Browse Rules

Search and filter across all detection sources

200 rules

wazuh low xml

osquery: $(osquery.pack) $(osquery.subquery): OS $(osquery.columns.name) $(osquery.columns.version) $(osquery.columns.major).$(osquery.columns.minor) $(osquery.columns.codename)

osquery: $(osquery.pack) $(osquery.subquery): OS $(osquery.columns.name) $(osquery.columns.version) $(osquery.columns.major).$(osquery.columns.minor) $(osquery.columns.codename)

wazuh low xml

osquery: $(osquery.pack) $(osquery.subquery): Osquery version is $(osquery.columns.version) build on $(osquery.columns.build_platform) $(osquery.columns.build_distro)

osquery: $(osquery.pack) $(osquery.subquery): Osquery version is $(osquery.columns.version) build on $(osquery.columns.build_platform) $(osquery.columns.build_distro)

wazuh low xml

osquery: $(osquery.pack) $(osquery.subquery): Key $(osquery.columns.key), Value $(osquery.columns.value)

osquery: $(osquery.pack) $(osquery.subquery): Key $(osquery.columns.key), Value $(osquery.columns.value)

wazuh low xml

osquery: $(osquery.pack) $(osquery.subquery): Key $(osquery.columns.key), Value $(osquery.columns.value)

osquery: $(osquery.pack) $(osquery.subquery): Key $(osquery.columns.key), Value $(osquery.columns.value)

wazuh low xml

osquery: $(osquery.pack) $(osquery.subquery): Username $(osquery.columns.username), Key $(osquery.columns.key)

osquery: $(osquery.pack) $(osquery.subquery): Username $(osquery.columns.username), Key $(osquery.columns.key)

wazuh low xml

osquery: $(osquery.pack) $(osquery.subquery): Username $(osquery.columns.username), Key $(osquery.columns.key)

osquery: $(osquery.pack) $(osquery.subquery): Username $(osquery.columns.username), Key $(osquery.columns.key)

wazuh low xml

osquery: $(osquery.pack) $(osquery.subquery): Address $(osquery.columns.address) Hostnames $(osquery.columns.hostnames)

osquery: $(osquery.pack) $(osquery.subquery): Address $(osquery.columns.address) Hostnames $(osquery.columns.hostnames)

wazuh low xml

osquery: $(osquery.pack) $(osquery.subquery): User $(osquery.columns.username) host $(osquery.columns.host)

osquery: $(osquery.pack) $(osquery.subquery): User $(osquery.columns.username) host $(osquery.columns.host)

wazuh low xml

osquery: $(osquery.pack) $(osquery.subquery): Osquery version is $(osquery.columns.version) build on $(osquery.columns.build_platform) $(osquery.columns.build_distro)

osquery: $(osquery.pack) $(osquery.subquery): Osquery version is $(osquery.columns.version) build on $(osquery.columns.build_platform) $(osquery.columns.build_distro)

wazuh low xml

osquery: $(osquery.pack) $(osquery.subquery): Device $(osquery.columns.path), UID $(osquery.columns.uid), GID $(osquery.columns.gid), type $(osquery.columns.type)

osquery: $(osquery.pack) $(osquery.subquery): Device $(osquery.columns.path), UID $(osquery.columns.uid), GID $(osquery.columns.gid), type $(osquery.columns.type)

wazuh low xml

osquery: $(osquery.pack) $(osquery.subquery): Command launched $(osquery.columns.command) at $(osquery.columns.hour):$(osquery.columns.minute) $(osquery.columns.day_of_month) $(osquery.columns.month)

osquery: $(osquery.pack) $(osquery.subquery): Command launched $(osquery.columns.command) at $(osquery.columns.hour):$(osquery.columns.minute) $(osquery.columns.day_of_month) $(osquery.columns.month)

wazuh low xml

osquery: $(osquery.pack) $(osquery.subquery): Kernel module $(osquery.columns.name) version $(osquery.columns.version)

osquery: $(osquery.pack) $(osquery.subquery): Kernel module $(osquery.columns.name) version $(osquery.columns.version)

wazuh low xml

osquery: $(osquery.pack) $(osquery.subquery): Shared NFS $(osquery.columns.share) options $(osquery.columns.options)

