security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
983 Commits 1 Branch 0 Tags
cfa5bafb79023d508ab317a0ff342cfe97be0c03
Commit Graph

733 Commits

Author SHA1 Message Date
Samirbous cfa5bafb79 [New Rule] Suspicious Remote Registry Access via SeBackupPrivilege (#1783) 
* [New Rule] Suspicious Remote Registry Access via SeBackupPrivilege

https://github.com/mpgn/BackupOperatorToDA
https://raw.githubusercontent.com/Wh04m1001/Random/main/BackupOperators.cpp

Detection mainly occurs on AD/DC side :
EQL

```
sequence by host.id, winlog.event_data.SubjectLogonId with maxspan=1m
 [iam where event.action == "logged-in-special"  and
  winlog.event_data.PrivilegeList : "SeBackupPrivilege"]
 [any where event.action == "Detailed File Share" and winlog.event_data.RelativeTargetName : "winreg"]
```

```
  "sequences" : [
      {
        "join_keys" : [
          "83989f29-8447-4b3c-a54b-4a0f7e5a4872",
          "0x2a23a5"
        ],
        "events" : [
          {
            "_index" : ".ds-logs-system.security-default-2022.02.11-000001",
            "_id" : "L68HAn8BQQK22TUvoE_k",
            "_source" : {
              "agent" : {
                "name" : "01566s-win16-ir",
                "id" : "0517bf72-e8ae-4f53-bc09-cdf3428aa683",
                "type" : "filebeat",
                "ephemeral_id" : "26383f4e-4412-4aa4-8ed4-7e729fb593e8",
                "version" : "8.0.0"
              },
              "winlog" : {
                "computer_name" : "01566s-win16-ir.threebeesco.com",
                "process" : {
                  "pid" : 624,
                  "thread" : {
                    "id" : 756
                  }
                },
                "keywords" : [
                  "Audit Success"
                ],
                "logon" : {
                  "id" : "0x2a23a5"
                },
                "channel" : "Security",
                "event_data" : {
                  "SubjectUserName" : "samir",
                  "SubjectDomainName" : "3B",
                  "SubjectLogonId" : "0x2a23a5",
                  "PrivilegeList" : [
                    "SeBackupPrivilege",
                    "SeRestorePrivilege"
                  ],
                  "SubjectUserSid" : "S-1-5-21-308926384-506822093-3341789130-220106"
                },
                "opcode" : "Info",
                "record_id" : "2987813",
                "task" : "Special Logon",
                "event_id" : "4672",
                "provider_guid" : "{54849625-5478-4994-A5BA-3E3B0328C30D}",
                "api" : "wineventlog",
                "provider_name" : "Microsoft-Windows-Security-Auditing"
              },
              "log" : {
                "level" : "information"
              },
              "elastic_agent" : {
                "id" : "0517bf72-e8ae-4f53-bc09-cdf3428aa683",
                "version" : "8.0.0",
                "snapshot" : false
              },
              "message" : """Special privileges assigned to new logon.

Subject:
	Security ID:		S-1-5-21-308926384-506822093-3341789130-220106
	Account Name:		samir
	Account Domain:		3B
	Logon ID:		0x2A23A5

Privileges:		SeBackupPrivilege
			SeRestorePrivilege""",
              "input" : {
                "type" : "winlog"
              },
              "@timestamp" : "2022-02-16T10:15:26.330Z",
              "ecs" : {
                "version" : "1.12.0"
              },
              "related" : {
                "user" : [
                  "samir"
                ]
              },
              "data_stream" : {
                "namespace" : "default",
                "type" : "logs",
                "dataset" : "system.security"
              },
              "host" : {
                "hostname" : "01566s-win16-ir",
                "os" : {
                  "build" : "14393.3659",
                  "kernel" : "10.0.14393.3659 (rs1_release_1.200410-1813)",
                  "name" : "Windows Server 2016 Datacenter",
                  "type" : "windows",
                  "family" : "windows",
                  "version" : "10.0",
                  "platform" : "windows"
                },
                "ip" : [
                  "172.16.66.36",
                  "fe80::ffff:ffff:fffe",
                  "fe80::5efe:ac10:4224"
                ],
                "name" : "01566s-win16-ir.threebeesco.com",
                "id" : "83989f29-8447-4b3c-a54b-4a0f7e5a4872",
                "mac" : [
                  "00:50:56:24:6c:d2",
                  "00:00:00:00:00:00:00:e0",
                  "00:00:00:00:00:00:00:e0"
                ],
                "architecture" : "x86_64"
              },
              "event" : {
                "agent_id_status" : "verified",
                "ingested" : "2022-02-16T10:15:28Z",
                "code" : "4672",
                "provider" : "Microsoft-Windows-Security-Auditing",
                "created" : "2022-02-16T10:15:27.675Z",
                "kind" : "event",
                "action" : "logged-in-special",
                "category" : [
                  "iam"
                ],
                "type" : [
                  "admin"
                ],
                "dataset" : "system.security",
                "outcome" : "success"
              },
              "user" : {
                "domain" : "3B",
                "name" : "samir",
