first rule cuts (elastic#54990)

* rule cuts first pass at rule cuts, 21 deelted rule files, no adds, no changes. * Update index.ts * index regen Co-authored-by: Elastic Machine <[email protected]>
jkelastic · Jan 17, 2020 · f6517fa · f6517fa
1 parent c2caa02
commit f6517fa
Show file tree

Hide file tree

Showing 37 changed files with 300 additions and 1,492 deletions.
diff --git a/.../detection_engine/rules/prepackaged_rules/command_shell_started_by_internet_explorer.json b/.../detection_engine/rules/prepackaged_rules/command_shell_started_by_internet_explorer.json
diff --git a/...ver/lib/detection_engine/rules/prepackaged_rules/command_shell_started_by_powershell.json b/...ver/lib/detection_engine/rules/prepackaged_rules/command_shell_started_by_powershell.json
diff --git a/...server/lib/detection_engine/rules/prepackaged_rules/command_shell_started_by_svchost.json b/...server/lib/detection_engine/rules/prepackaged_rules/command_shell_started_by_svchost.json
diff --git a/...ection_engine/rules/prepackaged_rules/ece_network_detect_large_outbound_icmp_packets.json b/...ection_engine/rules/prepackaged_rules/ece_network_detect_large_outbound_icmp_packets.json
diff --git a/...ction_engine/rules/prepackaged_rules/ece_network_detect_long_dns_txt_record_response.json b/...ction_engine/rules/prepackaged_rules/ece_network_detect_long_dns_txt_record_response.json
diff --git a/...ne/rules/prepackaged_rules/ece_network_protocols_passing_authentication_in_cleartext.json b/...ne/rules/prepackaged_rules/ece_network_protocols_passing_authentication_in_cleartext.json
diff --git a/...b/detection_engine/rules/prepackaged_rules/ece_windows_child_processes_of_spoolsvexe.json b/...b/detection_engine/rules/prepackaged_rules/ece_windows_child_processes_of_spoolsvexe.json
diff --git a/.../detection_engine/rules/prepackaged_rules/ece_windows_detect_new_local_admin_account.json b/.../detection_engine/rules/prepackaged_rules/ece_windows_detect_new_local_admin_account.json
diff --git a/...ection_engine/rules/prepackaged_rules/ece_windows_detect_psexec_with_accepteula_flag.json b/...ection_engine/rules/prepackaged_rules/ece_windows_detect_psexec_with_accepteula_flag.json
diff --git a/...les/prepackaged_rules/ece_windows_detect_use_of_cmdexe_to_launch_script_interpreters.json b/...les/prepackaged_rules/ece_windows_detect_use_of_cmdexe_to_launch_script_interpreters.json
diff --git a/.../server/lib/detection_engine/rules/prepackaged_rules/ece_windows_new_external_device.json b/.../server/lib/detection_engine/rules/prepackaged_rules/ece_windows_new_external_device.json
diff --git a/.../lib/detection_engine/rules/prepackaged_rules/ece_windows_processes_created_by_netsh.json b/.../lib/detection_engine/rules/prepackaged_rules/ece_windows_processes_created_by_netsh.json
diff --git a/...r/lib/detection_engine/rules/prepackaged_rules/ece_windows_processes_launching_netsh.json b/...r/lib/detection_engine/rules/prepackaged_rules/ece_windows_processes_launching_netsh.json