github-actions[bot]
f37d13f29b
* Locked versions for releases: 8.3,8.4,8.5,8.6,8.7,8.8,8.9,8.10,8.11,8.12 * Update detection_rules/etc/deprecated_rules.json --------- Co-authored-by: terrancedejesus <terrancedejesus@users.noreply.github.com> Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
9039 lines
325 KiB
JSON
9039 lines
325 KiB
JSON
{
|
|
"000047bb-b27a-47ec-8b62-ef1a5d2c9e19": {
|
|
"min_stack_version": "8.10",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 206,
|
|
"rule_name": "Attempt to Modify an Okta Policy Rule",
|
|
"sha256": "ab816235d1086e87acda877a4f3bc72e72af952ecf7a40b59d2d45991812ef73",
|
|
"type": "query",
|
|
"version": 107
|
|
}
|
|
},
|
|
"rule_name": "Attempt to Modify an Okta Policy Rule",
|
|
"sha256": "8e250a9c8ff04c25044e7bd0932764e6d21ad669c07dcbd9589c825b771b13f2",
|
|
"type": "query",
|
|
"version": 207
|
|
},
|
|
"00140285-b827-4aee-aa09-8113f58a08f3": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Credential Access via Windows Utilities",
|
|
"sha256": "456e5ed43e056841aea460851e9e496aa85a9828fcb4bebade3a4f8b1d2a637e",
|
|
"type": "eql",
|
|
"version": 110
|
|
},
|
|
"0022d47d-39c7-4f69-a232-4fe9dc7a3acd": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "System Shells via Services",
|
|
"sha256": "629ee62bf64e9993225823b0969be69d7b4494d53adc0ffbcdc501745be3ab8f",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"00678712-b2df-11ed-afe9-f661ea17fbcc": {
|
|
"min_stack_version": "8.4",
|
|
"rule_name": "Google Workspace Suspended User Account Renewed",
|
|
"sha256": "cfbc6ffe95e39937d68146e42f932947e2c3c96cc9a42ab296e12bc8c613f5f1",
|
|
"type": "query",
|
|
"version": 2
|
|
},
|
|
"0136b315-b566-482f-866c-1d8e2477ba16": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Microsoft 365 User Restricted from Sending Email",
|
|
"sha256": "3801a06e2eb380734652847208adb12ceb5e1bb394da148a047b8a25afe3bc17",
|
|
"type": "query",
|
|
"version": 102
|
|
},
|
|
"015cca13-8832-49ac-a01b-a396114809f6": {
|
|
"min_stack_version": "8.9",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 204,
|
|
"rule_name": "AWS Redshift Cluster Creation",
|
|
"sha256": "7a1faa4c3dfde300711d7bb69b6a93b8e64a3d33cc83a37a3d5cfcf6d9b09b2d",
|
|
"type": "query",
|
|
"version": 105
|
|
}
|
|
},
|
|
"rule_name": "AWS Redshift Cluster Creation",
|
|
"sha256": "b1c8e121fb4363f74d0c8928f3335aa2f374919f5257a9f4b17483773c49f348",
|
|
"type": "query",
|
|
"version": 205
|
|
},
|
|
"0171f283-ade7-4f87-9521-ac346c68cc9b": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Network Scan Detected",
|
|
"sha256": "6f969409e34ce2e04899c197404f8717d28ae3866797966be0653c4a3867fdc6",
|
|
"type": "threshold",
|
|
"version": 4
|
|
},
|
|
"027ff9ea-85e7-42e3-99d2-bbb7069e02eb": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Cookies Theft via Browser Debugging",
|
|
"sha256": "5717d643abdcfef9a6d60fff6d57720c82151980bb8e27c67620f86f538f9a1a",
|
|
"type": "eql",
|
|
"version": 104
|
|
},
|
|
"02a23ee7-c8f8-4701-b99d-e9038ce313cb": {
|
|
"min_stack_version": "8.4",
|
|
"rule_name": "Process Created with an Elevated Token",
|
|
"sha256": "6c3c1a1a62be741fbfd99c0d2a69725f05c69adb7d911d8241132facbd72dbe8",
|
|
"type": "eql",
|
|
"version": 5
|
|
},
|
|
"02a4576a-7480-4284-9327-548a806b5e48": {
|
|
"min_stack_version": "8.8",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 205,
|
|
"rule_name": "Potential Credential Access via DuplicateHandle in LSASS",
|
|
"sha256": "8f8844fda927ba3149c7d983e7f7619e33e5745f8b1f389c0e10f3b6ba852e0a",
|
|
"type": "eql",
|
|
"version": 106
|
|
}
|
|
},
|
|
"rule_name": "Potential Credential Access via DuplicateHandle in LSASS",
|
|
"sha256": "e194561c4501f18810b36c5747c2d6cdddb401d1dc29d19507a4af173c85ef22",
|
|
"type": "eql",
|
|
"version": 207
|
|
},
|
|
"02ea4563-ec10-4974-b7de-12e65aa4f9b3": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Dumping Account Hashes via Built-In Commands",
|
|
"sha256": "6995ce3fd849830e0591d6419fc8b53d604990cd30316594c1a70f032d3115a1",
|
|
"type": "query",
|
|
"version": 105
|
|
},
|
|
"03024bd9-d23f-4ec1-8674-3cf1a21e130b": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Microsoft 365 Exchange Safe Attachment Rule Disabled",
|
|
"sha256": "f0f075e54cb17ce304f0d93b12277a29c7b1454d8bec5c05615e31fc6ebee725",
|
|
"type": "query",
|
|
"version": 102
|
|
},
|
|
"035889c4-2686-4583-a7df-67f89c292f2c": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "High Number of Process and/or Service Terminations",
|
|
"sha256": "71c36a582a1af6f143c5b2316611eceae40fef43328be88831c24b2317e7ccae",
|
|
"type": "threshold",
|
|
"version": 106
|
|
},
|
|
"03a514d9-500e-443e-b6a9-72718c548f6c": {
|
|
"min_stack_version": "8.8",
|
|
"rule_name": "SSH Process Launched From Inside A Container",
|
|
"sha256": "f4b1b23b638e8ea812f6cf173daedccc2a82fb1df5feeca4e6723b6726052c4d",
|
|
"type": "eql",
|
|
"version": 2
|
|
},
|
|
"03c23d45-d3cb-4ad4-ab5d-b361ffe8724a": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Network Scan Executed From Host",
|
|
"sha256": "ec82385a8fee3e9b8a3e2bfe0b4a9678a7cd9d31611bbc8c5538214912a0831d",
|
|
"type": "threshold",
|
|
"version": 2
|
|
},
|
|
"0415f22a-2336-45fa-ba07-618a5942e22c": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Modification of OpenSSH Binaries",
|
|
"sha256": "a8e44864c0255586bcea1d4b241810c54170028501986f52bb80bf79c2136c98",
|
|
"type": "query",
|
|
"version": 107
|
|
},
|
|
"041d4d41-9589-43e2-ba13-5680af75ebc2": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Deprecated - Potential DNS Tunneling via Iodine",
|
|
"sha256": "bee1691d491fbbea753a91ebb85df78974469ba5769d4a517e72420787563047",
|
|
"type": "query",
|
|
"version": 105
|
|
},
|
|
"04c5a96f-19c5-44fd-9571-a0b033f9086f": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Azure AD Global Administrator Role Assigned",
|
|
"sha256": "fd3270ab237a24dde97ddba5bd81bde19c086742e131a59117fa0e610f05bef9",
|
|
"type": "query",
|
|
"version": 102
|
|
},
|
|
"053a0387-f3b5-4ba5-8245-8002cca2bd08": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential DLL Side-Loading via Microsoft Antimalware Service Executable",
|
|
"sha256": "e916c4a76f7f4724dde59c0d5c7fadb93add0c6ad283f0e1d57ae6305853886f",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"054db96b-fd34-43b3-9af2-587b3bd33964": {
|
|
"min_stack_version": "8.6",
|
|
"rule_name": "Potential Persistence Through Systemd-udevd",
|
|
"sha256": "e8095cdee7458ed504ab6072b4d91c7d572d159b7f95965cb8b93a5fc4c1ed32",
|
|
"type": "new_terms",
|
|
"version": 1
|
|
},
|
|
"0564fb9d-90b9-4234-a411-82a546dc1343": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Microsoft IIS Service Account Password Dumped",
|
|
"sha256": "1e11e71d550916f3027c212e5cb88b8489cc66382f8969badce547b978a64358",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"05b358de-aa6d-4f6c-89e6-78f74018b43b": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Conhost Spawned By Suspicious Parent Process",
|
|
"sha256": "73ca1614ed192b3b473355db2817b5f0a68bdd630741d03fa3c3ac9fb6596bfc",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"05cad2fb-200c-407f-b472-02ea8c9e5e4a": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Tainted Kernel Module Load",
|
|
"sha256": "096c4047e2d5c332df1556e653b387ff45bc20f504f8a4b0a6b48151a55674ed",
|
|
"type": "query",
|
|
"version": 2
|
|
},
|
|
"05e5a668-7b51-4a67-93ab-e9af405c9ef3": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Interactive Terminal Spawned via Perl",
|
|
"sha256": "c509bf24e613999a96e9f6e7ec6a6754b69d21683106ac3528a730fb635ad675",
|
|
"type": "query",
|
|
"version": 107
|
|
},
|
|
"0635c542-1b96-4335-9b47-126582d2c19a": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Remote System Discovery Commands",
|
|
"sha256": "3ff2e26f26973251308b3a47b92955b2d31e844b07905f658b693e4464638cc1",
|
|
"type": "eql",
|
|
"version": 110
|
|
},
|
|
"06568a02-af29-4f20-929c-f3af281e41aa": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "System Time Discovery",
|
|
"sha256": "79c7e1897310a5fff8e9aa62c967679ae8fb0f6681b13c0fd66289142de0e1d6",
|
|
"type": "eql",
|
|
"version": 5
|
|
},
|
|
"0678bc9c-b71a-433b-87e6-2f664b6b3131": {
|
|
"min_stack_version": "8.9",
|
|
"rule_name": "Unusual Remote File Size",
|
|
"sha256": "9e8ce2ede438524fde20e36cf675fed67bdb8b9f33c673b0573c7ab9c8ef476d",
|
|
"type": "machine_learning",
|
|
"version": 2
|
|
},
|
|
"06a7a03c-c735-47a6-a313-51c354aef6c3": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Enumerating Domain Trusts via DSQUERY.EXE",
|
|
"sha256": "15afab23b7e9efd31d6586f78173366c7895bb1610bd6431cfc8cf2daf8dc063",
|
|
"type": "eql",
|
|
"version": 5
|
|
},
|
|
"06dceabf-adca-48af-ac79-ffdf4c3b1e9a": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Evasion via Filter Manager",
|
|
"sha256": "ff88a573a0a319738afbfe4b609f25b741830e26d67d348a9b995e5a9d489dcb",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"074464f9-f30d-4029-8c03-0ed237fffec7": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Remote Desktop Enabled in Windows Firewall by Netsh",
|
|
"sha256": "6992b6ee67e76b2c6fa0320f7a2f7acccc539973b27803777e37f928b1adce03",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"07639887-da3a-4fbf-9532-8ce748ff8c50": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "GitHub Protected Branch Settings Changed",
|
|
"sha256": "092ecb6ac6f1197744e2e114398553fa810674561481b66f9665c3ed95ff0017",
|
|
"type": "eql",
|
|
"version": 2
|
|
},
|
|
"0787daa6-f8c5-453b-a4ec-048037f6c1cd": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Suspicious Proc Pseudo File System Enumeration",
|
|
"sha256": "9a08bba2e66dd9f99a6a87ab539e1f2f205273b9af8e42a91a6be93beeb479e8",
|
|
"type": "threshold",
|
|
"version": 5
|
|
},
|
|
"07b1ef73-1fde-4a49-a34a-5dd40011b076": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Local Account TokenFilter Policy Disabled",
|
|
"sha256": "89428d0f0fc36a5b1ff0704bcfaf222c5592e066c0a1179e4d851b02b8384d67",
|
|
"type": "eql",
|
|
"version": 6
|
|
},
|
|
"07b5f85a-240f-11ed-b3d9-f661ea17fbce": {
|
|
"min_stack_version": "8.4",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 103,
|
|
"rule_name": "Google Drive Ownership Transferred via Google Workspace",
|
|
"sha256": "4ec0b63c545009d7d16d34cd9b95f34edbcf4135f498aa77a805f544b07e6310",
|
|
"type": "query",
|
|
"version": 5
|
|
}
|
|
},
|
|
"rule_name": "Google Drive Ownership Transferred via Google Workspace",
|
|
"sha256": "9df4d9a342110c032419b2564bf6376a9357291ca8b3ead073faf9e5214419e6",
|
|
"type": "query",
|
|
"version": 106
|
|
},
|
|
"080bc66a-5d56-4d1f-8071-817671716db9": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Suspicious Browser Child Process",
|
|
"sha256": "c250a73408b1392c937770c4ced1fb28a2703649fe04cdb78b0e5b7b4cf63ec8",
|
|
"type": "eql",
|
|
"version": 105
|
|
},
|
|
"082e3f8c-6f80-485c-91eb-5b112cb79b28": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Launch Agent Creation or Modification and Immediate Loading",
|
|
"sha256": "3e3611a0cd7131c9e8caba18a69dab717a16cf76442be2888fb39623e7a310bf",
|
|
"type": "eql",
|
|
"version": 105
|
|
},
|
|
"083fa162-e790-4d85-9aeb-4fea04188adb": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Suspicious Hidden Child Process of Launchd",
|
|
"sha256": "102bf6dbf633ea578191b0cba7f03a80e733a63b307a563d2287868c832d13c4",
|
|
"type": "query",
|
|
"version": 105
|
|
},
|
|
"0859355c-0f08-4b43-8ff5-7d2a4789fc08": {
|
|
"min_stack_version": "8.4",
|
|
"rule_name": "First Time Seen Removable Device",
|
|
"sha256": "8f68357de02e845b6234f38e1867817fe26ebc0f260faded9b8c6d2be88b2ae0",
|
|
"type": "new_terms",
|
|
"version": 2
|
|
},
|
|
"089db1af-740d-4d84-9a5b-babd6de143b0": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Windows Account or Group Discovery",
|
|
"sha256": "bb76e59c53a0b50ac513121a9591fecea2eac83851584542c8860bb511c0785f",
|
|
"type": "eql",
|
|
"version": 3
|
|
},
|
|
"08d5d7e2-740f-44d8-aeda-e41f4263efaf": {
|
|
"rule_name": "TCP Port 8000 Activity to the Internet",
|
|
"sha256": "d0c6cdede82a9cafacef49dcd6afc1b13383214401be7fbaa3b09ae1fbe9a3fb",
|
|
"type": "query",
|
|
"version": 100
|
|
},
|
|
"092b068f-84ac-485d-8a55-7dd9e006715f": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Creation of Hidden Launch Agent or Daemon",
|
|
"sha256": "a1faf99442ff04d9e895ed0ef988840ddea9fafcb839a00391dd27152099ecf8",
|
|
"type": "eql",
|
|
"version": 106
|
|
},
|
|
"09443c92-46b3-45a4-8f25-383b028b258d": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Process Termination followed by Deletion",
|
|
"sha256": "ee3f7d78630d4adbddf7402565e30e9e5b09adbfb02eaed22e884dfd5429bc8e",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"0968cfbd-40f0-4b1c-b7b1-a60736c7b241": {
|
|
"rule_name": "Linux Restricted Shell Breakout via cpulimit Shell Evasion",
|
|
"sha256": "a49a4358e83bf40e29e9dad1bb8afb6700d89cfe5a5b3e29adaa28e1f3c0b244",
|
|
"type": "eql",
|
|
"version": 100
|
|
},
|
|
"09bc6c90-7501-494d-b015-5d988dc3f233": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "File Creation, Execution and Self-Deletion in Suspicious Directory",
|
|
"sha256": "41f9768d8739cf9cff0a5ab80f5ac4056209af12abd8a87456875d5fabd271ee",
|
|
"type": "eql",
|
|
"version": 3
|
|
},
|
|
"09d028a5-dcde-409f-8ae0-557cef1b7082": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Azure Frontdoor Web Application Firewall (WAF) Policy Deleted",
|
|
"sha256": "08faf9e24053c3b8463889e3c47cec194c8acedaad33ce17bc7acd6ac50c3a53",
|
|
"type": "query",
|
|
"version": 102
|
|
},
|
|
"0a97b20f-4144-49ea-be32-b540ecc445de": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Malware - Detected - Elastic Endgame",
|
|
"sha256": "e7526826870e2810425f96e236661c418fd0b78632279740ea92cfe0edc0de6c",
|
|
"type": "query",
|
|
"version": 101
|
|
},
|
|
"0ab319ef-92b8-4c7f-989b-5de93c852e93": {
|
|
"min_stack_version": "8.10",
|
|
"rule_name": "Statistical Model Detected C2 Beaconing Activity with High Confidence",
|
|
"sha256": "9b3055e1c359a21625fd9a6ffb3b15d6ddcc6c9cbce357e0f66d68ba9a2a4164",
|
|
"type": "query",
|
|
"version": 2
|
|
},
|
|
"0abf0c5b-62dd-48d2-ac4e-6b43fe3a6e83": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "PowerShell Script with Remote Execution Capabilities via WinRM",
|
|
"sha256": "4d8b6dfe62f6b9bc2ce89b79f7ad0e881dc744022d619b382b2e6e2d3ed15a17",
|
|
"type": "query",
|
|
"version": 4
|
|
},
|
|
"0b29cab4-dbbd-4a3f-9e8e-1287c7c11ae5": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Anomalous Windows Process Creation",
|
|
"sha256": "a97e8495484e9053dfe57d0b3b3e2cc47984f3e326f8bce2c00bcab788337579",
|
|
"type": "machine_learning",
|
|
"version": 105
|
|
},
|
|
"0b2f3da5-b5ec-47d1-908b-6ebb74814289": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "User account exposed to Kerberoasting",
|
|
"sha256": "4d9914b3179a3e81042daf2378c760535c3b1fe6a90367a9f939f8427e1c4500",
|
|
"type": "query",
|
|
"version": 108
|
|
},
|
|
"0b803267-74c5-444d-ae29-32b5db2d562a": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Shell via Wildcard Injection Detected",
|
|
"sha256": "4de1162d4124823c1b08df4e7630411d08269eb515c9cfc8179d1eb8a06327ae",
|
|
"type": "eql",
|
|
"version": 4
|
|
},
|
|
"0c093569-dff9-42b6-87b1-0242d9f7d9b4": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Processes with Trailing Spaces",
|
|
"sha256": "e4ad46e5487eedd9a600516e6aaaef43bfdd74f9bab9254376a7ab03846dbdf1",
|
|
"type": "eql",
|
|
"version": 1
|
|
},
|
|
"0c41e478-5263-4c69-8f9e-7dfd2c22da64": {
|
|
"min_stack_version": "8.5",
|
|
"rule_name": "Threat Intel IP Address Indicator Match",
|
|
"sha256": "0226bcc18f65bc8670480b12a71f13488f9f7fc519e664d5a16634de8b356951",
|
|
"type": "threat_match",
|
|
"version": 4
|
|
},
|
|
"0c7ca5c2-728d-4ad9-b1c5-bbba83ecb1f4": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Peripheral Device Discovery",
|
|
"sha256": "9453d6d14110a5bd8e263b6c8438683e2151cdb64a07cc0497960ca3ce991b4e",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"0c9a14d9-d65d-486f-9b5b-91e4e6b22bd0": {
|
|
"min_stack_version": "8.5",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 203,
|
|
"rule_name": "Threat Intel Indicator Match",
|
|
"sha256": "92b2fe11e138552116f69ae042966934b52ed36c6cfa6e03831de7f703c68bca",
|
|
"type": "threat_match",
|
|
"version": 104
|
|
}
|
|
},
|
|
"rule_name": "Deprecated - Threat Intel Indicator Match",
|
|
"sha256": "ec5023dc861db76d527d73f0343ba6a97b38c94f47aaa698929029d922d98e6a",
|
|
"type": "threat_match",
|
|
"version": 204
|
|
},
|
|
"0ce6487d-8069-4888-9ddd-61b52490cebc": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "O365 Exchange Suspicious Mailbox Right Delegation",
|
|
"sha256": "2dfc5642c7eff9f946739bbe4289e5bd8fe6f4374a492ed1fc5215e7b6e721ff",
|
|
"type": "query",
|
|
"version": 102
|
|
},
|
|
"0d160033-fab7-4e72-85a3-3a9d80c8bff7": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Multiple Alerts Involving a User",
|
|
"sha256": "43984fe31af84306a2a8266b867a70c8b185159a7419988e7211ff4a74fde252",
|
|
"type": "threshold",
|
|
"version": 3
|
|
},
|
|
"0d69150b-96f8-467c-a86d-a67a3378ce77": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Nping Process Activity",
|
|
"sha256": "affd117afc6ebeb37b988f85e144c43ebcadc77ed73c48470478dd749dd593f3",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"0d8ad79f-9025-45d8-80c1-4f0cd3c5e8e5": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Execution of File Written or Modified by Microsoft Office",
|
|
"sha256": "0f8793b32099bcedee8142d49e3265c81daa7a103fd8a4005b61e56aeeb487f4",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"0e52157a-8e96-4a95-a6e3-5faae5081a74": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "SharePoint Malware File Upload",
|
|
"sha256": "e32858e7a0449a506cfe595eabf2e1e82954cf683de287c05d0bf7295253c579",
|
|
"type": "query",
|
|
"version": 102
|
|
},
|
|
"0e5acaae-6a64-4bbc-adb8-27649c03f7e1": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "GCP Service Account Key Creation",
|
|
"sha256": "ffe1bc8de6ff95c0fd9bb67fb93eace9b0ba96055cbf863fe0286dd7b033061b",
|
|
"type": "query",
|
|
"version": 104
|
|
},
|
|
"0e79980b-4250-4a50-a509-69294c14e84b": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "MsBuild Making Network Connections",
|
|
"sha256": "a1bf29b67c9d4b591676101ae899db1fa607402bfd59d1ea37a30c02d751f9b3",
|
|
"type": "eql",
|
|
"version": 106
|
|
},
|
|
"0f4d35e4-925e-4959-ab24-911be207ee6f": {
|
|
"min_stack_version": "8.6",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 102,
|
|
"rule_name": "RC Script Creation",
|
|
"sha256": "56ff748867dc738357a731cfd37b4ae44c954383780d616e3d9034aed76dd9e1",
|
|
"type": "eql",
|
|
"version": 6
|
|
}
|
|
},
|
|
"rule_name": "Potential Persistence Through Run Control Detected",
|
|
"sha256": "2fbbc2683f2b38e5fbfa30e12d93b04afa2aa3f59df9b312bb793cab7f3211d8",
|
|
"type": "new_terms",
|
|
"version": 108
|
|
},
|
|
"0f56369f-eb3d-459c-a00b-87c2bf7bdfc5": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Netcat Listener Established via rlwrap",
|
|
"sha256": "709341b184f3833219d910074fc3df6035266d8b90c5cdcf213a48afbcdcc538",
|
|
"type": "eql",
|
|
"version": 2
|
|
},
|
|
"0f616aee-8161-4120-857e-742366f5eeb3": {
|
|
"rule_name": "PowerShell spawning Cmd",
|
|
"sha256": "02b0c2f928a762f61da9b493780d5fe36255c5565093c0d59db3776340a7b2be",
|
|
"type": "query",
|
|
"version": 100
|
|
},
|
|
"0f93cb9a-1931-48c2-8cd0-f173fd3e5283": {
|
|
"min_stack_version": "8.8",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 205,
|
|
"rule_name": "Potential LSASS Memory Dump via PssCaptureSnapShot",
|
|
"sha256": "62abee660a99e58c72f6c4c79047fea8effc510ba10448a766fc3d03d4a36720",
|
|
"type": "threshold",
|
|
"version": 106
|
|
}
|
|
},
|
|
"rule_name": "Potential LSASS Memory Dump via PssCaptureSnapShot",
|
|
"sha256": "202c9c176a43f16620bdff4bf9d03665053b52c262d0277462afd841a08c623c",
|
|
"type": "threshold",
|
|
"version": 207
|
|
},
|
|
"0ff84c42-873d-41a2-a4ed-08d74d352d01": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Privilege Escalation via Root Crontab File Modification",
|
|
"sha256": "667a8075ceb2fd14308a5c021811d4dadc06be89300c4eb74d8fc02268962810",
|
|
"type": "query",
|
|
"version": 105
|
|
},
|
|
"10754992-28c7-4472-be5b-f3770fd04f2d": {
|
|
"rule_name": "Linux Restricted Shell Breakout via awk Commands",
|
|
"sha256": "d712972fb7e71daddbd2b5ced9e9845171a1e544e0e981d72fa350f743dec969",
|
|
"type": "eql",
|
|
"version": 100
|
|
},
|
|
"10a500bb-a28f-418e-ba29-ca4c8d1a9f2f": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "WebProxy Settings Modification",
|
|
"sha256": "8d0a544fd454889ae996a250c40de6b79ca174a55887fc883a6c0f1d6fb672b4",
|
|
"type": "query",
|
|
"version": 105
|
|
},
|
|
"11013227-0301-4a8c-b150-4db924484475": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Abnormally Large DNS Response",
|
|
"sha256": "a8cf0f414de9d2716b4dbf0198d541bf88a0777aefe1be83c09fc6f472d86721",
|
|
"type": "query",
|
|
"version": 105
|
|
},
|
|
"1160dcdb-0a0a-4a79-91d8-9b84616edebd": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential DLL Side-Loading via Trusted Microsoft Programs",
|
|
"sha256": "8b1466a22fc9368899862a84bebbbc8304df306ba80857e8857991f935d82953",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"1178ae09-5aff-460a-9f2f-455cd0ac4d8e": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "UAC Bypass via Windows Firewall Snap-In Hijack",
|
|
"sha256": "b49dd643b78ce80ed0ff86c6b03d206c7922e4364a738c813cb0d96194b9e53d",
|
|
"type": "eql",
|
|
"version": 109
|
|
},
|
|
"119c8877-8613-416d-a98a-96b6664ee73a": {
|
|
"min_stack_version": "8.9",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 204,
|
|
"rule_name": "AWS RDS Snapshot Export",
|
|
"sha256": "d7c79adde1bf89e2a7544eec2729c0b5c45c62fdcdd5f00090d28e5cb73f6da7",
|
|
"type": "query",
|
|
"version": 105
|
|
}
|
|
},
|
|
"rule_name": "AWS RDS Snapshot Export",
|
|
"sha256": "8ad9d6381bc6ad8046516f5f50cdc304ccb0958161af21a171928b95088b6b17",
|
|
"type": "query",
|
|
"version": 205
|
|
},
|
|
"119c8877-8613-416d-a98a-96b6664ee73a5": {
|
|
"rule_name": "AWS RDS Snapshot Export",
|
|
"sha256": "dc07a6005a4da8eea9b23185abaf24f9db9fbe2271e4c8ddc3f39f020a9ea3d0",
|
|
"type": "query",
|
|
"version": 100
|
|
},
|
|
"11dd9713-0ec6-4110-9707-32daae1ee68c": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "PowerShell Script with Token Impersonation Capabilities",
|
|
"sha256": "9e7a7c40caec4ca683ed1aad64cea12a7f3d4fae3015ca523b447c1a93362aa4",
|
|
"type": "query",
|
|
"version": 10
|
|
},
|
|
"11ea6bec-ebde-4d71-a8e9-784948f8e3e9": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Third-party Backup Files Deleted via Unexpected Process",
|
|
"sha256": "e3f49374583b3283173ec5a2b56bf984b274041c4f13c423595f0740c9437bc5",
|
|
"type": "eql",
|
|
"version": 109
|
|
},
|
|
"12051077-0124-4394-9522-8f4f4db1d674": {
|
|
"min_stack_version": "8.9",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 204,
|
|
"rule_name": "AWS Route 53 Domain Transfer Lock Disabled",
|
|
"sha256": "845e16fdf9dd59a0ee37658ad41a83a6149e5487422dac763de90cde6aad227f",
|
|
"type": "query",
|
|
"version": 105
|
|
}
|
|
},
|
|
"rule_name": "AWS Route 53 Domain Transfer Lock Disabled",
|
|
"sha256": "ee7d0fde7179ecae486163263d6baf71e90dd5e6048b4db1674a4d4eff6f2975",
|
|
"type": "query",
|
|
"version": 205
|
|
},
|
|
"120559c6-5e24-49f4-9e30-8ffe697df6b9": {
|
|
"rule_name": "User Discovery via Whoami",
|
|
"sha256": "226bffc8f05628ba3e39c84344b42aff68d3c0a8ad10612929d4cb704d902d3e",
|
|
"type": "query",
|
|
"version": 100
|
|
},
|
|
"1224da6c-0326-4b4f-8454-68cdc5ae542b": {
|
|
"min_stack_version": "8.9",
|
|
"rule_name": "Suspicious Windows Process Cluster Spawned by a User",
|
|
"sha256": "3271476794a96692c0bcef81fe8cac64f7f9b72274691a91d92f0075be7a8bba",
|
|
"type": "machine_learning",
|
|
"version": 2
|
|
},
|
|
"125417b8-d3df-479f-8418-12d7e034fee3": {
|
|
"rule_name": "Attempt to Disable IPTables or Firewall",
|
|
"sha256": "7852c6d19ed6216fb60c46fdeffb6d109d509b83ed076aab9240c57540fc2960",
|
|
"type": "query",
|
|
"version": 100
|
|
},
|
|
"128468bf-cab1-4637-99ea-fdf3780a4609": {
|
|
"min_stack_version": "8.8",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 104,
|
|
"rule_name": "Suspicious Lsass Process Access",
|
|
"sha256": "c30f6e62697cdaf210db4d6f79d2686bc91e4427ee7bbaea3468482a88373d5c",
|
|
"type": "eql",
|
|
"version": 5
|
|
}
|
|
},
|
|
"rule_name": "Suspicious Lsass Process Access",
|
|
"sha256": "9a0adebc4688de3fd5a514af5e63944ea533f9a6b3a1b9832c1736e34b9ff2a9",
|
|
"type": "eql",
|
|
"version": 106
|
|
},
|
|
"12a2f15d-597e-4334-88ff-38a02cb1330b": {
|
|
"min_stack_version": "8.4",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 199,
|
|
"rule_name": "Kubernetes Suspicious Self-Subject Review",
|
|
"sha256": "658882e3d31e0988978c24743e8f15fb3423fde5b395cbfc75a641548a291359",
|
|
"type": "query",
|
|
"version": 101
|
|
}
|
|
},
|
|
"rule_name": "Kubernetes Suspicious Self-Subject Review",
|
|
"sha256": "88110d27337692c0a9c75ea40f6f8f7a3d14cb6e22a5864992d0ca94879b45ec",
|
|
"type": "query",
|
|
"version": 203
|
|
},
|
|
"12cbf709-69e8-4055-94f9-24314385c27e": {
|
|
"min_stack_version": "8.4",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 199,
|
|
"rule_name": "Kubernetes Pod Created With HostNetwork",
|
|
"sha256": "00e261301692eeb8bc7453cbea5c4605ca9c6d2ae38199b35ad83ffd4a9d0c4b",
|
|
"type": "query",
|
|
"version": 101
|
|
}
|
|
},
|
|
"rule_name": "Kubernetes Pod Created With HostNetwork",
|
|
"sha256": "e48fb5d94222f67fbea19233c7fea01163d00908c3844df80f9e36d5e87ad7b7",
|
|
"type": "query",
|
|
"version": 203
|
|
},
|
|
"12de29d4-bbb0-4eef-b687-857e8a163870": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Exploitation of an Unquoted Service Path Vulnerability",
|
|
"sha256": "6a69ca21111665ced0b0cc269c53ac00d37ac29fccb5d3e5d04abe8e0de046d6",
|
|
"type": "eql",
|
|
"version": 2
|
|
},
|
|
"12f07955-1674-44f7-86b5-c35da0a6f41a": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Suspicious Cmd Execution via WMI",
|
|
"sha256": "6f00425e03b75ccad2d669adf599edf5e627579bfd6c02dfd5a8b8074c9ee0e1",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"1327384f-00f3-44d5-9a8c-2373ba071e92": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Persistence via Scheduled Job Creation",
|
|
"sha256": "f7da8ec3bf0a1cd28b4e1bc7a091b73bc0f8a408eb3510bd3abc386277dca211",
|
|
"type": "eql",
|
|
"version": 105
|
|
},
|
|
"138c5dd5-838b-446e-b1ac-c995c7f8108a": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Rare User Logon",
|
|
"sha256": "84ad771aac0fd0883efd7525692d964e0f85a436752431c84b7dc4e012b05679",
|
|
"type": "machine_learning",
|
|
"version": 104
|
|
},
|
|
"139c7458-566a-410c-a5cd-f80238d6a5cd": {
|
|
"rule_name": "SQL Traffic to the Internet",
|
|
"sha256": "26fce2242bdb3d7341ec772772151eae5dfe28e3f14a60bbe586e0d5d5842ad7",
|
|
"type": "query",
|
|
"version": 100
|
|
},
|
|
"13e908b9-7bf0-4235-abc9-b5deb500d0ad": {
|
|
"min_stack_version": "8.9",
|
|
"rule_name": "Machine Learning Detected a Suspicious Windows Event Predicted to be Malicious Activity",
|
|
"sha256": "551d15b4a76aa3a0932077f553cdd60ad02d13b2aada4d46cb9d343b7d8ffcc3",
|
|
"type": "eql",
|
|
"version": 2
|
|
},
|
|
"141e9b3a-ff37-4756-989d-05d7cbf35b0e": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Azure External Guest User Invitation",
|
|
"sha256": "c606c9477a2fa88e6a1b70468ffa95df50528629745068026ef6c9758caadaf1",
|
|
"type": "query",
|
|
"version": 102
|
|
},
|
|
"143cb236-0956-4f42-a706-814bcaa0cf5a": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "RPC (Remote Procedure Call) from the Internet",
|
|
"sha256": "9b392ee77e47d008944419960e03112af84f3ccc7b043af0c2d16d636e610214",
|
|
"type": "query",
|
|
"version": 103
|
|
},
|
|
"14dab405-5dd9-450c-8106-72951af2391f": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Office Test Registry Persistence",
|
|
"sha256": "dfc7bc44c6f6d34fee6331a065d25992ba9f2cb18ddddf1d91a9c581eb4f15b8",
|
|
"type": "eql",
|
|
"version": 2
|
|
},
|
|
"14de811c-d60f-11ec-9fd7-f661ea17fbce": {
|
|
"min_stack_version": "8.4",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 199,
|
|
"rule_name": "Kubernetes User Exec into Pod",
|
|
"sha256": "3d39cfe20aef41ad7da949c25c18b33868177276c2c4ee9af234be4282e68392",
|
|
"type": "query",
|
|
"version": 101
|
|
}
|
|
},
|
|
"rule_name": "Kubernetes User Exec into Pod",
|
|
"sha256": "2e20c515d2b1304091833efa5d5f19b38c4f1eaa4f2a5b3cdee64f89ed7bf4a9",
|
|
"type": "query",
|
|
"version": 203
|
|
},
|
|
"14ed1aa9-ebfd-4cf9-a463-0ac59ec55204": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Persistence via Time Provider Modification",
|
|
"sha256": "4b1eec485af47d33737ca5c571fb0460f4b65037669ab0dbabe9bac5698770dd",
|
|
"type": "eql",
|
|
"version": 106
|
|
},
|
|
"1542fa53-955e-4330-8e4d-b2d812adeb5f": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Execution from a Removable Media with Network Connection",
|
|
"sha256": "395e463813d0cad1e718f84d5a13a564016c82b69dcfd8027af981c0ec07cc2f",
|
|
"type": "eql",
|
|
"version": 1
|
|
},
|
|
"15a8ba77-1c13-4274-88fe-6bd14133861e": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Scheduled Task Execution at Scale via GPO",
|
|
"sha256": "7429e9a1ede15a8d3ef3f9c969e435fd27f290eba5d56942784d6b43291cb85b",
|
|
"type": "query",
|
|
"version": 109
|
|
},
|
|
"15c0b7a7-9c34-4869-b25b-fa6518414899": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Remote File Download via Desktopimgdownldr Utility",
|
|
"sha256": "42bf489fc1a03321f0d5b7eb330f6afaf2d64dfea7d2e5afdc041c2ed1b084bc",
|
|
"type": "eql",
|
|
"version": 109
|
|
},
|
|
"15dacaa0-5b90-466b-acab-63435a59701a": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Virtual Private Network Connection Attempt",
|
|
"sha256": "91a1712e57b935ca9c222118c8d99f2ca99aa936eea6677ad83d308946976166",
|
|
"type": "eql",
|
|
"version": 106
|
|
},
|
|
"16280f1e-57e6-4242-aa21-bb4d16f13b2f": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Azure Automation Runbook Created or Modified",
|
|
"sha256": "d63660127e37638852d3943a3f02745a9d7ecf28ffba3fd3d314558d66fa3633",
|
|
"type": "query",
|
|
"version": 102
|
|
},
|
|
"166727ab-6768-4e26-b80c-948b228ffc06": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "File Creation Time Changed",
|
|
"sha256": "a13ea0c57c34bf29a26117cd89ad3d1760dedb9b4fa54adcc0eee079fa605f83",
|
|
"type": "eql",
|
|
"version": 3
|
|
},
|
|
"16904215-2c95-4ac8-bf5c-12354e047192": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Kerberos Attack via Bifrost",
|
|
"sha256": "62f4c4c7d614af2f638274d716d37e705bfa849a15b241efb9a779e1eea0b8c0",
|
|
"type": "query",
|
|
"version": 105
|
|
},
|
|
"169f3a93-efc7-4df2-94d6-0d9438c310d1": {
|
|
"min_stack_version": "8.9",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 204,
|
|
"rule_name": "AWS IAM Group Creation",
|
|
"sha256": "b742e26488a024ca917c76ed8b6d78e38bceaf88b12ac5a184cba21816858e5c",
|
|
"type": "query",
|
|
"version": 105
|
|
}
|
|
},
|
|
"rule_name": "AWS IAM Group Creation",
|
|
"sha256": "b97182b40fec27cf6728746f838be74ee2cf5ebee183fc5d0f6eaf338b7d90a3",
|
|
"type": "query",
|
|
"version": 205
|
|
},
|
|
"16a52c14-7883-47af-8745-9357803f0d4c": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Component Object Model Hijacking",
|
|
"sha256": "c0cd1aaa9aa6759d34b3b00592c50454726fad1c02fe5887b0a6f33c1e4ef794",
|
|
"type": "eql",
|
|
"version": 109
|
|
},
|
|
"16fac1a1-21ee-4ca6-b720-458e3855d046": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Startup/Logon Script added to Group Policy Object",
|
|
"sha256": "c1962ed3ad486c1c8ab7837d32854ef5d5c1026a407b61542db8e9886def0da4",
|
|
"type": "query",
|
|
"version": 108
|
|
},
|
|
"1781d055-5c66-4adf-9c59-fc0fa58336a5": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Unusual Windows Username",
|
|
"sha256": "3f017bebc4cd49b96144c2c37d613353b9c74438bb528240c830a99a32537120",
|
|
"type": "machine_learning",
|
|
"version": 104
|
|
},
|
|
"1781d055-5c66-4adf-9c71-fc0fa58338c7": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Unusual Windows Service",
|
|
"sha256": "89e1fd74a24609ea12f4b8735c03de06e82fa5940400ce7cc3860d473e9f9b9a",
|
|
"type": "machine_learning",
|
|
"version": 103
|
|
},
|
|
"1781d055-5c66-4adf-9d60-fc0fa58337b6": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Suspicious Powershell Script",
|
|
"sha256": "c3d4419ad9b4d398652f573451d61439143854032c964a86b28b44f63627d3d3",
|
|
"type": "machine_learning",
|
|
"version": 104
|
|
},
|
|
"1781d055-5c66-4adf-9d82-fc0fa58449c8": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Unusual Windows User Privilege Elevation Activity",
|
|
"sha256": "3e378c975b7684d44d468c1b90b70fd66198d70f52b1af31c2d9877e6e01cda5",
|
|
"type": "machine_learning",
|
|
"version": 103
|
|
},
|
|
"1781d055-5c66-4adf-9e93-fc0fa69550c9": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Unusual Windows Remote User",
|
|
"sha256": "83958e6d3f7ccbbbba3e4f0796b176f124604f15277f14ce33c142029d6c8ff9",
|
|
"type": "machine_learning",
|
|
"version": 103
|
|
},
|
|
"17b0a495-4d9f-414c-8ad0-92f018b8e001": {
|
|
"min_stack_version": "8.6",
|
|
"rule_name": "New Systemd Service Created by Previously Unknown Process",
|
|
"sha256": "400131c604d2387a643233aeae981ecf85b248f90b0914a4b349e1ed55ddce84",
|
|
"type": "new_terms",
|
|
"version": 7
|
|
},
|
|
"17c7f6a5-5bc9-4e1f-92bf-13632d24384d": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Renamed Utility Executed with Short Program Name",
|
|
"sha256": "333e76901898def53aa58c45b53af5fa36c5089a44572e8677b626c99d9e9864",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"17e68559-b274-4948-ad0b-f8415bb31126": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Unusual Network Destination Domain Name",
|
|
"sha256": "d0d9eef72ecbbb7af63f2aa522abc13a4cba650dd6da7a17c6b37218c39c1fb8",
|
|
"type": "machine_learning",
|
|
"version": 103
|
|
},
|
|
"184dfe52-2999-42d9-b9d1-d1ca54495a61": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "GCP Logging Sink Modification",
|
|
"sha256": "f831f5412e30676ce24c068dcaf3521ab6be818cb202bca3625fb0f61ea6c3b2",
|
|
"type": "query",
|
|
"version": 104
|
|
},
|
|
"1859ce38-6a50-422b-a5e8-636e231ea0cd": {
|
|
"rule_name": "Linux Restricted Shell Breakout via c89/c99 Shell evasion",
|
|
"sha256": "7e7de93079eef0b085e35930659004f7dc4b966ad722932b86b82c762d627e1e",
|
|
"type": "eql",
|
|
"version": 100
|
|
},
|
|
"18a5dd9a-e3fa-4996-99b1-ae533b8f27fc": {
|
|
"min_stack_version": "8.9",
|
|
"rule_name": "Spike in Number of Connections Made to a Destination IP",
|
|
"sha256": "871f128810304fd883353470a5d1c2aac984a262de2c216b6d8b94e64fd8615c",
|
|
"type": "machine_learning",
|
|
"version": 2
|
|
},
|
|
"193549e8-bb9e-466a-a7f9-7e783f5cb5a6": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Privilege Escalation via Recently Compiled Executable",
|
|
"sha256": "8806cde9bf6f85d4dbf7c642a37a0723d2c9cda4383535560b018b1ab8eb2df1",
|
|
"type": "eql",
|
|
"version": 3
|
|
},
|
|
"19de8096-e2b0-4bd8-80c9-34a820813fff": {
|
|
"min_stack_version": "8.9",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 207,
|
|
"rule_name": "Rare AWS Error Code",
|
|
"sha256": "36fb7f357ab4c1d87f38a2a9f453fb1093c959582b23dda8d3071db185b7d65d",
|
|
"type": "machine_learning",
|
|
"version": 108
|
|
}
|
|
},
|
|
"rule_name": "Rare AWS Error Code",
|
|
"sha256": "45da42408e9e47f7550b2ff787fd33fe211dc4d0c4ccbfd9342ae768d88384ec",
|
|
"type": "machine_learning",
|
|
"version": 208
|
|
},
|
|
"19e9daf3-f5c5-4bc2-a9af-6b1e97098f03": {
|
|
"min_stack_version": "8.9",
|
|
"rule_name": "Spike in Number of Processes in an RDP Session",
|
|
"sha256": "0eae02bca1aa24bba6aa6420f05401d4890c290ff47f2be34bbc1ed4cf55881b",
|
|
"type": "machine_learning",
|
|
"version": 2
|
|
},
|
|
"1a289854-5b78-49fe-9440-8a8096b1ab50": {
|
|
"min_stack_version": "8.8",
|
|
"rule_name": "Suspicious Network Tool Launched Inside A Container",
|
|
"sha256": "e456a59a32e02e71884dee04e925140b321a34650d49651cf7216610213066fc",
|
|
"type": "eql",
|
|
"version": 2
|
|
},
|
|
"1a36cace-11a7-43a8-9a10-b497c5a02cd3": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Azure Application Credential Modification",
|
|
"sha256": "e08f14b9002ce52664d169dc98fd7a2d3fd3dd0e24933ce44ec2f0cc93f14b7a",
|
|
"type": "query",
|
|
"version": 102
|
|
},
|
|
"1a6075b0-7479-450e-8fe7-b8b8438ac570": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Execution of COM object via Xwizard",
|
|
"sha256": "f0bed76a611cf637f400967119419ac503bb528123d294a8a6b149fdcd8cfabf",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"1aa8fa52-44a7-4dae-b058-f3333b91c8d7": {
|
|
"min_stack_version": "8.9",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 207,
|
|
"rule_name": "AWS CloudTrail Log Suspended",
|
|
"sha256": "e728282d89ab6116e74d508a075da4f9a1388ba2da235fd87605b4ad580312f0",
|
|
"type": "query",
|
|
"version": 108
|
|
}
|
|
},
|
|
"rule_name": "AWS CloudTrail Log Suspended",
|
|
"sha256": "dd01a147a8898a4f6c696c83a4c436bf0325ab7552a03039d7cd71ff0b6c00dc",
|
|
"type": "query",
|
|
"version": 208
|
|
},
|
|
"1aa9181a-492b-4c01-8b16-fa0735786b2b": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "User Account Creation",
|
|
"sha256": "e9425321d9364d0c69d31c985962e0e5af2b19bb9d6ccea2c92aec82e0f73f6d",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"1b0b4818-5655-409b-9c73-341cac4bb73f": {
|
|
"min_stack_version": "8.4",
|
|
"rule_name": "Process Created with a Duplicated Token",
|
|
"sha256": "108c96892c8db5e48adb3729e9a21cf75d35c098e4739cc055042e86fbeddccb",
|
|
"type": "eql",
|
|
"version": 1
|
|
},
|
|
"1b21abcc-4d9f-4b08-a7f5-316f5f94b973": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Connection to Internal Network via Telnet",
|
|
"sha256": "1a9795116a97f7bc045cbda5a8af5e8e78f0d62a88cd641583e3838f293c26b6",
|
|
"type": "eql",
|
|
"version": 106
|
|
},
|
|
"1ba5160d-f5a2-4624-b0ff-6a1dc55d2516": {
|
|
"min_stack_version": "8.9",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 204,
|
|
"rule_name": "AWS ElastiCache Security Group Modified or Deleted",
|
|
"sha256": "bcef75f6d49bb03184f9398613ed080bc7bd2279da99afaa50ba68d3a99f3b4c",
|
|
"type": "query",
|
|
"version": 105
|
|
}
|
|
},
|
|
"rule_name": "AWS ElastiCache Security Group Modified or Deleted",
|
|
"sha256": "95e2cb6322ef7b2d7bc2fc96460cbfcb4c76f0eb17351a134c783936996adab0",
|
|
"type": "query",
|
|
"version": 205
|
|
},
|
|
"1c27fa22-7727-4dd3-81c0-de6da5555feb": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Internal Linux SSH Brute Force Detected",
|
|
"sha256": "38c57c420c15a1f0758f68c979f680379cd78121e64ea43be7600b11823ed5f6",
|
|
"type": "eql",
|
|
"version": 9
|
|
},
|
|
"1c5a04ae-d034-41bf-b0d8-96439b5cc774": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Process Injection from Malicious Document",
|
|
"sha256": "585cc415f1c54e220db615a5f052321909100ebc7b9e63b944e6b19a6a4e6404",
|
|
"type": "eql",
|
|
"version": 1
|
|
},
|
|
"1c6a8c7a-5cb6-4a82-ba27-d5a5b8a40a38": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Possible Consent Grant Attack via Azure-Registered Application",
|
|
"sha256": "bf4b6f557cbd3c0c009d3f0aa39401b563a920b2ed64f0d20ef86c9a95fc5e45",
|
|
"type": "query",
|
|
"version": 106
|
|
},
|
|
"1c84dd64-7e6c-4bad-ac73-a5014ee37042": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Suspicious File Creation in /etc for Persistence",
|
|
"sha256": "1b168626a13b010e11e758702eb6d895a779be9163e0265089d56c852cd438b6",
|
|
"type": "eql",
|
|
"version": 111
|
|
},
|
|
"1c966416-60c1-436b-bfd0-e002fddbfd89": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Azure Kubernetes Rolebindings Created",
|
|
"sha256": "d86625ab5e731436d6846810c232431aafe71ea4ce7684c0f5ad7b03709bb6ce",
|
|
"type": "query",
|
|
"version": 102
|
|
},
|
|
"1ca62f14-4787-4913-b7af-df11745a49da": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "New GitHub App Installed",
|
|
"sha256": "02e98cecd6d72a19ba1f1961d35d14774632ecb42f89c7fc7f1e162b60bc89fe",
|
|
"type": "eql",
|
|
"version": 1
|
|
},
|
|
"1cd01db9-be24-4bef-8e7c-e923f0ff78ab": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Incoming Execution via WinRM Remote Shell",
|
|
"sha256": "38ff22d9612874236bb0fdc1ac65f9f649734272e2484b7058245985ecadd621",
|
|
"type": "eql",
|
|
"version": 106
|
|
},
|
|
"1ceb05c4-7d25-11ee-9562-f661ea17fbcd": {
|
|
"min_stack_version": "8.10",
|
|
"rule_name": "Okta Sign-In Events via Third-Party IdP",
|
|
"sha256": "50473966980c6830aa4b12aa9acafafacf8d3e86b508832e498777b302fd9b54",
|
|
"type": "query",
|
|
"version": 2
|
|
},
|
|
"1d276579-3380-4095-ad38-e596a01bc64f": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Remote File Download via Script Interpreter",
|
|
"sha256": "9b721a8bd708e3ba1c854f032771bd1fa175535e5dc546a07be290e5c156c6d3",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"1d72d014-e2ab-4707-b056-9b96abe7b511": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "External IP Lookup from Non-Browser Process",
|
|
"sha256": "d08e975b8630d786933967d9de847dfbdd6fc6a5447715691a1a27ee3b22198a",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"1d9aeb0b-9549-46f6-a32d-05e2a001b7fd": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "PowerShell Script with Encryption/Decryption Capabilities",
|
|
"sha256": "a8152d99c80a969cc7354a42c0e8265cfaec6d349d3e41e85f38049db45a1755",
|
|
"type": "query",
|
|
"version": 5
|
|
},
|
|
"1dcc51f6-ba26-49e7-9ef4-2655abb2361e": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "UAC Bypass via DiskCleanup Scheduled Task Hijack",
|
|
"sha256": "9d74966200ab76215b5f75666d8a4991c2b0147b50e7786298a59b9b037dc303",
|
|
"type": "eql",
|
|
"version": 106
|
|
},
|
|
"1dee0500-4aeb-44ca-b24b-4a285d7b6ba1": {
|
|
"min_stack_version": "8.4",
|
|
"rule_name": "Suspicious Inter-Process Communication via Outlook",
|
|
