security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
78577873283f890bd36296889f809a4f8647e410
sigma-rules/rules/ml
T
History
Craig Chamberlain 4473f6d8f3 [New Rule] Unusual Sudo Activity (#263) 
* Create ml_linux_anomalous_sudo_activity.toml

rule to accompany the unusual sudo activity job

* Update ml_linux_anomalous_sudo_activity.toml

added fp field

* Update ml_linux_anomalous_sudo_activity.toml

* Update ml_linux_anomalous_sudo_activity.toml

linting

* Update ml_linux_anomalous_sudo_activity.toml

* Update ml_linux_anomalous_sudo_activity.toml

* Update rules/ml/ml_linux_anomalous_sudo_activity.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update ml_linux_anomalous_sudo_activity.toml

* Update ml_linux_anomalous_sudo_activity.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
2020-09-24 14:55:33 -04:00
..
ml_cloudtrail_error_message_spike.toml
Add ECS 1.6.0 schema for validation testing (#220)
2020-08-27 11:54:49 -05:00
ml_cloudtrail_rare_error_code.toml
Add ECS 1.6.0 schema for validation testing (#220)
2020-08-27 11:54:49 -05:00
ml_cloudtrail_rare_method_by_city.toml
Add ECS 1.6.0 schema for validation testing (#220)
2020-08-27 11:54:49 -05:00
ml_cloudtrail_rare_method_by_country.toml
Add ECS 1.6.0 schema for validation testing (#220)
2020-08-27 11:54:49 -05:00
ml_cloudtrail_rare_method_by_user.toml
Add ECS 1.6.0 schema for validation testing (#220)
2020-08-27 11:54:49 -05:00
ml_linux_anomalous_compiler_activity.toml
[New Rule] Anomalous Linux Compiler Activity (#262)
2020-09-22 16:24:32 -04:00
ml_linux_anomalous_kernel_module_arguments.toml
Refresh ATT&CK data to v7.2 and expand threat validation (#330)
2020-09-23 22:03:29 -08:00
ml_linux_anomalous_metadata_process.toml
[New Rule] Unusual Process Calling the Metadata Service [Linux] (#321)
2020-09-23 15:29:48 -04:00
ml_linux_anomalous_network_activity.toml
Add ECS 1.6.0 schema for validation testing (#220)
2020-08-27 11:54:49 -05:00
ml_linux_anomalous_network_port_activity.toml
Add ECS 1.6.0 schema for validation testing (#220)
2020-08-27 11:54:49 -05:00
ml_linux_anomalous_network_service.toml
Add ECS 1.6.0 schema for validation testing (#220)
2020-08-27 11:54:49 -05:00
ml_linux_anomalous_network_url_activity.toml
Add ECS 1.6.0 schema for validation testing (#220)
2020-08-27 11:54:49 -05:00
ml_linux_anomalous_process_all_hosts.toml
Add ECS 1.6.0 schema for validation testing (#220)
2020-08-27 11:54:49 -05:00
ml_linux_anomalous_sudo_activity.toml
[New Rule] Unusual Sudo Activity (#263)
2020-09-24 14:55:33 -04:00
ml_linux_anomalous_user_name.toml
Add ECS 1.6.0 schema for validation testing (#220)
2020-08-27 11:54:49 -05:00
ml_linux_system_information_discovery.toml
Refresh ATT&CK data to v7.2 and expand threat validation (#330)
2020-09-23 22:03:29 -08:00
ml_linux_system_network_configuration_discovery.toml
[New Rule] Unusual Linux System Network Configuration Discovery (#265)
2020-09-24 09:07:34 -04:00
ml_linux_system_network_connection_discovery.toml
Refresh ATT&CK data to v7.2 and expand threat validation (#330)
2020-09-23 22:03:29 -08:00
ml_linux_system_process_discovery.toml
[New Rule] Unusual Linux Process Discovery Activity (#261)
2020-09-22 16:15:36 -04:00
ml_linux_system_user_discovery.toml
Refresh ATT&CK data to v7.2 and expand threat validation (#330)
2020-09-23 22:03:29 -08:00
ml_packetbeat_dns_tunneling.toml
Add ECS 1.6.0 schema for validation testing (#220)
2020-08-27 11:54:49 -05:00
ml_packetbeat_rare_dns_question.toml
Add ECS 1.6.0 schema for validation testing (#220)
2020-08-27 11:54:49 -05:00
ml_packetbeat_rare_server_domain.toml
Add ECS 1.6.0 schema for validation testing (#220)
2020-08-27 11:54:49 -05:00
ml_packetbeat_rare_urls.toml
Add ECS 1.6.0 schema for validation testing (#220)
2020-08-27 11:54:49 -05:00
ml_packetbeat_rare_user_agent.toml
Add ECS 1.6.0 schema for validation testing (#220)
2020-08-27 11:54:49 -05:00
ml_rare_process_by_host_linux.toml
Add ECS 1.6.0 schema for validation testing (#220)
2020-08-27 11:54:49 -05:00
ml_rare_process_by_host_windows.toml
Add ECS 1.6.0 schema for validation testing (#220)
2020-08-27 11:54:49 -05:00
ml_suspicious_login_activity.toml
Add ECS 1.6.0 schema for validation testing (#220)
2020-08-27 11:54:49 -05:00
ml_windows_anomalous_metadata_process.toml
[New Rule] Unusual Process Calling the Metadata Service [Windows] (#323)
2020-09-23 15:50:43 -04:00
ml_windows_anomalous_network_activity.toml
Add ECS 1.6.0 schema for validation testing (#220)
2020-08-27 11:54:49 -05:00
ml_windows_anomalous_path_activity.toml
Add ECS 1.6.0 schema for validation testing (#220)
2020-08-27 11:54:49 -05:00
ml_windows_anomalous_process_all_hosts.toml
Add ECS 1.6.0 schema for validation testing (#220)
2020-08-27 11:54:49 -05:00
ml_windows_anomalous_process_creation.toml
Add ECS 1.6.0 schema for validation testing (#220)
2020-08-27 11:54:49 -05:00
ml_windows_anomalous_script.toml
Add ECS 1.6.0 schema for validation testing (#220)
2020-08-27 11:54:49 -05:00
ml_windows_anomalous_service.toml
Add ECS 1.6.0 schema for validation testing (#220)
2020-08-27 11:54:49 -05:00
ml_windows_anomalous_user_name.toml
Add ECS 1.6.0 schema for validation testing (#220)
2020-08-27 11:54:49 -05:00
ml_windows_rare_user_runas_event.toml
Add ECS 1.6.0 schema for validation testing (#220)
2020-08-27 11:54:49 -05:00
ml_windows_rare_user_type10_remote_login.toml
Add ECS 1.6.0 schema for validation testing (#220)
2020-08-27 11:54:49 -05:00