Terrance DeJesus
4312d8c958
* initial commit * addressing flake errors * added apm to _get_packagted_integrations logic * addressed flake errors * adjusted integration schema and updated rules to be a list * updated several rules and removed a unit test * updated rules with logs-* only index patterns * Update tests/test_all_rules.py Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com> * addressed flake errors * integration is none is windows, endpoint or apm * adding rules with accepted incoming changes from main * fixed tag and tactic alignment errors from unit testing * adjusted unit testing logic for integration tags; added more exclusion rules * adjusted test_integration logic to be rule resistent and skip if -8.3 * adjusted comments for unit test skip * fixed merge conflicts from main * changing test_integration_tag to remove logic for rule version comparisons * added integration tag to new rule * adjusted rules updated_date value * ignore guided onboarding rule in unit tests * added integration tag to new rule Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>
111 lines
3.3 KiB
TOML
111 lines
3.3 KiB
TOML
[metadata]
|
|
creation_date = "2022/07/22"
|
|
maturity = "production"
|
|
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
|
|
min_stack_version = "8.3.0"
|
|
updated_date = "2022/12/15"
|
|
integration = ["endpoint"]
|
|
|
|
[rule]
|
|
author = ["Elastic"]
|
|
description = """
|
|
Detects the manual creation of files in specific etc directories, via user root, used by Linux malware to persist and elevate privileges on compromised systems. File creation in these directories should not be entirely common and could indicate a malicious binary or script installing persistence for long term access.
|
|
"""
|
|
from = "now-9m"
|
|
index = ["logs-endpoint.events.*"]
|
|
language = "eql"
|
|
license = "Elastic License v2"
|
|
name = "Suspicious File Creation in /etc for Persistence"
|
|
references = [
|
|
"https://www.intezer.com/blog/incident-response/orbit-new-undetected-linux-threat/",
|
|
"https://www.intezer.com/blog/research/lightning-framework-new-linux-threat/"
|
|
]
|
|
risk_score = 47
|
|
rule_id = "1c84dd64-7e6c-4bad-ac73-a5014ee37042"
|
|
severity = "medium"
|
|
tags = ["Elastic", "Host", "Linux", "Threat Detection", "Persistence", "Orbit", "Lightning Framework"]
|
|
timestamp_override = "event.ingested"
|
|
type = "eql"
|
|
|
|
query = '''
|
|
file where event.action == "creation" and user.name == "root" and
|
|
file.path : ("/etc/ld.so.conf.d/*", "/etc/cron.d/*", "/etc/sudoers.d/*", "/etc/rc.d/init.d/*", "/etc/systemd/system/*")
|
|
and not process.executable : ("*/dpkg", "*/yum", "*/apt", "*/dnf", "*/systemd", "*/snapd", "*/dnf-automatic",
|
|
"*/yum-cron", "*/elastic-agent", "*/dnfdaemon-system")
|
|
'''
|
|
|
|
[[rule.threat]]
|
|
framework = "MITRE ATT&CK"
|
|
|
|
[rule.threat.tactic]
|
|
id = "TA0003"
|
|
name = "Persistence"
|
|
reference = "https://attack.mitre.org/tactics/TA0003/"
|
|
|
|
[[rule.threat.technique]]
|
|
id = "T1037"
|
|
name = "Boot or Logon Initialization Scripts"
|
|
reference = "https://attack.mitre.org/techniques/T1037/"
|
|
|
|
[[rule.threat.technique.subtechnique]]
|
|
id = "T1037.004"
|
|
name = "RC Scripts"
|
|
reference = "https://attack.mitre.org/techniques/T1037/004/"
|
|
|
|
[[rule.threat.technique]]
|
|
id = "T1574"
|
|
name = "Hijack Execution Flow"
|
|
reference = "https://attack.mitre.org/techniques/T1574/"
|
|
|
|
[[rule.threat.technique.subtechnique]]
|
|
id = "T1574.006"
|
|
name = "Dynamic Linker Hijacking"
|
|
reference = "https://attack.mitre.org/techniques/T1574/006/"
|
|
|
|
[[rule.threat.technique]]
|
|
id = "T1543"
|
|
name = "Create or Modify System Process"
|
|
reference = "https://attack.mitre.org/techniques/T1543/"
|
|
|
|
[[rule.threat.technique.subtechnique]]
|
|
id = "T1543.002"
|
|
name = "Systemd Service"
|
|
reference = "https://attack.mitre.org/techniques/T1543/002/"
|
|
|
|
[[rule.threat]]
|
|
framework = "MITRE ATT&CK"
|
|
|
|
[rule.threat.tactic]
|
|
id = "TA0002"
|
|
name = "Execution"
|
|
reference = "https://attack.mitre.org/tactics/TA0002/"
|
|
|
|
[[rule.threat.technique]]
|
|
id = "T1053"
|
|
name = "Scheduled Task/Job"
|
|
reference = "https://attack.mitre.org/techniques/T1053/"
|
|
|
|
[[rule.threat.technique.subtechnique]]
|
|
id = "T1053.003"
|
|
name = "Cron"
|
|
reference = "https://attack.mitre.org/techniques/T1053/003/"
|
|
|
|
[[rule.threat]]
|
|
framework = "MITRE ATT&CK"
|
|
|
|
[rule.threat.tactic]
|
|
id = "TA0004"
|
|
name = "Privilege Escalation"
|
|
reference = "https://attack.mitre.org/tactics/TA0004/"
|
|
|
|
[[rule.threat.technique]]
|
|
id = "T1548"
|
|
name = "Abuse Elevation Control Mechanism"
|
|
reference = "https://attack.mitre.org/techniques/T1548/"
|
|
|
|
[[rule.threat.technique.subtechnique]]
|
|
id = "T1548.003"
|
|
name = "Sudo and Sudo Caching"
|
|
reference = "https://attack.mitre.org/techniques/T1548/003/"
|
|
|