Detection Syntax Error for Detection "Privileged User Has Been Created"

[craigsmooth]

Version

2.4.70

Installation Method

Security Onion ISO image

Description

installation

Installation Type

Distributed

Location

airgap

Hardware Specs

Exceeds minimum requirements

CPU

16

RAM

128 GB

Storage for /

5 TB

Storage for /nsm

10 TB

Network Traffic Collection

tap

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

I'm hoping someone can help me. I'm trying to do some testing with the new .70 release and one of the canned sigma rules "Privileged User Has Been Created". I am unable to use Elastic Agent at this time so I am just ingesting via syslog. I see the syslog message come through that I think should trigger the alert:

{
  "_index": ".ds-logs-syslog-so-2024.06.12-000001",
  "_id": "_HboDZABSh8C4kiV9oaq",
  "_version": 1,
  "_score": 0,
  "_source": {
    "metadata": {
      "pipeline": "syslog",
      "input": {
        "beats": {
          "host": {
            "ip": "172.30.1.103"
          }
        }
      },
      "raw_index": "logs-syslog-so",
      "stream_id": "udp-udp.generic-eb158f30-8fee-4b81-9f82-80e657069e9a",
      "beat": "filebeat",
      "truncated": false,
      "type": "_doc",
      "version": "8.10.4",
      "input_id": "udp-udp-eb158f30-8fee-4b81-9f82-80e657069e9a"
    },
    "log": {
      "source": {
        "address": "172.30.1.5:48864"
      }
    },
    "real_message": "new user: name=badguy, UID=1001, GID=0, home=/home/badguy, shell=/bin/bash, from=/dev/pts/1",
    "elastic_agent": {
      "id": "273e2ce3-ca2c-4076-b49a-24a24be4d089",
      "version": "8.10.4",
      "snapshot": false
    },
    "syslog": {
      "severity": 6,
      "priority": 86,
      "facility": 10,
      "severity_label": "INFO",
      "timestamp": "Jun 12 14:24:46 sysloghost",
      "facility_label": "AUTHPRIV"
    },
    "source": {
      "application": "useradd"
    },
    "message": "<86>Jun 12 14:24:46 sysloghost useradd[2436]: new user: name=badguy, UID=1001, GID=0, home=/home/badguy, shell=/bin/bash, from=/dev/pts/1",
    "tags": [
      "syslog",
      "elastic-agent",
      "input-so2mgr",
      "beats_input_codec_plain_applied",
      "syslog"
    ],
    "ingest": {
      "timestamp": "2024-06-12T19:24:46.628Z"
    },
    "input": {
      "type": "udp"
    },
    "@timestamp": "2024-06-12T19:24:46.628Z",
    "ecs": {
      "version": "8.0.0"
    },
    "data_stream": {
      "namespace": "so",
      "type": "logs",
      "dataset": "syslog"
    },
    "@version": "1",
    "host": {
      "hostname": "so2fwd",
      "os": {
        "kernel": "5.15.0-204.147.6.3.el9uek.x86_64",
        "name": "Oracle Linux Server",
        "family": "redhat",
        "type": "linux",
        "version": "9.3",
        "platform": "ol"
      },
      "containerized": false,
      "ip": [
        "172.30.1.103",
        "172.17.1.1",
        "172.17.0.1"
      ],
      "name": "so2fwd",
      "id": "88c09428a1a54bcc8966c685b0a2319e",
      "mac": [
        "00-0C-29-D1-32-23",
        "00-0C-29-D1-32-2D",
        "02-42-64-15-EA-E2",
        "02-42-AC-32-5D-3B",
        "66-EB-35-41-F5-FE",
        "6E-63-F4-FC-58-B8",
        "8E-40-71-49-1B-49",
        "BE-89-93-94-11-D8",
        "D6-1C-3D-43-90-62",
        "EA-6C-33-09-61-C8"
      ],
      "architecture": "x86_64"
    },
    "event": {
      "module": "syslog",
      "dataset": "syslog.syslog"
    }
  },
  "fields": {
    "elastic_agent.version": [
      "8.10.4"
    ],
    "host.name.keyword": [
      "so2fwd"
    ],
    "syslog.priority.keyword": [
      "86"
    ],
    "event.dataset.keyword": [
      "syslog.syslog"
    ],
    "host.hostname": [
      "so2fwd"
    ],
    "host.mac": [
      "00-0C-29-D1-32-23",
      "00-0C-29-D1-32-2D",
      "02-42-64-15-EA-E2",
      "02-42-AC-32-5D-3B",
      "66-EB-35-41-F5-FE",
      "6E-63-F4-FC-58-B8",
      "8E-40-71-49-1B-49",
      "BE-89-93-94-11-D8",
      "D6-1C-3D-43-90-62",
      "EA-6C-33-09-61-C8"
    ],
    "ecs.version.keyword": [
      "8.0.0"
    ],
    "host.os.version": [
      "9.3"
    ],
    "metadata.stream_id": [
      "udp-udp.generic-eb158f30-8fee-4b81-9f82-80e657069e9a"
    ],
    "syslog.timestamp": [
      "Jun 12 14:24:46 sysloghost"
    ],
    "host.os.name": [
      "Oracle Linux Server"
    ],
    "host.name": [
      "so2fwd"
    ],
    "metadata.raw_index": [
      "logs-syslog-so"
    ],
    "host.os.type": [
      "linux"
    ],
    "metadata.input.beats.host.ip": [
      "172.30.1.103"
    ],
    "metadata.input.beats.host.ip.keyword": [
      "172.30.1.103"
    ],
    "input.type": [
      "udp"
    ],
    "metadata.input_id": [
      "udp-udp-eb158f30-8fee-4b81-9f82-80e657069e9a"
    ],
    "data_stream.type": [
      "logs"
    ],
    "tags": [
      "syslog",
      "elastic-agent",
      "input-so2mgr",
      "beats_input_codec_plain_applied",
      "syslog"
    ],
    "host.architecture": [
      "x86_64"
    ],
    "ecs.version": [
      "8.0.0"
    ],
    "host.containerized": [
      false
    ],
    "log.source.address": [
      "172.30.1.5:48864"
    ],
    "message.keyword": [
      "<86>Jun 12 14:24:46 sysloghost useradd[2436]: new user: name=badguy, UID=1001, GID=0, home=/home/badguy, shell=/bin/bash, from=/dev/pts/1"
    ],
    "event.module.keyword": [
      "syslog"
    ],
    "host.hostname.keyword": [
      "so2fwd"
    ],
    "host.os.family": [
      "redhat"
    ],
    "tags.keyword": [
      "syslog",
      "elastic-agent",
      "input-so2mgr",
      "beats_input_codec_plain_applied",
      "syslog"
    ],
    "syslog.facility": [
      10
    ],
    "host.ip": [
      "172.30.1.103",
      "172.17.1.1",
      "172.17.0.1"
    ],
    "event.module": [
      "syslog"
    ],
    "host.os.kernel": [
      "5.15.0-204.147.6.3.el9uek.x86_64"
    ],
    "@version": [
      "1"
    ],
    "elastic_agent.snapshot": [
      false
    ],
    "host.id": [
      "88c09428a1a54bcc8966c685b0a2319e"
    ],
    "metadata.type": [
      "_doc"
    ],
    "host.mac.keyword": [
      "00-0C-29-D1-32-23",
      "00-0C-29-D1-32-2D",
      "02-42-64-15-EA-E2",
      "02-42-AC-32-5D-3B",
      "66-EB-35-41-F5-FE",
      "6E-63-F4-FC-58-B8",
      "8E-40-71-49-1B-49",
      "BE-89-93-94-11-D8",
      "D6-1C-3D-43-90-62",
      "EA-6C-33-09-61-C8"
    ],
    "metadata.beat": [
      "filebeat"
    ],
    "elastic_agent.id": [
      "273e2ce3-ca2c-4076-b49a-24a24be4d089"
    ],
    "real_message": [
      "new user: name=badguy, UID=1001, GID=0, home=/home/badguy, shell=/bin/bash, from=/dev/pts/1"
    ],
    "syslog.severity": [
      6
    ],
    "data_stream.namespace": [
      "so"
    ],
    "metadata.pipeline": [
      "syslog"
    ],
    "syslog.priority": [
      86
    ],
    "metadata.version": [
      "8.10.4"
    ],
    "source.application": [
      "useradd"
    ],
    "metadata.truncated": [
      false
    ],
    "message": [
      "<86>Jun 12 14:24:46 sysloghost useradd[2436]: new user: name=badguy, UID=1001, GID=0, home=/home/badguy, shell=/bin/bash, from=/dev/pts/1"
    ],
    "@timestamp": [
      "2024-06-12T19:24:46.628Z"
    ],
    "syslog.severity_label": [
      "INFO"
    ],
    "host.os.platform": [
      "ol"
    ],
    "syslog.facility.keyword": [
      "10"
    ],
    "data_stream.dataset": [
      "syslog"
    ],
    "syslog.facility_label": [
      "AUTHPRIV"
    ],
    "event.dataset": [
      "syslog.syslog"
    ],
    "ingest.timestamp": [
      "2024-06-12T19:24:46.628Z"
    ]
  }
}

The rule is enabled and when I do a convert, I get the following query:

GET /.ds-logs-*/_eql/search
{
	"query": """
	any where ""new user"" and (""GID=0"" or ""UID=0"" or ""GID=10"" or ""GID=27"")
	"""
}

Which results in the following error:

{
  "error": {
    "root_cause": [
      {
        "type": "parsing_exception",
        "reason": "line 2:14: mismatched input 'new' expecting {<EOF>, 'and', 'in', 'in~', 'like', 'like~', 'not', 'or', 'regex', 'regex~', ':', '+', '-', '*', '/', '%', '|'}"
      }
    ],
    "type": "parsing_exception",
    "reason": "line 2:14: mismatched input 'new' expecting {<EOF>, 'and', 'in', 'in~', 'like', 'like~', 'not', 'or', 'regex', 'regex~', ':', '+', '-', '*', '/', '%', '|'}",
    "caused_by": {
      "type": "input_mismatch_exception",
      "reason": null
    }
  },
  "status": 400
}

Can someone tell me where I might be going wrong here? I am just using one of the builtin rules. Nothing super fancy. Not sure why I would be getting a syntax error on the query also. Any guidance would be greatly appreciated. Thank you.

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.