Files

 main

/

rules_building_block

/

Copy path

Directory actions

More options

Directory actions

More options

Latest commit

shashank-elastic

Prep main for 9.1 (#4555)

Mar 26, 2025

e8c5416 · Mar 26, 2025

History

History

/

rules_building_block

/

Top

Folders and files

Name		Name	Last commit message	Last commit date
parent directory ..
.gitkeep		.gitkeep	[FR] Add support for building block rules (BBR) (#2822)	Jun 20, 2023
collection_archive_data_zip_imageload.toml		collection_archive_data_zip_imageload.toml	Back-porting Version Trimming (#3704)	May 22, 2024
collection_common_compressed_archived_file.toml		collection_common_compressed_archived_file.toml	[Rule Tuning] Windows Misc BBR Tuning (#4368)	Jan 13, 2025
collection_files_staged_in_recycle_bin_root.toml		collection_files_staged_in_recycle_bin_root.toml	Prep main for 9.1 (#4555)	Mar 26, 2025
collection_outlook_email_archive.toml		collection_outlook_email_archive.toml	Prep main for 9.1 (#4555)	Mar 26, 2025
collection_posh_compression.toml		collection_posh_compression.toml	Prep main for 9.1 (#4555)	Mar 26, 2025
command_and_control_bitsadmin_activity.toml		command_and_control_bitsadmin_activity.toml	Prep main for 9.1 (#4555)	Mar 26, 2025
command_and_control_certutil_network_connection.toml		command_and_control_certutil_network_connection.toml	Prep main for 9.1 (#4555)	Mar 26, 2025
command_and_control_non_standard_http_port.toml		command_and_control_non_standard_http_port.toml	Replace master doc URLs with current (#4439)	Feb 3, 2025
credential_access_iis_apppoolsa_pwd_appcmd.toml		credential_access_iis_apppoolsa_pwd_appcmd.toml	Prep main for 9.1 (#4555)	Mar 26, 2025
credential_access_mdmp_file_creation.toml		credential_access_mdmp_file_creation.toml	[Rule Tuning] Windows Misc BBR Tuning (#4368)	Jan 13, 2025
credential_access_mdmp_file_unusual_extension.toml		credential_access_mdmp_file_unusual_extension.toml	Back-porting Version Trimming (#3704)	May 22, 2024
credential_access_win_private_key_access.toml		credential_access_win_private_key_access.toml	Prep main for 9.1 (#4555)	Mar 26, 2025
defense_evasion_aws_rds_snapshot_created.toml		defense_evasion_aws_rds_snapshot_created.toml	[New BBR] AWS RDS DB Snapshot Created (#3828)	Jun 28, 2024
defense_evasion_cmd_copy_binary_contents.toml		defense_evasion_cmd_copy_binary_contents.toml	Prep main for 9.1 (#4555)	Mar 26, 2025
defense_evasion_cmstp_execution.toml		defense_evasion_cmstp_execution.toml	Prep main for 9.1 (#4555)	Mar 26, 2025
defense_evasion_collection_masquerading_unusual_archive_file_extension.toml		defense_evasion_collection_masquerading_unusual_archive_file_extension.toml	Back-porting Version Trimming (#3704)	May 22, 2024
defense_evasion_dll_hijack.toml		defense_evasion_dll_hijack.toml	Back-porting Version Trimming (#3704)	May 22, 2024
defense_evasion_dotnet_clickonce_dfsvc_netcon.toml		defense_evasion_dotnet_clickonce_dfsvc_netcon.toml	Back-porting Version Trimming (#3704)	May 22, 2024
defense_evasion_download_susp_extension.toml		defense_evasion_download_susp_extension.toml	Back-porting Version Trimming (#3704)	May 22, 2024
defense_evasion_execution_via_visualstudio_prebuildevent.toml		defense_evasion_execution_via_visualstudio_prebuildevent.toml	Back-porting Version Trimming (#3704)	May 22, 2024
defense_evasion_file_permission_modification.toml		defense_evasion_file_permission_modification.toml	Back-porting Version Trimming (#3704)	May 22, 2024
defense_evasion_generic_deletion.toml		defense_evasion_generic_deletion.toml	Back-porting Version Trimming (#3704)	May 22, 2024
defense_evasion_indirect_command_exec_pcalua_forfiles.toml		defense_evasion_indirect_command_exec_pcalua_forfiles.toml	Prep main for 9.1 (#4555)	Mar 26, 2025
defense_evasion_injection_from_msoffice.toml		defense_evasion_injection_from_msoffice.toml	Back-porting Version Trimming (#3704)	May 22, 2024
