sigma
sigma copied to clipboard
fix: FPs on docker images
Summary of the Pull Request
Fixes false positives on official Docker images:
- golang
- postgres
- python
- redis
- ruby
Changelog
fix: Cron Pathes - filter legit cron filepathes
Example Log Event
/etc/cron.daily/apt
/etc/cron.daily/dpkg
/etc/cron.daily/passwd
/etc/crontabs/root
/etc/crontab
Fixed Issues
SigmaHQ Rule Creation Conventions
- If your PR adds new rules, please consider following and applying these conventions
Do your things @nasbench. I'll give the rule a tweak afterwards to increase coverage (more include paths) but also add the default cron jobs as filters for the distributions that I have lying around.