"sha256": "4c8c8473db95992186d566e79adf668d651878042f01dc8c4a1de75f8a44c347",
|
|
"type": "eql",
|
|
"version": 5
|
|
},
|
|
"1defdd62-cd8d-426e-a246-81a37751bb2b": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Execution of File Written or Modified by PDF Reader",
|
|
"sha256": "2a864a262ee617027d2731c9da168a2d0d477cb915904829e10eb863ad881d85",
|
|
"type": "eql",
|
|
"version": 106
|
|
},
|
|
"1df1152b-610a-4f48-9d7a-504f6ee5d9da": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Linux Hack Tool Launched",
|
|
"sha256": "03227f8f005fd0a6e2824b8615533828cdad806c0d69e6d5f11c0504f4ceb316",
|
|
"type": "eql",
|
|
"version": 2
|
|
},
|
|
"1e0a3f7c-21e7-4bb1-98c7-2036612fb1be": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "PowerShell Script with Discovery Capabilities",
|
|
"sha256": "476840872bfeccaff488dd65134b6a82f2299b815ee751a661219204e8c1ad9a",
|
|
"type": "query",
|
|
"version": 4
|
|
},
|
|
"1e0b832e-957e-43ae-b319-db82d228c908": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Azure Storage Account Key Regenerated",
|
|
"sha256": "49bb6b71d6e597de0157a424d93fdb4690ae7ad2586b8d725a627878c02edc1e",
|
|
"type": "query",
|
|
"version": 102
|
|
},
|
|
"1e6363a6-3af5-41d4-b7ea-d475389c0ceb": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Creation of SettingContent-ms Files",
|
|
"sha256": "a57fdc00e51caf3e5c8c515a75a6b8e8bc79b4e2dbb0f9fb97bc36859dd60525",
|
|
"type": "eql",
|
|
"version": 1
|
|
},
|
|
"1e9fc667-9ff1-4b33-9f40-fefca8537eb0": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Unusual Sudo Activity",
|
|
"sha256": "aad0990989bfa63d159c45b28e23cec25bcdd6cb4054ad31584f085b1e38568c",
|
|
"type": "machine_learning",
|
|
"version": 103
|
|
},
|
|
"1f0a69c0-3392-4adf-b7d5-6012fd292da8": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Antimalware Scan Interface Bypass via PowerShell",
|
|
"sha256": "90ed2f95452d78c897f5ff0a9109393db93bf7b6131cf7ab1f265ec52a86a3f1",
|
|
"type": "query",
|
|
"version": 7
|
|
},
|
|
"1f460f12-a3cf-4105-9ebb-f788cc63f365": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Unusual Process Execution on WBEM Path",
|
|
"sha256": "7d596dca903c48dde13a6b90746947628693b11dd9140e3eb89ca6eba10ae966",
|
|
"type": "eql",
|
|
"version": 1
|
|
},
|
|
"1faec04b-d902-4f89-8aff-92cd9043c16f": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Unusual Linux User Calling the Metadata Service",
|
|
"sha256": "8eb47dead708d739318e797d2fac9c942978cd80eca1354c0063c15ff502adb9",
|
|
"type": "machine_learning",
|
|
"version": 103
|
|
},
|
|
"1fe3b299-fbb5-4657-a937-1d746f2c711a": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Unusual Network Activity from a Windows System Binary",
|
|
"sha256": "8ec035184478d2650916a571216dd1d6f03c7c0eaac4a894f81390ff1663c2bd",
|
|
"type": "eql",
|
|
"version": 109
|
|
},
|
|
"2003cdc8-8d83-4aa5-b132-1f9a8eb48514": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Exploit - Detected - Elastic Endgame",
|
|
"sha256": "e985eb9816fbebe3599feb87b715f34c43f15a76293dc8ebefa29e0d5b6a7e3f",
|
|
"type": "query",
|
|
"version": 101
|
|
},
|
|
"201200f1-a99b-43fb-88ed-f65a45c4972c": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Suspicious .NET Code Compilation",
|
|
"sha256": "38254e10c94b71503f642eb25ccf9bd0e66542f343d369ab1cfe7cc1e0d8729a",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"203ab79b-239b-4aa5-8e54-fc50623ee8e4": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Creation or Modification of Root Certificate",
|
|
"sha256": "c2204e192d86865e713663390b2fb1c3859f2871ce24908f5899475a741571c4",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"2045567e-b0af-444a-8c0b-0b6e2dae9e13": {
|
|
"min_stack_version": "8.9",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 204,
|
|
"rule_name": "AWS Route 53 Domain Transferred to Another Account",
|
|
"sha256": "cd100d12464b46b1f170d8e6b26ed144023ba52b4077a97354a6a9fcbabf7465",
|
|
"type": "query",
|
|
"version": 105
|
|
}
|
|
},
|
|
"rule_name": "AWS Route 53 Domain Transferred to Another Account",
|
|
"sha256": "7512cf97f8885a42febe293ecc8c04d77f6369d4ba87372fcd3ef38a204f9af3",
|
|
"type": "query",
|
|
"version": 205
|
|
},
|
|
"20457e4f-d1de-4b92-ae69-142e27a4342a": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Access of Stored Browser Credentials",
|
|
"sha256": "3e3f5aec51ac2d4bed5a22f8ab0e6bc87db4da5c76f3e93dd107ed6f15e2c5a2",
|
|
"type": "eql",
|
|
"version": 106
|
|
},
|
|
"205b52c4-9c28-4af4-8979-935f3278d61a": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Werfault ReflectDebugger Persistence",
|
|
"sha256": "6178ac16e7a1b92253a4eae0123a253627554a9bb2d28ac941328fb97f5250dc",
|
|
"type": "eql",
|
|
"version": 1
|
|
},
|
|
"208dbe77-01ed-4954-8d44-1e5751cb20de": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "LSASS Memory Dump Handle Access",
|
|
"sha256": "a1c0793e46ef70df7a07d937496dac757813e319583a4835ca03b7889dc59aab",
|
|
"type": "eql",
|
|
"version": 109
|
|
},
|
|
"20dc4620-3b68-4269-8124-ca5091e00ea8": {
|
|
"rule_name": "Auditd Max Login Sessions",
|
|
"sha256": "70f4efe66d78f8696efee5cf24c949aa421b1983ddb6a69944cae1e300da5a37",
|
|
"type": "query",
|
|
"version": 100
|
|
},
|
|
"210d4430-b371-470e-b879-80b7182aa75e": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Mofcomp Activity",
|
|
"sha256": "d42c6a1889b42bcd83cb46d9838038cfd4248b792d5fef1abc4cedc81b269d4a",
|
|
"type": "eql",
|
|
"version": 1
|
|
},
|
|
"2138bb70-5a5e-42fd-be5e-b38edf6a6777": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Reverse Shell via Child",
|
|
"sha256": "a000ef62eb0c4260a2c35b773be14845533597b5363d8762a9dc78b65a342149",
|
|
"type": "eql",
|
|
"version": 1
|
|
},
|
|
"21bafdf0-cf17-11ed-bd57-f661ea17fbcc": {
|
|
"min_stack_version": "8.4",
|
|
"rule_name": "First Time Seen Google Workspace OAuth Login from Third-Party Application",
|
|
"sha256": "8b83d7d20910ac09b5cd9f7b2e96a38f9b03f38f314ecf1f779637906818161b",
|
|
"type": "new_terms",
|
|
"version": 3
|
|
},
|
|
"220be143-5c67-4fdb-b6ce-dd6826d024fd": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Full User-Mode Dumps Enabled System-Wide",
|
|
"sha256": "c54e0fcc5ec27640dfa0db638f45805ad4749c78972fa33cc061cab3f04f13d8",
|
|
"type": "eql",
|
|
"version": 5
|
|
},
|
|
"2215b8bd-1759-4ffa-8ab8-55c8e6b32e7f": {
|
|
"min_stack_version": "8.6",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 203,
|
|
"rule_name": "SSH Authorized Keys File Modification",
|
|
"sha256": "8e07f35dbd0f747e519638ad9464ab2502ac2d84b6db85f092155081cf57f23c",
|
|
"type": "query",
|
|
"version": 104
|
|
}
|
|
},
|
|
"rule_name": "SSH Authorized Keys File Modification",
|
|
"sha256": "005f7835fa070f7f885e2383bf737e042e166aa86438d213922d52e82ff0cd91",
|
|
"type": "new_terms",
|
|
"version": 204
|
|
},
|
|
"22599847-5d13-48cb-8872-5796fee8692b": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "SUNBURST Command and Control Activity",
|
|
"sha256": "ba55f907ef22d742e948ef03ed381c51077959c108f1166ec3e32bca889d77f0",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"227dc608-e558-43d9-b521-150772250bae": {
|
|
"min_stack_version": "8.9",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 205,
|
|
"rule_name": "AWS S3 Bucket Configuration Deletion",
|
|
"sha256": "ad8600664f0e0704b136c9959aec90beb90d433fd1457d49adc4e920ad882f17",
|
|
"type": "query",
|
|
"version": 106
|
|
}
|
|
},
|
|
"rule_name": "AWS S3 Bucket Configuration Deletion",
|
|
"sha256": "7804226b0da1b8d6dde3bbfed024feab1da6c23e091dfa55852b50309f4dd9fe",
|
|
"type": "query",
|
|
"version": 206
|
|
},
|
|
"231876e7-4d1f-4d63-a47c-47dd1acdc1cb": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Shell via Web Server",
|
|
"sha256": "95829ac14cae4f4c82e003be08372f6c44edc266c796409e6971824d0be747f1",
|
|
"type": "query",
|
|
"version": 105
|
|
},
|
|
"2326d1b2-9acf-4dee-bd21-867ea7378b4d": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "GCP Storage Bucket Permissions Modification",
|
|
"sha256": "278f8d56c3932a208c4873795aa99690d1d05550d1e099c6fcdb6f6fca729604",
|
|
"type": "query",
|
|
"version": 104
|
|
},
|
|
"2339f03c-f53f-40fa-834b-40c5983fc41f": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Kernel Module Load via insmod",
|
|
"sha256": "2cc6d7aa7add54ada5a4d8c00fdb52a0b87509638431999e633b74055b8c0f4a",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"2377946d-0f01-4957-8812-6878985f515d": {
|
|
"min_stack_version": "8.9",
|
|
"rule_name": "Remote File Creation on a Sensitive Directory",
|
|
"sha256": "d175835a59f26f5a7a7607eec8ec9be98bff92a092fcb817859b99170ad0ddd6",
|
|
"type": "eql",
|
|
"version": 1
|
|
},
|
|
"24401eca-ad0b-4ff9-9431-487a8e183af9": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "New GitHub Owner Added",
|
|
"sha256": "839fb4e1ecdfcb2be6949ac45bfd11ec72c4ccee48cff00ef05e661a7fc1c6a3",
|
|
"type": "eql",
|
|
"version": 2
|
|
},
|
|
"25224a80-5a4a-4b8a-991e-6ab390465c4f": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Lateral Movement via Startup Folder",
|
|
"sha256": "d8e20705353d3835109854dff70bf6bcec1d3cc3959cb9434fc53f2e46925c1b",
|
|
"type": "eql",
|
|
"version": 106
|
|
},
|
|
"259be2d8-3b1a-4c2c-a0eb-0c8e77f35e39": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Reverse Shell via Background Process",
|
|
"sha256": "707d343409c8eb1b73e83d906c6564b4401912393e9d157bd4913b267dd1c108",
|
|
"type": "eql",
|
|
"version": 3
|
|
},
|
|
"25d917c4-aa3c-4111-974c-286c0312ff95": {
|
|
"min_stack_version": "8.6",
|
|
"rule_name": "Network Activity Detected via Kworker",
|
|
"sha256": "135aee6821b8cd1ee41d9c054c4f355427b8352720b5463c6e68144a5f53830a",
|
|
"type": "new_terms",
|
|
"version": 1
|
|
},
|
|
"260486ee-7d98-11ee-9599-f661ea17fbcd": {
|
|
"min_stack_version": "8.10",
|
|
"rule_name": "New Okta Authentication Behavior Detected",
|
|
"sha256": "44887f3eb626b80c75a0110be4b26d1ce66bf37892a7bab818d90f36023aae1c",
|
|
"type": "query",
|
|
"version": 1
|
|
},
|
|
"2605aa59-29ac-4662-afad-8d86257c7c91": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Suspicious DebugFS Root Device Access",
|
|
"sha256": "e7d2c248c0ef9948b7461ecd30161e9e5fae46a1bd58ce87073cb10b5b354b85",
|
|
"type": "eql",
|
|
"version": 4
|
|
},
|
|
"2636aa6c-88b5-4337-9c31-8d0192a8ef45": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Azure Blob Container Access Level Modification",
|
|
"sha256": "b8c9984ea50176ed7e98738246a92b5729623ecdef068b256bd5deae26c26534",
|
|
"type": "query",
|
|
"version": 102
|
|
},
|
|
"265db8f5-fc73-4d0d-b434-6483b56372e2": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Persistence via Update Orchestrator Service Hijack",
|
|
"sha256": "22c2959b31f776a92a435478b6ab0d09b9f9faaaee332d070e0e0a5236352c97",
|
|
"type": "eql",
|
|
"version": 109
|
|
},
|
|
"26b01043-4f04-4d2f-882a-5a1d2e95751b": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Privileges Elevation via Parent Process PID Spoofing",
|
|
"sha256": "3beffde62280896b2aa6df7e414ebeb74f72233abfefcc99493b20c3c02d6aed",
|
|
"type": "eql",
|
|
"version": 5
|
|
},
|
|
"26edba02-6979-4bce-920a-70b080a7be81": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Azure Active Directory High Risk User Sign-in Heuristic",
|
|
"sha256": "81486e6269e07586e44c0e2e31d679dd20a6c335f856a8adad10143d41b7ada7",
|
|
"type": "query",
|
|
"version": 105
|
|
},
|
|
"26f68dba-ce29-497b-8e13-b4fde1db5a2d": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Attempts to Brute Force a Microsoft 365 User Account",
|
|
"sha256": "6034810ddf957379536be3d43d1d1f5868b60b212e1e0224b1347552764b3240",
|
|
"type": "threshold",
|
|
"version": 102
|
|
},
|
|
"27071ea3-e806-4697-8abc-e22c92aa4293": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "PowerShell Script with Archive Compression Capabilities",
|
|
"sha256": "3a7e860d0d7d4932d1765d9a9890853d23ee8dbe1726f151accf8ed96efd88c2",
|
|
"type": "query",
|
|
"version": 4
|
|
},
|
|
"2724808c-ba5d-48b2-86d2-0002103df753": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Attempt to Clear Kernel Ring Buffer",
|
|
"sha256": "e93a1e9fd50b7401c5d62def71f3729c535a1a070f8e42194e4a2a9bfe8843b4",
|
|
"type": "eql",
|
|
"version": 1
|
|
},
|
|
"272a6484-2663-46db-a532-ef734bf9a796": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Microsoft 365 Exchange Transport Rule Modification",
|
|
"sha256": "fbfde864c7e1f31e7fcfef374c9517e890a58223969f83a4c15fee6afb623353",
|
|
"type": "query",
|
|
"version": 102
|
|
},
|
|
"2772264c-6fb9-4d9d-9014-b416eed21254": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Incoming Execution via PowerShell Remoting",
|
|
"sha256": "06a344a111e75594161e3a08c78be77d29fd146dec8b6ce48d5cc9330a9166f1",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"2783d84f-5091-4d7d-9319-9fceda8fa71b": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "GCP Firewall Rule Modification",
|
|
"sha256": "7f903b4ec5008e277d2c4f30f030c9063155c7624b7938ba5d57635458cfbbdf",
|
|
"type": "query",
|
|
"version": 104
|
|
},
|
|
"27f7c15a-91f8-4c3d-8b9e-1f99cc030a51": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Microsoft 365 Teams External Access Enabled",
|
|
"sha256": "94685626f0a0ed06951084baeb71eae9ec250c07e2ccd46be608e1f1321d5726",
|
|
"type": "query",
|
|
"version": 102
|
|
},
|
|
"2820c9c2-bcd7-4d6e-9eba-faf3891ba450": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Account Password Reset Remotely",
|
|
"sha256": "a3ad12d5f9099c09f319bd8673a640d823bd711b02d7db6ac84e83966963cfc2",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"2856446a-34e6-435b-9fb5-f8f040bfa7ed": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Account Discovery Command via SYSTEM Account",
|
|
"sha256": "9d0bcbf7b54f9ec62e6ac93c6fc9afa7729ae93e9eda196e3470f9f2ce3c3131",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"2863ffeb-bf77-44dd-b7a5-93ef94b72036": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Exploit - Prevented - Elastic Endgame",
|
|
"sha256": "2cd4ef3408eed788d9622c7de25f23314bbe10bbc4d7cfeb94d651618911ad94",
|
|
"type": "query",
|
|
"version": 101
|
|
},
|
|
"28738f9f-7427-4d23-bc69-756708b5f624": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Suspicious File Changes Activity Detected",
|
|
"sha256": "748d22c0d796641d48a1bc6cc42284615cf7f1682f6204efa1dc80e97ca715ac",
|
|
"type": "eql",
|
|
"version": 7
|
|
},
|
|
"28896382-7d4f-4d50-9b72-67091901fd26": {
|
|
"rule_name": "Suspicious Process from Conhost",
|
|
"sha256": "166baa4ec5aa318e31032e58e6481323c9332f11eb53f214bfdd71b0ec7e2a79",
|
|
"type": "eql",
|
|
"version": 100
|
|
},
|
|
"28d39238-0c01-420a-b77a-24e5a7378663": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Sudo Command Enumeration Detected",
|
|
"sha256": "7812955eb756c08f5d9f17dbf1d672b0f9a1587bf4d1f8fb36bbd42fab2a4a82",
|
|
"type": "eql",
|
|
"version": 4
|
|
},
|
|
"29052c19-ff3e-42fd-8363-7be14d7c5469": {
|
|
"min_stack_version": "8.9",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 204,
|
|
"rule_name": "AWS Security Group Configuration Change Detection",
|
|
"sha256": "6eafdfc2847d0f8150d36752200d76b3777de7dd46ac7d6c1dab97c2b6afaa67",
|
|
"type": "query",
|
|
"version": 105
|
|
}
|
|
},
|
|
"rule_name": "AWS Security Group Configuration Change Detection",
|
|
"sha256": "f057a319aa5b049290fa8416727ae3ef64bb9ac7779901a61713efe9acef57da",
|
|
"type": "query",
|
|
"version": 205
|
|
},
|
|
"290aca65-e94d-403b-ba0f-62f320e63f51": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "UAC Bypass Attempt via Windows Directory Masquerading",
|
|
"sha256": "ee657966d36d8e1dcc396dedd56fee8e5c2f1fdc6d06e0ad9dd4b9c5bc655463",
|
|
"type": "eql",
|
|
"version": 109
|
|
},
|
|
"2917d495-59bd-4250-b395-c29409b76086": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Web Shell Detection: Script Process Child of Common Web Processes",
|
|
"sha256": "583bcc5f3c4c54715db820cfd49175943c5c77bcf448a46843c29a7dfe8a1e0b",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"291a0de9-937a-4189-94c0-3e847c8b13e4": {
|
|
"min_stack_version": "8.6",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 207,
|
|
"rule_name": "Enumeration of Privileged Local Groups Membership",
|
|
"sha256": "f1ce7be911b34a06915e3f07c41e6e91d314bf37dfb168fb109057d04b56b5c3",
|
|
"type": "eql",
|
|
"version": 108
|
|
}
|
|
},
|
|
"rule_name": "Enumeration of Privileged Local Groups Membership",
|
|
"sha256": "63b960b37cd4248376f81706924a1929775fa96a6eaf6575da361e96fafafc8b",
|
|
"type": "new_terms",
|
|
"version": 209
|
|
},
|
|
"29b53942-7cd4-11ee-b70e-f661ea17fbcd": {
|
|
"min_stack_version": "8.10",
|
|
"rule_name": "New Okta Identity Provider (IdP) Added by Admin",
|
|
"sha256": "ed5ee5cca37901181403052c73c15575a768c00863a860235c68fae83f550ce1",
|
|
"type": "query",
|
|
"version": 1
|
|
},
|
|
"29ef5686-9b93-433e-91b5-683911094698": {
|
|
"min_stack_version": "8.6",
|
|
"rule_name": "Unusual Discovery Signal Alert with Unusual Process Command Line",
|
|
"sha256": "18bae187efca3e9942f377e9508ca6f0266f122ab379929ab8d6a0d22dc4a342",
|
|
"type": "new_terms",
|
|
"version": 1
|
|
},
|
|
"29f0cf93-d17c-4b12-b4f3-a433800539fa": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Linux SSH X11 Forwarding",
|
|
"sha256": "5033fd4d9756e3c485f90e5526da651406b9805f178469b7a8ae4cbd0903d60b",
|
|
"type": "eql",
|
|
"version": 2
|
|
},
|
|
"2a692072-d78d-42f3-a48a-775677d79c4e": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Code Execution via Postgresql",
|
|
"sha256": "304872798cec74b70f3b39512a44006ab49849897e5b760c45f57663f6cbb753",
|
|
"type": "eql",
|
|
"version": 5
|
|
},
|
|
"2abda169-416b-4bb3-9a6b-f8d239fd78ba": {
|
|
"min_stack_version": "8.4",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 199,
|
|
"rule_name": "Kubernetes Pod created with a Sensitive hostPath Volume",
|
|
"sha256": "bd95cc69164fae41e991e31ae5435c01f2785e2c361dafea62766db0b0f66a10",
|
|
"type": "query",
|
|
"version": 101
|
|
}
|
|
},
|
|
"rule_name": "Kubernetes Pod created with a Sensitive hostPath Volume",
|
|
"sha256": "2704808ccae32f5b44395171db755258b7e7a248df4bab32a33cddb2ac181df0",
|
|
"type": "query",
|
|
"version": 203
|
|
},
|
|
"2b662e21-dc6e-461e-b5cf-a6eb9b235ec4": {
|
|
"min_stack_version": "8.5",
|
|
"rule_name": "ESXI Discovery via Grep",
|
|
"sha256": "60b8604133b04c233608035975acff3e5c7ffae33d7e6f65d97cca37326561a3",
|
|
"type": "eql",
|
|
"version": 5
|
|
},
|
|
"2bf78aa2-9c56-48de-b139-f169bf99cf86": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Adobe Hijack Persistence",
|
|
"sha256": "d4540f314ef044ee0c2fbf1fbfe559d927eaadd79f9cedfbad924a877eb3a5ca",
|
|
"type": "eql",
|
|
"version": 109
|
|
},
|
|
"2c17e5d7-08b9-43b2-b58a-0270d65ac85b": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Windows Defender Exclusions Added via PowerShell",
|
|
"sha256": "30fae5f472da92e741d6c44d0ad23b2c739fee3b3ccd38f73960e06567dda767",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"2c3c29a4-f170-42f8-a3d8-2ceebc18eb6a": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Suspicious Microsoft Diagnostics Wizard Execution",
|
|
"sha256": "6240a5e2945d67deadb4e2ae6462053f9659a0144f048bc91767c92e390ffe30",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"2d8043ed-5bda-4caf-801c-c1feb7410504": {
|
|
"min_stack_version": "8.6",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 203,
|
|
"rule_name": "Enumeration of Kernel Modules",
|
|
"sha256": "b3bad6443210cec62c090d0872efcafedb7565ac5fed882aa46afab6073c4e08",
|
|
"type": "eql",
|
|
"version": 105
|
|
}
|
|
},
|
|
"rule_name": "Enumeration of Kernel Modules",
|
|
"sha256": "11cd32635c6cb009185cf4605d2b361f086b0699c8ac390eb8bf7fa0b988192a",
|
|
"type": "new_terms",
|
|
"version": 207
|
|
},
|
|
"2dd480be-1263-4d9c-8672-172928f6789a": {
|
|
"min_stack_version": "8.8",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 207,
|
|
"rule_name": "Suspicious Process Access via Direct System Call",
|
|
"sha256": "9aa09b7a6367bc4d21531ae1e5860ac4f0f89b9a2331c0c63032d8fa85c753e5",
|
|
"type": "eql",
|
|
"version": 108
|
|
}
|
|
},
|
|
"rule_name": "Suspicious Process Access via Direct System Call",
|
|
"sha256": "02194b622839ad66b2931225a725b2013f5ba1b1ae524083ede33369dc018840",
|
|
"type": "eql",
|
|
"version": 210
|
|
},
|
|
"2ddc468e-b39b-4f5b-9825-f3dcb0e998ea": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential SSH-IT SSH Worm Downloaded",
|
|
"sha256": "65f4f675acd03a58a2f89697fff8a4bd8c77099a91215437f4453ac89851caef",
|
|
"type": "eql",
|
|
"version": 2
|
|
},
|
|
"2de10e77-c144-4e69-afb7-344e7127abd0": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "O365 Excessive Single Sign-On Logon Errors",
|
|
"sha256": "6bbeaa26cdd427d0a628c899b4f643da7efd6be92918fc554a679d294bf1e136",
|
|
"type": "threshold",
|
|
"version": 102
|
|
},
|
|
"2de87d72-ee0c-43e2-b975-5f0b029ac600": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Wireless Credential Dumping using Netsh Command",
|
|
"sha256": "7c1c93dc3cbb29566f0cea895464bfbda60a453682f8184de11de21ca49597b1",
|
|
"type": "eql",
|
|
"version": 6
|
|
},
|
|
"2e1e835d-01e5-48ca-b9fc-7a61f7f11902": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Renamed AutoIt Scripts Interpreter",
|
|
"sha256": "0d68982c3ad2c66fe584668a2a911d7ba89c1e7a8e876b33f359f2f58a1094d8",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"2e29e96a-b67c-455a-afe4-de6183431d0d": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Process Injection via PowerShell",
|
|
"sha256": "265f859057d32706bc44115c2b619366f405b94b82a1930e01559999ad451bc1",
|
|
"type": "query",
|
|
"version": 109
|
|
},
|
|
"2e311539-cd88-4a85-a301-04f38795007c": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Accessing Outlook Data Files",
|
|
"sha256": "143b6346fd2ca02b863de7457499fe60da116e99bc385dce6d07aa870d1e2054",
|
|
"type": "eql",
|
|
"version": 1
|
|
},
|
|
"2e56e1bc-867a-11ee-b13e-f661ea17fbcd": {
|
|
"min_stack_version": "8.10",
|
|
"rule_name": "Okta User Sessions Started from Different Geolocations",
|
|
"sha256": "3beda1aaafd667d3d07527a51968311e2237f960536219febd320c0b5ea7a0cc",
|
|
"type": "threshold",
|
|
"version": 1
|
|
},
|
|
"2e580225-2a58-48ef-938b-572933be06fe": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Halfbaked Command and Control Beacon",
|
|
"sha256": "67f17bb4543d663bbd223adf3ed78c7e8f5018d561d5600b0b835ed24d9a6174",
|
|
"type": "query",
|
|
"version": 104
|
|
},
|
|
"2edc8076-291e-41e9-81e4-e3fcbc97ae5e": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Creation of a Hidden Local User Account",
|
|
"sha256": "de2e56710056a8b6da9dc0876399c464d483cd8d86b9960d864a3012ab56e30e",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"2f0bae2d-bf20-4465-be86-1311addebaa3": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "GCP Kubernetes Rolebindings Created or Patched",
|
|
"sha256": "bd0cfcd18ddea0b9730c52e91f2de67a9b343831ce2a5351233e44a328498830",
|
|
"type": "query",
|
|
"version": 101
|
|
},
|
|
"2f2f4939-0b34-40c2-a0a3-844eb7889f43": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "PowerShell Suspicious Script with Audio Capture Capabilities",
|
|
"sha256": "63a0240e890b59f4e0d8ef6057b38f2c59f013ac31f0899372ea40782b935ee2",
|
|
"type": "query",
|
|
"version": 109
|
|
},
|
|
"2f8a1226-5720-437d-9c20-e0029deb6194": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Attempt to Disable Syslog Service",
|
|
"sha256": "b5c037e4028ed9b2148058177b53b6f8cd416c2002692c954030a5797c8c08b9",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"2fba96c0-ade5-4bce-b92f-a5df2509da3f": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Startup Folder Persistence via Unsigned Process",
|
|
"sha256": "c77de421e7a60ec97356465d4a834fc49fed6b0b7ae28debbac3786b07459d62",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"2ffa1f1e-b6db-47fa-994b-1512743847eb": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Windows Defender Disabled via Registry Modification",
|
|
"sha256": "1db13a5ac155b6497736f067e6755417f99f9cf5b5245f36c2b96437eebc703c",
|
|
"type": "eql",
|
|
"version": 109
|
|
},
|
|
"301571f3-b316-4969-8dd0-7917410030d3": {
|
|
"min_stack_version": "8.9",
|
|
"rule_name": "Malicious Remote File Creation",
|
|
"sha256": "3b64dae20a1caf09073534a22a7e22eb31c7ac6212a08748110048e1e2f0f2f0",
|
|
"type": "eql",
|
|
"version": 1
|
|
},
|
|
"30562697-9859-4ae0-a8c5-dab45d664170": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "GCP Firewall Rule Creation",
|
|
"sha256": "bb0dfe6b9f2f4b9ceed60017b384a9ec5cdb5c52df95261b4b306681aa1f7a1e",
|
|
"type": "query",
|
|
"version": 104
|
|
},
|
|
"30bfddd7-2954-4c9d-bbc6-19a99ca47e23": {
|
|
"min_stack_version": "8.5",
|
|
"rule_name": "ESXI Timestomping using Touch Command",
|
|
"sha256": "9648e6c27ae63c4d6b1419abbd96b927ee8834cb13bac73d2f3c36c874122c45",
|
|
"type": "eql",
|
|
"version": 5
|
|
},
|
|
"3115bd2c-0baa-4df0-80ea-45e474b5ef93": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Agent Spoofing - Mismatched Agent ID",
|
|
"sha256": "edb96a30a9a4b522b0f24c47e6c9e97132020bca3d111e9f0fb2478062ca5c46",
|
|
"type": "query",
|
|
"version": 101
|
|
},
|
|
"31295df3-277b-4c56-a1fb-84e31b4222a9": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Inbound Connection to an Unsecure Elasticsearch Node",
|
|
"sha256": "7aca9860d8b4e2d6a3c826f3c89aad15a3ccef60bdb18f3a6c0e5d9d5eb96446",
|
|
"type": "query",
|
|
"version": 104
|
|
},
|
|
"31b4c719-f2b4-41f6-a9bd-fce93c2eaf62": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Bypass UAC via Event Viewer",
|
|
"sha256": "daa92a1b6f43697ea1240f49a719d9b47291cfa4bfa6656460a9ede23b2d00e3",
|
|
"type": "eql",
|
|
"version": 109
|
|
},
|
|
"3202e172-01b1-4738-a932-d024c514ba72": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "GCP Pub/Sub Topic Deletion",
|
|
"sha256": "124b074b61fa892959b957078f6b0ce22d6fc14dfa12721b099e26e56784daa0",
|
|
"type": "query",
|
|
"version": 104
|
|
},
|
|
"323cb487-279d-4218-bcbd-a568efe930c6": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Azure Network Watcher Deletion",
|
|
"sha256": "2639a17ce5e5d5cbfafd00c48a0d20d73a8f7fd26a389a962808a2d552c1cd1a",
|
|
"type": "query",
|
|
"version": 102
|
|
},
|
|
"32923416-763a-4531-bb35-f33b9232ecdb": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "RPC (Remote Procedure Call) to the Internet",
|
|
"sha256": "7ca9c8daa861f8675fc6d90454ceb1fbbeb55621db753f0ffa615be1509581ea",
|
|
"type": "query",
|
|
"version": 103
|
|
},
|
|
"32c5cf9c-2ef8-4e87-819e-5ccb7cd18b14": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Program Files Directory Masquerading",
|
|
"sha256": "06de85209a1b0dde5bc8b4f17f289dac52ac59beb2bb0e35c4dec8c8c2a29cb5",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"32f4675e-6c49-4ace-80f9-97c9259dca2e": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Suspicious MS Outlook Child Process",
|
|
"sha256": "9c7b1be8cd662dea09651d051b6aedfa04b3380cfa9fcb294a5776f8f883980b",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"333de828-8190-4cf5-8d7c-7575846f6fe0": {
|
|
"min_stack_version": "8.9",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 207,
|
|
"rule_name": "AWS IAM User Addition to Group",
|
|
"sha256": "02db7a25c54c4fbd473ce6ca4a124bfeaba29b63ff68e2d89d4cd27167d6ae7d",
|
|
"type": "query",
|
|
"version": 108
|
|
}
|
|
},
|
|
"rule_name": "AWS IAM User Addition to Group",
|
|
"sha256": "e6dc79527703135b1ce027a5d88baa39dd4c3512d0a5f56a036b8a27eab4ee81",
|
|
"type": "query",
|
|
"version": 208
|
|
},
|
|
"33a6752b-da5e-45f8-b13a-5f094c09522f": {
|
|
"min_stack_version": "8.5",
|
|
"rule_name": "ESXI Discovery via Find",
|
|
"sha256": "e78c45bd7a967de7c4defaf1dd745c826bfec1fd5423a3925426ae981a8822ac",
|
|
"type": "eql",
|
|
"version": 5
|
|
},
|
|
"33f306e8-417c-411b-965c-c2812d6d3f4d": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Remote File Download via PowerShell",
|
|
"sha256": "0843453e23fff6268308485d859e6668867b85c5cf0ed912c931d28d040ca4f7",
|
|
"type": "eql",
|
|
"version": 109
|
|
},
|
|
"342f834b-21a6-41bf-878c-87d116eba3ee": {
|
|
"min_stack_version": "8.8",
|
|
"rule_name": "Modification of Dynamic Linker Preload Shared Object Inside A Container",
|
|
"sha256": "80a1285a2fc10cd2a83830beb16066febaf04201e827216516c4e4dc9b47ade6",
|
|
"type": "eql",
|
|
"version": 1
|
|
},
|
|
"345889c4-23a8-4bc0-b7ca-756bd17ce83b": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "GitHub Repository Deleted",
|
|
"sha256": "82225047c1559d8bba7c15944953088395802e8a1ad8fd0552714eee65b22635",
|
|
"type": "eql",
|
|
"version": 1
|
|
},
|
|
"34fde489-94b0-4500-a76f-b8a157cf9269": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Accepted Default Telnet Port Connection",
|
|
"sha256": "5a1c81a6f5119308ed2c419c07cd7d61610c4bf863351341f4f1c5c3d54644b1",
|
|
"type": "query",
|
|
"version": 104
|
|
},
|
|
"35330ba2-c859-4c98-8b7f-c19159ea0e58": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Execution via Electron Child Process Node.js Module",
|
|
"sha256": "b91e01cbd654f79bb65cb81f07f055521e97ddb636f27bcb5c55ba7c599d55f0",
|
|
"type": "query",
|
|
"version": 105
|
|
},
|
|
"3535c8bb-3bd5-40f4-ae32-b7cd589d5372": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Port Forwarding Rule Addition",
|
|
"sha256": "291793bdb267500bb51af75132d44acbe6c3514e74d3fac34ce187ef4cc58d43",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"35a3b253-eea8-46f0-abd3-68bdd47e6e3d": {
|
|
"min_stack_version": "8.9",
|
|
"rule_name": "Spike in Bytes Sent to an External Device",
|
|
"sha256": "32a12fdccb57725b598715c3cf122e2068cf259b449fb15047fb9b0fc99a5fcd",
|
|
"type": "machine_learning",
|
|
"version": 2
|
|
},
|
|
"35df0dd8-092d-4a83-88c1-5151a804f31b": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Unusual Parent-Child Relationship",
|
|
"sha256": "f43b593fe851b23a69b109c4a9fd1e07aeb8374bab2d9c192ef74fc76cba8ec0",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"35f86980-1fb1-4dff-b311-3be941549c8d": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Network Traffic to Rare Destination Country",
|
|
"sha256": "599670166b519587f8e2c8712aaec4839a9edfbd71f94eef4d3ca35a4bff8e82",
|
|
"type": "machine_learning",
|
|
"version": 103
|
|
},
|
|
"3605a013-6f0c-4f7d-88a5-326f5be262ec": {
|
|
"rule_name": "Potential Privilege Escalation via Local Kerberos Relay over LDAP",
|
|
"sha256": "b7b6b739b9fc792afe27f022163d52b96501aec86dff5a7aa67b1ca17ecd47b3",
|
|
"type": "eql",
|
|
"version": 100
|
|
},
|
|
"3688577a-d196-11ec-90b0-f661ea17fbce": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Process Started from Process ID (PID) File",
|
|
"sha256": "954fc970c7c982de04f1ec41cdd8c4c8f00fe8b2bbc5507e42e9e255d9150c96",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"36a8e048-d888-4f61-a8b9-0f9e2e40f317": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Suspicious ImagePath Service Creation",
|
|
"sha256": "dabff5221c0b2f406165374af490dcdb04a568295196b805962ea4b2e88e734e",
|
|
"type": "eql",
|
|
"version": 105
|
|
},
|
|
"36c48a0c-c63a-4cbc-aee1-8cac87db31a9": {
|
|
"min_stack_version": "8.9",
|
|
"rule_name": "High Mean of Process Arguments in an RDP Session",
|
|
"sha256": "296e8ed0e6066e7b702fcf4311d2217ba39f5c0799f3226fad2477b5424210d1",
|
|
"type": "machine_learning",
|
|
"version": 2
|
|
},
|
|
"3728c08d-9b70-456b-b6b8-007c7d246128": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Suspicious File Edit",
|
|
"sha256": "0f9b9c003bc39253a948a9da6d7c5b5263d9d1dc3c73abf730550e6c0c3ff687",
|
|
"type": "eql",
|
|
"version": 3
|
|
},
|
|
"378f9024-8a0c-46a5-aa08-ce147ac73a4e": {
|
|
"min_stack_version": "8.9",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 204,
|
|
"rule_name": "AWS RDS Security Group Creation",
|
|
"sha256": "5b75c7ff3b23af486b2a98aa509dba99b6e5935a1884bcf20ce26298c87a413a",
|
|
"type": "query",
|
|
"version": 105
|
|
}
|
|
},
|
|
"rule_name": "AWS RDS Security Group Creation",
|
|
"sha256": "6ed9dc7097e846293dbf822a322406b46fcbd9d6642245a4dfbc73aabd62537b",
|
|
"type": "query",
|
|
"version": 205
|
|
},
|
|
"37994bca-0611-4500-ab67-5588afe73b77": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Azure Active Directory High Risk Sign-in",
|
|
"sha256": "81cfc0cf1d22eac182fb2dbed83295eb880bff4c46b583ac7a02667c2bd7140a",
|
|
"type": "query",
|
|
"version": 105
|
|
},
|
|
"37b0816d-af40-40b4-885f-bb162b3c88a9": {
|
|
"rule_name": "Anomalous Kernel Module Activity",
|
|
"sha256": "d514b94eb1d1b1d05bf21aff148b4318ba2188538a2407bb9737943370627c12",
|
|
"type": "machine_learning",
|
|
"version": 100
|
|
},
|
|
"37b211e8-4e2f-440f-86d8-06cc8f158cfa": {
|
|
"min_stack_version": "8.9",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 207,
|
|
"rule_name": "AWS Execution via System Manager",
|
|
"sha256": "2cbc10f8cfc4b487c2e60d03f65c07f3edfffcc2aff4715f233e6dc5d5164c60",
|
|
"type": "query",
|
|
"version": 108
|
|
}
|
|
},
|
|
"rule_name": "AWS Execution via System Manager",
|
|
"sha256": "f01c87073629652bd0f1abe3f300881145bb533a262308717ffcc0bab17a3dd0",
|
|
"type": "query",
|
|
"version": 208
|
|
},
|
|
"37f638ea-909d-4f94-9248-edd21e4a9906": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Finder Sync Plugin Registered and Enabled",
|
|
"sha256": "b41ece736909738d8ea437111abfff24846ce37e0dbf28c436ad918ae7056fc5",
|
|
"type": "eql",
|
|
"version": 105
|
|
},
|
|
"3805c3dc-f82c-4f8d-891e-63c24d3102b0": {
|
|
"min_stack_version": "8.10",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 206,
|
|
"rule_name": "Attempted Bypass of Okta MFA",
|
|
"sha256": "f4d46f02451d1b387f81c66eaf2bac499ae2b55dab8b5ff072060d572c17bae2",
|
|
"type": "query",
|
|
"version": 107
|
|
}
|
|
},
|
|
"rule_name": "Attempted Bypass of Okta MFA",
|
|
"sha256": "6873fd08617e0efde5dccf424aacbfe7057877288810c2ed68293f795964241b",
|
|
"type": "query",
|
|
"version": 207
|
|
},
|
|
"3838e0e3-1850-4850-a411-2e8c5ba40ba8": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Network Connection via Certutil",
|
|
"sha256": "ff32cd3ea3d3f5aa49fb8c8bcc7368b8211ee44bcad1809ab55e3874291c4274",
|
|
"type": "eql",
|
|
"version": 109
|
|
},
|
|
"38948d29-3d5d-42e3-8aec-be832aaaf8eb": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Prompt for Credentials with OSASCRIPT",
|
|
"sha256": "8ad731c423f1a7a201eea63221fa6f1c19645b46b39421558ced549ddda00f7d",
|
|
"type": "eql",
|
|
"version": 106
|
|
},
|
|
"38e5acdd-5f20-4d99-8fe4-f0a1a592077f": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "User Added as Owner for Azure Service Principal",
|
|
"sha256": "0366d38e25390f27d5a88679fdeb1186fa00482024bab6e37b84f6d6ee4bdf2f",
|
|
"type": "query",
|
|
"version": 102
|
|
},
|
|
"38f384e0-aef8-11ed-9a38-f661ea17fbcc": {
|
|
"min_stack_version": "8.4",
|
|
"rule_name": "External User Added to Google Workspace Group",
|
|
"sha256": "5b576006ba63579d8d410c1b6a505b7129e0e534887b142f08e9778bab82d1a1",
|
|
"type": "eql",
|
|
"version": 2
|
|
},
|
|
"39144f38-5284-4f8e-a2ae-e3fd628d90b0": {
|
|
"min_stack_version": "8.9",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 204,
|
|
"rule_name": "AWS EC2 Network Access Control List Creation",
|
|
"sha256": "dea5a5643f79a683de4d055fc1e7c3f2444af041cad46e962eea1d3f5f8310d4",
|
|
"type": "query",
|
|
"version": 105
|
|
}
|
|
},
|
|
"rule_name": "AWS EC2 Network Access Control List Creation",
|
|
"sha256": "ad7864116d4d41fba90af76f8325d2a86358ed55b0b9be7204d8983cc62b2614",
|
|
"type": "query",
|
|
"version": 205
|
|
},
|
|
"39157d52-4035-44a8-9d1a-6f8c5f580a07": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Downloaded Shortcut Files",
|
|
"sha256": "362ab87565072831948627491a1ba91889340030ce6f1438122322ffa57acb5d",
|
|
"type": "eql",
|
|
"version": 1
|
|
},
|
|
"397945f3-d39a-4e6f-8bcb-9656c2031438": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Persistence via Microsoft Outlook VBA",
|
|
"sha256": "2d7c95cdf099081d29fe694938ae75a1e1e05d03d14e2314b91abcf074cb3d2a",
|
|
"type": "eql",
|
|
"version": 105
|
|
},
|
|
"3a59fc81-99d3-47ea-8cd6-d48d561fca20": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential DNS Tunneling via NsLookup",
|
|
"sha256": "1feb23973523f2629afbcfd02fc9042a94493d897f520c7db2799fb1f9e27af7",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"3a6001a0-0939-4bbe-86f4-47d8faeb7b97": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Suspicious Module Loaded by LSASS",
|
|
"sha256": "bb7e77e182b27492c362583686a193391f56ca19f0c2663ade4d1b95e4fab26c",
|
|
"type": "eql",
|
|
"version": 6
|
|
},
|
|
"3a86e085-094c-412d-97ff-2439731e59cb": {
|
|
"rule_name": "Setgid Bit Set via chmod",
|
|
"sha256": "8a227c09d80f4787ecef3e02690f51fd836b29aafcd6b210d859c4cd51203941",
|
|
"type": "query",
|
|
"version": 100
|
|
},
|
|
"3ad49c61-7adc-42c1-b788-732eda2f5abf": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "VNC (Virtual Network Computing) to the Internet",
|
|
"sha256": "75c83bc25b63f6d009bfaa4c5ad8ac726f34d8463a71addc994107e75c6f41e3",
|
|
"type": "query",
|
|
"version": 104
|
|
},
|
|
"3ad77ed4-4dcf-4c51-8bfc-e3f7ce316b2f": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Azure Full Network Packet Capture Detected",
|
|
"sha256": "5ff3c05e76cc5d8d9d4be4f532e57b7f4b864c7b441e409db8c6424396b0030d",
|
|
"type": "query",
|
|
"version": 103
|
|
},
|
|
"3b382770-efbb-44f4-beed-f5e0a051b895": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Malware - Prevented - Elastic Endgame",
|
|
"sha256": "43bc73a5cbc5ccf4e81390755489787a2abc83ecabb1d94666471e4082fdd0a3",
|
|
"type": "query",
|
|
"version": 101
|
|
},
|
|
"3b47900d-e793-49e8-968f-c90dc3526aa1": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Unusual Parent Process for cmd.exe",
|
|
"sha256": "373baf17283c276e152b141c68c56eee4698cd1a52b9fb64f8343325b5e7d7b0",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"3bc6deaa-fbd4-433a-ae21-3e892f95624f": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "NTDS or SAM Database File Copied",
|
|
"sha256": "aa1f6b51dfaf16ed53025b1b4cb2f73647fb4e83a6da692753a3f319bf43c6e1",
|
|
"type": "eql",
|
|
"version": 109
|
|
},
|
|
"3c7e32e6-6104-46d9-a06e-da0f8b5795a0": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Unusual Linux Network Port Activity",
|
|
"sha256": "a2800c6cc225debfe9958195da944e5b1ead6405ccad4dac405b7e7d337dade9",
|
|
"type": "machine_learning",
|
|
"version": 103
|
|
},
|
|
"3d3aa8f9-12af-441f-9344-9f31053e316d": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "PowerShell Script with Log Clear Capabilities",
|
|
"sha256": "d2820917e295f70cedcc97c012d7e6f4bfa4368d8a77e79023225614feb95c7a",
|
|
"type": "query",
|
|
"version": 3
|
|
},
|
|
"3e002465-876f-4f04-b016-84ef48ce7e5d": {
|
|
"min_stack_version": "8.9",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 207,
|
|
"rule_name": "AWS CloudTrail Log Updated",
|
|
"sha256": "c544d2bed3c1f0c3eb62422883fdd5c1a029d8a1e4ade88af0b3aaaa0955dc99",
|
|
"type": "query",
|
|
"version": 108
|
|
}
|
|
},
|
|
"rule_name": "AWS CloudTrail Log Updated",
|
|
"sha256": "889bfc3e221a4919949c2b2fab1b12ee9a96a75c27e1e249c243318f7bd81063",
|
|
"type": "query",
|
|
"version": 208
|
|
},
|
|
"3e0561b5-3fac-4461-84cc-19163b9aaa61": {
|
|
"min_stack_version": "8.9",
|
|
"rule_name": "Spike in Number of Connections Made from a Source IP",
|
|
"sha256": "1d9b0dc7353a9d3f8bfc169a53aed8e05d122ae303c184d2ef1de2baf411c76b",
|
|
"type": "machine_learning",
|
|
"version": 2
|
|
},
|
|
"3e0eeb75-16e8-4f2f-9826-62461ca128b7": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Suspicious Execution via Windows Subsystem for Linux",
|
|
"sha256": "4d57fbe0eec06316d1ee5f24cf1f0a48bff5ed1d8f8bf4c944d57a25fc9c875e",
|
|
"type": "eql",
|
|
"version": 4
|
|
},
|
|
"3e12a439-d002-4944-bc42-171c0dcb9b96": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Kernel Driver Load",
|
|
"sha256": "b59ce0343e153ae461c5fccc6dd6aa3b6f38eff17a3960852a0a1b9c9dc88e3b",
|
|
"type": "eql",
|
|
"version": 2
|
|
},
|
|
"3e3d15c6-1509-479a-b125-21718372157e": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Suspicious Emond Child Process",
|
|
"sha256": "712b5f698a3cdac28ddf24ce2c91dff930454f6cb82e79b2c623129ba42ac23b",
|
|
"type": "eql",
|
|
"version": 105
|
|
},
|
|
"3e441bdb-596c-44fd-8628-2cfdf4516ada": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Remote File Execution via MSIEXEC",
|
|
"sha256": "1d20b245f40477327dbf43e563d8a93eca7531b9c1fa4649a0e9692d0eb33b01",
|
|
"type": "eql",
|
|
"version": 1
|
|
},
|
|
"3ecbdc9e-e4f2-43fa-8cca-63802125e582": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Privilege Escalation via Named Pipe Impersonation",
|
|
"sha256": "09ed4561cb386a7b90520c318b820066f354c61f1b5e023d10563ad64a035c2b",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"3ed032b2-45d8-4406-bc79-7ad1eabb2c72": {
|
|
"min_stack_version": "8.8",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 206,
|
|
"rule_name": "Suspicious Process Creation CallTrace",
|
|
"sha256": "ef3b36cfe9937ac9e94d85f43e7c8d1eb725f6edec2353a6c3df2745f5d06fbb",
|
|
"type": "eql",
|
|
"version": 107
|
|
}
|
|
},
|
|
"rule_name": "Suspicious Process Creation CallTrace",
|
|
"sha256": "7cb2b7500b86c37fa3f51926431b8f44f6c119d48cf37e143cfa176f9facadb8",
|
|
"type": "eql",
|
|
"version": 207
|
|
},
|
|
"3efee4f0-182a-40a8-a835-102c68a4175d": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Password Spraying of Microsoft 365 User Accounts",
|
|
"sha256": "d864c81705b90eda8f509178fdd93a918d5d23bf207160ac4eef1159233974e1",
|
|
"type": "threshold",
|
|
"version": 102
|
|
},
|
|
"3f0e5410-a4bf-4e8c-bcfc-79d67a285c54": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "CyberArk Privileged Access Security Error",
|
|
"sha256": "c386d6369ab49aa1ccb5c14a29f84d5f2856b09ca44e9d53418a1477ace1a37a",
|
|
"type": "query",
|
|
"version": 102
|
|
},
|
|
"3f12325a-4cc6-410b-8d4c-9fbbeb744cfd": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Protocol Tunneling via Chisel Client",
|
|
"sha256": "096a86b65506d41f82036e1d4ea0151a295eefc548fe5ba3f7c38995c83f088b",
|
|
"type": "eql",
|
|
"version": 4
|
|
},
|
|
