-
69173872da
[Tuning] Connection to Commonly Abused Web Services (#3425)
Samirbous
2024-04-02 14:41:10 +01:00
-
22857aca2e
[New Rule] Suspicious Access to LDAP Attributes (#2504)
Samirbous
2024-04-02 13:57:38 +01:00
-
ece5175894
[New Rule] Suspicious Access to LDAP Attributes (#2504)
Samirbous
2024-04-02 13:57:38 +01:00
-
f025616cbd
[New Rule] Suspicious Access to LDAP Attributes (#2504)
Samirbous
2024-04-02 13:57:38 +01:00
-
5a18a6cea2
[Rule Tuning] Potential Application Shimming via Sdbinst (#3553)
Jonhnathan
2024-04-02 06:35:14 -03:00
-
36c6968d71
[Rule Tuning] Potential Application Shimming via Sdbinst (#3553)
Jonhnathan
2024-04-02 06:35:14 -03:00
-
c781376188
[Rule Tuning] Potential Application Shimming via Sdbinst (#3553)
Jonhnathan
2024-04-02 06:35:14 -03:00
-
de3db7007a
[New] Potential Execution via XZBackdoor (#3555)
Samirbous
2024-04-02 05:15:04 +01:00
-
d00325f432
[New] Potential Execution via XZBackdoor (#3555)
Samirbous
2024-04-02 05:15:04 +01:00
-
f2490007e8
[New] Potential Execution via XZBackdoor (#3555)
Samirbous
2024-04-02 05:15:04 +01:00
-
21f23f6d33
[Rule Tuning] Tighten up Indexes of Elastic Defend Windows Rules (#3549)
Jonhnathan
2024-04-01 20:45:12 -03:00
-
4eac68bb07
[Rule Tuning] Tighten up Indexes of Elastic Defend Windows Rules (#3549)
Jonhnathan
2024-04-01 20:45:12 -03:00
-
b47b91b9ec
[Rule Tuning] Tighten up Indexes of Elastic Defend Windows Rules (#3549)
Jonhnathan
2024-04-01 20:45:12 -03:00
-
7838042839
[Rule Tuning] Replace KQL exceptions for Query DSL Exceptions (#3505)
Jonhnathan
2024-04-01 17:44:50 -03:00
-
9cba1e96e6
[Rule Tuning] Replace KQL exceptions for Query DSL Exceptions (#3505)
Jonhnathan
2024-04-01 17:44:50 -03:00
-
67ca13c1ce
[Rule Tuning] Replace KQL exceptions for Query DSL Exceptions (#3505)
Jonhnathan
2024-04-01 17:44:50 -03:00
-
c1dd8cae21
Update setup guide for ML integration packages (#3475)
Susan
2024-04-01 15:02:32 -04:00
-
390cb8e2d1
Update setup guide for ML integration packages (#3475)
Susan
2024-04-01 15:02:32 -04:00
-
400a84628e
Update setup guide for ML integration packages (#3475)
Susan
2024-04-01 15:02:32 -04:00
-
e74f7a4d6b
[FR] Add support for investigation_fields (#3550)
Mika Ayenson
2024-04-01 11:52:46 -05:00
-
aef30b595d
[FR] Add support for investigation_fields (#3550)
Mika Ayenson
2024-04-01 11:52:46 -05:00
-
bb907a4d76
[FR] Add support for investigation_fields (#3550)
Mika Ayenson
2024-04-01 11:52:46 -05:00
-
69d2f4b607
Fix create PR in release workflow (#3528)
shashank-elastic
2024-04-01 21:17:10 +05:30
-
a2fd651db3
Fix create PR in release workflow (#3528)
shashank-elastic
2024-04-01 21:17:10 +05:30
-
8b215eac41
Fix create PR in release workflow (#3528)
shashank-elastic
2024-04-01 21:17:10 +05:30
-
57627e562f
[Rule Deprecation] Deprecate
