security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
3,314 Commits 1 Branch 0 Tags
1ce072a4e58238d94deae33ff8de25458ac129d5
Commit Graph

3314 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Mika Ayenson b3334941f9 [Rule Tuning] Remote SSH Login Enabled via systemsetup Command (#2147) 
* exclude jamf fp and add ssh subtechnique
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
 2022-07-22 17:10:09 -04:00
Mika Ayenson 84104773a6 exclude google drive FP (#2145) 2022-07-22 17:00:00 -04:00
Mika Ayenson 44ae72d054 [Rule Tuning] Suspicious Automator Workflows Execution (#2142) 
* add subtechnique

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
 2022-07-22 16:50:45 -04:00
Mika Ayenson f176b5ef57 update tags to include C2 tactic (#2140) 2022-07-22 16:39:25 -04:00
Colson Wilhoit d6527afd51 [Rule Tuning] Remove File Quarantine Attribute (#2129) 2022-07-22 15:25:12 -05:00
Mika Ayenson 1e28385ea4 [Rule Tuning] Enumeration of Users or Groups via Built-in Commands (#2136) 
* fix parens and exclude parent process FPs and update description
 2022-07-22 16:16:27 -04:00
Mika Ayenson d2be29b226 [Rule Tuning] Potential Privacy Control Bypass via TCCDB Modification (#2121) 
* add exception for Bitdefender
 2022-07-22 16:07:41 -04:00
Mika Ayenson cefb84ae15 [Rule Tuning] Modification of Environment Variable via Launchctl (#2119) 
* add exception for vmoptions
 2022-07-22 16:03:46 -04:00
Terrance DeJesus e8c39d19a7 [Rule Tuning] Missing MITRE ATT&CK Mappings (#2073) 
* initial commit with eggshell mitre mapping added

* adding updated rules

* [Rule Tuning] MITRE for GCP rules

I've added Mitre references for the 4 GCP rules missing. Changed 3 of the rules from "Impact" to "Defense Evasion" based on the technique used and it's matched tactic.

* [Rule Tuning] Endgame Rule name updates for Mitre

Updated Endgame rule names for those with Mitre tactics to match the tactics.

* Update rules/integrations/aws/persistence_redshift_instance_creation.toml

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>

* Update rules/integrations/aws/exfiltration_rds_snapshot_restored.toml

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>

* adding 10 updated rules for google_workspace, ml and o365

* adding 22 rule updates for mitre att&ck mappings

* adding 24 rule updates related mainly to ML rules

* adding 3 rules related to detection via ML

* adding adjustments

* adding adjustments with solutions to recent pytest errors

* removed tabs from tags

* adjusted mappings and added techniques

* adjusted endgame rule mappings per review

* adjusted names to match different tactics

* added execution and defense evasion tag

* adjustments to address errors from merging with main

* added newlines to rules missing them at the end of the file

Co-authored-by: imays11 <59296946+imays11@users.noreply.github.com>
Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>
 2022-07-22 14:30:34 -04:00
Mika Ayenson cd11001fe8 [Rule Tuning] Attempt to Remove File Quarantine Attribute (#2117) 
* Add exceptions for browser FPs
 2022-07-22 14:26:48 -04:00
Mika Ayenson c1c83a536c [Rule Tuning] Kerberos Cached Credentials Dumping (#2103) 
* Updated description to include threat actor utilization
 2022-07-22 14:19:04 -04:00
Mika Ayenson a9de227cfa [Rule Tuning] Access to Keychain Credentials Directories (#2101) 
* rule tune to remove noisy FPs
 2022-07-22 14:14:12 -04:00
Mika Ayenson aaf9a708ae [Rule Tuning] Access of Stored Browser Credentials (#2098) 
* audit update : added technique T1539 and excluded additional cookies path
 2022-07-22 13:57:59 -04:00
Jonhnathan 7ddae4b493 [Security Content] Add Investigation Guides - Cloud - 2 (#2124) 
* [Security Content] Add Investigation Guides - Cloud - 2

