Samirbous

Results 10 comments of Samirbous

Modify JSON filenames to include technique IDs

@jaimeatwork that's awesome, I think a PR branch to branch will be good.

[New] Microsoft Entra ID Protection Alert and Device Registration

@terrancedejesus 👍 moved the two ones that passed the checks to a different PR to avoid dependency on the blocker https://github.com/elastic/detection-rules/pull/4694

[Rule Tuning] Potential Antimalware Scan Interface Bypass via PowerShell

thank you @drummbelbummel for submitting the sample FP, after verification it appears like you are using an old version of the rule that we previously tuned, can you compare the...

[Rule Tuning] Potential Antimalware Scan Interface Bypass via PowerShell

@shashank-elastic any ideas on this update issue ?

[Rule Tuning] Potential Antimalware Scan Interface Bypass via PowerShell

@drummbelbummel Great, let me know if you don't see the same FPs, so we can close this issue.

[Bug] Suspicious wmi library load

Hi @mSALDANHAf you can add an endpoint exception https://www.elastic.co/docs/solutions/security/detect-and-alert/add-manage-exceptions#endpoint-rule-exceptions : ``` rule.id is "3cd302aa-098b-4da6-bf20-8d37efe5f861" process.executable is ```

[New Rule] Large data exfiltration from elasticsearch clusters

@clement-fouque sorry it was closed automatically, we will review this internally. Do you have example of logs ?

[Custom]: Remove useless newline in execution_initial_access_discovery_via_applet_executable

fyi @DefSecSentinel

[Rule Tuning] Potential DLL Side-Loading via Trusted Microsoft Programs

@tyler-mcadam thank you for reporting this issue, indeed the not condition `not (process.name : ("winword.exe", "explorer.exe", "w3wp.exe", "Dism.exe")` will cause to miss if the binary is just moved to a...

[Rule Tuning] Potential DLL Side-Loading via Trusted Microsoft Programs

> Am I supposed to close the issue or do you do it after merging? @tyler-mcadam once merged we will close it.