6e2d20362a
[Rule Tuning] Standardizing Risk Score according to Severity ( #2242 )
2022-08-21 22:29:39 -03:00
d3420e3386
[Deprecate Rule] Suspicious Process from Conhost ( #2222 )
...
only FPs with no way to tune other than opening the rule for easy evasion by excluding by process.executable/args).
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com >
2022-08-16 16:32:24 +02:00
8e0ae64a04
[Rule Tuning] Whoami Process Activity ( #2224 )
...
* added Whoami Process Activity
* Update discovery_whoami_command_activity.toml
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com >
2022-08-16 16:26:10 +02:00
0f7b29918c
[Rule Tuning] Suspicious Execution via Scheduled Task ( #2235 )
...
Excluding`?:\\ProgramData` and few other noisy FP pattern by process.args + name to reduce users alert fatigue.
2022-08-15 21:50:23 +02:00
b89d6185b2
[Rule Tuning] Reduce FPs ( #2223 )
...
9 rules tuned to exclude common noisy FP patterns.
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com >
2022-08-15 09:15:48 -05:00
fc7a384d19
[Security Content] 8.4 - Add Investigation Guides - Windows - 2 ( #2144 )
...
* [Security Content] 8.4 - Add Investigation Guides - Windows - 2
* update date
* Apply suggestions from review
* Apply suggestions from code review
Co-authored-by: Joe Peeples <joe.peeples@elastic.co >
Co-authored-by: Joe Peeples <joe.peeples@elastic.co >
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com >
2022-08-08 21:34:05 -03:00
b043695833
Remove ambiguity from impact_modification_of_boot_config.toml ( #2199 )
...
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com >
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com >
Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com >
2022-08-05 10:38:41 -03:00
50bb821708
[Rules Tuning] Add support for Sysmon ImageLoad Events ( #2215 )
...
* [Rules Tuning] Add support for Sysmon ImageLoad Events
added correct event.category and event.action to rules using library events to support sysmon eventid 7.
`event.category == "library"` --> `(event.category == "process" and event.action : "Image loaded*")`
`dll.name` --> `file.name`
* added Suspicious RDP ActiveX Client Loaded
* Delete workspace.xml
2022-08-02 18:40:26 +02:00
b15f0de9a4
[Rules Tuning] Diverse Windows Rules - FPs reduction ( #2213 )
...
* [Rules Tuning] 7 diverse Windows rules
Excluding FP patterns while avoiding breaking compat with winlogbeat and 4688 events lack of codesign metadata.
* Update initial_access_suspicious_ms_exchange_process.toml
* Update privilege_escalation_persistence_phantom_dll.toml
* Update execution_psexec_lateral_movement_command.toml
* Update persistence_remote_password_reset.toml
* Update non-ecs-schema.json
* Update persistence_remote_password_reset.toml
* Update non-ecs-schema.json
* Update discovery_privileged_localgroup_membership.toml
2022-08-02 18:37:07 +02:00
a046dc0d29
[Deprecate rule] Whitespace Padding in Process Command Line ( #2218 )
...
very noisy and will require frequent tuning with very low TP rate.
2022-08-02 18:30:57 +02:00
e5ee8e024f
[Deprecate Rule] File and Directory Discovery ( #2217 )
...
* [Deprecate Rule] File and Directory Discovery
very noisy and most if not all are FPs, few rooms for tuning without rendering the rule easy to bypass.
* Delete workspace.xml
2022-08-02 17:57:28 +02:00
04dcf09c03
[Rule Tuning] Suspicious Process Creation CallTrace ( #2207 )
...
Excluding some FPs by process.parent.executable and process.parent.args.
2022-08-01 19:00:13 +02:00
1f21c5c57f
[Rule Tuning] Unusual Service Host Child Process - Childless Service ( #2208 )
...
Excluding some noisy unique processes.
2022-08-01 18:40:45 +02:00
8d34416049
[Deprecated Rule] Potential Privilege Escalation via Local Kerberos R… ( #2209 )
...
* [Deprecated Rule] Potential Privilege Escalation via Local Kerberos Relay over LDAP
FPs in certain cases with no room for tuning.
* Update privilege_escalation_krbrelayup_suspicious_logon.toml
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com >
2022-08-01 18:28:26 +02:00
a22fef8723
[Rule Tuning] Suspicious Process Access via Direct System Call ( #2204 )
...
Excluding some FPs by calltrace.
2022-08-01 18:16:08 +02:00
6f69695820
[Rule Tuning] Remotely Started Services via RPC ( #2211 )
...
* [Rule Tuning] Remotely Started Services via RPC
excluding noisy FPs by process.executable to be compatible with winlog and endpoint
* Update lateral_movement_remote_services.toml
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com >
2022-08-01 18:11:11 +02:00
91896db453
[Rule Tuning] Process Termination followed by Deletion ( #2206 )
...
Excluded some FPs by process.executable and file.path.
2022-08-01 18:01:31 +02:00
049fbf7979
[Rule Tuning] Potential Remote Credential Access via Registry ( #2203 )
...
* [Rule Tuning] Potential Remote Credential Access via Registry
Excluding some noisy FPs by file.path (user and machine hives std paths) and event.action (scoped to logged-in)
* Update credential_access_remote_sam_secretsdump.toml
2022-08-01 17:49:39 +02:00
527507835f
[Rule Tuning] Kerberos Traffic from Unusual Process ( #2202 )
...
Excluding couple of FPs by process.executables to reduce FPs rate.
2022-07-29 22:27:59 +02:00
386a8202c0
[Rule Tuning] Persistence via Update Orchestrator Service Hijack ( #2195 )
...
* [Rule Tuning] Persistence via Update Orchestrator Service Hijack
I changed the query to exclude FPs for safe executables found in telemetry: MoUsoCoreWorker.exe and OfficeC2RClient.exe. Changed the query type to KQL to account for the wildcard needed to capture 2 of the executable paths found in telemetry. I'm open to changing back to eql with suggestions.
* Update persistence_via_update_orchestrator_service_hijack.toml
revert back to eql
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com >
2022-07-29 16:11:16 -04:00
6d61a68c29
[Rule Tuning] Modification of WDigest Security Provider ( #2201 )
...
excluding svchost.exe running as system (main src of FPs for this use case).
