security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[Rule Tuning] Tighten up Indexes of Elastic Defend Windows Rules (#3549)

Browse Source 
* [Rule Tuning] Tighten up Indexes of Elastic Defend Windows Rules

* Delete test.pkl

---------

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
This commit is contained in:
Jonhnathan
2024-04-01 20:45:12 -03:00
committed by GitHub
parent 67ca13c1ce
commit b47b91b9ec
223 changed files with 445 additions and 445 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/collection_email_outlook_mailbox_via_com.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.4.0"
updated_date = "2023/10/16"
updated_date = "2024/03/28"
[rule]
author = ["Elastic"]
@@ -13,7 +13,7 @@ Detects Inter-Process Communication with Outlook via Component Object Model from
sensitive information or send email on their behalf via API.
"""
from = "now-9m"
index = ["logs-endpoint.events.*"]
index = ["logs-endpoint.events.process*"]
language = "eql"
license = "Elastic License v2"
name = "Suspicious Inter-Process Communication via Outlook"
rules/windows/collection_email_powershell_exchange_mailbox.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows", "system"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/08"
updated_date = "2024/03/28"
[rule]
author = ["Elastic"]
@@ -14,7 +14,7 @@ mailbox or archive to a .pst file. Adversaries may target user email to collect
"""
false_positives = ["Legitimate exchange system administration activity."]
from = "now-9m"
index = ["logs-endpoint.events.*", "winlogbeat-*", "logs-windows.*", "endgame-*", "logs-system.security*"]
index = ["logs-endpoint.events.process-*", "winlogbeat-*", "logs-windows.*", "endgame-*", "logs-system.security*"]
language = "eql"
license = "Elastic License v2"
name = "Exporting Exchange Mailbox via PowerShell"
rules/windows/collection_winrar_encryption.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/08"
updated_date = "2024/03/28"
[rule]
author = ["Elastic"]
@@ -13,7 +13,7 @@ Identifies use of WinRar or 7z to create an encrypted files. Adversaries will of
preparation for exfiltration.
"""
from = "now-9m"
index = ["logs-endpoint.events.*", "winlogbeat-*", "logs-windows.*", "endgame-*"]
index = ["logs-endpoint.events.process-*", "winlogbeat-*", "logs-windows.*", "endgame-*"]
language = "eql"
license = "Elastic License v2"
name = "Encrypting Files with WinRar or 7z"
rules/windows/command_and_control_certreq_postdata.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows", "system"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/01/16"
updated_date = "2024/03/28"
[transform]
[[transform.osquery]]
@@ -37,7 +37,7 @@ description = """
Identifies Certreq making an HTTP Post request. Adversaries could abuse Certreq to download files or upload data to a remote URL.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*", "logs-system.security*"]
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.*", "endgame-*", "logs-system.security*"]
language = "eql"
license = "Elastic License v2"
name = "Potential File Transfer via Certreq"
rules/windows/command_and_control_common_webservices.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/12/07"
updated_date = "2024/03/28"
[transform]
[[transform.osquery]]
@@ -73,7 +73,7 @@ allows the adversary to blend into legitimate traffic activity. These popular se
have most likely been used before compromise, which helps malicious traffic blend in.
"""
from = "now-9m"
index = ["logs-endpoint.events.*"]
index = ["logs-endpoint.events.network-*"]
language = "eql"
license = "Elastic License v2"
name = "Connection to Commonly Abused Web Services"
rules/windows/command_and_control_dns_tunneling_nslookup.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows", "system"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/01/16"
updated_date = "2024/03/28"
[rule]
author = ["Elastic"]
@@ -13,7 +13,7 @@ This rule identifies a large number (15) of nslookup.exe executions with an expl
may indicate command and control activity utilizing the DNS protocol.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*", "logs-system.security*"]
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.*", "endgame-*", "logs-system.security*"]
language = "eql"
license = "Elastic License v2"
name = "Potential DNS Tunneling via NsLookup"
rules/windows/command_and_control_encrypted_channel_freesslcert.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/08"
updated_date = "2024/03/28"
[rule]
author = ["Elastic"]
@@ -13,7 +13,7 @@ Identifies unusual processes connecting to domains using known free SSL certific
encryption algorithm to conceal command and control traffic.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.sysmon_operational-*"]
index = ["winlogbeat-*", "logs-endpoint.events.network-*", "logs-windows.sysmon_operational-*"]
language = "eql"
license = "Elastic License v2"
name = "Connection to Commonly Abused Free SSL Certificate Providers"
rules/windows/command_and_control_ingress_transfer_bits.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/12/19"
updated_date = "2024/03/28"
[transform]
[[transform.osquery]]
@@ -38,7 +38,7 @@ Identifies downloads of executable and archive files via the Windows Background
Adversaries could leverage Windows BITS transfer jobs to download remote payloads.
"""
from = "now-9m"
index = ["logs-endpoint.events.*"]
index = ["logs-endpoint.events.file-*"]
language = "eql"
license = "Elastic License v2"
name = "Ingress Transfer via Windows BITS"
rules/windows/command_and_control_port_forwarding_added_registry.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/08"
updated_date = "2024/03/28"
[rule]
author = ["Elastic"]
@@ -13,7 +13,7 @@ Identifies the creation of a new port forwarding rule. An adversary may abuse th
segmentation restrictions.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.sysmon_operational-*", "endgame-*"]
index = ["winlogbeat-*", "logs-endpoint.events.registry-*", "logs-windows.sysmon_operational-*", "endgame-*"]
language = "eql"
license = "Elastic License v2"
name = "Port Forwarding Rule Addition"
rules/windows/command_and_control_rdp_tunnel_plink.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/08"
updated_date = "2024/03/28"
[rule]
author = ["Elastic"]
@@ -13,7 +13,7 @@ Identifies potential use of an SSH utility to establish RDP over a reverse SSH T
enable routing of network packets that would otherwise not reach their intended destination.
"""
from = "now-9m"
index = ["logs-endpoint.events.*", "winlogbeat-*", "logs-windows.*", "endgame-*", "logs-system.security*"]
index = ["logs-endpoint.events.process-*", "winlogbeat-*", "logs-windows.*", "endgame-*", "logs-system.security*"]
language = "eql"
license = "Elastic License v2"
name = "Potential Remote Desktop Tunneling Detected"
rules/windows/command_and_control_remote_file_copy_desktopimgdownldr.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/09/03"
integration = ["endpoint", "windows", "system"]
maturity = "production"
updated_date = "2024/01/16"
updated_date = "2024/03/28"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
@@ -70,7 +70,7 @@ Identifies the desktopimgdownldr utility being used to download a remote file. A
download arbitrary files as an alternative to certutil.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*", "logs-system.security*"]
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.*", "endgame-*", "logs-system.security*"]
language = "eql"
license = "Elastic License v2"
name = "Remote File Download via Desktopimgdownldr Utility"
rules/windows/command_and_control_remote_file_copy_mpcmdrun.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/09/03"
integration = ["endpoint", "windows", "system"]
maturity = "production"
updated_date = "2024/01/16"
updated_date = "2024/03/28"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
@@ -67,7 +67,7 @@ providers = [
author = ["Elastic"]
description = "Identifies the Windows Defender configuration utility (MpCmdRun.exe) being used to download a remote file."
