50c7d5f262
[Rule Tuning] Microsoft 365 Inbox Forwarding Rule Created ( #1683 )
...
* Inbox Rule Tuning
* Add RedirectTo
* Update non-ecs-schema.json
2022-01-27 09:20:49 -03:00
e42fee2d84
Lock versions for releases: 7.13,7.14,7.15,7.16,8.0 ( #1732 )
...
* Locked versions for releases: 7.13,7.14,7.15,7.16,8.0
Co-authored-by: brokensound77 <brokensound77@users.noreply.github.com >
2022-01-26 13:54:18 -09:00
f7d93e20d4
fix bug in yaml parsing for github workflows ( #1725 )
...
* fix bug in yaml parsing for github workflows
* fix kibana version
2022-01-25 18:56:29 -09:00
2e78da5c9a
Prepare for creation of 8.1 branch ( #1700 )
2022-01-25 18:11:59 -09:00
95e3b87faf
[New Rule] Startup/Logon Script added to Group Policy Object ( #1607 )
...
* "Startup/Logon Script added to Group Policy Object" Initial Rule
* Change severity
* nest non-ecs schema and move logs-system to winlogbeat
* format query and remove quotes
* Update rules/windows/privilege_escalation_group_policy_iniscript.toml
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
* Add rule_ids and false_positives instance
Co-authored-by: brokensound77 <brokensound77@users.noreply.github.com >
2022-01-20 09:11:23 -03:00
865771886e
[New Rule] Scheduled Task Execution at Scale via GPO ( #1605 )
...
* "Scheduled Task Execution at Scale via GPO" Initial Rule
* Update non-ecs-schema.json
2022-01-19 16:06:48 -09:00
a33de6bfb8
Lock versions for releases: 7.13,7.14,7.15,7.16 ( #1659 )
...
* Locked versions for releases: 7.13,7.14,7.15,7.16
2021-12-10 19:06:19 -09:00
d43e3d8e4e
[New Rule] Suspicious Process Creation CallTrace ( #1588 )
...
* [New Rule] Suspicious Process Creation CallTrace
* Update non-ecs-schema.json
* added min stack vers
* min_stack_vers not needed
* Update rules/windows/defense_evasion_suspicious_process_creation_calltrace.toml
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
* Update rules/windows/defense_evasion_suspicious_process_creation_calltrace.toml
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
2021-11-30 21:35:43 +01:00
53a17e6b06
[New Rule] Account Password Reset Remotely ( #1571 )
...
* [New Rule] Account Password Reset Remotely
* Update non-ecs-schema.json
* udpate ruleId
* Update rules/windows/persistence_remote_password_reset.toml
Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com >
* Update rules/windows/persistence_remote_password_reset.toml
Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com >
* Update rules/windows/persistence_remote_password_reset.toml
Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com >
* Update rules/windows/persistence_remote_password_reset.toml
Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com >
* Update rules/windows/persistence_remote_password_reset.toml
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com >
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
2021-11-18 10:25:50 +01:00
c18c08a976
[New Rule] Potential Credential Access via LSASS Memory Dump ( #1533 )
...
* [New Rule] Potential Credential Access via LSASS Memory Dump
* Update credential_access_suspicious_lsass_access_memdump.toml
* fix typo in calltrace and event.code type
* Update rules/windows/credential_access_suspicious_lsass_access_memdump.toml
Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com >
* Update credential_access_suspicious_lsass_access_memdump.toml
* added TargetImage to non ecs schema
* Update non-ecs-schema.json
* format
* Update credential_access_suspicious_lsass_access_memdump.toml
* Update credential_access_suspicious_lsass_access_memdump.toml
Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com >
2021-11-17 08:36:26 +01:00
f0f3b83eab
Lock versions for releases: 7.13,7.14,7.15,7.16 ( #1619 )
...
* Locked versions for releases: 7.13,7.14,7.15,7.16
2021-11-16 00:31:27 -09:00
0cce812552
Update registry data to reflect "ga" for release ( #1482 )
2021-11-15 21:44:21 -09:00
d78f6354df
Bump min_stack_version in version.lock for specific rules ( #1614 )
2021-11-15 14:38:19 -09:00
95d7e9b6f5
Prepare for creation of 7.16 release branch ( #1611 )
2021-11-15 09:39:34 -09:00
c8cf88cd62
Refresh ECS (1.12.1) and beats (7.15.1) schemas ( #1584 )
...
* Refresh ECS (1.12.1) and beats (7.15.1) schemas
* update ecs to 1.10 for 7.14 stack validation
* add note with reference url
2021-10-28 11:24:28 -05:00
5a69ceb0c5
Add test for improper rule demotion (released production -> development) ( #1555 )
2021-10-19 21:47:36 -08:00
b7dcbbae72
[New Rule] PowerShell Suspicious Discovery Related Windows API Functions ( #1548 )
...
* PowerShell Suspicious Discovery Related Windows API Functions Initial Rule
* Update severity
* Lint
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
2021-10-14 06:54:45 -03:00
c6ddb44445
Lock versions for releases: 7.13,7.14,7.15 ( #1545 )
...
