3 Commits

Author	SHA1	Message	Date
Terrance DeJesus	4997f95300	[Rule Tuning] Link Elastic Security Labs content to compatible rules (#2388) ... * added elastic security labs URL references * Update rules/macos/credential_access_keychain_pwd_retrieval_security_cmd.toml Is not compatible with Windows blog. * Update rules/macos/credential_access_keychain_pwd_retrieval_security_cmd.toml Is not compatible with Windows blog. Reverting updated date. * Update rules/macos/credential_access_access_to_browser_credentials_procargs.toml Is not compatible with Windows blog. Reverting updated date. * Update rules/macos/credential_access_access_to_browser_credentials_procargs.toml Is not compatible with Windows blog. * Update rules/ml/execution_ml_windows_anomalous_script.toml Is not compatible with Windows blog. Reverting updated date. * Update rules/linux/credential_access_collection_sensitive_files.toml Not compatible with Windows blog. Reverting updated date. * Update rules/linux/credential_access_collection_sensitive_files.toml Not compatible with Windows blog. * added credential access URL for mimikatz rules * updated version ml windows anomalous script rule * removed change to macOS rule since no blog correlation	2022-11-07 15:17:49 -05:00
Justin Ibarra	46d5e37b76	min_stack all rules to 8.3 (#2259) ... * min_stack all rules to 8.3 * bump date Co-authored-by: Mika Ayenson <mika.ayenson@elastic.co>	2022-08-24 10:38:49 -06:00
Terrance DeJesus	1704924f7b	[New Rule] Abnormal Process ID File Creation (#1964) ... * adding rule detection * changed Rule ID * Update rules/linux/execution_abnormal_process_id_file_created.toml Adding reboot extension as well. Reference: https://exatrack.com/public/Tricephalic_Hellkeeper.pdf * Update rules/linux/execution_abnormal_process_id_file_created.toml Adding reboot to description. Reference: https://exatrack.com/public/Tricephalic_Hellkeeper.pdf * Update rules/linux/execution_abnormal_process_id_file_created.toml Added additional reference to similar threat. * Update rules/linux/execution_abnormal_process_id_file_created.toml Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com> * Update rules/linux/execution_abnormal_process_id_file_created.toml Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com> * added rule for a process starting where the executable's name represented a PID file * Adjusted user.id value from integer to string * Added simple investigation notes and osquery coverage * TOML linting * Updated date to reflect recent changes Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com> Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>	2022-05-12 10:38:27 -04:00