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*", "logs-system.security*"]
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.*", "endgame-*", "logs-system.security*"]
language = "eql"
license = "Elastic License v2"
name = "Remote File Download via MpCmdRun"
rules/windows/command_and_control_screenconnect_childproc.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2024/03/27"
integration = ["endpoint", "windows"]
maturity = "production"
updated_date = "2024/03/27"
updated_date = "2024/03/28"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
@@ -14,7 +14,7 @@ Identifies suspicious processes being spawned by the ScreenConnect client proces
abusing unauthorized access to the ScreenConnect remote access software.
"""
from = "now-9m"
index = ["logs-endpoint.events.*", "winlogbeat-*", "logs-windows.sysmon_operational-*", "logs-system.security*", "endgame-*"]
index = ["logs-endpoint.events.process-*", "winlogbeat-*", "logs-windows.sysmon_operational-*", "logs-system.security*", "endgame-*"]
language = "eql"
license = "Elastic License v2"
name = "Suspicious ScreenConnect Client Child Process"
rules/windows/command_and_control_sunburst_c2_activity_detected.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/06/22"
updated_date = "2024/03/28"
[transform]
[[transform.osquery]]
@@ -39,7 +39,7 @@ The malware known as SUNBURST targets the SolarWind's Orion business software fo
post-exploitation command and control activity of the SUNBURST backdoor.
"""
from = "now-9m"
index = ["logs-endpoint.events.*"]
index = ["logs-endpoint.events.network-*"]
language = "eql"
license = "Elastic License v2"
name = "SUNBURST Command and Control Activity"
rules/windows/command_and_control_teamviewer_remote_file_copy.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/09/02"
integration = ["endpoint"]
maturity = "production"
updated_date = "2024/03/08"
updated_date = "2024/03/28"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
@@ -36,7 +36,7 @@ authenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.resu
author = ["Elastic"]
description = "Identifies an executable or script file remotely downloaded via a TeamViewer transfer session."
from = "now-9m"
index = ["logs-endpoint.events.*"]
index = ["logs-endpoint.events.file-*"]
language = "eql"
license = "Elastic License v2"
name = "Remote File Copy via TeamViewer"
rules/windows/credential_access_cmdline_dump_tool.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/08"
updated_date = "2024/03/28"
[rule]
author = ["Elastic"]
@@ -13,7 +13,7 @@ Identifies the execution of known Windows utilities often abused to dump LSASS m
(NTDS.dit) in preparation for credential access.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*", "logs-system.security*"]
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.*", "endgame-*", "logs-system.security*"]
language = "eql"
license = "Elastic License v2"
name = "Potential Credential Access via Windows Utilities"
rules/windows/credential_access_copy_ntds_sam_volshadowcp_cmdline.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows", "system"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/01/16"
updated_date = "2024/03/28"
[transform]
[[transform.osquery]]
@@ -38,7 +38,7 @@ Identifies a copy operation of the Active Directory Domain Database (ntds.dit) o
Those files contain sensitive information including hashed domain and/or local credentials.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*", "logs-system.security*"]
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.*", "endgame-*", "logs-system.security*"]
language = "eql"
license = "Elastic License v2"
max_signals = 33
rules/windows/credential_access_domain_backup_dpapi_private_keys.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/08"
updated_date = "2024/03/28"
[rule]
author = ["Elastic"]
@@ -13,7 +13,7 @@ Identifies the creation or modification of Domain Backup private keys. Adversari
(DPAPI) domain backup key from a Domain Controller (DC) to be able to decrypt any domain user master key file.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.sysmon_operational-*", "endgame-*"]
index = ["winlogbeat-*", "logs-endpoint.events.file-*", "logs-windows.sysmon_operational-*", "endgame-*"]
language = "eql"
license = "Elastic License v2"
name = "Creation or Modification of Domain Backup DPAPI private key"
rules/windows/credential_access_dump_registry_hives.toml
+2 -2
View File
@@ -4,13 +4,13 @@ integration = ["endpoint", "windows", "system"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/01/16"
updated_date = "2024/03/28"
[rule]
author = ["Elastic"]
description = "Identifies attempts to export a registry hive which may contain credentials using the Windows reg.exe tool."
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*", "logs-system.security*"]
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.*", "endgame-*", "logs-system.security*"]
language = "eql"
license = "Elastic License v2"
name = "Credential Acquisition via Registry Hive Dumping"
rules/windows/credential_access_generic_localdumps.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/08"
updated_date = "2024/03/28"
[rule]
author = ["Elastic"]
@@ -16,7 +16,7 @@ the credentials present on the system without having to bring malware to the sys
default, and applications must create their registry subkeys to hold settings that enable them to collect dumps.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.sysmon_operational-*", "endgame-*"]
index = ["winlogbeat-*", "logs-endpoint.events.registry-*", "logs-windows.sysmon_operational-*", "endgame-*"]
language = "eql"
license = "Elastic License v2"
name = "Full User-Mode Dumps Enabled System-Wide"
rules/windows/credential_access_iis_apppoolsa_pwd_appcmd.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows", "system"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/01/16"
updated_date = "2024/03/28"
[rule]
author = ["Elastic"]
@@ -13,7 +13,7 @@ Identifies the Internet Information Services (IIS) command-line tool, AppCmd, be
with IIS web server access via a web shell can decrypt and dump the IIS AppPool service account password using AppCmd.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*", "logs-system.security*"]
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.*", "endgame-*", "logs-system.security*"]
language = "eql"
license = "Elastic License v2"
max_signals = 33
rules/windows/credential_access_iis_connectionstrings_dumping.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows", "system"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/01/16"
updated_date = "2024/03/28"
[rule]
author = ["Elastic"]
@@ -14,7 +14,7 @@ access via a webshell or alike can decrypt and dump any hardcoded connection str
password using aspnet_regiis command.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*", "logs-system.security*"]
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.*", "endgame-*", "logs-system.security*"]
language = "eql"
license = "Elastic License v2"
max_signals = 33
rules/windows/credential_access_kerberoasting_unusual_process.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/11/02"
integration = ["endpoint"]
maturity = "production"
updated_date = "2023/10/23"
updated_date = "2024/03/28"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
@@ -44,7 +44,7 @@ false_positives = [
""",
]
from = "now-9m"
index = ["logs-endpoint.events.*"]
index = ["logs-endpoint.events.network-*"]
language = "eql"
license = "Elastic License v2"
name = "Kerberos Traffic from Unusual Process"
rules/windows/credential_access_kirbi_file.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/08"
updated_date = "2024/03/28"
[rule]
author = ["Elastic"]
@@ -15,7 +15,7 @@ attacker to impersonate users using Kerberos tickets.
"""
from = "now-9m"
interval = "60m"
index = ["logs-endpoint.events.*", "logs-windows.sysmon_operational-*"]
index = ["logs-endpoint.events.file-*", "logs-windows.sysmon_operational-*"]
language = "eql"
license = "Elastic License v2"
name = "Kirbi File Creation"
rules/windows/credential_access_lsass_loaded_susp_dll.toml
+2 -2
View File
@@ -4,7 +4,7 @@ maturity = "production"
integration = ["endpoint"]
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/12/14"
updated_date = "2024/03/28"
[rule]
author = ["Elastic"]
@@ -14,7 +14,7 @@ LSSAS process at system start. Once loaded into the LSA, SSP DLLs have access to
are stored in Windows, such as any logged-on user's Domain password or smart card PINs.