Remote File Creation on a Sensitive Directory (#3477)
Terrance DeJesus
2024-04-01 11:01:20 -04:00
-
92c5b6ad1b
[Rule Deprecation] Deprecate
Remote File Creation on a Sensitive Directory (#3477)
Terrance DeJesus
2024-04-01 11:01:20 -04:00
-
d4bf04256d
[Rule Deprecation] Deprecate
Remote File Creation on a Sensitive Directory (#3477)
Terrance DeJesus
2024-04-01 11:01:20 -04:00
-
e7416a6a68
[FR] Add required-fields option to import-rules (#3546)
Mika Ayenson
2024-03-28 18:29:47 -05:00
-
5ab2090060
[FR] Add required-fields option to import-rules (#3546)
Mika Ayenson
2024-03-28 18:29:47 -05:00
-
b6a7e7ebda
[FR] Add required-fields option to import-rules (#3546)
Mika Ayenson
2024-03-28 18:29:47 -05:00
-
5a7d7cf4a0
[New Rules] Potential PowerShell Pass-the-Hash/Relay Script (#3543)
Jonhnathan
2024-03-28 07:05:35 -03:00
-
24d4cdaf5d
[New Rules] Potential PowerShell Pass-the-Hash/Relay Script (#3543)
Jonhnathan
2024-03-28 07:05:35 -03:00
-
218c3bead6
[New Rules] Potential PowerShell Pass-the-Hash/Relay Script (#3543)
Jonhnathan
2024-03-28 07:05:35 -03:00
-
c871bbb6d6
[New Rule] Creation of a DNS-Named Record (#3539)
Jonhnathan
2024-03-27 18:21:07 -03:00
-
f217aed00d
[New Rule] Creation of a DNS-Named Record (#3539)
Jonhnathan
2024-03-27 18:21:07 -03:00
-
954a93c3b4
[New Rule] Creation of a DNS-Named Record (#3539)
Jonhnathan
2024-03-27 18:21:07 -03:00
-
06dcbb80f5
[New Rule] Potential ADIDNS Poisoning via Wildcard Record Creation (#3535)
Jonhnathan
2024-03-27 10:07:23 -03:00
-
fff1170ffc
[New Rule] Potential ADIDNS Poisoning via Wildcard Record Creation (#3535)
Jonhnathan
2024-03-27 10:07:23 -03:00
-
67e9ebf8e1
[New Rule] Potential ADIDNS Poisoning via Wildcard Record Creation (#3535)
Jonhnathan
2024-03-27 10:07:23 -03:00
-
bfd3289680
[New] Suspicious Execution via ScreenConnect (#3541)
Samirbous
2024-03-27 11:52:47 +00:00
-
09b2ff76a9
[New] Suspicious Execution via ScreenConnect (#3541)
Samirbous
2024-03-27 11:52:47 +00:00
-
d7aff43621
[New] Suspicious Execution via ScreenConnect (#3541)
Samirbous
2024-03-27 11:52:47 +00:00
-
e388aaf409
fix typo in lateral_movement_remote_services.toml (#3538)
ALEXANDER MA COTE
2024-03-27 06:38:57 -04:00
-
28b6e2c042
fix typo in lateral_movement_remote_services.toml (#3538)
ALEXANDER MA COTE
2024-03-27 06:38:57 -04:00
-
138447221f
fix typo in lateral_movement_remote_services.toml (#3538)
ALEXANDER MA COTE
2024-03-27 06:38:57 -04:00
-
75a0a3f338
[Rule Tuning] Scheduled Task Activity via pwsh (#3534)
Ruben Groenewoud
2024-03-26 14:45:04 +01:00
-
155ac20303
[Rule Tuning] Scheduled Task Activity via pwsh (#3534)
Ruben Groenewoud
2024-03-26 14:45:04 +01:00
-
760b99bcc1
[Rule Tuning] Scheduled Task Activity via pwsh (#3534)
Ruben Groenewoud
2024-03-26 14:45:04 +01:00
-
5ce96738c4
[New] Suspicious JetBrains TeamCity Child Process (#3532)
