security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
2,648 Commits 1 Branch 0 Tags
8dfa5da3bf41eec3acec83beb6ee15498cd6fbb3
Commit Graph

446 Commits

Author SHA1 Message Date
Ruben Groenewoud 8dfa5da3bf [New Rules] Potential Port/Subnet Scanning Activity from Compromised Host (#4509) 
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
 2025-03-06 16:57:33 +01:00
Ruben Groenewoud fe06843636 [New Rule] Unusual Process Spawned from Web Server Parent (#4513) 2025-03-06 16:46:12 +01:00
Ruben Groenewoud 7ce6aaf566 [New Rule] Unusual Command Execution from Web Server Parent (#4512) 
* [New Rule] Unusual Command Execution from Web Server Parent

* ++
 2025-03-06 16:25:38 +01:00
Ruben Groenewoud b9e8115c2f [New Rule] Python Site or User Customize File Creation (#4500) 
* [New Rule] Python Site or User Customize File Creation

* Update persistence_site_and_user_customize_file_creation.toml

* Update persistence_site_and_user_customize_file_creation.toml

---------

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
 2025-03-03 15:30:33 +01:00
Ruben Groenewoud d948279af6 [New Rule] Python Path File (pth) Creation (#4499) 
* [New Rule] Python Path File (pth) Creation

* ++

* Update persistence_pth_file_creation.toml

* Update persistence_pth_file_creation.toml

* Update persistence_pth_file_creation.toml

---------

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
 2025-03-03 15:20:00 +01:00
Ruben Groenewoud f70eafb8e7 [New Rule] Successful SSH Authentication from Unusual User (#4481) 
* [New Rule] Succesful SSH Authentication from Unusual User

* Rename initial_access_first_time_public_key_authentication.toml to initial_access_successful_ssh_authentication_by_unusual_user.toml

* Update rules/linux/initial_access_successful_ssh_authentication_by_unusual_user.toml

* Update initial_access_successful_ssh_authentication_by_unusual_user.toml

* Update rules/linux/initial_access_successful_ssh_authentication_by_unusual_user.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

---------

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
 2025-03-03 11:55:27 +01:00
Ruben Groenewoud 06002cd9ac [New Rule] Kill Command Execution (#4485) 
* [New Rule] Kill Command Execution

* Update defense_evasion_kill_command_executed.toml

---------

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
 2025-02-28 11:26:50 +01:00
Ruben Groenewoud 9bb3b9f204 [New Rule] Unusual File Transfer Utility Launched (#4487) 
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
 2025-02-28 11:15:21 +01:00
Ruben Groenewoud 029fd45bb1 [New Rule] Base64 Decoded Payload Piped to Interpreter (#4488) 
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
 2025-02-28 11:01:52 +01:00
Ruben Groenewoud a2a120858f [New Rule] Unusual Base64 Encoding/Decoding Activity (#4486) 
* [New Rule] Unusual Base64 Encoding/Decoding Activity

* Update defense_evasion_base64_decoding_activity.toml

---------

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
 2025-02-28 10:09:48 +01:00
Ruben Groenewoud 8c250db3c3 [New Rule] Successful SSH Authentication from Unusual IP-Address (#4482) 
* [New Rule] Successful SSH Authentication from Unusual IP-Address

* Apply suggestions from code review

* Update rules/linux/initial_access_successful_ssh_authentication_by_unusual_ip.toml

---------

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
 2025-02-28 09:55:35 +01:00
Ruben Groenewoud 89f79c6e4f [New Rule] Successful SSH Authentication from Unusual SSH Public Key (#4478) 
* [New Rule] First Time Public Key Authentication

* Update initial_access_first_time_public_key_authentication.toml

* Update initial_access_first_time_public_key_authentication.toml

---------

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
 2025-02-28 09:44:51 +01:00
Ruben Groenewoud fe48309daf [New Rule] Linux User Account Credential Modification (#4484) 
* [New Rule] Linux User Account Credential Modification

* Update rules/linux/persistence_user_credential_modification_via_echo.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

---------

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
 2025-02-27 16:42:11 +01:00
Ruben Groenewoud 342e18075b [New Rule] SSH Authorized Keys File Deletion (#4483) 
* [New Rule] Authorized Keys File Deletion

* Apply suggestions from code review

---------

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
 2025-02-27 16:29:51 +01:00
Ruben Groenewoud a614da5900 [New Rule] Remote File Creation in World Writeable Directory (#4475) 
* [New Rule] Remote File Creation in World Writeable Directory

* Update rules/linux/lateral_movement_remote_file_creation_world_writeable_dir.toml

