security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[New Rule] Adding Data Exfiltration Rules from Advanced Analytic DED Package (#3126)

Browse Source 
* Adding DED rules

* adding integration manifests and schemas for DED

* Updating min stack version

* updating manifests and schemas to match main

* added setup note; updated references

---------

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: terrancedejesus <terrance.dejesus@elastic.co>
This commit is contained in:
Apoorva Joshi
2023-10-14 10:23:48 -07:00
committed by GitHub
parent 2b0735024e
commit 97ff7fb26e
7 changed files with 364 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/integrations/ded/exfiltration_ml_high_bytes_destination_geo_country_iso_code.toml
+52
View File
@@ -0,0 +1,52 @@
[metadata]
creation_date = "2023/09/22"
integration = ["ded"]
maturity = "production"
min_stack_comments = "New rule"
min_stack_version = "8.9.0"
updated_date = "2023/10/14"
[rule]
anomaly_threshold = 75
author = ["Elastic"]
description = """
A machine learning job has detected data exfiltration to a particular geo-location (by region name). Data transfers to
geo-locations that are outside the normal traffic patterns of an organization could indicate exfiltration over command
and control channels.
"""
from = "now-6h"
interval = "15m"
license = "Elastic License v2"
machine_learning_job_id = "ded_high_sent_bytes_destination_geo_country_iso_code"
name = "Potential Data Exfiltration Activity to an Unusual ISO Code"
note = """## Setup
The Data Exfiltration Detection integration must be enabled and related ML jobs configured for this rule to be effective. Please refer to this rule's references for more information.
"""
references = [
"https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html",
"https://docs.elastic.co/en/integrations/ded"
]
risk_score = 21
rule_id = "e1db8899-97c1-4851-8993-3a3265353601"
severity = "low"
tags = [
"Use Case: Data Exfiltration Detection",
"Rule Type: ML",
"Rule Type: Machine Learning",
"Tactic: Exfiltration",
]
type = "machine_learning"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1041"
name = "Exfiltration Over C2 Channel"
reference = "https://attack.mitre.org/techniques/T1041/"
[rule.threat.tactic]
id = "TA0010"
name = "Exfiltration"
reference = "https://attack.mitre.org/tactics/TA0010/"
rules/integrations/ded/exfiltration_ml_high_bytes_destination_ip.toml
+52
View File
@@ -0,0 +1,52 @@
[metadata]
creation_date = "2023/09/22"
integration = ["ded"]
maturity = "production"
min_stack_comments = "New rule"
min_stack_version = "8.9.0"
updated_date = "2023/10/14"
[rule]
anomaly_threshold = 75
author = ["Elastic"]
description = """
A machine learning job has detected data exfiltration to a particular geo-location (by IP address). Data transfers to
geo-locations that are outside the normal traffic patterns of an organization could indicate exfiltration over command
and control channels.
"""
from = "now-6h"
interval = "15m"
license = "Elastic License v2"
machine_learning_job_id = "ded_high_sent_bytes_destination_ip"
name = "Potential Data Exfiltration Activity to an Unusual IP Address"
note = """## Setup
The Data Exfiltration Detection integration must be enabled and related ML jobs configured for this rule to be effective. Please refer to this rule's references for more information.
"""
references = [
"https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html",
"https://docs.elastic.co/en/integrations/ded"
]
risk_score = 21
rule_id = "cc653d77-ddd2-45b1-9197-c75ad19df66c"
severity = "low"
tags = [
"Use Case: Data Exfiltration Detection",
"Rule Type: ML",
"Rule Type: Machine Learning",
"Tactic: Exfiltration",
]
type = "machine_learning"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1041"
name = "Exfiltration Over C2 Channel"
reference = "https://attack.mitre.org/techniques/T1041/"
[rule.threat.tactic]
id = "TA0010"
name = "Exfiltration"
reference = "https://attack.mitre.org/tactics/TA0010/"
rules/integrations/ded/exfiltration_ml_high_bytes_destination_port.toml
+51
View File
@@ -0,0 +1,51 @@
[metadata]
creation_date = "2023/09/22"
integration = ["ded"]