defense_evasion_installutil_command_activity.toml		defense_evasion_installutil_command_activity.toml	Prep main for 9.1 (#4555)	Mar 26, 2025
defense_evasion_invalid_codesign_imageload.toml		defense_evasion_invalid_codesign_imageload.toml	Back-porting Version Trimming (#3704)	May 22, 2024
defense_evasion_masquerading_browsers.toml		defense_evasion_masquerading_browsers.toml	[Rule Tuning] Windows Misc BBR Tuning (#4368)	Jan 13, 2025
defense_evasion_masquerading_unusual_exe_file_extension.toml		defense_evasion_masquerading_unusual_exe_file_extension.toml	Back-porting Version Trimming (#3704)	May 22, 2024
defense_evasion_masquerading_vlc_dll.toml		defense_evasion_masquerading_vlc_dll.toml	Refresh MITRE Attack v15.1.0 (#3725)	Jun 4, 2024
defense_evasion_masquerading_windows_dll.toml		defense_evasion_masquerading_windows_dll.toml	Refresh MITRE Attack v15.1.0 (#3725)	Jun 4, 2024
defense_evasion_masquerading_windows_system32_exe.toml		defense_evasion_masquerading_windows_system32_exe.toml	Refresh MITRE Attack v15.1.0 (#3725)	Jun 4, 2024
defense_evasion_msdt_suspicious_diagcab.toml		defense_evasion_msdt_suspicious_diagcab.toml	Prep main for 9.1 (#4555)	Mar 26, 2025
defense_evasion_msiexec_installsource_archive_file.toml		defense_evasion_msiexec_installsource_archive_file.toml	[Rule Tuning] Windows Registry Rules Tuning - 2 (#3958)	Aug 6, 2024
defense_evasion_outlook_suspicious_child.toml		defense_evasion_outlook_suspicious_child.toml	[Rule Tuning] Suspicious Communication App Child Process (#4369)	Jan 15, 2025
defense_evasion_posh_defender_tampering.toml		defense_evasion_posh_defender_tampering.toml	Prep main for 9.1 (#4555)	Mar 26, 2025
defense_evasion_powershell_clear_logs_script.toml		defense_evasion_powershell_clear_logs_script.toml	Prep main for 9.1 (#4555)	Mar 26, 2025
defense_evasion_processes_with_trailing_spaces.toml		defense_evasion_processes_with_trailing_spaces.toml	Back-porting Version Trimming (#3704)	May 22, 2024
defense_evasion_service_disabled_registry.toml		defense_evasion_service_disabled_registry.toml	Back-porting Version Trimming (#3704)	May 22, 2024
defense_evasion_service_path_registry.toml		defense_evasion_service_path_registry.toml	Prep main for 9.1 (#4555)	Mar 26, 2025
defense_evasion_services_exe_path.toml		defense_evasion_services_exe_path.toml	Prep main for 9.1 (#4555)	Mar 26, 2025
defense_evasion_suspicious_msiexec_execution.toml		defense_evasion_suspicious_msiexec_execution.toml	Prep main for 9.1 (#4555)	Mar 26, 2025
defense_evasion_unsigned_bits_client.toml		defense_evasion_unsigned_bits_client.toml	Back-porting Version Trimming (#3704)	May 22, 2024
defense_evasion_unusual_process_extension.toml		defense_evasion_unusual_process_extension.toml	Back-porting Version Trimming (#3704)	May 22, 2024
defense_evasion_unusual_process_path_wbem.toml		defense_evasion_unusual_process_path_wbem.toml	Prep main for 9.1 (#4555)	Mar 26, 2025
defense_evasion_write_dac_access.toml		defense_evasion_write_dac_access.toml	Prep main for 9.1 (#4555)	Mar 26, 2025
discovery_capnetraw_capability.toml		discovery_capnetraw_capability.toml	Prep for Release 8.17 (#4256)	Nov 7, 2024
discovery_files_dir_systeminfo_via_cmd.toml		discovery_files_dir_systeminfo_via_cmd.toml	Prep main for 9.1 (#4555)	Mar 26, 2025
discovery_generic_account_groups.toml		discovery_generic_account_groups.toml	Back-porting Version Trimming (#3704)	May 22, 2024
discovery_generic_process_discovery.toml		discovery_generic_process_discovery.toml	Prep main for 9.1 (#4555)	Mar 26, 2025
discovery_generic_registry_query.toml		discovery_generic_registry_query.toml	[Rule Tuning] Lookback Times for Okta Multiple Session and AWS KMS Re…	Dec 19, 2024
discovery_getconf_execution.toml		discovery_getconf_execution.toml	[New BBR] Linux System Information Discovery via Getconf (#4337)	Jan 16, 2025
discovery_hosts_file_access.toml		discovery_hosts_file_access.toml	Back-porting Version Trimming (#3704)	May 22, 2024
