Merge branch '7.9' into main

detection_rules/schemas/v79.py

@@ -37,7 +37,7 @@ class SeverityMapping(jsl.Document):
 
 
 class ThresholdMapping(jsl.Document):
-    field = jsl.StringField(required=False)
+    field = jsl.StringField(required=True, default="")
     value = jsl.IntField(minimum=1, required=True)
 
 

rules/aws/credential_access_aws_iam_assume_role_brute_force.toml

@@ -48,4 +48,5 @@ name = "Credential Access"
 reference = "https://attack.mitre.org/tactics/TA0006/"
 
 [rule.threshold]
+field = ""
 value = 25

rules/linux/credential_access_tcpdump_activity.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/02/18"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/25"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -17,7 +17,7 @@ false_positives = [
     troubleshooting.
     """,
 ]
-index = ["auditbeat-*"]
+index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "Network Sniffing via Tcpdump"

rules/linux/defense_evasion_attempt_to_disable_iptables_or_firewall.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/04/24"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/07/01"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -10,7 +10,7 @@ description = """
 Adversaries may attempt to disable the iptables or firewall service in an attempt to affect how a host is allowed to
 receive or send network traffic.
 """
-index = ["auditbeat-*"]
+index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "Attempt to Disable IPTables or Firewall"

rules/linux/defense_evasion_attempt_to_disable_syslog_service.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/04/27"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/25"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -10,7 +10,7 @@ description = """
 Adversaries may attempt to disable the syslog service in an attempt to an attempt to disrupt event logging and evade
 detection by security controls.
 """
-index = ["auditbeat-*"]
+index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "Attempt to Disable Syslog Service"

rules/linux/defense_evasion_base16_or_base32_encoding_or_decoding_activity.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/04/17"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/25"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -13,7 +13,7 @@ false_positives = [
     filtered by the process executable or username values.
     """,
 ]
-index = ["auditbeat-*"]
+index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "Base16 or Base32 Encoding/Decoding Activity"

rules/linux/defense_evasion_base64_encoding_or_decoding_activity.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/04/17"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/25"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -13,7 +13,7 @@ false_positives = [
     filtered by the process executable or username values.
     """,
 ]
-index = ["auditbeat-*"]
+index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "Base64 Encoding/Decoding Activity"

rules/linux/defense_evasion_deletion_of_bash_command_line_history.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/05/04"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/25"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -10,7 +10,7 @@ description = """
 Adversaries may attempt to clear the bash command line history in an attempt to evade detection or forensic
 investigations.
 """
-index = ["auditbeat-*"]
+index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "lucene"
 license = "Elastic License"
 name = "Deletion of Bash Command Line History"

rules/linux/defense_evasion_disable_selinux_attempt.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/04/22"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/25"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -11,7 +11,7 @@ Identifies potential attempts to disable Security-Enhanced Linux (SELinux), whic
 support access control policies. Adversaries may disable security tools to avoid possible detection of their tools and
 activities.
 """
-index = ["auditbeat-*"]
+index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "Potential Disabling of SELinux"

rules/linux/defense_evasion_file_deletion_via_shred.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/04/27"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/25"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -11,7 +11,7 @@ Malware or other files dropped or created on a system by an adversary may leave
 a network and how. Adversaries may remove these files over the course of an intrusion to keep their footprint low or
 remove them at the end as part of the post-intrusion cleanup process.
 """
-index = ["auditbeat-*"]
+index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "File Deletion via Shred"

rules/linux/defense_evasion_file_mod_writable_dir.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/04/21"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/25"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -16,7 +16,7 @@ false_positives = [
     by username.
     """,
 ]
-index = ["auditbeat-*"]
+index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "File Permission Modification in Writable Directory"

rules/linux/defense_evasion_hex_encoding_or_decoding_activity.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/04/17"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/25"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -13,7 +13,7 @@ false_positives = [
     filtered by the process executable or username values.
     """,
 ]
-index = ["auditbeat-*"]
+index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "Hex Encoding/Decoding Activity"

