security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[Rule Tuning] 3rd Party EDR Compatibility - 5 (#4022)

Browse Source 
* [Rule Tuning] 3rd Party EDR Compatibility - 5

* bump updated_date to 8.16 release date

* min_stack for merge, bump updated_date
This commit is contained in:
Jonhnathan
2024-10-11 14:21:17 -03:00
committed by GitHub
parent 1d9cb6a195
commit f91a6fa8d6
10 changed files with 89 additions and 78 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/defense_evasion_dotnet_compiler_parent_process.toml
+11 -3
View File
@@ -1,8 +1,10 @@
[metadata]
creation_date = "2020/08/21"
integration = ["endpoint", "windows"]
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2024/08/07"
updated_date = "2024/10/10"
min_stack_version = "8.13.0"
min_stack_comments = "Breaking change at 8.13.0 for SentinelOne Integration."
[rule]
author = ["Elastic"]
@@ -14,9 +16,12 @@ from = "now-9m"
index = [
"winlogbeat-*",
"logs-endpoint.events.process-*",
"logs-windows.*",
"logs-windows.forwarded*",
"logs-windows.sysmon_operational-*",
"endgame-*",
"logs-system.security*",
"logs-m365_defender.event-*",
"logs-sentinel_one_cloud_funnel.*",
]
language = "eql"
license = "Elastic License v2"
@@ -41,6 +46,9 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: System",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Sysmon",
"Data Source: SentinelOne",
]
timestamp_override = "event.ingested"
type = "eql"
rules/windows/defense_evasion_enable_inbound_rdp_with_netsh.toml
+11 -11
View File
@@ -1,8 +1,10 @@
[metadata]
creation_date = "2020/10/13"
integration = ["endpoint", "windows", "system"]
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2024/08/07"
updated_date = "2024/10/10"
min_stack_version = "8.13.0"
min_stack_comments = "Breaking change at 8.13.0 for SentinelOne Integration."
[rule]
author = ["Elastic"]
@@ -14,9 +16,12 @@ from = "now-9m"
index = [
"winlogbeat-*",
"logs-endpoint.events.process-*",
"logs-windows.*",
"logs-windows.forwarded*",
"logs-windows.sysmon_operational-*",
"endgame-*",
"logs-system.security*",
"logs-m365_defender.event-*",
"logs-sentinel_one_cloud_funnel.*",
]
language = "eql"
license = "Elastic License v2"
@@ -59,14 +64,6 @@ This rule detects the creation of a Windows Firewall inbound rule that would all
"""
risk_score = 47
rule_id = "074464f9-f30d-4029-8c03-0ed237fffec7"
setup = """## Setup
If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
`event.ingested` to @timestamp.
For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
"""
severity = "medium"
tags = [
"Domain: Endpoint",
@@ -77,6 +74,9 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: System",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Sysmon",
"Data Source: SentinelOne",
]
timestamp_override = "event.ingested"
type = "eql"
rules/windows/defense_evasion_enable_network_discovery_with_netsh.toml
+11 -11
View File
@@ -1,8 +1,10 @@
[metadata]
creation_date = "2021/07/07"
integration = ["endpoint", "windows"]
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2024/08/07"
updated_date = "2024/10/10"
min_stack_version = "8.13.0"
min_stack_comments = "Breaking change at 8.13.0 for SentinelOne Integration."
[rule]
author = ["Elastic"]
@@ -15,9 +17,12 @@ from = "now-9m"
index = [
"winlogbeat-*",
"logs-endpoint.events.process-*",
"logs-windows.*",
"logs-windows.forwarded*",
"logs-windows.sysmon_operational-*",
"endgame-*",
"logs-system.security*",
"logs-m365_defender.event-*",
"logs-sentinel_one_cloud_funnel.*",
]
language = "eql"
license = "Elastic License v2"
@@ -55,14 +60,6 @@ Attackers can enable Network Discovery on the Windows firewall to find other sys
"""
risk_score = 47
rule_id = "8b4f0816-6a65-4630-86a6-c21c179c0d09"
setup = """## Setup
If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
`event.ingested` to @timestamp.
For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
"""
severity = "medium"
tags = [
"Domain: Endpoint",
@@ -73,6 +70,9 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: System",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Sysmon",
"Data Source: SentinelOne",
]
timestamp_override = "event.ingested"
type = "eql"
rules/windows/defense_evasion_execution_control_panel_suspicious_args.toml
+11 -3
View File
@@ -1,8 +1,10 @@
[metadata]
creation_date = "2021/09/08"
integration = ["endpoint", "windows", "system"]
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2024/08/07"
updated_date = "2024/10/10"
min_stack_version = "8.13.0"
min_stack_comments = "Breaking change at 8.13.0 for SentinelOne Integration."
