7fdb6b2e80
Create persistence_time_provider_mod.toml ( #890 )
2021-01-25 14:42:56 -05:00
ecbb57814a
Create credential_access_saved_creds_vaultcmd.toml ( #884 )
2021-01-25 14:25:35 -05:00
4639df022b
[New Rule] Modification of WDigest Security Provider ( #883 )
...
* Create credential_access_mod_wdigest_security_provider.toml
* syntax tweaks
2021-01-25 13:54:36 -05:00
8c123785f0
[New Rule] Enumeration Command Spawned via WMIPrvSE ( #882 )
...
* Create execution_enumeration_via_wmiprvse.toml
* alignment
2021-01-25 13:46:26 -05:00
01c3c718f5
[New Rule] Executable File Creation with Multiple Extensions ( #881 )
...
* Create defense_evasion_file_creation_mult_extension.toml
* spacing
* Update rules/windows/defense_evasion_file_creation_mult_extension.toml
Co-authored-by: Ross Wolf <31489089+rw-access@users.noreply.github.com >
* update query
* alignment
Co-authored-by: Ross Wolf <31489089+rw-access@users.noreply.github.com >
2021-01-25 13:40:25 -05:00
aa409111b8
[New Rule] Azure Active Directory High Risk Sign-in ( #790 )
...
* [New Rule] Azure Active Directory High Risk Sign-in
* Update initial_access_azure_active_directory_high_risk_signin.toml
2021-01-25 13:27:06 -05:00
1708ea3252
Loosen query DSL filter schema validation ( #895 )
2021-01-20 12:21:46 -07:00
fb92c69797
[New Rule] Clearing Windows Security Logs ( #529 )
...
* [New Rule] Clearing Windows Security Logs
* Fix Date Format Error
* Update rules/windows/defense_evasion_clearing_windows_security_logs.toml
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
* Update rules/windows/defense_evasion_clearing_windows_security_logs.toml
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
* Update rules/windows/defense_evasion_clearing_windows_security_logs.toml
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
* Update rules/windows/defense_evasion_clearing_windows_security_logs.toml
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
* Update rules/windows/defense_evasion_clearing_windows_security_logs.toml
Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com >
* Update rules/windows/defense_evasion_clearing_windows_security_logs.toml
Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com >
* Update rules/windows/defense_evasion_clearing_windows_security_logs.toml
Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com >
* Update rules/windows/defense_evasion_clearing_windows_security_logs.toml
Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com >
* Update rules/windows/defense_evasion_clearing_windows_security_logs.toml
Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com >
* Add Elastic tag
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
* update maturity
* Add Elastic to list of authors
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com >
* bump updated_date
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com >
Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com >
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com >
2021-01-11 17:17:20 -07:00
5bbe43144d
Fix default branch name for GitHub Actions
2021-01-05 20:05:37 -07:00
67413cee47
Update ML-DGA docs ( #750 )
2020-12-21 16:25:24 -09:00
5561738f28
update incomplete bug fix from 736 for 7.11 -> 7.10 downgrade logic
2020-12-18 22:01:06 -09:00
783332642d
Merge branch '7.11' into main
2020-12-18 09:28:30 -07:00
7dcb666d81
Fix 7.11 -> 7.10 ATT&CK downgrade logic for optional techiques ( #736 )
2020-12-18 09:28:05 -07:00
331d321648
Make threat.technique optional ( #727 )
2020-12-17 20:22:59 -09:00
39ab9f14e1
strip trailing slash from kibana_url only if defined
2020-12-16 13:00:20 -09:00
ff76571366
strip trailing slash in kibana_url only when defined
2020-12-16 12:59:30 -09:00
86fe2d6279
Restore PR jobs
2020-12-16 08:12:21 -07:00
97f9f864d1
Remove duplicate PR job ( #728 )
2020-12-15 13:59:14 -07:00
889828d473
[New Rule] SUNBURST Command and Control Activity Detected ( #723 )
...
