security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,447 Commits 1 Branch 0 Tags
2eda02c10e1f4cecb9b9155773e1082bb44d0b83
Commit Graph

1447 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Samirbous 2eda02c10e [Rule Tuning] Multiple Logon Failure from the same Source Address (#2588) 
* Update credential_access_bruteforce_multiple_logon_failure_same_srcip.toml

* Update rules/windows/credential_access_bruteforce_multiple_logon_failure_same_srcip.toml

* Update rules/windows/credential_access_bruteforce_multiple_logon_failure_same_srcip.toml

---------

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
 2023-04-24 09:16:17 -03:00
shashank-elastic 2996c79ff4 Detect Mount Execution With Hidepid Parameter (#2706) 2023-04-22 08:00:30 +05:30
Jonhnathan 84acf004da [Rule Tuning] Component Object Model Hijacking (#2730) 2023-04-21 18:43:02 -03:00
Jonhnathan 12d6b49a24 [Rule Tuning] Potential Credential Access via Windows Utilities (#2727) 
* [Rule Tuning] Potential Credential Access via Windows Utilities

* Add system integration index

---------

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
 2023-04-21 18:27:44 -03:00
Terrance DeJesus b5ef2f5f02 [FR] Generate Historical Rule Files in Build Release Packages (#2715) 
* adding solution for historical rules in release package

* addressing flake errors

* format changes

* REVERT CHANGES - testing release-fleet workflow

* REVERTING CHANGES

* added historical flag for packaging to account for older branches

* addressing flake errors

* updated build for CI

* REMOVE: This is temporary to run a workflow from this branch

* updates to address requirements for contents

* reverting packages.yml

* Update detection_rules/integrations.py

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

* Update detection_rules/integrations.py

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

* addressed feedback and added click echo comments

* addressed flake errors and added some comments

---------

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>
 2023-04-21 11:03:29 -04:00
Jonhnathan 255c53cff0 [Rule Tuning] Connection to Commonly Abused Web Services (#2728) 
Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
 2023-04-20 18:26:00 -03:00
Jonhnathan b1e3215cd5 [Rule Tuning] Tune PowerShell rule FPs related to MS ATP (#2729) 2023-04-20 12:37:06 -03:00
shashank-elastic 2705df81e2 Tune Shell evasion Rule to incorporate GTFOArgs shell evasion (#2687) 2023-04-20 18:35:18 +05:30
shashank-elastic f7aa477536 Correct Event Action to include endgame event schema (#2610) 2023-04-20 17:28:01 +05:30
shashank-elastic 94baa89ea8 New Rule to identify defense evasion via PRoot (#2625) 2023-04-20 17:14:01 +05:30
eric-forte-elastic 8ef2f6557b Patch to allow integration validation if ECS/beats fails (#2701) 
* Updated for AND logic

* Added case for no package_intregrations

* Fixed linting

* Added unit test for new functionality

* Fixed linting

* Added valid query tests

* Add unit test for event.dataset

* Switched type calls to isinstance calls

* Removed  unused stack validation call

* Added additional error type

* Fixed linting

* Cleaned up error handling

* fixed linting

* Added proper type hints

* Fixed typo in Unions

* Updated unit test with additional test cases

* Updated  test_invalid_queries unit test

* Fixed linting

* Added kql to unit tests

* Updated tests

* Fixed error handling

* Fixed style issues

* updating integration manifests and schemas

---------

Co-authored-by: terrancedejesus <terrance.dejesus@elastic.co>
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
 2023-04-18 15:43:35 -04:00
Jonhnathan fb09208132 [Rule Tuning] Connection to Commonly Abused Web Services (#2717) 
* [Rule Tuning] Connection to Commonly Abused Web Services

* Update command_and_control_common_webservices.toml
 2023-04-18 09:15:47 -03:00
Terrance DeJesus f21a9e4793 updating min stack comments (#2712) 2023-04-12 14:30:34 -04:00
Terrance DeJesus 894e34f82c [Bug] Add new-package argument to bump-pkg-versions CLI (#2703) 
* initial changes to release fleet workflow and CLI

