Jonhnathan 5a9f86e665 [Rule Tuning] Misc Rule Tuning (#5858) ...

* [Rule Tuning] Misc Rule Tuning

* Update defense_evasion_elastic_agent_service_terminated.toml

(cherry picked from commit 38e1456eca)

2026-03-23 16:04:46 +00:00

..

.gitkeep

[FR] Add support for building block rules (BBR) (#2822)

2023-06-20 09:00:30 -04:00

collection_archive_data_zip_imageload.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

collection_common_compressed_archived_file.toml

[Rule Tuning] Windows Misc BBR Tuning (#4368)

2025-01-13 12:03:40 -03:00

collection_files_staged_in_recycle_bin_root.toml

Prep main for 9.1 (#4555)

2025-03-26 11:04:14 -04:00

collection_microsoft_purview_dlp_signal.toml

[New Rule] Microsoft UAL Security-Related Building-Block Signals (#5746)

2026-02-25 17:14:14 +00:00

collection_microsoft_purview_insider_risk_signal.toml

[New Rule] Microsoft UAL Security-Related Building-Block Signals (#5746)

2026-02-25 17:14:14 +00:00

collection_outlook_email_archive.toml

Prep main for 9.1 (#4555)

2025-03-26 11:04:14 -04:00

collection_posh_compression.toml

[Rule Tuning] PowerShell Rules Revamp - 9 (#5706)

2026-02-18 15:26:50 +00:00

command_and_control_bitsadmin_activity.toml

Prep main for 9.1 (#4555)

2025-03-26 11:04:14 -04:00

command_and_control_certutil_network_connection.toml

Prep main for 9.1 (#4555)

2025-03-26 11:04:14 -04:00

command_and_control_ollama_model_download_untrusted_source.toml

[New Rules] Ollama Detections (#5546)

2026-01-12 17:09:12 +00:00

credential_access_entra_id_risk_detection_signal.toml

[New Rule] Microsoft UAL Security-Related Building-Block Signals (#5746)

2026-02-25 17:14:14 +00:00

credential_access_iis_apppoolsa_pwd_appcmd.toml

Prep main for 9.1 (#4555)

2025-03-26 11:04:14 -04:00

credential_access_mdmp_file_creation.toml

[Rule Tuning] Windows Misc BBR Tuning (#4368)

2025-01-13 12:03:40 -03:00

credential_access_mdmp_file_unusual_extension.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

credential_access_win_private_key_access.toml

Prep main for 9.1 (#4555)

2025-03-26 11:04:14 -04:00

defense_evasion_aws_rds_snapshot_created.toml

[New BBR] AWS RDS DB Snapshot Created (#3828)

2024-06-27 23:59:33 -04:00

defense_evasion_cmd_copy_binary_contents.toml

Prep main for 9.1 (#4555)

2025-03-26 11:04:14 -04:00

defense_evasion_cmstp_execution.toml

Prep main for 9.1 (#4555)

2025-03-26 11:04:14 -04:00

defense_evasion_collection_masquerading_unusual_archive_file_extension.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

defense_evasion_dll_hijack.toml

Monthly Schema Updates (#5046)

2025-09-01 20:42:42 +05:30

defense_evasion_dotnet_clickonce_dfsvc_netcon.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

defense_evasion_download_susp_extension.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

defense_evasion_execution_via_visualstudio_prebuildevent.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

defense_evasion_file_permission_modification.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

defense_evasion_generic_deletion.toml

[Rule Tuning] Misc Rule Tuning (#5858)

2026-03-23 16:04:46 +00:00

defense_evasion_indirect_command_exec_pcalua_forfiles.toml

Prep main for 9.1 (#4555)

2025-03-26 11:04:14 -04:00

defense_evasion_injection_from_msoffice.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

defense_evasion_installutil_command_activity.toml

Prep main for 9.1 (#4555)

2025-03-26 11:04:14 -04:00

defense_evasion_invalid_codesign_imageload.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

defense_evasion_masquerading_browsers.toml

Refresh ecs, beats, integration manifests & schemas (#4699)

2025-05-05 23:06:40 +05:30

defense_evasion_masquerading_unusual_exe_file_extension.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

defense_evasion_masquerading_vlc_dll.toml

Refresh ecs, beats, integration manifests & schemas (#4699)

2025-05-05 23:06:40 +05:30

defense_evasion_masquerading_windows_dll.toml

Monthly Schema Updates (#5046)

2025-09-01 20:42:42 +05:30

defense_evasion_masquerading_windows_system32_exe.toml

Refresh ecs, beats, integration manifests & schemas (#4699)

