security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,734 Commits 1 Branch 0 Tags
efa7c428ea6609faab2be4488372f253d5536ffa
Commit Graph

1734 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Jonhnathan efa7c428ea [Rule Tuning] Windows DR Tuning - 2 (#3209) 
* [Rule Tuning] Windows DR Tuning - 2

* Update rules/windows/credential_access_kerberoasting_unusual_process.toml

* Update credential_access_kerberoasting_unusual_process.toml

* Update command_and_control_teamviewer_remote_file_copy.toml
 2023-10-26 18:10:31 -03:00
Jonhnathan a5240e4063 [Rule Tuning] Windows DR Tuning - 1 (#3198) 
* [Rule Tuning] Windows DR Tuning - 1

* Update collection_winrar_encryption.toml
 2023-10-26 17:20:32 -03:00
eric-forte-elastic 36b0a49e7d [FR] Updated typing-extensions dependency (#3204) 
* Updated typing-extensions

* Added entries for <=3.11 and >=3.12

---------

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>
 2023-10-26 12:13:37 -04:00
Terrance DeJesus e6ead7b5f7 [FR] Adjust Risk Severity Unit Test to Match UI (#3218) 
* adjusted risk score to include ranges allowed upstream

* Update tests/test_all_rules.py

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

---------

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>
 2023-10-25 10:25:46 -04:00
Ruben Groenewoud 1ac3775743 [New Rule] Network Activity Detected via kworker (#3202) 
* [New Rule] Potential curl CVE-2023-38545 Exploitation

* Revert "[New Rule] Potential curl CVE-2023-38545 Exploitation"

This reverts commit 9c04d1b53d3d63678289f43ec0c7b617d26f1ce0.

* [New Rule] Network Activity Detected via kworker

* White space

* Update rules/linux/command_and_control_linux_kworker_netcon.toml

* Update rules/linux/command_and_control_linux_kworker_netcon.toml

* Update rules/linux/command_and_control_linux_kworker_netcon.toml

* Update command_and_control_linux_kworker_netcon.toml

* Update rules/linux/command_and_control_linux_kworker_netcon.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/linux/command_and_control_linux_kworker_netcon.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update command_and_control_linux_kworker_netcon.toml

---------

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
 2023-10-25 15:24:55 +02:00
github-actions[bot] ab6f28a380 Lock versions for releases: 8.3,8.4,8.5,8.6,8.7,8.8,8.9,8.10,8.11 (#3223) 
* Locked versions for releases: 8.3,8.4,8.5,8.6,8.7,8.8,8.9,8.10,8.11

* Update detection_rules/etc/deprecated_rules.json

---------

Co-authored-by: terrancedejesus <terrancedejesus@users.noreply.github.com>
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
 2023-10-24 14:01:11 -04:00
Terrance DeJesus 3d57209705 [Rule Tuning] Bump Minimum Stacks for AWS and Okta for Version Control (#3221) 
* adding adjusted Okta rules

* adding adjusted AWS rules

* adding adjusted AWS rules
 2023-10-24 12:51:59 -04:00
Ruben Groenewoud 3855dd06d8 [New Rule] Potential Linux Hack Tool Launched (#3125) 
* [New Rule] Potential Linux Hack Tool Launched

* changed description slightly

* Updated description

* Update rules/linux/execution_potential_hack_tool_executed.toml

* Update rules/linux/execution_potential_hack_tool_executed.toml
 2023-10-23 21:35:43 +02:00
Jonhnathan 6fcf26b20e [Promote] Potential Masquerading as Communication Apps (#3181) 
* [Promote] Potential Masquerading as Communication Apps

* Update defense_evasion_masquerading_communication_apps.toml

* Update defense_evasion_masquerading_communication_apps.toml

* Update rules/windows/defense_evasion_masquerading_communication_apps.toml

* Update defense_evasion_masquerading_communication_apps.toml

---------

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
 2023-10-23 14:56:03 -03:00
Jonhnathan a471f6fc60 [Rule Tuning] Potential Privilege Escalation via InstallerFileTakeOver (#3215) 
* [Rule Tuning] Potential Privilege Escalation via InstallerFileTakeOver