* bump package version to 7.12
* Auth to Kibana connector using an existing cookie (#711 )
* initial commit
* simplified by any method not to solarwinds.com
* Updates from review
* updated desc and note
* query readability
* update to optimize query to pass unit tests
* optimized
* optimized
* Update command_and_control_sunburst_c2_activity_detected.toml
* Restore package version
* updated rule after rebase
* re-lint
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
Co-authored-by: Brent Murphy <bmurphy@endgame.com >
Co-authored-by: Ross Wolf <31489089+rw-access@users.noreply.github.com >
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com >
2020-12-15 14:41:54 -06:00
79a5ca9b78
[New Rule] APT Solarwinds Backdoor Behavior - 5 rules ( #722 )
...
* bump package version to 7.12
* Auth to Kibana connector using an existing cookie (#711 )
* [New Rule] APT Solarwinds Bakcdoor Behavior - 3 rules
* ruleID
* fixed process names to include both 32 and 64bits
* fixed process names to include both 32 and 64 bits
* deleted unnecessary condition
* adjusted rule to cover cmd and ps
* renamed rule and fixed tactic
* added rule to SW package - Exporting MailBox with Powershell
* Update rules/windows/defense_evasion_solarwinds_backdoor_service_disabled_via_registry.toml
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
* Update rules/windows/defense_evasion_solarwinds_backdoor_service_disabled_via_registry.toml
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
* added details to FP tag as sug by JLB
* added rule New ActiveSync Allowed Device Added via PowerShell to SW pkg
* Update rules/windows/defense_evasion_solarwinds_backdoor_service_disabled_via_registry.toml
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
* relinted
* adjusted desc and FPs
* adjusted alert name as sug by DevK
* Update collection_email_powershell_exchange_mailbox.toml
* Update collection_persistence_powershell_exch_mailbox_activesync_add_device.toml
* Update rules/windows/collection_email_powershell_exchange_mailbox.toml
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com >
* Update rules/windows/collection_email_powershell_exchange_mailbox.toml
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com >
* Update rules/windows/collection_persistence_powershell_exch_mailbox_activesync_add_device.toml
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com >
* updated registry to include symlink
* Update rules/windows/execution_apt_solarwinds_backdoor_child_cmd_powershell.toml
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com >
* added T1195 as sug by JLB
* added T1195 as sug by JLB
* added T1195 as sug by JLB
* added pwsh as sug by Dan
* added pwsh as sug by Dan
* [New Rule] Outbound Scheduled Tasks Activity via PowerShell (#725 )
* [New Rule] Outbound Scheduled Tasks Activity via PowerShell
* Update rules/windows/lateral_movement_scheduled_task_powershell_source.toml
Co-authored-by: dstepanic17 <57736958+dstepanic17@users.noreply.github.com >
* fixed - added pwsh to seq_netblock
* Update rules/windows/lateral_movement_scheduled_task_powershell_source.toml
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com >
* Update rules/windows/lateral_movement_scheduled_task_powershell_source.toml
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com >
* Update rules/windows/lateral_movement_scheduled_task_powershell_source.toml
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com >
* relinted
Co-authored-by: dstepanic17 <57736958+dstepanic17@users.noreply.github.com >
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com >
* relinted
* Update rules/windows/collection_email_powershell_exchange_mailbox.toml
Co-authored-by: Andrew Pease <7442091+peasead@users.noreply.github.com >
* Update rules/windows/collection_persistence_powershell_exch_mailbox_activesync_add_device.toml
Co-authored-by: Andrew Pease <7442091+peasead@users.noreply.github.com >
* Restore packages file
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com >
Co-authored-by: dstepanic17 <57736958+dstepanic17@users.noreply.github.com >
Co-authored-by: Andrew Pease <7442091+peasead@users.noreply.github.com >
Co-authored-by: Ross Wolf <31489089+rw-access@users.noreply.github.com >
2020-12-15 21:33:00 +01:00
b6aa6c6548
Auth to Kibana connector using an existing cookie ( #711 )
2020-12-15 13:20:46 -07:00
3042cbb5d6
[New Rule] Outbound Scheduled Tasks Activity via PowerShell ( #725 )
...
