admin/elastic-detection-rules
1
0
Fork 0
mirror of https://github.com/elastic/detection-rules synced 2026-06-08 14:00:08 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
15faf34a2fbb9892e70166fa6ff56a53d7fa5cee
elastic-detection-rules/rules/_deprecated
T
History
Jonhnathan 22dd7f0ada Deprecate PrintNightmare Rules (#1852)
2022-03-17 19:39:36 -03:00
..
command_and_control_ftp_file_transfer_protocol_activity_to_the_internet.toml
[Deprecation] Deprecate inherently noisy rules based on testing (#1122)
2021-04-21 15:10:06 -04:00
command_and_control_irc_internet_relay_chat_protocol_activity_to_the_internet.toml
[Deprecation] Deprecate inherently noisy rules based on testing (#1122)
2021-04-21 15:10:06 -04:00
command_and_control_port_8000_activity_to_the_internet.toml
[Deprecation] Deprecate inherently noisy rules based on testing (#1122)
2021-04-21 15:10:06 -04:00
command_and_control_pptp_point_to_point_tunneling_protocol_activity.toml
[Deprecation] Deprecate inherently noisy rules based on testing (#1122)
2021-04-21 15:10:06 -04:00
command_and_control_proxy_port_activity_to_the_internet.toml
[Deprecation] Deprecate inherently noisy rules based on testing (#1122)
2021-04-21 15:10:06 -04:00
command_and_control_smtp_to_the_internet.toml
[Deprecation] Deprecate inherently noisy rules based on testing (#1122)
2021-04-21 15:10:06 -04:00
command_and_control_sql_server_port_activity_to_the_internet.toml
[Deprecation] Deprecate inherently noisy rules based on testing (#1122)
2021-04-21 15:10:06 -04:00
command_and_control_ssh_secure_shell_from_the_internet.toml
[Rule Tuning] Rule description tweaks (#1388)
2021-07-29 10:56:13 -08:00
command_and_control_ssh_secure_shell_to_the_internet.toml
[Rule Tuning] Rule description tweaks (#1388)
2021-07-29 10:56:13 -08:00
command_and_control_tor_activity_to_the_internet.toml
[Deprecation] Deprecate inherently noisy rules based on testing (#1122)
2021-04-21 15:10:06 -04:00
credential_access_tcpdump_activity.toml
[Deprecation] Deprecate inherently noisy rules based on testing (#1122)
2021-04-21 15:10:06 -04:00
defense_evasion_base64_encoding_or_decoding_activity.toml
[Deprecation] Deprecate inherently noisy rules based on testing (#1122)
2021-04-21 15:10:06 -04:00
defense_evasion_execution_via_trusted_developer_utilities.toml
[Deprecation] Trusted Developer Application Usage (#1118)
2021-04-15 22:15:38 +02:00
defense_evasion_hex_encoding_or_decoding_activity.toml
[Deprecation] Deprecate inherently noisy rules based on testing (#1122)
2021-04-21 15:10:06 -04:00
defense_evasion_mshta_making_network_connections.toml
Add test for improper rule demotion (released production -> development) (#1555)
2021-10-19 21:47:36 -08:00
discovery_process_discovery_via_tasklist_command.toml
[Deprecation] Process Discovery via Tasklist (#1116)
2021-04-15 22:18:56 +02:00
discovery_query_registry_via_reg.toml
[Deprecation] Deprecate inherently noisy rules based on testing (#1122)
2021-04-21 15:10:06 -04:00
discovery_whoami_commmand.toml
[Deprecation] Deprecate inherently noisy rules based on testing (#1122)
2021-04-21 15:10:06 -04:00
execution_command_shell_started_by_powershell.toml
[Deprecation] Deprecate inherently noisy rules based on testing (#1122)
2021-04-21 15:10:06 -04:00
execution_via_net_com_assemblies.toml
[Rule Tuning] Merge and Delete duplicate rules for Registration Utilities (#1028)
2021-03-19 10:05:09 +01:00
exfiltration_rds_snapshot_export.toml
[Bug] Tighten definitions validation patterns (#1396)
2021-10-26 10:26:20 -05:00
initial_access_rdp_remote_desktop_protocol_to_the_internet.toml
[Rule Tuning] Rule description tweaks (#1388)
2021-07-29 10:56:13 -08:00
linux_mknod_activity.toml
[Deprecation] Deprecate inherently noisy rules based on testing (#1122)
2021-04-21 15:10:06 -04:00
linux_nmap_activity.toml
[Deprecation] Deprecate inherently noisy rules based on testing (#1122)
2021-04-21 15:10:06 -04:00
linux_socat_activity.toml
[Deprecation] Deprecate inherently noisy rules based on testing (#1122)
2021-04-21 15:10:06 -04:00
persistence_cron_jobs_creation_and_runtime.toml
[Deprecation] Deprecate inherently noisy rules based on testing (#1122)
2021-04-21 15:10:06 -04:00
persistence_kernel_module_activity.toml
[Deprecation] Deprecate inherently noisy rules based on testing (#1122)
2021-04-21 15:10:06 -04:00
privilege_escalation_printspooler_malicious_driver_file_changes.toml
Deprecate PrintNightmare Rules (#1852)
2022-03-17 19:39:36 -03:00
privilege_escalation_printspooler_malicious_registry_modification.toml
Deprecate PrintNightmare Rules (#1852)
2022-03-17 19:39:36 -03:00
privilege_escalation_setgid_bit_set_via_chmod.toml
Add tests to ensure rules are properly deprecated (#1050)
2021-03-16 21:31:33 -08:00
threat_intel_filebeat7x.toml
[Deprecate Rule] Threat Intel Filebeat Module (v7.x) Indicator Match (#1703)
2022-01-25 16:46:49 -09:00