61b731c300
[Rule Tuning] Remove Salesforce Client User-Agent Whitelisting in MFA Deactivation with no Re-Activation for Okta User Account ( #4145 )
...
* tuning
* added note about whitelisting user agent
* removed extra new line
2024-10-16 11:41:50 -04:00
06319b7a13
[Rule Tuning] Add KEEP Command to all ES|QL Rules ( #4146 )
...
* updating ES|QL rules to include KEEP command
* fixed some ES|QL rules with typos; added validation for KEEP command
* fixed ES|QL errors from missing fields
* fixed flake errors
* updated date
* added best practices to hunt docs
2024-10-09 21:08:38 -04:00
281926052c
[Rule Tuning] Add METADATA checks for non-aggregate ES|QL queries and fix existing ( #4126 )
...
* fixed existing rules;added query checks
* fixed flake errors
* added re.DOTALL to regex pattern, adjusted pattern slightly; reverted some rules
* removed valueError and replaced ValidationError
* adjusted validation error output based on feedback
* Update rules/integrations/aws/persistence_iam_user_created_access_keys_for_another_user.toml
Co-authored-by: Isai <59296946+imays11@users.noreply.github.com >
* Update rules/integrations/aws/persistence_iam_user_created_access_keys_for_another_user.toml
Co-authored-by: Isai <59296946+imays11@users.noreply.github.com >
* added space for failure
* updated to use re.compile
---------
Co-authored-by: Isai <59296946+imays11@users.noreply.github.com >
2024-10-09 15:25:36 -04:00
7674229f49
[New Rule] Successful Application SSO from Rare Unknown Client Device ( #4141 )
...
* new rule 'Successful Application SSO from Rare Unknown Client Device'
* removing extra newlines
* adjusted tags; adjusted risk
2024-10-07 12:11:57 -04:00
45a347580c
[Rule Tuning] Fixing Incorrect ES|QL Operator Use - AWS Service Quotas Multi-Region GetServiceQuota Request ( #4118 )
...
* fixing single equal operator
* Additional data source tag for consistency
---------
Co-authored-by: Isai <59296946+imays11@users.noreply.github.com >
2024-10-02 15:50:22 -04:00
ef4e433d97
[Rule Tuning] Ignore "Not Available" in o365.audit.UserId for Microsoft 365 Rules ( #4105 )
...
* tuning M365 impossible travel activity rules
* added additional filters for user type logins
* adjusted updated date
2024-09-28 18:13:03 -04:00
ef95a541f4
Fix GenAI Request Model ID Field ( #4111 )
2024-09-27 21:59:02 +05:30
b80d8342d6
[Docs | Rule Tuning] Add blog references to rules ( #4097 )
...
* [Docs | Rule Tuning] Add blog references to rules
* Apply suggestions from code review
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com >
* Apply suggestions from code review
* Update google_workspace blog references
* add okta blog references
* Update dates
---------
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com >
2024-09-25 15:19:20 -05:00
0ed6b3f0a2
[Rule Tuning] AWS STS GetCallerIdentity API Called for the First Time ( #4094 )
...
Tuning this rule to exclude identity type `AssumedRole` as this is too common a behavior, often automated, and used to verify current identity and role assumptions. Therefore it is not as indicative of suspicious behavior when used by assumed roles. This rule will still trigger for `IAM User` and `Federated User` identity types. In telemetry this change reduces alerts from ~240,000 to 43 in the last 30 days.
2024-09-24 09:32:12 -04:00
bb9a772870
[New Rule] Okta Public Client App OAuth Token Request with Client Credentials ( #4074 )
...
* adding new rule for Okta public client app OAuth token request with client credentials
* Update detection_rules/etc/non-ecs-schema.json
* changing new terms to okta.actor.display_name
* linted; added references
2024-09-13 14:57:49 -04:00
3e25ea8c2b
[New Rule] AWS Bedrock Detections ( #4072 )
2024-09-13 19:46:47 +05:30
8d27b6069b
[Rule Tuning] M365/Azure Brute-Forcing New Rule and Tuning; Deprecate Similar Rule ( #4057 )
...
* deprecated rule; tuned for single source inclusion
* adjusted query comments
* added min-stack
* updated date
* added Azure-based rule for brute forcing
* added reference to o365spray
* fixed tag
* adjusted query comment
* added rule for repeat source
* adjusted query to use count distinct
* added intervals; adjusted lookback window according to time truncation
2024-09-10 11:26:40 -04:00
0a08f5e677
[New Rule] New Microsoft 365 Impossible Travel Rules and Deprecation ( #4054 )
...