* Replace config/setup

* Applies suggestions from review

* Update credential_access_aws_iam_assume_role_brute_force.toml

* Apply suggestions from code review

* Update credential_access_aws_iam_assume_role_brute_force.toml

* Apply suggestions from code review

Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com>

Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com>
 2022-07-22 14:32:42 -03:00
Colson Wilhoit 98d93bc21e [New Rule] Hidden so file (#2131) 
* [New Rule] Hidden Shared Object File

* [Rule Tuning] Hidden File from Tmp

* Update updated_date

* Update rules/linux/defense_evasion_hidden_shared_object.toml

* Update rules/linux/defense_evasion_hidden_shared_object.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* Update rules/linux/defense_evasion_hidden_shared_object.toml

* Update rules/linux/defense_evasion_hidden_shared_object.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
 2022-07-22 11:37:47 -05:00
Samirbous d312f49117 [New Rule] Suspicious HTML File Creation (#2068) 
* [New Rule] Suspicious HTML File Creation

* Update initial_access_evasion_suspicious_htm_file_creation.toml

* Update non-ecs-schema.json

* Update initial_access_evasion_suspicious_htm_file_creation.toml

* Update rules/windows/initial_access_evasion_suspicious_htm_file_creation.toml

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>
 2022-07-22 16:21:53 +02:00
Terrance DeJesus 9cefd88b90 removed googlecloud.audit from event datasets (#2105) 2022-07-21 12:11:15 -04:00
Terrance DeJesus 5ff3844fbe [Rule Tuning] GCP Firewall Rules Should Include App Engine (#2107) 
* removed googlecloud.audit and added app engine event actions

* adjusted query for rule created

* adjusted queries to exclude v1

* Update rules/integrations/gcp/defense_evasion_gcp_firewall_rule_deleted.toml

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
 2022-07-21 11:56:28 -04:00
Jonhnathan d854b943e5 [Security Content] Add Investigation Guides to Cloud Rules - AWS (#2104) 
* [Security Content] Add Investigation Guides to Cloud Rules - AWS

* Apply suggestion from review

* Update rules/integrations/aws/exfiltration_ec2_snapshot_change_activity.toml

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

* Update rules/integrations/aws/impact_cloudwatch_log_stream_deletion.toml

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

* Apply suggestions from review

* Apply suggestions from code review

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

* Apply suggestions from code review

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

* .

* Applies suggestions from the https://github.com/elastic/detection-rules/pull/2124 PR

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>
 2022-07-20 12:28:58 -03:00
Samirbous 59736e3973 [New Rule] Suspicious LSASS Access via MalSecLogon (#2063) 
* [New Rule]

Identifies suspicious access to LSASS handle from a call trace pointing to seclogon.dll and with a suspicious access rights value, this may indicate an attempt to leak an Lsass handle via abusing the Secondary Logon service in preparation for credential access.

