security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,103 Commits 1 Branch 0 Tags
a9de227cfafbb14ec1e5aa9d43423ef4a7eb6fa3
Commit Graph

817 Commits

Author SHA1 Message Date
Mika Ayenson a9de227cfa [Rule Tuning] Access to Keychain Credentials Directories (#2101) 
* rule tune to remove noisy FPs
 2022-07-22 14:14:12 -04:00
Mika Ayenson aaf9a708ae [Rule Tuning] Access of Stored Browser Credentials (#2098) 
* audit update : added technique T1539 and excluded additional cookies path
 2022-07-22 13:57:59 -04:00
Jonhnathan 7ddae4b493 [Security Content] Add Investigation Guides - Cloud - 2 (#2124) 
* [Security Content] Add Investigation Guides - Cloud - 2

* Replace config/setup

* Applies suggestions from review

* Update credential_access_aws_iam_assume_role_brute_force.toml

* Apply suggestions from code review

* Update credential_access_aws_iam_assume_role_brute_force.toml

* Apply suggestions from code review

Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com>

Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com>
 2022-07-22 14:32:42 -03:00
Colson Wilhoit 98d93bc21e [New Rule] Hidden so file (#2131) 
* [New Rule] Hidden Shared Object File

* [Rule Tuning] Hidden File from Tmp

* Update updated_date

* Update rules/linux/defense_evasion_hidden_shared_object.toml

* Update rules/linux/defense_evasion_hidden_shared_object.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* Update rules/linux/defense_evasion_hidden_shared_object.toml

* Update rules/linux/defense_evasion_hidden_shared_object.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
 2022-07-22 11:37:47 -05:00
Samirbous d312f49117 [New Rule] Suspicious HTML File Creation (#2068) 
* [New Rule] Suspicious HTML File Creation

* Update initial_access_evasion_suspicious_htm_file_creation.toml

* Update non-ecs-schema.json

* Update initial_access_evasion_suspicious_htm_file_creation.toml

* Update rules/windows/initial_access_evasion_suspicious_htm_file_creation.toml

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>
 2022-07-22 16:21:53 +02:00
Terrance DeJesus 9cefd88b90 removed googlecloud.audit from event datasets (#2105) 2022-07-21 12:11:15 -04:00
Terrance DeJesus 5ff3844fbe [Rule Tuning] GCP Firewall Rules Should Include App Engine (#2107) 
* removed googlecloud.audit and added app engine event actions

* adjusted query for rule created

* adjusted queries to exclude v1

* Update rules/integrations/gcp/defense_evasion_gcp_firewall_rule_deleted.toml

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
 2022-07-21 11:56:28 -04:00
Jonhnathan d854b943e5 [Security Content] Add Investigation Guides to Cloud Rules - AWS (#2104) 
* [Security Content] Add Investigation Guides to Cloud Rules - AWS

* Apply suggestion from review

* Update rules/integrations/aws/exfiltration_ec2_snapshot_change_activity.toml

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

* Update rules/integrations/aws/impact_cloudwatch_log_stream_deletion.toml

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

* Apply suggestions from review

* Apply suggestions from code review

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

* Apply suggestions from code review

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

* .

* Applies suggestions from the https://github.com/elastic/detection-rules/pull/2124 PR

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>
 2022-07-20 12:28:58 -03:00
Samirbous 59736e3973 [New Rule] Suspicious LSASS Access via MalSecLogon (#2063) 
* [New Rule]

Identifies suspicious access to LSASS handle from a call trace pointing to seclogon.dll and with a suspicious access rights value, this may indicate an attempt to leak an Lsass handle via abusing the Secondary Logon service in preparation for credential access.

