security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,703 Commits 1 Branch 0 Tags
a33a124eab4e5ca95e099480058c6c59d520ea2d
Commit Graph

1239 Commits

Author SHA1 Message Date
Jonhnathan e4e68c2dd8 [Rule Tuning] Potential Masquerading as System32 DLL (#3184) 
Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
 2023-10-17 08:29:08 -03:00
Jonhnathan 82685e36ce [Rule Tuning] Adjust Lucene queries to use Uppercase operators (#3196) 2023-10-16 17:07:53 -03:00
Apoorva Joshi a5a606e804 [New Rule] Adding DGA Rules from Advanced Analytic DGA Package (#3102) 
* Adding DGA rules

* Adding references

* updated rule tags and queries

* Updating min stack version

* added logic to handle ml jobs

* added code comments for clarity

* removing subbed security docs folder

* added event dataset to queries for endpoint; updated note

* removed event dataset

---------

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: terrancedejesus <terrance.dejesus@elastic.co>
 2023-10-16 15:48:54 -04:00
Samirbous 24b0aa5c63 [Tuning] Adjusted Rules for Anti-Evasion (#3163) 
* Update lateral_movement_executable_tool_transfer_smb.toml

* Update lateral_movement_incoming_wmi.toml

* Update lateral_movement_execution_via_file_shares_sequence.toml

* Update lateral_movement_executable_tool_transfer_smb.toml

* Update lateral_movement_execution_via_file_shares_sequence.toml

* Update lateral_movement_executable_tool_transfer_smb.toml

---------

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
 2023-10-16 17:56:09 +01:00
Jonhnathan f584fb6e31 [Security Content] Adjust Mitre Att&ck Mappings - Windows Rules (#3165) 
* [Security Content] Adjust Mitre Att&ck Mappings - Windows Rules

* Fix dates

* Fix unit test errors

* updated tags and fixed branch conflicts

updated tags and fixed branch conflicts

* description nit

* Reverting unintended changes

* Update initial_access_suspicious_ms_office_child_process.toml

---------

Co-authored-by: imays11 <59296946+imays11@users.noreply.github.com>
 2023-10-15 18:12:20 -03:00
Apoorva Joshi 97ff7fb26e [New Rule] Adding Data Exfiltration Rules from Advanced Analytic DED Package (#3126) 
* Adding DED rules

* adding integration manifests and schemas for DED

* Updating min stack version

* updating manifests and schemas to match main

* added setup note; updated references

---------

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: terrancedejesus <terrance.dejesus@elastic.co>
 2023-10-14 13:23:48 -04:00
shashank-elastic 15718ea09e Improve exsisting setup configurations for Linux (#3141) 2023-10-13 13:39:03 +05:30
Isai 374c9c6257 [New Rule] New GitHub App Installed (#3055) 
* new rule

* Update rules/integrations/github/execution_new_github_app_installed.toml

* Update rules/integrations/github/execution_new_github_app_installed.toml

edits from review

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

* change query from event.module to event.dataset

---------

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
 2023-10-12 20:10:20 -04:00
Terrance DeJesus 1e514afa57 [New Rule] Migrate Lateral Movement Detection Rules (#3175) 
* adding LMD rules

* added setup note; updated references

* adds 2.0.0 lmd manifest and schema

* adjusted min-stack for non-ML rules
 2023-10-12 15:02:19 -04:00
Jonhnathan 3f2a709370 [Rule Tuning] PowerShell Rules Tuning (#3169) 2023-10-11 17:57:32 -03:00
Ruben Groenewoud 89cfdcd440 [New Rule] Potential curl CVE-2023-38545 Exploitation (#3168) 
* [New Rule] Potential curl CVE-2023-38545 Exploitation