Samirbous
2024-03-25 16:32:56 +00:00
-
9fa3292200
[New] Suspicious JetBrains TeamCity Child Process (#3532)
Samirbous
2024-03-25 16:32:56 +00:00
-
fc76a8bcb5
[New] Suspicious JetBrains TeamCity Child Process (#3532)
Samirbous
2024-03-25 16:32:56 +00:00
-
6bf3a82f51
Update sort parameter (#3531)
Eric Forte
2024-03-25 11:46:30 -04:00
-
149c78b390
Update sort parameter (#3531)
Eric Forte
2024-03-25 11:46:30 -04:00
-
3503786154
Update sort parameter (#3531)
Eric Forte
2024-03-25 11:46:30 -04:00
-
dda6a33f70
Lock versions for releases: 8.3,8.4,8.5,8.6,8.7,8.8,8.9,8.10,8.11,8.12,8.13 (#3526)
integration-v8.11.11
github-actions[bot]
2024-03-21 20:30:46 +05:30
-
981702698c
Lock versions for releases: 8.3,8.4,8.5,8.6,8.7,8.8,8.9,8.10,8.11,8.12,8.13 (#3526)
integration-v8.10.14
github-actions[bot]
2024-03-21 20:30:46 +05:30
-
eaf4658620
Lock versions for releases: 8.3,8.4,8.5,8.6,8.7,8.8,8.9,8.10,8.11,8.12,8.13 (#3526)
github-actions[bot]
2024-03-21 20:30:46 +05:30
-
43d0fa1aad
[Bug] Update lock versions dependencies (#3525)
Mika Ayenson
2024-03-21 08:35:24 -05:00
-
ba1158808f
[Bug] Update lock versions dependencies (#3525)
Mika Ayenson
2024-03-21 08:35:24 -05:00
-
fc7cc2c06a
[Bug] Update lock versions dependencies (#3525)
Mika Ayenson
2024-03-21 08:35:24 -05:00
-
b6aff9b2e5
[New Rules] Veeam Credential Access DRs (#3516)
Jonhnathan
2024-03-21 10:00:48 -03:00
-
7f3799319d
[New Rules] Veeam Credential Access DRs (#3516)
Jonhnathan
2024-03-21 10:00:48 -03:00
-
779fa7710d
[New Rules] Veeam Credential Access DRs (#3516)
Jonhnathan
2024-03-21 10:00:48 -03:00
-
f0a06bc56b
[Rule Tuning] Potential Reverse Shell via UDP (#3508)
Ruben Groenewoud
2024-03-21 13:48:41 +01:00
-
ce984b8531
[Rule Tuning] Potential Reverse Shell via UDP (#3508)
Ruben Groenewoud
2024-03-21 13:48:41 +01:00
-
a6028b43b3
[Rule Tuning] Potential Reverse Shell via UDP (#3508)
Ruben Groenewoud
2024-03-21 13:48:41 +01:00
-
4f0bd6e165
Update README.md (#3524)
Mika Ayenson
2024-03-20 13:32:26 -05:00
-
b06b730213
Update README.md (#3524)
Mika Ayenson
2024-03-20 13:32:26 -05:00
-
e37bc6f781
Update README.md (#3524)
Mika Ayenson
2024-03-20 13:32:26 -05:00
-
88181b0f80
[Rule Tuning] SMTP on Port 26/TCP (#3521)
Mika Ayenson
2024-03-19 15:55:25 -05:00
-
32ed8f141d
[Rule Tuning] SMTP on Port 26/TCP (#3521)
Mika Ayenson
2024-03-19 15:55:25 -05:00
-
07abc19932
[Rule Tuning] SMTP on Port 26/TCP (#3521)
Mika Ayenson
2024-03-19 15:55:25 -05:00
-
edf52a578c
[FR] Update Python Dependency Versions (#3515)
Mika Ayenson
2024-03-19 14:07:16 -05:00
-
f66da9d350
[FR] Update Python Dependency Versions (#3515)
Mika Ayenson
2024-03-19 14:07:16 -05:00
-
5c3523954e
[FR] Update Python Dependency Versions (#3515)
Mika Ayenson
2024-03-19 14:07:16 -05:00
-
078c86ab40
[Rule Tuning] Tuning 'First Time Seen AWS Secret Value Accessed in Secrets Manager' (#3494)
