2326b30a87
[Rule Tuning] Suspicious Browser Child Process ( #2138 )
2022-08-23 09:56:23 -04:00
3fc34b86f2
Update License to Elastic v2 ( #944 )
2021-03-03 22:12:11 -09:00
645a0cd67b
[Rule Tuning] Add timestamp_override to all query and non-sequence EQL rules ( #945 )
...
* [Rule Tuning] Add timestamp_override field to rules
* add tests for lookback and timestamp_override
* fix dates and add test to ensure updated > creation
2021-02-17 19:49:58 -09:00
6a61caa84f
[New Rule] Suspicious Browser Child Process ( #767 )
...
* [New Rule] Suspicious Browser Child Process
* auditbeat removed
auditbeat process execution does not log the parent process name.
* added more suspicious childproc
* added perl and php
* Update execution_initial_access_suspicious_browser_childproc.toml
* Update execution_initial_access_suspicious_browser_childproc.toml
* Update execution_initial_access_suspicious_browser_childproc.toml
* excluded noisy stuff
* Update rules/macos/execution_initial_access_suspicious_browser_childproc.toml
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com >
* Update rules/macos/execution_initial_access_suspicious_browser_childproc.toml
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com >
* Update rules/macos/execution_initial_access_suspicious_browser_childproc.toml
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com >
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com >
2021-02-08 15:06:18 +01:00
Mika Ayenson