                "id" : "S-1-5-21-308926384-506822093-3341789130-220106"
              }
            }
          },
          {
            "_index" : ".ds-logs-system.security-default-2022.02.11-000001",
            "_id" : "Mq8HAn8BQQK22TUvoE_k",
            "_source" : {
              "agent" : {
                "name" : "01566s-win16-ir",
                "id" : "0517bf72-e8ae-4f53-bc09-cdf3428aa683",
                "ephemeral_id" : "26383f4e-4412-4aa4-8ed4-7e729fb593e8",
                "type" : "filebeat",
                "version" : "8.0.0"
              },
              "winlog" : {
                "computer_name" : "01566s-win16-ir.threebeesco.com",
                "process" : {
                  "pid" : 4,
                  "thread" : {
                    "id" : 1176
                  }
                },
                "keywords" : [
                  "Audit Success"
                ],
                "logon" : {
                  "id" : "0x2a23a5"
                },
                "channel" : "Security",
                "event_data" : {
                  "ShareName" : """\\*\IPC$""",
                  "IpPort" : "50071",
                  "SubjectLogonId" : "0x2a23a5",
                  "AccessMask" : "0x12019f",
                  "ObjectType" : "File",
                  "SubjectUserName" : "samir",
                  "AccessReason" : "-",
                  "SubjectDomainName" : "3B",
                  "IpAddress" : "172.16.66.25",
                  "AccessMaskDescription" : [
                    "List Object",
                    "Read Property",
                    "Create Child",
                    "Control Access",
                    "Delete Child",
                    "List Contents",
                    "SELF",
                    "SYNCHRONIZE",
                    "READ_CONTROL"
                  ],
                  "RelativeTargetName" : "winreg",
                  "AccessList" : """%%1538
				%%1541
				%%4416
				%%4417
				%%4418
				%%4419
				%%4420
				%%4423
				%%4424
				""",
                  "SubjectUserSid" : "S-1-5-21-308926384-506822093-3341789130-220106"
                },
                "opcode" : "Info",
                "record_id" : "2987816",
                "event_id" : "5145",
                "task" : "Detailed File Share",
                "provider_guid" : "{54849625-5478-4994-A5BA-3E3B0328C30D}",
                "api" : "wineventlog",
                "provider_name" : "Microsoft-Windows-Security-Auditing"
              },
              "log" : {
                "level" : "information"
              },
              "elastic_agent" : {
                "id" : "0517bf72-e8ae-4f53-bc09-cdf3428aa683",
                "version" : "8.0.0",
                "snapshot" : false
              },
              "message" : """A network share object was checked to see whether client can be granted desired access.

Subject:
	Security ID:		S-1-5-21-308926384-506822093-3341789130-220106
	Account Name:		samir
	Account Domain:		3B
	Logon ID:		0x2A23A5

Network Information:
	Object Type:		File
	Source Address:		172.16.66.25
	Source Port:		50071

Share Information:
	Share Name:		\\*\IPC$
	Share Path:
	Relative Target Name:	winreg

Access Request Information:
	Access Mask:		0x12019F
	Accesses:		READ_CONTROL
				SYNCHRONIZE
				ReadData (or ListDirectory)
				WriteData (or AddFile)
				AppendData (or AddSubdirectory or CreatePipeInstance)
				ReadEA
				WriteEA
				ReadAttributes
				WriteAttributes

Access Check Results:
	-""",
              "input" : {
                "type" : "winlog"
              },
              "@timestamp" : "2022-02-16T10:15:26.336Z",
              "ecs" : {
                "version" : "1.12.0"
              },
              "data_stream" : {
                "namespace" : "default",
                "type" : "logs",
                "dataset" : "system.security"
              },
              "host" : {
                "hostname" : "01566s-win16-ir",
                "os" : {
                  "build" : "14393.3659",
                  "kernel" : "10.0.14393.3659 (rs1_release_1.200410-1813)",
                  "name" : "Windows Server 2016 Datacenter",
                  "family" : "windows",
                  "type" : "windows",
                  "version" : "10.0",
                  "platform" : "windows"
                },
                "ip" : [
                  "172.16.66.36",
                  "fe80::ffff:ffff:fffe",
                  "fe80::5efe:ac10:4224"
                ],
                "name" : "01566s-win16-ir.threebeesco.com",
                "id" : "83989f29-8447-4b3c-a54b-4a0f7e5a4872",
                "mac" : [
                  "00:50:56:24:6c:d2",
                  "00:00:00:00:00:00:00:e0",
                  "00:00:00:00:00:00:00:e0"
                ],
                "architecture" : "x86_64"
              },
              "event" : {
                "agent_id_status" : "verified",
                "ingested" : "2022-02-16T10:15:28Z",
                "code" : "5145",
                "provider" : "Microsoft-Windows-Security-Auditing",
                "kind" : "event",
                "created" : "2022-02-16T10:15:27.675Z",
                "action" : "Detailed File Share",
                "dataset" : "system.security",
                "outcome" : "success"
              }
            }
          }
        ]
      },
```

