security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add exceptions to C2 Beaconing Activity (#3771)

Browse Source 
(cherry picked from commit 8baf5dc2d8)
This commit is contained in:
James Valente
2024-06-11 09:13:46 -04:00
committed by github-actions[bot]
parent d26951d94e
commit d8131f9c60
1 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/integrations/beaconing/command_and_control_beaconing.toml
+7 -2
View File
@@ -4,7 +4,7 @@ integration = ["beaconing", "endpoint", "network_traffic"]
maturity = "production"
min_stack_comments = "Beaconing package updates and support"
min_stack_version = "8.10.1"
updated_date = "2024/01/05"
updated_date = "2024/06/10"
[rule]
author = ["Elastic"]
@@ -51,7 +51,12 @@ timestamp_override = "event.ingested"
query = '''
beacon_stats.is_beaconing: true and
not process.name: ("WaAppAgent.exe" or "metricbeat.exe" or "packetbeat.exe" or "WindowsAzureGuestAgent.exe" or "HealthService.exe" or "Widgets.exe" or "lsass.exe" or "msedgewebview2.exe" or "MsMpEng.exe" or "OUTLOOK.EXE" or "msteams.exe" or "FileSyncHelper.exe" or "SearchProtocolHost.exe" or "Creative Cloud.exe" or "ms-teams.exe" or "ms-teamsupdate.exe" or "curl.exe" or "rundll32.exe" or "MsSense.exe" or "wermgr.exe" or "java" or "olk.exe" or "iexplore.exe" or "NetworkManager" or "packetbeat" or "Ssms.exe" or "NisSrv.exe" or "gamingservices.exe" or "appidcertstorecheck.exe" or "POWERPNT.EXE" or "miiserver.exe" or "Grammarly.Desktop.exe" or "SnagitEditor.exe" or "CRWindowsClientService.exe")
not process.name: ("WaAppAgent.exe" or "metricbeat.exe" or "packetbeat.exe" or "WindowsAzureGuestAgent.exe" or "HealthService.exe" or "Widgets.exe" or "lsass.exe" or "msedgewebview2.exe" or
"MsMpEng.exe" or "OUTLOOK.EXE" or "msteams.exe" or "FileSyncHelper.exe" or "SearchProtocolHost.exe" or "Creative Cloud.exe" or "ms-teams.exe" or "ms-teamsupdate.exe" or
"curl.exe" or "rundll32.exe" or "MsSense.exe" or "wermgr.exe" or "java" or "olk.exe" or "iexplore.exe" or "NetworkManager" or "packetbeat" or "Ssms.exe" or "NisSrv.exe" or
"gamingservices.exe" or "appidcertstorecheck.exe" or "POWERPNT.EXE" or "miiserver.exe" or "Grammarly.Desktop.exe" or "SnagitEditor.exe" or "CRWindowsClientService.exe" or
"agentbeat" or "dnf" or "yum" or "apt"
)
'''