https://splintercod3.blogspot.com/p/the-hidden-side-of-seclogon-part-3.html

Data:

```
{
  "_index": ".ds-logs-windows.sysmon_operational-default-2022.06.16-000005",
  "_id": "QxU4rIEBTJjT82fLq8Cf",
  "_score": 1,
  "_source": {
    "agent": {
      "name": "02694w-win10",
      "id": "85e87161-ea22-4847-a978-fb4ed45ebf0e",
      "type": "filebeat",
      "ephemeral_id": "137d194a-e542-4cd6-a1e3-f4ca9f5ad6b8",
      "version": "8.0.0"
    },
    "process": {
      "name": "svchost.exe",
      "pid": 456,
      "thread": {
        "id": 15264
      },
      "entity_id": "{6a3c3ef2-3646-62ab-1300-00000000d300}",
      "executable": "C:\\WINDOWS\\system32\\svchost.exe"
    },
    "winlog": {
      "computer_name": "02694w-win10.threebeesco.com",
      "process": {
        "pid": 2680,
        "thread": {
          "id": 3988
        }
      },
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "event_data": {
        "GrantedAccess": "0x14c0",
        "TargetProcessId": "680",
        "SourceUser": "NT AUTHORITY\\SYSTEM",
        "TargetImage": "C:\\WINDOWS\\system32\\lsass.exe",
        "CallTrace": "C:\\WINDOWS\\SYSTEM32\\ntdll.dll+9c534|C:\\WINDOWS\\System32\\KERNELBASE.dll+2726e|c:\\windows\\system32\\seclogon.dll+128f|c:\\windows\\system32\\seclogon.dll+10a0|C:\\WINDOWS\\System32\\RPCRT4.dll+76953|C:\\WINDOWS\\System32\\RPCRT4.dll+da036|C:\\WINDOWS\\System32\\RPCRT4.dll+37a4c|C:\\WINDOWS\\System32\\RPCRT4.dll+548c8|C:\\WINDOWS\\System32\\RPCRT4.dll+2c921|C:\\WINDOWS\\System32\\RPCRT4.dll+2c1db|C:\\WINDOWS\\System32\\RPCRT4.dll+1a86f|C:\\WINDOWS\\System32\\RPCRT4.dll+19d1a|C:\\WINDOWS\\System32\\RPCRT4.dll+19301|C:\\WINDOWS\\System32\\RPCRT4.dll+18d6e|C:\\WINDOWS\\System32\\RPCRT4.dll+169a5|C:\\WINDOWS\\SYSTEM32\\ntdll.dll+333ed|C:\\WINDOWS\\SYSTEM32\\ntdll.dll+34142|C:\\WINDOWS\\System32\\KERNEL32.DLL+17bd4|C:\\WINDOWS\\SYSTEM32\\ntdll.dll+6ce51",
        "TargetProcessGUID": "{6a3c3ef2-3646-62ab-0c00-00000000d300}",
        "TargetUser": "NT AUTHORITY\\SYSTEM"
      },
      "opcode": "Info",
      "version": 3,
      "record_id": "1825496",
      "task": "Process accessed (rule: ProcessAccess)",
      "event_id": "10",
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "api": "wineventlog",
      "provider_name": "Microsoft-Windows-Sysmon",
      "user": {
        "identifier": "S-1-5-18",
        "domain": "NT AUTHORITY",
        "name": "SYSTEM",
        "type": "User"
      }
    },
    "log": {
      "level": "information"
    },
    "elastic_agent": {
      "id": "85e87161-ea22-4847-a978-fb4ed45ebf0e",
      "version": "8.0.0",
      "snapshot": false
    },
    "message": "Process accessed:\nRuleName: -\nUtcTime: 2022-06-28 21:29:49.829\nSourceProcessGUID: {6a3c3ef2-3646-62ab-1300-00000000d300}\nSourceProcessId: 456\nSourceThreadId: 15264\nSourceImage: C:\\WINDOWS\\system32\\svchost.exe\nTargetProcessGUID: {6a3c3ef2-3646-62ab-0c00-00000000d300}\nTargetProcessId: 680\nTargetImage: C:\\WINDOWS\\system32\\lsass.exe\nGrantedAccess: 0x14C0\nCallTrace: C:\\WINDOWS\\SYSTEM32\\ntdll.dll+9c534|C:\\WINDOWS\\System32\\KERNELBASE.dll+2726e|c:\\windows\\system32\\seclogon.dll+128f|c:\\windows\\system32\\seclogon.dll+10a0|C:\\WINDOWS\\System32\\RPCRT4.dll+76953|C:\\WINDOWS\\System32\\RPCRT4.dll+da036|C:\\WINDOWS\\System32\\RPCRT4.dll+37a4c|C:\\WINDOWS\\System32\\RPCRT4.dll+548c8|C:\\WINDOWS\\System32\\RPCRT4.dll+2c921|C:\\WINDOWS\\System32\\RPCRT4.dll+2c1db|C:\\WINDOWS\\System32\\RPCRT4.dll+1a86f|C:\\WINDOWS\\System32\\RPCRT4.dll+19d1a|C:\\WINDOWS\\System32\\RPCRT4.dll+19301|C:\\WINDOWS\\System32\\RPCRT4.dll+18d6e|C:\\WINDOWS\\System32\\RPCRT4.dll+169a5|C:\\WINDOWS\\SYSTEM32\\ntdll.dll+333ed|C:\\WINDOWS\\SYSTEM32\\ntdll.dll+34142|C:\\WINDOWS\\System32\\KERNEL32.DLL+17bd4|C:\\WINDOWS\\SYSTEM32\\ntdll.dll+6ce51\nSourceUser: NT AUTHORITY\\SYSTEM\nTargetUser: NT AUTHORITY\\SYSTEM",
