mirror of
https://github.com/elastic/kibana.git
synced 2025-04-24 17:59:23 -04:00
[Detections] Adds automatic updating for Prebuilt Security Detection Rules package (#101846) (#103366)
* Automatically install and update the security_detection_engine package * Remove security_detection_engine from required Fleet packages * Update fleet package-registry image * Add sha256: to the distribution package * Use distribution from https://beats-ci.elastic.co/job/Ingest-manager/job/release-distribution/152 * Change fleet required packag * Fix bad merge * Update rules to 0.13.1 package * Fix NOTICE.txt Co-authored-by: Ross Wolf <31489089+rw-access@users.noreply.github.com>
This commit is contained in:
Kibana Machine
GitHub
parent
ebe1f7c95d
commit
c13c32af4b
285 changed files with 728 additions and 362 deletions
18
NOTICE.txt
18
NOTICE.txt
|
|
@ -149,17 +149,17 @@ SOFTWARE.
|
|||
|
||||
---
|
||||
Detection Rules
|
||||
Copyright 2020 Elasticsearch B.V.
|
||||
Copyright 2021 Elasticsearch B.V.
|
||||
|
||||
---
|
||||
This product bundles rules based on https://github.com/BlueTeamLabs/sentinel-attack
|
||||
which is available under a "MIT" license. The files based on this license are:
|
||||
which is available under a "MIT" license. The rules based on this license are:
|
||||
|
||||
- defense_evasion_via_filter_manager
|
||||
- discovery_process_discovery_via_tasklist_command
|
||||
- persistence_priv_escalation_via_accessibility_features
|
||||
- persistence_via_application_shimming
|
||||
- defense_evasion_execution_via_trusted_developer_utilities
|
||||
- "Potential Evasion via Filter Manager" (06dceabf-adca-48af-ac79-ffdf4c3b1e9a)
|
||||
- "Process Discovery via Tasklist" (cc16f774-59f9-462d-8b98-d27ccd4519ec)
|
||||
- "Potential Modification of Accessibility Binaries" (7405ddf1-6c8e-41ce-818f-48bea6bcaed8)
|
||||
- "Potential Application Shimming via Sdbinst" (fd4a992d-6130-4802-9ff8-829b89ae801f)
|
||||
- "Trusted Developer Application Usage" (9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae1)
|
||||
|
||||
MIT License
|
||||
|
||||
|
|
@ -185,9 +185,9 @@ SOFTWARE.
|
|||
|
||||
---
|
||||
This product bundles rules based on https://github.com/FSecureLABS/leonidas
|
||||
which is available under a "MIT" license. The files based on this license are:
|
||||
which is available under a "MIT" license. The rules based on this license are:
|
||||
|
||||
- credential_access_secretsmanager_getsecretvalue.toml
|
||||
- "AWS Access Secret in Secrets Manager" (a00681e3-9ed6-447c-ab2c-be648821c622)
|
||||
|
||||
MIT License
|
||||
|
||||
|
|
|
|||
|
|
@ -17,7 +17,7 @@ import { useInitSourcerer, useSourcererScope } from '../../common/containers/sou
|
|||
import { useKibana } from '../../common/lib/kibana';
|
||||
import { DETECTIONS_SUB_PLUGIN_ID } from '../../../common/constants';
|
||||
import { SourcererScopeName } from '../../common/store/sourcerer/model';
|
||||
import { useUpgradeEndpointPackage } from '../../common/hooks/endpoint/upgrade';
|
||||
import { useUpgradeSecurityPackages } from '../../common/hooks/use_upgrade_security_packages';
|
||||
import { GlobalHeader } from './global_header';
|
||||
import { SecuritySolutionTemplateWrapper } from './template_wrapper';
|
||||
|
||||
|
|
@ -56,7 +56,7 @@ const HomePageComponent: React.FC<HomePageProps> = ({
|
|||
// tabs in the app. This is useful for keeping the endpoint package as up to date as possible until
|
||||
// a background task solution can be built on the server side. Once a background task solution is available we
|
||||
// can remove this.
|
||||
useUpgradeEndpointPackage();
|
||||
useUpgradeSecurityPackages();
|
||||
|
||||
return (
|
||||
<SecuritySolutionAppWrapper className="kbnAppWrapper">
|
||||
|
|
|
|||
|
|
@ -6,31 +6,31 @@
|
|||
*/
|
||||
|
||||
import { useEffect } from 'react';
|
||||
import { HttpFetchOptions, HttpStart } from 'src/core/public';
|
||||
import { useKibana } from '../../../../../../../src/plugins/kibana_react/public';
|
||||
import { HttpFetchOptions, HttpStart } from 'kibana/public';
|
||||
import { useKibana } from '../../../../../../src/plugins/kibana_react/public';
|
||||
import {
|
||||
epmRouteService,
|
||||
appRoutesService,
|
||||
CheckPermissionsResponse,
|
||||
BulkInstallPackagesResponse,
|
||||
} from '../../../../../fleet/common';
|
||||
import { StartServices } from '../../../types';
|
||||
import { useIngestEnabledCheck } from './ingest_enabled';
|
||||
} from '../../../../fleet/common';
|
||||
import { StartServices } from '../../types';
|
||||
import { useIngestEnabledCheck } from './endpoint/ingest_enabled';
|
||||
|
||||
/**
|
||||
* Requests that the endpoint package be upgraded to the latest version
|
||||
* Requests that the endpoint and security_detection_engine package be upgraded to the latest version
|
||||
*
|
||||
* @param http an http client for sending the request
|
||||
* @param options an object containing options for the request
|
||||
*/
|
||||
const sendUpgradeEndpointPackage = async (
|
||||
const sendUpgradeSecurityPackages = async (
|
||||
http: HttpStart,
|
||||
options: HttpFetchOptions = {}
|
||||
): Promise<BulkInstallPackagesResponse> => {
|
||||
return http.post<BulkInstallPackagesResponse>(epmRouteService.getBulkInstallPath(), {
|
||||
...options,
|
||||
body: JSON.stringify({
|
||||
packages: ['endpoint'],
|
||||
packages: ['endpoint', 'security_detection_engine'],
|
||||
}),
|
||||
});
|
||||
};
|
||||
|
|
@ -51,7 +51,7 @@ const sendCheckPermissions = async (
|
|||
});
|
||||
};
|
||||
|
||||
export const useUpgradeEndpointPackage = () => {
|
||||
export const useUpgradeSecurityPackages = () => {
|
||||
const context = useKibana<StartServices>();
|
||||
const { allEnabled: ingestEnabled } = useIngestEnabledCheck();
|
||||
|
||||
|
|
@ -79,7 +79,7 @@ export const useUpgradeEndpointPackage = () => {
|
|||
}
|
||||
|
||||
// ignore the response for now since we aren't notifying the user
|
||||
await sendUpgradeEndpointPackage(context.services.http, { signal });
|
||||
await sendUpgradeSecurityPackages(context.services.http, { signal });
|
||||
} catch (error) {
|
||||
// Ignore Errors, since this should not hinder the user's ability to use the UI
|
||||
|
||||
|
|
@ -12,7 +12,7 @@
|
|||
"language": "kuery",
|
||||
"license": "Elastic License v2",
|
||||
"name": "Web Application Suspicious Activity: POST Request Declined",
|
||||
"query": "http.response.status_code:403 and http.request.method:post",
|
||||
"query": "http.response.status_code:403 and http.request.method:post\n",
|
||||
"references": [
|
||||
"https://en.wikipedia.org/wiki/HTTP_403"
|
||||
],
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@
|
|||
"language": "kuery",
|
||||
"license": "Elastic License v2",
|
||||
"name": "Web Application Suspicious Activity: Unauthorized Method",
|
||||
"query": "http.response.status_code:405",
|
||||
"query": "http.response.status_code:405\n",
|
||||
"references": [
|
||||
"https://en.wikipedia.org/wiki/HTTP_405"
|
||||
],
|
||||
|
|
|
|||
|
|
@ -30,7 +30,7 @@
|
|||
"language": "kuery",
|
||||
"license": "Elastic License v2",
|
||||
"name": "Web Application Suspicious Activity: No User Agent",
|
||||
"query": "url.path:*",
|
||||
"query": "url.path:*\n",
|
||||
"references": [
|
||||
"https://en.wikipedia.org/wiki/User_agent"
|
||||
],
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@
|
|||
"language": "kuery",
|
||||
"license": "Elastic License v2",
|
||||
"name": "Web Application Suspicious Activity: sqlmap User Agent",
|
||||
"query": "user_agent.original:\"sqlmap/1.3.11#stable (http://sqlmap.org)\"",
|
||||
"query": "user_agent.original:\"sqlmap/1.3.11#stable (http://sqlmap.org)\"\n",
|
||||
"references": [
|
||||
"http://sqlmap.org/"
|
||||
],
|
||||
|
|
|
|||
|
|
@ -16,7 +16,7 @@
|
|||
"license": "Elastic License v2",
|
||||
"name": "Application Added to Google Workspace Domain",
|
||||
"note": "## Config\n\nThe Google Workspace Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.\n\n### Important Information Regarding Google Workspace Event Lag Times\n- As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs.\n- This rule is configured to run every 10 minutes with a lookback time of 130 minutes.\n- To reduce the risk of false negatives, consider reducing the interval that the Google Workspace (formerly G Suite) Filebeat module polls Google's reporting API for new events.\n- By default, `var.interval` is set to 2 hours (2h). Consider changing this interval to a lower value, such as 10 minutes (10m).\n- See the following references for further information.\n - https://support.google.com/a/answer/7061566\n - https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-gsuite.html",
|
||||
"query": "event.dataset:(gsuite.admin or google_workspace.admin) and event.provider:admin and event.category:iam and event.action:ADD_APPLICATION",
|
||||
"query": "event.dataset:(gsuite.admin or google_workspace.admin) and event.provider:admin and event.category:iam and event.action:ADD_APPLICATION\n",
|
||||
"references": [
|
||||
"https://support.google.com/a/answer/6328701?hl=en#"
|
||||
],
|
||||
|
|
|
|||
|
|
@ -14,7 +14,7 @@
|
|||
"license": "Elastic License v2",
|
||||
"name": "Attempt to Deactivate an Okta Network Zone",
|
||||
"note": "## Config\n\nThe Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.",
|
||||
"query": "event.dataset:okta.system and event.action:zone.deactivate",
|
||||
"query": "event.dataset:okta.system and event.action:zone.deactivate\n",
|
||||
"references": [
|
||||
"https://help.okta.com/en/prod/Content/Topics/Security/network/network-zones.htm",
|
||||
"https://developer.okta.com/docs/reference/api/system-log/",
|
||||
|
|
|
|||
|
|
@ -14,7 +14,7 @@
|
|||
"license": "Elastic License v2",
|
||||
"name": "Attempt to Delete an Okta Network Zone",
|
||||
"note": "## Config\n\nThe Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.",
|
||||
"query": "event.dataset:okta.system and event.action:zone.delete",
|
||||
"query": "event.dataset:okta.system and event.action:zone.delete\n",
|
||||
"references": [
|
||||
"https://help.okta.com/en/prod/Content/Topics/Security/network/network-zones.htm",
|
||||
"https://developer.okta.com/docs/reference/api/system-log/",
|
||||
|
|
|
|||
|
|
@ -16,7 +16,7 @@
|
|||
"license": "Elastic License v2",
|
||||
"name": "AWS CloudTrail Log Created",
|
||||
"note": "## Config\n\nThe AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.",
|
||||
"query": "event.dataset:aws.cloudtrail and event.provider:cloudtrail.amazonaws.com and event.action:CreateTrail and event.outcome:success",
|
||||
"query": "event.dataset:aws.cloudtrail and event.provider:cloudtrail.amazonaws.com and event.action:CreateTrail and event.outcome:success\n",
|
||||
"references": [
|
||||
"https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_CreateTrail.html",
|
||||
"https://awscli.amazonaws.com/v2/documentation/api/latest/reference/cloudtrail/create-trail.html"
|
||||
|
|
|
|||
|
|
@ -14,7 +14,7 @@
|
|||
"license": "Elastic License v2",
|
||||
"name": "GCP Pub/Sub Subscription Creation",
|
||||
"note": "## Config\n\nThe GCP Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.",
|
||||
"query": "event.dataset:(googlecloud.audit or gcp.audit) and event.action:google.pubsub.v*.Subscriber.CreateSubscription and event.outcome:success",
|
||||
"query": "event.dataset:(googlecloud.audit or gcp.audit) and event.action:google.pubsub.v*.Subscriber.CreateSubscription and event.outcome:success\n",
