Skip to content

Commit 6ed5fb2

Browse files
terrancedejesusterrancedejesus
authored
Merge branch 'main' into new-rule-aws-ssm-command-document-creation
2 parents 9e3da9b + 63956a6 commit 6ed5fb2

13 files changed

+195
-47
lines changed

‎detection_rules/etc/non-ecs-schema.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -150,7 +150,8 @@
150150
"logs-aws.cloudtrail-*": {
151151
"aws.cloudtrail.flattened.request_parameters.cidrIp": "keyword",
152152
"aws.cloudtrail.flattened.request_parameters.fromPort": "keyword",
153-
"aws.cloudtrail.flattened.request_parameters.roleArn": "keyword"
153+
"aws.cloudtrail.flattened.request_parameters.roleArn": "keyword",
154+
"aws.cloudtrail.flattened.request_parameters.serialNumber": "keyword"
154155
},
155156
"logs-azure.signinlogs-*": {
156157
"azure.signinlogs.properties.conditional_access_audiences.application_id": "keyword"

‎rules/integrations/aws/impact_iam_deactivate_mfa_device.toml‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
creation_date = "2020/05/26"
33
integration = ["aws"]
44
maturity = "production"
5-
updated_date = "2024/05/21"
5+
updated_date = "2024/10/25"
66

77
[rule]
88
author = ["Elastic", "Austin Songer"]
@@ -80,6 +80,7 @@ tags = [
8080
"Data Source: AWS IAM",
8181
"Resources: Investigation Guide",
8282
"Tactic: Impact",
83+
"Tactic: Persistence",
8384
]
8485
timestamp_override = "event.ingested"
8586
type = "query"
@@ -101,4 +102,19 @@ reference = "https://attack.mitre.org/techniques/T1531/"
101102
id = "TA0040"
102103
name = "Impact"
103104
reference = "https://attack.mitre.org/tactics/TA0040/"
105+
[[rule.threat]]
106+
framework = "MITRE ATT&CK"
107+
[[rule.threat.technique]]
108+
id = "T1556"
109+
name = "Modify Authentication Process"
110+
reference = "https://attack.mitre.org/techniques/T1556/"
111+
[[rule.threat.technique.subtechnique]]
112+
id = "T1556.006"
113+
name = "Multi-Factor Authentication"
114+
reference = "https://attack.mitre.org/techniques/T1556/006/"
104115

116+
117+
[rule.threat.tactic]
118+
id = "TA0003"
119+
name = "Persistence"
120+
reference = "https://attack.mitre.org/tactics/TA0003/"