"""
from = "now-9m"
index = ["logs-endpoint.events.*"]
index = ["logs-endpoint.events.library-*"]
language = "eql"
license = "Elastic License v2"
name = "Suspicious Module Loaded by LSASS"
rules/windows/credential_access_lsass_memdump_file_created.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/08"
updated_date = "2024/03/28"
[transform]
[[transform.osquery]]
@@ -40,7 +40,7 @@ indicate a credential access attempt via trusted system utilities such as Task M
(sqldumper.exe) or known pentesting tools such as Dumpert and AndrewSpecial.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.sysmon_operational-*", "endgame-*"]
index = ["winlogbeat-*", "logs-endpoint.events.file-*", "logs-windows.sysmon_operational-*", "endgame-*"]
language = "eql"
license = "Elastic License v2"
name = "LSASS Memory Dump Creation"
rules/windows/credential_access_lsass_openprocess_api.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint"]
maturity = "production"
min_stack_comments = "New fields added: Lsass access events added in Elastic Endpoint 8.7."
min_stack_version = "8.7.0"
updated_date = "2023/11/03"
updated_date = "2024/03/28"
[transform]
[[transform.osquery]]
@@ -37,7 +37,7 @@ description = """
Identifies access attempts to the LSASS handle, which may indicate an attempt to dump credentials from LSASS memory.
"""
from = "now-9m"
index = ["logs-endpoint.events.*"]
index = ["logs-endpoint.events.api-*"]
language = "eql"
license = "Elastic License v2"
name = "LSASS Process Access via Windows API"
rules/windows/credential_access_mimikatz_memssp_default_logs.toml
+2 -2
View File
@@ -4,13 +4,13 @@ integration = ["endpoint", "windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/08"
updated_date = "2024/03/28"
[rule]
author = ["Elastic"]
description = "Identifies the password log file from the default Mimikatz memssp module."
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.sysmon_operational-*", "endgame-*"]
index = ["winlogbeat-*", "logs-endpoint.events.file-*", "logs-windows.sysmon_operational-*", "endgame-*"]
language = "eql"
license = "Elastic License v2"
name = "Mimikatz Memssp Log File Detected"
rules/windows/credential_access_mod_wdigest_security_provider.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/08"
updated_date = "2024/03/28"
[rule]
author = ["Elastic"]
@@ -15,7 +15,7 @@ an endpoint. Once the UseLogonCredential value is modified, the adversary may at
memory.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.sysmon_operational-*", "endgame-*"]
index = ["winlogbeat-*", "logs-endpoint.events.registry-*", "logs-windows.sysmon_operational-*", "endgame-*"]
language = "eql"
license = "Elastic License v2"
name = "Modification of WDigest Security Provider"
rules/windows/credential_access_moving_registry_hive_via_smb.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/10/23"
updated_date = "2024/03/28"
[rule]
author = ["Elastic"]
@@ -14,7 +14,7 @@ may indicate an exfiltration attempt of a previously dumped Security Account Man
extraction on an attacker-controlled system.
"""
from = "now-9m"
index = ["logs-endpoint.events.*"]
index = ["logs-endpoint.events.file-*"]
language = "eql"
license = "Elastic License v2"
name = "Windows Registry File Creation in SMB Share"
rules/windows/credential_access_persistence_network_logon_provider_modification.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/08"
updated_date = "2024/03/28"
[transform]
[[transform.osquery]]
@@ -40,7 +40,7 @@ during user logon.
"""
false_positives = ["Authorized third party network logon providers."]
from = "now-9m"
index = ["logs-endpoint.events.*", "endgame-*", "logs-windows.sysmon_operational-*"]
index = ["logs-endpoint.events.registry-*", "endgame-*", "logs-windows.sysmon_operational-*"]
language = "eql"
license = "Elastic License v2"
name = "Network Logon Provider Registry Modification"
rules/windows/credential_access_relay_ntlm_auth_via_http_spoolss.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/08"
updated_date = "2024/03/28"
[rule]
author = ["Elastic"]
@@ -13,7 +13,7 @@ Identifies attempt to coerce a local NTLM authentication via HTTP using the Wind
An adversary may use this primitive in combination with other techniques to elevate privileges on a compromised system.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*", "logs-system.security*"]
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.*", "endgame-*", "logs-system.security*"]
language = "eql"
license = "Elastic License v2"
name = "Potential Local NTLM Relay via HTTP"
rules/windows/credential_access_remote_sam_secretsdump.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/10/23"
updated_date = "2024/03/28"
[rule]
author = ["Elastic"]
@@ -13,7 +13,7 @@ Identifies remote access to the registry to potentially dump credential data fro
registry hive in preparation for credential access and privileges elevation.
"""
from = "now-9m"
index = ["logs-endpoint.events.*"]
index = ["logs-endpoint.events.file-*"]
language = "eql"
license = "Elastic License v2"
name = "Potential Remote Credential Access via Registry"
rules/windows/credential_access_saved_creds_vaultcmd.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/08"
updated_date = "2024/03/28"
[rule]
author = ["Elastic"]
@@ -14,7 +14,7 @@ applications, and networks. An adversary may abuse this to list or dump credenti
saved usernames and passwords. This may also be performed in preparation of lateral movement.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*", "logs-system.security*"]
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.*", "endgame-*", "logs-system.security*"]
language = "eql"
license = "Elastic License v2"
name = "Searching for Saved Credentials via VaultCmd"
rules/windows/credential_access_symbolic_link_to_shadow_copy_created.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/08"
updated_date = "2024/03/28"
[rule]
author = ["Elastic", "Austin Songer"]
@@ -14,7 +14,7 @@ copy, including sensitive files such as ntds.dit, System Boot Key and browser of
"""
false_positives = ["Legitimate administrative activity related to shadow copies."]
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*", "logs-system.security*"]
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.*", "endgame-*", "logs-system.security*"]
language = "eql"
license = "Elastic License v2"
name = "Symbolic Link to Shadow Copy Created"
rules/windows/credential_access_veeam_backup_dll_imageload.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/14"
updated_date = "2024/03/28"
[rule]
author = ["Elastic"]
@@ -14,7 +14,7 @@ library. Attackers can use Veeam Credentials to target backups as part of destru
attacks.
"""
from = "now-9m"
index = ["logs-endpoint.events.library*"]
index = ["logs-endpoint.events.library-*"]
language = "eql"
license = "Elastic License v2"
name = "Veeam Backup Library Loaded by Unusual Process"
rules/windows/credential_access_wireless_creds_dumping.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows", "system"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/01/16"
updated_date = "2024/03/28"
[transform]
[[transform.osquery]]
@@ -36,7 +36,7 @@ authenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.resu
author = ["Elastic"]
description = "Identifies attempts to dump Wireless saved access keys in clear text using the Windows built-in utility Netsh."