"3f3f9fe2-d095-11ec-95dc-f661ea17fbce": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Binary Executed from Shared Memory Directory",
|
|
"sha256": "a99ea10f8baeb92b2c9e2c4363393f2718bab9daab338ce36617565d14e8a3c8",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"3f4d7734-2151-4481-b394-09d7c6c91f75": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Process Discovery via Built-In Applications",
|
|
"sha256": "f0fbc9841d89528d4653aecdb898606cdec1a669cbf73110c4cc05ec417c4ad2",
|
|
"type": "eql",
|
|
"version": 2
|
|
},
|
|
"3f4e2dba-828a-452a-af35-fe29c5e78969": {
|
|
"min_stack_version": "8.9",
|
|
"rule_name": "Unusual Time or Day for an RDP Session",
|
|
"sha256": "9b471f8864eedbbad89dffb8d15a22628f08b9e1a67dd5221d1766d6eba59e57",
|
|
"type": "machine_learning",
|
|
"version": 2
|
|
},
|
|
"40155ee4-1e6a-4e4d-a63b-e8ba16980cfb": {
|
|
"min_stack_version": "8.9",
|
|
"rule_name": "Unusual Process Spawned by a User",
|
|
"sha256": "b50af272ff3b6b7eb7b333f0c8d267b51bfdd83586ee5b0691748862fd2c3923",
|
|
"type": "machine_learning",
|
|
"version": 2
|
|
},
|
|
"403ef0d3-8259-40c9-a5b6-d48354712e49": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Unusual Persistence via Services Registry",
|
|
"sha256": "0f9c30762b9d866395af98426eb9a784abbf168110167161bb7302fc4402a8dc",
|
|
"type": "eql",
|
|
"version": 105
|
|
},
|
|
"40ddbcc8-6561-44d9-afc8-eefdbfe0cccd": {
|
|
"min_stack_version": "8.6",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 102,
|
|
"rule_name": "Suspicious Modprobe File Event",
|
|
"sha256": "db18497df8258d667278d17da2d21dadbc1c81dedbd75ddcbb22e91e172a8c1c",
|
|
"type": "eql",
|
|
"version": 3
|
|
}
|
|
},
|
|
"rule_name": "Suspicious Modprobe File Event",
|
|
"sha256": "e2563182898cd53fd297c35504ad76579440cfef8eabe9d2cfe715150dce74eb",
|
|
"type": "new_terms",
|
|
"version": 105
|
|
},
|
|
"41284ba3-ed1a-4598-bfba-a97f75d9aba2": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Unix Socket Connection",
|
|
"sha256": "38561d8ce173227b49b1459ae11d38bfba76385fa68298e1ddb7b8603d57a8b6",
|
|
"type": "eql",
|
|
"version": 1
|
|
},
|
|
"416697ae-e468-4093-a93d-59661fa619ec": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Control Panel Process with Unusual Arguments",
|
|
"sha256": "88b7f3edd6dcf39eb51d9ad50f608aae26b1aaaff95adb1f19b6565abcf8d9e1",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"41824afb-d68c-4d0e-bfee-474dac1fa56e": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "EggShell Backdoor Execution",
|
|
"sha256": "a000d7946f2d9c6608fef001a71aa8b626b93b668a56cb558aae7b94e49089cb",
|
|
"type": "query",
|
|
"version": 103
|
|
},
|
|
"41b638a1-8ab6-4f8e-86d9-466317ef2db5": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Hidden Local User Account Creation",
|
|
"sha256": "473f098ef25c7659b7ec2c953c7fe83d29d17210bae3f18a76e7aabe5ef9aa31",
|
|
"type": "query",
|
|
"version": 105
|
|
},
|
|
"420e5bb4-93bf-40a3-8f4a-4cc1af90eca1": {
|
|
"min_stack_version": "8.8",
|
|
"rule_name": "Interactive Exec Command Launched Against A Running Container",
|
|
"sha256": "3e2d9d02297e6659a2e22c12019c924caed14914e8e223416d9275a1c232f063",
|
|
"type": "eql",
|
|
"version": 2
|
|
},
|
|
"42bf698b-4738-445b-8231-c834ddefd8a0": {
|
|
"min_stack_version": "8.10",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 206,
|
|
"rule_name": "Okta Brute Force or Password Spraying Attack",
|
|
"sha256": "9ecdb590d2df1959b2b11908911f24308925c345cce10b0370721afd09a2196e",
|
|
"type": "threshold",
|
|
"version": 107
|
|
}
|
|
},
|
|
"rule_name": "Okta Brute Force or Password Spraying Attack",
|
|
"sha256": "60954a70897438ce1627fe0aab388688a6c189b04e7eca5543e0c450283c029b",
|
|
"type": "threshold",
|
|
"version": 207
|
|
},
|
|
"42eeee3d-947f-46d3-a14d-7036b962c266": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Process Creation via Secondary Logon",
|
|
"sha256": "65781e6a82dfba3a861174decf22fa460a0930a12169646ca3d6d4aa7eaa7c6a",
|
|
"type": "eql",
|
|
"version": 8
|
|
},
|
|
"4330272b-9724-4bc6-a3ca-f1532b81e5c2": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Unusual Login Activity",
|
|
"sha256": "178b730df2f0523fca5d50f1c7bfb91a3b574b4d6bfa9a475d11d6208ef93b2c",
|
|
"type": "machine_learning",
|
|
"version": 103
|
|
},
|
|
"43303fd4-4839-4e48-b2b2-803ab060758d": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Web Application Suspicious Activity: No User Agent",
|
|
"sha256": "dba7037fea9889f8f9bb14d8bc56ff2eb114acab0af17a595d777e53783c3919",
|
|
"type": "query",
|
|
"version": 101
|
|
},
|
|
"43d6ec12-2b1c-47b5-8f35-e9de65551d3b": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Linux User Added to Privileged Group",
|
|
"sha256": "8b01aed5f72d886c28700069c04c106550f8803094c43e8fb5f458bba3e843ff",
|
|
"type": "eql",
|
|
"version": 5
|
|
},
|
|
"440e2db4-bc7f-4c96-a068-65b78da59bde": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Startup Persistence by a Suspicious Process",
|
|
"sha256": "dd409ade4fd40ee77479589620573779b153ec9c46ba6ecd32a0b3878b417730",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"445a342e-03fb-42d0-8656-0367eb2dead5": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Unusual Windows Path Activity",
|
|
"sha256": "0c0dc0204bae57db331547a95b8be8a1a7a915fd32f0e9ed199b109a8418db7e",
|
|
"type": "machine_learning",
|
|
"version": 104
|
|
},
|
|
"4494c14f-5ff8-4ed2-8e99-bf816a1642fc": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Masquerading as VLC DLL",
|
|
"sha256": "ed65c5d1379b83e560f4fa24ff1f51887de783c7e8f3fc329b717a14700a859c",
|
|
"type": "eql",
|
|
"version": 2
|
|
},
|
|
"44fc462c-1159-4fa8-b1b7-9b6296ab4f96": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Multiple Vault Web Credentials Read",
|
|
"sha256": "d1dc99f54476ef81bf7b7a1b8a5ea2e40a3c58ee6cad0f93459808bc06d3fae9",
|
|
"type": "eql",
|
|
"version": 9
|
|
},
|
|
"453f659e-0429-40b1-bfdb-b6957286e04b": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Permission Theft - Prevented - Elastic Endgame",
|
|
"sha256": "223843bf80e272f189bee419979e4fcda5a2022bcf2c5c1f15706307e1f98fb1",
|
|
"type": "query",
|
|
"version": 101
|
|
},
|
|
"45ac4800-840f-414c-b221-53dd36a5aaf7": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Windows Event Logs Cleared",
|
|
"sha256": "fc09cce15ed08c912228c02d8c8a913febbcfde1263a2410a281a5b780cbc1bd",
|
|
"type": "query",
|
|
"version": 108
|
|
},
|
|
"45d273fb-1dca-457d-9855-bcb302180c21": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Encrypting Files with WinRar or 7z",
|
|
"sha256": "87876e96cffd8fcaa7701a062020cde8d6ada8f48aeed13a7b7153b0274318f5",
|
|
"type": "eql",
|
|
"version": 109
|
|
},
|
|
"4630d948-40d4-4cef-ac69-4002e29bc3db": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Adding Hidden File Attribute via Attrib",
|
|
"sha256": "5b1155c651c8cba197b8525501a76da112e7941889fa0a8b5b0e27caf1105deb",
|
|
"type": "eql",
|
|
"version": 109
|
|
},
|
|
"4682fd2c-cfae-47ed-a543-9bed37657aa6": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Local NTLM Relay via HTTP",
|
|
"sha256": "990b886b92cb87798246a158ca46bf1b61eb1ac09d2e34d3744dee85300efb72",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"46f804f5-b289-43d6-a881-9387cf594f75": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Unusual Process For a Linux Host",
|
|
"sha256": "5fbea0760b51ff40b45435e9978a27fd21ee1b2a9792c2892ca01cc45f6dc782",
|
|
"type": "machine_learning",
|
|
"version": 104
|
|
},
|
|
"474fd20e-14cc-49c5-8160-d9ab4ba16c8b": {
|
|
"min_stack_version": "8.6",
|
|
"rule_name": "Potential Persistence Through init.d Detected",
|
|
"sha256": "bac9e6b18e0ec38e0b8930bb9402ed0d4c8000c06cacaaabaa388556a67dcb48",
|
|
"type": "new_terms",
|
|
"version": 7
|
|
},
|
|
"475b42f0-61fb-4ef0-8a85-597458bfb0a1": {
|
|
"min_stack_version": "8.8",
|
|
"rule_name": "Sensitive Files Compression Inside A Container",
|
|
"sha256": "4e4eac63997eab8b7b05da7301b3f3d904afbc53f9ac2c2789df7ff023df7939",
|
|
"type": "eql",
|
|
"version": 2
|
|
},
|
|
"47e22836-4a16-4b35-beee-98f6c4ee9bf2": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Suspicious Remote Registry Access via SeBackupPrivilege",
|
|
"sha256": "b3e13c97d0c0bff23ce9255d93a0a60d4aed4d262d14236423927bff1458d583",
|
|
"type": "eql",
|
|
"version": 109
|
|
},
|
|
"47f09343-8d1f-4bb5-8bb0-00c9d18f5010": {
|
|
"rule_name": "Execution via Regsvcs/Regasm",
|
|
"sha256": "fa283dded0764ed89000be343cbbb926c659d742d2cf19d15ad5c5680a096578",
|
|
"type": "query",
|
|
"version": 100
|
|
},
|
|
"47f76567-d58a-4fed-b32b-21f571e28910": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Apple Script Execution followed by Network Connection",
|
|
"sha256": "0707726336298da0eacdb012ecfd3d5a1d4db190cc8b010ea63e32319a591bd7",
|
|
"type": "eql",
|
|
"version": 105
|
|
},
|
|
"483c4daf-b0c6-49e0-adf3-0bfa93231d6b": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Microsoft Exchange Server UM Spawning Suspicious Processes",
|
|
"sha256": "639eb15abbef368443484e39fabea441656acc3ae63f1e516bcf0809870d0297",
|
|
"type": "eql",
|
|
"version": 106
|
|
},
|
|
"48819484-9826-4083-9eba-1da74cd0eaf2": {
|
|
"min_stack_version": "8.6",
|
|
"rule_name": "Suspicious Microsoft 365 Mail Access by ClientAppId",
|
|
"sha256": "fadad966a91f932ed17c91f28dccd142d23d55cd4ae7ea7c57bdd1571b0c95ea",
|
|
"type": "new_terms",
|
|
"version": 1
|
|
},
|
|
"48b3d2e3-f4e8-41e6-95e6-9b2091228db3": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Reverse Shell",
|
|
"sha256": "89cb7506c40c363e3a341bf80a940b915a41f7abbf4c1e2889967a5a1c18b485",
|
|
"type": "eql",
|
|
"version": 7
|
|
},
|
|
"48b6edfc-079d-4907-b43c-baffa243270d": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Multiple Logon Failure from the same Source Address",
|
|
"sha256": "b4fb37e1e7527312d0819a95373e8bdd68e9b4b4f4cbfb074007c7fbe3cb736f",
|
|
"type": "eql",
|
|
"version": 8
|
|
},
|
|
"48d7f54d-c29e-4430-93a9-9db6b5892270": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Unexpected Child Process of macOS Screensaver Engine",
|
|
"sha256": "9a234c8cffcb67324557459f70bc5644b48f12b78ddc226765d69211e2034ced",
|
|
"type": "eql",
|
|
"version": 106
|
|
},
|
|
"48ec9452-e1fd-4513-a376-10a1a26d2c83": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Persistence via Periodic Tasks",
|
|
"sha256": "3c035219a5681c2514f111063f313c5e3108fc0d98ca2ab089aa72eb6f519951",
|
|
"type": "query",
|
|
"version": 105
|
|
},
|
|
"48f657ee-de4f-477c-aa99-ed88ee7af97a": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Remote XSL Script Execution via COM",
|
|
"sha256": "19961cd9171e3ef5204e98314fdf573ac68e28c6ab1c5e91b5f1d71c919ea7db",
|
|
"type": "eql",
|
|
"version": 1
|
|
},
|
|
"493834ca-f861-414c-8602-150d5505b777": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Agent Spoofing - Multiple Hosts Using Same Agent",
|
|
"sha256": "6928326257c9c13a06c0f1b72217966aa1141319570100427a2bc9edc41964c0",
|
|
"type": "threshold",
|
|
"version": 101
|
|
},
|
|
"494ebba4-ecb7-4be4-8c6f-654c686549ad": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Linux Backdoor User Account Creation",
|
|
"sha256": "5b5bf047bef61d90083e4c43c267c4ec7b4769ca32b5928ea33b8ddd31fc7530",
|
|
"type": "eql",
|
|
"version": 5
|
|
},
|
|
"495e5f2e-2480-11ed-bea8-f661ea17fbce": {
|
|
"min_stack_version": "8.4",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 103,
|
|
"rule_name": "Application Removed from Blocklist in Google Workspace",
|
|
"sha256": "e61b1bbcf81ae0a39c5740592307709fdd354ac9c7ca1cff724f403f2683e67e",
|
|
"type": "query",
|
|
"version": 5
|
|
}
|
|
},
|
|
"rule_name": "Application Removed from Blocklist in Google Workspace",
|
|
"sha256": "458d45e2d4ec3ad54e104516c1bf827f241392740f457d0b358ed439cea466f4",
|
|
"type": "query",
|
|
"version": 106
|
|
},
|
|
"4973e46b-a663-41b8-a875-ced16dda2bb0": {
|
|
"min_stack_version": "8.6",
|
|
"rule_name": "Deprecated - Potential Process Injection via LD_PRELOAD Environment Variable",
|
|
"sha256": "9fa82ebadcb5c5f29578c49072ea5d921ce9a8af05291cd755e5c6aefcc422d7",
|
|
"type": "eql",
|
|
"version": 3
|
|
},
|
|
"4982ac3e-d0ee-4818-b95d-d9522d689259": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Process Discovery Using Built-in Tools",
|
|
"sha256": "37099aca1b1bdce63f77e75103ff60a0d61898af8036c43eaa2f4d672bd326dd",
|
|
"type": "eql",
|
|
"version": 3
|
|
},
|
|
"4a4e23cf-78a2-449c-bac3-701924c269d3": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Possible FIN7 DGA Command and Control Behavior",
|
|
"sha256": "42113dd49a2b2df45e90301ac64feac172a5fe2d5ae21baddb22e62943b28082",
|
|
"type": "query",
|
|
"version": 105
|
|
},
|
|
"4a99ac6f-9a54-4ba5-a64f-6eb65695841b": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Unauthorized Access via Wildcard Injection Detected",
|
|
"sha256": "854656d39824472174625ba831a52a49485204da2450fdca9db0362d785b2ca6",
|
|
"type": "eql",
|
|
"version": 4
|
|
},
|
|
"4aa58ac6-4dc0-4d18-b713-f58bf8bd015c": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Cross Site Scripting (XSS)",
|
|
"sha256": "0ddba68a65a560e542542a531d9b0222a706b62e38442f5afb342b989f8d70fa",
|
|
"type": "eql",
|
|
"version": 1
|
|
},
|
|
"4b1a807a-4e7b-414e-8cea-24bf580f6fc5": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Deprecated - Potential Reverse Shell via Suspicious Parent Process",
|
|
"sha256": "a8340e173929cc26fccdb80d23355387d04d41b26c099412fc6542025089e982",
|
|
"type": "eql",
|
|
"version": 6
|
|
},
|
|
"4b438734-3793-4fda-bd42-ceeada0be8f9": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Disable Windows Firewall Rules via Netsh",
|
|
"sha256": "a04f9f214a8657301ff6f4a703643d13ac53077379481968c70e4bf2cea816a6",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"4b4e9c99-27ea-4621-95c8-82341bc6e512": {
|
|
"min_stack_version": "8.8",
|
|
"rule_name": "Container Workload Protection",
|
|
"sha256": "7dc1df259f2559b82c60fd64135e3a8b31538897e166eb5e423a3487b860e4d7",
|
|
"type": "query",
|
|
"version": 3
|
|
},
|
|
"4b868f1f-15ff-4ba3-8c11-d5a7a6356d37": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "ProxyChains Activity",
|
|
"sha256": "b6d4b380b3738c08ae7418cf9bf2094fea2128d43315465e741e17fb6bf6c361",
|
|
"type": "eql",
|
|
"version": 2
|
|
},
|
|
"4b95ecea-7225-4690-9938-2a2c0bad9c99": {
|
|
"min_stack_version": "8.9",
|
|
"rule_name": "Unusual Process Writing Data to an External Device",
|
|
"sha256": "b86e21f533a8abbe681d8e714d35bff6b31ec9354bf3751ee7d5f488940e6bd3",
|
|
"type": "machine_learning",
|
|
"version": 2
|
|
},
|
|
"4bd1c1af-79d4-4d37-9efa-6e0240640242": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Unusual Process Execution Path - Alternate Data Stream",
|
|
"sha256": "502fa24c53c1494b06d2a0ced551622a637c45233b440fc68dc1742cd299071b",
|
|
"type": "eql",
|
|
"version": 106
|
|
},
|
|
"4c59cff1-b78a-41b8-a9f1-4231984d1fb6": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "PowerShell Share Enumeration Script",
|
|
"sha256": "8912807ab7734bcfcf236a07a04964d896253b8066febf03afd16256f013020e",
|
|
"type": "query",
|
|
"version": 8
|
|
},
|
|
"4d4c35f4-414e-4d0c-bb7e-6db7c80a6957": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Kernel Load or Unload via Kexec Detected",
|
|
"sha256": "53f533ffdd9d2d9f7c1a5cba374de00d7db74d814cde9706d3750390086f3c78",
|
|
"type": "eql",
|
|
"version": 5
|
|
},
|
|
"4d50a94f-2844-43fa-8395-6afbd5e1c5ef": {
|
|
"min_stack_version": "8.9",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 204,
|
|
"rule_name": "AWS Management Console Brute Force of Root User Identity",
|
|
"sha256": "32d9ab18831ca9798b2304547daeb8258a6f8905a01a54c468b20409eee885f6",
|
|
"type": "threshold",
|
|
"version": 105
|
|
}
|
|
},
|
|
"rule_name": "AWS Management Console Brute Force of Root User Identity",
|
|
"sha256": "c7f85d799207c359e3f84f41c0473858bad893198ffa7f3d8327d153eb0b422c",
|
|
"type": "threshold",
|
|
"version": 205
|
|
},
|
|
"4da13d6e-904f-4636-81d8-6ab14b4e6ae9": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Attempt to Disable Gatekeeper",
|
|
"sha256": "8d66b86897c0f7e9f90e2ab46d46d6734db7e1fd64cdf5c5c9926e164ccef324",
|
|
"type": "query",
|
|
"version": 105
|
|
},
|
|
"4de76544-f0e5-486a-8f84-eae0b6063cdc": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Disable Windows Event and Security Logs Using Built-in Tools",
|
|
"sha256": "6bb389b8e69d040d951bc64627e254593b1ba372685398e81c21eb814dd51b62",
|
|
"type": "eql",
|
|
"version": 109
|
|
},
|
|
"4e85dc8a-3e41-40d8-bc28-91af7ac6cf60": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Multiple Logon Failure Followed by Logon Success",
|
|
"sha256": "5fc006866645843af182ca61acac0199ac14da30181a0da5371c2bde0902ec72",
|
|
"type": "eql",
|
|
"version": 9
|
|
},
|
|
"4ec47004-b34a-42e6-8003-376a123ea447": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Suspicious Process Spawned from MOTD Detected",
|
|
"sha256": "2e853ef0a4b3eea2270e8d8fc0910e0cfd526c79682e1776dbf7500c6d825341",
|
|
"type": "eql",
|
|
"version": 7
|
|
},
|
|
"4ed493fc-d637-4a36-80ff-ac84937e5461": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Execution via MSSQL xp_cmdshell Stored Procedure",
|
|
"sha256": "a1c46d81fd67c7642daa17b16bf816cde74efe2dfaee7d15579ef7111e42b7ee",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"4ed678a9-3a4f-41fb-9fea-f85a6e0a0dff": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Suspicious Script Object Execution",
|
|
"sha256": "8db69fc49940b524199c4fc60605ef12797755543bf966dcb698d7ea10ce6ade",
|
|
"type": "eql",
|
|
"version": 106
|
|
},
|
|
"4edd3e1a-3aa0-499b-8147-4d2ea43b1613": {
|
|
"min_stack_version": "8.10",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 205,
|
|
"rule_name": "Unauthorized Access to an Okta Application",
|
|
"sha256": "8e3e57e9dbe9ec6a8cc4673f80020513ca5a4c120e4a9efb9f8acc7a646de4c8",
|
|
"type": "query",
|
|
"version": 106
|
|
}
|
|
},
|
|
"rule_name": "Unauthorized Access to an Okta Application",
|
|
"sha256": "6cf84f243e86183b9bc2efdc39aa92f7573c421593ce71f1ce90dd87daf5b2dd",
|
|
"type": "query",
|
|
"version": 206
|
|
},
|
|
"4fe9d835-40e1-452d-8230-17c147cafad8": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Execution via TSClient Mountpoint",
|
|
"sha256": "675fe51d000d7b660cd1a39a19d74d93f2ee7341be001e5ad5e10cd547cdf869",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"50887ba8-7ff7-11ee-a038-f661ea17fbcd": {
|
|
"min_stack_version": "8.10",
|
|
"rule_name": "Multiple Okta User Auth Events with Same Device Token Hash Behind a Proxy",
|
|
"sha256": "9f8682da0707ca62f5537007eb440a25605c097964d7acb1ab228c8c773845ca",
|
|
"type": "threshold",
|
|
"version": 2
|
|
},
|
|
"51176ed2-2d90-49f2-9f3d-17196428b169": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Windows System Information Discovery",
|
|
"sha256": "2c0c54011671e9e99d2654529520c137188a4bbcf8feb0beb28c196f0525d88e",
|
|
"type": "eql",
|
|
"version": 3
|
|
},
|
|
"5124e65f-df97-4471-8dcb-8e3953b3ea97": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Hidden Files and Directories via Hidden Flag",
|
|
"sha256": "77af208d8070c7123775d9c7708d351a1d4ae579a13d0190e489642b5810f639",
|
|
"type": "eql",
|
|
"version": 1
|
|
},
|
|
"513f0ffd-b317-4b9c-9494-92ce861f22c7": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Registry Persistence via AppCert DLL",
|
|
"sha256": "6f0e1ffcea5865ac47fd6f0f59001b4cf947d26aefdeeb3eda27d545d84820e3",
|
|
"type": "eql",
|
|
"version": 106
|
|
},
|
|
"514121ce-c7b6-474a-8237-68ff71672379": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Microsoft 365 Exchange DKIM Signing Configuration Disabled",
|
|
"sha256": "a5c1852e0f0b5d54d522bc9d34146368b3966050fdbb0b514ad8a5c883a865c3",
|
|
"type": "query",
|
|
"version": 102
|
|
},
|
|
"51859fa0-d86b-4214-bf48-ebb30ed91305": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "GCP Logging Sink Deletion",
|
|
"sha256": "c9a8ece69b7f242aba612e1ba56c3839f13edb69babaff4ec9dd0f717dbcf827",
|
|
"type": "query",
|
|
"version": 104
|
|
},
|
|
"51a09737-80f7-4551-a3be-dac8ef5d181a": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Tainted Out-Of-Tree Kernel Module Load",
|
|
"sha256": "906a021911de5e8f4437da9087e7b52974e5ae6d5decb416ebc494866bf4ecc9",
|
|
"type": "query",
|
|
"version": 1
|
|
},
|
|
"51ce96fb-9e52-4dad-b0ba-99b54440fc9a": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Incoming DCOM Lateral Movement with MMC",
|
|
"sha256": "298d203a01db67a0653310a2665d704f81a97db74789cbe2fdf632ebe7574155",
|
|
"type": "eql",
|
|
"version": 106
|
|
},
|
|
"521fbe5c-a78d-4b6b-a323-f978b0e4c4c0": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Successful Linux RDP Brute Force Attack Detected",
|
|
"sha256": "32d05a814889ee60dc87a1d8bfd9ccde871f528b806978fcd7a8e999fac7d565",
|
|
"type": "eql",
|
|
"version": 5
|
|
},
|
|
"523116c0-d89d-4d7c-82c2-39e6845a78ef": {
|
|
"min_stack_version": "8.9",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 204,
|
|
"rule_name": "AWS GuardDuty Detector Deletion",
|
|
"sha256": "875d325d03aab871f3af655b2a4f09f60421b1863ada9a2e59e415560be70fa6",
|
|
"type": "query",
|
|
"version": 105
|
|
}
|
|
},
|
|
"rule_name": "AWS GuardDuty Detector Deletion",
|
|
"sha256": "238e31f86ad8ffd8ec077358374a122a8c7bbee39ce994f761ad3441be820a9c",
|
|
"type": "query",
|
|
"version": 205
|
|
},
|
|
"52376a86-ee86-4967-97ae-1a05f55816f0": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Linux Restricted Shell Breakout via Linux Binary(s)",
|
|
"sha256": "24bd83686da07cb3f3459249f9eb34318aaa69517e06082b9df92f5456b93485",
|
|
"type": "eql",
|
|
"version": 111
|
|
},
|
|
"5297b7f1-bccd-4611-93fa-ea342a01ff84": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Execution via Microsoft DotNet ClickOnce Host",
|
|
"sha256": "71ef45621a5ba89795ad23007d4a9f50038ad681e75b73c50d4f275e0cd848b7",
|
|
"type": "eql",
|
|
"version": 1
|
|
},
|
|
"52aaab7b-b51c-441a-89ce-4387b3aea886": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Unusual Network Connection via RunDLL32",
|
|
"sha256": "ed4bedce5bbc1788f21c4a7cf33af783dbfc0a12fcc6a88df03c97257eed9e7a",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"52afbdc5-db15-485e-bc24-f5707f820c4b": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Unusual Linux Network Activity",
|
|
"sha256": "17357496d0db27a4d0ccddae1c436a5239eced079e597b6deaf8b586add984e7",
|
|
"type": "machine_learning",
|
|
"version": 103
|
|
},
|
|
"52afbdc5-db15-485e-bc35-f5707f820c4c": {
|
|
"rule_name": "Unusual Linux Web Activity",
|
|
"sha256": "a25a0fe20cc7cdd9b940f1455c54b3cbd54a07d575ec8d8b6219b61af322aaad",
|
|
"type": "machine_learning",
|
|
"version": 100
|
|
},
|
|
"52afbdc5-db15-596e-bc35-f5707f820c4b": {
|
|
"rule_name": "Unusual Linux Network Service",
|
|
"sha256": "af448b51ebd531a54c02ae19fc4cc63deef15eb691efcc957764e26879b9a87c",
|
|
"type": "machine_learning",
|
|
"version": 100
|
|
},
|
|
"530178da-92ea-43ce-94c2-8877a826783d": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Suspicious CronTab Creation or Modification",
|
|
"sha256": "27807c0b1bbc5c951feb992b0d6326af2b457c21ea661e1cc745995c25745e21",
|
|
"type": "eql",
|
|
"version": 105
|
|
},
|
|
"53617418-17b4-4e9c-8a2c-8deb8086ca4b": {
|
|
"min_stack_version": "8.6",
|
|
"rule_name": "Suspicious Network Activity to the Internet by Previously Unknown Executable",
|
|
"sha256": "0ca4553577a276a0afb0bbee5fc06fa283385f41dc413ebf23ecd2e4eb1b6e6a",
|
|
"type": "new_terms",
|
|
"version": 6
|
|
},
|
|
"536997f7-ae73-447d-a12d-bff1e8f5f0a0": {
|
|
"min_stack_version": "8.9",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 204,
|
|
"rule_name": "AWS EFS File System or Mount Deleted",
|
|
"sha256": "dea68832916d128880a091971ddca7401be50c5a91b85315b44276c17c34b3a2",
|
|
"type": "query",
|
|
"version": 105
|
|
}
|
|
},
|
|
"rule_name": "AWS EFS File System or Mount Deleted",
|
|
"sha256": "28f9744c81cfffbf8417f66ee1911ac9da89e9e352c5db4f0af9d725cd73c907",
|
|
"type": "query",
|
|
"version": 205
|
|
},
|
|
"5370d4cd-2bb3-4d71-abf5-1e1d0ff5a2de": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Azure Diagnostic Settings Deletion",
|
|
"sha256": "d8cf4f99c49156e9bc70819e7e213ddc8254034a37779b4650402dfe6597dce2",
|
|
"type": "query",
|
|
"version": 102
|
|
},
|
|
"5397080f-34e5-449b-8e9c-4c8083d7ccc6": {
|
|
"min_stack_version": "8.10",
|
|
"rule_name": "Statistical Model Detected C2 Beaconing Activity",
|
|
"sha256": "7b3107911e8c741b9ec3094b7c7a52e543860a937b4ed244eece2b4aa8e5e3e7",
|
|
"type": "query",
|
|
"version": 2
|
|
},
|
|
"53a26770-9cbd-40c5-8b57-61d01a325e14": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Suspicious PDF Reader Child Process",
|
|
"sha256": "740a3469ba041ca4f12509b7a293c6506daa3b69237686b4d407c20e3300931e",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"53dedd83-1be7-430f-8026-363256395c8b": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Binary Content Copy via Cmd.exe",
|
|
"sha256": "8ece78d3d804106f87c006fdd8a027648880338a3a56c52e28a393d8f18aff40",
|
|
"type": "eql",
|
|
"version": 2
|
|
},
|
|
"54902e45-3467-49a4-8abc-529f2c8cfb80": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Uncommon Registry Persistence Change",
|
|
"sha256": "470d8e6c5c1dfd3564bd5f3b59d7853db9137942de25c38e4281b2d16df70ede",
|
|
"type": "eql",
|
|
"version": 105
|
|
},
|
|
"54a81f68-5f2a-421e-8eed-f888278bb712": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Exchange Mailbox Export via PowerShell",
|
|
"sha256": "8b8b47b60cf612754dc318d5963e5f915e3a9a6cc52152d9e3211eeb0155b2c2",
|
|
"type": "query",
|
|
"version": 7
|
|
},
|
|
"54c3d186-0461-4dc3-9b33-2dc5c7473936": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Network Logon Provider Registry Modification",
|
|
"sha256": "7181c9bb9bcebc8e25b18d6dabbedd9cbf39592c805512606e418ec028f4003b",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"55c2bf58-2a39-4c58-a384-c8b1978153c2": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Windows Service Installed via an Unusual Client",
|
|
"sha256": "837622000e1ecb3a269462a17f996c294b62888bbbd19f9585ad12521b4326a3",
|
|
"type": "query",
|
|
"version": 106
|
|
},
|
|
"55d551c6-333b-4665-ab7e-5d14a59715ce": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "PsExec Network Connection",
|
|
"sha256": "ea9ce524558142eeb928e1288478f70877cf06e9b9344009845c85f0257329e7",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"55f07d1b-25bc-4a0f-aa0c-05323c1319d0": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Windows Installer with Suspicious Properties",
|
|
"sha256": "ef9f5b3f0202dcd4e752c19f9ee8c807b55c72c653b8e1fa0399b2a0408c8753",
|
|
"type": "eql",
|
|
"version": 1
|
|
},
|
|
"56004189-4e69-4a39-b4a9-195329d226e9": {
|
|
"min_stack_version": "8.9",
|
|
"rule_name": "Unusual Process Spawned by a Host",
|
|
"sha256": "096b9a5a676e3ff07deaf9518e90a65b1b738c50f20cd0599281e782282da58f",
|
|
"type": "machine_learning",
|
|
"version": 2
|
|
},
|
|
"5610b192-7f18-11ee-825b-f661ea17fbcd": {
|
|
"min_stack_version": "8.10",
|
|
"rule_name": "Stolen Credentials Used to Login to Okta Account After MFA Reset",
|
|
"sha256": "19f2524462a1935f7bd77fa31385a7dbf59740b36cd1da2d0ac2166624973870",
|
|
"type": "eql",
|
|
"version": 1
|
|
},
|
|
"56557cde-d923-4b88-adee-c61b3f3b5dc3": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Windows CryptoAPI Spoofing Vulnerability (CVE-2020-0601 - CurveBall)",
|
|
"sha256": "602c658a04190e27d27abced9d3265d8025a5a5173c8381cdaf432a69eef80ff",
|
|
"type": "query",
|
|
"version": 103
|
|
},
|
|
"565c2b44-7a21-4818-955f-8d4737967d2e": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Admin Group Account Addition",
|
|
"sha256": "8bc8501a6ddd8f64743ca0b9449b6827723b051c90177dc1d95977ec71d638f3",
|
|
"type": "query",
|
|
"version": 105
|
|
},
|
|
"565d6ca5-75ba-4c82-9b13-add25353471c": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Dumping of Keychain Content via Security Command",
|
|
"sha256": "b61fe6deed081a783eadb490bf3de817c38a34b3369fb4393f17e1e058370e7d",
|
|
"type": "eql",
|
|
"version": 106
|
|
},
|
|
"5663b693-0dea-4f2e-8275-f1ae5ff2de8e": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "GCP Logging Bucket Deletion",
|
|
"sha256": "080210ccfb075c63c43cbbdd386dcf8857830563eb3757d61841656cf2099d2a",
|
|
"type": "query",
|
|
"version": 104
|
|
},
|
|
"56f2e9b5-4803-4e44-a0a4-a52dc79d57fe": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "PowerShell PSReflect Script",
|
|
"sha256": "b61f13daa6709718b5efc18e44952a5b335d296a74a6958432dbc67304d4c731",
|
|
"type": "query",
|
|
"version": 109
|
|
},
|
|
"56fdfcf1-ca7c-4fd9-951d-e215ee26e404": {
|
|
"min_stack_version": "8.6",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 101,
|
|
"rule_name": "Execution of an Unsigned Service",
|
|
"sha256": "d6a1937f8097432a0d45cff0e4c52746877e8dfc576edec64a5e6235c80ca1bc",
|
|
"type": "eql",
|
|
"version": 2
|
|
}
|
|
},
|
|
"rule_name": "Execution of an Unsigned Service",
|
|
"sha256": "296152e8a3e1843df21e40fa6f6a05608b99b61ab06971ab80e9a3a35910b4fb",
|
|
"type": "new_terms",
|
|
"version": 103
|
|
},
|
|
"5700cb81-df44-46aa-a5d7-337798f53eb8": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "VNC (Virtual Network Computing) from the Internet",
|
|
"sha256": "08484b01efb6cd6e700e6ac39d1766a24491ac8d9aee3de5719c03ee0e204a06",
|
|
"type": "query",
|
|
"version": 104
|
|
},
|
|
"571afc56-5ed9-465d-a2a9-045f099f6e7e": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Credential Dumping - Detected - Elastic Endgame",
|
|
"sha256": "dd1d2bea2a77074d95a5cb954bac84a5931dfa69391613cb54de8fd114d134cd",
|
|
"type": "query",
|
|
"version": 101
|
|
},
|
|
"573f6e7a-7acf-4bcd-ad42-c4969124d3c0": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Azure Virtual Network Device Modified or Deleted",
|
|
"sha256": "fe8f8cc7acb845230d488c2148d4c27351978ae3582a05be60a1d7373afa9762",
|
|
"type": "query",
|
|
"version": 102
|
|
},
|
|
"577ec21e-56fe-4065-91d8-45eb8224fe77": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "PowerShell MiniDump Script",
|
|
"sha256": "35dd040100009d246bc9f9a4dceafd8567877a83869db407986601d55633e369",
|
|
"type": "query",
|
|
"version": 107
|
|
},
|
|
"57bccf1d-daf5-4e1a-9049-ff79b5254704": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "File Staged in Root Folder of Recycle Bin",
|
|
"sha256": "88ae25fb6df6c66c976902e4f17c39a5af63c217bb4aa298e7f898b003fa484d",
|
|
"type": "eql",
|
|
"version": 2
|
|
},
|
|
"581add16-df76-42bb-af8e-c979bfb39a59": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Deleting Backup Catalogs with Wbadmin",
|
|
"sha256": "1f51a18c5b7294c2940d6c10a4cf3140689a2b6d361f967a6a5b091240ad4a7d",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"58aa72ca-d968-4f34-b9f7-bea51d75eb50": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "RDP Enabled via Registry",
|
|
"sha256": "ce293530acf459b922e5fc59532707e9f1aa5a0c2d302c835cc83e427a9937af",
|
|
"type": "eql",
|
|
"version": 109
|
|
},
|
|
"58ac2aa5-6718-427c-a845-5f3ac5af00ba": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Zoom Meeting with no Passcode",
|
|
"sha256": "bdc5d37d933591a9e749303f4d0da889d2fd76c0cc51bec4152b74f1518bd85e",
|
|
"type": "query",
|
|
"version": 102
|
|
},
|
|
"58bc134c-e8d2-4291-a552-b4b3e537c60b": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Lateral Tool Transfer via SMB Share",
|
|
"sha256": "a9ada00d22041e1fc97021dfb923cb62dfcafe5849324b04534f7c53a65903d4",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"58c6d58b-a0d3-412d-b3b8-0981a9400607": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Privilege Escalation via InstallerFileTakeOver",
|
|
"sha256": "304917eeb1af9702d87f54af173823bfcc8f3c5dd3212076b77290bce0667d28",
|
|
"type": "eql",
|
|
"version": 109
|
|
},
|
|
"5919988c-29e1-4908-83aa-1f087a838f63": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "File or Directory Deletion Command",
|
|
"sha256": "f9ebc148c3faecff5518d839295aa1dbefa51d7ba038dc12a382d2c27dff3458",
|
|
"type": "eql",
|
|
"version": 2
|
|
},
|
|
"5930658c-2107-4afc-91af-e0e55b7f7184": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "O365 Email Reported by User as Malware or Phish",
|
|
"sha256": "6f1117902fd841998a715673511a3831fe99e7a953113854fd094e8aaf57d935",
|
|
"type": "query",
|
|
"version": 102
|
|
},
|
|
"594e0cbf-86cc-45aa-9ff7-ff27db27d3ed": {
|
|
"min_stack_version": "8.9",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 205,
|
|
"rule_name": "AWS CloudTrail Log Created",
|
|
"sha256": "0ebf115d87113f0fb8cfb856cf09dd40a7bc00703443d8f5dc149be5cf2d7a26",
|
|
"type": "query",
|
|
"version": 106
|
|
}
|
|
},
|
|
"rule_name": "AWS CloudTrail Log Created",
|
|
"sha256": "84221ea6d1d7084ea241331b852a80ca276abc757430ea68253a3add4daca7a4",
|
|
"type": "query",
|
|
"version": 206
|
|
},
|
|
"59756272-1998-4b8c-be14-e287035c4d10": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Unusual Linux User Discovery Activity",
|
|
"sha256": "f22f060fba5f9de2376d38ce5ced5885370cdee60ce06026422199c3d3636225",
|
|
"type": "machine_learning",
|
|
"version": 104
|
|
},
|
|
"5a14d01d-7ac8-4545-914c-b687c2cf66b3": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "UAC Bypass Attempt via Privileged IFileOperation COM Interface",
|
|
"sha256": "124e2a2505d5c7c0a21c7253177b086db714b6d1ae3ba8ea59bbf20adf715237",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"5a3d5447-31c9-409a-aed1-72f9921594fd": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Reverse Shell via Java",
|
|
"sha256": "101fe62af1dde7632ea69d604f837f167ce9c392ec275f41f97edbf9d32bb888",
|
|
"type": "eql",
|
|
"version": 6
|
|
},
|
|
"5ae4e6f8-d1bf-40fa-96ba-e29645e1e4dc": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Remote SSH Login Enabled via systemsetup Command",
|
|
"sha256": "0468696a45e242d7e3e71b093c8c41a2a2e0318d204b64572529c03774829201",
|
|
"type": "query",
|
|
"version": 105
|
|
},
|
|
"5aee924b-6ceb-4633-980e-1bde8cdb40c5": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Secure File Deletion via SDelete Utility",
|
|
"sha256": "b57b1fa14361058e949c21cc407ad8e502c41b901b2f7b5a575ffb1d9fb460bd",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"5b03c9fb-9945-4d2f-9568-fd690fee3fba": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Virtual Machine Fingerprinting",
|
|
"sha256": "7fa5c6ec0c42f301e37556a06ef4523f6ce815cae9e248f5928dbf04495f7c47",
|
|
"type": "query",
|
|
"version": 107
|
|
},
|
|
"5b06a27f-ad72-4499-91db-0c69667bffa5": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "SUID/SGUID Enumeration Detected",
|
|
"sha256": "41cd9d8a7f6fb679feae8b8bfb68140693c08e8c276e33b6eeb919788312d60a",
|
|
"type": "eql",
|
|
"version": 4
|
|
},
|
|
"5b18eef4-842c-4b47-970f-f08d24004bde": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Suspicious which Enumeration",
|
|
"sha256": "7d7caddbf4b4d96f05ac6949cb45758377a5e3bf4b700ccf482055409ec6f2c2",
|
|
"type": "eql",
|
|
"version": 3
|
|
},
|
|
"5b9eb30f-87d6-45f4-9289-2bf2024f0376": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Masquerading as Browser Process",
|
|
"sha256": "10846cbf0f6d148b7fc84a14a62f5bc1b44382eda5971d84a0747c8788c93721",
|
|
"type": "eql",
|
|
"version": 2
|
|
},
|
|
"5bb4a95d-5a08-48eb-80db-4c3a63ec78a8": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Suspicious PrintSpooler Service Executable File Creation",
|
|
"sha256": "4ef5a001820e5135ffd557947919a55c875cd3a75ed5f351507a7f3c9e06c77b",
|
|
"type": "eql",
|
|
"version": 105
|
|
},
|
|
"5beaebc1-cc13-4bfc-9949-776f9e0dc318": {
|
|
"min_stack_version": "8.9",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 204,
|
|
"rule_name": "AWS WAF Rule or Rule Group Deletion",
|
|
"sha256": "353bb55da009500a46a3701adb0b1bb680c718959d2e5969960085c211562f98",
|
|
"type": "query",
|
|
"version": 105
|
|
}
|
|
},
|
|
"rule_name": "AWS WAF Rule or Rule Group Deletion",
|
|
"sha256": "333f27913815c1e4ec223cb266bc34cfadb31ac1a598d1fac7a8de01ac3abd9b",
|
|
"type": "query",
|
|
"version": 205
|
|
},
|
|
"5c6f4c58-b381-452a-8976-f1b1c6aa0def": {
|
|
"min_stack_version": "8.4",
|
|
"rule_name": "FirstTime Seen Account Performing DCSync",
|
|
"sha256": "6d5bf9fe5d4e6cc423f1a2c017576e9714f20baf6d4fa80d1bdf31e37e1e7267",
|
|
"type": "new_terms",
|
|
"version": 8
|
|
},
|
|
"5c81fc9d-1eae-437f-ba07-268472967013": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Segfault Detected",
|
|
"sha256": "67588b53b3aa8fcb88b35baa601ae2d44b31ffc590864787f6a46c72bc5b4dc8",
|
|
"type": "query",
|
|
"version": 1
|
|
},
|
|
"5c895b4f-9133-4e68-9e23-59902175355c": {
|
|
"min_stack_version": "8.6",
|
|
"rule_name": "Potential Meterpreter Reverse Shell",
|
|
"sha256": "9a1e8c65a29391713f609dcbd4a1305713e9a2c306af2f32b6a83dfce192b63b",
|
|
"type": "eql",
|
|
"version": 4
|
|
},
|
|
"5c983105-4681-46c3-9890-0c66d05e776b": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Unusual Linux Process Discovery Activity",
|
|
"sha256": "e67ff82fd38ab4af435c7cd93dee29535aac33d0dca591dada0c896337e58380",
|
|
"type": "machine_learning",
|
|
"version": 103
|
|
},
|
|
"5c9ec990-37fa-4d5c-abfc-8d432f3dedd0": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Defense Evasion via PRoot",
|
|
"sha256": "178b04d6fc23202ec48ba3400969daf969f8d4985439414241705f5d43766ae0",
|
|
"type": "eql",
|
|
"version": 5
|
|
},
|
|
"5cd55388-a19c-47c7-8ec4-f41656c2fded": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Outbound Scheduled Task Activity via PowerShell",
|
|
"sha256": "c0fd1feebe4607a5b3db25454a63e6c46b64c43070cd6c6487fac57bfd65b53c",
|
|
"type": "eql",
|
|
"version": 105
|
|
},
|
|
"5cd8e1f7-0050-4afc-b2df-904e40b2f5ae": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "User Added to Privileged Group",
|
|
"sha256": "7884adba746a934e4698623cb4c2553c24162fb3cb42176f7939bd3b0abb7ea5",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"5cf6397e-eb91-4f31-8951-9f0eaa755a31": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Persistence via PowerShell profile",
|
|
"sha256": "bcad25e05d53aa35c64eed0d265c87d015b8da21345be33534265a037330e687",
|
|
"type": "eql",
|
|
"version": 7
|
|
},
|
|
"5d0265bf-dea9-41a9-92ad-48a8dcd05080": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Persistence via Login or Logout Hook",
|
|
"sha256": "4b664dd5877d1ea41aa62988945b0551c37d895fe86546e544ee732f93985f78",
|
|
"type": "eql",
|
|
"version": 106
|
|
},
|
|
"5d1d6907-0747-4d5d-9b24-e4a18853dc0a": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Suspicious Execution via Scheduled Task",
|
|
"sha256": "ee93ccc7c656e52fd7841c8332e970ea5217ce16621e6044e8fe23e5c775ca70",
|
|
"type": "eql",
|
|
"version": 106
|
|
},
|
|
"5d9f8cfc-0d03-443e-a167-2b0597ce0965": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Suspicious Automator Workflows Execution",
|
|
"sha256": "2f1b66054ac5bbc100d284a9f0ceda0c965b47881c9787c1945b8e466f298324",
|
|
"type": "eql",
|
|
"version": 105
|
|
},
|
|
"5e161522-2545-11ed-ac47-f661ea17fbce": {
|
|
"min_stack_version": "8.4",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 103,
|
|
"rule_name": "Google Workspace 2SV Policy Disabled",
|
|
"sha256": "ddbea6e8e6fead49ee6b7eb17b83de0996fdabfef882164c7f04a134f1438293",
|
|
"type": "query",
|
|
"version": 5
|
|
}
|
|
},
|
|
"rule_name": "Google Workspace 2SV Policy Disabled",
|
|
"sha256": "90ed7cc03c1d2f50cb22cde81cefe5234690d44b19be19c4b0029735fa3e4f3a",
|
|
"type": "query",
|
|
"version": 106
|
|
},
|
|
"5e552599-ddec-4e14-bad1-28aa42404388": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Microsoft 365 Teams Guest Access Enabled",
|
|
"sha256": "4e4a262b9c4e5ab8a6ad524df85e1f6b13bdcae8c45ccea1db5bb31e2acd028f",
|
|
"type": "query",
|
|
"version": 102
|
|
},
|
|
"5e87f165-45c2-4b80-bfa5-52822552c997": {
|
|
"rule_name": "Potential PrintNightmare File Modification",
|
|
"sha256": "cce3c92801296f877a7b98b1d40e5eb47cc9843149d203377272809894e0c933",
|
|
"type": "eql",
|
|
"version": 100
|
|
},
|
|
"60884af6-f553-4a6c-af13-300047455491": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Azure Command Execution on Virtual Machine",
|
|
"sha256": "7e3e549fc0541f65e9d0ee9df09e5453f76574a9d8b90a03c5b8f905ebe6ce12",
|
|
"type": "query",
|
|
"version": 102
|
|
},
|
|
"60b6b72f-0fbc-47e7-9895-9ba7627a8b50": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Azure Service Principal Addition",
|
|
"sha256": "786b2ddb2ad2584581e0eeea78d24c23a5647d0a32680f1fa9625b6c06ebbda2",
|
|
"type": "query",
|
|
"version": 105
|
|
},
|
|
"60f3adec-1df9-4104-9c75-b97d9f078b25": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Microsoft 365 Exchange DLP Policy Removed",
|
|
"sha256": "0886a8d4f32a069d4f64c2559bfc5d527f4a2d24045aab00ae97f1de9ad9efb7",
|
|
"type": "query",
|
|
"version": 102
|
|
},
|
|
"610949a1-312f-4e04-bb55-3a79b8c95267": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Unusual Process Network Connection",
|
|
"sha256": "fd5996be6b2f46fc713908920b4d06537ad841086cb3b09c6c3e163cab734e9a",
|
|
"type": "eql",
|
|
"version": 106
|
|
},
|
|
"61766ef9-48a5-4247-ad74-3349de7eb2ad": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Interactive Logon by an Unusual Process",
|
|
"sha256": "57a629aaa1c6c8e3211d86871c40fb1532a1b8041321a4a49e09bf2207ddd1d7",
|
|
"type": "eql",
|
|
"version": 1
|
|
},
|
|
"61ac3638-40a3-44b2-855a-985636ca985e": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "PowerShell Suspicious Discovery Related Windows API Functions",
|
|
"sha256": "a2efc8419825dff241841f4cd67f7a4249150821200aa74a49a973b274ba1b66",
|
|
"type": "query",
|
|
"version": 111
|
|
},
|
|
"61c31c14-507f-4627-8c31-072556b89a9c": {
|
|
"rule_name": "Mknod Process Activity",
|
|
"sha256": "9070708b87661e05dc8b0275151d9c928fbf29feacc6b771a10e56eea2ff82ea",
|
|
"type": "query",
|
|
"version": 100
|
|
},
|
|
"61d29caf-6c15-4d1e-9ccb-7ad12ccc0bc7": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "AdminSDHolder SDProp Exclusion Added",
|
|
"sha256": "0c65d784e165a4fcbc42ac4338574c946caae6bd23afccceeb079c4f7346a467",
|
|