* [New Rule] Outbound Scheduled Tasks Activity via PowerShell
* Update rules/windows/lateral_movement_scheduled_task_powershell_source.toml
Co-authored-by: dstepanic17 <57736958+dstepanic17@users.noreply.github.com >
* fixed - added pwsh to seq_netblock
* Update rules/windows/lateral_movement_scheduled_task_powershell_source.toml
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com >
* Update rules/windows/lateral_movement_scheduled_task_powershell_source.toml
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com >
* Update rules/windows/lateral_movement_scheduled_task_powershell_source.toml
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com >
* relinted
Co-authored-by: dstepanic17 <57736958+dstepanic17@users.noreply.github.com >
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com >
2020-12-15 13:20:28 -07:00
5244151b2e
[New Rule] Outbound Scheduled Tasks Activity via PowerShell ( #725 )
...
* [New Rule] Outbound Scheduled Tasks Activity via PowerShell
* Update rules/windows/lateral_movement_scheduled_task_powershell_source.toml
Co-authored-by: dstepanic17 <57736958+dstepanic17@users.noreply.github.com >
* fixed - added pwsh to seq_netblock
* Update rules/windows/lateral_movement_scheduled_task_powershell_source.toml
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com >
* Update rules/windows/lateral_movement_scheduled_task_powershell_source.toml
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com >
* Update rules/windows/lateral_movement_scheduled_task_powershell_source.toml
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com >
* relinted
Co-authored-by: dstepanic17 <57736958+dstepanic17@users.noreply.github.com >
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com >
2020-12-15 19:10:52 +01:00
c5cae5c437
[New Rule] Azure Active Directory PowerShell Sign-in ( #718 )
...
* Create initial_access_azure_active_directory_powershell_signon.toml
* Apply suggestions from code review
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
* Update initial_access_azure_active_directory_powershell_signin.toml
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
2020-12-15 11:52:43 -05:00
6b31b96bf8
[New Rule] Azure Service Principal Addition ( #717 )
...
* Create defense_evasion_azure_service_principal_addition.toml
* Update defense_evasion_azure_service_principal_addition.toml
* Update rules/azure/defense_evasion_azure_service_principal_addition.toml
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
* Update rules/azure/defense_evasion_azure_service_principal_addition.toml
Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com >
* lint
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com >
2020-12-15 11:47:23 -05:00
84ab3db48c
[New Rule] Azure Application Credential Modification ( #716 )
...
* Create defense_evasion_azure_application_credential_modification.toml
* Update rules/azure/defense_evasion_azure_application_credential_modification.toml
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
2020-12-15 11:41:26 -05:00
a6463b435c
[Rule Tuning] Replace line comments with block comments ( #710 )
2020-12-12 17:11:17 -09:00
b012a23df8
Auth to Kibana connector using an existing cookie ( #711 )
2020-12-12 16:10:52 -09:00
7926e50b8f
bump package version to 7.12
2020-12-09 13:51:19 -09:00
7c2abc68d7
[Docs] Update ML_DGA.md ( #707 )
2020-12-09 13:06:35 -09:00
a5cd35f498
AdFind Command Activity ( #395 )
...
* initial commit
* added sub-techniques
* Update rules/windows/discovery_adfind_command_activity.toml
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
* Update rules/windows/discovery_adfind_command_activity.toml
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
* Update rules/windows/discovery_adfind_command_activity.toml
* Update rules/windows/discovery_adfind_command_activity.toml
* update threat mapping with sub-techniques
* update technique url
* remove ecs_version
* convert rule to eql
* added sub-techniques
* Update rules/windows/discovery_adfind_command_activity.toml
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
2020-12-09 15:01:28 -06:00
66506139d9
[New Rule] Detects Mimikatz via Invoke-Mimikatz ( #700 )
...
* initial commit
* lint
* note updates
* convert to eql and moved to dev
* convert to eql and moved to dev
2020-12-09 14:51:45 -06:00
17cf79d076
[New Rule] Default Cobalt Strike Team Server Certificate ( #358 )
...
* initial commit
* Update rules/network/command_and_control_cobalt_strike_default_teamserver_cert.toml
Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com >
* Update rules/network/command_and_control_cobalt_strike_default_teamserver_cert.toml
Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com >
* Update rules/network/command_and_control_cobalt_strike_default_teamserver_cert.toml
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com >
* Update rules/network/command_and_control_cobalt_strike_default_teamserver_cert.toml
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com >
* updated to include sub-techniques
Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com >
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com >
2020-12-09 14:49:31 -06:00
d5eaf5db53
[New Rule] High Number of Process and/or Services Termination ( #672 )
...
