3 Commits

Author	SHA1	Message	Date
Terrance DeJesus	141b00ec41	[Rule Tuning] Missing MITRE ATT&CK Mappings (#2073) ... * initial commit with eggshell mitre mapping added * adding updated rules * [Rule Tuning] MITRE for GCP rules I've added Mitre references for the 4 GCP rules missing. Changed 3 of the rules from "Impact" to "Defense Evasion" based on the technique used and it's matched tactic. * [Rule Tuning] Endgame Rule name updates for Mitre Updated Endgame rule names for those with Mitre tactics to match the tactics. * Update rules/integrations/aws/persistence_redshift_instance_creation.toml Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com> * Update rules/integrations/aws/exfiltration_rds_snapshot_restored.toml Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com> * adding 10 updated rules for google_workspace, ml and o365 * adding 22 rule updates for mitre att&ck mappings * adding 24 rule updates related mainly to ML rules * adding 3 rules related to detection via ML * adding adjustments * adding adjustments with solutions to recent pytest errors * removed tabs from tags * adjusted mappings and added techniques * adjusted endgame rule mappings per review * adjusted names to match different tactics * added execution and defense evasion tag * adjustments to address errors from merging with main * added newlines to rules missing them at the end of the file Co-authored-by: imays11 <59296946+imays11@users.noreply.github.com> Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com> Removed changes from: - rules/integrations/google_workspace/application_added_to_google_workspace_domain.toml - rules/integrations/google_workspace/domain_added_to_google_workspace_trusted_domains.toml - rules/integrations/google_workspace/google_workspace_admin_role_deletion.toml - rules/integrations/google_workspace/google_workspace_mfa_enforcement_disabled.toml - rules/integrations/google_workspace/google_workspace_policy_modified.toml - rules/integrations/google_workspace/mfa_disabled_for_google_workspace_organization.toml - rules/ml/ml_linux_anomalous_compiler_activity.toml - rules/ml/ml_linux_anomalous_metadata_process.toml - rules/ml/ml_linux_anomalous_metadata_user.toml - rules/ml/ml_linux_anomalous_process_all_hosts.toml - rules/ml/ml_linux_anomalous_sudo_activity.toml - rules/ml/ml_linux_anomalous_user_name.toml - rules/ml/ml_linux_system_information_discovery.toml - rules/ml/ml_linux_system_network_configuration_discovery.toml - rules/ml/ml_linux_system_network_connection_discovery.toml - rules/ml/ml_linux_system_process_discovery.toml - rules/ml/ml_linux_system_user_discovery.toml - rules/ml/ml_rare_process_by_host_linux.toml - rules/ml/ml_rare_process_by_host_windows.toml - rules/ml/ml_suspicious_login_activity.toml - rules/ml/ml_windows_anomalous_metadata_process.toml - rules/ml/ml_windows_anomalous_metadata_user.toml - rules/ml/ml_windows_anomalous_path_activity.toml - rules/ml/ml_windows_anomalous_process_all_hosts.toml - rules/ml/ml_windows_anomalous_process_creation.toml - rules/ml/ml_windows_anomalous_script.toml - rules/ml/ml_windows_anomalous_service.toml - rules/ml/ml_windows_anomalous_user_name.toml - rules/ml/ml_windows_rare_user_runas_event.toml - rules/ml/ml_windows_rare_user_type10_remote_login.toml - rules/windows/defense_evasion_execution_lolbas_wuauclt.toml (selectively cherry picked from commit e8c39d19a7)	2022-07-22 18:31:42 +00:00
Mika Ayenson	62298d92f4	2058 add setup field to metadata (#2061) ... * Convert config header to setup in note field * Parse note field into separate setup and note field with marko gfm * only validate and parse note on elastic authored rules and add CLI description for new DR_BYPASS_NOTE_VALIDATION_AND_PARSE environment variable Co-authored-by: brokensound77 <brokensound77@users.noreply.github.com> Removed changes from: - rules/cross-platform/impact_hosts_file_modified.toml - rules/integrations/google_workspace/application_added_to_google_workspace_domain.toml - rules/integrations/google_workspace/domain_added_to_google_workspace_trusted_domains.toml - rules/integrations/google_workspace/google_workspace_admin_role_deletion.toml - rules/integrations/google_workspace/google_workspace_mfa_enforcement_disabled.toml - rules/integrations/google_workspace/google_workspace_policy_modified.toml - rules/integrations/google_workspace/mfa_disabled_for_google_workspace_organization.toml - rules/integrations/google_workspace/persistence_google_workspace_admin_role_assigned_to_user.toml - rules/integrations/google_workspace/persistence_google_workspace_api_access_granted_via_domain_wide_delegation_of_authority.toml - rules/integrations/google_workspace/persistence_google_workspace_custom_admin_role_created.toml - rules/integrations/google_workspace/persistence_google_workspace_role_modified.toml - rules/integrations/kubernetes/execution_user_exec_to_pod.toml - rules/windows/credential_access_lsass_memdump_file_created.toml - rules/windows/defense_evasion_adding_the_hidden_file_attribute_with_via_attribexe.toml - rules/windows/defense_evasion_execution_lolbas_wuauclt.toml - rules/windows/defense_evasion_suspicious_certutil_commands.toml - rules/windows/execution_command_shell_started_by_svchost.toml (selectively cherry picked from commit a52751494e)	2022-07-18 21:25:32 +00:00
Pete Hampton	6a5a59ad00	[New Rule] AWS Redshift Cluster Creation (#1921) ... * Add rule for Redshift data warehouse creation. * Add fp block. * Add AWS integration metadata. * Add timestamp override. * Add note. * Update rules/integrations/aws/persistence_redshift_instance_creation.toml Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com> * Update rules/integrations/aws/persistence_redshift_instance_creation.toml Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com> * Update description for redshift instance creation. Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com> (cherry picked from commit 34655374c1)	2022-04-28 18:45:31 +00:00