Samirbous
6029783721
* [New Rule] Security Software Discovery using Grep * fixed index * Update discovery_security_software_grep.toml * Update discovery_security_software_grep.toml * conv to kql and added few AVs * added more AV procs * Update rules/macos/discovery_security_software_grep.toml Co-authored-by: Andrew Pease <7442091+peasead@users.noreply.github.com> * moved to cross-platform * Update discovery_security_software_grep.toml * Update rules/cross-platform/discovery_security_software_grep.toml Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com> * Update rules/cross-platform/discovery_security_software_grep.toml Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com> Co-authored-by: Andrew Pease <7442091+peasead@users.noreply.github.com> Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
71 lines
1.6 KiB
TOML
71 lines
1.6 KiB
TOML
[metadata]
|
|
creation_date = "2020/12/20"
|
|
maturity = "production"
|
|
updated_date = "2020/12/20"
|
|
|
|
[rule]
|
|
author = ["Elastic"]
|
|
description = """
|
|
Identifies the use of the grep command to discover known third-party macOS and Linux security tools, such as
|
|
Antivirus or Host Firewall details.
|
|
"""
|
|
from = "now-9m"
|
|
index = ["logs-endpoint.events.*", "auditbeat-*"]
|
|
language = "kuery"
|
|
license = "Elastic License"
|
|
name = "Security Software Discovery via Grep"
|
|
risk_score = 47
|
|
rule_id = "870aecc0-cea4-4110-af3f-e02e9b373655"
|
|
severity = "medium"
|
|
tags = ["Elastic", "Host", "macOS", "Linux", "Threat Detection", "Discovery"]
|
|
type = "query"
|
|
|
|
query = '''
|
|
event.category : process and event.type : (start or process_started) and
|
|
process.name : grep and
|
|
process.args :
|
|
("Little Snitch" or
|
|
Avast* or
|
|
Avira* or
|
|
ESET* or
|
|
esets_* or
|
|
BlockBlock or
|
|
360* or
|
|
LuLu or
|
|
KnockKnock* or
|
|
kav or
|
|
KIS or
|
|
RTProtectionDaemon or
|
|
Malware* or
|
|
VShieldScanner or
|
|
WebProtection or
|
|
webinspectord or
|
|
McAfee* or
|
|
isecespd* or
|
|
macmnsvc* or
|
|
masvc or
|
|
kesl or
|
|
avscan or
|
|
guard or
|
|
rtvscand or
|
|
symcfgd or
|
|
scmdaemon or
|
|
symantec or
|
|
elastic-endpoint
|
|
)
|
|
'''
|
|
|
|
|
|
[[rule.threat]]
|
|
framework = "MITRE ATT&CK"
|
|
[[rule.threat.technique]]
|
|
id = "T1518"
|
|
name = "Software Discovery"
|
|
reference = "https://attack.mitre.org/techniques/T1518/"
|
|
|
|
|
|
[rule.threat.tactic]
|
|
id = "TA0007"
|
|
name = "Discovery"
|
|
reference = "https://attack.mitre.org/tactics/TA0007/"
|