* Update non-ecs-schema.json

* Update rules/windows/credential_access_suspicious_winreg_access_via_sebackup_priv.toml

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>

(cherry picked from commit c254d0de8b)
 2022-03-23 18:44:44 +00:00
Justin Ibarra 5bc3d1e2d5 [New Rule] Okta User Session Impersonation (#1867) 
* [New Rule] Okta User Session Impersonation
Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>

(cherry picked from commit 46c2383e5b)
 2022-03-23 00:13:53 +00:00
Stijn Holzhauer 99597a2ed2 [Rule Tuning] Adding event.provider to AWS WAF Rule or Rule Group Deletion (#1833) 
* Adding event.provider

* Removing new line

* Updating updated_date field

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>

(cherry picked from commit 2ed97d2e8c)
 2022-03-22 23:40:22 +00:00
shashank-elastic bbf92cec94 crash shell evasion threat (#1861) 
(cherry picked from commit 22367d3702)
 2022-03-22 13:20:12 +00:00
shashank-elastic d4c426a022 [New Rule] cpulimit shell evasion threat (#1851) 
* cpulimit shell evasion threat

* Update rules/linux/execution_cpulimit_binary.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update rules/linux/execution_cpulimit_binary.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

(cherry picked from commit 2ab5a1f44a)
 2022-03-21 17:20:00 +00:00
Terrance DeJesus d26759d5a8 [Rule Tuning] Symbolic Link to Shadow Copy Created (#1830) 
* fixed duplicated file name

* deprecated Symbolic Link to Shadow Copy Created as it may be prone to FP and the intrusion steps are covered with NTDS or SAM Database File Copied

* moved rule back to production, added investigation notes and sequencing to EQL query

* added related rule 3bc6deaa-fbd4-433a-ae21-3e892f95624f to investigation notes

* updating with minor changes

* adjusted related rules

* adjusted investigation notes

* Update rules/windows/credential_access_symbolic_link_to_shadow_copy_created.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* Update rules/windows/credential_access_symbolic_link_to_shadow_copy_created.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* Update rules/windows/credential_access_symbolic_link_to_shadow_copy_created.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* TOML linted and adjusted updated date

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

(cherry picked from commit 096723b2a1)
 2022-03-18 15:11:05 +00:00
shashank-elastic b7d064d210 Updation of Mitre Tactic and Threats (#1850) 
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>

(cherry picked from commit 7feebc2c10)
 2022-03-18 09:38:46 +00:00
Jonhnathan 18532b8468 Deprecate PrintNightmare Rules (#1852) 
(cherry picked from commit 22dd7f0ada)
 2022-03-17 22:41:59 +00:00
Jonhnathan 185b23e169 Update defense_evasion_posh_process_injection.toml (#1838) 
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>

(cherry picked from commit a6edb7cfcf)
 2022-03-17 22:39:54 +00:00
shashank-elastic 174add51cc [New Rule] busybox shell evasion threat (#1842) 
* busybox shell evasion threat

