security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,051 Commits 1 Branch 0 Tags
a1bdf2b5647b4e53b2adbf7b8a9ca1f95d602045
Commit Graph

1051 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Jonhnathan a1bdf2b564 [Security Content] 8.3 - Add Investigation Guides (#1937) 
* 8.3 - Add Investigation Guides

* Apply suggestions

* Apply the refactor

* Apply suggestions from Samir

* .

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
 2022-05-19 13:23:35 -03:00
Mika Ayenson 92640f517a [Rule tuning] check for anything found in the emondClient directory (#1977) 
* check for anything found in the emondClient directory and add reference
 2022-05-18 12:33:23 -04:00
Jonhnathan 817b97f428 [Security Content] Refactor Existing Investigation Guides (#1959) 
* Initial commit

* Update Investigation guides - security-docs review

* Update command_and_control_dns_tunneling_nslookup.toml

* Update defense_evasion_amsienable_key_mod.toml

* Apply security-docs review

* Remove dot

* Update rules/windows/command_and_control_rdp_tunnel_plink.toml

Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com>

* Apply changes from review

* Apply the suggestion

Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com>
 2022-05-18 12:59:39 -03:00
Colson Wilhoit d12f45c6ba [Rule Tuning] Update Rule Name: Suspicious Network Connection Attempt Sequence by Root (#1983) 
* [Rule Tuning] Update Rule Name

* Update rules/linux/command_and_control_connection_attempt_by_non_ssh_root_session.toml
 2022-05-17 17:41:05 -05:00
Terrance DeJesus c89f423961 [New Rule] Suspicious Outbound Network Connect Sequence by Root (#1975) 
* adding initial rule

* adjusted UUID

* removed event.ingested as query is a sequence

* changed file name to match mitre ATT&CK tactic

* Update rules/linux/command_and_control_connection_attempt_by_non_ssh_root_session.toml

* Update rules/linux/command_and_control_connection_attempt_by_non_ssh_root_session.toml

* Update rules/linux/command_and_control_connection_attempt_by_non_ssh_root_session.toml

* Update rules/linux/command_and_control_connection_attempt_by_non_ssh_root_session.toml

* Update rules/linux/command_and_control_connection_attempt_by_non_ssh_root_session.toml

* Update rules/linux/command_and_control_connection_attempt_by_non_ssh_root_session.toml

* TOML linted

* Update command_and_control_connection_attempt_by_non_ssh_root_session.toml

Just edited a couple grammar things. Looks good

* Update rules/linux/command_and_control_connection_attempt_by_non_ssh_root_session.toml

* Update rules/linux/command_and_control_connection_attempt_by_non_ssh_root_session.toml

* Update rules/linux/command_and_control_connection_attempt_by_non_ssh_root_session.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* Update rules/linux/command_and_control_connection_attempt_by_non_ssh_root_session.toml

* added additional tactic for privilege escalation and linted

* formatted query to be more readable

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
 2022-05-16 16:22:33 -05:00
Jonhnathan 27e6632ecd Update command_and_control_common_webservices.toml (#1970) 2022-05-16 14:04:26 -03:00
Terrance DeJesus 1704924f7b [New Rule] Abnormal Process ID File Creation (#1964) 
* adding rule detection

* changed Rule ID

* Update rules/linux/execution_abnormal_process_id_file_created.toml

Adding reboot extension as well.

Reference: https://exatrack.com/public/Tricephalic_Hellkeeper.pdf

* Update rules/linux/execution_abnormal_process_id_file_created.toml

Adding reboot to description.

Reference: https://exatrack.com/public/Tricephalic_Hellkeeper.pdf

* Update rules/linux/execution_abnormal_process_id_file_created.toml

Added additional reference to similar threat.

* Update rules/linux/execution_abnormal_process_id_file_created.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update rules/linux/execution_abnormal_process_id_file_created.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* added rule for a process starting where the executable's name represented a PID file

* Adjusted user.id value from integer to string

* Added simple investigation notes and osquery coverage

* TOML linting

* Updated date to reflect recent changes

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
 2022-05-12 10:38:27 -04:00
Samirbous 19ff825a91 [New rule] Remote Computer Account DnsHostName Update (#1962) 
* [New rule] Remote Computer Account DnsHostName Update

Identifies remote update to a computer account DnsHostName attribute, if the new value is set a valid domain controller DNS hostname and the subject computer name is not a domain controller then it's high likely a preparation step to exploit CVE-2022-26923 in an attempt to elevate privileges from a standard domain user to domain admin privileges :