2022-07-29 19:45:33 +02:00
e8c39d19a7
[Rule Tuning] Missing MITRE ATT&CK Mappings ( #2073 )
...
* initial commit with eggshell mitre mapping added
* adding updated rules
* [Rule Tuning] MITRE for GCP rules
I've added Mitre references for the 4 GCP rules missing. Changed 3 of the rules from "Impact" to "Defense Evasion" based on the technique used and it's matched tactic.
* [Rule Tuning] Endgame Rule name updates for Mitre
Updated Endgame rule names for those with Mitre tactics to match the tactics.
* Update rules/integrations/aws/persistence_redshift_instance_creation.toml
Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com >
* Update rules/integrations/aws/exfiltration_rds_snapshot_restored.toml
Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com >
* adding 10 updated rules for google_workspace, ml and o365
* adding 22 rule updates for mitre att&ck mappings
* adding 24 rule updates related mainly to ML rules
* adding 3 rules related to detection via ML
* adding adjustments
* adding adjustments with solutions to recent pytest errors
* removed tabs from tags
* adjusted mappings and added techniques
* adjusted endgame rule mappings per review
* adjusted names to match different tactics
* added execution and defense evasion tag
* adjustments to address errors from merging with main
* added newlines to rules missing them at the end of the file
Co-authored-by: imays11 <59296946+imays11@users.noreply.github.com >
Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com >
2022-07-22 14:30:34 -04:00
d312f49117
[New Rule] Suspicious HTML File Creation ( #2068 )
...
* [New Rule] Suspicious HTML File Creation
* Update initial_access_evasion_suspicious_htm_file_creation.toml
* Update non-ecs-schema.json
* Update initial_access_evasion_suspicious_htm_file_creation.toml
* Update rules/windows/initial_access_evasion_suspicious_htm_file_creation.toml
Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com >
2022-07-22 16:21:53 +02:00
d854b943e5
[Security Content] Add Investigation Guides to Cloud Rules - AWS ( #2104 )
...
* [Security Content] Add Investigation Guides to Cloud Rules - AWS
* Apply suggestion from review
* Update rules/integrations/aws/exfiltration_ec2_snapshot_change_activity.toml
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com >
* Update rules/integrations/aws/impact_cloudwatch_log_stream_deletion.toml
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com >
* Apply suggestions from review
* Apply suggestions from code review
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com >
* Apply suggestions from code review
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com >
* .
* Applies suggestions from the https://github.com/elastic/detection-rules/pull/2124 PR
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com >
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com >
2022-07-20 12:28:58 -03:00
59736e3973
[New Rule] Suspicious LSASS Access via MalSecLogon ( #2063 )
...
* [New Rule]
Identifies suspicious access to LSASS handle from a call trace pointing to seclogon.dll and with a suspicious access rights value, this may indicate an attempt to leak an Lsass handle via abusing the Secondary Logon service in preparation for credential access.
https://splintercod3.blogspot.com/p/the-hidden-side-of-seclogon-part-3.html
Data:
```
{
"_index": ".ds-logs-windows.sysmon_operational-default-2022.06.16-000005",
"_id": "QxU4rIEBTJjT82fLq8Cf",
"_score": 1,
"_source": {
"agent": {
"name": "02694w-win10",
"id": "85e87161-ea22-4847-a978-fb4ed45ebf0e",
"type": "filebeat",
"ephemeral_id": "137d194a-e542-4cd6-a1e3-f4ca9f5ad6b8",
"version": "8.0.0"
},
"process": {
"name": "svchost.exe",
"pid": 456,
"thread": {
"id": 15264
},
"entity_id": "{6a3c3ef2-3646-62ab-1300-00000000d300}",
"executable": "C:\\WINDOWS\\system32\\svchost.exe"
},
"winlog": {
"computer_name": "02694w-win10.threebeesco.com",
"process": {
"pid": 2680,
"thread": {
"id": 3988
}
},
"channel": "Microsoft-Windows-Sysmon/Operational",
"event_data": {
"GrantedAccess": "0x14c0",
"TargetProcessId": "680",
"SourceUser": "NT AUTHORITY\\SYSTEM",
"TargetImage": "C:\\WINDOWS\\system32\\lsass.exe",
"CallTrace": "C:\\WINDOWS\\SYSTEM32\\ntdll.dll+9c534|C:\\WINDOWS\\System32\\KERNELBASE.dll+2726e|c:\\windows\\system32\\seclogon.dll+128f|c:\\windows\\system32\\seclogon.dll+10a0|C:\\WINDOWS\\System32\\RPCRT4.dll+76953|C:\\WINDOWS\\System32\\RPCRT4.dll+da036|C:\\WINDOWS\\System32\\RPCRT4.dll+37a4c|C:\\WINDOWS\\System32\\RPCRT4.dll+548c8|C:\\WINDOWS\\System32\\RPCRT4.dll+2c921|C:\\WINDOWS\\System32\\RPCRT4.dll+2c1db|C:\\WINDOWS\\System32\\RPCRT4.dll+1a86f|C:\\WINDOWS\\System32\\RPCRT4.dll+19d1a|C:\\WINDOWS\\System32\\RPCRT4.dll+19301|C:\\WINDOWS\\System32\\RPCRT4.dll+18d6e|C:\\WINDOWS\\System32\\RPCRT4.dll+169a5|C:\\WINDOWS\\SYSTEM32\\ntdll.dll+333ed|C:\\WINDOWS\\SYSTEM32\\ntdll.dll+34142|C:\\WINDOWS\\System32\\KERNEL32.DLL+17bd4|C:\\WINDOWS\\SYSTEM32\\ntdll.dll+6ce51",
