security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[Rule Tuning] Update AWS rules to account for Agent index (#256)

Browse Source 
* Update AWS rules

* chnage updated date
This commit is contained in:
Brent Murphy
2020-09-21 09:04:50 -04:00
committed by GitHub
parent 453553f685
commit 6a1e97cd06
32 changed files with 63 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/aws/collection_cloudtrail_logging_created.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/06/10"
ecs_version = ["1.6.0"]
maturity = "production"
updated_date = "2020/07/28"
updated_date = "2020/09/03"
[rule]
author = ["Elastic"]
@@ -15,7 +15,7 @@ false_positives = [
""",
]
from = "now-60m"
index = ["filebeat-*"]
index = ["filebeat-*", "logs-aws*"]
interval = "10m"
language = "kuery"
license = "Elastic License"
rules/aws/credential_access_aws_iam_assume_role_brute_force.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/07/16"
ecs_version = ["1.6.0"]
maturity = "production"
updated_date = "2020/07/28"
updated_date = "2020/09/03"
[rule]
author = ["Elastic"]
@@ -12,7 +12,7 @@ used to delegate access to users or services. An adversary may attempt to enumer
role exists before attempting to assume or hijack the discovered role.
"""
from = "now-20m"
index = ["filebeat-*"]
index = ["filebeat-*", "logs-aws*"]
language = "kuery"
license = "Elastic License"
name = "AWS IAM Brute Force of Assume Role Policy"
rules/aws/credential_access_iam_user_addition_to_group.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/06/04"
ecs_version = ["1.6.0"]
maturity = "production"
updated_date = "2020/07/28"
updated_date = "2020/09/03"
[rule]
author = ["Elastic"]
@@ -16,7 +16,7 @@ false_positives = [
""",
]
from = "now-60m"
index = ["filebeat-*"]
index = ["filebeat-*", "logs-aws*"]
interval = "10m"
language = "kuery"
license = "Elastic License"
rules/aws/credential_access_secretsmanager_getsecretvalue.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/07/06"
ecs_version = ["1.6.0"]
maturity = "production"
updated_date = "2020/07/28"
updated_date = "2020/09/03"
[rule]
author = ["Nick Jones", "Elastic"]
@@ -17,7 +17,7 @@ false_positives = [
""",
]
from = "now-60m"
index = ["filebeat-*"]
index = ["filebeat-*", "logs-aws*"]
interval = "10m"
language = "kuery"
license = "Elastic License"
rules/aws/defense_evasion_cloudtrail_logging_deleted.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/05/26"
ecs_version = ["1.6.0"]
maturity = "production"
updated_date = "2020/07/28"
updated_date = "2020/09/03"
[rule]
author = ["Elastic"]
@@ -15,7 +15,7 @@ false_positives = [
""",
]
from = "now-60m"
index = ["filebeat-*"]
index = ["filebeat-*", "logs-aws*"]
interval = "10m"
language = "kuery"
license = "Elastic License"
rules/aws/defense_evasion_cloudtrail_logging_suspended.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/06/10"
ecs_version = ["1.6.0"]
maturity = "production"
updated_date = "2020/07/28"
updated_date = "2020/09/03"
[rule]
author = ["Elastic"]
@@ -19,7 +19,7 @@ false_positives = [
""",
]
from = "now-60m"
index = ["filebeat-*"]
index = ["filebeat-*", "logs-aws*"]
interval = "10m"
language = "kuery"
license = "Elastic License"
rules/aws/defense_evasion_cloudwatch_alarm_deletion.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/06/15"
ecs_version = ["1.6.0"]
maturity = "production"
updated_date = "2020/07/28"
updated_date = "2020/09/03"
[rule]
author = ["Elastic"]
@@ -15,7 +15,7 @@ false_positives = [
""",
]
from = "now-60m"
index = ["filebeat-*"]
index = ["filebeat-*", "logs-aws*"]
