security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[Rule Tuning] Add Initial SentinelOne Compatibility to Windows DRs (#3627)

Browse Source 
* [Rule Tuning] Add Initial SentinelOne Compatibility

* updated definitions.py; updated tags; fixed unit tests

* added prerelease versions for s1 integration; updated build CLI commands to allow prerelease; bumped min-stacks

* updating manifests and integrations

* fixing flake errors

* min_stack

---------

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: terrancedejesus <terrance.dejesus@elastic.co>
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
This commit is contained in:
Jonhnathan
2024-05-20 09:50:57 -03:00
committed by GitHub
parent ec27bf8545
commit d023ad66b1
26 changed files with 155 additions and 137 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detection_rules/devtools.py
+3 -2
View File
@@ -1095,7 +1095,8 @@ def integrations_group():
@integrations_group.command('build-manifests')
@click.option('--overwrite', '-o', is_flag=True, help="Overwrite the existing integrations-manifest.json.gz file")
@click.option("--integration", "-i", type=str, help="Adds an integration tag to the manifest file")
def build_integration_manifests(overwrite: bool, integration: str):
@click.option("--prerelease", "-p", is_flag=True, default=False, help="Include prerelease versions")
def build_integration_manifests(overwrite: bool, integration: str, prerelease: bool = False):
"""Builds consolidated integrations manifests file."""
click.echo("loading rules to determine all integration tags")
@@ -1103,7 +1104,7 @@ def build_integration_manifests(overwrite: bool, integration: str):
return list(set([tag for tags in tag_list for tag in (flatten(tags) if isinstance(tags, list) else [tags])]))
if integration:
build_integrations_manifest(overwrite=False, integration=integration)
build_integrations_manifest(overwrite=False, integration=integration, prerelease=prerelease)
else:
rules = RuleCollection.default()
integration_tags = [r.contents.metadata.integration for r in rules if r.contents.metadata.integration]
detection_rules/etc/integration-manifests.json.gz
BIN
View File
Binary file not shown.
detection_rules/etc/integration-schemas.json.gz
BIN
View File
Binary file not shown.
detection_rules/integrations.py
+3 -2
View File
@@ -59,7 +59,8 @@ class IntegrationManifestSchema(Schema):
return data
def build_integrations_manifest(overwrite: bool, rule_integrations: list = [], integration: str = None) -> None:
def build_integrations_manifest(overwrite: bool, rule_integrations: list = [],
integration: str = None, prerelease: bool = False) -> None:
"""Builds a new local copy of manifest.yaml from integrations Github."""
def write_manifests(integrations: dict) -> None:
@@ -77,7 +78,7 @@ def build_integrations_manifest(overwrite: bool, rule_integrations: list = [], i
rule_integrations = rule_integrations or [integration]
for integration in rule_integrations:
integration_manifests = get_integration_manifests(integration)
integration_manifests = get_integration_manifests(integration, prerelease=prerelease)
for manifest in integration_manifests:
validated_manifest = IntegrationManifestSchema(unknown=EXCLUDE).load(manifest)
package_version = validated_manifest.pop("version")
detection_rules/schemas/definitions.py
+8 -1
View File
@@ -33,7 +33,14 @@ ELASTICSEARCH_EQL_FEATURES = {
"allow_sample": (Version.parse('8.6.0'), None),
"elasticsearch_validate_optional_fields": (Version.parse('7.16.0'), None)
}
NON_DATASET_PACKAGES = ['apm', 'auditd_manager', 'cloud_defend', 'endpoint', 'network_traffic', 'system', 'windows']
NON_DATASET_PACKAGES = ['apm',
'auditd_manager',
'cloud_defend',
'endpoint',
'network_traffic',
'system',
'windows',
'sentinel_one_cloud_funnel']
NON_PUBLIC_FIELDS = {
"related_integrations": (Version.parse('8.3.0'), None),
"required_fields": (Version.parse('8.3.0'), None),
rules/windows/collection_email_powershell_exchange_mailbox.toml
+7 -7
View File
@@ -1,10 +1,10 @@
[metadata]
creation_date = "2020/12/15"
integration = ["endpoint", "windows", "system"]
integration = ["endpoint", "windows", "system", "sentinel_one_cloud_funnel"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/28"
min_stack_comments = "SentinelOne integration package minimum version for validation."