rules/linux/defense_evasion_hidden_file_dir_tmp.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/04/29"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/25"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -17,7 +17,7 @@ false_positives = [
     behavior. These events can be filtered by the process arguments, username, or process name values.
     """,
 ]
-index = ["auditbeat-*"]
+index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "lucene"
 license = "Elastic License"
 max_signals = 33

rules/linux/defense_evasion_kernel_module_removal.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/04/24"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/25"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -17,7 +17,7 @@ false_positives = [
     Note that some Linux distributions are not built to support the removal of modules at all.
     """,
 ]
-index = ["auditbeat-*"]
+index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "Kernel Module Removal"

rules/linux/discovery_kernel_module_enumeration.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/04/23"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/25"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -17,7 +17,7 @@ false_positives = [
     by ordinary users is uncommon. These can be exempted by process name or username.
     """,
 ]
-index = ["auditbeat-*"]
+index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "Enumeration of Kernel Modules"

rules/linux/discovery_virtual_machine_fingerprinting.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/04/27"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/25"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -17,7 +17,7 @@ false_positives = [
     process arguments to eliminate potential noise.
     """,
 ]
-index = ["auditbeat-*"]
+index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "Virtual Machine Fingerprinting"

rules/linux/discovery_whoami_commmand.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/02/18"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/25"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -16,7 +16,7 @@ false_positives = [
     automation tools and frameworks.
     """,
 ]
-index = ["auditbeat-*"]
+index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "User Discovery via Whoami"

rules/linux/execution_perl_tty_shell.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/04/16"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/25"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -10,7 +10,7 @@ description = """
 Identifies when a terminal (tty) is spawned via Perl. Attackers may upgrade a simple reverse shell to a fully
 interactive tty after obtaining initial access to a host.
 """
-index = ["auditbeat-*"]
+index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "Interactive Terminal Spawned via Perl"

rules/linux/execution_python_tty_shell.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/04/15"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/25"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -10,7 +10,7 @@ description = """
 Identifies when a terminal (tty) is spawned via Python. Attackers may upgrade a simple reverse shell to a fully
 interactive tty after obtaining initial access to a host.
 """
-index = ["auditbeat-*"]
+index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "Interactive Terminal Spawned via Python"

rules/linux/lateral_movement_telnet_network_activity_external.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/04/23"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/25"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -18,7 +18,7 @@ false_positives = [
     suspicious.
     """,
 ]
-index = ["auditbeat-*"]
+index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "Connection to External Network via Telnet"

rules/linux/lateral_movement_telnet_network_activity_internal.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/04/23"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/25"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -18,7 +18,7 @@ false_positives = [
     suspicious.
     """,
 ]
-index = ["auditbeat-*"]
+index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "Connection to Internal Network via Telnet"

rules/linux/linux_hping_activity.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/02/18"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/25"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -16,7 +16,7 @@ false_positives = [
     uncommon.
     """,
 ]
-index = ["auditbeat-*"]
+index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "Hping Process Activity"

rules/linux/linux_iodine_activity.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/02/18"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/25"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -16,7 +16,7 @@ false_positives = [
     uncommon.
     """,
 ]
-index = ["auditbeat-*"]
+index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "Potential DNS Tunneling via Iodine"

rules/linux/linux_mknod_activity.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/02/18"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/25"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -16,7 +16,7 @@ false_positives = [
     scripts, automation tools, and frameworks. Usage by web servers is more likely to be suspicious.
     """,
 ]
-index = ["auditbeat-*"]
+index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "Mknod Process Activity"

rules/linux/linux_netcat_network_connection.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/02/18"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/25"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -18,7 +18,7 @@ false_positives = [
     originate from scripts, automation tools, and frameworks.
     """,
 ]
-index = ["auditbeat-*"]
+index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "Netcat Network Activity"

rules/linux/linux_nmap_activity.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/02/18"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/25"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -18,7 +18,7 @@ false_positives = [
     uncommon.
     """,
 ]
-index = ["auditbeat-*"]
+index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "Nmap Process Activity"

rules/linux/linux_nping_activity.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/02/18"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/25"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -16,7 +16,7 @@ false_positives = [
     is usually not routine or unannounced. Use of `Nping` by non-engineers or ordinary users is uncommon.
     """,
 ]
-index = ["auditbeat-*"]
+index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "Nping Process Activity"

