sigma-rules

Author	SHA1	Message	Date
Ruben Groenewoud	a973da1a6b	[Rule Tuning] Linux DR Tuning - 9 (#5508 ) * [Rule Tuning] Linux DR Tuning - 9 * Update rules/linux/persistence_apt_package_manager_file_creation.toml * Fix formatting in persistence_boot_file_copy.toml * Update persistence_chkconfig_service_add.toml * Change user.id values to string format in TOML * Fix condition for Java process working directory * Fix logical operator in OpenSSL passwd hash rule * Fix syntax for working_directory check * Fix condition for original file name check * Update persistence_web_server_unusual_command_execution.toml * Add cloud CLI tools to persistence rules --------- Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>	2026-01-07 16:18:38 +01:00
Ruben Groenewoud	37e18af7a5	[Rule Tuning] Adds Crowdstrike Compatibility to Linux Process Rules (#5232 ) * First batch * Second batch * Batch 2	2025-11-10 16:03:39 +01:00
shashank-elastic	059d7efa25	Prep for Release 9.0 (#4550 )	2025-03-20 20:32:07 +05:30
Mika Ayenson	fe8c81d762	[FR] Generate investigation guides (#4358 )	2025-01-22 11:17:38 -06:00
Jonhnathan	2af2e1f57b	[Rule Tuning] Linux 3rd Party EDR Support - Crowdstrike and S1 - 9 (#4356 )	2025-01-09 08:29:51 -03:00
Mika Ayenson	b80d8342d6	[Docs \| Rule Tuning] Add blog references to rules (#4097 ) * [Docs \| Rule Tuning] Add blog references to rules * Apply suggestions from code review Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com> * Apply suggestions from code review * Update google_workspace blog references * add okta blog references * Update dates --------- Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>	2024-09-25 15:19:20 -05:00
Ruben Groenewoud	39350847d6	[New Rules] Git Hook execution/netcon (#3896 ) * [New Rules] Git Hook execution/netcon * TImestamp formatting change * Update rules/linux/persistence_git_hook_netcon.toml Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> --------- Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com> Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>	2024-07-17 15:28:37 +02:00

7 Commits