security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,758 Commits 1 Branch 0 Tags
88f752bf8bceacd5c8a9307c3ce80353af782c30
Commit Graph

1274 Commits

Author SHA1 Message Date
Samirbous 88f752bf8b [New] First Time Seen NewCredentials Lgon Process (#3276) 
* Create privilege_escalation_newcreds_logon_rare_process.toml

* Update privilege_escalation_newcreds_logon_rare_process.toml

* Update privilege_escalation_newcreds_logon_rare_process.toml

* Update privilege_escalation_newcreds_logon_rare_process.toml

* Update rules/windows/privilege_escalation_newcreds_logon_rare_process.toml

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

---------

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
 2023-11-27 18:37:15 +00:00
shashank-elastic 7854081cc0 Setup Guide information for MacOS rules (#3274) 2023-11-22 20:18:22 +05:30
Terrance DeJesus 832ee02aed [New Rule] Adding Detection Logic for Okta User Sessions Started from Different Geolocations (#3279) 
* new rule 'Okta User Sessions Started from Different Geolocations'

* Update rules/integrations/okta/initial_access_okta_user_sessions_started_from_different_geolocations.toml
 2023-11-21 17:32:09 -05:00
Jonhnathan f53f46efd5 [Rule Tuning] Fix Menasec Expired Links (#3271) 2023-11-14 10:18:34 -03:00
shashank-elastic d52546eee5 Enhance Setup Guide information (#3256) 2023-11-03 19:05:29 +05:30
shashank-elastic 5c5d1b214b Setup information for Linux Rules - Set8 (#3200) 2023-10-30 20:58:40 +05:30
Apoorva Joshi a4f9cf4616 [New Rule] Adding Beaconing Rules from Advanced Analytic Beaconing Package (#3128) 
* Adding beaconing rules

* Update rules/integrations/beaconing/command_and_control_beaconing_high_confidence.toml

Co-authored-by: Kirti Sodhi <109447885+sodhikirti07@users.noreply.github.com>

* Update rules/integrations/beaconing/command_and_control_beaconing.toml

Co-authored-by: Kirti Sodhi <109447885+sodhikirti07@users.noreply.github.com>

* Updating min stack version

* added beaconing to manifests and schemas; updated rules

---------

Co-authored-by: Kirti Sodhi <109447885+sodhikirti07@users.noreply.github.com>
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: terrancedejesus <terrance.dejesus@elastic.co>
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
 2023-10-30 10:05:24 -04:00
shashank-elastic a568c56bc1 Move Config Guides for Pre-Built Detection Rules to Setup Field - Windows, MacOS, BBR and Cross Platform (#3157) 2023-10-30 16:53:04 +05:30
Ruben Groenewoud 618a1dbe06 [New Rule] Attempt to Clear Kernel Ring Buffer (#3217) 
* [New Rule] Attempt to Clear Kernel Ring Buffer

* Update defense_evasion_clear_kernel_ring_buffer.toml

---------

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
 2023-10-30 09:37:11 +01:00
Colson Wilhoit 6400bb3237 [Tuning] Access to Stored Browser Credentials (#3066) 
* Exclude FPs

* Update rules/macos/credential_access_access_to_browser_credentials_procargs.toml

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

---------

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
 2023-10-27 15:10:09 -05:00
Terrance DeJesus e7db39a492 [Rule Tuning] Review and Tune Potential Malicious File Downloaded from Google Drive (#3197) 
* added tuning to remove signed binaries and benign processes

* Update rules/cross-platform/command_and_control_google_drive_malicious_file_download.toml

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

* Update rules/cross-platform/command_and_control_google_drive_malicious_file_download.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/cross-platform/command_and_control_google_drive_malicious_file_download.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

---------

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
 2023-10-27 14:12:55 -04:00
Jonhnathan 1133b3a8a9 [Rule Tuning] Windows DR Tuning - 4 (#3214) 
* [Rule Tuning] Windows DR Tuning - 4

* Update credential_access_remote_sam_secretsdump.toml
 2023-10-26 20:58:49 -03:00
Jonhnathan 3d73427e29 [Rule Tuning] Windows DR Tuning - 3 (#3212) 
* [Rule Tuning] Windows DR Tuning - 3

