security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[Rule Tuning] Use cidrMatch for eql rules checking multiple IPs (#431)

Browse Source
This commit is contained in:
Justin Ibarra
2020-10-29 20:06:24 +01:00
committed by GitHub
parent fda1e7ef94
commit a575cf9ff3
12 changed files with 32 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/linux/lateral_movement_telnet_network_activity_external.toml
+3 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/04/23"
ecs_version = ["1.6.0"]
maturity = "production"
updated_date = "2020/10/28"
updated_date = "2020/10/29"
[rule]
author = ["Elastic"]
@@ -34,7 +34,8 @@ query = '''
sequence by process.entity_id
[process where process.name == "telnet" and event.type == "start"]
[network where process.name == "telnet" and
destination.ip not in ("127.0.0.0/8", "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "FE80::/10", "::1/128")]
not cidrmatch(destination.ip, "127.0.0.0/8", "10.0.0.0/8", "172.16.0.0/12",
"192.168.0.0/16", "FE80::/10", "::1/128")]
'''
rules/linux/lateral_movement_telnet_network_activity_internal.toml
+3 -3
View File
@@ -2,7 +2,7 @@
creation_date = "2020/04/23"
ecs_version = ["1.6.0"]
maturity = "production"
updated_date = "2020/10/28"
updated_date = "2020/10/29"
[rule]
author = ["Elastic"]
@@ -34,8 +34,8 @@ query = '''
sequence by process.entity_id
[process where process.name == "telnet" and event.type == "start"]
[network where process.name == "telnet" and
destination.ip in ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "FE80::/10") and
destination.ip not in ("127.0.0.0/8", "::1/128")]
cidrmatch(destination.ip, "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "FE80::/10") and
not cidrmatch(destination.ip, "127.0.0.0/8", "::1/128")]
'''