|
||||
"references": [
|
||||
"https://cloud.google.com/pubsub/docs/overview"
|
||||
],
|
||||
|
|
|
|||
|
|
@ -14,7 +14,7 @@
|
|||
"license": "Elastic License v2",
|
||||
"name": "GCP Pub/Sub Topic Creation",
|
||||
"note": "## Config\n\nThe GCP Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.",
|
||||
"query": "event.dataset:(googlecloud.audit or gcp.audit) and event.action:google.pubsub.v*.Publisher.CreateTopic and event.outcome:success",
|
||||
"query": "event.dataset:(googlecloud.audit or gcp.audit) and event.action:google.pubsub.v*.Publisher.CreateTopic and event.outcome:success\n",
|
||||
"references": [
|
||||
"https://cloud.google.com/pubsub/docs/admin"
|
||||
],
|
||||
|
|
|
|||
|
|
@ -17,7 +17,7 @@
|
|||
"license": "Elastic License v2",
|
||||
"name": "Microsoft 365 New Inbox Rule Created",
|
||||
"note": "## Config\n\nThe Microsoft 365 Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.",
|
||||
"query": "event.dataset:o365.audit and event.provider:Exchange and event.category:web and event.action:\"New-InboxRule\" and event.outcome:success",
|
||||
"query": "event.dataset:o365.audit and event.provider:Exchange and event.category:web and event.action:\"New-InboxRule\" and event.outcome:success\n",
|
||||
"references": [
|
||||
"https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/responding-to-a-compromised-email-account?view=o365-worldwide",
|
||||
"https://docs.microsoft.com/en-us/powershell/module/exchange/new-inboxrule?view=exchange-ps",
|
||||
|
|
|
|||
|
|
@ -15,7 +15,7 @@
|
|||
"license": "Elastic License v2",
|
||||
"name": "Azure Event Hub Authorization Rule Created or Updated",
|
||||
"note": "## Config\n\nThe Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.",
|
||||
"query": "event.dataset:azure.activitylogs and azure.activitylogs.operation_name:\"MICROSOFT.EVENTHUB/NAMESPACES/AUTHORIZATIONRULES/WRITE\" and event.outcome:(Success or success)",
|
||||
"query": "event.dataset:azure.activitylogs and azure.activitylogs.operation_name:\"MICROSOFT.EVENTHUB/NAMESPACES/AUTHORIZATIONRULES/WRITE\" and event.outcome:(Success or success)\n",
|
||||
"references": [
|
||||
"https://docs.microsoft.com/en-us/azure/event-hubs/authorize-access-shared-access-signature"
|
||||
],
|
||||
|
|
|
|||
|
|
@ -12,7 +12,10 @@
|
|||
"language": "eql",
|
||||
"license": "Elastic License v2",
|
||||
"name": "Network Connection via Certutil",
|
||||
"query": "sequence by process.entity_id\n [process where process.name : \"certutil.exe\" and event.type == \"start\"]\n [network where process.name : \"certutil.exe\" and\n not cidrmatch(destination.ip, \"10.0.0.0/8\", \"172.16.0.0/12\", \"192.168.0.0/16\")]\n",
|
||||
"query": "sequence by process.entity_id\n [process where process.name : \"certutil.exe\" and event.type == \"start\"]\n [network where process.name : \"certutil.exe\" and\n not cidrmatch(destination.ip, \"10.0.0.0/8\", \"127.0.0.0/8\", \"169.254.0.0/16\", \"172.16.0.0/12\", \"192.0.0.0/24\",\n \"192.0.0.0/29\", \"192.0.0.8/32\", \"192.0.0.9/32\", \"192.0.0.10/32\", \"192.0.0.170/32\",\n \"192.0.0.171/32\", \"192.0.2.0/24\", \"192.31.196.0/24\", \"192.52.193.0/24\",\n \"192.168.0.0/16\", \"192.88.99.0/24\", \"224.0.0.0/4\", \"100.64.0.0/10\", \"192.175.48.0/24\",\n \"198.18.0.0/15\", \"198.51.100.0/24\", \"203.0.113.0/24\", \"240.0.0.0/4\", \"::1\",\n \"FE80::/10\", \"FF00::/8\")]\n",
|
||||
"references": [
|
||||
"https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml"
|
||||
],
|
||||
"risk_score": 21,
|
||||
"rule_id": "3838e0e3-1850-4850-a411-2e8c5ba40ba8",
|
||||
"severity": "low",
|
||||
|
|
@ -41,5 +44,5 @@
|
|||
}
|
||||
],
|
||||
"type": "eql",
|
||||
"version": 5
|
||||
"version": 6
|
||||
}
|
||||
|
|
|
|||
|
|
@ -13,7 +13,7 @@
|
|||
"license": "Elastic License v2",
|
||||
"name": "Cobalt Strike Command and Control Beacon",
|
||||
"note": "## Threat intel\n\nThis activity has been observed in FIN7 campaigns.",
|
||||
"query": "event.category:(network OR network_traffic) AND type:(tls OR http) AND network.transport:tcp AND destination.domain:/[a-z]{3}.stage.[0-9]{8}\\..*/",
|
||||
"query": "event.category:(network OR network_traffic) AND type:(tls OR http) AND network.transport:tcp AND destination.domain:/[a-z]{3}.stage.[0-9]{8}\\..*/\n",
|
||||
"references": [
|
||||
"https://blog.morphisec.com/fin7-attacks-restaurant-industry",
|
||||
"https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html"
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@
|
|||
"license": "Elastic License v2",
|
||||
"name": "Default Cobalt Strike Team Server Certificate",
|
||||
"note": "## Threat intel\n\nWhile Cobalt Strike is intended to be used for penetration tests and IR training, it is frequently used by actual threat actors (TA) such as APT19, APT29, APT32, APT41, FIN6, DarkHydrus, CopyKittens, Cobalt Group, Leviathan, and many other unnamed criminal TAs. This rule uses high-confidence atomic indicators, alerts should be investigated rapidly.",
|
||||
"query": "event.category:(network or network_traffic) and (tls.server.hash.md5:950098276A495286EB2A2556FBAB6D83 or tls.server.hash.sha1:6ECE5ECE4192683D2D84E25B0BA7E04F9CB7EB7C or tls.server.hash.sha256:87F2085C32B6A2CC709B365F55873E207A9CAA10BFFECF2FD16D3CF9D94D390C)",
|
||||
"query": "event.category:(network or network_traffic) and (tls.server.hash.md5:950098276A495286EB2A2556FBAB6D83 or\n tls.server.hash.sha1:6ECE5ECE4192683D2D84E25B0BA7E04F9CB7EB7C or\n tls.server.hash.sha256:87F2085C32B6A2CC709B365F55873E207A9CAA10BFFECF2FD16D3CF9D94D390C)\n",
|
||||
"references": [
|
||||
"https://attack.mitre.org/software/S0154/",
|
||||
"https://www.cobaltstrike.com/help-setup-collaboration",
|
||||
|
|
|
|||
|
|
@ -13,10 +13,11 @@
|
|||
"language": "kuery",
|
||||
"license": "Elastic License v2",
|
||||
"name": "DNS Activity to the Internet",
|
||||
"query": "event.category:(network or network_traffic) and (event.type:connection or type:dns) and (destination.port:53 or event.dataset:zeek.dns) and source.ip:( 10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 ) and not destination.ip:( 10.0.0.0/8 or 127.0.0.0/8 or 169.254.0.0/16 or 172.16.0.0/12 or 192.168.0.0/16 or 224.0.0.0/4 or 255.255.255.255 or \"::1\" or \"FE80::/10\" or \"FF00::/8\")",
|
||||
"query": "event.category:(network or network_traffic) and (event.type:connection or type:dns) and (destination.port:53 or event.dataset:zeek.dns)\n and source.ip:(\n 10.0.0.0/8 or\n 172.16.0.0/12 or\n 192.168.0.0/16\n ) and\n not destination.ip:(\n 10.0.0.0/8 or\n 127.0.0.0/8 or\n 169.254.0.0/16 or\n 172.16.0.0/12 or\n 192.0.0.0/24 or\n 192.0.0.0/29 or\n 192.0.0.8/32 or\n 192.0.0.9/32 or\n 192.0.0.10/32 or\n 192.0.0.170/32 or\n 192.0.0.171/32 or\n 192.0.2.0/24 or\n 192.31.196.0/24 or\n 192.52.193.0/24 or\n 192.168.0.0/16 or\n 192.88.99.0/24 or\n 224.0.0.0/4 or\n 100.64.0.0/10 or\n 192.175.48.0/24 or\n 198.18.0.0/15 or\n 198.51.100.0/24 or\n 203.0.113.0/24 or\n 240.0.0.0/4 or\n \"::1\" or\n \"FE80::/10\" or\n \"FF00::/8\"\n )\n",
|
||||
"references": [
|
||||
"https://www.us-cert.gov/ncas/alerts/TA15-240A",
|
||||
"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-81-2.pdf"
|
||||
"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-81-2.pdf",
|
||||
"https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml"
|
||||
],
|
||||
"risk_score": 47,
|
||||
"rule_id": "6ea71ff0-9e95-475b-9506-2580d1ce6154",
|
||||
|
|
@ -40,5 +41,5 @@
|
|||
],
|
||||
"timestamp_override": "event.ingested",
|
||||
"type": "query",
|
||||
"version": 8
|
||||
"version": 9
|
||||
}
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@
|
|||
"language": "kuery",
|
||||
"license": "Elastic License v2",
|
||||
"name": "Potential DNS Tunneling via NsLookup",
|
||||
"query": "event.category:process and event.type:start and process.name:nslookup.exe and process.args:(-querytype=* or -qt=* or -q=* or -type=*)",
|
||||
"query": "event.category:process and event.type:start and process.name:nslookup.exe and process.args:(-querytype=* or -qt=* or -q=* or -type=*)\n",
|
||||
"references": [
|
||||
"https://unit42.paloaltonetworks.com/dns-tunneling-in-the-wild-overview-of-oilrigs-dns-tunneling/"
|
||||
],
|
||||
|
|
|
|||
|
|
@ -13,10 +13,11 @@
|
|||
"license": "Elastic License v2",
|
||||
"name": "Roshal Archive (RAR) or PowerShell File Downloaded from the Internet",
|
||||
"note": "## Threat intel\n\nThis activity has been observed in FIN7 campaigns.",
|
||||
"query": "event.category:(network OR network_traffic) AND network.protocol:http AND url.path:/.*(rar|ps1)/ AND source.ip:(10.0.0.0\\/8 OR 172.16.0.0\\/12 OR 192.168.0.0\\/16)",
|
||||
"query": "event.category:(network or network_traffic) and network.protocol:http and\n (url.extension:(ps1 or rar) or url.path:(*.ps1 or *.rar)) and\n not destination.ip:(\n 10.0.0.0/8 or\n 127.0.0.0/8 or\n 169.254.0.0/16 or\n 172.16.0.0/12 or\n 192.0.0.0/24 or\n 192.0.0.0/29 or\n 192.0.0.8/32 or\n 192.0.0.9/32 or\n 192.0.0.10/32 or\n 192.0.0.170/32 or\n 192.0.0.171/32 or\n 192.0.2.0/24 or\n 192.31.196.0/24 or\n 192.52.193.0/24 or\n 192.168.0.0/16 or\n 192.88.99.0/24 or\n 224.0.0.0/4 or\n 100.64.0.0/10 or\n 192.175.48.0/24 or\n 198.18.0.0/15 or\n 198.51.100.0/24 or\n 203.0.113.0/24 or\n 240.0.0.0/4 or\n \"::1\" or\n \"FE80::/10\" or\n \"FF00::/8\"\n ) and\n source.ip:(\n 10.0.0.0/8 or\n 172.16.0.0/12 or\n 192.168.0.0/16\n )\n",
|
||||
"references": [
|
||||
"https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html",
|
||||
"https://www.justice.gov/opa/press-release/file/1084361/download"
|
||||
"https://www.justice.gov/opa/press-release/file/1084361/download",
|
||||
"https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml"
|
||||
],
|
||||
"risk_score": 47,
|
||||
"rule_id": "ff013cb4-274d-434a-96bb-fe15ddd3ae92",
|
||||
|
|
@ -46,5 +47,5 @@
|
|||
],
|
||||
"timestamp_override": "event.ingested",
|
||||
"type": "query",
|
||||
"version": 4
|
||||
"version": 5
|
||||
}
|
||||
|
|
|
|||
|
|
@ -13,7 +13,7 @@
|
|||
"license": "Elastic License v2",
|
||||
"name": "Possible FIN7 DGA Command and Control Behavior",
|
||||
"note": "## Triage and analysis\n\nIn the event this rule identifies benign domains in your environment, the `destination.domain` field in the rule can be modified to include those domains. Example: `...AND NOT destination.domain:(zoom.us OR benign.domain1 OR benign.domain2)`.",
|
||||
"query": "event.category:(network OR network_traffic) AND type:(tls OR http) AND network.transport:tcp AND destination.domain:/[a-zA-Z]{4,5}\\.(pw|us|club|info|site|top)/ AND NOT destination.domain:zoom.us",
|
||||
"query": "event.category:(network OR network_traffic) AND type:(tls OR http) AND network.transport:tcp\nAND destination.domain:/[a-zA-Z]{4,5}\\.(pw|us|club|info|site|top)/ AND NOT destination.domain:zoom.us\n",
|
||||
"references": [
|
||||
"https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
|
||||
],
|
||||
|
|
|
|||
|
|
@ -13,7 +13,7 @@
|
|||
"license": "Elastic License v2",
|
||||
"name": "Halfbaked Command and Control Beacon",
|
||||
"note": "## Threat intel\n\nThis activity has been observed in FIN7 campaigns.",
|
||||
"query": "event.category:(network OR network_traffic) AND network.protocol:http AND network.transport:tcp AND url.full:/http:\\/\\/[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}\\/cd/ AND destination.port:(53 OR 80 OR 8080 OR 443)",
|
||||