* added MS ref url

* Update rules/windows/privilege_escalation_suspicious_dnshostname_update.toml

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>

* Update rules/windows/privilege_escalation_suspicious_dnshostname_update.toml

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>
 2022-05-11 19:40:34 +02:00
Terrance DeJesus 5f447a63a2 [New Rule] Executable Launched from Shared Memory Directory (#1961) 
* new rule to check for executables launched from shared memory directory

* added references and false positive instances

* Update rules/linux/execution_shared_memory_executable.toml

* Update rules/linux/execution_shared_memory_executable.toml

* Update rules/linux/execution_shared_memory_executable.toml

* adjusted process to account for var run and lock directories

* TOML lint and query formatting

* TOML lint and query formatting

* Update rules/linux/execution_process_started_in_shared_memory_directory.toml

* Update rules/linux/execution_process_started_in_shared_memory_directory.toml

* Update rules/linux/execution_process_started_in_shared_memory_directory.toml

* Update rules/linux/execution_process_started_in_shared_memory_directory.toml

* added BPFDoor tag to be threat specific

* TOML linting and adjusted risk because of root requirement

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
 2022-05-11 12:18:55 -04:00
Justin Ibarra c031bb501d [Rule tuning] SSH Authorized Keys File Modification (#1955) 2022-05-09 07:50:27 -08:00
Samirbous 03836d45fa [New Rule] Potential Local NTLM Relay via HTTP (#1947) 
* [New Rule] Potential Local NTLM Relay via HTTP

Detect attempt to elevate privileges via coercing a privileged service to connect to a local rogue HTTP endpoint, leading to NTLM relay, example of logs while testing https://github.com/med0x2e/NTLMRelay2Self (step 5):

* Update credential_access_relay_ntlm_auth_via_http_spoolss.toml

* Update credential_access_relay_ntlm_auth_via_http_spoolss.toml

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
 2022-05-06 21:07:27 +02:00
Terrance DeJesus e9f5585a9f [Rule Tuning] Update Rule Content Changes from Security Docs Team (#1945) 
* updated content to reflect changes from Security Docs team

* Update rules/linux/execution_flock_binary.toml

* Update rules/linux/execution_expect_binary.toml

* TOML linting

* added escape for crdential_access_spn_attribute_modified.toml
 2022-05-06 13:21:12 -04:00
Justin Ibarra 8168551c59 Manually reconciled versions from forked rule package generation bug (#1950) 2022-05-04 10:04:10 -08:00
Justin Ibarra 22679e16d2 Add delta command to determine changes to endpoint rules between tags (#1943) 
* update git tag loader to be compatible with lock validation
* add diff command
* default to query for missing rules
 2022-05-03 12:30:11 -08:00
Mika Ayenson 6219fc06b9 Move etc under detection_rules (#1885) 
* Move etc directory under detection_rules
* Prepend original `etc` path with `detection_rules`
* Update docstrings in util and CODEOWNERS
* Add resiliency to tags to account for the old directory structure
* Bug fix: remove unused param caused by commit 6ed1a39efe

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
 2022-05-02 10:11:21 -04:00
Samirbous 3f047b987e [New Rule] Service Creation via Local Kerberos Authentication (#1941) 
* [New Rule] Suspicious Service Creation via Local Kerberos Relay over LDAP

This rule will catch also the suspicious service that was created leveraging the imported kerberos ticket https://gist.github.com/tyranid/c24cfd1bd141d14d4925043ee7e03c82 which makes triage easier :

