security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,671 Commits 1 Branch 0 Tags
e4b66c23dc54797e05ca99718c41bcd4b7c07eac
Commit Graph

1671 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Mika Ayenson e4b66c23dc [Bug] Create Rule CLI Crashes on Required Arg (#3127) 2023-09-28 14:28:13 -05:00
eric-forte-elastic 4828ae07df [FR] Added asset tag to expected tags (#3115) 
* Added asset tag to expected tags

* removed *

* Add regex wildcard tag support

* Updated tag format test location

* Updated to use env variable

* fixed typo
 2023-09-28 14:09:05 -04:00
Terrance DeJesus 8650b26002 [Rule Tuning] Update LMD Rules Min-Stack to 8.5 (#3142) 
* updating min-stack to 8.5

* updated min stack comments
 2023-09-27 16:17:52 -04:00
Apoorva Joshi 747ee7d593 [New Rule] Adding Lateral Movement Rules from Advanced Analytic LMD Package (#3119) 
* Adding Lateral Movement Detection rules

* added tags; adjusted tests; updated manifests and schemas

* added default value to build_integrations_schema

* combined analytic and non-dataset packages for related integrations

* adjusted machine learning definitions

* adjusted machine learning definitions

* removed splat for machine learning list due to 3.8 constraints

---------

Co-authored-by: terrancedejesus <terrance.dejesus@elastic.co>
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
 2023-09-27 14:53:38 -04:00
Jonhnathan f77bec8552 [New Rule] [BBR] File with Suspicious Extension Downloaded (#3139) 
* [New Rule] [BBR] File with Suspicious Extension Downloaded

* Update defense_evasion_download_susp_extension.toml
 2023-09-27 12:37:11 -03:00
Ruben Groenewoud 6f7e419f1e [New RTA] Privesc via OverlayFS (#3003) 
* [New RTA] Privesc via OverlayFS

* Update rta/overlayfs_privesc.py

---------

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
 2023-09-27 10:45:19 +02:00
Justin Ibarra f6b6bee5c2 update transform test to fail on missing transform (#3085) 
Co-authored-by: brokensound77 <brokensound77@users.noreply.github.com>
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
 2023-09-21 13:22:39 -06:00
github-actions[bot] de2b97a492 Lock versions for releases: 8.3,8.4,8.5,8.6,8.7,8.8,8.9,8.10 (#3108) 
* Locked versions for releases: 8.3,8.4,8.5,8.6,8.7,8.8,8.9,8.10

* Update detection_rules/etc/version.lock.json

---------

Co-authored-by: terrancedejesus <terrancedejesus@users.noreply.github.com>
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
 2023-09-18 11:14:42 -04:00
Ruben Groenewoud b291317ea6 [New Rule] Network Activity Detected via cat (#3069) 
* [New Rule] Network Activity via cat

* Update command_and_control_cat_network_activity.toml

---------

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
 2023-09-18 09:51:20 +02:00
Isai 9146e0965d [New Rule] Github Repository Deleted (#3056) 
* new rule

* Update rules/integrations/github/impact_github_repository_deleted.toml

* Update rules/integrations/github/impact_github_repository_deleted.toml

updates based on review

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

---------

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
 2023-09-14 18:00:25 -04:00
Isai 904e37b732 [New Rule] GitHub Protected Branch Settings Changed (#3054) 
* new rule file

* testing query change

* query changed back

* Update rules/integrations/github/defense_evasion_github_protected_branch_settings_changed.toml

updates based on review

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

* updated integration manifests with github schema

* Update defense_evasion_github_protected_branch_settings_changed.toml

added event.dataset to query

* added timestamp_override

* changed timestamp_override to @timestamp

* changed timestamp_override

---------

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>
 2023-09-14 17:16:51 -04:00
Hilton ccfc931fbd Tunes Unusual Parent Process for cmd.exe rule to exclude oobe activity (#3091) 
* Tunes Unusual Parent Process for cmd.exe rule to exclude oobe activity

When dllhost.exe is called with the "/Processid:{CA8C87C1-929D-45BA-94DB-EF8E6CB346AD}" argument it is creating an "OOBE Elevated Object Server"  as per https://strontic.github.io/xcyclopedia/library/clsid_ca8c87c1-929d-45ba-94db-ef8e6cb346ad.html

Out of the box experience is part of the Windows autopilot and therefore should be legitimate behaviour.

* simplified detection logic by utilising process.parent.args

---------

Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>
 2023-09-13 13:51:07 -03:00
Jonhnathan 4034436f06 [Security Content] Add missing osquery transforms (#3088) 
* [Security Content] Add missing osquery transforms

* Revertable unit test

* .

