Merge branch 'main' into new-rule-docker-exec-host-ref-via-priv-container

Author: Aegrah

rules/cross-platform/multiple_alerts_elastic_defend_netsecurity_by_host.toml

@@ -2,7 +2,7 @@
 creation_date = "2025/11/18"
 integration = ["endpoint", "panw", "fortinet_fortigate", "suricata"]
 maturity = "production"
-updated_date = "2025/11/18"
+updated_date = "2025/11/28"
 
 [rule]
 author = ["Elastic"]
@@ -65,6 +65,9 @@ FROM logs-* metadata _id
         Esql.destination_ip_values = VALUES(destination.ip)
         by Esql.source_ip
 | where Esql.event_module_distinct_count >= 2
+| eval concat_module_values = MV_CONCAT(Esql.event_module_values, ",")
+// Make sure an endpoint alert is present along one of the network ones
+| where concat_module_values like "*endpoint*"
 | keep Esql.alerts_count, Esql.source_ip, Esql.destination_ip_values, Esql.host_id_values, Esql.user_name_values, Esql.event_module_values, Esql.message_values, Esql.process_executable_values
 '''
 note = """## Triage and analysis

rules/cross-platform/persistence_web_server_potential_command_injection.toml

@@ -1,8 +1,8 @@
 [metadata]
 creation_date = "2025/11/19"
-integration = ["nginx", "apache", "apache_tomcat", "iis", "network_traffic"]
+integration = ["nginx", "apache", "apache_tomcat", "iis"]
 maturity = "production"
-updated_date = "2025/11/24"
+updated_date = "2025/12/01"
 
 [rule]
 author = ["Elastic"]
@@ -54,14 +54,12 @@ rule_id = "f3ac6734-7e52-4a0d-90b7-6847bf4308f2"
 severity = "low"
 tags = [
     "Domain: Web",
-    "Domain: Network",
     "Use Case: Threat Detection",
     "Tactic: Reconnaissance",
     "Tactic: Persistence",
     "Tactic: Execution",
     "Tactic: Credential Access",
     "Tactic: Command and Control",
-    "Data Source: Network Packet Capture",
     "Data Source: Nginx",
     "Data Source: Apache",
     "Data Source: Apache Tomcat",
@@ -71,26 +69,24 @@ tags = [
 timestamp_override = "event.ingested"
 type = "esql"
 query = '''
-from logs-network_traffic.http-*, logs-network_traffic.tls-*, logs-nginx.access-*, logs-apache.access-*, logs-apache_tomcat.access-*, logs-iis.access-*
+from logs-nginx.access-*, logs-apache.access-*, logs-apache_tomcat.access-*, logs-iis.access-*
 | where
-    (url.original is not null or url.full is not null) and
     // Limit to 200 response code to reduce noise
     http.response.status_code == 200
 