"query": "event.category:(network OR network_traffic) AND network.protocol:http AND\n network.transport:tcp AND url.full:/http:\\/\\/[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}\\/cd/ AND\n destination.port:(53 OR 80 OR 8080 OR 443)\n",
|
||||
"references": [
|
||||
"https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html",
|
||||
"https://attack.mitre.org/software/S0151/"
|
||||
|
|
|
|||
|
|
@ -15,7 +15,7 @@
|
|||
"language": "kuery",
|
||||
"license": "Elastic License v2",
|
||||
"name": "IPSEC NAT Traversal Port Activity",
|
||||
"query": "event.category:(network or network_traffic) and network.transport:udp and destination.port:4500",
|
||||
"query": "event.category:(network or network_traffic) and network.transport:udp and destination.port:4500\n",
|
||||
"risk_score": 21,
|
||||
"rule_id": "a9cb3641-ff4b-4cdc-a063-b4b8d02a67c7",
|
||||
"severity": "low",
|
||||
|
|
|
|||
|
|
@ -15,7 +15,7 @@
|
|||
"language": "kuery",
|
||||
"license": "Elastic License v2",
|
||||
"name": "SMTP on Port 26/TCP",
|
||||
"query": "event.category:(network or network_traffic) and network.transport:tcp and (destination.port:26 or (event.dataset:zeek.smtp and destination.port:26))",
|
||||
"query": "event.category:(network or network_traffic) and network.transport:tcp and (destination.port:26 or (event.dataset:zeek.smtp and destination.port:26))\n",
|
||||
"references": [
|
||||
"https://unit42.paloaltonetworks.com/unit42-badpatch/",
|
||||
"https://isc.sans.edu/forums/diary/Next+up+whats+up+with+TCP+port+26/25564/"
|
||||
|
|
|
|||
|
|
@ -15,7 +15,10 @@
|
|||
"language": "kuery",
|
||||
"license": "Elastic License v2",
|
||||
"name": "RDP (Remote Desktop Protocol) from the Internet",
|
||||
"query": "event.category:(network or network_traffic) and network.transport:tcp and (destination.port:3389 or event.dataset:zeek.rdp) and not source.ip:( 10.0.0.0/8 or 127.0.0.0/8 or 169.254.0.0/16 or 172.16.0.0/12 or 192.168.0.0/16 or 224.0.0.0/4 or \"::1\" or \"FE80::/10\" or \"FF00::/8\" ) and destination.ip:( 10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 )",
|
||||
"query": "event.category:(network or network_traffic) and network.transport:tcp and (destination.port:3389 or event.dataset:zeek.rdp) and\n not source.ip:(\n 10.0.0.0/8 or\n 127.0.0.0/8 or\n 169.254.0.0/16 or\n 172.16.0.0/12 or\n 192.0.0.0/24 or\n 192.0.0.0/29 or\n 192.0.0.8/32 or\n 192.0.0.9/32 or\n 192.0.0.10/32 or\n 192.0.0.170/32 or\n 192.0.0.171/32 or\n 192.0.2.0/24 or\n 192.31.196.0/24 or\n 192.52.193.0/24 or\n 192.168.0.0/16 or\n 192.88.99.0/24 or\n 224.0.0.0/4 or\n 100.64.0.0/10 or\n 192.175.48.0/24 or\n 198.18.0.0/15 or\n 198.51.100.0/24 or\n 203.0.113.0/24 or\n 240.0.0.0/4 or\n \"::1\" or\n \"FE80::/10\" or\n \"FF00::/8\"\n ) and\n destination.ip:(\n 10.0.0.0/8 or\n 172.16.0.0/12 or\n 192.168.0.0/16\n )\n",
|
||||
"references": [
|
||||
"https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml"
|
||||
],
|
||||
"risk_score": 47,
|
||||
"rule_id": "8c1bdde8-4204-45c0-9e0c-c85ca3902488",
|
||||
"severity": "medium",
|
||||
|
|
@ -69,5 +72,5 @@
|
|||
],
|
||||
"timestamp_override": "event.ingested",
|
||||
"type": "query",
|
||||
"version": 8
|
||||
"version": 9
|
||||
}
|
||||
|
|
|
|||
|
|
@ -15,7 +15,7 @@
|
|||
"language": "kuery",
|
||||
"license": "Elastic License v2",
|
||||
"name": "Telnet Port Activity",
|
||||
"query": "event.category:(network or network_traffic) and network.transport:tcp and destination.port:23",
|
||||
"query": "event.category:(network or network_traffic) and network.transport:tcp and destination.port:23\n",
|
||||
"risk_score": 47,
|
||||
"rule_id": "34fde489-94b0-4500-a76f-b8a157cf9269",
|
||||
"severity": "medium",
|
||||
|
|
|
|||
|
|
@ -15,7 +15,10 @@
|
|||
"language": "kuery",
|
||||
"license": "Elastic License v2",
|
||||
"name": "VNC (Virtual Network Computing) from the Internet",
|
||||
"query": "event.category:(network or network_traffic) and network.transport:tcp and destination.port >= 5800 and destination.port <= 5810 and not source.ip:( 10.0.0.0/8 or 127.0.0.0/8 or 169.254.0.0/16 or 172.16.0.0/12 or 192.168.0.0/16 or 224.0.0.0/4 or \"::1\" or \"FE80::/10\" or \"FF00::/8\" ) and destination.ip:( 10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 )",
|
||||
"query": "event.category:(network or network_traffic) and network.transport:tcp and destination.port >= 5800 and destination.port <= 5810 and\n not source.ip:(\n 10.0.0.0/8 or\n 127.0.0.0/8 or\n 169.254.0.0/16 or\n 172.16.0.0/12 or\n 192.0.0.0/24 or\n 192.0.0.0/29 or\n 192.0.0.8/32 or\n 192.0.0.9/32 or\n 192.0.0.10/32 or\n 192.0.0.170/32 or\n 192.0.0.171/32 or\n 192.0.2.0/24 or\n 192.31.196.0/24 or\n 192.52.193.0/24 or\n 192.168.0.0/16 or\n 192.88.99.0/24 or\n 224.0.0.0/4 or\n 100.64.0.0/10 or\n 192.175.48.0/24 or\n 198.18.0.0/15 or\n 198.51.100.0/24 or\n 203.0.113.0/24 or\n 240.0.0.0/4 or\n \"::1\" or\n \"FE80::/10\" or\n \"FF00::/8\"\n ) and\n destination.ip:(\n 10.0.0.0/8 or\n 172.16.0.0/12 or\n 192.168.0.0/16\n )\n",
|
||||
"references": [
|
||||
"https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml"
|
||||
],
|
||||
"risk_score": 73,
|
||||
"rule_id": "5700cb81-df44-46aa-a5d7-337798f53eb8",
|
||||
"severity": "high",
|
||||
|
|
@ -60,5 +63,5 @@
|
|||
],
|
||||
"timestamp_override": "event.ingested",
|
||||
"type": "query",
|
||||
"version": 8
|
||||
"version": 9
|
||||
}
|
||||
|
|
|
|||
|
|
@ -15,7 +15,10 @@
|
|||
"language": "kuery",
|
||||
"license": "Elastic License v2",
|
||||
"name": "VNC (Virtual Network Computing) to the Internet",
|
||||
"query": "event.category:(network or network_traffic) and network.transport:tcp and destination.port >= 5800 and destination.port <= 5810 and source.ip:( 10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 ) and not destination.ip:( 10.0.0.0/8 or 127.0.0.0/8 or 169.254.0.0/16 or 172.16.0.0/12 or 192.168.0.0/16 or 224.0.0.0/4 or \"::1\" or \"FE80::/10\" or \"FF00::/8\" )",
|
||||
"query": "event.category:(network or network_traffic) and network.transport:tcp and destination.port >= 5800 and destination.port <= 5810 and\n source.ip:(\n 10.0.0.0/8 or\n 172.16.0.0/12 or\n 192.168.0.0/16\n ) and\n not destination.ip:(\n 10.0.0.0/8 or\n 127.0.0.0/8 or\n 169.254.0.0/16 or\n 172.16.0.0/12 or\n 192.0.0.0/24 or\n 192.0.0.0/29 or\n 192.0.0.8/32 or\n 192.0.0.9/32 or\n 192.0.0.10/32 or\n 192.0.0.170/32 or\n 192.0.0.171/32 or\n 192.0.2.0/24 or\n 192.31.196.0/24 or\n 192.52.193.0/24 or\n 192.168.0.0/16 or\n 192.88.99.0/24 or\n 224.0.0.0/4 or\n 100.64.0.0/10 or\n 192.175.48.0/24 or\n 198.18.0.0/15 or\n 198.51.100.0/24 or\n 203.0.113.0/24 or\n 240.0.0.0/4 or\n \"::1\" or\n \"FE80::/10\" or\n \"FF00::/8\"\n )\n",
|
||||
"references": [
|
||||
"https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml"
|
||||
],
|
||||
"risk_score": 47,
|
||||
"rule_id": "3ad49c61-7adc-42c1-b788-732eda2f5abf",
|
||||
"severity": "medium",
|
||||
|
|
@ -45,5 +48,5 @@
|
|||
],
|
||||
"timestamp_override": "event.ingested",
|
||||
"type": "query",
|
||||
"version": 8
|
||||
"version": 9
|
||||
}
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@
|
|||
"license": "Elastic License v2",
|
||||
"name": "Attempted Bypass of Okta MFA",
|
||||
"note": "## Config\n\nThe Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.",
|
||||
"query": "event.dataset:okta.system and event.action:user.mfa.attempt_bypass",
|
||||
"query": "event.dataset:okta.system and event.action:user.mfa.attempt_bypass\n",
|
||||
"references": [
|
||||
"https://developer.okta.com/docs/reference/api/system-log/",
|
||||
"https://developer.okta.com/docs/reference/api/event-types/"
|
||||
|
|
|
|||
|
|
@ -1,6 +1,8 @@
|
|||
{
|
||||
"author": [
|
||||
"Elastic"
|
||||
"Elastic",
|
||||
"@BenB196",
|
||||
"Austin Songer"
|
||||
],
|
||||
"description": "Identifies when an Okta user account is locked out 3 times within a 3 hour window. An adversary may attempt a brute force or password spraying attack to obtain unauthorized access to user accounts. The default Okta authentication policy ensures that a user account is locked out after 10 failed authentication attempts.",
|
||||
"from": "now-180m",
|
||||
|
|
@ -12,7 +14,7 @@
|
|||
"license": "Elastic License v2",
|
||||
"name": "Attempts to Brute Force an Okta User Account",
|
||||
"note": "## Config\n\nThe Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.",
|
||||
"query": "event.dataset:okta.system and event.action:user.account.lock",
|
||||
"query": "event.dataset:okta.system and event.action:user.account.lock\n",
|
||||
"references": [
|
||||
"https://developer.okta.com/docs/reference/api/system-log/",
|
||||
"https://developer.okta.com/docs/reference/api/event-types/"
|
||||
|
|
@ -47,10 +49,10 @@
|
|||
],
|
||||
"threshold": {
|
||||
"field": [
|
||||
"okta.actor.id"
|
||||
"okta.actor.alternate_id"
|
||||
],
|
||||
"value": 3
|
||||
},
|
||||
"type": "threshold",
|
||||
"version": 4
|
||||
"version": 5
|
||||
}
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@
|
|||
"license": "Elastic License v2",
|
||||
"name": "AWS IAM Brute Force of Assume Role Policy",
|
||||
"note": "## Config\n\nThe AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.",
|
||||
"query": "event.dataset:aws.cloudtrail and event.provider:iam.amazonaws.com and event.action:UpdateAssumeRolePolicy and aws.cloudtrail.error_code:MalformedPolicyDocumentException and event.outcome:failure",
|
||||
"query": "event.dataset:aws.cloudtrail and\n event.provider:iam.amazonaws.com and event.action:UpdateAssumeRolePolicy and\n aws.cloudtrail.error_code:MalformedPolicyDocumentException and event.outcome:failure\n",
|
||||
"references": [
|
||||
"https://www.praetorian.com/blog/aws-iam-assume-role-vulnerabilities",
|
||||
"https://rhinosecuritylabs.com/aws/assume-worst-aws-assume-role-enumeration/"
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@
|
|||
"language": "kuery",
|
||||
"license": "Elastic License v2",
|
||||
"name": "Sensitive Files Compression",
|
||||
"query": "event.category:process and event.type:start and process.name:(zip or tar or gzip or hdiutil or 7z) and process.args: ( /root/.ssh/id_rsa or /root/.ssh/id_rsa.pub or /root/.ssh/id_ed25519 or /root/.ssh/id_ed25519.pub or /root/.ssh/authorized_keys or /root/.ssh/authorized_keys2 or /root/.ssh/known_hosts or /root/.bash_history or /etc/hosts or /home/*/.ssh/id_rsa or /home/*/.ssh/id_rsa.pub or /home/*/.ssh/id_ed25519 or /home/*/.ssh/id_ed25519.pub or /home/*/.ssh/authorized_keys or /home/*/.ssh/authorized_keys2 or /home/*/.ssh/known_hosts or /home/*/.bash_history or /root/.aws/credentials or /root/.aws/config or /home/*/.aws/credentials or /home/*/.aws/config or /root/.docker/config.json or /home/*/.docker/config.json or /etc/group or /etc/passwd or /etc/shadow or /etc/gshadow )",
|
||||
"query": "event.category:process and event.type:start and\n process.name:(zip or tar or gzip or hdiutil or 7z) and\n process.args:\n (\n /root/.ssh/id_rsa or\n /root/.ssh/id_rsa.pub or\n /root/.ssh/id_ed25519 or\n /root/.ssh/id_ed25519.pub or\n /root/.ssh/authorized_keys or\n /root/.ssh/authorized_keys2 or\n /root/.ssh/known_hosts or\n /root/.bash_history or\n /etc/hosts or\n /home/*/.ssh/id_rsa or\n /home/*/.ssh/id_rsa.pub or\n /home/*/.ssh/id_ed25519 or\n /home/*/.ssh/id_ed25519.pub or\n /home/*/.ssh/authorized_keys or\n /home/*/.ssh/authorized_keys2 or\n /home/*/.ssh/known_hosts or\n /home/*/.bash_history or\n /root/.aws/credentials or\n /root/.aws/config or\n /home/*/.aws/credentials or\n /home/*/.aws/config or\n /root/.docker/config.json or\n /home/*/.docker/config.json or\n /etc/group or\n /etc/passwd or\n /etc/shadow or\n /etc/gshadow\n )\n",
