[Rule Tuning] Small Linux DR Tuning (#3074)

* [Rule tuning] Adressing community issue

* Changed title

* Changed IG title

rules/linux/credential_access_bruteforce_password_guessing.toml

@@ -4,7 +4,7 @@ integration = ["system"]
 maturity = "production"
 min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 min_stack_version = "8.3.0"
-updated_date = "2023/06/28"
+updated_date = "2023/09/05"
 
 [rule]
 author = ["Elastic"]
@@ -16,10 +16,10 @@ from = "now-9m"
 index = ["auditbeat-*", "logs-system.auth-*"]
 language = "eql"
 license = "Elastic License v2"
-name = "Potential SSH Password Guessing"
+name = "Potential Successful SSH Brute Force Attack"
 note = """## Triage and analysis
 
-### Investigating Potential SSH Password Guessing Attack
+### Investigating Potential Successful SSH Brute Force Attack
 
 The rule identifies consecutive SSH login failures followed by a successful login from the same source IP address to the same target host indicating a successful attempt of brute force password guessing.
 
@@ -47,9 +47,9 @@ The rule identifies consecutive SSH login failures followed by a successful logi
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 """
-risk_score = 47
+risk_score = 73
 rule_id = "8cb84371-d053-4f4f-bce0-c74990e28f28"
-severity = "medium"
+severity = "high"
 tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Credential Access"]
 type = "eql"
 query = '''
@@ -61,13 +61,14 @@ sequence by host.id, source.ip, user.name with maxspan=3s
    event.outcome == "success" and source.ip != null and source.ip != "0.0.0.0" and source.ip != "::" ]
 '''
 
-
 [[rule.threat]]
 framework = "MITRE ATT&CK"
+
 [[rule.threat.technique]]
 id = "T1110"
 name = "Brute Force"
 reference = "https://attack.mitre.org/techniques/T1110/"
+
 [[rule.threat.technique.subtechnique]]
 id = "T1110.001"
 name = "Password Guessing"
@@ -78,10 +79,7 @@ id = "T1110.003"
 name = "Password Spraying"
 reference = "https://attack.mitre.org/techniques/T1110/003/"
 
-
-
 [rule.threat.tactic]
 id = "TA0006"
 name = "Credential Access"
 reference = "https://attack.mitre.org/tactics/TA0006/"
-

rules/linux/execution_shell_evasion_linux_binary.toml

@@ -4,7 +4,7 @@ integration = ["endpoint"]
 maturity = "production"
 min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 min_stack_version = "8.3.0"
-updated_date = "2023/08/04"
+updated_date = "2023/09/05"
 
 [rule]
 author = ["Elastic"]
@@ -108,7 +108,10 @@ process where host.os.type == "linux" and event.type == "start" and
   
   /* launching shells from unusual parents or parent+arg combos */
   (process.name : "*sh" and (
-    (process.parent.name : ("byebug", "ftp", "strace", "zip", "*awk", "git", "tar") and 
+    (process.parent.name : "*awk" and process.parent.args : "BEGIN {system(*)}") or
+    (process.parent.name == "git" and process.parent.args : ("*PAGER*", "!*sh", "exec *sh") or 
+     process.args : ("*PAGER*", "!*sh", "exec *sh") and not process.name == "ssh" ) or
+    (process.parent.name : ("byebug", "ftp", "strace", "zip", "tar") and 
     (
       process.parent.args : "BEGIN {system(*)}" or
       (process.parent.args : ("*PAGER*", "!*sh", "exec *sh") or process.args : ("*PAGER*", "!*sh", "exec *sh")) or
@@ -125,7 +128,8 @@ process where host.os.type == "linux" and event.type == "start" and
       (
         (process.parent.name == "nice") or
         (process.parent.name == "cpulimit" and process.parent.args == "-f") or
-        (process.parent.name == "find" and process.parent.args == "-exec" and process.parent.args == ";" and process.parent.args == "-p") or
+        (process.parent.name == "find" and process.parent.args == "." and process.parent.args == "-exec" and 
+         process.parent.args == ";" and process.parent.args : "/bin/*sh") or
         (process.parent.name == "flock" and process.parent.args == "-u" and process.parent.args == "/")
       )
     )
@@ -140,7 +144,7 @@ process where host.os.type == "linux" and event.type == "start" and
   )) or
   (process.name == "busybox" and event.action == "exec" and process.args_count == 2 and process.args : "*sh" and not 
    process.executable : "/var/lib/docker/overlay2/*/merged/bin/busybox" and not (process.parent.args == "init" and
-   process.parent.args == "runc") and not process.parent.args in ("ls-remote", "push", "fetch")) or
+   process.parent.args == "runc") and not process.parent.args in ("ls-remote", "push", "fetch") and not process.parent.name == "mkinitramfs") or
   (process.name == "env" and process.args_count == 2 and process.args : "*sh") or
   (process.parent.name in ("vi", "vim") and process.parent.args == "-c" and process.parent.args : ":!*sh") or
   (process.parent.name in ("c89", "c99", "gcc") and process.parent.args : "*sh,-s" and process.parent.args == "-wrapper") or