diff --git a/rules/windows/file/file_event/file_event_win_susp_clr_logs.yml b/rules-deprecated/windows/file_event_win_susp_clr_logs.yml similarity index 97% rename from rules/windows/file/file_event/file_event_win_susp_clr_logs.yml rename to rules-deprecated/windows/file_event_win_susp_clr_logs.yml index 4b5d1c854..84d2f62d7 100644 --- a/rules/windows/file/file_event/file_event_win_susp_clr_logs.yml +++ b/rules-deprecated/windows/file_event_win_susp_clr_logs.yml @@ -1,6 +1,6 @@ title: Suspicious CLR Logs Creation id: e4b63079-6198-405c-abd7-3fe8b0ce3263 -status: experimental +status: deprecated description: Detects suspicious .NET assembly executions. Could detect using Cobalt Strike's command execute-assembly. references: - https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html @@ -8,7 +8,7 @@ references: - https://github.com/olafhartong/sysmon-modular/blob/5e5f6d90819a7f35eec0aba08021d0d201bb9055/11_file_create/include_dotnet.xml author: omkar72, oscd.community, Wojciech Lesicki date: 2020/10/12 -modified: 2022/06/24 +modified: 2023/01/05 tags: - attack.execution - attack.defense_evasion diff --git a/rules/windows/process_creation/proc_creation_win_indirect_cmd.yml b/rules-deprecated/windows/proc_creation_win_indirect_cmd.yml similarity index 96% rename from rules/windows/process_creation/proc_creation_win_indirect_cmd.yml rename to rules-deprecated/windows/proc_creation_win_indirect_cmd.yml index a2f9064b5..ae206f284 100644 --- a/rules/windows/process_creation/proc_creation_win_indirect_cmd.yml +++ b/rules-deprecated/windows/proc_creation_win_indirect_cmd.yml @@ -1,13 +1,13 @@ title: Indirect Command Execution id: fa47597e-90e9-41cd-ab72-c3b74cfb0d02 -status: test +status: deprecated description: Detect indirect command execution via Program Compatibility Assistant (pcalua.exe or forfiles.exe). references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1202/T1202.md - https://eqllib.readthedocs.io/en/latest/analytics/884a7ccd-7305-4130-82d0-d4f90bc118b6.html author: E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community date: 2019/10/24 -modified: 2021/11/27 +modified: 2023/01/04 tags: - attack.defense_evasion - attack.t1202 diff --git a/rules/windows/process_creation/proc_creation_win_indirect_command_execution_forfiles.yml b/rules-deprecated/windows/proc_creation_win_indirect_command_execution_forfiles.yml similarity index 73% rename from rules/windows/process_creation/proc_creation_win_indirect_command_execution_forfiles.yml rename to rules-deprecated/windows/proc_creation_win_indirect_command_execution_forfiles.yml index 29a87ef8f..e05d0a2a5 100644 --- a/rules/windows/process_creation/proc_creation_win_indirect_command_execution_forfiles.yml +++ b/rules-deprecated/windows/proc_creation_win_indirect_command_execution_forfiles.yml @@ -1,12 +1,16 @@ title: Indirect Command Exectuion via Forfiles id: a85cf4e3-56ee-4e79-adeb-789f8fb209a8 -status: experimental -description: Detects the use of native Windows tool, forfiles to execute a file. Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters. +related: + - id: fa47597e-90e9-41cd-ab72-c3b74cfb0d02 + type: obsoletes +status: deprecated +description: Detects execition of commands and binaries from the context of "forfiles.exe". This can be used as a LOLBIN in order to bypass application whitelisting. references: - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-73d61931b2c77fde294189ce5d62323b416296a7c23ea98a608f425566538d1a - https://lolbas-project.github.io/lolbas/Binaries/Forfiles/ -author: Tim Rauch (rule), Elastic (idea) +author: Tim Rauch (rule), Elastic (idea), E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community date: 2022/10/17 +modified: 2023/01/04 tags: - attack.defense_evasion - attack.t1202 diff --git a/rules/cloud/aws/aws_enum_buckets.yml b/rules/cloud/aws/aws_enum_buckets.yml new file mode 100644 index 000000000..dafc5c15e --- /dev/null +++ b/rules/cloud/aws/aws_enum_buckets.yml @@ -0,0 +1,29 @@ +title: Potential Bucket Enumeration on AWS +id: f305fd62-beca-47da-ad95-7690a0620084 +related: + - id: 4723218f-2048-41f6-bcb0-417f2d784f61 + type: similar +status: experimental +description: Looks for potential enumeration of AWS buckets via ListBuckets. +references: + - https://github.com/Lifka/hacking-resources/blob/c2ae355d381bd0c9f0b32c4ead049f44e5b1573f/cloud-hacking-cheat-sheets.md + - https://jamesonhacking.blogspot.com/2020/12/pivoting-to-private-aws-s3-buckets.html + - https://securitycafe.ro/2022/12/14/aws-enumeration-part-ii-practical-enumeration/ +author: 'Christopher Peacock @securepeacock, SCYTHE @scythe_io' +date: 2023/01/06 +tags: + - attack.discovery + - attack.t1580 +logsource: + product: aws + service: cloudtrail +detection: + selection: + eventSource: 'ec2.amazonaws.com' + eventName: 'ListBuckets' + filter: + type: 'AssumedRole' + condition: selection and not filter +falsepositives: + - Administrators listing buckets, it may be necessary to filter out users who commonly conduct this activity. +level: low diff --git a/rules/cloud/aws/aws_enum_storage.yml b/rules/cloud/aws/aws_enum_storage.yml index c47b8e5f7..6e81408f4 100644 --- a/rules/cloud/aws/aws_enum_storage.yml +++ b/rules/cloud/aws/aws_enum_storage.yml @@ -1,5 +1,8 @@ title: Potential Storage Enumeration on AWS id: 4723218f-2048-41f6-bcb0-417f2d784f61 +related: + - id: f305fd62-beca-47da-ad95-7690a0620084 + type: similar status: experimental description: Detects potential enumeration activity targeting AWS storage references: diff --git a/rules/cloud/azure/azure_app_privileged_permissions.yml b/rules/cloud/azure/azure_app_privileged_permissions.yml index ec44918df..bdc64a4c7 100644 --- a/rules/cloud/azure/azure_app_privileged_permissions.yml +++ b/rules/cloud/azure/azure_app_privileged_permissions.yml @@ -9,8 +9,8 @@ date: 2022/07/28 tags: - attack.privilege_escalation logsource: - product: microsoft365portal - service: auditlogs + product: azure + service: microsoft365portal detection: selection: properties.message: Add app role assignment to service principal diff --git a/rules/linux/auditd/lnx_auditd_binary_padding.yml b/rules/linux/auditd/lnx_auditd_binary_padding.yml index 54d9207d9..a13c63e96 100644 --- a/rules/linux/auditd/lnx_auditd_binary_padding.yml +++ b/rules/linux/auditd/lnx_auditd_binary_padding.yml @@ -2,13 +2,13 @@ title: Binary Padding - Linux id: c52a914f-3d8b-4b2a-bb75-b3991e75f8ba status: test description: | - Adversaries may use binary padding to add junk data and change the on-disk representation of malware. - This rule detect using dd and truncate to add a junk data to file. + Adversaries may use binary padding to add junk data and change the on-disk representation of malware. + This rule detect using dd and truncate to add a junk data to file. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1027.001/T1027.001.md author: 'Igor Fits, oscd.community' date: 2020/10/13 -modified: 2022/11/26 +modified: 2023/01/06 tags: - attack.defense_evasion - attack.t1027.001 @@ -16,17 +16,17 @@ logsource: product: linux service: auditd detection: - execve: + selection_execve: type: 'EXECVE' - truncate: + keywords_truncate: - 'truncate' - '-s' - dd: + keywords_dd: - 'dd' - 'if=' - filter: + keywords_filter: - 'of=' - condition: execve and (all of truncate or (all of dd and not filter)) + condition: selection_execve and (all of keywords_truncate or (all of keywords_dd and not keywords_filter)) falsepositives: - - Legitimate script work + - Unknown level: high diff --git a/rules/linux/auditd/lnx_auditd_find_cred_in_files.yml b/rules/linux/auditd/lnx_auditd_find_cred_in_files.yml index fc4b87556..db6bb212a 100644 --- a/rules/linux/auditd/lnx_auditd_find_cred_in_files.yml +++ b/rules/linux/auditd/lnx_auditd_find_cred_in_files.yml @@ -6,7 +6,7 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.001/T1552.001.md author: 'Igor Fits, oscd.community' date: 2020/10/15 -modified: 2022/11/28 +modified: 2023/01/06 tags: - attack.credential_access - attack.t1552.001 @@ -14,12 +14,12 @@ logsource: product: linux service: auditd detection: - execve: + selection: type: 'EXECVE' - passwordgrep: + keywords: - 'grep' - 'password' - condition: execve and all of passwordgrep + condition: selection and all of keywords falsepositives: - Unknown level: high diff --git a/rules/linux/builtin/lnx_pwnkit_local_privilege_escalation.yml b/rules/linux/builtin/auth/lnx_auth_pwnkit_local_privilege_escalation.yml similarity index 90% rename from rules/linux/builtin/lnx_pwnkit_local_privilege_escalation.yml rename to rules/linux/builtin/auth/lnx_auth_pwnkit_local_privilege_escalation.yml index d28ba5af1..618c59c82 100644 --- a/rules/linux/builtin/lnx_pwnkit_local_privilege_escalation.yml +++ b/rules/linux/builtin/auth/lnx_auth_pwnkit_local_privilege_escalation.yml @@ -6,6 +6,7 @@ references: - https://twitter.com/wdormann/status/1486161836961579020 author: Sreeman date: 2022/01/26 +modified: 2023/01/06 tags: - attack.privilege_escalation - attack.t1548.001 @@ -13,11 +14,11 @@ logsource: product: linux service: auth detection: - keyword: + keywords: - 'pkexec' - 'The value for environment variable XAUTHORITY contains suscipious content' - '[USER=root] [TTY=/dev/pts/0]' - condition: all of keyword + condition: all of keywords falsepositives: - Unknown level: high diff --git a/rules/linux/other/lnx_susp_failed_logons_single_source.yml b/rules/linux/builtin/auth/lnx_auth_susp_failed_logons_single_source.yml similarity index 100% rename from rules/linux/other/lnx_susp_failed_logons_single_source.yml rename to rules/linux/builtin/auth/lnx_auth_susp_failed_logons_single_source.yml diff --git a/rules/linux/other/lnx_clamav.yml b/rules/linux/builtin/clamav/lnx_clamav_relevant_message.yml similarity index 100% rename from rules/linux/other/lnx_clamav.yml rename to rules/linux/builtin/clamav/lnx_clamav_relevant_message.yml diff --git a/rules/linux/builtin/lnx_crontab_file_modification.yml b/rules/linux/builtin/cron/lnx_cron_crontab_file_modification.yml similarity index 100% rename from rules/linux/builtin/lnx_crontab_file_modification.yml rename to rules/linux/builtin/cron/lnx_cron_crontab_file_modification.yml diff --git a/rules/linux/other/lnx_susp_guacamole.yml b/rules/linux/builtin/guacamole/lnx_guacamole_susp_guacamole.yml similarity index 100% rename from rules/linux/other/lnx_susp_guacamole.yml rename to