* Update privilege_escalation_installertakeover.toml
 2023-10-23 14:34:36 -03:00
Terrance DeJesus 835be9b245 [New Rule] Add Living-off-the-Land (LotL) ProblemChild Rules (#3193) 
* adding new LotL rules

* added endpoint tags; updated technique mapping

* added missing data source tag

* Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_user.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_host.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_host.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_parent_process.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_host.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_user.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_parent_process.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_user.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_parent_process.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_host.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_host.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_host.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_parent_process.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_user.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_event.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_event_high_probability.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_host.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* updated note, references and date

* changed ATT&CK technique to binary proxy execution

---------

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
 2023-10-23 12:23:56 -04:00
Ruben Groenewoud ff268cc6a0 [New Rule] Netcat Listener Established via rlwrap (#3124) 
* [New Rule] Netcat Listener Established via rlwrap

* Update rules/linux/execution_nc_listener_via_rlwrap.toml
 2023-10-23 17:31:26 +02:00
Ruben Groenewoud 9807bebd8e [New BBR] Unix Socket Communication (#3072) 
* [New Rule] Unix Socket Communication

* Update rules_building_block/execution_unix_socket_communication.toml

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>

* Update rules_building_block/execution_unix_socket_communication.toml

---------

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>
 2023-10-23 17:18:48 +02:00
Ruben Groenewoud 024d45bd56 [New BBR] Tainted Kernel Module Load (#3211) 
* [New Rule] Tainted Kernel Module Load

* added setup note

* Fixed tag

* added type change

* timestamp override

---------

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
 2023-10-23 17:06:16 +02:00
Jonhnathan 18ff85ce84 [Promote] Expired or Revoked Driver Loaded (#3185) 
* [Promote] Expired or Revoked Driver Loaded

* Update privilege_escalation_expired_driver_loaded.toml
 2023-10-23 11:44:37 -03:00
Ruben Groenewoud 020fff3aea [Rule Tuning] Linux Rules (#3092) 
* [Rule Tuning] [WIP] Linux DR

* Update defense_evasion_binary_copied_to_suspicious_directory.toml

* Fixed tag

* Added additional tuning

* unit test fix

* Additional tuning

* tuning

* added max signals

* Added max_signals=1 to brute force rules

* Cross-Platform Tuning

* Small fix

* new_terms conversion

* typo

* new_terms conversion

* Ransomware rule tuning

* performance tuning

* new_terms conversion for auditd_manager

* tune

* Need coffee

* kql/eql stuff

* formatting improvement

* new_terms sudo hijacking conversion

* exclusion

* Deprecations that were added last tuning

* Deprecations that were added last tuning

* Increased max timespan for brute force rules

* version bump

* added domain tag

* Two tunings

* More tuning

* Additional tuning

* updated_date bump

* query optimization

* Tuning

* Readded the exclusions for this one

* Changed int comparison

* Some tunings

* Update persistence_systemd_scheduled_timer_created.toml

* Update rules/linux/privilege_escalation_ld_preload_shared_object_modif.toml

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>

* [New Rule] Potential curl CVE-2023-38545 Exploitation

* Revert "[New Rule] Potential curl CVE-2023-38545 Exploitation"

This reverts commit 9c04d1b53d3d63678289f43ec0c7b617d26f1ce0.

* Update rules/cross-platform/command_and_control_non_standard_ssh_port.toml

* Update rules/linux/command_and_control_cat_network_activity.toml

* Update persistence_message_of_the_day_execution.toml

* Changed max_signals

* Revert "Merge branch 'main' into rule-tuning-ongoing-dr"

This reverts commit 1106b5d2eba1a3529eff325226d6baabfd4b0bf3, reversing
changes made to 5ff510757f25b0cb32e1ef18e9e2c34c8ec325a8.

