2 Commits

Author	SHA1	Message	Date
Ruben Groenewoud	e1698890a4	[Rule Tuning] Linux DR Tuning - 7 (#5504) ... * [Rule Tuning] Linux DR Tuning - 7 * Update execution_egress_connection_from_entrypoint_in_container.toml * Update execution_kubernetes_direct_api_request_via_curl_or_wget.toml * Update rules/linux/execution_perl_tty_shell.toml * Update execution_perl_tty_shell.toml * Update rules/linux/execution_unix_socket_communication.toml * Update execution_file_made_executable_via_chmod_inside_container.toml * Remove duplicate Crowdstrike data source entry --------- Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>	2026-01-08 11:10:46 +01:00
Ruben Groenewoud	3b1f780435	[D4C Conversion] Converting Compatible D4C Rules to DR (#4532) ... * [D4C Conversion] Converting Compatible D4C Rules to DR * added host.os.type * Rename * Update rules/linux/execution_container_management_binary_launched_inside_container.toml Co-authored-by: Isai <59296946+imays11@users.noreply.github.com> * Update rules/linux/privilege_escalation_debugfs_launched_inside_container.toml Co-authored-by: Isai <59296946+imays11@users.noreply.github.com> * Update rules/linux/privilege_escalation_debugfs_launched_inside_container.toml Co-authored-by: Isai <59296946+imays11@users.noreply.github.com> * Update rules/linux/privilege_escalation_mount_launched_inside_container.toml Co-authored-by: Isai <59296946+imays11@users.noreply.github.com> * Update rules/linux/privilege_escalation_mount_launched_inside_container.toml Co-authored-by: Isai <59296946+imays11@users.noreply.github.com> --------- Co-authored-by: Isai <59296946+imays11@users.noreply.github.com> Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com> Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>	2025-04-10 14:26:40 +02:00