security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[Rule Tuning] Q2 Linux DR Tuning - Part 2 (#4163)

Browse Source
This commit is contained in:
Ruben Groenewoud
2024-10-18 16:07:09 +02:00
committed by GitHub
parent af9f9e2456
commit 3982228132
10 changed files with 67 additions and 76 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/linux/defense_evasion_kernel_module_removal.toml
+10 -11
View File
@@ -2,7 +2,7 @@
creation_date = "2020/04/24"
integration = ["endpoint"]
maturity = "production"
updated_date = "2024/05/21"
updated_date = "2024/17/21"
[rule]
author = ["Elastic"]
@@ -61,46 +61,45 @@ tags = [
]
timestamp_override = "event.ingested"
type = "eql"
query = '''
process where host.os.type == "linux" and event.type == "start" and event.action in ("exec", "exec_event") and
process.name == "rmmod" or (process.name == "modprobe" and process.args in ("--remove", "-r")) and
process.parent.name in ("sudo", "bash", "dash", "ash", "sh", "tcsh", "csh", "zsh", "ksh", "fish")
process where host.os.type == "linux" and event.type == "start" and event.action in ("exec", "exec_event") and (
process.name == "rmmod" or
(process.name == "modprobe" and process.args in ("--remove", "-r"))
) and process.parent.name in ("sudo", "bash", "dash", "ash", "sh", "tcsh", "csh", "zsh", "ksh", "fish")
'''
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[rule.threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"
[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1547"
name = "Boot or Logon Autostart Execution"
reference = "https://attack.mitre.org/techniques/T1547/"
[[rule.threat.technique.subtechnique]]
id = "T1547.006"
name = "Kernel Modules and Extensions"
reference = "https://attack.mitre.org/techniques/T1547/006/"
[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
rules/linux/defense_evasion_mount_execution.toml
+6 -8
View File
@@ -2,7 +2,7 @@
creation_date = "2023/04/11"
integration = ["endpoint", "auditd_manager"]
maturity = "production"
updated_date = "2024/05/21"
updated_date = "2024/10/17"
[rule]
author = ["Elastic"]
@@ -60,24 +60,22 @@ tags = [
]
timestamp_override = "event.ingested"
type = "eql"
query = '''
process where host.os.type == "linux" and event.type == "start" and event.action in ("exec", "exec_event", "executed", "process_started")
and process.name == "mount" and process.args == "/proc" and process.args == "-o" and
process.args : "*hidepid=2*"
process where host.os.type == "linux" and event.type == "start" and
event.action in ("exec", "exec_event", "executed", "process_started") and
process.name == "mount" and process.args == "/proc" and process.args == "-o" and process.args : "*hidepid=2*" and
not process.parent.command_line like "/opt/cloudlinux/*"
'''
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1564"
name = "Hide Artifacts"
reference = "https://attack.mitre.org/techniques/T1564/"
[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
rules/linux/defense_evasion_root_certificate_installation.toml
+5 -4
View File
@@ -2,7 +2,7 @@
creation_date = "2024/08/28"
integration = ["endpoint"]
maturity = "production"
updated_date = "2024/08/28"
updated_date = "2024/10/17"
[rule]
author = ["Elastic"]
@@ -58,10 +58,11 @@ type = "eql"
query = '''
process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and
process.name in ("update-ca-trust", "update-ca-certificates") and not (
process.parent.name : (
"ca-certificates.postinst", "ca-certificates-*.trigger", "pacman", "pamac-daemon", "autofirma.postinst"
process.parent.name like (
"ca-certificates.postinst", "ca-certificates-*.trigger", "pacman", "pamac-daemon", "autofirma.postinst",
"ipa-client-install", "su", "platform-python", "python*", "kesl", "execd"
) or
process.parent.args : "/var/tmp/rpm*" or
process.parent.args like "/var/tmp/rpm*" or
(process.parent.name in ("sh", "bash", "zsh") and process.args == "-e")
)
'''
rules/linux/defense_evasion_sus_utility_executed_via_tmux_or_screen.toml
+6 -9
View File
@@ -2,7 +2,7 @@
creation_date = "2023/09/04"
