-
80f16bb7ac
Lock versions for releases: 8.3,8.4,8.5,8.6,8.7,8.8,8.9,8.10 (#3108)
integration-v8.10.3
github-actions[bot]
2023-09-18 11:14:42 -04:00
-
de2b97a492
Lock versions for releases: 8.3,8.4,8.5,8.6,8.7,8.8,8.9,8.10 (#3108)
github-actions[bot]
2023-09-18 11:14:42 -04:00
-
18fb966776
[New Rule] Network Activity Detected via cat (#3069)
Ruben Groenewoud
2023-09-18 09:51:20 +02:00
-
b291317ea6
[New Rule] Network Activity Detected via cat (#3069)
Ruben Groenewoud
2023-09-18 09:51:20 +02:00
-
f4ce48063c
[New Rule] Github Repository Deleted (#3056)
Isai
2023-09-14 18:00:25 -04:00
-
9146e0965d
[New Rule] Github Repository Deleted (#3056)
Isai
2023-09-14 18:00:25 -04:00
-
09feb8b94f
[New Rule] GitHub Protected Branch Settings Changed (#3054)
Isai
2023-09-14 17:16:51 -04:00
-
904e37b732
[New Rule] GitHub Protected Branch Settings Changed (#3054)
Isai
2023-09-14 17:16:51 -04:00
-
0bc9b126f6
Tunes Unusual Parent Process for cmd.exe rule to exclude oobe activity (#3091)
Hilton
2023-09-14 02:51:07 +10:00
-
ccfc931fbd
Tunes Unusual Parent Process for cmd.exe rule to exclude oobe activity (#3091)
Hilton
2023-09-14 02:51:07 +10:00
-
ab3a15861c
[Security Content] Add missing osquery transforms (#3088)
Jonhnathan
2023-09-13 08:07:01 -03:00
-
4034436f06
[Security Content] Add missing osquery transforms (#3088)
Jonhnathan
2023-09-13 08:07:01 -03:00
-
711e0f3ab7
[New Rule] New BBR Rules - Part 2 (#3029)
Jonhnathan
2023-09-12 21:49:22 -03:00
-
ddb1f75352
[New Rule] New BBR Rules - Part 2 (#3029)
Jonhnathan
2023-09-12 21:49:22 -03:00
-
4b2112f4a0
[New Rule] New BBR Rules - Part 3 (#3034)
Jonhnathan
2023-09-12 21:28:01 -03:00
-
af99186992
[New Rule] New BBR Rules - Part 3 (#3034)
Jonhnathan
2023-09-12 21:28:01 -03:00
-
40a8e64278
Merge branch 'main' of github.com:elastic/detection-rules
Mika Ayenson
2023-09-11 12:53:45 -05:00
-
-
fa494e4c46
[New Rule] Potential UDP Reverse Shell (#2906)
Ruben Groenewoud
2023-09-07 17:13:22 +02:00
-
f8f3576971
[New Rule] Potential UDP Reverse Shell (#2906)
Ruben Groenewoud
2023-09-07 17:13:22 +02:00
-
63b817353a
[New Rule] Potential Meterpreter Reverse Shell (#3007)
Ruben Groenewoud
2023-09-07 17:04:06 +02:00
-
15e71ec2e8
[New Rule] Potential Meterpreter Reverse Shell (#3007)
Ruben Groenewoud
2023-09-07 17:04:06 +02:00
-
49c7a9317e
[FR] Add support for samples in eql 0.9.18 (#3000)
Mika Ayenson
2023-09-07 09:01:28 -05:00
-
20de1d8d1d
[FR] Add support for samples in eql 0.9.18 (#3000)
Mika Ayenson
2023-09-07 09:01:28 -05:00
-
2e74d50950
Lock versions for releases: 8.3,8.4,8.5,8.6,8.7,8.8,8.9,8.10 (#3079)
integration-v8.10.2
github-actions[bot]
2023-09-06 13:21:22 -04:00
-
87af5b43ba
