sigma-rules

Author	SHA1	Message	Date
Mika Ayenson, PhD	8993d1450b	[Rule Tuning] Add Supplemental Mitre Mappings (#5876 ) --------- Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> Co-authored-by: Isai <59296946+imays11@users.noreply.github.com> Co-authored-by: terrancedejesus <terrance.dejesus@elastic.co> Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> Co-authored-by: eric-forte-elastic <eric.forte@elastic.co>	2026-04-01 09:12:42 -05:00
Ruben Groenewoud	aaf99b1873	[Rule Tuning] `agent.id` --> `host.id` `new_terms` Key Modification (#5802 ) * [Rule Tuning] `agent.id` --> `host.id` Migration * Updated_date bump	2026-03-02 13:24:25 +01:00
Ruben Groenewoud	a973da1a6b	[Rule Tuning] Linux DR Tuning - 9 (#5508 ) * [Rule Tuning] Linux DR Tuning - 9 * Update rules/linux/persistence_apt_package_manager_file_creation.toml * Fix formatting in persistence_boot_file_copy.toml * Update persistence_chkconfig_service_add.toml * Change user.id values to string format in TOML * Fix condition for Java process working directory * Fix logical operator in OpenSSL passwd hash rule * Fix syntax for working_directory check * Fix condition for original file name check * Update persistence_web_server_unusual_command_execution.toml * Add cloud CLI tools to persistence rules --------- Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>	2026-01-07 16:18:38 +01:00
Mika Ayenson	fe8c81d762	[FR] Generate investigation guides (#4358 )	2025-01-22 11:17:38 -06:00
Ruben Groenewoud	d16f56b4e2	[New Rule] SSH via Backdoored System User (#4336 ) * [New Rule] SSH via Backdoored System User * ++ * Update persistence_ssh_via_backdoored_system_user.toml * Update persistence_ssh_via_backdoored_system_user.toml * Update rules/linux/persistence_ssh_via_backdoored_system_user.toml Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com> * Update rules/linux/persistence_ssh_via_backdoored_system_user.toml Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com> --------- Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>	2025-01-07 13:20:36 +01:00

5 Commits