integration = ["endpoint"]
maturity = "production"
updated_date = "2024/05/21"
updated_date = "2024/10/17"
[rule]
author = ["Elastic"]
@@ -29,26 +29,23 @@ tags = [
]
timestamp_override = "event.ingested"
type = "eql"
query = '''
process where host.os.type == "linux" and event.type == "start" and event.action in ("exec", "exec_event") and
process.parent.name in ("screen", "tmux") and process.name : (
"nmap", "nc", "ncat", "netcat", "socat", "nc.openbsd", "ngrok", "ping", "java", "python*", "php*", "perl", "ruby",
"lua*", "openssl", "telnet", "awk", "wget", "curl", "id"
)
process.parent.name in ("screen", "tmux") and process.name like (
"nmap", "nc", "ncat", "netcat", "socat", "nc.openbsd", "ngrok", "ping", "java", "php*", "perl", "ruby", "lua*",
"openssl", "telnet", "wget", "curl", "id"
)
'''
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
rules/linux/discovery_esxi_software_via_find.toml
+6 -7
View File
@@ -2,7 +2,7 @@
creation_date = "2023/04/11"
integration = ["endpoint", "auditd_manager"]
maturity = "production"
updated_date = "2024/05/21"
updated_date = "2024/10/17"
[rule]
author = ["Elastic"]
@@ -59,23 +59,22 @@ tags = [
]
timestamp_override = "event.ingested"
type = "eql"
query = '''
process where host.os.type == "linux" and event.type == "start" and event.action in ("exec", "exec_event", "executed", "process_started")
and process.name == "find" and process.args : ("/etc/vmware/*", "/usr/lib/vmware/*", "/vmfs/*")
process where host.os.type == "linux" and event.type == "start" and
event.action in ("exec", "exec_event", "executed", "process_started") and process.name == "find" and
process.args : ("/etc/vmware/*", "/usr/lib/vmware/*", "/vmfs/*") and
not process.parent.executable == "/usr/lib/vmware/viewagent/bin/uninstall_viewagent.sh"
'''
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1518"
name = "Software Discovery"
reference = "https://attack.mitre.org/techniques/T1518/"
[rule.threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"
rules/linux/discovery_esxi_software_via_grep.toml
+7 -9
View File
@@ -2,7 +2,7 @@
creation_date = "2023/04/11"
integration = ["endpoint", "auditd_manager"]
maturity = "production"
updated_date = "2024/05/21"
updated_date = "2024/10/17"
[rule]
author = ["Elastic"]
@@ -59,25 +59,23 @@ tags = [
]
timestamp_override = "event.ingested"
type = "eql"
query = '''
process where host.os.type == "linux" and event.type == "start" and event.action in ("exec", "exec_event", "executed", "process_started")
and process.name in ("grep", "egrep", "pgrep") and process.args in (
"vmdk", "vmx", "vmxf", "vmsd", "vmsn", "vswp", "vmss", "nvram", "vmem"
)
process where host.os.type == "linux" and event.type == "start" and
event.action in ("exec", "exec_event", "executed", "process_started") and
process.name in ("grep", "egrep", "pgrep") and
process.args in ("vmdk", "vmx", "vmxf", "vmsd", "vmsn", "vswp", "vmss", "nvram", "vmem") and
not process.parent.executable == "/usr/share/qemu/init/qemu-kvm-init"
'''
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1518"
name = "Software Discovery"
reference = "https://attack.mitre.org/techniques/T1518/"
[rule.threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"
rules/linux/discovery_kernel_module_enumeration.toml
+12 -9
View File
@@ -2,7 +2,7 @@
creation_date = "2020/04/23"
integration = ["endpoint"]
maturity = "production"
updated_date = "2024/05/21"
updated_date = "2024/10/17"
[rule]
author = ["Elastic"]
@@ -66,20 +66,24 @@ event.category:process and host.os.type:linux and event.type:start and event.act
(process.name:(lsmod or modinfo)) or
(process.name:kmod and process.args:list) or
(process.name:depmod and process.args:(--all or -a))
) and not process.parent.name:(mkinitramfs or cryptroot or framebuffer or dracut or jem or thin-provisioning-tools
or readykernel or lvm2 or vz-start or iscsi or mdadm or ovalprobes or bcache or plymouth or dkms or overlayroot or
weak-modules or zfs)
) and
not (
process.parent.name:(