"TargetProcessGUID": "{6a3c3ef2-3646-62ab-0c00-00000000d300}",
"TargetUser": "NT AUTHORITY\\SYSTEM"
},
"opcode": "Info",
"version": 3,
"record_id": "1825496",
"task": "Process accessed (rule: ProcessAccess)",
"event_id": "10",
"provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
"api": "wineventlog",
"provider_name": "Microsoft-Windows-Sysmon",
"user": {
"identifier": "S-1-5-18",
"domain": "NT AUTHORITY",
"name": "SYSTEM",
"type": "User"
}
},
"log": {
"level": "information"
},
"elastic_agent": {
"id": "85e87161-ea22-4847-a978-fb4ed45ebf0e",
"version": "8.0.0",
"snapshot": false
},
"message": "Process accessed:\nRuleName: -\nUtcTime: 2022-06-28 21:29:49.829\nSourceProcessGUID: {6a3c3ef2-3646-62ab-1300-00000000d300}\nSourceProcessId: 456\nSourceThreadId: 15264\nSourceImage: C:\\WINDOWS\\system32\\svchost.exe\nTargetProcessGUID: {6a3c3ef2-3646-62ab-0c00-00000000d300}\nTargetProcessId: 680\nTargetImage: C:\\WINDOWS\\system32\\lsass.exe\nGrantedAccess: 0x14C0\nCallTrace: C:\\WINDOWS\\SYSTEM32\\ntdll.dll+9c534|C:\\WINDOWS\\System32\\KERNELBASE.dll+2726e|c:\\windows\\system32\\seclogon.dll+128f|c:\\windows\\system32\\seclogon.dll+10a0|C:\\WINDOWS\\System32\\RPCRT4.dll+76953|C:\\WINDOWS\\System32\\RPCRT4.dll+da036|C:\\WINDOWS\\System32\\RPCRT4.dll+37a4c|C:\\WINDOWS\\System32\\RPCRT4.dll+548c8|C:\\WINDOWS\\System32\\RPCRT4.dll+2c921|C:\\WINDOWS\\System32\\RPCRT4.dll+2c1db|C:\\WINDOWS\\System32\\RPCRT4.dll+1a86f|C:\\WINDOWS\\System32\\RPCRT4.dll+19d1a|C:\\WINDOWS\\System32\\RPCRT4.dll+19301|C:\\WINDOWS\\System32\\RPCRT4.dll+18d6e|C:\\WINDOWS\\System32\\RPCRT4.dll+169a5|C:\\WINDOWS\\SYSTEM32\\ntdll.dll+333ed|C:\\WINDOWS\\SYSTEM32\\ntdll.dll+34142|C:\\WINDOWS\\System32\\KERNEL32.DLL+17bd4|C:\\WINDOWS\\SYSTEM32\\ntdll.dll+6ce51\nSourceUser: NT AUTHORITY\\SYSTEM\nTargetUser: NT AUTHORITY\\SYSTEM",
"input": {
"type": "winlog"
},
"@timestamp": "2022-06-28T21:29:49.829Z",
"ecs": {
"version": "1.12.0"
},
"data_stream": {
"namespace": "default",
"type": "logs",
"dataset": "windows.sysmon_operational"
},
"host": {
"hostname": "02694w-win10",
"os": {
"build": "18363.815",
"kernel": "10.0.18362.815 (WinBuild.160101.0800)",
"name": "Windows 10 Enterprise",
"type": "windows",
"family": "windows",
"version": "10.0",
"platform": "windows"
},
"ip": [
"fe80::7587:a5c1:5a7b:68f6",
"172.16.66.25"
],
"name": "02694w-win10.threebeesco.com",
"id": "6a3c3ef2-208f-4d6f-90ee-b34f4e3fd160",
"mac": [
"00:50:56:03:c6:93"
],
"architecture": "x86_64"
},
"event": {
"agent_id_status": "verified",
"ingested": "2022-06-28T21:30:04Z",
"code": "10",
"provider": "Microsoft-Windows-Sysmon",
"created": "2022-06-28T21:29:51.107Z",
"kind": "event",
"action": "Process accessed (rule: ProcessAccess)",
"category": [
"process"
],
"type": [
"access"
],
"dataset": "windows.sysmon_operational"
},
"user": {
"id": "S-1-5-18"
}
},
"fields": {
"elastic_agent.version": [
"8.0.0"
],
"event.category": [
"process"
],
"host.os.name.text": [
"Windows 10 Enterprise"
],
"winlog.provider_guid": [
"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}"
],
"winlog.provider_name": [
"Microsoft-Windows-Sysmon"
],
"host.hostname": [
"02694w-win10"
],
"winlog.computer_name": [
"02694w-win10.threebeesco.com"
],
"process.pid": [
456
],
"host.mac": [
"00:50:56:03:c6:93"
],
"winlog.process.pid": [
2680
],
"host.os.version": [
"10.0"
],
"winlog.record_id": [
"1825496"
],
"winlog.event_data.TargetUser": [
"NT AUTHORITY\\SYSTEM"
],
"host.os.name": [
"Windows 10 Enterprise"
],
"log.level": [
"information"
],
"agent.name": [
"02694w-win10"
],
"host.name": [
"02694w-win10.threebeesco.com"
],
"event.agent_id_status": [
"verified"
],
"event.kind": [
"event"
],
"winlog.version": [
3
],
"host.os.type": [
"windows"
],
"user.id": [
"S-1-5-18"
],
"input.type": [
"winlog"
],
"data_stream.type": [
"logs"
],
"host.architecture": [
"x86_64"
],
"process.name": [
"svchost.exe"
],
"event.provider": [
"Microsoft-Windows-Sysmon"
],
"event.code": [
"10"
],
"agent.id": [
"85e87161-ea22-4847-a978-fb4ed45ebf0e"
],
"ecs.version": [
"1.12.0"
],
"event.created": [
"2022-06-28T21:29:51.107Z"
],
"winlog.event_data.CallTrace": [
