-
8dc0963ae6
[Rule Tuning] LSASS Process Access via Windows API (#3824)
Joe Desimone
2024-07-04 16:45:46 -04:00
-
5dcdb368f0
[New Rule] Potential PowerShell Obfuscated Script (#3864)
Jonhnathan
2024-07-04 09:26:32 -03:00
-
208e330b44
[New Rule] Potential PowerShell Obfuscated Script (#3864)
Jonhnathan
2024-07-04 09:26:32 -03:00
-
e027efeb53
[Rule Tuning] Suspicious Inter-Process Communication via Outlook #3803 (#3806)
ar3diu
2024-07-03 17:39:15 +03:00
-
5048bc26bd
[Rule Tuning] Suspicious Inter-Process Communication via Outlook #3803 (#3806)
ar3diu
2024-07-03 17:39:15 +03:00
-
617991db0b
Test case to check updated_date (#3818)
shashank-elastic
2024-07-03 19:17:27 +05:30
-
50f0fb3518
Test case to check updated_date (#3818)
shashank-elastic
2024-07-03 19:17:27 +05:30
-
e36686570f
[New Rule] AWS RDS DB Instance Made Public (#3836)
Isai
2024-07-03 01:01:52 -04:00
-
83be212632
[New Rule] AWS RDS DB Instance Made Public (#3836)
Isai
2024-07-03 01:01:52 -04:00
-
85f949539c
[New Rule] AWS RDS DB Instance or Cluster Deletion Protection Disabled (#3851)
Isai
2024-07-02 17:22:03 -04:00
-
3a5c5c20a8
[New Rule] AWS RDS DB Instance or Cluster Deletion Protection Disabled (#3851)
Isai
2024-07-02 17:22:03 -04:00
-
634a3f50d5
[New Rule] AWS RDS DB Instance or Cluster Password Modified (#3844)
Isai
2024-07-02 16:14:51 -04:00
-
9f4956f542
[New Rule] AWS RDS DB Instance or Cluster Password Modified (#3844)
Isai
2024-07-02 16:14:51 -04:00
-
8e9f3659ed
[New Rule] AWS RDS Snapshot Shared with Another Account (#3831)
Isai
2024-07-02 15:36:44 -04:00
-
43fbf94d8a
[New Rule] AWS RDS Snapshot Shared with Another Account (#3831)
Isai
2024-07-02 15:36:44 -04:00
-
594b8a1574
[New Rule] AWS RDS Snapshot Deleted (#3852)
Isai
2024-07-02 14:01:15 -04:00
-
aaf014390b
[New Rule] AWS RDS Snapshot Deleted (#3852)
Isai
2024-07-02 14:01:15 -04:00
-
d59d462956
[Rule Tuning] Potential AWS S3 Bucket Ransomware Note Uploaded (#3854)
Terrance DeJesus
2024-07-02 13:02:52 -04:00
-
5ec1428de6
Create an Issue in Kibana for MITRE Updates (#3796)
shashank-elastic
2024-07-02 18:57:41 +05:30
-
30ffe00012
Create an Issue in Kibana for MITRE Updates (#3796)
shashank-elastic
2024-07-02 18:57:41 +05:30
-
6fb82a87e4
[Rule Tuning] Tuning Google Workspace Rules and File Name Length Reduction (#3849)
Terrance DeJesus
2024-07-01 15:50:12 -04:00
-
5fe7833312
[Rule Tuning] Tuning Google Workspace Rules and File Name Length Reduction (#3849)
Terrance DeJesus
2024-07-01 15:50:12 -04:00
-
c4caabfe07
[Rule Tuning] Unusual File Creation - Alternate Data Stream (#3848)
Jonhnathan
2024-07-01 13:45:19 -03:00
-
d5c34b5750
[Rule Tuning] Unusual File Creation - Alternate Data Stream (#3848)
Jonhnathan
2024-07-01 13:45:19 -03:00
-
0b808211f6
[New Rule] Entra ID Device Code Auth with Broker Client (#3819)
Terrance DeJesus
2024-07-01 10:31:26 -04:00
-
99a4d629c9