rules/linux/builtin/guacamole/lnx_guacamole_susp_guacamole.yml diff --git a/rules/linux/builtin/lnx_nimbuspwn_privilege_escalation_exploit.yml b/rules/linux/builtin/lnx_nimbuspwn_privilege_escalation_exploit.yml index 36577bd51..ae84422a5 100644 --- a/rules/linux/builtin/lnx_nimbuspwn_privilege_escalation_exploit.yml +++ b/rules/linux/builtin/lnx_nimbuspwn_privilege_escalation_exploit.yml @@ -7,17 +7,18 @@ references: - https://github.com/Immersive-Labs-Sec/nimbuspwn author: Bhabesh Raj date: 2022/05/04 +modified: 2023/01/06 tags: - attack.privilege_escalation - attack.t1068 logsource: product: linux detection: - keyword: + keywords: - 'networkd-dispatcher' - 'Error handling notification for interface' - '../../' - condition: all of keyword + condition: all of keywords falsepositives: - Unknown level: high diff --git a/rules/linux/builtin/lnx_susp_dev_tcp.yml b/rules/linux/builtin/lnx_susp_dev_tcp.yml index 74a59784c..324126620 100644 --- a/rules/linux/builtin/lnx_susp_dev_tcp.yml +++ b/rules/linux/builtin/lnx_susp_dev_tcp.yml @@ -8,13 +8,13 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1046/T1046.md#atomic-test-1---port-scan author: frack113 date: 2021/12/10 -modified: 2022/01/10 +modified: 2023/01/06 tags: - attack.reconnaissance logsource: product: linux detection: - keyword: + keywords: - 'cat /dev/tcp/' - 'echo >/dev/tcp/' @@ -25,7 +25,7 @@ detection: - '(sh)0>/dev/tcp/' - 'bash -c ''bash -i >& /dev/tcp/' - 'echo -e ''#!/bin/bash\nbash -i >& /dev/tcp/' - condition: 1 of keyword + condition: keywords falsepositives: - Unknown level: medium diff --git a/rules/linux/other/lnx_ssh_cve_2018_15473.yml b/rules/linux/builtin/sshd/lnx_sshd_ssh_cve_2018_15473.yml similarity index 100% rename from rules/linux/other/lnx_ssh_cve_2018_15473.yml rename to rules/linux/builtin/sshd/lnx_sshd_ssh_cve_2018_15473.yml diff --git a/rules/linux/other/lnx_susp_ssh.yml b/rules/linux/builtin/sshd/lnx_sshd_susp_ssh.yml similarity index 100% rename from rules/linux/other/lnx_susp_ssh.yml rename to rules/linux/builtin/sshd/lnx_sshd_susp_ssh.yml diff --git a/rules/linux/builtin/lnx_sudo_cve_2019_14287_user.yml b/rules/linux/builtin/sudo/lnx_sudo_cve_2019_14287_user.yml similarity index 100% rename from rules/linux/builtin/lnx_sudo_cve_2019_14287_user.yml rename to rules/linux/builtin/sudo/lnx_sudo_cve_2019_14287_user.yml diff --git a/rules/linux/other/lnx_security_tools_disabling_syslog.yml b/rules/linux/builtin/syslog/lnx_syslog_security_tools_disabling_syslog.yml similarity index 100% rename from rules/linux/other/lnx_security_tools_disabling_syslog.yml rename to rules/linux/builtin/syslog/lnx_syslog_security_tools_disabling_syslog.yml diff --git a/rules/linux/other/lnx_susp_named.yml b/rules/linux/builtin/syslog/lnx_syslog_susp_named.yml similarity index 100% rename from rules/linux/other/lnx_susp_named.yml rename to rules/linux/builtin/syslog/lnx_syslog_susp_named.yml diff --git a/rules/linux/other/lnx_susp_vsftp.yml b/rules/linux/builtin/vsftpd/lnx_vsftpd_susp_error_messages.yml similarity index 100% rename from rules/linux/other/lnx_susp_vsftp.yml rename to rules/linux/builtin/vsftpd/lnx_vsftpd_susp_error_messages.yml diff --git a/rules/linux/process_creation/proc_creation_lnx_hack_tools.yml b/rules/linux/process_creation/proc_creation_lnx_hack_tools.yml new file mode 100644 index 000000000..9633677c0 --- /dev/null +++ b/rules/linux/process_creation/proc_creation_lnx_hack_tools.yml @@ -0,0 +1,29 @@ +title: HackTool