Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[New Rule] Threat intel indicator match rule (#1133) #2

Merged
merged 1 commit into from
Apr 26, 2021

Conversation

austinsonger
Copy link
Owner

Issues

Summary

Contributor checklist

@austinsonger austinsonger merged commit 76344b7 into austinsonger:main Apr 26, 2021
austinsonger pushed a commit that referenced this pull request May 8, 2023
* tuned web shell logic, and converted to EQL

* Removed old, created new rule to bypass "type" bug

* Revert "Removed old, created new rule to bypass "type" bug"

This reverts commit e994b62.

* Revert "tuned web shell logic, and converted to EQL"

This reverts commit 28bda94.

* Deprecated old rule, added new

* formatting fix

* removed endgame index

* Fixed changes captured as edited, not created

* Update rules/linux/persistence_shell_activity_through_web_server.toml

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>

* fix conflict

* added host.os.type==linux for unit testing

* removed wildcards in process.args

* Update rules/linux/persistence_shell_activity_via_web_server.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* fixed conflict by changing file name and changes

* Trying to resolve the GH conflict

* attempt to fix GH conflict #2

* Update persistence_shell_activity_by_web_server.toml

* Added endgame support

* Added OSQuery to investigation guide

* Update rules/linux/persistence_linux_shell_activity_via_web_server.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/linux/persistence_linux_shell_activity_via_web_server.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* removed investigation guide to add in future PR

---------

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
2 participants