Ruben Groenewoud a7ff449fbc [Rule Tuning] Some Tunings of several 8.9 rules (#2985) ...

* [Rule Tuning] Doing some quick tunings

* updated_date bump

* Update rules/linux/discovery_linux_modprobe_enumeration.toml

* Update rules/linux/discovery_linux_modprobe_enumeration.toml

* Update rules/linux/discovery_linux_sysctl_enumeration.toml

* Update rules/linux/persistence_init_d_file_creation.toml

* Update rules/linux/persistence_rc_script_creation.toml

* Update rules/linux/persistence_shared_object_creation.toml

* deprecate rule

* deprecate rule

* Update execution_abnormal_process_id_file_created.toml

* Update discovery_kernel_module_enumeration_via_proc.toml

* Update discovery_linux_modprobe_enumeration.toml

* Update execution_remote_code_execution_via_postgresql.toml

* Update discovery_potential_syn_port_scan_detected.toml

* Added 2 tunings, sorry I missed those..

* One more tune

* Update discovery_suspicious_proc_enumeration.toml

2023-08-03 15:25:33 +02:00

..

command_and_control_accepted_default_telnet_port_connection.toml

[Rule Tuning] Change Network Rules to Use Network Packet Capture Integration (#2665)

2023-06-26 17:35:49 -04:00

command_and_control_cobalt_strike_beacon.toml

[Rule Tuning] Change Network Rules to Use Network Packet Capture Integration (#2665)

2023-06-26 17:35:49 -04:00

command_and_control_cobalt_strike_default_teamserver_cert.toml

[Rule Tuning] Change Network Rules to Use Network Packet Capture Integration (#2665)

2023-06-26 17:35:49 -04:00

command_and_control_download_rar_powershell_from_internet.toml

[Rule Tuning] Change Network Rules to Use Network Packet Capture Integration (#2665)

2023-06-26 17:35:49 -04:00

command_and_control_fin7_c2_behavior.toml

[Rule Tuning] Change Network Rules to Use Network Packet Capture Integration (#2665)

2023-06-26 17:35:49 -04:00

command_and_control_halfbaked_beacon.toml

[Rule Tuning] Change Network Rules to Use Network Packet Capture Integration (#2665)

2023-06-26 17:35:49 -04:00

command_and_control_nat_traversal_port_activity.toml

[Rule Tuning] Change Network Rules to Use Network Packet Capture Integration (#2665)

2023-06-26 17:35:49 -04:00

command_and_control_port_26_activity.toml

[Rule Tuning] Change Network Rules to Use Network Packet Capture Integration (#2665)

2023-06-26 17:35:49 -04:00

command_and_control_rdp_remote_desktop_protocol_from_the_internet.toml

[Rule Tuning] Change Network Rules to Use Network Packet Capture Integration (#2665)

2023-06-26 17:35:49 -04:00

command_and_control_vnc_virtual_network_computing_from_the_internet.toml

[Rule Tuning] Change Network Rules to Use Network Packet Capture Integration (#2665)

2023-06-26 17:35:49 -04:00

command_and_control_vnc_virtual_network_computing_to_the_internet.toml

[Rule Tuning] Change Network Rules to Use Network Packet Capture Integration (#2665)

2023-06-26 17:35:49 -04:00

discovery_potential_network_sweep_detected.toml

[Rule Tuning] Some Tunings of several 8.9 rules (#2985)

2023-08-03 15:25:33 +02:00

discovery_potential_port_scan_detected.toml

[Rule Tuning] Some Tunings of several 8.9 rules (#2985)

2023-08-03 15:25:33 +02:00

discovery_potential_syn_port_scan_detected.toml

[Rule Tuning] Some Tunings of several 8.9 rules (#2985)

2023-08-03 15:25:33 +02:00

initial_access_rpc_remote_procedure_call_from_the_internet.toml

[Rule Tuning] Change Network Rules to Use Network Packet Capture Integration (#2665)

2023-06-26 17:35:49 -04:00

initial_access_rpc_remote_procedure_call_to_the_internet.toml

[Rule Tuning] Change Network Rules to Use Network Packet Capture Integration (#2665)

2023-06-26 17:35:49 -04:00

initial_access_smb_windows_file_sharing_activity_to_the_internet.toml

[Rule Tuning] Change Network Rules to Use Network Packet Capture Integration (#2665)

2023-06-26 17:35:49 -04:00

initial_access_unsecure_elasticsearch_node.toml

[Rule Tuning] Change Network Rules to Use Network Packet Capture Integration (#2665)

2023-06-26 17:35:49 -04:00

lateral_movement_dns_server_overflow.toml

[Rule Tuning] Change Network Rules to Use Network Packet Capture Integration (#2665)

2023-06-26 17:35:49 -04:00