[rule]
author = ["Elastic"]
@@ -14,9 +16,12 @@ from = "now-9m"
index = [
"logs-endpoint.events.process-*",
"winlogbeat-*",
"logs-windows.*",
"logs-windows.forwarded*",
"logs-windows.sysmon_operational-*",
"endgame-*",
"logs-system.security*",
"logs-m365_defender.event-*",
"logs-sentinel_one_cloud_funnel.*",
]
language = "eql"
license = "Elastic License v2"
@@ -42,6 +47,9 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: System",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Sysmon",
"Data Source: SentinelOne",
]
timestamp_override = "event.ingested"
type = "eql"
rules/windows/defense_evasion_execution_lolbas_wuauclt.toml
+11 -11
View File
@@ -1,8 +1,10 @@
[metadata]
creation_date = "2020/10/13"
integration = ["endpoint", "windows", "system"]
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2024/08/07"
updated_date = "2024/10/10"
min_stack_version = "8.13.0"
min_stack_comments = "Breaking change at 8.13.0 for SentinelOne Integration."
[transform]
[[transform.osquery]]
@@ -40,9 +42,12 @@ from = "now-9m"
index = [
"logs-endpoint.events.process-*",
"winlogbeat-*",
"logs-windows.*",
"logs-windows.forwarded*",
"logs-windows.sysmon_operational-*",
"endgame-*",
"logs-system.security*",
"logs-m365_defender.event-*",
"logs-sentinel_one_cloud_funnel.*",
]
language = "eql"
license = "Elastic License v2"
@@ -101,14 +106,6 @@ This rule identifies potential abuse for code execution by monitoring for specif
references = ["https://dtm.uk/wuauclt/"]
risk_score = 47
rule_id = "edf8ee23-5ea7-4123-ba19-56b41e424ae3"
setup = """## Setup
If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
`event.ingested` to @timestamp.
For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
"""
severity = "medium"
tags = [
"Domain: Endpoint",
@@ -119,6 +116,9 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: System",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Sysmon",
"Data Source: SentinelOne",
]
timeline_id = "e70679c2-6cde-4510-9764-4823df18f7db"
timeline_title = "Comprehensive Process Timeline"
rules/windows/defense_evasion_execution_msbuild_started_by_office_app.toml
+11 -11
View File
@@ -1,8 +1,10 @@
[metadata]
creation_date = "2020/03/25"
integration = ["endpoint", "windows"]
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2024/08/07"
updated_date = "2024/10/10"
min_stack_version = "8.13.0"
min_stack_comments = "Breaking change at 8.13.0 for SentinelOne Integration."
[rule]
author = ["Elastic"]
@@ -20,9 +22,12 @@ from = "now-9m"
index = [
"winlogbeat-*",
"logs-endpoint.events.process-*",
"logs-windows.*",
"logs-windows.forwarded*",
"logs-windows.sysmon_operational-*",
"endgame-*",
"logs-system.security*",
"logs-m365_defender.event-*",
"logs-sentinel_one_cloud_funnel.*",
]
language = "eql"
license = "Elastic License v2"
@@ -80,14 +85,6 @@ This rule looks for the `Msbuild.exe` utility spawned by MS Office programs. Thi
references = ["https://blog.talosintelligence.com/2020/02/building-bypass-with-msbuild.html"]
risk_score = 73
rule_id = "c5dc3223-13a2-44a2-946c-e9dc0aa0449c"
setup = """## Setup
If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
`event.ingested` to @timestamp.
For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
"""
severity = "high"
tags = [
"Domain: Endpoint",
@@ -99,6 +96,9 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: System",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Sysmon",
"Data Source: SentinelOne",
]
timestamp_override = "event.ingested"
type = "eql"
rules/windows/defense_evasion_execution_msbuild_started_by_system_process.toml
+11 -11
View File
@@ -1,8 +1,10 @@
[metadata]
creation_date = "2020/03/25"
integration = ["endpoint", "windows"]
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2024/08/07"
updated_date = "2024/10/10"
min_stack_version = "8.13.0"
min_stack_comments = "Breaking change at 8.13.0 for SentinelOne Integration."