Lock versions for releases: 8.3,8.4,8.5,8.6,8.7,8.8,8.9,8.10 (#3079)
github-actions[bot]
2023-09-06 13:21:22 -04:00
-
e9b1ebae3f
[New Rule] New BBR Rules - Part 5 (#3052)
Jonhnathan
2023-09-05 18:36:34 -03:00
-
3614f42b00
[New Rule] New BBR Rules - Part 5 (#3052)
Jonhnathan
2023-09-05 18:36:34 -03:00
-
521ecdc6c4
[New Rule] New BBR Rules - Part 1 (#3026)
Jonhnathan
2023-09-05 18:07:47 -03:00
-
8049c96281
[New Rule] New BBR Rules - Part 1 (#3026)
Jonhnathan
2023-09-05 18:07:47 -03:00
-
56e54e714c
[New Rule] Potential Masquerading as Business App Installer (#3068)
Jonhnathan
2023-09-05 17:58:34 -03:00
-
26c97dc241
[New Rule] Potential Masquerading as Business App Installer (#3068)
Jonhnathan
2023-09-05 17:58:34 -03:00
-
7780167504
Added unit test (#3038)
eric-forte-elastic
2023-09-05 15:27:04 -04:00
-
34ebcec679
Added unit test (#3038)
eric-forte-elastic
2023-09-05 15:27:04 -04:00
-
063386829c
[Security Content] Include "Data Source: Elastic Defend" tag (#3002)
Jonhnathan
2023-09-05 15:22:01 -03:00
-
4233fef238
[Security Content] Include "Data Source: Elastic Defend" tag (#3002)
Jonhnathan
2023-09-05 15:22:01 -03:00
-
4bb0cdc3f3
[Rule Tuning] Small Linux DR Tuning (#3074)
Ruben Groenewoud
2023-09-05 14:20:57 +02:00
-
6115a68aba
[Rule Tuning] Small Linux DR Tuning (#3074)
Ruben Groenewoud
2023-09-05 14:20:57 +02:00
-
bdda925921
label bbr rules (#3067)
Mika Ayenson
2023-08-31 17:00:16 -05:00
-
811d1b7727
label bbr rules (#3067)
Mika Ayenson
2023-08-31 17:00:16 -05:00
-
06e3367683
[New Rule] Sus User Privilege Enumeration via id (#3049)
Ruben Groenewoud
2023-08-31 18:13:42 +02:00
-
3c64b454fb
[New Rule] Sus User Privilege Enumeration via id (#3049)
Ruben Groenewoud
2023-08-31 18:13:42 +02:00
-
6c074f21d8
[New Rule][BBR] WRITEDAC Access on Active Directory Object (#3015)
Jonhnathan
2023-08-31 12:59:02 -03:00
-
fdd45148b8
[New Rule][BBR] WRITEDAC Access on Active Directory Object (#3015)
Jonhnathan
2023-08-31 12:59:02 -03:00
-
3926384446
[New Rules] GDB Secret Dumping (#3060)
Ruben Groenewoud
2023-08-31 17:41:22 +02:00
-
f7d8d4752a
[New Rules] GDB Secret Dumping (#3060)
Ruben Groenewoud
2023-08-31 17:41:22 +02:00
-
5c0ff8765b
[New Rule] File Creation, Exec and Self-Deletion (#3045)
Ruben Groenewoud
2023-08-31 17:32:17 +02:00
-
b6ed215958
[New Rule] File Creation, Exec and Self-Deletion (#3045)
Ruben Groenewoud
2023-08-31 17:32:17 +02:00
-
ba6952c242
[Rule Tuning] 3 tunings to reduce FPs (#3058)
Ruben Groenewoud
2023-08-31 17:16:57 +02:00
-
3588600d57
[Rule Tuning] 3 tunings to reduce FPs (#3058)
Ruben Groenewoud
2023-08-31 17:16:57 +02:00
-
fb2fbf3589
[New Rule] Potential Disabling of AppArmor (#3046)
Ruben Groenewoud
2023-08-31 17:06:15 +02:00
-
2eaaf27f1e