"C:\\WINDOWS\\SYSTEM32\\ntdll.dll+9c534|C:\\WINDOWS\\System32\\KERNELBASE.dll+2726e|c:\\windows\\system32\\seclogon.dll+128f|c:\\windows\\system32\\seclogon.dll+10a0|C:\\WINDOWS\\System32\\RPCRT4.dll+76953|C:\\WINDOWS\\System32\\RPCRT4.dll+da036|C:\\WINDOWS\\System32\\RPCRT4.dll+37a4c|C:\\WINDOWS\\System32\\RPCRT4.dll+548c8|C:\\WINDOWS\\System32\\RPCRT4.dll+2c921|C:\\WINDOWS\\System32\\RPCRT4.dll+2c1db|C:\\WINDOWS\\System32\\RPCRT4.dll+1a86f|C:\\WINDOWS\\System32\\RPCRT4.dll+19d1a|C:\\WINDOWS\\System32\\RPCRT4.dll+19301|C:\\WINDOWS\\System32\\RPCRT4.dll+18d6e|C:\\WINDOWS\\System32\\RPCRT4.dll+169a5|C:\\WINDOWS\\SYSTEM32\\ntdll.dll+333ed|C:\\WINDOWS\\SYSTEM32\\ntdll.dll+34142|C:\\WINDOWS\\System32\\KERNEL32.DLL+17bd4|C:\\WINDOWS\\SYSTEM32\\ntdll.dll+6ce51"
],
"agent.version": [
"8.0.0"
],
"host.os.family": [
"windows"
],
"process.thread.id": [
15264
],
"winlog.event_data.TargetProcessGUID": [
"{6a3c3ef2-3646-62ab-0c00-00000000d300}"
],
"winlog.process.thread.id": [
3988
],
"winlog.event_data.TargetImage": [
"C:\\WINDOWS\\system32\\lsass.exe"
],
"winlog.event_data.TargetProcessId": [
"680"
],
"process.entity_id": [
"{6a3c3ef2-3646-62ab-1300-00000000d300}"
],
"host.os.build": [
"18363.815"
],
"winlog.user.type": [
"User"
],
"host.ip": [
"fe80::7587:a5c1:5a7b:68f6",
"172.16.66.25"
],
"agent.type": [
"filebeat"
],
"event.module": [
"windows"
],
"host.os.kernel": [
"10.0.18362.815 (WinBuild.160101.0800)"
],
"winlog.api": [
"wineventlog"
],
"elastic_agent.snapshot": [
false
],
"host.id": [
"6a3c3ef2-208f-4d6f-90ee-b34f4e3fd160"
],
"process.executable": [
"C:\\WINDOWS\\system32\\svchost.exe"
],
"winlog.user.identifier": [
"S-1-5-18"
],
"winlog.event_data.SourceUser": [
"NT AUTHORITY\\SYSTEM"
],
"winlog.task": [
"Process accessed (rule: ProcessAccess)"
],
"winlog.user.domain": [
"NT AUTHORITY"
],
"elastic_agent.id": [
"85e87161-ea22-4847-a978-fb4ed45ebf0e"
],
"data_stream.namespace": [
"default"
],
"winlog.event_data.GrantedAccess": [
"0x14c0"
],
"message": [
"Process accessed:\nRuleName: -\nUtcTime: 2022-06-28 21:29:49.829\nSourceProcessGUID: {6a3c3ef2-3646-62ab-1300-00000000d300}\nSourceProcessId: 456\nSourceThreadId: 15264\nSourceImage: C:\\WINDOWS\\system32\\svchost.exe\nTargetProcessGUID: {6a3c3ef2-3646-62ab-0c00-00000000d300}\nTargetProcessId: 680\nTargetImage: C:\\WINDOWS\\system32\\lsass.exe\nGrantedAccess: 0x14C0\nCallTrace: C:\\WINDOWS\\SYSTEM32\\ntdll.dll+9c534|C:\\WINDOWS\\System32\\KERNELBASE.dll+2726e|c:\\windows\\system32\\seclogon.dll+128f|c:\\windows\\system32\\seclogon.dll+10a0|C:\\WINDOWS\\System32\\RPCRT4.dll+76953|C:\\WINDOWS\\System32\\RPCRT4.dll+da036|C:\\WINDOWS\\System32\\RPCRT4.dll+37a4c|C:\\WINDOWS\\System32\\RPCRT4.dll+548c8|C:\\WINDOWS\\System32\\RPCRT4.dll+2c921|C:\\WINDOWS\\System32\\RPCRT4.dll+2c1db|C:\\WINDOWS\\System32\\RPCRT4.dll+1a86f|C:\\WINDOWS\\System32\\RPCRT4.dll+19d1a|C:\\WINDOWS\\System32\\RPCRT4.dll+19301|C:\\WINDOWS\\System32\\RPCRT4.dll+18d6e|C:\\WINDOWS\\System32\\RPCRT4.dll+169a5|C:\\WINDOWS\\SYSTEM32\\ntdll.dll+333ed|C:\\WINDOWS\\SYSTEM32\\ntdll.dll+34142|C:\\WINDOWS\\System32\\KERNEL32.DLL+17bd4|C:\\WINDOWS\\SYSTEM32\\ntdll.dll+6ce51\nSourceUser: NT AUTHORITY\\SYSTEM\nTargetUser: NT AUTHORITY\\SYSTEM"
],
"winlog.user.name": [
"SYSTEM"
],
"winlog.event_id": [
"10"
],
"event.ingested": [
"2022-06-28T21:30:04.000Z"
],
"event.action": [
"Process accessed (rule: ProcessAccess)"
],
"@timestamp": [
"2022-06-28T21:29:49.829Z"
],
"winlog.channel": [
"Microsoft-Windows-Sysmon/Operational"
],
"host.os.platform": [
"windows"
],
"data_stream.dataset": [
"windows.sysmon_operational"
],
"event.type": [
"access"
],
"winlog.opcode": [
"Info"
],
"agent.ephemeral_id": [
"137d194a-e542-4cd6-a1e3-f4ca9f5ad6b8"
],
"event.dataset": [
"windows.sysmon_operational"
]
}
}
```
* Update rules/windows/credential_access_lsass_handle_via_malseclogon.toml
* Update rules/windows/credential_access_lsass_handle_via_malseclogon.toml
Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com >
Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com >
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com >
2022-07-20 16:30:19 +02:00
a52751494e
2058 add setup field to metadata ( #2061 )
...
* Convert config header to setup in note field
* Parse note field into separate setup and note field with marko gfm
* only validate and parse note on elastic authored rules and add CLI description for new DR_BYPASS_NOTE_VALIDATION_AND_PARSE environment variable
Co-authored-by: brokensound77 <brokensound77@users.noreply.github.com >
2022-07-18 15:41:32 -04:00
3a8efc8183
[Security Content] 8.4 - Add Investigation Guides ( #2069 )
...
