Skip to content

Commit 54b19e7

Browse files
Aegrahtradebot-elastic
Aegrah
authored and
tradebot-elastic
committed
[Rule Tuning] Misc. Linux ES|QL Rules (#5050)
* [Rule Tuning] Misc. Linux ES|QL Rules * update date bump * ++ * Update persistence_web_server_sus_child_spawned.toml * Update working directory conditions in TOML file (cherry picked from commit ef7ff52)
1 parent 0a1af01 commit 54b19e7

7 files changed

+132
-62
lines changed

‎rules/linux/command_and_control_frequent_egress_netcon_from_sus_executable.toml‎

Lines changed: 13 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
creation_date = "2025/02/20"
33
integration = ["endpoint"]
44
maturity = "production"
5-
updated_date = "2025/07/16"
5+
updated_date = "2025/09/02"
66

77
[rule]
88
author = ["Elastic"]
@@ -91,7 +91,6 @@ tags = [
9191
]
9292
timestamp_override = "event.ingested"
9393
type = "esql"
94-
9594
query = '''
9695
from logs-endpoint.events.network-*
9796
| where
@@ -103,8 +102,17 @@ from logs-endpoint.events.network-*
103102
process.executable like "/tmp/*" or
104103
process.executable like "/var/tmp/*" or
105104
process.executable like "/dev/shm/*" or
106-
process.name rlike ".*"
107-
) and not (
105+
process.executable like "/var/log/*" or
106+
process.executable like "/sys/*" or
107+
process.executable like "/media/*" or
108+
process.executable like "/proc/*" or
109+
process.executable like "/var/backups/*" or
110+
process.executable like "/var/mail/*" or
111+
process.executable like "/var/spool/*" or
112+
process.executable like "./*" or
113+
process.name like ".*"
114+
) and
115+
not (
108116
cidr_match(destination.ip,
109117
"10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12",
110118
"192.0.0.0/24", "192.0.0.29/32", "192.0.0.8/32", "192.0.0.9/32",
@@ -113,7 +121,6 @@ from logs-endpoint.events.network-*
113121
"224.0.0.0/4", "100.64.0.0/10", "192.175.48.0/24", "198.18.0.0/15",
114122
"198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1", "FE80::/10", "FF00::/8"
115123
) or
116-
process.executable like "/nix/store/*" or
117124
process.executable like "/tmp/newroot/*" or
118125
process.executable like "/tmp/.mount*" or
119126
process.executable like "/tmp/go-build*"
@@ -141,17 +148,15 @@ from logs-endpoint.events.network-*
141148
| limit 100
142149
'''
143150

144-
145151
[[rule.threat]]
146152
framework = "MITRE ATT&CK"
153+
147154
[[rule.threat.technique]]
148155
id = "T1071"
149156
name = "Application Layer Protocol"
150157
reference = "https://attack.mitre.org/techniques/T1071/"
151158

152-
153159
[rule.threat.tactic]
154160
id = "TA0011"
155161
name = "Command and Control"
156162
reference = "https://attack.mitre.org/tactics/TA0011/"
157-

‎rules/linux/discovery_port_scanning_activity_from_compromised_host.toml‎

Lines changed: 17 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
creation_date = "2025/03/04"
33
integration = ["endpoint"]
44
maturity = "production"
5-
updated_date = "2025/07/16"
5+
updated_date = "2025/09/02"
66

77
[rule]
88
author = ["Elastic"]
@@ -93,14 +93,27 @@ tags = [
9393
]
9494
timestamp_override = "event.ingested"
9595
type = "esql"
96-
9796
query = '''
9897
from logs-endpoint.events.network-*
9998
| where
10099
@timestamp > now() - 1h and
101100
host.os.type == "linux" and
102101
event.type == "start" and
103-
event.action == "connection_attempted"
102+
event.action == "connection_attempted" and
103+
not (
104+
cidr_match(destination.ip, "127.0.0.0/8", "::1", "FE80::/10", "FF00::/8") or
105+
process.executable in (
106+
"/opt/dbtk/bin/jsvc", "/usr/lib/dotnet/dotnet", "/usr/share/elasticsearch/jdk/bin/java", "/usr/sbin/haproxy",
107+
"/usr/bin/java", "/opt/kaspersky/kesl/libexec/kesl", "/usr/bin/dotnet", "/opt/java/openjdk/bin/java"
108+
) or
109+
process.executable like "/var/opt/kaspersky/kesl/*kesl" or
110+
process.executable like "/usr/lib/jvm/*/java" or
111+
process.executable like "/opt/google/chrome*" or
112+
process.executable like "/var/lib/docker/*/java" or
113+
process.executable like "/usr/lib64/jvm/*/java" or
114+
process.executable like "/snap/*" or
115+
process.executable like "/home/*/.local/share/JetBrains/*"
116+
)
104117
| keep
105118
@timestamp,
106119
host.os.type,
@@ -125,17 +138,15 @@ from logs-endpoint.events.network-*
125138
| limit 100
126139
'''
127140

