security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,956 Commits 1 Branch 0 Tags
5cc02b9bc466403fadcebd4f3ceba2d705463e9f
Commit Graph

91 Commits

Author SHA1 Message Date
Jonhnathan e311ca538b [Rule Tuning] Windows BBR Rule Tuning - 1 (#3579) 
* [Rule Tuning] Windows BBR Rule Tuning - 1

* Update non-ecs-schema.json

* Update rules_building_block/command_and_control_certutil_network_connection.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* Update rules_building_block/collection_common_compressed_archived_file.toml

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

* Update defense_evasion_dll_hijack.toml

---------

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

(cherry picked from commit d0dfa479bb)
 2024-04-08 13:45:38 +00:00
Jonhnathan 724790e74a [Rule Tuning] Windows BBR Rule Tuning - 3 (#3581) 
* [Rule Tuning] Windows BBR Rule Tuning - 3

* Update non-ecs-schema.json

* Update rules_building_block/execution_settingcontent_ms_file_creation.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* Update persistence_startup_folder_lnk.toml

---------

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

(cherry picked from commit c5addae009)
 2024-04-08 12:54:51 +00:00
Jonhnathan 740f139cbd [Rule Tuning] Windows BBR Rule Tuning - 2 (#3580) 
Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

Removed changes from:
- rules_building_block/discovery_posh_generic.toml

(selectively cherry picked from commit 1bc59bdc04)
 2024-04-08 12:41:34 +00:00
Jonhnathan 535175c33d [Rule Tuning] BBR Rule Tuning 1 - Tighten Indexes Edition (#3576) 
* [Rule Tuning] BBR Rule Tuning 1 - Tighten Indexes Edition

* Apply suggestions from code review

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* Update defense_evasion_msdt_suspicious_diagcab.toml

* Update defense_evasion_suspicious_msiexec_execution.toml

* Update discovery_security_software_wmic.toml

* Update rules_building_block/discovery_security_software_wmic.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* Endgame tag

---------

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

(cherry picked from commit 109e8a85a5)
 2024-04-08 12:04:40 +00:00
Jonhnathan b4743f52de [Rule Tuning] WRITEDAC Access on Active Directory Object (#3583) 
(cherry picked from commit e125a4e4cf)
 2024-04-08 11:50:28 +00:00
Jonhnathan 4eac68bb07 [Rule Tuning] Tighten up Indexes of Elastic Defend Windows Rules (#3549) 
* [Rule Tuning] Tighten up Indexes of Elastic Defend Windows Rules

* Delete test.pkl

---------

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

(cherry picked from commit b47b91b9ec)
 2024-04-01 23:52:07 +00:00
Jonhnathan b43003c3f1 [Rule Tuning] Improve Compatibility in WIndows Detection Rules - Part 1 (#3501) 
* Initial commit

* Date bump

(cherry picked from commit f5254f3b5e)
 2024-03-13 13:32:43 +00:00
Ruben Groenewoud 578e86eeae [Tuning] event.action and event.type change (#3495) 
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

Removed changes from:
- rules/linux/discovery_process_capabilities.toml
- rules/linux/privilege_escalation_enlightenment_window_manager.toml
- rules/linux/privilege_escalation_gdb_sys_ptrace_elevation.toml
- rules/linux/privilege_escalation_gdb_sys_ptrace_netcon.toml
- rules/linux/privilege_escalation_suspicious_chown_fowner_elevation.toml
- rules/linux/privilege_escalation_suspicious_uid_guid_elevation.toml
- rules_building_block/discovery_capnetraw_capability.toml
- rules_building_block/persistence_cap_sys_admin_added_to_new_binary.toml

(selectively cherry picked from commit 9f8638a004)
 2024-03-13 09:16:15 +00:00
Jonhnathan b1989a921b [Security Content] Small tweaks on the setup guides (#3308) 
* [Security Content] Small tweaks on the setup guides