* changed the default value of package version for 8.8

* changed how true/false is passed into CLI command

* reverted changes to packages.yml
 2023-04-12 13:48:58 -04:00
Terrance DeJesus d6f277e379 [New Rule] Google Workspace New OAuth Login from Third-Party Application (#2677) 
* adding new rule 'Google Workspace New OAuth Login from Custom Application'

* changed name and 'custom' to 'third-party'

* Update rules/integrations/google_workspace/defense_evasion_google_workspace_new_oauth_login_from_third_party_application.toml

* Update rules/integrations/google_workspace/defense_evasion_google_workspace_new_oauth_login_from_third_party_application.toml

* updated non-ecs
 2023-04-12 09:40:31 -04:00
Terrance DeJesus 4511ab0666 [Rule Tuning] Add Sequence for OAuth Authorization to Custom App - Google Workspace (#2674) 
* tuning rule to add token sequence

* updated date

* updated non-ecs, integration schemas and manifests

* added investigation guide

* Updating note

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>

* updating note

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>

* updated false positive description

* updating manifest and schemas with main to resolve conflicts

---------

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>
 2023-04-12 09:15:58 -04:00
Jonhnathan 16749e45ae [Rule Tuning] Third-party Backup Files Deleted via Unexpected Process (#2704) 
* [Rule Tuning] Third-party Backup Files Deleted via Unexpected Process

* Update impact_backup_file_deletion.toml
 2023-04-11 13:47:52 -03:00
Mika Ayenson e9ebb1f2d8 [Bug] Rename 8.7 schemas from *.master and strip build time fields (#2707) 2023-04-11 10:56:20 -04:00
github-actions[bot] 6edfb32160 Lock versions for releases: 7.16,8.0,8.1,8.2,8.3,8.4,8.5,8.6,8.7 (#2702) 
* Locked versions for releases: 7.16,8.0,8.1,8.2,8.3,8.4,8.5,8.6,8.7

* kicking off testing

* removed change to kickoff testing

---------

Co-authored-by: terrancedejesus <terrancedejesus@users.noreply.github.com>
Co-authored-by: terrancedejesus <terrance.dejesus@elastic.co>
 2023-04-10 11:24:16 -04:00
Eric d1aadde671 [Rule Tuning] Suspicious Antimalware Scan Interface DLL (#2671) (#2672) 
* --amend

* --amend

---------

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
 2023-04-06 15:15:57 -03:00
Karl Godard d0ea8c6f98 [New Rule] new CWP rule to surface alerts from the cloud_defend integration (#2679) 
* new CWP rule to surface alerts from the cloud_defend integration

* created new rule uuid

* updated version info. removed risk level overrides and endpoint exception list

* added event.module

* removed rule name override

* updated_date and min_stack_comments updated

* updated external alerts updated_date. added kubernetes to cwp rule tags

---------

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
 2023-04-05 21:31:03 -03:00
Jonhnathan 1a9b0e732c [Rule Tuning] Potential PowerShell HackTool Script by Function Names (#2692) 2023-04-05 16:48:33 -03:00
Jonhnathan eafe54c2cc [Rule Tuning] Potential LSASS Clone Creation via PssCaptureSnapShot (#2691) 2023-04-05 13:28:57 -03:00
Jonhnathan 5aaac84f3a [Rule Tuning] Suspicious service was installed in the system (#2693) 
* [Rule Tuning] Suspicious service was installed in the system

* Update persistence_service_windows_service_winlog.toml
 2023-04-05 13:23:47 -03:00
Samirbous 0c8d0bfd3d [New Rule] Suspicious Execution via Microsoft Office Add-Ins (#2651) 
* Create

* Update initial_access_execution_via_office_addins.toml

* Update initial_access_execution_via_office_addins.toml

* Update initial_access_execution_via_office_addins.toml

* Update rules/windows/initial_access_execution_via_office_addins.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