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*", "logs-system.security*"]
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.*", "endgame-*", "logs-system.security*"]
language = "eql"
license = "Elastic License v2"
name = "Wireless Credential Dumping using Netsh Command"
rules/windows/defense_evasion_adding_the_hidden_file_attribute_with_via_attribexe.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows", "system"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/01/16"
updated_date = "2024/03/28"
[transform]
[[transform.osquery]]
@@ -35,7 +35,7 @@ authenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.resu
author = ["Elastic"]
description = "Adversaries can add the 'hidden' attribute to files to hide them from the user in an attempt to evade detection."
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*", "logs-system.security*"]
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.*", "endgame-*", "logs-system.security*"]
language = "eql"
license = "Elastic License v2"
name = "Adding Hidden File Attribute via Attrib"
rules/windows/defense_evasion_amsi_bypass_dllhijack.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["windows", "endpoint"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/08"
updated_date = "2024/03/28"
[transform]
[[transform.osquery]]
@@ -39,7 +39,7 @@ Identifies the creation of the Antimalware Scan Interface (AMSI) DLL in an unusu
attempt to bypass AMSI by loading a rogue AMSI module instead of the legit one.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.sysmon_operational-*", "endgame-*"]
index = ["winlogbeat-*", "logs-endpoint.events.file-*", "logs-windows.sysmon_operational-*", "endgame-*"]
language = "eql"
license = "Elastic License v2"
name = "Suspicious Antimalware Scan Interface DLL"
rules/windows/defense_evasion_amsienable_key_mod.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/08"
updated_date = "2024/03/28"
[rule]
author = ["Elastic"]
@@ -13,7 +13,7 @@ Identifies modifications of the AmsiEnable registry key to 0, which disables the
adversary can modify this key to disable AMSI protections.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.sysmon_operational-*", "endgame-*"]
index = ["winlogbeat-*", "logs-endpoint.events.registry-*", "logs-windows.sysmon_operational-*", "endgame-*"]
language = "eql"
license = "Elastic License v2"
name = "Modification of AmsiEnable Registry Key"
rules/windows/defense_evasion_clearing_windows_console_history.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows", "system"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/01/16"
updated_date = "2024/03/28"
[rule]
author = ["Austin Songer"]
@@ -13,7 +13,7 @@ Identifies when a user attempts to clear console history. An adversary may clear
account to conceal the actions undertaken during an intrusion.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*", "logs-system.security*"]
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.*", "endgame-*", "logs-system.security*"]
language = "eql"
license = "Elastic License v2"
name = "Clearing Windows Console History"
rules/windows/defense_evasion_clearing_windows_event_logs.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows", "system"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/01/16"
updated_date = "2024/03/28"
[rule]
author = ["Elastic"]
@@ -13,7 +13,7 @@ Identifies attempts to clear or disable Windows event log stores using Windows w
attackers in an attempt to evade detection or destroy forensic evidence on a system.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*", "logs-system.security*"]
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.*", "endgame-*", "logs-system.security*"]
language = "eql"
license = "Elastic License v2"
name = "Clearing Windows Event Logs"
rules/windows/defense_evasion_code_signing_policy_modification_builtin_tools.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows", "system"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/01/16"
updated_date = "2024/03/28"
[transform]
[[transform.osquery]]
@@ -27,7 +27,7 @@ authenticity on a program, and grants the user with the ability to check whether
By allowing the execution of unsigned or self-signed code, threat actors can craft and execute malicious code.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*", "logs-system.security*"]
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.*", "endgame-*", "logs-system.security*"]
language = "eql"
license = "Elastic License v2"
name = "Code Signing Policy Modification Through Built-in tools"
rules/windows/defense_evasion_code_signing_policy_modification_registry.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/08"
updated_date = "2024/03/28"
[transform]
[[transform.osquery]]
@@ -27,7 +27,7 @@ program, and grants the user with the ability to check whether the program has b
execution of unsigned or self-signed code, threat actors can craft and execute malicious code.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.sysmon_operational-*", "endgame-*"]
index = ["winlogbeat-*", "logs-endpoint.events.registry-*", "logs-windows.sysmon_operational-*", "endgame-*"]
language = "eql"
license = "Elastic License v2"
name = "Code Signing Policy Modification Through Registry"
rules/windows/defense_evasion_create_mod_root_certificate.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/08"
updated_date = "2024/03/28"
[rule]
author = ["Elastic"]
@@ -15,7 +15,7 @@ certificate would allow an attacker the ability to masquerade malicious files as
"""
false_positives = ["Certain applications may install root certificates for the purpose of inspecting SSL traffic."]
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.sysmon_operational-*", "endgame-*"]
index = ["winlogbeat-*", "logs-endpoint.events.registry-*", "logs-windows.sysmon_operational-*", "endgame-*"]
language = "eql"
license = "Elastic License v2"
name = "Creation or Modification of Root Certificate"
rules/windows/defense_evasion_defender_disabled_via_registry.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/08"
updated_date = "2024/03/28"
[rule]
author = ["Elastic"]
@@ -13,7 +13,7 @@ Identifies modifications to the Windows Defender registry settings to disable th
started manually.
"""
from = "now-9m"
index = ["logs-endpoint.events.*", "endgame-*", "logs-windows.sysmon_operational-*"]
index = ["logs-endpoint.events.registry-*", "endgame-*", "logs-windows.sysmon_operational-*"]
language = "eql"
license = "Elastic License v2"
name = "Windows Defender Disabled via Registry Modification"
rules/windows/defense_evasion_defender_exclusion_via_powershell.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows", "system"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/01/16"
updated_date = "2024/03/28"
[rule]
author = ["Elastic"]
@@ -13,7 +13,7 @@ Identifies modifications to the Windows Defender configuration settings using Po
directory or process level.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*", "logs-system.security*"]
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.*", "endgame-*", "logs-system.security*"]
language = "eql"
license = "Elastic License v2"
name = "Windows Defender Exclusions Added via PowerShell"
rules/windows/defense_evasion_delete_volume_usn_journal_with_fsutil.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows", "system"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/01/16"
updated_date = "2024/03/28"
[rule]
author = ["Elastic"]
@@ -13,7 +13,7 @@ Identifies use of the fsutil.exe to delete the volume USNJRNL. This technique is
of files created during post-exploitation activities.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*", "logs-system.security*"]
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.*", "endgame-*", "logs-system.security*"]
language = "eql"
license = "Elastic License v2"
name = "Delete Volume USN Journal with Fsutil"
rules/windows/defense_evasion_disable_posh_scriptblocklogging.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/08"
updated_date = "2024/03/28"
[rule]
author = ["Elastic"]
@@ -13,7 +13,7 @@ Identifies attempts to disable PowerShell Script Block Logging via registry modi
logging to conceal their activities in the host and evade detection.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.sysmon_operational-*", "endgame-*"]
index = ["winlogbeat-*", "logs-endpoint.events.registry-*", "logs-windows.sysmon_operational-*", "endgame-*"]
language = "eql"
license = "Elastic License v2"
name = "PowerShell Script Block Logging Disabled"
rules/windows/defense_evasion_disable_windows_firewall_rules_with_netsh.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows", "system"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/01/16"
updated_date = "2024/03/28"
[rule]
author = ["Elastic"]
@@ -13,7 +13,7 @@ Identifies use of the netsh.exe to disable or weaken the local firewall. Attacke
disable the firewall during troubleshooting or to enable network mobility.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*", "logs-system.security*"]
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.*", "endgame-*", "logs-system.security*"]
language = "eql"
license = "Elastic License v2"
name = "Disable Windows Firewall Rules via Netsh"
rules/windows/defense_evasion_disabling_windows_defender_powershell.toml
+2 -2
View File
@@ -4,14 +4,14 @@ integration = ["endpoint", "windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/08"
updated_date = "2024/03/28"
[rule]
author = ["Elastic"]
description = "Identifies use of the Set-MpPreference PowerShell command to disable or weaken certain Windows Defender settings."
false_positives = ["Planned Windows Defender configuration changes."]
