description: Process started by MS Office program - possible payload

severity: low

to: now

type: internal

process.parent.name

type: keyword

type: query

query: process.parent.name:EXCEL.EXE or process.parent.name:MSPUB.EXE or process.parent.name:OUTLOOK.EXE or process.parent.name:POWERPNT.EXE or process.parent.name:VISIO.EXE or process.parent.name:WINWORD.EXE

type: phrase

query: Process Create (rule: ProcessCreate)

store: appState

query: Process Create (rule: ProcessCreate)


severity: low

note:
This a a test sample investigation Guide
This a a test sample investigation Guide
This a a test sample investigation Guide

!{osquery{"query":"SELECT * FROM file WHERE ( path LIKE '/etc/ld.so.conf.d/%' OR path LIKE '/etc/cron.d/%' OR path LIKE '/etc/sudoers.d/%'\nOR path LIKE '/etc/rc%.d/%' OR path LIKE '/etc/init.d/%' OR path LIKE '/etc/systemd/system/%' OR path LIKE\n'/usr/lib/systemd/system/%' )","label":"test-osquery"}}

!{investigate{"label":"test-investigation-query","description":"test-investigation-query","providers":[[{"field":"host.name","excluded":false,"queryType":"phrase","value":"test-host","valueType":"string"}]]}}

to: now

type: query

query: process.parent.name:EXCEL.EXE or process.parent.name:MSPUB.EXE or process.parent.name:OUTLOOK.EXE or process.parent.name:POWERPNT.EXE or process.parent.name:VISIO.EXE or process.parent.name:WINWORD.EXE

query: Process Create (rule: ProcessCreate)

query: Process Create (rule: ProcessCreate)

unit: h

missing_fields_strategy: suppress


severity: low

to: now

type: query

query: process.parent.name:EXCEL.EXE or process.parent.name:MSPUB.EXE or process.parent.name:OUTLOOK.EXE or process.parent.name:POWERPNT.EXE or process.parent.name:VISIO.EXE or process.parent.name:WINWORD.EXE

query: Process Create (rule: ProcessCreate)

query: Process Create (rule: ProcessCreate)


description: Unusual rundll32.exe network connection

severity: low

to: now

type: long

type: eql

query: sequence by process.entity_id with maxspan=2h [process where event.type in ("start", "process_started") and (process.name == "rundll32.exe" or process.pe.original_file_name == "rundll32.exe") and ((process.args == "rundll32.exe" and process.args_count == 1) or (process.args != "rundll32.exe" and process.args_count == 0))] [network where event.type == "connection" and (process.name == "rundll32.exe" or process.pe.original_file_name == "rundll32.exe")]


description: Find Excel events

severity: low

to: now

type: detection

namespace_type: single

type: esql

query: from auditbeat-* METADATA _id, _version, _index | KEEP process.parent.name | where process.parent.name == "EXCEL.EXE"


description: Detects a user associated with a new IP address

severity: medium

to: now

source.ip

type: ip

query: host.name:prml-19 and event.category:authentication and event.outcome:failure


to: now

description: Checks for bad IP addresses listed in the ip-threat-list index

severity: medium

message: Rule {{context.rule.name}} generated {{state.signals_count}} alerts

subject: Test Actions

action_type_id: .email

notifyWhen: onActiveAlert

group: default

query: destination.ip:* or host.ip:*

type: mapping

threat_language: kuery


description: Detects when there are 20 or more failed login attempts from the same IP address with a 2 minute time frame.

severity: low

operator: equals

severity: low

value: Manchester

severity: medium

value: London

severity: high

value: Birmingham

severity: critical

value: Wallingford

to: now

type: threshold

query: host.name:prml-19 and event.category:authentication and event.outcome:failure


description: Generates alerts when the job discovers anomalies over 70

note: Shut down the internet.

to: now

setup: This rule requires data coming in from Elastic Defend.

action_type_id: .index


description: Exception list item

type: match

value: test-host

operator: included

type: simple


description: Exception list containing exceptions for rule with id: 51a51212-5975-45ac-b909-c7840a903141

name: Exceptions for rule - Test Windows server prml-19


int-ips

description: Exception list item

value: liv-win-ser