interval = "10m"
language = "kuery"
license = "Elastic License"
rules/aws/defense_evasion_config_service_rule_deletion.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/06/26"
ecs_version = ["1.6.0"]
maturity = "production"
updated_date = "2020/07/28"
updated_date = "2020/09/03"
[rule]
author = ["Elastic"]
@@ -19,7 +19,7 @@ false_positives = [
""",
]
from = "now-60m"
index = ["filebeat-*"]
index = ["filebeat-*", "logs-aws*"]
interval = "10m"
language = "kuery"
license = "Elastic License"
rules/aws/defense_evasion_configuration_recorder_stopped.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/06/16"
ecs_version = ["1.6.0"]
maturity = "production"
updated_date = "2020/07/28"
updated_date = "2020/09/03"
[rule]
author = ["Elastic"]
@@ -15,7 +15,7 @@ false_positives = [
""",
]
from = "now-60m"
index = ["filebeat-*"]
index = ["filebeat-*", "logs-aws*"]
interval = "10m"
language = "kuery"
license = "Elastic License"
rules/aws/defense_evasion_ec2_flow_log_deletion.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/06/15"
ecs_version = ["1.6.0"]
maturity = "production"
updated_date = "2020/07/28"
updated_date = "2020/09/03"
[rule]
author = ["Elastic"]
@@ -18,7 +18,7 @@ false_positives = [
""",
]
from = "now-60m"
index = ["filebeat-*"]
index = ["filebeat-*", "logs-aws*"]
interval = "10m"
language = "kuery"
license = "Elastic License"
rules/aws/defense_evasion_ec2_network_acl_deletion.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/05/26"
ecs_version = ["1.6.0"]
maturity = "production"
updated_date = "2020/07/28"
updated_date = "2020/09/03"
[rule]
author = ["Elastic"]
@@ -18,7 +18,7 @@ false_positives = [
""",
]
from = "now-60m"
index = ["filebeat-*"]
index = ["filebeat-*", "logs-aws*"]
interval = "10m"
language = "kuery"
license = "Elastic License"
rules/aws/defense_evasion_guardduty_detector_deletion.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/05/28"
ecs_version = ["1.6.0"]
maturity = "production"
updated_date = "2020/07/28"
updated_date = "2020/09/03"
[rule]
author = ["Elastic"]
@@ -18,7 +18,7 @@ false_positives = [
""",
]
from = "now-60m"
index = ["filebeat-*"]
index = ["filebeat-*", "logs-aws*"]
interval = "10m"
language = "kuery"
license = "Elastic License"
rules/aws/defense_evasion_s3_bucket_configuration_deletion.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/05/27"
ecs_version = ["1.6.0"]
maturity = "production"
updated_date = "2020/07/28"
updated_date = "2020/09/03"
[rule]
author = ["Elastic"]
@@ -15,7 +15,7 @@ false_positives = [
""",
]
from = "now-60m"
index = ["filebeat-*"]
index = ["filebeat-*", "logs-aws*"]
interval = "10m"
language = "kuery"
license = "Elastic License"
rules/aws/defense_evasion_waf_acl_deletion.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/05/21"
ecs_version = ["1.6.0"]
maturity = "production"
updated_date = "2020/07/28"
updated_date = "2020/09/03"
[rule]
author = ["Elastic"]
@@ -15,7 +15,7 @@ false_positives = [
""",
]
from = "now-60m"
index = ["filebeat-*"]
index = ["filebeat-*", "logs-aws*"]
interval = "10m"
language = "kuery"
license = "Elastic License"
rules/aws/defense_evasion_waf_rule_or_rule_group_deletion.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/06/09"
ecs_version = ["1.6.0"]
maturity = "production"
updated_date = "2020/07/28"
updated_date = "2020/09/03"
[rule]
author = ["Elastic"]
@@ -15,7 +15,7 @@ false_positives = [
""",
]
from = "now-60m"
index = ["filebeat-*"]
index = ["filebeat-*", "logs-aws*"]
interval = "10m"
language = "kuery"
license = "Elastic License"