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*", "logs-system.security*"]
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.*", "endgame-*", "logs-system.security*"]
language = "eql"
license = "Elastic License v2"
name = "Disabling Windows Defender Security Settings via PowerShell"
rules/windows/defense_evasion_disabling_windows_logs.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows", "system"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/01/16"
updated_date = "2024/03/28"
[rule]
author = ["Elastic", "Ivan Ninichuck", "Austin Songer"]
@@ -13,7 +13,7 @@ Identifies attempts to disable EventLog via the logman Windows utility, PowerShe
attackers in an attempt to evade detection on a system.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*", "logs-system.security*"]
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.*", "endgame-*", "logs-system.security*"]
language = "eql"
license = "Elastic License v2"
name = "Disable Windows Event and Security Logs Using Built-in Tools"
rules/windows/defense_evasion_dns_over_https_enabled.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/08"
updated_date = "2024/03/28"
[rule]
author = ["Austin Songer"]
@@ -14,7 +14,7 @@ data. With this enabled, an organization will lose visibility into data such as
IP, which are used to determine bad actors.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.sysmon_operational-*", "endgame-*"]
index = ["winlogbeat-*", "logs-endpoint.events.registry-*", "logs-windows.sysmon_operational-*", "endgame-*"]
language = "eql"
license = "Elastic License v2"
name = "DNS-over-HTTPS Enabled via Registry"
rules/windows/defense_evasion_dotnet_compiler_parent_process.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/08"
updated_date = "2024/03/28"
[rule]
author = ["Elastic"]
@@ -13,7 +13,7 @@ Identifies executions of .NET compilers with suspicious parent processes, which
to compile code after delivery in order to bypass security mechanisms.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*", "logs-system.security*"]
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.*", "endgame-*", "logs-system.security*"]
language = "eql"
license = "Elastic License v2"
name = "Suspicious .NET Code Compilation"
rules/windows/defense_evasion_enable_inbound_rdp_with_netsh.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows", "system"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/01/16"
updated_date = "2024/03/28"
[rule]
author = ["Elastic"]
@@ -13,7 +13,7 @@ Identifies use of the network shell utility (netsh.exe) to enable inbound Remote
the Windows Firewall.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*", "logs-system.security*"]
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.*", "endgame-*", "logs-system.security*"]
language = "eql"
license = "Elastic License v2"
name = "Remote Desktop Enabled in Windows Firewall by Netsh"
rules/windows/defense_evasion_enable_network_discovery_with_netsh.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/08"
updated_date = "2024/03/28"
[rule]
author = ["Elastic"]
@@ -14,7 +14,7 @@ tool to weaken the host firewall settings.
"""
false_positives = ["Host Windows Firewall planned system administration changes."]
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*", "logs-system.security*"]
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.*", "endgame-*", "logs-system.security*"]
language = "eql"
license = "Elastic License v2"
name = "Enable Host Network Discovery via Netsh"
rules/windows/defense_evasion_execution_control_panel_suspicious_args.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows", "system"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/01/16"
updated_date = "2024/03/28"
[rule]
author = ["Elastic"]
@@ -13,7 +13,7 @@ Identifies unusual instances of Control Panel with suspicious keywords or paths
Adversaries may abuse control.exe to proxy execution of malicious code.
"""
from = "now-9m"
index = ["logs-endpoint.events.*", "winlogbeat-*", "logs-windows.*", "endgame-*", "logs-system.security*"]
index = ["logs-endpoint.events.process-*", "winlogbeat-*", "logs-windows.*", "endgame-*", "logs-system.security*"]
language = "eql"
license = "Elastic License v2"
name = "Control Panel Process with Unusual Arguments"
rules/windows/defense_evasion_execution_lolbas_wuauclt.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows", "system"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/11/14"
updated_date = "2024/03/28"
[transform]
[[transform.osquery]]
@@ -38,7 +38,7 @@ Identifies abuse of the Windows Update Auto Update Client (wuauclt.exe) to load
as a defense evasion technique to blend-in malicious activity with legitimate Windows software.
"""
from = "now-9m"
index = ["logs-endpoint.events.*", "winlogbeat-*", "logs-windows.*", "endgame-*", "logs-system.security*"]
index = ["logs-endpoint.events.process-*", "winlogbeat-*", "logs-windows.*", "endgame-*", "logs-system.security*"]
language = "eql"
license = "Elastic License v2"
name = "ImageLoad via Windows Update Auto Update Client"
rules/windows/defense_evasion_execution_msbuild_started_by_office_app.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/08"
updated_date = "2024/03/28"
[rule]
author = ["Elastic"]
@@ -19,7 +19,7 @@ false_positives = [
""",
]
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*", "logs-system.security*"]
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.*", "endgame-*", "logs-system.security*"]
language = "eql"
license = "Elastic License v2"
name = "Microsoft Build Engine Started by an Office Application"
rules/windows/defense_evasion_execution_msbuild_started_by_script.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows"]
maturity = "production"
min_stack_comments = "Multiple field support in the New Terms rule type was added in Elastic 8.6"
min_stack_version = "8.6.0"
updated_date = "2023/10/23"
updated_date = "2024/03/28"
[rule]
author = ["Elastic"]
@@ -14,7 +14,7 @@ behavior is unusual and is sometimes used by malicious payloads.
"""
false_positives = ["The Build Engine is commonly used by Windows developers but use by non-engineers is unusual."]
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*"]
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.*"]
language = "kuery"
license = "Elastic License v2"
name = "Microsoft Build Engine Started by a Script Process"
rules/windows/defense_evasion_execution_msbuild_started_by_system_process.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/08"
updated_date = "2024/03/28"
[rule]
author = ["Elastic"]
@@ -14,7 +14,7 @@ Instrumentation) subsystem. This behavior is unusual and is sometimes used by ma
"""
false_positives = ["The Build Engine is commonly used by Windows developers but use by non-engineers is unusual."]
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*", "logs-system.security*"]
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.*", "endgame-*", "logs-system.security*"]
language = "eql"
license = "Elastic License v2"
name = "Microsoft Build Engine Started by a System Process"
rules/windows/defense_evasion_execution_msbuild_started_renamed.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/08"
updated_date = "2024/03/28"
[transform]
[[transform.osquery]]
@@ -40,7 +40,7 @@ indicate an attempt to run unnoticed or undetected.
"""
false_positives = ["The Build Engine is commonly used by Windows developers but use by non-engineers is unusual."]
