From ca78f550fd1ae9299181a2053f810d5f82cf59b5 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Tue, 30 Apr 2024 18:06:01 +0530 Subject: [PATCH] Lock versions for releases: 8.3,8.4,8.5,8.6,8.7,8.8,8.9,8.10,8.11,8.12,8.13 (#3630) --- detection_rules/etc/version.lock.json | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-) diff --git a/detection_rules/etc/version.lock.json b/detection_rules/etc/version.lock.json index 2b6b8f3a9ec..28ab8b992b6 100644 --- a/detection_rules/etc/version.lock.json +++ b/detection_rules/etc/version.lock.json @@ -1509,9 +1509,9 @@ "25d917c4-aa3c-4111-974c-286c0312ff95": { "min_stack_version": "8.6", "rule_name": "Network Activity Detected via Kworker", - "sha256": "f9452cfd3dd6898a8e874ba512f1348b0914cd30dd59bda481fa9b8f7932ac94", + "sha256": "6169ab76be1ab1b6d165bc6e91e309957523da07f42cfa74c0b2eabc0fff457b", "type": "new_terms", - "version": 3 + "version": 4 }, "260486ee-7d98-11ee-9599-f661ea17fbcd": { "min_stack_version": "8.10", @@ -1688,6 +1688,13 @@ "type": "eql", "version": 5 }, + "28f6f34b-8e16-487a-b5fd-9d22eb903db8": { + "min_stack_version": "8.6", + "rule_name": "Shell Configuration Modification", + "sha256": "1082bfbb3e988caa2fc49527f3dcd4024a4657a591fb5edc4d08e2ba311ca62c", + "type": "new_terms", + "version": 1 + }, "29052c19-ff3e-42fd-8363-7be14d7c5469": { "min_stack_version": "8.9", "previous": { @@ -4235,9 +4242,9 @@ "6ee947e9-de7e-4281-a55d-09289bdf947e": { "min_stack_version": "8.3", "rule_name": "Potential Linux Tunneling and/or Port Forwarding", - "sha256": "eedc4cf7524cdf63ff5577f28828497e02335c1a260f32c37d3a2b4cda6272f7", + "sha256": "e7974fdba41cd2ce4d8ff22447cfab64cec739f3dd5bc0ab0749e92fc578bcf8", "type": "eql", - "version": 6 + "version": 7 }, "6f1500bc-62d7-4eb9-8601-7485e87da2f4": { "rule_name": "SSH (Secure Shell) to the Internet", @@ -8406,6 +8413,13 @@ "type": "query", "version": 100 }, + "dffbd37c-d4c5-46f8-9181-5afdd9172b4c": { + "min_stack_version": "8.3", + "rule_name": "Potential privilege escalation via CVE-2022-38028", + "sha256": "6c482e61313171b3dc7b0d4085b1103871e12cb403c6fa1d2048781f9e805253", + "type": "eql", + "version": 1 + }, "e00b8d49-632f-4dc6-94a5-76153a481915": { "min_stack_version": "8.3", "rule_name": "Delayed Execution via Ping",