min_stack_version = "8.11.0"
updated_date = "2024/05/16"
[rule]
author = ["Elastic"]
@@ -14,7 +14,7 @@ mailbox or archive to a .pst file. Adversaries may target user email to collect
"""
false_positives = ["Legitimate exchange system administration activity."]
from = "now-9m"
index = ["logs-endpoint.events.process-*", "winlogbeat-*", "logs-windows.*", "endgame-*", "logs-system.security*"]
index = ["logs-endpoint.events.process-*", "winlogbeat-*", "logs-windows.*", "endgame-*", "logs-system.security*", "logs-sentinel_one_cloud_funnel.*"]
language = "eql"
license = "Elastic License v2"
name = "Exporting Exchange Mailbox via PowerShell"
@@ -74,13 +74,13 @@ Hence for this rule to work effectively, users will need to add a custom ingest
For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
"""
severity = "medium"
tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Collection", "Tactic: Execution", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"]
tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Collection", "Tactic: Execution", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend", "Data Source: SentinelOne"]
timestamp_override = "event.ingested"
type = "eql"
query = '''
process where host.os.type == "windows" and event.type == "start" and
process.name: ("powershell.exe", "pwsh.exe", "powershell_ise.exe") and
process.name: ("powershell.exe", "pwsh.exe", "powershell_ise.exe") and
process.command_line : ("*MailboxExportRequest*", "*-Mailbox*-ContentFilter*")
'''
rules/windows/command_and_control_port_forwarding_added_registry.toml
+9 -7
View File
@@ -1,10 +1,10 @@
[metadata]
creation_date = "2020/11/25"
integration = ["endpoint", "windows"]
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/28"
min_stack_comments = "SentinelOne integration package minimum version for validation."
min_stack_version = "8.11.0"
updated_date = "2024/05/16"
[rule]
author = ["Elastic"]
@@ -13,7 +13,7 @@ Identifies the creation of a new port forwarding rule. An adversary may abuse th
segmentation restrictions.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.registry-*", "logs-windows.sysmon_operational-*", "endgame-*"]
index = ["winlogbeat-*", "logs-endpoint.events.registry-*", "logs-windows.sysmon_operational-*", "endgame-*", "logs-sentinel_one_cloud_funnel.*"]
language = "eql"
license = "Elastic License v2"
name = "Port Forwarding Rule Addition"
@@ -81,7 +81,8 @@ tags = [
"Resources: Investigation Guide",
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: Sysmon"
"Data Source: Sysmon",
"Data Source: SentinelOne"
]
timestamp_override = "event.ingested"
type = "eql"
@@ -89,7 +90,8 @@ type = "eql"
query = '''
registry where host.os.type == "windows" and registry.path : (
"HKLM\\SYSTEM\\*ControlSet*\\Services\\PortProxy\\v4tov4\\*",
"\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Services\\PortProxy\\v4tov4\\*"
"\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Services\\PortProxy\\v4tov4\\*",
"MACHINE\\SYSTEM\\*ControlSet*\\Services\\PortProxy\\v4tov4\\*"
)
'''
rules/windows/command_and_control_rdp_tunnel_plink.toml
+7 -6
View File
@@ -1,10 +1,10 @@
[metadata]
creation_date = "2020/10/14"
integration = ["endpoint", "windows"]
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/28"
min_stack_comments = "SentinelOne integration package minimum version for validation."
min_stack_version = "8.11.0"
updated_date = "2024/05/16"
[rule]
author = ["Elastic"]
@@ -13,7 +13,7 @@ Identifies potential use of an SSH utility to establish RDP over a reverse SSH T
enable routing of network packets that would otherwise not reach their intended destination.
"""
from = "now-9m"
index = ["logs-endpoint.events.process-*", "winlogbeat-*", "logs-windows.*", "endgame-*", "logs-system.security*"]
index = ["logs-endpoint.events.process-*", "winlogbeat-*", "logs-windows.*", "endgame-*", "logs-system.security*", "logs-sentinel_one_cloud_funnel.*"]
language = "eql"
license = "Elastic License v2"
name = "Potential Remote Desktop Tunneling Detected"
@@ -71,7 +71,8 @@ tags = [
"Tactic: Lateral Movement",
"Resources: Investigation Guide",
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend"
"Data Source: Elastic Defend",
"Data Source: SentinelOne"
]
timestamp_override = "event.ingested"
type = "eql"
rules/windows/command_and_control_screenconnect_childproc.toml
+8 -7
View File
@@ -1,10 +1,10 @@
[metadata]
creation_date = "2024/03/27"
integration = ["endpoint", "windows"]
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2024/03/28"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
min_stack_comments = "SentinelOne integration package minimum version for validation."
min_stack_version = "8.11.0"
updated_date = "2024/05/16"
[rule]
@@ -14,7 +14,7 @@ Identifies suspicious processes being spawned by the ScreenConnect client proces
abusing unauthorized access to the ScreenConnect remote access software.