|
||||
"references": [
|
||||
"https://www.trendmicro.com/en_ca/research/20/l/teamtnt-now-deploying-ddos-capable-irc-bot-tntbotinger.html"
|
||||
],
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@
|
|||
"language": "kuery",
|
||||
"license": "Elastic License v2",
|
||||
"name": "Dumping Account Hashes via Built-In Commands",
|
||||
"query": "event.category:process and event.type:start and process.name:(defaults or mkpassdb) and process.args:(ShadowHashData or \"-dump\")",
|
||||
"query": "event.category:process and event.type:start and\n process.name:(defaults or mkpassdb) and process.args:(ShadowHashData or \"-dump\")\n",
|
||||
"references": [
|
||||
"https://apple.stackexchange.com/questions/186893/os-x-10-9-where-are-password-hashes-stored",
|
||||
"https://www.unix.com/man-page/osx/8/mkpassdb/"
|
||||
|
|
|
|||
|
|
@ -16,7 +16,7 @@
|
|||
"license": "Elastic License v2",
|
||||
"name": "AWS IAM User Addition to Group",
|
||||
"note": "## Config\n\nThe AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.",
|
||||
"query": "event.dataset:aws.cloudtrail and event.provider:iam.amazonaws.com and event.action:AddUserToGroup and event.outcome:success",
|
||||
"query": "event.dataset:aws.cloudtrail and event.provider:iam.amazonaws.com and event.action:AddUserToGroup and event.outcome:success\n",
|
||||
"references": [
|
||||
"https://docs.aws.amazon.com/IAM/latest/APIReference/API_AddUserToGroup.html"
|
||||
],
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@
|
|||
"language": "kuery",
|
||||
"license": "Elastic License v2",
|
||||
"name": "Kerberos Cached Credentials Dumping",
|
||||
"query": "event.category:process and event.type:(start or process_started) and process.name:kcc and process.args:copy_cred_cache",
|
||||
"query": "event.category:process and event.type:(start or process_started) and\n process.name:kcc and\n process.args:copy_cred_cache\n",
|
||||
"references": [
|
||||
"https://github.com/EmpireProject/EmPyre/blob/master/lib/modules/collection/osx/kerberosdump.py",
|
||||
"https://opensource.apple.com/source/Heimdal/Heimdal-323.12/kuser/kcc-commands.in.auto.html"
|
||||
|
|
|
|||
|
|
@ -15,7 +15,7 @@
|
|||
"license": "Elastic License v2",
|
||||
"name": "Azure Key Vault Modified",
|
||||
"note": "## Config\n\nThe Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.",
|
||||
"query": "event.dataset:azure.activitylogs and azure.activitylogs.operation_name:\"MICROSOFT.KEYVAULT/VAULTS/WRITE\" and event.outcome:(Success or success)",
|
||||
"query": "event.dataset:azure.activitylogs and azure.activitylogs.operation_name:\"MICROSOFT.KEYVAULT/VAULTS/WRITE\" and event.outcome:(Success or success)\n",
|
||||
"references": [
|
||||
"https://docs.microsoft.com/en-us/azure/key-vault/general/basic-concepts",
|
||||
"https://docs.microsoft.com/en-us/azure/key-vault/general/secure-your-key-vault"
|
||||
|
|
|
|||
|
|
@ -15,7 +15,7 @@
|
|||
"license": "Elastic License v2",
|
||||
"name": "Attempts to Brute Force a Microsoft 365 User Account",
|
||||
"note": "## Config\n\nThe Microsoft 365 Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.",
|
||||
"query": "event.dataset:o365.audit and event.provider:AzureActiveDirectory and event.category:authentication and event.action:UserLoginFailed and event.outcome:failure",
|
||||
"query": "event.dataset:o365.audit and event.provider:(Exchange or AzureActiveDirectory) and event.category:authentication and \nevent.action:(\"UserLoginFailed\" or \"PasswordLogonInitialAuthUsingPassword\") and event.outcome:failure\n",
|
||||
"risk_score": 73,
|
||||
"rule_id": "26f68dba-ce29-497b-8e13-b4fde1db5a2d",
|
||||
"severity": "high",
|
||||
|
|
@ -51,5 +51,5 @@
|
|||
"value": 10
|
||||
},
|
||||
"type": "threshold",
|
||||
"version": 3
|
||||
"version": 4
|
||||
}
|
||||
|
|
|
|||
|
|
@ -15,7 +15,7 @@
|
|||
"license": "Elastic License v2",
|
||||
"name": "Potential Password Spraying of Microsoft 365 User Accounts",
|
||||
"note": "## Config\n\nThe Microsoft 365 Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.",
|
||||
"query": "event.dataset:o365.audit and event.provider:AzureActiveDirectory and event.category:authentication and event.action:UserLoginFailed and event.outcome:failure",
|
||||
"query": "event.dataset:o365.audit and event.provider:AzureActiveDirectory and event.category:authentication and event.action:UserLoginFailed and event.outcome:failure\n",
|
||||
"risk_score": 73,
|
||||
"rule_id": "3efee4f0-182a-40a8-a835-102c68a4175d",
|
||||
"severity": "high",
|
||||
|
|
|
|||
|
|
@ -14,7 +14,7 @@
|
|||
"language": "kuery",
|
||||
"license": "Elastic License v2",
|
||||
"name": "WebProxy Settings Modification",
|
||||
"query": "event.category : process and event.type : start and process.name : networksetup and process.args : ((\"-setwebproxy\" or \"-setsecurewebproxy\" or \"-setautoproxyurl\") and not (Bluetooth or off)) and not process.parent.executable : (\"/Library/PrivilegedHelperTools/com.80pct.FreedomHelper\" or \"/Applications/Fiddler Everywhere.app/Contents/Resources/app/out/WebServer/Fiddler.WebUi\" or \"/usr/libexec/xpcproxy\")",
|
||||
"query": "event.category : process and event.type : start and\n process.name : networksetup and process.args : ((\"-setwebproxy\" or \"-setsecurewebproxy\" or \"-setautoproxyurl\") and not (Bluetooth or off)) and\n not process.parent.executable : (\"/Library/PrivilegedHelperTools/com.80pct.FreedomHelper\" or\n \"/Applications/Fiddler Everywhere.app/Contents/Resources/app/out/WebServer/Fiddler.WebUi\" or\n \"/usr/libexec/xpcproxy\")\n",
|
||||
"references": [
|
||||
"https://unit42.paloaltonetworks.com/mac-malware-steals-cryptocurrency-exchanges-cookies/",
|
||||
"https://objectivebythesea.com/v2/talks/OBTS_v2_Zohar.pdf"
|
||||
|
|
|
|||
|
|
@ -14,7 +14,7 @@
|
|||
"license": "Elastic License v2",
|
||||
"name": "Okta Brute Force or Password Spraying Attack",
|
||||
"note": "## Config\n\nThe Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.",
|
||||
"query": "event.dataset:okta.system and event.category:authentication and event.outcome:failure",
|
||||
"query": "event.dataset:okta.system and event.category:authentication and event.outcome:failure\n",
|
||||
"references": [
|
||||
"https://developer.okta.com/docs/reference/api/system-log/",
|
||||
"https://developer.okta.com/docs/reference/api/event-types/"
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@
|
|||
"language": "kuery",
|
||||
"license": "Elastic License v2",
|
||||
"name": "Potential SSH Brute Force Detected",
|
||||
"query": "event.category:process and event.type:start and process.name:\"sshd-keygen-wrapper\" and process.parent.name:launchd",
|
||||
"query": "event.category:process and event.type:start and process.name:\"sshd-keygen-wrapper\" and process.parent.name:launchd\n",
|
||||
"references": [
|
||||
"https://themittenmac.com/detecting-ssh-activity-via-process-monitoring/"
|
||||
],
|
||||
|
|
|
|||
|
|
@ -15,7 +15,7 @@
|
|||
"license": "Elastic License v2",
|
||||
"name": "AWS Management Console Brute Force of Root User Identity",
|
||||
"note": "## Config\n\nThe AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.",
|
||||
"query": "event.dataset:aws.cloudtrail and event.provider:signin.amazonaws.com and event.action:ConsoleLogin and aws.cloudtrail.user_identity.type:Root and event.outcome:failure",
|
||||
"query": "event.dataset:aws.cloudtrail and event.provider:signin.amazonaws.com and event.action:ConsoleLogin and aws.cloudtrail.user_identity.type:Root and event.outcome:failure\n",
|
||||
"references": [
|
||||
"https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html"
|
||||
],
|
||||
|
|
|
|||
|
|
@ -17,7 +17,7 @@
|
|||
"license": "Elastic License v2",
|
||||
"name": "AWS Access Secret in Secrets Manager",
|
||||
"note": "## Config\n\nThe AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.",
|
||||
"query": "event.dataset:aws.cloudtrail and event.provider:secretsmanager.amazonaws.com and event.action:GetSecretValue",
|
||||
"query": "event.dataset:aws.cloudtrail and event.provider:secretsmanager.amazonaws.com and event.action:GetSecretValue\n",
|
||||
"references": [
|
||||
"https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_GetSecretValue.html",
|
||||
"http://detectioninthe.cloud/credential_access/access_secret_in_secrets_manager/"
|
||||
|
|
|
|||
|
|
@ -15,7 +15,7 @@
|
|||
"license": "Elastic License v2",
|
||||
"name": "Azure Storage Account Key Regenerated",
|
||||
"note": "## Config\n\nThe Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.",
|
||||
"query": "event.dataset:azure.activitylogs and azure.activitylogs.operation_name:\"MICROSOFT.STORAGE/STORAGEACCOUNTS/REGENERATEKEY/ACTION\" and event.outcome:(Success or success)",
|
||||
"query": "event.dataset:azure.activitylogs and azure.activitylogs.operation_name:\"MICROSOFT.STORAGE/STORAGEACCOUNTS/REGENERATEKEY/ACTION\" and event.outcome:(Success or success)\n",
|
||||
"references": [
|
||||
"https://docs.microsoft.com/en-us/azure/storage/common/storage-account-keys-manage?tabs=azure-portal"
|
||||
],
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@
|
|||
"language": "kuery",
|
||||
"license": "Elastic License v2",
|
||||
"name": "SystemKey Access via Command Line",
|
||||
"query": "event.category:process and event.type:(start or process_started) and process.args:\"/private/var/db/SystemKey\"",
|
||||
"query": "event.category:process and event.type:(start or process_started) and\n process.args:\"/private/var/db/SystemKey\"\n",
|
||||
"references": [
|
||||
"https://github.com/AlessandroZ/LaZagne/blob/master/Mac/lazagne/softwares/system/chainbreaker.py"
|
||||
],
|
||||
|
|
|
|||
|
|
@ -0,0 +1,57 @@
|
|||
{
|
||||
"author": [
|
||||
"Elastic"
|
||||
],
|
||||
"description": "Jscript tries to query the AmsiEnable registry key from the HKEY_USERS registry hive before initializing Antimalware Scan Interface (AMSI). If this key is set to 0, AMSI is not enabled for the Jscript process. An adversary can modify this key to disable AMSI protections.",
|
||||
"from": "now-9m",
|
||||
"index": [
|
||||
"winlogbeat-*",
|
||||
"logs-endpoint.events.*",
|
||||
"logs-windows.*"
|
||||
],
|
||||
"language": "eql",
|
||||
"license": "Elastic License v2",
|
||||
"name": "Modification of AmsiEnable Registry Key",
|
||||
"query": "registry where event.type in (\"creation\", \"change\") and\n registry.path: \"HKEY_USERS\\\\*\\\\Software\\\\Microsoft\\\\Windows Script\\\\Settings\\\\AmsiEnable\" and\n registry.data.strings: \"0\"\n",
|
||||
"references": [
|
||||
"https://hackinparis.com/data/slides/2019/talks/HIP2019-Dominic_Chell-Cracking_The_Perimeter_With_Sharpshooter.pdf",
|
||||
"https://docs.microsoft.com/en-us/windows/win32/amsi/antimalware-scan-interface-portal"
|
||||
],
|
||||
"risk_score": 73,
|
||||
"rule_id": "f874315d-5188-4b4a-8521-d1c73093a7e4",
|
||||
"severity": "high",
|
||||
"tags": [
|
||||
"Elastic",
|
||||
"Host",
|
||||
"Windows",
|
||||
"Threat Detection",
|
||||
"Defense Evasion"
|
||||
],
|
||||
"threat": [
|
||||
{
|
||||
"framework": "MITRE ATT&CK",
|
||||
"tactic": {
|
||||
"id": "TA0005",
|
||||
"name": "Defense Evasion",
|
||||
"reference": "https://attack.mitre.org/tactics/TA0005/"
|
||||
},
|
||||
"technique": [
|
||||
{
|
||||
"id": "T1562",
|
||||
"name": "Impair Defenses",
|
||||
"reference": "https://attack.mitre.org/techniques/T1562/",
|
||||
"subtechnique": [
|