DATA :

```
 "sequences" : [
      {
        "join_keys" : [
          "6a3c3ef2-208f-4d6f-90ee-b34f4e3fd160",
          "0xefac5f"
        ],
        "events" : [
          {
            "_index" : ".ds-logs-system.security-default-2022.04.12-000003",
            "_id" : "XAy1YoABQhClK0XGpqaL",
            "_source" : {
              "agent" : {
                "name" : "02694w-win10",
                "id" : "77a829ec-a564-44d5-9bc4-61eeefbf783a",
                "type" : "filebeat",
                "ephemeral_id" : "6c751494-97a3-46aa-bab2-5baf01d17d04",
                "version" : "8.0.0"
              },
              "process" : {
                "name" : "-",
                "pid" : 0,
                "executable" : "-"
              },
              "winlog" : {
                "computer_name" : "02694w-win10.threebeesco.com",
                "process" : {
                  "pid" : 688,
                  "thread" : {
                    "id" : 5160
                  }
                },
                "keywords" : [
                  "Audit Success"
                ],
                "logon" : {
                  "id" : "0x0",
                  "type" : "Network"
                },
                "channel" : "Security",
                "event_data" : {
                  "LogonGuid" : "{82d3503b-9dac-ab6d-b045-8877b5aab051}",
                  "TargetOutboundDomainName" : "-",
                  "VirtualAccount" : "%%1843",
                  "LogonType" : "3",
                  "TransmittedServices" : "-",
                  "SubjectLogonId" : "0x0",
                  "LmPackageName" : "-",
                  "TargetOutboundUserName" : "-",
                  "KeyLength" : "0",
                  "RestrictedAdminMode" : "-",
                  "TargetLogonId" : "0xefac5f",
                  "SubjectUserName" : "-",
                  "TargetLinkedLogonId" : "0x0",
                  "ElevatedToken" : "%%1842",
                  "SubjectDomainName" : "-",
                  "ImpersonationLevel" : "%%1833",
                  "TargetUserName" : "Administrator",
                  "TargetDomainName" : "THREEBEESCO.COM",
                  "LogonProcessName" : "Kerberos",
                  "SubjectUserSid" : "S-1-0-0",
                  "TargetUserSid" : "S-1-5-21-308926384-506822093-3341789130-500",
                  "AuthenticationPackageName" : "Kerberos"
                },
                "opcode" : "Info",
                "version" : 2,
                "record_id" : "59330",
                "task" : "Logon",
                "event_id" : "4624",
                "provider_guid" : "{54849625-5478-4994-a5ba-3e3b0328c30d}",
                "activity_id" : "{e22af019-58dd-0002-43f0-2ae2dd58d801}",
                "api" : "wineventlog",
                "provider_name" : "Microsoft-Windows-Security-Auditing"
              },
              "log" : {
                "level" : "information"
              },
              "elastic_agent" : {
                "id" : "77a829ec-a564-44d5-9bc4-61eeefbf783a",
                "version" : "8.0.0",
                "snapshot" : false
              },
              "source" : {
                "port" : 50494,
                "ip" : "127.0.0.1",
                "domain" : "-"
              },
              "message" : """An account was successfully logged on.

Subject:
	Security ID:		S-1-0-0
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		S-1-5-21-308926384-506822093-3341789130-500
	Account Name:		Administrator
	Account Domain:		THREEBEESCO.COM
	Logon ID:		0xEFAC5F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{82d3503b-9dac-ab6d-b045-8877b5aab051}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	127.0.0.1
	Source Port:		50494

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.""",
              "input" : {
                "type" : "winlog"
              },
              "@timestamp" : "2022-04-25T21:09:04.559Z",
              "ecs" : {
                "version" : "1.12.0"
              },
              "related" : {
                "ip" : [
                  "127.0.0.1"
                ],
                "user" : [
                  "Administrator"
                ]
              },
              "data_stream" : {
                "namespace" : "default",
                "type" : "logs",
                "dataset" : "system.security"
              },
              "host" : {
                "hostname" : "02694w-win10",
                "os" : {
                  "build" : "18363.815",
                  "kernel" : "10.0.18362.815 (WinBuild.160101.0800)",
                  "name" : "Windows 10 Enterprise",
                  "family" : "windows",
                  "type" : "windows",
                  "version" : "10.0",
                  "platform" : "windows"
                },
                "ip" : [
                  "fe80::7587:a5c1:5a7b:68f6",
                  "172.16.66.25"
                ],
                "name" : "02694w-win10.threebeesco.com",
                "id" : "6a3c3ef2-208f-4d6f-90ee-b34f4e3fd160",
                "mac" : [
                  "00:50:56:03:c6:93"
                ],
                "architecture" : "x86_64"
              },
              "event" : {
                "agent_id_status" : "verified",
                "ingested" : "2022-04-25T21:51:53Z",
                "code" : "4624",
                "provider" : "Microsoft-Windows-Security-Auditing",
                "kind" : "event",
                "created" : "2022-04-25T21:51:15.561Z",