rules/linux/linux_process_started_in_temp_directory.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/02/18"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/25"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -13,7 +13,7 @@ false_positives = [
     username.
     """,
 ]
-index = ["auditbeat-*"]
+index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "Unusual Process Execution - Temp"

rules/linux/linux_socat_activity.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/02/18"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/25"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -17,7 +17,7 @@ false_positives = [
     more likely to be suspicious.
     """,
 ]
-index = ["auditbeat-*"]
+index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "Socat Process Activity"

rules/linux/linux_strace_activity.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/02/18"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/25"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -16,7 +16,7 @@ false_positives = [
     originate from developers or SREs engaged in debugging or system call tracing.
     """,
 ]
-index = ["auditbeat-*"]
+index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "Strace Process Activity"

rules/linux/persistence_kernel_module_activity.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/02/18"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/25"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -13,7 +13,7 @@ false_positives = [
     programs by ordinary users is uncommon.
     """,
 ]
-index = ["auditbeat-*"]
+index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "Persistence via Kernel Module Modification"

rules/linux/persistence_shell_activity_by_web_server.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/02/18"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/25"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -13,7 +13,7 @@ false_positives = [
     behavior.
     """,
 ]
-index = ["auditbeat-*"]
+index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "Potential Shell via Web Server"

rules/linux/privilege_escalation_setgid_bit_set_via_chmod.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/04/23"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/25"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -12,7 +12,7 @@ group. An adversary can take advantage of this to either do a shell escape or ex
 with the setgid bit to get code running in a different user’s context. Additionally, adversaries can use this mechanism
 on their own malware to make sure they're able to execute in elevated contexts in the future.
 """
-index = ["auditbeat-*"]
+index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "lucene"
 license = "Elastic License"
 max_signals = 33

rules/linux/privilege_escalation_setuid_bit_set_via_chmod.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/04/23"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/25"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -12,7 +12,7 @@ user. An adversary can take advantage of this to either do a shell escape or exp
 with the setuid bit to get code running in a different user’s context. Additionally, adversaries can use this mechanism
 on their own malware to make sure they're able to execute in elevated contexts in the future.
 """
-index = ["auditbeat-*"]
+index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "lucene"
 license = "Elastic License"
 max_signals = 33

rules/linux/privilege_escalation_sudoers_file_mod.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/04/13"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/25"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -10,7 +10,7 @@ description = """
 A sudoers file specifies the commands that users or groups can run and from which terminals. Adversaries can take
 advantage of these configurations to execute commands as other users or spawn processes with higher privileges.
 """
-index = ["auditbeat-*"]
+index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "Sudoers File Modification"

rules/promotions/elastic_endpoint.toml

@@ -32,6 +32,7 @@ event.kind:alert and event.module:(endpoint and not endgame)
 
 [[rule.exceptions_list]]
 id = "endpoint_list"
+list_id = "endpoint_list"
 namespace_type = "agnostic"
 type = "endpoint"
 

rules/promotions/external_alerts.toml

@@ -7,10 +7,10 @@ updated_date = "2020/07/08"
 [rule]
 author = ["Elastic"]
 description = """
-Generates a detection alert for each external alert written to the configured indices. Enabling
-this rule allows you to immediately begin investigating external alerts in the app.
+Generates a detection alert for each external alert written to the configured indices. Enabling this rule allows you to
+immediately begin investigating external alerts in the app.
 """
-index = ["apm-*-transaction*", "auditbeat-*", "endgame-*", "filebeat-*", "logs-*", "packetbeat-*", "winlogbeat-*"]
+index = ["apm-*-transaction*", "auditbeat-*", "filebeat-*", "logs-*", "packetbeat-*", "winlogbeat-*"]
 language = "kuery"
 license = "Elastic License"
 max_signals = 10000
@@ -57,3 +57,4 @@ operator = "equals"
 value = "99"
 severity = "critical"
 
