Mika Ayenson, PhD b322b7505c [Rule Tuning] Add Supplemental Mitre Mappings (#5876) ...

---------

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>
Co-authored-by: terrancedejesus <terrance.dejesus@elastic.co>
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
Co-authored-by: eric-forte-elastic <eric.forte@elastic.co>

(cherry picked from commit 8993d1450b)

2026-04-01 14:16:50 +00:00

..

command_and_control_ml_packetbeat_dns_tunneling.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:16:50 +00:00

command_and_control_ml_packetbeat_rare_dns_question.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:16:50 +00:00

command_and_control_ml_packetbeat_rare_urls.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:16:50 +00:00

command_and_control_ml_packetbeat_rare_user_agent.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

credential_access_ml_auth_spike_in_failed_logon_events.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:16:50 +00:00

credential_access_ml_auth_spike_in_logon_events_from_a_source_ip.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:16:50 +00:00

credential_access_ml_auth_spike_in_logon_events.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:16:50 +00:00

credential_access_ml_linux_anomalous_metadata_process.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

credential_access_ml_linux_anomalous_metadata_user.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

credential_access_ml_suspicious_login_activity.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

credential_access_ml_windows_anomalous_metadata_process.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:16:50 +00:00

credential_access_ml_windows_anomalous_metadata_user.toml

Prep main for 9.1 (#4555)

2025-03-26 11:04:14 -04:00

discovery_ml_linux_system_information_discovery.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

discovery_ml_linux_system_network_configuration_discovery.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

discovery_ml_linux_system_network_connection_discovery.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

discovery_ml_linux_system_process_discovery.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

discovery_ml_linux_system_user_discovery.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

execution_ml_windows_anomalous_script.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:16:50 +00:00

initial_access_ml_auth_rare_hour_for_a_user_to_logon.toml

Adding setup templates to the ML rules (#3798)

2024-06-19 10:04:41 -04:00

initial_access_ml_auth_rare_source_ip_for_a_user.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:16:50 +00:00

initial_access_ml_auth_rare_user_logon.toml

Adding setup templates to the ML rules (#3798)

2024-06-19 10:04:41 -04:00

initial_access_ml_linux_anomalous_user_name.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

initial_access_ml_windows_anomalous_user_name.toml

Prep main for 9.1 (#4555)

2025-03-26 11:04:14 -04:00

initial_access_ml_windows_rare_user_type10_remote_login.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:16:50 +00:00

ml_high_count_events_for_a_host_name.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:16:50 +00:00

ml_high_count_network_denies.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:16:50 +00:00

ml_high_count_network_events.toml

add mitre attack rules for ML job rules, bump dates (#5333)

2025-12-01 15:48:59 -06:00

ml_linux_anomalous_network_activity.toml

add mitre attack rules for ML job rules, bump dates (#5333)

2025-12-01 15:48:59 -06:00

ml_linux_anomalous_network_port_activity.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:16:50 +00:00

ml_low_count_events_for_a_host_name.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:16:50 +00:00

ml_packetbeat_rare_server_domain.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:16:50 +00:00

ml_rare_destination_country.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:16:50 +00:00

ml_spike_in_traffic_to_a_country.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:16:50 +00:00

ml_windows_anomalous_network_activity.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:16:50 +00:00

persistence_ml_linux_anomalous_process_all_hosts.toml

Adding setup templates to the ML rules (#3798)

2024-06-19 10:04:41 -04:00

persistence_ml_rare_process_by_host_linux.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

persistence_ml_rare_process_by_host_windows.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:16:50 +00:00

persistence_ml_windows_anomalous_path_activity.toml

Prep main for 9.1 (#4555)

2025-03-26 11:04:14 -04:00

persistence_ml_windows_anomalous_process_all_hosts.toml

Prep main for 9.1 (#4555)

2025-03-26 11:04:14 -04:00

persistence_ml_windows_anomalous_process_creation.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:16:50 +00:00

persistence_ml_windows_anomalous_service.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:16:50 +00:00

privilege_escalation_ml_linux_anomalous_sudo_activity.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

privilege_escalation_ml_windows_rare_user_runas_event.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:16:50 +00:00

resource_development_ml_linux_anomalous_compiler_activity.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:16:50 +00:00