"""
from = "now-9m"
index = ["logs-endpoint.events.process-*", "winlogbeat-*", "logs-windows.sysmon_operational-*", "logs-system.security*", "endgame-*"]
index = ["logs-endpoint.events.process-*", "winlogbeat-*", "logs-windows.sysmon_operational-*", "logs-system.security*", "endgame-*", "logs-sentinel_one_cloud_funnel.*"]
language = "eql"
license = "Elastic License v2"
name = "Suspicious ScreenConnect Client Child Process"
@@ -30,7 +30,8 @@ tags = [
"Resources: Investigation Guide",
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: Sysmon"
"Data Source: Sysmon",
"Data Source: SentinelOne"
]
timestamp_override = "event.ingested"
type = "eql"
@@ -52,7 +53,7 @@ process where host.os.type == "windows" and event.type == "start" and
(process.name : "rundll32.exe" and not process.args : "url.dll,FileProtocolHandler") or
(process.name : "msiexec.exe" and process.args : ("/i", "-i") and
process.args : ("/q", "/quiet", "/qn", "-q", "-quiet", "-qn", "-Q+")) or
process.name : ("mshta.exe", "certutil.exe", "bistadmin.exe", "certreq.exe", "wscript.exe", "cscript.exe", "curl.exe",
process.name : ("mshta.exe", "certutil.exe", "bistadmin.exe", "certreq.exe", "wscript.exe", "cscript.exe", "curl.exe",
"ssh.exe", "scp.exe", "wevtutil.exe", "wget.exe", "wmic.exe")
)
'''
rules/windows/credential_access_domain_backup_dpapi_private_keys.toml
+6 -6
View File
@@ -1,10 +1,10 @@
[metadata]
creation_date = "2020/08/13"
integration = ["endpoint", "windows"]
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/28"
min_stack_comments = "SentinelOne integration package minimum version for validation."
min_stack_version = "8.11.0"
updated_date = "2024/05/16"
[rule]
author = ["Elastic"]
@@ -13,7 +13,7 @@ Identifies the creation or modification of Domain Backup private keys. Adversari
(DPAPI) domain backup key from a Domain Controller (DC) to be able to decrypt any domain user master key file.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.file-*", "logs-windows.sysmon_operational-*", "endgame-*"]
index = ["winlogbeat-*", "logs-endpoint.events.file-*", "logs-windows.sysmon_operational-*", "endgame-*", "logs-sentinel_one_cloud_funnel.*"]
language = "eql"
license = "Elastic License v2"
name = "Creation or Modification of Domain Backup DPAPI private key"
@@ -36,7 +36,7 @@ Hence for this rule to work effectively, users will need to add a custom ingest
For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
"""
severity = "high"
tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Credential Access", "Data Source: Elastic Endgame", "Data Source: Elastic Defend", "Data Source: Sysmon"]
tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Credential Access", "Data Source: Elastic Endgame", "Data Source: Elastic Defend", "Data Source: Sysmon", "Data Source: SentinelOne"]
timestamp_override = "event.ingested"
type = "eql"
rules/windows/credential_access_kirbi_file.toml
+6 -7
View File
@@ -1,10 +1,10 @@
[metadata]
creation_date = "2023/08/23"
integration = ["endpoint"]
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/28"
min_stack_comments = "SentinelOne integration package minimum version for validation."
min_stack_version = "8.11.0"
updated_date = "2024/05/16"
[rule]
author = ["Elastic"]
@@ -14,15 +14,14 @@ Kerberos ticket dump utilities, such as Mimikatz, and precedes attacks such as P
attacker to impersonate users using Kerberos tickets.
