security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[Rule Tuning] Timeline Templates For Windows and Linux (#1892)

Browse Source 
* added comprehensive file timeline to Hosts File Modified rule

* added Comprehensive Process Timeline to Interactive Terminal Spawned via Python rule

* updated rules to have generic instead of comprehensive

* updated several rules with timeline ID and timeline title values

* changed updated_date for threat intel fleet integrations

* added missing templates to timeline_templates dict in definitions.py

* added comprehensive timeline templates to alerts after definitions.py was updated

* updated rules with comprehensive timeline templates and added min stack comments and versions

* removing timeline template changes which is tracked in #1904

* Update rules/linux/execution_python_tty_shell.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Delete Pipfile

Removing pipfile

* Delete Pipfile.lock

deleting pipfile.lock

* Update rules/windows/execution_command_shell_started_by_svchost.toml

updating title

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
This commit is contained in:
Terrance DeJesus
2022-04-01 13:44:35 -04:00
committed by GitHub
parent e72031a71a
commit 93edc44284
11 changed files with 57 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/linux/execution_python_tty_shell.toml
+7 -2
View File
@@ -1,7 +1,9 @@
[metadata]
creation_date = "2020/04/15"
maturity = "production"
updated_date = "2021/03/03"
updated_date = "2022/03/31"
min_stack_comments = "Comprehensive timeline templates only available in 8.2+"
min_stack_version = "8.2"
[rule]
author = ["Elastic"]
@@ -18,11 +20,14 @@ risk_score = 73
rule_id = "d76b02ef-fc95-4001-9297-01cb7412232f"
severity = "high"
tags = ["Elastic", "Host", "Linux", "Threat Detection", "Execution"]
timeline_id = "e70679c2-6cde-4510-9764-4823df18f7db"
timeline_title = "Comprehensive Process Timeline"
timestamp_override = "event.ingested"
type = "query"
query = '''
event.category:process and event.type:(start or process_started) and process.name:python and
event.category:process and event.type:(start or process_started) and
process.name:python* and
process.args:("import pty; pty.spawn(\"/bin/sh\")" or
"import pty; pty.spawn(\"/bin/dash\")" or
"import pty; pty.spawn(\"/bin/bash\")")