Setup Guide information for MacOS rules (#3274)
(cherry picked from commit 7854081cc0)
This commit is contained in:
shashank-elastic
committed by
github-actions[bot]
github-actions[bot]
parent
633f364632
commit
a3388dbf36
@@ -4,7 +4,7 @@ integration = ["endpoint"]
|
||||
maturity = "production"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
updated_date = "2023/10/23"
|
||||
updated_date = "2023/11/15"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -13,7 +13,7 @@ Identifies the execution of a process with arguments pointing to known browser f
|
||||
Adversaries may acquire credentials from web browsers by reading files specific to the target browser.
|
||||
"""
|
||||
from = "now-9m"
|
||||
index = ["auditbeat-*", "logs-endpoint.events.*"]
|
||||
index = ["logs-endpoint.events.*"]
|
||||
language = "eql"
|
||||
license = "Elastic License v2"
|
||||
name = "Access of Stored Browser Credentials"
|
||||
@@ -22,11 +22,29 @@ risk_score = 73
|
||||
rule_id = "20457e4f-d1de-4b92-ae69-142e27a4342a"
|
||||
setup = """
|
||||
|
||||
If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
|
||||
events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
|
||||
Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
|
||||
`event.ingested` to @timestamp.
|
||||
For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
|
||||
This rule requires data coming in from Elastic Defend.
|
||||
|
||||
### Elastic Defend Integration Setup
|
||||
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
|
||||
|
||||
#### Prerequisite Requirements:
|
||||
- Fleet is required for Elastic Defend.
|
||||
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
|
||||
|
||||
#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
|
||||
- Go to the Kibana home page and click "Add integrations".
|
||||
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
|
||||
- Click "Add Elastic Defend".
|
||||
- Configure the integration name and optionally add a description.
|
||||
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
|
||||
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
|
||||
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
|
||||
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
|
||||
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
|
||||
- Click "Save and Continue".
|
||||
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
|
||||
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
|
||||
|
||||
"""
|
||||
severity = "high"
|
||||
tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Credential Access", "Data Source: Elastic Defend"]
|
||||
|
||||
@@ -4,7 +4,7 @@ integration = ["endpoint"]
|
||||
maturity = "production"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
updated_date = "2023/10/23"
|
||||
updated_date = "2023/11/15"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -14,7 +14,7 @@ for macOS to keep track of users' passwords and credentials for many services an
|
||||
websites, secure notes and certificates.
|
||||
"""
|
||||
from = "now-9m"
|
||||
index = ["auditbeat-*", "logs-endpoint.events.*"]
|
||||
index = ["logs-endpoint.events.*"]
|
||||
language = "eql"
|
||||
license = "Elastic License v2"
|
||||
name = "Access to Keychain Credentials Directories"
|
||||
@@ -26,11 +26,29 @@ risk_score = 73
|
||||
rule_id = "96e90768-c3b7-4df6-b5d9-6237f8bc36a8"
|
||||
setup = """
|
||||
|
||||
If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
|
||||
events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
|
||||
Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
|
||||
`event.ingested` to @timestamp.
|
||||
For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
|
||||
This rule requires data coming in from Elastic Defend.
|
||||
|
||||
### Elastic Defend Integration Setup
|
||||
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
|
||||
|
||||
#### Prerequisite Requirements:
|
||||
- Fleet is required for Elastic Defend.
|
||||
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
|
||||
|
||||
#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
|
||||
- Go to the Kibana home page and click "Add integrations".
|
||||
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
|
||||
- Click "Add Elastic Defend".
|
||||
- Configure the integration name and optionally add a description.
|
||||
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
|
||||
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
|
||||
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
|
||||
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
|
||||
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
|
||||
- Click "Save and Continue".
|
||||
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
|
||||
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
|
||||
|
||||
"""
|
||||
severity = "high"
|
||||
tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Credential Access", "Data Source: Elastic Defend"]
|
||||
|
||||
@@ -4,7 +4,7 @@ integration = ["endpoint"]
|
||||
maturity = "production"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
updated_date = "2023/06/22"
|
||||
updated_date = "2023/11/15"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -14,7 +14,7 @@ credentials to obtain account login information in the form of a hash. These has
|
||||
lateral movement.
|
||||
"""
|
||||
from = "now-9m"
|
||||
index = ["auditbeat-*", "logs-endpoint.events.*"]
|
||||
index = ["logs-endpoint.events.*"]
|
||||
language = "kuery"
|
||||
license = "Elastic License v2"
|
||||
name = "Dumping Account Hashes via Built-In Commands"
|
||||
@@ -24,6 +24,32 @@ references = [
|
||||
]
|
||||
risk_score = 73
|
||||
rule_id = "02ea4563-ec10-4974-b7de-12e65aa4f9b3"
|
||||
setup = """
|
||||
|
||||
This rule requires data coming in from Elastic Defend.
|
||||
|
||||
### Elastic Defend Integration Setup
|
||||
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
|
||||
|
||||
#### Prerequisite Requirements:
|
||||
- Fleet is required for Elastic Defend.
|
||||
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
|
||||
|
||||
#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
|
||||
- Go to the Kibana home page and click "Add integrations".
|
||||
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
|
||||
- Click "Add Elastic Defend".
|
||||
- Configure the integration name and optionally add a description.
|
||||
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
|
||||
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
|
||||
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
|
||||
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
|
||||
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
|
||||
- Click "Save and Continue".
|
||||
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
|
||||
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
|
||||
|
||||
"""
|
||||
severity = "high"
|
||||
tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Credential Access", "Data Source: Elastic Defend"]
|
||||
timestamp_override = "event.ingested"
|
||||
|
||||
@@ -4,7 +4,7 @@ integration = ["endpoint"]
|
||||
maturity = "production"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
updated_date = "2023/06/22"
|
||||
updated_date = "2023/11/15"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -14,17 +14,35 @@ built-in way for macOS to keep track of users' passwords and credentials for man
|
||||
and website passwords, secure notes, certificates, and Kerberos.
|
||||
"""
|
||||
from = "now-9m"
|
||||
index = ["auditbeat-*", "logs-endpoint.events.*"]
|
||||
index = ["logs-endpoint.events.*"]
|
||||
language = "eql"
|
||||
license = "Elastic License v2"
|
||||
name = "Dumping of Keychain Content via Security Command"
|
||||
setup = """
|
||||
|
||||
If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
|
||||
events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
|
||||
Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
|
||||
`event.ingested` to @timestamp.
|
||||
For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
|
||||
This rule requires data coming in from Elastic Defend.
|
||||
|
||||
### Elastic Defend Integration Setup
|
||||
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
|
||||
|
||||
#### Prerequisite Requirements:
|
||||
- Fleet is required for Elastic Defend.
|
||||
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
|
||||
|
||||
#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
|
||||
- Go to the Kibana home page and click "Add integrations".
|
||||
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
|
||||
- Click "Add Elastic Defend".
|
||||
- Configure the integration name and optionally add a description.
|
||||
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
|
||||
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
|
||||
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
|
||||
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
|
||||
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
|
||||
- Click "Save and Continue".
|
||||
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
|
||||
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
|
||||
|
||||
"""
|
||||
references = ["https://ss64.com/osx/security.html"]
|
||||
risk_score = 73
|
||||
|
||||
@@ -4,7 +4,7 @@ integration = ["endpoint"]
|
||||
maturity = "production"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
updated_date = "2023/06/22"
|
||||
updated_date = "2023/11/15"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -13,7 +13,7 @@ Identifies the use of the Kerberos credential cache (kcc) utility to dump locall
|
||||
may attempt to dump credential material in the form of tickets that can be leveraged for lateral movement.
|
||||
"""
|
||||
from = "now-9m"
|
||||
index = ["auditbeat-*", "logs-endpoint.events.*"]
|
||||
index = ["logs-endpoint.events.*"]
|
||||
language = "kuery"
|
||||
license = "Elastic License v2"
|
||||
name = "Kerberos Cached Credentials Dumping"
|
||||
@@ -23,6 +23,32 @@ references = [
|
||||
]
|
||||
risk_score = 73
|
||||
rule_id = "ad88231f-e2ab-491c-8fc6-64746da26cfe"
|
||||
setup = """
|
||||
|
||||
This rule requires data coming in from Elastic Defend.
|
||||
|
||||
### Elastic Defend Integration Setup
|
||||
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
|
||||
|
||||
#### Prerequisite Requirements:
|
||||
- Fleet is required for Elastic Defend.
|
||||
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
|
||||
|
||||
#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
|
||||
- Go to the Kibana home page and click "Add integrations".
|
||||
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
|
||||
- Click "Add Elastic Defend".
|
||||
- Configure the integration name and optionally add a description.
|
||||
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
|
||||
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
|
||||
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
|
||||
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
|
||||
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
|
||||
- Click "Save and Continue".
|
||||
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
|
||||
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
|
||||
|
||||
"""
|
||||
severity = "high"
|
||||
tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Credential Access", "Data Source: Elastic Defend"]
|
||||
timestamp_override = "event.ingested"
|
||||
|
||||
@@ -4,7 +4,7 @@ integration = ["endpoint"]
|
||||
maturity = "production"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
updated_date = "2023/10/23"
|
||||
updated_date = "2023/11/15"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -15,7 +15,7 @@ and website passwords, secure notes, certificates, and Kerberos.
|
||||
"""
|
||||
false_positives = ["Applications for password management."]
|
||||
from = "now-9m"
|
||||
index = ["auditbeat-*", "logs-endpoint.events.*"]
|
||||
index = ["logs-endpoint.events.*"]
|
||||
language = "eql"
|
||||
license = "Elastic License v2"
|
||||
name = "Keychain Password Retrieval via Command Line"
|
||||
@@ -29,11 +29,29 @@ risk_score = 73
|
||||
rule_id = "9092cd6c-650f-4fa3-8a8a-28256c7489c9"
|
||||
setup = """
|
||||
|
||||
If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
|
||||
events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
|
||||
Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
|
||||
`event.ingested` to @timestamp.
|
||||
For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
|
||||
This rule requires data coming in from Elastic Defend.
|
||||
|
||||
### Elastic Defend Integration Setup
|
||||
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
|
||||
|
||||
#### Prerequisite Requirements:
|
||||
- Fleet is required for Elastic Defend.
|
||||
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
|
||||
|
||||
#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
|
||||
- Go to the Kibana home page and click "Add integrations".
|
||||
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
|
||||
- Click "Add Elastic Defend".
|
||||
- Configure the integration name and optionally add a description.
|
||||
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
|
||||
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
|
||||
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
|
||||
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
|
||||
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
|
||||
- Click "Save and Continue".
|
||||
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
|
||||
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
|
||||
|
||||
"""
|
||||
severity = "high"
|
||||
tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Credential Access", "Data Source: Elastic Defend"]
|
||||
|
||||
@@ -4,7 +4,7 @@ integration = ["endpoint"]
|
||||
maturity = "production"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
updated_date = "2023/06/22"
|
||||
updated_date = "2023/11/15"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -14,7 +14,7 @@ hijack web browser traffic for credential access via traffic sniffing or redirec
|
||||
"""
|
||||
false_positives = ["Legitimate WebProxy Settings Modification"]
|
||||
from = "now-9m"
|
||||
index = ["auditbeat-*", "logs-endpoint.events.*"]
|
||||
index = ["logs-endpoint.events.*"]
|
||||
language = "kuery"
|
||||
license = "Elastic License v2"
|
||||
name = "WebProxy Settings Modification"
|
||||
@@ -24,6 +24,32 @@ references = [
|
||||
]
|
||||
risk_score = 47
|
||||
rule_id = "10a500bb-a28f-418e-ba29-ca4c8d1a9f2f"
|
||||
setup = """
|
||||
|
||||
This rule requires data coming in from Elastic Defend.
|
||||
|
||||
### Elastic Defend Integration Setup
|
||||
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
|
||||
|
||||
#### Prerequisite Requirements:
|
||||
- Fleet is required for Elastic Defend.
|
||||
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
|
||||
|
||||
#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
|
||||
- Go to the Kibana home page and click "Add integrations".
|
||||
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
|
||||
- Click "Add Elastic Defend".
|
||||
- Configure the integration name and optionally add a description.
|
||||
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
|
||||
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
|
||||
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
|
||||
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
|
||||
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
|
||||
- Click "Save and Continue".
|
||||
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
|
||||
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
|
||||
|
||||
"""
|
||||
severity = "medium"
|
||||
tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Credential Access", "Data Source: Elastic Defend"]
|
||||
timestamp_override = "event.ingested"
|
||||
|
||||
@@ -4,7 +4,7 @@ integration = ["endpoint"]
|
||||
maturity = "production"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
updated_date = "2023/06/22"
|
||||
updated_date = "2023/11/15"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -13,13 +13,39 @@ Identifies a high number (20) of macOS SSH KeyGen process executions from the sa
|
||||
brute force attack to obtain unauthorized access to user accounts.
