* [New Rule] Kubernetes Anonymous Request Authorized
## Issue
#2038
## Summary
This rule detects when an unauthenticated user request is authorized within the cluster. Attackers may attempt to use
anonymous accounts to gain initial access to the cluster or to avoid attribution of their activities within the cluster.
This rule excludes the /healthz, /livez and /readyz endpoints which are commonly accessed anonymously.
* [New Rule] Kubernetes Suspicious Change to Privileges of Running Security Context
## Issue
https://github.com/elastic/detection-rules/issues/2032
## Summary
* Delete non-ecs-schema.json
* Delete privilege_escalation_suspicious_change_to_privileges_of_running_security_context.toml
* Create non-ecs-schema.json
* Update detection_rules/etc/non-ecs-schema.json
Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com>
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com>
* adding new rule
* adjusted query format
* adjusted file and rule name to include google workspace
* Update collection_google_drive_ownership_transferred_via_google_workspace.toml
Fixed a couple minor typos
Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>
* adding new rule
* adjusting rule name, file name and description
* adjusted att&ck technique
* adjusted file and rule name to include google workspace
* adjusted references
* Update persistence_google_workspace_user_group_access_modified_to_allow_external_access.toml
Fixed minor typo
Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>
* [Rule Tuning] Abnormal Process ID or Lock File Created
* Update rules/linux/execution_abnormal_process_id_file_created.toml
* Update execution_abnormal_process_id_file_created.toml
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
only FPs with no way to tune other than opening the rule for easy evasion by excluding by process.executable/args).
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
* [Deprecate Rule] File and Directory Discovery
very noisy and most if not all are FPs, few rooms for tuning without rendering the rule easy to bypass.
* Delete workspace.xml
* [Deprecated Rule] Potential Privilege Escalation via Local Kerberos Relay over LDAP
FPs in certain cases with no room for tuning.
* Update privilege_escalation_krbrelayup_suspicious_logon.toml
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
* [Rule Tuning] Remotely Started Services via RPC
excluding noisy FPs by process.executable to be compatible with winlog and endpoint
* Update lateral_movement_remote_services.toml
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
* [Rule Tuning] Potential Remote Credential Access via Registry
Excluding some noisy FPs by file.path (user and machine hives std paths) and event.action (scoped to logged-in)
* Update credential_access_remote_sam_secretsdump.toml
* [Rule Tuning] Persistence via Update Orchestrator Service Hijack
I changed the query to exclude FPs for safe executables found in telemetry: MoUsoCoreWorker.exe and OfficeC2RClient.exe. Changed the query type to KQL to account for the wildcard needed to capture 2 of the executable paths found in telemetry. I'm open to changing back to eql with suggestions.
* Update persistence_via_update_orchestrator_service_hijack.toml
revert back to eql
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
Isai