* [New Rule] High Number of Process and/or Services Termination
* removed url and fixed ruleid
* fixed tags
* Update rules/windows/defense_evasion_stop_process_service_threshold.toml
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
* Update rules/windows/defense_evasion_stop_process_service_threshold.toml
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com >
* relinted
* Update rules/windows/defense_evasion_stop_process_service_threshold.toml
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com >
* Update rules/windows/defense_evasion_stop_process_service_threshold.toml
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com >
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com >
2020-12-09 09:00:19 +01:00
14fe63bb1e
[Rule Tuning] Unusual Parent-Child Relationship and Suspicious MS Office Child Process ( #676 )
...
* [Rule Tuning] Unusual Parent-Child Relationship and Suspicious MS Office Child Process
* replaced path with name for faster comparaison
* added few more cases and refurl
also organized items per anomaly category
* added extra refurl plus few excep
* Update execution_suspicious_ms_office_child_process.toml
* added parenthesis
* excluded an FP
2020-12-09 08:55:58 +01:00
e272800a5d
Add ATT&CK sub-technique support to CLI ( #614 )
...
* Add Mitre sub-technique support to CLI
* Add subtechnique enum to schema
* Add test to prevent duplicative tactics in mapping
2020-12-08 21:56:55 -09:00
b8d2f6fc96
[Rule Tuning] Possible Consent Grant Attack via Azure-Registered Application ( #575 )
...
* Update initial_access_consent_grant_attack_via_azure_registered_application.toml
* bump updated_date
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com >
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
2020-12-08 17:20:30 -07:00
24828ea9cb
[New Rule] Conversions of some APT-29 Endgame rules ( #702 )
...
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com >
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com >
2020-12-08 14:13:34 -09:00
598e807a5c
[New Rule] Microsoft 365 Teams Custom Application Interaction Allowed ( #657 )
...
* [New Rule] O365 Teams Custom Application Interaction Allowed
* rebrand to m365, still needed non ecs schema
* Update non-ecs-schema.json
2020-12-08 17:36:47 -05:00
0ed1e1df71
Add support to validate against dev ECS and beats schemas ( #691 )
2020-12-08 13:29:56 -09:00
73e2690ec0
[New Rule] Potential Password Spraying of Microsoft 365 User Accounts ( #665 )
...
* [New Rule] Potential Password Spraying of O365 User Accounts
* Update credential_access_o365_potential_password_spraying_attack.toml
* rebrand to m365
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
2020-12-08 17:19:39 -05:00
200fbe939e
[Bug] Allow duplicative queries across different rule types ( #704 )
2020-12-08 13:16:59 -09:00
8c92ae7348
Add ATT&CK subtechniques to the schema ( #337 )
...
* Add ATT&CK subtechniques to the schema
* Switch subtechniques to the 7.11 schema
* Make technique still required
* Lint fixes
* Cleanup EQL constant
* Trim more cruft
* Restore EQL for 710
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
2020-12-08 14:57:30 -07:00
d74b41c1a0
[New Rule] Microsoft 365 Teams External Access Enabled ( #661 )
...
* [New Rule] O365 Teams External Access Enabled
* rebrand to m365, still needed non ecs schema
* update description
* remove non ecs change
2020-12-08 16:48:15 -05:00
6bfe5d3dd8
[New Rule] Microsoft 365 Teams Guest Access Enabled ( #601 )
...
* [New Rule] O365 Teams Guest Access Enabled
* rebrand to m365, still needed non ecs schema
* remove non ecs schma change
2020-12-08 16:44:15 -05:00
6a296c64c5
[New Rule] Microsoft 365 Exchange DKIM Signing Configuration Disabled ( #578 )
...
* [New Rule] O365 Exchange DKIM Signing Configuration Disabled
* rebrand to m365
* still req non ecs schema
* Remove the ECS override
* Update _flatten_schema logic
* Allow fields with * in the path
* Allow explicit fields to overwrite implicit * fields
Co-authored-by: Ross Wolf <31489089+rw-access@users.noreply.github.com >
2020-12-08 16:38:00 -05:00
94e8fa80bb
[Rule Tuning] Suspicious Endpoint Security Parent Process ( #509 )
...