* Additional Fixes

* Avoid touching deprecated rules

Removed changes from:
- rules/integrations/beaconing/command_and_control_beaconing.toml
- rules/integrations/beaconing/command_and_control_beaconing_high_confidence.toml
- rules/linux/discovery_process_capabilities.toml
- rules/linux/privilege_escalation_dac_permissions.toml
- rules/linux/privilege_escalation_enlightenment_window_manager.toml
- rules/linux/privilege_escalation_gdb_sys_ptrace_elevation.toml
- rules/linux/privilege_escalation_gdb_sys_ptrace_netcon.toml
- rules/linux/privilege_escalation_suspicious_chown_fowner_elevation.toml
- rules/linux/privilege_escalation_suspicious_uid_guid_elevation.toml
- rules_building_block/discovery_capnetraw_capability.toml
- rules_building_block/persistence_cap_sys_admin_added_to_new_binary.toml

(selectively cherry picked from commit 458e67918a)
 2024-03-11 12:14:53 +00:00
Ruben Groenewoud e18bf43532 [Tuning] Linux BBR Tuning - Part 1 (#3469) 
* [Tuning] Linux BBR Tuning - Part 1

* [Tuning] Linux BBR Tuning - Part 1

* Update defense_evasion_processes_with_trailing_spaces.toml

* Update defense_evasion_processes_with_trailing_spaces.toml

* One more tuning

* Update collection_linux_suspicious_clipboard_activity.toml

---------

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>

(cherry picked from commit 3fd0358b73)
 2024-03-07 16:24:05 +00:00
Ruben Groenewoud c62e3fdc02 [Tuning] Linux BBR Tuning - Part 2 (#3470) 
* [Tuning] Linux BBR Tuning - Part 2

* Update discovery_of_accounts_or_groups_via_builtin_tools.toml

* Update discovery_process_discovery_via_builtin_tools.toml

* Update discovery_hosts_file_access.toml

* Update discovery_system_network_connections.toml

---------

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>

(cherry picked from commit 7a0967924c)
 2024-03-07 11:40:07 +00:00
Ruben Groenewoud 2bd89801ee [BBR Promotion] Linux BBR --> DR Promotion (#3472) 
* [BBR Promotion] Linux BBR --> DR Promotion

* [BBR Promotion] Linux BBR --> DR Promotion

---------

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>

(cherry picked from commit 5a80423003)
 2024-03-06 13:54:31 +00:00
Ruben Groenewoud 3183bfea23 [Tuning] Event.dataset removal & Tag Addition (#3451) 
* [Tuning] Removed event.dataset and added tag

* [Tuning] Removed event.dataset and added tag

* fixed typo

---------

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

Removed changes from:
- rules/linux/privilege_escalation_suspicious_chown_fowner_elevation.toml

(selectively cherry picked from commit 3484cac7eb)
 2024-02-20 14:23:14 +00:00
Jonhnathan e631f8d11d [Rule Tuning] Windows BBR Tuning - 3 (#3382) 
* [Rule Tuning] Windows BBR Tuning - 3

* Update defense_evasion_service_disabled_registry.toml

---------

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

(cherry picked from commit 5334601b6f)
 2024-02-14 18:05:32 +00:00
Jonhnathan e3aa44e5c4 [Rule Tuning] Windows BBR Tuning - 4 (#3384) 
* [Rule Tuning] Windows BBR Tuning - 4

* Update discovery_system_time_discovery.toml

(cherry picked from commit 1a8271db2f)
 2024-02-14 17:26:00 +00:00
Jonhnathan c0ef9cea69 [Rule Tuning] Windows BBR Tuning - 6 (#3386) 
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

(cherry picked from commit f233909e7d)
 2024-02-14 15:54:15 +00:00
Jonhnathan 9577e2a4d8 [Rule Tuning] Windows BBR Tuning - 5 (#3385) 
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

(cherry picked from commit 97e49795ab)
 2024-02-14 13:27:51 +00:00
Jonhnathan adcf721ae3 [Rule Tuning] Windows BBR Tuning - 2 (#3381) 
* [Rule Tuning] Windows BBR Tuning - 2

* Update defense_evasion_masquerading_windows_system32_exe.toml

---------

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

(cherry picked from commit ae00f30574)
 2024-02-14 13:03:13 +00:00
Ruben Groenewoud fa29e4b2b1 [New Rules] DDExec Analysis (#3408) 
* [New Rules] DDExec Analysis

* Increased rule scope

* [New Rule] Dynamic Linker Discovery via od

* Revert "[New Rule] Dynamic Linker Discovery via od"

This reverts commit c58595b77f517d3f236a64a52c38804253db64cc.