[New Rule] Entra ID Device Code Auth with Broker Client (#3819)
Terrance DeJesus
2024-07-01 10:31:26 -04:00
-
b671293b6b
[Rule Tuning] Improve Compatibility in WIndows BBR Detection Rules (#3841)
Jonhnathan
2024-07-01 10:41:00 -03:00
-
125084ceec
[Rule Tuning] Improve Compatibility in WIndows BBR Detection Rules (#3841)
Jonhnathan
2024-07-01 10:41:00 -03:00
-
d47d87386c
[Rule Tuning] AWS RDS Snapshot Restored (#3809)
Isai
2024-06-28 20:42:36 -04:00
-
f62644887e
[Rule Tuning] AWS RDS Snapshot Restored (#3809)
Isai
2024-06-28 20:42:36 -04:00
-
28f67e3ace
Generate Better Index Keys (#3826)
shashank-elastic
2024-06-28 23:18:09 +05:30
-
949ceccc0f
Generate Better Index Keys (#3826)
shashank-elastic
2024-06-28 23:18:09 +05:30
-
408442e185
[Rule Tuning] Multiple Device Token Hashes for Single Okta Session (#3814)
Terrance DeJesus
2024-06-28 12:59:24 -04:00
-
2e3aca62f0
[Rule Tuning] Multiple Device Token Hashes for Single Okta Session (#3814)
Terrance DeJesus
2024-06-28 12:59:24 -04:00
-
a1b34e0211
Lock versions for releases: 8.9,8.10,8.11,8.12,8.13,8.14 (#3845)
integration-v8.11.20
github-actions[bot]
2024-06-28 17:49:18 +05:30
-
aef9fe8ec4
Lock versions for releases: 8.9,8.10,8.11,8.12,8.13,8.14 (#3845)
github-actions[bot]
2024-06-28 17:49:18 +05:30
-
2133e1f1a3
[FR] Limit historical rules to the latest 2 (#3842)
Mika Ayenson
2024-06-28 06:42:10 -05:00
-
357204e1c5
[FR] Limit historical rules to the latest 2 (#3842)
Mika Ayenson
2024-06-28 06:42:10 -05:00
-
c46e92791f
[New Rules] Git Hook Execution/File Creation (#3832)
Ruben Groenewoud
2024-06-28 11:34:32 +02:00
-
b311d49c2a
[New Rules] Git Hook Execution/File Creation (#3832)
Ruben Groenewoud
2024-06-28 11:34:32 +02:00
-
1c404b7861
[New Rule] DNF Package Manager Plugin File Creation (#3822)
Ruben Groenewoud
2024-06-28 11:14:48 +02:00
-
f33c25b118
[New Rule] DNF Package Manager Plugin File Creation (#3822)
Ruben Groenewoud
2024-06-28 11:14:48 +02:00
-
1dad651fcc
[New Rules] rc.local Execution Rules (#3813)
Ruben Groenewoud
2024-06-28 09:59:26 +02:00
-
edc501accf
[New Rules] rc.local Execution Rules (#3813)
Ruben Groenewoud
2024-06-28 09:59:26 +02:00
-
96060d50fa
Update defense_evasion_microsoft_defender_tampering.toml (#3840)
Samirbous
2024-06-28 08:16:11 +01:00
-
b97069c3e9
Update defense_evasion_microsoft_defender_tampering.toml (#3840)
Samirbous
2024-06-28 08:16:11 +01:00
-
a3eae479ff
[New BBR] AWS RDS DB Snapshot Created (#3828)
Isai
2024-06-27 23:59:33 -04:00
-
a8ce53f82f
[New BBR] AWS RDS DB Snapshot Created (#3828)
Isai
2024-06-27 23:59:33 -04:00
-
733c138b18
[New Rule & Tuning] Systemd Generator Created (#3801)
Ruben Groenewoud
2024-06-27 22:00:48 +02:00
-
cd4fe07c2c
[New Rule & Tuning] Systemd Generator Created (#3801)
Ruben Groenewoud
2024-06-27 22:00:48 +02:00
-
4b88408acf
[Rule Tuning] rc.local/rc.common File Creation (#3805)