rules/aws/execution_via_system_manager.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/07/06"
ecs_version = ["1.6.0"]
maturity = "production"
updated_date = "2020/07/28"
updated_date = "2020/09/03"
[rule]
author = ["Elastic"]
@@ -19,7 +19,7 @@ false_positives = [
""",
]
from = "now-60m"
index = ["filebeat-*"]
index = ["filebeat-*", "logs-aws*"]
interval = "10m"
language = "kuery"
license = "Elastic License"
rules/aws/exfiltration_ec2_snapshot_change_activity.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/06/24"
ecs_version = ["1.6.0"]
maturity = "production"
updated_date = "2020/07/28"
updated_date = "2020/09/03"
[rule]
author = ["Elastic"]
@@ -18,7 +18,7 @@ false_positives = [
""",
]
from = "now-60m"
index = ["filebeat-*"]
index = ["filebeat-*", "logs-aws*"]
interval = "10m"
language = "kuery"
license = "Elastic License"
rules/aws/impact_cloudtrail_logging_updated.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/06/10"
ecs_version = ["1.6.0"]
maturity = "production"
updated_date = "2020/07/28"
updated_date = "2020/09/03"
[rule]
author = ["Elastic"]
@@ -15,7 +15,7 @@ false_positives = [
""",
]
from = "now-60m"
index = ["filebeat-*"]
index = ["filebeat-*", "logs-aws*"]
interval = "10m"
language = "kuery"
license = "Elastic License"
rules/aws/impact_cloudwatch_log_group_deletion.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/05/18"
ecs_version = ["1.6.0"]
maturity = "production"
updated_date = "2020/07/28"
updated_date = "2020/09/03"
[rule]
author = ["Elastic"]
@@ -18,7 +18,7 @@ false_positives = [
""",
]
from = "now-60m"
index = ["filebeat-*"]
index = ["filebeat-*", "logs-aws*"]
interval = "10m"
language = "kuery"
license = "Elastic License"
rules/aws/impact_cloudwatch_log_stream_deletion.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/05/20"
ecs_version = ["1.6.0"]
maturity = "production"
updated_date = "2020/07/28"
updated_date = "2020/09/03"
[rule]
author = ["Elastic"]
@@ -18,7 +18,7 @@ false_positives = [
""",
]
from = "now-60m"
index = ["filebeat-*"]
index = ["filebeat-*", "logs-aws*"]
interval = "10m"
language = "kuery"
license = "Elastic License"
rules/aws/impact_ec2_disable_ebs_encryption.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/06/05"
ecs_version = ["1.6.0"]
maturity = "production"
updated_date = "2020/07/28"
updated_date = "2020/09/03"
[rule]
author = ["Elastic"]
@@ -18,7 +18,7 @@ false_positives = [
""",
]
from = "now-60m"
index = ["filebeat-*"]
index = ["filebeat-*", "logs-aws*"]
interval = "10m"
language = "kuery"
license = "Elastic License"
rules/aws/impact_iam_deactivate_mfa_device.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/05/26"
ecs_version = ["1.6.0"]
maturity = "production"
updated_date = "2020/07/28"
updated_date = "2020/09/03"
[rule]
author = ["Elastic"]
@@ -19,7 +19,7 @@ false_positives = [
""",
]
from = "now-60m"
index = ["filebeat-*"]
index = ["filebeat-*", "logs-aws*"]
interval = "10m"
language = "kuery"
license = "Elastic License"
rules/aws/impact_iam_group_deletion.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/05/21"
ecs_version = ["1.6.0"]
maturity = "production"
updated_date = "2020/07/28"
updated_date = "2020/09/03"
[rule]
author = ["Elastic"]
@@ -18,7 +18,7 @@ false_positives = [
""",
]
from = "now-60m"
index = ["filebeat-*"]
index = ["filebeat-*", "logs-aws*"]
interval = "10m"
language = "kuery"
license = "Elastic License"
rules/aws/impact_rds_cluster_deletion.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/05/21"
ecs_version = ["1.6.0"]