* [New Rule] Dynamic Linker Discovery via od

* [New Rule] Potential Memory Seeking Activity

* [New BBR] Suspicious Memory grep Activity

* Added endgame + auditd_manager support

* Removed auditd_manager support for now

* Removed auditd_manager support for now

* Update discovery_suspicious_memory_grep_activity.toml

---------

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

(cherry picked from commit d41855a2ac)
 2024-02-06 13:52:48 +00:00
Jonhnathan 59bb8e5ce0 [Rule Tuning] Windows BBR Tuning - 1 (#3380) 
* [Rule Tuning] Windows BBR Tuning - 1

* .

---------

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

(cherry picked from commit 8274f9a816)
 2024-02-05 15:52:27 +00:00
Ruben Groenewoud 0a658bafce [New BBR] Reverse Connection through Port Knocking (#3219) 
* [New BBR] Reverse Connection through Port Knocking

* Attempt to fix unit testing error

* Mitre list fix?

* Revert "Mitre list fix?"

This reverts commit 83682b8a58c2954911495d218392a33ee0615db2.

* Update command_and_control_linux_port_knocking_reverse_connection.toml

* Update command_and_control_linux_port_knocking_reverse_connection.toml

* Update rules_building_block/command_and_control_linux_port_knocking_reverse_connection.toml

* Update command_and_control_linux_port_knocking_reverse_connection.toml

* Update command_and_control_linux_port_knocking_reverse_connection.toml

---------

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>

(cherry picked from commit a66394c550)
 2024-01-24 15:35:25 +00:00
Isai f0028e1457 [New Rules] UEBA GItHub BBRs and Rules (#3174) 
* [New Rules] UEBA GItHub BBRs and Rules

A new set of BBRs and rules that will be used to trigger new UEBA GitHub threshold Rules.

* Update rules/integrations/github/impact_github_member_removed_from_organization.toml

* Apply suggestions from code review

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

* edited BBR rules

-removed newly added member rule

* updated integration manifests and schemas

* Updated min_stack for some rules based on newest GitHub integration schema manifest

* testing min_stack bump to 8.8 for new fields

* removing offending rule to troubleshoot seperately

* added UEBA tags and created UEBA threshold rule

* updated non-ecs-schema to add signal.rule.tags

* updated non-ecs-schema with kibana.alert.workflow_status

* updated rule.threat.tactic

* added user.name to non-ecs-schema

* added quotes to kibana.alert.workflow_status value

* removed trailing space from rule name

* update tags and optimize query for UEBA threshold rule

* removed integration field from Higher-Order rule

* Apply suggestions from code review

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

* adjusted new_terms order and rule types based on review feedback

* Apply suggestions from code review

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

* remove user.name from detection_rules/etc/non-ecs-schema.json

* fix json formatting

---------

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

(cherry picked from commit 442435830f)
 2024-01-22 17:53:12 +00:00
Terrance DeJesus 869988c20f [Rule Tuning] Update timestamp_override Unit Tests and Fix Rules Missing Field (#3368) 
* updated timestamp override unit test; fixed rules missing this field

* fixed flake error

* simplified and consolidated logic

* Update tests/test_all_rules.py

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

* Update tests/test_all_rules.py

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

* added comments

* updated logic; added comments; removed unused variables

* removed custom python script

* updated dates

* removed deprecated rule change

* updated dates

---------

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

Removed changes from:
- rules/integrations/beaconing/command_and_control_beaconing.toml
- rules/integrations/beaconing/command_and_control_beaconing_high_confidence.toml

(selectively cherry picked from commit 1c10c37468)
 2024-01-17 19:19:45 +00:00
Ruben Groenewoud 3247e1565b [Rule Tuning] Linux BBR Tuning (#3347) 
* [Rule Tuning] Linux BBR Tuning