Execution +id: a015e032-146d-4717-8944-7a1884122111 +status: experimental +description: Detects known hacktool execution based on image name +references: + - Internal Research +author: Nasreddine Bencherchali +date: 2023/01/03 +tags: + - attack.execution +logsource: + product: linux + category: process_creation +detection: + selection: + Image|endswith: + # Add more as you see fit + - '/sqlmap' + - '/teamserver' + - '/aircrack-ng' + - '/john' + - '/setoolkit' + - '/wpscan' + - '/hydra' + - '/nikto' + condition: selection +falsepositives: + - Unknown +level: high diff --git a/rules/linux/process_creation/proc_creation_lnx_install_suspicioua_packages.yml b/rules/linux/process_creation/proc_creation_lnx_install_suspicioua_packages.yml new file mode 100644 index 000000000..726225676 --- /dev/null +++ b/rules/linux/process_creation/proc_creation_lnx_install_suspicioua_packages.yml @@ -0,0 +1,47 @@ +title: Suspicious Package Installed - Linux +id: 700fb7e8-2981-401c-8430-be58e189e741 +status: experimental +description: Detects installation of suspicious packages using system installation utilities +references: + - https://gist.githubusercontent.com/MichaelKoczwara/12faba9c061c12b5814b711166de8c2f/raw/e2068486692897b620c25fde1ea258c8218fe3d3/history.txt +author: Nasreddine Bencherchali +date: 2023/01/03 +tags: + - attack.defense_evasion + - attack.t1553.004 +logsource: + product: linux + category: process_creation +detection: + selection_tool_apt: + Image|endswith: + - '/apt' + - '/apt-get' + CommandLine|contains: 'install' + selection_tool_yum: + Image|endswith: '/yum' + CommandLine|contains: + - 'localinstall' + - 'install' + selection_tool_rpm: + Image|endswith: '/rpm' + CommandLine|contains: '-i' + selection_tool_dpkg: + Image|endswith: '/dpkg' + CommandLine|contains: + - '--install' + - '-i' + selection_keyword: + CommandLine|contains: + # Add more suspicious packages + - 'nmap' + - ' nc' + - 'netcat' + - 'wireshark' + - 'tshark' + - 'openconnect' + - 'proxychains' + condition: 1 of selection_tool_* and selection_keyword +falsepositives: + - Legitimate administration activities +level: medium diff --git a/rules/linux/process_creation/proc_creation_lnx_susp_git_clone.yml b/rules/linux/process_creation/proc_creation_lnx_susp_git_clone.yml new file mode 100644 index 000000000..33e0d9972 --- /dev/null +++ b/rules/linux/process_creation/proc_creation_lnx_susp_git_clone.yml @@ -0,0 +1,41 @@ +title: Suspicious Git Clone - Linux +id: cfec9d29-64ec-4a0f-9ffe-0fdb856d5446 +status: experimental +description: Detects execution of "git" in order to clone a remote repository that contain suspicious keywords which might be suspicious +references: + - https://gist.githubusercontent.com/MichaelKoczwara/12faba9c061c12b5814b711166de8c2f/raw/e2068486692897b620c25fde1ea258c8218fe3d3/history.txt +author: Nasreddine Bencherchali +date: 2023/01/03 +modified: 2023/01/05 +tags: + - attack.reconnaissance + - attack.t1593.003 +logsource: + category: process_creation + product: linux +detection: + selection_img: + Image|endswith: '/git' + CommandLine|contains: ' clone ' + selection_keyword: + CommandLine|contains: + # Add more suspicious keywords + - 'exploit' + - 'Vulns' + - 'vulnerability' + - 'RCE' + - 'RemoteCodeExecution' + - 'Invoke-' + - 'CVE-' + - 'poc-' + - 'ProofOfConcept' + # Add more vuln names + - 'proxyshell' + - 'log4shell' + - 'eternalblue' + - 'eternal-blue' + - 'MS17-' + condition: all of