Commit Graph

  • 621476b646 patch bump action_support_updates eric-forte-elastic 2026-06-08 09:55:34 -04:00
  • a2c35179ca Merge branch 'main' into action_support_updates Eric Forte 2026-06-08 09:53:20 -04:00
  • af25a58e6e Fix stack-dependent related_integrations.version export (#6208) 9.4 Mika Ayenson, PhD 2026-06-05 17:23:45 -05:00
  • 3dd5497c22 Fix stack-dependent related_integrations.version export (#6208) 9.3 Mika Ayenson, PhD 2026-06-05 17:23:45 -05:00
  • adf12e8e22 Fix stack-dependent related_integrations.version export (#6208) 9.2 Mika Ayenson, PhD 2026-06-05 17:23:45 -05:00
  • 19cbe50917 Fix stack-dependent related_integrations.version export (#6208) 8.19 Mika Ayenson, PhD 2026-06-05 17:23:45 -05:00
  • 1bc3dc0636 Fix stack-dependent related_integrations.version export (#6208) main dev-v1.6.49 Mika Ayenson, PhD 2026-06-05 17:23:45 -05:00
  • b33b6faa6c Merge branch 'main' into action_support_updates Eric Forte 2026-06-05 17:59:39 -04:00
  • 5baa90c5f6 [New] Entra ID Microsoft Authentication Broker DRS Sign-In from Susp ASN (#6190) Samirbous 2026-05-29 11:35:28 +01:00
  • f0012d8770 [New] Entra ID Microsoft Authentication Broker DRS Sign-In from Susp ASN (#6190) Samirbous 2026-05-29 11:35:28 +01:00
  • 322f96d64b [New] Entra ID Microsoft Authentication Broker DRS Sign-In from Susp ASN (#6190) Samirbous 2026-05-29 11:35:28 +01:00
  • 63154f626f [New] Entra ID Microsoft Authentication Broker DRS Sign-In from Susp ASN (#6190) Samirbous 2026-05-29 11:35:28 +01:00
  • 1a40600a18 Apply suggestion from @Mikaayenson new-rule/azure-ad-graph-unusual-client-and-user Terrance DeJesus 2026-06-05 17:26:56 -04:00
  • ceef9033c5 Merge branch 'main' into new-rule/m365-device-code-grant-unusual-asn new-rule/m365-device-code-grant-unusual-asn Terrance DeJesus 2026-06-05 17:26:39 -04:00
  • c375d2708d [New Rule] AWS Bedrock Foundation Model Enumeration Followed by Invocation via Long-Term Key (#6239) Bryan Porras 2026-06-05 17:49:12 +02:00
  • 223234e646 [New Rule] AWS Bedrock Foundation Model Enumeration Followed by Invocation via Long-Term Key (#6239) Bryan Porras 2026-06-05 17:49:12 +02:00
  • 59968be6fe [New Rule] AWS Bedrock Foundation Model Enumeration Followed by Invocation via Long-Term Key (#6239) Bryan Porras 2026-06-05 17:49:12 +02:00
  • 2d16550241 [New Rule] AWS Bedrock Foundation Model Enumeration Followed by Invocation via Long-Term Key (#6239) Bryan Porras 2026-06-05 17:49:12 +02:00
  • ef0e11ef90 Merge branch 'main' into new-rule/azure-ad-graph-unusual-client-and-user Mika Ayenson, PhD 2026-06-05 12:24:22 -05:00
  • ff09b91deb [New Rule] AWS Bedrock High-Frequency Single-Model Inference API Probing (#6256) Bryan Porras 2026-06-05 18:07:01 +02:00
  • c4ba75d0cc [New Rule] AWS Bedrock High-Frequency Single-Model Inference API Probing (#6256) Bryan Porras 2026-06-05 18:07:01 +02:00
  • 4d32700863 [New Rule] AWS Bedrock High-Frequency Single-Model Inference API Probing (#6256) Bryan Porras 2026-06-05 18:07:01 +02:00
  • ccb0623589 [New Rule] AWS Bedrock High-Frequency Single-Model Inference API Probing (#6256) Bryan Porras 2026-06-05 18:07:01 +02:00
  • da13fa8481 [New Rule] AWS Bedrock High-Frequency Single-Model Inference API Probing (#6256) Bryan Porras 2026-06-05 18:07:01 +02:00
  • b3f4efe623 [New Rule] AWS Bedrock Third-Party or External Knowledge Base Associated to Agent (#6246) Bryan Porras 2026-06-05 17:48:48 +02:00
  • fb8e1c170d [New Rule] AWS Bedrock Third-Party or External Knowledge Base Associated to Agent (#6246) Bryan Porras 2026-06-05 17:48:48 +02:00