* Locked versions for releases: 7.13,7.14,7.15
2021-10-13 14:23:26 -08:00
521e4dc8f1
[New Rule] Potential Lsass Memory Dump via MirrorDump ( #1504 )
...
* [New Rule] Potential Lsass Memory Dump via MirrorDump
* added tactic
* switched to kql
* added sysmon process access non ecs types
* Update rules/windows/credential_access_potential_lsa_memdump_via_mirrordump.toml
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
* Update rules/windows/credential_access_potential_lsa_memdump_via_mirrordump.toml
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
* rule.name as suggested by Justin and converted to EQL to add comments
* Update rules/windows/credential_access_potential_lsa_memdump_via_mirrordump.toml
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
* Update rules/windows/credential_access_potential_lsa_memdump_via_mirrordump.toml
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
2021-09-30 10:16:36 +02:00
5b24eca0bc
[Bug] CLI Fixes ( #1073 )
...
* add support for self-signed certs in es and kibana
* allow Kibana to auth against any providerType
* fix export-rules command
* fix kibana upload-rule command
* fix view-rule command
* fix validate-rule command
* fix search-rules command
* fix dev kibana-diff command
* fix dev package-stats command
* fix dev search-rule-prs command
* fix dev deprecate-rule command
* replace toml with pytoml to fix import-rules command
* use no_verify in get_kibana_client
* use Path for rule-file type in view-rule
* update schemas to resolve additionalProperties type bug
* fix missing unique_fields in package rule filter
* fix github pr loader
* Load gh rules as TOMLRule instead of dict
* remove unnecessary version insertion
2021-09-10 10:06:04 -08:00
58a4483222
Lock versions for releases: 7.13,7.14,7.15 ( #1474 )
...
* Locked versions for releases: 7.13,7.14,7.15
* remove extra previous sections
* add backport label to workflow
2021-09-07 12:32:40 -08:00
90aa65aed3
Generate detection rule to alert on traffic to typosquatting/homonym domains ( #1199 )
...
* create new cli commands
* add kibana object to create_dnstwist_rule
* Adding code for index-dnstwist-results
* Changed es to es_client
* Tested. it works!
* flake8-ed
* Adding timestamps
* use eql.utils.load_dump to load json file
* rename data to dnstwist_data
* start working on create-dnstwist-rule command
* add print statements for user
* tweak formatting for line length
* add template threat match rule file
* continue working on threat match rule creation
* create rule using TomlRuleContents
* save rule to toml file
* Moving rule creation to eswrap.py
* Moving create dnstwist rule stuff to eswrap
* Fixed imports
* flake8 fixes
* More flake8 fixes
* fix usage of @add_client('kibana')
* use ctx.invoke to upload rule
* cleanup record assembly and use bulk api
* swap order of notes in `note` for sample rule
* small modifications
* move command to root click group
* remove unused click group
* Update detection_rules/main.py
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
* remove rule upload and convert template to ndjson
* Adding docs for typosquatting rule
* renaming the file
* Adding a note
* separate index and rule prep commands
* Final changes
Co-authored-by: Apoorva <appujo@gmail.com >
Co-authored-by: brokensound77 <brokensound77@users.noreply.github.com >
Co-authored-by: Apoorva Joshi <30438249+ajosh0504@users.noreply.github.com >
2021-09-03 13:35:59 -07:00
7b8b18cb20
Update main to point to 7.16 ( #1457 )
...
* Update main to point to 7.16
* Add 7.16 -> 7.15 migration
* Update stack-schema-map
* Update conditions.kibana.version
2021-08-26 14:23:55 -06:00
4adad703fc
[CI] Add GitHub actions workflow to lock versions across branches ( #1456 )
...
* Start job to lock versions
* Update lock-versions workflow
* Call lock-multiple script
* Fix script
* Add the lock file to staging
* pass branches to the job
* Fetch all branches and tags
* Push the branch first
* Push with upstream
* Change PR params
* Remove protections machine token
* Add 7.14.0 to the lock for min_stack_version=7.14.0
* Fix branch prefix
* Add trailing newline
* Trailing newline
* Restrict to main branch
2021-08-26 14:17:34 -06:00
11c443ba26
Fix encoding of 'Any' type in jsonschema ( #1438 )
2021-08-19 10:15:21 -06:00
2d517432e3
Bump package versions ( #1418 )
...
* Bump package versions
* Add 7.14 migration; use master schema map if one does not exist
* add test to ensure an entry exists in the stack-schema-map for the current package version
Co-authored-by: Ross Wolf <31489089+rw-access@users.noreply.github.com >
2021-08-18 21:25:53 -08:00
b27a20fc3a
Pull latest ECS+beats schemas and update schema-map ( #1417 )
2021-08-12 13:08:12 -08:00
d31ea6253e
Refresh ATT&CK mappings to v9.0 ( #1401 )
...
* Refresh ATT&CK mappings to v9.0
* Update rules to reflect ATT&CK changes
2021-08-04 14:16:10 -08:00
5eccaf0cd5
Update the version lock for 7.14.0 and 0.13.3 ( #1383 )
2021-07-27 12:25:12 -06:00
163d9e3864
Update cardinality field in schema for threshold rules ( #1349 )
...