selection_* +falsepositives: + - Unknown +level: medium diff --git a/rules/macos/process_creation/proc_creation_macos_space_after_filename.yml b/rules/macos/process_creation/proc_creation_macos_space_after_filename.yml index f7f329e03..4570e106d 100644 --- a/rules/macos/process_creation/proc_creation_macos_space_after_filename.yml +++ b/rules/macos/process_creation/proc_creation_macos_space_after_filename.yml @@ -6,7 +6,7 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1036.006/T1036.006.md author: remotephone date: 2021/11/20 -modified: 2022/12/25 +modified: 2023/01/04 tags: - attack.defense_evasion - attack.t1036.006 @@ -17,7 +17,7 @@ detection: selection1: CommandLine|endswith: ' ' selection2: - ImageName|endswith: ' ' + Image|endswith: ' ' condition: 1 of selection* falsepositives: - Mistyped commands or legitimate binaries named to match the pattern diff --git a/rules/network/cisco/aaa/cisco_cli_collect_data.yml b/rules/network/cisco/aaa/cisco_cli_collect_data.yml index d832f6094..7e00356ca 100644 --- a/rules/network/cisco/aaa/cisco_cli_collect_data.yml +++ b/rules/network/cisco/aaa/cisco_cli_collect_data.yml @@ -4,7 +4,7 @@ status: test description: Collect pertinent data from the configuration files author: Austin Clark date: 2019/08/11 -modified: 2021/11/27 +modified: 2023/01/04 tags: - attack.discovery - attack.credential_access @@ -15,7 +15,6 @@ tags: logsource: product: cisco service: aaa - category: accounting detection: keywords: - 'show running-config' diff --git a/rules/network/cisco/aaa/cisco_cli_crypto_actions.yml b/rules/network/cisco/aaa/cisco_cli_crypto_actions.yml index cac0f231d..ee51db55f 100644 --- a/rules/network/cisco/aaa/cisco_cli_crypto_actions.yml +++ b/rules/network/cisco/aaa/cisco_cli_crypto_actions.yml @@ -4,7 +4,7 @@ status: test description: Show when private keys are being exported from the device, or when new certificates are installed author: Austin Clark date: 2019/08/12 -modified: 2021/11/27 +modified: 2023/01/04 tags: - attack.credential_access - attack.defense_evasion @@ -13,7 +13,6 @@ tags: logsource: product: cisco service: aaa - category: accounting detection: keywords: - 'crypto pki export' diff --git a/rules/network/cisco/aaa/cisco_cli_disable_logging.yml b/rules/network/cisco/aaa/cisco_cli_disable_logging.yml index ea9d7290f..7ff07143b 100644 --- a/rules/network/cisco/aaa/cisco_cli_disable_logging.yml +++ b/rules/network/cisco/aaa/cisco_cli_disable_logging.yml @@ -4,14 +4,13 @@ status: test description: Turn off logging locally or remote author: Austin Clark date: 2019/08/11 -modified: 2021/11/27 +modified: 2023/01/04 tags: - attack.defense_evasion - attack.t1562.001 logsource: product: cisco service: aaa - category: accounting detection: keywords: - 'no logging' diff --git a/rules/network/cisco/aaa/cisco_cli_discovery.yml b/rules/network/cisco/aaa/cisco_cli_discovery.yml index ca5e160ea..970e34df7 100644 --- a/rules/network/cisco/aaa/cisco_cli_discovery.yml +++ b/rules/network/cisco/aaa/cisco_cli_discovery.yml @@ -4,7 +4,7 @@ status: test description: Find information about network devices that is not stored in config files author: Austin Clark date: 2019/08/12 -modified: 2021/11/27 +modified: 2023/01/04 tags: - attack.discovery - attack.t1083 @@ -19,7 +19,6 @@ tags: logsource: product: cisco service: aaa - category: accounting detection: keywords: - 'dir' diff --git a/rules/network/cisco/aaa/cisco_cli_dos.yml b/rules/network/cisco/aaa/cisco_cli_dos.yml