  • d30ea961b6 [New Rule] AWS Bedrock Third-Party or External Knowledge Base Associated to Agent (#6246) Bryan Porras 2026-06-05 17:48:48 +02:00
  • 565521f1e7 [New Rule] AWS Bedrock Third-Party or External Knowledge Base Associated to Agent (#6246) Bryan Porras 2026-06-05 17:48:48 +02:00
  • 7fde397312 [New Rule] AWS Bedrock Foundation Model Enumeration Followed by Invocation via Long-Term Key (#6239) Bryan Porras 2026-06-05 17:49:12 +02:00
  • d2220defcd [New Rule] AWS Bedrock Third-Party or External Knowledge Base Associated to Agent (#6246) Bryan Porras 2026-06-05 17:48:48 +02:00
  • f8c34b6dd2 [Rule Tuning] Switch AWS Bedrock Knowledge Base or RAG Data Source Poisoning to New Terms (#6257) Bryan Porras 2026-06-05 17:32:14 +02:00
  • f947c8dadf [Rule Tuning] Switch AWS Bedrock Knowledge Base or RAG Data Source Poisoning to New Terms (#6257) Bryan Porras 2026-06-05 17:32:14 +02:00
  • 5ef01ab968 [Rule Tuning] Switch AWS Bedrock Knowledge Base or RAG Data Source Poisoning to New Terms (#6257) Bryan Porras 2026-06-05 17:32:14 +02:00
  • 1932ebd45b [Rule Tuning] Switch AWS Bedrock Knowledge Base or RAG Data Source Poisoning to New Terms (#6257) Bryan Porras 2026-06-05 17:32:14 +02:00
  • 2af73815ee [Rule Tuning] Switch AWS Bedrock Knowledge Base or RAG Data Source Poisoning to New Terms (#6257) Bryan Porras 2026-06-05 17:32:14 +02:00
  • 943387304e [New Rule] AWS Bedrock Agent Created by IAM User or Root (#6242) Bryan Porras 2026-06-05 17:02:32 +02:00
  • 93244c3209 [New Rule] AWS Bedrock Agent Created by IAM User or Root (#6242) Bryan Porras 2026-06-05 17:02:32 +02:00
  • e8fa43aa0b [New Rule] AWS Bedrock Agent Created by IAM User or Root (#6242) Bryan Porras 2026-06-05 17:02:32 +02:00
  • aacbdd6630 [New Rule] AWS Bedrock Knowledge Base or RAG Data Source Poisoning (#6240) Bryan Porras 2026-06-05 17:00:30 +02:00
  • 2415172320 [New Rule] AWS Bedrock Agent Created by IAM User or Root (#6242) Bryan Porras 2026-06-05 17:02:32 +02:00
  • 3ab8ba8253 [New Rule] AWS Bedrock Knowledge Base or RAG Data Source Poisoning (#6240) Bryan Porras 2026-06-05 17:00:30 +02:00
  • 16d1e6d626 [New Rule] AWS Bedrock Knowledge Base or RAG Data Source Poisoning (#6240) Bryan Porras 2026-06-05 17:00:30 +02:00
  • dc52cb2f5b [New Rule] AWS Bedrock Agent Created by IAM User or Root (#6242) Bryan Porras 2026-06-05 17:02:32 +02:00
  • e46105b6a6 [New Rule] AWS Bedrock Knowledge Base or RAG Data Source Poisoning (#6240) Bryan Porras 2026-06-05 17:00:30 +02:00
  • 30a91699be [New Rule] AWS Bedrock Knowledge Base or RAG Data Source Poisoning (#6240) Bryan Porras 2026-06-05 17:00:30 +02:00
  • 80fd1b0bcb [New Rule] AWS Bedrock Resource-Based Policy Modified or Deleted & AWS Bedrock Unauthorized Resource-Based Policy Modification Attempt (#6245) Bryan Porras 2026-06-05 16:53:24 +02:00
  • 07e1dd2f36 [New Rule] AWS Bedrock Resource-Based Policy Modified or Deleted & AWS Bedrock Unauthorized Resource-Based Policy Modification Attempt (#6245) Bryan Porras 2026-06-05 16:53:24 +02:00
  • 8b865011a3 [New Rule] AWS Bedrock Resource-Based Policy Modified or Deleted & AWS Bedrock Unauthorized Resource-Based Policy Modification Attempt (#6245) Bryan Porras 2026-06-05 16:53:24 +02:00
  • 3d01efdd45 [New Rule] AWS Bedrock Resource-Based Policy Modified or Deleted & AWS Bedrock Unauthorized Resource-Based Policy Modification Attempt (#6245) Bryan Porras 2026-06-05 16:53:24 +02:00