discovery_internet_capabilities.toml		discovery_internet_capabilities.toml	Back-porting Version Trimming (#3704)	May 22, 2024
discovery_kernel_module_enumeration_via_proc.toml		discovery_kernel_module_enumeration_via_proc.toml	[Rule Tuning] Q2 Linux DR Tuning - BBR (#4171)	Oct 18, 2024
discovery_linux_modprobe_enumeration.toml		discovery_linux_modprobe_enumeration.toml	[Rule Tuning] Q2 Linux DR Tuning - BBR (#4171)	Oct 18, 2024
discovery_linux_sysctl_enumeration.toml		discovery_linux_sysctl_enumeration.toml	[Rule Tuning] Q2 Linux DR Tuning - BBR (#4171)	Oct 18, 2024
discovery_linux_system_information_discovery.toml		discovery_linux_system_information_discovery.toml	Back-porting Version Trimming (#3704)	May 22, 2024
discovery_linux_system_owner_user_discovery.toml		discovery_linux_system_owner_user_discovery.toml	Back-porting Version Trimming (#3704)	May 22, 2024
discovery_net_share_discovery_winlog.toml		discovery_net_share_discovery_winlog.toml	Prep main for 9.1 (#4555)	Mar 26, 2025
discovery_net_view.toml		discovery_net_view.toml	Prep main for 9.1 (#4555)	Mar 26, 2025
discovery_of_accounts_or_groups_via_builtin_tools.toml		discovery_of_accounts_or_groups_via_builtin_tools.toml	Back-porting Version Trimming (#3704)	May 22, 2024
discovery_of_domain_groups.toml		discovery_of_domain_groups.toml	Back-porting Version Trimming (#3704)	May 22, 2024
discovery_posh_generic.toml		discovery_posh_generic.toml	Prep main for 9.1 (#4555)	Mar 26, 2025
discovery_posh_password_policy.toml		discovery_posh_password_policy.toml	Prep main for 9.1 (#4555)	Mar 26, 2025
discovery_post_exploitation_external_ip_lookup.toml		discovery_post_exploitation_external_ip_lookup.toml	Back-porting Version Trimming (#3704)	May 22, 2024
discovery_potential_memory_seeking_activity.toml		discovery_potential_memory_seeking_activity.toml	[Rule Tuning] Q2 Linux DR Tuning - BBR (#4171)	Oct 18, 2024
discovery_process_discovery_via_builtin_tools.toml		discovery_process_discovery_via_builtin_tools.toml	Back-porting Version Trimming (#3704)	May 22, 2024
discovery_remote_system_discovery_commands_windows.toml		discovery_remote_system_discovery_commands_windows.toml	Prep main for 9.1 (#4555)	Mar 26, 2025
discovery_security_software_wmic.toml		discovery_security_software_wmic.toml	Prep main for 9.1 (#4555)	Mar 26, 2025
discovery_signal_unusual_user_host.toml		discovery_signal_unusual_user_host.toml	Testcase to check if Rule Type: BBR tag is present for all BBR rules (#…	Sep 2, 2024
discovery_suspicious_proc_enumeration.toml		discovery_suspicious_proc_enumeration.toml	Back-porting Version Trimming (#3704)	May 22, 2024
discovery_system_network_connections.toml		discovery_system_network_connections.toml	Back-porting Version Trimming (#3704)	May 22, 2024
discovery_system_service_discovery.toml		discovery_system_service_discovery.toml	Prep main for 9.1 (#4555)	Mar 26, 2025
discovery_system_time_discovery.toml		discovery_system_time_discovery.toml	Prep main for 9.1 (#4555)	Mar 26, 2025
discovery_win_network_connections.toml		discovery_win_network_connections.toml	Back-porting Version Trimming (#3704)	May 22, 2024
discovery_windows_system_information_discovery.toml		discovery_windows_system_information_discovery.toml	Prep main for 9.1 (#4555)	Mar 26, 2025
execution_aws_lambda_function_updated.toml		execution_aws_lambda_function_updated.toml	Testcase to check if Rule Type: BBR tag is present for all BBR rules (#…	Sep 2, 2024
execution_github_new_event_action_for_pat.toml		execution_github_new_event_action_for_pat.toml	Prep for Release 9.0 (#4550)	Mar 20, 2025
execution_github_new_repo_interaction_for_pat.toml		execution_github_new_repo_interaction_for_pat.toml	Prep for Release 9.0 (#4550)	Mar 20, 2025
execution_github_new_repo_interaction_for_user.toml		execution_github_new_repo_interaction_for_user.toml	Prep for Release 9.0 (#4550)	Mar 20, 2025