128-
129141
[[rule.threat]]
130142
framework = "MITRE ATT&CK"
143+
131144
[[rule.threat.technique]]
132145
id = "T1046"
133146
name = "Network Service Discovery"
134147
reference = "https://attack.mitre.org/techniques/T1046/"
135148

136-
137149
[rule.threat.tactic]
138150
id = "TA0007"
139151
name = "Discovery"
140152
reference = "https://attack.mitre.org/tactics/TA0007/"
141-

‎rules/linux/discovery_subnet_scanning_activity_from_compromised_host.toml‎

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
creation_date = "2025/03/04"
33
integration = ["endpoint"]
44
maturity = "production"
5-
updated_date = "2025/07/16"
5+
updated_date = "2025/09/02"
66

77
[rule]
88
author = ["Elastic"]
@@ -92,15 +92,23 @@ tags = [
9292
]
9393
timestamp_override = "event.ingested"
9494
type = "esql"
95-
9695
query = '''
9796
from logs-endpoint.events.network-*
9897
| keep @timestamp, host.os.type, event.type, event.action, process.executable, destination.ip, agent.id, host.name
9998
| where
10099
@timestamp > now() - 1 hours and
101100
host.os.type == "linux" and
102101
event.type == "start" and
103-
event.action == "connection_attempted"
102+
event.action == "connection_attempted" and
103+
not (
104+
process.executable in ("/usr/local/bin/prometheus", "/app/extra/chrome") or
105+
process.executable like "/usr/local/prometheus/*/prometheus" or
106+
process.executable like "/usr/share/elastic-agent/*" or
107+
process.executable like "/var/lib/docker/overlay*connectord" or
108+
process.executable like "/opt/rumble/bin/rumble-agent*" or
109+
process.executable like "/opt/gitlab/*" or
110+
process.executable like "/opt/google/chrome/chrome*"
111+
)
104112
| stats
105113
Esql.event_count = count(),
106114
Esql.destination_ip_count_distinct = count_distinct(destination.ip),
@@ -115,17 +123,15 @@ from logs-endpoint.events.network-*
115123
| limit 100
116124
'''
117125

118-
119126
[[rule.threat]]
120127
framework = "MITRE ATT&CK"
128+
121129
[[rule.threat.technique]]
122130
id = "T1046"
123131
name = "Network Service Discovery"
124132
reference = "https://attack.mitre.org/techniques/T1046/"
125133

126-
127134
[rule.threat.tactic]
128135
id = "TA0007"
129136
name = "Discovery"
130137
reference = "https://attack.mitre.org/tactics/TA0007/"
131-

‎rules/linux/exfiltration_unusual_file_transfer_utility_launched.toml‎

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
creation_date = "2025/02/21"
33
integration = ["endpoint"]
44
maturity = "production"
5-
updated_date = "2025/07/16"
5+
updated_date = "2025/09/02"
66

77
[rule]
88
author = ["Elastic"]
@@ -91,10 +91,9 @@ tags = [
9191
]
9292
timestamp_override = "event.ingested"
9393
type = "esql"
94-
9594
query = '''
9695
from logs-endpoint.events.process-*
97-
| keep @timestamp, host.os.type, event.type, event.action, process.name, process.executable, process.parent.executable, process.command_line, agent.id, host.name
96+
| keep @timestamp, host.os.type, event.type, event.action, process.name, process.executable, process.parent.executable, agent.id, host.name
9897
| where
9998
@timestamp > now() - 1 hours and
10099
host.os.type == "linux" and
@@ -106,27 +105,26 @@ from logs-endpoint.events.process-*
106105
Esql.agent_id_count_distinct = count_distinct(agent.id),
107106
Esql.host_name_values = values(host.name),
108107
Esql.agent_id_values = values(agent.id)
109-
by process.executable, process.parent.executable, process.command_line
108+
by process.executable, process.parent.executable
110109
| where
111110
Esql.agent_id_count_distinct == 1 and
112111
Esql.event_count < 5
113112
| sort Esql.event_count asc
114113
| limit 100
115114
'''
116115