2025-05-05 23:06:40 +05:30

defense_evasion_microsoft_security_compliance_admin_signal.toml

[New Rule] Microsoft UAL Security-Related Building-Block Signals (#5746)

2026-02-25 17:14:14 +00:00

defense_evasion_msdt_suspicious_diagcab.toml

Prep main for 9.1 (#4555)

2025-03-26 11:04:14 -04:00

defense_evasion_msiexec_installsource_archive_file.toml

[Rule Tuning] Windows Registry Rules Tuning - 2 (#3958)

2024-08-06 17:15:08 +05:30

defense_evasion_outlook_suspicious_child.toml

Refresh ecs, beats, integration manifests & schemas (#4699)

2025-05-05 23:06:40 +05:30

defense_evasion_posh_obfuscation_proportion_special_chars.toml

[Rule Tuning] PowerShell Rules Revamp - 9 (#5706)

2026-02-18 15:26:50 +00:00

defense_evasion_powershell_clear_logs_script.toml

[Rule Tuning] PowerShell Rules Revamp - 9 (#5706)

2026-02-18 15:26:50 +00:00

defense_evasion_service_disabled_registry.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

defense_evasion_service_path_registry.toml

Prep main for 9.1 (#4555)

2025-03-26 11:04:14 -04:00

defense_evasion_services_exe_path.toml

Prep main for 9.1 (#4555)

2025-03-26 11:04:14 -04:00

defense_evasion_suspicious_msiexec_execution.toml

Prep main for 9.1 (#4555)

2025-03-26 11:04:14 -04:00

defense_evasion_unsigned_bits_client.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

defense_evasion_unusual_process_extension.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

defense_evasion_unusual_process_path_wbem.toml

Prep main for 9.1 (#4555)

2025-03-26 11:04:14 -04:00

defense_evasion_write_dac_access.toml

Prep main for 9.1 (#4555)

2025-03-26 11:04:14 -04:00

discovery_capnetraw_capability.toml

[Rule Tuning] Linux DR BBR Tuning (#5514)

2026-01-07 16:52:40 +01:00

discovery_ec2_multi_region_describe_instances.toml

[Rule Tunings] AWS Multiple API Calls ESQL rules (#5238)

2025-12-08 10:31:09 -05:00

discovery_files_dir_systeminfo_via_cmd.toml

Prep main for 9.1 (#4555)

2025-03-26 11:04:14 -04:00

discovery_generic_account_groups.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

discovery_generic_process_discovery.toml

[Tuning] Top Noisy Windows BBR (#5480)

2025-12-18 16:01:58 +00:00

discovery_generic_registry_query.toml

[Rule Tuning] Lookback Times for Okta Multiple Session and AWS KMS Retrieval Rules (#4324)

2024-12-19 13:03:50 -05:00

discovery_getconf_execution.toml

[Rule Tuning] Linux DR BBR Tuning (#5514)

2026-01-07 16:52:40 +01:00

discovery_hosts_file_access.toml

[Rule Tuning] Linux DR BBR Tuning (#5514)

2026-01-07 16:52:40 +01:00

discovery_internet_capabilities.toml

[Rule Tuning] Windows Misc Tunings (#5740)

2026-02-20 17:15:30 +00:00

discovery_kernel_module_enumeration_via_proc.toml

[Rule Tuning] Linux DR BBR Tuning (#5514)

2026-01-07 16:52:40 +01:00

discovery_kubectl_configuration_discovery.toml

[Rule Tuning] Adding D4C Compatibility to Compatible Container-Related Rules (#5685)

2026-02-06 08:42:54 +00:00

discovery_kubectl_workload_and_cluster_discovery.toml

[Rule Tuning] Adding D4C Compatibility to Compatible Container-Related Rules (#5685)

2026-02-06 08:42:54 +00:00

discovery_linux_modprobe_enumeration.toml

[Rule Tuning] Linux DR BBR Tuning (#5514)

2026-01-07 16:52:40 +01:00

discovery_linux_sysctl_enumeration.toml

[Rule Tuning] Linux DR BBR Tuning (#5514)

2026-01-07 16:52:40 +01:00

discovery_linux_system_information_discovery.toml

[Rule Tuning] agent.id --> host.id new_terms Key Modification (#5802)

2026-03-02 12:28:20 +00:00

discovery_linux_system_owner_user_discovery.toml

[Rule Tuning] agent.id --> host.id new_terms Key Modification (#5802)

2026-03-02 12:28:20 +00:00

discovery_net_share_discovery_winlog.toml

Prep main for 9.1 (#4555)

