataclasses to inherit base
Removed changes from:
- detection_rules/etc/packages.yml
(selectively cherry picked from commit cdeb398ab3
2023-11-01 16:53:22 +00:00
98e8748f9f
[FR] Support missing events ( #3153 )
...
(cherry picked from commit d0b0216362
2023-10-31 21:26:25 +00:00
d2050f755d
Pin python packages ( #3249 )
...
(cherry picked from commit 5722257119
2023-10-30 17:59:33 +00:00
90c06f5fce
Setup information for Linux Rules - Set8 ( #3200 )
...
(cherry picked from commit 5c5d1b214b
2023-10-30 15:34:50 +00:00
f32a83791a
[New Rule] Adding Beaconing Rules from Advanced Analytic Beaconing Package ( #3128 )
...
* Adding beaconing rules
* Update rules/integrations/beaconing/command_and_control_beaconing_high_confidence.toml
Co-authored-by: Kirti Sodhi <109447885+sodhikirti07@users.noreply.github.com >
* Update rules/integrations/beaconing/command_and_control_beaconing.toml
Co-authored-by: Kirti Sodhi <109447885+sodhikirti07@users.noreply.github.com >
* Updating min stack version
* added beaconing to manifests and schemas; updated rules
---------
Co-authored-by: Kirti Sodhi <109447885+sodhikirti07@users.noreply.github.com >
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com >
Co-authored-by: terrancedejesus <terrance.dejesus@elastic.co >
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com >
(cherry picked from commit a4f9cf4616
2023-10-30 14:11:53 +00:00
a31d788dcb
Move Config Guides for Pre-Built Detection Rules to Setup Field - Windows, MacOS, BBR and Cross Platform ( #3157 )
...
(cherry picked from commit a568c56bc1
2023-10-30 11:28:47 +00:00
01a8fd30f2
[Rule Tuning] Tainted Kernel Module Load ( #3234 )
...
* [Rule Tuning] Tainted kernel module load
* Update persistence_tainted_kernel_module_load.toml
* Update rules_building_block/persistence_tainted_kernel_module_load.toml
---------
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com >
(cherry picked from commit ad25c922fd
2023-10-30 08:55:15 +00:00
473039ceb8
[New Rule] Attempt to Clear Kernel Ring Buffer ( #3217 )
...
* [New Rule] Attempt to Clear Kernel Ring Buffer
* Update defense_evasion_clear_kernel_ring_buffer.toml
---------
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com >
(cherry picked from commit 618a1dbe06
2023-10-30 08:42:54 +00:00
700b6c5168
[Tuning] Access to Stored Browser Credentials ( #3066 )
...
* Exclude FPs
* Update rules/macos/credential_access_access_to_browser_credentials_procargs.toml
Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com >
---------
Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com >
(cherry picked from commit 6400bb3237
2023-10-27 20:15:40 +00:00
936db2cd9b
[Rule Tuning] Review and Tune Potential Malicious File Downloaded from Google Drive ( #3197 )
...
* added tuning to remove signed binaries and benign processes
* Update rules/cross-platform/command_and_control_google_drive_malicious_file_download.toml
Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com >
* Update rules/cross-platform/command_and_control_google_drive_malicious_file_download.toml
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com >
* Update rules/cross-platform/command_and_control_google_drive_malicious_file_download.toml
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com >
---------
Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com >
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com >
(cherry picked from commit e7db39a492
2023-10-27 18:18:25 +00:00
924056878d
[Rule Tuning] Windows DR Tuning - 4 ( #3214 )
...
* [Rule Tuning] Windows DR Tuning - 4
* Update credential_access_remote_sam_secretsdump.toml
(cherry picked from commit 1133b3a8a9
2023-10-27 00:04:57 +00:00
86bca86b6c
Cleanup saved_query references ( #3205 )
...
(cherry picked from commit a808130390
2023-10-26 23:13:17 +00:00
44cf454ce2
[Rule Tuning] Windows DR Tuning - 3 ( #3212 )
...