‎rules/integrations/aws/persistence_sts_assume_role_with_new_mfa.toml‎

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
[metadata]
2+
creation_date = "2024/10/25"
3+
integration = ["aws"]
4+
maturity = "production"
5+
updated_date = "2024/10/25"
6+
7+
8+
[rule]
9+
author = ["Elastic"]
10+
description = """
11+
Identifies when a user has assumed a role using a new MFA device. Users can assume a role to obtain temporary credentials and access AWS resources using the AssumeRole API of AWS Security Token Service (STS).
12+
While a new MFA device is not always indicative of malicious behavior it should be verified as adversaries can use this technique for persistence and privilege escalation.
13+
"""
14+
false_positives = [
15+
"AWS administrators or automated processes might regularly assume roles for legitimate administrative purposes and to perform periodic tasks such as data backups, updates, or deployments.",
16+
]
17+
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
18+
language = "kuery"
19+
license = "Elastic License v2"
20+
name = "AWS STS AssumeRole with New MFA Device"
21+
note = """## Setup
22+
23+
The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
24+
references = [
25+
"https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html",
26+
"https://github.com/RhinoSecurityLabs/cloudgoat/blob/d5863b80afd082d853f2e8df1955c6393695a4da/scenarios/iam_privesc_by_key_rotation/README.md",
27+
]
28+
risk_score = 21
29+
rule_id = "a22f566b-5b23-4412-880d-c6c957acd321"
30+
severity = "low"
31+
tags = [
32+
"Domain: Cloud",
33+
"Data Source: AWS",
34+
"Data Source: Amazon Web Services",
35+
"Data Source: AWS STS",
36+
"Use Case: Identity and Access Audit",
37+
"Tactic: Privilege Escalation",
38+
"Tactic: Persistence",
39+
"Tactic: Lateral Movement",
40+
]
41+
timestamp_override = "event.ingested"
42+
type = "new_terms"
43+
44+
query = '''
45+
event.dataset:aws.cloudtrail
46+
and event.provider:sts.amazonaws.com
47+
and event.action:(AssumeRole or AssumeRoleWithSAML or AssumeRoleWithWebIdentity)
48+
and event.outcome:success
49+
and user.id:*
50+
and aws.cloudtrail.flattened.request_parameters.serialNumber:*
51+
'''
52+
53+
54+
[[rule.threat]]
55+
framework = "MITRE ATT&CK"
56+
[[rule.threat.technique]]
57+
id = "T1556"
58+
name = "Modify Authentication Process"
59+
reference = "https://attack.mitre.org/techniques/T1556/"
60+
[[rule.threat.technique.subtechnique]]
61+
id = "T1556.006"
62+
name = "Multi-Factor Authentication"
63+
reference = "https://attack.mitre.org/techniques/T1556/006/"
64+
65+
66+
[rule.threat.tactic]
67+
id = "TA0003"
68+
name = "Persistence"
69+
reference = "https://attack.mitre.org/tactics/TA0003/"
70+
[[rule.threat]]
71+
framework = "MITRE ATT&CK"
72+
[[rule.threat.technique]]
73+
id = "T1548"
74+
name = "Abuse Elevation Control Mechanism"
75+
reference = "https://attack.mitre.org/techniques/T1548/"
76+
77+
78+
[rule.threat.tactic]
79+
id = "TA0004"
80+
name = "Privilege Escalation"
81+
reference = "https://attack.mitre.org/tactics/TA0004/"
82+
[[rule.threat]]
83+
framework = "MITRE ATT&CK"
84+
[[rule.threat.technique]]
85+
id = "T1550"
86+
name = "Use Alternate Authentication Material"
87+
reference = "https://attack.mitre.org/techniques/T1550/"
88+
[[rule.threat.technique.subtechnique]]
89+
id = "T1550.001"
90+
name = "Application Access Token"
91+
reference = "https://attack.mitre.org/techniques/T1550/001/"
92+
93+
94+
[rule.threat.tactic]
95+
id = "TA0008"
96+
name = "Lateral Movement"
97+
reference = "https://attack.mitre.org/tactics/TA0008/"
98+
99+
[rule.new_terms]
100+
field = "new_terms_fields"
101+
value = ["user.id", "aws.cloudtrail.flattened.request_parameters.serialNumber"]
102+
[[rule.new_terms.history_window_start]]
103+
field = "history_window_start"
104+
value = "now-10d"
105+
106+

‎rules/windows/execution_windows_powershell_susp_args.toml‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
[metadata]
22
creation_date = "2024/09/06"
3-
integration = ["windows", "system", "sentinel_one_cloud_funnel", "m365_defender"]
3+
integration = ["windows", "system", "sentinel_one_cloud_funnel", "m365_defender", "crowdstrike"]
44
maturity = "production"
55
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
66
min_stack_version = "8.14.0"
7-
updated_date = "2024/10/15"
7+
updated_date = "2024/10/31"
88

99
[rule]
1010
author = ["Elastic"]
@@ -19,7 +19,8 @@ index = [
1919
"logs-system.security*",
2020
"logs-windows.sysmon_operational-*",
2121
"logs-sentinel_one_cloud_funnel.*",
22-
"logs-m365_defender.event-*"
22+
"logs-m365_defender.event-*",
23+
"logs-crowdstrike.fdr*"
2324
]
2425
language = "eql"
2526
license = "Elastic License v2"
@@ -35,7 +36,8 @@ tags = [
3536
"Data Source: System",
3637
"Data Source: Sysmon",
3738
"Data Source: SentinelOne",
38-
"Data Source: Microsoft Defender for Endpoint"
39+
"Data Source: Microsoft Defender for Endpoint",
40+
"Data Source: Crowdstrike"
3941
]
4042
timestamp_override = "event.ingested"
4143
type = "eql"

‎rules/windows/impact_volume_shadow_copy_deletion_via_powershell.toml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
[metadata]
22
creation_date = "2021/07/19"
3-
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel"]
3+
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
44
maturity = "production"
5-
updated_date = "2024/10/15"
5+
updated_date = "2024/10/31"
66
min_stack_version = "8.14.0"
77
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
88

@@ -22,6 +22,7 @@ index = [
2222
"logs-system.security*",
2323
"logs-m365_defender.event-*",
2424
"logs-sentinel_one_cloud_funnel.*",
25+
"logs-crowdstrike.fdr*",
2526
]
2627
language = "eql"
2728
license = "Elastic License v2"
@@ -103,6 +104,7 @@ tags = [
103104
"Data Source: Microsoft Defender for Endpoint",
104105
"Data Source: Sysmon",
105106
"Data Source: SentinelOne",
107+
"Data Source: Crowdstrike",
106108
]
107109
timestamp_override = "event.ingested"
108110
type = "eql"