                "action" : "logged-in",
                "category" : [
                  "authentication"
                ],
                "type" : [
                  "start"
                ],
                "dataset" : "system.security",
                "outcome" : "success"
              },
              "user" : {
                "domain" : "THREEBEESCO.COM",
                "name" : "Administrator",
                "id" : "S-1-5-21-308926384-506822093-3341789130-500"
              }
            }
          },
          {
            "_index" : ".ds-logs-system.security-default-2022.04.12-000003",
            "_id" : "Xwy1YoABQhClK0XGpqaL",
            "_source" : {
              "agent" : {
                "name" : "02694w-win10",
                "id" : "77a829ec-a564-44d5-9bc4-61eeefbf783a",
                "ephemeral_id" : "6c751494-97a3-46aa-bab2-5baf01d17d04",
                "type" : "filebeat",
                "version" : "8.0.0"
              },
              "winlog" : {
                "computer_name" : "02694w-win10.threebeesco.com",
                "process" : {
                  "pid" : 688,
                  "thread" : {
                    "id" : 5160
                  }
                },
                "keywords" : [
                  "Audit Success"
                ],
                "logon" : {
                  "id" : "0xefac5f"
                },
                "channel" : "Security",
                "event_data" : {
                  "ServiceAccount" : "LocalSystem",
                  "SubjectUserName" : "Administrator",
                  "ServiceStartType" : "3",
                  "ServiceName" : "KrbSCM",
                  "ServiceType" : "0x10",
                  "SubjectDomainName" : "3B",
                  "SubjectLogonId" : "0xefac5f",
                  "SubjectUserSid" : "S-1-5-21-308926384-506822093-3341789130-500",
                  "ServiceFileName" : "\"C:\\Users\\lgreen\\Downloads\\KrbRelayUp.exe\" system 1"
                },
                "opcode" : "Info",
                "record_id" : "59331",
                "task" : "Security System Extension",
                "event_id" : "4697",
                "provider_guid" : "{54849625-5478-4994-a5ba-3e3b0328c30d}",
                "activity_id" : "{e22af019-58dd-0002-43f0-2ae2dd58d801}",
                "api" : "wineventlog",
                "provider_name" : "Microsoft-Windows-Security-Auditing"
              },
              "log" : {
                "level" : "information"
              },
              "elastic_agent" : {
                "id" : "77a829ec-a564-44d5-9bc4-61eeefbf783a",
                "version" : "8.0.0",
                "snapshot" : false
              },
              "message" : """A service was installed in the system.

Subject:
	Security ID:		S-1-5-21-308926384-506822093-3341789130-500
	Account Name:		Administrator
	Account Domain:		3B
	Logon ID:		0xEFAC5F

Service Information:
	Service Name: 		KrbSCM
	Service File Name:	"C:\Users\lgreen\Downloads\KrbRelayUp.exe" system 1

	Service Type: 		0x10
	Service Start Type:	3
	Service Account: 		LocalSystem""",
              "input" : {
                "type" : "winlog"
              },
              "@timestamp" : "2022-04-25T21:09:04.561Z",
              "ecs" : {
                "version" : "1.12.0"
              },
              "related" : {
                "user" : [
                  "Administrator"
                ]
              },
              "data_stream" : {
                "namespace" : "default",
                "type" : "logs",
                "dataset" : "system.security"
              },
              "service" : {
                "name" : "KrbSCM",
                "type" : "Win32 Own Process"
              },
              "host" : {
                "hostname" : "02694w-win10",
                "os" : {
                  "build" : "18363.815",
                  "kernel" : "10.0.18362.815 (WinBuild.160101.0800)",
                  "name" : "Windows 10 Enterprise",
                  "family" : "windows",
                  "type" : "windows",
                  "version" : "10.0",
                  "platform" : "windows"
                },
                "ip" : [
                  "fe80::7587:a5c1:5a7b:68f6",
                  "172.16.66.25"
                ],
                "name" : "02694w-win10.threebeesco.com",
                "id" : "6a3c3ef2-208f-4d6f-90ee-b34f4e3fd160",
                "mac" : [
                  "00:50:56:03:c6:93"
                ],
                "architecture" : "x86_64"
              },
              "event" : {
                "agent_id_status" : "verified",
                "ingested" : "2022-04-25T21:51:53Z",
                "code" : "4697",
                "provider" : "Microsoft-Windows-Security-Auditing",
                "created" : "2022-04-25T21:51:15.561Z",
                "kind" : "event",
                "action" : "service-installed",
                "category" : [
                  "iam",
                  "configuration"
                ],
                "type" : [
                  "admin",
                  "change"
                ],
                "dataset" : "system.security",
                "outcome" : "success"
              },
              "user" : {
                "domain" : "3B",
                "name" : "Administrator",
                "id" : "S-1-5-21-308926384-506822093-3341789130-500"
              }
            }
          }
        ]
````

