Isai
4c996490ec
* [New Rule] Netcat Listener Established Inside A Container new rule toml * remove references Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com> * remove false_positives Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com> * adjust from field from s to m for readability Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com> * Update execution_netcat_listener_established_inside_a_container.toml updated query, updated risk score, expanded explanation for 2nd part of the query where process args is used to search for target executables * optimized query optimized query to deduplicate fields based on review feedback * Update execution_netcat_listener_established_inside_a_container.toml updated query comment * Update execution_netcat_listener_established_inside_a_container.toml added false positive section * Update execution_netcat_listener_established_inside_a_container.toml adjusted tags * removed the != end query parameter removed the exclusion of end events for this to account for short-lived netcat listener processes --------- Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com> Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>