 Craig Chamberlain
|
8e2d4cbfc8
|
[New Rule] Unusual Linux System Owner or User Discovery Activity (#267)
* Create ml_linux_system_user_discovery.toml
ML rule to accompany the unusual system owner / user discovery job
* Update rules/ml/ml_linux_system_user_discovery.toml
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
* Update ml_linux_system_user_discovery.toml
added fp field
* Update ml_linux_system_user_discovery.toml
* Update ml_linux_system_user_discovery.toml
* Update ml_linux_system_user_discovery.toml
* Update ml_linux_system_user_discovery.toml
lint
* Update ml_linux_system_user_discovery.toml
* Update rules/ml/ml_linux_system_user_discovery.toml
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
|
2020-09-22 16:22:41 -04:00 |
|