diff --git a/rules/linux/privilege_escalation_linux_strace_activity.toml b/rules/_deprecated/privilege_escalation_linux_strace_activity.toml similarity index 94% rename from rules/linux/privilege_escalation_linux_strace_activity.toml rename to rules/_deprecated/privilege_escalation_linux_strace_activity.toml index 75e223f72..0326f0216 100644 --- a/rules/linux/privilege_escalation_linux_strace_activity.toml +++ b/rules/_deprecated/privilege_escalation_linux_strace_activity.toml @@ -1,7 +1,8 @@ [metadata] creation_date = "2020/02/18" -maturity = "production" -updated_date = "2021/06/15" +deprecation_date = "2022/07/28" +maturity = "deprecated" +updated_date = "2022/07/28" [rule] author = ["Elastic"] diff --git a/rules/linux/command_and_control_connection_attempt_by_non_ssh_root_session.toml b/rules/linux/command_and_control_connection_attempt_by_non_ssh_root_session.toml index e67c2cf3e..65af92765 100644 --- a/rules/linux/command_and_control_connection_attempt_by_non_ssh_root_session.toml +++ b/rules/linux/command_and_control_connection_attempt_by_non_ssh_root_session.toml @@ -1,7 +1,7 @@ [metadata] creation_date = "2022/05/16" maturity = "production" -updated_date = "2022/05/16" +updated_date = "2022/07/26" [rule] author = ["Elastic"] @@ -43,8 +43,9 @@ type = "eql" query = ''' sequence by process.entity_id with maxspan=1m [network where event.type == "start" and event.action == "connection_attempted" and user.id == "0" and - not process.executable : ("/bin/ssh", "/sbin/ssh", "/usr/lib/systemd/systemd")] -[process where event.action == "session_id_change" and user.id == "0"] + not process.executable : ("/bin/ssh", "/sbin/ssh", "/usr/lib/systemd/systemd", "/usr/sbin/sshd")] +[process where event.action == "session_id_change" and user.id == "0" and + not process.executable : ("/bin/ssh", "/sbin/ssh", "/usr/lib/systemd/systemd", "/usr/sbin/sshd")] ''' diff --git a/rules/linux/credential_access_ssh_backdoor_log.toml b/rules/linux/credential_access_ssh_backdoor_log.toml index 2285b7da3..736afdeec 100644 --- a/rules/linux/credential_access_ssh_backdoor_log.toml +++ b/rules/linux/credential_access_ssh_backdoor_log.toml @@ -1,7 +1,7 @@ [metadata] creation_date = "2020/12/21" maturity = "production" -updated_date = "2022/03/31" +updated_date = "2022/07/28" [rule] author = ["Elastic"] @@ -34,7 +34,7 @@ type = "eql" query = ''' file where event.type == "change" and process.executable : ("/usr/sbin/sshd", "/usr/bin/ssh") and ( - file.name : (".*", "~*") or + (file.name : (".*", "~*", "*~") and not file.name : (".cache", ".viminfo", ".bash_history")) or file.extension : ("in", "out", "ini", "h", "gz", "so", "sock", "sync", "0", "1", "2", "3", "4", "5", "6", "7", "8", "9") or file.path : ( diff --git a/rules/linux/defense_evasion_hidden_file_dir_tmp.toml b/rules/linux/defense_evasion_hidden_file_dir_tmp.toml index 370539d6d..ea799dd3e 100644 --- a/rules/linux/defense_evasion_hidden_file_dir_tmp.toml +++ b/rules/linux/defense_evasion_hidden_file_dir_tmp.toml @@ -3,7 +3,7 @@ creation_date = "2020/04/29" maturity = "production" min_stack_comments = "EQL regex syntax introduced in 7.12" min_stack_version = "7.12.0" -updated_date = "2022/07/20" +updated_date = "2022/07/26" [rule] author = ["Elastic"] @@ -39,7 +39,7 @@ query = ''' process where event.type in ("start", "process_started") and process.working_directory in ("/tmp", "/var/tmp", "/dev/shm") and process.args regex~ """\.[a-z0-9_\-][a-z0-9_\-\.]{1,254}""" and - not process.name in ("ls", "find") + not process.name in ("ls", "find", "grep") ''' diff --git a/rules/linux/defense_evasion_log_files_deleted.toml b/rules/linux/defense_evasion_log_files_deleted.toml index db66f9baf..a5eef7011 100644 --- a/rules/linux/defense_evasion_log_files_deleted.toml +++ b/rules/linux/defense_evasion_log_files_deleted.toml @@ -1,7 +1,7 @@ [metadata] creation_date = "2020/11/03" maturity = "production" -updated_date = "2022/03/31" +updated_date = "2022/07/26" [rule] author = ["Elastic"] @@ -41,7 +41,8 @@ file where event.type == "deletion" and "/var/log/messages", "/var/log/secure", "/var/log/auth.log" - ) + ) and + not process.name : ("gzip") ''' diff --git a/rules/linux/execution_process_started_in_shared_memory_directory.toml b/rules/linux/execution_process_started_in_shared_memory_directory.toml index 6926a05d9..0fe504fdf 100644 --- a/rules/linux/execution_process_started_in_shared_memory_directory.toml +++ b/rules/linux/execution_process_started_in_shared_memory_directory.toml @@ -1,7 +1,7 @@ [metadata] creation_date = "2022/05/10" maturity = "production" -updated_date = "2022/05/11" +updated_date = "2022/07/26" [rule] author = ["Elastic"] @@ -41,7 +41,8 @@ process where event.type == "start" and "/run/shm/*", "/var/run/*", "/var/lock/*" - ) + ) and + not process.executable : ( "/var/run/docker/*") ''' diff --git a/rules/linux/execution_shell_evasion_linux_binary.toml b/rules/linux/execution_shell_evasion_linux_binary.toml index ad66ab685..f72509813 100644 --- a/rules/linux/execution_shell_evasion_linux_binary.toml +++ b/rules/linux/execution_shell_evasion_linux_binary.toml @@ -1,7 +1,7 @@ [metadata] creation_date = "2022/05/06" maturity = "production" -updated_date = "2022/05/25" +updated_date = "2022/07/28" [rule] author = ["Elastic"] @@ -108,7 +108,7 @@ process where event.type == "start" and /* launching shells from unusual parents or parent+arg combos */ (process.name in ("bash", "sh", "dash","ash") and - (process.parent.name in ("byebug","git","ftp")) or + (process.parent.name in ("byebug","git","ftp","strace")) or /* shells specified in parent args */ /* nice rule is broken in 8.2 */ diff --git a/rules/linux/persistence_credential_access_modify_ssh_binaries.toml b/rules/linux/persistence_credential_access_modify_ssh_binaries.toml index a5aa08cf8..15ecd152a 100644 --- a/rules/linux/persistence_credential_access_modify_ssh_binaries.toml +++ b/rules/linux/persistence_credential_access_modify_ssh_binaries.toml @@ -1,7 +1,7 @@ [metadata] creation_date = "2020/12/21" maturity = "production" -updated_date = "2021/03/03" +updated_date = "2022/07/26" [rule] author = ["Elastic"] @@ -26,10 +26,10 @@ timestamp_override = "event.ingested" type = "query" query = ''' -event.category:file and event.type:change and +event.category:file and event.type:change and process.name:* and (file.path:(/usr/sbin/sshd or /usr/bin/ssh or /usr/bin/sftp or /usr/bin/scp) or file.name:libkeyutils.so) and - not process.executable:/usr/bin/dpkg + not process.name:("dpkg" or "yum" or "dnf" or "dnf-automatic") ''' diff --git a/rules/linux/persistence_kde_autostart_modification.toml b/rules/linux/persistence_kde_autostart_modification.toml index 2434c1352..23da8be43 100644 --- a/rules/linux/persistence_kde_autostart_modification.toml +++ b/rules/linux/persistence_kde_autostart_modification.toml @@ -1,7 +1,7 @@ [metadata] creation_date = "2021/01/06" maturity = "production" -updated_date = "2022/03/31" +updated_date = "2022/07/26" [rule] author = ["Elastic"] @@ -43,7 +43,8 @@ file where event.type != "deletion" and "/home/*/.local/share/autostart/*", "/root/.local/share/autostart/*", "/home/*/.config/autostart-scripts/*", "/root/.config/autostart-scripts/*", "/etc/xdg/autostart/*", "/usr/share/autostart/*" - ) + ) and + not process.name in ("yum", "dpkg", "install", "dnf", "teams", "yum-cron", "dnf-automatic") ''' diff --git a/rules/linux/persistence_shell_activity_by_web_server.toml b/rules/linux/persistence_shell_activity_by_web_server.toml index 221bc3bec..6052c4d2d 100644 --- a/rules/linux/persistence_shell_activity_by_web_server.toml +++ b/rules/linux/persistence_shell_activity_by_web_server.toml @@ -1,7 +1,7 @@ [metadata] creation_date = "2020/02/18" maturity = "production" -updated_date = "2021/03/03" +updated_date = "2022/07/26" [rule] author = ["Elastic"] @@ -26,8 +26,9 @@ timestamp_override = "event.ingested" type = "query" query = ''' -event.category:process and event.type:(start or process_started) and process.name:(bash or dash) and - user.name:(apache or nginx or www or "www-data") +event.category:process and event.type:(start or process_started) and +process.name:(bash or dash or ash or zsh or "python*" or "perl*" or "php*") and +process.parent.name:("apache" or "nginx" or "www" or "apache2" or "httpd" or "www-data") '''