-| eval Esql.url_lower  = case(url.original is not null, url.original, url.full)
-| eval Esql.url_lower = to_lower(Esql.url_lower)
-
-| eval Esql.contains_interpreter = case(Esql.url_lower like "*python* -c*" or Esql.url_lower like "*perl* -e*" or Esql.url_lower like "*ruby* -e*" or Esql.url_lower like "*ruby* -rsocket*" or Esql.url_lower like "*lua* -e*" or Esql.url_lower like "*php* -r*" or Esql.url_lower like "*node* -e*", 1, 0)
-| eval Esql.contains_shell = case(Esql.url_lower like "*/bin/bash*" or Esql.url_lower like "*bash*-c*" or Esql.url_lower like "*/bin/sh*" or Esql.url_lower rlike "*sh.{1,2}-c*", 1, 0)
-| eval Esql.contains_nc = case(Esql.url_lower like "*netcat*" or Esql.url_lower like "*ncat*" or Esql.url_lower rlike """.*nc.{1,2}[0-9]{1,3}(\.[0-9]{1,3}){3}.{1,2}[0-9]{1,5}.*""" or Esql.url_lower like "*nc.openbsd*" or Esql.url_lower like "*nc.traditional*" or Esql.url_lower like "*socat*", 1, 0)
-| eval Esql.contains_devtcp = case(Esql.url_lower like "*/dev/tcp/*" or Esql.url_lower like "*/dev/udp/*", 1, 0)
-| eval Esql.contains_helpers = case((Esql.url_lower like "*/bin/*" or Esql.url_lower like "*/usr/bin/*") and (Esql.url_lower like "*mkfifo*" or Esql.url_lower like "*nohup*" or Esql.url_lower like "*setsid*" or Esql.url_lower like "*busybox*"), 1, 0)
-| eval Esql.contains_sus_cli = case(Esql.url_lower like "*import*pty*spawn*" or Esql.url_lower like "*import*subprocess*call*" or Esql.url_lower like "*tcpsocket.new*" or Esql.url_lower like "*tcpsocket.open*" or Esql.url_lower like "*io.popen*" or Esql.url_lower like "*os.execute*" or Esql.url_lower like "*fsockopen*", 1, 0)
-| eval Esql.contains_privileges = case(Esql.url_lower like "*chmod*+x", 1, 0)
-| eval Esql.contains_downloader = case(Esql.url_lower like "*curl *" or Esql.url_lower like "*wget *" , 1, 0)
-| eval Esql.contains_file_read_keywords = case(Esql.url_lower like "*/etc/shadow*" or Esql.url_lower like "*/etc/passwd*" or Esql.url_lower like "*/root/.ssh/*" or Esql.url_lower like "*/home/*/.ssh/*" or Esql.url_lower like "*~/.ssh/*" or Esql.url_lower like "*/proc/self/environ*", 1, 0)
-| eval Esql.contains_base64_cmd = case(Esql.url_lower like "*base64*-d*" or Esql.url_lower like "*echo*|*base64*", 1, 0)
-| eval Esql.contains_suspicious_path = case(Esql.url_lower like "*/tmp/*" or Esql.url_lower like "*/var/tmp/*" or Esql.url_lower like "*/dev/shm/*" or Esql.url_lower like "*/root/*" or Esql.url_lower like "*/home/*/*" or Esql.url_lower like "*/var/www/*" or Esql.url_lower like "*/etc/cron.*/*", 1, 0)
+| eval Esql.url_original_to_lower = to_lower(url.original)
+
+| eval Esql.contains_interpreter = case(Esql.url_original_to_lower like "*python* -c*" or Esql.url_original_to_lower like "*perl* -e*" or Esql.url_original_to_lower like "*ruby* -e*" or Esql.url_original_to_lower like "*ruby* -rsocket*" or Esql.url_original_to_lower like "*lua* -e*" or Esql.url_original_to_lower like "*php* -r*" or Esql.url_original_to_lower like "*node* -e*", 1, 0)
+| eval Esql.contains_shell = case(Esql.url_original_to_lower like "*/bin/bash*" or Esql.url_original_to_lower like "*bash*-c*" or Esql.url_original_to_lower like "*/bin/sh*" or Esql.url_original_to_lower rlike "*sh.{1,2}-c*", 1, 0)
+| eval Esql.contains_nc = case(Esql.url_original_to_lower like "*netcat*" or Esql.url_original_to_lower like "*ncat*" or Esql.url_original_to_lower rlike """.*nc.{1,2}[0-9]{1,3}(\.[0-9]{1,3}){3}.{1,2}[0-9]{1,5}.*""" or Esql.url_original_to_lower like "*nc.openbsd*" or Esql.url_original_to_lower like "*nc.traditional*" or Esql.url_original_to_lower like "*socat*", 1, 0)
+| eval Esql.contains_devtcp = case(Esql.url_original_to_lower like "*/dev/tcp/*" or Esql.url_original_to_lower like "*/dev/udp/*", 1, 0)
+| eval Esql.contains_helpers = case((Esql.url_original_to_lower like "*/bin/*" or Esql.url_original_to_lower like "*/usr/bin/*") and (Esql.url_original_to_lower like "*mkfifo*" or Esql.url_original_to_lower like "*nohup*" or Esql.url_original_to_lower like "*setsid*" or Esql.url_original_to_lower like "*busybox*"), 1, 0)
+| eval Esql.contains_sus_cli = case(Esql.url_original_to_lower like "*import*pty*spawn*" or Esql.url_original_to_lower like "*import*subprocess*call*" or Esql.url_original_to_lower like "*tcpsocket.new*" or Esql.url_original_to_lower like "*tcpsocket.open*" or Esql.url_original_to_lower like "*io.popen*" or Esql.url_original_to_lower like "*os.execute*" or Esql.url_original_to_lower like "*fsockopen*", 1, 0)
+| eval Esql.contains_privileges = case(Esql.url_original_to_lower like "*chmod*+x", 1, 0)
+| eval Esql.contains_downloader = case(Esql.url_original_to_lower like "*curl *" or Esql.url_original_to_lower like "*wget *" , 1, 0)
+| eval Esql.contains_file_read_keywords = case(Esql.url_original_to_lower like "*/etc/shadow*" or Esql.url_original_to_lower like "*/etc/passwd*" or Esql.url_original_to_lower like "*/root/.ssh/*" or Esql.url_original_to_lower like "*/home/*/.ssh/*" or Esql.url_original_to_lower like "*~/.ssh/*" or Esql.url_original_to_lower like "*/proc/self/environ*", 1, 0)
+| eval Esql.contains_base64_cmd = case(Esql.url_original_to_lower like "*base64*-d*" or Esql.url_original_to_lower like "*echo*|*base64*", 1, 0)
+| eval Esql.contains_suspicious_path = case(Esql.url_original_to_lower like "*/tmp/*" or Esql.url_original_to_lower like "*/var/tmp/*" or Esql.url_original_to_lower like "*/dev/shm/*" or Esql.url_original_to_lower like "*/root/*" or Esql.url_original_to_lower like "*/home/*/*" or Esql.url_original_to_lower like "*/var/www/*" or Esql.url_original_to_lower like "*/etc/cron.*/*", 1, 0)
 
 | eval Esql.any_payload_keyword = case(
     Esql.contains_interpreter == 1 or Esql.contains_shell == 1 or Esql.contains_nc == 1 or Esql.contains_devtcp == 1 or
@@ -99,7 +95,7 @@ from logs-network_traffic.http-*, logs-network_traffic.tls-*, logs-nginx.access-
 
 | keep
     @timestamp,
-    Esql.url_lower,
+    Esql.url_original_to_lower,
     Esql.any_payload_keyword,
     Esql.contains_interpreter,
     Esql.contains_shell,
@@ -123,13 +119,13 @@ from logs-network_traffic.http-*, logs-network_traffic.tls-*, logs-nginx.access-
 
 | stats
     Esql.event_count = count(),
-    Esql.url_path_count_distinct = count_distinct(Esql.url_lower),
+    Esql.url_path_count_distinct = count_distinct(Esql.url_original_to_lower),
 
     // General fields
 
     Esql.host_name_values = values(host.name),
     Esql.agent_id_values = values(agent.id),
-    Esql.url_path_values = values(Esql.url_lower),
+    Esql.url_path_values = values(Esql.url_original_to_lower),
     Esql.http.response.status_code_values = values(http.response.status_code),
     Esql.user_agent_original_values = values(user_agent.original),
     Esql.event_dataset_values = values(event.dataset),

rules/cross-platform/reconnaissance_web_server_discovery_or_fuzzing_activity.toml

@@ -1,8 +1,8 @@
 [metadata]
 creation_date = "2025/11/19"
-integration = ["network_traffic", "nginx", "apache", "apache_tomcat", "iis"]
+integration = ["nginx", "apache", "apache_tomcat", "iis"]
 maturity = "production"
-updated_date = "2025/11/24"
+updated_date = "2025/12/01"
 
 [rule]
 author = ["Elastic"]
@@ -52,10 +52,8 @@ rule_id = "8383a8d0-008b-47a5-94e5-496629dc3590"
 severity = "low"
 tags = [
     "Domain: Web",
-    "Domain: Network",
     "Use Case: Threat Detection",
     "Tactic: Reconnaissance",
-    "Data Source: Network Packet Capture",
     "Data Source: Nginx",
     "Data Source: Apache",
     "Data Source: Apache Tomcat",
@@ -65,14 +63,12 @@ tags = [
 timestamp_override = "event.ingested"
 type = "esql"
 query = '''
-from logs-network_traffic.http-*, logs-network_traffic.tls-*, logs-nginx.access-*, logs-apache.access-*, logs-apache_tomcat.access-*, logs-iis.access-*
+from logs-nginx.access-*, logs-apache.access-*, logs-apache_tomcat.access-*, logs-iis.access-*
 | where
-    (url.original is not null or url.full is not null) and
     http.request.method == "GET" and 
     http.response.status_code in (404, 403)
 