* [Rule Tuning] added FPs and converted to EQL for more flexibilty
* Update rules/windows/defense_evasion_masquerading_as_elastic_endpoint_process.toml
Co-authored-by: Ross Wolf <31489089+rw-access@users.noreply.github.com >
* adjusted process names in scope to security agents
* eql syntax
* ecs_version
* adjusted format
* Update rules/windows/defense_evasion_masquerading_as_elastic_endpoint_process.toml
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
Co-authored-by: Ross Wolf <31489089+rw-access@users.noreply.github.com >
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
2020-12-08 22:34:28 +01:00
538aa80bba
[New Rule] Process Termination Followed by Deletion ( #482 )
...
* [New Rule] Process Termination Followed by Deletion
* excluded SoftwareDistrib and WinSxS Folders
* added drive letter for better performance
* excluded signed PE
* eql syntax
* ecs_version
* Update rules/windows/defense_evasion_process_termination_followed_by_deletion.toml
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com >
* Update rules/windows/defense_evasion_process_termination_followed_by_deletion.toml
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com >
* Update rules/windows/defense_evasion_process_termination_followed_by_deletion.toml
Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com >
* Update rules/windows/defense_evasion_process_termination_followed_by_deletion.toml
Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com >
* added few more extension as suggested by DanStep
* dropped winlogbeat due to pe.codesign
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com >
Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com >
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
2020-12-08 22:26:11 +01:00
97fa6c62cd
[New Rule] Remote File Download via Powershell ( #660 )
...
* [New Rule] Remote File Download via Powershell
* new line
* eql syntax
* ecs_version
* added google related FPs
* Update rules/windows/command_and_control_remote_file_copy_powershell.toml
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
* Update rules/windows/command_and_control_remote_file_copy_powershell.toml
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
* Update rules/windows/command_and_control_remote_file_copy_powershell.toml
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com >
* Update rules/windows/command_and_control_remote_file_copy_powershell.toml
Co-authored-by: seth-goodwin <58222969+seth-goodwin@users.noreply.github.com >
* Update rules/windows/command_and_control_remote_file_copy_powershell.toml
Co-authored-by: seth-goodwin <58222969+seth-goodwin@users.noreply.github.com >
* relint
* ecs_version removed
* replaced path with name to avoid FPs for users temp folder
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com >
Co-authored-by: seth-goodwin <58222969+seth-goodwin@users.noreply.github.com >
2020-12-08 21:28:28 +01:00
9792d967d7
[Rule Tuning] Convert to EQL 5 existing rules ( #414 )
...
* [Rule Tuning] 5 rules
* [Rule Tuning] Converted two IIS CredAccess rules to EQL
* Update rules/windows/credential_access_iis_apppoolsa_pwd_appcmd.toml
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
* Update rules/windows/credential_access_iis_connectionstrings_dumping.toml
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
* Update rules/windows/defense_evasion_masquerading_renamed_autoit.toml
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
* Update rules/windows/defense_evasion_suspicious_zoom_child_process.toml
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
* Update rules/windows/evasion_rundll32_no_arguments.toml
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
* deleted. rule looks incompatible with endpoint
* fixing units testing error
* Update credential_access_iis_apppoolsa_pwd_appcmd.toml
* Update rules/windows/credential_access_iis_apppoolsa_pwd_appcmd.toml
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
* desc
* fixed tags duplicate
* ecs_version
* ecs_version
* ecs_version
* ecs_version
* ecs_version
* ecs_version
* Update rules/windows/defense_evasion_masquerading_renamed_autoit.toml
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com >
* Update rules/windows/defense_evasion_suspicious_zoom_child_process.toml
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com >
* Update defense_evasion_rundll32_no_arguments.toml
* adjusted process args count to 1
adjusted process args count to 1 to account for winlogbeat Windows process creation events 4688 with missing cmdline value (avoid FPs).
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com >
2020-12-08 21:07:26 +01:00
Brent Murphy