117-
118116
[[rule.threat]]
119117
framework = "MITRE ATT&CK"
120118

121119
[rule.threat.tactic]
122120
id = "TA0010"
123121
name = "Exfiltration"
124122
reference = "https://attack.mitre.org/tactics/TA0010/"
123+
125124
[[rule.threat]]
126125
framework = "MITRE ATT&CK"
127126

128127
[rule.threat.tactic]
129128
id = "TA0002"
130129
name = "Execution"
131130
reference = "https://attack.mitre.org/tactics/TA0002/"
132-

‎rules/linux/impact_potential_bruteforce_malware_infection.toml‎

Lines changed: 15 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
creation_date = "2025/02/20"
33
integration = ["endpoint"]
44
maturity = "production"
5-
updated_date = "2025/07/16"
5+
updated_date = "2025/09/02"
66

77
[rule]
88
author = ["Elastic"]
@@ -95,7 +95,6 @@ tags = [
9595
]
9696
timestamp_override = "event.ingested"
9797
type = "esql"
98-
9998
query = '''
10099
from logs-endpoint.events.network-*
101100
| keep @timestamp, host.os.type, event.type, event.action, destination.port, process.executable, destination.ip, agent.id, host.name
@@ -105,14 +104,21 @@ from logs-endpoint.events.network-*
105104
event.type == "start" and
106105
event.action == "connection_attempted" and
107106
destination.port in (22, 222, 2222, 10022, 2022, 2200, 62612, 8022) and
108-
not cidr_match(
107+
not (
108+
cidr_match(
109109
destination.ip,
110110
"10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12",
111111
"192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32",
112112
"192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
113113
"192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24",
114114
"224.0.0.0/4", "100.64.0.0/10", "192.175.48.0/24", "198.18.0.0/15",
115115
"198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1", "FE80::/10", "FF00::/8"
116+
) or
117+
process.executable in (
118+
"/usr/bin/rclone", "/usr/bin/sss_ssh_knownhostsproxy", "/usr/sbin/sshd", "/usr/bin/ssh",
119+
"/usr/local/bin/php", "/usr/sbin/apache2", "/usr/sbin/nginx", "/usr/local/bin/argocd-repo-server"
120+
) or
121+
process.executable like "/usr/local/efax/*"
116122
)
117123
| stats
118124
Esql.event_count = count(),
@@ -127,46 +133,46 @@ from logs-endpoint.events.network-*
127133
| limit 100
128134
'''
129135

130-
131136
[[rule.threat]]
132137
framework = "MITRE ATT&CK"
138+
133139
[[rule.threat.technique]]
134140
id = "T1496"
135141
name = "Resource Hijacking"
136142
reference = "https://attack.mitre.org/techniques/T1496/"
137143

138-
139144
[rule.threat.tactic]
140145
id = "TA0040"
141146
name = "Impact"
142147
reference = "https://attack.mitre.org/tactics/TA0040/"
148+
143149
[[rule.threat]]
144150
framework = "MITRE ATT&CK"
151+
145152
[[rule.threat.technique]]
146153
id = "T1059"
147154
name = "Command and Scripting Interpreter"
148155
reference = "https://attack.mitre.org/techniques/T1059/"
156+
149157
[[rule.threat.technique.subtechnique]]
150158
id = "T1059.004"
151159
name = "Unix Shell"
152160
reference = "https://attack.mitre.org/techniques/T1059/004/"
153161

154-
155-
156162
[rule.threat.tactic]
157163
id = "TA0002"
158164
name = "Execution"
159165
reference = "https://attack.mitre.org/tactics/TA0002/"
166+
160167
[[rule.threat]]
161168
framework = "MITRE ATT&CK"
169+
162170
[[rule.threat.technique]]
163171
id = "T1071"
164172
name = "Application Layer Protocol"
165173
reference = "https://attack.mitre.org/techniques/T1071/"
166174

167-
168175
[rule.threat.tactic]
169176
id = "TA0011"
170177
name = "Command and Control"
171178
reference = "https://attack.mitre.org/tactics/TA0011/"
172-

0 commit comments

Comments
 (0)