"type": "eql",
|
|
"version": 109
|
|
},
|
|
"621e92b6-7e54-11ee-bdc0-f661ea17fbcd": {
|
|
"min_stack_version": "8.10",
|
|
"rule_name": "Multiple Okta Sessions Detected for a Single User",
|
|
"sha256": "061bd86219770d199904efabae4bb62bbc5897cdef6b8d1e517cae8670d3398e",
|
|
"type": "threshold",
|
|
"version": 1
|
|
},
|
|
"622ecb68-fa81-4601-90b5-f8cd661e4520": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Incoming DCOM Lateral Movement via MSHTA",
|
|
"sha256": "c34b60cbe2278701b99e658f035d05af7f68558251b332622334022f982c367c",
|
|
"type": "eql",
|
|
"version": 105
|
|
},
|
|
"62a70f6f-3c37-43df-a556-f64fa475fba2": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Account Configured with Never-Expiring Password",
|
|
"sha256": "bff6971b2108d22178fe7e1ba59610ea438646b4c81a203c7c85e90f0b42b640",
|
|
"type": "query",
|
|
"version": 108
|
|
},
|
|
"62b68eb2-1e47-4da7-85b6-8f478db5b272": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Non-Standard Port HTTP/HTTPS connection",
|
|
"sha256": "89ccb4bcf9974d7efeab3cd8f2c79c351f07bbe779369d826e8946ee6ef084fb",
|
|
"type": "eql",
|
|
"version": 3
|
|
},
|
|
"63c05204-339a-11ed-a261-0242ac120002": {
|
|
"min_stack_version": "8.4",
|
|
"rule_name": "Kubernetes Suspicious Assignment of Controller Service Account",
|
|
"sha256": "c3c4f5b5422708679b68f0f2fd71e860e9abfdc466e25b9cd35498d8a45cbdab",
|
|
"type": "query",
|
|
"version": 6
|
|
},
|
|
"63c056a0-339a-11ed-a261-0242ac120002": {
|
|
"min_stack_version": "8.4",
|
|
"rule_name": "Kubernetes Denied Service Account Request",
|
|
"sha256": "c04f7a46cbbd448139cfef70f2eaf9331faae7a4a1ab9a4a721463034e513e86",
|
|
"type": "query",
|
|
"version": 5
|
|
},
|
|
"63c057cc-339a-11ed-a261-0242ac120002": {
|
|
"min_stack_version": "8.4",
|
|
"rule_name": "Kubernetes Anonymous Request Authorized",
|
|
"sha256": "124c7243234a6880e622f6d2f811edd502e2406e6c96ad7066a7306794ced4fd",
|
|
"type": "query",
|
|
"version": 6
|
|
},
|
|
"63e65ec3-43b1-45b0-8f2d-45b34291dc44": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Network Connection via Signed Binary",
|
|
"sha256": "e3f5d9f1f0b68b258714156bb2d6558011e846b2fad3ad178aae26c7c0f6c81e",
|
|
"type": "eql",
|
|
"version": 106
|
|
},
|
|
"647fc812-7996-4795-8869-9c4ea595fe88": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Anomalous Process For a Linux Population",
|
|
"sha256": "83b053309247f90ea7bda7f3c8e474257fe61dec3fc68d387888dc2da6ccf096",
|
|
"type": "machine_learning",
|
|
"version": 104
|
|
},
|
|
"6482255d-f468-45ea-a5b3-d3a7de1331ae": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Modification of Safari Settings via Defaults Command",
|
|
"sha256": "df8fdd419ba042425bba4c2b32c414ac9dc05e1980edd08bc04fc4e8d18ead19",
|
|
"type": "query",
|
|
"version": 105
|
|
},
|
|
"64cfca9e-0f6f-4048-8251-9ec56a055e9e": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Network Connection via Recently Compiled Executable",
|
|
"sha256": "b50544cddecd269cc3a27814bdb19f3f1683fd8dcb3d2967588b2d38e487eb96",
|
|
"type": "eql",
|
|
"version": 3
|
|
},
|
|
"6506c9fd-229e-4722-8f0f-69be759afd2a": {
|
|
"rule_name": "Potential PrintNightmare Exploit Registry Modification",
|
|
"sha256": "2835937a732bcb071b232eba9fe5f11b5f7ea8c7742eec0640d79cca3fcea621",
|
|
"type": "eql",
|
|
"version": 100
|
|
},
|
|
"65f9bccd-510b-40df-8263-334f03174fed": {
|
|
"min_stack_version": "8.4",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 199,
|
|
"rule_name": "Kubernetes Exposed Service Created With Type NodePort",
|
|
"sha256": "c6cf6184bd1e4f3add0ac786022ed97b13163f8ef7278c905b94bcea8447509f",
|
|
"type": "query",
|
|
"version": 101
|
|
}
|
|
},
|
|
"rule_name": "Kubernetes Exposed Service Created With Type NodePort",
|
|
"sha256": "06a18e9f45ffe718b0156f37a7f5dc289078a2410a0e6ecb968b500a0e55378e",
|
|
"type": "query",
|
|
"version": 203
|
|
},
|
|
"661545b4-1a90-4f45-85ce-2ebd7c6a15d0": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Attempt to Mount SMB Share via Command Line",
|
|
"sha256": "d6221b6ee2915a7b34ad8447f034179710da43b944bec0968235b097e3823ad1",
|
|
"type": "eql",
|
|
"version": 106
|
|
},
|
|
"6641a5af-fb7e-487a-adc4-9e6503365318": {
|
|
"min_stack_version": "8.5",
|
|
"rule_name": "Suspicious Termination of ESXI Process",
|
|
"sha256": "0e3ded27dacf0a1e45129b4113f2ffeeff96888a708939d266d839584ea1431c",
|
|
"type": "eql",
|
|
"version": 5
|
|
},
|
|
"665e7a4f-c58e-4fc6-bc83-87a7572670ac": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "WebServer Access Logs Deleted",
|
|
"sha256": "03195d08eb16678c89d37803e31e7a409256687ff2402dfe25c3d36759a3ee10",
|
|
"type": "eql",
|
|
"version": 104
|
|
},
|
|
"66712812-e7f2-4a1d-bbda-dd0b5cf20c5d": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Successful Linux FTP Brute Force Attack Detected",
|
|
"sha256": "846fa5c4e35ad6a575c527857f8f08531770497ebfbd1e5c44038c9711e941fe",
|
|
"type": "eql",
|
|
"version": 5
|
|
},
|
|
"66883649-f908-4a5b-a1e0-54090a1d3a32": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Connection to Commonly Abused Web Services",
|
|
"sha256": "7745782aa933ea91dbfdffeaa535df98d4ba5d6b908c75cabba52d20958e79d4",
|
|
"type": "eql",
|
|
"version": 110
|
|
},
|
|
"66c058f3-99f4-4d18-952b-43348f2577a0": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Linux Secret Dumping via GDB",
|
|
"sha256": "69b91af7c13fbc10668c950da9d070e9350d6f40ae5115d828703884de988e06",
|
|
"type": "eql",
|
|
"version": 1
|
|
},
|
|
"66da12b1-ac83-40eb-814c-07ed1d82b7b9": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Suspicious macOS MS Office Child Process",
|
|
"sha256": "de9510393c24ff3e139c05854ab2ae53078fd1a040209a8d32e2a781b4429df5",
|
|
"type": "eql",
|
|
"version": 105
|
|
},
|
|
"670b3b5a-35e5-42db-bd36-6c5b9b4b7313": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Modification of the msPKIAccountCredentials",
|
|
"sha256": "971d5caa27171542c27406ef2aee1d385c7010cdc026d2ef226d4ea1346ffac4",
|
|
"type": "query",
|
|
"version": 8
|
|
},
|
|
"6731fbf2-8f28-49ed-9ab9-9a918ceb5a45": {
|
|
"min_stack_version": "8.10",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 205,
|
|
"rule_name": "Attempt to Modify an Okta Policy",
|
|
"sha256": "bcc00051e5ab5b70c88a4b1559e4edcff319d79f2bbe5bfcab404a3d63457d63",
|
|
"type": "query",
|
|
"version": 106
|
|
}
|
|
},
|
|
"rule_name": "Attempt to Modify an Okta Policy",
|
|
"sha256": "0f0e1ba88bbda85d60bb8fc96bda554db238881ea16937d0f0fa5414a15e6ede",
|
|
"type": "query",
|
|
"version": 206
|
|
},
|
|
"675239ea-c1bc-4467-a6d3-b9e2cc7f676d": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "O365 Mailbox Audit Logging Bypass",
|
|
"sha256": "cac04714049b7a004fe00585d8cc3e351f442896feb07e367f5e3406853f595d",
|
|
"type": "query",
|
|
"version": 102
|
|
},
|
|
"676cff2b-450b-4cf1-8ed2-c0c58a4a2dd7": {
|
|
"min_stack_version": "8.10",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 205,
|
|
"rule_name": "Attempt to Revoke Okta API Token",
|
|
"sha256": "f58a59fe0d9f317a1998e97634f691d5f4b4b0dc6b79fc874df5f7b9185a9f93",
|
|
"type": "query",
|
|
"version": 106
|
|
}
|
|
},
|
|
"rule_name": "Attempt to Revoke Okta API Token",
|
|
"sha256": "e8e7b2e174c70d5a4a851a47b90138516f2a3c440e275c037a6f1334759c87de",
|
|
"type": "query",
|
|
"version": 206
|
|
},
|
|
"67a9beba-830d-4035-bfe8-40b7e28f8ac4": {
|
|
"rule_name": "SMTP to the Internet",
|
|
"sha256": "38ddd772b9bc49726619cf527ed48d8871a0611ca88d76d03054c6702456d14d",
|
|
"type": "query",
|
|
"version": 100
|
|
},
|
|
"67f8443a-4ff3-4a70-916d-3cfa3ae9f02b": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "High Number of Process Terminations",
|
|
"sha256": "588f2aa6d820fea6e191906cb8791cee0b8a293222a681b6cc4ff1c3ff8f8ff6",
|
|
"type": "threshold",
|
|
"version": 110
|
|
},
|
|
"68113fdc-3105-4cdd-85bb-e643c416ef0b": {
|
|
"rule_name": "Query Registry via reg.exe",
|
|
"sha256": "5752b998b95537fedce81850330b693ee3cb9f030b36bf07dba1da9107bd68d9",
|
|
"type": "eql",
|
|
"version": 100
|
|
},
|
|
"6839c821-011d-43bd-bd5b-acff00257226": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Image File Execution Options Injection",
|
|
"sha256": "ad88e3a9101259f72a383196f9f474fb828e8dd2b844ef2d61caf9fb986c1028",
|
|
"type": "eql",
|
|
"version": 105
|
|
},
|
|
"684554fc-0777-47ce-8c9b-3d01f198d7f8": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "New or Modified Federation Domain",
|
|
"sha256": "c12b7d94ddd9ac7a54891cd86831775b8622d2c0681fcaf612e2842bed646cf6",
|
|
"type": "query",
|
|
"version": 102
|
|
},
|
|
"6885d2ae-e008-4762-b98a-e8e1cd3a81e9": {
|
|
"min_stack_version": "8.10",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 204,
|
|
"rule_name": "Okta ThreatInsight Threat Suspected Promotion",
|
|
"sha256": "44208f997fe40e0ec5625789243073bee7f66e3d2be2ed117e69e6f9b6907a21",
|
|
"type": "query",
|
|
"version": 105
|
|
}
|
|
},
|
|
"rule_name": "Okta ThreatInsight Threat Suspected Promotion",
|
|
"sha256": "8d04de56ef8b8f97264ebf4f9614963e43b9106d543823fdccbce9b59a0011d8",
|
|
"type": "query",
|
|
"version": 205
|
|
},
|
|
"68921d85-d0dc-48b3-865f-43291ca2c4f2": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Persistence via TelemetryController Scheduled Task Hijack",
|
|
"sha256": "cc263ea8f46aac31f4c4fc112a7dcd7ff453c89fa45066ec2569deff91b85ef5",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"68994a6c-c7ba-4e82-b476-26a26877adf6": {
|
|
"min_stack_version": "8.4",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 203,
|
|
"rule_name": "Google Workspace Admin Role Assigned to a User",
|
|
"sha256": "a8a7d4e956c4cd2733f3d5e26871a367b937a0944420b3eaaca82370b8246a55",
|
|
"type": "query",
|
|
"version": 105
|
|
}
|
|
},
|
|
"rule_name": "Google Workspace Admin Role Assigned to a User",
|
|
"sha256": "6efdcc0936767be2538639bc2b7dfc028b4f7d02b590bbfac757314fcec9ce2a",
|
|
"type": "query",
|
|
"version": 206
|
|
},
|
|
"689b9d57-e4d5-4357-ad17-9c334609d79a": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Scheduled Task Created by a Windows Script",
|
|
"sha256": "ebde0ba43ed054967c01f489cd5f2e45b9dddf79b90351dea7e78c5a5c2edfe6",
|
|
"type": "eql",
|
|
"version": 105
|
|
},
|
|
"68a7a5a5-a2fc-4a76-ba9f-26849de881b4": {
|
|
"min_stack_version": "8.9",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 207,
|
|
"rule_name": "AWS CloudWatch Log Group Deletion",
|
|
"sha256": "2e8fdc6b595399328a680fc066469a0edae5a41684f4190a837deaa8adf32ae4",
|
|
"type": "query",
|
|
"version": 108
|
|
}
|
|
},
|
|
"rule_name": "AWS CloudWatch Log Group Deletion",
|
|
"sha256": "6c4325ced0b53d29535ee5afd746cd09fd120823f660b5bd3518ca50fadca146",
|
|
"type": "query",
|
|
"version": 208
|
|
},
|
|
"68d56fdc-7ffa-4419-8e95-81641bd6f845": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "UAC Bypass via ICMLuaUtil Elevated COM Interface",
|
|
"sha256": "cb8466c3025fb4f8c5556eb62e311c02c11b56950756e170960f6bb8c9684090",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"6951f15e-533c-4a60-8014-a3c3ab851a1b": {
|
|
"min_stack_version": "8.9",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 104,
|
|
"rule_name": "AWS KMS Customer Managed Key Disabled or Scheduled for Deletion",
|
|
"sha256": "1bcb655a06d0561e1f4f6e9466d148178ddf1edc310aa5b738f246db479c1afd",
|
|
"type": "query",
|
|
"version": 5
|
|
}
|
|
},
|
|
"rule_name": "AWS KMS Customer Managed Key Disabled or Scheduled for Deletion",
|
|
"sha256": "62a819dfff5aff4d9a71c1af4dbee137aa6d96683a906088769effac0fdbd8b1",
|
|
"type": "query",
|
|
"version": 105
|
|
},
|
|
"699e9fdb-b77c-4c01-995c-1c15019b9c43": {
|
|
"min_stack_version": "8.5",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 203,
|
|
"rule_name": "Threat Intel Filebeat Module (v8.x) Indicator Match",
|
|
"sha256": "f2d4dda1642f078dcb77b698976c25ba557553c259a493e3a18224bfbbf36a96",
|
|
"type": "threat_match",
|
|
"version": 104
|
|
}
|
|
},
|
|
"rule_name": "Deprecated - Threat Intel Filebeat Module (v8.x) Indicator Match",
|
|
"sha256": "323f4b02dcebb3ae76b6d959c325eb0da4b02ab1cf6d98b0437795dbcdd6eb85",
|
|
"type": "threat_match",
|
|
"version": 204
|
|
},
|
|
"69c251fb-a5d6-4035-b5ec-40438bd829ff": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Modification of Boot Configuration",
|
|
"sha256": "a66226c5678227263920328ccc24dfca32a0620f02290922dff137101e01a7df",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"69c420e8-6c9e-4d28-86c0-8a2be2d1e78c": {
|
|
"min_stack_version": "8.9",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 204,
|
|
"rule_name": "AWS IAM Password Recovery Requested",
|
|
"sha256": "d16a1105cf83086a436f452d32fd1564076c4a7425498c922ca33cdcd2246c17",
|
|
"type": "query",
|
|
"version": 105
|
|
}
|
|
},
|
|
"rule_name": "AWS IAM Password Recovery Requested",
|
|
"sha256": "31f084b4192870ca6c93d341a1f9e6d9eecaaefe046fcf6687209ec23866edf3",
|
|
"type": "query",
|
|
"version": 205
|
|
},
|
|
"6a8ab9cc-4023-4d17-b5df-1a3e16882ce7": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Unusual Service Host Child Process - Childless Service",
|
|
"sha256": "79a34adf5b2d2e77e4b9db0d019c6af379cfa51e10a016385e4127e496667530",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"6aace640-e631-4870-ba8e-5fdda09325db": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Exporting Exchange Mailbox via PowerShell",
|
|
"sha256": "482861108067248f10161a39651726c2df97b6d2e8b7c5952cded1053b172ac9",
|
|
"type": "eql",
|
|
"version": 109
|
|
},
|
|
"6ace94ba-f02c-4d55-9f53-87d99b6f9af4": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Suspicious Utility Launched via ProxyChains",
|
|
"sha256": "fd2f406746a1331d05c1e2bf2940f233dfaaa7ab24732e3e56902a388363e65f",
|
|
"type": "eql",
|
|
"version": 4
|
|
},
|
|
"6b84d470-9036-4cc0-a27c-6d90bbfe81ab": {
|
|
"min_stack_version": "8.6",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 205,
|
|
"rule_name": "Sensitive Files Compression",
|
|
"sha256": "271c0de47099ee8a5e049d68bf4d49801b884b81f673df03edceab970daebe19",
|
|
"type": "query",
|
|
"version": 106
|
|
}
|
|
},
|
|
"rule_name": "Sensitive Files Compression",
|
|
"sha256": "f67a0194e92a6a62746f2344bc677d6a37e9b34cbd8ea2bc5bf99dc15e4050d5",
|
|
"type": "new_terms",
|
|
"version": 207
|
|
},
|
|
"6bed021a-0afb-461c-acbe-ffdb9574d3f3": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Remote Computer Account DnsHostName Update",
|
|
"sha256": "4a3308713c74898d9a52d894105c3a41556786008f169b725436c4dbc018ee99",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"6c6bb7ea-0636-44ca-b541-201478ef6b50": {
|
|
"min_stack_version": "8.8",
|
|
"rule_name": "Container Management Utility Run Inside A Container",
|
|
"sha256": "34ba8d894c34042f9a4c326daee9871fc209a1e209058b9f6a0f8ad30eeec04d",
|
|
"type": "eql",
|
|
"version": 2
|
|
},
|
|
"6cd1779c-560f-4b68-a8f1-11009b27fe63": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Microsoft Exchange Server UM Writing Suspicious Files",
|
|
"sha256": "fe55558d2f4c218f2fdfdca871cbaff991aabeb33b6622a44fdefd4d8ae81963",
|
|
"type": "eql",
|
|
"version": 106
|
|
},
|
|
"6d448b96-c922-4adb-b51c-b767f1ea5b76": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Unusual Process For a Windows Host",
|
|
"sha256": "f65a12afc06498c72c6fe35834ef48f2c6cee057748963b300cae83e7a411f78",
|
|
"type": "machine_learning",
|
|
"version": 107
|
|
},
|
|
"6d8685a1-94fa-4ef7-83de-59302e7c4ca8": {
|
|
"min_stack_version": "8.6",
|
|
"rule_name": "Potential Privilege Escalation via CVE-2023-4911",
|
|
"sha256": "d76c1108876f14e891d2625826f200b3eb225ace76c842c366b24949e9c28f73",
|
|
"type": "eql",
|
|
"version": 3
|
|
},
|
|
"6e1a2cc4-d260-11ed-8829-f661ea17fbcc": {
|
|
"min_stack_version": "8.4",
|
|
"rule_name": "First Time Seen Commonly Abused Remote Access Tool Execution",
|
|
"sha256": "ef918ece14946f78978846c902ca1e8891e295cc7065c895ba6e7e5b0d9f59b9",
|
|
"type": "new_terms",
|
|
"version": 4
|
|
},
|
|
"6e40d56f-5c0e-4ac6-aece-bee96645b172": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Anomalous Process For a Windows Population",
|
|
"sha256": "797cf8fc982536b11a0679348b4eca584db853de77646320ff0c146465196bcd",
|
|
"type": "machine_learning",
|
|
"version": 105
|
|
},
|
|
"6e9130a5-9be6-48e5-943a-9628bfc74b18": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "AdminSDHolder Backdoor",
|
|
"sha256": "53f33d98ecca40d46328a7ff7593743ac0f62aefad6854a203355d59f240ece1",
|
|
"type": "query",
|
|
"version": 106
|
|
},
|
|
"6e9b351e-a531-4bdc-b73e-7034d6eed7ff": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Enumeration of Users or Groups via Built-in Commands",
|
|
"sha256": "470df0c6e17a6b76b3d5dfe11b58055120699d9a00c0cfbb61259400adbc757a",
|
|
"type": "eql",
|
|
"version": 106
|
|
},
|
|
"6ea41894-66c3-4df7-ad6b-2c5074eb3df8": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Windows Error Manager Masquerading",
|
|
"sha256": "bd57722ccc74983106255532898917957a55fafd6c760af95a0650a7a93e5ef4",
|
|
"type": "eql",
|
|
"version": 106
|
|
},
|
|
"6ea55c81-e2ba-42f2-a134-bccf857ba922": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Security Software Discovery using WMIC",
|
|
"sha256": "f6dfe76cfea61ba2324b275dcd960ad3daed43c02c2cddc708af6ef3f3937ae8",
|
|
"type": "eql",
|
|
"version": 109
|
|
},
|
|
"6ea71ff0-9e95-475b-9506-2580d1ce6154": {
|
|
"rule_name": "DNS Activity to the Internet",
|
|
"sha256": "2b8ee3ad95436f33ac0289f2bbc2af3b6582974ac3f7eeb4c557d00df664f622",
|
|
"type": "query",
|
|
"version": 100
|
|
},
|
|
"6ee947e9-de7e-4281-a55d-09289bdf947e": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Linux Tunneling and/or Port Forwarding",
|
|
"sha256": "58ce00446ecb88689b8d1b9f52c81a45a77fd09bd0553ddaff0cf1cf19685342",
|
|
"type": "eql",
|
|
"version": 4
|
|
},
|
|
"6f1500bc-62d7-4eb9-8601-7485e87da2f4": {
|
|
"rule_name": "SSH (Secure Shell) to the Internet",
|
|
"sha256": "ccd5c6ae27b2cc637f6bbb39e5d6b025d56dc2c81975d697ada670a54ce65ef5",
|
|
"type": "query",
|
|
"version": 100
|
|
},
|
|
"6f1bb4b2-7dc8-11ee-92b2-f661ea17fbcd": {
|
|
"min_stack_version": "8.10",
|
|
"rule_name": "First Occurrence of Okta User Session Started via Proxy",
|
|
"sha256": "4a61b8effbf32d622b658833f4b222d18ac656a1cddd5bf60629bebf6292ec7f",
|
|
"type": "new_terms",
|
|
"version": 1
|
|
},
|
|
"6f435062-b7fc-4af9-acea-5b1ead65c5a5": {
|
|
"min_stack_version": "8.4",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 202,
|
|
"rule_name": "Google Workspace Role Modified",
|
|
"sha256": "8917dd169608ea491ef3f4c15d53b08aa6747b200e3b62a4bc22da3afb71fc9a",
|
|
"type": "query",
|
|
"version": 104
|
|
}
|
|
},
|
|
"rule_name": "Google Workspace Role Modified",
|
|
"sha256": "cc27c5d907038ca85c5d0c991e541013163f6fccc0bf95c84ac0b4ed62175081",
|
|
"type": "query",
|
|
"version": 205
|
|
},
|
|
"6f683345-bb10-47a7-86a7-71e9c24fb358": {
|
|
"rule_name": "Linux Restricted Shell Breakout via the find command",
|
|
"sha256": "7e1c03c53ba1a32b0780b4233a4278668a22939bf80ec896514a0237bbd28eb6",
|
|
"type": "eql",
|
|
"version": 100
|
|
},
|
|
"7024e2a0-315d-4334-bb1a-441c593e16ab": {
|
|
"min_stack_version": "8.9",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 207,
|
|
"rule_name": "AWS CloudTrail Log Deleted",
|
|
"sha256": "e4aa3aadf0d7e757977d5c02a31cae6d4ece731bc3478fec172e92a10c8f3ee1",
|
|
"type": "query",
|
|
"version": 108
|
|
}
|
|
},
|
|
"rule_name": "AWS CloudTrail Log Deleted",
|
|
"sha256": "6eb194ad10e7ea8d3c8547593a150c60eda885a07be0a3dc57dab3dc0d993314",
|
|
"type": "query",
|
|
"version": 208
|
|
},
|
|
"7024e2a0-315d-4334-bb1a-552d604f27bc": {
|
|
"min_stack_version": "8.9",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 207,
|
|
"rule_name": "AWS Config Resource Deletion",
|
|
"sha256": "e3f3358d38d5992c002d140012811e59a1ff80898107891dfbb67758d36adfc0",
|
|
"type": "query",
|
|
"version": 108
|
|
}
|
|
},
|
|
"rule_name": "AWS Config Resource Deletion",
|
|
"sha256": "16521ebadcb6ecd1ffe3b12756c604b96cf8b5daedd95eeec1e1fd2eef096dd9",
|
|
"type": "query",
|
|
"version": 208
|
|
},
|
|
"708c9d92-22a3-4fe0-b6b9-1f861c55502d": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Suspicious Execution via MSIEXEC",
|
|
"sha256": "934721c56a14fb6b1ea672f4cedb14eae9cdafb81a8e9bf35230f542a602740f",
|
|
"type": "eql",
|
|
"version": 1
|
|
},
|
|
"70d12c9c-0dbd-4a1a-bc44-1467502c9cf6": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Persistence via WMI Standard Registry Provider",
|
|
"sha256": "cdd0f600e28fdd26a6c761618ed095d7b9956e2064103ee046847872afd934fe",
|
|
"type": "eql",
|
|
"version": 106
|
|
},
|
|
"70fa1af4-27fd-4f26-bd03-50b6af6b9e24": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Attempt to Unload Elastic Endpoint Security Kernel Extension",
|
|
"sha256": "72795d027c2e5d95512a10ba9093cc08010fd8b0ca59bb63a4d890ebb975b67c",
|
|
"type": "query",
|
|
"version": 105
|
|
},
|
|
"7164081a-3930-11ed-a261-0242ac120002": {
|
|
"min_stack_version": "8.4",
|
|
"rule_name": "Kubernetes Container Created with Excessive Linux Capabilities",
|
|
"sha256": "86bf8bc61640a49c610c81cef5cb6bd417d85a5160637971eb56c908af7a3bec",
|
|
"type": "query",
|
|
"version": 4
|
|
},
|
|
"717f82c2-7741-4f9b-85b8-d06aeb853f4f": {
|
|
"min_stack_version": "8.6",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 206,
|
|
"rule_name": "Modification of Dynamic Linker Preload Shared Object",
|
|
"sha256": "dc67793718c16d2d90d8be38bf310b0ce87c25f4e9c56a66f7a231b80d9922f0",
|
|
"type": "query",
|
|
"version": 107
|
|
}
|
|
},
|
|
"rule_name": "Modification of Dynamic Linker Preload Shared Object",
|
|
"sha256": "ee370bb455e172738e8297e76bea0e3601dd176b407bb84768a2db8181e6ed4b",
|
|
"type": "new_terms",
|
|
"version": 208
|
|
},
|
|
"71bccb61-e19b-452f-b104-79a60e546a95": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Unusual File Creation - Alternate Data Stream",
|
|
"sha256": "460b042ab7e9d150c7f94a033204c22f67fdfe53c7425fedf71ff3765653154e",
|
|
"type": "eql",
|
|
"version": 112
|
|
},
|
|
"71c5cb27-eca5-4151-bb47-64bc3f883270": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Suspicious RDP ActiveX Client Loaded",
|
|
"sha256": "89ab2e24c739c528f048080597db9f446386a62730ba1e392eae623512e2ec6f",
|
|
"type": "eql",
|
|
"version": 106
|
|
},
|
|
"721999d0-7ab2-44bf-b328-6e63367b9b29": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Microsoft 365 Potential ransomware activity",
|
|
"sha256": "065cd0cc51b5457baa9bc37901045907810e07d074eef16982399654fae10302",
|
|
"type": "query",
|
|
"version": 102
|
|
},
|
|
"729aa18d-06a6-41c7-b175-b65b739b1181": {
|
|
"min_stack_version": "8.10",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 205,
|
|
"rule_name": "Attempt to Reset MFA Factors for an Okta User Account",
|
|
"sha256": "c60bc906d469f3485ac3f4e2694f2ad9335dd69d76776d4a7604221cdc4bd77c",
|
|
"type": "query",
|
|
"version": 106
|
|
}
|
|
},
|
|
"rule_name": "Attempt to Reset MFA Factors for an Okta User Account",
|
|
"sha256": "a26dbdf7534708e6c75311dac75a165cbb21ce2fedc44bffa5ebd8437ffe6354",
|
|
"type": "query",
|
|
"version": 206
|
|
},
|
|
"72d33577-f155-457d-aad3-379f9b750c97": {
|
|
"rule_name": "Linux Restricted Shell Breakout via env Shell Evasion",
|
|
"sha256": "1afd2b836cd82dafad139963d4d003d6088aaa83f45791c64cf7c0d7b66198e6",
|
|
"type": "eql",
|
|
"version": 100
|
|
},
|
|
"72ed9140-fe9d-4a34-a026-75b50e484b17": {
|
|
"min_stack_version": "8.6",
|
|
"rule_name": "Unusual Discovery Signal Alert with Unusual Process Executable",
|
|
"sha256": "b904f25bf5bb414b7b11d0a216395926f40e0ee77abebc5f9b7d19b0e35837d9",
|
|
"type": "new_terms",
|
|
"version": 2
|
|
},
|
|
"7405ddf1-6c8e-41ce-818f-48bea6bcaed8": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Modification of Accessibility Binaries",
|
|
"sha256": "9f5997c2b0fe4dada04cf6f3b344fbaddbe1f19800ee466dd053e2f7cb2879e5",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"7453e19e-3dbf-4e4e-9ae0-33d6c6ed15e1": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Modification of Environment Variable via Launchctl",
|
|
"sha256": "3db7bef640680a74100f7cb2389b8fa17b1bafa853c727820f3049d568ba79bf",
|
|
"type": "query",
|
|
"version": 105
|
|
},
|
|
"745b0119-0560-43ba-860a-7235dd8cee8d": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Unusual Hour for a User to Logon",
|
|
"sha256": "8c8f1df8c5b78cb30de44700004958516615a323691d707eee2ed79b9a00424c",
|
|
"type": "machine_learning",
|
|
"version": 104
|
|
},
|
|
"746edc4c-c54c-49c6-97a1-651223819448": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Unusual DNS Activity",
|
|
"sha256": "b9ea779f9594e53247551940577acd651bc9971f972c085f9476e736de350577",
|
|
"type": "machine_learning",
|
|
"version": 103
|
|
},
|
|
"7592c127-89fb-4209-a8f6-f9944dfd7e02": {
|
|
"min_stack_version": "8.6",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 102,
|
|
"rule_name": "Suspicious Sysctl File Event",
|
|
"sha256": "677db0e224b9e590ddaf2525bccc03fcd4c576f741537f13434eb9cecdd77bdc",
|
|
"type": "eql",
|
|
"version": 3
|
|
}
|
|
},
|
|
"rule_name": "Suspicious Sysctl File Event",
|
|
"sha256": "bfc9a20f20463b90faf15152ce6289f0f6144771298c87568ef2133798040a07",
|
|
"type": "new_terms",
|
|
"version": 105
|
|
},
|
|
"75dcb176-a575-4e33-a020-4a52aaa1b593": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Service Disabled via Registry Modification",
|
|
"sha256": "372c468ec6a0ebd2259d3b111dd8e4431353594ad85c0e66a0b97284f21d84f1",
|
|
"type": "eql",
|
|
"version": 1
|
|
},
|
|
"75ee75d8-c180-481c-ba88-ee50129a6aef": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Web Application Suspicious Activity: Unauthorized Method",
|
|
"sha256": "6888bde4c516f00a56257eb9f46531d38dbadb83d316387c5e20af3390580961",
|
|
"type": "query",
|
|
"version": 102
|
|
},
|
|
"76152ca1-71d0-4003-9e37-0983e12832da": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Privilege Escalation via Sudoers File Modification",
|
|
"sha256": "6dfec898ca5b57352a078ff6ea65a0452985eeac88bb6ca491399544d57be902",
|
|
"type": "query",
|
|
"version": 103
|
|
},
|
|
"764c8437-a581-4537-8060-1fdb0e92c92d": {
|
|
"min_stack_version": "8.4",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 199,
|
|
"rule_name": "Kubernetes Pod Created With HostIPC",
|
|
"sha256": "88a76082a0b05f8b848047174d1517f7746506e91ed2bb2d203255a52f38a8e2",
|
|
"type": "query",
|
|
"version": 101
|
|
}
|
|
},
|
|
"rule_name": "Kubernetes Pod Created With HostIPC",
|
|
"sha256": "beed3f7f4d2a86f155bd96e2903ded43fe8eb75d27f85650778e44bdf7e50982",
|
|
"type": "query",
|
|
"version": 203
|
|
},
|
|
"764c9fcd-4c4c-41e6-a0c7-d6c46c2eff66": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Access to a Sensitive LDAP Attribute",
|
|
"sha256": "665e0cbf656dd660a585342d9ca129af8624f7d4926bd110ac065ffa8c2a1895",
|
|
"type": "eql",
|
|
"version": 9
|
|
},
|
|
"766d3f91-3f12-448c-b65f-20123e9e9e8c": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Creation of Hidden Shared Object File",
|
|
"sha256": "799b4669a8e13bfbb627ddec54045adfc695820ba3e46b6dd098a33d9bf72da8",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"76ddb638-abf7-42d5-be22-4a70b0bf7241": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Privilege Escalation via Rogue Named Pipe Impersonation",
|
|
"sha256": "244ab9baa1c9c448b5266b5f61c1aa9a0a2ff4c56704e282a654e2a42221e5f3",
|
|
"type": "eql",
|
|
"version": 105
|
|
},
|
|
"76e4d92b-61c1-4a95-ab61-5fd94179a1ee": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Reverse Shell via Suspicious Child Process",
|
|
"sha256": "551061d1ad90acc7d6514094b3e49c26ca4410c8372871f868166f8e386e17a3",
|
|
"type": "eql",
|
|
"version": 7
|
|
},
|
|
"76fd43b7-3480-4dd9-8ad7-8bd36bfad92f": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Remote Desktop Tunneling Detected",
|
|
"sha256": "0a25436ab1e2f5bac3e48c5faeeda31383d3a1d24fa948ba070025f02583a311",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"770e0c4d-b998-41e5-a62e-c7901fd7f470": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Enumeration Command Spawned via WMIPrvSE",
|
|
"sha256": "d09566023f3a3ae877ed4d879c94ce1f4165ef8c664e0ef6794d43385d49cccf",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"774f5e28-7b75-4a58-b94e-41bf060fdd86": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "User Added as Owner for Azure Application",
|
|
"sha256": "b88d2f1b89f2bbf51454db3706d1461b08147f31841aea42ee15726e4632fa26",
|
|
"type": "query",
|
|
"version": 102
|
|
},
|
|
"7787362c-90ff-4b1a-b313-8808b1020e64": {
|
|
"min_stack_version": "8.6",
|
|
"rule_name": "UID Elevation from Previously Unknown Executable",
|
|
"sha256": "2730756601b3e9c3122bb97458b0f9f58e407913123e9572e2cac648e4ebab2a",
|
|
"type": "new_terms",
|
|
"version": 1
|
|
},
|
|
"77a3c3df-8ec4-4da4-b758-878f551dee69": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Adversary Behavior - Detected - Elastic Endgame",
|
|
"sha256": "80710ac325d0c53b1d15965386e8fbb32e1c4aace237b63664d9f4db8f7f815d",
|
|
"type": "query",
|
|
"version": 102
|
|
},
|
|
"781f8746-2180-4691-890c-4c96d11ca91d": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Network Sweep Detected",
|
|
"sha256": "e8646ede4715b107643a3098b6e032965f664c38e7341d9d0519b3a8510d2fab",
|
|
"type": "threshold",
|
|
"version": 4
|
|
},
|
|
"785a404b-75aa-4ffd-8be5-3334a5a544dd": {
|
|
"min_stack_version": "8.4",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 202,
|
|
"rule_name": "Application Added to Google Workspace Domain",
|
|
"sha256": "7fa64b656ada94baa0a8d76c00231f99bfd63f0925722bdfeb6528ff90cdef76",
|
|
"type": "query",
|
|
"version": 104
|
|
}
|
|
},
|
|
"rule_name": "Application Added to Google Workspace Domain",
|
|
"sha256": "ad5d0246eae8608a0868956eb3e4b6b36c94a4180a1194ca35da083d3264ecb6",
|
|
"type": "query",
|
|
"version": 205
|
|
},
|
|
"7882cebf-6cf1-4de3-9662-213aa13e8b80": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Azure Privilege Identity Management Role Modified",
|
|
"sha256": "26c5f67d4d0a686a2580c9991b656cf39bca2ec927dd297487125907f961585e",
|
|
"type": "query",
|
|
"version": 105
|
|
},
|
|
"78d3d8d9-b476-451d-a9e0-7a5addd70670": {
|
|
"min_stack_version": "8.9",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 207,
|
|
"rule_name": "Spike in AWS Error Messages",
|
|
"sha256": "333cdaf4a1706f9d4a7935d233bb7a28147712b8edf36e3500c61433a2cbee57",
|
|
"type": "machine_learning",
|
|
"version": 108
|
|
}
|
|
},
|
|
"rule_name": "Spike in AWS Error Messages",
|
|
"sha256": "b9c3990fedf14024b1c9c83464350edfd9ebd517c53d2aacebbb3a848d9740f2",
|
|
"type": "machine_learning",
|
|
"version": 208
|
|
},
|
|
"78ef0c95-9dc2-40ac-a8da-5deb6293a14e": {
|
|
"min_stack_version": "8.4",
|
|
"rule_name": "Unsigned DLL Loaded by Svchost",
|
|
"sha256": "11fb3b45a1ccc2f104c91997fb4d7093f0efd5534a8f2048aa90ef37cc11f6cd",
|
|
"type": "eql",
|
|
"version": 5
|
|
},
|
|
"79124edf-30a8-4d48-95c4-11522cad94b1": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "File Compressed or Archived into Common Format",
|
|
"sha256": "ffc63f1281c5daf184121bec10deda5e91670f64baeaf47d2ee5336649bf2c78",
|
|
"type": "eql",
|
|
"version": 1
|
|
},
|
|
"792dd7a6-7e00-4a0a-8a9a-a7c24720b5ec": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Azure Key Vault Modified",
|
|
"sha256": "79a68677542c96b2d8a804e552e8de37560ab6f599a24f9b828d0b1dbbee1a87",
|
|
"type": "query",
|
|
"version": 103
|
|
},
|
|
"79ce2c96-72f7-44f9-88ef-60fa1ac2ce47": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Masquerading as System32 Executable",
|
|
"sha256": "51fa21c1094b9e214686668956d499fc25f19607d7b1a93fc094aa557eda00d7",
|
|
"type": "eql",
|
|
"version": 2
|
|
},
|
|
"79f0a1f7-ed6b-471c-8eb1-23abd6470b1c": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential File Transfer via Certreq",
|
|
"sha256": "c33e5d3c93fbcee2f5e36fa7cabf7b38e81c6acc0d71b2fd57c13d5f3946887b",
|
|
"type": "eql",
|
|
"version": 6
|
|
},
|
|
"79f97b31-480e-4e63-a7f4-ede42bf2c6de": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Shadow Credentials added to AD Object",
|
|
"sha256": "5b2bc83ca0b1db8a3ce856ff7e859f4fec413978c1f0ddcd4886820fe2585e16",
|
|
"type": "query",
|
|
"version": 107
|
|
},
|
|
"7a137d76-ce3d-48e2-947d-2747796a78c0": {
|
|
"rule_name": "Network Sniffing via Tcpdump",
|
|
"sha256": "a1d61d8865b525e77420ddd2744a088b6776dae60edb6673253cd1aeba1fd426",
|
|
"type": "query",
|
|
"version": 100
|
|
},
|
|
"7acb2de3-8465-472a-8d9c-ccd7b73d0ed8": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Privilege Escalation through Writable Docker Socket",
|
|
"sha256": "37b23adf3530355a483eccca0d78d8bb47a4e3700e5cef77ef45018e2b92ecbb",
|
|
"type": "eql",
|
|
"version": 4
|
|
},
|
|
"7b08314d-47a0-4b71-ae4e-16544176924f": {
|
|
"rule_name": "File and Directory Discovery",
|
|
"sha256": "720c1bc79fdb18e1f5ef2fe1e9aa79081b3ca846cdab6f115116d45d72d115b5",
|
|
"type": "eql",
|
|
"version": 100
|
|
},
|
|
"7b3da11a-60a2-412e-8aa7-011e1eb9ed47": {
|
|
"min_stack_version": "8.9",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 204,
|
|
"rule_name": "AWS ElastiCache Security Group Created",
|
|
"sha256": "388613f453ad59a0b5a1346925a88c2ea72963b1a7a4ba77f510bdb527a655a4",
|
|
"type": "query",
|
|
"version": 105
|
|
}
|
|
},
|
|
"rule_name": "AWS ElastiCache Security Group Created",
|
|
"sha256": "05d7545eb5be8c088900939645d5a75858e48029b72b2926c878627697576a85",
|
|
"type": "query",
|
|
"version": 205
|
|
},
|
|
"7b8bfc26-81d2-435e-965c-d722ee397ef1": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Windows Network Enumeration",
|
|
"sha256": "1393d48866e1f5b0f4b57ee571029deeb6d2324314b1a1f037389847bb510a15",
|
|
"type": "eql",
|
|
"version": 109
|
|
},
|
|
"7ba58110-ae13-439b-8192-357b0fcfa9d7": {
|
|
"min_stack_version": "8.8",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 205,
|
|
"rule_name": "Suspicious LSASS Access via MalSecLogon",
|
|
"sha256": "cfb5125f0705e215f8dc00f7a38fe7454cf24077181b6b9c70068c7e46fbadb6",
|
|
"type": "eql",
|
|
"version": 106
|
|
}
|
|
},
|
|
"rule_name": "Suspicious LSASS Access via MalSecLogon",
|
|
"sha256": "f019fa7b9d9928dde2726f094f938de608d17db63b48a3250216ba18df59aa50",
|
|
"type": "eql",
|
|
"version": 207
|
|
},
|
|
"7bcbb3ac-e533-41ad-a612-d6c3bf666aba": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Tampering of Bash Command-Line History",
|
|
"sha256": "85f902935229ecdf379a249362b9275a5392b2e83a4012e4302c874e93861074",
|
|
"type": "eql",
|
|
"version": 104
|
|
},
|
|
"7caa8e60-2df0-11ed-b814-f661ea17fbce": {
|
|
"min_stack_version": "8.4",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 103,
|
|
"rule_name": "Google Workspace Bitlocker Setting Disabled",
|
|
"sha256": "b7f72377e6e5c62220a4932b83c0343a304f9e32c6f8df1a2320f97dc666d857",
|
|
"type": "query",
|
|
"version": 5
|
|
}
|
|
},
|
|
"rule_name": "Google Workspace Bitlocker Setting Disabled",
|
|
"sha256": "d876e552704f399012a35ef8ccd37653e6278d558e9904d895f023110f987c55",
|
|
"type": "query",
|
|
"version": 106
|
|
},
|
|
"7ceb2216-47dd-4e64-9433-cddc99727623": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "GCP Service Account Creation",
|
|
"sha256": "0c8a23dace5a96a836f6a55bbc9dc2e64550d584c98257f3b7dbbaaf0d79805c",
|
|
"type": "query",
|
|
"version": 104
|
|
},
|
|
"7d2c38d7-ede7-4bdf-b140-445906e6c540": {
|
|
"rule_name": "Tor Activity to the Internet",
|
|
"sha256": "a795f581489be91fab79b53ab0afee754fd43c0655cde52c08dd70983c606cb1",
|
|
"type": "query",
|
|
"version": 100
|
|
},
|
|
"7dfaaa17-425c-4fe7-bd36-83705fde7c2b": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Suspicious Kworker UID Elevation",
|
|
"sha256": "f6a376457e527734ea6ad8afb21d2c54e93b221f1f2bf986041ff905f2baaf67",
|
|
"type": "eql",
|
|
"version": 1
|
|
},
|
|
"7f370d54-c0eb-4270-ac5a-9a6020585dc6": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Suspicious WMIC XSL Script Execution",
|
|
"sha256": "c2521f557370eeadd9f5ab09fd706593451e0f0d44ffcb8ee63fd21ec3433862",
|
|
"type": "eql",
|
|
"version": 106
|
|
},
|
|
"7f89afef-9fc5-4e7b-bf16-75ffdf27f8db": {
|
|
"min_stack_version": "8.6",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 100,
|
|
"rule_name": "Discovery of Internet Capabilities via Built-in Tools",
|
|
"sha256": "a411322e3fd22e1fe67ca9c54dd4c5ecb965751365aebb4c0c9d7b4e3aa67a66",
|
|
"type": "eql",
|
|
"version": 1
|
|
}
|
|
},
|
|
"rule_name": "Discovery of Internet Capabilities via Built-in Tools",
|
|
"sha256": "bc8f0cbcbf93a3e84a7433c81cb3997b0f23a2d6b1a1df28e3828f0fe7f1ac50",
|
|
"type": "new_terms",
|
|
"version": 101
|
|
},
|
|
"7fb500fa-8e24-4bd1-9480-2a819352602c": {
|
|
"min_stack_version": "8.6",
|
|
"rule_name": "New Systemd Timer Created",
|
|
"sha256": "74881e97ab7721a1e539586fa0f192f38d25d7565c81928c9a8515daff525604",
|
|
"type": "new_terms",
|
|
"version": 7
|
|
},
|
|
"80084fa9-8677-4453-8680-b891d3c0c778": {
|
|
"min_stack_version": "8.6",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 102,
|
|
"rule_name": "Enumeration of Kernel Modules via Proc",
|
|
"sha256": "2dcd549142325271b0cc47d8d2a3b32dc6f1187d7ed0a0a2ad21238ba64e8ff0",
|
|
"type": "eql",
|
|
"version": 3
|
|
}
|
|
},
|
|
"rule_name": "Enumeration of Kernel Modules via Proc",
|
|
"sha256": "9328c54c32125014fec6bdbd75bf9d2b513fccfc86f1ea0a04e8ca44d8a6a097",
|
|
"type": "new_terms",
|
|
"version": 104
|
|
},
|
|
"800e01be-a7a4-46d0-8de9-69f3c9582b44": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Unusual Process Extension",
|
|
"sha256": "892abe65dfb4e821b001077e250ac7619928c9a8ba796ec314d9abce74c74ba8",
|
|
"type": "eql",
|
|
"version": 2
|
|
},
|
|
"808291d3-e918-4a3a-86cd-73052a0c9bdc": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Suspicious Troubleshooting Pack Cabinet Execution",
|
|
"sha256": "e07fdca00c03cede7dcd07d161752b6a5fa31a5987779dde490803e67071a0f7",
|
|
"type": "eql",
|
|
"version": 1
|
|
},
|
|
"809b70d3-e2c3-455e-af1b-2626a5a1a276": {
|
|
"min_stack_version": "8.9",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 207,
|
|
"rule_name": "Unusual City For an AWS Command",
|
|
"sha256": "51f5b37af37f1f4ec180b1de7aac38ca7d77afc0e1f44dfe6122eb8605e3adab",
|
|
"type": "machine_learning",
|
|
"version": 108
|
|
}
|
|
},
|
|
"rule_name": "Unusual City For an AWS Command",
|
|
"sha256": "d6cbad92730cf10d62df532e09bfef35bca6439b7ff5b0f34337bdda6ab38199",
|
|
"type": "machine_learning",
|
|
"version": 208
|
|
},
|
|
"80c52164-c82a-402c-9964-852533d58be1": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Process Injection - Detected - Elastic Endgame",
|
|
"sha256": "0dbd2d102b454f0abdb7f1d0be19cbee64db8c5429aee66b1cc09dc125766d6b",
|
|
"type": "query",
|
|
"version": 101
|
|
},
|
|
"814d96c7-2068-42aa-ba8e-fe0ddd565e2e": {
|
|
"min_stack_version": "8.9",
|
|
"rule_name": "Unusual Remote File Extension",
|
|
"sha256": "b84983a46efbfefb9fee7a305208a049944240b75335512e43271f5a7c3efebd",
|
|
"type": "machine_learning",
|
|
"version": 2
|
|
},
|
|
"818e23e6-2094-4f0e-8c01-22d30f3506c6": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "PowerShell Script Block Logging Disabled",
|
|
"sha256": "cd1b53b5cd9aacd751ae8801be77543c716fd21c184f54a776380edd185e8275",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"81cc58f5-8062-49a2-ba84-5cc4b4d31c40": {
|
|
"rule_name": "Persistence via Kernel Module Modification",
|
|
"sha256": "6d2938fb1e03fb76895197f4565a860e7c346b8cba3ac5bc612938f6af910d86",
|
|
"type": "query",
|
|
"version": 100
|
|
},
|
|
"81fe9dc6-a2d7-4192-a2d8-eed98afc766a": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "PowerShell Suspicious Payload Encoded and Compressed",
|
|
"sha256": "c3b7387b5dcfde107b183b9113a7218cc9cb00b15d06c8d637eee902809f04a3",
|
|
"type": "query",
|
|
"version": 110
|
|
},
|
|
"81ff45f8-f8c2-4e28-992e-5a0e8d98e0fe": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Temporarily Scheduled Task Creation",
|
|
"sha256": "b9eb095355ecc02a827ca56e41a3ccd5fd5fff3c57c2f1a1e16e0f32082bcd46",
|
|
"type": "eql",
|
|
"version": 7
|
|
},
|
|
"827f8d8f-4117-4ae4-b551-f56d54b9da6b": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Apple Scripting Execution with Administrator Privileges",
|
|
"sha256": "f9e2397c95b2c307f8a7ed2bf1151fe7306a38ee6b45dce9ef9531b8e455486f",
|
|
"type": "eql",
|
|
"version": 106
|
|
},
|
|
"835c0622-114e-40b5-a346-f843ea5d01f1": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Linux Local Account Brute Force Detected",
|
|
"sha256": "11bd5d0b943d146c2e7e684fa4b128c4692eae1ef64172cc1e8969eeabddeb73",
|
|
"type": "eql",
|
|
"version": 4
|
|
},
|
|
"83a1931d-8136-46fc-b7b9-2db4f639e014": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Azure Kubernetes Pods Deleted",
|
|
"sha256": "8c0f9a8ac544e84262204d80e667c90f7e1a0be582cea5152e2d44926f4e72a9",
|
|
"type": "query",
|
|
"version": 102
|
|
},
|
|
"83b2c6e5-e0b2-42d7-8542-8f3af86a1acb": {
|
|
"rule_name": "Linux Restricted Shell Breakout via the mysql command",
|
|
"sha256": "6a7fe2a2002dc6de66039a88c6f06a12e5ca7e45752690720ccd33d86d321194",
|
|
"type": "eql",
|
|
"version": 100
|
|
},
|
|
"83e9c2b3-24ef-4c1d-a8cd-5ebafb5dfa2f": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Attempt to Disable IPTables or Firewall",
|
|
"sha256": "02f2a52e75f96bb21611dfd66db9eacbdc7bde77eb1e7da4a5934751321134cc",
|
|
"type": "eql",
|
|
"version": 5
|
|
},
|
|
"846fe13f-6772-4c83-bd39-9d16d4ad1a81": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Microsoft Exchange Transport Agent Install Script",
|
|
"sha256": "814b05ca584b27e70940b7b56b00e0a980f69f27a29a732faf88da9bab468c7a",
|
|
"type": "query",
|
|
"version": 2
|
|
},
|
|
"84d1f8db-207f-45ab-a578-921d91c23eb2": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Upgrade of Non-interactive Shell",
|
|
"sha256": "851087e9141cd70c44f496078e66eaf761bf4622e80e942be61280452391a62e",
|
|
"type": "eql",
|
|
"version": 2
|
|
},
|
|
"84da2554-e12a-11ec-b896-f661ea17fbcd": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Enumerating Domain Trusts via NLTEST.EXE",
|
|