"""
from = "now-9m"
interval = "60m"
index = ["logs-endpoint.events.file-*", "logs-windows.sysmon_operational-*"]
index = ["logs-endpoint.events.file-*", "logs-windows.sysmon_operational-*", "logs-sentinel_one_cloud_funnel.*"]
language = "eql"
license = "Elastic License v2"
name = "Kirbi File Creation"
risk_score = 47
rule_id = "b8f8da2d-a9dc-48c0-90e4-955c0aa1259a"
severity = "medium"
tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Credential Access", "Data Source: Elastic Defend", "Data Source: Sysmon"]
tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Credential Access", "Data Source: Elastic Defend", "Data Source: Sysmon", "Data Source: SentinelOne"]
timestamp_override = "event.ingested"
type = "eql"
rules/windows/credential_access_mimikatz_memssp_default_logs.toml
+7 -6
View File
@@ -1,16 +1,16 @@
[metadata]
creation_date = "2020/08/31"
integration = ["endpoint", "windows"]
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/28"
min_stack_comments = "SentinelOne integration package minimum version for validation."
min_stack_version = "8.11.0"
updated_date = "2024/05/16"
[rule]
author = ["Elastic"]
description = "Identifies the password log file from the default Mimikatz memssp module."
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.file-*", "logs-windows.sysmon_operational-*", "endgame-*"]
index = ["winlogbeat-*", "logs-endpoint.events.file-*", "logs-windows.sysmon_operational-*", "endgame-*", "logs-sentinel_one_cloud_funnel.*"]
language = "eql"
license = "Elastic License v2"
name = "Mimikatz Memssp Log File Detected"
@@ -75,7 +75,8 @@ tags = [
"Resources: Investigation Guide",
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: Sysmon"
"Data Source: Sysmon",
"Data Source: SentinelOne"
]
timestamp_override = "event.ingested"
type = "eql"
rules/windows/defense_evasion_amsi_bypass_dllhijack.toml
+7 -6
View File
@@ -1,10 +1,10 @@
[metadata]
creation_date = "2023/01/17"
integration = ["windows", "endpoint"]
integration = ["windows", "endpoint", "sentinel_one_cloud_funnel"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/28"
min_stack_comments = "SentinelOne integration package minimum version for validation."
min_stack_version = "8.11.0"
updated_date = "2024/05/16"
[transform]
[[transform.osquery]]
@@ -39,7 +39,7 @@ Identifies the creation of the Antimalware Scan Interface (AMSI) DLL in an unusu
attempt to bypass AMSI by loading a rogue AMSI module instead of the legit one.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.file-*", "logs-windows.sysmon_operational-*", "endgame-*"]
index = ["winlogbeat-*", "logs-endpoint.events.file-*", "logs-windows.sysmon_operational-*", "endgame-*", "logs-sentinel_one_cloud_funnel.*"]
language = "eql"
license = "Elastic License v2"
name = "Suspicious Antimalware Scan Interface DLL"
@@ -103,7 +103,8 @@ tags = [
"Data Source: Elastic Endgame",
"Resources: Investigation Guide",
"Data Source: Elastic Defend",
"Data Source: Sysmon"
"Data Source: Sysmon",
"Data Source: SentinelOne"
]
timestamp_override = "event.ingested"
type = "eql"
rules/windows/defense_evasion_hide_encoded_executable_registry.toml
+6 -6
View File
@@ -1,10 +1,10 @@
[metadata]
creation_date = "2020/11/25"
integration = ["endpoint"]
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/28"
min_stack_comments = "SentinelOne integration package minimum version for validation."
min_stack_version = "8.11.0"
updated_date = "2024/05/16"
[rule]
author = ["Elastic"]
@@ -13,14 +13,14 @@ Identifies registry write modifications to hide an encoded portable executable.
defense evasion by avoiding the storing of malicious content directly on disk.
"""
from = "now-9m"
index = ["logs-endpoint.events.registry-*", "endgame-*", "logs-windows.sysmon_operational-*"]
index = ["logs-endpoint.events.registry-*", "endgame-*", "logs-windows.sysmon_operational-*", "logs-sentinel_one_cloud_funnel.*"]
language = "eql"
license = "Elastic License v2"
name = "Encoded Executable Stored in the Registry"
risk_score = 47
rule_id = "93c1ce76-494c-4f01-8167-35edfb52f7b1"
severity = "medium"
tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Endgame", "Data Source: Elastic Defend", "Data Source: Sysmon"]
tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Endgame", "Data Source: Elastic Defend", "Data Source: Sysmon", "Data Source: SentinelOne"]
timestamp_override = "event.ingested"
type = "eql"
rules/windows/defense_evasion_masquerading_suspicious_werfault_childproc.toml
+11 -11
View File
@@ -1,20 +1,20 @@
[metadata]
creation_date = "2020/08/24"
integration = ["endpoint", "windows"]
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/28"
min_stack_comments = "SentinelOne integration package minimum version for validation."