+

rules/windows/command_and_control_certutil_network_connection.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/03/19"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/24"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -10,7 +10,7 @@ description = """
 Identifies certutil.exe making a network connection. Adversaries could abuse certutil.exe to download a certificate, or
 malware, from a remote URL.
 """
-index = ["winlogbeat-*"]
+index = ["winlogbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "Network Connection via Certutil"

rules/windows/credential_access_credential_dumping_msbuild.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/03/25"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/24"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -11,7 +11,7 @@ An instance of MSBuild, the Microsoft Build Engine, loaded DLLs (dynamically lin
 credential management. This technique is sometimes used for credential dumping.
 """
 false_positives = ["The Build Engine is commonly used by Windows developers but use by non-engineers is unusual."]
-index = ["winlogbeat-*"]
+index = ["winlogbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "Microsoft Build Engine Loading Windows Credential Libraries"

rules/windows/defense_evasion_adding_the_hidden_file_attribute_with_via_attribexe.toml

@@ -2,12 +2,12 @@
 creation_date = "2020/02/18"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/24"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
 description = "Adversaries can add the 'hidden' attribute to files to hide them from the user in an attempt to evade detection."
-index = ["winlogbeat-*"]
+index = ["winlogbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "Adding Hidden File Attribute via Attrib"

rules/windows/defense_evasion_clearing_windows_event_logs.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/02/18"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/24"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -10,7 +10,7 @@ description = """
 Identifies attempts to clear Windows event log stores. This is often done by attackers in an attempt to evade detection
 or destroy forensic evidence on a system.
 """
-index = ["winlogbeat-*"]
+index = ["winlogbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "Clearing Windows Event Logs"

rules/windows/defense_evasion_delete_volume_usn_journal_with_fsutil.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/02/18"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/24"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -10,7 +10,7 @@ description = """
 Identifies use of the fsutil.exe to delete the volume USNJRNL. This technique is used by attackers to eliminate evidence
 of files created during post-exploitation activities.
 """
-index = ["winlogbeat-*"]
+index = ["winlogbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "Delete Volume USN Journal with Fsutil"

rules/windows/defense_evasion_deleting_backup_catalogs_with_wbadmin.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/02/18"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/24"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -10,7 +10,7 @@ description = """
 Identifies use of the wbadmin.exe to delete the backup catalog. Ransomware and other malware may do this to prevent
 system recovery.
 """
-index = ["winlogbeat-*"]
+index = ["winlogbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "Deleting Backup Catalogs with Wbadmin"

rules/windows/defense_evasion_disable_windows_firewall_rules_with_netsh.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/02/18"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/24"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -10,7 +10,7 @@ description = """
 Identifies use of the netsh.exe to disable or weaken the local firewall. Attackers will use this command line tool to
 disable the firewall during troubleshooting or to enable network mobility.
 """
-index = ["winlogbeat-*"]
+index = ["winlogbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "Disable Windows Firewall Rules via Netsh"

rules/windows/defense_evasion_encoding_or_decoding_files_via_certutil.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/02/18"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/24"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -11,7 +11,7 @@ Identifies the use of certutil.exe to encode or decode data. CertUtil is a nativ
 Certificate Services. CertUtil is often abused by attackers to encode or decode base64 data for stealthier command and
 control or exfiltration.
 """
-index = ["winlogbeat-*"]
+index = ["winlogbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "Encoding or Decoding Files via CertUtil"

rules/windows/defense_evasion_execution_msbuild_started_by_office_app.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/03/25"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/24"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -16,7 +16,7 @@ false_positives = [
     this program to be started by an Office application like Word or Excel.
     """,
 ]
-index = ["winlogbeat-*"]
+index = ["winlogbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "Microsoft Build Engine Started by an Office Application"

rules/windows/defense_evasion_execution_msbuild_started_by_script.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/03/25"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/24"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -11,7 +11,7 @@ An instance of MSBuild, the Microsoft Build Engine, was started by a script or t
 behavior is unusual and is sometimes used by malicious payloads.
 """
 false_positives = ["The Build Engine is commonly used by Windows developers but use by non-engineers is unusual."]
-index = ["winlogbeat-*"]
+index = ["winlogbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "Microsoft Build Engine Started by a Script Process"