* [Security Content] 8.4 - Add Investigation Guides
* Apply suggestions from code review
Co-authored-by: Joe Peeples <joe.peeples@elastic.co >
* Update rules/windows/credential_access_cmdline_dump_tool.toml
Co-authored-by: Joe Peeples <joe.peeples@elastic.co >
* Apply suggestions from code review
Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com >
* Update rules/windows/credential_access_credential_dumping_msbuild.toml
Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com >
Co-authored-by: Joe Peeples <joe.peeples@elastic.co >
Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com >
2022-07-13 11:28:34 -03:00
329530c8c3
[New Rule] Domain Trust Enumeration via Nltest ( #2010 )
...
* adding detection rule
* removed changes from unrelated rule
* adjusted threat technique
* Update rules/windows/discovery_enumerating_domain_trusts_via_nltest.toml
* Update rules/windows/discovery_enumerating_domain_trusts_via_nltest.toml
Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com >
* Update rules/windows/discovery_enumerating_domain_trusts_via_nltest.toml
Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com >
* Update rules/windows/discovery_enumerating_domain_trusts_via_nltest.toml
Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com >
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
2022-07-05 10:48:25 -04:00
853f8db8d0
Update discovery_privileged_localgroup_membership.toml ( #2046 )
2022-06-30 14:26:17 -03:00
c8ff1dc9cb
Update discovery_remote_system_discovery_commands_windows.toml ( #2033 )
2022-06-14 10:50:59 -03:00
b6631f200e
Update persistence_sdprop_exclusion_dsheuristics.toml ( #2017 )
2022-06-03 14:22:04 -03:00
f857e009c5
Adds logs-system.* index pattern ( #2016 )
2022-06-03 13:56:54 -03:00
d6e96a83d5
[New Rule] Suspicious Microsoft Diagnostics Wizard Execution ( #2005 )
...
* [New Rule] Suspicious Microsoft Diagnostics Wizard Execution
https://lolbas-project.github.io/lolbas/Binaries/Msdt/
https://twitter.com/nao_sec/status/1530196847679401984
* Update rules/windows/defense_evasion_proxy_execution_via_msdt.toml
Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com >
Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com >
2022-06-01 17:02:47 +02:00
27f5c2e695
[Security Content] 8.3 Add Investigation Guides - 3 ( #1990 )
...
* [Security Content] 8.3 Add Investigation Guides - 3
* bump date
* Apply suggestions from code review
Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com >
* Apply suggestions from code review
Co-authored-by: Joe Peeples <joe.peeples@elastic.co >
Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com >
Co-authored-by: Joe Peeples <joe.peeples@elastic.co >
2022-05-31 12:57:02 -03:00
e5d3c6329c
[Security Content] 8.3 - Add Investigation Guides 2 ( #1989 )
...
* [Security Content] 8.3 - Add Investigation Guides 2 - Initial Commit
* .
* Add Related rules
* Apply suggestions from code review
Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com >
* Apply suggestions from code review
Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com >
* .
* .
* Apply suggestions from code review
Co-authored-by: Joe Peeples <joe.peeples@elastic.co >
Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com >
Co-authored-by: Joe Peeples <joe.peeples@elastic.co >
2022-05-31 12:54:42 -03:00
bfea11c99f
[Rule Tuning] Suspicious MS Office Child Process ( #2003 )
...
added msdt.exe as a response to this in the wild 0day (works without vba and on latest office) ->
https://twitter.com/nao_sec/status/1530196847679401984
https://www.virustotal.com/gui/file/4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784/detection
2022-05-31 14:20:51 +02:00
1f8813d02f
[Promote Rule] Potential Invoke-Mimikatz PowerShell Script ( #1993 )
...
* Update credential_access_mimikatz_powershell_module.toml
* Update credential_access_mimikatz_powershell_module.toml
* Update credential_access_mimikatz_powershell_module.toml
* Update credential_access_mimikatz_powershell_module.toml
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com >
2022-05-25 17:02:21 -03:00
72c186b30b
[Rule tuning] Whitespace Padding in Process Command Line ( #1967 )
...
* [Rule tuning] Whitespace Padding in Process Command Line
* bump updated_date
* update comment
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com >
2022-05-23 14:33:48 -05:00
a1bdf2b564
[Security Content] 8.3 - Add Investigation Guides ( #1937 )
...
* 8.3 - Add Investigation Guides
* Apply suggestions
* Apply the refactor
* Apply suggestions from Samir
* .
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com >
2022-05-19 13:23:35 -03:00
817b97f428
[Security Content] Refactor Existing Investigation Guides ( #1959 )
...
* Initial commit
* Update Investigation guides - security-docs review
* Update command_and_control_dns_tunneling_nslookup.toml
* Update defense_evasion_amsienable_key_mod.toml
* Apply security-docs review
* Remove dot
* Update rules/windows/command_and_control_rdp_tunnel_plink.toml
Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com >
* Apply changes from review
* Apply the suggestion
Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com >
2022-05-18 12:59:39 -03:00
27e6632ecd
Update command_and_control_common_webservices.toml ( #1970 )
2022-05-16 14:04:26 -03:00
19ff825a91
[New rule] Remote Computer Account DnsHostName Update ( #1962 )
...
* [New rule] Remote Computer Account DnsHostName Update
Identifies remote update to a computer account DnsHostName attribute, if the new value is set a valid domain controller DNS hostname and the subject computer name is not a domain controller then it's high likely a preparation step to exploit CVE-2022-26923 in an attempt to elevate privileges from a standard domain user to domain admin privileges :
* added MS ref url
* Update rules/windows/privilege_escalation_suspicious_dnshostname_update.toml
Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com >
* Update rules/windows/privilege_escalation_suspicious_dnshostname_update.toml
Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com >
Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com >
2022-05-11 19:40:34 +02:00
03836d45fa
[New Rule] Potential Local NTLM Relay via HTTP ( #1947 )
...
* [New Rule] Potential Local NTLM Relay via HTTP
Detect attempt to elevate privileges via coercing a privileged service to connect to a local rogue HTTP endpoint, leading to NTLM relay, example of logs while testing https://github.com/med0x2e/NTLMRelay2Self (step 5):
* Update credential_access_relay_ntlm_auth_via_http_spoolss.toml
* Update credential_access_relay_ntlm_auth_via_http_spoolss.toml
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com >
2022-05-06 21:07:27 +02:00
e9f5585a9f
[Rule Tuning] Update Rule Content Changes from Security Docs Team ( #1945 )
...
