Skip to content

Commit 172d4ce

Browse files
DefSecSentinelDefSecSentinel
authored
Merge branch 'main' into customize-file-creation
2 parents 6dd538c + fe48309 commit 172d4ce

7 files changed

+193
-37
lines changed

‎rules/linux/defense_evasion_authorized_keys_file_deletion.toml‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
[metadata]
2+
creation_date = "2025/02/21"
3+
integration = ["endpoint"]
4+
maturity = "production"
5+
updated_date = "2025/02/21"
6+
7+
[rule]
8+
author = ["Elastic"]
9+
description = """
10+
This rule detects the deletion of the authorized_keys or authorized_keys2 files on Linux systems. These files
11+
are used to store public keys for SSH authentication. Unauthorized deletion of these files can be an indicator
12+
of an attacker removing access to the system, and may be a precursor to further malicious activity.
13+
"""
14+
from = "now-9m"
15+
index = ["logs-endpoint.events.process*"]
16+
language = "eql"
17+
license = "Elastic License v2"
18+
name = "SSH Authorized Keys File Deletion"
19+
risk_score = 21
20+
rule_id = "3c216ace-2633-4911-9aac-b61d4dc320e8"
21+
setup = """## Setup
22+
23+
This rule requires data coming in from Elastic Defend.
24+
25+
### Elastic Defend Integration Setup
26+
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
27+
28+
#### Prerequisite Requirements:
29+
- Fleet is required for Elastic Defend.
30+
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
31+
32+
#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
33+
- Go to the Kibana home page and click "Add integrations".
34+
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
35+
- Click "Add Elastic Defend".
36+
- Configure the integration name and optionally add a description.
37+
- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
38+
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
39+
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
40+
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
41+
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
42+
- Click "Save and Continue".
43+
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
44+
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
45+
"""
46+
severity = "low"
47+
tags = [
48+
"Domain: Endpoint",
49+
"OS: Linux",
50+
"Use Case: Threat Detection",
51+
"Tactic: Defense Evasion",
52+
"Data Source: Elastic Defend",
53+
]
54+
timestamp_override = "event.ingested"
55+
type = "eql"
56+
query = '''
57+
file where host.os.type == "linux" and event.type == "deletion" and file.name in ("authorized_keys", "authorized_keys2") and
58+
not (
59+
process.executable in (
60+
"/usr/bin/google_guest_agent", "/usr/bin/dockerd", "/bin/dockerd", "/usr/bin/containerd"
61+
) or
62+
process.executable like~ "/nix/store/*"
63+
)
64+
'''
65+
66+
[[rule.threat]]
67+
framework = "MITRE ATT&CK"
68+
69+
[[rule.threat.technique]]
70+
id = "T1070"
71+
name = "Indicator Removal"
72+
reference = "https://attack.mitre.org/techniques/T1070/"
73+
74+
[[rule.threat.technique.subtechnique]]
75+
id = "T1070.004"
76+
name = "File Deletion"
77+
reference = "https://attack.mitre.org/techniques/T1070/004/"
78+
79+
[rule.threat.tactic]
80+
id = "TA0005"
81+
name = "Defense Evasion"
82+
reference = "https://attack.mitre.org/tactics/TA0005/"