    "input": {
      "type": "winlog"
    },
    "@timestamp": "2022-06-28T21:29:49.829Z",
    "ecs": {
      "version": "1.12.0"
    },
    "data_stream": {
      "namespace": "default",
      "type": "logs",
      "dataset": "windows.sysmon_operational"
    },
    "host": {
      "hostname": "02694w-win10",
      "os": {
        "build": "18363.815",
        "kernel": "10.0.18362.815 (WinBuild.160101.0800)",
        "name": "Windows 10 Enterprise",
        "type": "windows",
        "family": "windows",
        "version": "10.0",
        "platform": "windows"
      },
      "ip": [
        "fe80::7587:a5c1:5a7b:68f6",
        "172.16.66.25"
      ],
      "name": "02694w-win10.threebeesco.com",
      "id": "6a3c3ef2-208f-4d6f-90ee-b34f4e3fd160",
      "mac": [
        "00:50:56:03:c6:93"
      ],
      "architecture": "x86_64"
    },
    "event": {
      "agent_id_status": "verified",
      "ingested": "2022-06-28T21:30:04Z",
      "code": "10",
      "provider": "Microsoft-Windows-Sysmon",
      "created": "2022-06-28T21:29:51.107Z",
      "kind": "event",
      "action": "Process accessed (rule: ProcessAccess)",
      "category": [
        "process"
      ],
      "type": [
        "access"
      ],
      "dataset": "windows.sysmon_operational"
    },
    "user": {
      "id": "S-1-5-18"
    }
  },
  "fields": {
    "elastic_agent.version": [
      "8.0.0"
    ],
    "event.category": [
      "process"
    ],
    "host.os.name.text": [
      "Windows 10 Enterprise"
    ],
    "winlog.provider_guid": [
      "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}"
    ],
    "winlog.provider_name": [
      "Microsoft-Windows-Sysmon"
    ],
    "host.hostname": [
      "02694w-win10"
    ],
    "winlog.computer_name": [
      "02694w-win10.threebeesco.com"
    ],
    "process.pid": [
      456
    ],
    "host.mac": [
      "00:50:56:03:c6:93"
    ],
    "winlog.process.pid": [
      2680
    ],
    "host.os.version": [
      "10.0"
    ],
    "winlog.record_id": [
      "1825496"
    ],
    "winlog.event_data.TargetUser": [
      "NT AUTHORITY\\SYSTEM"
    ],
    "host.os.name": [
      "Windows 10 Enterprise"
    ],
    "log.level": [
      "information"
    ],
    "agent.name": [
      "02694w-win10"
    ],
    "host.name": [
      "02694w-win10.threebeesco.com"
    ],
    "event.agent_id_status": [
      "verified"
    ],
    "event.kind": [
      "event"
    ],
    "winlog.version": [
      3
    ],
    "host.os.type": [
      "windows"
    ],
    "user.id": [
      "S-1-5-18"
    ],
    "input.type": [
      "winlog"
    ],
    "data_stream.type": [
      "logs"
    ],
    "host.architecture": [
      "x86_64"
    ],
    "process.name": [
      "svchost.exe"
    ],
    "event.provider": [
      "Microsoft-Windows-Sysmon"
    ],
    "event.code": [
      "10"
    ],
    "agent.id": [
      "85e87161-ea22-4847-a978-fb4ed45ebf0e"
    ],
    "ecs.version": [
      "1.12.0"
    ],
    "event.created": [
      "2022-06-28T21:29:51.107Z"
    ],
    "winlog.event_data.CallTrace": [
      "C:\\WINDOWS\\SYSTEM32\\ntdll.dll+9c534|C:\\WINDOWS\\System32\\KERNELBASE.dll+2726e|c:\\windows\\system32\\seclogon.dll+128f|c:\\windows\\system32\\seclogon.dll+10a0|C:\\WINDOWS\\System32\\RPCRT4.dll+76953|C:\\WINDOWS\\System32\\RPCRT4.dll+da036|C:\\WINDOWS\\System32\\RPCRT4.dll+37a4c|C:\\WINDOWS\\System32\\RPCRT4.dll+548c8|C:\\WINDOWS\\System32\\RPCRT4.dll+2c921|C:\\WINDOWS\\System32\\RPCRT4.dll+2c1db|C:\\WINDOWS\\System32\\RPCRT4.dll+1a86f|C:\\WINDOWS\\System32\\RPCRT4.dll+19d1a|C:\\WINDOWS\\System32\\RPCRT4.dll+19301|C:\\WINDOWS\\System32\\RPCRT4.dll+18d6e|C:\\WINDOWS\\System32\\RPCRT4.dll+169a5|C:\\WINDOWS\\SYSTEM32\\ntdll.dll+333ed|C:\\WINDOWS\\SYSTEM32\\ntdll.dll+34142|C:\\WINDOWS\\System32\\KERNEL32.DLL+17bd4|C:\\WINDOWS\\SYSTEM32\\ntdll.dll+6ce51"
