Skip to content

Commit 5a33d72

Browse files
terrancedejesusterrancedejesus
authored
Merge branch 'main' into rule-tuning-aws-sts-temporary-credentials-via-assumedrole
2 parents 06f178f + 6c2dad9 commit 5a33d72

File tree

47 files changed

+377
-149
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

47 files changed

+377
-149
lines changed

‎detection_rules/etc/non-ecs-schema.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -150,7 +150,8 @@
150150
"logs-aws.cloudtrail-*": {
151151
"aws.cloudtrail.flattened.request_parameters.cidrIp": "keyword",
152152
"aws.cloudtrail.flattened.request_parameters.fromPort": "keyword",
153-
"aws.cloudtrail.flattened.request_parameters.roleArn": "keyword"
153+
"aws.cloudtrail.flattened.request_parameters.roleArn": "keyword",
154+
"aws.cloudtrail.flattened.request_parameters.serialNumber": "keyword"
154155
},
155156
"logs-azure.signinlogs-*": {
156157
"azure.signinlogs.properties.conditional_access_audiences.application_id": "keyword"

‎rules/integrations/aws/impact_iam_deactivate_mfa_device.toml‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
creation_date = "2020/05/26"
33
integration = ["aws"]
44
maturity = "production"
5-
updated_date = "2024/05/21"
5+
updated_date = "2024/10/25"
66

77
[rule]
88
author = ["Elastic", "Austin Songer"]
@@ -80,6 +80,7 @@ tags = [
8080
"Data Source: AWS IAM",
8181
"Resources: Investigation Guide",
8282
"Tactic: Impact",
83+
"Tactic: Persistence",
8384
]
8485
timestamp_override = "event.ingested"
8586
type = "query"
@@ -101,4 +102,19 @@ reference = "https://attack.mitre.org/techniques/T1531/"
101102
id = "TA0040"
102103
name = "Impact"
103104
reference = "https://attack.mitre.org/tactics/TA0040/"
105+
[[rule.threat]]
106+
framework = "MITRE ATT&CK"
107+
[[rule.threat.technique]]
108+
id = "T1556"
109+
name = "Modify Authentication Process"
110+
reference = "https://attack.mitre.org/techniques/T1556/"
111+
[[rule.threat.technique.subtechnique]]
112+
id = "T1556.006"
113+
name = "Multi-Factor Authentication"
114+
reference = "https://attack.mitre.org/techniques/T1556/006/"
104115

116+
117+
[rule.threat.tactic]
118+
id = "TA0003"
119+
name = "Persistence"
120+
reference = "https://attack.mitre.org/tactics/TA0003/"