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.sysmon_operational-*", "endgame-*"]
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.sysmon_operational-*", "endgame-*"]
language = "eql"
license = "Elastic License v2"
name = "Microsoft Build Engine Using an Alternate Name"
rules/windows/defense_evasion_execution_msbuild_started_unusal_process.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows", "system"]
maturity = "production"
min_stack_comments = "Multiple field support in the New Terms rule type was added in Elastic 8.6"
min_stack_version = "8.6.0"
updated_date = "2024/01/16"
updated_date = "2024/03/28"
[rule]
author = ["Elastic"]
@@ -19,7 +19,7 @@ false_positives = [
""",
]
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "logs-system.security*"]
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.*", "logs-system.security*"]
language = "kuery"
license = "Elastic License v2"
name = "Microsoft Build Engine Started an Unusual Process"
rules/windows/defense_evasion_execution_suspicious_explorer_winword.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/08"
updated_date = "2024/03/28"
[rule]
author = ["Elastic"]
@@ -14,7 +14,7 @@ starting after being renamed or from a non-standard path. This is uncommon behav
defenses via side loading a malicious DLL within the memory space of one of those processes.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.sysmon_operational-*", "endgame-*"]
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.sysmon_operational-*", "endgame-*"]
language = "eql"
license = "Elastic License v2"
name = "Potential DLL Side-Loading via Trusted Microsoft Programs"
rules/windows/defense_evasion_execution_windefend_unusual_path.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/08"
updated_date = "2024/03/28"
[rule]
author = ["Elastic", "Dennis Perto"]
@@ -15,7 +15,7 @@ side-loading a malicious DLL within the memory space of one of those processes.
"""
false_positives = ["Microsoft Antimalware Service Executable installed on non default installation path."]
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.sysmon_operational-*", "endgame-*"]
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.sysmon_operational-*", "endgame-*"]
language = "eql"
license = "Elastic License v2"
name = "Potential DLL Side-Loading via Microsoft Antimalware Service Executable"
rules/windows/defense_evasion_file_creation_mult_extension.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/08"
updated_date = "2024/03/28"
[rule]
author = ["Elastic"]
@@ -14,7 +14,7 @@ when the name or location of a file is manipulated as a means of tricking a user
benign file type but is actually executable code.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.sysmon_operational-*", "endgame-*"]
index = ["winlogbeat-*", "logs-endpoint.events.file-*", "logs-windows.sysmon_operational-*", "endgame-*"]
language = "eql"
license = "Elastic License v2"
name = "Executable File Creation with Multiple Extensions"
rules/windows/defense_evasion_from_unusual_directory.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/08"
updated_date = "2024/03/28"
[transform]
[[transform.osquery]]
@@ -38,7 +38,7 @@ Identifies process execution from suspicious default Windows directories. This i
malware in trusted paths.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*", "logs-system.security*"]
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.*", "endgame-*", "logs-system.security*"]
language = "eql"
license = "Elastic License v2"
name = "Process Execution from an Unusual Directory"
rules/windows/defense_evasion_hide_encoded_executable_registry.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/08"
updated_date = "2024/03/28"
[rule]
author = ["Elastic"]
@@ -13,7 +13,7 @@ Identifies registry write modifications to hide an encoded portable executable.
defense evasion by avoiding the storing of malicious content directly on disk.
"""
from = "now-9m"
index = ["logs-endpoint.events.*", "endgame-*", "logs-windows.sysmon_operational-*"]
index = ["logs-endpoint.events.registry-*", "endgame-*", "logs-windows.sysmon_operational-*"]
language = "eql"
license = "Elastic License v2"
name = "Encoded Executable Stored in the Registry"
rules/windows/defense_evasion_iis_httplogging_disabled.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows", "system"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/01/16"
updated_date = "2024/03/28"
[rule]
author = ["Elastic"]
@@ -13,7 +13,7 @@ Identifies when Internet Information Services (IIS) HTTP Logging is disabled on
access via a webshell or other mechanism can disable HTTP Logging as an effective anti-forensics measure.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*", "logs-system.security*"]
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.*", "endgame-*", "logs-system.security*"]
language = "eql"
license = "Elastic License v2"
max_signals = 33
rules/windows/defense_evasion_masquerading_as_elastic_endpoint_process.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/08"
updated_date = "2024/03/28"
[rule]
author = ["Elastic"]
@@ -13,7 +13,7 @@ A suspicious Endpoint Security parent process was detected. This may indicate a
injection.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*", "logs-system.security*"]
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.*", "endgame-*", "logs-system.security*"]
language = "eql"
license = "Elastic License v2"
name = "Suspicious Endpoint Security Parent Process"
rules/windows/defense_evasion_masquerading_business_apps_installer.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/01/11"
updated_date = "2024/03/28"
[rule]
author = ["Elastic"]
@@ -14,7 +14,7 @@ developer. Attackers may trick users into downloading malicious executables that
via malicious ads, forum posts, and tutorials, effectively gaining initial access.
"""
from = "now-9m"
index = ["logs-endpoint.events.*"]
index = ["logs-endpoint.events.process-*"]
language = "eql"
license = "Elastic License v2"
name = "Potential Masquerading as Business App Installer"
rules/windows/defense_evasion_masquerading_communication_apps.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/10/13"
updated_date = "2024/03/28"
[rule]
author = ["Elastic"]
@@ -13,7 +13,7 @@ Identifies suspicious instances of communications apps, both unsigned and rename
conceal malicious activity, bypass security features such as allowlists, or trick users into executing malware.
"""
from = "now-9m"
index = ["logs-endpoint.events.*"]
index = ["logs-endpoint.events.process-*"]
language = "eql"
license = "Elastic License v2"
name = "Potential Masquerading as Communication Apps"
rules/windows/defense_evasion_masquerading_renamed_autoit.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/08"
updated_date = "2024/03/28"
[transform]
[[transform.osquery]]
@@ -39,7 +39,7 @@ Identifies a suspicious AutoIt process execution. Malware written as an AutoIt s
executable to avoid detection.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.sysmon_operational-*", "endgame-*"]
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.sysmon_operational-*", "endgame-*"]
language = "eql"
license = "Elastic License v2"
name = "Renamed AutoIt Scripts Interpreter"
rules/windows/defense_evasion_masquerading_suspicious_werfault_childproc.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/11/13"
updated_date = "2024/03/28"
[rule]
author = ["Elastic"]
@@ -14,7 +14,7 @@ registry key manipulation. Verify process details such as command line, network
"""
false_positives = ["Custom Windows error reporting debugger or applications restarted by WerFault after a crash."]
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*"]
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.*", "endgame-*"]
language = "eql"
license = "Elastic License v2"
name = "Suspicious WerFault Child Process"
rules/windows/defense_evasion_masquerading_trusted_directory.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/08"
updated_date = "2024/03/28"
[rule]
author = ["Elastic"]
@@ -14,7 +14,7 @@ usually host trusted third party programs. An adversary may leverage masqueradin
detections allowlisting those folders.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*", "logs-system.security*"]
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.*", "endgame-*", "logs-system.security*"]
language = "eql"
license = "Elastic License v2"
name = "Program Files Directory Masquerading"
rules/windows/defense_evasion_microsoft_defender_tampering.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/08"
updated_date = "2024/03/28"
[rule]
author = ["Austin Songer"]
@@ -14,7 +14,7 @@ Microsoft Defender features to evade detection and conceal malicious behavior.