-| eval Esql.url_text  = case(url.original is not null, url.original, url.full)
-| eval Esql.url_lower = to_lower(Esql.url_text)
+| eval Esql.url_original_to_lower = to_lower(url.original)
 
 | keep
     @timestamp,
@@ -82,19 +78,19 @@ from logs-network_traffic.http-*, logs-network_traffic.tls-*, logs-nginx.access-
     source.ip,
     agent.id,
     host.name,
-    Esql.url_lower
+    Esql.url_original_to_lower
 | stats
     Esql.event_count = count(),
-    Esql.url_lower_count_distinct = count_distinct(Esql.url_lower),
+    Esql.url_original_count_distinct = count_distinct(Esql.url_original_to_lower),
     Esql.host_name_values = values(host.name),
     Esql.agent_id_values = values(agent.id),
     Esql.http_request_method_values = values(http.request.method),
     Esql.http_response_status_code_values = values(http.response.status_code),
-    Esql.url_path_values = values(Esql.url_lower),
+    Esql.url_original_values = values(Esql.url_original_to_lower),
     Esql.event_dataset_values = values(event.dataset)
     by source.ip
 | where
-  Esql.event_count > 500 and Esql.url_lower_count_distinct > 250
+  Esql.event_count > 500 and Esql.url_original_count_distinct > 250
 '''
 
 [[rule.threat]]

rules/cross-platform/reconnaissance_web_server_unusual_spike_in_error_logs.toml

@@ -2,7 +2,7 @@
 creation_date = "2025/11/19"
 integration = ["nginx", "apache", "apache_tomcat", "iis"]
 maturity = "production"
-updated_date = "2025/11/25"
+updated_date = "2025/12/01"
 
 [rule]
 author = ["Elastic"]
@@ -80,7 +80,7 @@ from logs-nginx.error-*, logs-apache_tomcat.error-*, logs-apache.error-*, logs-i
     Esql.event_dataset_values = values(event.dataset)
     by source.ip, agent.id
 | where
-    Esql.event_count > 25
+    Esql.event_count > 50
 '''
 
 [[rule.threat]]

rules/cross-platform/reconnaissance_web_server_unusual_spike_in_error_response_codes.toml

@@ -1,8 +1,8 @@
 [metadata]
 creation_date = "2025/11/19"
-integration = ["network_traffic", "nginx", "apache", "apache_tomcat", "iis"]
+integration = ["nginx", "apache", "apache_tomcat", "iis"]
 maturity = "production"
-updated_date = "2025/11/24"
+updated_date = "2025/12/01"
 
 [rule]
 author = ["Elastic"]
@@ -53,10 +53,8 @@ rule_id = "6fa3abe3-9cd8-41de-951b-51ed8f710523"
 severity = "low"
 tags = [
     "Domain: Web",
-    "Domain: Network",
     "Use Case: Threat Detection",
     "Tactic: Reconnaissance",
-    "Data Source: Network Packet Capture",
     "Data Source: Nginx",
     "Data Source: Apache",
     "Data Source: Apache Tomcat",
@@ -66,18 +64,17 @@ tags = [
 timestamp_override = "event.ingested"
 type = "esql"
 query = '''
-from logs-network_traffic.http-*, logs-network_traffic.tls-*, logs-nginx.access-*, logs-apache.access-*, logs-apache_tomcat.access-*, logs-iis.access-*
+from logs-nginx.access-*, logs-apache.access-*, logs-apache_tomcat.access-*, logs-iis.access-*
 | where
-    (url.original is not null or url.full is not null) and
     http.request.method == "GET" and
     http.response.status_code in (
       500, // Internal Server Error
       502, // Bad Gateway
       503, // Service Unavailable
       504 // Gateway Timeout
     )
-| eval Esql.url_text  = case(url.original is not null, url.original, url.full)
-| eval Esql.url_lower = to_lower(Esql.url_text)
+
+| eval Esql.url_original_to_lower = to_lower(url.original)
 
 | keep
     @timestamp,
@@ -87,7 +84,7 @@ from logs-network_traffic.http-*, logs-network_traffic.tls-*, logs-nginx.access-
     source.ip,
     agent.id,
     host.name,
-    Esql.url_lower
+    Esql.url_original_to_lower
 | stats
     Esql.event_count = count(),
     Esql.http_response_status_code_count = count(http.response.status_code),
@@ -96,7 +93,7 @@ from logs-network_traffic.http-*, logs-network_traffic.tls-*, logs-nginx.access-
     Esql.agent_id_values = values(agent.id),
     Esql.http_request_method_values = values(http.request.method),
     Esql.http_response_status_code_values = values(http.response.status_code),
-    Esql.url_path_values = values(Esql.url_lower),
+    Esql.url_path_values = values(Esql.url_original_to_lower),
     Esql.event_dataset_values = values(event.dataset)
     by source.ip, agent.id
 | where