Isai 0eed8ce27f [New Rule] SSH Process Launched From Inside A Container (#2794) ...

* [New Rule] SSH Process Launched From Inside A Container

new toml rule file

* changed "not" query

changed query to !=

---------

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

2023-05-16 17:32:58 -04:00

..

container_workload_protection.toml

[Rule Tuning] added rule name override for cloud_defend integration rule (#2767)

2023-05-02 00:05:24 -04:00

credential_access_collection_sensitive_files_compression_inside_a_container.toml

[New Rule] Sensitive Files Compression Inside A Container (#2790)

2023-05-16 15:49:42 -04:00

credential_access_sensitive_keys_or_passwords_search_inside_a_container.toml

[New Rule] Sensitive Keys Or Passwords Searched For Inside A Container (#2789)

2023-05-16 15:29:54 -04:00

discovery_suspicious_network_tool_launched_inside_a_container.toml

[New Rule] Suspicious Network Tool Launched Inside A Container (#2759)

2023-05-16 15:21:42 -04:00

execution_container_management_binary_launched_inside_a_container.toml

[New Rule] Container Management Binary Run Inside A Container (#2754)

2023-05-16 14:41:27 -04:00

execution_file_made_executable_via_chmod_inside_a_container.toml

[New Rule] File Made Executable via Chmod Inside A Container (#2757)

2023-05-16 15:15:49 -04:00

execution_interactive_exec_to_container.toml

[New Rule] Interactive Exec Command Launched Against A Running Container (#2791)

2023-05-16 16:09:10 -04:00

execution_interactive_shell_spawned_from_inside_a_container.toml

[New Rule] Interactive Shell Spawned From Inside a Container (#2752)

2023-05-16 15:02:20 -04:00

execution_netcat_listener_established_inside_a_container.toml

[New Rule] Netcat Listener Established Inside A Container (#2756)

2023-05-16 15:08:20 -04:00

initial_access_ssh_connection_established_inside_a_container.toml

[New Rule] SSH Connection Established Inside A Running Container (#2793)

2023-05-16 16:56:52 -04:00

lateral_movement_ssh_process_launched_inside_a_container.toml

[New Rule] SSH Process Launched From Inside A Container (#2794)

2023-05-16 17:32:58 -04:00

persistence_ssh_authorized_keys_modification_inside_a_container.toml

[New Rule] SSH Authorized Keys File Modified Inside a Container (#2792)

2023-05-16 16:30:17 -04:00