‎rules/linux/persistence_user_credential_modification_via_echo.toml‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
[metadata]
2+
creation_date = "2025/02/21"
3+
integration = ["endpoint"]
4+
maturity = "production"
5+
updated_date = "2025/02/21"
6+
7+
[rule]
8+
author = ["Elastic"]
9+
description = """
10+
This rule detects Linux user account credential modification events where the echo command is
11+
used to directly echo a password into the passwd utility. This technique is used by malware
12+
to automate the process of user account credential modification on Linux systems post-infection.
13+
"""
14+
from = "now-9m"
15+
index = ["logs-endpoint.events.process*"]
16+
language = "eql"
17+
license = "Elastic License v2"
18+
name = "Linux User Account Credential Modification"
19+
risk_score = 21
20+
rule_id = "79e7291f-9e3b-4a4b-9823-800daa89c8f9"
21+
setup = """## Setup
22+
This rule requires data coming in from Elastic Defend.
23+
### Elastic Defend Integration Setup
24+
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
25+
#### Prerequisite Requirements:
26+
- Fleet is required for Elastic Defend.
27+
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
28+
#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
29+
- Go to the Kibana home page and click "Add integrations".
30+
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
31+
- Click "Add Elastic Defend".
32+
- Configure the integration name and optionally add a description.
33+
- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
34+
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
35+
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
36+
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
37+
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
38+
- Click "Save and Continue".
39+
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
40+
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
41+
"""
42+
severity = "low"
43+
tags = [
44+
"Domain: Endpoint",
45+
"OS: Linux",
46+
"Use Case: Threat Detection",
47+
"Tactic: Persistence",
48+
"Data Source: Elastic Defend"
49+
]
50+
timestamp_override = "event.ingested"
51+
type = "eql"
52+
query = '''
53+
process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and
54+
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and
55+
process.command_line like~ "*echo*passwd*" and
56+
not (
57+
process.parent.command_line == "runc init" or
58+
process.parent.executable in ("/usr/bin/make", "/bin/make")
59+
)
60+
'''
61+
62+
[[rule.threat]]
63+
framework = "MITRE ATT&CK"
64+
65+
[[rule.threat.technique]]
66+
id = "T1098"
67+
name = "Account Manipulation"
68+
reference = "https://attack.mitre.org/techniques/T1098/"
69+
70+
[rule.threat.tactic]
71+
id = "TA0003"
72+
name = "Persistence"
73+
reference = "https://attack.mitre.org/tactics/TA0003/"

‎rules/windows/defense_evasion_amsi_bypass_powershell.toml‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
creation_date = "2023/01/17"
33
integration = ["windows"]
44
maturity = "production"
5-
updated_date = "2025/02/03"
5+
updated_date = "2025/02/21"
66
min_stack_version = "8.14.0"
77
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
88

@@ -131,9 +131,7 @@ event.category:"process" and host.os.type:windows and
131131
"AllocHGlobal((9076" or
132132
"[cHAr](65)+[cHaR]([byTe]0x6d)+[ChaR]([ByTe]0x73)+[CHaR]([BYte]0x69"
133133
) or
134-
powershell.file.script_block_text:("[System.Runtime.InteropServices.Marshal]::Copy" and "VirtualProtect") or
135134
powershell.file.script_block_text:("[Ref].Assembly.GetType(('System.Management.Automation" and ".SetValue(") or
136-
powershell.file.script_block_text:("::AllocHGlobal((" and ("System.Management.Automation.$([" or "System.$([cHAr]" or "[cHaR]([byTe]")) or
137135
powershell.file.script_block_text:("::AllocHGlobal((" and ".SetValue(" and "-replace" and ".NoRMALiZe(")
138136
) and
139137
not powershell.file.script_block_text : (

‎rules/windows/defense_evasion_injection_msbuild.toml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
creation_date = "2020/03/25"
33
integration = ["windows"]
44
maturity = "production"
5-
updated_date = "2025/01/15"
5+
updated_date = "2025/02/25"
66
min_stack_version = "8.14.0"
77
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
88

@@ -33,8 +33,10 @@ timestamp_override = "event.ingested"
3333
type = "eql"
3434

3535
query = '''
36-
process where host.os.type == "windows" and process.name: "MSBuild.exe" and
37-
event.action:("CreateRemoteThread detected (rule: CreateRemoteThread)", "CreateRemoteThread")
36+
process where host.os.type == "windows" and
37+
event.provider == "Microsoft-Windows-Sysmon" and
38+
/* CreateRemoteThread */
39+
event.code == "8" and process.name: "MSBuild.exe"
3840
'''
3941
note = """## Triage and analysis
4042

‎rules/windows/defense_evasion_timestomp_sysmon.toml‎

Lines changed: 21 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
creation_date = "2023/01/17"
33
integration = ["windows"]
44
maturity = "production"
5-
updated_date = "2025/01/15"
5+
updated_date = "2025/02/25"
66
min_stack_version = "8.14.0"
77
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
88