* updated content to reflect changes from Security Docs team
* Update rules/linux/execution_flock_binary.toml
* Update rules/linux/execution_expect_binary.toml
* TOML linting
* added escape for crdential_access_spn_attribute_modified.toml
2022-05-06 13:21:12 -04:00
3f047b987e
[New Rule] Service Creation via Local Kerberos Authentication ( #1941 )
...
* [New Rule] Suspicious Service Creation via Local Kerberos Relay over LDAP
This rule will catch also the suspicious service that was created leveraging the imported kerberos ticket https://gist.github.com/tyranid/c24cfd1bd141d14d4925043ee7e03c82 which makes triage easier :
DATA :
```
"sequences" : [
{
"join_keys" : [
"6a3c3ef2-208f-4d6f-90ee-b34f4e3fd160",
"0xefac5f"
],
"events" : [
{
"_index" : ".ds-logs-system.security-default-2022.04.12-000003",
"_id" : "XAy1YoABQhClK0XGpqaL",
"_source" : {
"agent" : {
"name" : "02694w-win10",
"id" : "77a829ec-a564-44d5-9bc4-61eeefbf783a",
"type" : "filebeat",
"ephemeral_id" : "6c751494-97a3-46aa-bab2-5baf01d17d04",
"version" : "8.0.0"
},
"process" : {
"name" : "-",
"pid" : 0,
"executable" : "-"
},
"winlog" : {
"computer_name" : "02694w-win10.threebeesco.com",
"process" : {
"pid" : 688,
"thread" : {
"id" : 5160
}
},
"keywords" : [
"Audit Success"
],
"logon" : {
"id" : "0x0",
"type" : "Network"
},
"channel" : "Security",
"event_data" : {
"LogonGuid" : "{82d3503b-9dac-ab6d-b045-8877b5aab051}",
"TargetOutboundDomainName" : "-",
"VirtualAccount" : "%%1843",
"LogonType" : "3",
"TransmittedServices" : "-",
"SubjectLogonId" : "0x0",
"LmPackageName" : "-",
"TargetOutboundUserName" : "-",
"KeyLength" : "0",
"RestrictedAdminMode" : "-",
"TargetLogonId" : "0xefac5f",
"SubjectUserName" : "-",
"TargetLinkedLogonId" : "0x0",
"ElevatedToken" : "%%1842",
"SubjectDomainName" : "-",
"ImpersonationLevel" : "%%1833",
"TargetUserName" : "Administrator",
"TargetDomainName" : "THREEBEESCO.COM",
"LogonProcessName" : "Kerberos",
"SubjectUserSid" : "S-1-0-0",
"TargetUserSid" : "S-1-5-21-308926384-506822093-3341789130-500",
"AuthenticationPackageName" : "Kerberos"
},
"opcode" : "Info",
"version" : 2,
"record_id" : "59330",
"task" : "Logon",
"event_id" : "4624",
"provider_guid" : "{54849625-5478-4994-a5ba-3e3b0328c30d}",
"activity_id" : "{e22af019-58dd-0002-43f0-2ae2dd58d801}",
"api" : "wineventlog",
"provider_name" : "Microsoft-Windows-Security-Auditing"
},
"log" : {
"level" : "information"
},
"elastic_agent" : {
"id" : "77a829ec-a564-44d5-9bc4-61eeefbf783a",
"version" : "8.0.0",
"snapshot" : false
},
"source" : {
"port" : 50494,
"ip" : "127.0.0.1",
"domain" : "-"
},
"message" : """An account was successfully logged on.
Subject:
Security ID: S-1-0-0
Account Name: -
Account Domain: -
Logon ID: 0x0
Logon Information:
Logon Type: 3
Restricted Admin Mode: -
Virtual Account: No
Elevated Token: Yes
Impersonation Level: Impersonation
New Logon:
Security ID: S-1-5-21-308926384-506822093-3341789130-500
Account Name: Administrator
Account Domain: THREEBEESCO.COM
Logon ID: 0xEFAC5F
Linked Logon ID: 0x0
Network Account Name: -
Network Account Domain: -
Logon GUID: {82d3503b-9dac-ab6d-b045-8877b5aab051}
Process Information:
Process ID: 0x0
Process Name: -
Network Information:
Workstation Name: -
Source Network Address: 127.0.0.1
Source Port: 50494
Detailed Authentication Information:
Logon Process: Kerberos
Authentication Package: Kerberos
Transited Services: -
Package Name (NTLM only): -
Key Length: 0
This event is generated when a logon session is created. It is generated on the computer that was accessed.
The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.
The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).
The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.
The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.
The impersonation level field indicates the extent to which a process in the logon session can impersonate.
The authentication information fields provide detailed information about this specific logon request.
- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
- Transited services indicate which intermediate services have participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM protocols.
- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.""",
"input" : {
"type" : "winlog"
},
"@timestamp" : "2022-04-25T21:09:04.559Z",
"ecs" : {
"version" : "1.12.0"
},
"related" : {
"ip" : [
"127.0.0.1"
],
"user" : [
"Administrator"
]
},
"data_stream" : {
"namespace" : "default",
"type" : "logs",
"dataset" : "system.security"
},
"host" : {
"hostname" : "02694w-win10",
"os" : {
"build" : "18363.815",
"kernel" : "10.0.18362.815 (WinBuild.160101.0800)",
"name" : "Windows 10 Enterprise",
"family" : "windows",
"type" : "windows",
"version" : "10.0",
"platform" : "windows"
},
"ip" : [
"fe80::7587:a5c1:5a7b:68f6",
"172.16.66.25"
],
"name" : "02694w-win10.threebeesco.com",
"id" : "6a3c3ef2-208f-4d6f-90ee-b34f4e3fd160",
"mac" : [
"00:50:56:03:c6:93"
],
"architecture" : "x86_64"
},
"event" : {
"agent_id_status" : "verified",
"ingested" : "2022-04-25T21:51:53Z",
"code" : "4624",
"provider" : "Microsoft-Windows-Security-Auditing",
"kind" : "event",
"created" : "2022-04-25T21:51:15.561Z",
"action" : "logged-in",
"category" : [
"authentication"
],
"type" : [
"start"
],
"dataset" : "system.security",
"outcome" : "success"
},
"user" : {
"domain" : "THREEBEESCO.COM",
"name" : "Administrator",
"id" : "S-1-5-21-308926384-506822093-3341789130-500"
}
}
},
{
"_index" : ".ds-logs-system.security-default-2022.04.12-000003",
"_id" : "Xwy1YoABQhClK0XGpqaL",
"_source" : {
"agent" : {
"name" : "02694w-win10",
"id" : "77a829ec-a564-44d5-9bc4-61eeefbf783a",
"ephemeral_id" : "6c751494-97a3-46aa-bab2-5baf01d17d04",
"type" : "filebeat",
"version" : "8.0.0"
},
"winlog" : {
"computer_name" : "02694w-win10.threebeesco.com",
"process" : {
"pid" : 688,
"thread" : {
"id" : 5160
}
},
"keywords" : [
"Audit Success"
],
"logon" : {
"id" : "0xefac5f"
},
"channel" : "Security",
"event_data" : {
"ServiceAccount" : "LocalSystem",
"SubjectUserName" : "Administrator",
"ServiceStartType" : "3",
"ServiceName" : "KrbSCM",
"ServiceType" : "0x10",
"SubjectDomainName" : "3B",
"SubjectLogonId" : "0xefac5f",
"SubjectUserSid" : "S-1-5-21-308926384-506822093-3341789130-500",
"ServiceFileName" : "\"C:\\Users\\lgreen\\Downloads\\KrbRelayUp.exe\" system 1"
},
"opcode" : "Info",
"record_id" : "59331",
"task" : "Security System Extension",
"event_id" : "4697",
"provider_guid" : "{54849625-5478-4994-a5ba-3e3b0328c30d}",
"activity_id" : "{e22af019-58dd-0002-43f0-2ae2dd58d801}",
"api" : "wineventlog",
"provider_name" : "Microsoft-Windows-Security-Auditing"
},
"log" : {
"level" : "information"
},
"elastic_agent" : {
"id" : "77a829ec-a564-44d5-9bc4-61eeefbf783a",
"version" : "8.0.0",
"snapshot" : false
},
"message" : """A service was installed in the system.
Subject:
Security ID: S-1-5-21-308926384-506822093-3341789130-500
Account Name: Administrator
Account Domain: 3B
Logon ID: 0xEFAC5F
Service Information:
Service Name: KrbSCM
Service File Name: "C:\Users\lgreen\Downloads\KrbRelayUp.exe" system 1
Service Type: 0x10
Service Start Type: 3
Service Account: LocalSystem""",
"input" : {
"type" : "winlog"
},
"@timestamp" : "2022-04-25T21:09:04.561Z",
"ecs" : {
"version" : "1.12.0"
},
"related" : {
"user" : [
"Administrator"
]
},
"data_stream" : {
"namespace" : "default",
"type" : "logs",
"dataset" : "system.security"
},
"service" : {
"name" : "KrbSCM",
"type" : "Win32 Own Process"
},
"host" : {
"hostname" : "02694w-win10",
"os" : {
"build" : "18363.815",
"kernel" : "10.0.18362.815 (WinBuild.160101.0800)",
"name" : "Windows 10 Enterprise",
"family" : "windows",
"type" : "windows",
"version" : "10.0",
"platform" : "windows"
},
"ip" : [
"fe80::7587:a5c1:5a7b:68f6",
"172.16.66.25"
],
"name" : "02694w-win10.threebeesco.com",
"id" : "6a3c3ef2-208f-4d6f-90ee-b34f4e3fd160",
"mac" : [
"00:50:56:03:c6:93"
],
"architecture" : "x86_64"
},
"event" : {
"agent_id_status" : "verified",
"ingested" : "2022-04-25T21:51:53Z",
"code" : "4697",
"provider" : "Microsoft-Windows-Security-Auditing",
"created" : "2022-04-25T21:51:15.561Z",
"kind" : "event",
"action" : "service-installed",
"category" : [
"iam",
"configuration"
],
"type" : [
"admin",
"change"
],
"dataset" : "system.security",
"outcome" : "success"
},
"user" : {
"domain" : "3B",
"name" : "Administrator",
"id" : "S-1-5-21-308926384-506822093-3341789130-500"
}
}
}
]
````
* Update privilege_escalation_krbrelayup_service_creation.toml
* removed duplicate SubjectLogonId from non ecs fields list
2022-04-29 14:36:28 +02:00
a0672c7d2a
[New Rule] Potential Privileged Escalation via KrbRelayUp ( #1940 )
...
* [New Rule] Potential Privileged Escalation via KrbRelayUp
Identifies a suspicious local successful logon event where the Logon Package is kerberos, the remote address is set to localhost and the target user SID is the builtin local Administrator account, this may indicate an attempt to leverage a Kerberos relay attack variant that can be used to elevate privilege locally from filtered administrator token to a token with full System privileges.
