security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
2,115 Commits 1 Branch 0 Tags
7693d785aad70787971432c9d7511e7166312921
Commit Graph

1517 Commits

Author SHA1 Message Date
Jonhnathan 7693d785aa [Rule Tuning] LSASS Process Access via Windows API (#3839) 2024-06-27 12:22:13 -03:00
Ruben Groenewoud c3ba7b1262 [New Rule] Privilege Escalation via SUID/SGID (#3793) 
* [New Rule] Privilege Escalation via SUID/SGID

* unit test error fix?

* Update rules/linux/privilege_escalation_potential_suid_sgid_exploitation.toml
 2024-06-27 16:50:09 +02:00
Ruben Groenewoud 0ca16a1516 [New Rule] User or Group Creation/Modification (#3804) 2024-06-27 16:35:25 +02:00
Ruben Groenewoud 8d063e1a47 [Rule Tuning] SUID/SGID Bit Set (#3802) 2024-06-27 16:27:00 +02:00
Samirbous 17a07020f3 [New] Microsoft Management Console File from Unusual Path (#3834) 
* [New] Windows Script Execution via MMC Console File

* Update execution_via_mmc_console_file_unusual_path.toml

* Update execution_via_mmc_console_file_unusual_path.toml

* Update rules/windows/execution_via_mmc_console_file_unusual_path.toml

* Update execution_via_mmc_console_file_unusual_path.toml

* Update execution_via_mmc_console_file_unusual_path.toml

---------

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
 2024-06-27 11:32:45 +01:00
Jonhnathan deb08fd28d [New Rule] AD Group Modification by SYSTEM (#3833) 
* [New Rule] AD Group Modification by SYSTEM

* .

* Update rules/windows/persistence_group_modification_by_system.toml

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

* Tighten up indexes

* Update persistence_group_modification_by_system.toml

* Apply suggestions from code review

Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>

---------

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>
 2024-06-26 18:56:01 -03:00
Jonhnathan 54d5b442cf [Rule Tuning] Add Initial Microsoft Defender for Endpoint Compatibility to Windows DRs (#3825) 
* [Rule Tuning] Add Initial Microsoft Defender for Endpoint Compatibility to Windows DRs

* .

* Update integration-schemas.json.gz

* Fix integration manifests
 2024-06-26 11:06:27 -03:00
Ruben Groenewoud 6746a421c4 [New Rules] Yum Plugin Creation / Discovery (#3820) 
* [New Rules] Yum Plugin Creation / Discovery

* Update discovery_yum_plugin_detection.toml

* Update and rename discovery_yum_plugin_detection.toml to discovery_yum_dnf_plugin_detection.toml
 2024-06-25 16:14:28 +02:00
James Valente 0726ce41bf Tune rule to exclude forwarded events. (#3790) 
Events containing "forwarded" as a tag may include host information
that is not related to the host running elastic agent. This triggers
false positive alerts. Examples include Entity Analytics integrations,
Palo Alto GlobalProtect activity, and M365 Defender device events.

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
 2024-06-25 13:22:07 +02:00
Isai 2708a89f20 [New Rule] AWS IAM User Created Access Keys for Another User (#3788) 
* [New Rule] AWS IAM User Created Access Keys for Another User

...

* updated min_stack and removed index field

* reversed tactic order

* added AWS documentation as reference

* Apply suggestions from code review

updated_date, query format change, removed keep from query
 2024-06-25 00:11:48 -04:00
Terrance DeJesus da8f3e4880 [New Rule] Okta Credential Stuffing and Password Spraying Identification via Source, Device Token and Actor (#3797) 
* adding new rule 'Multiple Okta User Authentication Events with Same Device Token Hash'

* adding new rule 'Multiple Okta User Authentication Events with Client Address'

* updating UUIDs

* removed indexes

* adding new rule 'High Number of Okta Device Token Cookies Generated for Authentication'

