Skip to content

Commit 78e178e

Browse files
jpipkin1jpipkin1
committed
Add release notes
1 parent 3f60cce commit 78e178e

File tree

1 file changed

+157
-0
lines changed

1 file changed

+157
-0
lines changed

‎blog-cse/2024-10-31-content.md‎

Lines changed: 157 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,157 @@
1+
---
2+
title: October 31, 2024 - Content Release
3+
hide_table_of_contents: true
4+
keywords:
5+
- log mappers
6+
- log parsers
7+
- detection rules
8+
image: https://help.sumologic.com/img/sumo-square.png
9+
---
10+
11+
import useBaseUrl from '@docusaurus/useBaseUrl';
12+
13+
<a href="https://help.sumologic.com/release-notes-cse/rss.xml"><img src={useBaseUrl('img/release-notes/rss-orange2.png')} alt="icon" width="50"/></a>
14+
15+
This content release includes:
16+
- New Detection rules for Github Enterprise Audit.
17+
- New Detection rules for Okta identity and access management.
18+
- Updated parser and mappers for Cisco Meraki firewall, and Cisco Meraki Flows:
19+
- Updated the pattern lookup for: action, normalized action, and success.
20+
- Updated log mappers for Github Enterprise Audit:
21+
- Updated the name of the product and the internal ID that corresponds to it.
22+
- Updated parser for Github Enterprise Audit time handling.
23+
- New parsers and mappers for Apache HTTP server and Kandji EDR.
24+
- Other changes enumerated below.
25+
26+
Please be advised that rule FIRST-S00031 (First Seen IP Address Associated with User for a Successful Azure AD Sign In Event) is not performing as intended and will be decommissioned in a forthcoming release. Please use FIRST-S00047 (First Seen ASN Associated with User for a Successful Azure AD Sign In Event) which provides an accurate and less sensitive detection point.
27+
28+
## Rules
29+
30+
- [New] MATCH-S00922 AWS Bedrock Agent Created.
31+
- This rule detects when an AWS Bedrock Agent has been created in the environment.
32+
Bedrock Agents can be configured with various parameters to build AI applications.
33+
- [New] MATCH-S00924 AWS Bedrock Guardrail Deleted.
34+
- AWS Bedrock Guardrails provide users with the ability to configure options like filtering out harmful content or defining denied topics for models. Guardrails also allow the blocking of sensitive information such as PII. Ensure that this deletion was performed by an authorized user during an expected change.
35+
- [New] MATCH-S00923 AWS Bedrock Model Invocation Denied for User.
36+
- A user has attempted to invoke a model via AWS Bedrock for which access was denied due to a permission issue. This event can be a normal occurrence for a user who has not been provisioned the proper IAM resources for AWS Bedrock.
37+
- [New] MATCH-S00921 AWS Bedrock Model Invocation Logging Configuration Change Observed.
38+
- An AWS Bedrock Model invocation logging configuration change was observed. Ensure that this activity is expected and authorized.
39+
- [New] OUTLIER-S00024 AWS DynamoDB Outlier in GetItem Events from User.
40+
- An outlier in GetItem events to a DynamoDB resource within an hour time period has been detected. Ensure that the user performing these actions has business justification for modifying DynamoDB tables and instances.
41+
- [New] OUTLIER-S00025 AWS S3 Outlier in PutObject Denied Events
42+
- This rule utilizes an hourly baseline to detect an outlier in the number of denied PutObject access events to an S3 bucket. AWS Data events are necessary for this signal to function.
43+
- [New] MATCH-S00390 Attempted Credential Dump From Registry Via Reg.Exe
44+
- Monitors for use of reg.exe with parameters indicating the attempted export of hashed credentials.
45+
Audit Object Access (success and failure) must be enabled for this rule to function.
46+
- [New] MATCH-S00896 Azure Authentication Policy Change
47+
- Various authentication related policy configurations exist within Azure. These are tenant-wide policy changes that affect aspects such as enabling of number matching, changing of which authentication methods users are allowed to use, or the exclusion of certain groups from various authentication methods.
48+
