Terrance DeJesus faaa026094 [New Rule] Add Living-off-the-Land (LotL) ProblemChild Rules (#3193) ...

* adding new LotL rules

* added endpoint tags; updated technique mapping

* added missing data source tag

* Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_user.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_host.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_host.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_parent_process.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_host.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_user.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_parent_process.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_user.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_parent_process.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_host.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_host.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_host.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_parent_process.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_user.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_event.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_event_high_probability.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_host.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* updated note, references and date

* changed ATT&CK technique to binary proxy execution

---------

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

(cherry picked from commit 835be9b245)

2023-10-23 16:30:38 +00:00

..

aws

[Security Content] Tags Reform (#2725)

2023-06-22 18:38:56 -03:00

azure

[Security Content] Include "Data Source: Elastic Defend" tag (#3002)

2023-09-05 14:22:01 -04:00

cloud_defend

[New Rule] Modification of Dynamic Linker Preload Shared Object Inside A Container (#2837)

2023-07-17 15:03:24 -04:00

cyberarkpas

[Security Content] Tags Reform (#2725)

2023-06-22 18:38:56 -03:00

ded

[New Rule] Adding Data Exfiltration Rules from Advanced Analytic DED Package (#3126)

2023-10-14 17:30:03 +00:00

dga

[New Rule] Adding DGA Rules from Advanced Analytic DGA Package (#3102)

2023-10-16 19:55:12 +00:00

endpoint

[Security Content] Tags Reform (#2725)

2023-06-22 18:38:56 -03:00

gcp

[Security Content] Tags Reform (#2725)

2023-06-22 18:38:56 -03:00

github

[New Rule] New GitHub App Installed (#3055)

2023-10-12 20:10:20 -04:00

google_workspace

[Security Content] Tags Reform (#2725)

2023-06-22 18:38:56 -03:00

kubernetes

[Rule Tuning] Kubernetes Anonymous Request Authorized (#2865)

2023-07-17 13:03:05 -04:00

lmd

[New Rule] Migrate Lateral Movement Detection Rules (#3175)

2023-10-12 15:02:19 -04:00

o365

[New] Suspicious Microsoft 365 Mail Access by ClientAppId (#2933)

2023-07-19 16:05:13 +01:00

okta

[Bug] Duplicate tag on Okta rule (#3020)

2023-08-21 10:42:47 -04:00

problemchild

[New Rule] Add Living-off-the-Land (LotL) ProblemChild Rules (#3193)

2023-10-23 16:30:38 +00:00