* new impossible travel rules for o365; deprecated development rule
* deleted development rule as it has not lock version
* reverted rule deletion, added note about reliability and related rules
2024-09-05 17:36:56 -04:00
1ff26cf53e
[New Rule] New Rules AWS Multi-Region Discovery of EC2 Instances and Quotas ( #4015 )
...
* new rules AWS EC2 discovery in multiple-regions
* adjusted query and from window
* added event providers, adjusted tags, changed file name
2024-08-28 13:42:32 -04:00
dfbf86e853
Update ProblemChild detection rules with High and Low probability ( #4000 )
...
* Updated ProblemChild detection rules
2024-08-22 09:17:41 -04:00
b6b6f6b482
[New Rule] First Occurrence AWS STS Temporary Credential Request by User ( #3991 )
...
* adding new rule 'First Occurrence of STS GetFederationToken Request by User'
* added integration tag
* Update rules/integrations/aws/defense_evasion_sts_get_federation_token.toml
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com >
* added reference
---------
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com >
2024-08-21 20:17:10 -04:00
5493165440
[New Rule] AWS Signin Single Factor Console Login via Federated Session ( #3992 )
...
* adding new rule 'AWS Signin Single Factor Console Login with Federated User'
* changed uuid
* added integration tag
* fixed mitre mapping
* added min-stack
* Update rules/integrations/aws/initial_access_signin_console_login_no_mfa.toml
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com >
* added reference
* Update rules/integrations/aws/initial_access_signin_console_login_no_mfa.toml
---------
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com >
2024-08-21 18:19:54 -04:00
2559b7bb41
[Rule Tuning] Tuning AWS Rules for SAML Provider Updates and Assumed Roles via STS ( #3898 )
...
* tuning AWS rules for SAML provider updates and assumed roles via STS
* fixed mitre mapping
* adjusted new terms and added user ID to query
* reverting new terms value change
* adding non-ecs to new term checks
* fixing mitre mapping
* Update rules/integrations/aws/privilege_escalation_sts_temp_creds_via_assume_role.toml
* reverting file removal to add diff changes
* changeing rule contents
* reverting rule changes
* added rule contents
* changed file name
* linted
* reverting lint
2024-08-20 11:53:46 -04:00
f5069763b6
[Rule Tuning] Add System tag to DRs ( #3968 )
...
* [Rule Tuning] Add System tag to DRs
* bump
2024-08-09 11:14:33 -03:00
ff3f66cacf
[Rule Tuning] AWS S3 Object Versioning Suspended ( #3953 )
2024-08-02 13:36:11 -03:00
62982f9d8c
[New Rule] AWS IAM CompromisedKeyQuarantine Policy Attached to User ( #3910 )
...
* [New Rule] AWS IAM CompromisedKeyQuarantine Policy Attached to User
* increased severity score
Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com >
---------
Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com >
2024-08-01 00:30:02 -04:00
f2eb78219c
[New Rule] AWS IAM User or Role Created Cloudformation Stack for First Time ( #3923 )
...
* [New Rule] AWS IAM User or Role Created Cloudformation Stack for First Time
* Update discovery_new_terms_sts_getcalleridentity.toml
* Update execution_new_terms_ec2_instance_cloudformation_createstack.toml
* Update rules/integrations/aws/execution_new_terms_ec2_instance_cloudformation_createstack.toml
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com >
* rule name change, removed ec2
* Update rules/integrations/aws/execution_new_terms_cloudformation_createstack.toml
Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com >
---------
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com >
Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com >
2024-07-31 16:55:49 -04:00
1b58d0640b
[New Rule] AWS EC2 Instance Console Login via Assumed Role ( #3922 )
...
* [New Rule] AWS EC2 Instance Console Login via Assumed Role
* added reference for custom url creation
* added STS tag
* added event.provider to query
---------
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com >
2024-07-31 15:52:59 -04:00
a28af59d02
[New Rule] AWS EC2 Instance Interaction with IAM Service ( #3920 )
...
* [New Rule] AWS EC2 Instance Interaction with IAM Service
* Update rules/integrations/aws/persistence_ec2_instance_request_to_iam_service.toml
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com >
---------
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com >
2024-07-31 15:44:02 -04:00
f3b0dc1954
Prep for next release 8.16 ( #3919 )
2024-07-24 11:19:56 -04:00
baee89de9b
Revert "Prep for next release 8.16 ( #3914 )"
...
