Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Rule Tuning] Windows BBR Tuning - 4 #3384

Merged
merged 3 commits into from
Feb 14, 2024
Merged

[Rule Tuning] Windows BBR Tuning - 4 #3384

merged 3 commits into from
Feb 14, 2024

Conversation

w0rk3r
Copy link
Contributor

@w0rk3r w0rk3r commented Jan 12, 2024

Issues

Part of #3186

Summary

Tunes the following rules:

  • PowerShell Script with Discovery Capabilities
  • PowerShell Script with Password Policy Discovery Capabilities
  • System Time Discovery
  • Creation of SettingContent-ms Files
  • Execution of an Unsigned Service

@w0rk3r w0rk3r added Rule: Tuning tweaking or tuning an existing rule OS: Windows windows related rules Domain: Endpoint backport: auto bbr Building Block Rules labels Jan 12, 2024
@w0rk3r w0rk3r self-assigned this Jan 12, 2024
@w0rk3r w0rk3r merged commit 1a8271d into main Feb 14, 2024
13 checks passed
@w0rk3r w0rk3r deleted the rt_bbr_4 branch February 14, 2024 17:21
protectionsmachine pushed a commit that referenced this pull request Feb 14, 2024
* [Rule Tuning] Windows BBR Tuning - 4

* Update discovery_system_time_discovery.toml

Removed changes from:
- rules_building_block/execution_unsigned_service_executable.toml

(selectively cherry picked from commit 1a8271d)
protectionsmachine pushed a commit that referenced this pull request Feb 14, 2024
* [Rule Tuning] Windows BBR Tuning - 4

* Update discovery_system_time_discovery.toml

Removed changes from:
- rules_building_block/execution_unsigned_service_executable.toml

(selectively cherry picked from commit 1a8271d)
protectionsmachine pushed a commit that referenced this pull request Feb 14, 2024
* [Rule Tuning] Windows BBR Tuning - 4

* Update discovery_system_time_discovery.toml

Removed changes from:
- rules_building_block/execution_unsigned_service_executable.toml

(selectively cherry picked from commit 1a8271d)
protectionsmachine pushed a commit that referenced this pull request Feb 14, 2024
* [Rule Tuning] Windows BBR Tuning - 4

* Update discovery_system_time_discovery.toml

(cherry picked from commit 1a8271d)
protectionsmachine pushed a commit that referenced this pull request Feb 14, 2024
* [Rule Tuning] Windows BBR Tuning - 4

* Update discovery_system_time_discovery.toml

(cherry picked from commit 1a8271d)
protectionsmachine pushed a commit that referenced this pull request Feb 14, 2024
* [Rule Tuning] Windows BBR Tuning - 4

* Update discovery_system_time_discovery.toml

(cherry picked from commit 1a8271d)
protectionsmachine pushed a commit that referenced this pull request Feb 14, 2024
* [Rule Tuning] Windows BBR Tuning - 4

* Update discovery_system_time_discovery.toml

(cherry picked from commit 1a8271d)
protectionsmachine pushed a commit that referenced this pull request Feb 14, 2024
* [Rule Tuning] Windows BBR Tuning - 4

* Update discovery_system_time_discovery.toml

(cherry picked from commit 1a8271d)
protectionsmachine pushed a commit that referenced this pull request Feb 14, 2024
* [Rule Tuning] Windows BBR Tuning - 4

* Update discovery_system_time_discovery.toml

(cherry picked from commit 1a8271d)
protectionsmachine pushed a commit that referenced this pull request Feb 14, 2024
* [Rule Tuning] Windows BBR Tuning - 4

* Update discovery_system_time_discovery.toml

(cherry picked from commit 1a8271d)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
backport: auto bbr Building Block Rules Domain: Endpoint OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants