Commits

Breadcrumbs

History for

onmain

User selector

All users

Datepicker

All time

Commit History

Commits on Apr 24, 2025

• [New Rule] Adding Coverage for `AWS IAM or STS API Calls via Temporary Session Tokens` (#4628)

  Show description for f02ccfe
  

  3 peopleauthored
  f02ccfe

  Copy full SHA for f02ccfe

• [Rule Tuning] O365 Exchange Suspicious Mailbox Right Delegation (#4648)

  imays11

  authored
  b429be2

  Copy full SHA for b429be2

• Fix versions for changes in required_fileds (#4640)

  shashank-elastic

  authored
  3423116

  Copy full SHA for 3423116

• [Rule Tuning] User Added to Privileged Group in Active Directory (#4646)

  Show description for b9ed055
  

  w0rk3r

  and

  shashank-elastic

  authored
  b9ed055

  Copy full SHA for b9ed055

• [Rule Tuning] Replace legacy winlog.api usage (#4647)

  Show description for e8e7697
  

  w0rk3r

  and

  shashank-elastic

  authored
  e8e7697

  Copy full SHA for e8e7697

Commits on Apr 23, 2025

• [New] Suspicious Azure Sign-in via Visual Studio Code (#4639)

  Show description for ea31143
  Samirbous

  authored
  ea31143

  Copy full SHA for ea31143

Commits on Apr 22, 2025

• [New] RemoteMonologue Attack rules (#4604)

  Show description for f8e91be
  

  Samirbous

  and

  w0rk3r

  authored
  f8e91be

  Copy full SHA for f8e91be

• [New Rule] Potential Malicious PowerShell Based on Alert Correlation (#4635)

  Show description for 1bab741
  w0rk3r

  authored
  1bab741

  Copy full SHA for 1bab741

• [Deprecate] LaunchDaemon Creation or Modification and Immediate Loading (#4547)

  DefSecSentinel

  authored
  c80319d

  Copy full SHA for c80319d

• [New Rule] Potential PowerShell Obfuscation via String Reordering (#4595)

  Show description for 8361cfd
  w0rk3r

  authored
  8361cfd

  Copy full SHA for 8361cfd

• [New Rule] Threat Intel Email Indicator Match (#4598)

  Show description for 364d9dd
  

  w0rk3r

  and

  imays11

  authored
  364d9dd

  Copy full SHA for 364d9dd

• [Rule Tuning] Potential DLL Side-Loading via Trusted Microsoft Programs (#4627)

  w0rk3r

  authored
  a495b4b

  Copy full SHA for a495b4b

• [New Rule] Dynamic IEX Reconstruction via Method String Access (#4634)

  w0rk3r

  authored
  a9f9913

  Copy full SHA for a9f9913

Commits on Apr 21, 2025

• [Tuning] MacOS DR Tuning PR (#4546)

  Show description for 4ef7245
  

  DefSecSentinel

  and

  shashank-elastic

  authored
  4ef7245

  Copy full SHA for 4ef7245

• [New Rule] Adding Coverage for `AWS CLI with Kali Linux Fingerprint Identified` (#4625)

  Show description for c58d59e
  

  terrancedejesus

  and

  DefSecSentinel

  authored
  c58d59e

  Copy full SHA for c58d59e

• [New Rule] Adding Coverage for `AWS IAM Virtual MFA Device Registration` (#4626)

  Show description for 9423779
  

  terrancedejesus

  and

  DefSecSentinel

  authored
  9423779

  Copy full SHA for 9423779

Commits on Apr 17, 2025

• [New Rule] Adding Coverage for AWS Temporary User Session Token Used from Multiple Addresses (#4624)

  Show description for 96c2d0c
  

  terrancedejesus

  and

  DefSecSentinel

  authored
  96c2d0c

  Copy full SHA for 96c2d0c

Commits on Apr 16, 2025

• [Rule Tuning] Tuning `Azure Service Principal Credentials Added` (#4570)

  Show description for ba16e27
  terrancedejesus

  authored
  ba16e27

  Copy full SHA for ba16e27

• [Rule Tuning] Adjusting `Microsoft Entra ID Rare Authentication Requirement for Principal User` (#4562)

  Show description for 1a6669e
  terrancedejesus

  authored
  1a6669e

  Copy full SHA for 1a6669e

• [Rule Tuning] Suspicious WMI Event Subscription Created (#4618)

  Show description for e11fe78
  w0rk3r

  authored
  e11fe78

  Copy full SHA for e11fe78

Commits on Apr 15, 2025

• [Rule Tuning] SSH Authorized Keys File Deletion (#4591)

  Show description for 3eed0f5
  

  w0rk3r

  and

  Mikaayenson

  authored
  3eed0f5

  Copy full SHA for 3eed0f5

Commits on Apr 10, 2025

• [D4C Conversion] Converting Compatible D4C Rules to DR (#4532)

  Show description for 3b1f780
  

  5 peopleauthored
  3b1f780

  Copy full SHA for 3b1f780

Commits on Apr 8, 2025

• [FN Tuning] Shared Object Created or Changed by Previously Unknown Pr… (#4529)

  Show description for 05c9f6b
  

  5 peopleauthored
  05c9f6b

  Copy full SHA for 05c9f6b

Commits on Apr 7, 2025

• [Rule Tuning] Suspicious Execution via Scheduled Task (#4599)

  w0rk3r

  authored
  a5d9d64

  Copy full SHA for a5d9d64

• Add investigation guides (#4600)

  shashank-elastic

  authored
  3966981

  Copy full SHA for 3966981

• [Rule Tuning] Add Host Metadata to ES|QL Aggregation Rules (#4592)

  Show description for 9577d53
  

  w0rk3r

  and

  Mikaayenson

  authored
  9577d53

  Copy full SHA for 9577d53

Commits on Apr 3, 2025

• [New] Unusual Network Connection to Suspicious Top Level Domain (#4563)

  DefSecSentinel

  authored
  753e8d8

  Copy full SHA for 753e8d8

• [New] Unusual Network Connection to Suspicious Web Service (#4569)

  Show description for d4b2a35
  

  3 peopleauthored
  d4b2a35

  Copy full SHA for d4b2a35

Commits on Apr 2, 2025

• [Rule Tuning] O365 Exchange Suspicious Mailbox Right Delegation (#4589)

  w0rk3r

  authored
  e7806fc

  Copy full SHA for e7806fc

Commits on Apr 1, 2025

• Update defense_evasion_microsoft_defender_tampering.toml (#4573)

  Show description for 6d8cfda
  

  Samirbous

  and

  w0rk3r

  authored
  6d8cfda

  Copy full SHA for 6d8cfda

Commits on Mar 27, 2025

• [Rule Tuning] Tuning Illicit Grant Consent Detections in Azure and M365 (#4557)

  Show description for c6e37d6
  terrancedejesus

  authored
  c6e37d6

  Copy full SHA for c6e37d6

• tuning 'Azure Conditional Access Policy Modified' (#4558)

  terrancedejesus

  authored
  2801406

  Copy full SHA for 2801406

• deprecating 'Azure Virtual Network Device Modified or Deleted' (#4559)

  terrancedejesus

  authored
  2f3f4fb

  Copy full SHA for 2f3f4fb

• Update Max signals value to supported limits (#4556)

  shashank-elastic

  authored
  2b3095a

  Copy full SHA for 2b3095a

Commits on Mar 26, 2025

• [Rule Tuning] Added OWA (outlook for web) new AppID (#4568)

  Show description for 63c1f47
  BugOrFeature

  authored
  63c1f47

  Copy full SHA for 63c1f47

Pagination

Previous

Next