* Added setup guide

* Update execution_curl_CVE_2023_38545.toml

* File name change

* File name change

* Update dates

* Update rules/linux/execution_curl_cve_2023_38545_heap_overflow.toml

* Update rules/linux/execution_curl_cve_2023_38545_heap_overflow.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/linux/execution_curl_cve_2023_38545_heap_overflow.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/linux/execution_curl_cve_2023_38545_heap_overflow.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/linux/execution_curl_cve_2023_38545_heap_overflow.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/linux/execution_curl_cve_2023_38545_heap_overflow.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/linux/execution_curl_cve_2023_38545_heap_overflow.toml

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>

* Update rules/linux/execution_curl_cve_2023_38545_heap_overflow.toml

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>

* Update rules/linux/execution_curl_cve_2023_38545_heap_overflow.toml

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>

* Update rules/linux/execution_curl_cve_2023_38545_heap_overflow.toml

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>

---------

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>
 2023-10-11 11:42:25 -03:00
Ruben Groenewoud c2822e175c [Tuning] Windows Execution Rule Tuning for UEBA (#3107) 
* Update defense_evasion_execution_msbuild_started_by_script.toml

* Mostly updated Execution tags, also new_terms conv

* removed index

* Removed index

* WMIPrvSE tuning

* Additional tuning

* Tuning & changes

* Additional tuning

* Applied unit test optimization

* Addressed feedback

* Update rules/windows/execution_command_shell_started_by_svchost.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* caseless unit testing fix

* fixed caseless executable unit test

* unit testing fix

* Update rules/windows/execution_suspicious_powershell_imgload.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* Update execution_ms_office_written_file.toml

* Update rules/windows/defense_evasion_execution_msbuild_started_by_script.toml

* Update rules/windows/defense_evasion_execution_msbuild_started_unusal_process.toml

* Added user ids to new terms

* Update rules/windows/execution_suspicious_powershell_imgload.toml

Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>

* Update rules_building_block/execution_unsigned_service_executable.toml

Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>

* Update execution_unsigned_service_executable.toml

---------

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>
 2023-10-11 10:15:29 +02:00
Ruben Groenewoud 4cdf52129a [Tuning] Windows Discovery Rule Tuning for UEBA (#3097) 
* [Tuning] Win DR Tuning for UEBA

* Need to get used to Windows formatting

* Added additional content

* Updated min stack

* Added additional tuning

* Fixed unit testing for KQL optimization

* Update rules_building_block/discovery_internet_capabilities.toml

* Additional tuning

* Kuery optimization

* Additional tuning

* Additional tuning

* Additional tuning

* Additional tuning

* Unit testing optimization fix

* optimization

* tuning

* Optimization

* Update rules/windows/discovery_privileged_localgroup_membership.toml

* Added feedback

* Update rules/windows/discovery_privileged_localgroup_membership.toml

Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>

* Update rules/windows/discovery_remote_system_discovery_commands_windows.toml

Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>

* Update rules/windows/discovery_system_service_discovery.toml

Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>

* added host.id as additional new_terms field

* Reworked a lot.

* kibana.alert.rule.rule_id to non-ecs-schema.json

* Fixed index by adding a dot

* fixed typo

* Added host.os.type:windows for signals

* Added additional tag

* Added Higher-Order Rule tag

* Stripped down signal rules down to two

* revert

* Update rules/windows/discovery_admin_recon.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* Update rules/windows/discovery_enumerating_domain_trusts_via_nltest.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* Update rules_building_block/discovery_generic_registry_query.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* Update rules_building_block/discovery_system_time_discovery.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* Update rules/windows/discovery_privileged_localgroup_membership.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* Update discovery_generic_registry_query.toml

* Readded exclusions

* Added trailing wildcards for KQL

* Update discovery_privileged_localgroup_membership.toml

* Update rules_building_block/discovery_signal_unusual_user_host.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/windows/discovery_signal_unusual_discovery_signal_proc_cmdline.toml

Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>

* Formatting fix

---------

Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
 2023-10-11 09:43:26 +02:00
Ruben Groenewoud a46797b987 [New Rule] Pot. Rev. Shell via Background Process (#3114) 2023-10-06 23:14:39 +02:00
Isai ef8f5620e1 [New Rule] New GitHub Owner Added (#3090) 
* [New Rule] New GitHub Owner Added

new rule

* name change

* Apply suggestions from code review

Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>

---------

Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>
 2023-10-06 15:57:26 -04:00
Isai 9593412847 [New Rule] GitHub Owner Role Granted to User (#3087) 
* [New Rule] GitHub Owner Role Granted to User

new rule

* Update persistence_organization_owner_role_granted.toml

* updated integration schema

* changed timestamp_override

* Apply suggestions from code review

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

---------

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
 2023-10-06 15:44:04 -04:00
Ruben Groenewoud c3cc01333a [Tuning] CVE-2023-4911 (#3160) 2023-10-06 13:13:17 +02:00
Terrance DeJesus 57c05f0444 removing lmd rules and fixing version lock history (#3159) 2023-10-05 12:16:53 -04:00
Ruben Groenewoud f4ad1f28e3 [New Rule] PE via CVE-2023-4911 (Looney Tunables) (#3158) 
* [New Rule] PE via CVE-2023-4911 (Looney Tunables)

* Update rules/linux/privilege_escalation_looney_tunables_cve_2023_4911.toml

* Update rules/linux/privilege_escalation_looney_tunables_cve_2023_4911.toml
 2023-10-05 16:41:11 +02:00
Terrance DeJesus b8ae2218f8 [Rule Tuning] Add filebeat Compatibility to Network Rules (#2925) 
* add beats compatability to NPC rules

* added filebeat compatibility to 'Accepted Default Telnet Port Connection'

* added filebeat compatibility to 'Cobalt Strike Command and Control Beacon'

* added filebeat compatibility to 'Default Cobalt Strike Team Server Certificate'

* added filebeat compatibility to 'Roshal Archive (RAR) or PowerShell File Downloaded from the Internet'

* added filebeat compatibility to 'Possible FIN7 DGA Command and Control Behavior'

* added filebeat compatibility to 'Halfbaked Command and Control Beacon'

* added filebeat compatibility to 'IPSEC NAT Traversal Port Activity'

* added filebeat compatibility to 'SMTP on Port 26/TCP'

* added filebeat compatibility to 'RDP (Remote Desktop Protocol) from the Internet'

* added filebeat compatibility to 'VNC (Virtual Network Computing) from the Internet'

* added filebeat compatibility to 'VNC (Virtual Network Computing) to the Internet'

* added filebeat compatibility to 'RPC (Remote Procedure Call) from the Internet'

* added filebeat compatibility to 'RPC (Remote Procedure Call) to the Internet'

* added filebeat compatibility to 'SMB (Windows File Sharing) Activity to the Internet'

* removed extra space in query

* added filebeat compatibility to 'Inbound Connection to an Unsecure Elasticsearch Node'

* added filebeat compatibility to 'Abnormally Large DNS Response'

* fixed missing ending parenthesis

* added auditbeat to compatible rules

* addressed feedback

* removed filebeat and auditbeat due to incompatibility

* Update rules/network/command_and_control_cobalt_strike_beacon.toml

* Update rules/network/command_and_control_accepted_default_telnet_port_connection.toml

Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>

---------

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>
 2023-10-03 15:05:41 -04:00
Terrance DeJesus 8d2b730bc5 adjusting minimum stack version for version control (#3154) 2023-10-03 13:36:06 -04:00
Terrance DeJesus 8650b26002 [Rule Tuning] Update LMD Rules Min-Stack to 8.5 (#3142) 
* updating min-stack to 8.5

* updated min stack comments
 2023-09-27 16:17:52 -04:00
Apoorva Joshi 747ee7d593 [New Rule] Adding Lateral Movement Rules from Advanced Analytic LMD Package (#3119) 
* Adding Lateral Movement Detection rules