|
||||
"""
|
||||
from = "now-9m"
|
||||
index = ["auditbeat-*", "logs-endpoint.events.*"]
|
||||
index = ["logs-endpoint.events.*"]
|
||||
language = "kuery"
|
||||
license = "Elastic License v2"
|
||||
name = "Potential macOS SSH Brute Force Detected"
|
||||
references = ["https://themittenmac.com/detecting-ssh-activity-via-process-monitoring/"]
|
||||
risk_score = 47
|
||||
rule_id = "ace1e989-a541-44df-93a8-a8b0591b63c0"
|
||||
setup = """
|
||||
|
||||
This rule requires data coming in from Elastic Defend.
|
||||
|
||||
### Elastic Defend Integration Setup
|
||||
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
|
||||
|
||||
#### Prerequisite Requirements:
|
||||
- Fleet is required for Elastic Defend.
|
||||
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
|
||||
|
||||
#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
|
||||
- Go to the Kibana home page and click "Add integrations".
|
||||
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
|
||||
- Click "Add Elastic Defend".
|
||||
- Configure the integration name and optionally add a description.
|
||||
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
|
||||
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
|
||||
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
|
||||
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
|
||||
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
|
||||
- Click "Save and Continue".
|
||||
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
|
||||
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
|
||||
|
||||
"""
|
||||
severity = "medium"
|
||||
tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Credential Access", "Data Source: Elastic Defend"]
|
||||
type = "threshold"
|
||||
|
||||
@@ -4,7 +4,7 @@ integration = ["endpoint"]
|
||||
maturity = "production"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
updated_date = "2023/10/23"
|
||||
updated_date = "2023/11/15"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -13,7 +13,7 @@ Identifies the use of osascript to execute scripts via standard input that may p
|
||||
credentials.
|
||||
"""
|
||||
from = "now-9m"
|
||||
index = ["auditbeat-*", "logs-endpoint.events.*"]
|
||||
index = ["logs-endpoint.events.*"]
|
||||
language = "eql"
|
||||
license = "Elastic License v2"
|
||||
name = "Prompt for Credentials with OSASCRIPT"
|
||||
@@ -25,11 +25,29 @@ risk_score = 73
|
||||
rule_id = "38948d29-3d5d-42e3-8aec-be832aaaf8eb"
|
||||
setup = """
|
||||
|
||||
If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
|
||||
events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
|
||||
Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
|
||||
`event.ingested` to @timestamp.
|
||||
For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
|
||||
This rule requires data coming in from Elastic Defend.
|
||||
|
||||
### Elastic Defend Integration Setup
|
||||
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
|
||||
|
||||
#### Prerequisite Requirements:
|
||||
- Fleet is required for Elastic Defend.
|
||||
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
|
||||
|
||||
#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
|
||||
- Go to the Kibana home page and click "Add integrations".
|
||||
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
|
||||
- Click "Add Elastic Defend".
|
||||
- Configure the integration name and optionally add a description.
|
||||
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
|
||||
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
|
||||
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
|
||||
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
|
||||
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
|
||||
- Click "Save and Continue".
|
||||
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
|
||||
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
|
||||
|
||||
"""
|
||||
severity = "high"
|
||||
tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Credential Access", "Data Source: Elastic Defend"]
|
||||
|
||||
@@ -4,7 +4,7 @@ integration = ["endpoint"]
|
||||
maturity = "production"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
updated_date = "2023/06/22"
|
||||
updated_date = "2023/11/15"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -14,13 +14,39 @@ features, including Wi-Fi and website passwords, secure notes, certificates, and
|
||||
keychain storage data from a system to acquire credentials.
|
||||
"""
|
||||
from = "now-9m"
|
||||
index = ["auditbeat-*", "logs-endpoint.events.*"]
|
||||
index = ["logs-endpoint.events.*"]
|
||||
language = "kuery"
|
||||
license = "Elastic License v2"
|
||||
name = "SystemKey Access via Command Line"
|
||||
references = ["https://github.com/AlessandroZ/LaZagne/blob/master/Mac/lazagne/softwares/system/chainbreaker.py"]
|
||||
risk_score = 73
|
||||
rule_id = "d75991f2-b989-419d-b797-ac1e54ec2d61"
|
||||
setup = """
|
||||
|
||||
This rule requires data coming in from Elastic Defend.
|
||||
|
||||
### Elastic Defend Integration Setup
|
||||
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
|
||||
|
||||
#### Prerequisite Requirements:
|
||||
- Fleet is required for Elastic Defend.
|
||||
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
|
||||
|
||||
#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
|
||||
- Go to the Kibana home page and click "Add integrations".
|
||||
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
|
||||
- Click "Add Elastic Defend".
|
||||
- Configure the integration name and optionally add a description.
|
||||
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
|
||||
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
|
||||
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
|
||||
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
|
||||
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
|
||||
- Click "Save and Continue".
|
||||
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
|
||||
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
|
||||
|
||||
"""
|
||||
severity = "high"
|
||||
tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Credential Access", "Data Source: Elastic Defend"]
|
||||
timestamp_override = "event.ingested"
|
||||
|
||||
@@ -4,7 +4,7 @@ integration = ["endpoint"]
|
||||
maturity = "production"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
updated_date = "2023/06/22"
|
||||
updated_date = "2023/11/15"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -14,13 +14,39 @@ an attempt to disable security updates.
|
||||
"""
|
||||
false_positives = ["Authorized SoftwareUpdate Settings Changes"]
|
||||
from = "now-9m"
|
||||
index = ["auditbeat-*", "logs-endpoint.events.*"]
|
||||
index = ["logs-endpoint.events.*"]
|
||||
language = "kuery"
|
||||
license = "Elastic License v2"
|
||||
name = "SoftwareUpdate Preferences Modification"
|
||||
references = ["https://blog.checkpoint.com/2017/07/13/osxdok-refuses-go-away-money/"]
|
||||
risk_score = 47
|
||||
rule_id = "f683dcdf-a018-4801-b066-193d4ae6c8e5"
|
||||
setup = """
|
||||
|
||||
This rule requires data coming in from Elastic Defend.
|
||||
|
||||
### Elastic Defend Integration Setup
|
||||
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
|
||||
|
||||
#### Prerequisite Requirements:
|
||||
- Fleet is required for Elastic Defend.
|
||||
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
|
||||
|
||||
#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
|
||||
- Go to the Kibana home page and click "Add integrations".
|
||||
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
|
||||
- Click "Add Elastic Defend".
|
||||
- Configure the integration name and optionally add a description.
|
||||
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
|
||||
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
|
||||
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
|
||||
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
|
||||
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
|
||||
- Click "Save and Continue".
|
||||
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
|
||||
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
|
||||
|
||||
"""
|
||||
severity = "medium"
|
||||
tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Defend"]
|
||||
timestamp_override = "event.ingested"
|
||||
|
||||
@@ -4,7 +4,7 @@ integration = ["endpoint"]
|
||||
maturity = "production"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
updated_date = "2023/10/23"
|
||||
updated_date = "2023/11/15"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -14,7 +14,7 @@ there is a quarantine flag set on the file. This attribute is read by Apple's Ga
|
||||
time. An adversary may disable this attribute to evade defenses.
|
||||
"""
|
||||
from = "now-9m"
|
||||
index = ["auditbeat-*", "logs-endpoint.events.*"]
|
||||
index = ["logs-endpoint.events.*"]
|
||||
language = "eql"
|
||||
license = "Elastic License v2"
|
||||
name = "Attempt to Remove File Quarantine Attribute"
|
||||
@@ -26,11 +26,29 @@ risk_score = 47
|
||||
rule_id = "f0b48bbc-549e-4bcf-8ee0-a7a72586c6a7"
|
||||
setup = """
|
||||
|
||||
If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
|
||||
events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
|
||||
Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
|
||||
`event.ingested` to @timestamp.
|
||||
For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
|
||||
This rule requires data coming in from Elastic Defend.
|
||||
|
||||
### Elastic Defend Integration Setup
|
||||
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
|
||||
|
||||
#### Prerequisite Requirements:
|
||||
- Fleet is required for Elastic Defend.
|
||||
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
|
||||
|
||||
#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
|
||||
- Go to the Kibana home page and click "Add integrations".
|
||||
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
|
||||
- Click "Add Elastic Defend".
|
||||
- Configure the integration name and optionally add a description.
|
||||
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
|
||||
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
|
||||
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
|
||||
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
|
||||
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
|
||||
- Click "Save and Continue".
|
||||
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
|
||||
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
|
||||
|
||||
"""
|
||||
severity = "medium"
|
||||
tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Defend"]
|
||||
|
||||
@@ -4,7 +4,7 @@ integration = ["endpoint"]
|
||||
maturity = "production"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
updated_date = "2023/06/22"
|
||||
updated_date = "2023/11/15"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -13,7 +13,7 @@ Detects attempts to disable Gatekeeper on macOS. Gatekeeper is a security featur
|
||||
trusted software is run. Adversaries may attempt to disable Gatekeeper before executing malicious code.
|
||||
"""
|
||||
from = "now-9m"
|
||||
index = ["auditbeat-*", "logs-endpoint.events.*"]
|
||||
index = ["logs-endpoint.events.*"]
|
||||
language = "kuery"
|
||||
license = "Elastic License v2"
|
||||
name = "Attempt to Disable Gatekeeper"
|
||||
@@ -23,6 +23,32 @@ references = [
|
||||
]
|
||||
risk_score = 47
|
||||
rule_id = "4da13d6e-904f-4636-81d8-6ab14b4e6ae9"
|
||||
setup = """
|
||||
|
||||
This rule requires data coming in from Elastic Defend.
|
||||
|
||||
### Elastic Defend Integration Setup
|
||||
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
|
||||
|
||||
#### Prerequisite Requirements:
|
||||
- Fleet is required for Elastic Defend.
|
||||
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
|
||||
|
||||
#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
|
||||
- Go to the Kibana home page and click "Add integrations".
|
||||
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
|
||||
- Click "Add Elastic Defend".
|
||||
- Configure the integration name and optionally add a description.
|
||||
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
|
||||
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
|
||||
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
|
||||
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
|
||||
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
|
||||
- Click "Save and Continue".
|
||||
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
|
||||
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
|
||||
|
||||
"""
|
||||
severity = "medium"
|
||||
tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Defend"]
|
||||
timestamp_override = "event.ingested"
|
||||
|
||||
@@ -4,7 +4,7 @@ integration = ["endpoint"]
|
||||
maturity = "production"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
updated_date = "2023/06/22"
|
||||
updated_date = "2023/11/15"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -16,13 +16,39 @@ trust that have been signed by the root certificate.
|
||||
"""
|
||||
false_positives = ["Certain applications may install root certificates for the purpose of inspecting SSL traffic."]
|
||||
from = "now-9m"
|
||||
index = ["auditbeat-*", "logs-endpoint.events.*"]
|
||||
index = ["logs-endpoint.events.*"]
|
||||
language = "kuery"
|
||||
license = "Elastic License v2"
|
||||
name = "Attempt to Install Root Certificate"
|
||||
references = ["https://ss64.com/osx/security-cert.html"]
|
||||
risk_score = 47
|
||||
rule_id = "bc1eeacf-2972-434f-b782-3a532b100d67"
|
||||
setup = """
|
||||
|
||||
This rule requires data coming in from Elastic Defend.
|
||||
|
||||
### Elastic Defend Integration Setup
|
||||
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
|
||||
|
||||
#### Prerequisite Requirements:
|
||||
- Fleet is required for Elastic Defend.
|
||||
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
|
||||
|
||||
#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
|
||||
- Go to the Kibana home page and click "Add integrations".
|
||||
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
|
||||
- Click "Add Elastic Defend".
|
||||
- Configure the integration name and optionally add a description.
|
||||
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
|
||||
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
|
||||
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
|
||||
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
|
||||
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
|
||||
- Click "Save and Continue".
|
||||
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
|
||||
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
|
||||
|
||||
"""
|
||||
severity = "medium"
|
||||
tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Defend"]
|
||||
timestamp_override = "event.ingested"
|
||||
|
||||
@@ -4,7 +4,7 @@ integration = ["endpoint"]
|
||||
maturity = "production"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
updated_date = "2023/06/22"
|
||||
updated_date = "2023/11/15"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -14,7 +14,7 @@ own malicious payloads by hijacking certain environment variables to load arbitr
|
||||
restrictions.
|
||||
"""
|
||||
from = "now-9m"
|
||||
index = ["auditbeat-*", "logs-endpoint.events.*"]
|
||||
index = ["logs-endpoint.events.*"]
|
||||
language = "kuery"
|
||||
license = "Elastic License v2"
|
||||
name = "Modification of Environment Variable via Launchctl"
|
||||
@@ -23,6 +23,32 @@ references = [
|
||||
]
|
||||
risk_score = 47
|
||||
rule_id = "7453e19e-3dbf-4e4e-9ae0-33d6c6ed15e1"
|
||||
setup = """
|
||||
|
||||
This rule requires data coming in from Elastic Defend.
|
||||
|
||||
### Elastic Defend Integration Setup
|
||||
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
|
||||
|
||||
#### Prerequisite Requirements:
|
||||
- Fleet is required for Elastic Defend.
|
||||
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
|
||||
|
||||
#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
|
||||
- Go to the Kibana home page and click "Add integrations".
|
||||
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
|
||||
- Click "Add Elastic Defend".
|
||||
- Configure the integration name and optionally add a description.
|
||||
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
|
||||
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
|
||||
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
|
||||
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
|
||||
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
|
||||
- Click "Save and Continue".
