Merge branch '7.9' into main

rules/linux/credential_access_tcpdump_activity.toml

@@ -17,6 +17,7 @@ false_positives = [
     troubleshooting.
     """,
 ]
+from = "now-9m"
 index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"

rules/linux/defense_evasion_attempt_to_disable_iptables_or_firewall.toml

@@ -10,6 +10,7 @@ description = """
 Adversaries may attempt to disable the iptables or firewall service in an attempt to affect how a host is allowed to
 receive or send network traffic.
 """
+from = "now-9m"
 index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"

rules/linux/defense_evasion_attempt_to_disable_syslog_service.toml

@@ -10,6 +10,7 @@ description = """
 Adversaries may attempt to disable the syslog service in an attempt to an attempt to disrupt event logging and evade
 detection by security controls.
 """
+from = "now-9m"
 index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"

rules/linux/defense_evasion_base16_or_base32_encoding_or_decoding_activity.toml

@@ -13,6 +13,7 @@ false_positives = [
     filtered by the process executable or username values.
     """,
 ]
+from = "now-9m"
 index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"

rules/linux/defense_evasion_base64_encoding_or_decoding_activity.toml

@@ -13,6 +13,7 @@ false_positives = [
     filtered by the process executable or username values.
     """,
 ]
+from = "now-9m"
 index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"

rules/linux/defense_evasion_deletion_of_bash_command_line_history.toml

@@ -10,6 +10,7 @@ description = """
 Adversaries may attempt to clear the bash command line history in an attempt to evade detection or forensic
 investigations.
 """
+from = "now-9m"
 index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "lucene"
 license = "Elastic License"

rules/linux/defense_evasion_disable_selinux_attempt.toml

@@ -11,6 +11,7 @@ Identifies potential attempts to disable Security-Enhanced Linux (SELinux), whic
 support access control policies. Adversaries may disable security tools to avoid possible detection of their tools and
 activities.
 """
+from = "now-9m"
 index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"

rules/linux/defense_evasion_file_deletion_via_shred.toml

@@ -11,6 +11,7 @@ Malware or other files dropped or created on a system by an adversary may leave
 a network and how. Adversaries may remove these files over the course of an intrusion to keep their footprint low or
 remove them at the end as part of the post-intrusion cleanup process.
 """
+from = "now-9m"
 index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"

rules/linux/defense_evasion_file_mod_writable_dir.toml

@@ -16,6 +16,7 @@ false_positives = [
     by username.
     """,
 ]
+from = "now-9m"
 index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"

rules/linux/defense_evasion_hex_encoding_or_decoding_activity.toml

@@ -13,6 +13,7 @@ false_positives = [
     filtered by the process executable or username values.
     """,
 ]
+from = "now-9m"
 index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"

rules/linux/defense_evasion_hidden_file_dir_tmp.toml

@@ -17,6 +17,7 @@ false_positives = [
     behavior. These events can be filtered by the process arguments, username, or process name values.
     """,
 ]
+from = "now-9m"
 index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "lucene"
 license = "Elastic License"

rules/linux/defense_evasion_kernel_module_removal.toml

@@ -17,6 +17,7 @@ false_positives = [
     Note that some Linux distributions are not built to support the removal of modules at all.
     """,
 ]
+from = "now-9m"
 index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"

rules/linux/discovery_kernel_module_enumeration.toml

@@ -17,6 +17,7 @@ false_positives = [
     by ordinary users is uncommon. These can be exempted by process name or username.
     """,
 ]
+from = "now-9m"
 index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"

rules/linux/discovery_virtual_machine_fingerprinting.toml

@@ -17,6 +17,7 @@ false_positives = [
     process arguments to eliminate potential noise.
     """,
 ]
+from = "now-9m"
 index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"

rules/linux/discovery_whoami_commmand.toml

@@ -16,6 +16,7 @@ false_positives = [
     automation tools and frameworks.
     """,
 ]
+from = "now-9m"
 index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"

rules/linux/execution_perl_tty_shell.toml

@@ -10,6 +10,7 @@ description = """
 Identifies when a terminal (tty) is spawned via Perl. Attackers may upgrade a simple reverse shell to a fully
 interactive tty after obtaining initial access to a host.
 """
+from = "now-9m"
 index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"

