5 Commits

Author	SHA1	Message	Date
Samirbous	b15f0de9a4	[Rules Tuning] Diverse Windows Rules - FPs reduction (#2213) ... * [Rules Tuning] 7 diverse Windows rules Excluding FP patterns while avoiding breaking compat with winlogbeat and 4688 events lack of codesign metadata. * Update initial_access_suspicious_ms_exchange_process.toml * Update privilege_escalation_persistence_phantom_dll.toml * Update execution_psexec_lateral_movement_command.toml * Update persistence_remote_password_reset.toml * Update non-ecs-schema.json * Update persistence_remote_password_reset.toml * Update non-ecs-schema.json * Update discovery_privileged_localgroup_membership.toml	2022-08-02 18:37:07 +02:00
Mika Ayenson	a52751494e	2058 add setup field to metadata (#2061) ... * Convert config header to setup in note field * Parse note field into separate setup and note field with marko gfm * only validate and parse note on elastic authored rules and add CLI description for new DR_BYPASS_NOTE_VALIDATION_AND_PARSE environment variable Co-authored-by: brokensound77 <brokensound77@users.noreply.github.com>	2022-07-18 15:41:32 -04:00
Justin Ibarra	6bdfddac8e	Expand timestamp override tests (#1907) ... * Expand timestamp_override tests * removed timestamp_override from eql sequence rules * add config entry for eql rules with beats index and t_o * add timestamp_override to missing fields	2022-04-01 15:27:08 -08:00
Justin Ibarra	0b65678d8c	[Rule tuning] Correct tags with associated threat mappings (#1003)	2021-03-08 14:12:29 -09:00
Andrew Pease	4494b02e01	[New Rule] Microsoft Exchange Server’s Unified Messaging Spawning Vulnerability - CVE-2021-26857 (#979) ... Co-authored-by: Brent Murphy <bmurphy@endgame.com> Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>	2021-03-04 16:46:49 -05:00