  • 281bdee6fd [New Rule] AWS Bedrock Resource-Based Policy Modified or Deleted & AWS Bedrock Unauthorized Resource-Based Policy Modification Attempt (#6245) Bryan Porras 2026-06-05 16:53:24 +02:00
  • 120b9ae8cb [New Rule] AWS Bedrock Automated Reasoning Safety Policy Tampering (#6235) Bryan Porras 2026-06-05 16:46:37 +02:00
  • b5ca681a72 [New Rule] AWS Bedrock Automated Reasoning Safety Policy Tampering (#6235) Bryan Porras 2026-06-05 16:46:37 +02:00
  • 25a9cbef41 [New Rule] AWS Bedrock Automated Reasoning Safety Policy Tampering (#6235) Bryan Porras 2026-06-05 16:46:37 +02:00
  • 115dd7b5f1 [New Rule] AWS Bedrock Automated Reasoning Safety Policy Tampering (#6235) Bryan Porras 2026-06-05 16:46:37 +02:00
  • abe5b9d4b2 [New Rule] AWS Bedrock Automated Reasoning Safety Policy Tampering (#6235) Bryan Porras 2026-06-05 16:46:37 +02:00
  • 177f48a922 [New Rule] AWS Bedrock Guardrail Deleted or Weakened (#6236) Bryan Porras 2026-06-05 16:40:43 +02:00
  • 15269e7201 [New Rule] AWS Bedrock Guardrail Deleted or Weakened (#6236) Bryan Porras 2026-06-05 16:40:43 +02:00
  • d82bd60f10 [New Rule] AWS Bedrock Guardrail Deleted or Weakened (#6236) Bryan Porras 2026-06-05 16:40:43 +02:00
  • a6a7e19f67 [New Rule] AWS Bedrock Guardrail Deleted or Weakened (#6236) Bryan Porras 2026-06-05 16:40:43 +02:00
  • a549b66c8c [New Rule] AWS Bedrock Guardrail Deleted or Weakened (#6236) Bryan Porras 2026-06-05 16:40:43 +02:00
  • 57a5fd4110 [New Rule] AWS Bedrock Model Invocation Logging Disabled or Modified (#6237) Bryan Porras 2026-06-05 16:33:05 +02:00
  • ace551f002 [New Rule] AWS Bedrock Model Invocation Logging Disabled or Modified (#6237) Bryan Porras 2026-06-05 16:33:05 +02:00
  • 5d822579e8 [New Rule] AWS Bedrock Model Invocation Logging Disabled or Modified (#6237) Bryan Porras 2026-06-05 16:33:05 +02:00
  • 908a2bbca1 [New Rule] AWS Bedrock Model Invocation Logging Disabled or Modified (#6237) Bryan Porras 2026-06-05 16:33:05 +02:00
  • 96c73f74ce [New Rule] AWS Bedrock Model Invocation Logging Disabled or Modified (#6237) Bryan Porras 2026-06-05 16:33:05 +02:00
  • 18d5490897 [New Rule] AWS Bedrock Provisioned Model Throughput Tampering (#6241) Bryan Porras 2026-06-05 16:21:38 +02:00
  • ab2779800f [New Rule] AWS Bedrock Provisioned Model Throughput Tampering (#6241) Bryan Porras 2026-06-05 16:21:38 +02:00
  • 04692d8e55 [New Rule] AWS Bedrock Provisioned Model Throughput Tampering (#6241) Bryan Porras 2026-06-05 16:21:38 +02:00
  • feb5521f4b [New Rule] AWS Bedrock Foundation Model Access Enabled or Entitlement Granted & AWS Bedrock Unauthorized Foundation Model Access Attempt (#6244) Bryan Porras 2026-06-05 16:19:40 +02:00
  • 498bca3f61 [New Rule] AWS Bedrock Provisioned Model Throughput Tampering (#6241) Bryan Porras 2026-06-05 16:21:38 +02:00
  • 8c98646fed [New Rule] AWS Bedrock Foundation Model Access Enabled or Entitlement Granted & AWS Bedrock Unauthorized Foundation Model Access Attempt (#6244) Bryan Porras 2026-06-05 16:19:40 +02:00
  • c07b8336e4 [New Rule] AWS Bedrock Agent or Action Group Manipulation (#6243) Bryan Porras 2026-06-05 16:18:12 +02:00
  • 29f9baa220 [New Rule] AWS Bedrock Foundation Model Access Enabled or Entitlement Granted & AWS Bedrock Unauthorized Foundation Model Access Attempt (#6244) Bryan Porras 2026-06-05 16:19:40 +02:00
  • bde4c5ceb8 [New Rule] AWS Bedrock Provisioned Model Throughput Tampering (#6241) Bryan Porras 2026-06-05 16:21:38 +02:00
