security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[Rule Tuning] 3rd Party EDR - Add Crowdstrike FDR support - 7 (#4232)

Browse Source 
Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com>
This commit is contained in:
Jonhnathan
2024-11-07 12:27:47 -03:00
committed by GitHub
parent d2dfd46b3e
commit ef0f96c874
10 changed files with 67 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/credential_access_wbadmin_ntds.toml
+4 -2
View File
@@ -1,8 +1,8 @@
[metadata]
creation_date = "2024/06/05"
integration = ["windows", "endpoint", "system", "m365_defender", "sentinel_one_cloud_funnel"]
integration = ["windows", "endpoint", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2024/10/15"
updated_date = "2024/11/02"
min_stack_version = "8.14.0"
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
@@ -22,6 +22,7 @@ index = [
"logs-system.security*",
"logs-m365_defender.event-*",
"logs-sentinel_one_cloud_funnel.*",
"logs-crowdstrike.fdr*",
]
language = "eql"
license = "Elastic License v2"
@@ -43,6 +44,7 @@ tags = [
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Crowdstrike",
]
timestamp_override = "event.ingested"
type = "eql"
rules/windows/credential_access_wireless_creds_dumping.toml
+4 -2
View File
@@ -1,8 +1,8 @@
[metadata]
creation_date = "2022/11/01"
integration = ["endpoint", "system", "windows", "m365_defender", "sentinel_one_cloud_funnel"]
integration = ["endpoint", "system", "windows", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2024/10/15"
updated_date = "2024/11/02"
min_stack_version = "8.14.0"
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
@@ -45,6 +45,7 @@ index = [
"logs-system.security*",
"logs-m365_defender.event-*",
"logs-sentinel_one_cloud_funnel.*",
"logs-crowdstrike.fdr*",
]
language = "eql"
license = "Elastic License v2"
@@ -110,6 +111,7 @@ tags = [
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Crowdstrike",
]
timestamp_override = "event.ingested"
type = "eql"
rules/windows/defense_evasion_adding_the_hidden_file_attribute_with_via_attribexe.toml
+4 -2
View File
@@ -1,8 +1,8 @@
[metadata]
creation_date = "2020/02/18"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel"]
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2024/10/15"
updated_date = "2024/11/02"
min_stack_version = "8.14.0"
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
@@ -45,6 +45,7 @@ index = [
"logs-system.security*",
"logs-m365_defender.event-*",
"logs-sentinel_one_cloud_funnel.*",
"logs-crowdstrike.fdr*",
]
language = "eql"
license = "Elastic License v2"
@@ -118,6 +119,7 @@ tags = [
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Crowdstrike",
]
timeline_id = "e70679c2-6cde-4510-9764-4823df18f7db"
timeline_title = "Comprehensive Process Timeline"
rules/windows/defense_evasion_clearing_windows_console_history.toml
+13 -14
View File
@@ -1,8 +1,8 @@
[metadata]
creation_date = "2021/11/22"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel"]
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2024/10/15"
updated_date = "2024/11/02"
min_stack_version = "8.14.0"
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
@@ -22,6 +22,7 @@ index = [
"logs-system.security*",
"logs-m365_defender.event-*",
"logs-sentinel_one_cloud_funnel.*",
"logs-crowdstrike.fdr*",
]
language = "eql"
license = "Elastic License v2"
@@ -64,14 +65,6 @@ references = [
]
risk_score = 47
rule_id = "b5877334-677f-4fb9-86d5-a9721274223b"
setup = """## Setup
If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
`event.ingested` to @timestamp.
For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
"""
severity = "medium"
tags = [
"Domain: Endpoint",
@@ -86,16 +79,22 @@ tags = [
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Crowdstrike",
]
timestamp_override = "event.ingested"
type = "eql"
query = '''
process where host.os.type == "windows" and event.type == "start" and
(process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe") or ?process.pe.original_file_name == "PowerShell.EXE") and
(process.args : "*Clear-History*" or
(process.args : ("*Remove-Item*", "rm") and process.args : ("*ConsoleHost_history.txt*", "*(Get-PSReadlineOption).HistorySavePath*")) or
(process.args : "*Set-PSReadlineOption*" and process.args : "*SaveNothing*"))
(
process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe") or
?process.pe.original_file_name in ("powershell.exe", "pwsh.dll", "powershell_ise.exe")
) and
(
process.args : "*Clear-History*" or
(process.args : ("*Remove-Item*", "rm") and process.args : ("*ConsoleHost_history.txt*", "*(Get-PSReadlineOption).HistorySavePath*")) or
(process.args : "*Set-PSReadlineOption*" and process.args : "*SaveNothing*")
)
'''
rules/windows/defense_evasion_clearing_windows_event_logs.toml
+8 -3
View File
@@ -1,8 +1,8 @@
[metadata]
creation_date = "2020/02/18"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel"]
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2024/10/15"
updated_date = "2024/11/02"
min_stack_version = "8.14.0"
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
@@ -22,6 +22,7 @@ index = [
"logs-system.security*",
"logs-m365_defender.event-*",
"logs-sentinel_one_cloud_funnel.*",
"logs-crowdstrike.fdr*",
]
language = "eql"
license = "Elastic License v2"
@@ -74,6 +75,7 @@ tags = [