"""
false_positives = ["Legitimate Windows Defender configuration changes"]
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.sysmon_operational-*"]
index = ["winlogbeat-*", "logs-endpoint.events.registry-*", "logs-windows.sysmon_operational-*"]
language = "eql"
license = "Elastic License v2"
name = "Microsoft Windows Defender Tampering"
rules/windows/defense_evasion_parent_process_pid_spoofing.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/10/13"
updated_date = "2024/03/28"
[rule]
author = ["Elastic"]
@@ -13,7 +13,7 @@ Identifies parent process spoofing used to thwart detection. Adversaries may spo
of a new process to evade process-monitoring defenses or to elevate privileges.
"""
from = "now-9m"
index = ["logs-endpoint.events.*"]
index = ["logs-endpoint.events.process-*"]
language = "eql"
license = "Elastic License v2"
name = "Parent Process PID Spoofing"
rules/windows/defense_evasion_persistence_account_tokenfilterpolicy.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/08"
updated_date = "2024/03/28"
[rule]
author = ["Elastic"]
@@ -14,7 +14,7 @@ default) and is set to 1, then remote connections from all local members of Admi
high-integrity tokens during negotiation.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.sysmon_operational-*", "endgame-*"]
index = ["winlogbeat-*", "logs-endpoint.events.registry-*", "logs-windows.sysmon_operational-*", "endgame-*"]
language = "eql"
license = "Elastic License v2"
name = "Local Account TokenFilter Policy Disabled"
rules/windows/defense_evasion_powershell_windows_firewall_disabled.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/08"
updated_date = "2024/03/28"
[rule]
author = ["Austin Songer"]
@@ -20,7 +20,7 @@ false_positives = [
""",
]
from = "now-9m"
index = ["logs-endpoint.events.*", "winlogbeat-*", "logs-windows.*", "endgame-*"]
index = ["logs-endpoint.events.process-*", "winlogbeat-*", "logs-windows.*", "endgame-*"]
language = "eql"
license = "Elastic License v2"
name = "Windows Firewall Disabled via PowerShell"
rules/windows/defense_evasion_proxy_execution_via_msdt.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/10/23"
updated_date = "2024/03/28"
[rule]
author = ["Elastic"]
@@ -13,7 +13,7 @@ Identifies potential abuse of the Microsoft Diagnostics Troubleshooting Wizard (
binary execution via malicious process arguments.
"""
from = "now-9m"
index = ["logs-endpoint.events.*", "winlogbeat-*", "logs-windows.*", "endgame-*"]
index = ["logs-endpoint.events.process-*", "winlogbeat-*", "logs-windows.*", "endgame-*"]
language = "eql"
license = "Elastic License v2"
name = "Suspicious Microsoft Diagnostics Wizard Execution"
rules/windows/defense_evasion_rundll32_no_arguments.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/08"
updated_date = "2024/03/28"
[transform]
[[transform.osquery]]
@@ -38,7 +38,7 @@ Identifies child processes of unusual instances of RunDLL32 where the command li
RunDLL32 could indicate malicious activity.
"""
from = "now-60m"
index = ["logs-endpoint.events.*", "winlogbeat-*", "logs-windows.sysmon_operational-*"]
index = ["logs-endpoint.events.process-*", "winlogbeat-*", "logs-windows.sysmon_operational-*"]
interval = "30m"
language = "eql"
license = "Elastic License v2"
rules/windows/defense_evasion_scheduledjobs_at_protocol_enabled.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/08"
updated_date = "2024/03/28"
[rule]
author = ["Elastic"]
@@ -14,7 +14,7 @@ move laterally or persist locally. The AT command has been deprecated since Wind
exists for backwards compatibility.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.sysmon_operational-*", "endgame-*"]
index = ["winlogbeat-*", "logs-endpoint.events.registry-*", "logs-windows.sysmon_operational-*", "endgame-*"]
language = "eql"
license = "Elastic License v2"
name = "Scheduled Tasks AT Command Enabled"
rules/windows/defense_evasion_sdelete_like_filename_rename.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/08"
updated_date = "2024/03/28"
[rule]
author = ["Elastic"]
@@ -13,7 +13,7 @@ Detects file name patterns generated by the use of Sysinternals SDelete utility
file overwrite and rename operations.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.sysmon_operational-*", "endgame-*"]
index = ["winlogbeat-*", "logs-endpoint.events.file-*", "logs-windows.sysmon_operational-*", "endgame-*"]
language = "eql"
license = "Elastic License v2"
name = "Potential Secure File Deletion via SDelete Utility"
rules/windows/defense_evasion_sip_provider_mod.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/08"
updated_date = "2024/03/28"
[rule]
author = ["Elastic"]
@@ -14,7 +14,7 @@ Windows cryptographic system to validate file signatures on the system. This may
validation checks or inject code into critical processes.
"""
from = "now-9m"
index = ["logs-endpoint.events.*", "endgame-*", "logs-windows.sysmon_operational-*"]
index = ["logs-endpoint.events.registry-*", "endgame-*", "logs-windows.sysmon_operational-*"]
language = "eql"
license = "Elastic License v2"
name = "SIP Provider Modification"
rules/windows/defense_evasion_solarwinds_backdoor_service_disabled_via_registry.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/08"
updated_date = "2024/03/28"
[rule]
author = ["Elastic"]
@@ -13,7 +13,7 @@ Identifies a SolarWinds binary modifying the start type of a service to be disab
technique to manipulate relevant security services.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.sysmon_operational-*", "endgame-*"]
index = ["winlogbeat-*", "logs-endpoint.events.registry-*", "logs-windows.sysmon_operational-*", "endgame-*"]
language = "eql"
license = "Elastic License v2"
name = "SolarWinds Process Disabling Services via Registry"
rules/windows/defense_evasion_suspicious_certutil_commands.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows", "system"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/01/16"
updated_date = "2024/03/28"
[transform]
[[transform.osquery]]
@@ -39,7 +39,7 @@ Certificate Services. CertUtil is often abused by attackers to live off the land
data exfiltration.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*", "logs-system.security*"]
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.*", "endgame-*", "logs-system.security*"]
language = "eql"
license = "Elastic License v2"
name = "Suspicious CertUtil Commands"
rules/windows/defense_evasion_suspicious_execution_from_mounted_device.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/08"
updated_date = "2024/03/28"
[rule]
author = ["Elastic"]
@@ -13,7 +13,7 @@ Identifies when a script interpreter or signed binary is launched via a non-stan
use this technique to evade defenses.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.sysmon_operational-*"]
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.sysmon_operational-*"]
language = "eql"
license = "Elastic License v2"
name = "Suspicious Execution from a Mounted Device"
rules/windows/defense_evasion_suspicious_short_program_name.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/08"
updated_date = "2024/03/28"
[transform]
[[transform.osquery]]
@@ -37,7 +37,7 @@ description = """
Identifies the execution of a process with a single character process name, differing from the original file name. This is often done by adversaries while staging, executing temporary utilities, or trying to bypass security detections based on the process name.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.sysmon_operational-*", "endgame-*"]
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.sysmon_operational-*", "endgame-*"]
language = "eql"
license = "Elastic License v2"
name = "Renamed Utility Executed with Short Program Name"
rules/windows/defense_evasion_suspicious_zoom_child_process.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/08"
updated_date = "2024/03/28"
[transform]
[[transform.osquery]]
@@ -39,7 +39,7 @@ A suspicious Zoom child process was detected, which may indicate an attempt to r
such as command line, network connections, file writes and associated file signature details as well.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*", "logs-system.security*"]
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.*", "endgame-*", "logs-system.security*"]
language = "eql"
license = "Elastic License v2"
name = "Suspicious Zoom Child Process"
rules/windows/defense_evasion_system_critical_proc_abnormal_file_activity.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/08"
updated_date = "2024/03/28"
[transform]
[[transform.osquery]]
@@ -39,7 +39,7 @@ Identifies an unexpected executable file being created or modified by a Windows
indicate activity related to remote code execution or other forms of exploitation.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.sysmon_operational-*", "endgame-*"]
index = ["winlogbeat-*", "logs-endpoint.events.file-*", "logs-windows.sysmon_operational-*", "endgame-*"]
language = "eql"
license = "Elastic License v2"
name = "Unusual Executable File Creation by a System Critical Process"
rules/windows/defense_evasion_unsigned_dll_loaded_from_suspdir.toml
+2 -2
View File
@@ -4,7 +4,7 @@ maturity = "production"
integration = ["endpoint"]
min_stack_comments = "New fields added: dll.Ext.relative_file_creation_time is populated in Elastic Endpoint 8.4 and above."