|
||||
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
|
||||
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
|
||||
|
||||
"""
|
||||
severity = "medium"
|
||||
tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Defend"]
|
||||
timestamp_override = "event.ingested"
|
||||
|
||||
@@ -4,7 +4,7 @@ integration = ["endpoint"]
|
||||
maturity = "production"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
updated_date = "2023/10/23"
|
||||
updated_date = "2023/11/15"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -14,7 +14,7 @@ indicate an attempt to bypass macOS privacy controls, including access to sensit
|
||||
microphone, address book, and calendar.
|
||||
"""
|
||||
from = "now-9m"
|
||||
index = ["auditbeat-*", "logs-endpoint.events.*"]
|
||||
index = ["logs-endpoint.events.*"]
|
||||
language = "eql"
|
||||
license = "Elastic License v2"
|
||||
name = "Potential Privacy Control Bypass via TCCDB Modification"
|
||||
@@ -27,11 +27,29 @@ risk_score = 47
|
||||
rule_id = "eea82229-b002-470e-a9e1-00be38b14d32"
|
||||
setup = """
|
||||
|
||||
If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
|
||||
events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
|
||||
Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
|
||||
`event.ingested` to @timestamp.
|
||||
For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
|
||||
This rule requires data coming in from Elastic Defend.
|
||||
|
||||
### Elastic Defend Integration Setup
|
||||
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
|
||||
|
||||
#### Prerequisite Requirements:
|
||||
- Fleet is required for Elastic Defend.
|
||||
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
|
||||
|
||||
#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
|
||||
- Go to the Kibana home page and click "Add integrations".
|
||||
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
|
||||
- Click "Add Elastic Defend".
|
||||
- Configure the integration name and optionally add a description.
|
||||
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
|
||||
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
|
||||
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
|
||||
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
|
||||
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
|
||||
- Click "Save and Continue".
|
||||
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
|
||||
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
|
||||
|
||||
"""
|
||||
severity = "medium"
|
||||
tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Defend"]
|
||||
|
||||
+25
-7
@@ -4,7 +4,7 @@ integration = ["endpoint"]
|
||||
maturity = "production"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
updated_date = "2023/10/23"
|
||||
updated_date = "2023/11/15"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -14,7 +14,7 @@ Daemon (sshd) to the authorized application list for Full Disk Access. This may
|
||||
privacy controls to access sensitive files.
|
||||
"""
|
||||
from = "now-9m"
|
||||
index = ["auditbeat-*", "logs-endpoint.events.*"]
|
||||
index = ["logs-endpoint.events.*"]
|
||||
language = "eql"
|
||||
license = "Elastic License v2"
|
||||
name = "Potential Privacy Control Bypass via Localhost Secure Copy"
|
||||
@@ -25,11 +25,29 @@ risk_score = 73
|
||||
rule_id = "c02c8b9f-5e1d-463c-a1b0-04edcdfe1a3d"
|
||||
setup = """
|
||||
|
||||
If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
|
||||
events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
|
||||
Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
|
||||
`event.ingested` to @timestamp.
|
||||
For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
|
||||
This rule requires data coming in from Elastic Defend.
|
||||
|
||||
### Elastic Defend Integration Setup
|
||||
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
|
||||
|
||||
#### Prerequisite Requirements:
|
||||
- Fleet is required for Elastic Defend.
|
||||
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
|
||||
|
||||
#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
|
||||
- Go to the Kibana home page and click "Add integrations".
|
||||
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
|
||||
- Click "Add Elastic Defend".
|
||||
- Configure the integration name and optionally add a description.
|
||||
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
|
||||
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
|
||||
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
|
||||
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
|
||||
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
|
||||
- Click "Save and Continue".
|
||||
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
|
||||
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
|
||||
|
||||
"""
|
||||
severity = "high"
|
||||
tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Tactic: Defense Evasion", "Data Source: Elastic Defend"]
|
||||
|
||||
@@ -4,7 +4,7 @@ integration = ["endpoint"]
|
||||
maturity = "production"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
updated_date = "2023/06/22"
|
||||
updated_date = "2023/11/15"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -14,13 +14,39 @@ disable certain Safari settings, such as enabling JavaScript from Apple Events t
|
||||
browser.
|
||||
"""
|
||||
from = "now-9m"
|
||||
index = ["auditbeat-*", "logs-endpoint.events.*"]
|
||||
index = ["logs-endpoint.events.*"]
|
||||
language = "kuery"
|
||||
license = "Elastic License v2"
|
||||
name = "Modification of Safari Settings via Defaults Command"
|
||||
references = ["https://objectivebythesea.com/v2/talks/OBTS_v2_Zohar.pdf"]
|
||||
risk_score = 47
|
||||
rule_id = "6482255d-f468-45ea-a5b3-d3a7de1331ae"
|
||||
setup = """
|
||||
|
||||
This rule requires data coming in from Elastic Defend.
|
||||
|
||||
### Elastic Defend Integration Setup
|
||||
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
|
||||
|
||||
#### Prerequisite Requirements:
|
||||
- Fleet is required for Elastic Defend.
|
||||
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
|
||||
|
||||
#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
|
||||
- Go to the Kibana home page and click "Add integrations".
|
||||
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
|
||||
- Click "Add Elastic Defend".
|
||||
- Configure the integration name and optionally add a description.
|
||||
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
|
||||
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
|
||||
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
|
||||
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
|
||||
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
|
||||
- Click "Save and Continue".
|
||||
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
|
||||
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
|
||||
|
||||
"""
|
||||
severity = "medium"
|
||||
tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Defend"]
|
||||
timestamp_override = "event.ingested"
|
||||
|
||||
@@ -4,7 +4,7 @@ integration = ["endpoint"]
|
||||
maturity = "production"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
updated_date = "2023/06/22"
|
||||
updated_date = "2023/11/15"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -14,7 +14,7 @@ applications on macOS are allowed to write files that start with special charact
|
||||
AutoStart location to achieve sandbox evasion.
|
||||
"""
|
||||
from = "now-9m"
|
||||
index = ["auditbeat-*", "logs-endpoint.events.*"]
|
||||
index = ["logs-endpoint.events.*"]
|
||||
language = "kuery"
|
||||
license = "Elastic License v2"
|
||||
name = "Potential Microsoft Office Sandbox Evasion"
|
||||
@@ -25,6 +25,32 @@ references = [
|
||||
]
|
||||
risk_score = 73
|
||||
rule_id = "d22a85c6-d2ad-4cc4-bf7b-54787473669a"
|
||||
setup = """
|
||||
|
||||
This rule requires data coming in from Elastic Defend.
|
||||
|
||||
### Elastic Defend Integration Setup
|
||||
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
|
||||
|
||||
#### Prerequisite Requirements:
|
||||
- Fleet is required for Elastic Defend.
|
||||
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
|
||||
|
||||
#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
|
||||
- Go to the Kibana home page and click "Add integrations".
|
||||
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
|
||||
- Click "Add Elastic Defend".
|
||||
- Configure the integration name and optionally add a description.
|
||||
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
|
||||
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
|
||||
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
|
||||
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
|
||||
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
|
||||
- Click "Save and Continue".
|
||||
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
|
||||
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
|
||||
|
||||
"""
|
||||
severity = "high"
|
||||
tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Defend"]
|
||||
timestamp_override = "event.ingested"
|
||||
|
||||
@@ -4,7 +4,7 @@ integration = ["endpoint"]
|
||||
maturity = "production"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
updated_date = "2023/06/22"
|
||||
updated_date = "2023/11/15"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -14,13 +14,39 @@ as read-only and with the noowners flag set. This action enables the adversary t
|
||||
system, including all user data and files protected by Apple’s privacy framework (TCC).
|
||||
"""
|
||||
from = "now-9m"
|
||||
index = ["auditbeat-*", "logs-endpoint.events.*"]
|
||||
index = ["logs-endpoint.events.*"]
|
||||
language = "kuery"
|
||||
license = "Elastic License v2"
|
||||
name = "TCC Bypass via Mounted APFS Snapshot Access"
|
||||
references = ["https://theevilbit.github.io/posts/cve_2020_9771/"]
|
||||
risk_score = 73
|
||||
rule_id = "b00bcd89-000c-4425-b94c-716ef67762f6"
|
||||
setup = """
|
||||
|
||||
This rule requires data coming in from Elastic Defend.
|
||||
|
||||
### Elastic Defend Integration Setup
|
||||
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
|
||||
|
||||
#### Prerequisite Requirements:
|
||||
- Fleet is required for Elastic Defend.
|
||||
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
|
||||
|
||||
#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
|
||||
- Go to the Kibana home page and click "Add integrations".
|
||||
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
|
||||
- Click "Add Elastic Defend".
|
||||
- Configure the integration name and optionally add a description.
|
||||
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
|
||||
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
|
||||
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
|
||||
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
|
||||
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
|
||||
- Click "Save and Continue".
|
||||
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
|
||||
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
|
||||
|
||||
"""
|
||||
severity = "high"
|
||||
tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Use Case: Vulnerability", "Data Source: Elastic Defend"]
|
||||
timestamp_override = "event.ingested"
|
||||
|
||||
@@ -4,18 +4,44 @@ integration = ["endpoint"]
|
||||
maturity = "production"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
updated_date = "2023/06/22"
|
||||
updated_date = "2023/11/15"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
description = "Identifies attempts to unload the Elastic Endpoint Security kernel extension via the kextunload command."
|
||||
from = "now-9m"
|
||||
index = ["auditbeat-*", "logs-endpoint.events.*"]
|
||||
index = ["logs-endpoint.events.*"]
|
||||
language = "kuery"
|
||||
license = "Elastic License v2"
|
||||
name = "Attempt to Unload Elastic Endpoint Security Kernel Extension"
|
||||
risk_score = 73
|
||||
rule_id = "70fa1af4-27fd-4f26-bd03-50b6af6b9e24"
|
||||
setup = """
|
||||
|
||||
This rule requires data coming in from Elastic Defend.
|
||||
|
||||
### Elastic Defend Integration Setup
|
||||
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
|
||||
|
||||
#### Prerequisite Requirements:
|
||||
- Fleet is required for Elastic Defend.
|
||||
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
|
||||
|
||||
#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
|
||||
- Go to the Kibana home page and click "Add integrations".
|
||||
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
|
||||
- Click "Add Elastic Defend".
|
||||
- Configure the integration name and optionally add a description.
|
||||
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
|
||||
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
|
||||
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
|
||||
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
|
||||
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
|
||||
- Click "Save and Continue".
|
||||
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
|
||||
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
|
||||
|
||||
"""
|
||||
severity = "high"
|
||||
tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Defend"]
|
||||
timestamp_override = "event.ingested"
|
||||
|
||||
@@ -4,7 +4,7 @@ integration = ["endpoint"]
|
||||
maturity = "production"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
updated_date = "2023/10/23"
|
||||
updated_date = "2023/11/15"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -13,7 +13,7 @@ Identifies the execution of macOS built-in commands related to account or group
|
||||
and group information to orient themselves before deciding how to act.
|
||||
"""
|
||||
from = "now-9m"
|
||||
index = ["auditbeat-*", "logs-endpoint.events.*"]
|
||||
index = ["logs-endpoint.events.*"]
|
||||
language = "eql"
|
||||
license = "Elastic License v2"
|
||||
name = "Enumeration of Users or Groups via Built-in Commands"
|
||||
@@ -21,11 +21,29 @@ risk_score = 21
|
||||
rule_id = "6e9b351e-a531-4bdc-b73e-7034d6eed7ff"
|
||||
setup = """
|
||||
|
||||
If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
|
||||
events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
|
||||
Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
|
||||
`event.ingested` to @timestamp.
|
||||
For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
|
||||
This rule requires data coming in from Elastic Defend.
|
||||
|
||||
### Elastic Defend Integration Setup
|
||||
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
|
||||
|
||||
#### Prerequisite Requirements:
|
||||
- Fleet is required for Elastic Defend.
|
||||
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
|
||||
|
||||
#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
|
||||
- Go to the Kibana home page and click "Add integrations".
|
||||
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
|
||||
- Click "Add Elastic Defend".
|
||||
- Configure the integration name and optionally add a description.
|
||||
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
|
||||
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
|
||||
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
|
||||
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
|
||||
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
|
||||
- Click "Save and Continue".
|
||||
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
|
||||
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
|
||||
|
||||
"""
|
||||
severity = "low"
|
||||
tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Discovery", "Data Source: Elastic Defend"]
|
||||
|
||||
@@ -4,7 +4,7 @@ integration = ["endpoint"]
|
||||
maturity = "production"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
updated_date = "2023/06/22"
|
||||
updated_date = "2023/11/15"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -13,7 +13,7 @@ Identifies attempts to execute a child process from within the context of an Ele
|
||||
child_process Node.js module. Adversaries may abuse this technique to inherit permissions from parent processes.