* Update lateral_movement_remote_file_creation_world_writeable_dir.toml

* Update rules/linux/lateral_movement_remote_file_creation_world_writeable_dir.toml
 2025-02-26 10:11:55 +01:00
Ruben Groenewoud 59473f09ac [New Rule] Potential Malware-Driven SSH Brute Force Attempt (#4474) 
* [New Rule] Potential Malware-Driven SSH Brute Force Attempt

* Update impact_potential_bruteforce_malware_infection.toml

* Update rules/linux/impact_potential_bruteforce_malware_infection.toml

* Update impact_potential_bruteforce_malware_infection.toml
 2025-02-26 10:00:31 +01:00
Ruben Groenewoud 758e155231 [New Rule] High Number of Egress Network Connections from Unusual Executable (#4473) 
* [New Rule] High Number of Egress Network Connections from Unusual Executable

* Update command_and_control_frequent_egress_netcon_from_sus_executable.toml

* Update rules/linux/command_and_control_frequent_egress_netcon_from_sus_executable.toml

* Update command_and_control_frequent_egress_netcon_from_sus_executable.toml

* Update command_and_control_frequent_egress_netcon_from_sus_executable.toml

---------

Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com>
 2025-02-26 09:43:54 +01:00
Ruben Groenewoud 8a221325e9 [New Rule] Unusual Remote File Creation (#4476) 
* [New Rule] Unusual Remote File Creation

* Description update

* ++

* ++

* Update rules/linux/lateral_movement_unusual_remote_file_creation.toml

---------

Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com>
 2025-02-26 09:30:47 +01:00
Jonhnathan 5155f47b86 [Rule Tuning] Event Aggregation - Fix event.action & event.type conditions (#4445) 
* [Rule Tuning] Event Aggregation - Fix `event.action` & `event.type` conditions

* .

---------

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
 2025-02-07 18:42:28 -03:00
Jonhnathan 0268daa17d [Rule Tuning] Tighten Up Elastic Defend Indexes - Linux (#4446) 2025-02-05 15:25:45 -03:00
shashank-elastic 818467f132 Replace master doc URLs with current (#4439) 2025-02-03 21:27:50 +05:30
Ruben Groenewoud 8d29a1f7d5 [New Rule] Process Backgrounded by Unusual Parent (#4431) 
* [New Rule] Process Backgrounded by Unusual Parent

* Update execution_process_backgrounded_by_unusual_parent.toml

* Update execution_process_backgrounded_by_unusual_parent.toml
 2025-02-03 14:17:15 +01:00
Ruben Groenewoud 14c648598e [Rule Tuning] Linux DR Tuning - Part 6 (#4423) 
* [Rule Tuning] Linux DR Tuning - Part 6

* Update privilege_escalation_ld_preload_shared_object_modif.toml

* Update privilege_escalation_ld_preload_shared_object_modif.toml
 2025-02-03 14:05:26 +01:00
Ruben Groenewoud 6b84542093 [Rule Tuning] Linux DR Tuning - Part 5 (#4422) 
* [Rule Tuning] Linux DR Tuning - Part 5

* Update rules/linux/persistence_xdg_autostart_netcon.toml
 2025-02-03 13:53:53 +01:00
Ruben Groenewoud 53b9b53467 [Rule Tuning] Linux DR Tuning - Part 4 (#4421) 
* [Rule Tuning] Linux DR Tuning - Part 4

* [Rule Tuning] Linux DR Tuning - Part 4

* Update persistence_etc_file_creation.toml
 2025-02-03 13:31:00 +01:00
Ruben Groenewoud 1c98a0d64c [Rule Tuning] Linux DR Tuning - Part 3 (#4420) 
* Initial set

* [Rule Tuning] Linux DR - Part 3

* ++

* Update execution_unusual_path_invocation_from_command_line.toml

* Update execution_unusual_path_invocation_from_command_line.toml
 2025-02-03 13:17:00 +01:00
Ruben Groenewoud b642c55680 [Rule Tuning] Potential OpenSSH Backdoor Logging Activity (#4429) 2025-01-31 15:33:21 +01:00
Ruben Groenewoud 18dd9cb04a [New Rule] Suspicious Usage of bpf_probe_write_user Helper (#4426) 
* [New Rule] Suspicious Usage of bpf_probe_write_user Helper