min_stack_version = "8.11.0"
updated_date = "2024/05/16"
[rule]
author = ["Elastic"]
description = """
A suspicious WerFault child process was detected, which may indicate an attempt to run via the SilentProcessExit
A suspicious WerFault child process was detected, which may indicate an attempt to run via the SilentProcessExit
registry key manipulation. Verify process details such as command line, network connections and file writes.
"""
false_positives = ["Custom Windows error reporting debugger or applications restarted by WerFault after a crash."]
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.*", "endgame-*"]
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.*", "endgame-*", "logs-sentinel_one_cloud_funnel.*"]
language = "eql"
license = "Elastic License v2"
name = "Suspicious WerFault Child Process"
@@ -35,18 +35,18 @@ Hence for this rule to work effectively, users will need to add a custom ingest
For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
"""
severity = "medium"
tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Tactic: Persistence", "Tactic: Privilege Escalation", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"]
tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Tactic: Persistence", "Tactic: Privilege Escalation", "Data Source: Elastic Endgame", "Data Source: Elastic Defend", "Data Source: SentinelOne"]
timestamp_override = "event.ingested"
type = "eql"
query = '''
process where host.os.type == "windows" and event.type == "start" and
process.parent.name : "WerFault.exe" and
process.parent.name : "WerFault.exe" and
/* args -s and -t used to execute a process via SilentProcessExit mechanism */
(process.parent.args : "-s" and process.parent.args : "-t" and process.parent.args : "-c") and
(process.parent.args : "-s" and process.parent.args : "-t" and process.parent.args : "-c") and
not process.executable : ("?:\\Windows\\SysWOW64\\Initcrypt.exe", "?:\\Program Files (x86)\\Heimdal\\Heimdal.Guard.exe")
'''
rules/windows/defense_evasion_persistence_account_tokenfilterpolicy.toml
+9 -7
View File
@@ -1,10 +1,10 @@
[metadata]
creation_date = "2022/11/01"
integration = ["endpoint", "windows"]
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/28"
min_stack_comments = "SentinelOne integration package minimum version for validation."
min_stack_version = "8.11.0"
updated_date = "2024/05/16"
[rule]
author = ["Elastic"]
@@ -14,7 +14,7 @@ default) and is set to 1, then remote connections from all local members of Admi
high-integrity tokens during negotiation.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.registry-*", "logs-windows.sysmon_operational-*", "endgame-*"]
index = ["winlogbeat-*", "logs-endpoint.events.registry-*", "logs-windows.sysmon_operational-*", "endgame-*", "logs-sentinel_one_cloud_funnel.*"]
language = "eql"
license = "Elastic License v2"
name = "Local Account TokenFilter Policy Disabled"
@@ -34,7 +34,8 @@ tags = [
"Tactic: Lateral Movement",
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: Sysmon"
"Data Source: Sysmon",
"Data Source: SentinelOne"
]
timestamp_override = "event.ingested"
type = "eql"
@@ -42,7 +43,8 @@ type = "eql"
query = '''
registry where host.os.type == "windows" and registry.path : (
"HKLM\\*\\LocalAccountTokenFilterPolicy",
"\\REGISTRY\\MACHINE\\*\\LocalAccountTokenFilterPolicy") and
"\\REGISTRY\\MACHINE\\*\\LocalAccountTokenFilterPolicy",
"MACHINE\\*\\LocalAccountTokenFilterPolicy") and
registry.data.strings : ("1", "0x00000001")
'''
rules/windows/defense_evasion_suspicious_zoom_child_process.toml
+6 -6
View File
@@ -1,10 +1,10 @@
[metadata]
creation_date = "2020/09/03"
integration = ["endpoint", "windows"]
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/28"
min_stack_comments = "SentinelOne integration package minimum version for validation."