* Revertable merge

* Update defense_evasion_ld_preload_env_variable_process_injection.toml

* File name change

---------

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
 2023-10-23 16:28:58 +02:00
shashank-elastic 7254c582c5 Move Setup information into setup filed (#3206) 2023-10-23 19:28:18 +05:30
Terrance DeJesus 3ab57fb8a7 [FR] Adding Support for missing_field_strategy Field in Alert Suppression (#3201) 
* adding missing field strategy option to alert suppression

* fixed linting errors

* added validate methods for alertsuppression dataclass

* fixed linting errors

* replaced old variable with new variable

* removing test rule

* adding post_load to queryruledata

* changed post_load to validates_schema

* updated unit testing for alert suppression

* fixed linting errors

* changed validates method name to validates_exceptions

* removed min compat for fields
 2023-10-19 18:16:54 -04:00
Ruben Groenewoud 9f41c9f35c [New Rule] Upgrade of Non-interactive Shell (#3113) 
* [New Rule] Upgrade of Non-interactive Shell

* Changed numbers to int

* Changed severity

* [New Rule] Pot. Rev Shell via Background Process

* Revert "[New Rule] Pot. Rev Shell via Background Process"

This reverts commit bbb36eae26561dbef4bf57f6c1388cebe7a8b88d.

* Update rules/linux/execution_interpreter_tty_upgrade.toml
 2023-10-18 16:47:07 +02:00
Ruben Groenewoud 6ea11cd9ad [New Rules] cap_setuid/cap_setgid privesc (#3075) 
* [New Rules] cap_setuid/cap_setgid privesc

* Update persistence_setuid_setgid_capability_set.toml

* Update rules/linux/privilege_escalation_suspicious_cap_setuid_python_execution.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update privilege_escalation_suspicious_cap_setuid_python_execution.toml

* Update rules/linux/privilege_escalation_suspicious_cap_setuid_python_execution.toml

* Update privilege_escalation_suspicious_cap_setuid_python_execution.toml

---------

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
 2023-10-18 16:24:01 +02:00
Ruben Groenewoud 4190c3a6a7 [New Rule] Potential SSH-IT SSH Worm Downloaded (#3121) 
* [New Rule]

* Fixed grammar mistake

* Update rules/linux/lateral_movement_ssh_it_worm_download.toml

* Update rules/linux/lateral_movement_ssh_it_worm_download.toml
 2023-10-18 16:08:25 +02:00
Ruben Groenewoud 7d674db11e [New Rule] Pot. Network Scan Executed from Host (#3070) 2023-10-18 15:46:31 +02:00
Jonhnathan 74222f86eb [New Rules] [BBR] Windows Deprecated ERs Conversion - 3 (#3143) 
* [New Rules] [BBR] Windows Deprecated ERs Conversion - 3

* Update defense_evasion_invalid_codesign_imageload.toml

* Update defense_evasion_invalid_codesign_imageload.toml

* Update rules_building_block/initial_access_execution_remote_via_msiexec.toml

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

* Update rules_building_block/initial_access_xsl_script_execution_via_com.toml

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>

* Update rules_building_block/initial_access_execution_remote_via_msiexec.toml

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>

---------

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>
 2023-10-17 14:16:28 -03:00
Jonhnathan 3ea3e5a9fd [New Rules] [BBR] Windows Deprecated ERs Conversion - 2 (#3138) 
* [New Rules] [BBR] Windows Deprecated ERs Conversion - 2

* Update defense_evasion_unsigned_bits_client.toml

* Update rules_building_block/defense_evasion_suspicious_msiexec_execution.toml

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

* .

---------

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
 2023-10-17 13:49:49 -03:00
Jonhnathan 32002fd89b [New Rules] [BBR] Windows Deprecated ERs Conversion - 1 (#3131) 
* [New Rules] [BBR] Windows Deprecated ERs Conversion - 1

* .

* .

* Update defense_evasion_dotnet_clickonce_dfsvc_netcon.toml

* .
 2023-10-17 11:36:53 -03:00
shashank-elastic 276c0f9cd3 Setup information for Linux Rules - Set7 (#3190) 2023-10-17 19:45:01 +05:30
shashank-elastic 5a98208b53 Setup information for Linux Rules - Set6 (#3189) 2023-10-17 19:33:07 +05:30
shashank-elastic 2a48db0598 Setup information for Linux Rules - Set5 (#3188) 2023-10-17 19:11:20 +05:30
shashank-elastic 25b527c149 Setup information for Linux Rules - Set4 (#3179) 2023-10-17 18:59:31 +05:30
shashank-elastic d2c2987d72 Setup information for Linux Rules - Set3 (#3178) 2023-10-17 18:37:20 +05:30
shashank-elastic 1801a4ee7e Setup information for Linux Rules - Set2 (#3177) 2023-10-17 18:25:55 +05:30
Jonhnathan a33a124eab [New Rule] [BBR] Memory Dump File Rules (#3122) 
* [New Rule] Memory Dump File Rules

* .