||||
{
|
||||
"id": "T1562.001",
|
||||
"name": "Disable or Modify Tools",
|
||||
"reference": "https://attack.mitre.org/techniques/T1562/001/"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"timestamp_override": "event.ingested",
|
||||
"type": "eql",
|
||||
"version": 1
|
||||
}
|
||||
|
|
@ -14,7 +14,7 @@
|
|||
"language": "kuery",
|
||||
"license": "Elastic License v2",
|
||||
"name": "SoftwareUpdate Preferences Modification",
|
||||
"query": "event.category:process and event.type:(start or process_started) and process.name:defaults and process.args:(write and \"-bool\" and (com.apple.SoftwareUpdate or /Library/Preferences/com.apple.SoftwareUpdate.plist) and not (TRUE or true))",
|
||||
"query": "event.category:process and event.type:(start or process_started) and\n process.name:defaults and \n process.args:(write and \"-bool\" and (com.apple.SoftwareUpdate or /Library/Preferences/com.apple.SoftwareUpdate.plist) and not (TRUE or true))\n",
|
||||
"references": [
|
||||
"https://blog.checkpoint.com/2017/07/13/osxdok-refuses-go-away-money/"
|
||||
],
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@
|
|||
"language": "kuery",
|
||||
"license": "Elastic License v2",
|
||||
"name": "Attempt to Disable Gatekeeper",
|
||||
"query": "event.category:process and event.type:(start or process_started) and process.args:(spctl and \"--master-disable\")",
|
||||
"query": "event.category:process and event.type:(start or process_started) and \n process.args:(spctl and \"--master-disable\")\n",
|
||||
"references": [
|
||||
"https://support.apple.com/en-us/HT202491",
|
||||
"https://www.carbonblack.com/blog/tau-threat-intelligence-notification-new-macos-malware-variant-of-shlayer-osx-discovered/"
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@
|
|||
"language": "kuery",
|
||||
"license": "Elastic License v2",
|
||||
"name": "Attempt to Disable IPTables or Firewall",
|
||||
"query": "event.category:process and event.type:(start or process_started) and process.name:ufw and process.args:(allow or disable or reset) or (((process.name:service and process.args:stop) or (process.name:chkconfig and process.args:off) or (process.name:systemctl and process.args:(disable or stop or kill))) and process.args:(firewalld or ip6tables or iptables))",
|
||||
"query": "event.category:process and event.type:(start or process_started) and\n process.name:ufw and process.args:(allow or disable or reset) or\n\n (((process.name:service and process.args:stop) or\n (process.name:chkconfig and process.args:off) or\n (process.name:systemctl and process.args:(disable or stop or kill))) and\n process.args:(firewalld or ip6tables or iptables))\n",
|
||||
"risk_score": 47,
|
||||
"rule_id": "125417b8-d3df-479f-8418-12d7e034fee3",
|
||||
"severity": "medium",
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@
|
|||
"language": "kuery",
|
||||
"license": "Elastic License v2",
|
||||
"name": "Attempt to Disable Syslog Service",
|
||||
"query": "event.category:process and event.type:(start or process_started) and ((process.name:service and process.args:stop) or (process.name:chkconfig and process.args:off) or (process.name:systemctl and process.args:(disable or stop or kill))) and process.args:(syslog or rsyslog or \"syslog-ng\")",
|
||||
"query": "event.category:process and event.type:(start or process_started) and\n ((process.name:service and process.args:stop) or\n (process.name:chkconfig and process.args:off) or\n (process.name:systemctl and process.args:(disable or stop or kill)))\n and process.args:(syslog or rsyslog or \"syslog-ng\")\n",
|
||||
"risk_score": 47,
|
||||
"rule_id": "2f8a1226-5720-437d-9c20-e0029deb6194",
|
||||
"severity": "medium",
|
||||
|
|
|
|||
|
|
@ -15,7 +15,7 @@
|
|||
"license": "Elastic License v2",
|
||||
"name": "Azure Application Credential Modification",
|
||||
"note": "## Config\n\nThe Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.",
|
||||
"query": "event.dataset:azure.auditlogs and azure.auditlogs.operation_name:\"Update application - Certificates and secrets management\" and event.outcome:(success or Success)",
|
||||
"query": "event.dataset:azure.auditlogs and azure.auditlogs.operation_name:\"Update application - Certificates and secrets management\" and event.outcome:(success or Success)\n",
|
||||
"references": [
|
||||
"https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/"
|
||||
],
|
||||
|
|
|
|||
|
|
@ -15,7 +15,7 @@
|
|||
"license": "Elastic License v2",
|
||||
"name": "Azure Diagnostic Settings Deletion",
|
||||
"note": "## Config\n\nThe Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.",
|
||||
"query": "event.dataset:azure.activitylogs and azure.activitylogs.operation_name:\"MICROSOFT.INSIGHTS/DIAGNOSTICSETTINGS/DELETE\" and event.outcome:(Success or success)",
|
||||
"query": "event.dataset:azure.activitylogs and azure.activitylogs.operation_name:\"MICROSOFT.INSIGHTS/DIAGNOSTICSETTINGS/DELETE\" and event.outcome:(Success or success)\n",
|
||||
"references": [
|
||||
"https://docs.microsoft.com/en-us/azure/azure-monitor/platform/diagnostic-settings"
|
||||
],
|
||||
|
|
|
|||
|
|
@ -15,7 +15,7 @@
|
|||
"license": "Elastic License v2",
|
||||
"name": "Azure Service Principal Addition",
|
||||
"note": "## Config\n\nThe Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.",
|
||||
"query": "event.dataset:azure.auditlogs and azure.auditlogs.operation_name:\"Add service principal\" and event.outcome:(success or Success)",
|
||||
"query": "event.dataset:azure.auditlogs and azure.auditlogs.operation_name:\"Add service principal\" and event.outcome:(success or Success)\n",
|
||||
"references": [
|
||||
"https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/",
|
||||
"https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-create-service-principal-portal"
|
||||
|
|
|
|||
|
|
@ -14,7 +14,7 @@
|
|||
"language": "kuery",
|
||||
"license": "Elastic License v2",
|
||||
"name": "Base16 or Base32 Encoding/Decoding Activity",
|
||||
"query": "event.category:process and event.type:(start or process_started) and process.name:(base16 or base32 or base32plain or base32hex)",
|
||||
"query": "event.category:process and event.type:(start or process_started) and\n process.name:(base16 or base32 or base32plain or base32hex)\n",
|
||||
"risk_score": 21,
|
||||
"rule_id": "debff20a-46bc-4a4d-bae5-5cdd14222795",
|
||||
"severity": "low",
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@
|
|||
"language": "kuery",
|
||||
"license": "Elastic License v2",
|
||||
"name": "Windows Event Logs Cleared",
|
||||
"query": "event.action:(\"audit-log-cleared\" or \"Log clear\")",
|
||||
"query": "event.action:(\"audit-log-cleared\" or \"Log clear\")\n",
|
||||
"risk_score": 21,
|
||||
"rule_id": "45ac4800-840f-414c-b221-53dd36a5aaf7",
|
||||
"severity": "low",
|
||||
|
|
|
|||
|
|
@ -16,7 +16,7 @@
|
|||
"license": "Elastic License v2",
|
||||
"name": "AWS CloudTrail Log Deleted",
|
||||
"note": "## Config\n\nThe AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.",
|
||||
"query": "event.dataset:aws.cloudtrail and event.provider:cloudtrail.amazonaws.com and event.action:DeleteTrail and event.outcome:success",
|
||||
"query": "event.dataset:aws.cloudtrail and event.provider:cloudtrail.amazonaws.com and event.action:DeleteTrail and event.outcome:success\n",
|
||||
"references": [
|
||||
"https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_DeleteTrail.html",
|
||||
"https://awscli.amazonaws.com/v2/documentation/api/latest/reference/cloudtrail/delete-trail.html"
|
||||
|
|
|
|||
|
|
@ -16,7 +16,7 @@
|
|||
"license": "Elastic License v2",
|
||||
"name": "AWS CloudTrail Log Suspended",
|
||||
"note": "## Config\n\nThe AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.",
|
||||
"query": "event.dataset:aws.cloudtrail and event.provider:cloudtrail.amazonaws.com and event.action:StopLogging and event.outcome:success",
|
||||
"query": "event.dataset:aws.cloudtrail and event.provider:cloudtrail.amazonaws.com and event.action:StopLogging and event.outcome:success\n",
|
||||
"references": [
|
||||
"https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_StopLogging.html",
|
||||
"https://awscli.amazonaws.com/v2/documentation/api/latest/reference/cloudtrail/stop-logging.html"
|
||||
|
|
|
|||
|
|
@ -16,7 +16,7 @@
|
|||
"license": "Elastic License v2",
|
||||
"name": "AWS CloudWatch Alarm Deletion",
|
||||
"note": "## Config\n\nThe AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.",
|
||||
"query": "event.dataset:aws.cloudtrail and event.provider:monitoring.amazonaws.com and event.action:DeleteAlarms and event.outcome:success",
|
||||
"query": "event.dataset:aws.cloudtrail and event.provider:monitoring.amazonaws.com and event.action:DeleteAlarms and event.outcome:success\n",
|
||||
"references": [
|
||||
"https://awscli.amazonaws.com/v2/documentation/api/latest/reference/cloudwatch/delete-alarms.html",
|
||||
"https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_DeleteAlarms.html"
|
||||
|
|
|
|||
|
|
@ -17,7 +17,7 @@
|
|||
"license": "Elastic License v2",
|
||||
"name": "AWS Config Service Tampering",
|
||||
"note": "## Config\n\nThe AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.",
|
||||
"query": "event.dataset:aws.cloudtrail and event.provider:config.amazonaws.com and event.action:(DeleteConfigRule or DeleteOrganizationConfigRule or DeleteConfigurationAggregator or DeleteConfigurationRecorder or DeleteConformancePack or DeleteOrganizationConformancePack or DeleteDeliveryChannel or DeleteRemediationConfiguration or DeleteRetentionConfiguration)",
|
||||
"query": "event.dataset:aws.cloudtrail and event.provider:config.amazonaws.com and\n event.action:(DeleteConfigRule or DeleteOrganizationConfigRule or DeleteConfigurationAggregator or\n DeleteConfigurationRecorder or DeleteConformancePack or DeleteOrganizationConformancePack or\n DeleteDeliveryChannel or DeleteRemediationConfiguration or DeleteRetentionConfiguration)\n",
|
||||
"references": [
|
||||
"https://docs.aws.amazon.com/config/latest/developerguide/how-does-config-work.html",
|
||||
"https://docs.aws.amazon.com/config/latest/APIReference/API_Operations.html"
|
||||
|
|
|
|||
|
|
@ -16,7 +16,7 @@
|
|||
"license": "Elastic License v2",
|
||||
"name": "AWS Configuration Recorder Stopped",
|
||||
"note": "## Config\n\nThe AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.",
|
||||
"query": "event.dataset:aws.cloudtrail and event.provider:config.amazonaws.com and event.action:StopConfigurationRecorder and event.outcome:success",
|
||||
"query": "event.dataset:aws.cloudtrail and event.provider:config.amazonaws.com and event.action:StopConfigurationRecorder and event.outcome:success\n",
|
||||
"references": [
|
||||
"https://awscli.amazonaws.com/v2/documentation/api/latest/reference/configservice/stop-configuration-recorder.html",
|
||||
"https://docs.aws.amazon.com/config/latest/APIReference/API_StopConfigurationRecorder.html"
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@
|
|||
"language": "kuery",
|
||||
"license": "Elastic License v2",
|
||||
"name": "Windows CryptoAPI Spoofing Vulnerability (CVE-2020-0601 - CurveBall)",
|
||||
"query": "event.provider:\"Microsoft-Windows-Audit-CVE\" and message:\"[CVE-2020-0601]\"",
|
||||
"query": "event.provider:\"Microsoft-Windows-Audit-CVE\" and message:\"[CVE-2020-0601]\"\n",
|
||||
"risk_score": 21,
|
||||
"rule_id": "56557cde-d923-4b88-adee-c61b3f3b5dc3",
|
||||
"severity": "low",