* [Rule Tuning] Windows DR Tuning - 3
* Update credential_access_lsass_openprocess_api.toml
* Update credential_access_moving_registry_hive_via_smb.toml
(cherry picked from commit 3d73427e29
2023-10-26 22:04:49 +00:00
4d98afbc1d
[Rule Tuning] Windows DR Tuning - 2 ( #3209 )
...
* [Rule Tuning] Windows DR Tuning - 2
* Update rules/windows/credential_access_kerberoasting_unusual_process.toml
* Update credential_access_kerberoasting_unusual_process.toml
* Update command_and_control_teamviewer_remote_file_copy.toml
(cherry picked from commit efa7c428ea
2023-10-26 21:17:05 +00:00
aa62790ae6
[Rule Tuning] Windows DR Tuning - 1 ( #3198 )
...
* [Rule Tuning] Windows DR Tuning - 1
* Update collection_winrar_encryption.toml
(cherry picked from commit a5240e4063
2023-10-26 20:26:43 +00:00
43b0346493
[FR] Updated typing-extensions dependency ( #3204 )
...
* Updated typing-extensions
* Added entries for <=3.11 and >=3.12
---------
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com >
(cherry picked from commit 36b0a49e7d
2023-10-26 16:21:29 +00:00
32bdb2ba93
[FR] Adjust Risk Severity Unit Test to Match UI ( #3218 )
...
* adjusted risk score to include ranges allowed upstream
* Update tests/test_all_rules.py
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com >
---------
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com >
(cherry picked from commit e6ead7b5f7
2023-10-25 14:31:49 +00:00
85458c65cd
[New Rule] Network Activity Detected via kworker ( #3202 )
...
* [New Rule] Potential curl CVE-2023-38545 Exploitation
* Revert "[New Rule] Potential curl CVE-2023-38545 Exploitation"
This reverts commit 9c04d1b53d3d63678289f43ec0c7b617d26f1ce0.
* [New Rule] Network Activity Detected via kworker
* White space
* Update rules/linux/command_and_control_linux_kworker_netcon.toml
* Update rules/linux/command_and_control_linux_kworker_netcon.toml
* Update rules/linux/command_and_control_linux_kworker_netcon.toml
* Update command_and_control_linux_kworker_netcon.toml
* Update rules/linux/command_and_control_linux_kworker_netcon.toml
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com >
* Update rules/linux/command_and_control_linux_kworker_netcon.toml
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com >
* Update command_and_control_linux_kworker_netcon.toml
---------
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com >
(cherry picked from commit 1ac3775743
2023-10-25 13:30:50 +00:00
46c430d4d4
Lock versions for releases: 8.3,8.4,8.5,8.6,8.7,8.8,8.9,8.10,8.11 ( #3223 )
...
* Locked versions for releases: 8.3,8.4,8.5,8.6,8.7,8.8,8.9,8.10,8.11
* Update detection_rules/etc/deprecated_rules.json
---------
Co-authored-by: terrancedejesus <terrancedejesus@users.noreply.github.com >
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com >
(cherry picked from commit ab6f28a380
2023-10-24 18:06:52 +00:00
1b9aaa3730
[Rule Tuning] Bump Minimum Stacks for AWS and Okta for Version Control ( #3221 )
...
* adding adjusted Okta rules
* adding adjusted AWS rules
* adding adjusted AWS rules
(cherry picked from commit 3d57209705
2023-10-24 16:58:20 +00:00
8c03047130
[New Rule] Potential Linux Hack Tool Launched ( #3125 )
...
* [New Rule] Potential Linux Hack Tool Launched
* changed description slightly
* Updated description
* Update rules/linux/execution_potential_hack_tool_executed.toml
* Update rules/linux/execution_potential_hack_tool_executed.toml
(cherry picked from commit 3855dd06d8
2023-10-23 19:42:37 +00:00
223bfe0a6d
[Promote] Potential Masquerading as Communication Apps ( #3181 )
...