* .

* .
 2023-10-17 09:35:38 -03:00
Jonhnathan 8035516e8e [Rule Tuning] Potential Masquerading as Browser Process (#3180) 
* [Rule Tuning] Potential Masquerading as Browser Process

* Update defense_evasion_masquerading_browsers.toml

* Update defense_evasion_masquerading_browsers.toml
 2023-10-17 08:53:37 -03:00
Jonhnathan e4e68c2dd8 [Rule Tuning] Potential Masquerading as System32 DLL (#3184) 
Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
 2023-10-17 08:29:08 -03:00
Jonhnathan 82685e36ce [Rule Tuning] Adjust Lucene queries to use Uppercase operators (#3196) 2023-10-16 17:07:53 -03:00
Apoorva Joshi a5a606e804 [New Rule] Adding DGA Rules from Advanced Analytic DGA Package (#3102) 
* Adding DGA rules

* Adding references

* updated rule tags and queries

* Updating min stack version

* added logic to handle ml jobs

* added code comments for clarity

* removing subbed security docs folder

* added event dataset to queries for endpoint; updated note

* removed event dataset

---------

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: terrancedejesus <terrance.dejesus@elastic.co>
 2023-10-16 15:48:54 -04:00
Samirbous 24b0aa5c63 [Tuning] Adjusted Rules for Anti-Evasion (#3163) 
* Update lateral_movement_executable_tool_transfer_smb.toml

* Update lateral_movement_incoming_wmi.toml

* Update lateral_movement_execution_via_file_shares_sequence.toml

* Update lateral_movement_executable_tool_transfer_smb.toml

* Update lateral_movement_execution_via_file_shares_sequence.toml

* Update lateral_movement_executable_tool_transfer_smb.toml

---------

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
 2023-10-16 17:56:09 +01:00
Jonhnathan f584fb6e31 [Security Content] Adjust Mitre Att&ck Mappings - Windows Rules (#3165) 
* [Security Content] Adjust Mitre Att&ck Mappings - Windows Rules

* Fix dates

* Fix unit test errors

* updated tags and fixed branch conflicts

updated tags and fixed branch conflicts

* description nit

* Reverting unintended changes

* Update initial_access_suspicious_ms_office_child_process.toml

---------

Co-authored-by: imays11 <59296946+imays11@users.noreply.github.com>
 2023-10-15 18:12:20 -03:00
Apoorva Joshi 97ff7fb26e [New Rule] Adding Data Exfiltration Rules from Advanced Analytic DED Package (#3126) 
* Adding DED rules

* adding integration manifests and schemas for DED

* Updating min stack version

* updating manifests and schemas to match main

* added setup note; updated references

---------

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: terrancedejesus <terrance.dejesus@elastic.co>
 2023-10-14 13:23:48 -04:00
github-actions[bot] 2b0735024e Lock versions for releases: 8.3,8.4,8.5,8.6,8.7,8.8,8.9,8.10,8.11 (#3183) 
* Locked versions for releases: 8.3,8.4,8.5,8.6,8.7,8.8,8.9,8.10,8.11

* Update detection_rules/etc/version.lock.json

---------

Co-authored-by: terrancedejesus <terrancedejesus@users.noreply.github.com>
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
 2023-10-13 15:10:49 -04:00
Terrance DeJesus b4f8fc3290 [FR] 8.11 Release Preparation and Update Main Branch to 8.12 (#3182) 
* prepping for 8.12 branch

* added ananlytic manifests and schemas

* fix linting issues

* updated analytic package manifests and schemas
 2023-10-13 13:37:21 -04:00
shashank-elastic 15718ea09e Improve exsisting setup configurations for Linux (#3141) 2023-10-13 13:39:03 +05:30
Isai 374c9c6257 [New Rule] New GitHub App Installed (#3055) 
* new rule

* Update rules/integrations/github/execution_new_github_app_installed.toml

* Update rules/integrations/github/execution_new_github_app_installed.toml

edits from review

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

* change query from event.module to event.dataset

---------

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
 2023-10-12 20:10:20 -04:00
Terrance DeJesus 1e514afa57 [New Rule] Migrate Lateral Movement Detection Rules (#3175) 
* adding LMD rules

