Commits

Branch selector

 main

User selector

All users

Datepicker

All time

Commit History

Commits on Jul 15, 2024

• [New Rules] Docker Entrypoint Netcon / Nsenter Escape (elastic#3883)

  Show description for 56e8e05
  Aegrah

  authored
  56e8e05

• [New Rules] DPKG Execution/Installation (elastic#3879)

  Show description for 82a0cc8
  Aegrah

  authored
  82a0cc8

• [Rule Tuning] Suspicious DLL Loaded for Persistence or Privilege Escalation (elastic#3887)

  w0rk3r

  authored
  ffb6817

Commits on Jul 12, 2024

• [FR] Support new_terms schema import/export w/custom format (elastic#3890)

  Show description for 2110ad5
  Mikaayenson

  authored
  2110ad5

Commits on Jul 11, 2024

• [Bug] Hunting - Add UTF-8 Encoding for all Read and Write Operations (elastic#3886)

  Show description for bd345d4
  terrancedejesus

  authored
  bd345d4

• [FR] Add API auth to Kibana module (elastic#3815)

  Show description for 361e97a
  

  brokensound77

  and

  eric-forte-elastic

  authored
  361e97a

• [Rule Tunings] Change from to prevent double alerts (elastic#3868)

  imays11

  authored
  44658ea

• [Rule Tunings] AWS Administrator Access Policy Attached Rules (elastic#3867)

  Show description for f0ab897
  imays11

  authored
  f0ab897

• [Rule BugFix] Google Workspace Oauth2 new app (elastic#3436)

  Show description for 80ac279
  

  3 peopleauthored
  80ac279

• [Tuning & Changes] Misc rule/hunt tuning (elastic#3875)

  Show description for 21485b1
  Aegrah

  authored
  21485b1

Commits on Jul 10, 2024

• [FR] Detection Rule PR Guidelines and Issue Forms (elastic#3850)

  Mikaayenson

  authored
  c62321f

• Unit Test to validate from field in toml file (elastic#3866)

  shashank-elastic

  authored
  59a10be

• [Bug] Normalize Hunting Index Link Generation (elastic#3872)

  Show description for 7041166
  terrancedejesus

  authored
  7041166

• [Rule Tuning] Fix event.action conditions - AD Rules (elastic#3874)

  w0rk3r

  authored
  6e7ece4

• [Rule Tuning] LSASS Memory Dump Creation (elastic#3810)

  Show description for b303b82
  

  ar3diu

  and

  Andrei Rediu

  authored
  b303b82

Commits on Jul 9, 2024

• Added Schema Check for Data View ID and Index (elastic#3830)

  eric-forte-elastic

  authored
  ec6038b

• Lock versions for releases: 8.9,8.10,8.11,8.12,8.13,8.14 (elastic#3880)

  github-actions[bot]

  authored
  6a28881

• Fix Double Bump For Rule Microsoft Management Console File from Unusual Path (elastic#3878)

  shashank-elastic

  authored
  b66d6e0

Commits on Jul 8, 2024

• [Rule Tuning] Tune Attempts to Brute Force a Microsoft 365 User Account (elastic#3860)

  Show description for 7f3c977
  

  3 peopleauthored
  7f3c977

• [New Hunt] Persistence through System V Init (elastic#3871)

  Show description for b230f83
  

  3 peopleauthored
  b230f83

• [Bug] Persistence ssh key generation index pattern (elastic#3873)

  Show description for 6a2f5e7
  

  joe-desimone

  and

  Aegrah

  authored
  6a2f5e7

• Use command masquerading in linux_compress rta script (elastic#3782)

  jesse-sant

  authored
  c32e17c

Commits on Jul 5, 2024

• [New Hunt] Add Initial Linux Hunting Files (elastic#3847)

  Show description for f0b2cb7
  

  3 peopleauthored
  f0b2cb7

• [New Rule] AWS S3 Object Encryption Using External KMS Key (elastic#3861)

  Show description for 215d5a0
  imays11

  authored
  215d5a0

• Update defense_evasion_deletion_of_bash_command_line_history.toml (elastic#3614)

  Show description for 1d57e0c
  

  3 peopleauthored
  1d57e0c

• [New Rule] Linux Shadow File Modification (elastic#3737)

  Show description for 64f0e25
  

  Aegrah

  and

  Mikaayenson

  authored
  64f0e25

• [New] Sensitive Registry Hive Access via RegBack (elastic#3855)

  Show description for 801aab8
  

  Samirbous

  and

  w0rk3r

  authored
  801aab8

• [Tuning] Ransomware over SMB (elastic#3808)

  Show description for 15e9c9a
  

  Samirbous

  and

  Mikaayenson

  authored
  15e9c9a

• [Tuning] Suspicious Microsoft 365 Mail Access by ClientAppId (elastic#3685)

  Show description for cd716e5
  

  Samirbous

  and

  Mikaayenson

  authored
  cd716e5

Commits on Jul 4, 2024

• [Rule Tuning] LSASS Process Access via Windows API (elastic#3824)

  Show description for 8dc0963
  

  3 peopleauthored
  8dc0963

• [New Rule] Potential PowerShell Obfuscated Script (elastic#3864)

  Show description for 208e330
  

  w0rk3r

  and

  Mikaayenson

  authored
  208e330

Commits on Jul 3, 2024

• [Rule Tuning] Suspicious Inter-Process Communication via Outlook elastic#3803 (elastic#3806)

  Show description for 5048bc2
  

  5 peopleauthored
  5048bc2

• Test case to check updated_date (elastic#3818)

  shashank-elastic

  authored
  50f0fb3

• [New Rule] AWS RDS DB Instance Made Public (elastic#3836)

  Show description for 83be212
  

  imays11

  and

  terrancedejesus

  authored
  83be212

Commits on Jul 2, 2024

• [New Rule] AWS RDS DB Instance or Cluster Deletion Protection Disabled (elastic#3851)

  Show description for 3a5c5c2
  imays11

  authored
  3a5c5c2

Pagination

PreviousNext