rules/windows/defense_evasion_execution_msbuild_started_by_system_process.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/03/25"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/24"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -11,7 +11,7 @@ An instance of MSBuild, the Microsoft Build Engine, was started by Explorer or t
 Instrumentation) subsystem. This behavior is unusual and is sometimes used by malicious payloads.
 """
 false_positives = ["The Build Engine is commonly used by Windows developers but use by non-engineers is unusual."]
-index = ["winlogbeat-*"]
+index = ["winlogbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "Microsoft Build Engine Started by a System Process"

rules/windows/defense_evasion_execution_msbuild_started_renamed.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/03/25"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/24"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -11,7 +11,7 @@ An instance of MSBuild, the Microsoft Build Engine, was started after being rena
 indicate an attempt to run unnoticed or undetected.
 """
 false_positives = ["The Build Engine is commonly used by Windows developers but use by non-engineers is unusual."]
-index = ["winlogbeat-*"]
+index = ["winlogbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "Microsoft Build Engine Using an Alternate Name"

rules/windows/defense_evasion_execution_msbuild_started_unusal_process.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/03/25"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/24"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -16,7 +16,7 @@ false_positives = [
     triggers this rule it can be exempted by process, user or host name.
     """,
 ]
-index = ["winlogbeat-*"]
+index = ["winlogbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "Microsoft Build Engine Started an Unusual Process"

rules/windows/defense_evasion_misc_lolbin_connecting_to_the_internet.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/02/18"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/24"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -11,7 +11,7 @@ Binaries signed with trusted digital certificates can execute on Windows systems
 validation. Adversaries may use these binaries to 'live off the land' and execute malicious files that could bypass
 application allowlists and signature validation.
 """
-index = ["winlogbeat-*"]
+index = ["winlogbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "Network Connection via Signed Binary"

rules/windows/defense_evasion_modification_of_boot_config.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/03/16"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/24"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -10,7 +10,7 @@ description = """
 Identifies use of bcdedit.exe to delete boot configuration data. This tactic is sometimes used as by malware or an
 attacker as a destructive technique.
 """
-index = ["winlogbeat-*"]
+index = ["winlogbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "Modification of Boot Configuration"

rules/windows/defense_evasion_volume_shadow_copy_deletion_via_vssadmin.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/02/18"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/24"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -10,7 +10,7 @@ description = """
 Identifies use of vssadmin.exe for shadow copy deletion on endpoints. This commonly occurs in tandem with ransomware or
 other destructive attacks.
 """
-index = ["winlogbeat-*"]
+index = ["winlogbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "Volume Shadow Copy Deletion via VssAdmin"

rules/windows/defense_evasion_volume_shadow_copy_deletion_via_wmic.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/02/18"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/24"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -10,7 +10,7 @@ description = """
 Identifies use of wmic.exe for shadow copy deletion on endpoints. This commonly occurs in tandem with ransomware or
 other destructive attacks.
 """
-index = ["winlogbeat-*"]
+index = ["winlogbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "Volume Shadow Copy Deletion via WMIC"

rules/windows/discovery_net_command_system_account.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/03/18"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/24"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -10,7 +10,7 @@ description = """
 Identifies the SYSTEM account using the Net utility. The Net utility is a component of the Windows operating system. It
 is used in command line operations for control of users, groups, services, and network connections.
 """
-index = ["winlogbeat-*"]
+index = ["winlogbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "Net command via SYSTEM account"

rules/windows/execution_command_prompt_connecting_to_the_internet.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/02/18"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/24"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -16,7 +16,7 @@ false_positives = [
     environment for network connections being made from the command prompt to determine any abnormal use of this tool.
     """,
 ]
-index = ["winlogbeat-*"]
+index = ["winlogbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "Command Prompt Network Connection"

rules/windows/execution_command_shell_started_by_powershell.toml

@@ -2,12 +2,12 @@
 creation_date = "2020/02/18"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/24"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
 description = "Identifies a suspicious parent child process relationship with cmd.exe descending from PowerShell.exe."
-index = ["winlogbeat-*"]
+index = ["winlogbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "PowerShell spawning Cmd"

