Ruben Groenewoud ec223a4a05 [New Rule] Suspicious File Modification (#3746) ...

* [New Rule] Suspicious File Modification

* Update persistence_suspicious_file_modifications.toml

* Update rules/linux/persistence_suspicious_file_modifications.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/linux/persistence_suspicious_file_modifications.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Updates

* Update rules/integrations/fim/persistence_suspicious_file_modifications.toml

---------

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>

2024-06-11 13:03:20 +02:00

..

data

[FR] Add Support for ES|QL Rule Type and Remote Validation (#3281)

2023-12-08 12:46:28 -07:00

kuery

[Bug] KQL fails validation on uppercase keywords (#3568)

2024-04-04 18:03:30 -04:00

__init__.py

[FR] Add host family to data path (#2839)

2023-06-12 16:03:33 -04:00

base.py

[FR] Add support for building block rules (BBR) (#2822)

2023-06-20 09:00:30 -04:00

test_all_rules.py

[New Rule] Suspicious File Modification (#3746)

2024-06-11 13:03:20 +02:00

test_gh_workflows.py

[Bug] Fix test_matrix_to_lock_version_defaults test (#2014)

2022-06-02 16:34:54 -08:00

test_hunt_data.py

[FR] Add Hunt Structure and Initial LLM Queries 🚀 (#3637)

2024-05-03 09:33:06 -05:00

test_mappings.py

react_sync_rta_updates_3575 (#3762)

2024-06-07 00:12:37 +05:30

test_packages.py

[FR] Normalize yml ext to yaml (#3675)

2024-05-15 15:18:39 -05:00

test_python_library.py

[Bug] Query validation failing to capture InSet edge case with ip field types (#3572)

2024-05-06 07:58:42 -04:00

test_rules_remote.py

[FR] Add Support for ES|QL Rule Type and Remote Validation (#3281)

2023-12-08 12:46:28 -07:00

test_schemas.py

[FR] Adapt PyPi semver Library and Remove Custom (#2503)

2023-02-07 14:26:29 -05:00

test_specific_rules.py

[Bug] Fix test_os_and_platform_in_query test and rules (#3695)

2024-05-20 08:43:30 -07:00

test_toml_formatter.py

Test to trigger workflows (#1612)

2021-11-15 10:02:31 -09:00

test_transform_fields.py

Make call to TOMLRuleContents.to_dict from TOMLRuleContents.to_api_format (#2742)

2023-04-25 12:33:43 -04:00

test_utils.py

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

test_version_locking.py

[Bug] Removed Strip Calls in Favor of F-Strings with Major and Minor Versions (#2541)

2023-02-10 13:18:53 -05:00