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@
|
|||
"language": "kuery",
|
||||
"license": "Elastic License v2",
|
||||
"name": "Potential Disabling of SELinux",
|
||||
"query": "event.category:process and event.type:(start or process_started) and process.name:setenforce and process.args:0",
|
||||
"query": "event.category:process and event.type:(start or process_started) and process.name:setenforce and process.args:0\n",
|
||||
"risk_score": 47,
|
||||
"rule_id": "eb9eb8ba-a983-41d9-9c93-a1c05112ca5e",
|
||||
"severity": "medium",
|
||||
|
|
|
|||
|
|
@ -16,7 +16,7 @@
|
|||
"license": "Elastic License v2",
|
||||
"name": "AWS EC2 Flow Log Deletion",
|
||||
"note": "## Config\n\nThe AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.",
|
||||
"query": "event.dataset:aws.cloudtrail and event.provider:ec2.amazonaws.com and event.action:DeleteFlowLogs and event.outcome:success",
|
||||
"query": "event.dataset:aws.cloudtrail and event.provider:ec2.amazonaws.com and event.action:DeleteFlowLogs and event.outcome:success\n",
|
||||
"references": [
|
||||
"https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/delete-flow-logs.html",
|
||||
"https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteFlowLogs.html"
|
||||
|
|
|
|||
|
|
@ -16,7 +16,7 @@
|
|||
"license": "Elastic License v2",
|
||||
"name": "AWS EC2 Network Access Control List Deletion",
|
||||
"note": "## Config\n\nThe AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.",
|
||||
"query": "event.dataset:aws.cloudtrail and event.provider:ec2.amazonaws.com and event.action:(DeleteNetworkAcl or DeleteNetworkAclEntry) and event.outcome:success",
|
||||
"query": "event.dataset:aws.cloudtrail and event.provider:ec2.amazonaws.com and event.action:(DeleteNetworkAcl or DeleteNetworkAclEntry) and event.outcome:success\n",
|
||||
"references": [
|
||||
"https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/delete-network-acl.html",
|
||||
"https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteNetworkAcl.html",
|
||||
|
|
|
|||
|
|
@ -15,7 +15,7 @@
|
|||
"license": "Elastic License v2",
|
||||
"name": "Azure Event Hub Deletion",
|
||||
"note": "## Config\n\nThe Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.",
|
||||
"query": "event.dataset:azure.activitylogs and azure.activitylogs.operation_name:\"MICROSOFT.EVENTHUB/NAMESPACES/EVENTHUBS/DELETE\" and event.outcome:(Success or success)",
|
||||
"query": "event.dataset:azure.activitylogs and azure.activitylogs.operation_name:\"MICROSOFT.EVENTHUB/NAMESPACES/EVENTHUBS/DELETE\" and event.outcome:(Success or success)\n",
|
||||
"references": [
|
||||
"https://docs.microsoft.com/en-us/azure/event-hubs/event-hubs-about",
|
||||
"https://azure.microsoft.com/en-in/services/event-hubs/",
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@
|
|||
"language": "kuery",
|
||||
"license": "Elastic License v2",
|
||||
"name": "File Deletion via Shred",
|
||||
"query": "event.category:process and event.type:(start or process_started) and process.name:shred and process.args:(\"-u\" or \"--remove\" or \"-z\" or \"--zero\")",
|
||||
"query": "event.category:process and event.type:(start or process_started) and process.name:shred and\n process.args:(\"-u\" or \"--remove\" or \"-z\" or \"--zero\")\n",
|
||||
"risk_score": 21,
|
||||
"rule_id": "a1329140-8de3-4445-9f87-908fb6d824f4",
|
||||
"severity": "low",
|
||||
|
|
|
|||
|
|
@ -14,7 +14,7 @@
|
|||
"language": "kuery",
|
||||
"license": "Elastic License v2",
|
||||
"name": "File Permission Modification in Writable Directory",
|
||||
"query": "event.category:process and event.type:(start or process_started) and process.name:(chmod or chown or chattr or chgrp) and process.working_directory:(/tmp or /var/tmp or /dev/shm) and not user.name:root",
|
||||
"query": "event.category:process and event.type:(start or process_started) and\n process.name:(chmod or chown or chattr or chgrp) and\n process.working_directory:(/tmp or /var/tmp or /dev/shm) and\n not user.name:root\n",
|
||||
"risk_score": 21,
|
||||
"rule_id": "9f9a2a82-93a8-4b1a-8778-1780895626d4",
|
||||
"severity": "low",
|
||||
|
|
|
|||
|
|
@ -15,7 +15,7 @@
|
|||
"license": "Elastic License v2",
|
||||
"name": "Azure Firewall Policy Deletion",
|
||||
"note": "## Config\n\nThe Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.",
|
||||
"query": "event.dataset:azure.activitylogs and azure.activitylogs.operation_name:\"MICROSOFT.NETWORK/FIREWALLPOLICIES/DELETE\" and event.outcome:(Success or success)",
|
||||
"query": "event.dataset:azure.activitylogs and azure.activitylogs.operation_name:\"MICROSOFT.NETWORK/FIREWALLPOLICIES/DELETE\" and event.outcome:(Success or success)\n",
|
||||
"references": [
|
||||
"https://docs.microsoft.com/en-us/azure/firewall-manager/policy-overview"
|
||||
],
|
||||
|
|
|
|||
|
|
@ -14,7 +14,7 @@
|
|||
"license": "Elastic License v2",
|
||||
"name": "GCP Firewall Rule Creation",
|
||||
"note": "## Config\n\nThe GCP Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.",
|
||||
"query": "event.dataset:(googlecloud.audit or gcp.audit) and event.action:v*.compute.firewalls.insert",
|
||||
"query": "event.dataset:(googlecloud.audit or gcp.audit) and event.action:v*.compute.firewalls.insert\n",
|
||||
"references": [
|
||||
"https://cloud.google.com/vpc/docs/firewalls"
|
||||
],
|
||||
|
|
|
|||
|
|
@ -14,7 +14,7 @@
|
|||
"license": "Elastic License v2",
|
||||
"name": "GCP Firewall Rule Deletion",
|
||||
"note": "## Config\n\nThe GCP Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.",
|
||||
"query": "event.dataset:(googlecloud.audit or gcp.audit) and event.action:v*.compute.firewalls.delete",
|
||||
"query": "event.dataset:(googlecloud.audit or gcp.audit) and event.action:v*.compute.firewalls.delete\n",
|
||||
"references": [
|
||||
"https://cloud.google.com/vpc/docs/firewalls"
|
||||
],
|
||||
|
|
|
|||
|
|
@ -14,7 +14,7 @@
|
|||
"license": "Elastic License v2",
|
||||
"name": "GCP Firewall Rule Modification",
|
||||
"note": "## Config\n\nThe GCP Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.",
|
||||
"query": "event.dataset:(googlecloud.audit or gcp.audit) and event.action:v*.compute.firewalls.patch",
|
||||
"query": "event.dataset:(googlecloud.audit or gcp.audit) and event.action:v*.compute.firewalls.patch\n",
|
||||
"references": [
|
||||
"https://cloud.google.com/vpc/docs/firewalls"
|
||||
],
|
||||
|
|
|
|||
|
|
@ -14,7 +14,7 @@
|
|||
"license": "Elastic License v2",
|
||||
"name": "GCP Logging Bucket Deletion",
|
||||
"note": "## Config\n\nThe GCP Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.",
|
||||
"query": "event.dataset:(googlecloud.audit or gcp.audit) and event.action:google.logging.v*.ConfigServiceV*.DeleteBucket and event.outcome:success",
|
||||
"query": "event.dataset:(googlecloud.audit or gcp.audit) and event.action:google.logging.v*.ConfigServiceV*.DeleteBucket and event.outcome:success\n",
|
||||
"references": [
|
||||
"https://cloud.google.com/logging/docs/buckets",
|
||||
"https://cloud.google.com/logging/docs/storage"
|
||||
|
|
|
|||
|
|
@ -14,7 +14,7 @@
|
|||
"license": "Elastic License v2",
|
||||
"name": "GCP Logging Sink Deletion",
|
||||
"note": "## Config\n\nThe GCP Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.",
|
||||
"query": "event.dataset:(googlecloud.audit or gcp.audit) and event.action:google.logging.v*.ConfigServiceV*.DeleteSink and event.outcome:success",
|
||||
"query": "event.dataset:(googlecloud.audit or gcp.audit) and event.action:google.logging.v*.ConfigServiceV*.DeleteSink and event.outcome:success\n",
|
||||
"references": [
|
||||
"https://cloud.google.com/logging/docs/export"
|
||||
],
|
||||
|
|
|
|||
|
|
@ -14,7 +14,7 @@
|
|||
"license": "Elastic License v2",
|
||||
"name": "GCP Pub/Sub Subscription Deletion",
|
||||
"note": "## Config\n\nThe GCP Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.",
|
||||
"query": "event.dataset:(googlecloud.audit or gcp.audit) and event.action:google.pubsub.v*.Subscriber.DeleteSubscription and event.outcome:success",
|
||||
"query": "event.dataset:(googlecloud.audit or gcp.audit) and event.action:google.pubsub.v*.Subscriber.DeleteSubscription and event.outcome:success\n",
|
||||
"references": [
|
||||
"https://cloud.google.com/pubsub/docs/overview"
|
||||
],
|
||||
|
|
|
|||
|
|
@ -14,7 +14,7 @@
|
|||
"license": "Elastic License v2",
|
||||
"name": "GCP Pub/Sub Topic Deletion",
|
||||
"note": "## Config\n\nThe GCP Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.",
|
||||
"query": "event.dataset:(googlecloud.audit or gcp.audit) and event.action:google.pubsub.v*.Publisher.DeleteTopic and event.outcome:success",
|
||||
"query": "event.dataset:(googlecloud.audit or gcp.audit) and event.action:google.pubsub.v*.Publisher.DeleteTopic and event.outcome:success\n",
|
||||
"references": [
|
||||
"https://cloud.google.com/pubsub/docs/overview"
|
||||
],
|
||||
|
|
|
|||
|
|
@ -14,7 +14,7 @@
|
|||
"license": "Elastic License v2",
|
||||
"name": "GCP Storage Bucket Configuration Modification",
|
||||
"note": "## Config\n\nThe GCP Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.",
|
||||
"query": "event.dataset:(googlecloud.audit or gcp.audit) and event.action:\"storage.buckets.update\" and event.outcome:success",
|
||||
"query": "event.dataset:(googlecloud.audit or gcp.audit) and event.action:\"storage.buckets.update\" and event.outcome:success\n",
|
||||
"references": [
|
||||
"https://cloud.google.com/storage/docs/key-terms#buckets"
|
||||
],
|
||||
|
|
|
|||
|
|
@ -14,7 +14,7 @@
|
|||
"license": "Elastic License v2",
|
||||
"name": "GCP Storage Bucket Permissions Modification",
|
||||
"note": "## Config\n\nThe GCP Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.",
|
||||
"query": "event.dataset:(googlecloud.audit or gcp.audit) and event.action:\"storage.setIamPermissions\" and event.outcome:success",
|
||||
"query": "event.dataset:(googlecloud.audit or gcp.audit) and event.action:\"storage.setIamPermissions\" and event.outcome:success\n",
|
||||
"references": [
|
||||
"https://cloud.google.com/storage/docs/access-control/iam-permissions"
|
||||
],
|
||||
|
|
|
|||
|
|
@ -16,7 +16,7 @@
|
|||
"license": "Elastic License v2",
|
||||
"name": "AWS GuardDuty Detector Deletion",
|
||||
"note": "## Config\n\nThe AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.",
|
||||
"query": "event.dataset:aws.cloudtrail and event.provider:guardduty.amazonaws.com and event.action:DeleteDetector and event.outcome:success",
|
||||
"query": "event.dataset:aws.cloudtrail and event.provider:guardduty.amazonaws.com and event.action:DeleteDetector and event.outcome:success\n",
|
||||
"references": [
|
||||
"https://awscli.amazonaws.com/v2/documentation/api/latest/reference/guardduty/delete-detector.html",
|
||||
"https://docs.aws.amazon.com/guardduty/latest/APIReference/API_DeleteDetector.html"
|
||||
|
|
|
|||
|
|
@ -15,7 +15,7 @@
|
|||
"license": "Elastic License v2",
|
||||
"max_signals": 33,
|
||||
"name": "Creation of Hidden Files and Directories",
|
||||
"query": "event.category:process AND event.type:(start or process_started) AND process.working_directory:(\"/tmp\" or \"/var/tmp\" or \"/dev/shm\") AND process.args:/\\.[a-zA-Z0-9_\\-][a-zA-Z0-9_\\-\\.]{1,254}/ AND NOT process.name:(ls or find)",
|
||||
"query": "event.category:process AND event.type:(start or process_started) AND\n process.working_directory:(\"/tmp\" or \"/var/tmp\" or \"/dev/shm\") AND\n process.args:/\\.[a-zA-Z0-9_\\-][a-zA-Z0-9_\\-\\.]{1,254}/ AND\n NOT process.name:(ls or find)\n",