@@ -33,27 +33,26 @@ timestamp_override = "event.ingested"
3333
type = "eql"
3434

3535
query = '''
36-
file where host.os.type == "windows" and event.code : "2" and
37-
38-
/* Requires Sysmon EventID 2 - File creation time change */
39-
event.action : "File creation time changed*" and
40-
41-
not process.executable :
42-
("?:\\Program Files\\*",
43-
"?:\\Program Files (x86)\\*",
44-
"?:\\Windows\\system32\\cleanmgr.exe",
45-
"?:\\Windows\\system32\\msiexec.exe",
46-
"?:\\Windows\\syswow64\\msiexec.exe",
47-
"?:\\Windows\\system32\\svchost.exe",
48-
"?:\\WINDOWS\\system32\\backgroundTaskHost.exe",
49-
"?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe",
50-
"?:\\Users\\*\\AppData\\Local\\Mozilla Firefox\\firefox.exe",
51-
"?:\\Users\\*\\AppData\\Local\\slack\\app-*\\slack.exe",
52-
"?:\\Users\\*\\AppData\\Local\\GitHubDesktop\\app-*\\GitHubDesktop.exe",
53-
"?:\\Users\\*\\AppData\\Local\\Microsoft\\Teams\\current\\Teams.exe",
54-
"?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe") and
55-
not file.extension : ("temp", "tmp", "~tmp", "xml", "newcfg") and not user.name : ("SYSTEM", "Local Service", "Network Service") and
56-
not file.name : ("LOG", "temp-index", "license.rtf", "iconcache_*.db")
36+
file where host.os.type == "windows" and
37+
event.provider == "Microsoft-Windows-Sysmon" and
38+
/* File creation time change */
39+
event.code == "2" and
40+
not process.executable :
41+
("?:\\Program Files\\*",
42+
"?:\\Program Files (x86)\\*",
43+
"?:\\Windows\\system32\\cleanmgr.exe",
44+
"?:\\Windows\\system32\\msiexec.exe",
45+
"?:\\Windows\\syswow64\\msiexec.exe",
46+
"?:\\Windows\\system32\\svchost.exe",
47+
"?:\\WINDOWS\\system32\\backgroundTaskHost.exe",
48+
"?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe",
49+
"?:\\Users\\*\\AppData\\Local\\Mozilla Firefox\\firefox.exe",
50+
"?:\\Users\\*\\AppData\\Local\\slack\\app-*\\slack.exe",
51+
"?:\\Users\\*\\AppData\\Local\\GitHubDesktop\\app-*\\GitHubDesktop.exe",
52+
"?:\\Users\\*\\AppData\\Local\\Microsoft\\Teams\\current\\Teams.exe",
53+
"?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe") and
54+
not file.extension : ("temp", "tmp", "~tmp", "xml", "newcfg") and not user.name : ("SYSTEM", "Local Service", "Network Service") and
55+
not file.name : ("LOG", "temp-index", "license.rtf", "iconcache_*.db")
5756
'''
5857
note = """## Triage and analysis
5958

‎rules/windows/lateral_movement_remote_file_copy_hidden_share.toml‎

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
creation_date = "2020/11/04"
33
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
44
maturity = "production"
5-
updated_date = "2025/02/21"
5+
updated_date = "2025/02/25"
66
min_stack_version = "8.14.0"
77
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
88

@@ -50,11 +50,8 @@ type = "eql"
5050

5151
query = '''
5252
process where host.os.type == "windows" and event.type == "start" and
53-
(
54-
process.name : ("cmd.exe", "powershell.exe", "xcopy.exe") and
55-
process.args : ("copy*", "move*", "cp", "mv") or
56-
process.name : "robocopy.exe"
57-
) and process.args : "*\\\\*\\*$*"
53+
process.name : ("cmd.exe", "powershell.exe", "xcopy.exe", "pwsh.exe", "powershell_ise.exe") and
54+
process.command_line : "*\\\\*\\*$*" and process.command_line : ("*copy*", "*move*", "* cp *", "* mv *")
5855
'''
5956
note = """## Triage and analysis
6057

‎rules/windows/privilege_escalation_via_rogue_named_pipe.toml‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
creation_date = "2021/10/13"
33
integration = ["windows"]
44
maturity = "production"
5-
updated_date = "2025/01/15"
5+
updated_date = "2025/02/25"
66
min_stack_version = "8.14.0"
77
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
88

@@ -48,8 +48,13 @@ timestamp_override = "event.ingested"
4848
type = "eql"
4949

5050
query = '''
51-
file where host.os.type == "windows" and event.action : "Pipe Created*" and
52-
/* normal sysmon named pipe creation events truncate the pipe keyword */
51+
file where host.os.type == "windows" and
52+
event.provider == "Microsoft-Windows-Sysmon" and
53+
54+
/* Named Pipe Creation */
55+
event.code == "17" and
56+
57+
/* Sysmon truncates the "Pipe" keyword in normal named pipe creation events */
5358
file.name : "\\*\\Pipe\\*"
5459
'''
5560
note = """## Triage and analysis

0 commit comments

Comments
 (0)