mkinitramfs or cryptroot or framebuffer or dracut or jem or thin-provisioning-tools or readykernel or lvm2 or
vz-start or iscsi or mdadm or ovalprobes or bcache or plymouth or dkms or overlayroot or weak-modules or zfs or
systemd or whoopsie-upload-all or kdumpctl or apport-gtk or casper or rear or kernel-install
)
)
'''
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1082"
name = "System Information Discovery"
reference = "https://attack.mitre.org/techniques/T1082/"
[rule.threat.tactic]
id = "TA0007"
name = "Discovery"
@@ -87,9 +91,8 @@ reference = "https://attack.mitre.org/tactics/TA0007/"
[rule.new_terms]
field = "new_terms_fields"
value = ["process.parent.command_line", "process.command_line", "host.id"]
value = ["process.executable", "process.parent.executable"]
[[rule.new_terms.history_window_start]]
field = "history_window_start"
value = "now-14d"
rules/linux/discovery_pspy_process_monitoring_detected.toml
+5 -6
View File
@@ -2,7 +2,7 @@
creation_date = "2023/07/20"
integration = ["auditd_manager"]
maturity = "production"
updated_date = "2024/05/21"
updated_date = "2024/10/17"
[rule]
author = ["Elastic"]
@@ -53,16 +53,17 @@ tags = [
"Tactic: Discovery",
]
type = "eql"
query = '''
sequence by process.pid, host.id with maxspan=5s
[file where host.os.type == "linux" and auditd.data.syscall == "openat" and file.path == "/proc" and
auditd.data.a0 : ("ffffffffffffff9c", "ffffff9c") and auditd.data.a2 : ("80000", "88000") ] with runs=10
auditd.data.a0 : ("ffffffffffffff9c", "ffffff9c") and auditd.data.a2 : ("80000", "88000") and
not process.name == "agentbeat"
] with runs=10
'''
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1057"
name = "Process Discovery"
@@ -73,9 +74,7 @@ id = "T1082"
name = "System Information Discovery"
reference = "https://attack.mitre.org/techniques/T1082/"
[rule.threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"
rules/linux/discovery_sudo_allowed_command_enumeration.toml
+3 -6
View File
@@ -2,7 +2,7 @@
creation_date = "2023/08/30"
integration = ["endpoint"]
maturity = "production"
updated_date = "2024/05/21"
updated_date = "2024/10/17"
[rule]
author = ["Elastic"]
@@ -53,25 +53,22 @@ tags = [
]
timestamp_override = "event.ingested"
type = "eql"
query = '''
process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and
process.name == "sudo" and process.args == "-l" and process.args_count == 2 and
process.parent.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and
not group.Ext.real.id : "0" and not user.Ext.real.id : "0" and not process.args == "dpkg"
not process.args == "dpkg"
'''
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1033"
name = "System Owner/User Discovery"
reference = "https://attack.mitre.org/techniques/T1033/"
[rule.threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"
rules/linux/discovery_suspicious_which_command_execution.toml
+7 -7
View File
@@ -2,7 +2,7 @@
creation_date = "2023/08/30"
integration = ["endpoint"]
maturity = "production"
updated_date = "2024/05/21"
updated_date = "2024/10/17"
[rule]
author = ["Elastic"]
@@ -29,11 +29,13 @@ tags = [
]
timestamp_override = "event.ingested"
type = "eql"
query = '''
process where host.os.type == "linux" and event.type == "start" and event.action in ("exec", "exec_event") and
process.name == "which" and process.args_count >= 10 and not process.parent.name == "jem" and
not process.args == "--tty-only"
process.name == "which" and process.args_count >= 10 and not (
process.parent.name == "jem" or
process.parent.executable like ("/vz/root/*", "/var/lib/docker/*") or
process.args == "--tty-only"
)
/* potential tuning if rule would turn out to be noisy
and process.args in ("nmap", "nc", "ncat", "netcat", nc.traditional", "gcc", "g++", "socat") and
@@ -41,17 +43,15 @@ process.parent.name in ("bash", "dash", "ash", "sh", "tcsh", "csh", "zsh", "ksh"
*/
'''
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1082"
name = "System Information Discovery"
reference = "https://attack.mitre.org/techniques/T1082/"
[rule.threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"