Skip to content

Commit 2858877

Browse files
EBWi11EBWi11
committed
feat(ruleset): add sysmon security pack and simplify built-in docs
Add production-ready Sysmon baseline/intrusion/exclude rulesets focused on high-confidence, low-noise intrusion detection, and update README built-in ruleset paths and summaries to match folder-based organization. Made-with: Cursor
1 parent c21a9ae commit 2858877

File tree

4 files changed

+571
-46
lines changed

4 files changed

+571
-46
lines changed

‎README.md‎

Lines changed: 20 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -128,57 +128,16 @@ AgentSmith-HUB ships with production-ready detection rulesets that you can deplo
128128

129129
### Kubernetes Audit Log Security
130130

131-
Two rulesets covering **25 detection rules** for Kubernetes audit logs, designed with multi-condition correlation and system-controller exclusion to minimize false positives.
132-
133-
<details>
134-
<summary><b>k8s_audit_baseline</b> — Workload & RBAC Security Baseline (11 rules)</summary>
135-
136-
Detects Kubernetes configurations that violate security best practices at the point of creation or modification.
137-
138-
| Rule | Detection | Severity | MITRE ATT&CK |
139-
|------|-----------|----------|---------------|
140-
| B001–B003 | **Privileged containers** — Pod, Deployment, DaemonSet with `privileged: true` | HIGH | T1611 Privilege Escalation |
141-
| B004–B005 | **Host namespace sharing** — `hostNetwork` / `hostPID` / `hostIPC` breaks container isolation | HIGH | T1611 Privilege Escalation |
142-
| B006, B011 | **Container runtime socket mount** — `docker.sock` / `containerd.sock` enables container escape | HIGH | T1611 Privilege Escalation |
143-
| B007 | **Sensitive hostPath mount** — mounting `/`, `/etc`, `/proc`, `/sys`, `/root` | HIGH | T1611 Privilege Escalation |
144-
| B008 | **CAP_SYS_ADMIN capability** — near-equivalent to full privileged mode | HIGH | T1611 Privilege Escalation |
145-
| B009 | **Wildcard ClusterRole** — `resources: ["*"]` or `verbs: ["*"]` grants unrestricted access | HIGH | T1098.001 Persistence |
146-
| B010 | **cluster-admin binding** — any subject bound to cluster-admin = full cluster compromise | HIGH | T1098.001 Persistence |
147-
148-
</details>
149-
150-
<details>
151-
<summary><b>k8s_audit_intrusion</b> — Active Intrusion Detection (14 rules)</summary>
152-
153-
Detects highly suspicious operations that indicate active intrusion, lateral movement, or post-exploitation activity.
154-
155-
| Rule | Detection | Severity | MITRE ATT&CK |
156-
|------|-----------|----------|---------------|
157-
| I001 | **Exec into kube-system pod** — non-system user shell access to critical pods | HIGH | T1609 Execution |
158-
| I002 | **Cluster-wide secrets enumeration** — listing secrets across all namespaces | HIGH | T1552.007 Credential Access |
159-
| I003 | **Anonymous RBAC binding** — granting roles to `system:anonymous` | HIGH | T1098 Persistence |
160-
| I004 | **Admission webhook tampering** — mutating webhook can intercept all resource creation | HIGH | T1546 Persistence |
161-
| I005 | **External workload in kube-system** — non-system user deploying to kube-system | HIGH | T1610 Persistence |
162-
| I006 | **Validating webhook deletion** — disabling OPA/Gatekeeper/Kyverno policy enforcement | HIGH | T1562.001 Defense Evasion |
163-
| I007 | **Node proxy access** — direct kubelet API access bypassing RBAC | HIGH | T1599 Lateral Movement |
164-
| I008 | **User impersonation** — assuming another identity via impersonation headers | HIGH | T1134.001 Privilege Escalation |
165-
| I009 | **kube-system secret/configmap deletion** — disrupting cluster operations | MEDIUM | T1485 Impact |
166-
| I010 | **Excessive secret access** — 20+ distinct secrets read in 5 min *(threshold)* | MEDIUM | T1552.007 Credential Access |
167-
| I011 | **Exec shell spray** — exec into 10+ different pods in 3 min *(threshold)* | HIGH | T1609 Lateral Movement |
168-
| I012 | **Privileged SA token theft** — creating tokens for kube-system service accounts | HIGH | T1528 Credential Access |
169-
| I013 | **CronJob with reverse shell** — bash reverse shells, nc, base64 obfuscation, attack tools | HIGH | T1053.007 Execution |
170-
| I014 | **Attack tool / crypto-miner images** — kali, metasploit, xmrig, cobaltstrike, etc. | HIGH | T1610 Execution |
171-
172-
</details>
173-
174-
> **Quick start:** Import the built-in rulesets from `config/ruleset/` (`k8s_audit_baseline.xml` and `k8s_audit_intrusion.xml`), connect your K8s audit log source, and you have production-grade Kubernetes threat detection running in minutes — no tuning needed.
131+
Two Kubernetes audit rulesets are provided for baseline hardening and active intrusion detection.
132+
133+
> **Quick start:** Import the built-in rulesets from `config/ruleset/k8s_security/` (`k8s_audit_baseline.xml` and `k8s_audit_intrusion.xml`), connect your K8s audit log source, and you have production-grade Kubernetes threat detection running in minutes — no tuning needed.
175134

