Skip to content

Commit

Permalink
[SIEM] Remove forgotten rules that weren't deleted (#64974) (#65160)
Browse files Browse the repository at this point in the history
* Remove stray rules that should've been deleted
* Update rule.ts and tests
* Remove deleted prebuilt rules from cypress ES archive (#1)
  • Loading branch information
rw-access authored May 5, 2020
1 parent 205db2c commit 0c6211a
Show file tree
Hide file tree
Showing 3 changed files with 18 additions and 23 deletions.
2 changes: 1 addition & 1 deletion x-pack/legacy/plugins/siem/cypress/objects/rule.ts
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
* you may not use this file except in compliance with the Elastic License.
*/

export const totalNumberOfPrebuiltRules = 130;
export const totalNumberOfPrebuiltRules = 127;

interface Mitre {
tactic: string;
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -118,25 +118,23 @@ import rule108 from './windows_execution_msbuild_started_renamed.json';
import rule109 from './windows_execution_msbuild_started_unusal_process.json';
import rule110 from './windows_execution_via_compiled_html_file.json';
import rule111 from './windows_execution_via_net_com_assemblies.json';
import rule112 from './windows_execution_via_regsvr32.json';
import rule113 from './windows_execution_via_trusted_developer_utilities.json';
import rule114 from './windows_html_help_executable_program_connecting_to_the_internet.json';
import rule115 from './windows_injection_msbuild.json';
import rule116 from './windows_misc_lolbin_connecting_to_the_internet.json';
import rule117 from './windows_modification_of_boot_config.json';
import rule118 from './windows_msxsl_network.json';
import rule119 from './windows_net_command_system_account.json';
import rule120 from './windows_persistence_via_application_shimming.json';
import rule121 from './windows_priv_escalation_via_accessibility_features.json';
import rule122 from './windows_process_discovery_via_tasklist_command.json';
import rule123 from './windows_rare_user_runas_event.json';
import rule124 from './windows_rare_user_type10_remote_login.json';
import rule125 from './windows_register_server_program_connecting_to_the_internet.json';
import rule126 from './windows_signed_binary_proxy_execution.json';
import rule127 from './windows_suspicious_pdf_reader.json';
import rule128 from './windows_suspicious_process_started_by_a_script.json';
import rule129 from './windows_uac_bypass_event_viewer.json';
import rule130 from './windows_whoami_command_activity.json';
import rule112 from './windows_execution_via_trusted_developer_utilities.json';
import rule113 from './windows_html_help_executable_program_connecting_to_the_internet.json';
import rule114 from './windows_injection_msbuild.json';
import rule115 from './windows_misc_lolbin_connecting_to_the_internet.json';
import rule116 from './windows_modification_of_boot_config.json';
import rule117 from './windows_msxsl_network.json';
import rule118 from './windows_net_command_system_account.json';
import rule119 from './windows_persistence_via_application_shimming.json';
import rule120 from './windows_priv_escalation_via_accessibility_features.json';
import rule121 from './windows_process_discovery_via_tasklist_command.json';
import rule122 from './windows_rare_user_runas_event.json';
import rule123 from './windows_rare_user_type10_remote_login.json';
import rule124 from './windows_register_server_program_connecting_to_the_internet.json';
import rule125 from './windows_suspicious_pdf_reader.json';
import rule126 from './windows_uac_bypass_event_viewer.json';
import rule127 from './windows_whoami_command_activity.json';

export const rawRules = [
rule1,
rule2,
Expand Down Expand Up @@ -265,7 +263,4 @@ export const rawRules = [
rule125,
rule126,
rule127,
rule128,
rule129,
rule130,
];
Binary file not shown.

0 comments on commit 0c6211a

Please sign in to comment.