* Update persistence_creation_of_kernel_module.toml

(cherry picked from commit b32733601a)
 2023-12-19 19:23:04 +00:00
Ruben Groenewoud 270a68c448 [Security Content] Add Investigation Guides to Linux C2 Rules (#3247) 
* [Security Content] Add Investigation Guides to Linux C2 Rules

* Applied feedback

(cherry picked from commit 91a757a018)
 2023-12-18 16:07:23 +00:00
Ruben Groenewoud ee5fa810aa [Tuning & New Rule] Linux Reverse Shell & DR Tuning (#3254) 
* [Rule Tuning & New Rule] Linux Reverse Shell

* [Tuning & New Rule] Linux Reverse Shells

* Name change

* Update rules/linux/execution_shell_via_child_tcp_utility_linux.toml

Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com>

* Update execution_shell_via_child_tcp_utility_linux.toml

* Update execution_shell_via_background_process.toml

---------

Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com>

(cherry picked from commit 84824c67fd)
 2023-12-18 08:41:02 +00:00
Justin Ibarra 7e07c12fd8 [Rule Tuning] Optimize query for Query Registry using Built-in Tools (#3330) 
* [Rule Tuning] Optimize query for Query Registry using Built-in Tools

* reduce history window to 7d

* use args vs command_line wildcards

---------

Co-authored-by: brokensound77 <brokensound77@users.noreply.github.com>

(cherry picked from commit a6c5cfc418)
 2023-12-15 02:59:59 +00:00
Jonhnathan 87f8498b68 [Security Content] Introduce Investigate Plugin in Investigation Guides (#3080) 
* [Security Content] Introduce Investigate Plugin in Investigation Guides
* Add compatibility note
* Update Transform format
* update transform unit tests for investigate
* updated docs with transform

---------

Co-authored-by: brokensound77 <brokensound77@users.noreply.github.com>
Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>

(cherry picked from commit aeb1f91320)
 2023-12-08 18:59:26 +00:00
Ruben Groenewoud 3cc7a46384 [New Rule] Out-Of-Tree Kernel Module Load (#3233) 
* [New Rule] Out-Of-Tree Kernel Module Load

* Update rules_building_block/persistence_tainted_kernel_module_out_of_tree_load.toml

* Update rules_building_block/persistence_tainted_kernel_module_out_of_tree_load.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules_building_block/persistence_tainted_kernel_module_out_of_tree_load.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules_building_block/persistence_tainted_kernel_module_out_of_tree_load.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

---------

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

(cherry picked from commit 490fa0e1d2)
 2023-12-07 21:57:56 +00:00
Ruben Groenewoud ab4f31499b [New BBR] Pot. Persistence Through Systemd-udevd (#3235) 
* [New BBR] Persistence Through Systemd-udevd

* Formatting change

* Update rules_building_block/persistence_udev_rule_creation.toml

* Update rules_building_block/persistence_udev_rule_creation.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules_building_block/persistence_udev_rule_creation.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

---------

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

(cherry picked from commit 07b1cab919)
 2023-12-07 21:46:59 +00:00
Ruben Groenewoud 7ab6b29c66 [Tuning] Small Linux DR Tuning (#3287) 
(cherry picked from commit 38862b89e9)
 2023-12-07 11:49:43 +00:00
Ruben Groenewoud 515ee158fb [New BBR] Segfault Detected (#3240) 
* [New BBR] Segfault Detected

* Update rules_building_block/execution_linux_segfault.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules_building_block/execution_linux_segfault.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

---------

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

(cherry picked from commit dff4633dd4)
 2023-11-02 08:46:22 +00:00
Ruben Groenewoud 13c6fbbcea [New BBR] Kernel Driver Load (#3236) 
* [New BBR] Kernel Driver Load