* [Promote] Potential Masquerading as Communication Apps
* Update defense_evasion_masquerading_communication_apps.toml
* Update defense_evasion_masquerading_communication_apps.toml
* Update rules/windows/defense_evasion_masquerading_communication_apps.toml
* Update defense_evasion_masquerading_communication_apps.toml
---------
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com >
(cherry picked from commit 6fcf26b20e
2023-10-23 18:01:34 +00:00
574a130346
[Rule Tuning] Potential Privilege Escalation via InstallerFileTakeOver ( #3215 )
...
* [Rule Tuning] Potential Privilege Escalation via InstallerFileTakeOver
* Update privilege_escalation_installertakeover.toml
(cherry picked from commit a471f6fc60
2023-10-23 17:40:51 +00:00
4ed6c7d594
[New Rule] Add Living-off-the-Land (LotL) ProblemChild Rules ( #3193 )
...
* adding new LotL rules
* added endpoint tags; updated technique mapping
* added missing data source tag
* Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_user.toml
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com >
* Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_host.toml
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com >
* Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_host.toml
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com >
* Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_parent_process.toml
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com >
* Update rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_host.toml
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com >
* Update rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_user.toml
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com >
* Update rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_parent_process.toml
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com >
* Update rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_user.toml
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com >
* Update rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_parent_process.toml
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com >
* Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_host.toml
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com >
* Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_host.toml
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com >
* Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_host.toml
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com >
* Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_parent_process.toml
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com >
* Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_user.toml
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com >
* Update rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_event.toml
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com >
* Update rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_event_high_probability.toml
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com >
* Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_host.toml
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com >
* updated note, references and date
* changed ATT&CK technique to binary proxy execution
---------
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com >
(cherry picked from commit 835be9b245
2023-10-23 16:29:59 +00:00
ab55bc399d
[New Rule] Netcat Listener Established via rlwrap ( #3124 )
...
* [New Rule] Netcat Listener Established via rlwrap
* Update rules/linux/execution_nc_listener_via_rlwrap.toml
(cherry picked from commit ff268cc6a0
2023-10-23 15:37:35 +00:00
9078f76827
[New BBR] Unix Socket Communication ( #3072 )
...
* [New Rule] Unix Socket Communication
* Update rules_building_block/execution_unix_socket_communication.toml
Co-authored-by: Isai <59296946+imays11@users.noreply.github.com >
* Update rules_building_block/execution_unix_socket_communication.toml
---------
Co-authored-by: Isai <59296946+imays11@users.noreply.github.com >
(cherry picked from commit 9807bebd8e
2023-10-23 15:24:36 +00:00
23337d90d4
[New BBR] Tainted Kernel Module Load ( #3211 )
...
* [New Rule] Tainted Kernel Module Load
* added setup note
* Fixed tag
* added type change
* timestamp override
---------
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com >
(cherry picked from commit 024d45bd56
2023-10-23 15:12:20 +00:00
916b1a2cad
[Promote] Expired or Revoked Driver Loaded ( #3185 )
...
* [Promote] Expired or Revoked Driver Loaded
* Update privilege_escalation_expired_driver_loaded.toml
(cherry picked from commit 18ff85ce84
2023-10-23 14:50:52 +00:00
9b2e74b220
[Rule Tuning] Linux Rules ( #3092 )
...
* [Rule Tuning] [WIP] Linux DR
* Update defense_evasion_binary_copied_to_suspicious_directory.toml
* Fixed tag
* Added additional tuning
* unit test fix
* Additional tuning
* tuning
* added max signals
* Added max_signals=1 to brute force rules
* Cross-Platform Tuning
* Small fix
* new_terms conversion
* typo
* new_terms conversion
* Ransomware rule tuning
* performance tuning
* new_terms conversion for auditd_manager
* tune
* Need coffee
* kql/eql stuff
* formatting improvement
* new_terms sudo hijacking conversion
* exclusion
* Deprecations that were added last tuning
* Deprecations that were added last tuning
* Increased max timespan for brute force rules
* version bump
* added domain tag
* Two tunings
* More tuning
* Additional tuning
* updated_date bump
* query optimization
* Tuning
* Readded the exclusions for this one
* Changed int comparison
* Some tunings
* Update persistence_systemd_scheduled_timer_created.toml
* Update rules/linux/privilege_escalation_ld_preload_shared_object_modif.toml
Co-authored-by: Isai <59296946+imays11@users.noreply.github.com >
* [New Rule] Potential curl CVE-2023-38545 Exploitation
* Revert "[New Rule] Potential curl CVE-2023-38545 Exploitation"
This reverts commit 9c04d1b53d3d63678289f43ec0c7b617d26f1ce0.
