security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
2,060 Commits 1 Branch 0 Tags
81ee6380ecb7b4c9017690fbd308db3d1cc86f91
Commit Graph

2060 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Ruben Groenewoud 81ee6380ec [New Rule & Tuning] (Ana)Cron & At Job Creation (#3726) 
* [New Rule & Tuning] (Ana)Cron & At Job Creation

* Update persistence_at_job_creation.toml

* Update persistence_cron_job_creation.toml

* ++

* Incompatible endgame field

* Update rules/linux/persistence_at_job_creation.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* Update rules/linux/persistence_cron_job_creation.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

---------

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
 2024-06-05 09:53:42 +02:00
shashank-elastic e357a2c050 Refresh MITRE Attack v15.1.0 (#3725) 2024-06-04 20:14:58 +05:30
Terrance DeJesus 59b7e3bde4 [New Rule] Rapid Secret Retrieval Attempts from AWS SecretsManager (#3589) 
* new rule 'Rapid Secret Retrieval Attempts from AWS SecretsManager'

* updated user identity arn to user.id for cross-service password retrieval

* added investigation guides; bumped dates; adjusted threshold value

* Update rules/integrations/aws/credential_access_rapid_secret_retrieval_attempts_from_secretsmanager.toml

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>

* Update rules/integrations/aws/credential_access_rapid_secret_retrieval_attempts_from_secretsmanager.toml

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>

* Update rules/integrations/aws/credential_access_new_terms_secretsmanager_getsecretvalue.toml

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>

---------

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>
Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
 2024-06-04 09:20:04 -04:00
Ruben Groenewoud 90bb8b53d8 [Rule Tuning] Agent Spoofing (#3729) 2024-06-03 19:28:24 +02:00
Terrance DeJesus f09a640ddf updating upload-artifact to version 4 (#3733) 
Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com>
 2024-06-03 12:04:01 -04:00
Terrance DeJesus 0885032b2c [New Rule] AWS Lambda Function Policy Updated To Allow Public Invocation (#3632) 
* new rule 'AWS Lambda Function Policy Updated To Allow Public Invocation'

* updated rule UUID

* added investigation guide

* Update rules/integrations/aws/persistence_lambda_backdoor_invoke_function_for_any_principal.toml

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>

* Update rules/integrations/aws/persistence_lambda_backdoor_invoke_function_for_any_principal.toml

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>

* Update rules/integrations/aws/persistence_lambda_backdoor_invoke_function_for_any_principal.toml

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

---------

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>
Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
 2024-06-03 11:42:38 -04:00
Terrance DeJesus 856c6c5a1f [New Rule] AWS EC2 EBS Snapshot Shared with Another Account (#3601) 
* new rule 'AWS EC2 EBS Snapshot Shared with Another Account'

* added investigation guide

* updated rule name

* converted to ES|QL

* reverting non-ecs update
 2024-06-02 10:30:08 -04:00
Terrance DeJesus 70469b4cdb [New Rule] AWS Lambda Layer Added to Existing Function (#3631) 
* new rule 'AWS Lambda Layer Added to Existing Function'

* updated query logic; added investigation note
 2024-06-02 08:41:04 -04:00
Terrance DeJesus 2e366741dc [New Rule] Building Block - AWS Lambda Function Created or Updated (#3610) 
* new rule 'AWS Lambda Function Created or Updated'

* added bbr fields

* updated severity

* Update rules_building_block/execution_aws_lambda_function_updated.toml
 2024-06-01 10:40:13 -04:00
Terrance DeJesus 7c82e75cf4 [New Rule] AWS S3 Bucket Policy Added to Share with External Account (#3603) 
* new rule 'AWS S3 Bucket Policy Added to Share with External Account'

* added investigation guide

* Update rules/integrations/aws/exfiltration_s3_bucket_policy_added_for_external_account_access.toml
 2024-06-01 10:31:41 -04:00
Isai 23ce41d8af [New Rule] AWS GetCallerIdentity API Called for the First Time (#3711) 
* [New Rule] AWS GetCallerIdentity API Called for the First Time

issue

* Apply suggestions from code review

name change, false positive additions, remove Setup, change new_terms window from 15d to 10d

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

* Update rules/integrations/aws/discovery_new_terms_sts_getcalleridentity.toml

fixed missing closing quotes

---------

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
 2024-05-31 17:55:06 -04:00
shashank-elastic 418a95205e Remove unwanted backticks (#3724) 2024-05-31 21:46:24 +05:30
James Valente 34294fbe6d Add exceptions to brute force threshold rule. (#3712) 
High volume, machine generated failures or MFA interruptions have been added to the rule.

Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com>
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
 2024-05-30 10:12:36 +02:00
github-actions[bot] 259bab7a5a Lock versions for releases: 8.9,8.10,8.11,8.12,8.13,8.14 (#3716) 2024-05-29 19:48:22 +05:30
shashank-elastic 9d019dcf26 Fix nodeenv version dependancy (#3715) 2024-05-29 18:52:34 +05:30
Gus Carlock 8b28a515c1 Update rule setup instructions for UEBA packages (#3652) 
* update detection-rules instructions for UEBA packages

---------

Co-authored-by: Susan <23287722+susan-shu-c@users.noreply.github.com>
 2024-05-28 14:21:46 -05:00
Terrance DeJesus d5c57463e1 [New Rule] First Occurrence of AWS Resource Starting SSM Session to EC2 Instance (#3598) 
* new rule 'First Occurrence of AWS Resource Starting SSM Session to EC2 Instance'

* added investigation guide

* changed file name to match tactic

* changed reference

* updated tags

* updated investigation notes

* changed new terms value; adjusted rule name
 2024-05-28 11:23:17 -04:00
Terrance DeJesus 3b994c1133 [New Rule] Building Block Rule - Attempt to Retrieve User Data from AWS EC2 Instance (#3593) 
* adding new rule 'Attempt to Retrieve User Data from AWS EC2 Instance'

* Update rules_building_block/discovery_userdata_request_from_ec2_instance.toml

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

---------

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
 2024-05-28 11:15:04 -04:00
Terrance DeJesus 527f785a60 [New Rule] AWS EC2 VPC Security Group Rule Added for Any Address or Remote Access Ports (#3599) 
* new rule 'AWS EC2 VPC Security Group Rule Added for Any Address or Remote Access Ports'

* updated rule name

* changed file name; added false-positive note

* changed rule UUID

* adjusted file name

* updated tags

* added investigation guide; updated query logic

* Update rules/integrations/aws/defense_evasion_vpc_security_group_ingress_rule_added_for_remote_connections.toml

Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>

* updated query and name

* updated query optimization

---------

Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>
 2024-05-28 10:49:20 -04:00
Samirbous ec609d826a [New RTA] Input Capture via Keylog (#3033) 
* [New RTA] Input Capture via Keylog

APIs in scope covered by 2 seperate RTAs  :

SetWindowsHookEx (collection_keylog_hook_keystate)
GetAsyncKeyState (collection_keylog_hook_keystate)
RegisterRawInputDevices (collection_keylog_rawinputdevice)

* Update rta/collection_keylog_hook_keystate.py

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

* Update rta/collection_keylog_rawinputdevice.py

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

---------

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>
Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com>
 2024-05-24 11:37:42 +01:00
Ruben Groenewoud 390629da4e [New Rule & Tunings] Linux Springtail Backdoor (#3692) 
* [New Rules and Tuning] Springtail backdoor

* consistency formatting

* update

* unit testing formatting change

* Update persistence_systemd_service_started.toml

* Update persistence_systemd_service_started.toml

* Update command_and_control_suspicious_network_activity_from_unknown_executable.toml
 2024-05-24 10:10:11 +02:00
Eric Forte f43fbfba0d [FR] Update utility path computation to use pathlib (#3699) 
* update