* added okta outcome reason 'INVALID_CREDENTIALS' to queries

* updated risk score

* made all rules low risk score

* added user session start to rule

* updated min-stack comments
 2024-06-21 13:11:23 -04:00
Terrance DeJesus 11aab028dc [Rule Tuning] Okta User Sessions Started from Different Geolocations (#3799) 
* tuning 'Okta User Sessions Started from Different Geolocations'

* TOML linting

* updated min-stack comments

* added setup

* Removed some blank spaces
 2024-06-20 16:52:26 -04:00
Krishna Chaitanya Reddy Burri e9d7ddfa35 [Rule Tuning]: Fix threat_index and filters in Rapid7 CVE rule (#3800) 
* Fix index and filters in Rapid7 CVE rule

* change updated date

---------

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
 2024-06-20 15:17:06 -04:00
Jonhnathan c20318d0d0 [New Rule] Potential Privilege Escalation via Service ImagePath Modification (#3757) 
* [New Rule] Potential Privilege Escalation via Service ImagePath Modification

* Update privilege_escalation_reg_service_imagepath_mod.toml

* [New Rule] NTDS Dump via Wbadmin

* Revert "[New Rule] NTDS Dump via Wbadmin"

This reverts commit 09fd513b1e8b35e22c7d1a371b0aa5aa4837cdc5.

* Apply suggestions from code review

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* Update privilege_escalation_reg_service_imagepath_mod.toml

---------

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
 2024-06-20 10:41:53 -03:00
Jonhnathan 236444200b [New Rule] NTDS Dump via Wbadmin (#3758) 
* [New Rule] NTDS Dump via Wbadmin

* Update rules/windows/credential_access_wbadmin_ntds.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

---------

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
 2024-06-20 09:55:07 -03:00
Jonhnathan 3fd9bae611 [New Rule] Potential WPAD Spoofing via DNS Record Creation (#3748) 2024-06-20 09:34:27 -03:00
Jonhnathan 6a0ac563a0 Create defense_evasion_reg_disable_enableglobalqueryblocklist.toml (#3734) 2024-06-20 09:23:06 -03:00
Kirti Sodhi 51b9717ac0 Adding setup templates to the ML rules (#3798) 
* Added setup instructions for ml rules
 2024-06-19 10:04:41 -04:00
Anthony c1dcd21531 Closes #2216 (#2855) 
* Update privilege_escalation_sts_assumerole_usage.toml

* Update privilege_escalation_sts_assumerole_usage.toml

---------

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>
 2024-06-13 16:52:54 -04:00
Terrance DeJesus 020ca4be24 [New Rule] Rapid7 Threat Command CVEs Correlation (#3718) 
* new rule 'Rapid7 Threat Command CVEs Correlation'

* Update rules/threat_intel/threat_intel_rapid7_threat_command.toml

Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>

* updated threat index and tags

* changed 'indicator match' to 'threat match' for tags

* removed timeline

* updating integrations to match main

* re-adding rapid7 threat command integration manifest and schema

* reverting changes; removing timeline

* changed max signals to 10000

---------

Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>
 2024-06-12 18:01:44 -04:00
Jonhnathan 4eff7c6c87 [New Rule] Potential DNS Server Privilege Escalation via ServerLevelPluginDll (#3717) 
* [New Rule] Potential DNS Server Privilege Escalation via ServerLevelPluginDll

* Update privilege_escalation_dns_serverlevelplugindll.toml

* Update privilege_escalation_dns_serverlevelplugindll.toml

* Update rules/windows/privilege_escalation_dns_serverlevelplugindll.toml

---------

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
 2024-06-12 15:18:31 -03:00
shashank-elastic 89d89f15d2 Update FIM integration Setup sequence (#3781) 2024-06-12 16:40:45 +05:30
shashank-elastic 0a69c19c83 Update Minstack versions for SentinelOne rules (#3777) 2024-06-11 18:58:26 +05:30
James Valente 8baf5dc2d8 Add exceptions to C2 Beaconing Activity (#3771) 2024-06-11 18:43:46 +05:30
Ruben Groenewoud ec223a4a05 [New Rule] Suspicious File Modification (#3746) 
* [New Rule] Suspicious File Modification