* added tags; adjusted tests; updated manifests and schemas

* added default value to build_integrations_schema

* combined analytic and non-dataset packages for related integrations

* adjusted machine learning definitions

* adjusted machine learning definitions

* removed splat for machine learning list due to 3.8 constraints

---------

Co-authored-by: terrancedejesus <terrance.dejesus@elastic.co>
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
 2023-09-27 14:53:38 -04:00
Ruben Groenewoud b291317ea6 [New Rule] Network Activity Detected via cat (#3069) 
* [New Rule] Network Activity via cat

* Update command_and_control_cat_network_activity.toml

---------

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
 2023-09-18 09:51:20 +02:00
Isai 9146e0965d [New Rule] Github Repository Deleted (#3056) 
* new rule

* Update rules/integrations/github/impact_github_repository_deleted.toml

* Update rules/integrations/github/impact_github_repository_deleted.toml

updates based on review

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

---------

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
 2023-09-14 18:00:25 -04:00
Isai 904e37b732 [New Rule] GitHub Protected Branch Settings Changed (#3054) 
* new rule file

* testing query change

* query changed back

* Update rules/integrations/github/defense_evasion_github_protected_branch_settings_changed.toml

updates based on review

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

* updated integration manifests with github schema

* Update defense_evasion_github_protected_branch_settings_changed.toml

added event.dataset to query

* added timestamp_override

* changed timestamp_override to @timestamp

* changed timestamp_override

---------

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>
 2023-09-14 17:16:51 -04:00
Hilton ccfc931fbd Tunes Unusual Parent Process for cmd.exe rule to exclude oobe activity (#3091) 
* Tunes Unusual Parent Process for cmd.exe rule to exclude oobe activity

When dllhost.exe is called with the "/Processid:{CA8C87C1-929D-45BA-94DB-EF8E6CB346AD}" argument it is creating an "OOBE Elevated Object Server"  as per https://strontic.github.io/xcyclopedia/library/clsid_ca8c87c1-929d-45ba-94db-ef8e6cb346ad.html

Out of the box experience is part of the Windows autopilot and therefore should be legitimate behaviour.

* simplified detection logic by utilising process.parent.args

---------

Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>
 2023-09-13 13:51:07 -03:00
Jonhnathan 4034436f06 [Security Content] Add missing osquery transforms (#3088) 
* [Security Content] Add missing osquery transforms

* Revertable unit test

* .

* Revert "Revertable unit test"

This reverts commit 8c909fc2712b16e062890a63f31a6c080b81244a.

---------

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>
 2023-09-13 08:07:01 -03:00
Jonhnathan ddb1f75352 [New Rule] New BBR Rules - Part 2 (#3029) 
* [New Rule] New BBR Rules - Part 2

* Update discovery_generic_account_groups.toml

* Update discovery_generic_account_groups.toml

* Update rules_building_block/defense_evasion_cmd_copy_binary_contents.toml

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

* Update rules_building_block/execution_downloaded_shortcut_files.toml

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

* Update rules_building_block/defense_evasion_cmd_copy_binary_contents.toml

Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>

* Update rules_building_block/defense_evasion_unusual_process_extension.toml

Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>

* Update defense_evasion_unusual_process_extension.toml

---------

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>
 2023-09-12 21:49:22 -03:00
Jonhnathan af99186992 [New Rule] New BBR Rules - Part 3 (#3034) 
* [New Rule] New BBR Rules - Part 3

* Apply suggestions from code review

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

---------

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
 2023-09-12 21:28:01 -03:00
Ruben Groenewoud f8f3576971 [New Rule] Potential UDP Reverse Shell (#2906) 
* [New Rule] Potential UDP Reverse Shell Detected