* Update rules/cross-platform/command_and_control_non_standard_ssh_port.toml
* Update rules/linux/command_and_control_cat_network_activity.toml
* Update persistence_message_of_the_day_execution.toml
* Changed max_signals
* Revert "Merge branch 'main' into rule-tuning-ongoing-dr"
This reverts commit 1106b5d2eba1a3529eff325226d6baabfd4b0bf3, reversing
changes made to 5ff510757f25b0cb32e1ef18e9e2c34c8ec325a8.
* Revertable merge
* Update defense_evasion_ld_preload_env_variable_process_injection.toml
* File name change
---------
Co-authored-by: Isai <59296946+imays11@users.noreply.github.com >
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com >
(cherry picked from commit 020fff3aea
2023-10-23 14:34:55 +00:00
60475f6aa0
Move Setup information into setup filed ( #3206 )
...
(cherry picked from commit 7254c582c5
2023-10-23 14:04:26 +00:00
21bff0b9d2
[FR] Adding Support for missing_field_strategy Field in Alert Suppression ( #3201 )
...
* adding missing field strategy option to alert suppression
* fixed linting errors
* added validate methods for alertsuppression dataclass
* fixed linting errors
* replaced old variable with new variable
* removing test rule
* adding post_load to queryruledata
* changed post_load to validates_schema
* updated unit testing for alert suppression
* fixed linting errors
* changed validates method name to validates_exceptions
* removed min compat for fields
(cherry picked from commit 3ab57fb8a7
2023-10-19 22:22:50 +00:00
85854896e6
[New Rule] Upgrade of Non-interactive Shell ( #3113 )
...
* [New Rule] Upgrade of Non-interactive Shell
* Changed numbers to int
* Changed severity
* [New Rule] Pot. Rev Shell via Background Process
* Revert "[New Rule] Pot. Rev Shell via Background Process"
This reverts commit bbb36eae26561dbef4bf57f6c1388cebe7a8b88d.
* Update rules/linux/execution_interpreter_tty_upgrade.toml
(cherry picked from commit 9f41c9f35c
2023-10-18 14:53:36 +00:00
6b03cbb54b
[New Rules] cap_setuid/cap_setgid privesc ( #3075 )
...
* [New Rules] cap_setuid/cap_setgid privesc
* Update persistence_setuid_setgid_capability_set.toml
* Update rules/linux/privilege_escalation_suspicious_cap_setuid_python_execution.toml
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com >
* Update privilege_escalation_suspicious_cap_setuid_python_execution.toml
* Update rules/linux/privilege_escalation_suspicious_cap_setuid_python_execution.toml
* Update privilege_escalation_suspicious_cap_setuid_python_execution.toml
---------
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com >
(cherry picked from commit 6ea11cd9ad
2023-10-18 14:29:35 +00:00
71f4ba024c
[New Rule] Potential SSH-IT SSH Worm Downloaded ( #3121 )
...
* [New Rule]
* Fixed grammar mistake
* Update rules/linux/lateral_movement_ssh_it_worm_download.toml
* Update rules/linux/lateral_movement_ssh_it_worm_download.toml
(cherry picked from commit 4190c3a6a7
2023-10-18 14:14:42 +00:00
28c04cbdcf
[New Rule] Pot. Network Scan Executed from Host ( #3070 )
...
