-
afbca3ee75
Lock versions for releases: 8.10,8.11,8.12,8.13,8.14,8.15 (#4147)
github-actions[bot]
2024-10-09 20:56:57 -05:00
-
06319b7a13
[Rule Tuning] Add KEEP Command to all ES|QL Rules (#4146)
Terrance DeJesus
2024-10-09 21:08:38 -04:00
-
4edef2ea80
[FR][DAC] Import Rules Verbose Message (#4093)
Eric Forte
2024-10-09 17:19:59 -04:00
-
281926052c
[Rule Tuning] Add
METADATA checks for non-aggregate ES|QL queries and fix existing (#4126)
Terrance DeJesus
2024-10-09 15:25:36 -04:00
-
7674229f49
[New Rule]
Successful Application SSO from Rare Unknown Client Device (#4141)
Terrance DeJesus
2024-10-07 12:11:57 -04:00
-
50e23ba242
[Hunting] Re-factor Hunting Library Code (#4085)
Terrance DeJesus
2024-10-03 12:47:40 -04:00
-
45a347580c
[Rule Tuning] Fixing Incorrect ES|QL Operator Use - AWS Service Quotas Multi-Region
GetServiceQuota Request (#4118)
Terrance DeJesus
2024-10-02 15:50:22 -04:00
-
51859e57f3
Sync RTA Base64 or Xxd Decode Argument Evasion (#4113)
protections machine
2024-10-02 03:40:34 +10:00
-
e6646790d5
Sync RTA Suspicious Echo Execution (#4110)
protections machine
2024-10-02 03:27:13 +10:00
-
264938236c
Sync RTA Hexadecimal Payload Execution (#4109)
protections machine
2024-10-02 03:17:04 +10:00
-
9e539e82f4
Sync RTA Potential Process Injection via dd (#4108)
protections machine
2024-10-02 03:06:56 +10:00
-
37ba89bc3e
Sync RTA Linux Telegram API Request (#4107)
protections machine
2024-10-02 02:58:29 +10:00
-
80143b23b2
Lock versions for releases: 8.10,8.11,8.12,8.13,8.14,8.15 (#4116)
github-actions[bot]
2024-10-01 18:14:03 +05:30
-
a68a404bd8
Update defense_evasion_posh_assembly_load.toml (#4112)
Samirbous
2024-10-01 13:00:38 +01:00
-
5b41bbd5e9
[Tuning] Updated references (#4114)
Ruben Groenewoud
2024-10-01 13:43:14 +02:00
-
ef4e433d97
[Rule Tuning] Ignore "Not Available" in
o365.audit.UserId for Microsoft 365 Rules (#4105)
Terrance DeJesus
2024-09-28 18:13:03 -04:00
-
1d1b2eb90f
Update command_and_control_tunnel_vscode.toml (#4104)
Samirbous
2024-09-28 11:46:46 +01:00
-
ef95a541f4
Fix GenAI Request Model ID Field (#4111)
shashank-elastic
2024-09-27 21:59:02 +05:30
-
a3e89a7fab
[New Rules] CVE-2024-x.x.x.x.x (CUPS/Foomatic-RIP RCE) (#4106)
Ruben Groenewoud
2024-09-27 14:48:03 +02:00
-
b80d8342d6
[Docs | Rule Tuning] Add blog references to rules (#4097)
Mika Ayenson
2024-09-25 15:19:20 -05:00
-
0ed6b3f0a2
[Rule Tuning] AWS STS GetCallerIdentity API Called for the First Time (#4094)
Isai
2024-09-24 09:32:12 -04:00
-
fab842b414
Update ATT&CK coverage URL(s) in docs/ATT&CK-coverage.md (#4091)
github-actions[bot]
2024-09-19 23:25:32 +05:30
-
e2f1fcefa8
Add flag to update the docs/ATT&CK-coverage.md with markdown URL(s) (#4077)
shashank-elastic
2024-09-19 23:12:01 +05:30
-
5e0fb4a63e
[Tuning] Add logs-panw.panos index to Network rules (#4089)
Samirbous
2024-09-19 08:01:44 +01:00
-
df31c002ca
[Bug] Handle formatting empty list (#4086)
Mika Ayenson
2024-09-17 13:25:17 -05:00