min_stack_version = "8.11.0"
updated_date = "2024/05/16"
[transform]
[[transform.osquery]]
@@ -39,7 +39,7 @@ A suspicious Zoom child process was detected, which may indicate an attempt to r
such as command line, network connections, file writes and associated file signature details as well.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.*", "endgame-*", "logs-system.security*"]
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.*", "endgame-*", "logs-system.security*", "logs-sentinel_one_cloud_funnel.*"]
language = "eql"
license = "Elastic License v2"
name = "Suspicious Zoom Child Process"
@@ -97,7 +97,7 @@ This rule identifies a potential malicious process masquerading as `Zoom.exe` or
risk_score = 47
rule_id = "97aba1ef-6034-4bd3-8c1a-1e0996b27afa"
severity = "medium"
tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Tactic: Execution", "Data Source: Elastic Endgame", "Resources: Investigation Guide", "Data Source: Elastic Defend"]
tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Tactic: Execution", "Data Source: Elastic Endgame", "Resources: Investigation Guide", "Data Source: Elastic Defend", "Data Source: SentinelOne"]
timestamp_override = "event.ingested"
type = "eql"
rules/windows/execution_command_shell_started_by_unusual_process.toml
+6 -6
View File
@@ -1,16 +1,16 @@
[metadata]
creation_date = "2020/08/21"
integration = ["endpoint", "windows"]
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/28"
min_stack_comments = "SentinelOne integration package minimum version for validation."
min_stack_version = "8.11.0"
updated_date = "2024/05/16"
[rule]
author = ["Elastic"]
description = "Identifies a suspicious parent child process relationship with cmd.exe descending from an unusual process."
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.sysmon_operational-*", "endgame-*"]
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.sysmon_operational-*", "endgame-*", "logs-sentinel_one_cloud_funnel.*"]
language = "eql"
license = "Elastic License v2"
name = "Unusual Parent Process for cmd.exe"
@@ -25,7 +25,7 @@ Hence for this rule to work effectively, users will need to add a custom ingest
For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
"""
severity = "medium"
tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Execution", "Data Source: Elastic Endgame", "Data Source: Elastic Defend", "Data Source: Sysmon"]
tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Execution", "Data Source: Elastic Endgame", "Data Source: Elastic Defend", "Data Source: Sysmon", "Data Source: SentinelOne"]
timestamp_override = "event.ingested"
type = "eql"
rules/windows/initial_access_suspicious_ms_outlook_child_process.toml
+6 -6
View File
@@ -1,10 +1,10 @@
[metadata]
creation_date = "2020/02/18"
integration = ["endpoint", "windows", "system"]
integration = ["endpoint", "windows", "system", "sentinel_one_cloud_funnel"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/28"
min_stack_comments = "SentinelOne integration package minimum version for validation."
min_stack_version = "8.11.0"
updated_date = "2024/05/16"
[rule]
author = ["Elastic"]
@@ -13,7 +13,7 @@ Identifies suspicious child processes of Microsoft Outlook. These child processe
phishing activity.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.*", "endgame-*", "logs-system.security*"]
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.*", "endgame-*", "logs-system.security*", "logs-sentinel_one_cloud_funnel.*"]
language = "eql"
license = "Elastic License v2"
name = "Suspicious MS Outlook Child Process"
@@ -75,7 +75,7 @@ Hence for this rule to work effectively, users will need to add a custom ingest
For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
"""
severity = "low"
tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Initial Access", "Tactic: Defense Evasion", "Tactic: Execution", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"]
tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Initial Access", "Tactic: Defense Evasion", "Tactic: Execution", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend", "Data Source: SentinelOne"]
timestamp_override = "event.ingested"
type = "eql"
rules/windows/persistence_adobe_hijack_persistence.toml
+6 -6
View File
@@ -1,10 +1,10 @@
[metadata]
creation_date = "2020/02/18"
integration = ["endpoint", "windows"]
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2024/03/28"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
min_stack_comments = "SentinelOne integration package minimum version for validation."
min_stack_version = "8.11.0"
updated_date = "2024/05/16"
[transform]
[[transform.osquery]]
@@ -36,7 +36,7 @@ authenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.resu
author = ["Elastic"]
description = "Detects writing executable files that will be automatically launched by Adobe on launch."
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.file-*", "logs-windows.sysmon_operational-*", "endgame-*"]
index = ["winlogbeat-*", "logs-endpoint.events.file-*", "logs-windows.sysmon_operational-*", "endgame-*", "logs-sentinel_one_cloud_funnel.*"]
language = "eql"
license = "Elastic License v2"
name = "Adobe Hijack Persistence"
@@ -101,7 +101,7 @@ Hence for this rule to work effectively, users will need to add a custom ingest
For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
"""
severity = "low"
tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend", "Data Source: Sysmon"]
tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend", "Data Source: Sysmon", "Data Source: SentinelOne"]
timestamp_override = "event.ingested"
type = "eql"
rules/windows/persistence_appcertdlls_registry.toml
+8 -7
View File
@@ -1,10 +1,10 @@
[metadata]
creation_date = "2020/11/18"
integration = ["endpoint", "windows"]
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/28"
min_stack_comments = "SentinelOne integration package minimum version for validation."
min_stack_version = "8.11.0"
updated_date = "2024/05/16"
[rule]
author = ["Elastic"]
@@ -13,7 +13,7 @@ Detects attempts to maintain persistence by creating registry keys using AppCert
process using the common API functions to create processes.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.registry-*", "logs-windows.sysmon_operational-*", "endgame-*"]
index = ["winlogbeat-*", "logs-endpoint.events.registry-*", "logs-windows.sysmon_operational-*", "endgame-*", "logs-sentinel_one_cloud_funnel.*"]
language = "eql"
license = "Elastic License v2"
name = "Registry Persistence via AppCert DLL"
@@ -28,7 +28,7 @@ Hence for this rule to work effectively, users will need to add a custom ingest
For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
"""
severity = "medium"
tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Tactic: Privilege Escalation", "Data Source: Elastic Endgame", "Data Source: Elastic Defend", "Data Source: Sysmon"]
tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Tactic: Privilege Escalation", "Data Source: Elastic Endgame", "Data Source: Elastic Defend", "Data Source: Sysmon", "Data Source: SentinelOne"]
timestamp_override = "event.ingested"
type = "eql"
@@ -37,7 +37,8 @@ registry where host.os.type == "windows" and
/* uncomment once stable length(bytes_written_string) > 0 and */
registry.path : (
"HKLM\\SYSTEM\\*ControlSet*\\Control\\Session Manager\\AppCertDLLs\\*",
"\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\Session Manager\\AppCertDLLs\\*"
"\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\Session Manager\\AppCertDLLs\\*",
"MACHINE\\SYSTEM\\*ControlSet*\\Control\\Session Manager\\AppCertDLLs\\*"
)
'''
rules/windows/persistence_local_scheduled_job_creation.toml
+6 -6
View File
@@ -1,10 +1,10 @@
[metadata]
creation_date = "2021/03/15"
integration = ["endpoint", "windows"]
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/28"
min_stack_comments = "SentinelOne integration package minimum version for validation."
min_stack_version = "8.11.0"
updated_date = "2024/05/16"
[rule]
author = ["Elastic"]
@@ -14,7 +14,7 @@ task scheduling functionality to facilitate initial or recurring execution of ma
"""
false_positives = ["Legitimate scheduled jobs may be created during installation of new software."]
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.file-*", "logs-windows.sysmon_operational-*", "endgame-*"]
index = ["winlogbeat-*", "logs-endpoint.events.file-*", "logs-windows.sysmon_operational-*", "endgame-*", "logs-sentinel_one_cloud_funnel.*"]
language = "eql"
license = "Elastic License v2"
name = "Persistence via Scheduled Job Creation"
@@ -29,7 +29,7 @@ Hence for this rule to work effectively, users will need to add a custom ingest
For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
"""
severity = "medium"
tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Endgame", "Data Source: Elastic Defend", "Data Source: Sysmon"]
tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Endgame", "Data Source: Elastic Defend", "Data Source: Sysmon", "Data Source: SentinelOne"]
timestamp_override = "event.ingested"
type = "eql"
rules/windows/persistence_system_shells_via_services.toml
+6 -6
View File
@@ -1,10 +1,10 @@
[metadata]
creation_date = "2020/02/18"
integration = ["endpoint", "windows", "system"]
integration = ["endpoint", "windows", "system", "sentinel_one_cloud_funnel"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/28"
min_stack_comments = "SentinelOne integration package minimum version for validation."