maturity = "production"
updated_date = "2020/07/28"
updated_date = "2020/09/03"
[rule]
author = ["Elastic"]
@@ -18,7 +18,7 @@ false_positives = [
""",
]
from = "now-60m"
index = ["filebeat-*"]
index = ["filebeat-*", "logs-aws*"]
interval = "10m"
language = "kuery"
license = "Elastic License"
rules/aws/impact_rds_instance_cluster_stoppage.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/05/20"
ecs_version = ["1.6.0"]
maturity = "production"
updated_date = "2020/07/28"
updated_date = "2020/09/03"
[rule]
author = ["Elastic"]
@@ -15,7 +15,7 @@ false_positives = [
""",
]
from = "now-60m"
index = ["filebeat-*"]
index = ["filebeat-*", "logs-aws*"]
interval = "10m"
language = "kuery"
license = "Elastic License"
rules/aws/initial_access_console_login_root.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/06/11"
ecs_version = ["1.6.0"]
maturity = "production"
updated_date = "2020/07/28"
updated_date = "2020/09/03"
[rule]
author = ["Elastic"]
@@ -16,7 +16,7 @@ false_positives = [
""",
]
from = "now-60m"
index = ["filebeat-*"]
index = ["filebeat-*", "logs-aws*"]
interval = "10m"
language = "kuery"
license = "Elastic License"
rules/aws/initial_access_password_recovery.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/07/02"
ecs_version = ["1.6.0"]
maturity = "production"
updated_date = "2020/07/28"
updated_date = "2020/09/03"
[rule]
author = ["Elastic"]
@@ -18,7 +18,7 @@ false_positives = [
""",
]
from = "now-60m"
index = ["filebeat-*"]
index = ["filebeat-*", "logs-aws*"]
interval = "10m"
language = "kuery"
license = "Elastic License"
rules/aws/persistence_ec2_network_acl_creation.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/06/04"
ecs_version = ["1.6.0"]
maturity = "production"
updated_date = "2020/07/28"
updated_date = "2020/09/03"
[rule]
author = ["Elastic"]
@@ -18,7 +18,7 @@ false_positives = [
""",
]
from = "now-60m"
index = ["filebeat-*"]
index = ["filebeat-*", "logs-aws*"]
interval = "10m"
language = "kuery"
license = "Elastic License"
rules/aws/persistence_iam_group_creation.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/06/05"
ecs_version = ["1.6.0"]
maturity = "production"
updated_date = "2020/07/28"
updated_date = "2020/09/03"
[rule]
author = ["Elastic"]
@@ -18,7 +18,7 @@ false_positives = [
""",
]
from = "now-60m"
index = ["filebeat-*"]
index = ["filebeat-*", "logs-aws*"]
interval = "10m"
language = "kuery"
license = "Elastic License"
rules/aws/persistence_rds_cluster_creation.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/05/20"
ecs_version = ["1.6.0"]
maturity = "production"
updated_date = "2020/07/28"
updated_date = "2020/09/03"
[rule]
author = ["Elastic"]
@@ -18,7 +18,7 @@ false_positives = [
""",
]
from = "now-60m"
index = ["filebeat-*"]
index = ["filebeat-*", "logs-aws*"]
interval = "10m"
language = "kuery"
license = "Elastic License"
rules/aws/privilege_escalation_root_login_without_mfa.toml
+1 -1
View File
@@ -2,7 +2,7 @@
creation_date = "2020/07/06"
ecs_version = ["1.6.0"]
maturity = "production"
updated_date = "2020/08/31"
updated_date = "2020/09/03"
[rule]
author = ["Elastic"]
rules/aws/privilege_escalation_updateassumerolepolicy.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/07/06"
ecs_version = ["1.6.0"]
maturity = "production"
updated_date = "2020/07/28"
updated_date = "2020/09/03"
[rule]
author = ["Elastic"]
@@ -18,7 +18,7 @@ false_positives = [
""",
]
from = "now-60m"
index = ["filebeat-*"]
index = ["filebeat-*", "logs-aws*"]
interval = "10m"
language = "kuery"
license = "Elastic License"