security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[Tuning] event.action and event.type change (#3495)

Browse Source 
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

Removed changes from:
- rules/linux/discovery_process_capabilities.toml
- rules/linux/privilege_escalation_enlightenment_window_manager.toml
- rules/linux/privilege_escalation_gdb_sys_ptrace_elevation.toml
- rules/linux/privilege_escalation_gdb_sys_ptrace_netcon.toml
- rules/linux/privilege_escalation_suspicious_chown_fowner_elevation.toml
- rules/linux/privilege_escalation_suspicious_uid_guid_elevation.toml
- rules_building_block/discovery_capnetraw_capability.toml
- rules_building_block/persistence_cap_sys_admin_added_to_new_binary.toml

(selectively cherry picked from commit 9f8638a004)
This commit is contained in:
Ruben Groenewoud
2024-03-13 10:11:21 +01:00
committed by github-actions[bot]
parent b1989a921b
commit 578e86eeae
73 changed files with 198 additions and 185 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/linux/command_and_control_linux_chisel_server_activity.toml
+3 -3
View File
@@ -4,7 +4,7 @@ integration = ["endpoint"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/11/02"
updated_date = "2024/03/08"
[transform]
[[transform.osquery]]
@@ -148,10 +148,10 @@ tags = [
type = "eql"
query = '''
sequence by host.id, process.entity_id with maxspan=1m
[process where host.os.type == "linux" and event.action == "exec" and event.type == "start" and
[process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and
process.args == "server" and process.args in ("--port", "-p", "--reverse", "--backend", "--socks5") and
process.args_count >= 3 and process.parent.name in ("bash", "dash", "ash", "sh", "tcsh", "csh", "zsh", "ksh", "fish")]
[network where host.os.type == "linux" and event.action == "connection_accepted" and event.type == "start" and
[network where host.os.type == "linux" and event.type == "start" and event.action == "connection_accepted" and
destination.ip != null and destination.ip != "127.0.0.1" and destination.ip != "::1" and
not process.name : (
"python*", "php*", "perl", "ruby", "lua*", "openssl", "nc", "netcat", "ncat", "telnet", "awk", "java", "telnet",