* added event.dataset to the query

---------

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>

(cherry picked from commit 967f6a4c89)
 2023-11-02 08:38:32 +00:00
shashank-elastic a31d788dcb Move Config Guides for Pre-Built Detection Rules to Setup Field - Windows, MacOS, BBR and Cross Platform (#3157) 
(cherry picked from commit a568c56bc1)
 2023-10-30 11:28:47 +00:00
Ruben Groenewoud 01a8fd30f2 [Rule Tuning] Tainted Kernel Module Load (#3234) 
* [Rule Tuning] Tainted kernel module load

* Update persistence_tainted_kernel_module_load.toml

* Update rules_building_block/persistence_tainted_kernel_module_load.toml

---------

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>

(cherry picked from commit ad25c922fd)
 2023-10-30 08:55:15 +00:00
Jonhnathan aa62790ae6 [Rule Tuning] Windows DR Tuning - 1 (#3198) 
* [Rule Tuning] Windows DR Tuning - 1

* Update collection_winrar_encryption.toml

(cherry picked from commit a5240e4063)
 2023-10-26 20:26:43 +00:00
Jonhnathan 223bfe0a6d [Promote] Potential Masquerading as Communication Apps (#3181) 
* [Promote] Potential Masquerading as Communication Apps

* Update defense_evasion_masquerading_communication_apps.toml

* Update defense_evasion_masquerading_communication_apps.toml

* Update rules/windows/defense_evasion_masquerading_communication_apps.toml

* Update defense_evasion_masquerading_communication_apps.toml

---------

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

(cherry picked from commit 6fcf26b20e)
 2023-10-23 18:01:34 +00:00
Ruben Groenewoud 9078f76827 [New BBR] Unix Socket Communication (#3072) 
* [New Rule] Unix Socket Communication

* Update rules_building_block/execution_unix_socket_communication.toml

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>

* Update rules_building_block/execution_unix_socket_communication.toml

---------

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>

(cherry picked from commit 9807bebd8e)
 2023-10-23 15:24:36 +00:00
Ruben Groenewoud 23337d90d4 [New BBR] Tainted Kernel Module Load (#3211) 
* [New Rule] Tainted Kernel Module Load

* added setup note

* Fixed tag

* added type change

* timestamp override

---------

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

(cherry picked from commit 024d45bd56)
 2023-10-23 15:12:20 +00:00
Jonhnathan 916b1a2cad [Promote] Expired or Revoked Driver Loaded (#3185) 
* [Promote] Expired or Revoked Driver Loaded

* Update privilege_escalation_expired_driver_loaded.toml

(cherry picked from commit 18ff85ce84)
 2023-10-23 14:50:52 +00:00
Ruben Groenewoud 9b2e74b220 [Rule Tuning] Linux Rules (#3092) 
* [Rule Tuning] [WIP] Linux DR

* Update defense_evasion_binary_copied_to_suspicious_directory.toml

* Fixed tag

* Added additional tuning

* unit test fix

* Additional tuning

* tuning

* added max signals

* Added max_signals=1 to brute force rules

* Cross-Platform Tuning

* Small fix

* new_terms conversion

* typo

* new_terms conversion

* Ransomware rule tuning

* performance tuning

* new_terms conversion for auditd_manager

* tune

* Need coffee

* kql/eql stuff

* formatting improvement

* new_terms sudo hijacking conversion

* exclusion

* Deprecations that were added last tuning

* Deprecations that were added last tuning

* Increased max timespan for brute force rules

* version bump

* added domain tag

* Two tunings

* More tuning

* Additional tuning

* updated_date bump

* query optimization

* Tuning

* Readded the exclusions for this one

* Changed int comparison

* Some tunings

* Update persistence_systemd_scheduled_timer_created.toml

* Update rules/linux/privilege_escalation_ld_preload_shared_object_modif.toml

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>

* [New Rule] Potential curl CVE-2023-38545 Exploitation

* Revert "[New Rule] Potential curl CVE-2023-38545 Exploitation"

This reverts commit 9c04d1b53d3d63678289f43ec0c7b617d26f1ce0.

* Update rules/cross-platform/command_and_control_non_standard_ssh_port.toml

* Update rules/linux/command_and_control_cat_network_activity.toml

* Update persistence_message_of_the_day_execution.toml

* Changed max_signals

* Revert "Merge branch 'main' into rule-tuning-ongoing-dr"

This reverts commit 1106b5d2eba1a3529eff325226d6baabfd4b0bf3, reversing
changes made to 5ff510757f25b0cb32e1ef18e9e2c34c8ec325a8.