‎rules/integrations/aws/persistence_sts_assume_role_with_new_mfa.toml‎

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
[metadata]
2+
creation_date = "2024/10/25"
3+
integration = ["aws"]
4+
maturity = "production"
5+
updated_date = "2024/10/25"
6+
7+
8+
[rule]
9+
author = ["Elastic"]
10+
description = """
11+
Identifies when a user has assumed a role using a new MFA device. Users can assume a role to obtain temporary credentials and access AWS resources using the AssumeRole API of AWS Security Token Service (STS).
12+
While a new MFA device is not always indicative of malicious behavior it should be verified as adversaries can use this technique for persistence and privilege escalation.
13+
"""
14+
false_positives = [
15+
"AWS administrators or automated processes might regularly assume roles for legitimate administrative purposes and to perform periodic tasks such as data backups, updates, or deployments.",
16+
]
17+
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
18+
language = "kuery"
19+
license = "Elastic License v2"
20+
name = "AWS STS AssumeRole with New MFA Device"
21+
note = """## Setup
22+
23+
The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
24+
references = [
25+
"https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html",
26+
"https://github.com/RhinoSecurityLabs/cloudgoat/blob/d5863b80afd082d853f2e8df1955c6393695a4da/scenarios/iam_privesc_by_key_rotation/README.md",
27+
]
28+
risk_score = 21
29+
rule_id = "a22f566b-5b23-4412-880d-c6c957acd321"
30+
severity = "low"
31+
tags = [
32+
"Domain: Cloud",
33+
"Data Source: AWS",
34+
"Data Source: Amazon Web Services",
35+
"Data Source: AWS STS",
36+
"Use Case: Identity and Access Audit",
37+
"Tactic: Privilege Escalation",
38+
"Tactic: Persistence",
39+
"Tactic: Lateral Movement",
40+
]
41+
timestamp_override = "event.ingested"
42+
type = "new_terms"
43+
44+
query = '''
45+
event.dataset:aws.cloudtrail
46+
and event.provider:sts.amazonaws.com
47+
and event.action:(AssumeRole or AssumeRoleWithSAML or AssumeRoleWithWebIdentity)
48+
and event.outcome:success
49+
and user.id:*
50+
and aws.cloudtrail.flattened.request_parameters.serialNumber:*
51+
'''
52+
53+
54+
[[rule.threat]]
55+
framework = "MITRE ATT&CK"
56+
[[rule.threat.technique]]
57+
id = "T1556"
58+
name = "Modify Authentication Process"
59+
reference = "https://attack.mitre.org/techniques/T1556/"
60+
[[rule.threat.technique.subtechnique]]
61+
id = "T1556.006"
62+
name = "Multi-Factor Authentication"
63+
reference = "https://attack.mitre.org/techniques/T1556/006/"
64+
65+
66+
[rule.threat.tactic]
67+
id = "TA0003"
68+
name = "Persistence"
69+
reference = "https://attack.mitre.org/tactics/TA0003/"
70+
[[rule.threat]]
71+
framework = "MITRE ATT&CK"
72+
[[rule.threat.technique]]
73+
id = "T1548"
74+
name = "Abuse Elevation Control Mechanism"
75+
reference = "https://attack.mitre.org/techniques/T1548/"
76+
77+
78+
[rule.threat.tactic]
79+
id = "TA0004"
80+
name = "Privilege Escalation"
81+
reference = "https://attack.mitre.org/tactics/TA0004/"
82+
[[rule.threat]]
83+
framework = "MITRE ATT&CK"
84+
[[rule.threat.technique]]
85+
id = "T1550"
86+
name = "Use Alternate Authentication Material"
87+
reference = "https://attack.mitre.org/techniques/T1550/"
88+
[[rule.threat.technique.subtechnique]]
89+
id = "T1550.001"
90+
name = "Application Access Token"
91+
reference = "https://attack.mitre.org/techniques/T1550/001/"
92+
93+
94+
[rule.threat.tactic]
95+
id = "TA0008"
96+
name = "Lateral Movement"
97+
reference = "https://attack.mitre.org/tactics/TA0008/"
98+
99+
[rule.new_terms]
100+
field = "new_terms_fields"
101+
value = ["user.id", "aws.cloudtrail.flattened.request_parameters.serialNumber"]
102+
[[rule.new_terms.history_window_start]]
103+
field = "history_window_start"
104+
value = "now-10d"
105+
106+

‎rules/windows/collection_winrar_encryption.toml‎

Lines changed: 19 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
[metadata]
22
creation_date = "2020/12/04"
3-
integration = ["endpoint", "windows"]
3+
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel"]
44
maturity = "production"
5-
updated_date = "2024/10/15"
5+
updated_date = "2024/11/02"
66
min_stack_version = "8.14.0"
77
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
88