index 769660112..e2455a3bc 100644 --- a/rules/network/cisco/aaa/cisco_cli_dos.yml +++ b/rules/network/cisco/aaa/cisco_cli_dos.yml @@ -4,7 +4,7 @@ status: test description: Detect a system being shutdown or put into different boot mode author: Austin Clark date: 2019/08/15 -modified: 2021/11/27 +modified: 2023/01/04 tags: - attack.impact - attack.t1495 @@ -13,7 +13,6 @@ tags: logsource: product: cisco service: aaa - category: accounting detection: keywords: - 'shutdown' diff --git a/rules/network/cisco/aaa/cisco_cli_file_deletion.yml b/rules/network/cisco/aaa/cisco_cli_file_deletion.yml index e79f3b9f7..beedf9793 100644 --- a/rules/network/cisco/aaa/cisco_cli_file_deletion.yml +++ b/rules/network/cisco/aaa/cisco_cli_file_deletion.yml @@ -4,7 +4,7 @@ status: test description: See what files are being deleted from flash file systems author: Austin Clark date: 2019/08/12 -modified: 2021/11/27 +modified: 2023/01/04 tags: - attack.defense_evasion - attack.impact @@ -14,7 +14,6 @@ tags: logsource: product: cisco service: aaa - category: accounting detection: keywords: - 'erase' diff --git a/rules/network/cisco/aaa/cisco_cli_input_capture.yml b/rules/network/cisco/aaa/cisco_cli_input_capture.yml index 4a8bbfc82..ccd20f84a 100644 --- a/rules/network/cisco/aaa/cisco_cli_input_capture.yml +++ b/rules/network/cisco/aaa/cisco_cli_input_capture.yml @@ -4,14 +4,13 @@ status: test description: See what commands are being input into the device by other people, full credentials can be in the history author: Austin Clark date: 2019/08/11 -modified: 2021/11/27 +modified: 2023/01/04 tags: - attack.credential_access - attack.t1552.003 logsource: product: cisco service: aaa - category: accounting detection: keywords: - 'show history' diff --git a/rules/network/cisco/aaa/cisco_cli_local_accounts.yml b/rules/network/cisco/aaa/cisco_cli_local_accounts.yml index c941f2447..678773565 100644 --- a/rules/network/cisco/aaa/cisco_cli_local_accounts.yml +++ b/rules/network/cisco/aaa/cisco_cli_local_accounts.yml @@ -4,7 +4,7 @@ status: test description: Find local accounts being created or modified as well as remote authentication configurations author: Austin Clark date: 2019/08/12 -modified: 2021/11/27 +modified: 2023/01/04 tags: - attack.persistence - attack.t1136.001 @@ -12,7 +12,6 @@ tags: logsource: product: cisco service: aaa - category: accounting detection: keywords: - 'username' diff --git a/rules/network/cisco/aaa/cisco_cli_modify_config.yml b/rules/network/cisco/aaa/cisco_cli_modify_config.yml index a3f833c20..699678c94 100644 --- a/rules/network/cisco/aaa/cisco_cli_modify_config.yml +++ b/rules/network/cisco/aaa/cisco_cli_modify_config.yml @@ -4,7 +4,7 @@ status: test description: Modifications to a config that will serve an adversary's impacts or persistence author: Austin Clark date: 2019/08/12 -modified: 2021/11/27 +modified: 2023/01/04 tags: - attack.persistence - attack.impact @@ -15,7 +15,6 @@ tags: logsource: product: cisco service: aaa - category: accounting detection: keywords: - 'ip http server' diff --git a/rules/network/cisco/aaa/cisco_cli_moving_data.yml b/rules/network/cisco/aaa/cisco_cli_moving_data.yml index b4f5f2963..a5068ab1d 100644 --- a/rules/network/cisco/aaa/cisco_cli_moving_data.yml +++ b/rules/network/cisco/aaa/cisco_cli_moving_data.yml @@ -4,7 +4,7 @@ status: test description: Various protocols maybe used to put data on the device for exfil or infil author: Austin Clark date: 