Commits

Branch selector

 main

User selector

All users

Datepicker

All time

Commit History

Commits on May 25, 2022

• [Promote Rule] Potential Invoke-Mimikatz PowerShell Script (elastic#1993)

  Show description for 1f8813d
  

  w0rk3r

  and

  terrancedejesus

  authored
  1f8813d

• Refresh ECS/beats schemas up to 8.2 (elastic#1995)

  brokensound77

  authored
  0428e16

• Skip previous validation on pre/post load/dump (elastic#1942)

  Show description for e1266a6
  Mikaayenson

  authored
  e1266a6

• [New Rule] Elastic Agent Stopped (elastic#1991)

  Show description for cdc5c72
  terrancedejesus

  authored
  cdc5c72

• [Rule tuning] Linux binary(s) shell evasion threat

  Show description for fd7a6d6
  shashank-elastic

  authored
  fd7a6d6

• [Rule tuning] Linux binary(s) shell evasion threat (elastic#1957)

  Show description for 51b2d9d
  

  4 peopleauthored
  51b2d9d

Commits on May 23, 2022

• [Rule tuning] Whitespace Padding in Process Command Line (elastic#1967)

  Show description for 72c186b
  

  brokensound77

  and

  DefSecSentinel

  authored
  72c186b

• [Rule tuning] Unusual Process Execution - Temp (elastic#1968)

  Show description for 1840a63
  

  brokensound77

  and

  terrancedejesus

  authored
  1840a63

Commits on May 20, 2022

• Modifying rules assoc w/ deprecation of v2 ML jobs (elastic#1846)

  Show description for 9a739b7
  

  4 peopleauthored
  9a739b7

• [Rule tuning] add support for osx, zsh, and expand tampering techniques (elastic#1974)

  Show description for 7796647
  Mikaayenson

  authored
  7796647

Commits on May 19, 2022

• [Security Content] 8.3 - Add Investigation Guides (elastic#1937)

  Show description for a1bdf2b
  

  w0rk3r

  and

  DefSecSentinel

  authored
  a1bdf2b

Commits on May 18, 2022

• [Rule tuning] check for anything found in the emondClient directory (elastic#1977)

  Show description for 92640f5
  Mikaayenson

  authored
  92640f5

• [Security Content] Refactor Existing Investigation Guides (elastic#1959)

  Show description for 817b97f
  

  w0rk3r

  and

  nastasha-solomon

  authored
  817b97f

Commits on May 17, 2022

• [Rule Tuning] Update Rule Name: Suspicious Network Connection Attempt Sequence by Root (elastic#1983)

  Show description for d12f45c
  DefSecSentinel

  authored
  d12f45c

Commits on May 16, 2022

• [New Rule] Suspicious Outbound Network Connect Sequence by Root (elastic#1975)

  Show description for c89f423
  

  4 peopleauthored
  c89f423

• Update command_and_control_common_webservices.toml (elastic#1970)

  w0rk3r

  authored
  27e6632

Commits on May 12, 2022

• [New Rule] Abnormal Process ID File Creation (elastic#1964)

  Show description for 1704924
  

  3 peopleauthored
  1704924

Commits on May 11, 2022

• [New rule] Remote Computer Account DnsHostName Update (elastic#1962)

  Show description for 19ff825
  

  Samirbous

  and

  w0rk3r

  authored
  19ff825

• [New Rule] Executable Launched from Shared Memory Directory (elastic#1961)

  Show description for 5f447a6
  

  terrancedejesus

  and

  DefSecSentinel

  authored
  5f447a6

Commits on May 9, 2022

• [Rule tuning] SSH Authorized Keys File Modification (elastic#1955)

  brokensound77

  authored
  c031bb5

Commits on May 6, 2022

• [New Rule] Potential Local NTLM Relay via HTTP (elastic#1947)

  Show description for 03836d4
  

  Samirbous

  and

  DefSecSentinel

  authored
  03836d4

• [Rule Tuning] Update Rule Content Changes from Security Docs Team (elastic#1945)

  Show description for e9f5585
  terrancedejesus

  authored
  e9f5585

Commits on May 4, 2022

• Manually reconciled versions from forked rule package generation bug (elastic#1950)

  brokensound77

  authored
  8168551

Commits on May 3, 2022

• Add delta command to determine changes to endpoint rules between tags (elastic#1943)

  Show description for 22679e1
  brokensound77

  authored
  22679e1

Commits on May 2, 2022

• Move etc under detection_rules (elastic#1885)

  Show description for 6219fc0
  

  Mikaayenson

  and

  brokensound77

  authored
  6219fc0

Commits on Apr 29, 2022

• [New Rule] Service Creation via Local Kerberos Authentication (elastic#1941)

  Show description for 3f047b9
  Samirbous

  authored
  3f047b9

Commits on Apr 28, 2022

• [New Rule] AWS Redshift Cluster Creation (elastic#1921)

  Show description for 3465537
  

  pjhampton

  and

  w0rk3r

  authored
  3465537

Commits on Apr 27, 2022

• [Rule Tuning] Microsoft 365 Inbox Forwarding Rule Created (elastic#1939)

  Show description for f050b0c
  

  w0rk3r

  and

  brokensound77

  authored
  f050b0c

• Detection of suspicious crontab creation or modification (elastic#1938)

  Show description for 88f7123
  

  3 peopleauthored
  88f7123

• Validate version lock and deprecation files on load and save (elastic#1884)

  Show description for c803160
  brokensound77

  authored
  c803160

Commits on Apr 26, 2022

• [New Rule] Potential Privileged Escalation via KrbRelayUp (elastic#1940)

  Show description for a0672c7
  

  3 peopleauthored
  a0672c7

• Review & Fix Invalid References (elastic#1936)

  w0rk3r

  authored
  20d2e92

• [Rule Tuning] Exclude MS OneDrive/Teams from Component Object Model Hijacking (elastic#1932)

  Show description for 5bf321a
  

  3 peopleauthored
  5bf321a

Commits on Apr 22, 2022

• [eql2kql] fix wildcard bug (elastic#1507)

  Show description for 15faf34
  

  3 peopleauthored
  15faf34

Commits on Apr 14, 2022

• Lock versions for releases: 7.13,7.14,7.15,7.16,8.0,8.1,8.2 (elastic#1929)

  Show description for 187c7a4
  

  github-actions[bot]

  and

  terrancedejesus

  authored
  187c7a4

Pagination

PreviousNext