Justin Ibarra cb34ee5a28 [Rule tuning] Update rules based on docs review (#1663) ...

* [Rule tuning] Update rule verbiage based on docs review

* fix typos

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>

* revert TI rule changes since it was deprecated

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>

Removed changes from:
- rules/cross-platform/threat_intel_filebeat8x.toml
- rules/cross-platform/threat_intel_fleet_integrations.toml

(selectively cherry picked from commit 72c64de3f5)

2022-01-28 19:43:11 +00:00

..

credential_access_access_to_browser_credentials_procargs.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

credential_access_credentials_keychains.toml

[Rule Tuning] Access to Keychain Credentials Directories (#999)

2021-03-19 09:42:32 +01:00

credential_access_dumping_hashes_bi_cmds.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

credential_access_dumping_keychain_security.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

credential_access_kerberosdump_kcc.toml

Additional Att&ck Mappings for credential access Rules (#1495)

2021-09-21 11:04:16 -05:00

credential_access_keychain_pwd_retrieval_security_cmd.toml

[Rule Tuning] Keychain Password Retrieval via Command Line (#992)

2021-04-13 18:16:43 +02:00

credential_access_mitm_localhost_webproxy.toml

[Rule Tuning] WebProxy Settings Modification (#1008)

2021-03-19 10:00:50 +01:00

credential_access_potential_ssh_bruteforce.toml

Update schema for threshold rule type for 7.12 (#976)

2021-03-05 14:35:50 -09:00

credential_access_promt_for_pwd_via_osascript.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

credential_access_systemkey_dumping.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

defense_evasion_apple_softupdates_modification.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

defense_evasion_attempt_del_quarantine_attrib.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

defense_evasion_attempt_to_disable_gatekeeper.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

defense_evasion_install_root_certificate.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

defense_evasion_modify_environment_launchctl.toml

[Rule Tuning] Modification of Environment Variable via Launchctl (#1010)

2021-03-19 10:20:04 +01:00

defense_evasion_privacy_controls_tcc_database_modification.toml

[Rule tuning] Fix spacing in reference URLs (#1455)

2021-08-31 15:59:06 -08:00

defense_evasion_privilege_escalation_privacy_pref_sshd_fulldiskaccess.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

defense_evasion_safari_config_change.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

defense_evasion_sandboxed_office_app_suspicious_zip_file.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

defense_evasion_tcc_bypass_mounted_apfs_access.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

defense_evasion_unload_endpointsecurity_kext.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

discovery_users_domain_built_in_commands.toml

[Rule Tuning] Enumeration of Users or Groups via Built-in Commands (#1046)

2021-04-13 11:31:47 -06:00

execution_defense_evasion_electron_app_childproc_node_js.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

execution_initial_access_suspicious_browser_childproc.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

execution_installer_spawned_network_event.toml

Refresh ATT&CK mappings to v9.0 (#1401)

2021-08-04 14:16:10 -08:00

execution_script_via_automator_workflows.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

execution_scripting_osascript_exec_followed_by_netcon.toml

[Rule Tuning] Update network rule address blocks (#1227)

2021-06-15 09:22:59 -04:00

execution_shell_execution_via_apple_scripting.toml

Switch from process.ppid to process.parent.pid (#1255)

2021-06-22 09:10:28 -06:00

initial_access_suspicious_mac_ms_office_child_process.toml

[Rule Tuning] Suspicious macOS MS Office Child Process (#1022)

2021-03-19 09:48:27 +01:00

lateral_movement_credential_access_kerberos_bifrostconsole.toml

Additional Att&ck Mappings for credential access Rules (#1495)

2021-09-21 11:04:16 -05:00

lateral_movement_mounting_smb_share.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

lateral_movement_remote_ssh_login_enabled.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

lateral_movement_vpn_connection_attempt.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

persistence_account_creation_hide_at_logon.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

persistence_creation_change_launch_agents_file.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

persistence_creation_hidden_login_item_osascript.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

persistence_creation_modif_launch_deamon_sequence.toml

MacOS Launch Daemon Creation Rule - Query Fix (#1722)

2022-01-25 18:50:02 +00:00

persistence_credential_access_authorization_plugin_creation.toml

[Rule tuning] Correct tags with associated threat mappings (#1003)

2021-03-08 14:12:29 -09:00

persistence_defense_evasion_hidden_launch_agent_deamon_logonitem_process.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

persistence_directory_services_plugins_modification.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

persistence_docker_shortcuts_plist_modification.toml

[Rule tuning] Fix spacing in reference URLs (#1455)

2021-08-31 15:59:06 -08:00

persistence_emond_rules_file_creation.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

persistence_emond_rules_process_execution.toml

[Rule tuning] Correct tags with associated threat mappings (#1003)

2021-03-08 14:12:29 -09:00

persistence_enable_root_account.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

persistence_evasion_hidden_launch_agent_deamon_creation.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

persistence_finder_sync_plugin_pluginkit.toml

[Rule tuning] Fix spacing in reference URLs (#1455)

2021-08-31 15:59:06 -08:00

persistence_folder_action_scripts_runtime.toml

MacOS FolderActionScripts Process List Update (#1723)

2022-01-25 20:29:34 +00:00

persistence_login_logout_hooks_defaults.toml

[Rule Tuning] Persistence via Login or Logout Hook (#1020)

2021-03-19 10:32:51 +01:00

persistence_loginwindow_plist_modification.toml

Cleanup note field in rules (#1194)

2021-05-10 13:40:56 -08:00

persistence_modification_sublime_app_plugin_or_script.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

persistence_periodic_tasks_file_mdofiy.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

persistence_screensaver_engine_unexpected_child_process.toml

[Rule tuning] Update rules based on docs review (#1663)

2022-01-28 19:43:11 +00:00

persistence_screensaver_plist_file_modification.toml

[New Rule] Rules to detect screensaver persistence on macOS (#1531)

2021-10-07 08:22:58 -06:00

persistence_suspicious_calendar_modification.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

persistence_via_atom_init_file_modification.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

privilege_escalation_applescript_with_admin_privs.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

privilege_escalation_explicit_creds_via_scripting.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

privilege_escalation_exploit_adobe_acrobat_updater.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

privilege_escalation_local_user_added_to_admin.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00

privilege_escalation_root_crontab_filemod.toml

Update License to Elastic v2 (#944)

2021-03-03 22:12:11 -09:00