execution_github_repo_created.toml		execution_github_repo_created.toml	Prep for Release 9.0 (#4550)	Mar 20, 2025
execution_github_repo_interaction_from_new_ip.toml		execution_github_repo_interaction_from_new_ip.toml	Prep for Release 9.0 (#4550)	Mar 20, 2025
execution_linux_segfault.toml		execution_linux_segfault.toml	Back-porting Version Trimming (#3704)	May 22, 2024
execution_settingcontent_ms_file_creation.toml		execution_settingcontent_ms_file_creation.toml	Prep main for 9.1 (#4555)	Mar 26, 2025
execution_unsigned_service_executable.toml		execution_unsigned_service_executable.toml	Back-porting Version Trimming (#3704)	May 22, 2024
execution_wmi_wbemtest.toml		execution_wmi_wbemtest.toml	Prep main for 9.1 (#4555)	Mar 26, 2025
impact_github_member_removed_from_organization.toml		impact_github_member_removed_from_organization.toml	Prep for Release 9.0 (#4550)	Mar 20, 2025
impact_github_pat_access_revoked.toml		impact_github_pat_access_revoked.toml	Prep for Release 9.0 (#4550)	Mar 20, 2025
impact_github_user_blocked_from_organization.toml		impact_github_user_blocked_from_organization.toml	Prep for Release 9.0 (#4550)	Mar 20, 2025
initial_access_github_new_ip_address_for_pat.toml		initial_access_github_new_ip_address_for_pat.toml	Prep for Release 9.0 (#4550)	Mar 20, 2025
initial_access_github_new_ip_address_for_user.toml		initial_access_github_new_ip_address_for_user.toml	Prep for Release 9.0 (#4550)	Mar 20, 2025
initial_access_github_new_user_agent_for_pat.toml		initial_access_github_new_user_agent_for_pat.toml	Prep for Release 9.0 (#4550)	Mar 20, 2025
initial_access_github_new_user_agent_for_user.toml		initial_access_github_new_user_agent_for_user.toml	Prep for Release 9.0 (#4550)	Mar 20, 2025
lateral_movement_at.toml		lateral_movement_at.toml	Prep main for 9.1 (#4555)	Mar 26, 2025
lateral_movement_posh_winrm_activity.toml		lateral_movement_posh_winrm_activity.toml	Prep main for 9.1 (#4555)	Mar 26, 2025
lateral_movement_rdp_conn_unusual_process.toml		lateral_movement_rdp_conn_unusual_process.toml	Testcase to check if Rule Type: BBR tag is present for all BBR rules (#…	Sep 2, 2024
lateral_movement_unusual_process_sql_accounts.toml		lateral_movement_unusual_process_sql_accounts.toml	Back-porting Version Trimming (#3704)	May 22, 2024
lateral_movement_wmic_remote.toml		lateral_movement_wmic_remote.toml	Prep main for 9.1 (#4555)	Mar 26, 2025
persistence_aws_iam_login_profile_added_to_user.toml		persistence_aws_iam_login_profile_added_to_user.toml	Back-porting Version Trimming (#3704)	May 22, 2024
persistence_cap_sys_admin_added_to_new_binary.toml		persistence_cap_sys_admin_added_to_new_binary.toml	Prep for Release 8.17 (#4256)	Nov 7, 2024
persistence_creation_of_kernel_module.toml		persistence_creation_of_kernel_module.toml	Back-porting Version Trimming (#3704)	May 22, 2024
persistence_github_new_pat_for_user.toml		persistence_github_new_pat_for_user.toml	Prep for Release 9.0 (#4550)	Mar 20, 2025
persistence_github_new_user_added_to_organization.toml		persistence_github_new_user_added_to_organization.toml	Prep for Release 9.0 (#4550)	Mar 20, 2025
persistence_iam_instance_request_to_iam_service.toml		persistence_iam_instance_request_to_iam_service.toml	[Rule Tuning] Add Investigation Fields to Specific AWS Rules (#4261)	Nov 9, 2024
persistence_startup_folder_lnk.toml		persistence_startup_folder_lnk.toml	Back-porting Version Trimming (#3704)	May 22, 2024
persistence_transport_agent_exchange.toml		persistence_transport_agent_exchange.toml	Prep main for 9.1 (#4555)	Mar 26, 2025
persistence_web_server_sus_file_creation.toml		persistence_web_server_sus_file_creation.toml	Prep for Release 9.0 (#4550)	Mar 20, 2025
privilege_escalation_trap_execution.toml		privilege_escalation_trap_execution.toml	Back-porting Version Trimming (#3704)	May 22, 2024
View all files