-
def2a9ef09
[New] ROT encoded Python Script Execution (#4084)
Samirbous
2024-09-17 16:52:46 +01:00
-
9181c00586
[New Hunt] Add Initial Okta Hunting Queries (#4064)
Terrance DeJesus
2024-09-16 14:36:44 -04:00
-
574064272d
Lock versions for releases: 8.10,8.11,8.12,8.13,8.14,8.15 (#4082)
github-actions[bot]
2024-09-16 21:43:16 +05:30
-
814130bf34
min_stack New Rules that use the S1 Integration (#4081)
shashank-elastic
2024-09-16 20:12:09 +05:30
-
7c78e4081f
[Rule Tuning] min_stack New Rules that use the S1 Integration (#4079)
Jonhnathan
2024-09-16 11:02:46 -03:00
-
31ca246ea7
[New] Potential Foxmail Exploitation (#4044)
Samirbous
2024-09-16 12:29:40 +01:00
-
41a7a5f049
[New] Execution via Windows Command Debugging Utility (#3918)
Samirbous
2024-09-16 09:14:39 +01:00
-
f26d7fc81b
[New] Persistence via a Windows Installer (#4055)
Samirbous
2024-09-16 07:50:57 +01:00
-
b60b6e2af3
[New] Attempt to establish VScode Remote Tunnel (#4061)
Samirbous
2024-09-16 07:39:39 +01:00
-
3a3400c8e5
[New] MsiExec Service Child Process With Network Connection (#4062)
Samirbous
2024-09-15 20:22:44 +01:00
-
56fc2beb46
[New] Suspicious PowerShell Execution via Windows Scripts (#4060)
Samirbous
2024-09-15 19:51:21 +01:00
-
b6162abefa
[New] WPS Office Exploitation via DLL Hijack (#4043)
Samirbous
2024-09-15 11:23:35 +01:00
-
9255dafe53
[New] Detonate LNK TOP Rules (#4058)
Samirbous
2024-09-15 10:49:17 +01:00
-
bb9a772870
[New Rule] Okta Public Client App OAuth Token Request with Client Credentials (#4074)
Terrance DeJesus
2024-09-13 14:57:49 -04:00
-
cad3865fcf
[New] Potential Escalation via Vulnerable MSI Repair - CVE-2024-38014 (#4076)
Samirbous
2024-09-13 17:57:44 +01:00
-
c3160b9279
[New Rule] PowerShell Script with Windows Defender Tampering Capabilities (#4075)
Jonhnathan
2024-09-13 11:51:19 -03:00
-
eda179bbe1
Skip Development Rules from Security Docs (#4073)
shashank-elastic
2024-09-13 19:57:00 +05:30
-
3e25ea8c2b
[New Rule] AWS Bedrock Detections (#4072)
shashank-elastic
2024-09-13 19:46:47 +05:30
-
df1f0bc98e
[New Rule] Add Jamf Protect detection rules (#4047)
Thijs Xhaflaire
2024-09-12 22:03:56 +02:00
-
29051c2e33
[New Rule] Cross Platform: AWS
SendCommand API Call with Run Shell Command Parameters (#4052)
Terrance DeJesus
2024-09-11 13:40:25 -04:00
-
8618b1ad73
Support toml lint for investigate transforms (#4066)
shashank-elastic
2024-09-11 20:45:36 +05:30
-
127a56aede
[Rule Tuning] Remote Execution via File Shares (#4067)
Jonhnathan
2024-09-11 10:49:41 -03:00
-
a8dd78d834
Sync RTA Hidden Executable Initiated Egress Network Connection (#4070)
protections machine
2024-09-11 22:57:18 +10:00
-
4cab0e7d04
Sync RTA Socat Reverse Shell or Listener Activity (#4071)
protections machine
2024-09-11 22:44:29 +10:00
-
6a76bbb8d2
Sync RTA Potential Persistence via Direct Crontab Modification (#4069)
protections machine
2024-09-11 22:14:37 +10:00
-
09a6803804
Sync RTA Kill Command Executed from Binary in Unusual Location (#4068)