* Title change

* Update execution_shell_via_udp_cli_utility_linux.toml

* Update execution_shell_via_udp_cli_utility_linux.toml

* Update rules/linux/execution_shell_via_udp_cli_utility_linux.toml

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

* updated non-ecs-schema to update unmapped fields

* Update rules/linux/execution_shell_via_udp_cli_utility_linux.toml

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

* Removed netcat, added destination ip list

* Update execution_shell_via_udp_cli_utility_linux.toml

* Added precautionary exclusions

* Update rules/linux/execution_shell_via_udp_cli_utility_linux.toml

* replaced schema files

* Update execution_shell_via_udp_cli_utility_linux.toml

* Update execution_shell_via_udp_cli_utility_linux.toml

* Update execution_shell_via_udp_cli_utility_linux.toml

---------

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
 2023-09-07 17:13:22 +02:00
Ruben Groenewoud 15e71ec2e8 [New Rule] Potential Meterpreter Reverse Shell (#3007) 
* [New Rule] Potential Meterpreter Reverse Shell

* Update execution_shell_via_meterpreter_linux.toml

* Update execution_shell_via_meterpreter_linux.toml

* Update rules/linux/execution_shell_via_meterpreter_linux.toml

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

---------

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>
 2023-09-07 17:04:06 +02:00
Jonhnathan 3614f42b00 [New Rule] New BBR Rules - Part 5 (#3052) 
* [New Rule] New BBR Rules - Part 5

* Apply suggestions from code review

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

* Tag work

---------

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
 2023-09-05 18:36:34 -03:00
Jonhnathan 4233fef238 [Security Content] Include "Data Source: Elastic Defend" tag (#3002) 
* win folder

* Other folders

* Update test_all_rules.py

* .

* updated missing elastic defend tags

---------

Co-authored-by: terrancedejesus <terrance.dejesus@elastic.co>
 2023-09-05 14:22:01 -04:00
Ruben Groenewoud 6115a68aba [Rule Tuning] Small Linux DR Tuning (#3074) 
* [Rule tuning] Adressing community issue

* Changed title

* Changed IG title
 2023-09-05 14:20:57 +02:00
Ruben Groenewoud 3c64b454fb [New Rule] Sus User Privilege Enumeration via id (#3049) 2023-08-31 18:13:42 +02:00
Jonhnathan fdd45148b8 [New Rule][BBR] WRITEDAC Access on Active Directory Object (#3015) 
* [New Rule] WRITEDAC Access on Active Directory Object

* Update defense_evasion_write_dac_access.toml

* Fix Setup Instructions

* Update defense_evasion_write_dac_access.toml

* Update rules_building_block/defense_evasion_write_dac_access.toml

Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>

---------

Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>
 2023-08-31 12:59:02 -03:00
Ruben Groenewoud f7d8d4752a [New Rules] GDB Secret Dumping (#3060) 
* [New Rules] GDB Secret Dumping

* Added references to BBR

* Update rules/linux/credential_access_gdb_init_memory_dump.toml

* Update rules_building_block/credential_access_gdb_memory_dump.toml

* Update rules_building_block/credential_access_gdb_memory_dump.toml

* Update rules_building_block/credential_access_gdb_memory_dump.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

---------

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
 2023-08-31 17:41:22 +02:00
Ruben Groenewoud b6ed215958 [New Rule] File Creation, Exec and Self-Deletion (#3045) 
* [New Rule] File Creation, Exec and Self-Deletion

* Update execution_file_execution_followed_by_deletion.toml

* Update execution_file_execution_followed_by_deletion.toml

* Update execution_file_execution_followed_by_deletion.toml

* Update execution_file_execution_followed_by_deletion.toml

---------

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
 2023-08-31 17:32:17 +02:00
Ruben Groenewoud 3588600d57 [Rule Tuning] 3 tunings to reduce FPs (#3058) 
* [Rule Tuning] 2 tunings to reduce FPs back to 0

* Added one more tune for community issue #3041

* Update rules/linux/execution_abnormal_process_id_file_created.toml

* Update rules/linux/execution_abnormal_process_id_file_created.toml
 2023-08-31 17:16:57 +02:00
Ruben Groenewoud 2eaaf27f1e [New Rule] Potential Disabling of AppArmor (#3046) 
* [New Rule] Potential Disabling of AppArmor