    ],
    "agent.version": [
      "8.0.0"
    ],
    "host.os.family": [
      "windows"
    ],
    "process.thread.id": [
      15264
    ],
    "winlog.event_data.TargetProcessGUID": [
      "{6a3c3ef2-3646-62ab-0c00-00000000d300}"
    ],
    "winlog.process.thread.id": [
      3988
    ],
    "winlog.event_data.TargetImage": [
      "C:\\WINDOWS\\system32\\lsass.exe"
    ],
    "winlog.event_data.TargetProcessId": [
      "680"
    ],
    "process.entity_id": [
      "{6a3c3ef2-3646-62ab-1300-00000000d300}"
    ],
    "host.os.build": [
      "18363.815"
    ],
    "winlog.user.type": [
      "User"
    ],
    "host.ip": [
      "fe80::7587:a5c1:5a7b:68f6",
      "172.16.66.25"
    ],
    "agent.type": [
      "filebeat"
    ],
    "event.module": [
      "windows"
    ],
    "host.os.kernel": [
      "10.0.18362.815 (WinBuild.160101.0800)"
    ],
    "winlog.api": [
      "wineventlog"
    ],
    "elastic_agent.snapshot": [
      false
    ],
    "host.id": [
      "6a3c3ef2-208f-4d6f-90ee-b34f4e3fd160"
    ],
    "process.executable": [
      "C:\\WINDOWS\\system32\\svchost.exe"
    ],
    "winlog.user.identifier": [
      "S-1-5-18"
    ],
    "winlog.event_data.SourceUser": [
      "NT AUTHORITY\\SYSTEM"
    ],
    "winlog.task": [
      "Process accessed (rule: ProcessAccess)"
    ],
    "winlog.user.domain": [
      "NT AUTHORITY"
    ],
    "elastic_agent.id": [
      "85e87161-ea22-4847-a978-fb4ed45ebf0e"
    ],
    "data_stream.namespace": [
      "default"
    ],
    "winlog.event_data.GrantedAccess": [
      "0x14c0"
    ],
    "message": [
      "Process accessed:\nRuleName: -\nUtcTime: 2022-06-28 21:29:49.829\nSourceProcessGUID: {6a3c3ef2-3646-62ab-1300-00000000d300}\nSourceProcessId: 456\nSourceThreadId: 15264\nSourceImage: C:\\WINDOWS\\system32\\svchost.exe\nTargetProcessGUID: {6a3c3ef2-3646-62ab-0c00-00000000d300}\nTargetProcessId: 680\nTargetImage: C:\\WINDOWS\\system32\\lsass.exe\nGrantedAccess: 0x14C0\nCallTrace: C:\\WINDOWS\\SYSTEM32\\ntdll.dll+9c534|C:\\WINDOWS\\System32\\KERNELBASE.dll+2726e|c:\\windows\\system32\\seclogon.dll+128f|c:\\windows\\system32\\seclogon.dll+10a0|C:\\WINDOWS\\System32\\RPCRT4.dll+76953|C:\\WINDOWS\\System32\\RPCRT4.dll+da036|C:\\WINDOWS\\System32\\RPCRT4.dll+37a4c|C:\\WINDOWS\\System32\\RPCRT4.dll+548c8|C:\\WINDOWS\\System32\\RPCRT4.dll+2c921|C:\\WINDOWS\\System32\\RPCRT4.dll+2c1db|C:\\WINDOWS\\System32\\RPCRT4.dll+1a86f|C:\\WINDOWS\\System32\\RPCRT4.dll+19d1a|C:\\WINDOWS\\System32\\RPCRT4.dll+19301|C:\\WINDOWS\\System32\\RPCRT4.dll+18d6e|C:\\WINDOWS\\System32\\RPCRT4.dll+169a5|C:\\WINDOWS\\SYSTEM32\\ntdll.dll+333ed|C:\\WINDOWS\\SYSTEM32\\ntdll.dll+34142|C:\\WINDOWS\\System32\\KERNEL32.DLL+17bd4|C:\\WINDOWS\\SYSTEM32\\ntdll.dll+6ce51\nSourceUser: NT AUTHORITY\\SYSTEM\nTargetUser: NT AUTHORITY\\SYSTEM"
    ],
    "winlog.user.name": [
      "SYSTEM"
    ],
    "winlog.event_id": [
      "10"
    ],
    "event.ingested": [
      "2022-06-28T21:30:04.000Z"
    ],
    "event.action": [
      "Process accessed (rule: ProcessAccess)"
    ],
    "@timestamp": [
      "2022-06-28T21:29:49.829Z"
    ],
    "winlog.channel": [
      "Microsoft-Windows-Sysmon/Operational"
    ],
    "host.os.platform": [
      "windows"
    ],
    "data_stream.dataset": [
      "windows.sysmon_operational"
    ],
    "event.type": [
      "access"
    ],
    "winlog.opcode": [
      "Info"
    ],
    "agent.ephemeral_id": [
      "137d194a-e542-4cd6-a1e3-f4ca9f5ad6b8"
    ],
    "event.dataset": [
      "windows.sysmon_operational"
    ]
  }
}
```

