Commit Graph

4 Commits

Author SHA1 Message Date
Ruben Groenewoud a973da1a6b [Rule Tuning] Linux DR Tuning - 9 (#5508)
* [Rule Tuning] Linux DR Tuning - 9

* Update rules/linux/persistence_apt_package_manager_file_creation.toml

* Fix formatting in persistence_boot_file_copy.toml

* Update persistence_chkconfig_service_add.toml

* Change user.id values to string format in TOML

* Fix condition for Java process working directory

* Fix logical operator in OpenSSL passwd hash rule

* Fix syntax for working_directory check

* Fix condition for original file name check

* Update persistence_web_server_unusual_command_execution.toml

* Add cloud CLI tools to persistence rules

---------

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
2026-01-07 16:18:38 +01:00
Ruben Groenewoud 37e18af7a5 [Rule Tuning] Adds Crowdstrike Compatibility to Linux Process Rules (#5232)
* First batch

* Second batch

* Batch 2
2025-11-10 16:03:39 +01:00
Mika Ayenson fe8c81d762 [FR] Generate investigation guides (#4358) 2025-01-22 11:17:38 -06:00
Ruben Groenewoud 2530c4d376 [New Rule] Pluggable Authentication Module Source Download (#4301)
* [New Rule] Pluggable Authentication Module Source Download

* Update persistence_pluggable_authentication_module_source_download.toml

* Update rules/linux/persistence_pluggable_authentication_module_source_download.toml
2025-01-07 13:04:05 +01:00