|
||||
"""
|
||||
from = "now-9m"
|
||||
index = ["auditbeat-*", "logs-endpoint.events.*"]
|
||||
index = ["logs-endpoint.events.*"]
|
||||
language = "kuery"
|
||||
license = "Elastic License v2"
|
||||
name = "Execution via Electron Child Process Node.js Module"
|
||||
@@ -24,6 +24,32 @@ references = [
|
||||
]
|
||||
risk_score = 47
|
||||
rule_id = "35330ba2-c859-4c98-8b7f-c19159ea0e58"
|
||||
setup = """
|
||||
|
||||
This rule requires data coming in from Elastic Defend.
|
||||
|
||||
### Elastic Defend Integration Setup
|
||||
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
|
||||
|
||||
#### Prerequisite Requirements:
|
||||
- Fleet is required for Elastic Defend.
|
||||
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
|
||||
|
||||
#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
|
||||
- Go to the Kibana home page and click "Add integrations".
|
||||
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
|
||||
- Click "Add Elastic Defend".
|
||||
- Configure the integration name and optionally add a description.
|
||||
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
|
||||
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
|
||||
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
|
||||
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
|
||||
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
|
||||
- Click "Save and Continue".
|
||||
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
|
||||
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
|
||||
|
||||
"""
|
||||
severity = "medium"
|
||||
tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Tactic: Execution", "Data Source: Elastic Defend"]
|
||||
timestamp_override = "event.ingested"
|
||||
|
||||
@@ -4,7 +4,7 @@ integration = ["endpoint"]
|
||||
maturity = "production"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
updated_date = "2023/06/22"
|
||||
updated_date = "2023/11/15"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -24,6 +24,32 @@ references = [
|
||||
]
|
||||
risk_score = 73
|
||||
rule_id = "080bc66a-5d56-4d1f-8071-817671716db9"
|
||||
setup = """
|
||||
|
||||
This rule requires data coming in from Elastic Defend.
|
||||
|
||||
### Elastic Defend Integration Setup
|
||||
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
|
||||
|
||||
#### Prerequisite Requirements:
|
||||
- Fleet is required for Elastic Defend.
|
||||
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
|
||||
|
||||
#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
|
||||
- Go to the Kibana home page and click "Add integrations".
|
||||
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
|
||||
- Click "Add Elastic Defend".
|
||||
- Configure the integration name and optionally add a description.
|
||||
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
|
||||
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
|
||||
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
|
||||
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
|
||||
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
|
||||
- Click "Save and Continue".
|
||||
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
|
||||
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
|
||||
|
||||
"""
|
||||
severity = "high"
|
||||
tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Initial Access", "Tactic: Execution", "Data Source: Elastic Defend"]
|
||||
timestamp_override = "event.ingested"
|
||||
|
||||
@@ -4,7 +4,7 @@ integration = ["endpoint"]
|
||||
maturity = "production"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
updated_date = "2023/06/22"
|
||||
updated_date = "2023/11/15"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -33,6 +33,32 @@ references = [
|
||||
]
|
||||
risk_score = 47
|
||||
rule_id = "99239e7d-b0d4-46e3-8609-acafcf99f68c"
|
||||
setup = """
|
||||
|
||||
This rule requires data coming in from Elastic Defend.
|
||||
|
||||
### Elastic Defend Integration Setup
|
||||
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
|
||||
|
||||
#### Prerequisite Requirements:
|
||||
- Fleet is required for Elastic Defend.
|
||||
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
|
||||
|
||||
#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
|
||||
- Go to the Kibana home page and click "Add integrations".
|
||||
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
|
||||
- Click "Add Elastic Defend".
|
||||
- Configure the integration name and optionally add a description.
|
||||
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
|
||||
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
|
||||
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
|
||||
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
|
||||
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
|
||||
- Click "Save and Continue".
|
||||
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
|
||||
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
|
||||
|
||||
"""
|
||||
severity = "medium"
|
||||
tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Execution", "Tactic: Command and Control", "Data Source: Elastic Defend"]
|
||||
type = "eql"
|
||||
|
||||
@@ -4,7 +4,7 @@ integration = ["endpoint"]
|
||||
maturity = "production"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
updated_date = "2023/06/22"
|
||||
updated_date = "2023/11/15"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -14,13 +14,39 @@ Adversaries may drop a custom workflow template that hosts malicious JavaScript
|
||||
alternative to using osascript.
|
||||
"""
|
||||
from = "now-9m"
|
||||
index = ["auditbeat-*", "logs-endpoint.events.*"]
|
||||
index = ["logs-endpoint.events.*"]
|
||||
language = "eql"
|
||||
license = "Elastic License v2"
|
||||
name = "Suspicious Automator Workflows Execution"
|
||||
references = ["https://posts.specterops.io/persistent-jxa-66e1c3cd1cf5"]
|
||||
risk_score = 47
|
||||
rule_id = "5d9f8cfc-0d03-443e-a167-2b0597ce0965"
|
||||
setup = """
|
||||
|
||||
This rule requires data coming in from Elastic Defend.
|
||||
|
||||
### Elastic Defend Integration Setup
|
||||
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
|
||||
|
||||
#### Prerequisite Requirements:
|
||||
- Fleet is required for Elastic Defend.
|
||||
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
|
||||
|
||||
#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
|
||||
- Go to the Kibana home page and click "Add integrations".
|
||||
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
|
||||
- Click "Add Elastic Defend".
|
||||
- Configure the integration name and optionally add a description.
|
||||
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
|
||||
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
|
||||
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
|
||||
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
|
||||
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
|
||||
- Click "Save and Continue".
|
||||
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
|
||||
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
|
||||
|
||||
"""
|
||||
severity = "medium"
|
||||
tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Execution", "Data Source: Elastic Defend"]
|
||||
type = "eql"
|
||||
|
||||
@@ -4,7 +4,7 @@ integration = ["endpoint"]
|
||||
maturity = "production"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
updated_date = "2023/06/22"
|
||||
updated_date = "2023/11/15"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -13,7 +13,7 @@ Detects execution via the Apple script interpreter (osascript) followed by a net
|
||||
within a short time period. Adversaries may use malicious scripts for execution and command and control.
|
||||
"""
|
||||
from = "now-9m"
|
||||
index = ["auditbeat-*", "logs-endpoint.events.*"]
|
||||
index = ["logs-endpoint.events.*"]
|
||||
language = "eql"
|
||||
license = "Elastic License v2"
|
||||
name = "Apple Script Execution followed by Network Connection"
|
||||
@@ -23,6 +23,32 @@ references = [
|
||||
]
|
||||
risk_score = 47
|
||||
rule_id = "47f76567-d58a-4fed-b32b-21f571e28910"
|
||||
setup = """
|
||||
|
||||
This rule requires data coming in from Elastic Defend.
|
||||
|
||||
### Elastic Defend Integration Setup
|
||||
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
|
||||
|
||||
#### Prerequisite Requirements:
|
||||
- Fleet is required for Elastic Defend.
|
||||
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
|
||||
|
||||
#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
|
||||
- Go to the Kibana home page and click "Add integrations".
|
||||
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
|
||||
- Click "Add Elastic Defend".
|
||||
- Configure the integration name and optionally add a description.
|
||||
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
|
||||
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
|
||||
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
|
||||
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
|
||||
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
|
||||
- Click "Save and Continue".
|
||||
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
|
||||
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
|
||||
|
||||
"""
|
||||
severity = "medium"
|
||||
tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Command and Control", "Tactic: Execution", "Data Source: Elastic Defend"]
|
||||
type = "eql"
|
||||
|
||||
@@ -4,7 +4,7 @@ integration = ["endpoint"]
|
||||
maturity = "production"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
updated_date = "2023/06/22"
|
||||
updated_date = "2023/11/15"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -13,7 +13,7 @@ Identifies the execution of the shell process (sh) via scripting (JXA or AppleSc
|
||||
doShellScript functionality in JXA or do shell script in AppleScript to execute system commands.
|
||||
"""
|
||||
from = "now-9m"
|
||||
index = ["auditbeat-*", "logs-endpoint.events.*"]
|
||||
index = ["logs-endpoint.events.*"]
|
||||
language = "eql"
|
||||
license = "Elastic License v2"
|
||||
name = "Shell Execution via Apple Scripting"
|
||||
@@ -23,6 +23,32 @@ references = [
|
||||
]
|
||||
risk_score = 47
|
||||
rule_id = "d461fac0-43e8-49e2-85ea-3a58fe120b4f"
|
||||
setup = """
|
||||
|
||||
This rule requires data coming in from Elastic Defend.
|
||||
|
||||
### Elastic Defend Integration Setup
|
||||
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
|
||||
|
||||
#### Prerequisite Requirements:
|
||||
- Fleet is required for Elastic Defend.
|
||||
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
|
||||
|
||||
#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
|
||||
- Go to the Kibana home page and click "Add integrations".
|
||||
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
|
||||
- Click "Add Elastic Defend".
|
||||
- Configure the integration name and optionally add a description.
|
||||
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
|
||||
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
|
||||
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
|
||||
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
|
||||
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
|
||||
- Click "Save and Continue".
|
||||
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
|
||||
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
|
||||
|
||||
"""
|
||||
severity = "medium"
|
||||
tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Execution", "Data Source: Elastic Defend"]
|
||||
type = "eql"
|
||||
|
||||
@@ -4,7 +4,7 @@ integration = ["endpoint"]
|
||||
maturity = "production"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
updated_date = "2023/06/22"
|
||||
updated_date = "2023/11/15"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -21,6 +21,32 @@ name = "Suspicious macOS MS Office Child Process"
|
||||
references = ["https://blog.malwarebytes.com/cybercrime/2017/02/microsoft-office-macro-malware-targets-macs/"]
|
||||
risk_score = 47
|
||||
rule_id = "66da12b1-ac83-40eb-814c-07ed1d82b7b9"
|
||||
setup = """
|
||||
|
||||
This rule requires data coming in from Elastic Defend.
|
||||
|
||||
### Elastic Defend Integration Setup
|
||||
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
|
||||
|
||||
#### Prerequisite Requirements:
|
||||
- Fleet is required for Elastic Defend.
|
||||
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
|
||||
|
||||
#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
|
||||
- Go to the Kibana home page and click "Add integrations".
|
||||
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
|
||||
- Click "Add Elastic Defend".
|
||||
- Configure the integration name and optionally add a description.
|
||||
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
|
||||
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
|
||||
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
|
||||
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
|
||||
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
|
||||
- Click "Save and Continue".
|
||||
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
|
||||
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
|
||||
|
||||
"""
|
||||
severity = "medium"
|
||||
tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Initial Access", "Data Source: Elastic Defend"]
|
||||
timestamp_override = "event.ingested"
|
||||
|
||||
@@ -4,7 +4,7 @@ integration = ["endpoint"]
|
||||
maturity = "production"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
updated_date = "2023/06/22"
|
||||
updated_date = "2023/11/15"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -13,13 +13,39 @@ Identifies use of Bifrost, a known macOS Kerberos pentesting tool, which can be
|
||||
attempt unauthorized authentication techniques such as pass-the-ticket/hash and kerberoasting.
|
||||
"""
|
||||
from = "now-9m"
|
||||
index = ["auditbeat-*", "logs-endpoint.events.*"]
|
||||
index = ["logs-endpoint.events.*"]
|
||||
language = "kuery"
|
||||
license = "Elastic License v2"
|
||||
name = "Potential Kerberos Attack via Bifrost"
|
||||
references = ["https://github.com/its-a-feature/bifrost"]
|
||||
risk_score = 73
|
||||
rule_id = "16904215-2c95-4ac8-bf5c-12354e047192"
|
||||
setup = """
|
||||
|
||||
This rule requires data coming in from Elastic Defend.
|
||||
|
||||
### Elastic Defend Integration Setup
|
||||
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
|
||||
|
||||
#### Prerequisite Requirements:
|
||||
- Fleet is required for Elastic Defend.
|
||||
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
|
||||
|
||||
#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
|
||||
- Go to the Kibana home page and click "Add integrations".
|
||||
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
|
||||
- Click "Add Elastic Defend".
|
||||
- Configure the integration name and optionally add a description.
|
||||
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
|
||||
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
|
||||
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
|
||||
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
|
||||
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
|
||||
- Click "Save and Continue".
|
||||
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
|
||||
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
|
||||
|
||||
"""
|
||||
severity = "high"
|
||||
tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Credential Access", "Tactic: Lateral Movement", "Data Source: Elastic Defend"]
|
||||
timestamp_override = "event.ingested"
|
||||
|
||||
@@ -4,7 +4,7 @@ integration = ["endpoint"]
|
||||
maturity = "production"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
updated_date = "2023/10/23"
|
||||
updated_date = "2023/11/15"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -13,7 +13,7 @@ Identifies the execution of macOS built-in commands to mount a Server Message Bl
|
||||
use valid accounts to interact with a remote network share using SMB.
|
||||
"""
|
||||
from = "now-9m"
|
||||
index = ["auditbeat-*", "logs-endpoint.events.*"]
|
||||
index = ["logs-endpoint.events.*"]
|
||||
language = "eql"
|
||||
license = "Elastic License v2"
|
||||
name = "Attempt to Mount SMB Share via Command Line"
|
||||
@@ -22,11 +22,29 @@ risk_score = 21
|
||||
rule_id = "661545b4-1a90-4f45-85ce-2ebd7c6a15d0"
|
||||
setup = """
|
||||
|
||||
If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
|
||||
events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
|
||||
Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
|
||||
`event.ingested` to @timestamp.