https://splintercod3.blogspot.com/p/the-hidden-side-of-seclogon-part-3.html

Data:

```
{
  "_index": ".ds-logs-windows.sysmon_operational-default-2022.06.16-000005",
  "_id": "QxU4rIEBTJjT82fLq8Cf",
  "_score": 1,
  "_source": {
    "agent": {
      "name": "02694w-win10",
      "id": "85e87161-ea22-4847-a978-fb4ed45ebf0e",
      "type": "filebeat",
      "ephemeral_id": "137d194a-e542-4cd6-a1e3-f4ca9f5ad6b8",
      "version": "8.0.0"
    },
    "process": {
      "name": "svchost.exe",
      "pid": 456,
      "thread": {
        "id": 15264
      },
      "entity_id": "{6a3c3ef2-3646-62ab-1300-00000000d300}",
      "executable": "C:\\WINDOWS\\system32\\svchost.exe"
    },
    "winlog": {
      "computer_name": "02694w-win10.threebeesco.com",
      "process": {
        "pid": 2680,
        "thread": {
          "id": 3988
        }
      },
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "event_data": {
        "GrantedAccess": "0x14c0",
        "TargetProcessId": "680",
        "SourceUser": "NT AUTHORITY\\SYSTEM",
        "TargetImage": "C:\\WINDOWS\\system32\\lsass.exe",
        "CallTrace": "C:\\WINDOWS\\SYSTEM32\\ntdll.dll+9c534|C:\\WINDOWS\\System32\\KERNELBASE.dll+2726e|c:\\windows\\system32\\seclogon.dll+128f|c:\\windows\\system32\\seclogon.dll+10a0|C:\\WINDOWS\\System32\\RPCRT4.dll+76953|C:\\WINDOWS\\System32\\RPCRT4.dll+da036|C:\\WINDOWS\\System32\\RPCRT4.dll+37a4c|C:\\WINDOWS\\System32\\RPCRT4.dll+548c8|C:\\WINDOWS\\System32\\RPCRT4.dll+2c921|C:\\WINDOWS\\System32\\RPCRT4.dll+2c1db|C:\\WINDOWS\\System32\\RPCRT4.dll+1a86f|C:\\WINDOWS\\System32\\RPCRT4.dll+19d1a|C:\\WINDOWS\\System32\\RPCRT4.dll+19301|C:\\WINDOWS\\System32\\RPCRT4.dll+18d6e|C:\\WINDOWS\\System32\\RPCRT4.dll+169a5|C:\\WINDOWS\\SYSTEM32\\ntdll.dll+333ed|C:\\WINDOWS\\SYSTEM32\\ntdll.dll+34142|C:\\WINDOWS\\System32\\KERNEL32.DLL+17bd4|C:\\WINDOWS\\SYSTEM32\\ntdll.dll+6ce51",
        "TargetProcessGUID": "{6a3c3ef2-3646-62ab-0c00-00000000d300}",
        "TargetUser": "NT AUTHORITY\\SYSTEM"
      },
      "opcode": "Info",
      "version": 3,
      "record_id": "1825496",
      "task": "Process accessed (rule: ProcessAccess)",
      "event_id": "10",
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "api": "wineventlog",
      "provider_name": "Microsoft-Windows-Sysmon",
      "user": {
        "identifier": "S-1-5-18",
        "domain": "NT AUTHORITY",
        "name": "SYSTEM",
        "type": "User"
      }
    },
    "log": {
      "level": "information"
    },
    "elastic_agent": {
      "id": "85e87161-ea22-4847-a978-fb4ed45ebf0e",
      "version": "8.0.0",
      "snapshot": false
    },
    "message": "Process accessed:\nRuleName: -\nUtcTime: 2022-06-28 21:29:49.829\nSourceProcessGUID: {6a3c3ef2-3646-62ab-1300-00000000d300}\nSourceProcessId: 456\nSourceThreadId: 15264\nSourceImage: C:\\WINDOWS\\system32\\svchost.exe\nTargetProcessGUID: {6a3c3ef2-3646-62ab-0c00-00000000d300}\nTargetProcessId: 680\nTargetImage: C:\\WINDOWS\\system32\\lsass.exe\nGrantedAccess: 0x14C0\nCallTrace: C:\\WINDOWS\\SYSTEM32\\ntdll.dll+9c534|C:\\WINDOWS\\System32\\KERNELBASE.dll+2726e|c:\\windows\\system32\\seclogon.dll+128f|c:\\windows\\system32\\seclogon.dll+10a0|C:\\WINDOWS\\System32\\RPCRT4.dll+76953|C:\\WINDOWS\\System32\\RPCRT4.dll+da036|C:\\WINDOWS\\System32\\RPCRT4.dll+37a4c|C:\\WINDOWS\\System32\\RPCRT4.dll+548c8|C:\\WINDOWS\\System32\\RPCRT4.dll+2c921|C:\\WINDOWS\\System32\\RPCRT4.dll+2c1db|C:\\WINDOWS\\System32\\RPCRT4.dll+1a86f|C:\\WINDOWS\\System32\\RPCRT4.dll+19d1a|C:\\WINDOWS\\System32\\RPCRT4.dll+19301|C:\\WINDOWS\\System32\\RPCRT4.dll+18d6e|C:\\WINDOWS\\System32\\RPCRT4.dll+169a5|C:\\WINDOWS\\SYSTEM32\\ntdll.dll+333ed|C:\\WINDOWS\\SYSTEM32\\ntdll.dll+34142|C:\\WINDOWS\\System32\\KERNEL32.DLL+17bd4|C:\\WINDOWS\\SYSTEM32\\ntdll.dll+6ce51\nSourceUser: NT AUTHORITY\\SYSTEM\nTargetUser: NT AUTHORITY\\SYSTEM",