* Update rules/windows/credential_access_lsass_handle_via_malseclogon.toml

* Update rules/windows/credential_access_lsass_handle_via_malseclogon.toml

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
 2022-07-20 16:30:19 +02:00
Jonhnathan 1276f98a70 [Rule Tuning] Elastic Agent Service Terminated (#2112) 2022-07-19 13:33:52 -03:00
Mika Ayenson a52751494e 2058 add setup field to metadata (#2061) 
* Convert config header to setup in note field
* Parse note field into separate setup and note field with marko gfm
* only validate and parse note on elastic authored rules and add CLI description for new DR_BYPASS_NOTE_VALIDATION_AND_PARSE environment variable

Co-authored-by: brokensound77 <brokensound77@users.noreply.github.com>
 2022-07-18 15:41:32 -04:00
Colson Wilhoit 9995558b2a [New Rule] Dynamic Linker Copy (#2099) 
* [New Rule] Dynamic Linker Copy

* Update rules/linux/persistence_dynamic_linker_backup.toml

* Update rules/linux/persistence_dynamic_linker_backup.toml

* Update rules/linux/persistence_dynamic_linker_backup.toml
 2022-07-13 10:17:46 -05:00
Colson Wilhoit 58ad0823ca [New Rule] Tc BPF Filter (#2091) 
* tc bpf filter

* Update rules/linux/execution_tc_bpf_filter.toml
 2022-07-13 09:41:46 -05:00
Jonhnathan 3a8efc8183 [Security Content] 8.4 - Add Investigation Guides (#2069) 
* [Security Content] 8.4 - Add Investigation Guides