Ruben Groenewoud
2024-06-27 21:50:49 +02:00
-
e941645b2f
[Rule Tuning] rc.local/rc.common File Creation (#3805)
Ruben Groenewoud
2024-06-27 21:50:49 +02:00
-
2f292dacb4
[Rule Tuning] System V Init Script Created (#3811)
Ruben Groenewoud
2024-06-27 21:38:34 +02:00
-
68bf4e453e
[Rule Tuning] System V Init Script Created (#3811)
Ruben Groenewoud
2024-06-27 21:38:34 +02:00
-
efd192d5f6
[Rule Tuning] Executable Bit Set for Potential Persistence Script (#3812)
Ruben Groenewoud
2024-06-27 21:29:30 +02:00
-
460b314f49
[Rule Tuning] Executable Bit Set for Potential Persistence Script (#3812)
Ruben Groenewoud
2024-06-27 21:29:30 +02:00
-
9193e4e9ff
Trim codeowners (#3829)
Justin Ibarra
2024-06-27 11:36:58 -07:00
-
74dd230e2d
Trim codeowners (#3829)
Justin Ibarra
2024-06-27 11:36:58 -07:00
-
61be78d1f6
[Rule Tuning] LSASS Process Access via Windows API (#3839)
Jonhnathan
2024-06-27 12:22:13 -03:00
-
7693d785aa
[Rule Tuning] LSASS Process Access via Windows API (#3839)
Jonhnathan
2024-06-27 12:22:13 -03:00
-
2bf7df1890
[New Rule] Privilege Escalation via SUID/SGID (#3793)
Ruben Groenewoud
2024-06-27 16:50:09 +02:00
-
c3ba7b1262
[New Rule] Privilege Escalation via SUID/SGID (#3793)
Ruben Groenewoud
2024-06-27 16:50:09 +02:00
-
de7e0c7e38
[New Rule] User or Group Creation/Modification (#3804)
Ruben Groenewoud
2024-06-27 16:35:25 +02:00
-
0ca16a1516
[New Rule] User or Group Creation/Modification (#3804)
Ruben Groenewoud
2024-06-27 16:35:25 +02:00
-
2c798a1d18
[Rule Tuning] SUID/SGID Bit Set (#3802)
Ruben Groenewoud
2024-06-27 16:27:00 +02:00
-
8d063e1a47
[Rule Tuning] SUID/SGID Bit Set (#3802)
Ruben Groenewoud
2024-06-27 16:27:00 +02:00
-
4daed66479
[New] Microsoft Management Console File from Unusual Path (#3834)
Samirbous
2024-06-27 11:32:45 +01:00
-
17a07020f3
[New] Microsoft Management Console File from Unusual Path (#3834)
Samirbous
2024-06-27 11:32:45 +01:00
-
0e6ec1f961
[New Rule] AD Group Modification by SYSTEM (#3833)
Jonhnathan
2024-06-26 18:56:01 -03:00
-
deb08fd28d
[New Rule] AD Group Modification by SYSTEM (#3833)
Jonhnathan
2024-06-26 18:56:01 -03:00
-
8bab0df7bf
[Rule Tuning] Add Initial Microsoft Defender for Endpoint Compatibility to Windows DRs (#3825)
Jonhnathan
2024-06-26 11:06:27 -03:00
-
54d5b442cf
[Rule Tuning] Add Initial Microsoft Defender for Endpoint Compatibility to Windows DRs (#3825)
Jonhnathan
2024-06-26 11:06:27 -03:00
-
a8a6562872
[New Rules] Yum Plugin Creation / Discovery (#3820)
Ruben Groenewoud
2024-06-25 16:14:28 +02:00
-
6746a421c4
[New Rules] Yum Plugin Creation / Discovery (#3820)
Ruben Groenewoud
2024-06-25 16:14:28 +02:00
-
45e6b901a2
[Hunt Tuning] Add Descriptions, Collapse Queries and Re-Generate Docs (#3791)
Terrance DeJesus
2024-06-25 09:35:36 -04:00
-
632e169f7a
[Hunt Tuning] Add Descriptions, Collapse Queries and Re-Generate Docs (#3791)
Terrance DeJesus