min_stack_version = "8.4.0"
updated_date = "2023/10/23"
updated_date = "2024/03/28"
[rule]
author = ["Elastic"]
@@ -14,7 +14,7 @@ program and loading a recently dropped DLL. This behavior may indicate an attemp
a malicious DLL within the memory space of a signed processes.
"""
from = "now-9m"
index = ["logs-endpoint.events.*"]
index = ["logs-endpoint.events.library-*"]
language = "eql"
license = "Elastic License v2"
name = "Unsigned DLL Side-Loading from a Suspicious Folder"
rules/windows/defense_evasion_untrusted_driver_loaded.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/10/09"
updated_date = "2024/03/28"
[transform]
[[transform.osquery]]
@@ -25,7 +25,7 @@ description = """
Identifies attempt to load an untrusted driver. Adversaries may modify code signing policies to enable execution of unsigned or self-signed code.
"""
from = "now-9m"
index = ["logs-endpoint.events.*"]
index = ["logs-endpoint.events.library-*"]
language = "eql"
license = "Elastic License v2"
name = "Untrusted Driver Loaded"
rules/windows/defense_evasion_unusual_ads_file_creation.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/08"
updated_date = "2024/03/28"
[transform]
[[transform.osquery]]
@@ -39,7 +39,7 @@ Identifies suspicious creation of Alternate Data Streams on highly targeted file
and sometimes done by adversaries to hide malware.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.sysmon_operational-*"]
index = ["winlogbeat-*", "logs-endpoint.events.file-*", "logs-windows.sysmon_operational-*"]
language = "eql"
license = "Elastic License v2"
name = "Unusual File Creation - Alternate Data Stream"
rules/windows/defense_evasion_unusual_dir_ads.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/08"
updated_date = "2024/03/28"
[rule]
author = ["Elastic"]
@@ -13,7 +13,7 @@ Identifies processes running from an Alternate Data Stream. This is uncommon for
by adversaries to hide malware.
"""
from = "now-9m"
index = ["logs-endpoint.events.*", "winlogbeat-*", "logs-windows.sysmon_operational-*", "endgame-*"]
index = ["logs-endpoint.events.process-*", "winlogbeat-*", "logs-windows.sysmon_operational-*", "endgame-*"]
language = "eql"
license = "Elastic License v2"
name = "Unusual Process Execution Path - Alternate Data Stream"
rules/windows/defense_evasion_unusual_system_vp_child_program.toml
+2 -2
View File
@@ -4,13 +4,13 @@ integration = ["endpoint", "windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/08"
updated_date = "2024/03/28"
[rule]
author = ["Elastic"]
description = "Identifies a suspicious child process of the Windows virtual system process, which could indicate code injection."
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*", "logs-system.security*"]
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.*", "endgame-*", "logs-system.security*"]
language = "eql"
license = "Elastic License v2"
name = "Unusual Child Process from a System Virtual Process"
rules/windows/defense_evasion_via_filter_manager.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/08"
updated_date = "2024/03/28"
[transform]
[[transform.osquery]]
@@ -38,7 +38,7 @@ The Filter Manager Control Program (fltMC.exe) binary may be abused by adversari
defenses.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*", "logs-system.security*"]
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.*", "endgame-*", "logs-system.security*"]
language = "eql"
license = "Elastic License v2"
name = "Potential Evasion via Filter Manager"
rules/windows/defense_evasion_windows_filtering_platform.toml
+2 -2
View File
@@ -4,7 +4,7 @@ integration = ["system", "windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/12/15"
updated_date = "2024/03/28"
[rule]
author = ["Elastic"]
@@ -14,7 +14,7 @@ an endpoint security software. Adversaries may add malicious WFP rules to preven
from sending telemetry.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-windows.*", "logs-system.security-*"]
index = ["winlogbeat-*", "logs-windows.network-*", "logs-system.security-*"]
language = "eql"
license = "Elastic License v2"
name = "Potential Evasion via Windows Filtering Platform"
rules/windows/defense_evasion_wsl_bash_exec.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2023/01/13"
integration = ["endpoint", "windows", "system"]
maturity = "production"
updated_date = "2024/01/16"
updated_date = "2024/03/28"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
@@ -13,7 +13,7 @@ Detects Linux Bash commands from the the Windows Subsystem for Linux. Adversarie
and use WSL for Linux to avoid detection.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*", "logs-system.security*"]
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.*", "endgame-*", "logs-system.security*"]
language = "eql"
license = "Elastic License v2"
name = "Suspicious Execution via Windows Subsystem for Linux"
rules/windows/defense_evasion_wsl_child_process.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2023/01/12"
integration = ["endpoint", "windows", "system"]
maturity = "production"
updated_date = "2023/12/21"
updated_date = "2024/03/28"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
@@ -13,7 +13,7 @@ Detects attempts to execute a program on the host from the Windows Subsystem for
Adversaries may enable and use WSL for Linux to avoid detection.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*", "logs-system.security*"]
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.*", "endgame-*", "logs-system.security*"]
language = "eql"
license = "Elastic License v2"
name = "Execution via Windows Subsystem for Linux"
rules/windows/defense_evasion_wsl_enabled_via_dism.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2023/01/13"
integration = ["endpoint", "windows", "system"]
maturity = "production"
updated_date = "2024/01/16"
updated_date = "2024/03/28"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
@@ -13,7 +13,7 @@ Detects attempts to enable the Windows Subsystem for Linux using Microsoft Dism
and use WSL for Linux to avoid detection.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*", "logs-system.security*"]
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.*", "endgame-*", "logs-system.security*"]
language = "eql"
license = "Elastic License v2"
name = "Windows Subsystem for Linux Enabled via Dism Utility"

Some files were not shown because too many files have changed in this diff Show More