|
||||
"risk_score": 47,
|
||||
"rule_id": "b9666521-4742-49ce-9ddc-b8e84c35acae",
|
||||
"severity": "medium",
|
||||
|
|
|
|||
|
|
@ -13,7 +13,7 @@
|
|||
"language": "kuery",
|
||||
"license": "Elastic License v2",
|
||||
"name": "Process Injection by the Microsoft Build Engine",
|
||||
"query": "process.name:MSBuild.exe and event.action:\"CreateRemoteThread detected (rule: CreateRemoteThread)\"",
|
||||
"query": "process.name:MSBuild.exe and event.action:\"CreateRemoteThread detected (rule: CreateRemoteThread)\"\n",
|
||||
"risk_score": 21,
|
||||
"rule_id": "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae9",
|
||||
"severity": "low",
|
||||
|
|
|
|||
|
|
@ -14,7 +14,7 @@
|
|||
"language": "kuery",
|
||||
"license": "Elastic License v2",
|
||||
"name": "Attempt to Install Root Certificate",
|
||||
"query": "event.category:process and event.type:(start or process_started) and process.name:security and process.args:\"add-trusted-cert\"",
|
||||
"query": "event.category:process and event.type:(start or process_started) and\n process.name:security and process.args:\"add-trusted-cert\"\n",
|
||||
"references": [
|
||||
"https://ss64.com/osx/security-cert.html"
|
||||
],
|
||||
|
|
|
|||
|
|
@ -14,7 +14,7 @@
|
|||
"language": "kuery",
|
||||
"license": "Elastic License v2",
|
||||
"name": "Kernel Module Removal",
|
||||
"query": "event.category:process and event.type:(start or process_started) and process.args:((rmmod and sudo) or (modprobe and sudo and (\"--remove\" or \"-r\")))",
|
||||
"query": "event.category:process and event.type:(start or process_started) and\n process.args:((rmmod and sudo) or (modprobe and sudo and (\"--remove\" or \"-r\")))\n",
|
||||
"references": [
|
||||
"http://man7.org/linux/man-pages/man8/modprobe.8.html"
|
||||
],
|
||||
|
|
|
|||
|
|
@ -15,7 +15,7 @@
|
|||
"license": "Elastic License v2",
|
||||
"name": "Microsoft 365 Exchange DLP Policy Removed",
|
||||
"note": "## Config\n\nThe Microsoft 365 Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.",
|
||||
"query": "event.dataset:o365.audit and event.provider:Exchange and event.category:web and event.action:\"Remove-DlpPolicy\" and event.outcome:success",
|
||||
"query": "event.dataset:o365.audit and event.provider:Exchange and event.category:web and event.action:\"Remove-DlpPolicy\" and event.outcome:success\n",
|
||||
"references": [
|
||||
"https://docs.microsoft.com/en-us/powershell/module/exchange/remove-dlppolicy?view=exchange-ps",
|
||||
"https://docs.microsoft.com/en-us/microsoft-365/compliance/data-loss-prevention-policies?view=o365-worldwide"
|
||||
|
|
|
|||
|
|
@ -15,7 +15,7 @@
|
|||
"license": "Elastic License v2",
|
||||
"name": "Microsoft 365 Exchange Malware Filter Policy Deletion",
|
||||
"note": "## Config\n\nThe Microsoft 365 Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.",
|
||||
"query": "event.dataset:o365.audit and event.provider:Exchange and event.category:web and event.action:\"Remove-MalwareFilterPolicy\" and event.outcome:success",
|
||||
"query": "event.dataset:o365.audit and event.provider:Exchange and event.category:web and event.action:\"Remove-MalwareFilterPolicy\" and event.outcome:success\n",
|
||||
"references": [
|
||||
"https://docs.microsoft.com/en-us/powershell/module/exchange/remove-malwarefilterpolicy?view=exchange-ps"
|
||||
],
|
||||
|
|
|
|||
|
|
@ -15,7 +15,7 @@
|
|||
"license": "Elastic License v2",
|
||||
"name": "Microsoft 365 Exchange Malware Filter Rule Modification",
|
||||
"note": "## Config\n\nThe Microsoft 365 Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.",
|
||||
"query": "event.dataset:o365.audit and event.provider:Exchange and event.category:web and event.action:(\"Remove-MalwareFilterRule\" or \"Disable-MalwareFilterRule\") and event.outcome:success",
|
||||
"query": "event.dataset:o365.audit and event.provider:Exchange and event.category:web and event.action:(\"Remove-MalwareFilterRule\" or \"Disable-MalwareFilterRule\") and event.outcome:success\n",
|
||||
"references": [
|
||||
"https://docs.microsoft.com/en-us/powershell/module/exchange/remove-malwarefilterrule?view=exchange-ps",
|
||||
"https://docs.microsoft.com/en-us/powershell/module/exchange/disable-malwarefilterrule?view=exchange-ps"
|
||||
|
|
|
|||
|
|
@ -15,7 +15,7 @@
|
|||
"license": "Elastic License v2",
|
||||
"name": "Microsoft 365 Exchange Safe Attachment Rule Disabled",
|
||||
"note": "## Config\n\nThe Microsoft 365 Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.",
|
||||
"query": "event.dataset:o365.audit and event.provider:Exchange and event.category:web and event.action:\"Disable-SafeAttachmentRule\" and event.outcome:success",
|
||||
"query": "event.dataset:o365.audit and event.provider:Exchange and event.category:web and event.action:\"Disable-SafeAttachmentRule\" and event.outcome:success\n",
|
||||
"references": [
|
||||
"https://docs.microsoft.com/en-us/powershell/module/exchange/disable-safeattachmentrule?view=exchange-ps"
|
||||
],
|
||||
|
|
|
|||
|
|
@ -12,7 +12,10 @@
|
|||
"language": "eql",
|
||||
"license": "Elastic License v2",
|
||||
"name": "Network Connection via Signed Binary",
|
||||
"query": "sequence by process.entity_id\n [process where (process.name : \"expand.exe\" or process.name : \"extrac.exe\" or\n process.name : \"ieexec.exe\" or process.name : \"makecab.exe\") and\n event.type == \"start\"]\n [network where (process.name : \"expand.exe\" or process.name : \"extrac.exe\" or\n process.name : \"ieexec.exe\" or process.name : \"makecab.exe\") and\n not cidrmatch(destination.ip, \"10.0.0.0/8\", \"172.16.0.0/12\", \"192.168.0.0/16\")]\n",
|
||||
"query": "sequence by process.entity_id\n [process where (process.name : \"expand.exe\" or process.name : \"extrac.exe\" or\n process.name : \"ieexec.exe\" or process.name : \"makecab.exe\") and\n event.type == \"start\"]\n [network where (process.name : \"expand.exe\" or process.name : \"extrac.exe\" or\n process.name : \"ieexec.exe\" or process.name : \"makecab.exe\") and\n not cidrmatch(destination.ip,\n \"10.0.0.0/8\", \"127.0.0.0/8\", \"169.254.0.0/16\", \"172.16.0.0/12\", \"192.0.0.0/24\", \"192.0.0.0/29\", \"192.0.0.8/32\",\n \"192.0.0.9/32\", \"192.0.0.10/32\", \"192.0.0.170/32\", \"192.0.0.171/32\", \"192.0.2.0/24\", \"192.31.196.0/24\",\n \"192.52.193.0/24\", \"192.168.0.0/16\", \"192.88.99.0/24\", \"224.0.0.0/4\", \"100.64.0.0/10\", \"192.175.48.0/24\",\n \"198.18.0.0/15\", \"198.51.100.0/24\", \"203.0.113.0/24\", \"240.0.0.0/4\", \"::1\", \"FE80::/10\", \"FF00::/8\")]\n",
|
||||
"references": [
|
||||
"https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml"
|
||||
],
|
||||
"risk_score": 21,
|
||||
"rule_id": "63e65ec3-43b1-45b0-8f2d-45b34291dc44",
|
||||
"severity": "low",
|
||||
|
|
@ -50,5 +53,5 @@
|
|||
}
|
||||
],
|
||||
"type": "eql",
|
||||
"version": 7
|
||||
"version": 8
|
||||
}
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@
|
|||
"language": "kuery",
|
||||
"license": "Elastic License v2",
|
||||
"name": "Modification of Environment Variable via Launchctl",
|
||||
"query": "event.category:process and event.type:start and process.name:launchctl and process.args:(setenv and not (JAVA*_HOME or RUNTIME_JAVA_HOME or DBUS_LAUNCHD_SESSION_BUS_SOCKET or ANT_HOME or LG_WEBOS_TV_SDK_HOME or WEBOS_CLI_TV or EDEN_ENV) ) and not process.parent.executable:(\"/Applications/NoMachine.app/Contents/Frameworks/bin/nxserver.bin\" or \"/usr/local/bin/kr\" or \"/Applications/NoMachine.app/Contents/Frameworks/bin/nxserver.bin\" or \"/Applications/IntelliJ IDEA CE.app/Contents/jbr/Contents/Home/lib/jspawnhelper\")",
|
||||
"query": "event.category:process and event.type:start and\n process.name:launchctl and\n process.args:(setenv and not (JAVA*_HOME or\n RUNTIME_JAVA_HOME or\n DBUS_LAUNCHD_SESSION_BUS_SOCKET or\n ANT_HOME or\n LG_WEBOS_TV_SDK_HOME or\n WEBOS_CLI_TV or\n EDEN_ENV)\n ) and\n not process.parent.executable:(\"/Applications/NoMachine.app/Contents/Frameworks/bin/nxserver.bin\" or\n \"/usr/local/bin/kr\" or\n \"/Applications/NoMachine.app/Contents/Frameworks/bin/nxserver.bin\" or\n \"/Applications/IntelliJ IDEA CE.app/Contents/jbr/Contents/Home/lib/jspawnhelper\")\n",
|
||||
"references": [
|
||||
"https://github.com/rapid7/metasploit-framework/blob/master//modules/post/osx/escalate/tccbypass.rb"
|
||||
],
|
||||
|
|
|
|||
|
|
@ -12,7 +12,10 @@
|
|||
"language": "eql",
|
||||
"license": "Elastic License v2",
|
||||
"name": "Network Connection via MsXsl",
|
||||
"query": "sequence by process.entity_id\n [process where process.name : \"msxsl.exe\" and event.type == \"start\"]\n [network where process.name : \"msxsl.exe\" and\n not cidrmatch(destination.ip, \"10.0.0.0/8\", \"172.16.0.0/12\", \"192.168.0.0/16\")]\n",
|
||||
"query": "sequence by process.entity_id\n [process where process.name : \"msxsl.exe\" and event.type == \"start\"]\n [network where process.name : \"msxsl.exe\" and\n not cidrmatch(destination.ip, \"10.0.0.0/8\", \"127.0.0.0/8\", \"169.254.0.0/16\", \"172.16.0.0/12\", \"192.0.0.0/24\",\n \"192.0.0.0/29\", \"192.0.0.8/32\", \"192.0.0.9/32\", \"192.0.0.10/32\", \"192.0.0.170/32\", \"192.0.0.171/32\",\n \"192.0.2.0/24\", \"192.31.196.0/24\", \"192.52.193.0/24\", \"192.168.0.0/16\", \"192.88.99.0/24\", \"224.0.0.0/4\",\n \"100.64.0.0/10\", \"192.175.48.0/24\",\"198.18.0.0/15\", \"198.51.100.0/24\", \"203.0.113.0/24\", \"240.0.0.0/4\", \"::1\",\n \"FE80::/10\", \"FF00::/8\")]\n",
|
||||
"references": [
|
||||
"https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml"
|
||||
],
|
||||
"risk_score": 21,
|
||||
"rule_id": "b86afe07-0d98-4738-b15d-8d7465f95ff5",
|
||||
"severity": "low",
|
||||
|
|
@ -41,5 +44,5 @@
|
|||
}
|
||||
],
|
||||
"type": "eql",
|
||||
"version": 6
|
||||
"version": 7
|
||||
}
|
||||
|
|
|
|||
|
|
@ -15,7 +15,7 @@
|
|||
"license": "Elastic License v2",
|
||||
"name": "Azure Network Watcher Deletion",
|
||||
"note": "## Config\n\nThe Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.",
|
||||
"query": "event.dataset:azure.activitylogs and azure.activitylogs.operation_name:\"MICROSOFT.NETWORK/NETWORKWATCHERS/DELETE\" and event.outcome:(Success or success)",
|
||||
"query": "event.dataset:azure.activitylogs and azure.activitylogs.operation_name:\"MICROSOFT.NETWORK/NETWORKWATCHERS/DELETE\" and event.outcome:(Success or success)\n",
|
||||
"references": [
|
||||
"https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-monitoring-overview"
|
||||
],
|
||||
|
|
|
|||
|
|
@ -16,7 +16,7 @@
|
|||
"license": "Elastic License v2",
|
||||
"name": "AWS S3 Bucket Configuration Deletion",
|
||||
"note": "## Config\n\nThe AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.",
|
||||
"query": "event.dataset:aws.cloudtrail and event.provider:s3.amazonaws.com and event.action:(DeleteBucketPolicy or DeleteBucketReplication or DeleteBucketCors or DeleteBucketEncryption or DeleteBucketLifecycle) and event.outcome:success",
|
||||
"query": "event.dataset:aws.cloudtrail and event.provider:s3.amazonaws.com and\n event.action:(DeleteBucketPolicy or DeleteBucketReplication or DeleteBucketCors or\n DeleteBucketEncryption or DeleteBucketLifecycle)\n and event.outcome:success\n",
|
||||
"references": [
|
||||
"https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketPolicy.html",
|
||||
"https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketReplication.html",
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@