"sha256": "ff711eea051615cadd16874b875330acd62c7aaf5fb10e2db0d36c1f15799712",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"850d901a-2a3c-46c6-8b22-55398a01aad8": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Remote Credential Access via Registry",
|
|
"sha256": "014fc8d0bc9296aba032766dc003316df6e0c776dd7afbd1eac19022bc646ba0",
|
|
"type": "eql",
|
|
"version": 109
|
|
},
|
|
"852c1f19-68e8-43a6-9dce-340771fe1be3": {
|
|
"min_stack_version": "8.6",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 207,
|
|
"rule_name": "Suspicious PowerShell Engine ImageLoad",
|
|
"sha256": "765d2c6702b22d625ca9fac30e74684428f6d6a852dd200dff84851fe76dda47",
|
|
"type": "eql",
|
|
"version": 108
|
|
}
|
|
},
|
|
"rule_name": "Suspicious PowerShell Engine ImageLoad",
|
|
"sha256": "4c25f7bb1a234052d7a5d22439a6b2ceaf128a052fa764bb1d97b0d2b5928eee",
|
|
"type": "new_terms",
|
|
"version": 208
|
|
},
|
|
"8623535c-1e17-44e1-aa97-7a0699c3037d": {
|
|
"min_stack_version": "8.9",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 204,
|
|
"rule_name": "AWS EC2 Network Access Control List Deletion",
|
|
"sha256": "196c1626443f797df1670e37fe56629d8da2a1b61087cac2f3fab49bd64b5113",
|
|
"type": "query",
|
|
"version": 105
|
|
}
|
|
},
|
|
"rule_name": "AWS EC2 Network Access Control List Deletion",
|
|
"sha256": "f9a3ba3b45d5b33b1e73c806495b984233a6b2bc200082fc945fa31d8fea41be",
|
|
"type": "query",
|
|
"version": 205
|
|
},
|
|
"863cdf31-7fd3-41cf-a185-681237ea277b": {
|
|
"min_stack_version": "8.9",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 204,
|
|
"rule_name": "AWS RDS Security Group Deletion",
|
|
"sha256": "f46878044473b51688032f8944026be841032d83fbab53ebccb6f3bd1056f1a7",
|
|
"type": "query",
|
|
"version": 105
|
|
}
|
|
},
|
|
"rule_name": "AWS RDS Security Group Deletion",
|
|
"sha256": "0c9d4de210e608efca7e588b59eeb71ca5f96b5b20c083daee0e8d4035f0cd32",
|
|
"type": "query",
|
|
"version": 205
|
|
},
|
|
"867616ec-41e5-4edc-ada2-ab13ab45de8a": {
|
|
"min_stack_version": "8.9",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 204,
|
|
"rule_name": "AWS IAM Group Deletion",
|
|
"sha256": "950ae30d904242ba798eb1658f1e238720d404743585e155f030dda45d0e05f6",
|
|
"type": "query",
|
|
"version": 105
|
|
}
|
|
},
|
|
"rule_name": "AWS IAM Group Deletion",
|
|
"sha256": "f4898405685170f2b55f69bcde2b41a0cb8b861ef6040f86e3257bf0abf93383",
|
|
"type": "query",
|
|
"version": 205
|
|
},
|
|
"870aecc0-cea4-4110-af3f-e02e9b373655": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Security Software Discovery via Grep",
|
|
"sha256": "f4d2ea0ece674f039a63702423275a0d16239f282e580bcea41aaacbf1505ae0",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"871ea072-1b71-4def-b016-6278b505138d": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Enumeration of Administrator Accounts",
|
|
"sha256": "faff9c1bc769a66960918e1a2f77f18910fbc478e2c1ab36d62656ed1756c01e",
|
|
"type": "eql",
|
|
"version": 109
|
|
},
|
|
"87594192-4539-4bc4-8543-23bc3d5bd2b4": {
|
|
"min_stack_version": "8.9",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 204,
|
|
"rule_name": "AWS EventBridge Rule Disabled or Deleted",
|
|
"sha256": "81d56536a960fa83385df001b8186c6a129128d000278be5586476a6d4b9e19b",
|
|
"type": "query",
|
|
"version": 105
|
|
}
|
|
},
|
|
"rule_name": "AWS EventBridge Rule Disabled or Deleted",
|
|
"sha256": "bf5d21e0ace96205fd8f8db491ac9d75625ef089e4f5b3499d4a4209268f9719",
|
|
"type": "query",
|
|
"version": 205
|
|
},
|
|
"87ec6396-9ac4-4706-bcf0-2ebb22002f43": {
|
|
"rule_name": "FTP (File Transfer Protocol) Activity to the Internet",
|
|
"sha256": "b6ea4d4c77b8c1ed584826fd5828493dc1a33eee3546be3a15f540a56a9dc9f7",
|
|
"type": "query",
|
|
"version": 100
|
|
},
|
|
"884e87cc-c67b-4c90-a4ed-e1e24a940c82": {
|
|
"min_stack_version": "8.6",
|
|
"rule_name": "Potential Suspicious Clipboard Activity Detected",
|
|
"sha256": "a845a994f21837d7225484856beb19514cb92efaadf804f6caf1748812efd2e6",
|
|
"type": "new_terms",
|
|
"version": 2
|
|
},
|
|
"88671231-6626-4e1b-abb7-6e361a171fbb": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Microsoft 365 Global Administrator Role Assigned",
|
|
"sha256": "bb6703bc49a5b12297b62e2aa1b7a9e5f01ce6108eabbd1d541ec655dd35ac50",
|
|
"type": "query",
|
|
"version": 102
|
|
},
|
|
"88817a33-60d3-411f-ba79-7c905d865b2a": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Sublime Plugin or Application Script Modification",
|
|
"sha256": "5c0fc7dd81e04f3fbd1c5c472f0bd727ad065924ec0d714e5bc13c4b6b3e45ff",
|
|
"type": "eql",
|
|
"version": 106
|
|
},
|
|
"88fdcb8c-60e5-46ee-9206-2663adf1b1ce": {
|
|
"min_stack_version": "8.6",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 102,
|
|
"rule_name": "Potential Sudo Hijacking Detected",
|
|
"sha256": "28eba13edb2d9454c08d86938d6bf41ed614c2c32879ec8719cd571c0c9cbef5",
|
|
"type": "eql",
|
|
"version": 3
|
|
}
|
|
},
|
|
"rule_name": "Potential Sudo Hijacking Detected",
|
|
"sha256": "23ef2c9b687dd9563523331067722ffb249e171d96bed0cb0aa2f444e2f69e54",
|
|
"type": "new_terms",
|
|
"version": 104
|
|
},
|
|
"891cb88e-441a-4c3e-be2d-120d99fe7b0d": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Suspicious WMI Image Load from MS Office",
|
|
"sha256": "fed96548137a4b9070b314d8dc25e74ad14c31c93a56277474da3a50d52a271b",
|
|
"type": "eql",
|
|
"version": 106
|
|
},
|
|
"89583d1b-3c2e-4606-8b74-0a9fd2248e88": {
|
|
"rule_name": "Linux Restricted Shell Breakout via the vi command",
|
|
"sha256": "4e641b4ff6b6f35846fe1d66fcc4aa611c357f27f064a62f067df3209e95af79",
|
|
"type": "eql",
|
|
"version": 100
|
|
},
|
|
"897dc6b5-b39f-432a-8d75-d3730d50c782": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Kerberos Traffic from Unusual Process",
|
|
"sha256": "6bf3ed975864635c702041b46dc27221005da366c7bea70255734a81a64a71b6",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"89f9a4b0-9f8f-4ee0-8823-c4751a6d6696": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Command Prompt Network Connection",
|
|
"sha256": "a7b53613b02ded1945e51652cf8c0a4b2548ec599948a7ac9a5a75287f819c3c",
|
|
"type": "eql",
|
|
"version": 105
|
|
},
|
|
"89fa6cb7-6b53-4de2-b604-648488841ab8": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Persistence via DirectoryService Plugin Modification",
|
|
"sha256": "abc0977e48e577f93d91ddb156280eb131accdb697133ac9f8e895d66e7ead14",
|
|
"type": "query",
|
|
"version": 105
|
|
},
|
|
"8a024633-c444-45c0-a4fe-78128d8c1ab6": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Suspicious Symbolic Link Created",
|
|
"sha256": "4567be1709664ab3c6b7714b68a3da2e392c751aaba951f50336affeacd7e7b4",
|
|
"type": "eql",
|
|
"version": 4
|
|
},
|
|
"8a0fbd26-867f-11ee-947c-f661ea17fbcd": {
|
|
"min_stack_version": "8.10",
|
|
"rule_name": "Potential Okta MFA Bombing via Push Notifications",
|
|
"sha256": "8700bb27ff54ad56343421ba6fac2f451fb22a01e93bf557ae17c9bf71d3bc7d",
|
|
"type": "eql",
|
|
"version": 2
|
|
},
|
|
"8a1b0278-0f9a-487d-96bd-d4833298e87a": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Setuid / Setgid Bit Set via chmod",
|
|
"sha256": "9c15ba48b9d09639823c4d9695769a98190668b5a82f91664552b3a1d00134d5",
|
|
"type": "query",
|
|
"version": 103
|
|
},
|
|
"8a1d4831-3ce6-4859-9891-28931fa6101d": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Suspicious Execution from a Mounted Device",
|
|
"sha256": "ac475836b78129386282207de17ce5b3665934cc05cee7e2f8f2a225ad06962e",
|
|
"type": "eql",
|
|
"version": 106
|
|
},
|
|
"8a5c1e5f-ad63-481e-b53a-ef959230f7f1": {
|
|
"min_stack_version": "8.10",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 205,
|
|
"rule_name": "Attempt to Deactivate an Okta Network Zone",
|
|
"sha256": "f01b127b08601cf43cda877946ee97bf4bc51e4cff8f27b3e3dc4a809a3bf009",
|
|
"type": "query",
|
|
"version": 106
|
|
}
|
|
},
|
|
"rule_name": "Attempt to Deactivate an Okta Network Zone",
|
|
"sha256": "42864ccbb8e48936452a309318951454ac5820199a0b5e62be20a53c6846eb2b",
|
|
"type": "query",
|
|
"version": 206
|
|
},
|
|
"8acb7614-1d92-4359-bfcf-478b6d9de150": {
|
|
"min_stack_version": "8.6",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 204,
|
|
"rule_name": "Suspicious JAVA Child Process",
|
|
"sha256": "c0f26a306606e4329dc19352d7f927e70467ccc86747f18345aefcf194110e16",
|
|
"type": "eql",
|
|
"version": 105
|
|
}
|
|
},
|
|
"rule_name": "Suspicious JAVA Child Process",
|
|
"sha256": "951a0bb72f0f5df1d2a10560cdc54d757d5fee1b3ee2c3156ea9728b05591a19",
|
|
"type": "new_terms",
|
|
"version": 206
|
|
},
|
|
"8af5b42f-8d74-48c8-a8d0-6d14b4197288": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Sudo Privilege Escalation via CVE-2019-14287",
|
|
"sha256": "17f895c23f484acde825286a1ddc686df34874b11ab6f8fe31bb183d6ecb0277",
|
|
"type": "eql",
|
|
"version": 3
|
|
},
|
|
"8b2b3a62-a598-4293-bc14-3d5fa22bb98f": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Executable File Creation with Multiple Extensions",
|
|
"sha256": "4198ea79876c82869eb8f56696ccca913c64daa9e44e66fef25cf4092cf41029",
|
|
"type": "eql",
|
|
"version": 106
|
|
},
|
|
"8b4f0816-6a65-4630-86a6-c21c179c0d09": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Enable Host Network Discovery via Netsh",
|
|
"sha256": "96398ef66e31c53fd65b2620d26184f54dca1cf241e0f8776db22fb848da94aa",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"8b64d36a-1307-4b2e-a77b-a0027e4d27c8": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Azure Kubernetes Events Deleted",
|
|
"sha256": "8a4def186433798cec337c4f9e6b8b1ac62a38ad3789dd570670d22444e74fb9",
|
|
"type": "query",
|
|
"version": 102
|
|
},
|
|
"8c1bdde8-4204-45c0-9e0c-c85ca3902488": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "RDP (Remote Desktop Protocol) from the Internet",
|
|
"sha256": "97a0561922556e3ced27828faed777dc5a0ab1da7843bfef7c19929702a26f4b",
|
|
"type": "query",
|
|
"version": 103
|
|
},
|
|
"8c37dc0e-e3ac-4c97-8aa0-cf6a9122de45": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Unusual Child Process of dns.exe",
|
|
"sha256": "50847b0a7904637d6c3c188fe6025061218aaea691f8e17e0eea0b75949cbdce",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"8c81e506-6e82-4884-9b9a-75d3d252f967": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential SharpRDP Behavior",
|
|
"sha256": "b6a8ffcc1a8ee2a11059084442b0318bebe5bc120cfafa14f65b4e1d7b321062",
|
|
"type": "eql",
|
|
"version": 105
|
|
},
|
|
"8cb4f625-7743-4dfb-ae1b-ad92be9df7bd": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Ransomware - Detected - Elastic Endgame",
|
|
"sha256": "c9bb739724755a7a6e1cbec08548874af36827e590163f7d6e0ff83b215c2fad",
|
|
"type": "query",
|
|
"version": 101
|
|
},
|
|
"8cb84371-d053-4f4f-bce0-c74990e28f28": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Successful SSH Brute Force Attack",
|
|
"sha256": "468af262f4fb45988c3072a2883f218b9b867218c50bfd7a910fdf553f88feda",
|
|
"type": "eql",
|
|
"version": 9
|
|
},
|
|
"8d366588-cbd6-43ba-95b4-0971c3f906e5": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "File with Suspicious Extension Downloaded",
|
|
"sha256": "4aee04fcae9856c8db9a767d12e37c08a83d89f0665b4be03150aa01c6e03b4b",
|
|
"type": "eql",
|
|
"version": 1
|
|
},
|
|
"8d3d0794-c776-476b-8674-ee2e685f6470": {
|
|
"min_stack_version": "8.8",
|
|
"rule_name": "Suspicious Interactive Shell Spawned From Inside A Container",
|
|
"sha256": "98d9856fbf5ecafe5dad0a89fd9c9d5281e1c02fee5b91a84b352c727f87441e",
|
|
"type": "eql",
|
|
"version": 2
|
|
},
|
|
"8da41fc9-7735-4b24-9cc6-c78dfc9fc9c9": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Privilege Escalation via PKEXEC",
|
|
"sha256": "d10513c76a16d9b08cc676bb9c075b5cb14a570fc47bbc001974e164a33c7fde",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"8ddab73b-3d15-4e5d-9413-47f05553c1d7": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Azure Automation Runbook Deleted",
|
|
"sha256": "6c88b863fccfcdd4aa41e1c790530f97914dc652a10e9121e26a28194746179c",
|
|
"type": "query",
|
|
"version": 102
|
|
},
|
|
"8e39f54e-910b-4adb-a87e-494fbba5fb65": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Outgoing RDP Connection by Unusual Process",
|
|
"sha256": "dd3d04e43bbd83b16a0414f323260473ea086aa839efad492a35c4a2cd203829",
|
|
"type": "eql",
|
|
"version": 1
|
|
},
|
|
"8eec4df1-4b4b-4502-b6c3-c788714604c9": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Bitsadmin Activity",
|
|
"sha256": "c07d18b1bad6186dd2af856dbf2362d78f773b50369e7044b1e1329cc0f23cce",
|
|
"type": "eql",
|
|
"version": 1
|
|
},
|
|
"8f3e91c7-d791-4704-80a1-42c160d7aa27": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Port Monitor or Print Processor Registration Abuse",
|
|
"sha256": "d3f17c275351dce43dbed1904257d053abe2a6e174ec12f91eabbc40236f918e",
|
|
"type": "eql",
|
|
"version": 105
|
|
},
|
|
"8f919d4b-a5af-47ca-a594-6be59cd924a4": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Incoming DCOM Lateral Movement with ShellBrowserWindow or ShellWindows",
|
|
"sha256": "9c3c0848659cf6ee23a2450fed6a0492e2de6ef5758060587ab61c498f7a2a26",
|
|
"type": "eql",
|
|
"version": 105
|
|
},
|
|
"8fb75dda-c47a-4e34-8ecd-34facf7aad13": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "GCP Service Account Deletion",
|
|
"sha256": "3c8184358856969e1362e374b7c72a678a3df1dc9ae082111b0ba80d01a44dcb",
|
|
"type": "query",
|
|
"version": 104
|
|
},
|
|
"8fed8450-847e-43bd-874c-3bbf0cd425f3": {
|
|
"rule_name": "Linux Restricted Shell Breakout via apt/apt-get Changelog Escape",
|
|
"sha256": "7e88fe635274dd47f23d744bd4b8fb482ab86c8b1b6db9434d64ab40c7edbb62",
|
|
"type": "eql",
|
|
"version": 100
|
|
},
|
|
"90169566-2260-4824-b8e4-8615c3b4ed52": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Hping Process Activity",
|
|
"sha256": "74d72e7e3dd68055c5ee97e48e346ba23e5f097eab561f664ba954586941ca4b",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"9055ece6-2689-4224-a0e0-b04881e1f8ad": {
|
|
"min_stack_version": "8.9",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 204,
|
|
"rule_name": "AWS Deletion of RDS Instance or Cluster",
|
|
"sha256": "637b97f8e4d2c60b80d6427cd89d111d077543e2103cb3a96f9e35e577bd9caa",
|
|
"type": "query",
|
|
"version": 105
|
|
}
|
|
},
|
|
"rule_name": "AWS Deletion of RDS Instance or Cluster",
|
|
"sha256": "52ad2c61bc4217845afa6a13fe3e23cd405324f6bc6779b2ed3a21ecda615e14",
|
|
"type": "query",
|
|
"version": 205
|
|
},
|
|
"9092cd6c-650f-4fa3-8a8a-28256c7489c9": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Keychain Password Retrieval via Command Line",
|
|
"sha256": "7ff71544a593f40e8c7261a058bd9edd9c796f925043bb8c917fbdfab7137f94",
|
|
"type": "eql",
|
|
"version": 106
|
|
},
|
|
"90babaa8-5216-4568-992d-d4a01a105d98": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "InstallUtil Activity",
|
|
"sha256": "c1312553a07dda6fa6995c57f31922c18dbb00fe5becd831c6d1bb4246bad8c0",
|
|
"type": "eql",
|
|
"version": 1
|
|
},
|
|
"90e28af7-1d96-4582-bf11-9a1eff21d0e5": {
|
|
"rule_name": "Auditd Login Attempt at Forbidden Time",
|
|
"sha256": "0410b9e68a9f6e6086c24a72980f090d2a0e09ff9961adc13895613c2bb15cad",
|
|
"type": "query",
|
|
"version": 100
|
|
},
|
|
"9180ffdf-f3d0-4db3-bf66-7a14bcff71b8": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "GCP Virtual Private Cloud Route Creation",
|
|
"sha256": "ef3f13ea53f5eeca327dcdcd4a456b5375942dc90208cc6bced56c5c208eeb79",
|
|
"type": "query",
|
|
"version": 104
|
|
},
|
|
"91d04cd4-47a9-4334-ab14-084abe274d49": {
|
|
"min_stack_version": "8.9",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 204,
|
|
"rule_name": "AWS WAF Access Control List Deletion",
|
|
"sha256": "4d59ddb17973a139d9be0a601ce33dda6071ea802724f0bd0333d7db8722280c",
|
|
"type": "query",
|
|
"version": 105
|
|
}
|
|
},
|
|
"rule_name": "AWS WAF Access Control List Deletion",
|
|
"sha256": "ecd61bd19c50c09347fdf33fed3a2f8ec9fc77dec053398a5b62f534e297ebdb",
|
|
"type": "query",
|
|
"version": 205
|
|
},
|
|
"91f02f01-969f-4167-8d77-07827ac4cee0": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Unusual Web User Agent",
|
|
"sha256": "085e5fd9bc868b88d70882d6ff9ad8cd88277bde6a5536d032d204050b191347",
|
|
"type": "machine_learning",
|
|
"version": 103
|
|
},
|
|
"91f02f01-969f-4167-8f55-07827ac3acc9": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Unusual Web Request",
|
|
"sha256": "ca0f4d650120d7af5f5c1b882104229c33beac3e20991c9c22403a8a79b89ae1",
|
|
"type": "machine_learning",
|
|
"version": 103
|
|
},
|
|
"91f02f01-969f-4167-8f66-07827ac3bdd9": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "DNS Tunneling",
|
|
"sha256": "30ea79771106d5283bb2b93e9376e9b56ebb99c37ef021f485fdc2ea17c783ea",
|
|
"type": "machine_learning",
|
|
"version": 103
|
|
},
|
|
"92984446-aefb-4d5e-ad12-598042ca80ba": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "PowerShell Suspicious Script with Clipboard Retrieval Capabilities",
|
|
"sha256": "56cc019faadb8280664ecf10a42855016007af7f3413a2503ba3216c9b8307aa",
|
|
"type": "query",
|
|
"version": 7
|
|
},
|
|
"92a6faf5-78ec-4e25-bea1-73bacc9b59d9": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "A scheduled task was created",
|
|
"sha256": "d06b732a19959ac408573130e7312505731217a17ec0035068bf7769ab026484",
|
|
"type": "eql",
|
|
"version": 7
|
|
},
|
|
"93075852-b0f5-4b8b-89c3-a226efae5726": {
|
|
"min_stack_version": "8.9",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 204,
|
|
"rule_name": "AWS Security Token Service (STS) AssumeRole Usage",
|
|
"sha256": "2e6053408cd8709eca1ec8f67f1435cba0deae2486a175e0943f710e9ee4e2b3",
|
|
"type": "query",
|
|
"version": 105
|
|
}
|
|
},
|
|
"rule_name": "AWS Security Token Service (STS) AssumeRole Usage",
|
|
"sha256": "b0edd6d0742b92fa2ebe2c3d5ea02c63f8a1edffe0b0f53320b86ed419ab8fb8",
|
|
"type": "query",
|
|
"version": 205
|
|
},
|
|
"931e25a5-0f5e-4ae0-ba0d-9e94eff7e3a4": {
|
|
"min_stack_version": "8.6",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 202,
|
|
"rule_name": "Sudoers File Modification",
|
|
"sha256": "61b18d5eee007e352b11ee5d0b8cd560ef127b7ca4a6704381e1b1f0bfe6e1ef",
|
|
"type": "query",
|
|
"version": 103
|
|
}
|
|
},
|
|
"rule_name": "Sudoers File Modification",
|
|
"sha256": "6a1a6b3462c4ea5f0ea3cf546684745e51efb7a52a094227c5b2f06e6fa90bc3",
|
|
"type": "new_terms",
|
|
"version": 203
|
|
},
|
|
"9395fd2c-9947-4472-86ef-4aceb2f7e872": {
|
|
"min_stack_version": "8.9",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 207,
|
|
"rule_name": "AWS VPC Flow Logs Deletion",
|
|
"sha256": "f3c39ae72c93e6c08f938d780fc70f56119ce17eb3ef31cf7645331efed700c3",
|
|
"type": "query",
|
|
"version": 108
|
|
}
|
|
},
|
|
"rule_name": "AWS VPC Flow Logs Deletion",
|
|
"sha256": "408b41a86252884a996ece1031334c7b73d4870202ad4a65c1a74d5392ad3454",
|
|
"type": "query",
|
|
"version": 208
|
|
},
|
|
"93b22c0a-06a0-4131-b830-b10d5e166ff4": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Suspicious SolarWinds Child Process",
|
|
"sha256": "6b57124ee39f8300e5f18425933da9f3a453ac5c4b36f209412a6fe5dd615b60",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"93c1ce76-494c-4f01-8167-35edfb52f7b1": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Encoded Executable Stored in the Registry",
|
|
"sha256": "3ab5284a9f2ffdcbb1cc8acb795f4da54e219abbd241a58dd7a0797097d55f66",
|
|
"type": "eql",
|
|
"version": 105
|
|
},
|
|
"93e63c3e-4154-4fc6-9f86-b411e0987bbf": {
|
|
"min_stack_version": "8.4",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 202,
|
|
"rule_name": "Google Workspace Admin Role Deletion",
|
|
"sha256": "723578f77b081beb3b8a8da703208e1279aa15eba410de837d67b390c4334bbe",
|
|
"type": "query",
|
|
"version": 104
|
|
}
|
|
},
|
|
"rule_name": "Google Workspace Admin Role Deletion",
|
|
"sha256": "cab219f6e8b4ccaf91b7f6190f1d098c08ddc5b898d2e1566965ba6039a72657",
|
|
"type": "query",
|
|
"version": 205
|
|
},
|
|
"93f47b6f-5728-4004-ba00-625083b3dcb0": {
|
|
"min_stack_version": "8.6",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 203,
|
|
"rule_name": "Modification of Standard Authentication Module or Configuration",
|
|
"sha256": "db86c17797a8d52db5ea04999393ce5c37395cc6a46b34ec1cd0da3f02d0435f",
|
|
"type": "query",
|
|
"version": 104
|
|
}
|
|
},
|
|
"rule_name": "Modification of Standard Authentication Module or Configuration",
|
|
"sha256": "1e01d9186d48db4667fa030761b3f63e12f70737f7fb423eb05d385ad1e6db30",
|
|
"type": "new_terms",
|
|
"version": 204
|
|
},
|
|
"947827c6-9ed6-4dec-903e-c856c86e72f3": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Creation of Kernel Module",
|
|
"sha256": "fa5ba6a7b2e6d152888b0d7092c06b5ede38ccd92aafe335279b3db465ec2076",
|
|
"type": "eql",
|
|
"version": 2
|
|
},
|
|
"94a401ba-4fa2-455c-b7ae-b6e037afc0b7": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Group Policy Discovery via Microsoft GPResult Utility",
|
|
"sha256": "2bacdc3988548986c2dd070cd0e1df419868ab248ce0c6cb0a2749f274c044c2",
|
|
"type": "eql",
|
|
"version": 6
|
|
},
|
|
"9510add4-3392-11ed-bd01-f661ea17fbce": {
|
|
"min_stack_version": "8.4",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 103,
|
|
"rule_name": "Google Workspace Custom Gmail Route Created or Modified",
|
|
"sha256": "0c7bcbc73caec8df64f6e5d9c2430357baaef7371ef1f47b25b5f5bd7f6edf7f",
|
|
"type": "query",
|
|
"version": 5
|
|
}
|
|
},
|
|
"rule_name": "Google Workspace Custom Gmail Route Created or Modified",
|
|
"sha256": "13c2c8915478dad932a8b2375537e1960622c8dde7a6ac83375802a12c539fe1",
|
|
"type": "query",
|
|
"version": 106
|
|
},
|
|
"954ee7c8-5437-49ae-b2d6-2960883898e9": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Remote Scheduled Task Creation",
|
|
"sha256": "1df41e4a31085a0992f0810059addf6a2ad7525c1b132d8c8e5396bff9167837",
|
|
"type": "eql",
|
|
"version": 106
|
|
},
|
|
"959a7353-1129-4aa7-9084-30746b256a70": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "PowerShell Suspicious Script with Screenshot Capabilities",
|
|
"sha256": "e78782a0cdbd987aa3010fccef02313ff6034a0bd881b5c21e14d0e2697e512d",
|
|
"type": "query",
|
|
"version": 107
|
|
},
|
|
"9661ed8b-001c-40dc-a777-0983b7b0c91a": {
|
|
"min_stack_version": "8.8",
|
|
"rule_name": "Sensitive Keys Or Passwords Searched For Inside A Container",
|
|
"sha256": "54b3d3c9b093b147b2a9544592815de34c26f37b971ca155743f92fafcd674b9",
|
|
"type": "eql",
|
|
"version": 2
|
|
},
|
|
"968ccab9-da51-4a87-9ce2-d3c9782fd759": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "File made Immutable by Chattr",
|
|
"sha256": "c2ddd9f37a21375386f51998a552ce13bd1b9a8a140474192da60553fa322aba",
|
|
"type": "eql",
|
|
"version": 109
|
|
},
|
|
"96b9f4ea-0e8c-435b-8d53-2096e75fcac5": {
|
|
"min_stack_version": "8.10",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 204,
|
|
"rule_name": "Attempt to Create Okta API Token",
|
|
"sha256": "14b3f9e9b5e605ca66fa3d7115e312ba72ced80772e0d51928496be9202b6353",
|
|
"type": "query",
|
|
"version": 105
|
|
}
|
|
},
|
|
"rule_name": "Attempt to Create Okta API Token",
|
|
"sha256": "00e7844e7b50556df54dd1a80585ef3b0d6e18949813883d66e9467cd40a90f9",
|
|
"type": "query",
|
|
"version": 205
|
|
},
|
|
"96d11d31-9a79-480f-8401-da28b194608f": {
|
|
"min_stack_version": "8.6",
|
|
"rule_name": "Potential Persistence Through MOTD File Creation Detected",
|
|
"sha256": "a65b4ea716da6e7c3ff70fae5abd7b6618963ba8e8e6f089bcf2d264bce4f23f",
|
|
"type": "new_terms",
|
|
"version": 7
|
|
},
|
|
"96e90768-c3b7-4df6-b5d9-6237f8bc36a8": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Access to Keychain Credentials Directories",
|
|
"sha256": "360631a00947fd49eec1f1e5ec2234141c5e18b5d345f84d59ffdbfcf8022c22",
|
|
"type": "eql",
|
|
"version": 106
|
|
},
|
|
"97020e61-e591-4191-8a3b-2861a2b887cd": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "SeDebugPrivilege Enabled by a Suspicious Process",
|
|
"sha256": "6e8d2549a28b15014cb6b7629b580649e27bef8496ddb32de9b5181c9dc480e4",
|
|
"type": "eql",
|
|
"version": 5
|
|
},
|
|
"97314185-2568-4561-ae81-f3e480e5e695": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Microsoft 365 Exchange Anti-Phish Rule Modification",
|
|
"sha256": "5e3900d8aa0de4868a0980ccd44983433b4f857bddf099cf73275a57e5145c8f",
|
|
"type": "query",
|
|
"version": 102
|
|
},
|
|
"97359fd8-757d-4b1d-9af1-ef29e4a8680e": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "GCP Storage Bucket Configuration Modification",
|
|
"sha256": "8898fb2725e12947da9bb2c12a300e9093f6eef9c309b3ff30af48d018501dd6",
|
|
"type": "query",
|
|
"version": 104
|
|
},
|
|
"979729e7-0c52-4c4c-b71e-88103304a79f": {
|
|
"min_stack_version": "8.9",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 204,
|
|
"rule_name": "AWS SAML Activity",
|
|
"sha256": "5ccb2e9205c690a15eeb580f91fbced1746f6a12cd487ec983e1bdb8b5f7b33d",
|
|
"type": "query",
|
|
"version": 105
|
|
}
|
|
},
|
|
"rule_name": "AWS SAML Activity",
|
|
"sha256": "6205667e0b3ffc035feaf7ed17e089eb50ab5ff04926b74e65bb83f73d79af8d",
|
|
"type": "query",
|
|
"version": 205
|
|
},
|
|
"97a8e584-fd3b-421f-9b9d-9c9d9e57e9d7": {
|
|
"min_stack_version": "8.10",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 206,
|
|
"rule_name": "Potential Abuse of Repeated MFA Push Notifications",
|
|
"sha256": "c65175629b87978771837a807d4ff8b51d3ae081548603d49475754979b246b4",
|
|
"type": "eql",
|
|
"version": 107
|
|
}
|
|
},
|
|
"rule_name": "Potentially Successful MFA Bombing via Push Notifications",
|
|
"sha256": "b5fcc4e747c548c7f941007c4c619f12ac40c55649e2cb4c8fdf0cba578433ed",
|
|
"type": "eql",
|
|
"version": 209
|
|
},
|
|
"97aba1ef-6034-4bd3-8c1a-1e0996b27afa": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Suspicious Zoom Child Process",
|
|
"sha256": "f82a785c120d52dcd2123f3f9d2f8b7503d520c6ea8e46fd74f310e8a53dd233",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"97da359b-2b61-4a40-b2e4-8fc48cf7a294": {
|
|
"rule_name": "Linux Restricted Shell Breakout via the ssh command",
|
|
"sha256": "835d5b35a441dd1e3abf0c3d4d19ef86039404014b487b05f77cf84e3690073f",
|
|
"type": "eql",
|
|
"version": 100
|
|
},
|
|
"97db8b42-69d8-4bf3-9fd4-c69a1d895d68": {
|
|
"min_stack_version": "8.5",
|
|
"rule_name": "Suspicious Renaming of ESXI Files",
|
|
"sha256": "b87b60b05b9803f0259a56de2a7e627e99f798c1c705c13683be2ed8ce2cdfa0",
|
|
"type": "eql",
|
|
"version": 5
|
|
},
|
|
"97f22dab-84e8-409d-955e-dacd1d31670b": {
|
|
"rule_name": "Base64 Encoding/Decoding Activity",
|
|
"sha256": "86fb84d8b0d3b72763c1f25b159b87869dedc4bbea83405c178c095c7f2e66f3",
|
|
"type": "query",
|
|
"version": 100
|
|
},
|
|
"97fc44d3-8dae-4019-ae83-298c3015600f": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Startup or Run Key Registry Modification",
|
|
"sha256": "e35230136b3e8717e95ef5022b13c355c44d14666a14d564449b2982dfc27e9d",
|
|
"type": "eql",
|
|
"version": 109
|
|
},
|
|
"980b70a0-c820-11ed-8799-f661ea17fbcc": {
|
|
"min_stack_version": "8.4",
|
|
"rule_name": "Google Workspace Drive Encryption Key(s) Accessed from Anonymous User",
|
|
"sha256": "bca34a9cc93d913e9dd7b38378787f84bffb714c7a1ff0e76fe33c0b81cce627",
|
|
"type": "eql",
|
|
"version": 3
|
|
},
|
|
"98843d35-645e-4e66-9d6a-5049acd96ce1": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Indirect Command Execution via Forfiles/Pcalua",
|
|
"sha256": "c01ebbcea37de715c7c123e6eac64a6049906339a0d60bf1f146d677061bbea5",
|
|
"type": "eql",
|
|
"version": 1
|
|
},
|
|
"9890ee61-d061-403d-9bf6-64934c51f638": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "GCP IAM Service Account Key Deletion",
|
|
"sha256": "f6e73ab78ecb9bdcafce24cf4de95c3ad91c3b9f84ebde53d8a1184c1145cbff",
|
|
"type": "query",
|
|
"version": 104
|
|
},
|
|
"98995807-5b09-4e37-8a54-5cae5dc932d7": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Microsoft 365 Exchange Management Group Role Assignment",
|
|
"sha256": "a8d4e67d87194878313ca642bb0cfef0c9fc3750c6cf26a8b74eeac52d8a0c9e",
|
|
"type": "query",
|
|
"version": 102
|
|
},
|
|
"98fd7407-0bd5-5817-cda0-3fcc33113a56": {
|
|
"min_stack_version": "8.9",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 207,
|
|
"rule_name": "AWS EC2 Snapshot Activity",
|
|
"sha256": "ed1f4e4296f79824714df9f3010887d3ecd69c44ffbf728bed8d47197ea5e08e",
|
|
"type": "query",
|
|
"version": 108
|
|
}
|
|
},
|
|
"rule_name": "AWS EC2 Snapshot Activity",
|
|
"sha256": "3c5613df7cc89e9a173b0632a5db11d02b917f05f3c24cb3d44c416a679a4056",
|
|
"type": "query",
|
|
"version": 208
|
|
},
|
|
"990838aa-a953-4f3e-b3cb-6ddf7584de9e": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Process Injection - Prevented - Elastic Endgame",
|
|
"sha256": "6306143790d8722aa16246c98c608a9cd232df0e1686f9a92e6cd306e8ee7676",
|
|
"type": "query",
|
|
"version": 101
|
|
},
|
|
"99239e7d-b0d4-46e3-8609-acafcf99f68c": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "MacOS Installer Package Spawns Network Event",
|
|
"sha256": "3716f7ea4026fc8bb71aa2f326ddd6b6d1d47e6e120cf8b992ebdc2dd76ebb95",
|
|
"type": "eql",
|
|
"version": 105
|
|
},
|
|
"994e40aa-8c85-43de-825e-15f665375ee8": {
|
|
"min_stack_version": "8.9",
|
|
"rule_name": "Machine Learning Detected a Suspicious Windows Event with a High Malicious Probability Score",
|
|
"sha256": "e793c278c3154d2a7eb15afce2d4936fa72a471bdcdf6df479c3166fcaa95e48",
|
|
"type": "eql",
|
|
"version": 2
|
|
},
|
|
"9960432d-9b26-409f-972b-839a959e79e2": {
|
|
"min_stack_version": "8.8",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 205,
|
|
"rule_name": "Potential Credential Access via LSASS Memory Dump",
|
|
"sha256": "51227a6967396d84ff70c0b13a8a92fe16f45b0f6824b1cafb1b648ea5d5fddd",
|
|
"type": "eql",
|
|
"version": 106
|
|
}
|
|
},
|
|
"rule_name": "Potential Credential Access via LSASS Memory Dump",
|
|
"sha256": "7c1bfb7ad5929a367b5f379a7dddffadf5d05a96b023c46d9f9dfc0f65c293ff",
|
|
"type": "eql",
|
|
"version": 208
|
|
},
|
|
"99dcf974-6587-4f65-9252-d866a3fdfd9c": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Spike in Failed Logon Events",
|
|
"sha256": "1a2c14a7384dc942a3ff18edf7acc8a80867ba7213895616cb80e917fa985a6f",
|
|
"type": "machine_learning",
|
|
"version": 104
|
|
},
|
|
"9a1a2dae-0b5f-4c3d-8305-a268d404c306": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Endpoint Security",
|
|
"sha256": "8c02160e083a13d6519e4b952e3d3890879d81fb7b014cd29461f8c5e1e5dee4",
|
|
"type": "query",
|
|
"version": 102
|
|
},
|
|
"9a3884d0-282d-45ea-86ce-b9c81100f026": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Unsigned BITS Service Client Process",
|
|
"sha256": "095fc86e65f65030c66df81f286788b89fcf9160e7970ddbb409cc824fc40fd2",
|
|
"type": "eql",
|
|
"version": 1
|
|
},
|
|
"9a3a3689-8ed1-4cdb-83fb-9506db54c61f": {
|
|
"min_stack_version": "8.4",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 104,
|
|
"rule_name": "Potential Shadow File Read via Command Line Utilities",
|
|
"sha256": "956ccfb72b0b0545eedcac7869c1de45bcdc05490d5bf7c07da51f94442f4cf8",
|
|
"type": "eql",
|
|
"version": 6
|
|
}
|
|
},
|
|
"rule_name": "Potential Shadow File Read via Command Line Utilities",
|
|
"sha256": "25484718086d5b02486408a92befb4c3f5ad9114ca059168686f84ada6efb1c0",
|
|
"type": "new_terms",
|
|
"version": 108
|
|
},
|
|
"9a5b4e31-6cde-4295-9ff7-6be1b8567e1b": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Suspicious Explorer Child Process",
|
|
"sha256": "c3d174846da93503bc0c6e8bad7457d78fd6407edb3c26126d26f77f0cfa641c",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"9aa0e1f6-52ce-42e1-abb3-09657cee2698": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Scheduled Tasks AT Command Enabled",
|
|
"sha256": "61f8172cb58555796f4e21453eed4c63c104954b1dd8b0c1bc083e27d2cbb30c",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"9b343b62-d173-4cfd-bd8b-e6379f964ca4": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "GitHub Owner Role Granted To User",
|
|
"sha256": "a16bdb7510672df6f37801d5358499f1a79cde453022a2a3f424c450d519def1",
|
|
"type": "eql",
|
|
"version": 2
|
|
},
|
|
"9b6813a1-daf1-457e-b0e6-0bb4e55b8a4c": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Persistence via WMI Event Subscription",
|
|
"sha256": "01291523553fdba38e5d3c7f1d2a822a56c6fecf2ae5081e5a3fcdd6421a827c",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"9c260313-c811-4ec8-ab89-8f6530e0246c": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Hosts File Modified",
|
|
"sha256": "50338b66af75925ac6caab0efac8d88389c5fc35d36c0c79d9cf13e6c5216d4d",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"9c865691-5599-447a-bac9-b3f2df5f9a9d": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Remote Scheduled Task Creation via RPC",
|
|
"sha256": "22e8e1bb2a6a9366178e012e1811993b0ce5f79b27afc154f93ed760c6489f1e",
|
|
"type": "eql",
|
|
"version": 7
|
|
},
|
|
"9ccf3ce0-0057-440a-91f5-870c6ad39093": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Command Shell Activity Started via RunDLL32",
|
|
"sha256": "7c85cda2ba8c616a49ecb284a9667fff21227a2b0dab8e6841784917cb0f5528",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"9cf7a0ae-2404-11ed-ae7d-f661ea17fbce": {
|
|
"min_stack_version": "8.4",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 103,
|
|
"rule_name": "Google Workspace User Group Access Modified to Allow External Access",
|
|
"sha256": "4ca64be8b81634872abafdfb31ec9ad8ac4825ceb19369bc47a5f59f0cd15968",
|
|
"type": "query",
|
|
"version": 5
|
|
}
|
|
},
|
|
"rule_name": "Google Workspace User Group Access Modified to Allow External Access",
|
|
"sha256": "3de5e59006729a058c18b93a17cacead586bbf1a2893756ce0951d59aa5bfdfd",
|
|
"type": "query",
|
|
"version": 104
|
|
},
|
|
"9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae1": {
|
|
"rule_name": "Trusted Developer Application Usage",
|
|
"sha256": "01562e377ae2b4b0c607fb9d5776d0d78e0c2452bfd0ec90c08ff9f99499e349",
|
|
"type": "query",
|
|
"version": 100
|
|
},
|
|
"9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae2": {
|
|
"min_stack_version": "8.6",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 204,
|
|
"rule_name": "Microsoft Build Engine Started by a Script Process",
|
|
"sha256": "a7dda34610cf31fe8bd552ca7b1be438b979f718bba2f25c1bfbe2dcf6e399c2",
|
|
"type": "eql",
|
|
"version": 105
|
|
}
|
|
},
|
|
"rule_name": "Microsoft Build Engine Started by a Script Process",
|
|
"sha256": "49ff4c065b98857ff01ee88c9052d337d8e6a1c932b1e257d3a2022da734fa7f",
|
|
"type": "new_terms",
|
|
"version": 207
|
|
},
|
|
"9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae3": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Microsoft Build Engine Started by a System Process",
|
|
"sha256": "72663ce937cfe8297eab4c6f26dd8146c42d0a5c335c22dd556e6c6fda096a26",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae4": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Microsoft Build Engine Using an Alternate Name",
|
|
"sha256": "0d0e8c94d7ee081e8bc9cc4346749b06acc07871ad4b8e3506d6a50db76a8e8f",
|
|
"type": "eql",
|
|
"version": 110
|
|
},
|
|
"9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae5": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Credential Access via Trusted Developer Utility",
|
|
"sha256": "4cf250c89befd6b335e6331fbef794c1a969a7f19e203c159d5a84ff3c54f944",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae6": {
|
|
"min_stack_version": "8.6",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 205,
|
|
"rule_name": "Microsoft Build Engine Started an Unusual Process",
|
|
"sha256": "a31248c2a77ee248c66bc397338932837d26cb27e8d0fe2ecc59cb2fd6705d5d",
|
|
"type": "eql",
|
|
"version": 106
|
|
}
|
|
},
|
|
"rule_name": "Microsoft Build Engine Started an Unusual Process",
|
|
"sha256": "b6e512dc643a38fc0f3437b2ab9b8a2ab3d056ec85db592e39c41a9e5941c0a2",
|
|
"type": "new_terms",
|
|
"version": 208
|
|
},
|
|
"9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae9": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Process Injection by the Microsoft Build Engine",
|
|
"sha256": "b8d4e0bd773e95d96983fb5724ac1405de2f5d491182e453c4dad3af9efe10cd",
|
|
"type": "query",
|
|
"version": 105
|
|
},
|
|
"9d19ece6-c20e-481a-90c5-ccca596537de": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "LaunchDaemon Creation or Modification and Immediate Loading",
|
|
"sha256": "a96af71832577dd58427030d8213653dc4e553bed0e3edf06ad87c56ceef6c49",
|
|
"type": "eql",
|
|
"version": 105
|
|
},
|
|
"9d302377-d226-4e12-b54c-1906b5aec4f6": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Unusual Linux Process Calling the Metadata Service",
|
|
"sha256": "a8ec37b93c67426decc04bb1828dece6c21599efba58c2bcbdba4de0db24d7e5",
|
|
"type": "machine_learning",
|
|
"version": 103
|
|
},
|
|
"9f1c4ca3-44b5-481d-ba42-32dc215a2769": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Protocol Tunneling via EarthWorm",
|
|
"sha256": "fe83625174ae62ca10465c0894c0d81aa59d398c6afe266c565f6f6e18c6d027",
|
|
"type": "eql",
|
|
"version": 109
|
|
},
|
|
"9f962927-1a4f-45f3-a57b-287f2c7029c1": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Credential Access via DCSync",
|
|
"sha256": "ce811f22916b00b56a6bdde9eeaa631f6ccf08130ad18edfb552d0205424c5b1",
|
|
"type": "eql",
|
|
"version": 111
|
|
},
|
|
"9f9a2a82-93a8-4b1a-8778-1780895626d4": {
|
|
"min_stack_version": "8.6",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 205,
|
|
"rule_name": "File Permission Modification in Writable Directory",
|
|
"sha256": "6c93604ac3f7c4e56ba67f913a4b594887a31706b87f87c25ce6fe48e9608fc3",
|
|
"type": "eql",
|
|
"version": 106
|
|
}
|
|
},
|
|
"rule_name": "File Permission Modification in Writable Directory",
|
|
"sha256": "f9910945cb1925f34c18653ab7d5b0ab2d6ba8491db17ce29349b10dd5af8e4c",
|
|
"type": "new_terms",
|
|
"version": 207
|
|
},
|
|
"a00681e3-9ed6-447c-ab2c-be648821c622": {
|
|
"min_stack_version": "8.9",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 204,
|
|
"rule_name": "AWS Access Secret in Secrets Manager",
|
|
"sha256": "8a809b35c09aae82a1f066892fa5746325703203ff96d57019f0c0566dc602fe",
|
|
"type": "query",
|
|
"version": 106
|
|
},
|
|
"8.6": {
|
|
"max_allowable_version": 307,
|
|
"rule_name": "First Time Seen AWS Secret Value Accessed in Secrets Manager",
|
|
"sha256": "a470900ff108beb4fc2bd4b7b585eab94d9c4069ec2fdc41e3d7b241c6fd4263",
|
|
"type": "new_terms",
|
|
"version": 208
|
|
}
|
|
},
|
|
"rule_name": "First Time Seen AWS Secret Value Accessed in Secrets Manager",
|
|
"sha256": "7cd0da2ff3ffb5eb309da5e40ce09ddc719465d69413af21aaa59db60bf569ea",
|
|
"type": "new_terms",
|
|
"version": 308
|
|
},
|
|
"a02cb68e-7c93-48d1-93b2-2c39023308eb": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "A scheduled task was updated",
|
|
"sha256": "f72866c48ccae69c487c9485afbf8ca05fc67403d5bda38d738920206c830645",
|
|
"type": "eql",
|
|
"version": 8
|
|
},
|
|
"a0ddb77b-0318-41f0-91e4-8c1b5528834f": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Privilege Escalation via Python cap_setuid",
|
|
"sha256": "34d3a3910421f8e47718cb1b17c6aba5121961b5615a4efd54311a63be1e1996",
|
|
"type": "eql",
|
|
"version": 2
|
|
},
|
|
"a10d3d9d-0f65-48f1-8b25-af175e2594f5": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "GCP Pub/Sub Topic Creation",
|
|
"sha256": "d1f3342fcfc31b466666d2653d511406c8d7118d669a1c5a031be8300152cc93",
|
|
"type": "query",
|
|
"version": 105
|
|
},
|
|
"a13167f1-eec2-4015-9631-1fee60406dcf": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "InstallUtil Process Making Network Connections",
|
|
"sha256": "5b2271e8146d2aa236084a96b10d1b5a449f721404a7262dc44bde744bac37ec",
|
|
"type": "eql",
|
|
"version": 105
|
|
},
|
|
"a1329140-8de3-4445-9f87-908fb6d824f4": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "File Deletion via Shred",
|
|
"sha256": "afbf43fb0d4ed4dc316833240730da4201b617ea02e60983d0ae60fa628e4926",
|
|
"type": "query",
|
|
"version": 107
|
|
},
|
|
"a16612dd-b30e-4d41-86a0-ebe70974ec00": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential LSASS Clone Creation via PssCaptureSnapShot",
|
|
"sha256": "3ff59549bc7312fb3e7d7ad2ef2c07ffa133897254e66a01276691c4242bfa47",
|
|
"type": "eql",
|
|
"version": 105
|
|
},
|
|
"a1699af0-8e1e-4ed0-8ec1-89783538a061": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Windows Subsystem for Linux Distribution Installed",
|
|
"sha256": "824c61e43e5e5a716f7c86a9bae768ce4ad3d3da5d6151920028b34c4e163889",
|
|
"type": "eql",
|
|
"version": 5
|
|
},
|
|
"a17bcc91-297b-459b-b5ce-bc7460d8f82a": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "GCP Virtual Private Cloud Route Deletion",
|
|
"sha256": "5830a379ffe8c72546a1ff07b39d70c6d196815e08f8e584828c81640426aa99",
|
|
"type": "query",
|
|
"version": 104
|
|
},
|
|
"a198fbbd-9413-45ec-a269-47ae4ccf59ce": {
|
|
"min_stack_version": "8.7",
|
|
"rule_name": "My First Rule",
|
|
"sha256": "43d6a8a026423a6d83ae7d5ef0bed2a9cdf07d16f2c3c2f778c6634a42c06617",
|
|
"type": "threshold",
|
|
"version": 2
|
|
},
|
|
"a1a0375f-22c2-48c0-81a4-7c2d11cc6856": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Reverse Shell Activity via Terminal",
|
|
"sha256": "8f69f6ae427ea73eafb4cf848c309276fe9aca7580196ae73c4ab5c04f17f76d",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"a1c2589e-0c8c-4ca8-9eb6-f83c4bbdbe8f": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Linux Group Creation",
|
|
"sha256": "82a50a210890c906316f6d24693a3fc54e187dc59bfda67f20fee0bf8d3814e4",
|
|
"type": "eql",
|
|
"version": 3
|
|
},
|
|
"a22a09c2-2162-4df0-a356-9aacbeb56a04": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "DNS-over-HTTPS Enabled via Registry",
|
|
"sha256": "efe8131f73b131021b975ef3db9981aa32094d89390efd450ec9534e861bed51",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"a2795334-2499-11ed-9e1a-f661ea17fbce": {
|
|
"min_stack_version": "8.4",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 103,
|
|
"rule_name": "Google Workspace Restrictions for Google Marketplace Modified to Allow Any App",
|
|