protections machine
2024-09-11 22:00:07 +10:00
-
dc9c58527f
[Tuning] Unusual Network Activity from a Windows System Binary (#4065)
Samirbous
2024-09-10 17:30:56 +01:00
-
8d27b6069b
[Rule Tuning] M365/Azure Brute-Forcing New Rule and Tuning; Deprecate Similar Rule (#4057)
Terrance DeJesus
2024-09-10 11:26:40 -04:00
-
0a08f5e677
[New Rule] New Microsoft 365 Impossible Travel Rules and Deprecation (#4054)
Terrance DeJesus
2024-09-05 17:36:56 -04:00
-
e30dc312e4
[Tuning] Potential Execution via XZBackdoor (#4053)
Samirbous
2024-09-05 20:13:32 +01:00
-
be611be8b3
[New Rule] Instance Metadata Service (IMDS) API Requests - Linux (#4005)
Terrance DeJesus
2024-09-05 10:08:32 -04:00
-
ba58a1e7cc
[New Hunt] Add AWS Hunting Queries to Shared Hunting Library (#3988)
Terrance DeJesus
2024-09-04 10:08:44 -04:00
-
9f964b68a4
[New Rule] Root Certificate Installation (#4025)
Ruben Groenewoud
2024-09-03 17:40:17 +02:00
-
6a1ba19f7c
Lock versions for releases: 8.10,8.11,8.12,8.13,8.14,8.15 (#4050)
github-actions[bot]
2024-09-03 17:40:44 +05:30
-
a53f7d55a3
Testcase to check if Rule Type: BBR tag is present for all BBR rules (#4048)
shashank-elastic
2024-09-02 21:29:31 +05:30
-
b3a75899d5
[New Rule] SELinux Configuration Creation or Modification (#4024)
Ruben Groenewoud
2024-09-01 10:14:59 +02:00
-
162b4e7be8
[New Rule] Access Control List Modification via setfacl (#4009)
Ruben Groenewoud
2024-09-01 09:58:50 +02:00
-
fb07033159
[New Rule] Attempt to Disable Auditd Service (#4028)
Ruben Groenewoud
2024-09-01 09:51:13 +02:00
-
30cd1b6a00
[New Rule] Potential Defense Evasion via Doas (#4027)
Ruben Groenewoud
2024-08-29 21:19:13 +02:00
-
19b4a4d7dd
[New Rule] SSL Certificate Deletion (#4026)
Ruben Groenewoud
2024-08-29 21:10:59 +02:00
-
1ff26cf53e
[New Rule] New Rules AWS Multi-Region Discovery of EC2 Instances and Quotas (#4015)
Terrance DeJesus
2024-08-28 13:42:32 -04:00
-
3e831b82c3
Update credential_access_suspicious_web_browser_sensitive_file_access.toml (#4029)
Samirbous
2024-08-28 16:33:44 +01:00
-
0c38662cf3
[FR] [DAC] Add Support for Known Types to Auto-generated Schemas (#3985)
Eric Forte
2024-08-28 10:48:00 -04:00
-
f7b7a04d53
[FR] Add Better Error Handling for CUSTOM_RULES_DIR (#3990)
Eric Forte
2024-08-28 10:30:45 -04:00
-
6aaccc64a6
[New Rule] AWS CLI Command with Custom Endpoint URL (#4002)
Terrance DeJesus
2024-08-28 09:58:08 -04:00
-
e60c21b37b
[Rule Tuning] Enumeration of Privileged Local Groups Membership (#4016)
Jonhnathan
2024-08-27 09:54:19 -03:00
-
cb739fb161
Sync RTA Linux Production Tuning (#4014)
protections machine
2024-08-27 04:27:42 +10:00
-
ba76c20b3d
Update import rules to repo help text. (#4013)
Eric Forte
2024-08-26 10:20:32 -04:00
-
70c3a6f7b1
[Rule Tuning] Potential privilege escalation via CVE-2022-38028 (#4004)
Jonhnathan
2024-08-22 15:32:28 -03:00
-
162a48c97f
[New Rule] Openssl Client or Server Activity (#3930)
Ruben Groenewoud
2024-08-22 16:53:31 +02:00
