5ce96738c4
[New] Suspicious JetBrains TeamCity Child Process ( #3532 )
...
* [New] Suspicious JetBrains TeamCity Child Process
* Update initial_access_exploit_jetbrains_teamcity.toml
* Update initial_access_exploit_jetbrains_teamcity.toml
* Update initial_access_exploit_jetbrains_teamcity.toml
* Update initial_access_exploit_jetbrains_teamcity.toml
(cherry picked from commit fc76a8bcb5
2024-03-25 16:40:44 +00:00
b6aff9b2e5
[New Rules] Veeam Credential Access DRs ( #3516 )
...
* [New Rules] Veeam Credential Access DRs
* bump
* Update credential_access_veeam_commands.toml
* Update credential_access_veeam_backup_dll_imageload.toml
* Update rules/windows/credential_access_veeam_backup_dll_imageload.toml
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com >
* Update credential_access_veeam_commands.toml
* Update rules/windows/credential_access_veeam_backup_dll_imageload.toml
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com >
---------
Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com >
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com >
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com >
(cherry picked from commit 779fa7710d
2024-03-21 13:09:29 +00:00
f0a06bc56b
[Rule Tuning] Potential Reverse Shell via UDP ( #3508 )
...
(cherry picked from commit a6028b43b3
2024-03-21 12:56:41 +00:00
88181b0f80
[Rule Tuning] SMTP on Port 26/TCP ( #3521 )
...
(cherry picked from commit 07abc19932
2024-03-19 21:03:05 +00:00
078c86ab40
[Rule Tuning] Tuning 'First Time Seen AWS Secret Value Accessed in Secrets Manager' ( #3494 )
...
* tuning 'First Time Seen AWS Secret Value Accessed in Secrets Manager'
* reverting lookback window
* missing word in description
(cherry picked from commit f6e79944f2
2024-03-15 23:17:27 +00:00
0a729b77a4
Beaconing - Add whitelist to rules, with some more processes ( #3497 )
...
* Add whitelist to rules, with some more processes
* Update rules exceptionlist
* Update exceptions
---------
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com >
(cherry picked from commit a4ecfe3ccf
2024-03-14 19:56:12 +00:00
a08cbc7390
[Rule Tuning] Guided Onboarding Rule ( #3502 )
...
* [Rule Tuning] Guided Onboarding Rule
* Update guided_onboarding_sample_rule.toml
* Revert "Update guided_onboarding_sample_rule.toml"
This reverts commit 18721277df7416534440a4708fa3b060f2775a27.
* Update guided_onboarding_sample_rule.toml
* Update guided_onboarding_sample_rule.toml
---------
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com >
(cherry picked from commit c610e19114
2024-03-14 14:04:49 +00:00
4fec1a766e
[New Rules] mprotect() RWX Binary Execution ( #3507 )
...
* [New Rules] mprotect() RWX Binary Execution
* Added rule names
* Update execution_netcon_from_rwx_mem_region_binary.toml
* Update execution_unknown_rwx_mem_region_binary_executed.toml
* Update execution_unknown_rwx_mem_region_binary_executed.toml
* Update execution_netcon_from_rwx_mem_region_binary.toml
* Update execution_netcon_from_rwx_mem_region_binary.toml
(cherry picked from commit 4179180fcb
2024-03-13 21:18:29 +00:00
22ed934946
[Rule Tuning] Improve Compatibility in WIndows Detection Rules - Part 1 ( #3501 )
...
* Initial commit
* Date bump
(cherry picked from commit f5254f3b5e
2024-03-13 13:33:15 +00:00
11168606d5
[Tuning] event.action and event.type change ( #3495 )
...
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com >
(cherry picked from commit 9f8638a004
2024-03-13 09:16:45 +00:00
9101dfc064
[Security Content] Small tweaks on the setup guides ( #3308 )
...
* [Security Content] Small tweaks on the setup guides
* Additional Fixes
* Avoid touching deprecated rules
(cherry picked from commit 458e67918a
2024-03-11 12:15:22 +00:00
aebe64a42b
[Rule Tuning] DR Performance-Poor Rules ( #3399 )
...
* [Rule Tuning] DR Performance
* .
* Update rules/cross-platform/lateral_movement_remote_file_creation_in_sensitive_directory.toml
Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com >
* Update rules/windows/persistence_registry_uncommon.toml
Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com >
* Update lateral_movement_remote_file_creation_in_sensitive_directory.toml
* Update lateral_movement_remote_file_creation_in_sensitive_directory.toml
* Update persistence_startup_folder_scripts.toml
---------
Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com >
(cherry picked from commit edf4da8526
2024-03-11 11:56:05 +00:00
6241e8c7b4
fix: correct the provider for the create, delete and modify routes in EC2 VPCs ( #3500 )
...