|
||||
For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
|
||||
This rule requires data coming in from Elastic Defend.
|
||||
|
||||
### Elastic Defend Integration Setup
|
||||
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
|
||||
|
||||
#### Prerequisite Requirements:
|
||||
- Fleet is required for Elastic Defend.
|
||||
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
|
||||
|
||||
#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
|
||||
- Go to the Kibana home page and click "Add integrations".
|
||||
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
|
||||
- Click "Add Elastic Defend".
|
||||
- Configure the integration name and optionally add a description.
|
||||
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
|
||||
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
|
||||
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
|
||||
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
|
||||
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
|
||||
- Click "Save and Continue".
|
||||
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
|
||||
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
|
||||
|
||||
"""
|
||||
severity = "low"
|
||||
tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Lateral Movement", "Data Source: Elastic Defend"]
|
||||
|
||||
@@ -4,13 +4,13 @@ integration = ["endpoint"]
|
||||
maturity = "production"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
updated_date = "2023/06/22"
|
||||
updated_date = "2023/11/15"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
description = "Detects use of the systemsetup command to enable remote SSH Login."
|
||||
from = "now-9m"
|
||||
index = ["auditbeat-*", "logs-endpoint.events.*"]
|
||||
index = ["logs-endpoint.events.*"]
|
||||
language = "kuery"
|
||||
license = "Elastic License v2"
|
||||
name = "Remote SSH Login Enabled via systemsetup Command"
|
||||
@@ -21,6 +21,32 @@ references = [
|
||||
]
|
||||
risk_score = 47
|
||||
rule_id = "5ae4e6f8-d1bf-40fa-96ba-e29645e1e4dc"
|
||||
setup = """
|
||||
|
||||
This rule requires data coming in from Elastic Defend.
|
||||
|
||||
### Elastic Defend Integration Setup
|
||||
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
|
||||
|
||||
#### Prerequisite Requirements:
|
||||
- Fleet is required for Elastic Defend.
|
||||
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
|
||||
|
||||
#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
|
||||
- Go to the Kibana home page and click "Add integrations".
|
||||
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
|
||||
- Click "Add Elastic Defend".
|
||||
- Configure the integration name and optionally add a description.
|
||||
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
|
||||
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
|
||||
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
|
||||
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
|
||||
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
|
||||
- Click "Save and Continue".
|
||||
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
|
||||
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
|
||||
|
||||
"""
|
||||
severity = "medium"
|
||||
tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Lateral Movement", "Data Source: Elastic Defend"]
|
||||
timestamp_override = "event.ingested"
|
||||
|
||||
@@ -4,7 +4,7 @@ integration = ["endpoint"]
|
||||
maturity = "production"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
updated_date = "2023/10/23"
|
||||
updated_date = "2023/11/15"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -13,7 +13,7 @@ Identifies the execution of macOS built-in commands to connect to an existing Vi
|
||||
may use VPN connections to laterally move and control remote systems on a network.
|
||||
"""
|
||||
from = "now-9m"
|
||||
index = ["auditbeat-*", "logs-endpoint.events.*"]
|
||||
index = ["logs-endpoint.events.*"]
|
||||
language = "eql"
|
||||
license = "Elastic License v2"
|
||||
name = "Virtual Private Network Connection Attempt"
|
||||
@@ -26,11 +26,29 @@ risk_score = 21
|
||||
rule_id = "15dacaa0-5b90-466b-acab-63435a59701a"
|
||||
setup = """
|
||||
|
||||
If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
|
||||
events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
|
||||
Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
|
||||
`event.ingested` to @timestamp.
|
||||
For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
|
||||
This rule requires data coming in from Elastic Defend.
|
||||
|
||||
### Elastic Defend Integration Setup
|
||||
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
|
||||
|
||||
#### Prerequisite Requirements:
|
||||
- Fleet is required for Elastic Defend.
|
||||
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
|
||||
|
||||
#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
|
||||
- Go to the Kibana home page and click "Add integrations".
|
||||
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
|
||||
- Click "Add Elastic Defend".
|
||||
- Configure the integration name and optionally add a description.
|
||||
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
|
||||
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
|
||||
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
|
||||
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
|
||||
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
|
||||
- Click "Save and Continue".
|
||||
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
|
||||
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
|
||||
|
||||
"""
|
||||
severity = "low"
|
||||
tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Lateral Movement", "Data Source: Elastic Defend"]
|
||||
|
||||
@@ -4,7 +4,7 @@ integration = ["endpoint"]
|
||||
maturity = "production"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
updated_date = "2023/06/22"
|
||||
updated_date = "2023/11/15"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -13,13 +13,39 @@ Identifies attempts to create a local account that will be hidden from the macOS
|
||||
attempt to evade user attention while maintaining persistence using a separate local account.
|
||||
"""
|
||||
from = "now-9m"
|
||||
index = ["auditbeat-*", "logs-endpoint.events.*"]
|
||||
index = ["logs-endpoint.events.*"]
|
||||
language = "kuery"
|
||||
license = "Elastic License v2"
|
||||
name = "Potential Hidden Local User Account Creation"
|
||||
references = ["https://support.apple.com/en-us/HT203998"]
|
||||
risk_score = 47
|
||||
rule_id = "41b638a1-8ab6-4f8e-86d9-466317ef2db5"
|
||||
setup = """
|
||||
|
||||
This rule requires data coming in from Elastic Defend.
|
||||
|
||||
### Elastic Defend Integration Setup
|
||||
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
|
||||
|
||||
#### Prerequisite Requirements:
|
||||
- Fleet is required for Elastic Defend.
|
||||
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
|
||||
|
||||
#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
|
||||
- Go to the Kibana home page and click "Add integrations".
|
||||
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
|
||||
- Click "Add Elastic Defend".
|
||||
- Configure the integration name and optionally add a description.
|
||||
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
|
||||
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
|
||||
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
|
||||
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
|
||||
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
|
||||
- Click "Save and Continue".
|
||||
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
|
||||
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
|
||||
|
||||
"""
|
||||
severity = "medium"
|
||||
tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Defend"]
|
||||
timestamp_override = "event.ingested"
|
||||
|
||||
@@ -4,7 +4,7 @@ integration = ["endpoint"]
|
||||
maturity = "production"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
updated_date = "2023/06/22"
|
||||
updated_date = "2023/11/15"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -14,7 +14,7 @@ launchctl to load a plist into the appropriate directories.
|
||||
"""
|
||||
false_positives = ["Trusted applications persisting via LaunchAgent"]
|
||||
from = "now-9m"
|
||||
index = ["auditbeat-*", "logs-endpoint.events.*"]
|
||||
index = ["logs-endpoint.events.*"]
|
||||
language = "eql"
|
||||
license = "Elastic License v2"
|
||||
name = "Launch Agent Creation or Modification and Immediate Loading"
|
||||
@@ -23,6 +23,32 @@ references = [
|
||||
]
|
||||
risk_score = 21
|
||||
rule_id = "082e3f8c-6f80-485c-91eb-5b112cb79b28"
|
||||
setup = """
|
||||
|
||||
This rule requires data coming in from Elastic Defend.
|
||||
|
||||
### Elastic Defend Integration Setup
|
||||
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
|
||||
|
||||
#### Prerequisite Requirements:
|
||||
- Fleet is required for Elastic Defend.
|
||||
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
|
||||
|
||||
#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
|
||||
- Go to the Kibana home page and click "Add integrations".
|
||||
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
|
||||
- Click "Add Elastic Defend".
|
||||
- Configure the integration name and optionally add a description.
|
||||
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
|
||||
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
|
||||
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
|
||||
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
|
||||
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
|
||||
- Click "Save and Continue".
|
||||
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
|
||||
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
|
||||
|
||||
"""
|
||||
severity = "low"
|
||||
tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Defend"]
|
||||
type = "eql"
|
||||
|
||||
@@ -4,7 +4,7 @@ integration = ["endpoint"]
|
||||
maturity = "production"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
updated_date = "2023/10/23"
|
||||
updated_date = "2023/11/15"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -13,7 +13,7 @@ Identifies the execution of osascript to create a hidden login item. This may in
|
||||
program while concealing its presence.
|
||||
"""
|
||||
from = "now-9m"
|
||||
index = ["auditbeat-*", "logs-endpoint.events.*"]
|
||||
index = ["logs-endpoint.events.*"]
|
||||
language = "eql"
|
||||
license = "Elastic License v2"
|
||||
name = "Creation of Hidden Login Item via Apple Script"
|
||||
@@ -21,11 +21,29 @@ risk_score = 47
|
||||
rule_id = "f24bcae1-8980-4b30-b5dd-f851b055c9e7"
|
||||
setup = """
|
||||
|
||||
If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
|
||||
events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
|
||||
Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
|
||||
`event.ingested` to @timestamp.
|
||||
For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
|
||||
This rule requires data coming in from Elastic Defend.
|
||||
|
||||
### Elastic Defend Integration Setup
|
||||
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
|
||||
|
||||
#### Prerequisite Requirements:
|
||||
- Fleet is required for Elastic Defend.
|
||||
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
|
||||
|
||||
#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
|
||||
- Go to the Kibana home page and click "Add integrations".
|
||||
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
|
||||
- Click "Add Elastic Defend".
|
||||
- Configure the integration name and optionally add a description.
|
||||
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
|
||||
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
|
||||
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
|
||||
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
|
||||
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
|
||||
- Click "Save and Continue".
|
||||
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
|
||||
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
|
||||
|
||||
"""
|
||||
severity = "medium"
|
||||
tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Persistence", "Tactic: Execution", "Data Source: Elastic Defend"]
|
||||
|
||||
@@ -4,7 +4,7 @@ integration = ["endpoint"]
|
||||
maturity = "production"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
updated_date = "2023/06/22"
|
||||
updated_date = "2023/11/15"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -14,7 +14,7 @@ payloads as part of persistence.
|
||||
"""
|
||||
false_positives = ["Trusted applications persisting via LaunchDaemons"]
|
||||
from = "now-9m"
|
||||
index = ["auditbeat-*", "logs-endpoint.events.*"]
|
||||
index = ["logs-endpoint.events.*"]
|
||||
language = "eql"
|
||||
license = "Elastic License v2"
|
||||
name = "LaunchDaemon Creation or Modification and Immediate Loading"
|
||||
@@ -23,6 +23,32 @@ references = [
|
||||
]
|
||||
risk_score = 21
|
||||
rule_id = "9d19ece6-c20e-481a-90c5-ccca596537de"
|
||||
setup = """
|
||||
|
||||
This rule requires data coming in from Elastic Defend.
|
||||
|
||||
### Elastic Defend Integration Setup
|
||||
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
|
||||
|
||||
#### Prerequisite Requirements:
|
||||
- Fleet is required for Elastic Defend.
|
||||
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
|
||||
|
||||
#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
|
||||
- Go to the Kibana home page and click "Add integrations".
|
||||
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
|
||||
- Click "Add Elastic Defend".
|
||||
- Configure the integration name and optionally add a description.
|
||||
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
|
||||
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
|
||||
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
|
||||
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
|
||||
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
|
||||
- Click "Save and Continue".
|
||||
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
|
||||
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
|
||||
|
||||
"""
|
||||
severity = "low"
|
||||
tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Defend"]
|
||||
type = "eql"
|
||||
|
||||
@@ -4,7 +4,7 @@ integration = ["endpoint"]
|
||||
maturity = "production"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
updated_date = "2023/06/22"
|
||||
updated_date = "2023/11/15"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -14,7 +14,7 @@ supported by the OS, such as multi-factor authentication with third party softwa
|
||||
to persist and/or collect clear text credentials as they traverse the registered plugins during user logon.
|
||||
"""
|
||||
from = "now-9m"
|
||||
index = ["auditbeat-*", "logs-endpoint.events.*"]
|
||||
index = ["logs-endpoint.events.*"]
|
||||
language = "kuery"
|
||||
license = "Elastic License v2"
|
||||
name = "Authorization Plugin Modification"
|
||||
@@ -24,6 +24,32 @@ references = [
|
||||
]
|
||||
risk_score = 47
|
||||
rule_id = "e6c98d38-633d-4b3e-9387-42112cd5ac10"
|
||||
setup = """
|
||||
|
||||
This rule requires data coming in from Elastic Defend.
|
||||
|
||||
### Elastic Defend Integration Setup
|
||||
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
|
||||
|
||||
#### Prerequisite Requirements:
|
||||
- Fleet is required for Elastic Defend.
|
||||
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
|
||||
|
||||
#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
|
||||
- Go to the Kibana home page and click "Add integrations".
|
||||
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
|
||||
- Click "Add Elastic Defend".
|
||||
- Configure the integration name and optionally add a description.
|
||||
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
|
||||
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
|
||||
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
|
||||
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
|
||||
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
|
||||
- Click "Save and Continue".
|
||||
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
|
||||
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
|
||||
|
||||
"""
|
||||
severity = "medium"
|
||||
tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Defend"]
|
||||
timestamp_override = "event.ingested"
|
||||
|
||||
@@ -4,7 +4,7 @@ integration = ["endpoint"]
|
||||
maturity = "production"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
updated_date = "2023/06/22"
|
||||
updated_date = "2023/11/15"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -23,6 +23,32 @@ references = [
|
||||
]
|
||||
risk_score = 47
|
||||
rule_id = "530178da-92ea-43ce-94c2-8877a826783d"
|
||||
setup = """
|
||||
|
||||
This rule requires data coming in from Elastic Defend.
