3 Commits

Author	SHA1	Message	Date
Jonhnathan	4233fef238	[Security Content] Include "Data Source: Elastic Defend" tag (#3002) ... * win folder * Other folders * Update test_all_rules.py * . * updated missing elastic defend tags --------- Co-authored-by: terrancedejesus <terrance.dejesus@elastic.co>	2023-09-05 14:22:01 -04:00
Ruben Groenewoud	3588600d57	[Rule Tuning] 3 tunings to reduce FPs (#3058) ... * [Rule Tuning] 2 tunings to reduce FPs back to 0 * Added one more tune for community issue #3041 * Update rules/linux/execution_abnormal_process_id_file_created.toml * Update rules/linux/execution_abnormal_process_id_file_created.toml	2023-08-31 17:16:57 +02:00
Ruben Groenewoud	4bcec3397c	[New Rule] Potential Suspicious DebugFS Root Device Access (#2982) ... * [New Rule] Potential DebugFS Privilege Escalation * Changed rule name * Update rules/linux/privilege_escalation_sda_disk_mount_non_root.toml --------- Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>	2023-08-03 16:13:34 +02:00