(cherry picked from commit 709cfddcbe
2024-03-08 19:07:31 +00:00
b180502a19
[Tuning] Linux Cross-Platform Tuning - Part 1 ( #3468 )
...
* [Tuning] Linux Cross-Platform Tuning - Part 1
* Update defense_evasion_deletion_of_bash_command_line_history.toml
* Update defense_evasion_deletion_of_bash_command_line_history.toml
* Update defense_evasion_deletion_of_bash_command_line_history.toml
* Update defense_evasion_deletion_of_bash_command_line_history.toml
---------
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com >
(cherry picked from commit a438052ff3
2024-03-07 17:26:26 +00:00
28220d0ccd
[Tuning] Linux DR Tuning - Part 12 ( #3464 )
...
* [Tuning] Linux DR Tuning - Part 12
* Update persistence_shared_object_creation.toml
* Update privilege_escalation_dac_permissions.toml
* Update privilege_escalation_enlightenment_window_manager.toml
* Update privilege_escalation_enlightenment_window_manager.toml
* Min stack rule-bending test
* formatting fix
* Revert "Merge branch 'linux-dr-tuning-12' of https://github.com/elastic/detection-rules into linux-dr-tuning-12"
This reverts commit 0170cddd905b4b983f8413eebbc11c9c7b3719ce, reversing
changes made to 29d4a747603faf0ac7c2d502786533b0cd93a5d5.
* Revert "Min stack rule-bending test"
This reverts commit 29d4a747603faf0ac7c2d502786533b0cd93a5d5.
* Update privilege_escalation_enlightenment_window_manager.toml
* Update privilege_escalation_chown_chmod_unauthorized_file_read.toml
---------
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com >
(cherry picked from commit 9c4ba4559d
2024-03-07 17:15:18 +00:00
a6c223de70
[Tuning] Linux BBR Tuning - Part 1 ( #3469 )
...
* [Tuning] Linux BBR Tuning - Part 1
* [Tuning] Linux BBR Tuning - Part 1
* Update defense_evasion_processes_with_trailing_spaces.toml
* Update defense_evasion_processes_with_trailing_spaces.toml
* One more tuning
* Update collection_linux_suspicious_clipboard_activity.toml
---------
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com >
(cherry picked from commit 3fd0358b73
2024-03-07 16:24:36 +00:00
124e8c836c
[Tuning] Linux DR Tuning - Part 14 ( #3467 )
...
* [Tuning] Linux DR Tuning - Part 14
* Update privilege_escalation_sudo_cve_2019_14287.toml
---------
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com >
(cherry picked from commit ed4a7fc15b
2024-03-07 15:51:17 +00:00
dfaed78e75
[Tuning] Linux DR Tuning - Part 13 ( #3465 )
...
* [Tuning] Linux DR Tuning - Part 13
* updated date bump
* Update privilege_escalation_load_and_unload_of_kernel_via_kexec.toml
* Update privilege_escalation_netcon_via_sudo_binary.toml
* Update privilege_escalation_load_and_unload_of_kernel_via_kexec.toml
* Update rules/linux/privilege_escalation_shadow_file_read.toml
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com >
---------
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com >
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com >
(cherry picked from commit 60fda8d756
2024-03-07 15:33:51 +00:00
09fe63d18f
[Tuning] Linux DR Tuning - Part 11 ( #3463 )
...
* [Tuning] Linux DR Tuning - Part 11
* Update persistence_message_of_the_day_creation.toml
* Update persistence_message_of_the_day_execution.toml
* Update rules/linux/persistence_message_of_the_day_execution.toml
* Update persistence_linux_user_added_to_privileged_group.toml
---------
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com >
(cherry picked from commit ef66c57030
2024-03-07 11:26:39 +00:00
68cfb3dfde
[Tuning] Linux DR Tuning - Part 10 ( #3462 )
...
* [Tuning] Linux DR Tuning - Part 10
* updated_date bump
* Update persistence_kworker_file_creation.toml
* Update persistence_linux_backdoor_user_creation.toml
---------
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com >
(cherry picked from commit a76a3755d9
2024-03-07 10:50:21 +00:00
6141bc3dd7
[Tuning] Linux DR Tuning - Part 9 ( #3461 )
...
* [Tuning] Linux DR Tuning - Part 9
* Update persistence_credential_access_modify_ssh_binaries.toml
* Update lateral_movement_ssh_it_worm_download.toml
---------
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com >
(cherry picked from commit fd84573212
2024-03-07 10:39:28 +00:00
f209923155
[Tuning] Linux DR Tuning - Part 8 ( #3460 )
...