|
||||
|
||||
### Elastic Defend Integration Setup
|
||||
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
|
||||
|
||||
#### Prerequisite Requirements:
|
||||
- Fleet is required for Elastic Defend.
|
||||
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
|
||||
|
||||
#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
|
||||
- Go to the Kibana home page and click "Add integrations".
|
||||
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
|
||||
- Click "Add Elastic Defend".
|
||||
- Configure the integration name and optionally add a description.
|
||||
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
|
||||
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
|
||||
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
|
||||
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
|
||||
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
|
||||
- Click "Save and Continue".
|
||||
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
|
||||
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
|
||||
|
||||
"""
|
||||
severity = "medium"
|
||||
tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Defend"]
|
||||
timestamp_override = "event.ingested"
|
||||
|
||||
+28
-2
@@ -4,7 +4,7 @@ integration = ["endpoint"]
|
||||
maturity = "production"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
updated_date = "2023/06/22"
|
||||
updated_date = "2023/11/15"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -13,7 +13,7 @@ Identifies the execution of a launchd child process with a hidden file. An adver
|
||||
installing a new logon item, launch agent, or daemon that executes upon login.
|
||||
"""
|
||||
from = "now-9m"
|
||||
index = ["auditbeat-*", "logs-endpoint.events.*"]
|
||||
index = ["logs-endpoint.events.*"]
|
||||
language = "kuery"
|
||||
license = "Elastic License v2"
|
||||
name = "Suspicious Hidden Child Process of Launchd"
|
||||
@@ -24,6 +24,32 @@ references = [
|
||||
]
|
||||
risk_score = 47
|
||||
rule_id = "083fa162-e790-4d85-9aeb-4fea04188adb"
|
||||
setup = """
|
||||
|
||||
This rule requires data coming in from Elastic Defend.
|
||||
|
||||
### Elastic Defend Integration Setup
|
||||
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
|
||||
|
||||
#### Prerequisite Requirements:
|
||||
- Fleet is required for Elastic Defend.
|
||||
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
|
||||
|
||||
#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
|
||||
- Go to the Kibana home page and click "Add integrations".
|
||||
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
|
||||
- Click "Add Elastic Defend".
|
||||
- Configure the integration name and optionally add a description.
|
||||
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
|
||||
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
|
||||
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
|
||||
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
|
||||
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
|
||||
- Click "Save and Continue".
|
||||
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
|
||||
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
|
||||
|
||||
"""
|
||||
severity = "medium"
|
||||
tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Persistence", "Tactic: Defense Evasion", "Data Source: Elastic Defend"]
|
||||
timestamp_override = "event.ingested"
|
||||
|
||||
@@ -4,7 +4,7 @@ integration = ["endpoint"]
|
||||
maturity = "production"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
updated_date = "2023/06/22"
|
||||
updated_date = "2023/11/15"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -14,13 +14,39 @@ launches on each system boot and automatically reloads after crash. It scans and
|
||||
the DirectoryServices PlugIns folder and can be abused by adversaries to maintain persistence.
|
||||
"""
|
||||
from = "now-9m"
|
||||
index = ["auditbeat-*", "logs-endpoint.events.*"]
|
||||
index = ["logs-endpoint.events.*"]
|
||||
language = "kuery"
|
||||
license = "Elastic License v2"
|
||||
name = "Persistence via DirectoryService Plugin Modification"
|
||||
references = ["https://blog.chichou.me/2019/11/21/two-macos-persistence-tricks-abusing-plugins/"]
|
||||
risk_score = 47
|
||||
rule_id = "89fa6cb7-6b53-4de2-b604-648488841ab8"
|
||||
setup = """
|
||||
|
||||
This rule requires data coming in from Elastic Defend.
|
||||
|
||||
### Elastic Defend Integration Setup
|
||||
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
|
||||
|
||||
#### Prerequisite Requirements:
|
||||
- Fleet is required for Elastic Defend.
|
||||
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
|
||||
|
||||
#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
|
||||
- Go to the Kibana home page and click "Add integrations".
|
||||
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
|
||||
- Click "Add Elastic Defend".
|
||||
- Configure the integration name and optionally add a description.
|
||||
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
|
||||
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
|
||||
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
|
||||
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
|
||||
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
|
||||
- Click "Save and Continue".
|
||||
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
|
||||
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
|
||||
|
||||
"""
|
||||
severity = "medium"
|
||||
tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Defend"]
|
||||
timestamp_override = "event.ingested"
|
||||
|
||||
@@ -4,7 +4,7 @@ integration = ["endpoint"]
|
||||
maturity = "production"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
updated_date = "2023/06/22"
|
||||
updated_date = "2023/11/15"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -13,7 +13,7 @@ An adversary can establish persistence by modifying an existing macOS dock prope
|
||||
application instead of the intended one when invoked.
|
||||
"""
|
||||
from = "now-9m"
|
||||
index = ["auditbeat-*", "logs-endpoint.events.*"]
|
||||
index = ["logs-endpoint.events.*"]
|
||||
language = "kuery"
|
||||
license = "Elastic License v2"
|
||||
name = "Persistence via Docker Shortcut Modification"
|
||||
@@ -22,6 +22,32 @@ references = [
|
||||
]
|
||||
risk_score = 47
|
||||
rule_id = "c81cefcb-82b9-4408-a533-3c3df549e62d"
|
||||
setup = """
|
||||
|
||||
This rule requires data coming in from Elastic Defend.
|
||||
|
||||
### Elastic Defend Integration Setup
|
||||
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
|
||||
|
||||
#### Prerequisite Requirements:
|
||||
- Fleet is required for Elastic Defend.
|
||||
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
|
||||
|
||||
#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
|
||||
- Go to the Kibana home page and click "Add integrations".
|
||||
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
|
||||
- Click "Add Elastic Defend".
|
||||
- Configure the integration name and optionally add a description.
|
||||
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
|
||||
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
|
||||
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
|
||||
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
|
||||
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
|
||||
- Click "Save and Continue".
|
||||
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
|
||||
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
|
||||
|
||||
"""
|
||||
severity = "medium"
|
||||
tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Defend"]
|
||||
timestamp_override = "event.ingested"
|
||||
|
||||
@@ -4,7 +4,7 @@ integration = ["endpoint"]
|
||||
maturity = "production"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
updated_date = "2023/10/23"
|
||||
updated_date = "2023/11/15"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -13,7 +13,7 @@ Identifies the creation or modification of the Event Monitor Daemon (emond) rule
|
||||
writing a rule to execute commands when a defined event occurs, such as system start up or user authentication.
|
||||
"""
|
||||
from = "now-9m"
|
||||
index = ["auditbeat-*", "logs-endpoint.events.*"]
|
||||
index = ["logs-endpoint.events.*"]
|
||||
language = "eql"
|
||||
license = "Elastic License v2"
|
||||
name = "Emond Rules Creation or Modification"
|
||||
@@ -25,11 +25,29 @@ risk_score = 47
|
||||
rule_id = "a6bf4dd4-743e-4da8-8c03-3ebd753a6c90"
|
||||
setup = """
|
||||
|
||||
If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
|
||||
events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
|
||||
Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
|
||||
`event.ingested` to @timestamp.
|
||||
For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
|
||||
This rule requires data coming in from Elastic Defend.
|
||||
|
||||
### Elastic Defend Integration Setup
|
||||
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
|
||||
|
||||
#### Prerequisite Requirements:
|
||||
- Fleet is required for Elastic Defend.
|
||||
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
|
||||
|
||||
#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
|
||||
- Go to the Kibana home page and click "Add integrations".
|
||||
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
|
||||
- Click "Add Elastic Defend".
|
||||
- Configure the integration name and optionally add a description.
|
||||
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
|
||||
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
|
||||
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
|
||||
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
|
||||
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
|
||||
- Click "Save and Continue".
|
||||
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
|
||||
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
|
||||
|
||||
"""
|
||||
severity = "medium"
|
||||
tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Defend"]
|
||||
|
||||
@@ -4,7 +4,7 @@ integration = ["endpoint"]
|
||||
maturity = "production"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
updated_date = "2023/06/22"
|
||||
updated_date = "2023/11/15"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -21,6 +21,32 @@ name = "Suspicious Emond Child Process"
|
||||
references = ["https://www.xorrior.com/emond-persistence/"]
|
||||
risk_score = 47
|
||||
rule_id = "3e3d15c6-1509-479a-b125-21718372157e"
|
||||
setup = """
|
||||
|
||||
This rule requires data coming in from Elastic Defend.
|
||||
|
||||
### Elastic Defend Integration Setup
|
||||
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
|
||||
|
||||
#### Prerequisite Requirements:
|
||||
- Fleet is required for Elastic Defend.
|
||||
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
|
||||
|
||||
#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
|
||||
- Go to the Kibana home page and click "Add integrations".
|
||||
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
|
||||
- Click "Add Elastic Defend".
|
||||
- Configure the integration name and optionally add a description.
|
||||
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
|
||||
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
|
||||
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
|
||||
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
|
||||
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
|
||||
- Click "Save and Continue".
|
||||
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
|
||||
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
|
||||
|
||||
"""
|
||||
severity = "medium"
|
||||
tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Defend"]
|
||||
timestamp_override = "event.ingested"
|
||||
|
||||
@@ -4,7 +4,7 @@ integration = ["endpoint"]
|
||||
maturity = "production"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
updated_date = "2023/06/22"
|
||||
updated_date = "2023/11/15"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -13,13 +13,39 @@ Identifies attempts to enable the root account using the dsenableroot command. T
|
||||
for persistence, as the root account is disabled by default.
|
||||
"""
|
||||
from = "now-9m"
|
||||
index = ["auditbeat-*", "logs-endpoint.events.*"]
|
||||
index = ["logs-endpoint.events.*"]
|
||||
language = "kuery"
|
||||
license = "Elastic License v2"
|
||||
name = "Attempt to Enable the Root Account"
|
||||
references = ["https://ss64.com/osx/dsenableroot.html"]
|
||||
risk_score = 47
|
||||
rule_id = "cc2fd2d0-ba3a-4939-b87f-2901764ed036"
|
||||
setup = """
|
||||
|
||||
This rule requires data coming in from Elastic Defend.
|
||||
|
||||
### Elastic Defend Integration Setup
|
||||
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
|
||||
|
||||
#### Prerequisite Requirements:
|
||||
- Fleet is required for Elastic Defend.
|
||||
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
|
||||
|
||||
#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
|
||||
- Go to the Kibana home page and click "Add integrations".
|
||||
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
|
||||
- Click "Add Elastic Defend".
|
||||
- Configure the integration name and optionally add a description.
|
||||
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
|
||||
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
|
||||
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
|
||||
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
|
||||
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
|
||||
- Click "Save and Continue".
|
||||
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
|
||||
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
|
||||
|
||||
"""
|
||||
severity = "medium"
|
||||
tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Defend"]
|
||||
timestamp_override = "event.ingested"
|
||||
|
||||
@@ -4,7 +4,7 @@ integration = ["endpoint"]
|
||||
maturity = "production"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
updated_date = "2023/10/23"
|
||||
updated_date = "2023/11/15"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -13,7 +13,7 @@ Identifies the creation of a hidden launch agent or daemon. An adversary may est
|
||||
launch agent or daemon which executes at login.
|
||||
"""
|
||||
from = "now-9m"
|
||||
index = ["auditbeat-*", "logs-endpoint.events.*"]
|
||||
index = ["logs-endpoint.events.*"]
|
||||
language = "eql"
|
||||
license = "Elastic License v2"
|
||||
name = "Creation of Hidden Launch Agent or Daemon"
|
||||
@@ -24,11 +24,29 @@ risk_score = 47
|
||||
rule_id = "092b068f-84ac-485d-8a55-7dd9e006715f"
|
||||
setup = """
|
||||
|
||||
If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
|
||||
events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
|
||||
Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
|
||||
`event.ingested` to @timestamp.
|
||||
For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
|
||||
This rule requires data coming in from Elastic Defend.
|
||||
|
||||
### Elastic Defend Integration Setup
|
||||
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
|
||||
|
||||
#### Prerequisite Requirements:
|
||||
- Fleet is required for Elastic Defend.
|
||||
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
|
||||
|
||||
#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
|
||||
- Go to the Kibana home page and click "Add integrations".
|
||||
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
|
||||
- Click "Add Elastic Defend".
|
||||
- Configure the integration name and optionally add a description.
|
||||
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
|
||||
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
|
||||
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
|
||||
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
|
||||
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
|
||||
- Click "Save and Continue".