* Updated to pathlib

* Linting

* Add string cast where needed

* Add additional string conversion as needed

* Str conversions to support eql lib

* Attack typo

* Typo in test script

* Updated for more pathlib

* Linting

* Update to convert string to path object

* Fix typo
 2024-05-23 17:36:51 -04:00
shashank-elastic f73022b900 Package Manifest changes to add capabilities (#3706) 2024-05-23 15:46:35 -05:00
Samirbous 603f3c313a Update impact_high_freq_file_renames_by_kernel.toml (#3707) 2024-05-23 17:59:58 +01:00
shashank-elastic 63e91c2f12 Back-porting Version Trimming (#3704) 2024-05-23 00:45:10 +05:30
Mika Ayenson 2c3dbfc039 Revert "Back-porting Version Trimming (#3681)" 
This reverts commit 71d2c59b5c.
 2024-05-22 13:51:46 -05:00
shashank-elastic 71d2c59b5c Back-porting Version Trimming (#3681) 2024-05-23 00:11:50 +05:30
Mika Ayenson 58ba0713fe [New Rule] AWS S3 Bucket Expiration Lifecycle Configuration Added (#3700) 
* new rule 'AWS S3 Bucket Expiration Lifecycle Configuration Added'

* added investigation guide

* updated query logic

---------

Co-authored-by: terrancedejesus <terrance.dejesus@elastic.co>
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
 2024-05-21 16:33:17 -05:00
Mika Ayenson 371e24b2ed Revert "[FR] Update Utility Path Computation to use Pathlib (#3659)" 
This reverts commit 23567c1d0c.
 2024-05-21 16:14:45 -05:00
Mika Ayenson ed0038ee1d Revert "[New Rule] AWS S3 Bucket Expiration Lifecycle Configuration Added (#3591)" 
This reverts commit 137b74c3aa.
 2024-05-21 15:53:02 -05:00
Eric Forte 23567c1d0c [FR] Update Utility Path Computation to use Pathlib (#3659) 
* update

* Updated to pathlib

* Linting

* Add string cast where needed

* Add additional string conversion as needed

* Str conversions to support eql lib

* Attack typo

* Typo in test script

* Updated for more pathlib

* Linting

* Update to convert string to path object
 2024-05-21 14:19:20 -04:00
Terrance DeJesus 137b74c3aa [New Rule] AWS S3 Bucket Expiration Lifecycle Configuration Added (#3591) 
* new rule 'AWS S3 Bucket Expiration Lifecycle Configuration Added'

* added investigation guide

* updated query logic
 2024-05-20 16:15:46 -04:00
Justin Ibarra ce21acef9c [Bug] Fix test_os_and_platform_in_query test and rules (#3695) 
Co-authored-by: brokensound77 <brokensound77@users.noreply.github.com>
 2024-05-20 08:43:30 -07:00
Jonhnathan d023ad66b1 [Rule Tuning] Add Initial SentinelOne Compatibility to Windows DRs (#3627) 
* [Rule Tuning] Add Initial SentinelOne Compatibility

* updated definitions.py; updated tags; fixed unit tests

* added prerelease versions for s1 integration; updated build CLI commands to allow prerelease; bumped min-stacks

* updating manifests and integrations

* fixing flake errors

* min_stack

---------

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: terrancedejesus <terrance.dejesus@elastic.co>
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
 2024-05-20 09:50:57 -03:00
Samirbous ec27bf8545 Update credential_access_suspicious_web_browser_sensitive_file_access.toml (#3691) 2024-05-17 21:30:16 -07:00
Eric Forte 707ca32ab1 [FR] Add --force flag to update-lock-versions (#3693) 
* Add --force flag to update-lock-versions

* Add type hinting
 2024-05-17 20:25:08 -04:00
Mika Ayenson 43b3a4b080 [Bug] Support spaces with capital letters (#3689) 2024-05-17 09:04:43 -05:00
Mika Ayenson 79f575b33c [FR] Normalize yml ext to yaml (#3675) 2024-05-15 15:18:39 -05:00
Samirbous f0b226c2b0 [Tuning] Suspicious Microsoft 365 Mail Access by ClientAppId (#3677) 
* Update initial_access_microsoft_365_abnormal_clientappid.toml

* Update initial_access_microsoft_365_abnormal_clientappid.toml

* Update initial_access_microsoft_365_abnormal_clientappid.toml

* Update initial_access_microsoft_365_abnormal_clientappid.toml

---------

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
 2024-05-15 18:11:49 +01:00
Jonhnathan 0eef7f62ff [Rule Tuning] Windows Service Installed via an Unusual Client (#3671) 
* [Rule Tuning] Windows Service Installed via an Unusual Client