* Update rules/linux/defense_evasion_disable_apparmor_attempt.toml

* Update rules/linux/defense_evasion_disable_apparmor_attempt.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

---------

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
 2023-08-31 17:06:15 +02:00
Ruben Groenewoud d838a3352f [New Rule] Binary Copied and/or Moved to Suspicious Directory (#3048) 
* [New Rule] Binary Copied and/or Moved to sus dir

* Update rules/linux/defense_evasion_binary_copied_to_suspicious_directory.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/linux/defense_evasion_binary_copied_to_suspicious_directory.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/linux/defense_evasion_binary_copied_to_suspicious_directory.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

---------

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
 2023-08-31 13:46:41 +02:00
Ruben Groenewoud a5b5d513af [New Rule] Potential Sudo Privilege Escalation via CVE-2019-14287 (#3057) 
* [New Rule] Sudo PE via CVE-2019-14287

* Added Elastic Defend Data Source tag

* Update rules/linux/privilege_escalation_sudo_cve_2019_14287.toml

* Update rules/linux/privilege_escalation_sudo_cve_2019_14287.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

---------

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
 2023-08-31 13:11:34 +02:00
Ruben Groenewoud a395f54054 [New Rules] sus program compilation activity (#3043) 2023-08-31 09:30:56 +02:00
Ruben Groenewoud 32abdb95f7 [New Rules] Linux Tunneling and Port Forwarding (#3028) 
* Removed iodine rule due to new tunneling rule

* [New Rules] Linux Tunneling and Port Forwarding

* added ash

* Fixed description styling

* Changed rule name

* Update command_and_control_linux_suspicious_proxychains_activity.toml

* Added deprecation note & name change

* Changed deprecation status

* Removed deprecation date

* Fixed unit testing

* Update rules_building_block/command_and_control_linux_ssh_x11_forwarding.toml

---------

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
 2023-08-30 22:12:19 +02:00
Eric 41a7a36817 Tune rule for new DLL written to Windows Servicing (#3062) 2023-08-30 13:51:23 -03:00
Jonhnathan 6d7df50d78 [New Rule] Suspicious WMI Event Subscription Created (#1860) 
* Suspicious WMI Event Subscription Initial rule

* Use EQL sequence

* Update non-ecs-schema

* Update persistence_sysmon_wmi_event_subscription.toml

* update description

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

* update query too look for even code 21 only

* update to case sensitive compare

* Update rules/windows/persistence_sysmon_wmi_event_subscription.toml

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

* Update persistence_sysmon_wmi_event_subscription.toml

* Update non-ecs-schema.json

* Update rules/windows/persistence_sysmon_wmi_event_subscription.toml

* Update non-ecs-schema.json

* Update persistence_sysmon_wmi_event_subscription.toml

---------

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
 2023-08-29 16:42:19 -03:00
Jonhnathan 7004c99ef5 [New Rule] Unusual Process For MSSQL Service Accounts (#3040) 
* [New Rule] Unusual Process For MSSQL Service Accounts

* Update initial_access_unusual_process_sql_accounts.toml

* Update initial_access_unusual_process_sql_accounts.toml

* Update collection_archive_data_zip_imageload.toml

* Update persistence_via_xp_cmdshell_mssql_stored_procedure.toml

* Update initial_access_unusual_process_sql_accounts.toml

* Update rules_building_block/initial_access_unusual_process_sql_accounts.toml

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

* Update persistence_via_xp_cmdshell_mssql_stored_procedure.toml

added   "vpnbridge.exe", "certutil.exe" and "bitsadmin.exe" to rule scope.

* Update persistence_via_xp_cmdshell_mssql_stored_procedure.toml

---------

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
 2023-08-29 09:10:25 -03:00
Samirbous 22931d6afb Update credential_access_lsass_openprocess_api.toml (#3047) 2023-08-28 16:22:08 +01:00
Jonhnathan de32287889 [Rule Tuning] High Number of Process and/or Service Terminations (#2940) 2023-08-25 19:19:25 -03:00