security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
3,571 Commits 1 Branch 0 Tags
ec791fa67a4e597ef5013fbd2972508fc522ec4d
Commit Graph

7 Commits

Author SHA1 Message Date
Mika Ayenson, PhD 8993d1450b [Rule Tuning] Add Supplemental Mitre Mappings (#5876) 
---------

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>
Co-authored-by: terrancedejesus <terrance.dejesus@elastic.co>
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
Co-authored-by: eric-forte-elastic <eric.forte@elastic.co>
 2026-04-01 09:12:42 -05:00
Ruben Groenewoud 440ff43810 [Rule Tuning] Adding D4C Compatibility to Compatible Container-Related Rules (#5685) 
* Updated kubernetes.audit.requestObject.spec.containers.image type of text to Keyword

* [Rule Tuning] Adding D4C Compatibility to Compatible Container-Related Rules
 2026-02-06 09:38:56 +01:00
Mika Ayenson, PhD bbe83452b4 Revert "[Rule Tuning] Adding D4C Compatibility to Compatible K8s-related Rules (#5578)" (#5620) 
This reverts commit c608b673bf.
 2026-01-26 08:31:53 -06:00
Ruben Groenewoud c608b673bf [Rule Tuning] Adding D4C Compatibility to Compatible K8s-related Rules (#5578) 
* [Rule Tuning] Adding D4C Compatibility to Compatible K8s-related Rules

* Update manifests & schemas

* [New/Updated] Migrated `process.command_line` --> `process.args` for Compatibility

* Pyproject.toml Patch

* ++
 2026-01-26 13:28:08 +01:00
Ruben Groenewoud a973da1a6b [Rule Tuning] Linux DR Tuning - 9 (#5508) 
* [Rule Tuning] Linux DR Tuning - 9

* Update rules/linux/persistence_apt_package_manager_file_creation.toml

* Fix formatting in persistence_boot_file_copy.toml

* Update persistence_chkconfig_service_add.toml

* Change user.id values to string format in TOML

* Fix condition for Java process working directory

* Fix logical operator in OpenSSL passwd hash rule

* Fix syntax for working_directory check

* Fix condition for original file name check

* Update persistence_web_server_unusual_command_execution.toml

* Add cloud CLI tools to persistence rules

---------

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
 2026-01-07 16:18:38 +01:00
shashank-elastic 7175b3ab06 Add investigation guides for detection rules (#4886) 2025-07-08 00:25:42 +05:30
Ruben Groenewoud 3efcd70f8c [New Rule] Kubernetes Sensitive Configuration File Activity (#4849) 
* [New Rule] Kubernetes Sensitive Configuration File Activity

* Update rules/linux/persistence_kubernetes_sensitive_file_activity.toml
 2025-07-02 17:16:25 +02:00