176135
### Built-in K8s Ruleset Files
177136

178137
AgentSmith-HUB includes Kubernetes security rulesets out of the box. You can use them directly without writing custom XML first:
179138

180-
- `config/ruleset/k8s_audit_baseline.xml`
181-
- `config/ruleset/k8s_audit_intrusion.xml`
139+
- `config/ruleset/k8s_security/k8s_audit_baseline.xml`
140+
- `config/ruleset/k8s_security/k8s_audit_intrusion.xml`
182141

183142
Recommended onboarding flow:
184143

@@ -187,6 +146,21 @@ Recommended onboarding flow:
187146
3. Verify detections in test mode with real sample events.
188147
4. Tune thresholds (if needed) for your cluster's normal behavior.
189148

149+
### Sysmon Endpoint Security (Windows)
150+
151+
Two Sysmon rulesets are provided for medium/high-confidence endpoint detection use cases:
152+
153+
- `config/ruleset/sysmon_security/sysmon_baseline.xml`
154+
- `config/ruleset/sysmon_security/sysmon_intrusion.xml`
155+
- `config/ruleset/sysmon_security/sysmon_exclude.xml` (strict allowlist template)
156+
157+
Recommended onboarding flow for Sysmon:
158+
159+
1. Ensure your input normalizes core Sysmon fields used by rulesets.
160+
2. Import `sysmon_baseline.xml` first and validate behavior in test mode.
161+
3. Import `sysmon_intrusion.xml` and tune based on your endpoint baseline.
162+
4. Add environment-specific allowlists with a separate EXCLUDE ruleset if needed.
163+
190164
More built-in rulesets for additional data sources are on the roadmap. Contributions are welcome!
191165

