Revert "Back-porting Version Trimming (#3681)"

This reverts commit 71d2c59b5c.
This commit is contained in:
Mika Ayenson
2024-05-22 13:51:46 -05:00
parent 71d2c59b5c
commit 2c3dbfc039
1036 changed files with 11405 additions and 12359 deletions
@@ -2,16 +2,18 @@
creation_date = "2023/09/05"
integration = ["endpoint"]
maturity = "production"
updated_date = "2024/05/21"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/08"
[rule]
author = ["Elastic"]
description = """
This detection rule monitors for the execution of a system command with setuid or setgid capabilities via Python,
This detection rule monitors for the execution of a system command with setuid or setgid capabilities via Python,
followed by a uid or gid change to the root user. This sequence of events may indicate successful privilege escalation.
Setuid (Set User ID) and setgid (Set Group ID) are Unix-like OS features that enable processes to run with elevated
privileges, based on the file owner or group. Threat actors can exploit these attributes to escalate privileges to the
privileges that are set on the binary that is being executed.
Setuid (Set User ID) and setgid (Set Group ID) are Unix-like OS features that enable processes to run with elevated
privileges, based on the file owner or group. Threat actors can exploit these attributes to escalate privileges to the
privileges that are set on the binary that is being executed.
"""
from = "now-9m"
index = ["logs-endpoint.events.*"]
@@ -47,15 +49,8 @@ For more details on Elastic Agent configuration settings, refer to the [helper g
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
"""
severity = "medium"
tags = [
"Domain: Endpoint",
"OS: Linux",
"Use Case: Threat Detection",
"Tactic: Privilege Escalation",
"Data Source: Elastic Defend",
]
tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Data Source: Elastic Defend"]
type = "eql"
query = '''
sequence by host.id, process.entity_id with maxspan=1s
[process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and
@@ -64,9 +59,9 @@ sequence by host.id, process.entity_id with maxspan=1s
(user.id == "0" or group.id == "0")]
'''
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1068"
name = "Exploitation for Privilege Escalation"
@@ -76,13 +71,12 @@ reference = "https://attack.mitre.org/techniques/T1068/"
id = "T1548"
name = "Abuse Elevation Control Mechanism"
reference = "https://attack.mitre.org/techniques/T1548/"
[[rule.threat.technique.subtechnique]]
id = "T1548.001"
name = "Setuid and Setgid"
reference = "https://attack.mitre.org/techniques/T1548/001/"
[rule.threat.tactic]
id = "TA0004"
name = "Privilege Escalation"