maturity = "production"
min_stack_comments = "New rule"
min_stack_version = "8.9.0"
updated_date = "2023/10/14"
[rule]
anomaly_threshold = 75
author = ["Elastic"]
description = """
A machine learning job has detected data exfiltration to a particular destination port. Data transfer patterns that are
outside the normal traffic patterns of an organization could indicate exfiltration over command and control channels.
"""
from = "now-6h"
interval = "15m"
license = "Elastic License v2"
machine_learning_job_id = "ded_high_sent_bytes_destination_port"
name = "Potential Data Exfiltration Activity to an Unusual Destination Port"
note = """## Setup
The Data Exfiltration Detection integration must be enabled and related ML jobs configured for this rule to be effective. Please refer to this rule's references for more information.
"""
references = [
"https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html",
"https://docs.elastic.co/en/integrations/ded"
]
risk_score = 21
rule_id = "ef8cc01c-fc49-4954-a175-98569c646740"
severity = "low"
tags = [
"Use Case: Data Exfiltration Detection",
"Rule Type: ML",
"Rule Type: Machine Learning",
"Tactic: Exfiltration",
]
type = "machine_learning"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1041"
name = "Exfiltration Over C2 Channel"
reference = "https://attack.mitre.org/techniques/T1041/"
[rule.threat.tactic]
id = "TA0010"
name = "Exfiltration"
reference = "https://attack.mitre.org/tactics/TA0010/"
rules/integrations/ded/exfiltration_ml_high_bytes_destination_region_name.toml
+52
View File
@@ -0,0 +1,52 @@
[metadata]
creation_date = "2023/09/22"
integration = ["ded"]
maturity = "production"
min_stack_comments = "New rule"
min_stack_version = "8.9.0"
updated_date = "2023/10/14"
[rule]
anomaly_threshold = 75
author = ["Elastic"]
description = """
A machine learning job has detected data exfiltration to a particular geo-location (by region name). Data transfers to
geo-locations that are outside the normal traffic patterns of an organization could indicate exfiltration over command
and control channels.
"""
from = "now-6h"
interval = "15m"
license = "Elastic License v2"
machine_learning_job_id = "ded_high_sent_bytes_destination_region_name"
name = "Potential Data Exfiltration Activity to an Unusual Region"
note = """## Setup
The Data Exfiltration Detection integration must be enabled and related ML jobs configured for this rule to be effective. Please refer to this rule's references for more information.
"""
references = [
"https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html",
"https://docs.elastic.co/en/integrations/ded"
]
risk_score = 21
rule_id = "bfba5158-1fd6-4937-a205-77d96213b341"
severity = "low"
tags = [
"Use Case: Data Exfiltration Detection",
"Rule Type: ML",
"Rule Type: Machine Learning",
"Tactic: Exfiltration",
]
type = "machine_learning"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1041"
name = "Exfiltration Over C2 Channel"
reference = "https://attack.mitre.org/techniques/T1041/"
[rule.threat.tactic]
id = "TA0010"
name = "Exfiltration"
reference = "https://attack.mitre.org/tactics/TA0010/"
rules/integrations/ded/exfiltration_ml_high_bytes_written_to_external_device.toml
+52
View File
@@ -0,0 +1,52 @@
[metadata]
creation_date = "2023/09/22"
integration = ["ded"]
maturity = "production"
min_stack_comments = "New rule"
min_stack_version = "8.9.0"
updated_date = "2023/10/14"
[rule]
anomaly_threshold = 75
author = ["Elastic"]
description = """
A machine learning job has detected high bytes of data written to an external device. In a typical operational setting,
there is usually a predictable pattern or a certain range of data that is written to external devices. An unusually
large amount of data being written is anomalous and can signal illicit data copying or transfer activities.
"""
from = "now-2h"
interval = "15m"
license = "Elastic License v2"
machine_learning_job_id = "ded_high_bytes_written_to_external_device"
name = "Spike in Bytes Sent to an External Device"
note = """## Setup
The Data Exfiltration Detection integration must be enabled and related ML jobs configured for this rule to be effective. Please refer to this rule's references for more information.