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>

(cherry picked from commit b492258fb0)
 2022-03-17 04:26:58 +00:00
Jonhnathan 8183b33240 Update persistence_user_account_added_to_privileged_group_ad.toml (#1845) 
(cherry picked from commit e0f8f61ca0)
 2022-03-16 16:32:22 +00:00
Jonhnathan 1b5720caa5 Update defense_evasion_microsoft_defender_tampering.toml (#1837) 
(cherry picked from commit b5f06f455c)
 2022-03-14 23:10:00 +00:00
Jonhnathan 944357ffd6 [New Rule] AdminSDHolder SDProp Exclusion Added (#1795) 
* AdminSDHolder SDProp Exclusion Added Initial Rule

* Update persistence_sdprop_exclusion_dsheuristics.toml

* Update rules/windows/persistence_sdprop_exclusion_dsheuristics.toml

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

(cherry picked from commit 53fbc50ea1)
 2022-03-10 17:19:47 +00:00
shashank-elastic b2a6abf831 gcc shell evasion threat (#1824) 
(cherry picked from commit c05f3c8aa3)
 2022-03-10 17:14:14 +00:00
shashank-elastic 632d7015b6 ssh shell evasion threat (#1827) 
(cherry picked from commit b49cce9fcb)
 2022-03-10 17:11:52 +00:00
shashank-elastic 9e91249421 mysql shell evasion threat (#1823) 
(cherry picked from commit ddbc1de45c)
 2022-03-10 17:09:25 +00:00
shashank-elastic 41c915c42e expect shell evasion threat (#1817) 
* expect shell evasion threat

* expect shell evasion threat

* Update rules/linux/defense_evasion_expect_binary.toml

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>

(cherry picked from commit 334aa12aaf)
 2022-03-07 20:26:43 +00:00
shashank-elastic 4cf4a66a4b nice shell evasion threat (#1820) 
* nice shell evasion threat

* Update rules/linux/defense_evasion_nice_binary.toml

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>

(cherry picked from commit 2b6a357a4b)
 2022-03-07 20:02:05 +00:00
shashank-elastic aaf1ab6bb2 [Rule Tuning] Rule description updates (#1811) 
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>

(cherry picked from commit f9503f2096)
 2022-03-07 14:06:37 +00:00
shashank-elastic c4fea2fc00 [New Rule] Linux Restricted Shell Breakout via the Vi command (#1809) 
* new:rule:issue-1808 vi shell evasion threat

* Update rules/linux/defense_evasion_vi_binary.toml

* Update rules/linux/defense_evasion_vi_binary.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* new:rule:issue-1808 vi shell evasion threat

* new:rule:issue-1808 vi shell evasion threat

* new:rule:issue-1808 vi shell evasion threat

* Update rules/linux/defense_evasion_vi_binary.toml

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

(cherry picked from commit 2a82f18e43)
 2022-03-04 19:48:40 +00:00
Samirbous ad2c069baa [New Rule] Potential Remote Credential Access via Registry (#1804) 
* [New Rule] Potential Remote Credential Access via Registry

4624 logon followed by hive file creation by regsvc svchost.exe by same user.name and host.id. This matches on secretdsdump and other similar implementations. require to correlation Elastic endpoint file events with System integration logs (4624).

Example of data :

* Delete workspace.xml

* Update credential_access_remote_sam_secretsdump.toml

* Update credential_access_remote_sam_secretsdump.toml

* add non ecs field

* Update non-ecs-schema.json

* Update credential_access_remote_sam_secretsdump.toml

* Update rules/windows/credential_access_remote_sam_secretsdump.toml

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>

* Update rules/windows/credential_access_remote_sam_secretsdump.toml

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>

* Update rules/windows/credential_access_remote_sam_secretsdump.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

(cherry picked from commit a6582351b5)
 2022-03-03 15:31:20 +00:00
Terrance DeJesus a1e28ef4ff [New Rule] Execution control.exe via WorkFolders.exe (#1806) 
* added detection rule defense_evasion_workfolders_control_execution.toml related to issue #1586

