Skip to content

Commit 825a6a0

Browse files
AegrahAegrah
authored
Merge branch 'main' into new-rule-general-web-server-sus-command-exec-new-terms
2 parents 9ce3947 + 02979fe commit 825a6a0

5 files changed

+404
-16
lines changed

rules/linux/command_and_control_curl_wget_spawn_via_nodejs_parent.toml renamed to rules/cross-platform/command_and_control_curl_wget_spawn_via_nodejs_parent.toml

Lines changed: 32 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
[metadata]
22
creation_date = "2025/09/18"
3-
integration = ["endpoint", "crowdstrike"]
3+
integration = ["endpoint", "windows", "system", "sentinel_one_cloud_funnel", "crowdstrike", "auditd_manager"]
44
maturity = "production"
5-
updated_date = "2025/10/17"
5+
updated_date = "2025/11/26"
66

77
[rule]
88
author = ["Elastic"]
@@ -12,7 +12,18 @@ command and control behavior. Adversaries may use Node.js to download additional
1212
the system.
1313
"""
1414
from = "now-9m"
15-
index = ["logs-endpoint.events.process*", "logs-crowdstrike.fdr*"]
15+
index = [
16+
"endgame-*",
17+
"logs-crowdstrike.fdr*",
18+
"logs-endpoint.events.process-*",
19+
"logs-sentinel_one_cloud_funnel.*",
20+
"logs-system.security*",
21+
"logs-windows.forwarded*",
22+
"logs-windows.sysmon_operational-*",
23+
"winlogbeat-*",
24+
"auditbeat-*",
25+
"logs-auditd_manager.auditd-*"
26+
]
1627
language = "eql"
1728
license = "Elastic License v2"
1829
name = "Curl or Wget Spawned via Node.js"
@@ -46,7 +57,7 @@ This rule flags Node.js launching curl or wget, directly or via a shell, a commo
4657
- Rebuild and redeploy the workload from a known-good image, remove the malicious child_process code path from the Node.js application, restore validated configs/data, rotate any keys or tokens used by that service, and verify no further curl/wget spawns occur post-recovery.
4758
- Harden by removing curl/wget from runtime images where not required, enforcing egress allowlists for the service, constraining execution with AppArmor/SELinux/seccomp and least-privilege service accounts, and adding CI/CD checks to block package.json postinstall scripts or code that shells out to downloaders.
4859
"""
49-
risk_score = 21
60+
risk_score = 47
5061
rule_id = "d9af2479-ad13-4471-a312-f586517f1243"
5162
setup = """## Setup
5263
@@ -73,28 +84,38 @@ For more details on Elastic Agent configuration settings, refer to the [helper g
7384
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
7485
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
7586
"""
76-
severity = "low"
87+
severity = "medium"
7788
tags = [
7889
"Domain: Endpoint",
7990
"OS: Linux",
91+
"OS: Windows",
92+
"OS: macOS",
8093
"Use Case: Threat Detection",
8194
"Tactic: Command and Control",
82-
"Data Source: Elastic Defend",
8395
"Resources: Investigation Guide",
96+
"Data Source: Elastic Defend",
97+
"Data Source: Elastic Endgame",
98+
"Data Source: Windows Security Event Logs",
99+
"Data Source: Sysmon",
100+
"Data Source: SentinelOne",
84101
"Data Source: Crowdstrike",
102+
"Data Source: Auditd Manager",
85103
]
86104
timestamp_override = "event.ingested"
87105
type = "eql"
88106
query = '''
89-
process where host.os.type == "linux" and event.type == "start" and event.action in ("exec", "ProcessRollup2") and process.parent.name == "node" and (
107+
process where event.type == "start" and
108+
event.action in ("exec", "exec_event", "start", "ProcessRollup2", "executed", "process_started") and
109+
process.parent.name in ("node", "bun", "node.exe", "bun.exe") and (
90110
(
91-
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and
92-
process.args == "-c" and process.command_line like~ ("*curl*", "*wget*")
111+
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "cmd.exe", "bash.exe", "powershell.exe") and
112+
process.command_line like~ ("*curl*http*", "*wget*http*")
93113
) or
94114
(
95-
process.name in ("curl", "wget")
115+
process.name in ("curl", "wget", "curl.exe", "wget.exe")
96116
)
97-
)
117+
) and
118+
not process.command_line like ("*127.0.0.1*", "*localhost*")
98119
'''
99120

100121
[[rule.threat]]

‎rules/cross-platform/credential_access_trufflehog_execution.toml‎

Lines changed: 24 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
[metadata]
22
creation_date = "2025/09/18"
3-
integration = ["endpoint"]
3+
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike", "auditd_manager"]
44
maturity = "production"
5-
updated_date = "2025/11/25"
5+
updated_date = "2025/11/26"
66

77
[rule]
88
author = ["Elastic"]
@@ -19,7 +19,19 @@ false_positives = [
1919
""",
2020
]
2121
from = "now-9m"
22-
index = ["logs-endpoint.events.process-*"]
22+
index = [
23+
"endgame-*",
24+
"logs-crowdstrike.fdr*",
25+
"logs-endpoint.events.process-*",
26+
"logs-m365_defender.event-*",
27+
"logs-sentinel_one_cloud_funnel.*",
28+
"logs-system.security*",
29+
"logs-windows.forwarded*",
30+
"logs-windows.sysmon_operational-*",
31+
"winlogbeat-*",
32+
"auditbeat-*",
33+
"logs-auditd_manager.auditd-*"
34+
]
2335
language = "eql"
2436
license = "Elastic License v2"
2537
name = "Credential Access via TruffleHog Execution"
@@ -58,17 +70,24 @@ references = [
5870
"https://www.elastic.co/blog/shai-hulud-worm-npm-supply-chain-compromise",
5971
"https://socket.dev/blog/shai-hulud-strikes-again-v2",
6072
]
61-
risk_score = 21
73+
risk_score = 47
6274
rule_id = "47595dea-452b-4d37-b82d-6dd691325139"
63-
severity = "low"
75+
severity = "medium"
6476
tags = [
6577
"Domain: Endpoint",
6678
"OS: Linux",
6779
"OS: Windows",
6880
"OS: macOS",
6981
"Use Case: Threat Detection",
7082
"Tactic: Credential Access",
83+
"Data Source: Elastic Endgame",
7184
"Data Source: Elastic Defend",
85+
"Data Source: Windows Security Event Logs",
86+
"Data Source: Microsoft Defender for Endpoint",
87+
"Data Source: Sysmon",
88+
"Data Source: SentinelOne",
89+
"Data Source: Crowdstrike",
90+
"Data Source: Auditd Manager",
7291
"Resources: Investigation Guide",
7392
]
7493
timestamp_override = "event.ingested"

‎rules/cross-platform/execution_register_github_actions_runner.toml‎

Lines changed: 126 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,126 @@
1+
[metadata]
2+
creation_date = "2025/11/26"
3+
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike", "auditd_manager"]
4+
maturity = "production"
5+
updated_date = "2025/11/26"
6+
7+
[rule]
8+
author = ["Elastic"]
9+
description = """
10+
This rule detects the configuration of a GitHub Actions self-hosted runner using the Runner.Listener binary.
11+
When a machine is registered to a remote repository, its owner gains the ability to execute arbitrary workflow commands on that host.
12+
Unexpected or unauthorized runner registration may indicate adversarial activity aimed at establishing remote code execution
13+
via malicious GitHub workflows.
14+
"""
15+
false_positives = [
16+
"Authorized github repository with no malicious workflow actions.",
17+
]
18+
from = "now-9m"
19+
index = [
20+
"endgame-*",
21+
"logs-crowdstrike.fdr*",
22+
"logs-endpoint.events.process-*",
23+
"logs-m365_defender.event-*",
24+
"logs-sentinel_one_cloud_funnel.*",
25+
"logs-system.security*",
26+
"logs-windows.forwarded*",
27+
"logs-windows.sysmon_operational-*",
28+
"winlogbeat-*",
29+
"auditbeat-*",
30+
"logs-auditd_manager.auditd-*"
31+
]
32+
language = "eql"
33+
license = "Elastic License v2"
34+
name = "Remote GitHub Actions Runner Registration"
35+
note = """## Triage and analysis
36+
37+
### Investigating Remote GitHub Actions Runner Registration
38+
39+
Unexpected or unauthorized Github actions runner registration may indicate adversarial activity aimed at establishing remote code execution via malicious GitHub workflows.
40+
41+
### Possible investigation steps
42+
43+
- Review the remote repository details and reputation.
44+
- Examine the remote repository for any suspicious workflows run commands in the `.github/workflows` folder.
45+
- Examine the execution context like process tree, associated network and file activities.
46+
- Verify if there is adjascent any sensitive file access or collection.
47+
- Correlate with other alerts and investiguate if this activity is related to a supply chain attack.
48+
49+
### False positive analysis
50+
51+
- Authorized configuration changes.
52+
53+
### Response and remediation
54+
55+
- Immediately isolate the affected system from the network to prevent further unauthorized command execution and potential lateral movement.
56+
- Terminate any suspicious child processes that were initiated by the registered Github actions runner.
57+
- Conduct a thorough review of the affected system's logs and configurations to identify any unauthorized changes or additional indicators of compromise.
58+
- Restore the system from a known good backup if any unauthorized changes or malicious activities are confirmed.
59+
- Implement application whitelisting to prevent unauthorized execution.
60+
- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to assess the potential impact on the broader network."""
61+
references = [
62+
"https://www.elastic.co/blog/shai-hulud-worm-npm-supply-chain-compromise",
63+
"https://socket.dev/blog/shai-hulud-strikes-again-v2",
64+
]
65+
risk_score = 47
66+
rule_id = "57e118c1-19eb-4c20-93a6-8a6c30a5b48b"
67+
severity = "medium"
68+
tags = [
69+
"Domain: Endpoint",
70+
"OS: Linux",
71+
"OS: Windows",
72+
"OS: macOS",
73+
"Use Case: Threat Detection",
74+
"Tactic: Execution",
75+
"Tactic: Initial Access",
76+
"Data Source: Elastic Endgame",
77+
"Data Source: Elastic Defend",
78+
"Data Source: Windows Security Event Logs",
79+
"Data Source: Microsoft Defender for Endpoint",
80+
"Data Source: Sysmon",
81+
"Data Source: SentinelOne",
82+
"Data Source: Crowdstrike",
83+
"Data Source: Auditd Manager",
84+
"Resources: Investigation Guide",
85+
]
86+
timestamp_override = "event.ingested"
87+
type = "eql"
88+
89+
query = '''
90+
process where event.type == "start" and event.action in ("exec", "exec_event", "start", "ProcessRollup2", "executed", "process_started") and
91+
process.name in ("Runner.Listener", "Runner.Listener.exe") and
92+
process.args == "configure" and process.args == "--url" and process.args == "--token"
93+
'''
94+
95+
96+
[[rule.threat]]
97+
framework = "MITRE ATT&CK"
98+
[[rule.threat.technique]]
99+
id = "T1059"
100+
name = "Command and Scripting Interpreter"
101+
reference = "https://attack.mitre.org/techniques/T1059/"
102+
103+
104+
105+
[rule.threat.tactic]
106+
id = "TA0002"
107+
name = "Execution"
108+
reference = "https://attack.mitre.org/tactics/TA0002/"
109+
[[rule.threat]]
110+
framework = "MITRE ATT&CK"
111+
[[rule.threat.technique]]
112+
id = "T1195"
113+
name = "Supply Chain Compromise"
114+
reference = "https://attack.mitre.org/techniques/T1195/"
115+
[[rule.threat.technique.subtechnique]]
116+
id = "T1195.002"
117+
name = "Compromise Software Supply Chain"
118+
reference = "https://attack.mitre.org/techniques/T1195/002/"
119+
120+
121+
122+
[rule.threat.tactic]
123+
id = "TA0001"
124+
name = "Initial Access"
125+
reference = "https://attack.mitre.org/tactics/TA0001/"
126+

0 commit comments

Comments
 (0)