* Revert "Revertable unit test"

This reverts commit 8c909fc2712b16e062890a63f31a6c080b81244a.

---------

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>
 2023-09-13 08:07:01 -03:00
Jonhnathan ddb1f75352 [New Rule] New BBR Rules - Part 2 (#3029) 
* [New Rule] New BBR Rules - Part 2

* Update discovery_generic_account_groups.toml

* Update discovery_generic_account_groups.toml

* Update rules_building_block/defense_evasion_cmd_copy_binary_contents.toml

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

* Update rules_building_block/execution_downloaded_shortcut_files.toml

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

* Update rules_building_block/defense_evasion_cmd_copy_binary_contents.toml

Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>

* Update rules_building_block/defense_evasion_unusual_process_extension.toml

Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>

* Update defense_evasion_unusual_process_extension.toml

---------

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>
 2023-09-12 21:49:22 -03:00
Jonhnathan af99186992 [New Rule] New BBR Rules - Part 3 (#3034) 
* [New Rule] New BBR Rules - Part 3

* Apply suggestions from code review

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

---------

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
 2023-09-12 21:28:01 -03:00
Ruben Groenewoud f8f3576971 [New Rule] Potential UDP Reverse Shell (#2906) 
* [New Rule] Potential UDP Reverse Shell Detected

* Title change

* Update execution_shell_via_udp_cli_utility_linux.toml

* Update execution_shell_via_udp_cli_utility_linux.toml

* Update rules/linux/execution_shell_via_udp_cli_utility_linux.toml

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

* updated non-ecs-schema to update unmapped fields

* Update rules/linux/execution_shell_via_udp_cli_utility_linux.toml

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

* Removed netcat, added destination ip list

* Update execution_shell_via_udp_cli_utility_linux.toml

* Added precautionary exclusions

* Update rules/linux/execution_shell_via_udp_cli_utility_linux.toml

* replaced schema files

* Update execution_shell_via_udp_cli_utility_linux.toml

* Update execution_shell_via_udp_cli_utility_linux.toml

* Update execution_shell_via_udp_cli_utility_linux.toml

---------

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
 2023-09-07 17:13:22 +02:00
Ruben Groenewoud 15e71ec2e8 [New Rule] Potential Meterpreter Reverse Shell (#3007) 
* [New Rule] Potential Meterpreter Reverse Shell

* Update execution_shell_via_meterpreter_linux.toml

* Update execution_shell_via_meterpreter_linux.toml

* Update rules/linux/execution_shell_via_meterpreter_linux.toml

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

---------

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>
 2023-09-07 17:04:06 +02:00
Mika Ayenson 20de1d8d1d [FR] Add support for samples in eql 0.9.18 (#3000) 2023-09-07 09:01:28 -05:00
github-actions[bot] 87af5b43ba Lock versions for releases: 8.3,8.4,8.5,8.6,8.7,8.8,8.9,8.10 (#3079) 
* Locked versions for releases: 8.3,8.4,8.5,8.6,8.7,8.8,8.9,8.10

* Update detection_rules/etc/version.lock.json

---------

Co-authored-by: terrancedejesus <terrancedejesus@users.noreply.github.com>
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
 2023-09-06 13:21:22 -04:00
Jonhnathan 3614f42b00 [New Rule] New BBR Rules - Part 5 (#3052) 
* [New Rule] New BBR Rules - Part 5

* Apply suggestions from code review

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

* Tag work

---------

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
 2023-09-05 18:36:34 -03:00
Jonhnathan 8049c96281 [New Rule] New BBR Rules - Part 1 (#3026) 
* [New Rule] New BBR Rules - Part 1

* Apply suggestions from code review

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

* Update rules_building_block/lateral_movement_at.toml

* Update rules_building_block/collection_outlook_email_archive.toml

Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>

---------

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>
 2023-09-05 18:07:47 -03:00
Jonhnathan 26c97dc241 [New Rule] Potential Masquerading as Business App Installer (#3068) 2023-09-05 17:58:34 -03:00
eric-forte-elastic 34ebcec679 Added unit test (#3038) 
* Added unit test

* removed print from unit test

* fixed linting

* Updated to put validation in init

* Updated for cleanliness

* removed Literal import
 2023-09-05 15:27:04 -04:00
Jonhnathan 4233fef238 [Security Content] Include "Data Source: Elastic Defend" tag (#3002) 
* win folder

* Other folders

* Update test_all_rules.py

* .