    "input": {
      "type": "winlog"
    },
    "@timestamp": "2022-06-28T21:29:49.829Z",
    "ecs": {
      "version": "1.12.0"
    },
    "data_stream": {
      "namespace": "default",
      "type": "logs",
      "dataset": "windows.sysmon_operational"
    },
    "host": {
      "hostname": "02694w-win10",
      "os": {
        "build": "18363.815",
        "kernel": "10.0.18362.815 (WinBuild.160101.0800)",
        "name": "Windows 10 Enterprise",
        "type": "windows",
        "family": "windows",
        "version": "10.0",
        "platform": "windows"
      },
      "ip": [
        "fe80::7587:a5c1:5a7b:68f6",
        "172.16.66.25"
      ],
      "name": "02694w-win10.threebeesco.com",
      "id": "6a3c3ef2-208f-4d6f-90ee-b34f4e3fd160",
      "mac": [
        "00:50:56:03:c6:93"
      ],
      "architecture": "x86_64"
    },
    "event": {
      "agent_id_status": "verified",
      "ingested": "2022-06-28T21:30:04Z",
      "code": "10",
      "provider": "Microsoft-Windows-Sysmon",
      "created": "2022-06-28T21:29:51.107Z",
      "kind": "event",
      "action": "Process accessed (rule: ProcessAccess)",
      "category": [
        "process"
      ],
      "type": [
        "access"
      ],
      "dataset": "windows.sysmon_operational"
    },
    "user": {
      "id": "S-1-5-18"
    }
  },
  "fields": {
    "elastic_agent.version": [
      "8.0.0"
    ],
    "event.category": [
      "process"
    ],
    "host.os.name.text": [
      "Windows 10 Enterprise"
    ],
    "winlog.provider_guid": [
      "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}"
    ],
    "winlog.provider_name": [
      "Microsoft-Windows-Sysmon"
    ],
    "host.hostname": [
      "02694w-win10"
    ],
    "winlog.computer_name": [
      "02694w-win10.threebeesco.com"
    ],
    "process.pid": [
      456
    ],
    "host.mac": [
      "00:50:56:03:c6:93"
    ],
    "winlog.process.pid": [
      2680
    ],
    "host.os.version": [
      "10.0"
    ],
    "winlog.record_id": [
      "1825496"
    ],
    "winlog.event_data.TargetUser": [
      "NT AUTHORITY\\SYSTEM"
    ],
    "host.os.name": [
      "Windows 10 Enterprise"
    ],
    "log.level": [
      "information"
    ],
    "agent.name": [
      "02694w-win10"
    ],
    "host.name": [
      "02694w-win10.threebeesco.com"
    ],
    "event.agent_id_status": [
      "verified"
    ],
    "event.kind": [
      "event"
    ],
    "winlog.version": [
      3
    ],
    "host.os.type": [
      "windows"
    ],
    "user.id": [
      "S-1-5-18"
    ],
    "input.type": [
      "winlog"
    ],
    "data_stream.type": [
      "logs"
    ],
    "host.architecture": [
      "x86_64"
    ],
    "process.name": [
      "svchost.exe"
    ],
    "event.provider": [
      "Microsoft-Windows-Sysmon"
    ],
    "event.code": [
      "10"
    ],
    "agent.id": [
      "85e87161-ea22-4847-a978-fb4ed45ebf0e"
    ],
    "ecs.version": [
      "1.12.0"
    ],
    "event.created": [
      "2022-06-28T21:29:51.107Z"
    ],
    "winlog.event_data.CallTrace": [
      "C:\\WINDOWS\\SYSTEM32\\ntdll.dll+9c534|C:\\WINDOWS\\System32\\KERNELBASE.dll+2726e|c:\\windows\\system32\\seclogon.dll+128f|c:\\windows\\system32\\seclogon.dll+10a0|C:\\WINDOWS\\System32\\RPCRT4.dll+76953|C:\\WINDOWS\\System32\\RPCRT4.dll+da036|C:\\WINDOWS\\System32\\RPCRT4.dll+37a4c|C:\\WINDOWS\\System32\\RPCRT4.dll+548c8|C:\\WINDOWS\\System32\\RPCRT4.dll+2c921|C:\\WINDOWS\\System32\\RPCRT4.dll+2c1db|C:\\WINDOWS\\System32\\RPCRT4.dll+1a86f|C:\\WINDOWS\\System32\\RPCRT4.dll+19d1a|C:\\WINDOWS\\System32\\RPCRT4.dll+19301|C:\\WINDOWS\\System32\\RPCRT4.dll+18d6e|C:\\WINDOWS\\System32\\RPCRT4.dll+169a5|C:\\WINDOWS\\SYSTEM32\\ntdll.dll+333ed|C:\\WINDOWS\\SYSTEM32\\ntdll.dll+34142|C:\\WINDOWS\\System32\\KERNEL32.DLL+17bd4|C:\\WINDOWS\\SYSTEM32\\ntdll.dll+6ce51"
