Skip to content

Lock versions for releases: 8.14,8.15,8.16,8.17,8.18,9.0 #4601

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Apr 8, 2025
Merged

Lock versions for releases: 8.14,8.15,8.16,8.17,8.18,9.0 #4601

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b5e66ba
Locked versions for releases: 8.14,8.15,8.16,8.17,8.18,9.0
shashank-elastic Apr 8, 2025
6343aa9
Reset Double bumps and upgrade patch version
shashank-elastic Apr 8, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
90 changes: 90 additions & 0 deletions detection_rules/etc/deprecated_rules.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,9 @@
{
"03a514d9-500e-443e-b6a9-72718c548f6c": {
"deprecation_date": "2025/03/14",
"rule_name": "Deprecated - SSH Process Launched From Inside A Container",
"stack_version": "8.14"
},
"041d4d41-9589-43e2-ba13-5680af75ebc2": {
"deprecation_date": "2023/09/25",
"rule_name": "Deprecated - Potential DNS Tunneling via Iodine",
Expand Down Expand Up @@ -49,11 +54,21 @@
"rule_name": "SQL Traffic to the Internet",
"stack_version": "7.14.0"
},
"160896de-b66f-42cb-8fef-20f53a9006ea": {
"deprecation_date": "2025/03/14",
"rule_name": "Deprecated - Potential Container Escape via Modified release_agent File",
"stack_version": "8.14"
},
"1859ce38-6a50-422b-a5e8-636e231ea0cd": {
"deprecation_date": "2022/05/09",
"rule_name": "Linux Restricted Shell Breakout via c89/c99 Shell evasion",
"stack_version": "7.16"
},
"1a289854-5b78-49fe-9440-8a8096b1ab50": {
"deprecation_date": "2025/03/14",
"rule_name": "Deprecated - Suspicious Network Tool Launched Inside A Container",
"stack_version": "8.14"
},
"20dc4620-3b68-4269-8124-ca5091e00ea8": {
"deprecation_date": "2022/07/25",
"rule_name": "Auditd Max Login Sessions",
Expand Down Expand Up @@ -89,6 +104,11 @@
"rule_name": "Malicious Remote File Creation",
"stack_version": "8.9"
},
"342f834b-21a6-41bf-878c-87d116eba3ee": {
"deprecation_date": "2025/03/14",
"rule_name": "Deprecated - Modification of Dynamic Linker Preload Shared Object Inside A Container",
"stack_version": "8.14"
},
"3605a013-6f0c-4f7d-88a5-326f5be262ec": {
"deprecation_date": "2022/08/01",
"rule_name": "Potential Privilege Escalation via Local Kerberos Relay over LDAP",
Expand All @@ -104,11 +124,26 @@
"rule_name": "Deprecated - Potential Password Spraying of Microsoft 365 User Accounts",
"stack_version": "8.12"
},
"41f7da9e-4e9f-4a81-9b58-40d725d83bc0": {
"deprecation_date": "2025/03/14",
"rule_name": "Deprecated - Mount Launched Inside a Privileged Container",
"stack_version": "8.14"
},
"420e5bb4-93bf-40a3-8f4a-4cc1af90eca1": {
"deprecation_date": "2025/03/14",
"rule_name": "Deprecated - Interactive Exec Command Launched Against A Running Container",
"stack_version": "8.14"
},
"43303fd4-4839-4e48-b2b2-803ab060758d": {
"deprecation_date": "2022/09/13",
"rule_name": "Web Application Suspicious Activity: No User Agent",
"stack_version": "8.5"
},
"475b42f0-61fb-4ef0-8a85-597458bfb0a1": {
"deprecation_date": "2025/03/14",
"rule_name": "Deprecated - Sensitive Files Compression Inside A Container",
"stack_version": "8.14"
},
"47f09343-8d1f-4bb5-8bb0-00c9d18f5010": {
"deprecation_date": "2021/03/17",
"rule_name": "Execution via Regsvcs/Regasm",
Expand All @@ -129,6 +164,11 @@
"rule_name": "Deprecated - Potential Reverse Shell via Suspicious Parent Process",
"stack_version": "8.3"
},
"4b4e9c99-27ea-4621-95c8-82341bc6e512": {
"deprecation_date": "2025/03/14",
"rule_name": "Deprecated - Container Workload Protection",
"stack_version": "8.14"
},
"5e87f165-45c2-4b80-bfa5-52822552c997": {
"deprecation_date": "2022/03/16",
"rule_name": "Potential PrintNightmare File Modification",
Expand Down Expand Up @@ -159,6 +199,11 @@
"rule_name": "Deprecated - Threat Intel Filebeat Module (v8.x) Indicator Match",