* updated missing elastic defend tags

---------

Co-authored-by: terrancedejesus <terrance.dejesus@elastic.co>
 2023-09-05 14:22:01 -04:00
Ruben Groenewoud 6115a68aba [Rule Tuning] Small Linux DR Tuning (#3074) 
* [Rule tuning] Adressing community issue

* Changed title

* Changed IG title
 2023-09-05 14:20:57 +02:00
Mika Ayenson 811d1b7727 label bbr rules (#3067) 2023-08-31 17:00:16 -05:00
Ruben Groenewoud 3c64b454fb [New Rule] Sus User Privilege Enumeration via id (#3049) 2023-08-31 18:13:42 +02:00
Jonhnathan fdd45148b8 [New Rule][BBR] WRITEDAC Access on Active Directory Object (#3015) 
* [New Rule] WRITEDAC Access on Active Directory Object

* Update defense_evasion_write_dac_access.toml

* Fix Setup Instructions

* Update defense_evasion_write_dac_access.toml

* Update rules_building_block/defense_evasion_write_dac_access.toml

Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>

---------

Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>
 2023-08-31 12:59:02 -03:00
Ruben Groenewoud f7d8d4752a [New Rules] GDB Secret Dumping (#3060) 
* [New Rules] GDB Secret Dumping

* Added references to BBR

* Update rules/linux/credential_access_gdb_init_memory_dump.toml

* Update rules_building_block/credential_access_gdb_memory_dump.toml

* Update rules_building_block/credential_access_gdb_memory_dump.toml

* Update rules_building_block/credential_access_gdb_memory_dump.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

---------

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
 2023-08-31 17:41:22 +02:00
Ruben Groenewoud b6ed215958 [New Rule] File Creation, Exec and Self-Deletion (#3045) 
* [New Rule] File Creation, Exec and Self-Deletion

* Update execution_file_execution_followed_by_deletion.toml

* Update execution_file_execution_followed_by_deletion.toml

* Update execution_file_execution_followed_by_deletion.toml

* Update execution_file_execution_followed_by_deletion.toml

---------

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
 2023-08-31 17:32:17 +02:00
Ruben Groenewoud 3588600d57 [Rule Tuning] 3 tunings to reduce FPs (#3058) 
* [Rule Tuning] 2 tunings to reduce FPs back to 0

* Added one more tune for community issue #3041

* Update rules/linux/execution_abnormal_process_id_file_created.toml

* Update rules/linux/execution_abnormal_process_id_file_created.toml
 2023-08-31 17:16:57 +02:00
Ruben Groenewoud 2eaaf27f1e [New Rule] Potential Disabling of AppArmor (#3046) 
* [New Rule] Potential Disabling of AppArmor

* Update rules/linux/defense_evasion_disable_apparmor_attempt.toml

* Update rules/linux/defense_evasion_disable_apparmor_attempt.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

---------

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
 2023-08-31 17:06:15 +02:00
Ruben Groenewoud 04d1c3cd5b [New BBR] Suspicious which Enumeration (#3059) 2023-08-31 13:55:56 +02:00
Ruben Groenewoud d838a3352f [New Rule] Binary Copied and/or Moved to Suspicious Directory (#3048) 
* [New Rule] Binary Copied and/or Moved to sus dir

* Update rules/linux/defense_evasion_binary_copied_to_suspicious_directory.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/linux/defense_evasion_binary_copied_to_suspicious_directory.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/linux/defense_evasion_binary_copied_to_suspicious_directory.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

---------

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
 2023-08-31 13:46:41 +02:00
Ruben Groenewoud a5b5d513af [New Rule] Potential Sudo Privilege Escalation via CVE-2019-14287 (#3057) 
* [New Rule] Sudo PE via CVE-2019-14287

* Added Elastic Defend Data Source tag

* Update rules/linux/privilege_escalation_sudo_cve_2019_14287.toml

* Update rules/linux/privilege_escalation_sudo_cve_2019_14287.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

---------

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
 2023-08-31 13:11:34 +02:00
Jonhnathan c89b722a34 [New Rule] Suspicious Communication App Child Process (#2998) 
* [New Rule] Suspicious Communication App Child Process

* Update defense_evasion_communication_apps_suspicious_child_process.toml

* Update rules_building_block/defense_evasion_communication_apps_suspicious_child_process.toml

---------

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
 2023-08-31 07:33:16 -03:00
Ruben Groenewoud a395f54054 [New Rules] sus program compilation activity (#3043) 2023-08-31 09:30:56 +02:00
Jonhnathan a7a22a0917 [New Rule] Potential Masquerading as VLC DLL (#3006) 
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
 2023-08-30 17:45:45 -03:00
Ruben Groenewoud 32abdb95f7 [New Rules] Linux Tunneling and Port Forwarding (#3028) 
* Removed iodine rule due to new tunneling rule

