admin/elastic-detection-rules
1
0
Fork 0
mirror of https://github.com/elastic/detection-rules synced 2026-06-08 14:00:08 +00:00
Code Issues Packages Projects Releases Wiki Activity
3,745 Commits 407 Branches 706 Tags
9.3
Commit Graph

3 Commits

Author SHA1 Message Date
Mika Ayenson, PhD b322b7505c [Rule Tuning] Add Supplemental Mitre Mappings (#5876) 
---------

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>
Co-authored-by: terrancedejesus <terrance.dejesus@elastic.co>
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
Co-authored-by: eric-forte-elastic <eric.forte@elastic.co>

(cherry picked from commit 8993d1450b)
 2026-04-01 14:16:50 +00:00
shashank-elastic fe942003a2 Add investigation guide for database dumping activity (#5871) 
(cherry picked from commit 07ccecb94b)
 2026-03-23 16:56:48 +00:00
Ruben Groenewoud 23ee0683ab [New/Tuning] New DB Dump Rule & Tuning wget/curl DRs (#5832) 
* [Rule Tuning] Tuning wget/curl DRs

* [New Rule] Potential Database Dumping Activity

* Update exfiltration_potential_curl_data_exfiltration.toml

* Expand URL patterns in curl data exfiltration rule

* Update rules/linux/exfiltration_potential_wget_data_exfiltration.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* Simplify process name conditions for database dumping

---------

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

(cherry picked from commit a4b614c681)
 2026-03-19 13:02:06 +00:00