    ],
    "agent.version": [
      "8.0.0"
    ],
    "host.os.family": [
      "windows"
    ],
    "process.thread.id": [
      15264
    ],
    "winlog.event_data.TargetProcessGUID": [
      "{6a3c3ef2-3646-62ab-0c00-00000000d300}"
    ],
    "winlog.process.thread.id": [
      3988
    ],
    "winlog.event_data.TargetImage": [
      "C:\\WINDOWS\\system32\\lsass.exe"
    ],
    "winlog.event_data.TargetProcessId": [
      "680"
    ],
    "process.entity_id": [
      "{6a3c3ef2-3646-62ab-1300-00000000d300}"
    ],
    "host.os.build": [
      "18363.815"
    ],
    "winlog.user.type": [
      "User"
    ],
    "host.ip": [
      "fe80::7587:a5c1:5a7b:68f6",
      "172.16.66.25"
    ],
    "agent.type": [
      "filebeat"
    ],
    "event.module": [
      "windows"
    ],
    "host.os.kernel": [
      "10.0.18362.815 (WinBuild.160101.0800)"
    ],
    "winlog.api": [
      "wineventlog"
    ],
    "elastic_agent.snapshot": [
      false
    ],
    "host.id": [
      "6a3c3ef2-208f-4d6f-90ee-b34f4e3fd160"
    ],
    "process.executable": [
      "C:\\WINDOWS\\system32\\svchost.exe"
    ],
    "winlog.user.identifier": [
      "S-1-5-18"
    ],
    "winlog.event_data.SourceUser": [
      "NT AUTHORITY\\SYSTEM"
    ],
    "winlog.task": [
      "Process accessed (rule: ProcessAccess)"
    ],
    "winlog.user.domain": [
      "NT AUTHORITY"
    ],
    "elastic_agent.id": [
      "85e87161-ea22-4847-a978-fb4ed45ebf0e"
    ],
    "data_stream.namespace": [
      "default"
    ],
    "winlog.event_data.GrantedAccess": [
      "0x14c0"
    ],
    "message": [
      "Process accessed:\nRuleName: -\nUtcTime: 2022-06-28 21:29:49.829\nSourceProcessGUID: {6a3c3ef2-3646-62ab-1300-00000000d300}\nSourceProcessId: 456\nSourceThreadId: 15264\nSourceImage: C:\\WINDOWS\\system32\\svchost.exe\nTargetProcessGUID: {6a3c3ef2-3646-62ab-0c00-00000000d300}\nTargetProcessId: 680\nTargetImage: C:\\WINDOWS\\system32\\lsass.exe\nGrantedAccess: 0x14C0\nCallTrace: C:\\WINDOWS\\SYSTEM32\\ntdll.dll+9c534|C:\\WINDOWS\\System32\\KERNELBASE.dll+2726e|c:\\windows\\system32\\seclogon.dll+128f|c:\\windows\\system32\\seclogon.dll+10a0|C:\\WINDOWS\\System32\\RPCRT4.dll+76953|C:\\WINDOWS\\System32\\RPCRT4.dll+da036|C:\\WINDOWS\\System32\\RPCRT4.dll+37a4c|C:\\WINDOWS\\System32\\RPCRT4.dll+548c8|C:\\WINDOWS\\System32\\RPCRT4.dll+2c921|C:\\WINDOWS\\System32\\RPCRT4.dll+2c1db|C:\\WINDOWS\\System32\\RPCRT4.dll+1a86f|C:\\WINDOWS\\System32\\RPCRT4.dll+19d1a|C:\\WINDOWS\\System32\\RPCRT4.dll+19301|C:\\WINDOWS\\System32\\RPCRT4.dll+18d6e|C:\\WINDOWS\\System32\\RPCRT4.dll+169a5|C:\\WINDOWS\\SYSTEM32\\ntdll.dll+333ed|C:\\WINDOWS\\SYSTEM32\\ntdll.dll+34142|C:\\WINDOWS\\System32\\KERNEL32.DLL+17bd4|C:\\WINDOWS\\SYSTEM32\\ntdll.dll+6ce51\nSourceUser: NT AUTHORITY\\SYSTEM\nTargetUser: NT AUTHORITY\\SYSTEM"
    ],
    "winlog.user.name": [
      "SYSTEM"
    ],
    "winlog.event_id": [
      "10"
    ],
    "event.ingested": [
      "2022-06-28T21:30:04.000Z"
    ],
    "event.action": [
      "Process accessed (rule: ProcessAccess)"
    ],
    "@timestamp": [
      "2022-06-28T21:29:49.829Z"
    ],
    "winlog.channel": [
      "Microsoft-Windows-Sysmon/Operational"
    ],
    "host.os.platform": [
      "windows"
    ],
    "data_stream.dataset": [
      "windows.sysmon_operational"
    ],
    "event.type": [
      "access"
    ],
    "winlog.opcode": [
      "Info"
    ],
    "agent.ephemeral_id": [
      "137d194a-e542-4cd6-a1e3-f4ca9f5ad6b8"
    ],
    "event.dataset": [
      "windows.sysmon_operational"
    ]
  }
}
```

