security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
c5ce910d3aabd61ce640f41b8f34e4fa645811f3
sigma-rules/rules/ml
T
History
Jonhnathan 0aa87d7f4a [Rule Tuning] Unusual Process For a Linux Host (#2445) 
* [Rule Tuning] Unusual Process For a Linux Host

* .
2023-01-23 21:03:29 -03:00
..
command_and_control_ml_packetbeat_dns_tunneling.toml
min_stack all rules to 8.3 (#2259)
2022-08-24 10:38:49 -06:00
command_and_control_ml_packetbeat_rare_dns_question.toml
min_stack all rules to 8.3 (#2259)
2022-08-24 10:38:49 -06:00
command_and_control_ml_packetbeat_rare_urls.toml
min_stack all rules to 8.3 (#2259)
2022-08-24 10:38:49 -06:00
command_and_control_ml_packetbeat_rare_user_agent.toml
min_stack all rules to 8.3 (#2259)
2022-08-24 10:38:49 -06:00
credential_access_ml_auth_spike_in_failed_logon_events.toml
min_stack all rules to 8.3 (#2259)
2022-08-24 10:38:49 -06:00
credential_access_ml_auth_spike_in_logon_events_from_a_source_ip.toml
min_stack all rules to 8.3 (#2259)
2022-08-24 10:38:49 -06:00
credential_access_ml_auth_spike_in_logon_events.toml
min_stack all rules to 8.3 (#2259)
2022-08-24 10:38:49 -06:00
credential_access_ml_linux_anomalous_metadata_process.toml
min_stack all rules to 8.3 (#2259)
2022-08-24 10:38:49 -06:00
credential_access_ml_linux_anomalous_metadata_user.toml
min_stack all rules to 8.3 (#2259)
2022-08-24 10:38:49 -06:00
credential_access_ml_suspicious_login_activity.toml
min_stack all rules to 8.3 (#2259)
2022-08-24 10:38:49 -06:00
credential_access_ml_windows_anomalous_metadata_process.toml
min_stack all rules to 8.3 (#2259)
2022-08-24 10:38:49 -06:00
credential_access_ml_windows_anomalous_metadata_user.toml
min_stack all rules to 8.3 (#2259)
2022-08-24 10:38:49 -06:00
discovery_ml_linux_system_information_discovery.toml
min_stack all rules to 8.3 (#2259)
2022-08-24 10:38:49 -06:00
discovery_ml_linux_system_network_configuration_discovery.toml
min_stack all rules to 8.3 (#2259)
2022-08-24 10:38:49 -06:00
discovery_ml_linux_system_network_connection_discovery.toml
min_stack all rules to 8.3 (#2259)
2022-08-24 10:38:49 -06:00
discovery_ml_linux_system_process_discovery.toml
min_stack all rules to 8.3 (#2259)
2022-08-24 10:38:49 -06:00
discovery_ml_linux_system_user_discovery.toml
min_stack all rules to 8.3 (#2259)
2022-08-24 10:38:49 -06:00
execution_ml_windows_anomalous_script.toml
[Rule Tuning] Link Elastic Security Labs content to compatible rules (#2388)
2022-11-07 15:17:49 -05:00
initial_access_ml_auth_rare_hour_for_a_user_to_logon.toml
min_stack all rules to 8.3 (#2259)
2022-08-24 10:38:49 -06:00
initial_access_ml_auth_rare_source_ip_for_a_user.toml
min_stack all rules to 8.3 (#2259)
2022-08-24 10:38:49 -06:00
initial_access_ml_auth_rare_user_logon.toml
min_stack all rules to 8.3 (#2259)
2022-08-24 10:38:49 -06:00
initial_access_ml_linux_anomalous_user_name.toml
min_stack all rules to 8.3 (#2259)
2022-08-24 10:38:49 -06:00
initial_access_ml_windows_anomalous_user_name.toml
min_stack all rules to 8.3 (#2259)
2022-08-24 10:38:49 -06:00
initial_access_ml_windows_rare_user_type10_remote_login.toml
min_stack all rules to 8.3 (#2259)
2022-08-24 10:38:49 -06:00
ml_high_count_network_denies.toml
min_stack all rules to 8.3 (#2259)
2022-08-24 10:38:49 -06:00
ml_high_count_network_events.toml
min_stack all rules to 8.3 (#2259)
2022-08-24 10:38:49 -06:00
ml_linux_anomalous_network_activity.toml
min_stack all rules to 8.3 (#2259)
2022-08-24 10:38:49 -06:00
ml_linux_anomalous_network_port_activity.toml
min_stack all rules to 8.3 (#2259)
2022-08-24 10:38:49 -06:00
ml_packetbeat_rare_server_domain.toml
min_stack all rules to 8.3 (#2259)
2022-08-24 10:38:49 -06:00
ml_rare_destination_country.toml
min_stack all rules to 8.3 (#2259)
2022-08-24 10:38:49 -06:00
ml_spike_in_traffic_to_a_country.toml
min_stack all rules to 8.3 (#2259)
2022-08-24 10:38:49 -06:00
ml_windows_anomalous_network_activity.toml
min_stack all rules to 8.3 (#2259)
2022-08-24 10:38:49 -06:00
persistence_ml_linux_anomalous_process_all_hosts.toml
min_stack all rules to 8.3 (#2259)
2022-08-24 10:38:49 -06:00
persistence_ml_rare_process_by_host_linux.toml
[Rule Tuning] Unusual Process For a Linux Host (#2445)
2023-01-23 21:03:29 -03:00
persistence_ml_rare_process_by_host_windows.toml
[Rule Tuning] Add tags to flag Sysmon-only rules & Modify Investigation Guide-related tag (#2352)
2022-11-18 12:32:27 -03:00
persistence_ml_windows_anomalous_path_activity.toml
min_stack all rules to 8.3 (#2259)
2022-08-24 10:38:49 -06:00
persistence_ml_windows_anomalous_process_all_hosts.toml
min_stack all rules to 8.3 (#2259)
2022-08-24 10:38:49 -06:00
persistence_ml_windows_anomalous_process_creation.toml
min_stack all rules to 8.3 (#2259)
2022-08-24 10:38:49 -06:00
persistence_ml_windows_anomalous_service.toml
min_stack all rules to 8.3 (#2259)
2022-08-24 10:38:49 -06:00
privilege_escalation_ml_linux_anomalous_sudo_activity.toml
min_stack all rules to 8.3 (#2259)
2022-08-24 10:38:49 -06:00
privilege_escalation_ml_windows_rare_user_runas_event.toml
min_stack all rules to 8.3 (#2259)
2022-08-24 10:38:49 -06:00
resource_development_ml_linux_anomalous_compiler_activity.toml
min_stack all rules to 8.3 (#2259)
2022-08-24 10:38:49 -06:00