rules/linux/execution_python_tty_shell.toml

@@ -10,6 +10,7 @@ description = """
 Identifies when a terminal (tty) is spawned via Python. Attackers may upgrade a simple reverse shell to a fully
 interactive tty after obtaining initial access to a host.
 """
+from = "now-9m"
 index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"

rules/linux/lateral_movement_telnet_network_activity_external.toml

@@ -18,6 +18,7 @@ false_positives = [
     suspicious.
     """,
 ]
+from = "now-9m"
 index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"

rules/linux/lateral_movement_telnet_network_activity_internal.toml

@@ -18,6 +18,7 @@ false_positives = [
     suspicious.
     """,
 ]
+from = "now-9m"
 index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"

rules/linux/linux_hping_activity.toml

@@ -16,6 +16,7 @@ false_positives = [
     uncommon.
     """,
 ]
+from = "now-9m"
 index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"

rules/linux/linux_iodine_activity.toml

@@ -16,6 +16,7 @@ false_positives = [
     uncommon.
     """,
 ]
+from = "now-9m"
 index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"

rules/linux/linux_mknod_activity.toml

@@ -16,6 +16,7 @@ false_positives = [
     scripts, automation tools, and frameworks. Usage by web servers is more likely to be suspicious.
     """,
 ]
+from = "now-9m"
 index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"

rules/linux/linux_netcat_network_connection.toml

@@ -18,6 +18,7 @@ false_positives = [
     originate from scripts, automation tools, and frameworks.
     """,
 ]
+from = "now-9m"
 index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"

rules/linux/linux_nmap_activity.toml

@@ -18,6 +18,7 @@ false_positives = [
     uncommon.
     """,
 ]
+from = "now-9m"
 index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"

rules/linux/linux_nping_activity.toml

@@ -16,6 +16,7 @@ false_positives = [
     is usually not routine or unannounced. Use of `Nping` by non-engineers or ordinary users is uncommon.
     """,
 ]
+from = "now-9m"
 index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"

rules/linux/linux_process_started_in_temp_directory.toml

@@ -13,6 +13,7 @@ false_positives = [
     username.
     """,
 ]
+from = "now-9m"
 index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"

rules/linux/linux_socat_activity.toml

@@ -17,6 +17,7 @@ false_positives = [
     more likely to be suspicious.
     """,
 ]
+from = "now-9m"
 index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"

rules/linux/linux_strace_activity.toml

@@ -16,6 +16,7 @@ false_positives = [
     originate from developers or SREs engaged in debugging or system call tracing.
     """,
 ]
+from = "now-9m"
 index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"

rules/linux/persistence_kernel_module_activity.toml

@@ -13,6 +13,7 @@ false_positives = [
     programs by ordinary users is uncommon.
     """,
 ]
+from = "now-9m"
 index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"

rules/linux/persistence_shell_activity_by_web_server.toml

@@ -13,6 +13,7 @@ false_positives = [
     behavior.
     """,
 ]
+from = "now-9m"
 index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"

rules/linux/privilege_escalation_setgid_bit_set_via_chmod.toml

@@ -12,6 +12,7 @@ group. An adversary can take advantage of this to either do a shell escape or ex
 with the setgid bit to get code running in a different user’s context. Additionally, adversaries can use this mechanism
 on their own malware to make sure they're able to execute in elevated contexts in the future.
 """
+from = "now-9m"
 index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "lucene"
 license = "Elastic License"

rules/linux/privilege_escalation_setuid_bit_set_via_chmod.toml

@@ -12,6 +12,7 @@ user. An adversary can take advantage of this to either do a shell escape or exp
 with the setuid bit to get code running in a different user’s context. Additionally, adversaries can use this mechanism
 on their own malware to make sure they're able to execute in elevated contexts in the future.
 """
+from = "now-9m"
 index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "lucene"
 license = "Elastic License"

rules/linux/privilege_escalation_sudoers_file_mod.toml

@@ -10,6 +10,7 @@ description = """
 A sudoers file specifies the commands that users or groups can run and from which terminals. Adversaries can take
 advantage of these configurations to execute commands as other users or spawn processes with higher privileges.
 """
+from = "now-9m"
 index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"