* Update persistence_bpf_probe_write_user.toml
 2025-01-29 11:46:40 +01:00
Ruben Groenewoud 52d33c12b8 [Rule Tuning] Linux DR Tuning - Part 2 (#4417) 2025-01-29 10:34:13 +01:00
Ruben Groenewoud fed7b216d5 [Rule Tuning] Linux DR Tuning - Part 1 (#4416) 2025-01-28 14:43:00 +01:00
Samirbous 4e6625ae40 [Tuning] Unusual Instance Metadata Service (IMDS) API Request (#4418) 
* Update credential_access_unusual_instance_metadata_service_api_request.toml

* Update credential_access_unusual_instance_metadata_service_api_request.toml

* Update credential_access_unusual_instance_metadata_service_api_request.toml

* Update rules/linux/credential_access_unusual_instance_metadata_service_api_request.toml

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

---------

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
 2025-01-24 17:23:32 +00:00
shashank-elastic d6f1a75f11 Fix S1 minstack version (#4415) 2025-01-23 17:59:40 +05:30
Mika Ayenson 7c6c77932c [FR] Add Remaining Guides (#4412) 2025-01-22 14:43:30 -06:00
Mika Ayenson fe8c81d762 [FR] Generate investigation guides (#4358) 2025-01-22 11:17:38 -06:00
Ruben Groenewoud b708e09f2b [New Rule] Unusual D-Bus Daemon Child Process (#4397) 2025-01-21 12:24:06 +01:00
Ruben Groenewoud cf183579b4 [New Rule] Polkit Version Discovery (#4378) 2025-01-20 15:58:27 +01:00
Ruben Groenewoud 2e6ec33141 [New Rule] Polkit Policy Creation (#4379) 
* [New Rule] Polkit Policy Creation

* Update persistence_polkit_policy_creation.toml
 2025-01-20 15:47:18 +01:00
Ruben Groenewoud 3e655abfef [New Rule] Unusual Pkexec Execution (#4380) 
* [New Rule] Unusual Pkexec Execution

* Update execution_unusual_pkexec_execution.toml
 2025-01-20 15:35:29 +01:00
Ruben Groenewoud 4294ed8981 [New Rule] NetworkManager Dispatcher Script Creation (#4381) 
* [New Rule] NetworkManager Dispatcher Script Creation

* ++
 2025-01-20 15:18:55 +01:00
Ruben Groenewoud 89c113560b [New Rule] D-Bus Service Created (#4382) 2025-01-20 15:07:06 +01:00
Ruben Groenewoud 6cc5184f70 [New Rule] Manual Dracut Execution (#4383) 2025-01-20 14:41:44 +01:00
Ruben Groenewoud abd199a9bc [New Rule] Dracut Module Creation (#4384) 2025-01-20 14:31:16 +01:00
Ruben Groenewoud 2bb46899ae [New Rule] OpenSSL Password Hash Generation (#4385) 
* [New Rule] OpenSSL Password Hash Generation

* Update rules/linux/persistence_openssl_passwd_hash_generation.toml
 2025-01-20 14:14:12 +01:00
Ruben Groenewoud 1fce3fd22a [New Rule] Boot File Copy (#4386) 
* [New Rule] Boot File Copy

* Update persistence_boot_file_copy.toml

* Update rules/linux/persistence_boot_file_copy.toml
 2025-01-20 14:04:02 +01:00
Ruben Groenewoud b633987e5b [New Rule] Initramfs Unpacking via unmkinitramfs (#4387) 
* [New Rule] Initramfs Unpacking via unmkinitramfs

* Update rules/linux/persistence_unpack_initramfs_via_unmkinitramfs.toml
 2025-01-20 13:43:54 +01:00
Ruben Groenewoud 971049957e [New Rule] Initramfs Extraction via CPIO (#4389) 
* [New Rule] Initramfs Extraction via CPIO

* Update rules/linux/persistence_extract_initramfs_via_cpio.toml
 2025-01-20 13:32:48 +01:00
Ruben Groenewoud 01eda44298 [Rule Tuning] Linux Persistence Rules (#4393) 
* [Rule Tuning] Linux Persistence Rules

* Update persistence_suspicious_file_modifications.toml

* Update rules/linux/persistence_potential_persistence_script_executable_bit_set.toml
 2025-01-20 09:51:49 +01:00
Ruben Groenewoud cf929554a6 [New Rule] Systemd Shell Execution During Boot (#4392) 2025-01-20 09:33:46 +01:00
Ruben Groenewoud f029e9a171 [New Rule] GRUB Configuration Generation through Built-in Utilities (#4391) 2025-01-17 18:00:01 +01:00
Ruben Groenewoud 0ef7f3a83e [New Rule] GRUB Configuration File Creation (#4390) 
* [New Rule] Grub Configuration File Creation

* Update persistence_grub_configuration_creation.toml
 2025-01-17 17:49:41 +01:00