192166
## Features at a Glance

‎config/ruleset/sysmon_security/sysmon_baseline.xml‎

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
<!-- ============================================================================
2+
Sysmon — Baseline Security Policy (Low-Noise Medium/High Severity)
3+
============================================================================
4+
Type: DETECTION
5+
Purpose: Detect high-confidence endpoint behaviors from Windows Sysmon logs
6+
with strict signal controls to keep false positives low.
7+
Scope: Windows Sysmon events (primarily Event ID 1/10/11/13/22)
8+
Notes:
9+
- Focused on medium/high severity only.
10+
- Most rules require multiple conditions (behavior + context).
11+
- Rule IDs are stable for triage workflow and suppression management.
12+
============================================================================ -->
13+
14+
<root type="DETECTION" name="sysmon_baseline" author="AgentSmith">
15+
16+
<!-- ================================================================
17+
S-B001 — Suspicious Encoded PowerShell
18+
Severity: HIGH
19+
================================================================ -->
20+
<rule id="S-B001" name="Suspicious encoded PowerShell execution">
21+
<check type="EQU" field="event.code">1</check>
22+
<check type="INCL" field="process.executable">powershell</check>
23+
<checklist condition="enc and hidden and bypass">
24+
<check id="enc" type="REGEX" field="process.command_line">(?i)(-enc|-encodedcommand)\s+[A-Za-z0-9+/=]{20,}</check>
25+
<check id="hidden" type="REGEX" field="process.command_line">(?i)(-w|/w|--windowstyle)\s*hidden</check>
26+
<check id="bypass" type="REGEX" field="process.command_line">(?i)(-ep|--executionpolicy)\s*bypass</check>
27+
</checklist>
28+
<append field="alert_id">S-B001</append>
29+
<append field="severity">high</append>
30+
<append field="category">baseline</append>
31+
<append field="description">Encoded PowerShell with hidden window and policy bypass</append>
32+
<append field="mitre_tactic">Execution</append>
33+
<append field="mitre_technique_id">T1059.001</append>
34+
</rule>
35+
36+
<!-- ================================================================
37+
S-B002 — Office/Browser spawning script engines
38+
Severity: HIGH
39+
================================================================ -->
40+
<rule id="S-B002" name="Office or browser spawned script engine">
41+
<check type="EQU" field="event.code">1</check>
42+
<check type="REGEX" field="process.parent.executable">(?i)(winword|excel|powerpnt|outlook|chrome|msedge|firefox)\.exe$</check>
43+
<check type="REGEX" field="process.executable">(?i)(powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32)\.exe$</check>
44+
<append field="alert_id">S-B002</append>
45+
<append field="severity">high</append>
46+
<append field="category">baseline</append>
47+
<append field="description">User-facing app spawned a high-risk script/LOLBin child process</append>
48+
<append field="mitre_tactic">Execution</append>
49+
<append field="mitre_technique_id">T1204</append>
50+
</rule>
51+
52+
<!-- ================================================================
53+
S-B003 — Run/RunOnce persistence write
54+
Severity: HIGH
55+
================================================================ -->
56+
<rule id="S-B003" name="Run key persistence created or modified">
57+
<check type="EQU" field="event.code">13</check>
58+
<check type="REGEX" field="registry.path">(?i)\\(CurrentVersion\\Run|CurrentVersion\\RunOnce)(\\|$)</check>
59+
<check type="REGEX" field="process.executable">(?i)(powershell|cmd|wscript|cscript|mshta|rundll32|regsvr32)\.exe$</check>
60+
<append field="alert_id">S-B003</append>
61+
<append field="severity">high</append>
62+
<append field="category">baseline</append>
63+
<append field="description">High-risk process modified Run/RunOnce persistence key</append>
64+
<append field="mitre_tactic">Persistence</append>
65+
<append field="mitre_technique_id">T1547.001</append>
66+
</rule>
67+
68+
<!-- ================================================================
69+
S-B004 — Suspicious startup-folder artifact
70+
Severity: MEDIUM
71+
================================================================ -->
72+
<rule id="S-B004" name="Script or executable dropped to startup folder">
73+
<check type="EQU" field="event.code">11</check>
74+
<check type="REGEX" field="file.path">(?i)\\(ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup|Users\\[^\\]+\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup)\\</check>
75+
<check type="REGEX" field="file.path">(?i)\.(ps1|vbs|js|hta|cmd|bat|exe|dll)$</check>
76+
<append field="alert_id">S-B004</append>
77+
<append field="severity">medium</append>
78+
<append field="category">baseline</append>
79+
<append field="description">Potential startup persistence payload dropped to Startup folder</append>
80+
<append field="mitre_tactic">Persistence</append>
81+
<append field="mitre_technique_id">T1547.001</append>
82+
</rule>
83+
84+
<!-- ================================================================
85+
S-B005 — Remote-script style LOLBin command
86+
Severity: HIGH
87+
================================================================ -->
88+
<rule id="S-B005" name="LOLBin with remote script or URL pattern">
89+
<check type="EQU" field="event.code">1</check>
90+
<check type="REGEX" field="process.executable">(?i)(mshta|regsvr32|rundll32)\.exe$</check>
91+
<check type="REGEX" field="process.command_line">(?i)(https?://|scrobj\.dll|javascript:|vbscript:)</check>
92+
<append field="alert_id">S-B005</append>
93+
<append field="severity">high</append>
94+
<append field="category">baseline</append>
95+
<append field="description">LOLBin commandline indicates remote script execution pattern</append>
96+
<append field="mitre_tactic">Defense Evasion</append>
97+
<append field="mitre_technique_id">T1218</append>
98+
</rule>
99+
100+
<!-- ================================================================
101+
S-B006 — Unusual scheduler abuse chain
102+
Severity: MEDIUM
103+
================================================================ -->
104+
<rule id="S-B006" name="Suspicious schtasks command writing script payload">
105+
<check type="EQU" field="event.code">1</check>
106+
<check type="INCL" field="process.executable">schtasks.exe</check>
107+
<checklist condition="create and payload">
108+
<check id="create" type="REGEX" field="process.command_line">(?i)\s/create(\s|$)</check>
109+
<check id="payload" type="REGEX" field="process.command_line">(?i)(powershell|wscript|cscript|mshta|rundll32|regsvr32|cmd\.exe\s+/c)</check>
110+
</checklist>
111+
<append field="alert_id">S-B006</append>
112+
<append field="severity">medium</append>
113+
<append field="category">baseline</append>
114+
<append field="description">Scheduled task created with script/LOLBin execution payload</append>
115+
<append field="mitre_tactic">Persistence</append>
116+
<append field="mitre_technique_id">T1053.005</append>
117+
</rule>
118+
119+
</root>

