security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[Rule Tuning] Update rules using case sensitive wildcard function (#904)

Browse Source 
* update rules using case sensitive wildcard function

* add appropriate spacing

* Apply suggestions from code review

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* update ==

* Apply suggestions from code review

* remove info update index

* Update defense_evasion_deletion_of_bash_command_line_history.toml

* Update persistence_evasion_hidden_local_account_creation.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
This commit is contained in:
Brent Murphy
2021-02-04 10:23:32 -05:00
committed by GitHub
parent 37ccdad0ee
commit 236c630c90
15 changed files with 93 additions and 99 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/linux/defense_evasion_deletion_of_bash_command_line_history.toml
+6 -6
View File
@@ -1,7 +1,7 @@
[metadata]
creation_date = "2020/05/04"
maturity = "production"
updated_date = "2020/12/22"
updated_date = "2021/02/04"
[rule]
author = ["Elastic"]
@@ -23,11 +23,11 @@ type = "eql"
query = '''
process where event.type in ("start", "process_started") and
(
(process.name in ("rm", "echo") and wildcard(process.args, ".bash_history", "/root/.bash_history", "/home/*/.bash_history")) or
(process.name == "history" and process.args == "-c") or
(process.name == "export" and process.args in ("HISTFILE=/dev/null", "HISTFILESIZE=0")) or
(process.name == "unset" and process.args == "HISTFILE") or
(process.name == "set" and process.args == "history" and process.args == "+o")
(process.name : ("rm", "echo") and process.args : (".bash_history", "/root/.bash_history", "/home/*/.bash_history")) or
(process.name : "history" and process.args : "-c") or
(process.name : "export" and process.args : ("HISTFILE=/dev/null", "HISTFILESIZE=0")) or
(process.name : "unset" and process.args : "HISTFILE") or
(process.name : "set" and process.args : "history" and process.args : "+o")
)
'''
rules/linux/defense_evasion_timestomp_touch.toml
+2 -3
View File
@@ -1,7 +1,7 @@
[metadata]
creation_date = "2020/11/03"
maturity = "production"
updated_date = "2020/12/09"
updated_date = "2021/01/21"
[rule]
author = ["Elastic"]
@@ -23,7 +23,7 @@ type = "eql"
query = '''
process where event.type in ("start", "process_started") and
process.name == "touch" and wildcard(process.args, "-r", "-t", "-a*","-m*")
process.name : "touch" and process.args : ("-r", "-t", "-a*","-m*")
'''
@@ -43,4 +43,3 @@ reference = "https://attack.mitre.org/techniques/T1070/006/"
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"