632e169f7ad5779a3b6652e9a30c85e02344d09b
4 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Terrance DeJesus
|
632e169f7a |
[Hunt Tuning] Add Descriptions, Collapse Queries and Re-Generate Docs (#3791)
* add description to hunting schema; change queries to be a list * update createremotethreat by process hunt * update dll hijack and masquerading as MSFT library * remove sysmon specific dDLL hijack via masquerading MSFT library * updated Masquerading Attempts as Native Windows Binaries * updates Rare DLL Side-Loading by Occurrence * updates Rare LSASS Process Access Attempts * update DNS Queries via LOLBins with Low Occurence Frequency * updated Low Occurrence of Drivers Loaded on Unique Hosts * updates Excessive RDP Network Activity by Host and User * updates Excessive SMB Network Activity by Process ID * updated Executable File Creation by an Unusual Microsoft Binary * Frequency of Process Execution and Network Logon by Source Address * updates Frequency of Process Execution and Network Logon by Source Address * updated Execution via Remote Services by Client Address * updated Startup Execution with Low Occurrence Frequency by Unique Host * updated Low Frequency of Process Execution via WMI by Unique Agent * updated Low Frequency of Process Execution via Windows Scheduled Task by Unique Agent * updated Low Occurence of Process Execution via Windows Services with Unique Agent * Updated High Count of Network Connection Over Extended Period by Process * update Libraries Loaded by svchost with Low Occurrence Frequency * updated Microsoft Office Child Processes with Low Occurrence Frequency by Unique Agent * updated Network Discovery via Sensitive Ports by Unusual Process * updated PE File Transfer via SMB_Admin Shares by Agent or User * updated Persistence via Run Key with Low Occurrence Frequency * updates Persistence via Startup with Low Occurrence Frequency by Unique Host * updates "Persistence via Run Key with Low Occurrence Frequency"; adjusted file names to remove data source * updates "Low Occurrence of Suspicious Launch Agent or Launch Daemon" * updates "Egress Network Connections with Total Bytes Greater than Threshold" * updates "Rundll32 Execution Aggregated by Command Line" * updates "Scheduled tasks Creation by Action via Registry" * updates "Scheduled Tasks Creation for Unique Hosts by Task Command" * updates "Suspicious Base64 Encoded Powershell Command" * updates "Suspicious DNS TXT Record Lookups by Process" * updates "Unique Windows Services Creation by Service File Name" * Updates "Unique Windows Services Creation by Service File Name" * updates "Windows Command and Scripting Interpreter from Unusual Parent Process" * updates "Windows Logon Activity by Source IP" * updates "Suspicious Network Connections by Unsigned Mach-O" * updates LLM hunting queries * re-generated markdown files; updated generate markdown py file * updated test_hunt_data * Update hunting/macos/queries/suspicious_network_connections_by_unsigned_macho.toml Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com> * Update hunting/windows/queries/drivers_load_with_low_occurrence_frequency.toml Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com> * Update hunting/windows/queries/domain_names_queried_via_lolbins_and_with_low_occurence_frequency.toml Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com> * Update hunting/windows/queries/excessive_rdp_network_activity_by_source_host_and_user.toml Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com> * Update hunting/windows/queries/excessive_rdp_network_activity_by_source_host_and_user.toml Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com> * updated missing integrations * updated MD docs according to recent hunting changes * Update hunting/windows/queries/executable_file_creation_by_an_unusual_microsoft_binary.toml Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> * Update hunting/windows/queries/detect_rare_dll_sideload_by_occurrence.toml Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> * Update hunting/windows/queries/detect_masquerading_attempts_as_native_windows_binaries.toml Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> * Update hunting/windows/queries/detect_dll_hijack_via_masquerading_as_microsoft_native_libraries.toml Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> * Update hunting/llm/queries/aws_bedrock_dos_resource_exhaustion_detection.toml Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> * added enrichment policy link to rule * Update hunting/windows/docs/execution_via_windows_management_instrumentation_by_occurrence_frequency_by_unique_agent.md Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com> * Update hunting/windows/docs/windows_command_and_scripting_interpreter_from_unusual_parent.md Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com> * Update hunting/windows/docs/windows_command_and_scripting_interpreter_from_unusual_parent.md Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com> * Update hunting/windows/docs/rundll32_execution_aggregated_by_cmdline.md Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com> * Update hunting/windows/docs/microsoft_office_child_processes_with_low_occurrence_frequency.md Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com> * Update hunting/windows/docs/microsoft_office_child_processes_with_low_occurrence_frequency.md Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com> * Update hunting/windows/queries/execution_via_windows_management_instrumentation_by_occurrence_frequency_by_unique_agent.toml Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com> * Update hunting/windows/queries/execution_via_windows_management_instrumentation_by_occurrence_frequency_by_unique_agent.toml Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com> * Update hunting/index.md Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com> * Update hunting/windows/docs/execution_via_network_logon_by_occurrence_frequency_by_top_source_ip.md Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com> * Update hunting/windows/queries/execution_via_network_logon_by_occurrence_frequency_by_top_source_ip.toml Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com> --------- Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com> Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com> |
||
|
Justin Ibarra
|
48e85439e0 |
[New hunts] 50 ES|QL Windows Hunt Queries (#3642)
* [New Hunt] Initial add of Windows hunt queries * Add markdown files * Added license to schema and md generation * add hunt index; minor tweaks to script * minor tweaks from feedback Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com> Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> * Update hunting/macos/queries/suspicious_network_connections_by_unsigned_macho.toml Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> * convert integrations to list * Update script to generate integration links * validate generated integrations links * Update hunting/windows/docs/execution_via_remote_services_by_client_address.md * Update hunting/windows/queries/execution_via_network_logon_by_occurrence_frequency_by_top_source_ip.toml * Update hunting/windows/queries/execution_via_remote_services_by_client_address.toml * Update hunting/windows/docs/execution_via_network_logon_by_occurrence_frequency_by_top_source_ip.md * Update hunting/windows/queries/execution_via_network_logon_by_occurrence_frequency.toml * Update hunting/windows/docs/execution_via_network_logon_by_occurrence_frequency.md * update docs with naming information * Create suspicious_base64_encoded_powershell_commands.toml * Create scheduled_task_creation_by_action_via_registry.toml * Create suspicious_base64_encoded_powershell_commands.md * Create scheduled_task_creation_by_action_via_registry.md * Update index.md --------- Co-authored-by: brokensound77 <brokensound77@users.noreply.github.com> Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com> |
||
|
Mika Ayenson
|
c8c8c96956 | [FR] Add ability to generate hunt index (#3643) | ||
|
Mika Ayenson
|
00b8a77f50 | [FR] Add Hunt Structure and Initial LLM Queries 🚀 (#3637) |