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Crowdstrike",
]
timestamp_override = "event.ingested"
type = "eql"
@@ -86,7 +88,10 @@ process where host.os.type == "windows" and event.type == "start" and
process.args : ("/e:false", "cl", "clear-log")
) or
(
process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe") and
(
process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe") or
?process.pe.original_file_name in ("powershell.exe", "pwsh.dll", "powershell_ise.exe")
) and
process.args : "Clear-EventLog"
)
)
rules/windows/defense_evasion_code_signing_policy_modification_builtin_tools.toml
+4 -2
View File
@@ -1,8 +1,8 @@
[metadata]
creation_date = "2023/01/31"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel"]
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2024/10/15"
updated_date = "2024/11/02"
min_stack_version = "8.14.0"
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
@@ -41,6 +41,7 @@ index = [
"logs-system.security*",
"logs-m365_defender.event-*",
"logs-sentinel_one_cloud_funnel.*",
"logs-crowdstrike.fdr*",
]
language = "eql"
license = "Elastic License v2"
@@ -108,6 +109,7 @@ tags = [
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Crowdstrike",
]
timestamp_override = "event.ingested"
type = "eql"
rules/windows/defense_evasion_defender_exclusion_via_powershell.toml
+4 -2
View File
@@ -1,8 +1,8 @@
[metadata]
creation_date = "2021/07/20"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel"]
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2024/10/15"
updated_date = "2024/11/02"
min_stack_version = "8.14.0"
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
@@ -22,6 +22,7 @@ index = [
"logs-system.security*",
"logs-m365_defender.event-*",
"logs-sentinel_one_cloud_funnel.*",
"logs-crowdstrike.fdr*",
]
language = "eql"
license = "Elastic License v2"
@@ -94,6 +95,7 @@ tags = [
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Crowdstrike",
]
timestamp_override = "event.ingested"
type = "eql"
rules/windows/defense_evasion_delete_volume_usn_journal_with_fsutil.toml
+4 -2
View File
@@ -1,8 +1,8 @@
[metadata]
creation_date = "2020/02/18"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel"]
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2024/10/15"
updated_date = "2024/11/02"
min_stack_version = "8.14.0"
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
@@ -22,6 +22,7 @@ index = [
"logs-system.security*",
"logs-m365_defender.event-*",
"logs-sentinel_one_cloud_funnel.*",
"logs-crowdstrike.fdr*",
]
language = "eql"
license = "Elastic License v2"
@@ -73,6 +74,7 @@ tags = [
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Crowdstrike",
]
timestamp_override = "event.ingested"
type = "eql"
rules/windows/defense_evasion_disabling_windows_defender_powershell.toml
+4 -2
View File
@@ -1,8 +1,8 @@
[metadata]
creation_date = "2021/07/07"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel"]
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2024/10/15"
updated_date = "2024/11/02"
min_stack_version = "8.14.0"
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
@@ -20,6 +20,7 @@ index = [
"logs-system.security*",
"logs-m365_defender.event-*",
"logs-sentinel_one_cloud_funnel.*",
"logs-crowdstrike.fdr*",
]
language = "eql"
license = "Elastic License v2"
@@ -82,6 +83,7 @@ tags = [
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Crowdstrike",
]
timestamp_override = "event.ingested"
type = "eql"
rules/windows/defense_evasion_disabling_windows_logs.toml
+18 -10
View File
@@ -1,8 +1,8 @@
[metadata]
creation_date = "2021/05/06"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel"]
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2024/10/15"
updated_date = "2024/11/02"
min_stack_version = "8.14.0"
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
@@ -22,6 +22,7 @@ index = [
"logs-system.security*",
"logs-m365_defender.event-*",
"logs-sentinel_one_cloud_funnel.*",
"logs-crowdstrike.fdr*",
]
language = "eql"
license = "Elastic License v2"
@@ -76,6 +77,7 @@ tags = [
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Crowdstrike",
]
timestamp_override = "event.ingested"
type = "eql"
@@ -83,14 +85,20 @@ type = "eql"
query = '''
process where host.os.type == "windows" and event.type == "start" and
(
((process.name:"logman.exe" or ?process.pe.original_file_name == "Logman.exe") and
process.args : "EventLog-*" and process.args : ("stop", "delete")) or
((process.name : ("pwsh.exe", "powershell.exe", "powershell_ise.exe") or ?process.pe.original_file_name in
("pwsh.exe", "powershell.exe", "powershell_ise.exe")) and
process.args : "Set-Service" and process.args: "EventLog" and process.args : "Disabled") or
((process.name:"auditpol.exe" or ?process.pe.original_file_name == "AUDITPOL.EXE") and process.args : "/success:disable")
(
(process.name:"logman.exe" or ?process.pe.original_file_name == "Logman.exe") and
process.args : "EventLog-*" and process.args : ("stop", "delete")
) or
(
(
process.name : ("pwsh.exe", "powershell.exe", "powershell_ise.exe") or
?process.pe.original_file_name in ("pwsh.exe", "powershell.exe", "powershell_ise.exe")
) and
process.args : "Set-Service" and process.args: "EventLog" and process.args : "Disabled"
) or
(
(process.name:"auditpol.exe" or ?process.pe.original_file_name == "AUDITPOL.EXE") and process.args : "/success:disable"
)
)
'''