* Update credential_access_lsass_openprocess_api.toml

* Update credential_access_moving_registry_hive_via_smb.toml
 2023-10-26 18:58:59 -03:00
Jonhnathan efa7c428ea [Rule Tuning] Windows DR Tuning - 2 (#3209) 
* [Rule Tuning] Windows DR Tuning - 2

* Update rules/windows/credential_access_kerberoasting_unusual_process.toml

* Update credential_access_kerberoasting_unusual_process.toml

* Update command_and_control_teamviewer_remote_file_copy.toml
 2023-10-26 18:10:31 -03:00
Jonhnathan a5240e4063 [Rule Tuning] Windows DR Tuning - 1 (#3198) 
* [Rule Tuning] Windows DR Tuning - 1

* Update collection_winrar_encryption.toml
 2023-10-26 17:20:32 -03:00
Ruben Groenewoud 1ac3775743 [New Rule] Network Activity Detected via kworker (#3202) 
* [New Rule] Potential curl CVE-2023-38545 Exploitation

* Revert "[New Rule] Potential curl CVE-2023-38545 Exploitation"

This reverts commit 9c04d1b53d3d63678289f43ec0c7b617d26f1ce0.

* [New Rule] Network Activity Detected via kworker

* White space

* Update rules/linux/command_and_control_linux_kworker_netcon.toml

* Update rules/linux/command_and_control_linux_kworker_netcon.toml

* Update rules/linux/command_and_control_linux_kworker_netcon.toml

* Update command_and_control_linux_kworker_netcon.toml

* Update rules/linux/command_and_control_linux_kworker_netcon.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/linux/command_and_control_linux_kworker_netcon.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update command_and_control_linux_kworker_netcon.toml

---------

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
 2023-10-25 15:24:55 +02:00
Terrance DeJesus 3d57209705 [Rule Tuning] Bump Minimum Stacks for AWS and Okta for Version Control (#3221) 
* adding adjusted Okta rules

* adding adjusted AWS rules

* adding adjusted AWS rules
 2023-10-24 12:51:59 -04:00
Ruben Groenewoud 3855dd06d8 [New Rule] Potential Linux Hack Tool Launched (#3125) 
* [New Rule] Potential Linux Hack Tool Launched

* changed description slightly

* Updated description

* Update rules/linux/execution_potential_hack_tool_executed.toml

* Update rules/linux/execution_potential_hack_tool_executed.toml
 2023-10-23 21:35:43 +02:00
Jonhnathan 6fcf26b20e [Promote] Potential Masquerading as Communication Apps (#3181) 
* [Promote] Potential Masquerading as Communication Apps

* Update defense_evasion_masquerading_communication_apps.toml

* Update defense_evasion_masquerading_communication_apps.toml

* Update rules/windows/defense_evasion_masquerading_communication_apps.toml

* Update defense_evasion_masquerading_communication_apps.toml

---------

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
 2023-10-23 14:56:03 -03:00
Jonhnathan a471f6fc60 [Rule Tuning] Potential Privilege Escalation via InstallerFileTakeOver (#3215) 
* [Rule Tuning] Potential Privilege Escalation via InstallerFileTakeOver

* Update privilege_escalation_installertakeover.toml
 2023-10-23 14:34:36 -03:00
Terrance DeJesus 835be9b245 [New Rule] Add Living-off-the-Land (LotL) ProblemChild Rules (#3193) 
* adding new LotL rules

* added endpoint tags; updated technique mapping

* added missing data source tag

* Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_user.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_host.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_host.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_parent_process.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_host.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_user.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_parent_process.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_user.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_parent_process.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_host.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_host.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_host.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_parent_process.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_user.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_event.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_event_high_probability.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_host.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* updated note, references and date

* changed ATT&CK technique to binary proxy execution

---------

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
 2023-10-23 12:23:56 -04:00
Ruben Groenewoud ff268cc6a0 [New Rule] Netcat Listener Established via rlwrap (#3124) 
* [New Rule] Netcat Listener Established via rlwrap

* Update rules/linux/execution_nc_listener_via_rlwrap.toml
 2023-10-23 17:31:26 +02:00
Jonhnathan 18ff85ce84 [Promote] Expired or Revoked Driver Loaded (#3185) 
* [Promote] Expired or Revoked Driver Loaded