---------

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
 2023-04-05 17:02:04 +01:00
Terrance DeJesus e878f4b820 adding fix for unit testing that broke in 8.3 (#2683) 2023-04-03 10:11:26 -04:00
Terrance DeJesus 71d12bdda4 [Bug] Unit Tests Passing for Rules with Integrations Not Reflected in Manifests (#2682) 
* add promotion to rulemeta schema class and updated promotion rules

* add promotion to rulemeta schema class and updated promotion rules

* adjusted test_integration_tag and okta rule missing dataset

* fixed flake errors

* updated manifests and schemas to include cloud defend
 2023-04-03 09:42:40 -04:00
Samirbous 51d50b7d8a [New Rule] Lsass Process Access - Generic (#2613) 
* Create credential_access_lsass_openprocess_api.toml

* Update credential_access_lsass_openprocess_api.toml

* Update credential_access_lsass_openprocess_api.toml

* Update non-ecs-schema.json

* Update rules/windows/credential_access_lsass_openprocess_api.toml

Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>

* Update rules/windows/credential_access_lsass_openprocess_api.toml

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

* Update rules/windows/credential_access_lsass_openprocess_api.toml

Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>

* Update rules/windows/credential_access_lsass_openprocess_api.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/windows/credential_access_lsass_openprocess_api.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/windows/credential_access_lsass_openprocess_api.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update credential_access_lsass_openprocess_api.toml

* Update non-ecs-schema.json

---------

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>
Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
 2023-04-03 14:34:30 +01:00
Charlie Pichette 9713384888 Add Rule Id and Rule Name to the RTA Test List Function (#2680) 2023-03-31 16:08:42 -04:00
eric-forte-elastic 94621d7567 Update layer version to 4.4 (#2676) 2023-03-30 12:29:17 -04:00
Samirbous 892757f4a4 [New Rule] Potential Pass The Hash (#2670) 
* Create lateral_movement_alternate_creds_pth.toml

* Update rules/windows/lateral_movement_alternate_creds_pth.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/windows/lateral_movement_alternate_creds_pth.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/windows/lateral_movement_alternate_creds_pth.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

---------

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
 2023-03-29 19:37:27 +01:00
Jonhnathan 5ed2120e3f [Rule Tuning] Potential Credential Access via Windows Utilities (#2659) 
* [Rule Tuning] Potential Credential Access via Windows Utilities

* Update credential_access_cmdline_dump_tool.toml
 2023-03-29 09:32:36 -03:00
Justin Ibarra 411ec36ff0 Validate markdown plugin fields (#2602) 2023-03-28 09:17:50 -04:00
Terrance DeJesus 7e28b8fc50 [FR] Support Rule Alert Suppression in Rule Schema (#2660) 
* adding initial solution for alert suppression support in rule schema

* reverting rule changes

* fixing flake errors

* reverting rule changes

* adding unit tests

* addressing flake errors

* Update detection_rules/rule.py

Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>

* Update detection_rules/schemas/definitions.py

Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>

* adjusting rule.py after commits

* adjusted test_group_field_in_schemas to check integrations

* Update detection_rules/rule.py

Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>

* Update detection_rules/rule.py

Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>

* nested AlertSuppressDuration class under mapping class

* adjusted dataclass naming

* added unit test to ensure rule is KQL

* fixing flake errors

* added docstrings

---------

Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>
 2023-03-27 15:37:35 -04:00
Jonhnathan 192047f46d [Rule Tuning] Potential Antimalware Scan Interface Bypass via PowerShell (#2663) 2023-03-27 11:50:53 -03:00
Ruben Groenewoud 3bfe3060a2 [Rule Tuning] Uncommon Registry Persistence Change (#2538) 
* [Rule Tuning] Uncommon Registry Persistence Change