‎rules/windows/initial_access_execution_from_inetcache.toml‎

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
[metadata]
22
creation_date = "2024/02/14"
3-
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel"]
3+
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
44
maturity = "production"
5-
updated_date = "2024/10/15"
5+
updated_date = "2024/10/31"
66
min_stack_version = "8.14.0"
77
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
88

@@ -22,6 +22,7 @@ index = [
2222
"logs-system.security*",
2323
"logs-m365_defender.event-*",
2424
"logs-sentinel_one_cloud_funnel.*",
25+
"logs-crowdstrike.fdr*",
2526
]
2627
language = "eql"
2728
license = "Elastic License v2"
@@ -44,15 +45,21 @@ tags = [
4445
"Data Source: Microsoft Defender for Endpoint",
4546
"Data Source: Sysmon",
4647
"Data Source: SentinelOne",
48+
"Data Source: Crowdstrike",
4749
]
4850
timestamp_override = "event.ingested"
4951
type = "eql"
5052

5153
query = '''
5254
process where host.os.type == "windows" and event.type == "start" and
53-
process.parent.name : ("explorer.exe", "winrar.exe", "7zFM.exe", "Bandizip.exe") and
54-
(process.args : "?:\\Users\\*\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\*" or
55-
process.executable : "?:\\Users\\*\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\*")
55+
process.parent.name : ("explorer.exe", "winrar.exe", "7zFM.exe", "Bandizip.exe") and
56+
(
57+
process.args : "?:\\Users\\*\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\*" or
58+
process.executable : (
59+
"?:\\Users\\*\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\*",
60+
"\\Device\\HarddiskVolume?\\Users\\*\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\*"
61+
)
62+
)
5663
'''
5764

5865

‎rules/windows/initial_access_suspicious_ms_exchange_process.toml‎

Lines changed: 24 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
[metadata]
22
creation_date = "2021/03/04"
3-
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel"]
3+
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
44
maturity = "production"
5-
updated_date = "2024/10/15"
5+
updated_date = "2024/10/31"
66
min_stack_version = "8.14.0"
77
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
88

@@ -28,6 +28,7 @@ index = [
2828
"logs-system.security*",
2929
"logs-m365_defender.event-*",
3030
"logs-sentinel_one_cloud_funnel.*",
31+
"logs-crowdstrike.fdr*",
3132
]
3233
language = "eql"
3334
license = "Elastic License v2"
@@ -52,23 +53,34 @@ tags = [
5253
"Data Source: Microsoft Defender for Endpoint",
5354
"Data Source: Sysmon",
5455
"Data Source: SentinelOne",
56+
"Data Source: Crowdstrike",
5557
]
5658
timestamp_override = "event.ingested"
5759
type = "eql"
5860

5961
query = '''
6062
process where host.os.type == "windows" and event.type == "start" and
6163
process.parent.name : ("UMService.exe", "UMWorkerProcess.exe") and
62-
not process.executable :
63-
("?:\\Windows\\System32\\werfault.exe",
64-
"?:\\Windows\\System32\\wermgr.exe",
65-
"?:\\Program Files\\Microsoft\\Exchange Server\\V??\\Bin\\UMWorkerProcess.exe",
66-
"?:\\Program Files\\Microsoft\\Exchange Server\\Bin\\UMWorkerProcess.exe",
67-
"D:\\Exchange 2016\\Bin\\UMWorkerProcess.exe",
68-
"E:\\ExchangeServer\\Bin\\UMWorkerProcess.exe",
69-
"D:\\Exchange\\Bin\\UMWorkerProcess.exe",
70-
"D:\\Exchange Server\\Bin\\UMWorkerProcess.exe",
71-
"E:\\Exchange Server\\V15\\Bin\\UMWorkerProcess.exe")
64+
not process.executable : (
65+
"?:\\Windows\\System32\\werfault.exe",
66+
"?:\\Windows\\System32\\wermgr.exe",
67+
"?:\\Program Files\\Microsoft\\Exchange Server\\V??\\Bin\\UMWorkerProcess.exe",
68+
"?:\\Program Files\\Microsoft\\Exchange Server\\Bin\\UMWorkerProcess.exe",
69+
"D:\\Exchange 2016\\Bin\\UMWorkerProcess.exe",
70+
"E:\\ExchangeServer\\Bin\\UMWorkerProcess.exe",
71+
"D:\\Exchange\\Bin\\UMWorkerProcess.exe",
72+
"D:\\Exchange Server\\Bin\\UMWorkerProcess.exe",
73+
"E:\\Exchange Server\\V15\\Bin\\UMWorkerProcess.exe",
74+
"\\Device\\HarddiskVolume?\\Windows\\System32\\werfault.exe",
75+
"\\Device\\HarddiskVolume?\\Windows\\System32\\wermgr.exe",
76+
"\\Device\\HarddiskVolume?\\Program Files\\Microsoft\\Exchange Server\\V??\\Bin\\UMWorkerProcess.exe",
77+
"\\Device\\HarddiskVolume?\\Program Files\\Microsoft\\Exchange Server\\Bin\\UMWorkerProcess.exe",
78+
"\\Device\\HarddiskVolume?\\Exchange 2016\\Bin\\UMWorkerProcess.exe",
79+
"\\Device\\HarddiskVolume?\\ExchangeServer\\Bin\\UMWorkerProcess.exe",
80+
"\\Device\\HarddiskVolume?\\Exchange\\Bin\\UMWorkerProcess.exe",
81+
"\\Device\\HarddiskVolume?\\Exchange Server\\Bin\\UMWorkerProcess.exe",
82+
"\\Device\\HarddiskVolume?\\Exchange Server\\V15\\Bin\\UMWorkerProcess.exe"
83+
)
7284
'''
7385