* Update rules/windows/credential_access_lsass_handle_via_malseclogon.toml

* Update rules/windows/credential_access_lsass_handle_via_malseclogon.toml

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
 2022-07-20 16:30:19 +02:00
Jonhnathan 1276f98a70 [Rule Tuning] Elastic Agent Service Terminated (#2112) 2022-07-19 13:33:52 -03:00
Mika Ayenson a52751494e 2058 add setup field to metadata (#2061) 
* Convert config header to setup in note field
* Parse note field into separate setup and note field with marko gfm
* only validate and parse note on elastic authored rules and add CLI description for new DR_BYPASS_NOTE_VALIDATION_AND_PARSE environment variable

Co-authored-by: brokensound77 <brokensound77@users.noreply.github.com>
 2022-07-18 15:41:32 -04:00
Colson Wilhoit 9995558b2a [New Rule] Dynamic Linker Copy (#2099) 
* [New Rule] Dynamic Linker Copy

* Update rules/linux/persistence_dynamic_linker_backup.toml

* Update rules/linux/persistence_dynamic_linker_backup.toml

* Update rules/linux/persistence_dynamic_linker_backup.toml
 2022-07-13 10:17:46 -05:00
Colson Wilhoit 58ad0823ca [New Rule] Tc BPF Filter (#2091) 
* tc bpf filter

* Update rules/linux/execution_tc_bpf_filter.toml
 2022-07-13 09:41:46 -05:00
Jonhnathan 3a8efc8183 [Security Content] 8.4 - Add Investigation Guides (#2069) 
* [Security Content] 8.4 - Add Investigation Guides

* Apply suggestions from code review

Co-authored-by: Joe Peeples <joe.peeples@elastic.co>

* Update rules/windows/credential_access_cmdline_dump_tool.toml

Co-authored-by: Joe Peeples <joe.peeples@elastic.co>

* Apply suggestions from code review

Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com>

* Update rules/windows/credential_access_credential_dumping_msbuild.toml

Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com>

Co-authored-by: Joe Peeples <joe.peeples@elastic.co>
Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com>
 2022-07-13 11:28:34 -03:00
Colson Wilhoit d7d0466344 [New Rule] Insmod kernel module load (#2093) 
* insmod kernel module load

* Update rules/linux/persistence_insmod_kernel_module_load.toml

* Update rules/linux/persistence_insmod_kernel_module_load.toml
 2022-07-13 09:22:21 -05:00
Terrance DeJesus 7581234fe8 [Rule Tuning] Potential Reverse Shell Activity via Terminal (#2077) 
* adjusted query rule to exclude noisy FPs

* adjusted event.action to be event.type
 2022-07-12 22:33:38 -04:00
Terrance DeJesus 329530c8c3 [New Rule] Domain Trust Enumeration via Nltest (#2010) 
* adding detection rule