rules/windows/execution_command_shell_started_by_svchost.toml

@@ -2,12 +2,12 @@
 creation_date = "2020/02/18"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/24"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
 description = "Identifies a suspicious parent child process relationship with cmd.exe descending from svchost.exe"
-index = ["winlogbeat-*"]
+index = ["winlogbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "Svchost spawning Cmd"

rules/windows/execution_html_help_executable_program_connecting_to_the_internet.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/02/18"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/24"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -11,7 +11,7 @@ Compiled HTML files (.chm) are commonly distributed as part of the Microsoft HTM
 malicious code in a CHM file and deliver it to a victim for execution. CHM content is loaded by the HTML Help executable
 program (hh.exe).
 """
-index = ["winlogbeat-*"]
+index = ["winlogbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "Network Connection via Compiled HTML File"

rules/windows/execution_local_service_commands.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/02/18"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/24"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -10,7 +10,7 @@ description = """
 Identifies use of sc.exe to create, modify, or start services on remote hosts. This could be indicative of adversary
 lateral movement but will be noisy if commonly done by admins.
 """
-index = ["winlogbeat-*"]
+index = ["winlogbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "Local Service Commands"

rules/windows/execution_msbuild_making_network_connections.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/02/18"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/24"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -10,7 +10,7 @@ description = """
 Identifies MsBuild.exe making outbound network connections. This may indicate adversarial activity as MsBuild is often
 leveraged by adversaries to execute code and evade detection.
 """
-index = ["winlogbeat-*"]
+index = ["winlogbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "MsBuild Making Network Connections"

rules/windows/execution_mshta_making_network_connections.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/02/18"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/24"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -10,7 +10,7 @@ description = """
 Identifies mshta.exe making a network connection. This may indicate adversarial activity as mshta.exe is often leveraged
 by adversaries to execute malicious scripts and evade detection.
 """
-index = ["winlogbeat-*"]
+index = ["winlogbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "Network Connection via Mshta"

rules/windows/execution_msxsl_network.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/03/18"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/24"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -10,7 +10,7 @@ description = """
 Identifies msxsl.exe making a network connection. This may indicate adversarial activity as msxsl.exe is often leveraged
 by adversaries to execute malicious scripts and evade detection.
 """
-index = ["winlogbeat-*"]
+index = ["winlogbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "Network Connection via MsXsl"

rules/windows/execution_psexec_lateral_movement_command.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/02/18"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/24"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -16,7 +16,7 @@ false_positives = [
     environment to determine the amount of noise to expect from this tool.
     """,
 ]
-index = ["winlogbeat-*"]
+index = ["winlogbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "PsExec Network Connection"

rules/windows/execution_register_server_program_connecting_to_the_internet.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/02/18"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/24"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -16,7 +16,7 @@ false_positives = [
     is unusual.
     """,
 ]
-index = ["winlogbeat-*"]
+index = ["winlogbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "Network Connection via Regsvr"

rules/windows/execution_script_executing_powershell.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/02/18"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/24"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -10,7 +10,7 @@ description = """
 Identifies a PowerShell process launched by either cscript.exe or wscript.exe. Observing Windows scripting processes
 executing a PowerShell script, may be indicative of malicious activity.
 """
-index = ["winlogbeat-*"]
+index = ["winlogbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "Windows Script Executing PowerShell"

rules/windows/execution_suspicious_ms_office_child_process.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/02/18"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/24"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -11,7 +11,7 @@ Identifies suspicious child processes of frequently targeted Microsoft Office ap
 These child processes are often launched during exploitation of Office applications or from documents with malicious
 macros.
 """
-index = ["winlogbeat-*"]
+index = ["winlogbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "Suspicious MS Office Child Process"

rules/windows/execution_suspicious_ms_outlook_child_process.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/02/18"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/24"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -10,7 +10,7 @@ description = """
 Identifies suspicious child processes of Microsoft Outlook. These child processes are often associated with spear
 phishing activity.
 """
-index = ["winlogbeat-*"]
+index = ["winlogbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "Suspicious MS Outlook Child Process"

rules/windows/execution_suspicious_pdf_reader.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/03/30"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/24"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -10,7 +10,7 @@ description = """
 Identifies suspicious child processes of PDF reader applications. These child processes are often launched via
 exploitation of PDF applications or social engineering.
 """
-index = ["winlogbeat-*"]
+index = ["winlogbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "Suspicious PDF Reader Child Process"