* Update persistence_suspicious_file_modifications.toml

* Update rules/linux/persistence_suspicious_file_modifications.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/linux/persistence_suspicious_file_modifications.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Updates

* Update rules/integrations/fim/persistence_suspicious_file_modifications.toml

---------

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>
 2024-06-11 13:03:20 +02:00
Ruben Groenewoud c87c4c9f5d [New Rules] PAM Module Creation & Unusual PAM Grantor (#3743) 
* [New Rules] PAM Module Creation & Unusual PAM Grantor

* Update persistence_unusual_pam_grantor.toml

* Update persistence_pluggable_authentication_module_creation.toml

* Update rules/linux/persistence_pluggable_authentication_module_creation.toml

* Update persistence_pluggable_authentication_module_creation.toml

* Update persistence_unusual_pam_grantor.toml

* Update rules/linux/persistence_pluggable_authentication_module_creation.toml
 2024-06-11 11:51:33 +02:00
Ruben Groenewoud 4cf0c2b9af [Rule Tuning] Systemd-udevd Rule File Creation (#3738) 
* [Rule Tuning] Systemd-udevd Rule File Creation

* Incompatible endgame field

* Update rules/linux/persistence_udev_rule_creation.toml

* Update rules/linux/persistence_udev_rule_creation.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* Update rules/linux/persistence_udev_rule_creation.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* Update persistence_udev_rule_creation.toml

---------

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
 2024-06-11 11:40:54 +02:00
Ruben Groenewoud 4003219aa1 [New Rule] APT Package Manager Configuration File Creation (#3739) 
* [New Rule] APT Package Manager Configuration File Creation

* Update rules/linux/persistence_apt_package_manager_file_creation.toml

* Update persistence_apt_package_manager_file_creation.toml
 2024-06-11 09:43:35 +02:00
Terrance DeJesus 62eea772d0 [New Rule] AWS S3 Bucket Ransom Note Uploaded (#3604) 
* new rule 'AWS S3 Bucket Object Retrieval, Deletion, and Potential Ransom Note Replacement'

* fixed technique mapping

* added investigation guide; added more ransom note extensions

* adjusted lookback and maxspan

* added  API call to second sequence

* updating date

* Update rules/integrations/aws/impact_s3_bucket_object_deletion_and_ransomware_note_added.toml

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

* Update rules/integrations/aws/impact_s3_bucket_object_deletion_and_ransomware_note_added.toml

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

* changed rule to ESQL; updated investigation guide

* changed file name

* removed txt, ecc, and note

---------

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
 2024-06-10 10:47:20 -04:00
Ruben Groenewoud 74f049cc7c [New Rule] Network Connection Initiated by SSH Parent Process (#3759) 
* [New Rule] Network Connection Initiated by SSH Parent Process

* Update persistence_ssh_netcon.toml

* Update rules/linux/persistence_ssh_netcon.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* Update rules/linux/persistence_ssh_netcon.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* Update persistence_ssh_netcon.toml

* Update persistence_ssh_netcon.toml

---------

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
 2024-06-10 10:30:45 +02:00
Ruben Groenewoud 29bb52d2fb [New Rule] Netcon through XDG Autostart Entry (#3741) 
* [New Rule] Netcon through XDG Autostart Entry

* Update rules/linux/persistence_xdg_autostart_netcon.toml

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

* Update persistence_xdg_autostart_netcon.toml

* Update persistence_xdg_autostart_netcon.toml

---------

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
 2024-06-10 10:17:09 +02:00
Ruben Groenewoud 70496f813f [New Rule] Executable Bit Set for rc.local/rc.common (#3736) 
* [New Rule] Executable Bit Set for rc.local/rc.common

* Endgame compatibility

* Update rules/linux/persistence_rc_local_common_executable_bit_set.toml
 2024-06-10 09:57:14 +02:00
Isai e1cbf9f684 [New rules] AWS IAM AdministratorAccess Policy Attached to : User, Group, Role(es|ql) (#3735) 
* [New Rule] AWS IAM AdministratorAccess Policy Attached to User

issue...