"sha256": "337d1765f1495c27d1a5daf28740c34409d3a57bbf7be559211000d47dd66469",
|
|
"type": "query",
|
|
"version": 5
|
|
}
|
|
},
|
|
"rule_name": "Google Workspace Restrictions for Google Marketplace Modified to Allow Any App",
|
|
"sha256": "89b0c47b77b31a2b7c84dfe6195e371e6678e7153a116dd44c14e22eae50b16c",
|
|
"type": "query",
|
|
"version": 106
|
|
},
|
|
"a2d04374-187c-4fd9-b513-3ad4e7fdd67a": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "PowerShell Mailbox Collection Script",
|
|
"sha256": "3087ff625a0c9849ca67d67b189bdf8521aef5642122426e1c7503f7c6e0559d",
|
|
"type": "query",
|
|
"version": 6
|
|
},
|
|
"a3ea12f3-0d4e-4667-8b44-4230c63f3c75": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Execution via local SxS Shared Module",
|
|
"sha256": "afc5e36abc802e9089f1c9b9220fa3199749c285d95ab25286451b2cb0647fe0",
|
|
"type": "eql",
|
|
"version": 106
|
|
},
|
|
"a4c7473a-5cb4-4bc1-9d06-e4a75adbc494": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Windows Registry File Creation in SMB Share",
|
|
"sha256": "2022d77c3a450819dba114be131ab4d32b3cdcb7b5b4d5048884740fc9ffb12e",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"a4ec1382-4557-452b-89ba-e413b22ed4b8": {
|
|
"rule_name": "Network Connection via Mshta",
|
|
"sha256": "233377abf3f67401dc4208d28639241ca34ed38ba30aa4037251b1274fa5bd17",
|
|
"type": "eql",
|
|
"version": 100
|
|
},
|
|
"a52a9439-d52c-401c-be37-2785235c6547": {
|
|
"min_stack_version": "8.8",
|
|
"rule_name": "Netcat Listener Established Inside A Container",
|
|
"sha256": "8f9886fc92a4c69f14005790f8fdaab0b79bfd94930a6aaadc156c7b8a78e146",
|
|
"type": "eql",
|
|
"version": 2
|
|
},
|
|
"a5eb21b7-13cc-4b94-9fe2-29bb2914e037": {
|
|
"min_stack_version": "8.6",
|
|
"rule_name": "Potential Reverse Shell via UDP",
|
|
"sha256": "164f4808f9233c0316265e8ac731e74784cc410587f5710bdd9f8f72fff7c7c3",
|
|
"type": "eql",
|
|
"version": 4
|
|
},
|
|
"a5f0d057-d540-44f5-924d-c6a2ae92f045": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential SSH Brute Force Detected on Privileged Account",
|
|
"sha256": "38d14b033e79ccc9d9cf97555e15e5132aaa6d8ca72e05d65885ee7bcc2feb22",
|
|
"type": "eql",
|
|
"version": 5
|
|
},
|
|
"a60326d7-dca7-4fb7-93eb-1ca03a1febbd": {
|
|
"min_stack_version": "8.9",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 207,
|
|
"rule_name": "AWS IAM Assume Role Policy Update",
|
|
"sha256": "76387a6bb7b623af513d1e3379567e01c3efd70a0fbf651fb1361a6a3fb63075",
|
|
"type": "query",
|
|
"version": 108
|
|
}
|
|
},
|
|
"rule_name": "AWS IAM Assume Role Policy Update",
|
|
"sha256": "10f0e0afc0e8f51f1c37dc1a9885a33dd37e56c43f029b3c5865e4983baefb3a",
|
|
"type": "query",
|
|
"version": 208
|
|
},
|
|
"a605c51a-73ad-406d-bf3a-f24cc41d5c97": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Azure Active Directory PowerShell Sign-in",
|
|
"sha256": "d50d23ae4c7359047320934418d1041ff10666e02a6ed8bc287366745ae74372",
|
|
"type": "query",
|
|
"version": 105
|
|
},
|
|
"a61809f3-fb5b-465c-8bff-23a8a068ac60": {
|
|
"min_stack_version": "8.5",
|
|
"rule_name": "Threat Intel Windows Registry Indicator Match",
|
|
"sha256": "ad3072e4913ac770d5ec08abc3f4164ebaeadfceadf19007ec2c196a86be9022",
|
|
"type": "threat_match",
|
|
"version": 4
|
|
},
|
|
"a624863f-a70d-417f-a7d2-7a404638d47f": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Suspicious MS Office Child Process",
|
|
"sha256": "5aad9bb6f69714bb192aff73543dd6712d88a59758b870c26af66643e481fab7",
|
|
"type": "eql",
|
|
"version": 109
|
|
},
|
|
"a6bf4dd4-743e-4da8-8c03-3ebd753a6c90": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Emond Rules Creation or Modification",
|
|
"sha256": "9c88642e11a43c139d78492404690649488e23d89b508c7de31e65e235630a25",
|
|
"type": "eql",
|
|
"version": 106
|
|
},
|
|
"a74c60cb-70ee-4629-a127-608ead14ebf1": {
|
|
"min_stack_version": "8.9",
|
|
"rule_name": "High Mean of RDP Session Duration",
|
|
"sha256": "b5ff9202f928ffea90be6b05e0a028c6b37da1aeb007eeba5fb6a7f5f75c92b3",
|
|
"type": "machine_learning",
|
|
"version": 2
|
|
},
|
|
"a7ccae7b-9d2c-44b2-a061-98e5946971fa": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Suspicious Print Spooler SPL File Created",
|
|
"sha256": "39dc07aae00d71e5e210d726a51202807f31ce7e26afe10c19fb8a6d773e2537",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"a7e7bfa3-088e-4f13-b29e-3986e0e756b8": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Credential Acquisition via Registry Hive Dumping",
|
|
"sha256": "027498bcace88695c3b5e09df27735c8b2063701ea3b27328d0fb52f8c6533b7",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"a87a4e42-1d82-44bd-b0bf-d9b7f91fb89e": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Web Application Suspicious Activity: POST Request Declined",
|
|
"sha256": "ebfc9e780da093a1ff6bd51cae7eafadee5cf30f6044a85add7779f17d924a88",
|
|
"type": "query",
|
|
"version": 102
|
|
},
|
|
"a8afdce2-0ec1-11ee-b843-f661ea17fbcd": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Malicious File Downloaded from Google Drive",
|
|
"sha256": "7a0d22e648caa03cd127a00cad9baff4f242263c35d9ad59ab1c7a9fe46a321a",
|
|
"type": "eql",
|
|
"version": 2
|
|
},
|
|
"a8d35ca0-ad8d-48a9-9f6c-553622dca61a": {
|
|
"min_stack_version": "8.9",
|
|
"rule_name": "High Variance in RDP Session Duration",
|
|
"sha256": "ae52791c8f4a7d0173fa12bfe257b0386155b7776abe2fe91e4598c465460409",
|
|
"type": "machine_learning",
|
|
"version": 2
|
|
},
|
|
"a9198571-b135-4a76-b055-e3e5a476fd83": {
|
|
"rule_name": "Hex Encoding/Decoding Activity",
|
|
"sha256": "b6cfa5bf24a78049ee0f873fe01bcc14ef5116a6adf59b8721abeb11ceca01cf",
|
|
"type": "query",
|
|
"version": 100
|
|
},
|
|
"a989fa1b-9a11-4dd8-a3e9-f0de9c6eb5f2": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Microsoft 365 Exchange Safe Link Policy Disabled",
|
|
"sha256": "6414cc66c7c80d4240492b269f8c591d61734d2cec368c51642c367fcb0a0fda",
|
|
"type": "query",
|
|
"version": 102
|
|
},
|
|
"a99f82f5-8e77-4f8b-b3ce-10c0f6afbc73": {
|
|
"min_stack_version": "8.4",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 202,
|
|
"rule_name": "Google Workspace Password Policy Modified",
|
|
"sha256": "6b7426c4610c0d99417b08152597279e42d5e7fb9b2a510913b106dddafe7abb",
|
|
"type": "query",
|
|
"version": 104
|
|
}
|
|
},
|
|
"rule_name": "Google Workspace Password Policy Modified",
|
|
"sha256": "de0ced40cd29bb489ca1a27d785bb3d66ba4d0711f5d8d42268c9f8cab7c7df9",
|
|
"type": "query",
|
|
"version": 205
|
|
},
|
|
"a9b05c3b-b304-4bf9-970d-acdfaef2944c": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Persistence via Hidden Run Key Detected",
|
|
"sha256": "a4fa9c90990fb09a05cf7871a006a72eaebb98589699350427858c062146d05b",
|
|
"type": "eql",
|
|
"version": 106
|
|
},
|
|
"a9cb3641-ff4b-4cdc-a063-b4b8d02a67c7": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "IPSEC NAT Traversal Port Activity",
|
|
"sha256": "8dcd8a517f60e962d4ebf18984358abb4a22823f7b32a4e918d1aa3645fa0fee",
|
|
"type": "query",
|
|
"version": 104
|
|
},
|
|
"aa8007f0-d1df-49ef-8520-407857594827": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "GCP IAM Custom Role Creation",
|
|
"sha256": "46fafcee6069a185beb2d0fc77d3f39e53b9ec3412f9afdef0e7b642b48e296f",
|
|
"type": "query",
|
|
"version": 104
|
|
},
|
|
"aa895aea-b69c-4411-b110-8d7599634b30": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "System Log File Deletion",
|
|
"sha256": "13abacac9bff946a2754663dce57296eb4b411ca308e66b45f82112bec190bdb",
|
|
"type": "eql",
|
|
"version": 109
|
|
},
|
|
"aa9a274d-6b53-424d-ac5e-cb8ca4251650": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Remotely Started Services via RPC",
|
|
"sha256": "57036ece2d16588ff5db14cfef90686fb253e824740a435cd77099efb522ead8",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"aab184d3-72b3-4639-b242-6597c99d8bca": {
|
|
"min_stack_version": "8.5",
|
|
"rule_name": "Threat Intel Hash Indicator Match",
|
|
"sha256": "67453761dd40533419f89a508cf05c8bf7e992831ad5f324e18f2b3b19929e59",
|
|
"type": "threat_match",
|
|
"version": 5
|
|
},
|
|
"ab75c24b-2502-43a0-bf7c-e60e662c811e": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Remote Execution via File Shares",
|
|
"sha256": "d0dd83e403bca3f7f3d1950d5015f30d849b5fcd9227445946baf01306304def",
|
|
"type": "eql",
|
|
"version": 109
|
|
},
|
|
"abae61a8-c560-4dbd-acca-1e1438bff36b": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Unusual Windows Process Calling the Metadata Service",
|
|
"sha256": "ac1ddf7a6cff4d90ca970314e03ccc69c8b2c416130ed735e10bbaf12458ff51",
|
|
"type": "machine_learning",
|
|
"version": 103
|
|
},
|
|
"ac412404-57a5-476f-858f-4e8fbb4f48d8": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Persistence via Login Hook",
|
|
"sha256": "5431b29441b0311ce85f05817f1b65afc8e1440be98c43efc808531aceb55b40",
|
|
"type": "query",
|
|
"version": 106
|
|
},
|
|
"ac5012b8-8da8-440b-aaaf-aedafdea2dff": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Suspicious WerFault Child Process",
|
|
"sha256": "6db650fd26dc358bff1969f2dddd549f4725e7cb9e13c6037613103125d67d05",
|
|
"type": "eql",
|
|
"version": 110
|
|
},
|
|
"ac706eae-d5ec-4b14-b4fd-e8ba8086f0e1": {
|
|
"min_stack_version": "8.9",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 207,
|
|
"rule_name": "Unusual AWS Command for a User",
|
|
"sha256": "9f57306030e5ba60d653be67aa9384950045aa7df06b096ce123ae72771cd11a",
|
|
"type": "machine_learning",
|
|
"version": 108
|
|
}
|
|
},
|
|
"rule_name": "Unusual AWS Command for a User",
|
|
"sha256": "17d74013b573ef431a61391d055df4a9ab5851741a17e466a651c3a1f13efb49",
|
|
"type": "machine_learning",
|
|
"version": 208
|
|
},
|
|
"ac8805f6-1e08-406c-962e-3937057fa86f": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Protocol Tunneling via Chisel Server",
|
|
"sha256": "8c1fcd1ccc01b7c092eac3e49fb246f3f883093d07485ca2528b0212e66d1421",
|
|
"type": "eql",
|
|
"version": 4
|
|
},
|
|
"ac96ceb8-4399-4191-af1d-4feeac1f1f46": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Invoke-Mimikatz PowerShell Script",
|
|
"sha256": "f9fa4733a750754f6f49fbaeaf98e2523d57e77e5daba2e13bfc9c2d201f92aa",
|
|
"type": "query",
|
|
"version": 107
|
|
},
|
|
"acbc8bb9-2486-49a8-8779-45fb5f9a93ee": {
|
|
"min_stack_version": "8.4",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 202,
|
|
"rule_name": "Google Workspace API Access Granted via Domain-Wide Delegation of Authority",
|
|
"sha256": "9977bfb82687f6ee557f2f9474b1cac3eb4b8c16af795908ef9b4a20ab600653",
|
|
"type": "query",
|
|
"version": 104
|
|
}
|
|
},
|
|
"rule_name": "Google Workspace API Access Granted via Domain-Wide Delegation of Authority",
|
|
"sha256": "dff7c67640bd01423d897e090d914f6661f2ccbd00d363315a58d011cac71b65",
|
|
"type": "query",
|
|
"version": 205
|
|
},
|
|
"acd611f3-2b93-47b3-a0a3-7723bcc46f6d": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Command and Control via Internet Explorer",
|
|
"sha256": "abc48431a5b42f5096e7d24ebd4ce9ce57b8f5f4f0edfbfb43583d71546b3e44",
|
|
"type": "eql",
|
|
"version": 104
|
|
},
|
|
"ace1e989-a541-44df-93a8-a8b0591b63c0": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential macOS SSH Brute Force Detected",
|
|
"sha256": "717b98ebd28d44eb41e239b4c1fce9a077b804fb2fa74887e44db8abf8a9d984",
|
|
"type": "threshold",
|
|
"version": 106
|
|
},
|
|
"acf738b5-b5b2-4acc-bad9-1e18ee234f40": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Suspicious Managed Code Hosting Process",
|
|
"sha256": "0a533f32c8d5462d986ae942d838d8fba2be5f9d9d777acbf61864a1fda4b275",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"ad0d2742-9a49-11ec-8d6b-acde48001122": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Signed Proxy Execution via MS Work Folders",
|
|
"sha256": "aab56ec768cc094769d54446314b0acd0757ae4db3a9da69e5099246b4710246",
|
|
"type": "eql",
|
|
"version": 106
|
|
},
|
|
"ad0e5e75-dd89-4875-8d0a-dfdc1828b5f3": {
|
|
"rule_name": "Proxy Port Activity to the Internet",
|
|
"sha256": "b6ebab2e583cd3bf78d4951f8718ff88b6bbea6dfd4004c586ce00a703ec0a10",
|
|
"type": "query",
|
|
"version": 100
|
|
},
|
|
"ad3f2807-2b3e-47d7-b282-f84acbbe14be": {
|
|
"min_stack_version": "8.4",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 202,
|
|
"rule_name": "Google Workspace Custom Admin Role Created",
|
|
"sha256": "e28b9f491eae0c8a606f9d315389ac4a117e5d30674f8e4f4e1d3be16bc8d9c4",
|
|
"type": "query",
|
|
"version": 104
|
|
}
|
|
},
|
|
"rule_name": "Google Workspace Custom Admin Role Created",
|
|
"sha256": "d1699c4738c1bd1387584e6a38c367c2f869b0045f7b6e2c635535f2dded6307",
|
|
"type": "query",
|
|
"version": 205
|
|
},
|
|
"ad84d445-b1ce-4377-82d9-7c633f28bf9a": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Suspicious Portable Executable Encoded in Powershell Script",
|
|
"sha256": "ece2a16a9368d49618c91e7029dec21e11078bc4c3f43049efcc7a83009a327c",
|
|
"type": "query",
|
|
"version": 109
|
|
},
|
|
"ad88231f-e2ab-491c-8fc6-64746da26cfe": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Kerberos Cached Credentials Dumping",
|
|
"sha256": "a1d0802a3a49d1a2c58175fb38e49b393c12892b0263bc10245b307ccec0d964",
|
|
"type": "query",
|
|
"version": 105
|
|
},
|
|
"adb961e0-cb74-42a0-af9e-29fc41f88f5f": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "File Transfer or Listener Established via Netcat",
|
|
"sha256": "20f29e024f8e2c4bfc4ab6a034eae6d65d6ea9e12e66e31fef4166c5db5a2ae4",
|
|
"type": "eql",
|
|
"version": 109
|
|
},
|
|
"adbfa3ee-777e-4747-b6b0-7bd645f30880": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Suspicious Communication App Child Process",
|
|
"sha256": "0e8ff7a50a23c7b9726e3fce8b74834754c75e9cc4bee21fddbb73b9acde9c43",
|
|
"type": "eql",
|
|
"version": 2
|
|
},
|
|
"ae343298-97bc-47bc-9ea2-5f2ad831c16e": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Suspicious File Creation via Kworker",
|
|
"sha256": "4d4e79da63198cef34c6daa28263e65a117d300b3526620cda6075a9a6532a45",
|
|
"type": "eql",
|
|
"version": 1
|
|
},
|
|
"ae8a142c-6a1d-4918-bea7-0b617e99ecfa": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Suspicious Execution via Microsoft Office Add-Ins",
|
|
"sha256": "a332e02143efbab6ecaf181c31cf786213bf5fa96f20b0248162df6cd92552ab",
|
|
"type": "eql",
|
|
"version": 3
|
|
},
|
|
"aebaa51f-2a91-4f6a-850b-b601db2293f4": {
|
|
"min_stack_version": "8.6",
|
|
"rule_name": "Shared Object Created or Changed by Previously Unknown Process",
|
|
"sha256": "93e731444b08dd8f1dbc6e88f457ee9aacbf61c1f988464f84cf5db0e056ff51",
|
|
"type": "new_terms",
|
|
"version": 5
|
|
},
|
|
"afa135c0-a365-43ab-aa35-fd86df314a47": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Unusual User Privilege Enumeration via id",
|
|
"sha256": "61d1e232e65d235e74fb2f09d2e3448d548edebd7ed582d6304475ea93299e0d",
|
|
"type": "eql",
|
|
"version": 3
|
|
},
|
|
"afcce5ad-65de-4ed2-8516-5e093d3ac99a": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Local Scheduled Task Creation",
|
|
"sha256": "4affb2391184f7f15ecce386a97e00cbad45ccfc2b853a118c89fdbe6fc192b0",
|
|
"type": "eql",
|
|
"version": 105
|
|
},
|
|
"afd04601-12fc-4149-9b78-9c3f8fe45d39": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Network Activity Detected via cat",
|
|
"sha256": "d8ce7ce1d50539e7b9b135a7463c03309cee47dba07797c4c9a4198edb10e223",
|
|
"type": "eql",
|
|
"version": 4
|
|
},
|
|
"afe6b0eb-dd9d-4922-b08a-1910124d524d": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Privilege Escalation via Container Misconfiguration",
|
|
"sha256": "b3876016cbc0e3a82a911ae80577053bb2c945e539ccb227a3ae520814c476ef",
|
|
"type": "eql",
|
|
"version": 4
|
|
},
|
|
"b0046934-486e-462f-9487-0d4cf9e429c6": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Timestomping using Touch Command",
|
|
"sha256": "2079a604f3faff6cc6b6b781db98c42700096fb46d6944292c62c13c01a7810a",
|
|
"type": "eql",
|
|
"version": 104
|
|
},
|
|
"b00bcd89-000c-4425-b94c-716ef67762f6": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "TCC Bypass via Mounted APFS Snapshot Access",
|
|
"sha256": "b919ec7747f8bf3d3a989dbb2894552ecf9eee7139899e68b404a3802c120c3d",
|
|
"type": "query",
|
|
"version": 105
|
|
},
|
|
"b0638186-4f12-48ac-83d2-47e686d08e82": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Netsh Helper DLL",
|
|
"sha256": "a6bceece7403f9bb47478cdb04702271892ebffa4ae4251220da5abbdae44f2b",
|
|
"type": "eql",
|
|
"version": 1
|
|
},
|
|
"b1c14366-f4f8-49a0-bcbb-51d2de8b0bb8": {
|
|
"rule_name": "Potential Persistence via Cron Job",
|
|
"sha256": "0c030fdda99d067a509f80bd3faff91ee4d8414e5074a9ef6cf7bf5fc97fcbed",
|
|
"type": "query",
|
|
"version": 100
|
|
},
|
|
"b2318c71-5959-469a-a3ce-3a0768e63b9c": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Network Share Discovery",
|
|
"sha256": "eb213dc86c103363dad386e08221252c0d865f53b002b17fe09c36adb6631ec5",
|
|
"type": "eql",
|
|
"version": 2
|
|
},
|
|
"b240bfb8-26b7-4e5e-924e-218144a3fa71": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Spike in Network Traffic",
|
|
"sha256": "36d61f7dbb342836f5db53ce1a06141cecfee9ba6d09cbb69983df79202257e6",
|
|
"type": "machine_learning",
|
|
"version": 103
|
|
},
|
|
"b25a7df2-120a-4db2-bd3f-3e4b86b24bee": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Remote File Copy via TeamViewer",
|
|
"sha256": "e726cfbb1046391cb001954a90288d5b3222d8379b5ae13d58b6e6bc20aec033",
|
|
"type": "eql",
|
|
"version": 109
|
|
},
|
|
"b2951150-658f-4a60-832f-a00d1e6c6745": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Microsoft 365 Unusual Volume of File Deletion",
|
|
"sha256": "0e2607bb68d167a217bd28be737c707eb6729cb8c449efd2f3c45064ba35fb07",
|
|
"type": "query",
|
|
"version": 102
|
|
},
|
|
"b29ee2be-bf99-446c-ab1a-2dc0183394b8": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Network Connection via Compiled HTML File",
|
|
"sha256": "dae5acefb06a64476ec330f3a9e199d0829f858f37e1a80b9f611ae9ecf0a42f",
|
|
"type": "eql",
|
|
"version": 105
|
|
},
|
|
"b347b919-665f-4aac-b9e8-68369bf2340c": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Unusual Linux Username",
|
|
"sha256": "fe769843cd4082749444ae077951c9a8e2bfe4d74ba57fd091eacee470975016",
|
|
"type": "machine_learning",
|
|
"version": 103
|
|
},
|
|
"b41a13c6-ba45-4bab-a534-df53d0cfed6a": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Suspicious Endpoint Security Parent Process",
|
|
"sha256": "1febba999144c11d4eda1df90ed6dea43965b2967e98e431fd00fd7678d5f6ab",
|
|
"type": "eql",
|
|
"version": 109
|
|
},
|
|
"b43570de-a908-4f7f-8bdb-b2df6ffd8c80": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Code Signing Policy Modification Through Built-in tools",
|
|
"sha256": "cf799c7c2e95e99b29012536ac50ca736dbaaa029b937b73985d8f4b31b30e9c",
|
|
"type": "eql",
|
|
"version": 5
|
|
},
|
|
"b4449455-f986-4b5a-82ed-e36b129331f7": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Persistence via Atom Init Script Modification",
|
|
"sha256": "c663140ba0d75027a34b394dec5c86633102e0f2514050f99e1d706c97cb9b8e",
|
|
"type": "query",
|
|
"version": 105
|
|
},
|
|
"b45ab1d2-712f-4f01-a751-df3826969807": {
|
|
"min_stack_version": "8.9",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 204,
|
|
"rule_name": "AWS STS GetSessionToken Abuse",
|
|
"sha256": "270622c32893a7ed8bb7c39017bb09133147e3b8af1c8844d93f0150447134ba",
|
|
"type": "query",
|
|
"version": 105
|
|
}
|
|
},
|
|
"rule_name": "AWS STS GetSessionToken Abuse",
|
|
"sha256": "1382976ef19290c1857b535d15facff537acd5d5a33e5575372bef70ba4c9090",
|
|
"type": "query",
|
|
"version": 205
|
|
},
|
|
"b483365c-98a8-40c0-92d8-0458ca25058a": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "At.exe Command Lateral Movement",
|
|
"sha256": "dd7f70787fff06dbfcdc2556f504ad62feda00ed2e1fa5d7effab3a1be31482f",
|
|
"type": "eql",
|
|
"version": 2
|
|
},
|
|
"b4bb1440-0fcb-4ed1-87e5-b06d58efc5e9": {
|
|
"min_stack_version": "8.10",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 205,
|
|
"rule_name": "Attempt to Delete an Okta Policy",
|
|
"sha256": "c3fda77e2d67870f675065527fb363156e723e6bc1090d9bdda28d930d7f3d04",
|
|
"type": "query",
|
|
"version": 106
|
|
}
|
|
},
|
|
"rule_name": "Attempt to Delete an Okta Policy",
|
|
"sha256": "614c1c668c20b47ea3131ada30c8e3553492804e1a59c5580715f70c757d07b6",
|
|
"type": "query",
|
|
"version": 206
|
|
},
|
|
"b51dbc92-84e2-4af1-ba47-65183fcd0c57": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Privilege Escalation via OverlayFS",
|
|
"sha256": "03a4f6b34b5dd327671e71297f46ad0cedca4be702f6d4e86c8bd886bf03f510",
|
|
"type": "eql",
|
|
"version": 4
|
|
},
|
|
"b5877334-677f-4fb9-86d5-a9721274223b": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Clearing Windows Console History",
|
|
"sha256": "3887ad885e0ebf5e37828d1e8dde4d5183e83f831a2a4c6c6d00a77cb3d15e0c",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"b5ea4bfe-a1b2-421f-9d47-22a75a6f2921": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Volume Shadow Copy Deleted or Resized via VssAdmin",
|
|
"sha256": "ca11a431744e13425dc24b1f98000a04346735be332e41061ba730bbcf3eee37",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"b627cd12-dac4-11ec-9582-f661ea17fbcd": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Elastic Agent Service Terminated",
|
|
"sha256": "36bd8dcc31b17a81b4108c6de71cf9eda443039b95e0c299255c8a89f2e8499f",
|
|
"type": "eql",
|
|
"version": 105
|
|
},
|
|
"b64b183e-1a76-422d-9179-7b389513e74d": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Windows Script Interpreter Executing Process via WMI",
|
|
"sha256": "9fbd1c201afd94da2c21d31f6797a87f96380d6cb42df20af7ad7205ffcd05ac",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"b6dce542-2b75-4ffb-b7d6-38787298ba9d": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Azure Event Hub Authorization Rule Created or Updated",
|
|
"sha256": "a4d9380d9e964e50c7845854fa02ca808976bf2d52c4cb73dd90ed4e9439ae09",
|
|
"type": "query",
|
|
"version": 103
|
|
},
|
|
"b719a170-3bdb-4141-b0e3-13e3cf627bfe": {
|
|
"min_stack_version": "8.10",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 205,
|
|
"rule_name": "Attempt to Deactivate an Okta Policy",
|
|
"sha256": "48e769c5aedb715bdbc0f990b68ced02323c1eef17b02595550b368f66a3c9c8",
|
|
"type": "query",
|
|
"version": 106
|
|
}
|
|
},
|
|
"rule_name": "Attempt to Deactivate an Okta Policy",
|
|
"sha256": "6a65ec96ad5423adc711dfec4c404f2e552f894f68eaa80a1f242d64218bbdc6",
|
|
"type": "query",
|
|
"version": 206
|
|
},
|
|
"b8075894-0b62-46e5-977c-31275da34419": {
|
|
"min_stack_version": "8.10",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 204,
|
|
"rule_name": "Administrator Privileges Assigned to an Okta Group",
|
|
"sha256": "8d9fe19feb7f250c14755465615f7a3fb4f831e20ba19b6ba0eeec6637d056e3",
|
|
"type": "query",
|
|
"version": 105
|
|
}
|
|
},
|
|
"rule_name": "Administrator Privileges Assigned to an Okta Group",
|
|
"sha256": "1177bae4785512b7c84e85287f4a1e6555c016a06a1a91407ee74cee2c622ae3",
|
|
"type": "query",
|
|
"version": 205
|
|
},
|
|
"b81bd314-db5b-4d97-82e8-88e3e5fc9de5": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Linux System Information Discovery",
|
|
"sha256": "0d6d405de797c6c80d2fbc4e4771ff74da4fcec8ef4672510e7906fd491f0185",
|
|
"type": "eql",
|
|
"version": 2
|
|
},
|
|
"b8386923-b02c-4b94-986a-d223d9b01f88": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "PowerShell Invoke-NinjaCopy script",
|
|
"sha256": "cb088aadbdd5bf616c55df2573347384815144c281ffc822045be2119b8568c7",
|
|
"type": "query",
|
|
"version": 4
|
|
},
|
|
"b83a7e96-2eb3-4edf-8346-427b6858d3bd": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Creation or Modification of Domain Backup DPAPI private key",
|
|
"sha256": "d902ba9e2e987d47b2388ca3a51d868c1807f2d5e0b5aa7dfc634c448c664986",
|
|
"type": "eql",
|
|
"version": 106
|
|
},
|
|
"b86afe07-0d98-4738-b15d-8d7465f95ff5": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Network Connection via MsXsl",
|
|
"sha256": "674552a858e0c108bede8311d70e4461a8f06e600ceccbe2ca598e97a67d2d8d",
|
|
"type": "eql",
|
|
"version": 104
|
|
},
|
|
"b8f8da2d-a9dc-48c0-90e4-955c0aa1259a": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Kirbi File Creation",
|
|
"sha256": "34a4c6af4a0abec4b49761fd3410e7ce843a7cd917929009de084283086d34f2",
|
|
"type": "eql",
|
|
"version": 2
|
|
},
|
|
"b90cdde7-7e0d-4359-8bf0-2c112ce2008a": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "UAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface",
|
|
"sha256": "4ae1fadfcda3b3eb16cd5ce038f967736e4b625bbc9a7296f347615d21d7725c",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"b910f25a-2d44-47f2-a873-aabdc0d355e6": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Chkconfig Service Add",
|
|
"sha256": "c6ecd8ef206d0f32e3bc9b72cf1a808affd09aa72bd8443c3a359bf000480e3f",
|
|
"type": "eql",
|
|
"version": 109
|
|
},
|
|
"b92d5eae-70bb-4b66-be27-f98ba9d0ccdc": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Discovery of Domain Groups",
|
|
"sha256": "da6f8b65c43fe10336ad0774d7a19fd888def6e0dea1c94eceab12afc0e3fde4",
|
|
"type": "eql",
|
|
"version": 1
|
|
},
|
|
"b946c2f7-df06-4c00-a5aa-1f6fbc7bb72c": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Multiple Alerts in Different ATT&CK Tactics on a Single Host",
|
|
"sha256": "b83cfd125f81b6526b23aac2a53cc883827934288f3bb4ae9a000c705c69cd7c",
|
|
"type": "threshold",
|
|
"version": 4
|
|
},
|
|
"b9554892-5e0e-424b-83a0-5aef95aa43bf": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Group Policy Abuse for Privilege Addition",
|
|
"sha256": "e7702b1cb759c6daf40a6f3464d984e9b0b59eb02c5ef8a4b805abddc598d678",
|
|
"type": "query",
|
|
"version": 108
|
|
},
|
|
"b9666521-4742-49ce-9ddc-b8e84c35acae": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Creation of Hidden Files and Directories via CommandLine",
|
|
"sha256": "b62ce757409f5b83483a6178edf83f96ca9f2694c59261960462d1d5aa5c823e",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"b9960fef-82c6-4816-befa-44745030e917": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "SolarWinds Process Disabling Services via Registry",
|
|
"sha256": "268cf591802efa58ca8ccc81f92c143605f8684dccee5d40e37775cc905c1ff5",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"ba342eb2-583c-439f-b04d-1fdd7c1417cc": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Unusual Windows Network Activity",
|
|
"sha256": "061e957d07cb102889f0ff1a1f4fa80b4f22eeefc5aad74fd2544ccf0852d5ad",
|
|
"type": "machine_learning",
|
|
"version": 103
|
|
},
|
|
"baa5d22c-5e1c-4f33-bfc9-efa73bb53022": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Suspicious Image Load (taskschd.dll) from MS Office",
|
|
"sha256": "8942d1f095059286fecf8c197b44e975598fc9beee88d0e296402f027b3c4e35",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"bb4fe8d2-7ae2-475c-8b5d-55b449e4264f": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Azure Resource Group Deletion",
|
|
"sha256": "d6e81ca3325b8461c497b7a0edcb7ba2a438aaadc2af98f490696891126c3576",
|
|
"type": "query",
|
|
"version": 102
|
|
},
|
|
"bb9b13b2-1700-48a8-a750-b43b0a72ab69": {
|
|
"min_stack_version": "8.9",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 204,
|
|
"rule_name": "AWS EC2 Encryption Disabled",
|
|
"sha256": "2e9848fe420de87afde4a086d63bb5d02bb91f3da348bd0eed54b6f7993a85cd",
|
|
"type": "query",
|
|
"version": 105
|
|
}
|
|
},
|
|
"rule_name": "AWS EC2 Encryption Disabled",
|
|
"sha256": "60c1a7d5d2cd24c909689b37015df4508b993bdd925b050e1b45df21a23479ba",
|
|
"type": "query",
|
|
"version": 205
|
|
},
|
|
"bba1b212-b85c-41c6-9b28-be0e5cdfc9b1": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "OneDrive Malware File Upload",
|
|
"sha256": "4f273dae13ee4bb9564a60c6771439fc10cd7f3357de2aa65839ff10d4cde814",
|
|
"type": "query",
|
|
"version": 102
|
|
},
|
|
"bbaa96b9-f36c-4898-ace2-581acb00a409": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential SYN-Based Network Scan Detected",
|
|
"sha256": "2425bfd3bc54bb802d2646cf30575b92b6de9f1768145e593f3640a9ed1ba450",
|
|
"type": "threshold",
|
|
"version": 4
|
|
},
|
|
"bbd1a775-8267-41fa-9232-20e5582596ac": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Microsoft 365 Teams Custom Application Interaction Allowed",
|
|
"sha256": "f4f0da241f45040111a47879928011d3b90da922010348154b5cb1c44d2f24ee",
|
|
"type": "query",
|
|
"version": 103
|
|
},
|
|
"bc0c6f0d-dab0-47a3-b135-0925f0a333bc": {
|
|
"min_stack_version": "8.9",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 207,
|
|
"rule_name": "AWS Root Login Without MFA",
|
|
"sha256": "40f1b53ce3bb3464e8d8bbad167820d4d5b70e24358eef7c18c72fcdaf161f26",
|
|
"type": "query",
|
|
"version": 108
|
|
}
|
|
},
|
|
"rule_name": "AWS Root Login Without MFA",
|
|
"sha256": "8f967af66ccd21f236403f460e274db15d0dab8e769626d091f26ddba123de07",
|
|
"type": "query",
|
|
"version": 208
|
|
},
|
|
"bc0f2d83-32b8-4ae2-b0e6-6a45772e9331": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "GCP Storage Bucket Deletion",
|
|
"sha256": "56e79003e4ad65163eb8f9aaf96239590b6a756222a60be2d8115a39b4c1a54d",
|
|
"type": "query",
|
|
"version": 104
|
|
},
|
|
"bc1eeacf-2972-434f-b782-3a532b100d67": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Attempt to Install Root Certificate",
|
|
"sha256": "7f461bbff1e8be89e57d400d6e907b6697dbc783dae396c6d6ee0ce3efd419f1",
|
|
"type": "query",
|
|
"version": 105
|
|
},
|
|
"bc48bba7-4a23-4232-b551-eca3ca1e3f20": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Azure Conditional Access Policy Modified",
|
|
"sha256": "cfacc3ddc30a65458618914bcd492cf9fbb25d104b2271afdb3ff3fef7bf0c0c",
|
|
"type": "query",
|
|
"version": 102
|
|
},
|
|
"bc8ca7e0-92fd-4b7c-b11e-ee0266b8d9c9": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Non-Standard Port SSH connection",
|
|
"sha256": "68365d0090a647d05f3396ace9d86f2c79f607bef610741ce9c4240ccfa0de26",
|
|
"type": "eql",
|
|
"version": 5
|
|
},
|
|
"bc9e4f5a-e263-4213-a2ac-1edf9b417ada": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "File and Directory Permissions Modification",
|
|
"sha256": "cd8d1d1e784ddc62a5db564994d9192996555133c9273a6f1b4384a76249ec0e",
|
|
"type": "eql",
|
|
"version": 1
|
|
},
|
|
"bca7d28e-4a48-47b1-adb7-5074310e9a61": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "GCP Service Account Disabled",
|
|
"sha256": "10252c6946a904bb799ac153943817d274319179587022f10240f3e65af79ace",
|
|
"type": "query",
|
|
"version": 104
|
|
},
|
|
"bcaa15ce-2d41-44d7-a322-918f9db77766": {
|
|
"min_stack_version": "8.9",
|
|
"rule_name": "Machine Learning Detected DGA activity using a known SUNBURST DNS domain",
|
|
"sha256": "f5220068a8eeba34ffc00f96b7aa3a8eebafc48bce2354524c3079da13b3e96a",
|
|
"type": "query",
|
|
"version": 2
|
|
},
|
|
"bd2c86a0-8b61-4457-ab38-96943984e889": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "PowerShell Keylogging Script",
|
|
"sha256": "fa1f00b9443c5ad654f7b853629f4075bf14005339a418325a786b9efeba54ad",
|
|
"type": "query",
|
|
"version": 111
|
|
},
|
|
"bd3d058d-5405-4cee-b890-337f09366ba2": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Defense Evasion via CMSTP.exe",
|
|
"sha256": "b31ac8c754822d3baf70384a75f0a66fc861ddb3ce0a3f8c40474fb161ea8306",
|
|
"type": "eql",
|
|
"version": 1
|
|
},
|
|
"bd7eefee-f671-494e-98df-f01daf9e5f17": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Suspicious Print Spooler Point and Print DLL",
|
|
"sha256": "4c15aa93333df41d25b1da7384c925b4d5277eb5694fbb8f7d8f7c794143ef0d",
|
|
"type": "eql",
|
|
"version": 104
|
|
},
|
|
"bdb04043-f0e3-4efa-bdee-7d9d13fa9edc": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Pspy Process Monitoring Detected",
|
|
"sha256": "a104d57c93d224bbb66c4c3ec0155970728973744f4f6e5f064a97439c0e12ca",
|
|
"type": "eql",
|
|
"version": 5
|
|
},
|
|
"bdcf646b-08d4-492c-870a-6c04e3700034": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Privileged Escalation via SamAccountName Spoofing",
|
|
"sha256": "46222aa552fbb0eb3445b6863d48086e14b83f540e63bf7f048bf0e645855756",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"bdfebe11-e169-42e3-b344-c5d2015533d3": {
|
|
"min_stack_version": "8.9",
|
|
"rule_name": "Suspicious Windows Process Cluster Spawned by a Host",
|
|
"sha256": "bfa8f71657fbb8749cf4f5f600a359722956bfa318207c2220ea634fc7403c4e",
|
|
"type": "machine_learning",
|
|
"version": 2
|
|
},
|
|
"be4c5aed-90f5-4221-8bd5-7ab3a4334751": {
|
|
"min_stack_version": "8.9",
|
|
"rule_name": "Unusual Remote File Directory",
|
|
"sha256": "679d1d5d3c635ce79753315c3c3081a592f215406e10e246e3a3fe9e4a2f7c9f",
|
|
"type": "machine_learning",
|
|
"version": 2
|
|
},
|
|
"be8afaed-4bcd-4e0a-b5f9-5562003dde81": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Searching for Saved Credentials via VaultCmd",
|
|
"sha256": "729e64a5fe9596b9514a3e5a2b56e8374fb6079ec891f4b85681422fc07671e5",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"bf1073bf-ce26-4607-b405-ba1ed8e9e204": {
|
|
"min_stack_version": "8.9",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 204,
|
|
"rule_name": "AWS RDS Snapshot Restored",
|
|
"sha256": "aa3da4102533524658662c93b127d4c25ca56ed19c01be2a8904cd695347b3d6",
|
|
"type": "query",
|
|
"version": 105
|
|
}
|
|
},
|
|
"rule_name": "AWS RDS Snapshot Restored",
|
|
"sha256": "31690f503f33025d8d634b7c33d01adff504c8c0cdfbeab6519116149937669e",
|
|
"type": "query",
|
|
"version": 205
|
|
},
|
|
"bf8c007c-7dee-4842-8e9a-ee534c09d205": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "System Owner/User Discovery Linux",
|
|
"sha256": "51ab813449dbe6bf71c403d5dffdb662db965a2d42c8049eaac20ba8bf5a9132",
|
|
"type": "eql",
|
|
"version": 2
|
|
},
|
|
"bfba5158-1fd6-4937-a205-77d96213b341": {
|
|
"min_stack_version": "8.9",
|
|
"rule_name": "Potential Data Exfiltration Activity to an Unusual Region",
|
|
"sha256": "63fa5830b9e441e960726196461abda7310d4b52b798a96b68b8cb2c717616ce",
|
|
"type": "machine_learning",
|
|
"version": 2
|
|
},
|
|
"bfeaf89b-a2a7-48a3-817f-e41829dc61ee": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Suspicious DLL Loaded for Persistence or Privilege Escalation",
|
|
"sha256": "a96413f43b35602b04b7947dfc44ba77f545ed0130c1d7c09cae4116e51754f7",
|
|
"type": "eql",
|
|
"version": 109
|
|
},
|
|
"c02c8b9f-5e1d-463c-a1b0-04edcdfe1a3d": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Privacy Control Bypass via Localhost Secure Copy",
|
|
"sha256": "2c9b4244cb4994ff559dfc5ff89df8400a366e4faadd5f8900810fa90b30281e",
|
|
"type": "eql",
|
|
"version": 106
|
|
},
|
|
"c0429aa8-9974-42da-bfb6-53a0a515a145": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Creation or Modification of a new GPO Scheduled Task or Service",
|
|
"sha256": "f03d327ae09793a9ec460b44da54cfc1c07d946b2d181da5ec77da0c5d2fa4aa",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"c0b9dc99-c696-4779-b086-0d37dc2b3778": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Memory Dump File with Unusual Extension",
|
|
"sha256": "d6064fcc8c3a68d8ecb16d376fef04353be367b0f897433bc82b46a6569f0eb5",
|
|
"type": "eql",
|
|
"version": 1
|
|
},
|
|
"c0be5f31-e180-48ed-aa08-96b36899d48f": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Credential Manipulation - Detected - Elastic Endgame",
|
|
"sha256": "f02b1ea97087aa0c75d168aafd1e53a360542cea5e0cebd4afb31782da226cbd",
|
|
"type": "query",
|
|
"version": 101
|
|
},
|
|
"c125e48f-6783-41f0-b100-c3bf1b114d16": {
|
|
"min_stack_version": "8.5",
|
|
"rule_name": "Suspicious Renaming of ESXI index.html File",
|
|
"sha256": "2acd7bb084fcacdbb12ec8d9c6a04121f2a5bfd99c81cd043158d03bd202e2fd",
|
|
"type": "eql",
|
|
"version": 5
|
|
},
|
|
"c1812764-0788-470f-8e74-eb4a14d47573": {
|
|
"min_stack_version": "8.9",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 204,
|
|
"rule_name": "AWS EC2 Full Network Packet Capture Detected",
|
|
"sha256": "c8fb1a9316a7bc5541a685e19440d21f4c158350903c4e21b6225360fee8258d",
|
|
"type": "query",
|
|
"version": 105
|
|
}
|
|
},
|
|
"rule_name": "AWS EC2 Full Network Packet Capture Detected",
|
|
"sha256": "53d6e6b5dc3942bb911622ffd2582ed4e8a3bff445df0e269aba07ed320f34e8",
|
|
"type": "query",
|
|
"version": 205
|
|
},
|
|
"c20cd758-07b1-46a1-b03f-fa66158258b8": {
|
|
"min_stack_version": "8.4",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 100,
|
|
"rule_name": "Unsigned DLL Loaded by a Trusted Process",
|
|
"sha256": "bb5c65b28dc087548516c6b186539ffc5f02db3440942a539777c49bd9e1e878",
|
|
"type": "eql",
|
|
"version": 1
|
|
}
|
|
},
|
|
"rule_name": "Unsigned DLL Loaded by a Trusted Process",
|
|
"sha256": "bb5c65b28dc087548516c6b186539ffc5f02db3440942a539777c49bd9e1e878",
|
|
"type": "eql",
|
|
"version": 101
|
|
},
|
|
"c25e9c87-95e1-4368-bfab-9fd34cf867ec": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Microsoft IIS Connection Strings Decryption",
|
|
"sha256": "e5ae5f0e597165278b0ee70abc0aaaf7bfa067cc6b731e26e4d4a9f8c130d70d",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"c28c4d8c-f014-40ef-88b6-79a1d67cd499": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Unusual Linux Network Connection Discovery",
|
|
"sha256": "197e0ebe16417250c895c6ab8ef0894bdebdd8535da44dc8426106a4eb63b02d",
|
|
"type": "machine_learning",
|
|
"version": 103
|
|
},
|
|
"c292fa52-4115-408a-b897-e14f684b3cb7": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Persistence via Folder Action Script",
|
|
"sha256": "bb9fad0b65e7bc241670ef85a6bc8750f4bcc92e98888e091f2ca9b30d833ce8",
|
|
"type": "eql",
|
|
"version": 105
|
|
},
|
|
"c2d90150-0133-451c-a783-533e736c12d7": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Mshta Making Network Connections",
|
|
"sha256": "12590f132922a1117fb9cf1c66fb7db25fd6aa692e594ab5e353b1ba010c6298",
|
|
"type": "eql",
|
|
"version": 105
|
|
},
|
|
"c3167e1b-f73c-41be-b60b-87f4df707fe3": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Permission Theft - Detected - Elastic Endgame",
|
|
"sha256": "a4c5424046eadd416d5c7852d917b60abbeedce771b7e1ffd2bc0bbbb6649b0e",
|
|
"type": "query",
|
|
"version": 101
|
|
},
|
|
"c3b915e0-22f3-4bf7-991d-b643513c722f": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Persistence via BITS Job Notify Cmdline",
|
|
"sha256": "331c14e73d76aebdcd4cac4d0fab69ddbb53ef866ef1a68f1868a3755733226f",
|
|
"type": "eql",
|
|
"version": 105
|
|
},
|
|
"c3f5e1d8-910e-43b4-8d44-d748e498ca86": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential JAVA/JNDI Exploitation Attempt",
|
|
"sha256": "0776cc8251cdbd9e2e2060a17b2300834a0ed4a49489a105abb3c0dd75b19cc8",
|
|
"type": "eql",
|
|
"version": 104
|
|
},
|
|
"c4210e1c-64f2-4f48-b67e-b5a8ffe3aa14": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Mounting Hidden or WebDav Remote Shares",
|
|
"sha256": "43fcbbce0e30de8a963685bf58748b27635b19c08af085815f6fff113533bd37",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"c4818812-d44f-47be-aaef-4cfb2f9cc799": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Suspicious Print Spooler File Deletion",
|
|
"sha256": "30182cfa6804a26e730d3c6e33a15816fbc229f1b76ba3b0a372388c91434099",
|
|
"type": "eql",
|
|
"version": 105
|
|
},
|
|
"c4e9ed3e-55a2-4309-a012-bc3c78dad10a": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Windows System Network Connections Discovery",
|
|
"sha256": "16cd4b39c59281f69407d88a2f0bbadab7ac9d1408c9e0c6e5400a92f25898d9",
|
|
"type": "eql",
|
|
"version": 3
|
|
},
|
|
"c55badd3-3e61-4292-836f-56209dc8a601": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Attempted Private Key Access",
|
|
"sha256": "878964185cf6bcfd3d1cee459b0664977de42cce6b31af0fb2ad35413e764dc5",
|
|
"type": "eql",
|
|
"version": 1
|
|
},
|
|
"c5677997-f75b-4cda-b830-a75920514096": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Service Path Modification via sc.exe",
|
|
"sha256": "471c10523b0876136cb7b2ebcf2df348a37efbe907b5bb0bd57c7650ce7c4fea",
|
|
"type": "eql",
|
|
"version": 1
|
|
},
|
|
"c57f8579-e2a5-4804-847f-f2732edc5156": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Remote Desktop Shadowing Activity",
|
|
"sha256": "ef18c4509361dc748c03f900e0cb04331a3870f4d37673c65632f7edcdc5fe80",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"c58c3081-2e1d-4497-8491-e73a45d1a6d6": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "GCP Virtual Private Cloud Network Deletion",
|
|
"sha256": "7f47bc00b67f2997890fd47eff9350e23e6effea54914edcbb180c321a553276",
|
|
"type": "query",
|
|
"version": 104
|
|
},
|
|
"c5c9f591-d111-4cf8-baec-c26a39bc31ef": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Credential Access via Renamed COM+ Services DLL",
|
|
"sha256": "7ae96f1df833b14af7547f0e08d6b5b00c9e944fbac39dbceb641ce799daf5e7",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"c5ce48a6-7f57-4ee8-9313-3d0024caee10": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Installation of Custom Shim Databases",
|
|
"sha256": "b7d3d0eac47540ae843fe1289c5c3b34a1f89e1f292b2990b68cb241983c52aa",
|
|
"type": "eql",
|
|
"version": 106
|
|
},
|
|
"c5dc3223-13a2-44a2-946c-e9dc0aa0449c": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Microsoft Build Engine Started by an Office Application",
|
|
"sha256": "7e7ffc94375f810fc0ec2748a6a096644fcde37cdf4979fb00de46501a74f0c3",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"c5f81243-56e0-47f9-b5bb-55a5ed89ba57": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "CyberArk Privileged Access Security Recommended Monitor",
|
|
"sha256": "13f4c23dbe61be7af51b9b4e4a27b192c9305f1caa67119f4ea89ac89792737f",
|
|
"type": "query",
|
|
"version": 102
|
|
},
|
|
"c6453e73-90eb-4fe7-a98c-cde7bbfc504a": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Remote File Download via MpCmdRun",
|
|
"sha256": "142247d62f7891a9ca33735f3b0dccfb8715548c603ac42fda40d37b4d391fe7",
|
|
"type": "eql",
|
|
"version": 109
|
|
},
|
|
"c6474c34-4953-447a-903e-9fcb7b6661aa": {
|
|
"rule_name": "IRC (Internet Relay Chat) Protocol Activity to the Internet",
|
|