-
dfbf86e853
Update ProblemChild detection rules with High and Low probability (#4000)
Kirti Sodhi
2024-08-22 09:17:41 -04:00
-
b6b6f6b482
[New Rule] First Occurrence AWS STS Temporary Credential Request by User (#3991)
Terrance DeJesus
2024-08-21 20:17:10 -04:00
-
5493165440
[New Rule] AWS Signin Single Factor Console Login via Federated Session (#3992)
Terrance DeJesus
2024-08-21 18:19:54 -04:00
-
589aa33508
[Bug] Add historical Rules as Default when Build Package (#4003)
Eric Forte
2024-08-21 18:00:02 -04:00
-
c77356c0f2
Refresh Integration Manifest and Schema (#4001)
shashank-elastic
2024-08-21 22:24:05 +05:30
-
fbe47298cf
Lock versions for releases: 8.10,8.11,8.12,8.13,8.14,8.15 (#3997)
august_updates
github-actions[bot]
2024-08-20 23:46:25 +05:30
-
0c25cfb82e
Remove unused @click.pass_context (#3996)
shashank-elastic
2024-08-20 23:11:22 +05:30
-
760d9f6398
Lock versions for releases: 8.10,8.11,8.12,8.13,8.14,8.15 (#3995)
github-actions[bot]
2024-08-20 21:32:43 +05:30
-
2559b7bb41
[Rule Tuning] Tuning AWS Rules for SAML Provider Updates and Assumed Roles via STS (#3898)
Terrance DeJesus
2024-08-20 11:53:46 -04:00
-
d3dc231315
Refresh ECS, Beats manifest and schemas (#3993)
shashank-elastic
2024-08-20 20:45:20 +05:30
-
10ba6ad5a6
[FR] Add Alert Suppression for Addtional Rule Types (#3986)
Mika Ayenson
2024-08-15 15:03:45 -05:00
-
4c44f98cd6
[Rule Tuning] LSASS Process Access via Windows API (#3975)
Jonhnathan
2024-08-14 11:42:18 -03:00
-
400b4dbd23
[Bug] [DAC] Fix Kibana action connector export to export details with action connectors (#3984)
Eric Forte
2024-08-13 14:28:17 -04:00
-
3500c3db15
[Rule Tuning] Tuning
Direct Outbound SMB Connection (#3485)
Terrance DeJesus
2024-08-13 13:53:07 -04:00
-
74d8186aeb
[Rule Tuning] Tuning
MsBuild Making Network Connections (#3482)
Terrance DeJesus
2024-08-13 12:55:08 -04:00
-
f4c6939987
Fix Attribute Issue in RTA common.py (#3983)
shashank-elastic
2024-08-13 21:32:45 +05:30
-
b0fd8659a2
Fix Windows Path for file (#3981)
shashank-elastic
2024-08-13 20:46:28 +05:30
-
d0597e4260
Create Nested Directories (#3980)
Eric Forte
2024-08-13 09:40:49 -04:00
-
e607d521b8
Add Unit Test test_index_or_data_view_id_present (#3967)
shashank-elastic
2024-08-12 17:48:05 +05:30
-
c58ae92dd1
[New Rule] Dynamic Linker Creation or Modification (#3969)
Ruben Groenewoud
2024-08-10 10:25:55 +02:00
-
55e81c1169
[Rule Tuning] Attempt to Disable IPTables or Firewall (#3972)
Ruben Groenewoud
2024-08-10 10:18:11 +02:00
-
b6ffb10ab2
[Rule Tuning] System Log File Deletion (#3970)
Ruben Groenewoud
2024-08-10 10:04:56 +02:00
-
6e3e5f6373
[Rule Tuning] Potential Disabling of AppArmor (#3971)
Ruben Groenewoud
2024-08-10 09:51:45 +02:00
-
8950d33539
[Rule Tuning] Suspicious PrintSpooler Service Executable File Creation (#3964)
Jonhnathan
2024-08-09 13:23:16 -03:00
-
20f4242566
[Rule Tuning] Simple KQL to EQL Conversion (#3948)
Jonhnathan
2024-08-09 13:11:27 -03:00