2025-03-26 11:04:14 -04:00

discovery_net_view.toml

Prep main for 9.1 (#4555)

2025-03-26 11:04:14 -04:00

discovery_of_accounts_or_groups_via_builtin_tools.toml

[Rule Tuning] agent.id --> host.id new_terms Key Modification (#5802)

2026-03-02 12:28:20 +00:00

discovery_of_domain_groups.toml

[Rule Tuning] Adds Crowdstrike Compatibility to Linux Process Rules (#5232)

2025-11-10 16:03:39 +01:00

discovery_posh_generic.toml

[Rule Deprecation] PowerShell Rules (#5707)

2026-02-11 19:53:27 +00:00

discovery_posh_password_policy.toml

[Rule Tuning] PowerShell Rules Revamp - 9 (#5706)

2026-02-18 15:26:50 +00:00

discovery_post_exploitation_external_ip_lookup.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

discovery_potential_memory_seeking_activity.toml

[Rule Tuning] Linux DR BBR Tuning (#5514)

2026-01-07 16:52:40 +01:00

discovery_process_discovery_via_builtin_tools.toml

[Rule Tuning] agent.id --> host.id new_terms Key Modification (#5802)

2026-03-02 12:28:20 +00:00

discovery_remote_system_discovery_commands_windows.toml

Prep main for 9.1 (#4555)

2025-03-26 11:04:14 -04:00

discovery_security_software_wmic.toml

Prep main for 9.1 (#4555)

2025-03-26 11:04:14 -04:00

discovery_signal_unusual_user_host.toml

[Rule Tuning] Windows Misc Tunings (#5740)

2026-02-20 17:15:30 +00:00

discovery_suspicious_proc_enumeration.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

discovery_system_network_connections.toml

[Rule Tuning] agent.id --> host.id new_terms Key Modification (#5802)

2026-03-02 12:28:20 +00:00

discovery_system_service_discovery.toml

[Tuning] Top Noisy Windows BBR (#5480)

2025-12-18 16:01:58 +00:00

discovery_system_time_discovery.toml

Prep main for 9.1 (#4555)

2025-03-26 11:04:14 -04:00

discovery_win_network_connections.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

discovery_windows_system_information_discovery.toml

Prep main for 9.1 (#4555)

2025-03-26 11:04:14 -04:00

entra_id_identity_protection_risk_detections.toml

[Rule Tuning] Update Azure / M365 Rule Names and File Paths (#5172)

2025-12-10 12:59:50 -05:00

execution_aws_lambda_function_updated.toml

Testcase to check if Rule Type: BBR tag is present for all BBR rules (#4048)

2024-09-02 21:29:31 +05:30

execution_github_new_event_action_for_pat.toml

[Rule Tuning] Linux DR BBR Tuning (#5514)

2026-01-07 16:52:40 +01:00

execution_github_new_repo_interaction_for_pat.toml

[Rule Tuning] Linux DR BBR Tuning (#5514)

2026-01-07 16:52:40 +01:00

execution_github_new_repo_interaction_for_user.toml

[Rule Tuning] Linux DR BBR Tuning (#5514)

2026-01-07 16:52:40 +01:00

execution_github_repo_created.toml

Prep for Release 9.0 (#4550)

2025-03-20 20:32:07 +05:30

execution_github_repo_interaction_from_new_ip.toml

[Rule Tuning] Linux DR BBR Tuning (#5514)

2026-01-07 16:52:40 +01:00

execution_linux_segfault.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

execution_mcp_server_child_process.toml

[New Rule] Execution via OpenClaw Agent (#5666)

2026-02-04 20:06:58 +00:00

execution_settingcontent_ms_file_creation.toml

Prep main for 9.1 (#4555)

2025-03-26 11:04:14 -04:00

execution_unsigned_service_executable.toml

[Rule Tuning] Windows Misc Tunings (#5740)

2026-02-20 17:15:30 +00:00

execution_wmi_wbemtest.toml

Prep main for 9.1 (#4555)

2025-03-26 11:04:14 -04:00

impact_azure_recovery_services_deletion.toml

[New Rule] Azure Recovery Services Deletion (#5214)

2025-10-17 10:11:10 -04:00

impact_github_member_removed_from_organization.toml

Prep for Release 9.0 (#4550)

2025-03-20 20:32:07 +05:30

impact_github_pat_access_revoked.toml

Prep for Release 9.0 (#4550)

2025-03-20 20:32:07 +05:30

impact_github_user_blocked_from_organization.toml

Prep for Release 9.0 (#4550)

