sigma-rules

Author	SHA1	Message	Date
Mika Ayenson, PhD	8993d1450b	[Rule Tuning] Add Supplemental Mitre Mappings (#5876 ) --------- Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> Co-authored-by: Isai <59296946+imays11@users.noreply.github.com> Co-authored-by: terrancedejesus <terrance.dejesus@elastic.co> Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> Co-authored-by: eric-forte-elastic <eric.forte@elastic.co>	2026-04-01 09:12:42 -05:00
Ruben Groenewoud	d968f62a5a	[Rule Tuning] Linux DR Tuning - 10 (#5510 ) * [Rule Tuning] Linux DR Tuning - 10 * Update persistence_udev_rule_creation.toml * Refactor ESQL query for Linux process events * Refactor query in persistence_web_server_sus_command_execution rule Removed unnecessary fields from the query and added new fields for event dataset and data stream namespace. * Update persistence_systemd_netcon.toml * Update persistence_web_server_sus_child_spawned.toml * Refactor process.parent.name conditions in TOML file * Update persistence_web_server_unusual_command_execution.toml * Update persistence_web_server_unusual_command_execution.toml --------- Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>	2026-01-08 09:32:57 +01:00
shashank-elastic	7175b3ab06	Add investigation guides for detection rules (#4886 )	2025-07-08 00:25:42 +05:30
Ruben Groenewoud	3a601a10fb	[New Rule] Unusual Exim4 Child Process (#4684 )	2025-05-06 22:24:34 +05:30