James Valente 0726ce41bf Tune rule to exclude forwarded events. (#3790) ...

Events containing "forwarded" as a tag may include host information
that is not related to the host running elastic agent. This triggers
false positive alerts. Examples include Entity Analytics integrations,
Palo Alto GlobalProtect activity, and M365 Defender device events.

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

2024-06-25 13:22:07 +02:00

..

command_and_control_google_drive_malicious_file_download.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

command_and_control_non_standard_ssh_port.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

credential_access_cookies_chromium_browsers_debugging.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

defense_evasion_agent_spoofing_mismatched_id.toml

[Rule Tuning] Agent Spoofing (#3729)

2024-06-03 19:28:24 +02:00

defense_evasion_agent_spoofing_multiple_hosts.toml

Tune rule to exclude forwarded events. (#3790)

2024-06-25 13:22:07 +02:00

defense_evasion_deleting_websvr_access_logs.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

defense_evasion_deletion_of_bash_command_line_history.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

defense_evasion_elastic_agent_service_terminated.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

defense_evasion_masquerading_space_after_filename.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

defense_evasion_timestomp_touch.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

discovery_security_software_grep.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

discovery_virtual_machine_fingerprinting_grep.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

execution_pentest_eggshell_remote_admin_tool.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

execution_potential_widespread_malware_infection.toml

[New Rule] Potential Widespread Malware Infection (#3656)

2024-05-10 13:51:04 -03:00

execution_python_script_in_cmdline.toml

[Security Content] Small tweaks on the setup guides (#3308)

2024-03-11 09:09:40 -03:00

execution_revershell_via_shell_cmd.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

execution_suspicious_jar_child_process.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

execution_suspicious_java_netcon_childproc.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

guided_onboarding_sample_rule.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

impact_hosts_file_modified.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

initial_access_zoom_meeting_with_no_passcode.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

multiple_alerts_different_tactics_host.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

multiple_alerts_involving_user.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

persistence_credential_access_modify_auth_module_or_config.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

persistence_shell_profile_modification.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

persistence_ssh_authorized_keys_modification.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

privilege_escalation_echo_nopasswd_sudoers.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

privilege_escalation_setuid_setgid_bit_set_via_chmod.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

privilege_escalation_sudo_buffer_overflow.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

privilege_escalation_sudoers_file_mod.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30