* Update privilege_escalation_expired_driver_loaded.toml
 2023-10-23 11:44:37 -03:00
Ruben Groenewoud 020fff3aea [Rule Tuning] Linux Rules (#3092) 
* [Rule Tuning] [WIP] Linux DR

* Update defense_evasion_binary_copied_to_suspicious_directory.toml

* Fixed tag

* Added additional tuning

* unit test fix

* Additional tuning

* tuning

* added max signals

* Added max_signals=1 to brute force rules

* Cross-Platform Tuning

* Small fix

* new_terms conversion

* typo

* new_terms conversion

* Ransomware rule tuning

* performance tuning

* new_terms conversion for auditd_manager

* tune

* Need coffee

* kql/eql stuff

* formatting improvement

* new_terms sudo hijacking conversion

* exclusion

* Deprecations that were added last tuning

* Deprecations that were added last tuning

* Increased max timespan for brute force rules

* version bump

* added domain tag

* Two tunings

* More tuning

* Additional tuning

* updated_date bump

* query optimization

* Tuning

* Readded the exclusions for this one

* Changed int comparison

* Some tunings

* Update persistence_systemd_scheduled_timer_created.toml

* Update rules/linux/privilege_escalation_ld_preload_shared_object_modif.toml

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>

* [New Rule] Potential curl CVE-2023-38545 Exploitation

* Revert "[New Rule] Potential curl CVE-2023-38545 Exploitation"

This reverts commit 9c04d1b53d3d63678289f43ec0c7b617d26f1ce0.

* Update rules/cross-platform/command_and_control_non_standard_ssh_port.toml

* Update rules/linux/command_and_control_cat_network_activity.toml

* Update persistence_message_of_the_day_execution.toml

* Changed max_signals

* Revert "Merge branch 'main' into rule-tuning-ongoing-dr"

This reverts commit 1106b5d2eba1a3529eff325226d6baabfd4b0bf3, reversing
changes made to 5ff510757f25b0cb32e1ef18e9e2c34c8ec325a8.

* Revertable merge

* Update defense_evasion_ld_preload_env_variable_process_injection.toml

* File name change

---------

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
 2023-10-23 16:28:58 +02:00
shashank-elastic 7254c582c5 Move Setup information into setup filed (#3206) 2023-10-23 19:28:18 +05:30
Ruben Groenewoud 9f41c9f35c [New Rule] Upgrade of Non-interactive Shell (#3113) 
* [New Rule] Upgrade of Non-interactive Shell

* Changed numbers to int

* Changed severity

* [New Rule] Pot. Rev Shell via Background Process

* Revert "[New Rule] Pot. Rev Shell via Background Process"

This reverts commit bbb36eae26561dbef4bf57f6c1388cebe7a8b88d.

* Update rules/linux/execution_interpreter_tty_upgrade.toml
 2023-10-18 16:47:07 +02:00
Ruben Groenewoud 6ea11cd9ad [New Rules] cap_setuid/cap_setgid privesc (#3075) 
* [New Rules] cap_setuid/cap_setgid privesc

* Update persistence_setuid_setgid_capability_set.toml

* Update rules/linux/privilege_escalation_suspicious_cap_setuid_python_execution.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update privilege_escalation_suspicious_cap_setuid_python_execution.toml

* Update rules/linux/privilege_escalation_suspicious_cap_setuid_python_execution.toml

* Update privilege_escalation_suspicious_cap_setuid_python_execution.toml

---------

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
 2023-10-18 16:24:01 +02:00
Ruben Groenewoud 4190c3a6a7 [New Rule] Potential SSH-IT SSH Worm Downloaded (#3121) 
* [New Rule]

