security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Expand timestamp override tests (#1907)

Browse Source 
* Expand timestamp_override tests
* removed timestamp_override from eql sequence rules
* add config entry for eql rules with beats index and t_o
* add timestamp_override to missing fields

Removed changes from:
- rules/cross-platform/impact_hosts_file_modified.toml
- rules/windows/credential_access_lsass_memdump_file_created.toml
- rules/windows/defense_evasion_adding_the_hidden_file_attribute_with_via_attribexe.toml
- rules/windows/defense_evasion_execution_lolbas_wuauclt.toml
- rules/windows/defense_evasion_suspicious_certutil_commands.toml
- rules/windows/execution_command_shell_started_by_svchost.toml

(selectively cherry picked from commit 6bdfddac8e)
This commit is contained in:
Justin Ibarra
2022-04-01 15:27:08 -08:00
committed by github-actions[bot]
parent 2edb1e0ee7
commit eeb8ab7744
227 changed files with 1653 additions and 714 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/linux/execution_mysql_binary.toml
+4 -4
View File
@@ -1,7 +1,7 @@
[metadata]
creation_date = "2022/03/09"
maturity = "production"
updated_date = "2022/03/28"
updated_date = "2022/03/31"
[rule]
author = ["Elastic"]
@@ -25,9 +25,9 @@ timestamp_override = "event.ingested"
type = "eql"
query = '''
process where event.type == "start" and process.name in ("bash", "sh", "dash") and
process.parent.name == "mysql" and process.parent.args == "-e" and
process.parent.args : ("\\!*sh", "\\!*bash", "\\!*dash", "\\!*/bin/sh", "\\!*/bin/bash", "\\!*/bin/dash")
process where event.type == "start" and process.name in ("bash", "sh", "dash") and
process.parent.name == "mysql" and process.parent.args == "-e" and
process.parent.args : ("\\!*sh", "\\!*bash", "\\!*dash", "\\!*/bin/sh", "\\!*/bin/bash", "\\!*/bin/dash")
'''