https://github.com/Dec0ne/KrbRelayUp
DATA :
```
{
"_index" : ".ds-logs-system.security-default-2022.04.12-000003",
"_id" : "Cwy1YoABQhClK0XGfqEU",
"_source" : {
"agent" : {
"name" : "02694w-win10",
"id" : "77a829ec-a564-44d5-9bc4-61eeefbf783a",
"type" : "filebeat",
"ephemeral_id" : "6c751494-97a3-46aa-bab2-5baf01d17d04",
"version" : "8.0.0"
},
"process" : {
"name" : "-",
"pid" : 0,
"executable" : "-"
},
"winlog" : {
"computer_name" : "02694w-win10.corpcorp.com",
"process" : {
"pid" : 688,
"thread" : {
"id" : 9384
}
},
"keywords" : [
"Audit Success"
],
"logon" : {
"id" : "0x0",
"type" : "Network"
},
"channel" : "Security",
"event_data" : {
"LogonGuid" : "{daac0d7c-3273-752c-bf5d-ea1c60851819}",
"TargetOutboundDomainName" : "-",
"VirtualAccount" : "%%1843",
"LogonType" : "3",
"TransmittedServices" : "-",
"SubjectLogonId" : "0x0",
"LmPackageName" : "-",
"TargetOutboundUserName" : "-",
"KeyLength" : "0",
"RestrictedAdminMode" : "-",
"TargetLogonId" : "0xebd3d4",
"SubjectUserName" : "-",
"TargetLinkedLogonId" : "0x0",
"ElevatedToken" : "%%1842",
"SubjectDomainName" : "-",
"TargetUserName" : "Administrator",
"ImpersonationLevel" : "%%1833",
"LogonProcessName" : "Kerberos",
"TargetDomainName" : "CORPCORP.COM",
"SubjectUserSid" : "S-1-0-0",
"AuthenticationPackageName" : "Kerberos",
"TargetUserSid" : "S-1-5-21-308926384-506822093-3341789130-500"
},
"opcode" : "Info",
"version" : 2,
"record_id" : "59063",
"task" : "Logon",
"event_id" : "4624",
"provider_guid" : "{54849625-5478-4994-a5ba-3e3b0328c30d}",
"activity_id" : "{e22af019-58dd-0002-43f0-2ae2dd58d801}",
"api" : "wineventlog",
"provider_name" : "Microsoft-Windows-Security-Auditing"
},
"log" : {
"level" : "information"
},
"elastic_agent" : {
"id" : "77a829ec-a564-44d5-9bc4-61eeefbf783a",
"version" : "8.0.0",
"snapshot" : false
},
"source" : {
"port" : 50480,
"ip" : "127.0.0.1",
"domain" : "-"
},
"message" : """An account was successfully logged on.
Subject:
Security ID: S-1-0-0
Account Name: -
Account Domain: -
Logon ID: 0x0
Logon Information:
Logon Type: 3
Restricted Admin Mode: -
Virtual Account: No
Elevated Token: Yes
Impersonation Level: Impersonation
New Logon:
Security ID: S-1-5-21-308926384-506822093-3341789130-500
Account Name: Administrator
Account Domain: CORPCORP.COM
Logon ID: 0xEBD3D4
Linked Logon ID: 0x0
Network Account Name: -
Network Account Domain: -
Logon GUID: {daac0d7c-3273-752c-bf5d-ea1c60851819}
Process Information:
Process ID: 0x0
Process Name: -
Network Information:
Workstation Name: -
Source Network Address: 127.0.0.1
Source Port: 50480
Detailed Authentication Information:
Logon Process: Kerberos
Authentication Package: Kerberos
Transited Services: -
Package Name (NTLM only): -
Key Length: 0
This event is generated when a logon session is created. It is generated on the computer that was accessed.
The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.
The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).
The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.
The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.
The impersonation level field indicates the extent to which a process in the logon session can impersonate.
The authentication information fields provide detailed information about this specific logon request.
- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
- Transited services indicate which intermediate services have participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM protocols.
- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.""",
"input" : {
"type" : "winlog"
},
"@timestamp" : "2022-04-25T21:07:15.306Z",
"ecs" : {
"version" : "1.12.0"
},
"related" : {
"ip" : [
"127.0.0.1"
],
"user" : [
"Administrator"
]
},
"data_stream" : {
"namespace" : "default",
"type" : "logs",
"dataset" : "system.security"
},
"host" : {
"hostname" : "02694w-win10",
"os" : {
"build" : "18363.815",
"kernel" : "10.0.18362.815 (WinBuild.160101.0800)",
"name" : "Windows 10 Enterprise",
"family" : "windows",
"type" : "windows",
"version" : "10.0",
"platform" : "windows"
},
"ip" : [
"fe80::7587:a5c1:5a7b:68f6",
"172.16.66.25"
],
"name" : "02694w-win10.corpcorp.com",
"id" : "6a3c3ef2-208f-4d6f-90ee-b34f4e3fd160",
"mac" : [
"00:50:56:03:c6:93"
],
"architecture" : "x86_64"
},
"event" : {
"agent_id_status" : "verified",
"ingested" : "2022-04-25T21:51:43Z",
"code" : "4624",
"provider" : "Microsoft-Windows-Security-Auditing",
"kind" : "event",
"created" : "2022-04-25T21:51:08.433Z",
"action" : "logged-in",
"category" : [
"authentication"
],
"type" : [
"start"
],
"dataset" : "system.security",
"outcome" : "success"
},
"user" : {
"domain" : "CORPCORP.COM",
"name" : "Administrator",
"id" : "S-1-5-21-308926384-506822093-3341789130-500"
}
}
}
```
* Update privilege_escalation_krbrelayup_suspicious_logon.toml
* Update privilege_escalation_krbrelayup_suspicious_logon.toml
* Update privilege_escalation_krbrelayup_suspicious_logon.toml
* Update privilege_escalation_krbrelayup_suspicious_logon.toml
* Update privilege_escalation_krbrelayup_suspicious_logon.toml
* Update rules/windows/privilege_escalation_krbrelayup_suspicious_logon.toml
Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com >
* Update rules/windows/privilege_escalation_krbrelayup_suspicious_logon.toml
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
* Update etc/non-ecs-schema.json
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
* relinted
Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com >
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
2022-04-27 01:39:54 +02:00
20d2e92cfe
Review & Fix Invalid References ( #1936 )
2022-04-26 17:57:15 -03:00
5bf321a505
[Rule Tuning] Exclude MS OneDrive/Teams from Component Object Model Hijacking ( #1932 )
...
* adjusted query to exclude OneDrive process name and MS Teams DLL reference in registry data strings
* adjusted formatting for altered query
* removed unecessary string used for reference
* removed unecessary parenthesis from new filters in query
* Update rules/windows/persistence_suspicious_com_hijack_registry.toml
Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com >
* Update rules/windows/persistence_suspicious_com_hijack_registry.toml
Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com >
* added FileSyncConfig.exe for OneDrive, added regsvr32 to Teams DLL filter
* added investigation notes
* removed comment from original rule creation
Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com >
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com >
2022-04-26 11:43:33 -04:00
0943ffba5f
[Rule Tuning] Remove logs-windows.* index ( #1928 )
...
* Remove `logs-windows.*` index
* Update discovery_privileged_localgroup_membership.toml
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
2022-04-14 09:25:44 -03:00
258418785f
MInor changes from Investigation Guides Review ( #1927 )
2022-04-13 16:53:29 -08:00
Jonhnathan