* Fixed grammar mistake

* Update rules/linux/lateral_movement_ssh_it_worm_download.toml

* Update rules/linux/lateral_movement_ssh_it_worm_download.toml
 2023-10-18 16:08:25 +02:00
Ruben Groenewoud 7d674db11e [New Rule] Pot. Network Scan Executed from Host (#3070) 2023-10-18 15:46:31 +02:00
shashank-elastic 276c0f9cd3 Setup information for Linux Rules - Set7 (#3190) 2023-10-17 19:45:01 +05:30
shashank-elastic 5a98208b53 Setup information for Linux Rules - Set6 (#3189) 2023-10-17 19:33:07 +05:30
shashank-elastic 2a48db0598 Setup information for Linux Rules - Set5 (#3188) 2023-10-17 19:11:20 +05:30
shashank-elastic 25b527c149 Setup information for Linux Rules - Set4 (#3179) 2023-10-17 18:59:31 +05:30
shashank-elastic d2c2987d72 Setup information for Linux Rules - Set3 (#3178) 2023-10-17 18:37:20 +05:30
shashank-elastic 1801a4ee7e Setup information for Linux Rules - Set2 (#3177) 2023-10-17 18:25:55 +05:30
Jonhnathan e4e68c2dd8 [Rule Tuning] Potential Masquerading as System32 DLL (#3184) 
Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
 2023-10-17 08:29:08 -03:00
Jonhnathan 82685e36ce [Rule Tuning] Adjust Lucene queries to use Uppercase operators (#3196) 2023-10-16 17:07:53 -03:00
Apoorva Joshi a5a606e804 [New Rule] Adding DGA Rules from Advanced Analytic DGA Package (#3102) 
* Adding DGA rules

* Adding references

* updated rule tags and queries

* Updating min stack version

* added logic to handle ml jobs

* added code comments for clarity

* removing subbed security docs folder

* added event dataset to queries for endpoint; updated note

* removed event dataset

---------

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: terrancedejesus <terrance.dejesus@elastic.co>
 2023-10-16 15:48:54 -04:00
Samirbous 24b0aa5c63 [Tuning] Adjusted Rules for Anti-Evasion (#3163) 
* Update lateral_movement_executable_tool_transfer_smb.toml

* Update lateral_movement_incoming_wmi.toml

* Update lateral_movement_execution_via_file_shares_sequence.toml

* Update lateral_movement_executable_tool_transfer_smb.toml

* Update lateral_movement_execution_via_file_shares_sequence.toml

* Update lateral_movement_executable_tool_transfer_smb.toml

---------

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
 2023-10-16 17:56:09 +01:00
Jonhnathan f584fb6e31 [Security Content] Adjust Mitre Att&ck Mappings - Windows Rules (#3165) 
* [Security Content] Adjust Mitre Att&ck Mappings - Windows Rules

* Fix dates

* Fix unit test errors

* updated tags and fixed branch conflicts

updated tags and fixed branch conflicts

* description nit

* Reverting unintended changes

* Update initial_access_suspicious_ms_office_child_process.toml

---------

Co-authored-by: imays11 <59296946+imays11@users.noreply.github.com>
 2023-10-15 18:12:20 -03:00
Apoorva Joshi 97ff7fb26e [New Rule] Adding Data Exfiltration Rules from Advanced Analytic DED Package (#3126) 
* Adding DED rules

* adding integration manifests and schemas for DED

* Updating min stack version

* updating manifests and schemas to match main

* added setup note; updated references

---------

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: terrancedejesus <terrance.dejesus@elastic.co>
 2023-10-14 13:23:48 -04:00
shashank-elastic 15718ea09e Improve exsisting setup configurations for Linux (#3141) 2023-10-13 13:39:03 +05:30
Isai 374c9c6257 [New Rule] New GitHub App Installed (#3055) 
* new rule

* Update rules/integrations/github/execution_new_github_app_installed.toml

* Update rules/integrations/github/execution_new_github_app_installed.toml

edits from review

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

* change query from event.module to event.dataset

---------

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
 2023-10-12 20:10:20 -04:00
Terrance DeJesus 1e514afa57 [New Rule] Migrate Lateral Movement Detection Rules (#3175) 
* adding LMD rules

* added setup note; updated references

* adds 2.0.0 lmd manifest and schema

* adjusted min-stack for non-ML rules
 2023-10-12 15:02:19 -04:00
Jonhnathan 3f2a709370 [Rule Tuning] PowerShell Rules Tuning (#3169) 2023-10-11 17:57:32 -03:00
Ruben Groenewoud 89cfdcd440 [New Rule] Potential curl CVE-2023-38545 Exploitation (#3168) 
* [New Rule] Potential curl CVE-2023-38545 Exploitation