* removed changes from unrelated rule

* adjusted threat technique

* Update rules/windows/discovery_enumerating_domain_trusts_via_nltest.toml

* Update rules/windows/discovery_enumerating_domain_trusts_via_nltest.toml

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>

* Update rules/windows/discovery_enumerating_domain_trusts_via_nltest.toml

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>

* Update rules/windows/discovery_enumerating_domain_trusts_via_nltest.toml

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
 2022-07-05 10:48:25 -04:00
Jonhnathan 853f8db8d0 Update discovery_privileged_localgroup_membership.toml (#2046) 2022-06-30 14:26:17 -03:00
shashank-elastic 2ee23bd80f [Rule tuning] existing strace activity rule. (#2028) 
* Update description and MITTRE Attack details
 2022-06-16 17:18:48 +05:30
Jonhnathan c8ff1dc9cb Update discovery_remote_system_discovery_commands_windows.toml (#2033) 2022-06-14 10:50:59 -03:00
Isai 63fda01fdd [New Rule] Kubernetes execution_user_exec_to_pod (#1979) 
* Create execution_user_exec_to_pod.toml

* Update execution_user_exec_to_pod.toml

* Update rules/integrations/kubernetes/execution_user_exec_to_pod.toml

* Update non-ecs-schema.json

* Update execution_user_exec_to_pod.toml

* Update rules/integrations/kubernetes/execution_user_exec_to_pod.toml

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

* Update execution_user_exec_to_pod.toml

* Update execution_user_exec_to_pod.toml

* Update execution_user_exec_to_pod.toml

* toml-linted file and add to false positive

toml-linted the file and added to the false positive description

* Create notepad.sct

Added this back into the repo, deleted by mistake.

* added min_stack_version based on integration

min stack version determined by integration support of necessary fields

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
 2022-06-09 17:52:45 -04:00
Jonhnathan 3aa53fc6c5 [Rule Tuning] M365 - Remove event.outcome condition from Auth Events (#2004) 
* Remove event.outcome condition

* Update credential_access_microsoft_365_brute_force_user_account_attempt.toml

* Revert "Update credential_access_microsoft_365_brute_force_user_account_attempt.toml"

This reverts commit c7e7c976174a62e6b50139291e8f7f1a34e7beab.

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
 2022-06-03 14:24:14 -03:00
Jonhnathan b6631f200e Update persistence_sdprop_exclusion_dsheuristics.toml (#2017) 2022-06-03 14:22:04 -03:00
Jonhnathan f857e009c5 Adds logs-system.* index pattern (#2016) 2022-06-03 13:56:54 -03:00
shashank-elastic f02325fe2f [Rule Tuning] Add MITRE Details to exisisting hpining activity rule. (#2012) 
* Add MITRE Details to existing hping activity rule.
 2022-06-02 10:36:23 +05:30
shashank-elastic 98a85ddcee Linux binary(s) ftp shell evasion threat (#2007) 
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
 2022-06-01 22:07:52 +05:30
Samirbous d6e96a83d5 [New Rule] Suspicious Microsoft Diagnostics Wizard Execution (#2005) 
* [New Rule] Suspicious Microsoft Diagnostics Wizard Execution

https://lolbas-project.github.io/lolbas/Binaries/Msdt/
https://twitter.com/nao_sec/status/1530196847679401984

* Update rules/windows/defense_evasion_proxy_execution_via_msdt.toml

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>
 2022-06-01 17:02:47 +02:00
Jonhnathan 27f5c2e695 [Security Content] 8.3 Add Investigation Guides - 3 (#1990) 
* [Security Content] 8.3 Add Investigation Guides - 3

* bump date

* Apply suggestions from code review

Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com>

* Apply suggestions from code review

Co-authored-by: Joe Peeples <joe.peeples@elastic.co>

Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com>
Co-authored-by: Joe Peeples <joe.peeples@elastic.co>
 2022-05-31 12:57:02 -03:00
Jonhnathan e5d3c6329c [Security Content] 8.3 - Add Investigation Guides 2 (#1989) 
* [Security Content] 8.3 - Add Investigation Guides 2 - Initial Commit

* .

* Add Related rules

* Apply suggestions from code review

Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com>

* Apply suggestions from code review

Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com>

* .

* .

* Apply suggestions from code review

Co-authored-by: Joe Peeples <joe.peeples@elastic.co>

Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com>
Co-authored-by: Joe Peeples <joe.peeples@elastic.co>
 2022-05-31 12:54:42 -03:00
Samirbous bfea11c99f [Rule Tuning] Suspicious MS Office Child Process (#2003) 
added msdt.exe as a response to this in the wild 0day (works without vba and on latest office) ->

https://twitter.com/nao_sec/status/1530196847679401984
https://www.virustotal.com/gui/file/4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784/detection
 2022-05-31 14:20:51 +02:00
Jonhnathan 1f8813d02f [Promote Rule] Potential Invoke-Mimikatz PowerShell Script (#1993) 
* Update credential_access_mimikatz_powershell_module.toml