Terrance DeJesus
2024-03-15 19:08:28 -04:00
-
b19541f0f8
[Rule Tuning] Tuning 'First Time Seen AWS Secret Value Accessed in Secrets Manager' (#3494)
Terrance DeJesus
2024-03-15 19:08:28 -04:00
-
f6e79944f2
[Rule Tuning] Tuning 'First Time Seen AWS Secret Value Accessed in Secrets Manager' (#3494)
Terrance DeJesus
2024-03-15 19:08:28 -04:00
-
434b3ffcc0
[FR] Independently package kql / kibana and bump to py3.12 (#3514)
Mika Ayenson
2024-03-14 20:18:32 -05:00
-
3354460843
[FR] Independently package kql / kibana and bump to py3.12 (#3514)
Mika Ayenson
2024-03-14 20:18:32 -05:00
-
d26981f712
[FR] Independently package kql / kibana and bump to py3.12 (#3514)
Mika Ayenson
2024-03-14 20:18:32 -05:00
-
3d2a36be32
Revert "[FR] Independently package kql / kibana and bump to py3.12 (#3492)"
Mika Ayenson
2024-03-14 19:48:50 -05:00
-
fc139fc3c2
[FR] Independently package kql / kibana and bump to py3.12 (#3492)
Mika Ayenson
2024-03-14 19:14:25 -05:00
-
2af0c64945
[FR] Add support for dataviews in the rule schema (#3510)
Mika Ayenson
2024-03-14 17:43:27 -05:00
-
f1542e6ef5
[FR] Add support for dataviews in the rule schema (#3510)
Mika Ayenson
2024-03-14 17:43:27 -05:00
-
8724077a0e
[FR] Add support for dataviews in the rule schema (#3510)
Mika Ayenson
2024-03-14 17:43:27 -05:00
-
0a729b77a4
Beaconing - Add whitelist to rules, with some more processes (#3497)
Susan
2024-03-14 15:51:02 -04:00
-
a4ecfe3ccf
Beaconing - Add whitelist to rules, with some more processes (#3497)
Susan
2024-03-14 15:51:02 -04:00
-
a08cbc7390
[Rule Tuning] Guided Onboarding Rule (#3502)
Jonhnathan
2024-03-14 10:59:31 -03:00
-
18a34a15ff
[Rule Tuning] Guided Onboarding Rule (#3502)
Jonhnathan
2024-03-14 10:59:31 -03:00
-
c610e19114
[Rule Tuning] Guided Onboarding Rule (#3502)
Jonhnathan
2024-03-14 10:59:31 -03:00
-
4fec1a766e
[New Rules] mprotect() RWX Binary Execution (#3507)
Ruben Groenewoud
2024-03-13 22:11:44 +01:00
-
9f234eecc7
[New Rules] mprotect() RWX Binary Execution (#3507)
Ruben Groenewoud
2024-03-13 22:11:44 +01:00
-
4179180fcb
[New Rules] mprotect() RWX Binary Execution (#3507)
Ruben Groenewoud
2024-03-13 22:11:44 +01:00
-
22ed934946
[Rule Tuning] Improve Compatibility in WIndows Detection Rules - Part 1 (#3501)
Jonhnathan
2024-03-13 10:27:44 -03:00
-
b43003c3f1
[Rule Tuning] Improve Compatibility in WIndows Detection Rules - Part 1 (#3501)
Jonhnathan
2024-03-13 10:27:44 -03:00
-
f5254f3b5e
[Rule Tuning] Improve Compatibility in WIndows Detection Rules - Part 1 (#3501)
Jonhnathan
2024-03-13 10:27:44 -03:00
-
11168606d5
[Tuning] event.action and event.type change (#3495)
Ruben Groenewoud
2024-03-13 10:11:21 +01:00
-
578e86eeae
[Tuning] event.action and event.type change (#3495)
Ruben Groenewoud
2024-03-13 10:11:21 +01:00