* Revertable merge

* Update defense_evasion_ld_preload_env_variable_process_injection.toml

* File name change

---------

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

(cherry picked from commit 020fff3aea)
 2023-10-23 14:34:55 +00:00
Jonhnathan f82c0b6e0b [New Rules] [BBR] Windows Deprecated ERs Conversion - 3 (#3143) 
* [New Rules] [BBR] Windows Deprecated ERs Conversion - 3

* Update defense_evasion_invalid_codesign_imageload.toml

* Update defense_evasion_invalid_codesign_imageload.toml

* Update rules_building_block/initial_access_execution_remote_via_msiexec.toml

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

* Update rules_building_block/initial_access_xsl_script_execution_via_com.toml

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>

* Update rules_building_block/initial_access_execution_remote_via_msiexec.toml

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>

---------

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>

(cherry picked from commit 74222f86eb)
 2023-10-17 17:22:19 +00:00
Jonhnathan 7921daeddd [New Rules] [BBR] Windows Deprecated ERs Conversion - 2 (#3138) 
* [New Rules] [BBR] Windows Deprecated ERs Conversion - 2

* Update defense_evasion_unsigned_bits_client.toml

* Update rules_building_block/defense_evasion_suspicious_msiexec_execution.toml

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

* .

---------

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

(cherry picked from commit 3ea3e5a9fd)
 2023-10-17 16:55:50 +00:00
Jonhnathan d24492678e [New Rules] [BBR] Windows Deprecated ERs Conversion - 1 (#3131) 
* [New Rules] [BBR] Windows Deprecated ERs Conversion - 1

* .

* .

* Update defense_evasion_dotnet_clickonce_dfsvc_netcon.toml

* .

(cherry picked from commit 32002fd89b)
 2023-10-17 14:42:54 +00:00
Jonhnathan 18dc3b0f73 [New Rule] [BBR] Memory Dump File Rules (#3122) 
* [New Rule] Memory Dump File Rules

* .

* .

* .

(cherry picked from commit a33a124eab)
 2023-10-17 12:41:28 +00:00
Jonhnathan f7a2c9b0b4 [Rule Tuning] Potential Masquerading as Browser Process (#3180) 
* [Rule Tuning] Potential Masquerading as Browser Process

* Update defense_evasion_masquerading_browsers.toml

* Update defense_evasion_masquerading_browsers.toml

(cherry picked from commit 8035516e8e)
 2023-10-17 11:59:16 +00:00
Jonhnathan 97ce9d7478 [Rule Tuning] Potential Masquerading as System32 DLL (#3184) 
Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

(cherry picked from commit e4e68c2dd8)
 2023-10-17 11:35:05 +00:00
Jonhnathan ef715864f4 [Security Content] Adjust Mitre Att&ck Mappings - Windows Rules (#3165) 
* [Security Content] Adjust Mitre Att&ck Mappings - Windows Rules

* Fix dates

* Fix unit test errors

* updated tags and fixed branch conflicts

updated tags and fixed branch conflicts

* description nit

* Reverting unintended changes

* Update initial_access_suspicious_ms_office_child_process.toml

---------

Co-authored-by: imays11 <59296946+imays11@users.noreply.github.com>

(cherry picked from commit f584fb6e31)
 2023-10-15 21:18:03 +00:00
Jonhnathan 788f2ce884 [Rule Tuning] PowerShell Rules Tuning (#3169) 
(cherry picked from commit 3f2a709370)
 2023-10-11 21:03:44 +00:00
Justin Ibarra 7c563fb834 [New Rule] File Compressed or Archived into Common Format (#3173) 
* [New Rule] File Compressed or Archived into Common Format
* new build-threat-map-entry-command

---------

Co-authored-by: brokensound77 <brokensound77@users.noreply.github.com>
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

(cherry picked from commit 7f8a9849c4)
 2023-10-11 18:40:16 +00:00