"""
references = [
"https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html",
"https://docs.elastic.co/en/integrations/ded"
]
risk_score = 21
rule_id = "35a3b253-eea8-46f0-abd3-68bdd47e6e3d"
severity = "low"
tags = [
"Use Case: Data Exfiltration Detection",
"Rule Type: ML",
"Rule Type: Machine Learning",
"Tactic: Exfiltration",
]
type = "machine_learning"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1052"
name = "Exfiltration Over Physical Medium"
reference = "https://attack.mitre.org/techniques/T1052/"
[rule.threat.tactic]
id = "TA0010"
name = "Exfiltration"
reference = "https://attack.mitre.org/tactics/TA0010/"
rules/integrations/ded/exfiltration_ml_high_bytes_written_to_external_device_airdrop.toml
+53
View File
@@ -0,0 +1,53 @@
[metadata]
creation_date = "2023/09/22"
integration = ["ded"]
maturity = "production"
min_stack_comments = "New rule"
min_stack_version = "8.9.0"
updated_date = "2023/10/14"
[rule]
anomaly_threshold = 75
author = ["Elastic"]
description = """
A machine learning job has detected high bytes of data written to an external device via Airdrop. In a typical
operational setting, there is usually a predictable pattern or a certain range of data that is written to external
devices. An unusually large amount of data being written is anomalous and can signal illicit data copying or transfer
activities.
"""
from = "now-2h"
interval = "15m"
license = "Elastic License v2"
machine_learning_job_id = "ded_high_bytes_written_to_external_device_airdrop"
name = "Spike in Bytes Sent to an External Device via Airdrop"
note = """## Setup
The Data Exfiltration Detection integration must be enabled and related ML jobs configured for this rule to be effective. Please refer to this rule's references for more information.
"""
references = [
"https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html",
"https://docs.elastic.co/en/integrations/ded"
]
risk_score = 21
rule_id = "e92c99b6-c547-4bb6-b244-2f27394bc849"
severity = "low"
tags = [
"Use Case: Data Exfiltration Detection",
"Rule Type: ML",
"Rule Type: Machine Learning",
"Tactic: Exfiltration",
]
type = "machine_learning"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1011"
name = "Exfiltration Over Other Network Medium"
reference = "https://attack.mitre.org/techniques/T1011/"
[rule.threat.tactic]
id = "TA0010"
name = "Exfiltration"
reference = "https://attack.mitre.org/tactics/TA0010/"
rules/integrations/ded/exfiltration_ml_rare_process_writing_to_external_device.toml
+52
View File
@@ -0,0 +1,52 @@
[metadata]
creation_date = "2023/09/22"
integration = ["ded"]
maturity = "production"
min_stack_comments = "New rule"
min_stack_version = "8.9.0"
updated_date = "2023/10/14"
[rule]
anomaly_threshold = 75
author = ["Elastic"]
description = """
A machine learning job has detected a rare process writing data to an external device. Malicious actors often use
benign-looking processes to mask their data exfiltration activities. The discovery of such a process that has no
legitimate reason to write data to external devices can indicate exfiltration.
"""
from = "now-2h"
interval = "15m"
license = "Elastic License v2"
machine_learning_job_id = "ded_rare_process_writing_to_external_device"
name = "Unusual Process Writing Data to an External Device"
note = """## Setup
The Data Exfiltration Detection integration must be enabled and related ML jobs configured for this rule to be effective. Please refer to this rule's references for more information.
"""
references = [
"https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html",
"https://docs.elastic.co/en/integrations/ded"
]
risk_score = 21
rule_id = "4b95ecea-7225-4690-9938-2a2c0bad9c99"
severity = "low"
tags = [
"Use Case: Data Exfiltration Detection",
"Rule Type: ML",
"Rule Type: Machine Learning",
"Tactic: Exfiltration",
]
type = "machine_learning"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1052"
name = "Exfiltration Over Physical Medium"
reference = "https://attack.mitre.org/techniques/T1052/"
[rule.threat.tactic]
id = "TA0010"
name = "Exfiltration"
reference = "https://attack.mitre.org/tactics/TA0010/"