[New Rule] Potential Disabling of AppArmor (#3046)
Ruben Groenewoud
2023-08-31 17:06:15 +02:00
-
7b5897bad4
[New BBR] Suspicious which Enumeration (#3059)
Ruben Groenewoud
2023-08-31 13:55:56 +02:00
-
04d1c3cd5b
[New BBR] Suspicious which Enumeration (#3059)
Ruben Groenewoud
2023-08-31 13:55:56 +02:00
-
ed6d73bba9
[New Rule] Binary Copied and/or Moved to Suspicious Directory (#3048)
Ruben Groenewoud
2023-08-31 13:46:41 +02:00
-
d838a3352f
[New Rule] Binary Copied and/or Moved to Suspicious Directory (#3048)
Ruben Groenewoud
2023-08-31 13:46:41 +02:00
-
5857a47cd4
[New Rule] Potential Sudo Privilege Escalation via CVE-2019-14287 (#3057)
Ruben Groenewoud
2023-08-31 13:11:34 +02:00
-
a5b5d513af
[New Rule] Potential Sudo Privilege Escalation via CVE-2019-14287 (#3057)
Ruben Groenewoud
2023-08-31 13:11:34 +02:00
-
dee3a5f61c
[New Rule] Suspicious Communication App Child Process (#2998)
Jonhnathan
2023-08-31 07:33:16 -03:00
-
c89b722a34
[New Rule] Suspicious Communication App Child Process (#2998)
Jonhnathan
2023-08-31 07:33:16 -03:00
-
53ac388228
[New Rules] sus program compilation activity (#3043)
Ruben Groenewoud
2023-08-31 09:30:56 +02:00
-
a395f54054
[New Rules] sus program compilation activity (#3043)
Ruben Groenewoud
2023-08-31 09:30:56 +02:00
-
ae1f704845
[New Rule] Potential Masquerading as VLC DLL (#3006)
Jonhnathan
2023-08-30 17:45:45 -03:00
-
a7a22a0917
[New Rule] Potential Masquerading as VLC DLL (#3006)
Jonhnathan
2023-08-30 17:45:45 -03:00
-
1da5bca492
[New Rules] Linux Tunneling and Port Forwarding (#3028)
Ruben Groenewoud
2023-08-30 22:12:19 +02:00
-
32abdb95f7
[New Rules] Linux Tunneling and Port Forwarding (#3028)
Ruben Groenewoud
2023-08-30 22:12:19 +02:00
-
4a4588c856
Tune rule for new DLL written to Windows Servicing (#3062)
Eric
2023-08-30 10:51:23 -06:00
-
41a7a36817
Tune rule for new DLL written to Windows Servicing (#3062)
Eric
2023-08-30 10:51:23 -06:00
-
d45b693e20
[New Rule] Suspicious WMI Event Subscription Created (#1860)
Jonhnathan
2023-08-29 16:42:19 -03:00
-
6d7df50d78
[New Rule] Suspicious WMI Event Subscription Created (#1860)
Jonhnathan
2023-08-29 16:42:19 -03:00
-
374ac8ad1c
[New Rule] Unusual Process For MSSQL Service Accounts (#3040)
Jonhnathan
2023-08-29 09:10:25 -03:00
-
7004c99ef5
[New Rule] Unusual Process For MSSQL Service Accounts (#3040)
Jonhnathan
2023-08-29 09:10:25 -03:00
-
154ee50051
[New Rule] New BBR Rules - Part 4 (#3035)
Jonhnathan
2023-08-29 08:49:22 -03:00
-
0e337e2c36
[New Rule] New BBR Rules - Part 4 (#3035)
Jonhnathan
2023-08-29 08:49:22 -03:00
-
520a670568
[New Rule] Potential Masquerading as Browser Process (#2995)
Jonhnathan
2023-08-28 13:28:26 -03:00
-
9f213cc9f7