@@ -13,7 +13,14 @@ Identifies use of WinRar or 7z to create an encrypted files. Adversaries will of
1313
preparation for exfiltration.
1414
"""
1515
from = "now-9m"
16-
index = ["logs-endpoint.events.process-*", "winlogbeat-*", "logs-windows.*", "endgame-*"]
16+
index = [
17+
"logs-endpoint.events.process-*",
18+
"winlogbeat-*",
19+
"logs-windows.sysmon_operational-*",
20+
"endgame-*",
21+
"logs-m365_defender.event-*",
22+
"logs-sentinel_one_cloud_funnel.*"
23+
]
1724
language = "eql"
1825
license = "Elastic License v2"
1926
name = "Encrypting Files with WinRar or 7z"
@@ -72,6 +79,9 @@ tags = [
7279
"Resources: Investigation Guide",
7380
"Data Source: Elastic Endgame",
7481
"Data Source: Elastic Defend",
82+
"Data Source: Sysmon",
83+
"Data Source: Microsoft Defender for Endpoint",
84+
"Data Source: SentinelOne"
7585
]
7686
timestamp_override = "event.ingested"
7787
type = "eql"
@@ -87,15 +97,19 @@ process where host.os.type == "windows" and event.type == "start" and
8797
process.args == "a" and process.args : ("-hp*", "-p*", "/hp*", "/p*")
8898
) or
8999
(
90-
?process.pe.original_file_name in ("7z.exe", "7za.exe") and
100+
(process.name : ("7z.exe", "7za.exe") or ?process.pe.original_file_name in ("7z.exe", "7za.exe")) and
91101
process.args == "a" and process.args : "-p*"
92102
)
93103
) and
94104
not process.parent.executable : (
95105
"C:\\Program Files\\*.exe",
96106
"C:\\Program Files (x86)\\*.exe",
97107
"?:\\ManageEngine\\*\\jre\\bin\\java.exe",
98-
"?:\\Nox\\bin\\Nox.exe"
108+
"?:\\Nox\\bin\\Nox.exe",
109+
"\\Device\\HarddiskVolume?\\Program Files\\*.exe",
110+
"\\Device\\HarddiskVolume?\\Program Files (x86)\\*.exe",
111+
"\\Device\\HarddiskVolume?\\ManageEngine\\*\\jre\\bin\\java.exe",
112+
"\\Device\\HarddiskVolume?\\Nox\\bin\\Nox.exe"
99113
)
100114
'''
101115

‎rules/windows/command_and_control_certreq_postdata.toml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
[metadata]
22
creation_date = "2023/01/13"
3-
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel"]
3+
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
44
maturity = "production"
5-
updated_date = "2024/10/15"
5+
updated_date = "2024/11/02"
66
min_stack_version = "8.14.0"
77
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
88

@@ -48,6 +48,7 @@ index = [
4848
"logs-system.security*",
4949
"logs-m365_defender.event-*",
5050
"logs-sentinel_one_cloud_funnel.*",
51+
"logs-crowdstrike.fdr*",
5152
]
5253
language = "eql"
5354
license = "Elastic License v2"
@@ -122,6 +123,7 @@ tags = [
122123
"Data Source: Microsoft Defender for Endpoint",
123124
"Data Source: Sysmon",
124125
"Data Source: SentinelOne",
126+
"Data Source: Crowdstrike",
125127
]
126128
timestamp_override = "event.ingested"
127129
type = "eql"

‎rules/windows/command_and_control_remote_file_copy_desktopimgdownldr.toml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
[metadata]
22
creation_date = "2020/09/03"
3-
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel"]
3+
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
44
maturity = "production"
5-
updated_date = "2024/10/15"
5+
updated_date = "2024/11/02"
66
min_stack_version = "8.14.0"
77
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
88

@@ -70,7 +70,7 @@ Identifies the desktopimgdownldr utility being used to download a remote file. A
7070
download arbitrary files as an alternative to certutil.
7171
"""
7272
from = "now-9m"
73-
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.forwarded*", "logs-windows.sysmon_operational-*", "endgame-*", "logs-system.security*", "logs-m365_defender.event-*", "logs-sentinel_one_cloud_funnel.*"]
73+
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.forwarded*", "logs-windows.sysmon_operational-*", "endgame-*", "logs-system.security*", "logs-m365_defender.event-*", "logs-sentinel_one_cloud_funnel.*", "logs-crowdstrike.fdr*"]
7474
language = "eql"
7575
license = "Elastic License v2"
7676
name = "Remote File Download via Desktopimgdownldr Utility"
@@ -148,6 +148,7 @@ tags = [
148148
"Data Source: Microsoft Defender for Endpoint",
149149
"Data Source: SentinelOne",
150150
"Data Source: Sysmon",
151+
"Data Source: Crowdstrike",
151152
]
152153
timestamp_override = "event.ingested"
153154
type = "eql"

‎rules/windows/command_and_control_remote_file_copy_mpcmdrun.toml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
[metadata]
22
creation_date = "2020/09/03"
3-
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel"]
3+
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
44
maturity = "production"
5-
updated_date = "2024/10/15"
5+
updated_date = "2024/11/02"
66
min_stack_version = "8.14.0"
77
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
88