* updated updated_date

---------

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
 2023-03-26 00:35:23 +01:00
Mika Ayenson 11d79912f1 [FR] Add new macOS RTAs for Endpoint Rules - 2 (#2661) 2023-03-24 17:29:22 -04:00
Mika Ayenson 62ec0ae086 [FR] Add new macOS RTAs for Endpoint Rules (#2632) 2023-03-24 16:53:37 -04:00
Terrance DeJesus 76500f0d46 [New Rule] Google Workspace Drive - Encryption Key(s) Accessed from Anonymous User (#2654) 
* new rule 'Google Workspace Drive Encryption Key(s) Accessed from Anonymous User'

* updated MITRE ATT&CK mappings
 2023-03-24 12:21:56 -04:00
Jonhnathan fd0d7a1d00 [RTA] Adds RTAs to Windows Rules - 2 (#2628) 
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
 2023-03-24 10:13:12 -03:00
Jonhnathan 95b8b1688b [RTA] Add RTAs for Endpoint Rules - 2 (#2633) 
* [RTA] Add RTAs for Endpoint Rules - 2

* Update exec_conhost_indirect.py

* Update msoffice_file_dll_sideload.py

---------

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
 2023-03-24 09:55:32 -03:00
Jonhnathan 5c792b86d7 [RTA] Adds RTAs for endpoint rules (#2621) 
* [RTA] Adds RTAs for endpoint rules

* Update exec_cscript_archive_args.py

* Review RTAs 1/2

* Update suspicious_msiexec_child.py

* Update rta/exec_cscript_archive_args.py

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

---------

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
 2023-03-23 18:14:06 -03:00
Jonhnathan 32ca0001ff [Rule Tuning] Untrusted Driver Loaded (#2656) 2023-03-23 08:26:52 -03:00
Ruben Groenewoud 0d1fca454a New Rule: Suspicious Mining Process Creation Event (#2531) 
* New Rule: Suspicious Mining Process Creation Event

* added host.os.type==linux

* trying to fix unit testing

* Revert "trying to fix unit testing"

This reverts commit ab3f371300fa400baa287b54e5f38b4855fc6512.

* unit testing fix attempt

* Revert "unit testing fix attempt"

This reverts commit 8b59343a5923a004423cf665b167611ef0129a9d.

* added endgame support

---------

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
 2023-03-21 16:35:25 +01:00
Terrance DeJesus 7be5788945 [New Rule] Google Workspace Resource Copied from External Drive (#2627) 
* added new rule 'Google Workspace Resource Copied from External Drive'

* adjusted mitre att&ck subtechnique ID
 2023-03-20 14:37:58 -04:00
Terrance DeJesus 2c5470349c [New Rule] External User Added to Private Organization Group (#2577) 
* new rule 'External User Added to Google Workspace Group'

* Update rules/integrations/google_workspace/initial_access_external_user_added_to_google_workspace_group.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update rules/integrations/google_workspace/initial_access_external_user_added_to_google_workspace_group.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* added Investigation Guide tag

---------

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
 2023-03-20 14:32:42 -04:00
Jonhnathan f41c5288cc [RTA] New RTAs for Windows Rules (#2426) 
* Part 1

* Part 2

* Part3

* Part4

* Final Part

* Dedup RTA where Office app loads wmiutils

* Add techniques

* Remove helper

* Update exec_cmd_set_mppreference.py
 2023-03-20 07:56:51 -03:00
Ruben Groenewoud eab30d7456 [Rule Tuning] Namespace Manipulation Using Unshare (#2599) 
* [Rule Tuning] Namespace Manipulation Using Unshare

* reverted updated_date change

---------

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
 2023-03-20 07:36:47 -03:00
Terrance DeJesus f40ad93224 [Bug] Failed CI Unit Tests from Marshmallow Dataclass and Typing Updates (#2645) 2023-03-17 16:38:35 -04:00
Ruben Groenewoud 672211500c [Rule Fix] Privileged SSH Brute Force Detected (#2595) 2023-03-14 15:42:58 -04:00