|
||||
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
|
||||
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
|
||||
|
||||
"""
|
||||
severity = "medium"
|
||||
tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Persistence", "Tactic: Defense Evasion", "Data Source: Elastic Defend"]
|
||||
|
||||
@@ -4,7 +4,7 @@ integration = ["endpoint"]
|
||||
maturity = "production"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
updated_date = "2023/06/22"
|
||||
updated_date = "2023/11/15"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -14,7 +14,7 @@ this feature by adding a rogue Finder Plugin to repeatedly execute malicious pay
|
||||
"""
|
||||
false_positives = ["Trusted Finder Sync Plugins"]
|
||||
from = "now-9m"
|
||||
index = ["auditbeat-*", "logs-endpoint.events.*"]
|
||||
index = ["logs-endpoint.events.*"]
|
||||
language = "eql"
|
||||
license = "Elastic License v2"
|
||||
name = "Finder Sync Plugin Registered and Enabled"
|
||||
@@ -23,6 +23,32 @@ references = [
|
||||
]
|
||||
risk_score = 47
|
||||
rule_id = "37f638ea-909d-4f94-9248-edd21e4a9906"
|
||||
setup = """
|
||||
|
||||
This rule requires data coming in from Elastic Defend.
|
||||
|
||||
### Elastic Defend Integration Setup
|
||||
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
|
||||
|
||||
#### Prerequisite Requirements:
|
||||
- Fleet is required for Elastic Defend.
|
||||
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
|
||||
|
||||
#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
|
||||
- Go to the Kibana home page and click "Add integrations".
|
||||
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
|
||||
- Click "Add Elastic Defend".
|
||||
- Configure the integration name and optionally add a description.
|
||||
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
|
||||
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
|
||||
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
|
||||
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
|
||||
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
|
||||
- Click "Save and Continue".
|
||||
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
|
||||
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
|
||||
|
||||
"""
|
||||
severity = "medium"
|
||||
tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Defend"]
|
||||
timestamp_override = "event.ingested"
|
||||
|
||||
@@ -4,7 +4,7 @@ integration = ["endpoint"]
|
||||
maturity = "production"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
updated_date = "2023/06/22"
|
||||
updated_date = "2023/11/15"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -14,13 +14,39 @@ attached has items added or removed, or when its window is opened, closed, moved
|
||||
feature to establish persistence by utilizing a malicious script.
|
||||
"""
|
||||
from = "now-9m"
|
||||
index = ["auditbeat-*", "logs-endpoint.events.*"]
|
||||
index = ["logs-endpoint.events.*"]
|
||||
language = "eql"
|
||||
license = "Elastic License v2"
|
||||
name = "Persistence via Folder Action Script"
|
||||
references = ["https://posts.specterops.io/folder-actions-for-persistence-on-macos-8923f222343d"]
|
||||
risk_score = 47
|
||||
rule_id = "c292fa52-4115-408a-b897-e14f684b3cb7"
|
||||
setup = """
|
||||
|
||||
This rule requires data coming in from Elastic Defend.
|
||||
|
||||
### Elastic Defend Integration Setup
|
||||
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
|
||||
|
||||
#### Prerequisite Requirements:
|
||||
- Fleet is required for Elastic Defend.
|
||||
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
|
||||
|
||||
#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
|
||||
- Go to the Kibana home page and click "Add integrations".
|
||||
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
|
||||
- Click "Add Elastic Defend".
|
||||
- Configure the integration name and optionally add a description.
|
||||
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
|
||||
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
|
||||
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
|
||||
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
|
||||
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
|
||||
- Click "Save and Continue".
|
||||
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
|
||||
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
|
||||
|
||||
"""
|
||||
severity = "medium"
|
||||
tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Execution", "Tactic: Persistence", "Data Source: Elastic Defend"]
|
||||
type = "eql"
|
||||
|
||||
@@ -4,7 +4,7 @@ integration = ["endpoint"]
|
||||
maturity = "production"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
updated_date = "2023/10/23"
|
||||
updated_date = "2023/11/15"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -13,7 +13,7 @@ Identifies use of the Defaults command to install a login or logoff hook in MacO
|
||||
capability to establish persistence in an environment by inserting code to be executed at login or logout.
|
||||
"""
|
||||
from = "now-9m"
|
||||
index = ["auditbeat-*", "logs-endpoint.events.*"]
|
||||
index = ["logs-endpoint.events.*"]
|
||||
language = "eql"
|
||||
license = "Elastic License v2"
|
||||
name = "Persistence via Login or Logout Hook"
|
||||
@@ -25,11 +25,29 @@ risk_score = 47
|
||||
rule_id = "5d0265bf-dea9-41a9-92ad-48a8dcd05080"
|
||||
setup = """
|
||||
|
||||
If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
|
||||
events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
|
||||
Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
|
||||
`event.ingested` to @timestamp.
|
||||
For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
|
||||
This rule requires data coming in from Elastic Defend.
|
||||
|
||||
### Elastic Defend Integration Setup
|
||||
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
|
||||
|
||||
#### Prerequisite Requirements:
|
||||
- Fleet is required for Elastic Defend.
|
||||
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
|
||||
|
||||
#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
|
||||
- Go to the Kibana home page and click "Add integrations".
|
||||
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
|
||||
- Click "Add Elastic Defend".
|
||||
- Configure the integration name and optionally add a description.
|
||||
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
|
||||
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
|
||||
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
|
||||
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
|
||||
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
|
||||
- Click "Save and Continue".
|
||||
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
|
||||
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
|
||||
|
||||
"""
|
||||
severity = "medium"
|
||||
tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Defend"]
|
||||
|
||||
@@ -4,7 +4,7 @@ integration = ["endpoint"]
|
||||
maturity = "production"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
updated_date = "2023/06/22"
|
||||
updated_date = "2023/11/15"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -13,7 +13,7 @@ Identifies the creation or modification of the login window property list (plist
|
||||
run a program during system boot or user login for persistence.
|
||||
"""
|
||||
from = "now-9m"
|
||||
index = ["auditbeat-*", "logs-endpoint.events.*"]
|
||||
index = ["logs-endpoint.events.*"]
|
||||
language = "kuery"
|
||||
license = "Elastic License v2"
|
||||
name = "Potential Persistence via Login Hook"
|
||||
@@ -23,6 +23,32 @@ Starting in Mac OS X 10.7 (Lion), users can specify certain applications to be r
|
||||
references = ["https://github.com/D00MFist/PersistentJXA/blob/master/LoginScript.js"]
|
||||
risk_score = 47
|
||||
rule_id = "ac412404-57a5-476f-858f-4e8fbb4f48d8"
|
||||
setup = """
|
||||
|
||||
This rule requires data coming in from Elastic Defend.
|
||||
|
||||
### Elastic Defend Integration Setup
|
||||
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
|
||||
|
||||
#### Prerequisite Requirements:
|
||||
- Fleet is required for Elastic Defend.
|
||||
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
|
||||
|
||||
#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
|
||||
- Go to the Kibana home page and click "Add integrations".
|
||||
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
|
||||
- Click "Add Elastic Defend".
|
||||
- Configure the integration name and optionally add a description.
|
||||
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
|
||||
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
|
||||
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
|
||||
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
|
||||
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
|
||||
- Click "Save and Continue".
|
||||
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
|
||||
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
|
||||
|
||||
"""
|
||||
severity = "medium"
|
||||
tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Defend"]
|
||||
timestamp_override = "event.ingested"
|
||||
|
||||
@@ -4,7 +4,7 @@ integration = ["endpoint"]
|
||||
maturity = "production"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
updated_date = "2023/10/23"
|
||||
updated_date = "2023/11/15"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -13,7 +13,7 @@ Adversaries may create or modify the Sublime application plugins or scripts to e
|
||||
Sublime application is started.
|
||||
"""
|
||||
from = "now-9m"
|
||||
index = ["auditbeat-*", "logs-endpoint.events.*"]
|
||||
index = ["logs-endpoint.events.*"]
|
||||
language = "eql"
|
||||
license = "Elastic License v2"
|
||||
name = "Sublime Plugin or Application Script Modification"
|
||||
@@ -22,11 +22,29 @@ risk_score = 21
|
||||
rule_id = "88817a33-60d3-411f-ba79-7c905d865b2a"
|
||||
setup = """
|
||||
|
||||
If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
|
||||
events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
|
||||
Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
|
||||
`event.ingested` to @timestamp.
|
||||
For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
|
||||
This rule requires data coming in from Elastic Defend.
|
||||
|
||||
### Elastic Defend Integration Setup
|
||||
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
|
||||
|
||||
#### Prerequisite Requirements:
|
||||
- Fleet is required for Elastic Defend.
|
||||
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
|
||||
|
||||
#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
|
||||
- Go to the Kibana home page and click "Add integrations".
|
||||
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
|
||||
- Click "Add Elastic Defend".
|
||||
- Configure the integration name and optionally add a description.
|
||||
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
|
||||
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
|
||||
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
|
||||
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
|
||||
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
|
||||
- Click "Save and Continue".
|
||||
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
|
||||
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
|
||||
|
||||
"""
|
||||
severity = "low"
|
||||
tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Defend"]
|
||||
|
||||
@@ -4,7 +4,7 @@ integration = ["endpoint"]
|
||||
maturity = "production"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
updated_date = "2023/06/22"
|
||||
updated_date = "2023/11/15"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -13,7 +13,7 @@ Identifies the creation or modification of the default configuration for periodi
|
||||
tasks to execute malicious code or maintain persistence.
|
||||
"""
|
||||
from = "now-9m"
|
||||
index = ["auditbeat-*", "logs-endpoint.events.*"]
|
||||
index = ["logs-endpoint.events.*"]
|
||||
language = "kuery"
|
||||
license = "Elastic License v2"
|
||||
name = "Potential Persistence via Periodic Tasks"
|
||||
@@ -24,6 +24,32 @@ references = [
|
||||
]
|
||||
risk_score = 21
|
||||
rule_id = "48ec9452-e1fd-4513-a376-10a1a26d2c83"
|
||||
setup = """
|
||||
|
||||
This rule requires data coming in from Elastic Defend.
|
||||
|
||||
### Elastic Defend Integration Setup
|
||||
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
|
||||
|
||||
#### Prerequisite Requirements:
|
||||
- Fleet is required for Elastic Defend.
|
||||
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
|
||||
|
||||
#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
|
||||
- Go to the Kibana home page and click "Add integrations".
|
||||
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
|
||||
- Click "Add Elastic Defend".
|
||||
- Configure the integration name and optionally add a description.
|
||||
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
|
||||
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
|
||||
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
|
||||
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
|
||||
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
|
||||
- Click "Save and Continue".
|
||||
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
|
||||
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
|
||||
|
||||
"""
|
||||
severity = "low"
|
||||
tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Defend"]
|
||||
timestamp_override = "event.ingested"
|
||||
|
||||
@@ -4,7 +4,7 @@ integration = ["endpoint"]
|
||||
maturity = "production"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
updated_date = "2023/10/23"
|
||||
updated_date = "2023/11/15"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -15,7 +15,7 @@ on a macOS endpoint by creating a malicious screensaver (.saver) file and config
|
||||
execute code each time the screensaver is activated.
|
||||
"""
|
||||
from = "now-9m"
|
||||
index = ["auditbeat-*", "logs-endpoint.events.*"]
|
||||
index = ["logs-endpoint.events.*"]
|
||||
language = "eql"
|
||||
license = "Elastic License v2"
|
||||
name = "Unexpected Child Process of macOS Screensaver Engine"
|
||||
@@ -35,11 +35,28 @@ risk_score = 47
|
||||
rule_id = "48d7f54d-c29e-4430-93a9-9db6b5892270"
|
||||
setup = """
|
||||
|
||||
If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
|
||||
events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
|
||||
Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
|
||||
`event.ingested` to @timestamp.
|
||||
For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
|
||||
This rule requires data coming in from Elastic Defend.
|
||||
|
||||
### Elastic Defend Integration Setup
|
||||
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
|
||||
|
||||
#### Prerequisite Requirements:
|
||||
- Fleet is required for Elastic Defend.
|
||||
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
|
||||
|
||||
#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
|
||||
- Go to the Kibana home page and click "Add integrations".
|
||||
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
|
||||
- Click "Add Elastic Defend".
|
||||
- Configure the integration name and optionally add a description.
|
||||
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
|
||||
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
|
||||
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
|
||||
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
|
||||
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
|
||||
- Click "Save and Continue".
|
||||
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
|
||||
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
|
||||
|
||||
"""
|
||||
severity = "medium"
|
||||
|
||||
@@ -4,7 +4,7 @@ integration = ["endpoint"]
|
||||
maturity = "production"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
updated_date = "2023/10/23"
|
||||
updated_date = "2023/11/15"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -14,7 +14,7 @@ a macOS endpoint by creating a malicious screensaver (.saver) file and configuri
|
||||
code each time the screensaver is activated.
|
||||
"""
|
||||
from = "now-9m"
|
||||
index = ["auditbeat-*", "logs-endpoint.events.*"]
|
||||
index = ["logs-endpoint.events.*"]
|
||||
language = "eql"
|
||||
license = "Elastic License v2"
|
||||
name = "Screensaver Plist File Modified by Unexpected Process"
|
||||
@@ -33,11 +33,28 @@ risk_score = 47
|
||||
rule_id = "e6e8912f-283f-4d0d-8442-e0dcaf49944b"
|
||||
setup = """
|
||||
|
||||
If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
|
||||
events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
|
||||
Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
|
||||
`event.ingested` to @timestamp.
|
||||
For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
|
||||
This rule requires data coming in from Elastic Defend.