@@ -67,7 +67,7 @@ providers = [
6767
author = ["Elastic"]
6868
description = "Identifies the Windows Defender configuration utility (MpCmdRun.exe) being used to download a remote file."
6969
from = "now-9m"
70-
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.forwarded*", "logs-windows.sysmon_operational-*", "endgame-*", "logs-system.security*", "logs-m365_defender.event-*", "logs-sentinel_one_cloud_funnel.*"]
70+
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.forwarded*", "logs-windows.sysmon_operational-*", "endgame-*", "logs-system.security*", "logs-m365_defender.event-*", "logs-sentinel_one_cloud_funnel.*", "logs-crowdstrike.fdr*"]
7171
language = "eql"
7272
license = "Elastic License v2"
7373
name = "Remote File Download via MpCmdRun"
@@ -146,6 +146,7 @@ tags = [
146146
"Data Source: Microsoft Defender for Endpoint",
147147
"Data Source: Sysmon",
148148
"Data Source: SentinelOne",
149+
"Data Source: Crowdstrike",
149150
]
150151
timestamp_override = "event.ingested"
151152
type = "eql"

‎rules/windows/credential_access_copy_ntds_sam_volshadowcp_cmdline.toml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
[metadata]
22
creation_date = "2020/11/24"
3-
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel"]
3+
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
44
maturity = "production"
5-
updated_date = "2024/10/15"
5+
updated_date = "2024/11/02"
66
min_stack_version = "8.14.0"
77
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
88

@@ -48,6 +48,7 @@ index = [
4848
"logs-system.security*",
4949
"logs-m365_defender.event-*",
5050
"logs-sentinel_one_cloud_funnel.*",
51+
"logs-crowdstrike.fdr*",
5152
]
5253
language = "eql"
5354
license = "Elastic License v2"
@@ -129,6 +130,7 @@ tags = [
129130
"Data Source: Microsoft Defender for Endpoint",
130131
"Data Source: SentinelOne",
131132
"Data Source: Sysmon",
133+
"Data Source: Crowdstrike",
132134
]
133135
timestamp_override = "event.ingested"
134136
type = "eql"

‎rules/windows/credential_access_dump_registry_hives.toml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
[metadata]
22
creation_date = "2020/11/23"
3-
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel"]
3+
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
44
maturity = "production"
5-
updated_date = "2024/10/15"
5+
updated_date = "2024/11/02"
66
min_stack_version = "8.14.0"
77
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
88

@@ -19,6 +19,7 @@ index = [
1919
"logs-system.security*",
2020
"logs-m365_defender.event-*",
2121
"logs-sentinel_one_cloud_funnel.*",
22+
"logs-crowdstrike.fdr*",
2223
]
2324
language = "eql"
2425
license = "Elastic License v2"
@@ -81,6 +82,7 @@ tags = [
8182
"Data Source: Microsoft Defender for Endpoint",
8283
"Data Source: SentinelOne",
8384
"Data Source: Sysmon",
85+
"Data Source: Crowdstrike",
8486
]
8587
timestamp_override = "event.ingested"
8688
type = "eql"

‎rules/windows/credential_access_iis_connectionstrings_dumping.toml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
[metadata]
22
creation_date = "2020/08/18"
3-
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel"]
3+
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
44
maturity = "production"
5-
updated_date = "2024/10/15"
5+
updated_date = "2024/11/02"
66
min_stack_version = "8.14.0"
77
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
88

@@ -23,6 +23,7 @@ index = [
2323
"logs-system.security*",
2424
"logs-m365_defender.event-*",
2525
"logs-sentinel_one_cloud_funnel.*",
26+
"logs-crowdstrike.fdr*",
2627
]
2728
language = "eql"
2829
license = "Elastic License v2"
@@ -46,6 +47,7 @@ tags = [
4647
"Data Source: Microsoft Defender for Endpoint",
4748
"Data Source: Sysmon",
4849
"Data Source: SentinelOne",
50+
"Data Source: Crowdstrike",
4951
]
5052
timestamp_override = "event.ingested"
5153
type = "eql"

0 commit comments

Comments
 (0)