* updated rule authors

* added references to the rule

* added timestamp override variable to the rule

* adjusted value of timestamp override from event_ingested to event.ingested

* Update rules/windows/defense_evasion_workfolders_control_execution.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* Update rules/windows/defense_evasion_workfolders_control_execution.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* Update rules/windows/defense_evasion_workfolders_control_execution.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* Update rules/windows/defense_evasion_workfolders_control_execution.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* Update rules/windows/defense_evasion_workfolders_control_execution.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update rules/windows/defense_evasion_workfolders_control_execution.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* linted toml file as suggested

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

(cherry picked from commit 202b9c7479)
 2022-03-03 14:24:27 +00:00
Jonhnathan 82331f05d1 [Rule Tuning] Update PowerShell script_block queries to avoid partial matches (#1807) 
* Update script_block queries

* Update execution_posh_psreflect.toml

(cherry picked from commit 5c477849fe)
 2022-03-03 10:39:59 +00:00
shashank-elastic 7bfd5622f3 find shell evasion threat(#1801) 
* new:rule:issue-1800 Adding new rule for find shell evasion

* new:rule:issue-1800 Adding new rule for find shell evasion

* new:rule:issue-1800 Adding new rule for find shell evasion

* Update rules/linux/privilege_escalation_find_binary.toml

* Update rules/linux/privilege_escalation_find_binary.toml

* new:rule:issue-1800 Adding Mittre Attack Techniques

* Update rules/linux/privilege_escalation_find_binary.toml

* Update rules/linux/privilege_escalation_find_binary.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update rules/linux/privilege_escalation_find_binary.toml

* Update rules/linux/privilege_escalation_find_binary.toml

* Update rules/linux/privilege_escalation_find_binary.toml

* Update rules/linux/privilege_escalation_find_binary.toml

* new:rule:issue-1800 Review Comments

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

(cherry picked from commit 283cbca702)
 2022-03-02 16:32:49 +00:00
shashank-elastic 139d56ee86 apt binary shell evasion threat (#1792) 
* new:rule:issue-1782 Adding a new Rule for apt binary shell evasion threat

* new:rule:issue-1782 Review Comments

* Update rules/linux/apt_binary_shell_evasion.toml

* new:rule:issue-1782 Adding Mittre Attack Techniques

* new:rule:issue-1782 Adding Mittre Attack Techniques

* new:rule:issue-1782 Adding Mittre Attack Techniques

* new:rule:issue-1782 Adding Mittre Attack Techniques

* new:rule:issue-1782 Adding Mittre Attack Techniques

* Update rules/linux/privilege_escalation_apt_binary.toml

* Update rules/linux/privilege_escalation_apt_binary.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update rules/linux/privilege_escalation_apt_binary.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update rules/linux/privilege_escalation_apt_binary.toml

* Update rules/linux/privilege_escalation_apt_binary.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* Update rules/linux/privilege_escalation_apt_binary.toml

* Update rules/linux/privilege_escalation_apt_binary.toml

* Update rules/linux/privilege_escalation_apt_binary.toml

* Update rules/linux/privilege_escalation_apt_binary.toml

* Update rules/linux/privilege_escalation_apt_binary.toml

* new:rule:issue-1782 Review Comments

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

(cherry picked from commit c9dd047966)
 2022-03-02 16:30:22 +00:00
shashank-elastic a645bc7bbb awk binary shell evasion threat (#1794) 
* new:rule:issue-1785 Adding a new Rule for awk binary shell evasion threat

* Update rules/linux/awk_binary_shell_evasion.toml

* Update rules/linux/awk_binary_shell_evasion.toml

* new:rule:issue-1785 Adding Mittre Attack Techniques

* new:rule:issue-1785 Adding Mittre Attack Techniques

* new:rule:issue-1785 Adding Mittre Attack Techniques

* Update rules/linux/privilege_escalation_awk_binary_shell.toml

* Update rules/linux/privilege_escalation_awk_binary_shell.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update rules/linux/privilege_escalation_awk_binary_shell.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* Update rules/linux/privilege_escalation_awk_binary_shell.toml

* Update rules/linux/privilege_escalation_awk_binary_shell.toml

* Update rules/linux/privilege_escalation_awk_binary_shell.toml

* Update rules/linux/privilege_escalation_awk_binary_shell.toml

* Update rules/linux/privilege_escalation_awk_binary_shell.toml

* new:rule:issue-1785 Review Comments

* new:rule:issue-1785 Review Comments

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

(cherry picked from commit e004a2f4a5)
 2022-03-02 16:26:37 +00:00
shashank-elastic 56997556f5 env binary shell evasion threat (#1793) 
* new:rule:issue-1786 Adding a new Rule for env binary shell evasion threat