rules/windows/execution_unusual_network_connection_via_rundll32.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/02/18"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/24"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -10,7 +10,7 @@ description = """
 Identifies unusual instances of rundll32.exe making outbound network connections. This may indicate adversarial activity
 and may identify malicious DLLs.
 """
-index = ["winlogbeat-*"]
+index = ["winlogbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "Unusual Network Connection via RunDLL32"

rules/windows/execution_unusual_process_network_connection.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/02/18"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/24"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -10,7 +10,7 @@ description = """
 Identifies network activity from unexpected system applications. This may indicate adversarial activity as these
 applications are often leveraged by adversaries to execute code and evade detection.
 """
-index = ["winlogbeat-*"]
+index = ["winlogbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "Unusual Process Network Connection"

rules/windows/execution_via_net_com_assemblies.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/03/25"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/24"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -11,7 +11,7 @@ RegSvcs.exe and RegAsm.exe are Windows command line utilities that are used to r
 (COM) assemblies. Adversaries can use RegSvcs.exe and RegAsm.exe to proxy execution of code through a trusted Windows
 utility.
 """
-index = ["winlogbeat-*"]
+index = ["winlogbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "Execution via Regsvcs/Regasm"

rules/windows/lateral_movement_direct_outbound_smb_connection.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/02/18"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/24"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -12,7 +12,7 @@ over Server Message Block (SMB), which communicates between hosts using port 445
 connections are established by the kernel. Processes making 445/tcp connections may be port scanners, exploits, or
 suspicious user-level processes moving laterally.
 """
-index = ["winlogbeat-*"]
+index = ["winlogbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "Direct Outbound SMB Connection"

rules/windows/persistence_adobe_hijack_persistence.toml

@@ -2,12 +2,12 @@
 creation_date = "2020/02/18"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/24"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
 description = "Detects writing executable files that will be automatically launched by Adobe on launch."
-index = ["winlogbeat-*"]
+index = ["winlogbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "Adobe Hijack Persistence"

rules/windows/persistence_local_scheduled_task_commands.toml

@@ -2,13 +2,13 @@
 creation_date = "2020/02/18"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/24"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
 description = "A scheduled task can be used by an adversary to establish persistence, move laterally, and/or escalate privileges."
 false_positives = ["Legitimate scheduled tasks may be created during installation of new software."]
-index = ["winlogbeat-*"]
+index = ["winlogbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "Local Scheduled Task Commands"

rules/windows/persistence_system_shells_via_services.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/02/18"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/24"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -10,7 +10,7 @@ description = """
 Windows services typically run as SYSTEM and can be used as a privilege escalation opportunity. Malware or penetration
 testers may run a shell as a service to gain SYSTEM permissions.
 """
-index = ["winlogbeat-*"]
+index = ["winlogbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "System Shells via Services"

rules/windows/persistence_user_account_creation.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/02/18"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/24"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -10,7 +10,7 @@ description = """
 Identifies attempts to create new local users. This is sometimes done by attackers to increase access to a system or
 domain.
 """
-index = ["winlogbeat-*"]
+index = ["winlogbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "User Account Creation"

rules/windows/privilege_escalation_uac_bypass_event_viewer.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/03/17"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/24"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -10,7 +10,7 @@ description = """
 Identifies User Account Control (UAC) bypass via eventvwr.exe. Attackers bypass UAC to stealthily execute code with
 elevated permissions.
 """
-index = ["winlogbeat-*"]
+index = ["winlogbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "Bypass UAC via Event Viewer"

rules/windows/privilege_escalation_unusual_parentchild_relationship.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/02/18"
 ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/06/24"
+updated_date = "2020/08/03"
 
 [rule]
 author = ["Elastic"]
@@ -10,7 +10,7 @@ description = """
 Identifies Windows programs run from unexpected parent processes. This could indicate masquerading or other strange
 activity on a system.
 """
-index = ["winlogbeat-*"]
+index = ["winlogbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"
 name = "Unusual Parent-Child Relationship"