"sha256": "dba60ab7ccce534b20532548b6aff6b799d54bacbacf3328fd250e65420a998c",
|
|
"type": "query",
|
|
"version": 100
|
|
},
|
|
"c749e367-a069-4a73-b1f2-43a3798153ad": {
|
|
"min_stack_version": "8.10",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 205,
|
|
"rule_name": "Attempt to Delete an Okta Network Zone",
|
|
"sha256": "fdb6f5c18f3893647e63e19723c1ad7c3f352be39e233b1273d08b6cd09edd5a",
|
|
"type": "query",
|
|
"version": 106
|
|
}
|
|
},
|
|
"rule_name": "Attempt to Delete an Okta Network Zone",
|
|
"sha256": "32aa247af72d8bfb3ed85d34d5c359b595a21f5b5ef6703aec68875147b2110f",
|
|
"type": "query",
|
|
"version": 206
|
|
},
|
|
"c74fd275-ab2c-4d49-8890-e2943fa65c09": {
|
|
"min_stack_version": "8.10",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 204,
|
|
"rule_name": "Attempt to Modify an Okta Application",
|
|
"sha256": "d467d49b83c884e4c1d43dc2f0e1dc879ceda77762f45968124a97e4fbacd2b0",
|
|
"type": "query",
|
|
"version": 105
|
|
}
|
|
},
|
|
"rule_name": "Attempt to Modify an Okta Application",
|
|
"sha256": "d9ce411d12a9dcd03a68e93eedabd0fc200c743908746faf634ade8744ff7f32",
|
|
"type": "query",
|
|
"version": 205
|
|
},
|
|
"c7894234-7814-44c2-92a9-f7d851ea246a": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Unusual Network Connection via DllHost",
|
|
"sha256": "66f9611335e40f84586a2c89a68668f5ad3a0f4f2fded39524a649132ad4360a",
|
|
"type": "eql",
|
|
"version": 105
|
|
},
|
|
"c7908cac-337a-4f38-b50d-5eeb78bdb531": {
|
|
"min_stack_version": "8.4",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 199,
|
|
"rule_name": "Kubernetes Privileged Pod Created",
|
|
"sha256": "e431240326e0ddb66017b695a15db0269ad7b4e5bde7cf37b10f01159fb9da19",
|
|
"type": "query",
|
|
"version": 101
|
|
}
|
|
},
|
|
"rule_name": "Kubernetes Privileged Pod Created",
|
|
"sha256": "276c33d57b4e3046ff3bf3eab838110627d9f8d9214a01036a62561084c6073a",
|
|
"type": "query",
|
|
"version": 203
|
|
},
|
|
"c7ce36c0-32ff-4f9a-bfc2-dcb242bf99f9": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Unusual File Modification by dns.exe",
|
|
"sha256": "29d7cf667acb99a68d444c3d61446d0b3ac071880d4ad6333c3be80645841c97",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"c7db5533-ca2a-41f6-a8b0-ee98abe0f573": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Spike in Network Traffic To a Country",
|
|
"sha256": "93087ad72f05b99dd3bc9858cd5edfd5ed9d21a4afa6e01d0d798e78b4e9ab61",
|
|
"type": "machine_learning",
|
|
"version": 104
|
|
},
|
|
"c81cefcb-82b9-4408-a533-3c3df549e62d": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Persistence via Docker Shortcut Modification",
|
|
"sha256": "4c1848771275a47db363a85fd08d70afa61b85baaca4651d4c823c0accc02d6d",
|
|
"type": "query",
|
|
"version": 105
|
|
},
|
|
"c82b2bd8-d701-420c-ba43-f11a155b681a": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "SMB (Windows File Sharing) Activity to the Internet",
|
|
"sha256": "6420c0fe2bee67b51779e539f2cfe3b480539c36abf148d1d69db79d6f2e8f67",
|
|
"type": "query",
|
|
"version": 103
|
|
},
|
|
"c82c7d8f-fb9e-4874-a4bd-fd9e3f9becf1": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Direct Outbound SMB Connection",
|
|
"sha256": "60e36bac49806489006bf776593fb6782d3af26d927558c032d5c6cc16be7340",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"c85eb82c-d2c8-485c-a36f-534f914b7663": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Virtual Machine Fingerprinting via Grep",
|
|
"sha256": "4e2c160e8b311df59edc07d890988f42898b8ee8467760d2692204ecc13cdede",
|
|
"type": "eql",
|
|
"version": 104
|
|
},
|
|
"c87fca17-b3a9-4e83-b545-f30746c53920": {
|
|
"rule_name": "Nmap Process Activity",
|
|
"sha256": "85b00c642776304ce2f5d7c1374ad4f666c1669ace49cc43ede47f075674581d",
|
|
"type": "query",
|
|
"version": 100
|
|
},
|
|
"c88d4bd0-5649-4c52-87ea-9be59dbfbcf2": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Parent Process PID Spoofing",
|
|
"sha256": "e1789b1189d98d1c0dd3e14aef3df67f994982f60001aab44c9785a8bab9bb3a",
|
|
"type": "eql",
|
|
"version": 105
|
|
},
|
|
"c8935a8b-634a-4449-98f7-bb24d3b2c0af": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Linux Ransomware Note Creation Detected",
|
|
"sha256": "644224b9f3ebd8dc3b7a7d5b2fb1b90cd7142ffb1853bfa847346361c0e952d3",
|
|
"type": "eql",
|
|
"version": 7
|
|
},
|
|
"c8b150f0-0164-475b-a75e-74b47800a9ff": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Suspicious Startup Shell Folder Modification",
|
|
"sha256": "1d46ce00fb8fa393c7b0122644b3e0a367bb2ce96e5767209a2e3f101b552c52",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"c8cccb06-faf2-4cd5-886e-2c9636cfcb87": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Disabling Windows Defender Security Settings via PowerShell",
|
|
"sha256": "f98a75e410bae28c2958515cf867ad360c55e5628e4074ff04168355fe113ee6",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"c9482bfa-a553-4226-8ea2-4959bd4f7923": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Masquerading as Communication Apps",
|
|
"sha256": "a5e68609def010ae4cea5c31b29ec9740ce793360ee2d0c8995ce5c93286ed58",
|
|
"type": "eql",
|
|
"version": 4
|
|
},
|
|
"c9e38e64-3f4c-4bf3-ad48-0e61a60ea1fa": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Credential Manipulation - Prevented - Elastic Endgame",
|
|
"sha256": "91b2db5824ba03638ae1b10d6b60a2cb0825c1aa43b80768357bf49d2dee514d",
|
|
"type": "query",
|
|
"version": 101
|
|
},
|
|
"ca79768e-40e1-4e45-a097-0e5fbc876ac2": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Microsoft 365 Exchange Malware Filter Rule Modification",
|
|
"sha256": "fdddb91dc8eaf01e3cca5626ab5e3b2c4ef51e15a8544385057399574b3d9b3b",
|
|
"type": "query",
|
|
"version": 102
|
|
},
|
|
"ca98c7cf-a56e-4057-a4e8-39603f7f0389": {
|
|
"min_stack_version": "8.4",
|
|
"rule_name": "Unsigned DLL Side-Loading from a Suspicious Folder",
|
|
"sha256": "cb3e06584ef3df219502f541a38afdd93024219e4a99f76ed05857f3b96c5772",
|
|
"type": "eql",
|
|
"version": 6
|
|
},
|
|
"cab4f01c-793f-4a54-a03e-e5d85b96d7af": {
|
|
"rule_name": "Auditd Login from Forbidden Location",
|
|
"sha256": "85a1d29a1ac4a700594437c856775141ae1b4cc58a4c41def22e0a8762c7a8ed",
|
|
"type": "query",
|
|
"version": 100
|
|
},
|
|
"cac91072-d165-11ec-a764-f661ea17fbce": {
|
|
"min_stack_version": "8.6",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 206,
|
|
"rule_name": "Abnormal Process ID or Lock File Created",
|
|
"sha256": "6ab73acfdcd8636a87c0fd8b1342d5e96de8cbd74ed0e4f4dbb689c32a3cbffa",
|
|
"type": "eql",
|
|
"version": 108
|
|
}
|
|
},
|
|
"rule_name": "Abnormal Process ID or Lock File Created",
|
|
"sha256": "55ab77b10e0bcb868314e0a9c77ad2c6b64b6a3dc98daa287fc5d3318225afe1",
|
|
"type": "new_terms",
|
|
"version": 211
|
|
},
|
|
"cad4500a-abd7-4ef3-b5d3-95524de7cfe1": {
|
|
"min_stack_version": "8.4",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 205,
|
|
"rule_name": "Google Workspace MFA Enforcement Disabled",
|
|
"sha256": "a8e10bb292478990aa0c82694fcd3621b81383a8058b87a25449238641d59e3b",
|
|
"type": "query",
|
|
"version": 107
|
|
}
|
|
},
|
|
"rule_name": "Google Workspace MFA Enforcement Disabled",
|
|
"sha256": "8a1f92b90737453373b48d24dd4dfd6e29615794a9ccaf5df7ba1a0ecf5d5e2a",
|
|
"type": "query",
|
|
"version": 207
|
|
},
|
|
"cb71aa62-55c8-42f0-b0dd-afb0bb0b1f51": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Suspicious Calendar File Modification",
|
|
"sha256": "4020e8d93c52fc49bce77c661a1566c03732a2a74906ceec9c5371f6f0fdecef",
|
|
"type": "query",
|
|
"version": 105
|
|
},
|
|
"cc16f774-59f9-462d-8b98-d27ccd4519ec": {
|
|
"rule_name": "Process Discovery via Tasklist",
|
|
"sha256": "8612fc7b7e41ef8548eb18803ce4a0ca6e178952add06c716bfbf190fa1788f3",
|
|
"type": "query",
|
|
"version": 100
|
|
},
|
|
"cc2fd2d0-ba3a-4939-b87f-2901764ed036": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Attempt to Enable the Root Account",
|
|
"sha256": "859a1abd493744516a89a3da4036d0f389decd9a8f56ee51a41b0f3bd7d335bd",
|
|
"type": "query",
|
|
"version": 105
|
|
},
|
|
"cc382a2e-7e52-11ee-9aac-f661ea17fbcd": {
|
|
"min_stack_version": "8.10",
|
|
"rule_name": "Multiple Okta Client Addresses for a Single User Session",
|
|
"sha256": "1fd88b6e7c9bf6b2176da46f28e40a91cff9746a635071e899bf47a6176021a5",
|
|
"type": "threshold",
|
|
"version": 2
|
|
},
|
|
"cc653d77-ddd2-45b1-9197-c75ad19df66c": {
|
|
"min_stack_version": "8.9",
|
|
"rule_name": "Potential Data Exfiltration Activity to an Unusual IP Address",
|
|
"sha256": "b5449914c57f3b158b22d6929e85c95b29763e3eb6af772e343f1f4d907efe24",
|
|
"type": "machine_learning",
|
|
"version": 2
|
|
},
|
|
"cc6a8a20-2df2-11ed-8378-f661ea17fbce": {
|
|
"min_stack_version": "8.4",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 103,
|
|
"rule_name": "Google Workspace User Organizational Unit Changed",
|
|
"sha256": "50eab7a58d52dc1eb0e8d8af2d5ca140762dfdf60970d1e7d5fcbf80aff362f4",
|
|
"type": "query",
|
|
"version": 5
|
|
}
|
|
},
|
|
"rule_name": "Google Workspace User Organizational Unit Changed",
|
|
"sha256": "98638b8378e232c3d8a54f3b4ec12fa3eae908ba56a658c7557b22c25766b823",
|
|
"type": "query",
|
|
"version": 106
|
|
},
|
|
"cc89312d-6f47-48e4-a87c-4977bd4633c3": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "GCP Pub/Sub Subscription Deletion",
|
|
"sha256": "be76246406041025864af7eeea3c9600ab406bf778763b00a6ea6e6489240408",
|
|
"type": "query",
|
|
"version": 104
|
|
},
|
|
"cc92c835-da92-45c9-9f29-b4992ad621a0": {
|
|
"min_stack_version": "8.10",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 206,
|
|
"rule_name": "Attempt to Deactivate an Okta Policy Rule",
|
|
"sha256": "ed2062f991db0a0dce267846fe8363883628421221166f8246b4924828f02999",
|
|
"type": "query",
|
|
"version": 107
|
|
}
|
|
},
|
|
"rule_name": "Attempt to Deactivate an Okta Policy Rule",
|
|
"sha256": "b478201ba15dcd2c82b79fa58c4c175e917d642653a86009ecf389042156d85c",
|
|
"type": "query",
|
|
"version": 207
|
|
},
|
|
"ccc55af4-9882-4c67-87b4-449a7ae8079c": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Process Herpaderping Attempt",
|
|
"sha256": "7358d900c0332bbc2ea6bd00db02a9d7ce7199fcbd5ffea5cce60caf11cc99c2",
|
|
"type": "eql",
|
|
"version": 105
|
|
},
|
|
"cd16fb10-0261-46e8-9932-a0336278cdbe": {
|
|
"min_stack_version": "8.10",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 205,
|
|
"rule_name": "Modification or Removal of an Okta Application Sign-On Policy",
|
|
"sha256": "32c09cb649d10eb0d58645624f6534db9c40073e42552b0381f5b414e9c58bb6",
|
|
"type": "query",
|
|
"version": 106
|
|
}
|
|
},
|
|
"rule_name": "Modification or Removal of an Okta Application Sign-On Policy",
|
|
"sha256": "06745b57fd263169ae59b2d860b840a6deb4a911da424fa9267827a54e77c61f",
|
|
"type": "query",
|
|
"version": 206
|
|
},
|
|
"cd4d5754-07e1-41d4-b9a5-ef4ea6a0a126": {
|
|
"rule_name": "Socat Process Activity",
|
|
"sha256": "572416fa9eb3b37a9360cbd474d0dccd7844685ad36b022f4a42d3a4525cac25",
|
|
"type": "query",
|
|
"version": 100
|
|
},
|
|
"cd66a419-9b3f-4f57-8ff8-ac4cd2d5f530": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Anomalous Linux Compiler Activity",
|
|
"sha256": "ac7fe1661692762ebf3969e3980d674808ea8cf32e188619fd6e08de268af793",
|
|
"type": "machine_learning",
|
|
"version": 103
|
|
},
|
|
"cd66a5af-e34b-4bb0-8931-57d0a043f2ef": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Kernel Module Removal",
|
|
"sha256": "3389bde0d2034a85fbb3b9902602f9751c82b86ef92ede4fd68b2c2aaac43319",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"cd82e3d6-1346-4afd-8f22-38388bbf34cb": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Downloaded URL Files",
|
|
"sha256": "3b2b2822568470b436f1a1db2ca7db260343faeb5f156b1b3b697a4393137938",
|
|
"type": "eql",
|
|
"version": 1
|
|
},
|
|
"cd89602e-9db0-48e3-9391-ae3bf241acd8": {
|
|
"min_stack_version": "8.10",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 205,
|
|
"rule_name": "Attempt to Deactivate MFA for an Okta User Account",
|
|
"sha256": "173487533fb84ffd2bbd8598bf0ac4f518f295cc6715c381743a3fe6d0f14ec7",
|
|
"type": "query",
|
|
"version": 106
|
|
}
|
|
},
|
|
"rule_name": "MFA Deactivation with no Re-Activation for Okta User Account",
|
|
"sha256": "68ad2d14c4876759c36eb2916aee5dc6a93ce9aba5183bea4fde222d94ad4fa5",
|
|
"type": "eql",
|
|
"version": 207
|
|
},
|
|
"cdbebdc1-dc97-43c6-a538-f26a20c0a911": {
|
|
"min_stack_version": "8.10",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 206,
|
|
"rule_name": "Okta User Session Impersonation",
|
|
"sha256": "36a5fb5b929045a84f302c057459e3b5e6eb50cb409fc5a9edf6cdcd47f30ee5",
|
|
"type": "query",
|
|
"version": 107
|
|
}
|
|
},
|
|
"rule_name": "Okta User Session Impersonation",
|
|
"sha256": "0a3253294eddbc09d843b81fe8f461f26e5b01e8456dc88dbce7c79923ff93b7",
|
|
"type": "query",
|
|
"version": 207
|
|
},
|
|
"cde1bafa-9f01-4f43-a872-605b678968b0": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential PowerShell HackTool Script by Function Names",
|
|
"sha256": "2eb8c5c3eeddd0af42ec3046f59499ed54cf8d1fda03bf20e935a69f2bcfd306",
|
|
"type": "query",
|
|
"version": 8
|
|
},
|
|
"ce64d965-6cb0-466d-b74f-8d2c76f47f05": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "New ActiveSyncAllowedDeviceID Added via PowerShell",
|
|
"sha256": "e2c5ca3d894271fd19e6f8f2a1766756db89da4380da5f63313dd2f1843b9589",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"cf53f532-9cc9-445a-9ae7-fced307ec53c": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Cobalt Strike Command and Control Beacon",
|
|
"sha256": "ddb4b9d7e2f95d26c85ab37fb9696c58aa1f937e5f4788214b8711b988206967",
|
|
"type": "query",
|
|
"version": 105
|
|
},
|
|
"cf549724-c577-4fd6-8f9b-d1b8ec519ec0": {
|
|
"min_stack_version": "8.4",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 202,
|
|
"rule_name": "Domain Added to Google Workspace Trusted Domains",
|
|
"sha256": "c773965d1c83361d3745d38a93d9ac9380056a79a5f3d4ebff542d94a9a369ce",
|
|
"type": "query",
|
|
"version": 104
|
|
}
|
|
},
|
|
"rule_name": "Domain Added to Google Workspace Trusted Domains",
|
|
"sha256": "15e692b56a4792a0434440ea85ef264cbfb31e1ebd9bdc618a03987f928a53a1",
|
|
"type": "query",
|
|
"version": 205
|
|
},
|
|
"cf575427-0839-4c69-a9e6-99fde02606f3": {
|
|
"min_stack_version": "8.6",
|
|
"rule_name": "Unusual Discovery Activity by User",
|
|
"sha256": "2dec950ffa14b4863a879f391b045196709a774f032c8bc35d8f61ba20e2bfff",
|
|
"type": "new_terms",
|
|
"version": 1
|
|
},
|
|
"cf6995ec-32a9-4b2d-9340-f8e61acf3f4e": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Trap Signals Execution",
|
|
"sha256": "0ba6ec2eec63d471e368b93ff67990a66c3d7e08e08719c6e2ee4eff8f216c81",
|
|
"type": "eql",
|
|
"version": 1
|
|
},
|
|
"cff92c41-2225-4763-b4ce-6f71e5bda5e6": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Execution from Unusual Directory - Command Line",
|
|
"sha256": "63f22faabb2c7cdd85b0f0550ea39855fbcdbb14b96b274cd260a985e747a7a9",
|
|
"type": "eql",
|
|
"version": 109
|
|
},
|
|
"cffbaf47-9391-4e09-a83c-1f27d7474826": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Archive File with Unusual Extension",
|
|
"sha256": "6fc1f60a466fb9cafbd52086ffba78f59d5ba996e6301563a12e09205b193e84",
|
|
"type": "eql",
|
|
"version": 1
|
|
},
|
|
"d00f33e7-b57d-4023-9952-2db91b1767c4": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Namespace Manipulation Using Unshare",
|
|
"sha256": "a856106c03c826b7cc37c298845052a3d071b61fc13d0a7e32d11346c49983b3",
|
|
"type": "eql",
|
|
"version": 8
|
|
},
|
|
"d0b0f3ed-0b37-44bf-adee-e8cb7de92767": {
|
|
"min_stack_version": "8.8",
|
|
"rule_name": "AWS Credentials Searched For Inside A Container",
|
|
"sha256": "27918dd9cf339832d9efc37e0b589ce887eae09959450ae8a4297df5ba0f040e",
|
|
"type": "eql",
|
|
"version": 1
|
|
},
|
|
"d0e159cf-73e9-40d1-a9ed-077e3158a855": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Registry Persistence via AppInit DLL",
|
|
"sha256": "283072265b8d9a5eb1ce5e409ca6923c251b01d80294784d68db0745ea03ff46",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"d117cbb4-7d56-41b4-b999-bdf8c25648a0": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Symbolic Link to Shadow Copy Created",
|
|
"sha256": "1a8f93e1420657bde476d44178510fe68b66e44c5329c320ca9cad7c4a0a46aa",
|
|
"type": "eql",
|
|
"version": 109
|
|
},
|
|
"d12bac54-ab2a-4159-933f-d7bcefa7b61d": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Expired or Revoked Driver Loaded",
|
|
"sha256": "bcc8530ce8aa18d4efbc4c6c3709e6308cacb5408758aa722e8a7c30dca27138",
|
|
"type": "eql",
|
|
"version": 3
|
|
},
|
|
"d197478e-39f0-4347-a22f-ba654718b148": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Compression DLL Loaded by Unusual Process",
|
|
"sha256": "8ec13c2f3c6784d7cfe3f314135c8c4c8afe0087deb18c62bcdf5b41db55f5f2",
|
|
"type": "eql",
|
|
"version": 2
|
|
},
|
|
"d2053495-8fe7-4168-b3df-dad844046be3": {
|
|
"rule_name": "PPTP (Point to Point Tunneling Protocol) Activity",
|
|
"sha256": "07e21a98e0a2f05e6d9191ef82577f66f1c1ed1a2f93cd54771faa83ee6ceda6",
|
|
"type": "query",
|
|
"version": 100
|
|
},
|
|
"d22a85c6-d2ad-4cc4-bf7b-54787473669a": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Microsoft Office Sandbox Evasion",
|
|
"sha256": "89e780b8ad04e619a91f21797ef0ad455995889221fac37ccd693f8a9be88e1c",
|
|
"type": "query",
|
|
"version": 105
|
|
},
|
|
"d31f183a-e5b1-451b-8534-ba62bca0b404": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Disabling User Account Control via Registry Modification",
|
|
"sha256": "258220c18110c30e13d2bf5c9c5b47b97d2591c38e6a207624eaa1335b384462",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"d331bbe2-6db4-4941-80a5-8270db72eb61": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Clearing Windows Event Logs",
|
|
"sha256": "8a73c10ef60c4773647f268027e24eae42f6ade586978349bdf9041116d0e531",
|
|
"type": "eql",
|
|
"version": 109
|
|
},
|
|
"d33ea3bf-9a11-463e-bd46-f648f2a0f4b1": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Remote Windows Service Installed",
|
|
"sha256": "63102ba4aec4aaab713fffceebe688d706bb41cdf8bcf23d4055467011cb9fb9",
|
|
"type": "eql",
|
|
"version": 6
|
|
},
|
|
"d3551433-782f-4e22-bbea-c816af2d41c6": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "WMI WBEMTEST Utility Execution",
|
|
"sha256": "687d0e851309a066fb0d13b00750846d62e6da9fca5b2a80f9f8b6864ada9b76",
|
|
"type": "eql",
|
|
"version": 1
|
|
},
|
|
"d461fac0-43e8-49e2-85ea-3a58fe120b4f": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Shell Execution via Apple Scripting",
|
|
"sha256": "692c64fb60537e8d2920f5feaa3ed8a0bbb120fa138fee7526e2698ed2895421",
|
|
"type": "eql",
|
|
"version": 105
|
|
},
|
|
"d48e1c13-4aca-4d1f-a7b1-a9161c0ad86f": {
|
|
"min_stack_version": "8.10",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 204,
|
|
"rule_name": "Attempt to Delete an Okta Application",
|
|
"sha256": "ec2d2014d13ce312c51e80554c30af695049e703918b7f1b19da53f58154d6f7",
|
|
"type": "query",
|
|
"version": 105
|
|
}
|
|
},
|
|
"rule_name": "Attempt to Delete an Okta Application",
|
|
"sha256": "ed729064054fe9156b2909c7970d2e38aa98c9ee0337d7f86e1ad0d8f28300c6",
|
|
"type": "query",
|
|
"version": 205
|
|
},
|
|
"d49cc73f-7a16-4def-89ce-9fc7127d7820": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Web Application Suspicious Activity: sqlmap User Agent",
|
|
"sha256": "f10cb94a414e6983ebdaa36e5c4a332a76a4d06134043937967fdf2e2faa2cc7",
|
|
"type": "query",
|
|
"version": 102
|
|
},
|
|
"d4af3a06-1e0a-48ec-b96a-faf2309fae46": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Unusual Linux System Information Discovery Activity",
|
|
"sha256": "1823af90ab9f82af85f6752bb44ce24df6e0ef1e0722d477f91a55675de28c8f",
|
|
"type": "machine_learning",
|
|
"version": 103
|
|
},
|
|
"d4b73fa0-9d43-465e-b8bf-50230da6718b": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Unusual Source IP for a User to Logon from",
|
|
"sha256": "b9964a7773745de7f347665b66883623fc60d4e0e4a004d0b7e3b5cd79694041",
|
|
"type": "machine_learning",
|
|
"version": 103
|
|
},
|
|
"d4ff2f53-c802-4d2e-9fb9-9ecc08356c3f": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Linux init (PID 1) Secret Dump via GDB",
|
|
"sha256": "fe9f5628cc8de2846077446c09d501bd05f366c5f81e3900c513dfa420b6ff75",
|
|
"type": "eql",
|
|
"version": 3
|
|
},
|
|
"d55436a8-719c-445f-92c4-c113ff2f9ba5": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Privilege Escalation via UID INT_MAX Bug Detected",
|
|
"sha256": "225b46731e54716469e060d028dc5a204d7dfeb3ec1062bc93ffdd4663f7acd1",
|
|
"type": "eql",
|
|
"version": 4
|
|
},
|
|
"d563aaba-2e72-462b-8658-3e5ea22db3a6": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Privilege Escalation via Windir Environment Variable",
|
|
"sha256": "7b25d0582e256fb4ce7c470b52e131cce26a826b62117c6ef9ff6f1769b4f003",
|
|
"type": "eql",
|
|
"version": 104
|
|
},
|
|
"d5d86bf5-cf0c-4c06-b688-53fdc072fdfd": {
|
|
"min_stack_version": "8.10",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 205,
|
|
"rule_name": "Attempt to Delete an Okta Policy Rule",
|
|
"sha256": "ef00abb177343a787a119303eaa0cb71aef503d40d309b2699d05fe0178157a6",
|
|
"type": "query",
|
|
"version": 106
|
|
}
|
|
},
|
|
"rule_name": "Attempt to Delete an Okta Policy Rule",
|
|
"sha256": "537f87bddcb81e9ba189e215fbb67e630dc5362f718cb3d8e57f843bd129033a",
|
|
"type": "query",
|
|
"version": 206
|
|
},
|
|
"d61cbcf8-1bc1-4cff-85ba-e7b21c5beedc": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Service Command Lateral Movement",
|
|
"sha256": "d560df7cdf03af3bf9cb7e30466dd2430565baa3ead05a508a50979884b3b607",
|
|
"type": "eql",
|
|
"version": 105
|
|
},
|
|
"d624f0ae-3dd1-4856-9aad-ccfe4d4bfa17": {
|
|
"min_stack_version": "8.9",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 207,
|
|
"rule_name": "AWS CloudWatch Log Stream Deletion",
|
|
"sha256": "e7f7445facc4da1f84ee331f6dbbf22337e319df0727349ff958c0f62154fd1f",
|
|
"type": "query",
|
|
"version": 108
|
|
}
|
|
},
|
|
"rule_name": "AWS CloudWatch Log Stream Deletion",
|
|
"sha256": "5bc55e01a217a6d8069b08e636d1e12080f2a96b645cc68f8f33806d04a820ee",
|
|
"type": "query",
|
|
"version": 208
|
|
},
|
|
"d62b64a8-a7c9-43e5-aee3-15a725a794e7": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "GCP Pub/Sub Subscription Creation",
|
|
"sha256": "981abcaff8eaa4e947885a8b6e60edb877602e6ec2974994837ffbf18e7085b4",
|
|
"type": "query",
|
|
"version": 105
|
|
},
|
|
"d6450d4e-81c6-46a3-bd94-079886318ed5": {
|
|
"rule_name": "Strace Process Activity",
|
|
"sha256": "d429bce6c680e9197c1314118b5cf81da6824a06e1d95e2882c4a9a274975eb7",
|
|
"type": "query",
|
|
"version": 100
|
|
},
|
|
"d68e95ad-1c82-4074-a12a-125fe10ac8ba": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "System Information Discovery via Windows Command Shell",
|
|
"sha256": "cc8a7869299dfb327b8a78d1709292c90e765523ecaed24698ec7fff46bb4440",
|
|
"type": "eql",
|
|
"version": 8
|
|
},
|
|
"d68eb1b5-5f1c-4b6d-9e63-5b6b145cd4aa": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Microsoft 365 Exchange Anti-Phish Policy Deletion",
|
|
"sha256": "3fa1ccf28083380bbb7d71135b1b5ab0753f90d5fde3ecdeda2cb4ffc6ae81aa",
|
|
"type": "query",
|
|
"version": 102
|
|
},
|
|
"d703a5af-d5b0-43bd-8ddb-7a5d500b7da5": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Modification of WDigest Security Provider",
|
|
"sha256": "0d92e00788578df71a3085d97bc9e16656ce1ab64a2d00cefd71d7ede7c98ce2",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"d72e33fc-6e91-42ff-ac8b-e573268c5a87": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Command Execution via SolarWinds Process",
|
|
"sha256": "75e96d95e76853c07370e086de891f29c8521f0570f5afbc6c674fb8ff2e13df",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"d743ff2a-203e-4a46-a3e3-40512cfe8fbb": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Microsoft 365 Exchange Malware Filter Policy Deletion",
|
|
"sha256": "4a8ffe50aa43eaf2654ac6a51517203a86c2951828434a1cb60bb435707c5a6b",
|
|
"type": "query",
|
|
"version": 102
|
|
},
|
|
"d75991f2-b989-419d-b797-ac1e54ec2d61": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "SystemKey Access via Command Line",
|
|
"sha256": "f758f68cb5c44f5582fdf29f91b5ede95c7b692861a950921ce02561e9bddb48",
|
|
"type": "query",
|
|
"version": 105
|
|
},
|
|
"d76b02ef-fc95-4001-9297-01cb7412232f": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Interactive Terminal Spawned via Python",
|
|
"sha256": "135ce1e246c6be718c533d4528fb82c9d1798007fda71bb7aa4126f2766cff68",
|
|
"type": "eql",
|
|
"version": 109
|
|
},
|
|
"d79c4b2a-6134-4edd-86e6-564a92a933f9": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Azure Blob Permissions Modification",
|
|
"sha256": "4721b8fe47efb148dfe195f28255209d453662590443eac3aeb27c0ef998640f",
|
|
"type": "query",
|
|
"version": 103
|
|
},
|
|
"d7d5c059-c19a-4a96-8ae3-41496ef3bcf9": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Spike in Logon Events",
|
|
"sha256": "d252490036f46e2d8c44e6c0aec56feb27ef9539cd83c5430534df5a0189a203",
|
|
"type": "machine_learning",
|
|
"version": 103
|
|
},
|
|
"d7e62693-aab9-4f66-a21a-3d79ecdd603d": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "SMTP on Port 26/TCP",
|
|
"sha256": "3816b9a7c573ec98806b9cc52fc8e281cd0559c43a7c7fce52c60f63c8a8eb2f",
|
|
"type": "query",
|
|
"version": 103
|
|
},
|
|
"d8ab1ec1-feeb-48b9-89e7-c12e189448aa": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Untrusted Driver Loaded",
|
|
"sha256": "aa9adda1ac8dfe9c91e83c7741e046bb1553fda39b7e023d70c58e86fa012e11",
|
|
"type": "eql",
|
|
"version": 6
|
|
},
|
|
"d8fc1cca-93ed-43c1-bbb6-c0dd3eff2958": {
|
|
"min_stack_version": "8.9",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 207,
|
|
"rule_name": "AWS IAM Deactivation of MFA Device",
|
|
"sha256": "3c501df177ec97cc6f46663425f4c04cb979694688cd3bfad27f03a0d8a2ac53",
|
|
"type": "query",
|
|
"version": 108
|
|
}
|
|
},
|
|
"rule_name": "AWS IAM Deactivation of MFA Device",
|
|
"sha256": "7e7bcfe14adab55f0ac9ab6478a826ff0dff7b31efe686b94a1bbf30d730bdd6",
|
|
"type": "query",
|
|
"version": 208
|
|
},
|
|
"d99a037b-c8e2-47a5-97b9-170d076827c4": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Volume Shadow Copy Deletion via PowerShell",
|
|
"sha256": "35cec24c6f40b74359e76b1c0b8b19ada3b0c73c18fdc5f92b4fc732bb168c40",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"da7733b1-fe08-487e-b536-0a04c6d8b0cd": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Code Signing Policy Modification Through Registry",
|
|
"sha256": "45983ba4145383efb62f613aaf8c96bb987077029f26ba1392ed5a802713ee0b",
|
|
"type": "eql",
|
|
"version": 7
|
|
},
|
|
"da7f5803-1cd4-42fd-a890-0173ae80ac69": {
|
|
"min_stack_version": "8.9",
|
|
"rule_name": "Machine Learning Detected a DNS Request With a High DGA Probability Score",
|
|
"sha256": "6e01111d746a2621fba51d683e3b21a475878fb95b0da75efef8c54f665fb13d",
|
|
"type": "query",
|
|
"version": 2
|
|
},
|
|
"da87eee1-129c-4661-a7aa-57d0b9645fad": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Suspicious Service was Installed in the System",
|
|
"sha256": "21882fe93edaef610a0b27aef9155e98576d28411bb1deb9914a0163f9f81694",
|
|
"type": "eql",
|
|
"version": 8
|
|
},
|
|
"da986d2c-ffbf-4fd6-af96-a88dbf68f386": {
|
|
"rule_name": "Linux Restricted Shell Breakout via the gcc command",
|
|
"sha256": "0dcf883b0cf19432784e5b592f0e8a9b03bef386eb8d86065ca7d27c3b395443",
|
|
"type": "eql",
|
|
"version": 100
|
|
},
|
|
"daafdf96-e7b1-4f14-b494-27e0d24b11f6": {
|
|
"min_stack_version": "8.4",
|
|
"rule_name": "Potential Pass-the-Hash (PtH) Attempt",
|
|
"sha256": "297e315306142cee4a09811f704f80247b099304aaedca726a6b155b0a285b02",
|
|
"type": "new_terms",
|
|
"version": 2
|
|
},
|
|
"dafa3235-76dc-40e2-9f71-1773b96d24cf": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Multi-Factor Authentication Disabled for an Azure User",
|
|
"sha256": "9bec414579dbdeb0c1a10611d7a97fa166af67379b6b69855a360097da1cc0ee",
|
|
"type": "query",
|
|
"version": 105
|
|
},
|
|
"db65f5ba-d1ef-4944-b9e8-7e51060c2b42": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Network-Level Authentication (NLA) Disabled",
|
|
"sha256": "f4edf52a98e83ab010153cdffb7067610814b7fcc0414bb5e8dcee5bf8d0d3ff",
|
|
"type": "eql",
|
|
"version": 2
|
|
},
|
|
"db7dbad5-08d2-4d25-b9b1-d3a1e4a15efd": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Execution via Windows Subsystem for Linux",
|
|
"sha256": "17af58de4b6c1966f11b602f2971c9d50764e0dd5a201bdaacbca05fb50d7f66",
|
|
"type": "eql",
|
|
"version": 4
|
|
},
|
|
"db8c33a8-03cd-4988-9e2c-d0a4863adb13": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Credential Dumping - Prevented - Elastic Endgame",
|
|
"sha256": "2f96b5a3c80cb7302384f5ad110eb5b90940fd4f578994b45253302d52e07936",
|
|
"type": "query",
|
|
"version": 101
|
|
},
|
|
"dc0b7782-0df0-47ff-8337-db0d678bdb66": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Suspicious Content Extracted or Decompressed via Funzip",
|
|
"sha256": "48b2377c407c6fd267364cd6a28cedd0830236fe92ed4e08111591a7a77999b1",
|
|
"type": "eql",
|
|
"version": 4
|
|
},
|
|
"dc672cb7-d5df-4d1f-a6d7-0841b1caafb9": {
|
|
"rule_name": "Threat Intel Filebeat Module (v7.x) Indicator Match",
|
|
"sha256": "a6db1fdda6906b8d352b2d9c369c0b2e4271c911d0919320c8dd20f053d0e095",
|
|
"type": "threat_match",
|
|
"version": 100
|
|
},
|
|
"dc71c186-9fe4-4437-a4d0-85ebb32b8204": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Hidden Process via Mount Hidepid",
|
|
"sha256": "e947ad288f1da43e4a883eb9da07ee706c06e2905ae2445421e2280db1d72486",
|
|
"type": "eql",
|
|
"version": 5
|
|
},
|
|
"dc9c1f74-dac3-48e3-b47f-eb79db358f57": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Volume Shadow Copy Deletion via WMIC",
|
|
"sha256": "6d5c7271ac35ece6b3d5ad727effafd19fad5b0e1fc68ca0ba309bbd0a1ca4c1",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"dca28dee-c999-400f-b640-50a081cc0fd1": {
|
|
"min_stack_version": "8.9",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 207,
|
|
"rule_name": "Unusual Country For an AWS Command",
|
|
"sha256": "09aabd7cf1fd572c2266143f903d21cbaedb757f619cc17b5f2c78b74e046946",
|
|
"type": "machine_learning",
|
|
"version": 108
|
|
}
|
|
},
|
|
"rule_name": "Unusual Country For an AWS Command",
|
|
"sha256": "e6e99ee2cb2084337de3331bcf945c7714a1fc79df6bc880c40dcb399e87a561",
|
|
"type": "machine_learning",
|
|
"version": 208
|
|
},
|
|
"dd34b062-b9e3-4a6b-8c0c-6c8ca6dd450e": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Attempt to Install Kali Linux via WSL",
|
|
"sha256": "e530308b262a81ac2d4d51105ec00c5574674221ede76c621d967f3bafa48e67",
|
|
"type": "eql",
|
|
"version": 5
|
|
},
|
|
"dd7f1524-643e-11ed-9e35-f661ea17fbcd": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Reverse Shell Created via Named Pipe",
|
|
"sha256": "d8b4bfe2baa5dc7735769bd51e37b1b139c521ec70d2ce8db325a4d6e409f82c",
|
|
"type": "eql",
|
|
"version": 6
|
|
},
|
|
"ddab1f5f-7089-44f5-9fda-de5b11322e77": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "NullSessionPipe Registry Modification",
|
|
"sha256": "6ff22a837ebb0aeecf0c358977ae439d6e5c872e7d002a5a13622b00638fa02a",
|
|
"type": "eql",
|
|
"version": 106
|
|
},
|
|
"de9bd7e0-49e9-4e92-a64d-53ade2e66af1": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Unusual Child Process from a System Virtual Process",
|
|
"sha256": "1b4652f974e6422672d712e10f16590cdee1527efd0cc592e2cfacaf6ab10754",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"debff20a-46bc-4a4d-bae5-5cdd14222795": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Base16 or Base32 Encoding/Decoding Activity",
|
|
"sha256": "3fdd204c8b26e4dc4f20eaf80a88b4f37cd9093b77f365fbf505b27c37e500d7",
|
|
"type": "query",
|
|
"version": 107
|
|
},
|
|
"ded09d02-0137-4ccc-8005-c45e617e8d4c": {
|
|
"min_stack_version": "8.6",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 101,
|
|
"rule_name": "Query Registry using Built-in Tools",
|
|
"sha256": "b2ee224e76ea602717f6188bd78728ea09a54c1c694fb5041f9d7f0197db8ebd",
|
|
"type": "eql",
|
|
"version": 2
|
|
}
|
|
},
|
|
"rule_name": "Query Registry using Built-in Tools",
|
|
"sha256": "66c6b23d0b93c2a355ec7809c00272dad9d6ae5d8e1b8c594010f6d352504e9c",
|
|
"type": "new_terms",
|
|
"version": 103
|
|
},
|
|
"df0fd41e-5590-4965-ad5e-cd079ec22fa9": {
|
|
"min_stack_version": "8.6",
|
|
"rule_name": "First Time Seen Driver Loaded",
|
|
"sha256": "ad243a0040fbf3b300d379e356e6d3eb10209a2132942ac2f4e08962b1e8bd79",
|
|
"type": "new_terms",
|
|
"version": 6
|
|
},
|
|
"df197323-72a8-46a9-a08e-3f5b04a4a97a": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Unusual Windows User Calling the Metadata Service",
|
|
"sha256": "d7b5f6ca8779a491a009ef24fa38c89815905e818546c5671f5dc05bd505e3ce",
|
|
"type": "machine_learning",
|
|
"version": 103
|
|
},
|
|
"df26fd74-1baa-4479-b42e-48da84642330": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Azure Automation Account Created",
|
|
"sha256": "b82b8d83b12f049d275d3f1d78e61640c6b772c160ca3844d5e09df9cf465669",
|
|
"type": "query",
|
|
"version": 102
|
|
},
|
|
"df6f62d9-caab-4b88-affa-044f4395a1e0": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Dynamic Linker Copy",
|
|
"sha256": "ad16600cea0282022eecee3a9321b3df7956ff9592e8c777caedaaf750b505c9",
|
|
"type": "eql",
|
|
"version": 106
|
|
},
|
|
"df7fda76-c92b-4943-bc68-04460a5ea5ba": {
|
|
"min_stack_version": "8.4",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 199,
|
|
"rule_name": "Kubernetes Pod Created With HostPID",
|
|
"sha256": "8504c3a7241f7cfb70d23f3d06e6f6c5191c15f0ac37578efdc476c6230b04a6",
|
|
"type": "query",
|
|
"version": 101
|
|
}
|
|
},
|
|
"rule_name": "Kubernetes Pod Created With HostPID",
|
|
"sha256": "b912b62e03d307861dc557cdbfc8fe17d54f7b8a394fee4ec9e46e4539393622",
|
|
"type": "query",
|
|
"version": 203
|
|
},
|
|
"df959768-b0c9-4d45-988c-5606a2be8e5a": {
|
|
"rule_name": "Unusual Process Execution - Temp",
|
|
"sha256": "95a4dd4b036baa17e7ddbfc9e142208cc5b2b5f28ef3a929836c1a6833d3552d",
|
|
"type": "query",
|
|
"version": 100
|
|
},
|
|
"e00b8d49-632f-4dc6-94a5-76153a481915": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Delayed Execution via Ping",
|
|
"sha256": "dea7cf4add6220cd27ddb9f1a641b95436204b87ca0fca1c18dc903d50ce57a4",
|
|
"type": "eql",
|
|
"version": 1
|
|
},
|
|
"e02bd3ea-72c6-4181-ac2b-0f83d17ad969": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Azure Firewall Policy Deletion",
|
|
"sha256": "fbf370e089437f900b3701b3d7a7af66a118801719201fe03fbfea44438802c0",
|
|
"type": "query",
|
|
"version": 102
|
|
},
|
|
"e052c845-48d0-4f46-8a13-7d0aba05df82": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "KRBTGT Delegation Backdoor",
|
|
"sha256": "b59881ecde4fbb260ada06f008c2bf8ff29a1dd8964b75ba7e4aab3e5d1cfbe2",
|
|
"type": "query",
|
|
"version": 106
|
|
},
|
|
"e0881d20-54ac-457f-8733-fe0bc5d44c55": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "System Service Discovery through built-in Windows Utilities",
|
|
"sha256": "5b07769d45f5a33fcbe539609647986809d75daea1b8aa5874d0ae7f0e6a8892",
|
|
"type": "eql",
|
|
"version": 5
|
|
},
|
|
"e08ccd49-0380-4b2b-8d71-8000377d6e49": {
|
|
"min_stack_version": "8.10",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 206,
|
|
"rule_name": "Attempts to Brute Force an Okta User Account",
|
|
"sha256": "71bc21a2e39ae429903f27a300a650a34aed1adfba8e5ce63f527c8362e23d02",
|
|
"type": "threshold",
|
|
"version": 107
|
|
}
|
|
},
|
|
"rule_name": "Attempts to Brute Force an Okta User Account",
|
|
"sha256": "10ee903471646d3de3429f99b45cf5e5d7fadc3fda75e3d87f0d1f495d30f511",
|
|
"type": "threshold",
|
|
"version": 207
|
|
},
|
|
"e0cc3807-e108-483c-bf66-5a4fbe0d7e89": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potentially Suspicious Process Started via tmux or screen",
|
|
"sha256": "e1ed4e0365edf2d5b5f63fc4a633c8d5520823cbb25d79826c9bde9fb5648a6a",
|
|
"type": "eql",
|
|
"version": 2
|
|
},
|
|
"e0dacebe-4311-4d50-9387-b17e89c2e7fd": {
|
|
"min_stack_version": "7.16",
|
|
"rule_name": "Whitespace Padding in Process Command Line",
|
|
"sha256": "2aa8bb1cd50151cb0c68f9f9aaca7894681a205d965326b65eb8c1163e176257",
|
|
"type": "eql",
|
|
"version": 100
|
|
},
|
|
"e0f36de1-0342-453d-95a9-a068b257b053": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Azure Event Hub Deletion",
|
|
"sha256": "a2ecaf7e5ffeba64be9df560b78b9046a7dd8803d4d3e1f50854456965291dc7",
|
|
"type": "query",
|
|
"version": 102
|
|
},
|
|
"e12c0318-99b1-44f2-830c-3a38a43207ca": {
|
|
"min_stack_version": "8.9",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 204,
|
|
"rule_name": "AWS Route Table Created",
|
|
"sha256": "7bc47ab3f6abaaa3ab9719f0b5584578bde76d5e46e45c4f5930b55727fde835",
|
|
"type": "query",
|
|
"version": 105
|
|
}
|
|
},
|
|
"rule_name": "AWS Route Table Created",
|
|
"sha256": "4081dda0ac65323a45109124e0222f68584e912ecdc216ad1e2f5b8f9f431afc",
|
|
"type": "query",
|
|
"version": 205
|
|
},
|
|
"e14c5fd7-fdd7-49c2-9e5b-ec49d817bc8d": {
|
|
"min_stack_version": "8.9",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 204,
|
|
"rule_name": "AWS RDS Cluster Creation",
|
|
"sha256": "1028d9d315c9b25af760a4d81b28115f4bc2ea1653f08740433bc44c0c49ecbf",
|
|
"type": "query",
|
|
"version": 105
|
|
}
|
|
},
|
|
"rule_name": "AWS RDS Cluster Creation",
|
|
"sha256": "064737df50105c6e8c5336eb8537b218f80ef6e29e079214fe8dca37dc5bda32",
|
|
"type": "query",
|
|
"version": 205
|
|
},
|
|
"e19e64ee-130e-4c07-961f-8a339f0b8362": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Connection to External Network via Telnet",
|
|
"sha256": "20d3c6c6a6f6513706a2ebd8383166c55e2c6bbe55be87a27695bc4d93937453",
|
|
"type": "eql",
|
|
"version": 106
|
|
},
|
|
"e1db8899-97c1-4851-8993-3a3265353601": {
|
|
"min_stack_version": "8.9",
|
|
"rule_name": "Potential Data Exfiltration Activity to an Unusual ISO Code",
|
|
"sha256": "cc35fa122722a6fb07e287d93ad415f86567f457bfb947fb14a2273427f257f6",
|
|
"type": "machine_learning",
|
|
"version": 2
|
|
},
|
|
"e2258f48-ba75-4248-951b-7c885edf18c2": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Suspicious Mining Process Creation Event",
|
|
"sha256": "f0e1450bcee3627ea25c3f1149f19e23d974096a93f38f4fcb2f8b1f3cbf4760",
|
|
"type": "eql",
|
|
"version": 5
|
|
},
|
|
"e26aed74-c816-40d3-a810-48d6fbd8b2fd": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Spike in Successful Logon Events from a Source IP",
|
|
"sha256": "433470a845fb7c68a2d975d0c852935ae2f613397f228fcbc0508dab28be90ff",
|
|
"type": "machine_learning",
|
|
"version": 104
|
|
},
|
|
"e26f042e-c590-4e82-8e05-41e81bd822ad": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Suspicious .NET Reflection via PowerShell",
|
|
"sha256": "f96c27d17387a29f3c9e0a76e761e50f58980ca2e8c5c47c750c1112b007a612",
|
|
"type": "query",
|
|
"version": 110
|
|
},
|
|
"e2a67480-3b79-403d-96e3-fdd2992c50ef": {
|
|
"min_stack_version": "8.9",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 207,
|
|
"rule_name": "AWS Management Console Root Login",
|
|
"sha256": "b9dd3e3ff50478a62eb78a03bd6f15b075d2c8b5205f36afb4bb4c84ec2aea89",
|
|
"type": "query",
|
|
"version": 108
|
|
}
|
|
},
|
|
"rule_name": "AWS Management Console Root Login",
|
|
"sha256": "c4f8568aee037cc76372958fdfc1556649341e70f4d8ffc9a8a3f8c1e5fbe0e6",
|
|
"type": "query",
|
|
"version": 208
|
|
},
|
|
"e2dc8f8c-5f16-42fa-b49e-0eb8057f7444": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "System Network Connections Discovery",
|
|
"sha256": "656484abbd7ea6b41057e6c9b6b267bf1bcf9a7144ec6e07f6fe26948404ab9f",
|
|
"type": "eql",
|
|
"version": 2
|
|
},
|
|
"e2e0537d-7d8f-4910-a11d-559bcf61295a": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Windows Subsystem for Linux Enabled via Dism Utility",
|
|
"sha256": "c6f1cf145ff3b061a79e8ace80cc5733fae16573c3ddb49f83073f52ee86ad31",
|
|
"type": "eql",
|
|
"version": 5
|
|
},
|
|
"e2f9fdf5-8076-45ad-9427-41e0e03dc9c2": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Suspicious Process Execution via Renamed PsExec Executable",
|
|
"sha256": "66e388663b228b2c8dd94c6fd5c4d2747293af0ad3223e8467b6dff513bfce19",
|
|
"type": "eql",
|
|
"version": 109
|
|
},
|
|
"e2fb5b18-e33c-4270-851e-c3d675c9afcd": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "GCP IAM Role Deletion",
|
|
"sha256": "81da5ac170cebd66bcbf89e17268d9b7d3559955c522f1623d651961f6419cbe",
|
|
"type": "query",
|
|
"version": 104
|
|
},
|
|
"e3343ab9-4245-4715-b344-e11c56b0a47f": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Process Activity via Compiled HTML File",
|
|
"sha256": "3e2a12fecf522267ef3afeb66114c8854824c72cc1d0e2ae4f0f4bc3a2308f70",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"e3c27562-709a-42bd-82f2-3ed926cced19": {
|
|
"min_stack_version": "8.9",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 204,
|
|
"rule_name": "AWS Route53 private hosted zone associated with a VPC",
|
|
"sha256": "dd9a314d7acf050b51fec079eb2ff4d0667d2954a8fe4eee7a86081d7971db12",
|
|
"type": "query",
|
|
"version": 105
|
|
}
|
|
},
|
|
"rule_name": "AWS Route53 private hosted zone associated with a VPC",
|
|
"sha256": "58bf1f2fc9acd22be3c161424a77c2a213cf1401372313a2272d73d6af866d41",
|
|
"type": "query",
|
|
"version": 205
|
|
},
|
|
"e3c5d5cb-41d5-4206-805c-f30561eae3ac": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Ransomware - Prevented - Elastic Endgame",
|
|
"sha256": "c3d5155da5baae86f8ea73fe2f45b44e3012406d9fc61cd2169142c81be06631",
|
|
"type": "query",
|
|
"version": 101
|
|
},
|
|
"e3cf38fa-d5b8-46cc-87f9-4a7513e4281d": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Connection to Commonly Abused Free SSL Certificate Providers",
|
|
"sha256": "5c04199205cb13930875dbab67b50a81f6de209289212579901c2a02bec11afe",
|
|
"type": "eql",
|
|
"version": 105
|
|
},
|
|
