Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Rule Tuning] SUID/SGID Bit Set #3802

Merged
merged 2 commits into from
Jun 27, 2024
Merged

[Rule Tuning] SUID/SGID Bit Set #3802

merged 2 commits into from
Jun 27, 2024

Conversation

Aegrah
Copy link
Contributor

@Aegrah Aegrah commented Jun 19, 2024

Summary

Converted the old Lucene rule over to EQL, and added additional coverage.

Removed some of the exclusions that were too exclusive. 36 hits last 90d in telemetry, which are all TP's. 25 hits in my own stack, which are all SUID/SGID testing.

image

Copy link
Contributor

@terrancedejesus terrancedejesus left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good tuning, LGTM ✅

@Aegrah Aegrah merged commit 8d063e1 into main Jun 27, 2024
9 checks passed
@Aegrah Aegrah deleted the tuning-suid-sgid-bit-set branch June 27, 2024 14:27
protectionsmachine pushed a commit that referenced this pull request Jun 27, 2024
protectionsmachine pushed a commit that referenced this pull request Jun 27, 2024
protectionsmachine pushed a commit that referenced this pull request Jun 27, 2024
protectionsmachine pushed a commit that referenced this pull request Jun 27, 2024
protectionsmachine pushed a commit that referenced this pull request Jun 27, 2024
protectionsmachine pushed a commit that referenced this pull request Jun 27, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants