security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

min_stack all rules to 8.3 (#2259)

Browse Source 
* min_stack all rules to 8.3

* bump date

Co-authored-by: Mika Ayenson <mika.ayenson@elastic.co>
This commit is contained in:
Justin Ibarra
2022-08-24 10:38:49 -06:00
committed by GitHub
parent 023fbc7bbd
commit 46d5e37b76
689 changed files with 2198 additions and 999 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/apm/apm_403_response_to_a_post.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2020/02/18"
maturity = "production"
updated_date = "2021/07/13"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
[rule]
author = ["Elastic"]
rules/apm/apm_405_response_method_not_allowed.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2020/02/18"
maturity = "production"
updated_date = "2021/07/13"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
[rule]
author = ["Elastic"]
rules/apm/apm_null_user_agent.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2020/02/18"
maturity = "production"
updated_date = "2021/07/13"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
[rule]
author = ["Elastic"]
rules/apm/apm_sqlmap_user_agent.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2020/02/18"
maturity = "production"
updated_date = "2021/07/13"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
[rule]
author = ["Elastic"]
rules/cross-platform/credential_access_cookies_chromium_browsers_debugging.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2020/12/21"
maturity = "production"
updated_date = "2022/03/31"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
[rule]
author = ["Elastic"]
rules/cross-platform/defense_evasion_agent_spoofing_mismatched_id.toml
+3 -3
View File
@@ -1,9 +1,9 @@
[metadata]
creation_date = "2021/07/14"
maturity = "production"
updated_date = "2022/02/28"
min_stack_comments = "The field `event.agent_id_status` was not introduced until 7.14"
min_stack_version = "7.15.0"
updated_date = "2022/08/24"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
[rule]
author = ["Elastic"]
rules/cross-platform/defense_evasion_agent_spoofing_multiple_hosts.toml
+3 -3
View File
@@ -1,9 +1,9 @@
[metadata]
creation_date = "2021/07/14"
maturity = "production"
updated_date = "2022/02/16"
min_stack_comments = "The field `event.agent_id_status` was not introduced until 7.14"
min_stack_version = "7.15.0"
updated_date = "2022/08/24"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
[rule]
author = ["Elastic"]
rules/cross-platform/defense_evasion_deleting_websvr_access_logs.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2020/11/03"
maturity = "production"
updated_date = "2022/03/31"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
[rule]
author = ["Elastic"]
rules/cross-platform/defense_evasion_deletion_of_bash_command_line_history.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2020/05/04"
maturity = "production"
updated_date = "2022/05/16"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
[rule]
author = ["Elastic"]
rules/cross-platform/defense_evasion_elastic_agent_service_terminated.toml
+6 -4
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2022/05/23"
maturity = "production"
updated_date = "2022/07/18"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
[rule]
author = ["Elastic"]
@@ -37,10 +39,10 @@ process where
or
/* service or systemctl used to stop Elastic Agent on Linux */
(event.type == "end" and
(process.name : ("systemctl", "service") and
(process.name : ("systemctl", "service") and
process.args : "elastic-agent" and
process.args : "stop")
or
process.args : "stop")
or
/* Unload Elastic Agent extension on MacOS */
(process.name : "kextunload" and
process.args : "com.apple.iokit.EndpointSecurity" and
rules/cross-platform/defense_evasion_timestomp_touch.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2020/11/03"
maturity = "production"
updated_date = "2022/03/31"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
[rule]
author = ["Elastic"]
rules/cross-platform/discovery_security_software_grep.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2020/12/20"
maturity = "production"
updated_date = "2022/03/31"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
[rule]
author = ["Elastic"]
rules/cross-platform/discovery_virtual_machine_fingerprinting_grep.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2021/09/29"
maturity = "production"
updated_date = "2022/03/31"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
[rule]
author = ["Elastic"]
rules/cross-platform/execution_pentest_eggshell_remote_admin_tool.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2021/01/12"
maturity = "production"
updated_date = "2022/07/05"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
[rule]
author = ["Elastic"]
rules/cross-platform/execution_python_script_in_cmdline.toml
+1 -1
View File
@@ -1,7 +1,7 @@
[metadata]
creation_date = "2021/01/13"
maturity = "development"
updated_date = "2022/03/31"
updated_date = "2022/08/24"
[rule]
author = ["Elastic"]
rules/cross-platform/execution_revershell_via_shell_cmd.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2020/01/07"
maturity = "production"
updated_date = "2022/07/06"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
[rule]
author = ["Elastic"]
rules/cross-platform/execution_suspicious_jar_child_process.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2021/01/19"
maturity = "production"
updated_date = "2022/03/31"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
[rule]
author = ["Elastic"]
rules/cross-platform/execution_suspicious_java_netcon_childproc.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2021/12/10"
maturity = "production"
updated_date = "2022/03/31"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
[rule]
author = ["Elastic"]
rules/cross-platform/impact_hosts_file_modified.toml
+3 -3
View File
@@ -1,9 +1,9 @@
[metadata]
creation_date = "2020/07/07"
maturity = "production"
updated_date = "2022/03/31"
min_stack_comments = "Comprehensive timeline templates only available in 8.2+"
min_stack_version = "8.2"
updated_date = "2022/08/24"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
[rule]
author = ["Elastic"]
rules/cross-platform/initial_access_zoom_meeting_with_no_passcode.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2020/09/14"
maturity = "production"
updated_date = "2021/05/10"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
[rule]
author = ["Elastic"]
rules/cross-platform/persistence_credential_access_modify_auth_module_or_config.toml
+14 -12
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2020/12/21"
maturity = "production"
updated_date = "2021/03/22"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
[rule]
author = ["Elastic"]
@@ -31,19 +33,19 @@ timestamp_override = "event.ingested"
type = "query"
query = '''
event.category:file and event.type:change and
(file.name:pam_*.so or file.path:(/etc/pam.d/* or /private/etc/pam.d/*)) and
event.category:file and event.type:change and
(file.name:pam_*.so or file.path:(/etc/pam.d/* or /private/etc/pam.d/*)) and
process.executable:
(* and
not
(* and
not
(
/bin/yum or
"/usr/sbin/pam-auth-update" or
/usr/libexec/packagekitd or
/usr/bin/dpkg or
/usr/bin/vim or
/usr/libexec/xpcproxy or
/usr/bin/bsdtar or
/bin/yum or
"/usr/sbin/pam-auth-update" or
/usr/libexec/packagekitd or
/usr/bin/dpkg or
/usr/bin/vim or
/usr/libexec/xpcproxy or
/usr/bin/bsdtar or
/usr/local/bin/brew or
/usr/bin/rsync or
/usr/bin/yum or
rules/cross-platform/persistence_shell_profile_modification.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2021/01/19"
maturity = "production"
updated_date = "2021/08/03"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
[rule]
author = ["Elastic"]
rules/cross-platform/persistence_ssh_authorized_keys_modification.toml
+12 -10
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2020/12/22"
maturity = "production"
updated_date = "2022/05/04"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
[rule]
author = ["Elastic"]
@@ -22,18 +24,18 @@ timestamp_override = "event.ingested"
type = "query"
query = '''
event.category:file and event.type:(change or creation) and
file.name:("authorized_keys" or "authorized_keys2") and
event.category:file and event.type:(change or creation) and
file.name:("authorized_keys" or "authorized_keys2") and
not process.executable:
(/Library/Developer/CommandLineTools/usr/bin/git or
/usr/local/Cellar/maven/*/libexec/bin/mvn or
/Library/Java/JavaVirtualMachines/jdk*.jdk/Contents/Home/bin/java or
/usr/bin/vim or
/usr/local/Cellar/coreutils/*/bin/gcat or
(/Library/Developer/CommandLineTools/usr/bin/git or
/usr/local/Cellar/maven/*/libexec/bin/mvn or
/Library/Java/JavaVirtualMachines/jdk*.jdk/Contents/Home/bin/java or
/usr/bin/vim or
/usr/local/Cellar/coreutils/*/bin/gcat or
/usr/bin/bsdtar or
/usr/bin/nautilus or
/usr/bin/nautilus or
/usr/bin/scp or
/usr/bin/touch or
/usr/bin/touch or
/var/lib/docker/* or
/usr/bin/google_guest_agent)
'''
rules/cross-platform/privilege_escalation_echo_nopasswd_sudoers.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2021/01/26"
maturity = "production"
updated_date = "2021/03/03"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
[rule]
author = ["Elastic"]
rules/cross-platform/privilege_escalation_setuid_setgid_bit_set_via_chmod.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2020/04/23"
maturity = "production"
updated_date = "2021/03/10"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
[rule]
author = ["Elastic"]
rules/cross-platform/privilege_escalation_sudo_buffer_overflow.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2021/02/03"
maturity = "production"
updated_date = "2021/03/03"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
[rule]
author = ["Elastic"]
rules/cross-platform/privilege_escalation_sudoers_file_mod.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2020/04/13"
maturity = "production"
updated_date = "2021/03/03"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
[rule]
author = ["Elastic"]
rules/cross-platform/threat_intel_filebeat8x.toml
+3 -3
View File
@@ -1,9 +1,9 @@
[metadata]
creation_date = "2021/11/24"
maturity = "production"
updated_date = "2022/02/16"
min_stack_comments = "Threat index is ECS 1.11 compliant (8.0)."
min_stack_version = "8.0"
updated_date = "2022/08/24"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
[rule]
author = ["Elastic"]
rules/cross-platform/threat_intel_fleet_integrations.toml
+3 -3
View File
@@ -1,9 +1,9 @@
[metadata]
creation_date = "2021/04/21"
maturity = "production"
updated_date = "2022/02/16"
min_stack_comments = "Threat intel module fields were updated from `threatintel.*` to `threat.*` in ECS 1.11 (7.16)."
min_stack_version = "8.0"
updated_date = "2022/08/24"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
[rule]
author = ["Elastic"]
rules/integrations/aws/collection_cloudtrail_logging_created.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2020/06/10"
maturity = "production"
updated_date = "2021/07/20"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "aws"
[rule]
rules/integrations/aws/credential_access_aws_iam_assume_role_brute_force.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2020/07/16"
maturity = "production"
updated_date = "2022/07/19"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "aws"
[rule]
rules/integrations/aws/credential_access_iam_user_addition_to_group.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2020/06/04"
maturity = "production"
updated_date = "2022/07/19"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "aws"
[rule]
rules/integrations/aws/credential_access_root_console_failure_brute_force.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2020/07/21"
maturity = "production"
updated_date = "2021/07/20"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "aws"
[rule]
rules/integrations/aws/credential_access_secretsmanager_getsecretvalue.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2020/07/06"
maturity = "production"
updated_date = "2022/07/14"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "aws"
[rule]
rules/integrations/aws/defense_evasion_cloudtrail_logging_deleted.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2020/05/26"
maturity = "production"
updated_date = "2022/07/22"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "aws"
[rule]
rules/integrations/aws/defense_evasion_cloudtrail_logging_suspended.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2020/06/10"
maturity = "production"
updated_date = "2022/07/22"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "aws"
[rule]
rules/integrations/aws/defense_evasion_cloudwatch_alarm_deletion.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2020/06/15"
maturity = "production"
updated_date = "2022/07/22"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "aws"
[rule]
rules/integrations/aws/defense_evasion_config_service_rule_deletion.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2020/06/26"
maturity = "production"
updated_date = "2022/07/14"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "aws"
[rule]
rules/integrations/aws/defense_evasion_configuration_recorder_stopped.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2020/06/16"
maturity = "production"
updated_date = "2021/07/20"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "aws"
[rule]
rules/integrations/aws/defense_evasion_ec2_flow_log_deletion.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2020/06/15"
maturity = "production"
updated_date = "2022/07/22"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "aws"
[rule]
rules/integrations/aws/defense_evasion_ec2_network_acl_deletion.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2020/05/26"
maturity = "production"
updated_date = "2021/07/20"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "aws"
[rule]
rules/integrations/aws/defense_evasion_elasticache_security_group_creation.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2021/07/19"
maturity = "production"
updated_date = "2021/10/01"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "aws"
[rule]
rules/integrations/aws/defense_evasion_elasticache_security_group_modified_or_deleted.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2021/07/19"
maturity = "production"
updated_date = "2021/10/01"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "aws"
[rule]
rules/integrations/aws/defense_evasion_guardduty_detector_deletion.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2020/05/28"
maturity = "production"
updated_date = "2021/07/20"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "aws"
[rule]
rules/integrations/aws/defense_evasion_s3_bucket_configuration_deletion.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2020/05/27"
maturity = "production"
updated_date = "2021/07/20"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "aws"
[rule]
rules/integrations/aws/defense_evasion_waf_acl_deletion.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2020/05/21"
maturity = "production"
updated_date = "2021/07/20"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "aws"
[rule]
rules/integrations/aws/defense_evasion_waf_rule_or_rule_group_deletion.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2020/06/09"
maturity = "production"
updated_date = "2022/03/11"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "aws"
[rule]
rules/integrations/aws/exfiltration_ec2_full_network_packet_capture_detected.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2021/05/05"
maturity = "production"
updated_date = "2021/07/20"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "aws"
[rule]
rules/integrations/aws/exfiltration_ec2_snapshot_change_activity.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2020/06/24"
maturity = "production"
updated_date = "2022/07/14"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "aws"
[rule]
rules/integrations/aws/exfiltration_ec2_vm_export_failure.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2021/04/22"
maturity = "production"
updated_date = "2021/07/20"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "aws"
[rule]
rules/integrations/aws/exfiltration_rds_snapshot_export.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2021/06/06"
maturity = "production"
updated_date = "2022/07/05"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "aws"
[rule]
rules/integrations/aws/exfiltration_rds_snapshot_restored.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2021/06/29"
maturity = "production"
updated_date = "2022/07/05"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "aws"
[rule]
rules/integrations/aws/impact_aws_eventbridge_rule_disabled_or_deleted.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2021/10/17"
maturity = "production"
updated_date = "2022/07/05"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "aws"
[rule]
rules/integrations/aws/impact_cloudtrail_logging_updated.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2020/06/10"
maturity = "production"
updated_date = "2022/07/22"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "aws"
[rule]
rules/integrations/aws/impact_cloudwatch_log_group_deletion.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2020/05/18"
maturity = "production"
updated_date = "2022/07/22"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "aws"
[rule]
rules/integrations/aws/impact_cloudwatch_log_stream_deletion.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2020/05/20"
maturity = "production"
updated_date = "2022/07/14"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "aws"
[rule]
rules/integrations/aws/impact_ec2_disable_ebs_encryption.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2020/06/05"
maturity = "production"
updated_date = "2021/07/20"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "aws"
[rule]
rules/integrations/aws/impact_efs_filesystem_or_mount_deleted.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2021/08/27"
maturity = "production"
updated_date = "2022/02/28"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "aws"
[rule]
rules/integrations/aws/impact_iam_deactivate_mfa_device.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2020/05/26"
maturity = "production"
updated_date = "2022/07/19"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "aws"
[rule]
rules/integrations/aws/impact_iam_group_deletion.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2020/05/21"
maturity = "production"
updated_date = "2021/07/20"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "aws"
[rule]
rules/integrations/aws/impact_rds_group_deletion.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2021/06/05"
maturity = "production"
updated_date = "2021/07/20"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "aws"
[rule]
rules/integrations/aws/impact_rds_instance_cluster_deletion.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2020/05/21"
maturity = "production"
updated_date = "2022/04/07"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "aws"
[rule]
rules/integrations/aws/impact_rds_instance_cluster_stoppage.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2020/05/20"
maturity = "production"
updated_date = "2021/07/20"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "aws"
[rule]
rules/integrations/aws/initial_access_console_login_root.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2020/06/11"
maturity = "production"
updated_date = "2022/07/22"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "aws"
[rule]
rules/integrations/aws/initial_access_password_recovery.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2020/07/02"
maturity = "production"
updated_date = "2022/04/20"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "aws"
[rule]
rules/integrations/aws/initial_access_via_system_manager.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2020/07/06"
maturity = "production"
updated_date = "2022/07/14"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "aws"
[rule]
rules/integrations/aws/ml_cloudtrail_error_message_spike.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2020/07/13"
maturity = "production"
updated_date = "2022/07/14"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "aws"
[rule]
rules/integrations/aws/ml_cloudtrail_rare_error_code.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2020/07/13"
maturity = "production"
updated_date = "2022/07/14"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "aws"
[rule]
rules/integrations/aws/ml_cloudtrail_rare_method_by_city.toml
+4 -2
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2020/07/13"
maturity = "production"
updated_date = "2022/07/14"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "aws"
[rule]
@@ -42,7 +44,7 @@ of the source IP address.
#### Possible investigation steps
- Identify the user account involved and the action performed. Verify whether it should perform this kind of action.
- Examine the user identity in the `aws.cloudtrail.user_identity.arn` field and the access key ID in the
- Examine the user identity in the `aws.cloudtrail.user_identity.arn` field and the access key ID in the
`aws.cloudtrail.user_identity.access_key_id` field, which can help identify the precise user context.
- The user agent details in the `user_agent.original` field may also indicate what kind of a client made the request.
- Investigate other alerts associated with the user account during the past 48 hours.
rules/integrations/aws/ml_cloudtrail_rare_method_by_country.toml
+4 -2
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2020/07/13"
maturity = "production"
updated_date = "2022/07/14"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "aws"
[rule]
@@ -42,7 +44,7 @@ of the source IP address.
#### Possible investigation steps
- Identify the user account involved and the action performed. Verify whether it should perform this kind of action.
- Examine the user identity in the `aws.cloudtrail.user_identity.arn` field and the access key ID in the
- Examine the user identity in the `aws.cloudtrail.user_identity.arn` field and the access key ID in the
`aws.cloudtrail.user_identity.access_key_id` field, which can help identify the precise user context.
- The user agent details in the `user_agent.original` field may also indicate what kind of a client made the request.
- Investigate other alerts associated with the user account during the past 48 hours.
rules/integrations/aws/ml_cloudtrail_rare_method_by_user.toml
+4 -2
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2020/07/13"
maturity = "production"
updated_date = "2022/07/14"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "aws"
[rule]
@@ -41,7 +43,7 @@ user.
#### Possible investigation steps
- Identify the user account involved and the action performed. Verify whether it should perform this kind of action.
- Examine the user identity in the `aws.cloudtrail.user_identity.arn` field and the access key ID in the
- Examine the user identity in the `aws.cloudtrail.user_identity.arn` field and the access key ID in the
`aws.cloudtrail.user_identity.access_key_id` field, which can help identify the precise user context.
- The user agent details in the `user_agent.original` field may also indicate what kind of a client made the request.
- Investigate other alerts associated with the user account during the past 48 hours.
rules/integrations/aws/persistence_ec2_network_acl_creation.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2020/06/04"
maturity = "production"
updated_date = "2021/07/20"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "aws"
[rule]
rules/integrations/aws/persistence_ec2_security_group_configuration_change_detection.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2021/05/05"
maturity = "production"
updated_date = "2022/04/07"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "aws"
[rule]
rules/integrations/aws/persistence_iam_group_creation.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2020/06/05"
maturity = "production"
updated_date = "2021/07/20"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "aws"
[rule]
rules/integrations/aws/persistence_rds_cluster_creation.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2020/05/20"
maturity = "production"
updated_date = "2021/07/20"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "aws"
[rule]
rules/integrations/aws/persistence_rds_group_creation.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2021/06/05"
maturity = "production"
updated_date = "2021/07/20"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "aws"
[rule]
rules/integrations/aws/persistence_rds_instance_creation.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2021/06/06"
maturity = "production"
updated_date = "2022/07/05"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "aws"
[rule]
rules/integrations/aws/persistence_redshift_instance_creation.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2022/04/12"
maturity = "production"
updated_date = "2022/07/05"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "aws"
[rule]
rules/integrations/aws/persistence_route_53_domain_transfer_lock_disabled.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2021/05/10"
maturity = "production"
updated_date = "2021/07/20"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "aws"
[rule]
rules/integrations/aws/persistence_route_53_domain_transferred_to_another_account.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2021/05/10"
maturity = "production"
updated_date = "2021/07/20"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "aws"
[rule]
rules/integrations/aws/persistence_route_53_hosted_zone_associated_with_a_vpc.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2021/07/19"
maturity = "production"
updated_date = "2021/07/19"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "aws"
[rule]
rules/integrations/aws/persistence_route_table_created.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2021/06/05"
maturity = "production"
updated_date = "2022/07/05"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "aws"
[rule]
rules/integrations/aws/persistence_route_table_modified_or_deleted.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2021/06/05"
maturity = "production"
updated_date = "2022/04/20"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "aws"
[rule]
rules/integrations/aws/privilege_escalation_aws_suspicious_saml_activity.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2021/09/22"
maturity = "production"
updated_date = "2021/09/22"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "aws"
[rule]
rules/integrations/aws/privilege_escalation_root_login_without_mfa.toml
+4 -2
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2020/07/06"
maturity = "production"
updated_date = "2022/07/22"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "aws"
[rule]
@@ -40,7 +42,7 @@ your first IAM user. Then securely lock away the root user credentials and use t
service management tasks. Amazon provides a [list of the tasks that require root user](https://docs.aws.amazon.com/general/latest/gr/root-vs-iam.html#aws_tasks-that-require-root).