"e3e904b3-0a8e-4e68-86a8-977a163e21d3": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Persistence via KDE AutoStart Script or Desktop File Modification",
|
|
"sha256": "2e2da840f77c57538857f88568962b68c7ed2da6036ccc86ed73e23d95b97f90",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"e468f3f6-7c4c-45bb-846a-053738b3fe5d": {
|
|
"min_stack_version": "8.4",
|
|
"rule_name": "First Time Seen NewCredentials Logon Process",
|
|
"sha256": "856cdc898f8b290d5ebe5bfffde4ce85f483f62eb7e0158a0f9e35f6e8dc2afd",
|
|
"type": "new_terms",
|
|
"version": 1
|
|
},
|
|
"e48236ca-b67a-4b4e-840c-fdc7782bc0c3": {
|
|
"min_stack_version": "8.10",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 205,
|
|
"rule_name": "Attempt to Modify an Okta Network Zone",
|
|
"sha256": "5f65ddaac1e8431e60917074c8cb8ead43d51ca2475c63ef74c89e0b558c3456",
|
|
"type": "query",
|
|
"version": 106
|
|
}
|
|
},
|
|
"rule_name": "Attempt to Modify an Okta Network Zone",
|
|
"sha256": "6d57260382880fab2e20021bd0235b13974bf1bde3fcdb2fe4b85484ea80f4c6",
|
|
"type": "query",
|
|
"version": 206
|
|
},
|
|
"e4e31051-ee01-4307-a6ee-b21b186958f4": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Service Creation via Local Kerberos Authentication",
|
|
"sha256": "c47f1f706cc482c626dc8045250f798362338387db47fe387412408b6be3bae1",
|
|
"type": "eql",
|
|
"version": 105
|
|
},
|
|
"e514d8cd-ed15-4011-84e2-d15147e059f1": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Kerberos Pre-authentication Disabled for User",
|
|
"sha256": "714940633134a4900fd804da4e9b3e223c9d3ff128f229f7a46599938fe9322d",
|
|
"type": "query",
|
|
"version": 109
|
|
},
|
|
"e555105c-ba6d-481f-82bb-9b633e7b4827": {
|
|
"min_stack_version": "8.4",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 202,
|
|
"rule_name": "MFA Disabled for Google Workspace Organization",
|
|
"sha256": "2c13a6fc437d2115e97e6e81a6d555601f5f93d05f444b9935bf76d94877c049",
|
|
"type": "query",
|
|
"version": 104
|
|
}
|
|
},
|
|
"rule_name": "MFA Disabled for Google Workspace Organization",
|
|
"sha256": "91e053deeef1fbe832a95085ef68f2122ba06d94e64114a2d0e61cf3f1d64d6f",
|
|
"type": "query",
|
|
"version": 205
|
|
},
|
|
"e56993d2-759c-4120-984c-9ec9bb940fd5": {
|
|
"rule_name": "RDP (Remote Desktop Protocol) to the Internet",
|
|
"sha256": "e2f1607e4ec15d9f1e4cdfb3c307852c151afef4fa9f42ee068ccd4b335543ed",
|
|
"type": "query",
|
|
"version": 100
|
|
},
|
|
"e6c1a552-7776-44ad-ae0f-8746cc07773c": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Bash Shell Profile Modification",
|
|
"sha256": "bc03a7affdb0db7aca8cb74b550750403c0cc22f1f31640dabbcf506dd04b2b3",
|
|
"type": "query",
|
|
"version": 104
|
|
},
|
|
"e6c98d38-633d-4b3e-9387-42112cd5ac10": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Authorization Plugin Modification",
|
|
"sha256": "0e60f668e5a539600f5060b2537b7bda7cd79b13c441946455056b809cb95563",
|
|
"type": "query",
|
|
"version": 105
|
|
},
|
|
"e6e3ecff-03dd-48ec-acbd-54a04de10c68": {
|
|
"min_stack_version": "8.10",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 204,
|
|
"rule_name": "Possible Okta DoS Attack",
|
|
"sha256": "0068f7eda335ee0ee3e6452f9a91166dd50e098862de1791f4e6b6bd0ff4a391",
|
|
"type": "query",
|
|
"version": 105
|
|
}
|
|
},
|
|
"rule_name": "Possible Okta DoS Attack",
|
|
"sha256": "065c5e51d3541a24ee401d4b9da8787e8fb858c1e89938d7f7fa8daf46e7199e",
|
|
"type": "query",
|
|
"version": 205
|
|
},
|
|
"e6e8912f-283f-4d0d-8442-e0dcaf49944b": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Screensaver Plist File Modified by Unexpected Process",
|
|
"sha256": "7180375170c573c1ff2a7287cba28879a2150c8796bb81c12556a08394e87e8f",
|
|
"type": "eql",
|
|
"version": 106
|
|
},
|
|
"e7075e8d-a966-458e-a183-85cd331af255": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Default Cobalt Strike Team Server Certificate",
|
|
"sha256": "6bbe76d52fd258b99c66bbf69e3f64060fa0a3112a36cd1c55f44d03d2da9d9e",
|
|
"type": "query",
|
|
"version": 104
|
|
},
|
|
"e707a7be-cc52-41ac-8ab3-d34b38c20005": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Credential Access via Memory Dump File Creation",
|
|
"sha256": "49debe62710e167c237de800f3dd2ce6ad4a3f4a6effd957439d576770b4e7c9",
|
|
"type": "eql",
|
|
"version": 1
|
|
},
|
|
"e7125cea-9fe1-42a5-9a05-b0792cf86f5a": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Execution of Persistent Suspicious Program",
|
|
"sha256": "e6030f17314972964810faa00556377b009451a1f81181856e9cd6099eecbfbc",
|
|
"type": "eql",
|
|
"version": 105
|
|
},
|
|
"e72f87d0-a70e-4f8d-8443-a6407bc34643": {
|
|
"min_stack_version": "8.8",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 104,
|
|
"rule_name": "Suspicious WMI Event Subscription Created",
|
|
"sha256": "bee333bfc8d77b96f009283d0b8dc93b5e2e38ef6b27b38b21daccf6fe50833a",
|
|
"type": "eql",
|
|
"version": 6
|
|
}
|
|
},
|
|
"rule_name": "Suspicious WMI Event Subscription Created",
|
|
"sha256": "bee333bfc8d77b96f009283d0b8dc93b5e2e38ef6b27b38b21daccf6fe50833a",
|
|
"type": "eql",
|
|
"version": 105
|
|
},
|
|
"e74d645b-fec6-431e-bf93-ca64a538e0de": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Unusual Process For MSSQL Service Accounts",
|
|
"sha256": "b79eae658a0dc89978d022131f60766565b9d713cf71cfa900e632da05719fe3",
|
|
"type": "eql",
|
|
"version": 2
|
|
},
|
|
"e7cb3cfd-aaa3-4d7b-af18-23b89955062c": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Linux Credential Dumping via Unshadow",
|
|
"sha256": "332682a3600cb59f9e5416f1a36782dd5b2cd5140ad2365e794fe319c8057d6a",
|
|
"type": "eql",
|
|
"version": 6
|
|
},
|
|
"e7cd5982-17c8-4959-874c-633acde7d426": {
|
|
"min_stack_version": "8.9",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 204,
|
|
"rule_name": "AWS Route Table Modified or Deleted",
|
|
"sha256": "aac5e30f0f52cc491d255e93c3f1f83cdb0547f9f20b8fe3376704aee6c6f730",
|
|
"type": "query",
|
|
"version": 105
|
|
}
|
|
},
|
|
"rule_name": "AWS Route Table Modified or Deleted",
|
|
"sha256": "2199bfaa82c73c0e3d8e7c4dd8d7df67b438163716298173157240784ea80fdc",
|
|
"type": "query",
|
|
"version": 205
|
|
},
|
|
"e8571d5f-bea1-46c2-9f56-998de2d3ed95": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Service Control Spawned via Script Interpreter",
|
|
"sha256": "2894b45c8036eb38c332ca6f58cdcc5e872a80caa4e846636d051be8a166fcfe",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"e86da94d-e54b-4fb5-b96c-cecff87e8787": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Installation of Security Support Provider",
|
|
"sha256": "8547cdc3808d7f235d3d0abae6b3718604a0f5fd3b25275e55649bcb89548514",
|
|
"type": "eql",
|
|
"version": 106
|
|
},
|
|
"e88d1fe9-b2f4-48d4-bace-a026dc745d4b": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Host Files System Changes via Windows Subsystem for Linux",
|
|
"sha256": "dc2992b1a27eba7999a488081a344e7546a35fed9138ada9a18fcca55cead2d4",
|
|
"type": "eql",
|
|
"version": 4
|
|
},
|
|
"e9001ee6-2d00-4d2f-849e-b8b1fb05234c": {
|
|
"min_stack_version": "8.6",
|
|
"previous": {
|
|
"8.4": {
|
|
"max_allowable_version": 102,
|
|
"rule_name": "Suspicious System Commands Executed by Previously Unknown Executable",
|
|
"sha256": "3a05a24c654cdb42c8718f7cf97e55b13d9be01f97cfd17a78db8f616168fa80",
|
|
"type": "new_terms",
|
|
"version": 3
|
|
}
|
|
},
|
|
"rule_name": "Suspicious System Commands Executed by Previously Unknown Executable",
|
|
"sha256": "db2a5674e261bc84e14f1523a5864fc02bf8d27e779d4bd8b3ef5e0f8c2a77d8",
|
|
"type": "new_terms",
|
|
"version": 104
|
|
},
|
|
"e90ee3af-45fc-432e-a850-4a58cf14a457": {
|
|
"min_stack_version": "8.10",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 206,
|
|
"rule_name": "High Number of Okta User Password Reset or Unlock Attempts",
|
|
"sha256": "94f8f87bf5279e92dae5e3f1a86adcc88c5e03a1ddc2d3ee3878b1ef488abd08",
|
|
"type": "threshold",
|
|
"version": 107
|
|
}
|
|
},
|
|
"rule_name": "High Number of Okta User Password Reset or Unlock Attempts",
|
|
"sha256": "bb06cc2e64669d793dd0ab51b8f596cf9ed9f9454f861ae51504837bb3552d10",
|
|
"type": "threshold",
|
|
"version": 207
|
|
},
|
|
"e919611d-6b6f-493b-8314-7ed6ac2e413b": {
|
|
"min_stack_version": "8.9",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 204,
|
|
"rule_name": "AWS EC2 VM Export Failure",
|
|
"sha256": "f5fbdb6dd8db185f84352432e56a887048b7d1bac9936d1c3a3944b9f5ed4d31",
|
|
"type": "query",
|
|
"version": 105
|
|
}
|
|
},
|
|
"rule_name": "AWS EC2 VM Export Failure",
|
|
"sha256": "3d6439c0aa3958b93a6dddcf1bd5a4bd85a8a42ea1de077784cbcddffa9842dd",
|
|
"type": "query",
|
|
"version": 205
|
|
},
|
|
"e92c99b6-c547-4bb6-b244-2f27394bc849": {
|
|
"min_stack_version": "8.9",
|
|
"rule_name": "Spike in Bytes Sent to an External Device via Airdrop",
|
|
"sha256": "a15543671d4d5fe65bb33045b81836fa6b6701277fde03baed1cfa4128d58b52",
|
|
"type": "machine_learning",
|
|
"version": 2
|
|
},
|
|
"e94262f2-c1e9-4d3f-a907-aeab16712e1a": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Unusual Executable File Creation by a System Critical Process",
|
|
"sha256": "3f3eec9bc3511f8a7b04c2ea53960d28e2c4cc9c1919b4ac0415627e28f49b80",
|
|
"type": "eql",
|
|
"version": 109
|
|
},
|
|
"e9abe69b-1deb-4e19-ac4a-5d5ac00f72eb": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential LSA Authentication Package Abuse",
|
|
"sha256": "a0ba2b3c599f12c32b5a0939253f61624c5aaef4f8bec7e3c2a58427a1421f1c",
|
|
"type": "eql",
|
|
"version": 104
|
|
},
|
|
"e9b0902b-c515-413b-b80b-a8dcebc81a66": {
|
|
"min_stack_version": "8.9",
|
|
"rule_name": "Spike in Remote File Transfers",
|
|
"sha256": "470e8ced054f1bc59729079e22245fdd3df57ee3c76ad8d61dc913d979c69f89",
|
|
"type": "machine_learning",
|
|
"version": 2
|
|
},
|
|
"e9b4a3c7-24fc-49fd-a00f-9c938031eef1": {
|
|
"rule_name": "Linux Restricted Shell Breakout via busybox Shell Evasion",
|
|
"sha256": "f5726e1a8ce8508e84699dd4648108f26b624ea175aeb4a0cdace248925f0d8a",
|
|
"type": "eql",
|
|
"version": 100
|
|
},
|
|
"e9ff9c1c-fe36-4d0d-b3fd-9e0bf4853a62": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Azure Automation Webhook Created",
|
|
"sha256": "064a5bf18acba039757d18c76b42acec87f1e497cf8143bc705af25765204078",
|
|
"type": "query",
|
|
"version": 102
|
|
},
|
|
"ea0784f0-a4d7-4fea-ae86-4baaf27a6f17": {
|
|
"rule_name": "SSH (Secure Shell) from the Internet",
|
|
"sha256": "a5b483bc27ea95cd71683dd2f631a41276da2ab442b4d14e2e843c1df6519efa",
|
|
"type": "query",
|
|
"version": 100
|
|
},
|
|
"ea09ff26-3902-4c53-bb8e-24b7a5d029dd": {
|
|
"min_stack_version": "8.9",
|
|
"rule_name": "Unusual Process Spawned by a Parent Process",
|
|
"sha256": "67bc8b9711b46b277066e6c665fb98446858a64b2fd08257cd3fbfb87dcdf4fd",
|
|
"type": "machine_learning",
|
|
"version": 2
|
|
},
|
|
"ea248a02-bc47-4043-8e94-2885b19b2636": {
|
|
"min_stack_version": "8.9",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 207,
|
|
"rule_name": "AWS IAM Brute Force of Assume Role Policy",
|
|
"sha256": "d8fbba1e46a7add1e78c5e5e8efbbd07526667d98224a35765adf2574e4c6e80",
|
|
"type": "threshold",
|
|
"version": 108
|
|
}
|
|
},
|
|
"rule_name": "AWS IAM Brute Force of Assume Role Policy",
|
|
"sha256": "c03ce8fcb77809e7578333b7e52f0fe9d851c9f6687eb1a7d20a33e2b642ed3f",
|
|
"type": "threshold",
|
|
"version": 208
|
|
},
|
|
"eaa77d63-9679-4ce3-be25-3ba8b795e5fa": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Spike in Firewall Denies",
|
|
"sha256": "2b70a5f6f296ce20ca6fb54b48a52c4bb57dec8c35b7dfc9b661509716a7cc0a",
|
|
"type": "machine_learning",
|
|
"version": 103
|
|
},
|
|
"eb079c62-4481-4d6e-9643-3ca499df7aaa": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "External Alerts",
|
|
"sha256": "987ec9abd74221c9ba9d74c421bc291c1a711da2030aac49cf842693483d9849",
|
|
"type": "query",
|
|
"version": 102
|
|
},
|
|
"eb44611f-62a8-4036-a5ef-587098be6c43": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "PowerShell Script with Webcam Video Capture Capabilities",
|
|
"sha256": "801852a3300f7b11b19c32b8f4151194247eb06f60814b531d70187da14da0a1",
|
|
"type": "query",
|
|
"version": 2
|
|
},
|
|
"eb610e70-f9e6-4949-82b9-f1c5bcd37c39": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "PowerShell Kerberos Ticket Request",
|
|
"sha256": "362b14187d99cc82260552ac8948c4169dfc7a138c656b64536dd43703b67906",
|
|
"type": "query",
|
|
"version": 110
|
|
},
|
|
"eb6a3790-d52d-11ec-8ce9-f661ea17fbce": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Suspicious Network Connection Attempt by Root",
|
|
"sha256": "7a02f3f1c3af4c212b9b07f86517b323423c7f03670c51025f5a7ea876473d5e",
|
|
"type": "eql",
|
|
"version": 104
|
|
},
|
|
"eb9eb8ba-a983-41d9-9c93-a1c05112ca5e": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Disabling of SELinux",
|
|
"sha256": "67e5d80d98a14e59513c76c67d9e7b585867dfa1bd03bc7fe57b4e529040abcf",
|
|
"type": "query",
|
|
"version": 107
|
|
},
|
|
"ebb200e8-adf0-43f8-a0bb-4ee5b5d852c6": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Mimikatz Memssp Log File Detected",
|
|
"sha256": "76c37cc7a589fe10dfaa88f6b7b661dea40b32593c1b666971619610af0593c6",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"ebf1adea-ccf2-4943-8b96-7ab11ca173a5": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "IIS HTTP Logging Disabled",
|
|
"sha256": "4bf7615c712ba6551f11469f116ac403329d8282ac9506d5ccd5b57da83c51b6",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"ebfe1448-7fac-4d59-acea-181bd89b1f7f": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Process Execution from an Unusual Directory",
|
|
"sha256": "76315bba25abe84b119f44de4c1b6c4f33fdc53d08a5ea67631b6f821c288236",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"ec604672-bed9-43e1-8871-cf591c052550": {
|
|
"min_stack_version": "8.8",
|
|
"rule_name": "File Made Executable via Chmod Inside A Container",
|
|
"sha256": "20c2ee6633bad709523ecb7a36a5e666212d251d264feca7543facf2bb56ea54",
|
|
"type": "eql",
|
|
"version": 2
|
|
},
|
|
"ec8efb0c-604d-42fa-ac46-ed1cfbc38f78": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Microsoft 365 Inbox Forwarding Rule Created",
|
|
"sha256": "ccb7629ab98a47b76d488ad0234349226bd54d20ba68a72bfa6d504471d57576",
|
|
"type": "query",
|
|
"version": 102
|
|
},
|
|
"ecd4857b-5bac-455e-a7c9-a88b66e56a9e": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Executable File with Unusual Extension",
|
|
"sha256": "d740eda69b10b688372f488feab1a6e9af2a26122ee1f6af6de7612aa33706e8",
|
|
"type": "eql",
|
|
"version": 1
|
|
},
|
|
"ecf2b32c-e221-4bd4-aa3b-c7d59b3bc01d": {
|
|
"min_stack_version": "8.9",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 204,
|
|
"rule_name": "AWS RDS Instance/Cluster Stoppage",
|
|
"sha256": "507678779aec70fd7d8e6f87c97bad4456c69b88fbf5e1ef2ede267b6c6d356b",
|
|
"type": "query",
|
|
"version": 105
|
|
}
|
|
},
|
|
"rule_name": "AWS RDS Instance/Cluster Stoppage",
|
|
"sha256": "ac0a0d9ae3dd952d42b9953594ccbb2e820c3b3754a613810c6568a3fb3205bc",
|
|
"type": "query",
|
|
"version": 205
|
|
},
|
|
"ed9ecd27-e3e6-4fd9-8586-7754803f7fc8": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Azure Global Administrator Role Addition to PIM User",
|
|
"sha256": "05eb2cfe7c6c45d6ae432cf2c83e8d0a56cb0a6c5111004de8625830d13ee06c",
|
|
"type": "query",
|
|
"version": 102
|
|
},
|
|
"eda499b8-a073-4e35-9733-22ec71f57f3a": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "AdFind Command Activity",
|
|
"sha256": "8a1027b9ad2f5361439241c61ece4bf8059f137a0718d154612fc6bc4e1582b6",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"edb91186-1c7e-4db8-b53e-bfa33a1a0a8a": {
|
|
"min_stack_version": "8.10",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 205,
|
|
"rule_name": "Attempt to Deactivate an Okta Application",
|
|
"sha256": "561500f4153a16fe94b06be9237be4ba8933a3192116af5ef57bdb83da24f973",
|
|
"type": "query",
|
|
"version": 106
|
|
}
|
|
},
|
|
"rule_name": "Attempt to Deactivate an Okta Application",
|
|
"sha256": "6015ee3b4d4c29fbd1e06ca5bb2947716089acffc92c07d1e1ef36a3aace0a7c",
|
|
"type": "query",
|
|
"version": 206
|
|
},
|
|
"edf8ee23-5ea7-4123-ba19-56b41e424ae3": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "ImageLoad via Windows Update Auto Update Client",
|
|
"sha256": "b08b05384865af516f9051b9fda7a2e86423e826268d86119d94bed51a40ae68",
|
|
"type": "eql",
|
|
"version": 109
|
|
},
|
|
"edfd5ca9-9d6c-44d9-b615-1e56b920219c": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Linux User Account Creation",
|
|
"sha256": "13b3b537fd8a6d150005572a86b138310ddc48a6341f26efff995090c828b47f",
|
|
"type": "eql",
|
|
"version": 3
|
|
},
|
|
"ee39a9f7-5a79-4b0a-9815-d36b3cf28d3e": {
|
|
"min_stack_version": "8.10",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 102,
|
|
"rule_name": "Okta FastPass Phishing Detection",
|
|
"sha256": "ec087af423a304d3b2f85af7926ba24f67f6207424c00d258a6e350a6721c932",
|
|
"type": "query",
|
|
"version": 3
|
|
}
|
|
},
|
|
"rule_name": "Okta FastPass Phishing Detection",
|
|
"sha256": "7957913d2c6870b3555352c9d5fff8bfa7ff001d9caf6ea1db026023c46d044c",
|
|
"type": "query",
|
|
"version": 103
|
|
},
|
|
"ee5300a7-7e31-4a72-a258-250abb8b3aa1": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Unusual Print Spooler Child Process",
|
|
"sha256": "1b81a42027a994ad37e3fd6a68e0cca9c1f3620c0ec4479d34cc05a33c94986c",
|
|
"type": "eql",
|
|
"version": 105
|
|
},
|
|
"ee53d67a-5f0c-423c-a53c-8084ae562b5c": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Shortcut File Written or Modified on Startup Folder",
|
|
"sha256": "0d2db57efc137fb2c937163b2d094d9504f0f8ef15c3c7805ad1b83d14ed8ee0",
|
|
"type": "eql",
|
|
"version": 1
|
|
},
|
|
"ee619805-54d7-4c56-ba6f-7717282ddd73": {
|
|
"rule_name": "Linux Restricted Shell Breakout via crash Shell evasion",
|
|
"sha256": "284931b7332c5d8775ad1b0d93e012b6b7391afd6b546209c576ebbb44f85a80",
|
|
"type": "eql",
|
|
"version": 100
|
|
},
|
|
"eea82229-b002-470e-a9e1-00be38b14d32": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Privacy Control Bypass via TCCDB Modification",
|
|
"sha256": "26d4865a30d6490602a379d7abcba4e5aa0095e306e662d489bb63f80cb57bc9",
|
|
"type": "eql",
|
|
"version": 106
|
|
},
|
|
"ef04a476-07ec-48fc-8f3d-5e1742de76d3": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "BPF filter applied using TC",
|
|
"sha256": "0ea652ae4056c21deda839089e82be5e8d139fe2a4d663b1c351ea38f5373b52",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"ef100a2e-ecd4-4f72-9d1e-2f779ff3c311": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Linux Credential Dumping via Proc Filesystem",
|
|
"sha256": "b484fef67869242e81d258aa6dd2f985dce79cf7ac6f49d81e8d62e1b34d69aa",
|
|
"type": "eql",
|
|
"version": 5
|
|
},
|
|
"ef862985-3f13-4262-a686-5f357bbb9bc2": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Whoami Process Activity",
|
|
"sha256": "69d5354c891fc163e1c5ade3bb65daff48c54108062356e2608bbe10b4bc33dd",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"ef8cc01c-fc49-4954-a175-98569c646740": {
|
|
"min_stack_version": "8.9",
|
|
"rule_name": "Potential Data Exfiltration Activity to an Unusual Destination Port",
|
|
"sha256": "56cd681da1967f0a220f930eeadbda12546363729b2fa2a955f9c59ac16086a4",
|
|
"type": "machine_learning",
|
|
"version": 2
|
|
},
|
|
"f036953a-4615-4707-a1ca-dc53bf69dcd5": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Unusual Child Processes of RunDLL32",
|
|
"sha256": "2c5262665887e553b48f7df98f3d614aefdf59b44a481d0ec6f946a75ba61cab",
|
|
"type": "eql",
|
|
"version": 106
|
|
},
|
|
"f0493cb4-9b15-43a9-9359-68c23a7f2cf3": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Suspicious HTML File Creation",
|
|
"sha256": "b3a8f746278cc301f6dc58d9f527dea32590a6d76cef0455b4f613d70e2d67a6",
|
|
"type": "eql",
|
|
"version": 105
|
|
},
|
|
"f06414a6-f2a4-466d-8eba-10f85e8abf71": {
|
|
"min_stack_version": "8.10",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 204,
|
|
"rule_name": "Administrator Role Assigned to an Okta User",
|
|
"sha256": "333aec880e8bd1653cea01f896e3df2e136839275bf1cffd71197ec4068129ba",
|
|
"type": "query",
|
|
"version": 105
|
|
}
|
|
},
|
|
"rule_name": "Administrator Role Assigned to an Okta User",
|
|
"sha256": "129a8d5f0cd2075e7fe6a38059a5ddcd26d18f1d6b9d8b93950bf60863671395",
|
|
"type": "query",
|
|
"version": 205
|
|
},
|
|
"f0b48bbc-549e-4bcf-8ee0-a7a72586c6a7": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Attempt to Remove File Quarantine Attribute",
|
|
"sha256": "692fa40e6bf4142e039d77a8009d3ffaf73cb02fb0bad253f89a7791b27bb286",
|
|
"type": "eql",
|
|
"version": 106
|
|
},
|
|
"f0bc081a-2346-4744-a6a4-81514817e888": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Azure Alert Suppression Rule Created or Modified",
|
|
"sha256": "1dce5b8c0bd067b1f048753efed2565f84b6d4c289bed2adbc7a6bf3f8a89270",
|
|
"type": "query",
|
|
"version": 102
|
|
},
|
|
"f0eb70e9-71e9-40cd-813f-bf8e8c812cb1": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Execution with Explicit Credentials via Scripting",
|
|
"sha256": "86c5bd201fcce02f843be59ad5577b453feab265fb5ace94414dfd794f1083c5",
|
|
"type": "query",
|
|
"version": 105
|
|
},
|
|
"f16fca20-4d6c-43f9-aec1-20b6de3b0aeb": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Remote Code Execution via Web Server",
|
|
"sha256": "9879db0ee4eb6fa5d55af57657d48ec0820bae075840304cdd6e403fc3ab1a1f",
|
|
"type": "eql",
|
|
"version": 6
|
|
},
|
|
"f1a6d0f4-95b8-11ed-9517-f661ea17fbcc": {
|
|
"min_stack_version": "8.4",
|
|
"rule_name": "Forwarded Google Workspace Security Alert",
|
|
"sha256": "4c73b09f4b3001484895476ebe7fa98e28d4b4ade73a8bc8cae1bf26c22cf8af",
|
|
"type": "query",
|
|
"version": 2
|
|
},
|
|
"f243fe39-83a4-46f3-a3b6-707557a102df": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Service Path Modification",
|
|
"sha256": "790cb59192049129174ca88a5027bbc545f0d19ab6d4278e4bd826f2aaedcfc4",
|
|
"type": "eql",
|
|
"version": 1
|
|
},
|
|
"f24bcae1-8980-4b30-b5dd-f851b055c9e7": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Creation of Hidden Login Item via Apple Script",
|
|
"sha256": "6fb54f1660018d11515f2fbdb198da3ff179bd8c841c93cccdb1fc2e681d5f7e",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"f28e2be4-6eca-4349-bdd9-381573730c22": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential OpenSSH Backdoor Logging Activity",
|
|
"sha256": "401bf25e8e77ccc790d62c63f3b09edebad5cd9b70eac15912db6aaa46127d58",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"f2c7b914-eda3-40c2-96ac-d23ef91776ca": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "SIP Provider Modification",
|
|
"sha256": "66bb086ae806373755f3c312b7a40a726c84622d160a5d644fe31f651e50d2b3",
|
|
"type": "eql",
|
|
"version": 105
|
|
},
|
|
"f2f46686-6f3c-4724-bd7d-24e31c70f98f": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "LSASS Memory Dump Creation",
|
|
"sha256": "c5245d22a0267264ade24de174cf1032b9c68466730cc42d6e58734984ae0c96",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"f30f3443-4fbb-4c27-ab89-c3ad49d62315": {
|
|
"min_stack_version": "8.9",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 204,
|
|
"rule_name": "AWS RDS Instance Creation",
|
|
"sha256": "1b57c3c8d9066a43e2cf1493eb351327278a05bf30471e51460fc99b3134a1c5",
|
|
"type": "query",
|
|
"version": 105
|
|
}
|
|
},
|
|
"rule_name": "AWS RDS Instance Creation",
|
|
"sha256": "25aeaebf372fd4e468e990590efe81685706f45ab5eb44bb246d187a16a8b6e0",
|
|
"type": "query",
|
|
"version": 205
|
|
},
|
|
"f33e68a4-bd19-11ed-b02f-f661ea17fbcc": {
|
|
"min_stack_version": "8.4",
|
|
"rule_name": "Google Workspace Object Copied from External Drive and Access Granted to Custom Application",
|
|
"sha256": "bf31263ee7b3dd377aad879072d95f3cfa5f487f3db9f91e6d47822700c554c9",
|
|
"type": "eql",
|
|
"version": 4
|
|
},
|
|
"f3403393-1fd9-4686-8f6e-596c58bc00b4": {
|
|
"min_stack_version": "8.9",
|
|
"rule_name": "Machine Learning Detected a DNS Request Predicted to be a DGA Domain",
|
|
"sha256": "23a660434de3455f0a6de99e5a7da5c45a05eeeffa82698844dcbab5d76c3932",
|
|
"type": "query",
|
|
"version": 2
|
|
},
|
|
"f3475224-b179-4f78-8877-c2bd64c26b88": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "WMI Incoming Lateral Movement",
|
|
"sha256": "05dfb891d848215da2bda7c42b5229022f92e80d8ee4f97ea007d57196cfd637",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"f37f3054-d40b-49ac-aa9b-a786c74c58b8": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Sudo Heap-Based Buffer Overflow Attempt",
|
|
"sha256": "115660e13a810016b291f195725e24a486fef4f4a29c1b6ea99e35462af86691",
|
|
"type": "threshold",
|
|
"version": 103
|
|
},
|
|
"f3e22c8b-ea47-45d1-b502-b57b6de950b3": {
|
|
"min_stack_version": "8.5",
|
|
"rule_name": "Threat Intel URL Indicator Match",
|
|
"sha256": "15e6c5f162e68e3e99d55f3e56f8e12ff21a337b3225df19df18e23d5223c734",
|
|
"type": "threat_match",
|
|
"version": 4
|
|
},
|
|
"f41296b4-9975-44d6-9486-514c6f635b2d": {
|
|
"min_stack_version": "8.6",
|
|
"rule_name": "Potential curl CVE-2023-38545 Exploitation",
|
|
"sha256": "ad7d073b51e1fa98d9af62232945217608d7cb3996a06e33226a4dcd83b222ef",
|
|
"type": "eql",
|
|
"version": 3
|
|
},
|
|
"f44fa4b6-524c-4e87-8d9e-a32599e4fb7c": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Persistence via Microsoft Office AddIns",
|
|
"sha256": "3532dcb1643708a0b5c5e2ae8f0674579cbb77fe60a022151328d4b38fbb72dd",
|
|
"type": "eql",
|
|
"version": 106
|
|
},
|
|
"f494c678-3c33-43aa-b169-bb3d5198c41d": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Sensitive Privilege SeEnableDelegationPrivilege assigned to a User",
|
|
"sha256": "d98a7e83fa24ec297e90f61de9d4e6781cfc0ba17dc00049f79130145d7ab7c7",
|
|
"type": "query",
|
|
"version": 109
|
|
},
|
|
"f52362cd-baf1-4b6d-84be-064efc826461": {
|
|
"rule_name": "Linux Restricted Shell Breakout via flock Shell evasion",
|
|
"sha256": "9a30702aaa4b583d4dfed22529c75be33a32d661580c7885d29a45fb627ec6b7",
|
|
"type": "eql",
|
|
"version": 100
|
|
},
|
|
"f530ca17-153b-4a7a-8cd3-98dd4b4ddf73": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Suspicious Data Encryption via OpenSSL Utility",
|
|
"sha256": "ddced9a0cc70d7a97aff4223b6abe5ed8faf61be30e7e56fbc87b2d124b9e693",
|
|
"type": "eql",
|
|
"version": 4
|
|
},
|
|
"f545ff26-3c94-4fd0-bd33-3c7f95a3a0fc": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Windows Script Executing PowerShell",
|
|
"sha256": "98f9b2395052ffc073feec29bc55c3952eae38faa5304ab59098692287a2995e",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"f5488ac1-099e-4008-a6cb-fb638a0f0828": {
|
|
"min_stack_version": "8.8",
|
|
"rule_name": "SSH Connection Established Inside A Running Container",
|
|
"sha256": "acfdb1c9d79a1ed5b532921e9010c1184da0de54b516f1c0505265cb48c135b7",
|
|
"type": "eql",
|
|
"version": 2
|
|
},
|
|
"f580bf0a-2d23-43bb-b8e1-17548bb947ec": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Rare SMB Connection to the Internet",
|
|
"sha256": "9a94f4d8101faf26b2c6b27adeca58352ce001eed85ee4b6bbb0bdf460045ec5",
|
|
"type": "new_terms",
|
|
"version": 1
|
|
},
|
|
"f5861570-e39a-4b8a-9259-abd39f84cb97": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "WRITEDAC Access on Active Directory Object",
|
|
"sha256": "9d093df26320c45b314e47dc2317d5b84a706d33b570f9b302014671f4b684de",
|
|
"type": "query",
|
|
"version": 2
|
|
},
|
|
"f59668de-caa0-4b84-94c1-3a1549e1e798": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "WMIC Remote Command",
|
|
"sha256": "e1ef94a11c4732f762e8f4e61014834b56c85ac0b9238a537e111d942fb12601",
|
|
"type": "eql",
|
|
"version": 2
|
|
},
|
|
"f5c005d3-4e17-48b0-9cd7-444d48857f97": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Setcap setuid/setgid Capability Set",
|
|
"sha256": "39e23b5edd4a250cfcefb9fd66eebd1876f9a408c1ca69902bad707c1ccfa236",
|
|
"type": "eql",
|
|
"version": 3
|
|
},
|
|
"f5d9d36d-7c30-4cdb-a856-9f653c13d4e0": {
|
|
"min_stack_version": "8.9",
|
|
"rule_name": "Suspicious Windows Process Cluster Spawned by a Parent Process",
|
|
"sha256": "866744b042cda9a292065f261e1a62d729b5c7aca98c990bd5be1c0dbf04bc39",
|
|
"type": "machine_learning",
|
|
"version": 2
|
|
},
|
|
"f5fb4598-4f10-11ed-bdc3-0242ac120002": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Masquerading Space After Filename",
|
|
"sha256": "c008022dcc942aac497e03a345678d4351f22bd37f8df7b55687be5b5ed9ce43",
|
|
"type": "eql",
|
|
"version": 5
|
|
},
|
|
"f638a66d-3bbf-46b1-a52c-ef6f39fb6caf": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Account or Group Discovery via Built-In Tools",
|
|
"sha256": "402cdc6a8b9fbe4bbda7174be70efe396596bdbc7c8e4adb6b4edffeb52d8334",
|
|
"type": "eql",
|
|
"version": 2
|
|
},
|
|
"f63c8e3c-d396-404f-b2ea-0379d3942d73": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Windows Firewall Disabled via PowerShell",
|
|
"sha256": "48ce252c07058d2ee1ca0800d2b1fecbe03128d07992d41375ca0c03b6a48f48",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"f675872f-6d85-40a3-b502-c0d2ef101e92": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Delete Volume USN Journal with Fsutil",
|
|
"sha256": "cee57a655fce6db9f5c07b5bed43fda69027de2fad8e578801e6811bab06077f",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"f683dcdf-a018-4801-b066-193d4ae6c8e5": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "SoftwareUpdate Preferences Modification",
|
|
"sha256": "fb87b9eb3ce642106368e9900a834940914053f852b8fb77bc5c68cc937f3312",
|
|
"type": "query",
|
|
"version": 105
|
|
},
|
|
"f75f65cf-ed04-48df-a7ff-b02a8bfe636e": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "System Hosts File Access",
|
|
"sha256": "f1c8e65d5f5b64c4daf0001b6c893d1cb6b75923a7d71c1986c7a6366a5fee9b",
|
|
"type": "eql",
|
|
"version": 2
|
|
},
|
|
"f766ffaf-9568-4909-b734-75d19b35cbf4": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Azure Service Principal Credentials Added",
|
|
"sha256": "93799b4dd788cc7cc2a439cc2a75f129676cafe866903105bfe880aa4a466103",
|
|
"type": "query",
|
|
"version": 102
|
|
},
|
|
"f772ec8a-e182-483c-91d2-72058f76a44c": {
|
|
"min_stack_version": "8.9",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 207,
|
|
"rule_name": "AWS CloudWatch Alarm Deletion",
|
|
"sha256": "c61b6a72d80df0fd58791ed1d3826f037ed108533807e6817a707d013f73e4bd",
|
|
"type": "query",
|
|
"version": 108
|
|
}
|
|
},
|
|
"rule_name": "AWS CloudWatch Alarm Deletion",
|
|
"sha256": "c58352df4a9adcf9259a2e3656fddae07215b10995a31acba7684366f084e0a9",
|
|
"type": "query",
|
|
"version": 208
|
|
},
|
|
"f7769104-e8f9-4931-94a2-68fc04eadec3": {
|
|
"min_stack_version": "8.8",
|
|
"rule_name": "SSH Authorized Keys File Modified Inside a Container",
|
|
"sha256": "d08ada3a6198777da68c1ad854b2c989ea3c25a2cd89c68741c538de9a433237",
|
|
"type": "eql",
|
|
"version": 2
|
|
},
|
|
"f7c4dc5a-a58d-491d-9f14-9b66507121c0": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Persistent Scripts in the Startup Directory",
|
|
"sha256": "cba0ef209d381391715a1d4cc32407099e0cc2826fad303f04e46cf39d3effb6",
|
|
"type": "eql",
|
|
"version": 109
|
|
},
|
|
"f81ee52c-297e-46d9-9205-07e66931df26": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Microsoft Exchange Worker Spawning Suspicious Processes",
|
|
"sha256": "eaf1fe196b0fd766b9dd3e92a9dea8ee67510efe613dff0483b398abdcf91389",
|
|
"type": "eql",
|
|
"version": 106
|
|
},
|
|
"f85ce03f-d8a8-4c83-acdc-5c8cd0592be7": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Suspicious Child Process of Adobe Acrobat Reader Update Service",
|
|
"sha256": "f27060c1e1635cedb3d4db1d8bb5ddabdf1ffa478643e158e4847d1405cac3ca",
|
|
"type": "query",
|
|
"version": 105
|
|
},
|
|
"f874315d-5188-4b4a-8521-d1c73093a7e4": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Modification of AmsiEnable Registry Key",
|
|
"sha256": "902e8a91c828264acc25b9b1ef81880b919f5739fef7a59cc8b1af766f54d38b",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"f9590f47-6bd5-4a49-bd49-a2f886476fb9": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Unusual Linux Network Configuration Discovery",
|
|
"sha256": "4dd687fdbb673c91ffcda22bc2630d7ea3e59cd3af2a796d57bd7077684f6042",
|
|
"type": "machine_learning",
|
|
"version": 104
|
|
},
|
|
"f95972d3-c23b-463b-89a8-796b3f369b49": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Ingress Transfer via Windows BITS",
|
|
"sha256": "17194641e5b83110a15ad1ea56df6e69c2061a202fd582a587fa4581966173fa",
|
|
"type": "eql",
|
|
"version": 6
|
|
},
|
|
"f97504ac-1053-498f-aeaa-c6d01e76b379": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Browser Extension Install",
|
|
"sha256": "6079caeac5bb8aaf376eca68eabd0a6470f809ea118a564a2bff36d9612b7e65",
|
|
"type": "eql",
|
|
"version": 1
|
|
},
|
|
"f9790abf-bd0c-45f9-8b5f-d0b74015e029": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Privileged Account Brute Force",
|
|
"sha256": "36afec4fdbf0b0dbe5dd5f33cf28d0866a711012c96115ea0e205eb6bd791364",
|
|
"type": "eql",
|
|
"version": 8
|
|
},
|
|
"f994964f-6fce-4d75-8e79-e16ccc412588": {
|
|
"min_stack_version": "8.10",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 204,
|
|
"rule_name": "Suspicious Activity Reported by Okta User",
|
|
"sha256": "f35146f9e2f6aef85cb21013ab2bc3039a0a449e1bf4ed3322496b0dbc449e06",
|
|
"type": "query",
|
|
"version": 105
|
|
}
|
|
},
|
|
"rule_name": "Suspicious Activity Reported by Okta User",
|
|
"sha256": "248121396e46c80ff9a64d88848fd372e40eef61b3d43d31e6ef56a70477f392",
|
|
"type": "query",
|
|
"version": 205
|
|
},
|
|
"fa01341d-6662-426b-9d0c-6d81e33c8a9d": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Remote File Copy to a Hidden Share",
|
|
"sha256": "07cb5a601ba090bd310db66dc7a01f3be28530f661533672dc80eae9361219ca",
|
|
"type": "eql",
|
|
"version": 106
|
|
},
|
|
"fa210b61-b627-4e5e-86f4-17e8270656ab": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential External Linux SSH Brute Force Detected",
|
|
"sha256": "218530cac5856894e6aa5cd3de9220598341cf39e21207726a8736e796656132",
|
|
"type": "eql",
|
|
"version": 5
|
|
},
|
|
"fa3a59dc-33c3-43bf-80a9-e8437a922c7f": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Reverse Shell via Suspicious Binary",
|
|
"sha256": "0614d99e192ebf727ca5211629665791841cb5b9db109bf11e3b8d8c67d84491",
|
|
"type": "eql",
|
|
"version": 6
|
|
},
|
|
"fa488440-04cc-41d7-9279-539387bf2a17": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Suspicious Antimalware Scan Interface DLL",
|
|
"sha256": "49d714fa5c7450eb4f2ae0d249c48cc4200969fed6ea2b87d14a560608ca32ce",
|
|
"type": "eql",
|
|
"version": 6
|
|
},
|
|
"fac52c69-2646-4e79-89c0-fd7653461010": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Disabling of AppArmor",
|
|
"sha256": "34fdcfc5bff48dc2d657a33d95b6f8a56e38e5110fad29d01863329e1f5e1f68",
|
|
"type": "eql",
|
|
"version": 3
|
|
},
|
|
"fb01d790-9f74-4e76-97dd-b4b0f7bf6435": {
|
|
"min_stack_version": "8.4",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 101,
|
|
"rule_name": "Potential Masquerading as System32 DLL",
|
|
"sha256": "44de9f686412f5ba599fbbf3c20d3d9a0e941c644469a473712133ff1293bf6d",
|
|
"type": "eql",
|
|
"version": 2
|
|
}
|
|
},
|
|
"rule_name": "Potential Masquerading as System32 DLL",
|
|
"sha256": "83d55181cc10cf106c86f733adfc8bcd7100be39580cbdaf2784a6237cd2f61b",
|
|
"type": "eql",
|
|
"version": 102
|
|
},
|
|
"fb02b8d3-71ee-4af1-bacd-215d23f17efa": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Network Connection via Registration Utility",
|
|
"sha256": "43bf761ed99e39883a71417804e95161874113a3d08e64e551fe474bb054586c",
|
|
"type": "eql",
|
|
"version": 106
|
|
},
|
|
"fb9937ce-7e21-46bf-831d-1ad96eac674d": {
|
|
"rule_name": "Auditd Max Failed Login Attempts",
|
|
"sha256": "10e3eb490a17e954aaf3fe1059a57a5b3f7f064eeea3e41b6ac7799bde4ce412",
|
|
"type": "query",
|
|
"version": 100
|
|
},
|
|
"fbd44836-0d69-4004-a0b4-03c20370c435": {
|
|
"min_stack_version": "8.9",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 204,
|
|
"rule_name": "AWS Configuration Recorder Stopped",
|
|
"sha256": "624fbf2987e46d010e6f19338b9a13acbd0fc5afb7c2704f7f5d076d82b9ced4",
|
|
"type": "query",
|
|
"version": 105
|
|
}
|
|
},
|
|
"rule_name": "AWS Configuration Recorder Stopped",
|
|
"sha256": "e2cf9c3a12bd9ec52910d1a412e540d1f76113ddae474ae4fe22f81ed3aafb15",
|
|
"type": "query",
|
|
"version": 205
|
|
},
|
|
"fc7c0fa4-8f03-4b3e-8336-c5feab0be022": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "UAC Bypass Attempt via Elevated COM Internet Explorer Add-On Installer",
|
|
"sha256": "695672533f96849fc04744a44bb0c3d2c8ad763e56b29d8e9df74708aa58ec0e",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"fd3fc25e-7c7c-4613-8209-97942ac609f6": {
|
|
"rule_name": "Linux Restricted Shell Breakout via the expect command",
|
|
"sha256": "39518f23768d9d8d0aee453661f03bc6b0f23cbb1de79fc370a7816ecebba032",
|
|
"type": "eql",
|
|
"version": 100
|
|
},
|
|
"fd4a992d-6130-4802-9ff8-829b89ae801f": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Application Shimming via Sdbinst",
|
|
"sha256": "1b6fb7fa94a0e738049d247dc04b6264f0be47b0bcd5ad5a93807de37e0d5f67",
|
|
"type": "eql",
|
|
"version": 107
|
|
},
|
|
"fd70c98a-c410-42dc-a2e3-761c71848acf": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Suspicious CertUtil Commands",
|
|
"sha256": "fd88b16bea9e60d003cfb12c298738c8c7c185dcbe2daa2b7efe66e7bc09b023",
|
|
"type": "eql",
|
|
"version": 106
|
|
},
|
|
"fd7a6052-58fa-4397-93c3-4795249ccfa2": {
|
|
"min_stack_version": "8.6",
|
|
"previous": {
|
|
"8.3": {
|
|
"max_allowable_version": 206,
|
|
"rule_name": "Svchost spawning Cmd",
|
|
"sha256": "2be5bf0d0a6fe7332e43fa29c1f0701bd1ddd82b98458eb81fbd031b4190ff04",
|
|
"type": "eql",
|
|
"version": 107
|
|
}
|
|
},
|
|
"rule_name": "Svchost spawning Cmd",
|
|
"sha256": "7848efd45bcbe0c34fac7bba24931d7f0cafe07c08a91af0e478d23d723a0bfd",
|
|
"type": "new_terms",
|
|
"version": 208
|
|
},
|
|
"fd9484f2-1c56-44ae-8b28-dc1354e3a0e8": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Image Loaded with Invalid Signature",
|
|
"sha256": "cc47fed45ee058e096104f4c1d2e2068a516895cf8a9e85ab1511686b49de1ee",
|
|
"type": "eql",
|
|
"version": 1
|
|
},
|
|
"fda1d332-5e08-4f27-8a9b-8c802e3292a6": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "System Binary Copied and/or Moved to Suspicious Directory",
|
|
"sha256": "9e0d8bd2ea5e365a73509a4d11f7cf61209d79e01d70d9fe086c66b920dde083",
|
|
"type": "eql",
|
|
"version": 4
|
|
},
|
|
"fddff193-48a3-484d-8d35-90bb3d323a56": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "PowerShell Kerberos Ticket Dump",
|
|
"sha256": "44dd765994937208cfee2f6b3d0e125111cbe88d94a5c67e840065955d2d3ea3",
|
|
"type": "query",
|
|
"version": 3
|
|
},
|
|
"fe25d5bc-01fa-494a-95ff-535c29cc4c96": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "PowerShell Script with Password Policy Discovery Capabilities",
|
|
"sha256": "233aae2af8866a118d0080a5d695beef8bddfb17bf9788964055df0f6cfdad5b",
|
|
"type": "query",
|
|
"version": 3
|
|
},
|
|
"fe794edd-487f-4a90-b285-3ee54f2af2d3": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Microsoft Windows Defender Tampering",
|
|
"sha256": "c96941a5ebb42e39bd2527bcfd0d2be708992dbdf722a7622a1642525b235ddd",
|
|
"type": "eql",
|
|
"version": 108
|
|
},
|
|
"feafdc51-c575-4ed2-89dd-8e20badc2d6c": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Masquerading as Business App Installer",
|
|
"sha256": "f8fb3a902d4649dae09ebfd3622387f97612d9ce93d0c82dc28badc57bf61ae1",
|
|
"type": "eql",
|
|
"version": 2
|
|
},
|
|
"fec7ccb7-6ed9-4f98-93ab-d6b366b063a0": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Execution via MS VisualStudio Pre/Post Build Events",
|
|
"sha256": "2d4dac5ee69aa01095329c1850ad5569f1d4d34fe06d5a73ef0f4fb93b1d98b7",
|
|
"type": "eql",
|
|
"version": 1
|
|
},
|
|
"feeed87c-5e95-4339-aef1-47fd79bcfbe3": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "MS Office Macro Security Registry Modifications",
|
|
"sha256": "df7ad57c972d298da6bf985f44b45cc04e2ebac358b7aa99a0662df6ab2d550b",
|
|
"type": "eql",
|
|
"version": 106
|
|
},
|
|
"ff013cb4-274d-434a-96bb-fe15ddd3ae92": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Roshal Archive (RAR) or PowerShell File Downloaded from the Internet",
|
|
"sha256": "be298496f5dc80a824431ca74dd636b027fd4a95e5b4cae739b13de1c3dfe055",
|
|
"type": "query",
|
|
"version": 103
|
|
},
|
|
"ff0d807d-869b-4a0d-a493-52bc46d2f1b1": {
|
|
"min_stack_version": "8.9",
|
|
"rule_name": "Potential DGA Activity",
|
|
"sha256": "589696d2263aedd5164e45823daed51e955d30cab677ac76f94129cb6dba05da",
|
|
"type": "machine_learning",
|
|
"version": 2
|
|
},
|
|
"ff10d4d8-fea7-422d-afb1-e5a2702369a9": {
|
|
"min_stack_version": "8.6",
|
|
"rule_name": "Cron Job Created or Changed by Previously Unknown Process",
|
|
"sha256": "616a82f9d56e96eca039a36156317b57f3ad06c109ee04f3772e1acd1fb66457",
|
|
"type": "new_terms",
|
|
"version": 7
|
|
},
|
|
"ff4599cb-409f-4910-a239-52e4e6f532ff": {
|
|
"min_stack_version": "8.7",
|
|
"rule_name": "LSASS Process Access via Windows API",
|
|
"sha256": "3ebb73fb1bc78e99a7321c9da744e2462cb56b7b8b3a372342993176f40608c2",
|
|
"type": "eql",
|
|
"version": 6
|
|
},
|
|
"ff4dd44a-0ac6-44c4-8609-3f81bc820f02": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Microsoft 365 Exchange Transport Rule Creation",
|
|
"sha256": "e247dbb68f81f5c55155bea1dd2a757717bdc740b8259a933165e5a612d3cdb7",
|
|
"type": "query",
|
|
"version": 102
|
|
},
|
|
"ff9b571e-61d6-4f6c-9561-eb4cca3bafe1": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "GCP Firewall Rule Deletion",
|
|
"sha256": "6ea6272c4b6fd3f4e7e5dfdd1e521af24e89ac9633ee8ee964f52fa09e28d068",
|
|
"type": "query",
|
|
"version": 104
|
|
},
|
|
"ff9bc8b9-f03b-4283-be58-ee0a16f5a11b": {
|
|
"min_stack_version": "8.3",
|
|
"rule_name": "Potential Sudo Token Manipulation via Process Injection",
|
|
"sha256": "0e051f6a89e0dd3e32af0d2331b7ab799d7e1f852849859f6cab82b3b5d8b4d9",
|
|
"type": "eql",
|
|
"version": 4
|
|
}
|
|
} |