min_stack_version = "8.11.0"
updated_date = "2024/05/16"
[transform]
[[transform.osquery]]
@@ -34,7 +34,7 @@ Windows services typically run as SYSTEM and can be used as a privilege escalati
testers may run a shell as a service to gain SYSTEM permissions.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.*", "endgame-*", "logs-system.security*"]
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.*", "endgame-*", "logs-system.security*", "logs-sentinel_one_cloud_funnel.*"]
language = "eql"
license = "Elastic License v2"
name = "System Shells via Services"
@@ -81,7 +81,7 @@ This rule looks for system shells being spawned by `services.exe`, which is comp
risk_score = 47
rule_id = "0022d47d-39c7-4f69-a232-4fe9dc7a3acd"
severity = "medium"
tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Tactic: Execution", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"]
tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Tactic: Execution", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend", "Data Source: SentinelOne"]
timestamp_override = "event.ingested"
type = "eql"
rules/windows/persistence_via_bits_job_notify_command.toml
+6 -6
View File
@@ -1,10 +1,10 @@
[metadata]
creation_date = "2021/12/04"
integration = ["endpoint", "windows"]
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/28"
min_stack_comments = "SentinelOne integration package minimum version for validation."
min_stack_version = "8.11.0"
updated_date = "2024/05/16"
[rule]
author = ["Elastic"]
@@ -14,7 +14,7 @@ that runs after a job finishes transferring data or after a job enters a specifi
system.
"""
from = "now-9m"
index = ["logs-endpoint.events.process-*", "winlogbeat-*", "logs-windows.sysmon_operational-*", "endgame-*"]
index = ["logs-endpoint.events.process-*", "winlogbeat-*", "logs-windows.sysmon_operational-*", "endgame-*", "logs-sentinel_one_cloud_funnel.*"]
language = "eql"
license = "Elastic License v2"
name = "Persistence via BITS Job Notify Cmdline"
@@ -35,7 +35,7 @@ Hence for this rule to work effectively, users will need to add a custom ingest
For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
"""
severity = "medium"
tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Endgame", "Data Source: Elastic Defend", "Data Source: Sysmon"]
tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Endgame", "Data Source: Elastic Defend", "Data Source: Sysmon", "Data Source: SentinelOne"]
timestamp_override = "event.ingested"
type = "eql"
rules/windows/persistence_webshell_detection.toml
+7 -7
View File
@@ -1,10 +1,10 @@
[metadata]
creation_date = "2021/08/24"
integration = ["endpoint", "windows", "system"]
integration = ["endpoint", "windows", "system", "sentinel_one_cloud_funnel"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/03/28"
min_stack_comments = "SentinelOne integration package minimum version for validation."
min_stack_version = "8.11.0"
updated_date = "2024/05/16"
[rule]
author = ["Elastic"]
@@ -16,7 +16,7 @@ false_positives = [
""",
]
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.*", "endgame-*", "logs-system.security*"]
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.*", "endgame-*", "logs-system.security*", "logs-sentinel_one_cloud_funnel.*"]
language = "eql"
license = "Elastic License v2"
name = "Web Shell Detection: Script Process Child of Common Web Processes"
@@ -79,7 +79,7 @@ Hence for this rule to work effectively, users will need to add a custom ingest
For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
"""
severity = "high"
tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Tactic: Initial Access", "Tactic: Execution", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"]
tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Tactic: Initial Access", "Tactic: Execution", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend", "Data Source: SentinelOne"]
timestamp_override = "event.ingested"
type = "eql"
@@ -87,7 +87,7 @@ query = '''
process where host.os.type == "windows" and event.type == "start" and
process.parent.name : ("w3wp.exe", "httpd.exe", "nginx.exe", "php.exe", "php-cgi.exe", "tomcat.exe") and
process.name : ("cmd.exe", "cscript.exe", "powershell.exe", "pwsh.exe", "powershell_ise.exe", "wmic.exe", "wscript.exe") and
not
not
(
process.parent.name : ("php.exe", "httpd.exe") and process.name : "cmd.exe" and
process.command_line : (
tests/test_all_rules.py
+1
View File
@@ -310,6 +310,7 @@ class TestRuleTags(BaseRuleTest):
'logs-endpoint.alerts-*': {'all': ['Data Source: Elastic Defend']},
'logs-windows.sysmon_operational-*': {'all': ['Data Source: Sysmon']},
'logs-windows.powershell*': {'all': ['Data Source: PowerShell Logs']},
'logs-sentinel_one_cloud_funnel.*': {'all': ['Data Source: SentinelOne']},
}
for rule in self.all_rules: