sigma-rules

Author	SHA1	Message	Date
Justin Ibarra	f87f2a46f4	[Rule Tuning] Remove all rule timelines (#466 )	2020-11-03 09:51:53 -09:00
Justin Ibarra	da64bacac1	[Rule Tuning] Add timeline_title to rules with timeline IDs defined (#452 )	2020-11-02 14:12:20 -09:00
Derek Ditch	580db2c13e	Add timeline_id to detection rules (#95 ) * Adds timeline_id to all network rules - Uses the ID for the 'Generic Network Timeline' from Elastic * Adds timeline_id to all endpoint rules - Uses the ID for the 'Generic Endpoint Timeline' from Elastic * Adds timeline_id to all process-oriented rules - Uses the ID for the 'Generic Process Timeline' from Elastic * Ran tests and toml-lint * Bumped 'updated_date'	2020-10-27 13:34:16 -05:00
seth-goodwin	2065af89b1	[Rule Tuning] Tag Categorization Updates (#380 ) * Add new categorization tags * Change updated_date to 2020/10/26 Co-authored-by: Ross Wolf <31489089+rw-access@users.noreply.github.com>, @bm11100	2020-10-26 13:50:45 -05:00
Justin Ibarra	2460333595	[Rule Tuning] Add extended lookback for all endpoint rules to account for ingest delays (#351 )	2020-09-30 16:16:04 -08:00
Samirbous	fc3dcdf133	[New Rule] Unusual CommandShell Parent Process (#202 ) * [New Rule] Suspicious CommandShell Parent Process * toml linted * Update execution_command_shell_started_by_unusual_process.toml * Update execution_command_shell_started_by_unusual_process.toml * Update execution_command_shell_started_by_unusual_process.toml * Update execution_command_shell_started_by_unusual_process.toml * Update execution_command_shell_started_by_unusual_process.toml * Update rules/windows/execution_command_shell_started_by_unusual_process.toml Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com> * Update rules/windows/execution_command_shell_started_by_unusual_process.toml Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com> * Update rules/windows/execution_command_shell_started_by_unusual_process.toml Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com> * Update rules/windows/execution_command_shell_started_by_unusual_process.toml Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com> * Update execution_command_shell_started_by_unusual_process.toml * Update execution_command_shell_started_by_unusual_process.toml Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>	2020-09-28 23:15:26 +02:00

6 Commits