‎config/ruleset/sysmon_security/sysmon_exclude.xml‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
<!-- ============================================================================
2+
Sysmon — Exclude Template (High-Precision Allowlist)
3+
============================================================================
4+
Type: EXCLUDE
5+
Purpose: Provide a safe allowlist template for known benign behaviors.
6+
This file is intentionally strict and uses placeholder values.
7+
By default, rules do NOT match until placeholders are replaced.
8+
Scope: Windows Sysmon events (1/10)
9+
10+
How to use:
11+
1) Copy this file and keep it environment-specific.
12+
2) Replace placeholder values with exact host/user/path combinations.
13+
3) Never use broad wildcards for critical behaviors (especially LSASS).
14+
4) Validate with test data before enabling in production.
15+
============================================================================ -->
16+
17+
<root type="EXCLUDE" name="sysmon_exclude" author="AgentSmith">
18+
19+
<!-- ================================================================
20+
X001 — Allow approved LSASS dump troubleshooting via procdump
21+
Targeted to suppress S-I006 only for explicitly approved runbooks.
22+
IMPORTANT:
23+
- Keep host and user exact.
24+
- Keep process path exact.
25+
- Keep commandline marker exact.
26+
================================================================ -->
27+
<rule id="X001" name="Approved procdump LSASS troubleshooting">
28+
<check type="EQU" field="event.code">1</check>
29+
<check type="EQU" field="host.name">__REPLACE_WITH_APPROVED_HOST__</check>
30+
<check type="EQU" field="user.name">__REPLACE_WITH_APPROVED_USER__</check>
31+
<check type="EQU" field="process.executable">__REPLACE_WITH_APPROVED_PROCDUMP_PATH__</check>
32+
<check type="INCL" field="process.command_line">__REPLACE_WITH_APPROVED_RUNBOOK_MARKER__</check>
33+
</rule>
34+
35+
<!-- ================================================================
36+
X002 — Allow approved comsvcs minidump workflow
37+
Targeted to suppress S-I004 only when fully approved and documented.
38+
IMPORTANT:
39+
- Must include exact host + user + commandline marker.
40+
- Do not allow this globally.
41+
================================================================ -->
42+
<rule id="X002" name="Approved rundll32 comsvcs minidump workflow">
43+
<check type="EQU" field="event.code">1</check>
44+
<check type="EQU" field="host.name">__REPLACE_WITH_APPROVED_HOST__</check>
45+
<check type="EQU" field="user.name">__REPLACE_WITH_APPROVED_USER__</check>
46+
<check type="EQU" field="process.executable">C:\Windows\System32\rundll32.exe</check>
47+
<checklist condition="comsvcs and marker">
48+
<check id="comsvcs" type="INCL" field="process.command_line">comsvcs.dll</check>
49+
<check id="marker" type="INCL" field="process.command_line">__REPLACE_WITH_APPROVED_RUNBOOK_MARKER__</check>
50+
</checklist>
51+
</rule>
52+
53+
</root>

0 commit comments

Comments
 (0)