sigma-rules

Files

T

Samirbous b996a29451 [Tuning] Diverse Rules Tuning (#5482 )

* [Tuning] Diverse Rules Tuning

* Update persistence_shell_profile_modification.toml

* Update defense_evasion_ml_suspicious_windows_event_low_probability.toml

* Update defense_evasion_ml_suspicious_windows_event_high_probability.toml

* Update defense_evasion_ml_suspicious_windows_event_high_probability.toml

* ++

* Update persistence_suspicious_ssh_execution_xzbackdoor.toml

* Update persistence_suspicious_ssh_execution_xzbackdoor.toml

* Update credential_access_potential_linux_ssh_bruteforce_internal.toml

* Update persistence_shell_profile_modification.toml

* Revert "Update credential_access_potential_linux_ssh_bruteforce_internal.toml"

This reverts commit bad889a30d3f4a028de2b6624307f75b279a205b.

* Update persistence_web_server_sus_destination_port.toml

* Update defense_evasion_ml_suspicious_windows_event_high_probability.toml

* Update defense_evasion_ml_suspicious_windows_event_low_probability.toml

---------

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

2025-12-18 15:30:12 +00:00

defense_evasion_ml_rare_process_for_a_host.toml

Prep main for 9.1 (#4555 )

2025-03-26 11:04:14 -04:00

defense_evasion_ml_rare_process_for_a_parent_process.toml

Prep main for 9.1 (#4555 )

2025-03-26 11:04:14 -04:00

defense_evasion_ml_rare_process_for_a_user.toml

Prep main for 9.1 (#4555 )

2025-03-26 11:04:14 -04:00

defense_evasion_ml_suspicious_windows_event_high_probability.toml

[Tuning] Diverse Rules Tuning (#5482 )