* Update privilege_escalation_krbrelayup_service_creation.toml

* removed duplicate SubjectLogonId from non ecs fields list
 2022-04-29 14:36:28 +02:00
Pete Hampton 34655374c1 [New Rule] AWS Redshift Cluster Creation (#1921) 
* Add rule for Redshift data warehouse creation.

* Add fp block.

* Add AWS integration metadata.

* Add timestamp override.

* Add note.

* Update rules/integrations/aws/persistence_redshift_instance_creation.toml

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>

* Update rules/integrations/aws/persistence_redshift_instance_creation.toml

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>

* Update description for redshift instance creation.

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>
 2022-04-28 14:43:26 -04:00
Jonhnathan f050b0ce0c [Rule Tuning] Microsoft 365 Inbox Forwarding Rule Created (#1939) 
* [Rule Tuning] Microsoft 365 Inbox Forwarding Rule Created

* Update non-ecs-schema.json

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
 2022-04-27 09:09:25 -03:00
shashank-elastic 88f71233c9 Detection of suspicious crontab creation or modification (#1938) 
* Detection of suspicious crontab creation or modification

* Update rules/macos/persistence_crontab_creation.toml

* Update rules/macos/persistence_crontab_creation.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update rules/macos/persistence_crontab_creation.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update rules/macos/persistence_crontab_creation.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
 2022-04-27 12:08:32 +05:30
Justin Ibarra c803160e4f Validate version lock and deprecation files on load and save (#1884) 
* Validate version lock and deprecation files on load and save
* add missing types for previous lock entries
* bump marshmallow_dataclass
 2022-04-26 22:17:20 -08:00
Samirbous a0672c7d2a [New Rule] Potential Privileged Escalation via KrbRelayUp (#1940) 
* [New Rule] Potential Privileged Escalation via KrbRelayUp

Identifies a suspicious local successful logon event where the Logon Package is kerberos, the remote address is set to localhost and the target user SID is the builtin local Administrator account, this may indicate an attempt to leverage a Kerberos relay attack variant that can be used to elevate privilege locally from filtered administrator token to a token with full System privileges.

https://github.com/Dec0ne/KrbRelayUp

DATA :

```
{
        "_index" : ".ds-logs-system.security-default-2022.04.12-000003",
        "_id" : "Cwy1YoABQhClK0XGfqEU",
        "_source" : {
          "agent" : {
            "name" : "02694w-win10",
            "id" : "77a829ec-a564-44d5-9bc4-61eeefbf783a",
            "type" : "filebeat",
            "ephemeral_id" : "6c751494-97a3-46aa-bab2-5baf01d17d04",
            "version" : "8.0.0"
          },
          "process" : {
            "name" : "-",
            "pid" : 0,
            "executable" : "-"
          },
          "winlog" : {
            "computer_name" : "02694w-win10.corpcorp.com",
            "process" : {
              "pid" : 688,
              "thread" : {
                "id" : 9384
              }
            },
            "keywords" : [
              "Audit Success"
            ],
            "logon" : {
              "id" : "0x0",
              "type" : "Network"
            },
            "channel" : "Security",
            "event_data" : {
              "LogonGuid" : "{daac0d7c-3273-752c-bf5d-ea1c60851819}",
              "TargetOutboundDomainName" : "-",
              "VirtualAccount" : "%%1843",
              "LogonType" : "3",
              "TransmittedServices" : "-",
              "SubjectLogonId" : "0x0",
              "LmPackageName" : "-",
              "TargetOutboundUserName" : "-",
              "KeyLength" : "0",
              "RestrictedAdminMode" : "-",
              "TargetLogonId" : "0xebd3d4",
              "SubjectUserName" : "-",
              "TargetLinkedLogonId" : "0x0",
              "ElevatedToken" : "%%1842",
              "SubjectDomainName" : "-",
              "TargetUserName" : "Administrator",
              "ImpersonationLevel" : "%%1833",
              "LogonProcessName" : "Kerberos",
              "TargetDomainName" : "CORPCORP.COM",
              "SubjectUserSid" : "S-1-0-0",
              "AuthenticationPackageName" : "Kerberos",
              "TargetUserSid" : "S-1-5-21-308926384-506822093-3341789130-500"
            },
            "opcode" : "Info",
            "version" : 2,
            "record_id" : "59063",
            "task" : "Logon",
            "event_id" : "4624",
            "provider_guid" : "{54849625-5478-4994-a5ba-3e3b0328c30d}",
            "activity_id" : "{e22af019-58dd-0002-43f0-2ae2dd58d801}",
            "api" : "wineventlog",
            "provider_name" : "Microsoft-Windows-Security-Auditing"
          },
          "log" : {
            "level" : "information"
          },
          "elastic_agent" : {
            "id" : "77a829ec-a564-44d5-9bc4-61eeefbf783a",
            "version" : "8.0.0",
            "snapshot" : false
          },
          "source" : {
            "port" : 50480,
            "ip" : "127.0.0.1",
            "domain" : "-"
          },
          "message" : """An account was successfully logged on.

Subject:
	Security ID:		S-1-0-0
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		S-1-5-21-308926384-506822093-3341789130-500
	Account Name:		Administrator
	Account Domain:		CORPCORP.COM
	Logon ID:		0xEBD3D4
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{daac0d7c-3273-752c-bf5d-ea1c60851819}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	127.0.0.1
	Source Port:		50480

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.""",
          "input" : {
            "type" : "winlog"
          },
          "@timestamp" : "2022-04-25T21:07:15.306Z",
          "ecs" : {
            "version" : "1.12.0"
          },
          "related" : {
            "ip" : [
              "127.0.0.1"
            ],
            "user" : [
              "Administrator"
            ]
          },
          "data_stream" : {
            "namespace" : "default",
            "type" : "logs",
            "dataset" : "system.security"
          },
          "host" : {
            "hostname" : "02694w-win10",
            "os" : {
              "build" : "18363.815",
              "kernel" : "10.0.18362.815 (WinBuild.160101.0800)",
              "name" : "Windows 10 Enterprise",
              "family" : "windows",
              "type" : "windows",
              "version" : "10.0",
              "platform" : "windows"
            },
            "ip" : [
              "fe80::7587:a5c1:5a7b:68f6",
              "172.16.66.25"
            ],
            "name" : "02694w-win10.corpcorp.com",
            "id" : "6a3c3ef2-208f-4d6f-90ee-b34f4e3fd160",
            "mac" : [
              "00:50:56:03:c6:93"
            ],
            "architecture" : "x86_64"
          },
          "event" : {
            "agent_id_status" : "verified",
            "ingested" : "2022-04-25T21:51:43Z",
            "code" : "4624",
            "provider" : "Microsoft-Windows-Security-Auditing",
            "kind" : "event",
            "created" : "2022-04-25T21:51:08.433Z",
            "action" : "logged-in",
            "category" : [
              "authentication"
            ],
            "type" : [
              "start"
            ],
            "dataset" : "system.security",
            "outcome" : "success"
          },
          "user" : {
            "domain" : "CORPCORP.COM",
            "name" : "Administrator",
            "id" : "S-1-5-21-308926384-506822093-3341789130-500"
          }
        }
      }
```

