Revert "Back-porting Version Trimming (#3681)"
This reverts commit 71d2c59b5c.
This commit is contained in:
@@ -2,16 +2,18 @@
|
||||
creation_date = "2023/09/05"
|
||||
integration = ["endpoint"]
|
||||
maturity = "production"
|
||||
updated_date = "2024/05/21"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
updated_date = "2024/03/08"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
description = """
|
||||
This detection rule monitors for the execution of a system command with setuid or setgid capabilities via Python,
|
||||
This detection rule monitors for the execution of a system command with setuid or setgid capabilities via Python,
|
||||
followed by a uid or gid change to the root user. This sequence of events may indicate successful privilege escalation.
|
||||
Setuid (Set User ID) and setgid (Set Group ID) are Unix-like OS features that enable processes to run with elevated
|
||||
privileges, based on the file owner or group. Threat actors can exploit these attributes to escalate privileges to the
|
||||
privileges that are set on the binary that is being executed.
|
||||
Setuid (Set User ID) and setgid (Set Group ID) are Unix-like OS features that enable processes to run with elevated
|
||||
privileges, based on the file owner or group. Threat actors can exploit these attributes to escalate privileges to the
|
||||
privileges that are set on the binary that is being executed.
|
||||
"""
|
||||
from = "now-9m"
|
||||
index = ["logs-endpoint.events.*"]
|
||||
@@ -47,15 +49,8 @@ For more details on Elastic Agent configuration settings, refer to the [helper g
|
||||
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
|
||||
"""
|
||||
severity = "medium"
|
||||
tags = [
|
||||
"Domain: Endpoint",
|
||||
"OS: Linux",
|
||||
"Use Case: Threat Detection",
|
||||
"Tactic: Privilege Escalation",
|
||||
"Data Source: Elastic Defend",
|
||||
]
|
||||
tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Data Source: Elastic Defend"]
|
||||
type = "eql"
|
||||
|
||||
query = '''
|
||||
sequence by host.id, process.entity_id with maxspan=1s
|
||||
[process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and
|
||||
@@ -64,9 +59,9 @@ sequence by host.id, process.entity_id with maxspan=1s
|
||||
(user.id == "0" or group.id == "0")]
|
||||
'''
|
||||
|
||||
|
||||
[[rule.threat]]
|
||||
framework = "MITRE ATT&CK"
|
||||
|
||||
[[rule.threat.technique]]
|
||||
id = "T1068"
|
||||
name = "Exploitation for Privilege Escalation"
|
||||
@@ -76,13 +71,12 @@ reference = "https://attack.mitre.org/techniques/T1068/"
|
||||
id = "T1548"
|
||||
name = "Abuse Elevation Control Mechanism"
|
||||
reference = "https://attack.mitre.org/techniques/T1548/"
|
||||
|
||||
[[rule.threat.technique.subtechnique]]
|
||||
id = "T1548.001"
|
||||
name = "Setuid and Setgid"
|
||||
reference = "https://attack.mitre.org/techniques/T1548/001/"
|
||||
|
||||
|
||||
|
||||
[rule.threat.tactic]
|
||||
id = "TA0004"
|
||||
name = "Privilege Escalation"
|
||||
|
||||
Reference in New Issue
Block a user