* Apply suggestions from code review

Co-authored-by: Joe Peeples <joe.peeples@elastic.co>

* Update rules/windows/credential_access_cmdline_dump_tool.toml

Co-authored-by: Joe Peeples <joe.peeples@elastic.co>

* Apply suggestions from code review

Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com>

* Update rules/windows/credential_access_credential_dumping_msbuild.toml

Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com>

Co-authored-by: Joe Peeples <joe.peeples@elastic.co>
Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com>
 2022-07-13 11:28:34 -03:00
Colson Wilhoit d7d0466344 [New Rule] Insmod kernel module load (#2093) 
* insmod kernel module load

* Update rules/linux/persistence_insmod_kernel_module_load.toml

* Update rules/linux/persistence_insmod_kernel_module_load.toml
 2022-07-13 09:22:21 -05:00
Terrance DeJesus 7581234fe8 [Rule Tuning] Potential Reverse Shell Activity via Terminal (#2077) 
* adjusted query rule to exclude noisy FPs

* adjusted event.action to be event.type
 2022-07-12 22:33:38 -04:00
Mika Ayenson c76a397969 Add new required_fields as a build-time restricted field (#2059) 
* Add new `require_field` restricted field
* validate new fields against BaseRuleData schema and global constant

Co-authored-by: Terrance DeJesus <terrance.dejesus@elastic.co>
Co-authored-by: brokensound77 <brokensound77@users.noreply.github.com>
 2022-07-06 11:49:44 -04:00
Terrance DeJesus 329530c8c3 [New Rule] Domain Trust Enumeration via Nltest (#2010) 
* adding detection rule

* removed changes from unrelated rule

* adjusted threat technique

* Update rules/windows/discovery_enumerating_domain_trusts_via_nltest.toml

* Update rules/windows/discovery_enumerating_domain_trusts_via_nltest.toml

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>

* Update rules/windows/discovery_enumerating_domain_trusts_via_nltest.toml

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>

* Update rules/windows/discovery_enumerating_domain_trusts_via_nltest.toml

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
 2022-07-05 10:48:25 -04:00
Janeen Mikell-Straughn 13c63ceaef Fixing doc bugs reported by QA. (#2065) 
Co-authored-by: Craig Chamberlain <randomuserid@users.noreply.github.com>
 2022-06-30 15:59:48 -04:00
Jonhnathan 853f8db8d0 Update discovery_privileged_localgroup_membership.toml (#2046) 2022-06-30 14:26:17 -03:00
Craig Chamberlain 1bb2273c0c user risk score docs (#2055) 
* user risk score

initial create of user risk score docs

* add paragraph

adding another paragraph for explainabiltiy as suggested by pm

* Update docs/experimental-machine-learning/readme.md

Co-authored-by: Apoorva Joshi <30438249+ajosh0504@users.noreply.github.com>

* Update user-risk-score.md

fixes and suggestions

* Update user-risk-score.md

rm int script reference

* Update docs/experimental-machine-learning/user-risk-score.md

Co-authored-by: Apoorva Joshi <30438249+ajosh0504@users.noreply.github.com>

* Update user-risk-score.md

* Update user-risk-score.md

* Update user-risk-score.md

Co-authored-by: Apoorva Joshi <30438249+ajosh0504@users.noreply.github.com>
 2022-06-28 11:52:38 -04:00
Justin Ibarra cc01d3fb1a Add support for restricted fields (#2053) 
* Add support for restricted fields (fields valid only in min/max stack versions)
* add test to ensure rule backports wont exceed min compat
 2022-06-27 10:02:15 -05:00
Mika Ayenson 4ef1a1a627 Update cli documentation for search-alerts (#2051) 
* Add cli documentation for search-alerts and table fields
 2022-06-24 09:58:58 -04:00
Mika Ayenson 3f6be4155c test automatically prevent future merges when a backport fails (#1909) 
automatically prevent future merges when a backport fails
 2022-06-23 15:10:26 -04:00
Mika Ayenson 4fdd978183 test automatically prevent future merges when a backport fails (#1909) 
automatically prevent future merges when a backport fails
 2022-06-23 14:59:25 -04:00
github-actions[bot] fd9c9f8abf Locked versions for releases: 7.16,8.0,8.1,8.2,8.3 (#2041) 
Co-authored-by: terrancedejesus <terrancedejesus@users.noreply.github.com>
 2022-06-17 11:44:07 -04:00
shashank-elastic 2ee23bd80f [Rule tuning] existing strace activity rule. (#2028) 
* Update description and MITTRE Attack details
 2022-06-16 17:18:48 +05:30
Jonhnathan c8ff1dc9cb Update discovery_remote_system_discovery_commands_windows.toml (#2033) 2022-06-14 10:50:59 -03:00
Isai 63fda01fdd [New Rule] Kubernetes execution_user_exec_to_pod (#1979) 
* Create execution_user_exec_to_pod.toml