* Update privilege_escalation_krbrelayup_suspicious_logon.toml

* Update privilege_escalation_krbrelayup_suspicious_logon.toml

* Update privilege_escalation_krbrelayup_suspicious_logon.toml

* Update privilege_escalation_krbrelayup_suspicious_logon.toml

* Update privilege_escalation_krbrelayup_suspicious_logon.toml

* Update rules/windows/privilege_escalation_krbrelayup_suspicious_logon.toml

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>

* Update rules/windows/privilege_escalation_krbrelayup_suspicious_logon.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update etc/non-ecs-schema.json

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* relinted

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
 2022-04-27 01:39:54 +02:00
Jonhnathan 20d2e92cfe Review & Fix Invalid References (#1936) 2022-04-26 17:57:15 -03:00
Terrance DeJesus 5bf321a505 [Rule Tuning] Exclude MS OneDrive/Teams from Component Object Model Hijacking (#1932) 
* adjusted query to exclude OneDrive process name and MS Teams DLL reference in registry data strings

* adjusted formatting for altered query

* removed unecessary string used for reference

* removed unecessary parenthesis from new filters in query

* Update rules/windows/persistence_suspicious_com_hijack_registry.toml

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>

* Update rules/windows/persistence_suspicious_com_hijack_registry.toml

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>

* added FileSyncConfig.exe for OneDrive, added regsvr32 to Teams DLL filter

* added investigation notes

* removed comment from original rule creation

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
 2022-04-26 11:43:33 -04:00
AbdelMoumene-Hadfi 15faf34a2f [eql2kql] fix wildcard bug (#1507) 
* [eql2kql] fix wildcard bug
* add test for wildcards

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>
 2022-04-21 23:44:39 -04:00
github-actions[bot] 187c7a461d Lock versions for releases: 7.13,7.14,7.15,7.16,8.0,8.1,8.2 (#1929) 
* Locked versions for releases: 7.13,7.14,7.15,7.16,8.0,8.1,8.2

* Update deprecated_rules.json

Added whitespace to trigger build.