2025-03-20 20:32:07 +05:30

initial_access_anomalous_rsc_flight_data_patterns.toml

[New Rule] React2Shell Detection (#5408)

2025-12-05 18:37:54 -05:00

initial_access_aws_signin_token_created.toml

[Rule Tuning][New BBR Rule] AWS Sign-In Token Creation and Console Login (#5197)

2025-10-16 12:47:30 -04:00

initial_access_github_new_ip_address_for_pat.toml

[Rule Tuning] Linux DR BBR Tuning (#5514)

2026-01-07 16:52:40 +01:00

initial_access_github_new_ip_address_for_user.toml

[Rule Tuning] Linux DR BBR Tuning (#5514)

2026-01-07 16:52:40 +01:00

initial_access_github_new_user_agent_for_pat.toml

[Rule Tuning] Linux DR BBR Tuning (#5514)

2026-01-07 16:52:40 +01:00

initial_access_github_new_user_agent_for_user.toml

[Rule Tuning] Linux DR BBR Tuning (#5514)

2026-01-07 16:52:40 +01:00

initial_access_microsoft_air_investigation_signal.toml

[New Rule] Microsoft UAL Security-Related Building-Block Signals (#5746)

2026-02-25 17:14:14 +00:00

initial_access_microsoft_defender_alerts_signal.toml

[New Rule] Microsoft UAL Security-Related Building-Block Signals (#5746)

2026-02-25 17:14:14 +00:00

initial_access_microsoft_defender_threat_intelligence_signal.toml

[New Rule] Microsoft UAL Security-Related Building-Block Signals (#5746)

2026-02-25 17:14:14 +00:00

initial_access_microsoft_purview_security_compliance_signal.toml

[New Rule] Microsoft UAL Security-Related Building-Block Signals (#5746)

2026-02-25 17:14:14 +00:00

initial_access_microsoft_quarantine_hygiene_signal.toml

[New Rule] Microsoft UAL Security-Related Building-Block Signals (#5746)

2026-02-25 17:14:14 +00:00

initial_access_new_okta_authentication_behavior.toml

[Rule Tuning] New Okta Authentication Behavior Detected (#5542)

2026-01-12 09:01:32 -05:00

initial_access_okta_admin_console_login_failure.toml

[New Rule] Okta Admin Console Login Failure (#5669)

2026-02-17 15:05:13 +00:00

initial_access_potential_rce_via_toolshell.toml

[New Rule] Toolshell Exploit Chain Detections (#4928)

2025-08-29 15:17:52 -04:00

initial_access_potential_toolshell_exploit_attempt.toml

[New Rule] Toolshell Exploit Chain Detections (#4928)

2025-08-29 15:17:52 -04:00

lateral_movement_at.toml

Prep main for 9.1 (#4555)

2025-03-26 11:04:14 -04:00

lateral_movement_posh_winrm_activity.toml

[Rule Deprecation] PowerShell Rules (#5707)

2026-02-11 19:53:27 +00:00

lateral_movement_rdp_conn_unusual_process.toml

Testcase to check if Rule Type: BBR tag is present for all BBR rules (#4048)

2024-09-02 21:29:31 +05:30

lateral_movement_unusual_process_sql_accounts.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

lateral_movement_wmic_remote.toml

Prep main for 9.1 (#4555)

2025-03-26 11:04:14 -04:00

persistence_aws_iam_login_profile_added_to_user.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

persistence_github_new_pat_for_user.toml

[Rule Tuning] Linux DR BBR Tuning (#5514)

2026-01-07 16:52:40 +01:00

persistence_github_new_user_added_to_organization.toml

Prep for Release 9.0 (#4550)

2025-03-20 20:32:07 +05:30

persistence_iam_instance_request_to_iam_service.toml

[Rule Tuning] Add Investigation Fields to Specific AWS Rules (#4261)

2024-11-08 23:11:18 -05:00

persistence_startup_folder_lnk.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

persistence_transport_agent_exchange.toml

[Rule Deprecation] PowerShell Rules (#5707)

2026-02-11 19:53:27 +00:00

persistence_web_server_potential_sql_injection.toml

[Rule Tuning] Added Traefik Compatibility to Web Server Access Rules (#5837)

2026-03-17 16:35:46 +00:00

persistence_web_server_sus_file_creation.toml

[Rule Tuning] Linux DR BBR Tuning (#5514)

2026-01-07 16:52:40 +01:00

privilege_escalation_sts_getsessiontoken_abuse.toml

[Rule Tuning] AWS GetSessionToken Abuse (#5274)

2025-11-14 04:14:13 -05:00