* Update execution_user_exec_to_pod.toml

* Update rules/integrations/kubernetes/execution_user_exec_to_pod.toml

* Update non-ecs-schema.json

* Update execution_user_exec_to_pod.toml

* Update rules/integrations/kubernetes/execution_user_exec_to_pod.toml

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

* Update execution_user_exec_to_pod.toml

* Update execution_user_exec_to_pod.toml

* Update execution_user_exec_to_pod.toml

* toml-linted file and add to false positive

toml-linted the file and added to the false positive description

* Create notepad.sct

Added this back into the repo, deleted by mistake.

* added min_stack_version based on integration

min stack version determined by integration support of necessary fields

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
 2022-06-09 17:52:45 -04:00
Justin Ibarra 744f56d98e [Bug] resolves bug in Rule version methods (#2021) 
* [Bug] resolves bug in Rule version methods

* comment out unused code with notes
 2022-06-07 15:40:46 -08:00
Jonhnathan 3aa53fc6c5 [Rule Tuning] M365 - Remove event.outcome condition from Auth Events (#2004) 
* Remove event.outcome condition

* Update credential_access_microsoft_365_brute_force_user_account_attempt.toml

* Revert "Update credential_access_microsoft_365_brute_force_user_account_attempt.toml"

This reverts commit c7e7c976174a62e6b50139291e8f7f1a34e7beab.

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
 2022-06-03 14:24:14 -03:00
Jonhnathan b6631f200e Update persistence_sdprop_exclusion_dsheuristics.toml (#2017) 2022-06-03 14:22:04 -03:00
Jonhnathan f857e009c5 Adds logs-system.* index pattern (#2016) 2022-06-03 13:56:54 -03:00
Justin Ibarra e850f39526 [Bug] Fix test_matrix_to_lock_version_defaults test (#2014) 2022-06-02 16:34:54 -08:00
Justin Ibarra f57950a3c9 Collapse unsupported previous version entries (#2013) 
* Collapse unsupported previous version entries
* drop the last entry in the matrix test
 2022-06-02 15:18:12 -08:00
Terrance DeJesus 35b1a69ff5 Prep for Creation of 8.4 Branch (#2001) 
* prepping for 8.4 branch

* adjusted schemas init file

* adjusted target matrix to only backport to 7.16, updated api schemas

* adjusted the lock-versions workflow to account for 7.16 and up support only

* Add test for version lock to schema map correlation

* decouple from static 7.13 references

* keep patch version for lock

* Update detection_rules/etc/packages.yml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>
Co-authored-by: brokensound77 <brokensound77@users.noreply.github.com>
 2022-06-02 14:59:18 -04:00
shashank-elastic f02325fe2f [Rule Tuning] Add MITRE Details to exisisting hpining activity rule. (#2012) 
* Add MITRE Details to existing hping activity rule.
 2022-06-02 10:36:23 +05:30
shashank-elastic 98a85ddcee Linux binary(s) ftp shell evasion threat (#2007) 
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
 2022-06-01 22:07:52 +05:30
Samirbous d6e96a83d5 [New Rule] Suspicious Microsoft Diagnostics Wizard Execution (#2005) 
* [New Rule] Suspicious Microsoft Diagnostics Wizard Execution

https://lolbas-project.github.io/lolbas/Binaries/Msdt/
https://twitter.com/nao_sec/status/1530196847679401984

* Update rules/windows/defense_evasion_proxy_execution_via_msdt.toml

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>
 2022-06-01 17:02:47 +02:00