Jonhnathan comments

Results 10 comments of


                                            Jonhnathan

Develop Sigma rules for Living Off The Land Binaries and Scripts

77 https://github.com/Neo23x0/sigma/pull/1072 34 - https://github.com/Neo23x0/sigma/pull/1085 94 - https://github.com/Neo23x0/sigma/pull/1085 96 - https://github.com/Neo23x0/sigma/pull/1085 97 - https://github.com/Neo23x0/sigma/pull/1085 98 - https://github.com/Neo23x0/sigma/pull/1085 99 - https://github.com/Neo23x0/sigma/pull/1085 100 - https://github.com/Neo23x0/sigma/pull/1085 101 - https://github.com/Neo23x0/sigma/pull/1085 102 - https://github.com/Neo23x0/sigma/pull/1085 103...

Refactor codebase

cc @0xtf @heyibrahimkhan

Misleading Detection Rule Name

@terrancedejesus

[New Rule] Potential PowerShell Obfuscation via String Reordering

Fixed a condition that was causing FPs and some feedback from Samir. g2g

[Rule Tuning] Update rules using NPC integration and non-ECS fields

@brokensound77, is this one ready to proceed, as the related PRs/Issues seem to be resolved?

[Security Content] Windows Audit Policies Config Guides - Repo Edition

Closing this one as I plan to work in an enhanced version in https://github.com/elastic/ia-trade-team/issues/681

[Rule Tuning] Potential DLL Side-Loading via Trusted Microsoft Programs

Nice catch @beninsh, do you want to submit a PR or should I do it?

[Rule Tuning] Potential DLL Side-Loading via Trusted Microsoft Programs

Closing it as the PR was merged

[Security Content] Basic EDR Setup Guides - Phase 1

I am marking this as a Draft until we discuss the rule size issue with D&R

[Security Content] Basic EDR Setup Guides - Phase 1

Closing this as it’s still blocked. I’ll open a new PR once it gets unblocked, as that will be easier than resolving the conflicts and adding this to the new...