[rule]
author = ["Elastic"]
@@ -15,23 +17,18 @@ from = "now-9m"
index = [
"winlogbeat-*",
"logs-endpoint.events.process-*",
"logs-windows.*",
"logs-windows.forwarded*",
"logs-windows.sysmon_operational-*",
"endgame-*",
"logs-system.security*",
"logs-m365_defender.event-*",
"logs-sentinel_one_cloud_funnel.*",
]
language = "eql"
license = "Elastic License v2"
name = "Microsoft Build Engine Started by a System Process"
risk_score = 47
rule_id = "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae3"
setup = """## Setup
If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
`event.ingested` to @timestamp.
For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
"""
severity = "medium"
tags = [
"Domain: Endpoint",
@@ -42,6 +39,9 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: System",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Sysmon",
"Data Source: SentinelOne",
]
timestamp_override = "event.ingested"
type = "eql"
rules/windows/defense_evasion_execution_msbuild_started_renamed.toml
+4 -11
View File
@@ -1,8 +1,8 @@
[metadata]
creation_date = "2020/03/25"
integration = ["endpoint", "windows"]
integration = ["endpoint", "windows", "m365_defender"]
maturity = "production"
updated_date = "2024/05/21"
updated_date = "2024/10/10"
[transform]
[[transform.osquery]]
@@ -38,7 +38,7 @@ indicate an attempt to run unnoticed or undetected.
"""
false_positives = ["The Build Engine is commonly used by Windows developers but use by non-engineers is unusual."]
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.sysmon_operational-*", "endgame-*"]
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.sysmon_operational-*", "endgame-*", "logs-m365_defender.event-*"]
language = "eql"
license = "Elastic License v2"
name = "Microsoft Build Engine Using an Alternate Name"
@@ -94,14 +94,6 @@ This rule checks for renamed instances of MSBuild, which can indicate an attempt
"""
risk_score = 21
rule_id = "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae4"
setup = """## Setup
If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
`event.ingested` to @timestamp.
For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
"""
severity = "low"
tags = [
"Domain: Endpoint",
@@ -113,6 +105,7 @@ tags = [
"Resources: Investigation Guide",
"Data Source: Elastic Defend",
"Data Source: Sysmon",
"Data Source: Microsoft Defender for Endpoint",
]
timestamp_override = "event.ingested"
type = "eql"
rules/windows/defense_evasion_execution_suspicious_explorer_winword.toml
+4 -3
View File
@@ -1,8 +1,8 @@
[metadata]
creation_date = "2020/09/03"
integration = ["endpoint", "windows"]
integration = ["endpoint", "windows", "m365_defender"]
maturity = "production"
updated_date = "2024/05/21"
updated_date = "2024/10/10"
[rule]
author = ["Elastic"]
@@ -12,7 +12,7 @@ starting after being renamed or from a non-standard path. This is uncommon behav
defenses via side loading a malicious DLL within the memory space of one of those processes.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.sysmon_operational-*", "endgame-*"]
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.sysmon_operational-*", "endgame-*", "logs-m365_defender.event-*"]
language = "eql"
license = "Elastic License v2"
name = "Potential DLL Side-Loading via Trusted Microsoft Programs"
@@ -36,6 +36,7 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: Sysmon",
"Data Source: Microsoft Defender for Endpoint",
]
timestamp_override = "event.ingested"
type = "eql"
rules/windows/defense_evasion_execution_windefend_unusual_path.toml
+4 -3
View File
@@ -1,8 +1,8 @@
[metadata]
creation_date = "2021/07/07"
integration = ["endpoint", "windows"]
integration = ["endpoint", "windows", "m365_defender"]
maturity = "production"
updated_date = "2024/05/21"
updated_date = "2024/10/10"
[rule]
author = ["Elastic", "Dennis Perto"]
@@ -13,7 +13,7 @@ side-loading a malicious DLL within the memory space of one of those processes.
"""
false_positives = ["Microsoft Antimalware Service Executable installed on non default installation path."]
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.sysmon_operational-*", "endgame-*"]
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.sysmon_operational-*", "endgame-*", "logs-m365_defender.event-*"]
language = "eql"
license = "Elastic License v2"
name = "Potential DLL Side-Loading via Microsoft Antimalware Service Executable"
@@ -40,6 +40,7 @@ tags = [
"Tactic: Execution",
"Data Source: Elastic Defend",
"Data Source: Sysmon",
"Data Source: Microsoft Defender for Endpoint",
]
timestamp_override = "event.ingested"
type = "eql"