* added setup note; updated references

* adds 2.0.0 lmd manifest and schema

* adjusted min-stack for non-ML rules
 2023-10-12 15:02:19 -04:00
Terrance DeJesus 3e212e2b74 [FR] Add ML Jobs to Schemas and Unit Test for Validation (#3161) 
* adding machine learning job id validation

* Update rules/ml/credential_access_ml_auth_spike_in_logon_events_from_a_source_ip.toml

* Update tests/test_all_rules.py

* adding integration manifests and schemas from main

* rebuilt manifests and schemas with lmd

* fixed unit test linting

* adding manifests and schemas for other analytic packages

* updated manifests and schemas; adjusted unit test for verbosity

* sorted imports
 2023-10-12 10:51:12 -04:00
Jonhnathan 3f2a709370 [Rule Tuning] PowerShell Rules Tuning (#3169) 2023-10-11 17:57:32 -03:00
Justin Ibarra 7f8a9849c4 [New Rule] File Compressed or Archived into Common Format (#3173) 
* [New Rule] File Compressed or Archived into Common Format
* new build-threat-map-entry-command

---------

Co-authored-by: brokensound77 <brokensound77@users.noreply.github.com>
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
 2023-10-11 11:34:34 -07:00
eric-forte-elastic 9f61ce4923 [FR] Only supporting known compatible rule file types (#3167) 
* Only supporting known compatible file types

* Add --ignore-invalid-files flag

* Added support to ignore invalid rule files

* Update detection_rules/utils.py

Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>

* Update detection_rules/utils.py

Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>

* Update detection_rules/utils.py

Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>

* Update detection_rules/utils.py

Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>

* Update detection_rules/main.py

Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>

* reverting main

* add punctuation

---------

Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
 2023-10-11 11:43:42 -04:00
Ruben Groenewoud 89cfdcd440 [New Rule] Potential curl CVE-2023-38545 Exploitation (#3168) 
* [New Rule] Potential curl CVE-2023-38545 Exploitation

* Added setup guide

* Update execution_curl_CVE_2023_38545.toml

* File name change

* File name change

* Update dates

* Update rules/linux/execution_curl_cve_2023_38545_heap_overflow.toml

* Update rules/linux/execution_curl_cve_2023_38545_heap_overflow.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/linux/execution_curl_cve_2023_38545_heap_overflow.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/linux/execution_curl_cve_2023_38545_heap_overflow.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/linux/execution_curl_cve_2023_38545_heap_overflow.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/linux/execution_curl_cve_2023_38545_heap_overflow.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/linux/execution_curl_cve_2023_38545_heap_overflow.toml

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>

* Update rules/linux/execution_curl_cve_2023_38545_heap_overflow.toml

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>

* Update rules/linux/execution_curl_cve_2023_38545_heap_overflow.toml

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>

* Update rules/linux/execution_curl_cve_2023_38545_heap_overflow.toml

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>

---------

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>
 2023-10-11 11:42:25 -03:00
Ruben Groenewoud c2822e175c [Tuning] Windows Execution Rule Tuning for UEBA (#3107) 
* Update defense_evasion_execution_msbuild_started_by_script.toml

* Mostly updated Execution tags, also new_terms conv

* removed index

* Removed index

* WMIPrvSE tuning

* Additional tuning

* Tuning & changes

* Additional tuning

* Applied unit test optimization

* Addressed feedback

* Update rules/windows/execution_command_shell_started_by_svchost.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* caseless unit testing fix

* fixed caseless executable unit test

* unit testing fix

* Update rules/windows/execution_suspicious_powershell_imgload.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

* Update execution_ms_office_written_file.toml

* Update rules/windows/defense_evasion_execution_msbuild_started_by_script.toml

* Update rules/windows/defense_evasion_execution_msbuild_started_unusal_process.toml

* Added user ids to new terms

* Update rules/windows/execution_suspicious_powershell_imgload.toml

Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>

* Update rules_building_block/execution_unsigned_service_executable.toml

Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>

* Update execution_unsigned_service_executable.toml

---------

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>
 2023-10-11 10:15:29 +02:00