chore: promote older rules status from experimental to test

Author: marvi

rules-emerging-threats/2021/Exploits/CVE-2021-40444/proc_creation_win_exploit_cve_2021_40444_office_directory_traversal.yml

@@ -1,6 +1,6 @@
 title: Potential Exploitation Attempt From Office Application
 id: 868955d9-697e-45d4-a3da-360cefd7c216
-status: experimental
+status: test
 description: Detects Office applications executing a child process that includes directory traversal patterns. This could be an attempt to exploit CVE-2022-30190 (MSDT RCE) or CVE-2021-40444 (MSHTML RCE)
 references:
     - https://twitter.com/sbousseaden/status/1531653369546301440

rules-emerging-threats/2022/Exploits/CVE-2022-26809/proc_creation_win_exploit_cve_2022_26809_rpcss_child_process_anomaly.yml

@@ -1,6 +1,6 @@
 title: Potential CVE-2022-26809 Exploitation Attempt
 id: a7cd7306-df8b-4398-b711-6f3e4935cf16
-status: experimental
+status: test
 description: Detects suspicious remote procedure call (RPC) service anomalies based on the spawned sub processes (long shot to detect the exploitation of vulnerabilities like CVE-2022-26809)
 references:
     - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26809

rules-emerging-threats/2022/Exploits/CVE-2022-44877/web_cve_2022_44877_exploitation_attempt.yml

@@ -1,6 +1,6 @@
 title: Potential Centos Web Panel Exploitation Attempt - CVE-2022-44877
 id: 1b2eeb27-949b-4704-8bfa-d8e5cfa045a1
-status: experimental
+status: test
 description: Detects potential exploitation attempts that target the Centos Web Panel 7 Unauthenticated Remote Code Execution CVE-2022-44877
 references:
     - https://seclists.org/fulldisclosure/2023/Jan/1

rules-emerging-threats/2023/Exploits/Windows-Server-Unknown-Exploit/proc_creation_win_exploit_other_win_server_undocumented_rce.yml

@@ -1,6 +1,6 @@
 title: Potential Exploitation Attempt Of Undocumented WindowsServer RCE
 id: 6d5b8176-d87d-4402-8af4-53aee9db7b5d
-status: experimental
+status: test
 description: Detects potential exploitation attempt of undocumented Windows Server Pre Auth Remote Code Execution (RCE)
 references:
     - https://github.com/SigmaHQ/sigma/pull/3946

rules-threat-hunting/windows/builtin/security/win_security_scheduled_task_deletion.yml

@@ -1,6 +1,6 @@
 title: Scheduled Task Deletion
 id: 4f86b304-3e02-40e3-aa5d-e88a167c9617
-status: experimental
+status: test
 description: Detects scheduled task deletion events. Scheduled tasks are likely to be deleted if not used for persistence. Malicious Software often creates tasks directly under the root node e.g. \TASKNAME
 references:
     - https://twitter.com/matthewdunwoody/status/1352356685982146562

rules/cloud/azure/signin_logs/azure_ad_risky_sign_ins_with_singlefactorauth_from_unknown_devices.yml

@@ -1,6 +1,6 @@
 title: Suspicious SignIns From A Non Registered Device
 id: 572b12d4-9062-11ed-a1eb-0242ac120002
-status: experimental
+status: test
 description: Detects risky authencaition from a non AD registered device without MFA being required.
 references:
     - https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-devices#non-compliant-device-sign-in

rules/cloud/github/github_delete_action_invoked.yml

@@ -1,6 +1,6 @@
 title: Github Delete Action Invoked
 id: 16a71777-0b2e-4db7-9888-9d59cb75200b
-status: experimental
+status: test
 description: Detects delete action in the Github audit logs for codespaces, environment, project and repo.
 author: Muhammad Faisal
 date: 2023/01/19

rules/cloud/github/github_disable_high_risk_configuration.yml

@@ -1,6 +1,6 @@
 title: Github High Risk Configuration Disabled
 id: 8622c92d-c00e-463c-b09d-fd06166f6794
-status: experimental
+status: test
 description: Detects when a user disables a critical security feature for an organization.
 author: Muhammad Faisal
 date: 2023/01/29

rules/cloud/github/github_disabled_outdated_dependency_or_vulnerability.yml

@@ -1,6 +1,6 @@
 title: Outdated Dependency Or Vulnerability Alert Disabled
 id: 34e1c7d4-0cd5-419d-9f1b-1dad3f61018d
-status: experimental
+status: test
 description: |
     Dependabot performs a scan to detect insecure dependencies, and sends Dependabot alerts.
     This rule detects when an organization owner disables Dependabot alerts private repositories or Dependabot security updates for all repositories.

rules/cloud/github/github_new_org_member.yml

@@ -1,6 +1,6 @@
 title: New Github Organization Member Added
 id: 3908d64a-3c06-4091-b503-b3a94424533b
-status: experimental
+status: test
 description: Detects when a new member is added or invited to a github organization.
 author: Muhammad Faisal
 date: 2023/01/29