* Update credential_access_mimikatz_powershell_module.toml

* Update credential_access_mimikatz_powershell_module.toml

* Update credential_access_mimikatz_powershell_module.toml

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
 2022-05-25 17:02:21 -03:00
Terrance DeJesus cdc5c7244a [New Rule] Elastic Agent Stopped (#1991) 
* new rule for detecting if elastic agent has been stopped

* adjusted query based on feedback; added powershell, taskkill, pskill and processhacker
 2022-05-25 13:16:21 -04:00
shashank-elastic fd7a6d63b0 [Rule tuning] Linux binary(s) shell evasion threat 
* Linux binary(s) git shell evasion threat
 2022-05-25 19:21:08 +05:30
shashank-elastic 51b2d9da4b [Rule tuning] Linux binary(s) shell evasion threat (#1957) 
* Linux binary(s) shell evasion threat

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
 2022-05-25 08:32:53 +05:30
Justin Ibarra 72c186b30b [Rule tuning] Whitespace Padding in Process Command Line (#1967) 
* [Rule tuning] Whitespace Padding in Process Command Line

* bump updated_date

* update comment

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
 2022-05-23 14:33:48 -05:00
Justin Ibarra 1840a638c8 [Rule tuning] Unusual Process Execution - Temp (#1968) 
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
 2022-05-23 11:04:35 -04:00
Bobby Filar 9a739b7e4c Modifying rules assoc w/ deprecation of v2 ML jobs (#1846) 
* modifying rules assoc w/ deprecation of v2 ML jobs

* modified updated_date field

* fixed machine_learning_job_id and added min_stack_version

* replacing rest of deprecated jobs with new naming convention

* Update ml_suspicious_login_activity.toml

* removing rules assoc w/ deprecated ML jobs

* Update rules/ml/ml_linux_anomalous_compiler_activity.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update rules/ml/ml_linux_anomalous_compiler_activity.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* updated ml job rules to reflect 8.3 changes

* updating min_stack_version for ml detection rules

Co-authored-by: Craig Chamberlain <randomuserid@users.noreply.github.com>
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
Co-authored-by: Apoorva Joshi <30438249+ajosh0504@users.noreply.github.com>
 2022-05-20 13:02:27 -07:00
Mika Ayenson 77966473d1 [Rule tuning] add support for osx, zsh, and expand tampering techniques (#1974) 
* add support for osx, zsh, and expand tampering techniques
* migrate to cross-platform and add macOS tag
 2022-05-20 11:10:56 -04:00
Jonhnathan a1bdf2b564 [Security Content] 8.3 - Add Investigation Guides (#1937) 
* 8.3 - Add Investigation Guides

* Apply suggestions

* Apply the refactor

* Apply suggestions from Samir

* .

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
 2022-05-19 13:23:35 -03:00
Mika Ayenson 92640f517a [Rule tuning] check for anything found in the emondClient directory (#1977) 
* check for anything found in the emondClient directory and add reference
 2022-05-18 12:33:23 -04:00
Jonhnathan 817b97f428 [Security Content] Refactor Existing Investigation Guides (#1959) 
* Initial commit

* Update Investigation guides - security-docs review

* Update command_and_control_dns_tunneling_nslookup.toml

* Update defense_evasion_amsienable_key_mod.toml

* Apply security-docs review

* Remove dot

* Update rules/windows/command_and_control_rdp_tunnel_plink.toml

Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com>

* Apply changes from review

* Apply the suggestion

Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com>
 2022-05-18 12:59:39 -03:00
Colson Wilhoit d12f45c6ba [Rule Tuning] Update Rule Name: Suspicious Network Connection Attempt Sequence by Root (#1983) 
* [Rule Tuning] Update Rule Name

* Update rules/linux/command_and_control_connection_attempt_by_non_ssh_root_session.toml
 2022-05-17 17:41:05 -05:00
Terrance DeJesus c89f423961 [New Rule] Suspicious Outbound Network Connect Sequence by Root (#1975) 
* adding initial rule

* adjusted UUID

* removed event.ingested as query is a sequence

* changed file name to match mitre ATT&CK tactic

* Update rules/linux/command_and_control_connection_attempt_by_non_ssh_root_session.toml

* Update rules/linux/command_and_control_connection_attempt_by_non_ssh_root_session.toml

* Update rules/linux/command_and_control_connection_attempt_by_non_ssh_root_session.toml

* Update rules/linux/command_and_control_connection_attempt_by_non_ssh_root_session.toml

* Update rules/linux/command_and_control_connection_attempt_by_non_ssh_root_session.toml