This reverts commit 4245a815d2
2024-07-23 14:06:04 -04:00
4245a815d2
Prep for next release 8.16 ( #3914 )
...
* Prep for Release 8.16
* Add subscription
* Remove double subscription
* Formatting
* Formatting
* Revert Beaconing rules minstack and lock version
2024-07-23 13:04:03 -04:00
03c99d22d3
Revert "Prep for Release 8.16 ( #3913 )"
...
This reverts commit 01135085f6
2024-07-23 09:50:04 -05:00
01135085f6
Prep for Release 8.16 ( #3913 )
2024-07-23 09:42:26 -05:00
322162f097
[New Rule] AWS S3 Bucket Replicated to Another Account ( #3895 )
2024-07-18 22:52:39 -04:00
e9cb2228e6
[New Rule] AWS S3 Object Versioning Suspended ( #3894 )
...
* [New Rule] AWS S3 Object Versioning Suspended
* description spacing changes
* update description
2024-07-18 22:14:46 -04:00
80f85cff4d
[New Rule] AWS S3 Bucket Server Access Logging Disabled ( #3892 )
...
* [New Rule] AWS S3 Bucket Server Access Logging Disabled
* changed severity from low to medium
2024-07-18 18:28:19 -04:00
44658ea5f6
[Rule Tunings] Change from to prevent double alerts ( #3868 )
2024-07-11 13:02:10 -04:00
f0ab897f99
[Rule Tunings] AWS Administrator Access Policy Attached Rules ( #3867 )
...
* [Tuning] AWS Administrator Access Policy Attached Rules
* change lookback to prevent overlap
* changed from to now-6m
2024-07-11 12:49:03 -04:00
80ac2794f2
[Rule BugFix] Google Workspace Oauth2 new app ( #3436 )
...
* [Rule BugFix] Google Workspace Oauth2 new app
In our extended testing the changed rule with latest Google Workspace
integration generates the following errors which make the rule fail everytime:
```
unsupported_operation_exception: [wildcard] queries are not currently supported on keyed [flattened] fields.
```
After careful investigation this happens since the field google_workspace.token.scope.data is a flattened
JSON filed that contains one or more key/value pairs and ES does not support wildcard matches withing flattened
fields as the error suggests.
We instead query the whole field (that contains the flattened fields) with the wildcard characters and achieve
the same outcome without the error.
* [Rule BugFix] Google Workspace Oauth2 new app update (#3436 )
In our extended testing the changed rule with latest Google Workspace
integration generates the following errors which make the rule fail everytime:
```
unsupported_operation_exception: [wildcard] queries are not currently supported on keyed [flattened] fields.
```
After careful investigation this happens since the field google_workspace.token.scope.data is a flattened
JSON filed that contains one or more key/value pairs and ES does not support wildcard matches withing flattened
fields as the error suggests.
We instead query the whole field (that contains the flattened fields) with the wildcard characters and achieve
the same outcome without the error.
---------
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com >
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com >
2024-07-11 10:45:17 -04:00
21485b16fa
[Tuning & Changes] Misc rule/hunt tuning ( #3875 )
...
* [Tuning & Changes] Misc rule/hunt tuning
* Bump update_date
* ++
* Updated docs
2024-07-11 14:55:33 +02:00
7f3c977192
[Rule Tuning] Tune Attempts to Brute Force a Microsoft 365 User Account ( #3860 )
...
* tuning 'Attempts to Brute Force a Microsoft 365 User Account'
* added reference
---------
Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com >
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com >
2024-07-08 13:07:44 -04:00
215d5a0861
[New Rule] AWS S3 Object Encryption Using External KMS Key ( #3861 )
...
* [New Rule] AWS S3 Object Encryption Using External KMS Key
Identifies encryption events for S3 bucket objects using an AWS KMS key from an external account. Adversaries with access to a misconfigured S3 bucket and the proper permissions may encrypt objects with an external KMS key to deny their victims access to their own data.
* Update impact_s3_object_encryption_with_external_key.toml
* Update impact_s3_object_encryption_with_external_key.toml
* missing coma after tag
* missing backslash on technique reference
2024-07-05 12:25:55 -04:00
cd716e5248
[Tuning] Suspicious Microsoft 365 Mail Access by ClientAppId ( #3685 )
...