* Update privilege_escalation_windows_service_via_unusual_client.toml

* Update rules/windows/privilege_escalation_windows_service_via_unusual_client.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

---------

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
 2024-05-15 10:31:44 -03:00
github-actions[bot] f3585da503 Lock versions for releases: 8.3,8.4,8.5,8.6,8.7,8.8,8.9,8.10,8.11,8.12,8.13,8.14 (#3676) 2024-05-15 17:04:22 +05:30
shashank-elastic 50a8b52cd5 Prepare For Next Elastic Stack 8.15 (#3670) 2024-05-15 00:31:02 +05:30
Mika Ayenson f07a9e6fbc [FR] Add max_signal note, unit test, and rule tuning (#3669) 2024-05-14 11:15:12 -05:00
Terrance DeJesus 608b801088 [New Rule] Building Block Rule - AWS IAM Login Profile Added to User (#3633) 
* new rule 'AWS IAM Login Profile Added to User'

* Update rules_building_block/persistence_aws_iam_login_profile_added_to_user.toml

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>

* Update rules_building_block/persistence_aws_iam_login_profile_added_to_user.toml

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

---------

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>
Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
 2024-05-14 11:10:43 -04:00
Terrance DeJesus 2375297879 [New Rule] Route53 Resolver Query Log Configuration Deleted (#3592) 
* new rule 'Route53 Resolver Query Log Configuration Deleted'

* added investigation guide

* adjusted investigation notes

* Update rules/integrations/aws/defense_evasion_route53_dns_query_resolver_config_deletion.toml

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

---------

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
 2024-05-14 10:24:20 -04:00
Samirbous a1ef8c9fc0 [New] Unusual Execution via Microsoft Common Console File (#3663) 
* [New] Unusual Execution via Microsoft Common Console File

https://www.genians.co.kr/blog/threat_intelligence/facebook

* Update rules/windows/execution_initial_access_via_msc_file.toml

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

* Update rules/windows/execution_initial_access_via_msc_file.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/windows/execution_initial_access_via_msc_file.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update execution_initial_access_via_msc_file.toml

---------

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
 2024-05-14 15:07:26 +01:00
Samirbous 83462a3087 [New] Potential File Download via a Headless Browser (#3660) 
* [New] Potential File Download via a Headless Browser

* Update command_and_control_headless_browser.toml

* Update command_and_control_headless_browser.toml

* Update command_and_control_common_webservices.toml

* Update command_and_control_headless_browser.toml

* Update command_and_control_headless_browser.toml
 2024-05-14 13:55:14 +01:00
Terrance DeJesus d505b95f3c [New Rule] AWS EC2 AMI Shared with Another Account (#3600) 
* new rule 'AWS EC2 AMI Shared with Another Account'

* linted; updated UUID

* added investigation guide

* updated description

* fixed spelling errors

* Update rules/integrations/aws/exfiltration_ec2_ami_shared_with_separate_account.toml

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

* fixed spacing issue

---------

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
 2024-05-14 01:56:26 -04:00
Terrance DeJesus 38e0f13e23 [New Rule] First Occurrence of User Identity Retrieving Credentials from EC2 Instance with an Assumed Role (#3586) 
* new rule 'First Occurrence of User Identity Sending  Requests to EC2 Instance'

* updated description and name

* added investigation guide; adjusted description

* Update rules/integrations/aws/credential_access_aws_getpassword_for_ec2_instance.toml

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>

* Update rules/integrations/aws/credential_access_aws_getpassword_for_ec2_instance.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* Update rules/integrations/aws/credential_access_aws_getpassword_for_ec2_instance.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* Update rules/integrations/aws/credential_access_aws_getpassword_for_ec2_instance.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* updated query logic

* fixed spacing issue

* Update rules/integrations/aws/credential_access_aws_getpassword_for_ec2_instance.toml

* Update rules/integrations/aws/credential_access_aws_getpassword_for_ec2_instance.toml

---------

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
 2024-05-13 23:07:39 -04:00
Mika Ayenson 78837549e8 [FR] Bundle KQL & Kibana libs into base dependencies (#3662) 2024-05-13 14:29:03 -05:00