 Jonhnathan
|
0268daa17d
|
[Rule Tuning] Tighten Up Elastic Defend Indexes - Linux (#4446)
|
2025-02-05 15:25:45 -03:00 |
|
|
Mika Ayenson
|
fe8c81d762
|
[FR] Generate investigation guides (#4358)
|
2025-01-22 11:17:38 -06:00 |
|
|
shashank-elastic
|
63e91c2f12
|
Back-porting Version Trimming (#3704)
|
2024-05-23 00:45:10 +05:30 |
|
|
Mika Ayenson
|
2c3dbfc039
|
Revert "Back-porting Version Trimming (#3681)"
This reverts commit 71d2c59b5c.
|
2024-05-22 13:51:46 -05:00 |
|
|
shashank-elastic
|
71d2c59b5c
|
Back-porting Version Trimming (#3681)
|
2024-05-23 00:11:50 +05:30 |
|
|
Justin Ibarra
|
ce21acef9c
|
[Bug] Fix test_os_and_platform_in_query test and rules (#3695)
Co-authored-by: brokensound77 <brokensound77@users.noreply.github.com>
|
2024-05-20 08:43:30 -07:00 |
|
|
Jonhnathan
|
458e67918a
|
[Security Content] Small tweaks on the setup guides (#3308)
* [Security Content] Small tweaks on the setup guides
* Additional Fixes
* Avoid touching deprecated rules
|
2024-03-11 09:09:40 -03:00 |
|
|
Ruben Groenewoud
|
84824c67fd
|
[Tuning & New Rule] Linux Reverse Shell & DR Tuning (#3254)
* [Rule Tuning & New Rule] Linux Reverse Shell
* [Tuning & New Rule] Linux Reverse Shells
* Name change
* Update rules/linux/execution_shell_via_child_tcp_utility_linux.toml
Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com>
* Update execution_shell_via_child_tcp_utility_linux.toml
* Update execution_shell_via_background_process.toml
---------
Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com>
|
2023-12-18 09:36:21 +01:00 |
|
|
shashank-elastic
|
d52546eee5
|
Enhance Setup Guide information (#3256)
|
2023-11-03 19:05:29 +05:30 |
|
|
Ruben Groenewoud
|
020fff3aea
|
[Rule Tuning] Linux Rules (#3092)
* [Rule Tuning] [WIP] Linux DR
* Update defense_evasion_binary_copied_to_suspicious_directory.toml
* Fixed tag
* Added additional tuning
* unit test fix
* Additional tuning
* tuning
* added max signals
* Added max_signals=1 to brute force rules
* Cross-Platform Tuning
* Small fix
* new_terms conversion
* typo
* new_terms conversion
* Ransomware rule tuning
* performance tuning
* new_terms conversion for auditd_manager
* tune
* Need coffee
* kql/eql stuff
* formatting improvement
* new_terms sudo hijacking conversion
* exclusion
* Deprecations that were added last tuning
* Deprecations that were added last tuning
* Increased max timespan for brute force rules
* version bump
* added domain tag
* Two tunings
* More tuning
* Additional tuning
* updated_date bump
* query optimization
* Tuning
* Readded the exclusions for this one
* Changed int comparison
* Some tunings
* Update persistence_systemd_scheduled_timer_created.toml
* Update rules/linux/privilege_escalation_ld_preload_shared_object_modif.toml
Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>
* [New Rule] Potential curl CVE-2023-38545 Exploitation
* Revert "[New Rule] Potential curl CVE-2023-38545 Exploitation"
This reverts commit 9c04d1b53d3d63678289f43ec0c7b617d26f1ce0.
* Update rules/cross-platform/command_and_control_non_standard_ssh_port.toml
* Update rules/linux/command_and_control_cat_network_activity.toml
* Update persistence_message_of_the_day_execution.toml
* Changed max_signals
* Revert "Merge branch 'main' into rule-tuning-ongoing-dr"
This reverts commit 1106b5d2eba1a3529eff325226d6baabfd4b0bf3, reversing
changes made to 5ff510757f25b0cb32e1ef18e9e2c34c8ec325a8.
* Revertable merge
* Update defense_evasion_ld_preload_env_variable_process_injection.toml
* File name change
---------
Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
|
2023-10-23 16:28:58 +02:00 |
|
|
shashank-elastic
|
7254c582c5
|
Move Setup information into setup filed (#3206)
|
2023-10-23 19:28:18 +05:30 |
|
|
shashank-elastic
|
2a48db0598
|
Setup information for Linux Rules - Set5 (#3188)
|
2023-10-17 19:11:20 +05:30 |
|
|
Jonhnathan
|
4233fef238
|
[Security Content] Include "Data Source: Elastic Defend" tag (#3002)
* win folder
* Other folders
* Update test_all_rules.py
* .
* updated missing elastic defend tags
---------
Co-authored-by: terrancedejesus <terrance.dejesus@elastic.co>
|
2023-09-05 14:22:01 -04:00 |
|
|
Ruben Groenewoud
|
e938ed28a0
|
[Rule Tuning] added additional event action (#3008)
|
2023-08-10 16:59:07 +02:00 |
|
|
Ruben Groenewoud
|
dbd7ed65a9
|
[Tuning] Reverse Shell Rules (#2959)
* [Rule Tuning] Reverse Shell Rule destination.ip tuning
* Updated updated_date
|
2023-07-25 14:55:56 +02:00 |
|
|
Ruben Groenewoud
|
646c316b66
|
[New Rules] Linux Reverse Shells (#2905)
* [New Rules] Linux Reverse Shells
* [New Rules] Linux Reverse Shells
* Update rules/linux/execution_shell_via_udp_cli_utility_linux.toml
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
* Update rules/linux/execution_shell_via_java_revshell_linux.toml
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
* Update rules/linux/execution_shell_via_java_revshell_linux.toml
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
* Update rules/linux/execution_shell_via_java_revshell_linux.toml
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
* Update rules/linux/execution_shell_suspicious_parent_child_revshell_linux.toml
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
* Update rules/linux/execution_shell_via_udp_cli_utility_linux.toml
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
* Update rules/linux/execution_shell_via_udp_cli_utility_linux.toml
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
* Update rules/linux/execution_shell_via_reverse_tcp_utility_linux.toml
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
* Update rules/linux/execution_shell_via_reverse_tcp_utility_linux.toml
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
* Update rules/linux/execution_shell_suspicious_parent_child_revshell_linux.toml
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
* Update rules/linux/execution_shell_suspicious_parent_child_revshell_linux.toml
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
* Delete UDP rule to add in separate PR
* Update rules/linux/execution_shell_via_lolbin_interpreter_linux.toml
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
* Update rules/linux/execution_shell_via_tcp_cli_utility_linux.toml
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
* Update rules/linux/execution_shell_via_reverse_tcp_utility_linux.toml
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
* Update rules/linux/execution_shell_via_tcp_cli_utility_linux.toml
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
* Update rules/linux/execution_shell_via_tcp_cli_utility_linux.toml
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
* Deleted one rule and tuned the others
* Improved the rules' performance
* Added the reverse_tcp rule back after tuning
* Update execution_shell_via_lolbin_interpreter_linux.toml
---------
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
|
2023-07-06 15:27:57 +02:00 |
|