* Make cardinality array in schema for threshold rules
* update master, 7.12, 7.13, and 7.14 schemas with cardinality fix
* fix 7.12 downgrade to handle cardinality as an array
* Add two new rules to detect agent spoofing
Co-authored-by: Ross Wolf <31489089+rw-access@users.noreply.github.com >
2021-07-21 08:32:54 -08:00
816e31cd38
Add optional integration field to the schema ( #1359 )
2021-07-19 12:52:44 -06:00
81ab43898c
[New Rule] Parent Process PID Spoofing ( #1338 )
...
* [New Rule] Parent Process PID Spoofing
* excluding sihost FPs
* Update rules/windows/defense_evasion_parent_process_pid_spoofing.toml
Co-authored-by: Ross Wolf <31489089+rw-access@users.noreply.github.com >
* relinted and added 2 non ecs fields
* Update rules/windows/defense_evasion_parent_process_pid_spoofing.toml
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
* Update rules/windows/defense_evasion_parent_process_pid_spoofing.toml
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
* Update rules/windows/defense_evasion_parent_process_pid_spoofing.toml
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
Co-authored-by: Ross Wolf <31489089+rw-access@users.noreply.github.com >
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
2021-07-15 22:55:46 +02:00
42957129ad
Lock versions for Fleet package 0.13.2 ( #1330 )
2021-07-07 15:43:40 -06:00
781953a0a0
Add min_stack_version to rule metadata ( #1173 )
...
* Add min_stack_version to metadata of rule structure
* validate all "stack versions" between defined and current package
* Use master schemas if min_stack_version > current_package
Co-authored-by: Ross Wolf <31489089+rw-access@users.noreply.github.com >
2021-06-30 13:26:27 -08:00
1099f181f9
Add new ECS and beats schemas ( #1303 )
2021-06-23 14:08:23 -08:00
119cd60f4e
Lock versions for 0.13.1 package
2021-06-17 12:39:57 -06:00
1ff659a634
Update the package version to 0.14.0-dev.0
2021-06-17 07:25:41 -06:00
e897a67604
Fix fleet package generation ( #1296 )
...
* Fix fleet package generation
* Add .lstrip()
* Lint fix
* Add newline
2021-06-17 06:16:09 -06:00
f6839e98d1
Simplify version locking code and fix 7.13.0 lock ( #1295 )
...
* Update version lock overwrite command
* Fix tooling and restore old version lock
* Lint fix
* Fix tests
* Remove dead code
* Filter to prod+deprecated rules
* Cast set -> list
* Store deprecation info
* Add correct version.lock.json (finally)
* Fix "stack_version" typo
* Remove stack_version
* Back out main.py changes
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
2021-06-16 18:02:47 -06:00
61e5b44c44
[Fleet] Update template and packaging code for fleet packages ( #1280 )
...
* Update template and packaging code for fleet packages
* Fix linting
2021-06-15 07:54:50 -06:00
90c6f24e8f
Lock the versions from 7.13.0 ( #1256 )
2021-06-04 16:15:33 -06:00
eb40c52c7c
Port historical schemas to jsonschema ( #1084 )
...
* Port historical schemas to jsonschema
* Add marshmallow-json dependency
* Mark etc/api_schemas as binary
* Remove gitattributes attempt
* Lint fix
* Apply PR feedback
* Additional PR feedback
* Extract stack version from packages.yml
* Fix the backport schemas
* Cache the schema reads
* Add migration for #1167
* Make a separate 'migration not found' error
2021-05-13 14:27:32 -06:00
7040538a9a
bump packages version to 7.14
2021-04-30 11:32:18 -08:00
a0a3143a52
Refresh beats and ecs schemas ( #1140 )
...
* download new beats and ecs schemas
* add beats download func by version and download v7.11.2
2021-04-22 09:49:06 -08:00
791c911b9e
Merge branch '7.12' into main
2021-04-15 16:17:59 -06:00
462fab3ff8
Update threshold rule schema to disallow empty field string ( #1098 )
...
* Update threshold rule schema to disallow empty field string
* lock versions for rule changes
2021-04-14 04:56:38 -08:00
b5bd9d2fe1
Bump version for endpoint promotion rules for 7.12.1 ( #1082 )
...
* Bump version for endpoint promotion rules
* remove timestamp_override
* lock versions
2021-04-12 05:55:51 -08:00
92313b479a
Lock 7.12 rule versions ( #1083 )
...
* lock versions for 7.12 rules
* Update promotion rules to match kibana with timestamp_override field
2021-04-06 10:48:17 -08:00
07be6b701d
Change the asset .type field ( #1075 )
2021-04-05 10:50:58 -06:00
d4cc4432ce
Add tests to ensure rules are properly deprecated ( #1050 )
...
* Add tests to ensure rules are properly deprecated
* add deprecate-rule command
2021-03-16 21:31:33 -08:00
Jonhnathan