2019/08/12 -modified: 2021/11/27 +modified: 2023/01/04 tags: - attack.collection - attack.lateral_movement @@ -16,7 +16,6 @@ tags: logsource: product: cisco service: aaa - category: accounting detection: keywords: - 'tftp' diff --git a/rules/network/cisco/aaa/cisco_cli_net_sniff.yml b/rules/network/cisco/aaa/cisco_cli_net_sniff.yml index 0a390d6d4..e5063d4dc 100644 --- a/rules/network/cisco/aaa/cisco_cli_net_sniff.yml +++ b/rules/network/cisco/aaa/cisco_cli_net_sniff.yml @@ -4,7 +4,7 @@ status: test description: Show when a monitor or a span/rspan is setup or modified author: Austin Clark date: 2019/08/11 -modified: 2021/11/27 +modified: 2023/01/04 tags: - attack.credential_access - attack.discovery @@ -12,7 +12,6 @@ tags: logsource: product: cisco service: aaa - category: accounting detection: keywords: - 'monitor capture point' diff --git a/rules/linux/modsecurity/modsec_mulitple_blocks.yml b/rules/product/modsecurity/modsec_mulitple_blocks.yml similarity index 92% rename from rules/linux/modsecurity/modsec_mulitple_blocks.yml rename to rules/product/modsecurity/modsec_mulitple_blocks.yml index 6ae3bc1ae..f98254afd 100644 --- a/rules/linux/modsecurity/modsec_mulitple_blocks.yml +++ b/rules/product/modsecurity/modsec_mulitple_blocks.yml @@ -4,12 +4,12 @@ status: stable description: Detects multiple blocks by the mod_security module (Web Application Firewall) author: Florian Roth date: 2017/02/28 +modified: 2023/01/07 tags: - attack.impact - attack.t1499 logsource: - product: linux - service: modsecurity + product: modsecurity detection: selection: - 'mod_security: Access denied' diff --git a/rules/web/web_cve_2021_26858_iis_rce.yml b/rules/web/web_cve_2021_26858_iis_rce.yml index 02853d426..e85114085 100644 --- a/rules/web/web_cve_2021_26858_iis_rce.yml +++ b/rules/web/web_cve_2021_26858_iis_rce.yml @@ -6,10 +6,10 @@ references: - https://bi-zone.medium.com/hunting-down-ms-exchange-attacks-part-1-proxylogon-cve-2021-26855-26858-27065-26857-6e885c5f197c author: frack113 date: 2021/08/10 -modified: 2022/10/09 +modified: 2023/01/04 logsource: product: windows - category: webserver + service: iis definition: w3c-logging must be enabled https://docs.microsoft.com/en-us/windows/win32/http/w3c-logging detection: selection: diff --git a/rules/windows/builtin/dns_server/win_susp_dns_config.yml b/rules/windows/builtin/dns_server/win_dns_server_susp_dns_config.yml similarity index 100% rename from rules/windows/builtin/dns_server/win_susp_dns_config.yml rename to rules/windows/builtin/dns_server/win_dns_server_susp_dns_config.yml diff --git a/rules/windows/builtin/msexchange/win_exchange_proxylogon_oabvirtualdir.yml b/rules/windows/builtin/msexchange/win_exchange_proxylogon_oabvirtualdir.yml index dc80a5d10..68b7cb97b 100644 --- a/rules/windows/builtin/msexchange/win_exchange_proxylogon_oabvirtualdir.yml +++ b/rules/windows/builtin/msexchange/win_exchange_proxylogon_oabvirtualdir.yml @@ -6,7 +6,7 @@ references: - https://bi-zone.medium.com/hunting-down-ms-exchange-attacks-part-1-proxylogon-cve-2021-26855-26858-27065-26857-6e885c5f197c author: Florian Roth date: 2021/08/09 -modified: 2022/10/09 +modified: 2023/01/06 tags: - attack.t1587.001 - attack.resource_development @@ -14,15 +14,15 @@ logsource: product: windows service: msexchange-management detection: - selection_cmdlet: + keywords_cmdlet: - 'OabVirtualDirectory' - ' -ExternalUrl ' - selection_params: + keywords_params: - 'eval(request' - 'http://f/