  • 6c172be5ea [New Rule] AWS Bedrock Foundation Model Access Enabled or Entitlement Granted & AWS Bedrock Unauthorized Foundation Model Access Attempt (#6244) Bryan Porras 2026-06-05 16:19:40 +02:00
  • 343fb05f3d [New Rule] AWS Bedrock Agent or Action Group Manipulation (#6243) Bryan Porras 2026-06-05 16:18:12 +02:00
  • 96b65fa73e [New Rule] AWS Bedrock Agent or Action Group Manipulation (#6243) Bryan Porras 2026-06-05 16:18:12 +02:00
  • 065d55e478 [New Rule] AWS Bedrock Agent or Action Group Manipulation (#6243) Bryan Porras 2026-06-05 16:18:12 +02:00
  • 05545d9ae4 [New Rule] AWS Bedrock Foundation Model Access Enabled or Entitlement Granted & AWS Bedrock Unauthorized Foundation Model Access Attempt (#6244) Bryan Porras 2026-06-05 16:19:40 +02:00
  • 00c4b45152 [New Rule] AWS Bedrock Agent or Action Group Manipulation (#6243) Bryan Porras 2026-06-05 16:18:12 +02:00
  • 38955ddacd [New Rule] AWS Bedrock Untrusted Model Imported or Marketplace Endpoint Registered (#6247) Bryan Porras 2026-06-05 16:07:15 +02:00
  • 6796fa540a [New Rule] AWS Bedrock Untrusted Model Imported or Marketplace Endpoint Registered (#6247) Bryan Porras 2026-06-05 16:07:15 +02:00
  • 5b04b2780b [New Rule] AWS Bedrock Untrusted Model Imported or Marketplace Endpoint Registered (#6247) Bryan Porras 2026-06-05 16:07:15 +02:00
  • d3b3ba7c1c [New Rule] AWS Bedrock Untrusted Model Imported or Marketplace Endpoint Registered (#6247) Bryan Porras 2026-06-05 16:07:15 +02:00
  • df4a4121d0 [New Rule] AWS Bedrock Untrusted Model Imported or Marketplace Endpoint Registered (#6247) Bryan Porras 2026-06-05 16:07:15 +02:00
  • 72eac5eab7 Potential fix for pull request finding systemd-override-conf-new-rule Ruben Groenewoud 2026-06-05 15:25:22 +02:00
  • 2d2c1cd4d1 Update defense_evasion_wsl_filesystem.toml fn-tuning-wsl-file-creation Ruben Groenewoud 2026-06-05 13:22:10 +02:00
  • 6c0e70e46a [Rule Tuning] Host File System Changes via Windows Subsystem for Linux Ruben Groenewoud 2026-06-05 13:16:36 +02:00
  • c417620865 Update persistence_systemd_override_conf_creation.toml Ruben Groenewoud 2026-06-05 11:33:03 +02:00
  • 3fb424b4f3 Name bump Ruben Groenewoud 2026-06-05 10:33:49 +02:00
  • f1fc5fc24c ++ Ruben Groenewoud 2026-06-05 10:33:31 +02:00
  • ab7c1b500b [New Rule] Systemd Override Configuration File Created Ruben Groenewoud 2026-06-05 10:29:18 +02:00
  • 5cefb56e06 increase thresholds 6195-rule-tuning-multiple-alerts-in-different-attck-tactics-on-a-single-host-b946c2f7-df06-4c00-a5aa-1f6fbc7bb72c Mika Ayenson 2026-06-04 13:07:24 -05:00
  • 6ed5a8c37d Merge branch 'main' into new-rule/azure-ad-graph-4xx-burst new-rule/azure-ad-graph-4xx-burst Terrance DeJesus 2026-06-04 13:57:58 -04:00
  • c9e458b062 Merge branch 'main' into new-rule/azure-ad-graph-potential-roadrecon-enum new-rule/azure-ad-graph-potential-roadrecon-enum Terrance DeJesus 2026-06-04 13:57:38 -04:00
  • d864645e1d Merge branch 'main' into new-rule/azure-ad-graph-suspicious-user-agent new-rule/azure-ad-graph-suspicious-user-agent Terrance DeJesus 2026-06-04 13:57:21 -04:00
  • 66272ee34e Merge branch 'main' into new-rule/azure-ad-graph-device-code-to-enum new-rule/azure-ad-graph-device-code-to-enum Terrance DeJesus 2026-06-04 13:57:18 -04:00
  • 492a2b0bf9 Merge branch 'main' into new-rule/azure-ad-graph-unusual-client-and-user Terrance DeJesus 2026-06-04 13:57:02 -04:00
  • 385b19192f Merge branch 'main' into new-rule/m365-device-code-grant-unusual-asn Terrance DeJesus 2026-06-04 13:56:54 -04:00
  • e7e713922a removing min-stack requirement Terrance DeJesus 2026-06-04 13:56:25 -04:00