osquery: $(osquery.pack) $(osquery.subquery): Shared NFS $(osquery.columns.share) options $(osquery.columns.options)

wazuh low xml

osquery: $(osquery.pack) $(osquery.subquery): Shared NFS $(osquery.columns.share) options $(osquery.columns.options)

osquery: $(osquery.pack) $(osquery.subquery): Shared NFS $(osquery.columns.share) options $(osquery.columns.options)

wazuh low xml

osquery: $(osquery.pack) $(osquery.subquery): Keychain $(osquery.columns.label) path is $(osquery.columns.path)

osquery: $(osquery.pack) $(osquery.subquery): Keychain $(osquery.columns.label) path is $(osquery.columns.path)

wazuh low xml

osquery: $(osquery.pack) $(osquery.subquery): Keychain $(osquery.columns.label) path is $(osquery.columns.path)

osquery: $(osquery.pack) $(osquery.subquery): Keychain $(osquery.columns.label) path is $(osquery.columns.path)

wazuh low xml

osquery: $(osquery.pack) $(osquery.subquery): Kernel module $(osquery.columns.name) version $(osquery.columns.version)

osquery: $(osquery.pack) $(osquery.subquery): Kernel module $(osquery.columns.name) version $(osquery.columns.version)

wazuh low xml

osquery: $(osquery.pack) $(osquery.subquery): NVRAM variable $(osquery.columns.name) value $(osquery.columns.value)

osquery: $(osquery.pack) $(osquery.subquery): NVRAM variable $(osquery.columns.name) value $(osquery.columns.value)

wazuh low xml

osquery: $(osquery.pack) $(osquery.subquery): EFI file $(osquery.columns.path) sha256 $(osquery.columns.sha256)

osquery: $(osquery.pack) $(osquery.subquery): EFI file $(osquery.columns.path) sha256 $(osquery.columns.sha256)

wazuh low xml

osquery: $(osquery.pack) $(osquery.subquery): Process $(osquery.columns.pid) Environment variable $(osquery.columns.key) value $(osquery.columns.value)

osquery: $(osquery.pack) $(osquery.subquery): Process $(osquery.columns.pid) Environment variable $(osquery.columns.key) value $(osquery.columns.value)

wazuh low xml

osquery: $(osquery.pack) $(osquery.subquery): Portage package $(osquery.columns.package) $(osquery.columns.version) USE flags $(osquery.columns.flags)

osquery: $(osquery.pack) $(osquery.subquery): Portage package $(osquery.columns.package) $(osquery.columns.version) USE flags $(osquery.columns.flags)

wazuh low xml

osquery: $(osquery.pack) $(osquery.subquery): Portage package $(osquery.columns.package) $(osquery.columns.version) USE flags $(osquery.columns.flags)

osquery: $(osquery.pack) $(osquery.subquery): Portage package $(osquery.columns.package) $(osquery.columns.version) USE flags $(osquery.columns.flags)

wazuh low xml

osquery: $(osquery.pack) $(osquery.subquery): Portage package $(osquery.columns.package) $(osquery.columns.version) USE flags $(osquery.columns.flags)

osquery: $(osquery.pack) $(osquery.subquery): Portage package $(osquery.columns.package) $(osquery.columns.version) USE flags $(osquery.columns.flags)

wazuh low xml

osquery: $(osquery.pack) $(osquery.subquery): Process $(osquery.columns.pid) $(osquery.columns.path) memory start $(osquery.columns.start), memory end $(osquery.columns.end)

osquery: $(osquery.pack) $(osquery.subquery): Process $(osquery.columns.pid) $(osquery.columns.path) memory start $(osquery.columns.start), memory end $(osquery.columns.end)

wazuh low xml

osquery: $(osquery.pack) $(osquery.subquery): OS $(osquery.columns.name) $(osquery.columns.version) with minor $(osquery.columns.minor) and major $(osquery.columns.major)

osquery: $(osquery.pack) $(osquery.subquery): OS $(osquery.columns.name) $(osquery.columns.version) with minor $(osquery.columns.minor) and major $(osquery.columns.major)