* add source.address and source.geo.location

* fix threat tactic ids

* AdministratorAccess Policy Attached to Group

* AdminstratoAccess Policy Attached to Role

* reduce severity to medium

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

---------

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
 2024-06-07 18:31:06 -04:00
Jonhnathan 087e8a6e85 [Rule Tuning] User Added to Privileged Group (#3763) 
* [New Rule] User Added to Privileged Group

* add more groups

* Update rules/windows/persistence_user_account_added_to_privileged_group_ad.toml

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

* Update persistence_user_account_added_to_privileged_group_ad.toml

---------

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
 2024-06-07 13:43:30 -03:00
Ruben Groenewoud d3e2f70ce2 [New Rule] Process Capability Set via setcap Utility (#3744) 
* [New Rule] Process Capability Set via setcap Utility

* ++

* Update rules/linux/persistence_process_capability_set_via_setcap.toml
 2024-06-06 12:44:31 +02:00
Ruben Groenewoud 8e6114f76c [Rule Tuning] System Binary Moved or Copied (#3742) 
* [Rule Tuning] System Binary Moved or Copied

* Added reference

* Update defense_evasion_binary_copied_to_suspicious_directory.toml

* Update defense_evasion_binary_copied_to_suspicious_directory.toml
 2024-06-06 12:24:48 +02:00
Ruben Groenewoud 61ab035f41 [Rule Tuning] Potential Sudo Hijacking (#3745) 
* [Rule Tuning] Potential Sudo Hijacking

* Update rules/linux/privilege_escalation_sudo_hijacking.toml

* Update rules/linux/privilege_escalation_sudo_hijacking.toml
 2024-06-06 11:59:26 +02:00
Ruben Groenewoud 342fde097f [New Rule] SSH Key Generated via ssh-keygen (#3731) 
* [New Rule] SSH Key Generated via ssh-keygen

* ++

* Update rules/linux/persistence_ssh_key_generation.toml

---------

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
 2024-06-06 11:50:38 +02:00
Terrance DeJesus 9f67585332 [New Rule] AWS EC2 Instance Connect SSH Public Key Uploaded (#3634) 
* new rule 'AWS EC2 Instance Connect SSH Public Key Uploaded'

* changed tactic to privilege escalation

* added additional reference

* added investigation guide

* updated summary

* changed risk score to medium; adjusted tags

* fixed mitre mapping

* Update rules/integrations/aws/privilege_escalation_ec2_instance_connect_ssh_public_key_uploaded.toml

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

---------

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
 2024-06-05 10:33:42 -04:00
Terrance DeJesus 05ac4e1bd3 [New Rule] AWS Systems Manager SecureString Parameter Request with Decryption Flag (#3590) 
* new rule 'First Occurrence of Resource Accessing AWS Systems Manager SecureString Parameters with Decryption Flag'

* updated rule contents

* added investigation guide; changed new terms to uder.id

* adjusted time window

* adjusted rule name

* updated query, adjusted new terms value
 2024-06-05 10:22:38 -04:00
Terrance DeJesus c77eb1d915 [New Rule] AWS IAM Roles Anywhere Profile Creation and Trusted Anchor with External CA Created (#3609) 
* new rule 'AWS IAM Roles Anywhere Role Creation'

* adjusted rule to focus on Roles Anywhere profile creation

* added rule for roles anywhere trusted anchor; updated rule file naming

* added investigation guide

* added investigation guide

* adjusted rule and file name

* Update rules/integrations/aws/persistence_iam_roles_anywhere_trusted_anchor_created_with_external_ca.toml

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

* Update rules/integrations/aws/persistence_iam_roles_anywhere_trusted_anchor_created_with_external_ca.toml