* new:rule:issue-1786 Adding a new Rule for env binary shell evasion threat

* Update rules/linux/env_binary_shell_evasion.toml

* Update rules/linux/env_binary_shell_evasion.toml

* new:rule:issue-1786 Adding Mittre Attack Techniques

* new:rule:issue-1786 Adding Mittre Attack Techniques

* new:rule:issue-1786 Adding Mittre Attack Techniques

* new:rule:issue-1786 Adding Mittre Attack Techniques

* new:rule:issue-1786 Adding Mittre Attack Techniques

* Update rules/linux/privilege_escalation_env_binary.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* Update rules/linux/privilege_escalation_env_binary.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update rules/linux/privilege_escalation_env_binary.toml

* Update rules/linux/privilege_escalation_env_binary.toml

* new:rule:issue-1786 Review Comments

* Update rules/linux/defense_evasion_env_binary.toml

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

(cherry picked from commit 758784d4d5)
 2022-03-02 16:19:45 +00:00
Samirbous 36369ebf96 [New Rule] Registry Hive File Creation via SMB (#1779) 
* [New Rule] Registry Hive File Creation via SMB

Identifies the creation or modification of a medium size registry hive file via the SMB protocol :

* Update credential_access_moving_registry_hive_via_smb.toml

* Update etc/non-ecs-schema.json

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

(cherry picked from commit f48144c6b3)
 2022-03-02 09:14:52 +00:00
Jonhnathan 31f75bd7e6 Update impact_azure_service_principal_credentials_added.toml (#1802) 
(cherry picked from commit 8a9b52f7e1)
 2022-03-02 08:38:49 +00:00
Jonhnathan 73b3bec457 [Security Content] Update rules based on docs review (#1803) 
* Adds suggestions from security-docs

* Update rules/windows/lateral_movement_powershell_remoting_target.toml

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

(cherry picked from commit 1c50f35aed)
 2022-03-02 00:41:56 +00:00
Mika Ayenson aab23636e8 [New Rule] LSASS Memory Dump (#1784) 
* Add new event_data fields (ObjectName, ProcessName)

* Add detection for LSASS Memory Dump Handle Access

* Reference an example of 120089 AccessMask presence

* modify query to increase performance and update the description to remove ("This rule").

* expand path to Elastic Agent ensure syntax consistency

* Optimize rule based on AccessMaskDescription and additional False Positives.

* add AccessMaskDescription keyword and rule tune to make sure AccessMask is used

* filter dllhost.exe and or the condition between AccessMask and AccessMaskDescription

* cleanup

(cherry picked from commit aa7d79cc53)
 2022-02-24 13:16:42 +00:00
Jonhnathan 99c559f870 Update persistence_azure_conditional_access_policy_modified.toml (#1788) 
(cherry picked from commit 8664ef59f4)
 2022-02-22 18:29:00 +00:00
Jonhnathan 678f7cb93c [Rule Tuning] Update rules based on docs review (#1778) 
* Update rules based on docs review

* trivial change to trigger CLA

* undo changes from triggering build

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

(cherry picked from commit dec4243db0)
 2022-02-16 16:44:51 +00:00
Jonhnathan f571eb970d [Rule Tuning] Remove Windows Integration & Winlogbeat Support - User.id (#1773) 
* Remove Windows Integration & Winlogbeat Support

* Update lateral_movement_service_control_spawned_script_int.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

(cherry picked from commit 3227d65cd8)
 2022-02-16 02:07:27 +00:00
Jonhnathan cd59ed785a [Rule Tuning] Potential Command and Control via Internet Explorer (#1771) 
* Use user.name on the sequence instead of user.id

* Update command_and_control_iexplore_via_com.toml

* Remove min_stack and comment "with runs"

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

(cherry picked from commit 03f60cc11c)
 2022-02-16 02:00:28 +00:00
Jonhnathan ef78093d88 [New Rule] Potential Credential Access via DCSync (#1763) 
* "Potential Credential Access via DCSync" Initial Rule