|
|||
"language": "kuery",
|
||||
"license": "Elastic License v2",
|
||||
"name": "Modification of Safari Settings via Defaults Command",
|
||||
"query": "event.category:process and event.type:start and process.name:defaults and process.args: (com.apple.Safari and write and not ( UniversalSearchEnabled or SuppressSearchSuggestions or WebKitTabToLinksPreferenceKey or ShowFullURLInSmartSearchField or com.apple.Safari.ContentPageGroupIdentifier.WebKit2TabsToLinks ) )",
|
||||
"query": "event.category:process and event.type:start and\n process.name:defaults and process.args:\n (com.apple.Safari and write and not\n (\n UniversalSearchEnabled or\n SuppressSearchSuggestions or\n WebKitTabToLinksPreferenceKey or\n ShowFullURLInSmartSearchField or\n com.apple.Safari.ContentPageGroupIdentifier.WebKit2TabsToLinks\n )\n )\n",
|
||||
"references": [
|
||||
"https://objectivebythesea.com/v2/talks/OBTS_v2_Zohar.pdf"
|
||||
],
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@
|
|||
"language": "kuery",
|
||||
"license": "Elastic License v2",
|
||||
"name": "Potential Microsoft Office Sandbox Evasion",
|
||||
"query": "event.category:file and not event.type:deletion and file.name:~$*.zip",
|
||||
"query": "event.category:file and not event.type:deletion and file.name:~$*.zip\n",
|
||||
"references": [
|
||||
"https://i.blackhat.com/USA-20/Wednesday/us-20-Wardle-Office-Drama-On-macOS.pdf",
|
||||
"https://www.mdsec.co.uk/2018/08/escaping-the-sandbox-microsoft-office-on-macos/",
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@
|
|||
"language": "kuery",
|
||||
"license": "Elastic License v2",
|
||||
"name": "High Number of Process and/or Service Terminations",
|
||||
"query": "event.category:process and event.type:start and process.name:(net.exe or sc.exe or taskkill.exe) and process.args:(stop or pause or delete or \"/PID\" or \"/IM\" or \"/T\" or \"/F\" or \"/t\" or \"/f\" or \"/im\" or \"/pid\")",
|
||||
"query": "event.category:process and event.type:start and process.name:(net.exe or sc.exe or taskkill.exe) and\n process.args:(stop or pause or delete or \"/PID\" or \"/IM\" or \"/T\" or \"/F\" or \"/t\" or \"/f\" or \"/im\" or \"/pid\")\n",
|
||||
"risk_score": 47,
|
||||
"rule_id": "035889c4-2686-4583-a7df-67f89c292f2c",
|
||||
"severity": "medium",
|
||||
|
|
|
|||
|
|
@ -0,0 +1,89 @@
|
|||
{
|
||||
"author": [
|
||||
"Elastic"
|
||||
],
|
||||
"description": "Identifies when a script interpreter or signed binary is launched via a non-standard working directory. An attacker may use this technique to evade defenses.",
|
||||
"from": "now-9m",
|
||||
"index": [
|
||||
"winlogbeat-*",
|
||||
"logs-endpoint.events.*",
|
||||
"logs-windows.*"
|
||||
],
|
||||
"language": "eql",
|
||||
"license": "Elastic License v2",
|
||||
"name": "Suspicious Execution from a Mounted Device",
|
||||
"query": "process where event.type == \"start\" and process.executable : \"C:\\\\*\" and\n (process.working_directory : \"?:\\\\\" and not process.working_directory: \"C:\\\\\") and\n process.parent.name : \"explorer.exe\" and\n process.name : (\"rundll32.exe\", \"mshta.exe\", \"powershell.exe\", \"pwsh.exe\", \"cmd.exe\", \"regsvr32.exe\",\n \"cscript.exe\", \"wscript.exe\")\n",
|
||||
"references": [
|
||||
"https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/",
|
||||
"https://www.volexity.com/blog/2021/05/27/suspected-apt29-operation-launches-election-fraud-themed-phishing-campaigns/"
|
||||
],
|
||||
"risk_score": 47,
|
||||
"rule_id": "8a1d4831-3ce6-4859-9891-28931fa6101d",
|
||||
"severity": "medium",
|
||||
"tags": [
|
||||
"Elastic",
|
||||
"Host",
|
||||
"Windows",
|
||||
"Threat Detection",
|
||||
"Defense Evasion"
|
||||
],
|
||||
"threat": [
|
||||
{
|
||||
"framework": "MITRE ATT&CK",
|
||||
"tactic": {
|
||||
"id": "TA0005",
|
||||
"name": "Defense Evasion",
|
||||
"reference": "https://attack.mitre.org/tactics/TA0005/"
|
||||
},
|
||||
"technique": [
|
||||
{
|
||||
"id": "T1218",
|
||||
"name": "Signed Binary Proxy Execution",
|
||||
"reference": "https://attack.mitre.org/techniques/T1218/",
|
||||
"subtechnique": [
|
||||
{
|
||||
"id": "T1218.011",
|
||||
"name": "Rundll32",
|
||||
"reference": "https://attack.mitre.org/techniques/T1218/011/"
|
||||
},
|
||||
{
|
||||
"id": "T1218.005",
|
||||
"name": "Mshta",
|
||||
"reference": "https://attack.mitre.org/techniques/T1218/005/"
|
||||
},
|
||||
{
|
||||
"id": "T1218.010",
|
||||
"name": "Regsvr32",
|
||||
"reference": "https://attack.mitre.org/techniques/T1218/010/"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"framework": "MITRE ATT&CK",
|
||||
"tactic": {
|
||||
"id": "TA0002",
|
||||
"name": "Execution",
|
||||
"reference": "https://attack.mitre.org/tactics/TA0002/"
|
||||
},
|
||||
"technique": [
|
||||
{
|
||||
"id": "T1059",
|
||||
"name": "Command and Scripting Interpreter",
|
||||
"reference": "https://attack.mitre.org/techniques/T1059/",
|
||||
"subtechnique": [
|
||||
{
|
||||
"id": "T1059.001",
|
||||
"name": "PowerShell",
|
||||
"reference": "https://attack.mitre.org/techniques/T1059/001/"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"timestamp_override": "event.ingested",
|
||||
"type": "eql",
|
||||
"version": 1
|
||||
}
|
||||
|
|
@ -1,8 +1,10 @@
|
|||
{
|
||||
"author": [
|
||||
"Elastic"
|
||||
"Elastic",
|
||||
"@BenB196",
|
||||
"Austin Songer"
|
||||
],
|
||||
"description": "Identifies a high number of Okta user password reset or account unlock attempts. An adversary may attempt to obtain unauthorized access to an Okta user account using these methods and attempt to blend in with normal activity in their target's environment and evade detection.",
|
||||
"description": "Identifies a high number of Okta user password reset or account unlock attempts. An adversary may attempt to obtain unauthorized access to Okta user accounts using these methods and attempt to blend in with normal activity in their target's environment and evade detection.",
|
||||
"false_positives": [
|
||||
"The number of Okta user password reset or account unlock attempts will likely vary between organizations. To fit this rule to their organization, users can duplicate this rule and edit the schedule and threshold values in the new rule."
|
||||
],
|
||||
|
|
@ -15,7 +17,7 @@
|
|||
"license": "Elastic License v2",
|
||||
"name": "High Number of Okta User Password Reset or Unlock Attempts",
|
||||
"note": "## Config\n\nThe Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.",
|
||||
"query": "event.dataset:okta.system and event.action:(system.email.account_unlock.sent_message or system.email.password_reset.sent_message or system.sms.send_account_unlock_message or system.sms.send_password_reset_message or system.voice.send_account_unlock_call or system.voice.send_password_reset_call or user.account.unlock_token)",
|
||||
"query": "event.dataset:okta.system and\n event.action:(system.email.account_unlock.sent_message or system.email.password_reset.sent_message or\n system.sms.send_account_unlock_message or system.sms.send_password_reset_message or\n system.voice.send_account_unlock_call or system.voice.send_password_reset_call or\n user.account.unlock_token)\n",
|
||||
"references": [
|
||||
"https://developer.okta.com/docs/reference/api/system-log/",
|
||||
"https://developer.okta.com/docs/reference/api/event-types/"
|
||||
|
|
@ -80,10 +82,10 @@
|
|||
],
|
||||
"threshold": {
|
||||
"field": [
|
||||
"okta.actor.id"
|
||||
"okta.actor.alternate_id"
|
||||
],
|
||||
"value": 5
|
||||
},
|
||||
"type": "threshold",
|
||||
"version": 4
|
||||
"version": 5
|
||||
}
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@
|
|||
"language": "kuery",
|
||||
"license": "Elastic License v2",
|
||||
"name": "TCC Bypass via Mounted APFS Snapshot Access",
|
||||
"query": "event.category : process and event.type : (start or process_started) and process.name : mount_apfs and process.args : (/System/Volumes/Data and noowners)",
|
||||
"query": "event.category : process and event.type : (start or process_started) and process.name : mount_apfs and\n process.args : (/System/Volumes/Data and noowners)\n",
|
||||
"references": [
|
||||
"https://theevilbit.github.io/posts/cve_2020_9771/"
|
||||
],
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@
|
|||
"language": "kuery",
|
||||
"license": "Elastic License v2",
|
||||
"name": "Attempt to Unload Elastic Endpoint Security Kernel Extension",
|
||||
"query": "event.category:process and event.type:(start or process_started) and process.name:kextunload and process.args:(\"/System/Library/Extensions/EndpointSecurity.kext\" or \"EndpointSecurity.kext\")",
|
||||
"query": "event.category:process and event.type:(start or process_started) and\n process.name:kextunload and process.args:(\"/System/Library/Extensions/EndpointSecurity.kext\" or \"EndpointSecurity.kext\")\n",
|
||||
"risk_score": 73,
|
||||
"rule_id": "70fa1af4-27fd-4f26-bd03-50b6af6b9e24",
|
||||
"severity": "high",
|
||||
|
|
|
|||
|
|
@ -0,0 +1,51 @@
|
|||
{
|
||||
"author": [
|
||||
"Elastic"
|
||||
],
|
||||
"description": "Identifies unusual instances of dllhost.exe making outbound network connections. This may indicate adversarial Command and Control activity.",
|
||||
"from": "now-9m",
|
||||
"index": [
|
||||
"winlogbeat-*",
|
||||
"logs-endpoint.events.*",
|
||||
"logs-windows.*"
|
||||
],
|
||||
"language": "eql",
|
||||
"license": "Elastic License v2",
|
||||
"name": "Unusual Network Connection via DllHost",
|
||||
"query": "sequence by host.id, process.entity_id with maxspan=1m\n [process where event.type in (\"start\", \"process_started\") and process.name : \"dllhost.exe\" and process.args_count == 1]\n [network where process.name : \"dllhost.exe\" and\n not cidrmatch(destination.ip, \"10.0.0.0/8\", \"127.0.0.0/8\", \"169.254.0.0/16\", \"172.16.0.0/12\", \"192.0.0.0/24\",\n \"192.0.0.0/29\", \"192.0.0.8/32\", \"192.0.0.9/32\", \"192.0.0.10/32\", \"192.0.0.170/32\", \"192.0.0.171/32\", \"192.0.2.0/24\",\n \"192.31.196.0/24\", \"192.52.193.0/24\", \"192.168.0.0/16\", \"192.88.99.0/24\", \"224.0.0.0/4\", \"100.64.0.0/10\",\n \"192.175.48.0/24\", \"198.18.0.0/15\", \"198.51.100.0/24\", \"203.0.113.0/24\", \"240.0.0.0/4\", \"::1\", \"FE80::/10\",\n \"FF00::/8\")]\n",
|
||||
"references": [
|
||||
"https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/",
|
||||
"https://www.volexity.com/blog/2021/05/27/suspected-apt29-operation-launches-election-fraud-themed-phishing-campaigns/",
|
||||
"https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml"
|
||||
],
|
||||
"risk_score": 47,
|
||||
"rule_id": "c7894234-7814-44c2-92a9-f7d851ea246a",
|
||||
"severity": "medium",
|
||||
"tags": [
|
||||
"Elastic",
|
||||
"Host",
|
||||
"Windows",
|
||||
"Threat Detection",
|
||||
"Defense Evasion"
|
||||
],
|
||||
"threat": [
|
||||
{
|
||||
"framework": "MITRE ATT&CK",
|
||||
"tactic": {
|
||||
"id": "TA0005",
|
||||
"name": "Defense Evasion",
|
||||
"reference": "https://attack.mitre.org/tactics/TA0005/"
|
||||
},
|
||||
"technique": [
|
||||
{
|
||||
"id": "T1218",
|
||||
"name": "Signed Binary Proxy Execution",
|
||||
"reference": "https://attack.mitre.org/techniques/T1218/"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"timestamp_override": "event.ingested",
|
||||
"type": "eql",
|
||||
"version": 1
|
||||
}
|
||||
Some files were not shown because too many files have changed in this diff Show more
Loading…
Add table
Add a link
Reference in a new issue