Co-authored-by: terrancedejesus <terrancedejesus@users.noreply.github.com>
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
 2022-04-14 13:29:52 -08:00
Jonhnathan 0943ffba5f [Rule Tuning] Remove logs-windows.* index (#1928) 
* Remove `logs-windows.*` index

* Update discovery_privileged_localgroup_membership.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
 2022-04-14 09:25:44 -03:00
Jonhnathan 258418785f MInor changes from Investigation Guides Review (#1927) 2022-04-13 16:53:29 -08:00
Justin Ibarra 53673c0c49 Revert "Lock versions for releases: 7.13,7.14,7.15,7.16,8.0,8.1,8.2 (#1922)" (#1925) 
This reverts commit 8789c15ae6.
 2022-04-12 23:05:54 -08:00
github-actions[bot] 8789c15ae6 Lock versions for releases: 7.13,7.14,7.15,7.16,8.0,8.1,8.2 (#1922) 2022-04-12 22:30:05 -08:00
Jonhnathan ebeb270075 [Security Content] Current Investigation Guides Review (#1896) 
* Modify investigation guides

* Apply suggestions from code review

Co-authored-by: benironside <91905639+benironside@users.noreply.github.com>

* Update rules/windows/credential_access_symbolic_link_to_shadow_copy_created.toml

Co-authored-by: benironside <91905639+benironside@users.noreply.github.com>

* Rewrite and apply previous reviews

* Apply suggestions from code review

Co-authored-by: Joe Peeples <joe.peeples@elastic.co>

* Update rules/windows/credential_access_spn_attribute_modified.toml

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

Co-authored-by: benironside <91905639+benironside@users.noreply.github.com>
Co-authored-by: Joe Peeples <joe.peeples@elastic.co>
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>
 2022-04-12 22:05:13 -03:00
Jonhnathan 46f5af436e [Security Content] Add Investigation Guides - 5 (#1895) 
* [Security Content] Add Investigation Guides - 5

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
 2022-04-12 16:12:59 -08:00
Jonhnathan 3a5fceac3b [Security Content] Add Investigation Guides - 3 (#1836) 
* [Security Content] Add Investigation Guides - 3
* Adjust Investigation Guides and Config
* Adjust Config

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: benironside <91905639+benironside@users.noreply.github.com>
 2022-04-12 15:58:50 -08:00
Justin Ibarra b3e789a202 Remove deprecated elasticsearch parameter (#1913) 2022-04-12 12:06:11 -08:00
Jonhnathan 3b6c594a22 Update discovery_net_command_system_account.toml (#1912) 2022-04-11 15:03:49 -03:00
Isai 9640ecb3fe [Rule Tuning] AWS RDS Instance/Cluster Deletion (#1916) 
* add RDS instance deletion to aws rule

I've added to this rule to improve coverage. Currently we detect creation and stopping of RDS clusters and instances. But, we only detect for the deletion of clusters, not instances. This adds the deletion of RDS instances to the detection.

* Update rules/integrations/aws/impact_rds_instance_cluster_deletion.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
 2022-04-10 15:33:33 -04:00
Jonhnathan 290763d9bb [Security Content] Add Investigation Guides - 4 (#1871) 
* [Security Content] Add Investigation Guides - 4

* Apply suggestions from code review

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

* Update rules/windows/initial_access_script_executing_powershell.toml

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

* lint

* Update persistence_user_account_creation.toml

* Apply suggestions from code review

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

* Apply suggestions from code review

Co-authored-by: benironside <91905639+benironside@users.noreply.github.com>
Co-authored-by: Joe Peeples <joe.peeples@elastic.co>
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

* .

* Fixes and lint

* .

* .

* revert modifications

* Apply suggestions from code review

Co-authored-by: Joe Peeples <joe.peeples@elastic.co>
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

* Update impact_stop_process_service_threshold.toml

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: benironside <91905639+benironside@users.noreply.github.com>
Co-authored-by: Joe Peeples <joe.peeples@elastic.co>
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>
 2022-04-10 15:37:06 -03:00
Isai 5073ef8be7 [Rule Tuning] AWS Security Group Configuration Change Detection (#1915) 
* Update persistence_ec2_security_group_configuration_change_detection

Rule does not trigger as expected due to 'iam' provider. I changed the specified provider to 'ec2'.

* update to improve rule coverage

I edited this rule to include the deletion of an RDS Instance. This fills a current gap in coverage as we are able to detect the creation and stopping of RDS instances and clusters, but only detect deletion of RDS clusters.

* Revert "update to improve rule coverage"

This reverts commit b3b094274fe13c56908aa6781c8236de6e3b5380.
 2022-04-07 14:47:09 -04:00
Justin Ibarra ad99c6b489 Update elasticsearch dependency to 8.1 (#1911) 2022-04-06 11:52:22 -08:00
Jonhnathan 49074ddeaa [Rule Tuning] Add EQL optional field syntax (#1910) 
* Add optional EQL syntax