(cherry picked from commit 7d674db11e
2023-10-18 13:52:28 +00:00
f82c0b6e0b
[New Rules] [BBR] Windows Deprecated ERs Conversion - 3 ( #3143 )
...
* [New Rules] [BBR] Windows Deprecated ERs Conversion - 3
* Update defense_evasion_invalid_codesign_imageload.toml
* Update defense_evasion_invalid_codesign_imageload.toml
* Update rules_building_block/initial_access_execution_remote_via_msiexec.toml
Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com >
* Update rules_building_block/initial_access_xsl_script_execution_via_com.toml
Co-authored-by: Isai <59296946+imays11@users.noreply.github.com >
* Update rules_building_block/initial_access_execution_remote_via_msiexec.toml
Co-authored-by: Isai <59296946+imays11@users.noreply.github.com >
---------
Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com >
Co-authored-by: Isai <59296946+imays11@users.noreply.github.com >
(cherry picked from commit 74222f86eb
2023-10-17 17:22:19 +00:00
7921daeddd
[New Rules] [BBR] Windows Deprecated ERs Conversion - 2 ( #3138 )
...
* [New Rules] [BBR] Windows Deprecated ERs Conversion - 2
* Update defense_evasion_unsigned_bits_client.toml
* Update rules_building_block/defense_evasion_suspicious_msiexec_execution.toml
Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com >
* .
---------
Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com >
(cherry picked from commit 3ea3e5a9fd
2023-10-17 16:55:50 +00:00
d24492678e
[New Rules] [BBR] Windows Deprecated ERs Conversion - 1 ( #3131 )
...
* [New Rules] [BBR] Windows Deprecated ERs Conversion - 1
* .
* .
* Update defense_evasion_dotnet_clickonce_dfsvc_netcon.toml
* .
(cherry picked from commit 32002fd89b
2023-10-17 14:42:54 +00:00
118f11daf6
Setup information for Linux Rules - Set7 ( #3190 )
...
(cherry picked from commit 276c0f9cd3
2023-10-17 14:21:37 +00:00
b873968d3a
Setup information for Linux Rules - Set6 ( #3189 )
...
(cherry picked from commit 5a98208b53
2023-10-17 14:09:16 +00:00
a7e83681e3
Setup information for Linux Rules - Set5 ( #3188 )
...
(cherry picked from commit 2a48db0598
2023-10-17 13:46:52 +00:00
95f45de9cc
Setup information for Linux Rules - Set4 ( #3179 )
...
(cherry picked from commit 25b527c149
2023-10-17 13:35:14 +00:00
f99b745866
Setup information for Linux Rules - Set3 ( #3178 )
...
(cherry picked from commit d2c2987d72
2023-10-17 13:13:05 +00:00
34ef0f1752
Setup information for Linux Rules - Set2 ( #3177 )
...
(cherry picked from commit 1801a4ee7e
2023-10-17 13:01:51 +00:00
18dc3b0f73
[New Rule] [BBR] Memory Dump File Rules ( #3122 )
...
* [New Rule] Memory Dump File Rules
* .
* .
* .
(cherry picked from commit a33a124eab
2023-10-17 12:41:28 +00:00
f7a2c9b0b4
[Rule Tuning] Potential Masquerading as Browser Process ( #3180 )
...
* [Rule Tuning] Potential Masquerading as Browser Process
* Update defense_evasion_masquerading_browsers.toml
* Update defense_evasion_masquerading_browsers.toml
(cherry picked from commit 8035516e8e
2023-10-17 11:59:16 +00:00
97ce9d7478
[Rule Tuning] Potential Masquerading as System32 DLL ( #3184 )
...
Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com >
(cherry picked from commit e4e68c2dd8
2023-10-17 11:35:05 +00:00
6bc1104f86
[Rule Tuning] Adjust Lucene queries to use Uppercase operators ( #3196 )
...
(cherry picked from commit 82685e36ce
2023-10-16 20:14:08 +00:00
Ruben Groenewoud