* Update initial_access_microsoft_365_abnormal_clientappid.toml
* Update initial_access_microsoft_365_abnormal_clientappid.toml
* Update initial_access_microsoft_365_abnormal_clientappid.toml
---------
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com >
2024-07-05 05:46:40 +01:00
83be212632
[New Rule] AWS RDS DB Instance Made Public ( #3836 )
...
* [New Rule] AWS RDS DB Instance Made Public
...
* Apply suggestions from code review
* added coverage for instances created with public access
* rule review edits
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com >
---------
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com >
2024-07-03 01:01:52 -04:00
3a5c5c20a8
[New Rule] AWS RDS DB Instance or Cluster Deletion Protection Disabled ( #3851 )
...
* [New Rule] AWS RDS DB Instance or Cluster Deletion Protection Removed
...
* insert rule_id
* rule name change
2024-07-02 17:22:03 -04:00
9f4956f542
[New Rule] AWS RDS DB Instance or Cluster Password Modified ( #3844 )
...
* [New Rule] AWS RDS DB Instance or Cluster Password Modified
..
* Update rules/integrations/aws/persistence_rds_db_instance_password_modified.toml
---------
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com >
2024-07-02 16:14:51 -04:00
43fbf94d8a
[New Rule] AWS RDS Snapshot Shared with Another Account ( #3831 )
...
* [New Rule] AWS RDS DB Snapshot Shared with Another Account
...
* Update exfiltration_rds_snapshot_shared_with_another_account.toml
* edit threat matrix format
* Apply suggestions from code review
* Update rules/integrations/aws/exfiltration_rds_snapshot_shared_with_another_account.toml
---------
Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com >
2024-07-02 15:36:44 -04:00
aaf014390b
[New Rule] AWS RDS Snapshot Deleted ( #3852 )
...
* [New Rule] AWS RDS Snapshot Deleted
* added coverage for backupRetentionPeriod set to 0
2024-07-02 14:01:15 -04:00
d59d462956
[Rule Tuning] Potential AWS S3 Bucket Ransomware Note Uploaded ( #3854 )
...
* tuning 'Potential AWS S3 Bucket Ransomware Note Uploaded'
* adding filter to ignore common AWS object path strings
2024-07-02 13:02:52 -04:00
5fe7833312
[Rule Tuning] Tuning Google Workspace Rules and File Name Length Reduction ( #3849 )
...
* tuning google workspace rules
* removed verbiage about runtime
2024-07-01 15:50:12 -04:00
99a4d629c9
[New Rule] Entra ID Device Code Auth with Broker Client ( #3819 )
...
* new rule 'Entra ID Device Code Auth with Broker Client'
* updated azure integration, non-ecs updated, rule date updated
* updates tags
* updated query to add Azure activity logs
* merging in main
* updated azure manifest and schemas
* updated azure manifest and schemas
* updated index map for summary and changelog
* removed string imports
* reverting packaging.py updates
* adjusted query
* adjusted query to be more optimized
---------
Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com >
2024-07-01 10:31:26 -04:00
f62644887e
[Rule Tuning] AWS RDS Snapshot Restored ( #3809 )
...
* [Tuning] AWS RDS Instance Restored
-name and description change to better describe behavior
- rule file name changed to match tactic
- query change to add coverage for restore from S3
- rule type changed to eql
- subtechnique added for creaing instance
- tag added for RDS datasource
- Investigation Guide added
* Update defense_evasion_rds_instance_restored.toml
* Update defense_evasion_rds_instance_restored.toml
* removed investigation guide place holder
* deprecated old rule because of name change
* change rule_id
* Revert "change rule_id"
This reverts commit 0764c932f412439319e2d15a6bd80c360cf3fdc2.
* Revert "deprecated old rule because of name change"
This reverts commit fd62673380b40ba9ee432a271da3a8c5374e7129.
2024-06-28 20:42:36 -04:00
2e3aca62f0
[Rule Tuning] Multiple Device Token Hashes for Single Okta Session ( #3814 )
...
* tuning 'Multiple Device Token Hashes for Single Okta Session'
* adjusted file name
* updated tags
* updated file name extension
* updated min-stack comments
2024-06-28 12:59:24 -04:00
2708a89f20
[New Rule] AWS IAM User Created Access Keys for Another User ( #3788 )
...
* [New Rule] AWS IAM User Created Access Keys for Another User
...
* updated min_stack and removed index field
* reversed tactic order
* added AWS documentation as reference
* Apply suggestions from code review
updated_date, query format change, removed keep from query
2024-06-25 00:11:48 -04:00
Terrance DeJesus