* Update rules/linux/command_and_control_connection_attempt_by_non_ssh_root_session.toml

* TOML linted

* Update command_and_control_connection_attempt_by_non_ssh_root_session.toml

Just edited a couple grammar things. Looks good

* Update rules/linux/command_and_control_connection_attempt_by_non_ssh_root_session.toml

* Update rules/linux/command_and_control_connection_attempt_by_non_ssh_root_session.toml

* Update rules/linux/command_and_control_connection_attempt_by_non_ssh_root_session.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* Update rules/linux/command_and_control_connection_attempt_by_non_ssh_root_session.toml

* added additional tactic for privilege escalation and linted

* formatted query to be more readable

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
 2022-05-16 16:22:33 -05:00
Jonhnathan 27e6632ecd Update command_and_control_common_webservices.toml (#1970) 2022-05-16 14:04:26 -03:00
Terrance DeJesus 1704924f7b [New Rule] Abnormal Process ID File Creation (#1964) 
* adding rule detection

* changed Rule ID

* Update rules/linux/execution_abnormal_process_id_file_created.toml

Adding reboot extension as well.

Reference: https://exatrack.com/public/Tricephalic_Hellkeeper.pdf

* Update rules/linux/execution_abnormal_process_id_file_created.toml

Adding reboot to description.

Reference: https://exatrack.com/public/Tricephalic_Hellkeeper.pdf

* Update rules/linux/execution_abnormal_process_id_file_created.toml

Added additional reference to similar threat.

* Update rules/linux/execution_abnormal_process_id_file_created.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update rules/linux/execution_abnormal_process_id_file_created.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* added rule for a process starting where the executable's name represented a PID file

* Adjusted user.id value from integer to string

* Added simple investigation notes and osquery coverage

* TOML linting

* Updated date to reflect recent changes

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
 2022-05-12 10:38:27 -04:00
Samirbous 19ff825a91 [New rule] Remote Computer Account DnsHostName Update (#1962) 
* [New rule] Remote Computer Account DnsHostName Update

Identifies remote update to a computer account DnsHostName attribute, if the new value is set a valid domain controller DNS hostname and the subject computer name is not a domain controller then it's high likely a preparation step to exploit CVE-2022-26923 in an attempt to elevate privileges from a standard domain user to domain admin privileges :

* added MS ref url

* Update rules/windows/privilege_escalation_suspicious_dnshostname_update.toml

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>

* Update rules/windows/privilege_escalation_suspicious_dnshostname_update.toml

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>
 2022-05-11 19:40:34 +02:00
Terrance DeJesus 5f447a63a2 [New Rule] Executable Launched from Shared Memory Directory (#1961) 
* new rule to check for executables launched from shared memory directory

* added references and false positive instances

* Update rules/linux/execution_shared_memory_executable.toml

* Update rules/linux/execution_shared_memory_executable.toml

* Update rules/linux/execution_shared_memory_executable.toml

* adjusted process to account for var run and lock directories

* TOML lint and query formatting

* TOML lint and query formatting

* Update rules/linux/execution_process_started_in_shared_memory_directory.toml

* Update rules/linux/execution_process_started_in_shared_memory_directory.toml

* Update rules/linux/execution_process_started_in_shared_memory_directory.toml

* Update rules/linux/execution_process_started_in_shared_memory_directory.toml

* added BPFDoor tag to be threat specific

* TOML linting and adjusted risk because of root requirement

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
 2022-05-11 12:18:55 -04:00
Justin Ibarra c031bb501d [Rule tuning] SSH Authorized Keys File Modification (#1955) 2022-05-09 07:50:27 -08:00
Samirbous 03836d45fa [New Rule] Potential Local NTLM Relay via HTTP (#1947) 
* [New Rule] Potential Local NTLM Relay via HTTP

Detect attempt to elevate privileges via coercing a privileged service to connect to a local rogue HTTP endpoint, leading to NTLM relay, example of logs while testing https://github.com/med0x2e/NTLMRelay2Self (step 5):

* Update credential_access_relay_ntlm_auth_via_http_spoolss.toml

* Update credential_access_relay_ntlm_auth_via_http_spoolss.toml

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
 2022-05-06 21:07:27 +02:00
Terrance DeJesus e9f5585a9f [Rule Tuning] Update Rule Content Changes from Security Docs Team (#1945) 
* updated content to reflect changes from Security Docs team

* Update rules/linux/execution_flock_binary.toml

* Update rules/linux/execution_expect_binary.toml

* TOML linting

* added escape for crdential_access_spn_attribute_modified.toml
 2022-05-06 13:21:12 -04:00