 Jonhnathan
|
817b97f428
|
[Security Content] Refactor Existing Investigation Guides (#1959)
* Initial commit
* Update Investigation guides - security-docs review
* Update command_and_control_dns_tunneling_nslookup.toml
* Update defense_evasion_amsienable_key_mod.toml
* Apply security-docs review
* Remove dot
* Update rules/windows/command_and_control_rdp_tunnel_plink.toml
Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com>
* Apply changes from review
* Apply the suggestion
Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com>
|
2022-05-18 12:59:39 -03:00 |
|
|
Jonhnathan
|
258418785f
|
MInor changes from Investigation Guides Review (#1927)
|
2022-04-13 16:53:29 -08:00 |
|
|
Jonhnathan
|
290763d9bb
|
[Security Content] Add Investigation Guides - 4 (#1871)
* [Security Content] Add Investigation Guides - 4
* Apply suggestions from code review
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
* Update rules/windows/initial_access_script_executing_powershell.toml
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
* lint
* Update persistence_user_account_creation.toml
* Apply suggestions from code review
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
* Apply suggestions from code review
Co-authored-by: benironside <91905639+benironside@users.noreply.github.com>
Co-authored-by: Joe Peeples <joe.peeples@elastic.co>
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
* .
* Fixes and lint
* .
* .
* revert modifications
* Apply suggestions from code review
Co-authored-by: Joe Peeples <joe.peeples@elastic.co>
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>
* Update impact_stop_process_service_threshold.toml
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: benironside <91905639+benironside@users.noreply.github.com>
Co-authored-by: Joe Peeples <joe.peeples@elastic.co>
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>
|
2022-04-10 15:37:06 -03:00 |
|
|
Jonhnathan
|
cc241c0b5e
|
[Rule Tuning] Update network.direction (#1547)
* Update network.direction
* bump updated_date
|
2021-10-13 21:46:36 -03:00 |
|
|
Justin Ibarra
|
3fc34b86f2
|
Update License to Elastic v2 (#944)
|
2021-03-03 22:12:11 -09:00 |
|
|
Brent Murphy
|
64366218c7
|
adjust risk score (#938)
|
2021-02-08 13:15:42 -05:00 |
|
|
Justin Ibarra
|
a0e86e20d6
|
[Rule Tuning] Add windows integration index to rules (#923)
|
2021-01-28 20:53:57 -09:00 |
|
|
Samirbous
|
6dc78c4703
|
[New Rule] Remote File Download via Scripting (#647)
* [New Rule] Remote File Download via Scripting
* Update rules/windows/command_and_control_remote_file_copy_scripts.toml
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
* Update rules/windows/command_and_control_remote_file_copy_scripts.toml
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
* eql syntax
* ecs_version
* Update rules/windows/command_and_control_remote_file_copy_scripts.toml
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
* relinted
* deleted ecs_version
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
|
2020-12-08 12:37:51 +01:00 |
|