7486

‎rules/windows/initial_access_suspicious_ms_office_child_process.toml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
[metadata]
22
creation_date = "2020/02/18"
3-
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel"]
3+
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
44
maturity = "production"
5-
updated_date = "2024/10/15"
5+
updated_date = "2024/10/31"
66
min_stack_version = "8.14.0"
77
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
88

@@ -23,6 +23,7 @@ index = [
2323
"logs-system.security*",
2424
"logs-m365_defender.event-*",
2525
"logs-sentinel_one_cloud_funnel.*",
26+
"logs-crowdstrike.fdr*",
2627
]
2728
language = "eql"
2829
license = "Elastic License v2"
@@ -92,6 +93,7 @@ tags = [
9293
"Data Source: Microsoft Defender for Endpoint",
9394
"Data Source: Sysmon",
9495
"Data Source: SentinelOne",
96+
"Data Source: Crowdstrike",
9597
]
9698
timestamp_override = "event.ingested"
9799
type = "eql"

‎rules/windows/initial_access_suspicious_ms_outlook_child_process.toml‎

Lines changed: 4 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
[metadata]
22
creation_date = "2020/02/18"
3-
integration = ["endpoint", "windows", "system", "sentinel_one_cloud_funnel", "m365_defender"]
3+
integration = ["endpoint", "windows", "system", "sentinel_one_cloud_funnel", "m365_defender", "crowdstrike"]
44
maturity = "production"
55
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
66
min_stack_version = "8.14.0"
7-
updated_date = "2024/10/15"
7+
updated_date = "2024/10/31"
88

99
[rule]
1010
author = ["Elastic"]
@@ -13,7 +13,7 @@ Identifies suspicious child processes of Microsoft Outlook. These child processe
1313
phishing activity.
1414
"""
1515
from = "now-9m"
16-
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.*", "endgame-*", "logs-system.security*", "logs-sentinel_one_cloud_funnel.*", "logs-m365_defender.event-*"]
16+
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.*", "endgame-*", "logs-system.security*", "logs-sentinel_one_cloud_funnel.*", "logs-m365_defender.event-*", "logs-crowdstrike.fdr*"]
1717
language = "eql"
1818
license = "Elastic License v2"
1919
name = "Suspicious MS Outlook Child Process"
@@ -66,16 +66,8 @@ This rule looks for suspicious processes spawned by MS Outlook, which can be the
6666
"""
6767
risk_score = 21
6868
rule_id = "32f4675e-6c49-4ace-80f9-97c9259dca2e"
69-
setup = """## Setup
70-
71-
If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
72-
events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
73-
Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
74-
`event.ingested` to @timestamp.
75-
For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
76-
"""
7769
severity = "low"
78-
tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Initial Access", "Tactic: Defense Evasion", "Tactic: Execution", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend", "Data Source: SentinelOne", "Data Source: Microsoft Defender for Endpoint", "Data Source: System"]
70+
tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Initial Access", "Tactic: Defense Evasion", "Tactic: Execution", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend", "Data Source: SentinelOne", "Data Source: Microsoft Defender for Endpoint", "Data Source: System", "Data Source: Crowdstrike"]
7971
timestamp_override = "event.ingested"
8072
type = "eql"
8173

0 commit comments

Comments
 (0)