* [New Rules] Linux Tunneling and Port Forwarding

* added ash

* Fixed description styling

* Changed rule name

* Update command_and_control_linux_suspicious_proxychains_activity.toml

* Added deprecation note & name change

* Changed deprecation status

* Removed deprecation date

* Fixed unit testing

* Update rules_building_block/command_and_control_linux_ssh_x11_forwarding.toml

---------

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
 2023-08-30 22:12:19 +02:00
Eric 41a7a36817 Tune rule for new DLL written to Windows Servicing (#3062) 2023-08-30 13:51:23 -03:00
Jonhnathan 6d7df50d78 [New Rule] Suspicious WMI Event Subscription Created (#1860) 
* Suspicious WMI Event Subscription Initial rule

* Use EQL sequence

* Update non-ecs-schema

* Update persistence_sysmon_wmi_event_subscription.toml

* update description

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

* update query too look for even code 21 only

* update to case sensitive compare

* Update rules/windows/persistence_sysmon_wmi_event_subscription.toml

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

* Update persistence_sysmon_wmi_event_subscription.toml

* Update non-ecs-schema.json

* Update rules/windows/persistence_sysmon_wmi_event_subscription.toml

* Update non-ecs-schema.json

* Update persistence_sysmon_wmi_event_subscription.toml

---------

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
 2023-08-29 16:42:19 -03:00
Jonhnathan 7004c99ef5 [New Rule] Unusual Process For MSSQL Service Accounts (#3040) 
* [New Rule] Unusual Process For MSSQL Service Accounts

* Update initial_access_unusual_process_sql_accounts.toml

* Update initial_access_unusual_process_sql_accounts.toml

* Update collection_archive_data_zip_imageload.toml

* Update persistence_via_xp_cmdshell_mssql_stored_procedure.toml

* Update initial_access_unusual_process_sql_accounts.toml

* Update rules_building_block/initial_access_unusual_process_sql_accounts.toml

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

* Update persistence_via_xp_cmdshell_mssql_stored_procedure.toml

added   "vpnbridge.exe", "certutil.exe" and "bitsadmin.exe" to rule scope.

* Update persistence_via_xp_cmdshell_mssql_stored_procedure.toml

---------

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
 2023-08-29 09:10:25 -03:00
Jonhnathan 0e337e2c36 [New Rule] New BBR Rules - Part 4 (#3035) 
* [New Rule] New BBR Rules - Part 4

* Apply suggestions from code review

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

---------

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
 2023-08-29 08:49:22 -03:00
Jonhnathan 9f213cc9f7 [New Rule] Potential Masquerading as Browser Process (#2995) 
* [New Rule] Potential Masquerading as Browser Process

* Update rules_building_block/defense_evasion_masquerading_browsers.toml

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

* Update defense_evasion_masquerading_browsers.toml

---------

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
 2023-08-28 13:28:26 -03:00
Samirbous 22931d6afb Update credential_access_lsass_openprocess_api.toml (#3047) 2023-08-28 16:22:08 +01:00
Jonhnathan 7496c5cb68 [New Rule] Potential Masquerading as Windows System32 DLL (#3021) 
* [New Rule] Potential Masquerading as Windows System32 DLL

* Update rules_building_block/defense_evasion_masquerading_windows_dll.toml

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

* Update rules_building_block/defense_evasion_masquerading_windows_dll.toml

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

* Restrict logic

* Update defense_evasion_masquerading_windows_dll.toml

---------

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
 2023-08-28 08:31:20 -03:00
Jonhnathan ffa60f2d03 [New Rule] Network-Level Authentication (NLA) Disabled (#3039) 
* [New Rule] Network-Level Authentication (NLA) Disabled

* Apply suggestions from code review

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

---------

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
 2023-08-28 08:05:21 -03:00
Jonhnathan de32287889 [Rule Tuning] High Number of Process and/or Service Terminations (#2940) 2023-08-25 19:19:25 -03:00
shashank-elastic d21ed24e4f BBR Rules Addition (#3027) 2023-08-25 19:10:12 +05:30
Ruben Groenewoud a1716bd673 [Rule Tuning] Several rule tunings (#3024) 
* [Rule Tuning] Several rule tunings

* Added 1 more

* optimized ransomware encryption rules

* Update rules/linux/impact_potential_linux_ransomware_file_encryption.toml

* Update rules/linux/impact_potential_linux_ransomware_note_detected.toml

* Added 2 more tunings based on todays telemetry

* Some tunings

* Tuning

* Tuning

* fixed user.id comparison

* Something went wrong with deprecation

* Something went wrong with deprecation

* Update rules/linux/impact_potential_linux_ransomware_file_encryption.toml

* Update rules/linux/discovery_linux_nping_activity.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/linux/discovery_linux_hping_activity.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Dedeprecated the rule to deprecate later

---------

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
 2023-08-25 14:03:29 +02:00