2024-06-25 09:35:36 -04:00
-
30f5784613
Lock versions for releases: 8.9,8.10,8.11,8.12,8.13,8.14 (#3821)
integration-v8.11.19
github-actions[bot]
2024-06-25 17:58:37 +05:30
-
6f43d1f535
Lock versions for releases: 8.9,8.10,8.11,8.12,8.13,8.14 (#3821)
github-actions[bot]
2024-06-25 17:58:37 +05:30
-
a995f27c13
Tune rule to exclude forwarded events. (#3790)
James Valente
2024-06-25 07:22:07 -04:00
-
0726ce41bf
Tune rule to exclude forwarded events. (#3790)
James Valente
2024-06-25 07:22:07 -04:00
-
2708a89f20
[New Rule] AWS IAM User Created Access Keys for Another User (#3788)
Isai
2024-06-25 00:11:48 -04:00
-
da8f3e4880
[New Rule] Okta Credential Stuffing and Password Spraying Identification via Source, Device Token and Actor (#3797)
Terrance DeJesus
2024-06-21 13:11:23 -04:00
-
a1015c32e5
Revert "Test case to check updated_date (#3764)"
Mika Ayenson
2024-06-21 11:09:05 -05:00
-
a131e021ed
Revert "Test case to check updated_date (#3764)"
Mika Ayenson
2024-06-21 11:05:57 -05:00
-
73a50036b7
Test case to check updated_date (#3764)
shashank-elastic
2024-06-21 18:43:32 +05:30
-
7621a54fcc
Test case to check updated_date (#3764)
shashank-elastic
2024-06-21 18:43:32 +05:30
-
c83a5a614b
Incorrect Integration Index Check (#3794)
shashank-elastic
2024-06-21 18:29:39 +05:30
-
675cad2ed4
Incorrect Integration Index Check (#3794)
shashank-elastic
2024-06-21 18:29:39 +05:30
-
11aab028dc
[Rule Tuning] Okta User Sessions Started from Different Geolocations (#3799)
Terrance DeJesus
2024-06-20 16:52:26 -04:00
-
24358ceb79
[Rule Tuning]: Fix threat_index and filters in Rapid7 CVE rule (#3800)
Krishna Chaitanya Reddy Burri
2024-06-21 00:47:06 +05:30
-
e9d7ddfa35
[Rule Tuning]: Fix threat_index and filters in Rapid7 CVE rule (#3800)
Krishna Chaitanya Reddy Burri
2024-06-21 00:47:06 +05:30
-
0ab0ea4d10
[New Rule] Potential Privilege Escalation via Service ImagePath Modification (#3757)
Jonhnathan
2024-06-20 10:41:53 -03:00
-
c20318d0d0
[New Rule] Potential Privilege Escalation via Service ImagePath Modification (#3757)
Jonhnathan
2024-06-20 10:41:53 -03:00
-
0e6ebd6e7a
[New Rule] NTDS Dump via Wbadmin (#3758)
Jonhnathan
2024-06-20 09:55:07 -03:00
-
236444200b
[New Rule] NTDS Dump via Wbadmin (#3758)
Jonhnathan
2024-06-20 09:55:07 -03:00
-
b8c63b0999
[New Rule] Potential WPAD Spoofing via DNS Record Creation (#3748)
Jonhnathan
2024-06-20 09:34:27 -03:00
-
3fd9bae611
[New Rule] Potential WPAD Spoofing via DNS Record Creation (#3748)
Jonhnathan
2024-06-20 09:34:27 -03:00
-
b0c0fa4e35
Create defense_evasion_reg_disable_enableglobalqueryblocklist.toml (#3734)
Jonhnathan
2024-06-20 09:23:06 -03:00
-
6a0ac563a0
Create defense_evasion_reg_disable_enableglobalqueryblocklist.toml (#3734)
Jonhnathan
2024-06-20 09:23:06 -03:00
-
cbc7fb5224
Adding setup templates to the ML rules (#3798)
Kirti Sodhi
2024-06-19 10:04:41 -04:00