Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Rule Tuning] Windows BBR Tuning - 5 #3385

Merged
merged 3 commits into from
Feb 14, 2024
Merged

[Rule Tuning] Windows BBR Tuning - 5 #3385

merged 3 commits into from
Feb 14, 2024

Conversation

w0rk3r
Copy link
Contributor

@w0rk3r w0rk3r commented Jan 12, 2024

Issues

Part of #3186

Summary

Tunes the following rules:

  • PowerShell Script with Remote Execution Capabilities via WinRM
  • Potential Outgoing RDP Connection by Unusual Process

Promotes the following rules (Keeping the severity low for a bit more time):

  • Execution from a Removable Media with Network Connection
  • Potential Remote File Execution via MSIEXEC
  • Remote XSL Script Execution via COM

@w0rk3r w0rk3r added Rule: Tuning tweaking or tuning an existing rule OS: Windows windows related rules Domain: Endpoint backport: auto labels Jan 12, 2024
@w0rk3r w0rk3r self-assigned this Jan 12, 2024
@botelastic botelastic bot added the bbr Building Block Rules label Jan 12, 2024
@w0rk3r w0rk3r mentioned this pull request Jan 12, 2024
Closed
@w0rk3r w0rk3r merged commit 97e4979 into main Feb 14, 2024
13 checks passed
@w0rk3r w0rk3r deleted the rt_bbr_5 branch February 14, 2024 13:23
protectionsmachine pushed a commit that referenced this pull request Feb 14, 2024
@w0rk3r @github-actions
[Rule Tuning] Windows BBR Tuning - 5 (#3385)
7f0a644 
Co-authored-by: Samirbous <[email protected]>

(cherry picked from commit 97e4979)
protectionsmachine pushed a commit that referenced this pull request Feb 14, 2024
@w0rk3r @github-actions
[Rule Tuning] Windows BBR Tuning - 5 (#3385)
be4bc16 
Co-authored-by: Samirbous <[email protected]>

(cherry picked from commit 97e4979)
protectionsmachine pushed a commit that referenced this pull request Feb 14, 2024
@w0rk3r @github-actions
[Rule Tuning] Windows BBR Tuning - 5 (#3385)
ea48e63 
Co-authored-by: Samirbous <[email protected]>

(cherry picked from commit 97e4979)
protectionsmachine pushed a commit that referenced this pull request Feb 14, 2024
@w0rk3r @github-actions
[Rule Tuning] Windows BBR Tuning - 5 (#3385)
f0572be 
Co-authored-by: Samirbous <[email protected]>

(cherry picked from commit 97e4979)
protectionsmachine pushed a commit that referenced this pull request Feb 14, 2024
@w0rk3r @github-actions
[Rule Tuning] Windows BBR Tuning - 5 (#3385)
519ac1e 
Co-authored-by: Samirbous <[email protected]>

(cherry picked from commit 97e4979)
protectionsmachine pushed a commit that referenced this pull request Feb 14, 2024
@w0rk3r @github-actions
[Rule Tuning] Windows BBR Tuning - 5 (#3385)
adcbaa1 
Co-authored-by: Samirbous <[email protected]>

(cherry picked from commit 97e4979)
protectionsmachine pushed a commit that referenced this pull request Feb 14, 2024
@w0rk3r @github-actions
[Rule Tuning] Windows BBR Tuning - 5 (#3385)
4f2ff9f 
Co-authored-by: Samirbous <[email protected]>

(cherry picked from commit 97e4979)
protectionsmachine pushed a commit that referenced this pull request Feb 14, 2024
@w0rk3r @github-actions
[Rule Tuning] Windows BBR Tuning - 5 (#3385)
9577e2a 
Co-authored-by: Samirbous <[email protected]>

(cherry picked from commit 97e4979)
protectionsmachine pushed a commit that referenced this pull request Feb 14, 2024
@w0rk3r @github-actions
[Rule Tuning] Windows BBR Tuning - 5 (#3385)
a864d77 
Co-authored-by: Samirbous <[email protected]>

(cherry picked from commit 97e4979)
protectionsmachine pushed a commit that referenced this pull request Feb 14, 2024
@w0rk3r @github-actions
[Rule Tuning] Windows BBR Tuning - 5 (#3385)
77d76b1 
Co-authored-by: Samirbous <[email protected]>

(cherry picked from commit 97e4979)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@terrancedejesus terrancedejesus terrancedejesus approved these changes

@Aegrah Aegrah Aegrah approved these changes

@Samirbous Samirbous Samirbous approved these changes

@brokensound77 brokensound77 Awaiting requested review from brokensound77

@DefSecSentinel DefSecSentinel Awaiting requested review from DefSecSentinel

@imays11 imays11 Awaiting requested review from imays11

@shashank-elastic shashank-elastic Awaiting requested review from shashank-elastic

Assignees

@w0rk3r w0rk3r

Labels
backport: auto bbr Building Block Rules Domain: Endpoint OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@w0rk3r @Samirbous @Aegrah @terrancedejesus