- [New] MATCH-S00525 Credential Dumping Via Copy Command From Shadow Copy
49+
- This rule detects credential dumping using copy command from a shadow copy.
50+
- [New] FIRST-S00084 First Seen AWS Bedrock API Call from User
51+
- This rule looks for a first seen AWS Bedrock API call from a user since the baseline period. Ensure the user in question is authorized to utilize AWS Bedrock services.
52+
- [New] FIRST-S00062 First Seen IP Address Connecting to Active Directory Certificate Services Process
53+
- This alert looks at Windows Filtering Platform Events and flags when a first seen IP address connects to the certificate services process. This can be indictive of enumeration of certificate templates which can potentially lead to forged certificates and privilege escalation avenues.
54+
- [New] FIRST-S00086 First Seen IP Address Performing Trufflehog AWS Credential Verification
55+
- Trufflehog is a tool that can be utilized to find and verify secrets. When Trufflehog locates AWS credentials, it attempts to validate them using the GetCallerIdentity API call. This signal looks for the default Trufflehog User Agent within CloudTrail telemetry, combined with the GetCallerIdentity API call occurring from an IP address not seen since the baseline period.
56+
- [New] FIRST-S00081 First Seen Model ID in AWS Bedrock Put Entitlement by User
57+
- A first seen model id was observed in AWS Bedrock. The PutFoundationModelEntitlement API call grants permission to put entitlement to access a foundational model.
58+
- [New] FIRST-S00088 First Seen NTLM Authentication to Host (User)
59+
- A user has performed NTLM authentication to a host on the network for the first time since the baseline period has been established.
60+
- [New] FIRST-S00076 First Seen Net Command Use on Host
61+
- [New] FIRST-S00085 First Seen Role Creating AWS Bedrock Agent
62+
- An AWS Bedrock Agent has been created in the environment by a Role seen for the first time since the baseline period. If this role is not expected in the environment and was not originally assigned IAM rights to Bedrock, this activity could be indicative of privilege escalation.
63+
- [New] FIRST-S00061 First Seen USB device in use on Windows host
64+
- This signal looks for a new removable USB device name being used by a host not seen since the baseline period. This activity by itself is not necessarily malicious, but can be indicative of potential lateral movement or initial access tactics.
65+
- [New] FIRST-S00087 First Seen User Creating or Modifying EC2 Launch Template
66+
- AWS EC2 launch templates allows cloud administrators to specify instance configuration information in a templated format. Granting permissions to modify or create launch templates within EC2 in certain circumstances grants the user PassRole permissions, potentially opening privilege escalation avenues via IAM.
67+
- [New] FIRST-S00082 First Seen User Enumerating AWS Bedrock Models
68+
- A first seen user was observed enumerating AWS Bedrock models via the ListFoundationModels API call. Ensure that the user performing the enumeration is authorized to work within AWS Bedrock.
69+
- [New] FIRST-S00059 First Seen esentutl command From User
70+
- Threat actors may use the esentutl utility to create volume shadow copies and/or backups on a Windows operating system and retrieve the Active Directory database (NTDS.dit) file in order to extract credential material.
71+
- [New] FIRST-S00058 First Seen vssadmin command From User
72+
- Threat actors may use the vssadmin utility to create volume shadow copies on a Windows operating system and retrieve the Active Directory database (NTDS.dit) file in order to extract credential material.
73+
- [New] FIRST-S00060 First Seen wbadmin command From User
74+
- Threat actors may use the wbadmin utility to create volume shadow copies and/or backups on a Windows operating system and retrieve the Active Directory database (NTDS.dit) file in order to extract credential material.
75+
- [New] MATCH-S00429 LSASS Memory Dumping
76+
- Detect creation of dump files containing the memory space of lsass.exe, which contains sensitive credentials. Identifies usage of Sysinternals procdump.exe to export the memory space of lsass.exe which contains sensitive credentials.
77+
- [New] MATCH-S00161 Malicious PowerShell Get Commands
78+
- This rule detects commandlets from common PowerShell exploitation frameworks.
79+
- [New] MATCH-S00895 NinjaCopy Usage Detected
80+
- NinjaCopy is a legacy PowerShell tool that can copy files from an NTFS volume in a manner that bypasses SACL auditing as well as DACL controls such as only allowing SYSTEM to open a file.
81+
- [New] MATCH-S00906 Okta - Application Created
82+
- This rule looks for an Okta application being created. Ensure that this activity is expected and authorized. Only Okta administrators should be creating applications.
83+
- [New] MATCH-S00903 Okta - Device Added To User
84+
- An Okta device was added to a user. This activity may occur as part of normal user operations such as lost device.
85+
- [New] MATCH-S00904 Okta - Device Removed From User
86+
- An Okta device was removed from a user. It is recommended that the user performing the action be cross-referenced to a list of approved Okta administrators.
87+
- [New] CHAIN-S00020 Okta - MFA Denied Followed by Successful Logon
88+
- This signal looks for a single user explicitly denying at least two (2) multi factor authentication prompts, followed by a successful Okta login via multi factor authentication within a twenty-five (25) minute window. This logic is designed to catch successful MFA fatigue type attacks.
89+
- [New] MATCH-S00908 Okta - MFA Request Denied by User
90+
- This signal will trigger when a user denies an MFA request within the Okta authenticator application.
91+
- [New] MATCH-S00907 Okta - Policy Rule Added
92+
- An Okta policy rule has been added through the Okta admin application.
93+
- [New] MATCH-S00905 Okta - Programmatic Access to Users API Endpoint
94+
- This signal looks for programmatic (PowerShell, Golang, Python or Curl) access to the Okta “users” API endpoint. This endpoint provides functionality to perform various actions on Okta user accounts such as password resets and account unlocks.
95+
- [New] AGGREGATION-S00008 Okta - Session Anomaly (Multiple ASNs)
96+
- This rule detects when a user has utilized multiple distinct ASNs when performing authentication through Okta. This activity could potentially indicate credential theft or a general session anomaly.
97+
- [New] AGGREGATION-S00009 Okta - Session Anomaly (Multiple User Agents)
98+
- This rule detects when a user has utilized multiple distinct User Agents when performing authentication through Okta. This activity could potentially indicate credential theft or a general session anomaly.
99+
- [New] OUTLIER-S00019 Outlier in AWS Bedrock API Calls from User
100+
- An outlier in the number of API calls made to AWS Bedrock from a user within an hour time period was observed. These events may be part of normal Bedrock operations or may be indicative of enumeration/discovery attempts.
101+
- [New] OUTLIER-S00022 Outlier in AWS Bedrock Foundation Model Enumeration Calls from User
102+
- An outlier in the number of Foundation Model Enumeration API Calls from a user within an hour time period was observed. These events may be part of normal Bedrock operations or may be indicative of enumeration/discovery attempts.
103+
- [New] MATCH-S00900 Overly-Permissive Active Directory Certificate Template Loaded
104+
- This alert looks at Active Directory Certificate Services Auditing Events to look for a certificate template issued that allows domain users full control over the certificate
105+
- [New] CHAIN-S00019 Potential Active Directory Certificate Services Enrollment Agent Misconfiguration
106+
- This alert looks for two events in a particular order, the first event involves a certificate template being loaded with a certificate request agent application policy.
107+
- [New] MATCH-S00898 Potentially Misconfigured Active Directory Certificate Template Loaded
108+
- This alert looks at Active Directory Certificate Services Auditing Events to look for a certificate template issued that allows all domain users the ability to enroll the template.
109+
- [New] MATCH-S00901 Potentially Vulnerable Active Directory Certificate Services Template Loaded
110+
- This alert looks at Active Directory Certificate Services Auditing Events to look for a certificate template issued that allows the enrolee to supply a subject and allows all domain users to enroll.
111+
- [New] MATCH-S00899 Suspicious Active Directory Certificate Modification
112+
- This alert looks for an Active Directory certificate being modified with the "Any Purpose" OID.
113+
- [New] MATCH-S00902 Suspicious Active Directory Certificate Modification - Enrollment Agent
114+
- This alert looks for an Active Directory certificate being modified with an Enrollment Agent value that allows an Active Directory principal to enroll a certificate on behalf of another user.
115+
- [New] MATCH-S00917 Suspicious PowerShell Application Window Discovery COM method
116+
- This PowerShell COM method allows for discovery of running application windows, along with the process path and window location coordinates.
117+
- [New] MATCH-S00920 Suspicious PowerShell Window Discovery Cmdlet execution
118+
- Detects the use of PowerShell for Applicaiton Window Discovery to identify open application windows to gather information on running programs, collect potential data, and discover security tooling.
119+
- [New] MATCH-S00918 Suspicious cat of PAM common-password policy
120+
- The Pluggable Authentication Module (PAM) in Linux allows system administrators to choose how applications authenticate users.
121+
- [New] MATCH-S00925 Trufflehog AWS Credential Verification Detected
122+
- Trufflehog is a tool that can be utilized to find and verify secrets. When Trufflehog locates AWS credentials, it attempts to validate them using the GetCallerIdentity API call.
123+
- [New] MATCH-S00583 WCE wceaux.dll Access
124+
- Obvserves for access of wceaux.dll, which may be indicative of credential access.
125+
- [New] MATCH-S00159 Windows - Permissions Group Discovery
126+
- Microsoft’s Net.exe can be used for multiple Discovery tactics, including Password Policy, Permissions, Account and Domain Trust Discovery. This detection identifies the use net.exe related commands on a system related to these discovery tactics.
127+
- [New] THRESHOLD-S00067 ZeroLogon Privilege Escalation Behavior
128+
- An attack against CVE-2020-1472 may create thousands of NetrServerReqChallenge and NetrServerAuthenticate3 requests in a short amount of time.
129+
- [New] MATCH-S00919 chage command use on host
130+
- The chage command on Linux allows for the changing of user password expiry information. The chage command is restricted to the root user; however, non-root/unprivileged users may use the -l flag to determine when the user’s password or account is due to expire.
131+
132+
133+
## Log Mappers
134+
- [New] Apache HTTP Server - Access log
135+
- [New] Kandji EDR - catch all
136+
- [Updated] Cisco Meraki Firewall - Custom Parser
137+
- [Updated] Cisco Meraki Flows - Custom Parser
138+
- [Updated] GitHub Enterprise Audit - Access Events
139+
- [Updated] GitHub Enterprise Audit - Authentication Events
140+
- [Updated] GitHub Enterprise Audit - Create Events
141+
- [Updated] GitHub Enterprise Audit - Modify Events
142+
- [Updated] GitHub Enterprise Audit - Remove Events
143+
- [Updated] GitHub Enterprise Audit - Restore Events
144+
- [Updated] GitHub Enterprise Audit - Transfer Events
145+
- [Updated] GitHub Enterprise Audit Catch All
146+
147+
## Parsers
148+
- [New] /Parsers/System/Apache/Apache HTTP Server
149+
- [New] /Parsers/System/Kandji/Kandji EDR
150+
- [Updated] /Parsers/System/Cisco/Cisco Meraki
151+
- Corrected parser to address incorrect mapping leading to alert errors.
152+
- [Updated] /Parsers/System/Github/GitHub Enterprise Audit
153+
- Parser modification to the MAPPER:product from Github Enterpries to Github Enterprise Audit
154+
- [Updated] /Parsers/System/Kemp/Kemp LoadMaster Syslog
155+
- Corrected parser transform for the log-entry format of the Process_Syslog_Header
156+
- [Updated] /Parsers/System/Netskope/Netskope Security Cloud JSON
157+
- Corrected the JSON parser for MAPPER:event_id to facilitiate proper mapping processing

0 commit comments

Comments
 (0)