Ruben Groenewoud 76fdd549a3 [Rule Tuning] Misc. DR Rule Tuning (#3904) ...

* [Rule Tuning] Misc. DR Rule Tuning

* Update execution_unknown_rwx_mem_region_binary_executed.toml

* Update command_and_control_suspicious_network_activity_from_unknown_executable.toml

* I love KQL validation

2024-07-19 15:13:42 +02:00

..

apm_null_user_agent.toml

…

command_and_control_connection_attempt_by_non_ssh_root_session.toml

…

command_and_control_dns_directly_to_the_internet.toml

…

command_and_control_ftp_file_transfer_protocol_activity_to_the_internet.toml

…

command_and_control_irc_internet_relay_chat_protocol_activity_to_the_internet.toml

…

command_and_control_linux_iodine_activity.toml

…

command_and_control_linux_port_knocking_reverse_connection.toml

…

command_and_control_port_8000_activity_to_the_internet.toml

…

command_and_control_pptp_point_to_point_tunneling_protocol_activity.toml

…

command_and_control_proxy_port_activity_to_the_internet.toml

…

command_and_control_smtp_to_the_internet.toml

…

command_and_control_sql_server_port_activity_to_the_internet.toml

…

command_and_control_ssh_secure_shell_from_the_internet.toml

…

command_and_control_ssh_secure_shell_to_the_internet.toml

…

command_and_control_tor_activity_to_the_internet.toml

…

credential_access_potential_linux_ssh_bruteforce_root.toml

…

credential_access_tcpdump_activity.toml

…

defense_evasion_attempt_to_disable_iptables_or_firewall.toml

…

defense_evasion_base64_encoding_or_decoding_activity.toml

…

defense_evasion_code_injection_conhost.toml

…

defense_evasion_execution_via_trusted_developer_utilities.toml

…

defense_evasion_hex_encoding_or_decoding_activity.toml

…

defense_evasion_ld_preload_env_variable_process_injection.toml

…

defense_evasion_mshta_making_network_connections.toml

…

defense_evasion_potential_processherpaderping.toml

…

defense_evasion_whitespace_padding_in_command_line.toml

…

discovery_file_dir_discovery.toml

…

discovery_process_discovery_via_tasklist_command.toml

…

discovery_query_registry_via_reg.toml

…

discovery_whoami_commmand.toml

…

execution_apt_binary.toml

…

execution_awk_binary_shell.toml

…

execution_busybox_binary.toml

…

execution_c89_c99_binary.toml

…

execution_command_shell_started_by_powershell.toml

…

execution_cpulimit_binary.toml

…

execution_crash_binary.toml

…

execution_env_binary.toml

…

execution_expect_binary.toml

…

execution_find_binary.toml

…

execution_flock_binary.toml

…

execution_gcc_binary.toml

…

execution_linux_process_started_in_temp_directory.toml

…

execution_mysql_binary.toml

…

execution_reverse_shell_via_named_pipe.toml

…

execution_shell_suspicious_parent_child_revshell_linux.toml

…

execution_ssh_binary.toml

…

execution_vi_binary.toml

…

execution_via_net_com_assemblies.toml

…

exfiltration_rds_snapshot_export.toml

…

impact_potential_linux_ransomware_file_encryption.toml

[Rule Tuning] Misc. DR Rule Tuning (#3904)

2024-07-19 15:13:42 +02:00

initial_access_login_failures.toml

…

initial_access_login_location.toml

…

initial_access_login_sessions.toml

…

initial_access_login_time.toml

…

initial_access_rdp_remote_desktop_protocol_to_the_internet.toml

…

lateral_movement_malicious_remote_file_creation.toml

…

lateral_movement_remote_file_creation_in_sensitive_directory.toml

…

linux_mknod_activity.toml

…

linux_nmap_activity.toml

…

linux_socat_activity.toml

…

persistence_cron_jobs_creation_and_runtime.toml

…

persistence_google_workspace_user_group_access_modified_to_allow_external_access.toml

…

persistence_kernel_module_activity.toml

…

persistence_shell_activity_by_web_server.toml

…

privilege_escalation_gcp_kubernetes_rolebindings_created_or_patched.toml

…

privilege_escalation_krbrelayup_suspicious_logon.toml

…

privilege_escalation_linux_strace_activity.toml

…

privilege_escalation_printspooler_malicious_driver_file_changes.toml

…

privilege_escalation_printspooler_malicious_registry_modification.toml

…

privilege_escalation_setgid_bit_set_via_chmod.toml

…

threat_intel_filebeat7x.toml

…

threat_intel_filebeat8x.toml

…

threat_intel_fleet_integrations.toml

…