[New Rule] Potential Masquerading as Browser Process (#2995)
Jonhnathan
2023-08-28 13:28:26 -03:00
-
d0d092a036
Update credential_access_lsass_openprocess_api.toml (#3047)
Samirbous
2023-08-28 16:22:08 +01:00
-
22931d6afb
Update credential_access_lsass_openprocess_api.toml (#3047)
Samirbous
2023-08-28 16:22:08 +01:00
-
112e2f2864
[New Rule] Potential Masquerading as Windows System32 DLL (#3021)
Jonhnathan
2023-08-28 08:31:20 -03:00
-
7496c5cb68
[New Rule] Potential Masquerading as Windows System32 DLL (#3021)
Jonhnathan
2023-08-28 08:31:20 -03:00
-
f00a14c3af
[New Rule] Network-Level Authentication (NLA) Disabled (#3039)
Jonhnathan
2023-08-28 08:05:21 -03:00
-
ffa60f2d03
[New Rule] Network-Level Authentication (NLA) Disabled (#3039)
Jonhnathan
2023-08-28 08:05:21 -03:00
-
c067542e13
[Rule Tuning] High Number of Process and/or Service Terminations (#2940)
Jonhnathan
2023-08-25 19:19:25 -03:00
-
de32287889
[Rule Tuning] High Number of Process and/or Service Terminations (#2940)
Jonhnathan
2023-08-25 19:19:25 -03:00
-
8aad7d7d02
BBR Rules Addition (#3027)
shashank-elastic
2023-08-25 19:10:12 +05:30
-
d21ed24e4f
BBR Rules Addition (#3027)
shashank-elastic
2023-08-25 19:10:12 +05:30
-
ed2daecb25
[Rule Tuning] Several rule tunings (#3024)
Ruben Groenewoud
2023-08-25 14:03:29 +02:00
-
a1716bd673
[Rule Tuning] Several rule tunings (#3024)
Ruben Groenewoud
2023-08-25 14:03:29 +02:00
-
939800bb03
[Rule Tuning] Threat Intel Hash Indicator Match (#3031)
Eric
2023-08-25 03:21:16 -06:00
-
17d0e5cda8
[Rule Tuning] Threat Intel Hash Indicator Match (#3031)
Eric
2023-08-25 03:21:16 -06:00
-
a16735676f
[Rule Tuning] Windows BBR Rules (#3018)
Jonhnathan
2023-08-25 05:21:16 -03:00
-
17f6537e44
[Rule Tuning] Windows BBR Rules (#3018)
Jonhnathan
2023-08-25 05:21:16 -03:00
-
38aca58b17
[Rule Tuning] Compression DLL Loaded by Unusual Process (#3017)
Jonhnathan
2023-08-25 05:08:36 -03:00
-
460919a9d7
[Rule Tuning] Compression DLL Loaded by Unusual Process (#3017)
Jonhnathan
2023-08-25 05:08:36 -03:00
-
7887392eaf
Merge branch 'main' of github.com:elastic/detection-rules
Mika Ayenson
2023-08-24 15:26:45 -05:00
-
-
4833f15de5
[Bug] Fix RTA Metadata (#3036)
Mika Ayenson
2023-08-24 11:12:16 -05:00
-
5bb5994c6f
[Bug] Fix RTA Metadata (#3036)
Mika Ayenson
2023-08-24 11:12:16 -05:00
-
7ad30125fd
Merge branch 'main' of github.com:elastic/detection-rules
Mika Ayenson
2023-08-24 10:34:28 -05:00
-
-
abdf54d4ac
[Bug] Set session cookie key to sid (#3010)
Mika Ayenson
2023-08-22 16:02:20 -05:00
-
c72ec4da90
[Bug] Set session cookie key to sid (#3010)
Mika Ayenson
2023-08-22 16:02:20 -05:00
-
d96eb29614
Adding related integrations to ML rules (#2972)
Apoorva Joshi
2023-08-22 20:39:18 +02:00