* Add min_stack_version
 2022-04-05 16:32:37 -03:00
Justin Ibarra 6bdfddac8e Expand timestamp override tests (#1907) 
* Expand timestamp_override tests
* removed timestamp_override from eql sequence rules
* add config entry for eql rules with beats index and t_o
* add timestamp_override to missing fields
 2022-04-01 15:27:08 -08:00
Terrance DeJesus 648daf1237 Prep for Creation of 8.3 Branch (#1906) 
* updating with changes for 8.3 prep
* adding updates
* adjusted version in packages.yml
 2022-04-01 13:33:18 -08:00
Terrance DeJesus 93edc44284 [Rule Tuning] Timeline Templates For Windows and Linux (#1892) 
* added comprehensive file timeline to Hosts File Modified rule

* added Comprehensive Process Timeline to Interactive Terminal Spawned via Python rule

* updated rules to have generic instead of comprehensive

* updated several rules with timeline ID and timeline title values

* changed updated_date for threat intel fleet integrations

* added missing templates to timeline_templates dict in definitions.py

* added comprehensive timeline templates to alerts after definitions.py was updated

* updated rules with comprehensive timeline templates and added min stack comments and versions

* removing timeline template changes which is tracked in #1904

* Update rules/linux/execution_python_tty_shell.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Delete Pipfile

Removing pipfile

* Delete Pipfile.lock

deleting pipfile.lock

* Update rules/windows/execution_command_shell_started_by_svchost.toml

updating title

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
 2022-04-01 13:44:35 -04:00
Terrance DeJesus e72031a71a added comprehensive timeline template definitions (#1905) 2022-04-01 08:51:54 -08:00
Jonhnathan e1b4a0d87c Svchost spawning Cmd - False Positives Tuning (#1894) 2022-03-31 19:28:46 -03:00
Jonhnathan 8a59b49fea [Security Content] Adjust Investigation Guides to be less generic (#1805) 
* PowerShell Suspicious Script with Audio Capture Capabilities

* PowerShell Keylogging Script

* PowerShell MiniDump Script

* Potential Process Injection via PowerShell

* PowerShell Suspicious Discovery Related Windows API Functions

* Suspicious Portable Executable Encoded in Powershell Script

* PowerShell PSReflect Script

* Startup/Logon Script added to Group Policy Object

* Group Policy Abuse for Privilege Addition

* Scheduled Task Execution at Scale via GPO

* Apply suggestions from code review

Co-authored-by: benironside <91905639+benironside@users.noreply.github.com>
Co-authored-by: Joe Peeples <joe.peeples@elastic.co>
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

* Apply suggestions from code review

Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com>
Co-authored-by: benironside <91905639+benironside@users.noreply.github.com>

* Adjust Posh desc

* .

* Apply suggestions from code review

Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com>

* .

* Apply suggestions from code review

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

* Update privilege_escalation_group_policy_scheduled_task.toml

* Update rules/windows/privilege_escalation_group_policy_iniscript.toml

Co-authored-by: Joe Peeples <joe.peeples@elastic.co>

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
Co-authored-by: benironside <91905639+benironside@users.noreply.github.com>
Co-authored-by: Joe Peeples <joe.peeples@elastic.co>
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com>
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>
 2022-03-31 11:29:30 -03:00
Jonhnathan a3d7427d29 [Security Content] Add Investigation Guides - 2 (#1822) 
* Add Investigation Guides for Windows Rules - First half

* + 1/2

* Update impact_volume_shadow_copy_deletion_or_resized_via_vssadmin.toml

* Update credential_access_mod_wdigest_security_provider.toml

* Apply suggestions from code review

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

* Update defense_evasion_amsienable_key_mod.toml

* Update defense_evasion_amsienable_key_mod.toml

* Apply suggestions from code review

Co-authored-by: benironside <91905639+benironside@users.noreply.github.com>

* Update command_and_control_certutil_network_connection.toml

* Apply suggestions from code review

Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com>
Co-authored-by: Joe Peeples <joe.peeples@elastic.co>
Co-authored-by: benironside <91905639+benironside@users.noreply.github.com>

* Update collection_winrar_encryption.toml

* Apply suggestions from code review

Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com>

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>
Co-authored-by: benironside <91905639+benironside@users.noreply.github.com>
Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com>
Co-authored-by: Joe Peeples <joe.peeples@elastic.co>
 2022-03-30 14:43:55 -03:00
Justin Ibarra 5214209f8d reset evasion rules (#1902) 2022-03-29 15:47:48 -08:00
Justin Ibarra 44facd7c2a reset linux evasion rules (#1901) 2022-03-29 15:23:08 -08:00
Justin Ibarra 8d09bca633 Re-add c89 rules (#1900) 2022-03-29 15:01:48 -08:00
Justin Ibarra 507a23ba01 temp remove rule to readd with backport (#1898) 2022-03-29 14:52:04 -08:00