elastic-detection-rules

mirror of https://github.com/elastic/detection-rules synced 2026-06-08 14:00:08 +00:00

Files

T

yuriShafet 5e30c40b7b [Rule Tuning] Machine Learning Detected a Suspicious Windows Event with a High Malicious Probability Score (#5523 ) (#5686 )

Add EQL exclusions for benign activity:
Opera GX renderer children,
Slack creating slack children,
Node using playwright to create chrome process
Python editors accessing reg.exe
Logitech manager activity
 and Zabbix script paths.

(cherry picked from commit 64cca9e1ba)

2026-02-05 20:58:20 +00:00

defense_evasion_ml_rare_process_for_a_host.toml

Prep main for 9.1 (#4555 )

2025-03-26 11:04:14 -04:00

defense_evasion_ml_rare_process_for_a_parent_process.toml

Prep main for 9.1 (#4555 )

2025-03-26 11:04:14 -04:00

defense_evasion_ml_rare_process_for_a_user.toml

Prep main for 9.1 (#4555 )

2025-03-26 11:04:14 -04:00

defense_evasion_ml_suspicious_windows_event_high_probability.toml

[Rule Tuning] Machine Learning Detected a Suspicious Windows Event with a High Malicious Probability Score (#5523 ) (#5686 )