Ruben Groenewoud
020fff3aea
* [Rule Tuning] [WIP] Linux DR * Update defense_evasion_binary_copied_to_suspicious_directory.toml * Fixed tag * Added additional tuning * unit test fix * Additional tuning * tuning * added max signals * Added max_signals=1 to brute force rules * Cross-Platform Tuning * Small fix * new_terms conversion * typo * new_terms conversion * Ransomware rule tuning * performance tuning * new_terms conversion for auditd_manager * tune * Need coffee * kql/eql stuff * formatting improvement * new_terms sudo hijacking conversion * exclusion * Deprecations that were added last tuning * Deprecations that were added last tuning * Increased max timespan for brute force rules * version bump * added domain tag * Two tunings * More tuning * Additional tuning * updated_date bump * query optimization * Tuning * Readded the exclusions for this one * Changed int comparison * Some tunings * Update persistence_systemd_scheduled_timer_created.toml * Update rules/linux/privilege_escalation_ld_preload_shared_object_modif.toml Co-authored-by: Isai <59296946+imays11@users.noreply.github.com> * [New Rule] Potential curl CVE-2023-38545 Exploitation * Revert "[New Rule] Potential curl CVE-2023-38545 Exploitation" This reverts commit 9c04d1b53d3d63678289f43ec0c7b617d26f1ce0. * Update rules/cross-platform/command_and_control_non_standard_ssh_port.toml * Update rules/linux/command_and_control_cat_network_activity.toml * Update persistence_message_of_the_day_execution.toml * Changed max_signals * Revert "Merge branch 'main' into rule-tuning-ongoing-dr" This reverts commit 1106b5d2eba1a3529eff325226d6baabfd4b0bf3, reversing changes made to 5ff510757f25b0cb32e1ef18e9e2c34c8ec325a8. * Revertable merge * Update defense_evasion_ld_preload_env_variable_process_injection.toml * File name change --------- Co-authored-by: Isai <59296946+imays11@users.noreply.github.com> Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
81 lines
3.2 KiB
TOML
81 lines
3.2 KiB
TOML
[metadata]
|
|
creation_date = "2023/06/08"
|
|
integration = ["auditd_manager"]
|
|
maturity = "production"
|
|
min_stack_comments = "Multiple field support in the New Terms rule type was added in Elastic 8.6"
|
|
min_stack_version = "8.6.0"
|
|
updated_date = "2023/09/25"
|
|
|
|
[rule]
|
|
author = ["Elastic"]
|
|
description = """
|
|
Monitors file events on sysctl configuration files (e.g., /etc/sysctl.conf, /etc/sysctl.d/*.conf) to identify potential
|
|
unauthorized access or manipulation of system-level configuration settings. Attackers may tamper with the sysctl
|
|
configuration files to modify kernel parameters, potentially compromising system stability, performance, or security.
|
|
"""
|
|
from = "now-119m"
|
|
interval = "60m"
|
|
index = ["auditbeat-*", "logs-auditd_manager.auditd-*"]
|
|
language = "kuery"
|
|
license = "Elastic License v2"
|
|
name = "Suspicious Sysctl File Event"
|
|
note = """## Setup
|
|
This rule requires the use of the `auditd_manager` integration. `Auditd_manager` is a tool designed to simplify and enhance the management of the audit subsystem in Linux systems. It provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. The following steps should be executed in order to install and deploy `auditd_manager` on a Linux system.
|
|
|
|
```
|
|
Kibana -->
|
|
Management -->
|
|
Integrations -->
|
|
Auditd Manager -->
|
|
Add Auditd Manager
|
|
```
|
|
|
|
`Auditd_manager` subscribes to the kernel and receives events as they occur without any additional configuration. However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the "audit rules" configuration box or the "auditd rule files" box by specifying a file to read the audit rules from.
|
|
|
|
For this detection rule to trigger, the following additional audit rules are required to be added to the integration:
|
|
|
|
```
|
|
-w /etc/sysctl.conf -p wa -k sysctl
|
|
-w /etc/sysctl.d -p wa -k sysctl
|
|
```
|
|
|
|
Add the newly installed `auditd manager` to an agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.
|
|
"""
|
|
risk_score = 21
|
|
rule_id = "7592c127-89fb-4209-a8f6-f9944dfd7e02"
|
|
severity = "low"
|
|
tags = [
|
|
"OS: Linux",
|
|
"Use Case: Threat Detection",
|
|
"Tactic: Discovery",
|
|
"Rule Type: BBR"
|
|
]
|
|
timestamp_override = "event.ingested"
|
|
type = "new_terms"
|
|
building_block_type = "default"
|
|
query = '''
|
|
host.os.type:linux and event.category:file and event.action:("opened-file" or "read-file" or "wrote-to-file") and
|
|
file.path : ("/etc/sysctl.conf" or "/etc/sysctl.d" or /etc/sysctl.d/*)
|
|
'''
|
|
|
|
[[rule.threat]]
|
|
framework = "MITRE ATT&CK"
|
|
|
|
[[rule.threat.technique]]
|
|
id = "T1082"
|
|
name = "System Information Discovery"
|
|
reference = "https://attack.mitre.org/techniques/T1082/"
|
|
|
|
[rule.threat.tactic]
|
|
id = "TA0007"
|
|
name = "Discovery"
|
|
reference = "https://attack.mitre.org/tactics/TA0007/"
|
|
|
|
[rule.new_terms]
|
|
field = "new_terms_fields"
|
|
value = ["host.id", "process.executable", "file.path"]
|
|
|
|
[[rule.new_terms.history_window_start]]
|
|
field = "history_window_start"
|
|
value = "now-7d"
|