|
||||
|
||||
### Elastic Defend Integration Setup
|
||||
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
|
||||
|
||||
#### Prerequisite Requirements:
|
||||
- Fleet is required for Elastic Defend.
|
||||
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
|
||||
|
||||
#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
|
||||
- Go to the Kibana home page and click "Add integrations".
|
||||
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
|
||||
- Click "Add Elastic Defend".
|
||||
- Configure the integration name and optionally add a description.
|
||||
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
|
||||
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
|
||||
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
|
||||
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
|
||||
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
|
||||
- Click "Save and Continue".
|
||||
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
|
||||
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
|
||||
|
||||
"""
|
||||
severity = "medium"
|
||||
|
||||
@@ -4,7 +4,7 @@ integration = ["endpoint"]
|
||||
maturity = "production"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
updated_date = "2023/06/22"
|
||||
updated_date = "2023/11/15"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -14,7 +14,7 @@ notification procedure to execute a malicious program at a recurring interval to
|
||||
"""
|
||||
false_positives = ["Trusted applications for managing calendars and reminders."]
|
||||
from = "now-9m"
|
||||
index = ["logs-endpoint.events.*", "auditbeat-*"]
|
||||
index = ["logs-endpoint.events.*"]
|
||||
language = "kuery"
|
||||
license = "Elastic License v2"
|
||||
name = "Suspicious Calendar File Modification"
|
||||
@@ -25,6 +25,32 @@ references = [
|
||||
]
|
||||
risk_score = 47
|
||||
rule_id = "cb71aa62-55c8-42f0-b0dd-afb0bb0b1f51"
|
||||
setup = """
|
||||
|
||||
This rule requires data coming in from Elastic Defend.
|
||||
|
||||
### Elastic Defend Integration Setup
|
||||
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
|
||||
|
||||
#### Prerequisite Requirements:
|
||||
- Fleet is required for Elastic Defend.
|
||||
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
|
||||
|
||||
#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
|
||||
- Go to the Kibana home page and click "Add integrations".
|
||||
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
|
||||
- Click "Add Elastic Defend".
|
||||
- Configure the integration name and optionally add a description.
|
||||
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
|
||||
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
|
||||
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
|
||||
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
|
||||
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
|
||||
- Click "Save and Continue".
|
||||
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
|
||||
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
|
||||
|
||||
"""
|
||||
severity = "medium"
|
||||
tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Defend"]
|
||||
timestamp_override = "event.ingested"
|
||||
|
||||
@@ -4,7 +4,7 @@ integration = ["endpoint"]
|
||||
maturity = "production"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
updated_date = "2023/06/22"
|
||||
updated_date = "2023/11/15"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -13,7 +13,7 @@ Identifies modifications to the Atom desktop text editor Init File. Adversaries
|
||||
init.coffee file that will be executed upon the Atom application opening.
|
||||
"""
|
||||
from = "now-9m"
|
||||
index = ["auditbeat-*", "logs-endpoint.events.*"]
|
||||
index = ["logs-endpoint.events.*"]
|
||||
language = "kuery"
|
||||
license = "Elastic License v2"
|
||||
name = "Potential Persistence via Atom Init Script Modification"
|
||||
@@ -23,6 +23,32 @@ references = [
|
||||
]
|
||||
risk_score = 21
|
||||
rule_id = "b4449455-f986-4b5a-82ed-e36b129331f7"
|
||||
setup = """
|
||||
|
||||
This rule requires data coming in from Elastic Defend.
|
||||
|
||||
### Elastic Defend Integration Setup
|
||||
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
|
||||
|
||||
#### Prerequisite Requirements:
|
||||
- Fleet is required for Elastic Defend.
|
||||
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
|
||||
|
||||
#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
|
||||
- Go to the Kibana home page and click "Add integrations".
|
||||
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
|
||||
- Click "Add Elastic Defend".
|
||||
- Configure the integration name and optionally add a description.
|
||||
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
|
||||
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
|
||||
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
|
||||
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
|
||||
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
|
||||
- Click "Save and Continue".
|
||||
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
|
||||
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
|
||||
|
||||
"""
|
||||
severity = "low"
|
||||
tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Defend"]
|
||||
timestamp_override = "event.ingested"
|
||||
|
||||
@@ -4,7 +4,7 @@ integration = ["endpoint"]
|
||||
maturity = "production"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
updated_date = "2023/10/23"
|
||||
updated_date = "2023/11/15"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -13,7 +13,7 @@ Identifies execution of the Apple script interpreter (osascript) without a passw
|
||||
privileges.
|
||||
"""
|
||||
from = "now-9m"
|
||||
index = ["auditbeat-*", "logs-endpoint.events.*"]
|
||||
index = ["logs-endpoint.events.*"]
|
||||
language = "eql"
|
||||
license = "Elastic License v2"
|
||||
name = "Apple Scripting Execution with Administrator Privileges"
|
||||
@@ -22,11 +22,29 @@ risk_score = 47
|
||||
rule_id = "827f8d8f-4117-4ae4-b551-f56d54b9da6b"
|
||||
setup = """
|
||||
|
||||
If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
|
||||
events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
|
||||
Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
|
||||
`event.ingested` to @timestamp.
|
||||
For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
|
||||
This rule requires data coming in from Elastic Defend.
|
||||
|
||||
### Elastic Defend Integration Setup
|
||||
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
|
||||
|
||||
#### Prerequisite Requirements:
|
||||
- Fleet is required for Elastic Defend.
|
||||
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
|
||||
|
||||
#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
|
||||
- Go to the Kibana home page and click "Add integrations".
|
||||
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
|
||||
- Click "Add Elastic Defend".
|
||||
- Configure the integration name and optionally add a description.
|
||||
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
|
||||
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
|
||||
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
|
||||
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
|
||||
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
|
||||
- Click "Save and Continue".
|
||||
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
|
||||
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
|
||||
|
||||
"""
|
||||
severity = "medium"
|
||||
tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Execution", "Tactic: Privilege Escalation", "Data Source: Elastic Defend"]
|
||||
|
||||
@@ -4,7 +4,7 @@ integration = ["endpoint"]
|
||||
maturity = "production"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
updated_date = "2023/06/22"
|
||||
updated_date = "2023/11/15"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -14,7 +14,7 @@ AuthorizationExecute-WithPrivileges from the Security.framework to run another p
|
||||
not be run by itself, as this is a sign of execution with explicit logon credentials.
|
||||
"""
|
||||
from = "now-9m"
|
||||
index = ["auditbeat-*", "logs-endpoint.events.*"]
|
||||
index = ["logs-endpoint.events.*"]
|
||||
language = "kuery"
|
||||
license = "Elastic License v2"
|
||||
name = "Execution with Explicit Credentials via Scripting"
|
||||
@@ -24,6 +24,32 @@ references = [
|
||||
]
|
||||
risk_score = 47
|
||||
rule_id = "f0eb70e9-71e9-40cd-813f-bf8e8c812cb1"
|
||||
setup = """
|
||||
|
||||
This rule requires data coming in from Elastic Defend.
|
||||
|
||||
### Elastic Defend Integration Setup
|
||||
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
|
||||
|
||||
#### Prerequisite Requirements:
|
||||
- Fleet is required for Elastic Defend.
|
||||
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
|
||||
|
||||
#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
|
||||
- Go to the Kibana home page and click "Add integrations".
|
||||
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
|
||||
- Click "Add Elastic Defend".
|
||||
- Configure the integration name and optionally add a description.
|
||||
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
|
||||
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
|
||||
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
|
||||
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
|
||||
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
|
||||
- Click "Save and Continue".
|
||||
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
|
||||
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
|
||||
|
||||
"""
|
||||
severity = "medium"
|
||||
tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Execution", "Tactic: Privilege Escalation", "Data Source: Elastic Defend"]
|
||||
timestamp_override = "event.ingested"
|
||||
|
||||
@@ -4,7 +4,7 @@ integration = ["endpoint"]
|
||||
maturity = "production"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
updated_date = "2023/06/22"
|
||||
updated_date = "2023/11/15"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -15,7 +15,7 @@ CVE-2020-9613 and verify that the impacted system is patched.
|
||||
"""
|
||||
false_positives = ["Trusted system or Adobe Acrobat Related processes."]
|
||||
from = "now-9m"
|
||||
index = ["auditbeat-*", "logs-endpoint.events.*"]
|
||||
index = ["logs-endpoint.events.*"]
|
||||
language = "kuery"
|
||||
license = "Elastic License v2"
|
||||
name = "Suspicious Child Process of Adobe Acrobat Reader Update Service"
|
||||
@@ -24,6 +24,32 @@ references = [
|
||||
]
|
||||
risk_score = 73
|
||||
rule_id = "f85ce03f-d8a8-4c83-acdc-5c8cd0592be7"
|
||||
setup = """
|
||||
|
||||
This rule requires data coming in from Elastic Defend.
|
||||
|
||||
### Elastic Defend Integration Setup
|
||||
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
|
||||
|
||||
#### Prerequisite Requirements:
|
||||
- Fleet is required for Elastic Defend.
|
||||
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
|
||||
|
||||
#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
|
||||
- Go to the Kibana home page and click "Add integrations".
|
||||
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
|
||||
- Click "Add Elastic Defend".
|
||||
- Configure the integration name and optionally add a description.
|
||||
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
|
||||
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
|
||||
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
|
||||
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
|
||||
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
|
||||
- Click "Save and Continue".
|
||||
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
|
||||
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
|
||||
|
||||
"""
|
||||
severity = "high"
|
||||
tags = [
|
||||
"Domain: Endpoint",
|
||||
|
||||
@@ -4,7 +4,7 @@ integration = ["endpoint"]
|
||||
maturity = "production"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
updated_date = "2023/06/22"
|
||||
updated_date = "2023/11/15"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -13,13 +13,39 @@ Identifies attempts to add an account to the admin group via the command line. T
|
||||
escalation activity.
|
||||
"""
|
||||
from = "now-9m"
|
||||
index = ["auditbeat-*", "logs-endpoint.events.*"]
|
||||
index = ["logs-endpoint.events.*"]
|
||||
language = "kuery"
|
||||
license = "Elastic License v2"
|
||||
name = "Potential Admin Group Account Addition"
|
||||
references = ["https://managingosx.wordpress.com/2010/01/14/add-a-user-to-the-admin-group-via-command-line-3-0/"]
|
||||
risk_score = 47
|
||||
rule_id = "565c2b44-7a21-4818-955f-8d4737967d2e"
|
||||
setup = """
|
||||
|
||||
This rule requires data coming in from Elastic Defend.
|
||||
|
||||
### Elastic Defend Integration Setup
|
||||
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
|
||||
|
||||
#### Prerequisite Requirements:
|
||||
- Fleet is required for Elastic Defend.
|
||||
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
|
||||
|
||||
#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
|
||||
- Go to the Kibana home page and click "Add integrations".
|
||||
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
|
||||
- Click "Add Elastic Defend".
|
||||
- Configure the integration name and optionally add a description.
|
||||
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
|
||||
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
|
||||
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
|
||||
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
|
||||
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
|
||||
- Click "Save and Continue".
|
||||
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
|
||||
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
|
||||
|
||||
"""
|
||||
severity = "medium"
|
||||
tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Data Source: Elastic Defend"]
|
||||
timestamp_override = "event.ingested"
|
||||
|
||||
@@ -4,7 +4,7 @@ integration = ["endpoint"]
|
||||
maturity = "production"
|
||||
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
||||
min_stack_version = "8.3.0"
|
||||
updated_date = "2023/06/22"
|
||||
updated_date = "2023/11/15"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -13,7 +13,7 @@ Identifies modifications to the root crontab file. Adversaries may overwrite thi
|
||||
privileges by exploiting privileged file write or move related vulnerabilities.
|
||||
"""
|
||||
from = "now-9m"
|
||||
index = ["auditbeat-*", "logs-endpoint.events.*"]
|
||||
index = ["logs-endpoint.events.*"]
|
||||
language = "kuery"
|
||||
license = "Elastic License v2"
|
||||
name = "Privilege Escalation via Root Crontab File Modification"
|
||||
@@ -23,6 +23,32 @@ references = [
|
||||
]
|
||||
risk_score = 73
|
||||
rule_id = "0ff84c42-873d-41a2-a4ed-08d74d352d01"
|
||||
setup = """
|
||||
|
||||
This rule requires data coming in from Elastic Defend.
|
||||
|
||||
### Elastic Defend Integration Setup
|
||||
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
|
||||
|
||||
#### Prerequisite Requirements:
|
||||
- Fleet is required for Elastic Defend.
|
||||
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
|
||||
|
||||
#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
|
||||
- Go to the Kibana home page and click "Add integrations".
|
||||
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
|
||||
- Click "Add Elastic Defend".
|
||||
- Configure the integration name and optionally add a description.
|
||||
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
|
||||
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
|
||||
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
|
||||
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
|
||||
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
|
||||
- Click "Save and Continue".
|
||||
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
|
||||
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
|
||||
|
||||
"""
|
||||
severity = "high"
|
||||
tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Data Source: Elastic Defend"]
|
||||
timestamp_override = "event.ingested"
|
||||
|
||||
Reference in New Issue
Block a user