rule cuts

first pass at rule cuts, 21 deelted rule files, no adds, no changes.
elastic · Jan 15, 2020 · 8ca6aa7 · 8ca6aa7
1 parent ed3c899
commit 8ca6aa7
Show file tree

Hide file tree

Showing 21 changed files with 0 additions and 357 deletions.
diff --git a/...ection_engine/rules/prepackaged_rules/ece_network_detect_large_outbound_icmp_packets.json b/...ection_engine/rules/prepackaged_rules/ece_network_detect_large_outbound_icmp_packets.json
diff --git a/...ction_engine/rules/prepackaged_rules/ece_network_detect_long_dns_txt_record_response.json b/...ction_engine/rules/prepackaged_rules/ece_network_detect_long_dns_txt_record_response.json
diff --git a/...ne/rules/prepackaged_rules/ece_network_protocols_passing_authentication_in_cleartext.json b/...ne/rules/prepackaged_rules/ece_network_protocols_passing_authentication_in_cleartext.json
diff --git a/...b/detection_engine/rules/prepackaged_rules/ece_windows_child_processes_of_spoolsvexe.json b/...b/detection_engine/rules/prepackaged_rules/ece_windows_child_processes_of_spoolsvexe.json
diff --git a/.../detection_engine/rules/prepackaged_rules/ece_windows_detect_new_local_admin_account.json b/.../detection_engine/rules/prepackaged_rules/ece_windows_detect_new_local_admin_account.json
diff --git a/...ection_engine/rules/prepackaged_rules/ece_windows_detect_psexec_with_accepteula_flag.json b/...ection_engine/rules/prepackaged_rules/ece_windows_detect_psexec_with_accepteula_flag.json
diff --git a/...les/prepackaged_rules/ece_windows_detect_use_of_cmdexe_to_launch_script_interpreters.json b/...les/prepackaged_rules/ece_windows_detect_use_of_cmdexe_to_launch_script_interpreters.json
diff --git a/.../server/lib/detection_engine/rules/prepackaged_rules/ece_windows_new_external_device.json b/.../server/lib/detection_engine/rules/prepackaged_rules/ece_windows_new_external_device.json
diff --git a/.../lib/detection_engine/rules/prepackaged_rules/ece_windows_processes_created_by_netsh.json b/.../lib/detection_engine/rules/prepackaged_rules/ece_windows_processes_created_by_netsh.json
diff --git a/...r/lib/detection_engine/rules/prepackaged_rules/ece_windows_processes_launching_netsh.json b/...r/lib/detection_engine/rules/prepackaged_rules/ece_windows_processes_launching_netsh.json
diff --git a/...r/lib/detection_engine/rules/prepackaged_rules/ece_windows_windows_event_log_cleared.json b/...r/lib/detection_engine/rules/prepackaged_rules/ece_windows_windows_event_log_cleared.json
diff --git a/...er/lib/detection_engine/rules/prepackaged_rules/splunk_child_processes_of_spoolsvexe.json b/...er/lib/detection_engine/rules/prepackaged_rules/splunk_child_processes_of_spoolsvexe.json
diff --git a/...b/detection_engine/rules/prepackaged_rules/splunk_detect_large_outbound_icmp_packets.json b/...b/detection_engine/rules/prepackaged_rules/splunk_detect_large_outbound_icmp_packets.json
diff --git a/.../detection_engine/rules/prepackaged_rules/splunk_detect_long_dns_txt_record_response.json b/.../detection_engine/rules/prepackaged_rules/splunk_detect_long_dns_txt_record_response.json
diff --git a/...r/lib/detection_engine/rules/prepackaged_rules/splunk_detect_new_local_admin_account.json b/...r/lib/detection_engine/rules/prepackaged_rules/splunk_detect_new_local_admin_account.json
diff --git a/...b/detection_engine/rules/prepackaged_rules/splunk_detect_psexec_with_accepteula_flag.json b/...b/detection_engine/rules/prepackaged_rules/splunk_detect_psexec_with_accepteula_flag.json
diff --git a/...ne/rules/prepackaged_rules/splunk_detect_use_of_cmdexe_to_launch_script_interpreters.json b/...ne/rules/prepackaged_rules/splunk_detect_use_of_cmdexe_to_launch_script_interpreters.json
diff --git a/...erver/lib/detection_engine/rules/prepackaged_rules/splunk_processes_created_by_netsh.json b/...erver/lib/detection_engine/rules/prepackaged_rules/splunk_processes_created_by_netsh.json
diff --git a/...server/lib/detection_engine/rules/prepackaged_rules/splunk_processes_launching_netsh.json b/...server/lib/detection_engine/rules/prepackaged_rules/splunk_processes_launching_netsh.json
diff --git a/..._engine/rules/prepackaged_rules/splunk_protocols_passing_authentication_in_cleartext.json b/..._engine/rules/prepackaged_rules/splunk_protocols_passing_authentication_in_cleartext.json
diff --git a/...server/lib/detection_engine/rules/prepackaged_rules/splunk_windows_event_log_cleared.json b/...server/lib/detection_engine/rules/prepackaged_rules/splunk_windows_event_log_cleared.json