* replace unintentional bracket removal

* json

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

(cherry picked from commit 42436d3364)
 2022-02-16 00:42:49 +00:00
Jonhnathan 9885be0f59 Modified to use Integrity fields instead of user.id (#1772) 
(cherry picked from commit fd678dc5cb)
 2022-02-16 00:25:10 +00:00
Jonhnathan fd3d2708a1 [Rule Tuning] Sysmon Registry-based Rules Review & Fixes (#1775) 
* Initial Review of Sysmon Registry Rules

* Update defense_evasion_sip_provider_mod.toml

(cherry picked from commit 9bbe26fec0)
 2022-02-15 12:59:15 +00:00
Jonhnathan 3b97ee423b Update discovery_net_command_system_account.toml (#1769) 
(cherry picked from commit c646a18efb)
 2022-02-14 15:13:55 +00:00
Samirbous fbcc7433ad [New Rule] Windows Service Installed via an Unusual Client (#1759) 
* [New Rule] Windows Service Installed via an Unusual Client

https://www.x86matthew.com/view_post?id=create_svc_rpc

* Update non-ecs-schema.json

* Update rules/windows/privilege_escalation_windows_service_via_unusual_client.toml

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>

* Update rules/windows/privilege_escalation_windows_service_via_unusual_client.toml

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>

* Add ```s

* Update privilege_escalation_windows_service_via_unusual_client.toml

* add missing comma to schema

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

(cherry picked from commit 326aa64ff6)
 2022-02-11 20:59:20 +00:00
Jonhnathan c59429719d Modification of AmsiEnable Registry Key - Sysmon support (#1760) 
(cherry picked from commit 9c56b00429)
 2022-02-11 20:51:51 +00:00
Jonhnathan 782b6c1d0e Update impact_volume_shadow_copy_deletion_or_resized_via_vssadmin.toml (#1757) 
(cherry picked from commit aa9fedd18d)
 2022-02-11 17:18:12 +00:00
Khristinin Nikita 4fe57055a0 [Rule Tuning] Fix IM query (#1767) 
* Fix IM quer

* Add update date

(cherry picked from commit b1121da237)
 2022-02-10 18:32:37 +00:00
Jonhnathan 6b1b8587e1 [Documentation] Fix O365 Integration name on Rules and Unit Test (#1684) 
* Adjust Integration Name

* Update defense_evasion_microsoft_365_mailboxauditbypassassociation.toml

* Update integration name

* .

* Case

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

(cherry picked from commit 5a16a222ad)
 2022-02-09 22:06:05 +00:00
Justin Ibarra b4863ddde5 Move misplaced rule to proper folder (#1756) 
Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>

(cherry picked from commit 97835bc5c5)
 2022-02-04 20:38:01 +00:00
Jonhnathan 2fe12168bc [New Rule] Potential Shadow Credentials added to AD Object (#1729) 
* Potential Shadow Credentials added to AD Object Initial Rule

* Apply suggestions from code review

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update credential_access_shadow_credentials.toml

* Add AD tag

* Update credential_access_shadow_credentials.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

(cherry picked from commit 85b72256c2)
 2022-02-04 18:51:25 +00:00
Jonhnathan df2a844584 [New Rule] PowerShell Script Block Logging Disabled (#1749) 
* PowerShell Script Block Logging Disabled

* Update rules/windows/defense_evasion_disable_posh_scriptblocklogging.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* Update defense_evasion_disable_posh_scriptblocklogging.toml

* Apply suggestions from code review

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

(cherry picked from commit 7dac52f1cf)
 2022-02-04 18:46:55 +00:00
Jonhnathan 7e25f14766 Update credential_access_mod_wdigest_security_provider.toml (#1751) 
(cherry picked from commit 40095d95bf)
 2022-02-04 18:40:39 +00:00
Jonhnathan 6ed9769eb6 [New Rule] AdminSDHolder Backdoor (#1745) 
* AdminSDHolder Backdoor

* Update rules/windows/persistence_ad_adminsdholder.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

(cherry picked from commit 9ce5d0b92a)
 2022-02-01 13:17:28 +00:00
Jonhnathan 58e0584e73 [New Rule] KRBTGT Delegation Backdoor (#1743) 
* KRBTGT Delegation Backdoor

* Update persistence_msds_alloweddelegateto_krbtgt.toml

* Update non-ecs-schema.json

* Update rules/windows/persistence_msds_alloweddelegateto_krbtgt.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* refresh rule_id with new uuid

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

(cherry picked from commit d949fefe0c)
 2022-02-01 13:11:57 +00:00