* [Tuning] Linux DR Tuning - Part 8
* Update impact_esxi_process_kill.toml
---------
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com >
(cherry picked from commit 08f946b394
2024-03-07 10:06:27 +00:00
e44b8a7768
[Tuning] Linux DR Tuning - Part 7 ( #3458 )
...
* [Tuning] Linux DR Tuning - Part 7
* Update execution_potential_hack_tool_executed.toml
---------
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com >
(cherry picked from commit c537fb9c22
2024-03-07 09:52:07 +00:00
472ca216d3
[Tuning] Linux DR Tuning - Part 6 ( #3457 )
...
* [Tuning] Linux DR Tuning - Part 6
* Update discovery_ping_sweep_detected.toml
---------
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com >
(cherry picked from commit f37a3bfd48
2024-03-07 09:14:25 +00:00
d28bd2abef
[Tuning] Linux DR Tuning - Part 5 ( #3456 )
...
* [Tuning] Linux DR Tuning - Part 6
* Update discovery_dynamic_linker_via_od.toml
* Update discovery_esxi_software_via_find.toml
* Update discovery_esxi_software_via_grep.toml
* Update discovery_linux_hping_activity.toml
* Update discovery_linux_nping_activity.toml
---------
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com >
(cherry picked from commit ae3f4737ab
2024-03-07 08:59:38 +00:00
2f18b54ac8
[Tuning] Auditbeat event.action Compatibility ( #3471 )
...
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com >
(cherry picked from commit 83abf8d42c
2024-03-06 14:34:12 +00:00
e6db511ac7
[BBR Promotion] Linux BBR --> DR Promotion ( #3472 )
...
* [BBR Promotion] Linux BBR --> DR Promotion
* [BBR Promotion] Linux BBR --> DR Promotion
---------
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com >
(cherry picked from commit 5a80423003
2024-03-06 13:55:08 +00:00
fb835e396d
[Tuning] Tuning Windows - 3 Rules ( #3388 )
...
* Update privilege_escalation_newcreds_logon_rare_process.toml
* Update privilege_escalation_make_token_local.toml
* Update privilege_escalation_make_token_local.toml
* Update privilege_escalation_create_process_with_token_unpriv.toml
---------
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com >
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com >
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com >
(cherry picked from commit 853e18950f
2024-02-20 16:01:52 +00:00
7adff8ebd2
[Tuning] Linux DR Tuning - Part 4 ( #3455 )
...
* [Tuning] Linux DR Tuning - Part 4
* Update defense_evasion_file_mod_writable_dir.toml
* Update defense_evasion_hidden_file_dir_tmp.toml
(cherry picked from commit 089e6671aa
2024-02-20 14:44:07 +00:00
24eea0e1e5
[Tuning] Event.dataset removal & Tag Addition ( #3451 )
...
* [Tuning] Removed event.dataset and added tag
* [Tuning] Removed event.dataset and added tag
* fixed typo
---------
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com >
(cherry picked from commit 3484cac7eb
2024-02-20 14:23:44 +00:00
5af7ec1a4b
[Tuning] Linux DR Tuning - Part 3 ( #3454 )
...
(cherry picked from commit 5e6e4a359b
2024-02-20 13:56:14 +00:00
d09d0b0609
[Tuning] Linux DR Tuning - Part 1 ( #3452 )
...
* [Tuning] Linux DR Tuning - Part 1
* Update command_and_control_linux_tunneling_and_port_forwarding.toml
* Update command_and_control_cat_network_activity.toml
(cherry picked from commit 1dc7fd6a42
2024-02-20 13:44:07 +00:00
5b8b6c4450
[Tuning] Linux DR Tuning - Part 2 ( #3453 )
...
* [Tuning] Linux DR Tuning - Part 2
* Update defense_evasion_binary_copied_to_suspicious_directory.toml
* Update defense_evasion_base16_or_base32_encoding_or_decoding_activity.toml
(cherry picked from commit 0e48747aa6
2024-02-20 13:22:50 +00:00
144754c8a5
[New] Suspicious Execution from INET Cache ( #3445 )
...
* Create initial_access_execution_from_inetcache.toml
* Update initial_access_execution_from_inetcache.toml
(cherry picked from commit 4809de6584
2024-02-15 19:19:30 +00:00
a864d77e0a
[Rule Tuning] Windows BBR Tuning - 5 ( #3385 )
...
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com >
(cherry picked from commit 97e49795ab
2024-02-14 13:28:21 +00:00
0c0a5bdaad
[Rule Tuning] Windows BBR Tuning - 2 ( #3381 )
...
* [Rule Tuning] Windows BBR Tuning - 2
* Update defense_evasion_masquerading_windows_system32_exe.toml
---------
Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com >
(cherry picked from commit ae00f30574
2024-02-14 13:03:47 +00:00
4ac56fbd40
[Rule Tuning] Suspicious Antimalware Scan Interface DLL ( #3432 )
...
Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com >
(cherry picked from commit 21b559c97f
2024-02-08 09:32:22 +00:00
e037d57c82
[New Rules] DDExec Analysis ( #3408 )
...
* [New Rules] DDExec Analysis
* Increased rule scope
* [New Rule] Dynamic Linker Discovery via od
* Revert "[New Rule] Dynamic Linker Discovery via od"
This reverts commit c58595b77f517d3f236a64a52c38804253db64cc.
* [New Rule] Dynamic Linker Discovery via od
* [New Rule] Potential Memory Seeking Activity
* [New BBR] Suspicious Memory grep Activity
* Added endgame + auditd_manager support
* Removed auditd_manager support for now
* Removed auditd_manager support for now
* Update discovery_suspicious_memory_grep_activity.toml
---------
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com >
(cherry picked from commit d41855a2ac
2024-02-06 13:53:27 +00:00
27b01ac788
[New Rule] Executable Masquerading as Kernel Process ( #3421 )
...
* [New Rule] Executable Masquerading as Kernel Proc
* Bumped dates
* Added endgame support
* Added auditd_manager support
* Removed auditd_manager support for now
(cherry picked from commit 90d64f0714
2024-02-06 09:54:53 +00:00
35dd5ad3c6
[New Rules] APT Package Manager Persistence ( #3418 )
...
* [New Rule] apt Package Manager Persistence
* [New Rules] APT Package Manager Persistence
* [New Rules] APT Package Manager Persistence
(cherry picked from commit 208b2e999c
2024-02-06 09:34:38 +00:00
8d3eed8d4d
[New Rule] Suspicious Network Connection via systemd ( #3420 )
...
* [New Rule] Network Connection via systemd
* Removed space from description
* Added updated query
(cherry picked from commit 4f303ab77e
2024-02-06 09:25:09 +00:00
66458bd33d
Update lateral_movement_remote_task_creation_winlog.toml ( #3419 )
...
(cherry picked from commit 6906a27c3a
2024-02-05 18:41:54 +00:00
67acfbae4d
[Rule Tuning] Windows BBR Tuning - 1 ( #3380 )
...
* [Rule Tuning] Windows BBR Tuning - 1
* .
---------
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com >
(cherry picked from commit 8274f9a816
2024-02-05 15:52:57 +00:00
5edd21a169
[Rule Tuning] Startup or Run Key Registry Modification ( #3367 )
...
(cherry picked from commit edd3556b63
2024-02-05 15:33:38 +00:00
41ee5b7509
[New] Potential Enumeration via Active Directory Web Service ( #3416 )
...
* Create discovery_active_directory_webservice.toml
* Update discovery_active_directory_webservice.toml
* Update discovery_active_directory_webservice.toml
* Update discovery_active_directory_webservice.toml
* Update discovery_active_directory_webservice.toml
(cherry picked from commit 5a68ccfd0d
2024-02-02 14:24:50 +00:00
332afabf04
[Rule Tuning] Potential Modification of Accessibility Binaries ( #3401 )
...
Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com >
(cherry picked from commit 50df6f3e9b
2024-02-01 14:32:00 +00:00
c8b1b59079
[Tuning] Suspicious File Downloaded from Google Drive ( #3411 )
...
* Update command_and_control_google_drive_malicious_file_download.toml
* Update command_and_control_google_drive_malicious_file_download.toml
* Update command_and_control_google_drive_malicious_file_download.toml
(cherry picked from commit 4c74588c00
2024-01-31 17:00:17 +00:00
50be89783c
[Tuning] DCSync Rules - 4662 event.action ( #3410 )
...
* Update credential_access_dcsync_newterm_subjectuser.toml
* Update credential_access_dcsync_replication_rights.toml
(cherry picked from commit d7f4d7972e
2024-01-30 11:48:48 +00:00
bad1eff29b
[New Rule] Suspicious Passwd File Event Action ( #3396 )
...
* [New Rule] Suspicious Passwd File Event Action
* Description fix
* Pot. UT fix
* Pot. UT fix.
---------
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com >
(cherry picked from commit 381ccf43ed
2024-01-26 08:42:09 +00:00
9ce2cdf675
[Rule Tuning] Windows DR Tuning - 15 ( #3377 )
...
* [Rule Tuning] Windows DR Tuning - 15
* Update privilege_escalation_windows_service_via_unusual_client.toml
* Update privilege_escalation_windows_service_via_unusual_client.toml
* Update defense_evasion_msbuild_making_network_connections.toml
(cherry picked from commit 92804343bc
2024-01-23 19:54:02 +00:00
Samirbous