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

---------

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
 2024-06-05 10:10:53 -04:00
Ruben Groenewoud 5f36f3a03e [Rule Tuning] Shell Configuration Creation or Modification (#3732) 
* [Rule Tuning] Shell Configuration Creation or Modification

* Incompatible endgame field

* Update rules/linux/persistence_shell_configuration_modification.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

---------

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
 2024-06-05 10:28:13 +02:00
Ruben Groenewoud e41a57f2ad [Rule Tuning] Message-of-the-Day (MOTD) (#3730) 
* [Rule Tuning] Message-of-the-Day (MOTD)

* Update persistence_message_of_the_day_creation.toml

* ++

* Incompatible endgame field

* Update rules/linux/persistence_message_of_the_day_creation.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* Update rules/linux/persistence_message_of_the_day_execution.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

---------

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
 2024-06-05 10:18:30 +02:00
Ruben Groenewoud bebf671881 [Rule Tuning] Systemd Service & Timer (#3728) 
* [Rule Tuning] Systemd Service & Timer

* Update

* Update persistence_systemd_scheduled_timer_created.toml

* Update persistence_systemd_service_creation.toml

* ++

* Incompatible endgame field

* Update rules/linux/persistence_systemd_service_creation.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* Update rules/linux/persistence_systemd_scheduled_timer_created.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

---------

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
 2024-06-05 10:01:15 +02:00
Ruben Groenewoud 81ee6380ec [New Rule & Tuning] (Ana)Cron & At Job Creation (#3726) 
* [New Rule & Tuning] (Ana)Cron & At Job Creation

* Update persistence_at_job_creation.toml

* Update persistence_cron_job_creation.toml

* ++

* Incompatible endgame field

* Update rules/linux/persistence_at_job_creation.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* Update rules/linux/persistence_cron_job_creation.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

---------

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
 2024-06-05 09:53:42 +02:00
shashank-elastic e357a2c050 Refresh MITRE Attack v15.1.0 (#3725) 2024-06-04 20:14:58 +05:30
Terrance DeJesus 59b7e3bde4 [New Rule] Rapid Secret Retrieval Attempts from AWS SecretsManager (#3589) 
* new rule 'Rapid Secret Retrieval Attempts from AWS SecretsManager'

* updated user identity arn to user.id for cross-service password retrieval

* added investigation guides; bumped dates; adjusted threshold value

* Update rules/integrations/aws/credential_access_rapid_secret_retrieval_attempts_from_secretsmanager.toml

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>

* Update rules/integrations/aws/credential_access_rapid_secret_retrieval_attempts_from_secretsmanager.toml

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>

* Update rules/integrations/aws/credential_access_new_terms_secretsmanager_getsecretvalue.toml

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>

---------

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>
Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
 2024-06-04 09:20:04 -04:00
Ruben Groenewoud 90bb8b53d8 [Rule Tuning] Agent Spoofing (#3729) 2024-06-03 19:28:24 +02:00
Terrance DeJesus 0885032b2c [New Rule] AWS Lambda Function Policy Updated To Allow Public Invocation (#3632) 
* new rule 'AWS Lambda Function Policy Updated To Allow Public Invocation'

* updated rule UUID

* added investigation guide

* Update rules/integrations/aws/persistence_lambda_backdoor_invoke_function_for_any_principal.toml

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>

* Update rules/integrations/aws/persistence_lambda_backdoor_invoke_function_for_any_principal.toml

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>

* Update rules/integrations/aws/persistence_lambda_backdoor_invoke_function_for_any_principal.toml

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

---------

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>
Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
 2024-06-03 11:42:38 -04:00
Terrance DeJesus 856c6c5a1f [New Rule] AWS EC2 EBS Snapshot Shared with Another Account (#3601) 
* new rule 'AWS EC2 EBS Snapshot Shared with Another Account'

* added investigation guide

* updated rule name

* converted to ES|QL

* reverting non-ecs update
 2024-06-02 10:30:08 -04:00