This rule looks for attempts to log in to AWS as the root user without using multi-factor authentication (MFA), meaning
the account is not secured properly.
the account is not secured properly.
#### Possible investigation steps
rules/integrations/aws/privilege_escalation_sts_assumerole_usage.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2021/05/17"
maturity = "production"
updated_date = "2021/10/05"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "aws"
[rule]
rules/integrations/aws/privilege_escalation_sts_getsessiontoken_abuse.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2021/05/17"
maturity = "production"
updated_date = "2021/10/11"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "aws"
[rule]
rules/integrations/aws/privilege_escalation_updateassumerolepolicy.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2020/07/06"
maturity = "production"
updated_date = "2022/07/19"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "aws"
[rule]
rules/integrations/azure/collection_update_event_hub_auth_rule.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2020/08/18"
maturity = "production"
updated_date = "2021/07/20"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "azure"
[rule]
rules/integrations/azure/credential_access_azure_full_network_packet_capture_detected.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2021/08/12"
maturity = "production"
updated_date = "2021/10/15"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "azure"
rules/integrations/azure/credential_access_key_vault_modified.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2020/08/31"
maturity = "production"
updated_date = "2021/07/20"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "azure"
[rule]
rules/integrations/azure/credential_access_storage_account_key_regenerated.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2020/08/19"
maturity = "production"
updated_date = "2021/07/20"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "azure"
[rule]
rules/integrations/azure/defense_evasion_azure_application_credential_modification.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2020/12/14"
maturity = "production"
updated_date = "2021/07/20"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "azure"
[rule]
rules/integrations/azure/defense_evasion_azure_automation_runbook_deleted.toml
+4 -2
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2020/09/01"
maturity = "production"
updated_date = "2022/07/13"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "azure"
[rule]
@@ -33,7 +35,7 @@ type = "query"
query = '''
event.dataset:azure.activitylogs and
azure.activitylogs.operation_name:"MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/RUNBOOKS/DELETE" and
azure.activitylogs.operation_name:"MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/RUNBOOKS/DELETE" and
event.outcome:(Success or success)
'''
rules/integrations/azure/defense_evasion_azure_blob_permissions_modified.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2021/09/22"
maturity = "production"
updated_date = "2021/09/22"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "azure"
[rule]
rules/integrations/azure/defense_evasion_azure_diagnostic_settings_deletion.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2020/08/17"
maturity = "production"
updated_date = "2021/07/20"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "azure"
[rule]
rules/integrations/azure/defense_evasion_azure_service_principal_addition.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2020/12/14"
maturity = "production"
updated_date = "2022/07/19"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "azure"
[rule]
rules/integrations/azure/defense_evasion_event_hub_deletion.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2020/08/18"
maturity = "production"
updated_date = "2021/07/20"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "azure"
[rule]
rules/integrations/azure/defense_evasion_firewall_policy_deletion.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2020/08/18"
maturity = "production"
updated_date = "2021/07/20"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "azure"
[rule]
rules/integrations/azure/defense_evasion_frontdoor_firewall_policy_deletion.toml
+3 -1
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2021/08/01"
maturity = "production"
updated_date = "2021/08/01"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/08/24"
integration = "azure"
[rule]

Some files were not shown because too many files have changed in this diff Show More