* Added setup guide

* Update execution_curl_CVE_2023_38545.toml

* File name change

* File name change

* Update dates

* Update rules/linux/execution_curl_cve_2023_38545_heap_overflow.toml

* Update rules/linux/execution_curl_cve_2023_38545_heap_overflow.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/linux/execution_curl_cve_2023_38545_heap_overflow.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/linux/execution_curl_cve_2023_38545_heap_overflow.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/linux/execution_curl_cve_2023_38545_heap_overflow.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/linux/execution_curl_cve_2023_38545_heap_overflow.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/linux/execution_curl_cve_2023_38545_heap_overflow.toml

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>

* Update rules/linux/execution_curl_cve_2023_38545_heap_overflow.toml

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>

* Update rules/linux/execution_curl_cve_2023_38545_heap_overflow.toml

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>

* Update rules/linux/execution_curl_cve_2023_38545_heap_overflow.toml

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>

---------

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>
 2023-10-11 11:42:25 -03:00
Ruben Groenewoud c2822e175c [Tuning] Windows Execution Rule Tuning for UEBA (#3107) 
* Update defense_evasion_execution_msbuild_started_by_script.toml

* Mostly updated Execution tags, also new_terms conv

* removed index

* Removed index

* WMIPrvSE tuning

* Additional tuning

* Tuning & changes

* Additional tuning

* Applied unit test optimization

* Addressed feedback

* Update rules/windows/execution_command_shell_started_by_svchost.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* caseless unit testing fix

* fixed caseless executable unit test

* unit testing fix

* Update rules/windows/execution_suspicious_powershell_imgload.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* Update execution_ms_office_written_file.toml

* Update rules/windows/defense_evasion_execution_msbuild_started_by_script.toml

* Update rules/windows/defense_evasion_execution_msbuild_started_unusal_process.toml

* Added user ids to new terms

* Update rules/windows/execution_suspicious_powershell_imgload.toml

Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>

* Update rules_building_block/execution_unsigned_service_executable.toml

Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>

* Update execution_unsigned_service_executable.toml

---------

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>
 2023-10-11 10:15:29 +02:00
Ruben Groenewoud 4cdf52129a [Tuning] Windows Discovery Rule Tuning for UEBA (#3097) 
* [Tuning] Win DR Tuning for UEBA

* Need to get used to Windows formatting

* Added additional content

* Updated min stack

* Added additional tuning

* Fixed unit testing for KQL optimization

* Update rules_building_block/discovery_internet_capabilities.toml

* Additional tuning

* Kuery optimization

* Additional tuning

* Additional tuning

* Additional tuning

* Additional tuning

* Unit testing optimization fix

* optimization

* tuning

* Optimization

* Update rules/windows/discovery_privileged_localgroup_membership.toml

* Added feedback

* Update rules/windows/discovery_privileged_localgroup_membership.toml

Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>

* Update rules/windows/discovery_remote_system_discovery_commands_windows.toml

Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>

* Update rules/windows/discovery_system_service_discovery.toml

Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>

* added host.id as additional new_terms field

* Reworked a lot.

* kibana.alert.rule.rule_id to non-ecs-schema.json

* Fixed index by adding a dot

* fixed typo

* Added host.os.type:windows for signals

* Added additional tag

* Added Higher-Order Rule tag

* Stripped down signal rules down to two

* revert

* Update rules/windows/discovery_admin_recon.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* Update rules/windows/discovery_enumerating_domain_trusts_via_nltest.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* Update rules_building_block/discovery_generic_registry_query.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* Update rules_building_block/discovery_system_time_discovery.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* Update rules/windows/discovery_privileged_localgroup_membership.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* Update discovery_generic_registry_query.toml

* Readded exclusions

* Added trailing wildcards for KQL

* Update discovery_privileged_localgroup_membership.toml

* Update rules_building_block/discovery_signal_unusual_user_host.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/windows/discovery_signal_unusual_discovery_signal_proc_cmdline.toml

Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>

* Formatting fix

---------

Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
 2023-10-11 09:43:26 +02:00
Ruben Groenewoud a46797b987 [New Rule] Pot. Rev. Shell via Background Process (#3114) 2023-10-06 23:14:39 +02:00
Isai ef8f5620e1 [New Rule] New GitHub Owner Added (#3090) 
* [New Rule] New GitHub Owner Added

new rule

* name change

* Apply suggestions from code review

Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>

---------

Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>
 2023-10-06 15:57:26 -04:00