"stack_version": "8.5"
},
"6c6bb7ea-0636-44ca-b541-201478ef6b50": {
"deprecation_date": "2025/03/14",
"rule_name": "Deprecated - Container Management Utility Run Inside A Container",
"stack_version": "8.14"
},
"6ea71ff0-9e95-475b-9506-2580d1ce6154": {
"deprecation_date": "2022/08/02",
"rule_name": "DNS Activity to the Internet",
Expand Down Expand Up @@ -224,6 +269,11 @@
"rule_name": "Deprecated - Suspicious JAVA Child Process",
"stack_version": "8.12"
},
"8d3d0794-c776-476b-8674-ee2e685f6470": {
"deprecation_date": "2025/03/14",
"rule_name": "Deprecated - Suspicious Interactive Shell Spawned From Inside A Container",
"stack_version": "8.14"
},
"8fed8450-847e-43bd-874c-3bbf0cd425f3": {
"deprecation_date": "2022/05/09",
"rule_name": "Linux Restricted Shell Breakout via apt/apt-get Changelog Escape",
Expand All @@ -234,6 +284,16 @@
"rule_name": "Auditd Login Attempt at Forbidden Time",
"stack_version": "7.16"
},
"9661ed8b-001c-40dc-a777-0983b7b0c91a": {
"deprecation_date": "2025/03/14",
"rule_name": "Deprecated - Sensitive Keys Or Passwords Searched For Inside A Container",
"stack_version": "8.14"
},
"97697a52-4a76-4f0a-aa4f-25c178aae6eb": {
"deprecation_date": "2025/03/14",
"rule_name": "Deprecated - File System Debugger Launched Inside a Privileged Container",
"stack_version": "8.14"
},
"97da359b-2b61-4a40-b2e4-8fc48cf7a294": {
"deprecation_date": "2022/05/09",
"rule_name": "Linux Restricted Shell Breakout via the SSH command",
Expand All @@ -259,6 +319,11 @@
"rule_name": "Network Connection via Mshta",
"stack_version": "7.10.0"
},
"a52a9439-d52c-401c-be37-2785235c6547": {
"deprecation_date": "2025/03/14",
"rule_name": "Deprecated - Netcat Listener Established Inside A Container",
"stack_version": "8.14"
},
"a5f0d057-d540-44f5-924d-c6a2ae92f045": {
"deprecation_date": "2023/06/22",
"rule_name": "Potential SSH Brute Force Detected on Privileged Account",
Expand Down Expand Up @@ -309,6 +374,11 @@
"rule_name": "Socat Process Activity",
"stack_version": "7.14.0"
},
"d0b0f3ed-0b37-44bf-adee-e8cb7de92767": {
"deprecation_date": "2025/03/14",
"rule_name": "Deprecated - AWS Credentials Searched For Inside A Container",
"stack_version": "8.14"
},
"d2053495-8fe7-4168-b3df-dad844046be3": {
"deprecation_date": "2021/04/15",
"rule_name": "PPTP (Point to Point Tunneling Protocol) Activity",
Expand Down Expand Up @@ -364,16 +434,36 @@
"rule_name": "Suspicious Network Connection Attempt by Root",
"stack_version": "8.3"
},
"ec604672-bed9-43e1-8871-cf591c052550": {
"deprecation_date": "2025/03/14",
"rule_name": "Deprecated - File Made Executable via Chmod Inside A Container",
"stack_version": "8.14"
},
"ee619805-54d7-4c56-ba6f-7717282ddd73": {
"deprecation_date": "2022/05/09",
"rule_name": "Linux Restricted Shell Breakout via crash Shell evasion",
"stack_version": "7.16"
},
"ef65e82c-d8b4-4895-9824-5f6bc6166804": {
"deprecation_date": "2025/03/14",
"rule_name": "Deprecated - Potential Container Escape via Modified notify_on_release File",
"stack_version": "8.14"
},
"f52362cd-baf1-4b6d-84be-064efc826461": {
"deprecation_date": "2022/05/09",
"rule_name": "Linux Restricted Shell Breakout via flock Shell evasion",
"stack_version": "7.16"
},
"f5488ac1-099e-4008-a6cb-fb638a0f0828": {
"deprecation_date": "2025/03/14",
"rule_name": "Deprecated - SSH Connection Established Inside A Running Container",
"stack_version": "8.14"
},
"f7769104-e8f9-4931-94a2-68fc04eadec3": {
"deprecation_date": "2025/03/14",
"rule_name": "Deprecated - SSH Authorized Keys File Modified Inside a Container",
"stack_version": "8.14"
},
"fb9937ce-7e21-46bf-831d-1ad96eac674d": {
"deprecation_date": "2022/07/25",
"rule_name": "Auditd Max Failed Login Attempts",
Expand Down
Loading
Loading