Skip to content

Commit 8522cf4

Browse files
lowercase all functions and logical operators
1 parent a5a5f01 commit 8522cf4

File tree

74 files changed

+1257
-1311
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

74 files changed

+1257
-1311
lines changed

rules/cross-platform/execution_potential_widespread_malware_infection.toml

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,6 @@ from logs-endpoint.alerts-*
6969
| keep host.id, rule.name, event.code
7070
| stats Esql.host_id_count_distinct = count_distinct(host.id) by rule.name, event.code
7171
| where Esql.host_id_count_distinct >= 3
72-
7372
'''
7473

7574

rules/cross-platform/initial_access_azure_o365_with_network_alert.toml

Lines changed: 19 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -77,14 +77,14 @@ timestamp_override = "event.ingested"
7777
type = "esql"
7878

7979
query = '''
80-
FROM logs-*, .alerts-security.*
80+
from logs-*, .alerts-security.*
8181
// query runs every 1 hour looking for activities occurred during last 8 hours to match on disparate events
82-
| where @timestamp > NOW() - 8 hours
83-
// filter for Azure or M365 sign-in and External Alerts with source.ip not null
84-
| where TO_IP(source.ip) is not null
82+
| where @timestamp > now() - 8 hours
83+
// filter for azure or m365 sign-in and external alerts with source.ip not null
84+
| where to_ip(source.ip) is not null
8585
and (event.dataset in ("o365.audit", "azure.signinlogs") or kibana.alert.rule.name == "External Alerts")
86-
and not CIDR_MATCH(
87-
TO_IP(source.ip),
86+
and not cidr_match(
87+
to_ip(source.ip),
8888
"10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.0.0/29",
8989
"192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
9090
"192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4",
@@ -95,31 +95,30 @@ FROM logs-*, .alerts-security.*
9595
// capture relevant raw fields
9696
| keep source.ip, event.action, event.outcome, event.dataset, kibana.alert.rule.name, event.category
9797
98-
// classify each source IP based on alert type
98+
// classify each source ip based on alert type
9999
| eval
100-
Esql.source_ip_mail_access_case = case(event.dataset == "o365.audit" and event.action == "MailItemsAccessed" and event.outcome == "success", TO_IP(source.ip), null),
101-
Esql.source_ip_azure_signin_case = case(event.dataset == "azure.signinlogs" and event.outcome == "success", TO_IP(source.ip), null),
102-
Esql.source_ip_network_alert_case = case(kibana.alert.rule.name == "External Alerts" and not event.dataset in ("o365.audit", "azure.signinlogs"), TO_IP(source.ip), null)
100+
Esql.source_ip_mail_access_case = case(event.dataset == "o365.audit" and event.action == "MailItemsAccessed" and event.outcome == "success", to_ip(source.ip), null),
101+
Esql.source_ip_azure_signin_case = case(event.dataset == "azure.signinlogs" and event.outcome == "success", to_ip(source.ip), null),
102+
Esql.source_ip_network_alert_case = case(kibana.alert.rule.name == "external alerts" and not event.dataset in ("o365.audit", "azure.signinlogs"), to_ip(source.ip), null)
103103
104-
// aggregate by source IP
104+
// aggregate by source ip
105105
| stats
106106
Esql.event_count = count(*),
107-
Esql.source_ip_mail_access_case_count_distinct = COUNT_DISTINCT(Esql.source_ip_mail_access_case),
108-
Esql.source_ip_azure_signin_case_count_distinct = COUNT_DISTINCT(Esql.source_ip_azure_signin_case),
109-
Esql.source_ip_network_alert_case_count_distinct = COUNT_DISTINCT(Esql.source_ip_network_alert_case),
110-
Esql.event_dataset_count_distinct = COUNT_DISTINCT(event.dataset),
111-
Esql.event_dataset_values = VALUES(event.dataset),
112-
Esql.kibana_alert_rule_name_values = VALUES(kibana.alert.rule.name),
113-
Esql.event_category_values = VALUES(event.category)
114-
by Esql.source_ip = TO_IP(source.ip)
107+
Esql.source_ip_mail_access_case_count_distinct = count_distinct(Esql.source_ip_mail_access_case),
108+
Esql.source_ip_azure_signin_case_count_distinct = count_distinct(Esql.source_ip_azure_signin_case),
109+
Esql.source_ip_network_alert_case_count_distinct = count_distinct(Esql.source_ip_network_alert_case),
110+
Esql.event_dataset_count_distinct = count_distinct(event.dataset),
111+
Esql.event_dataset_values = values(event.dataset),
112+
Esql.kibana_alert_rule_name_values = values(kibana.alert.rule.name),
113+
Esql.event_category_values = values(event.category)
114+
by Esql.source_ip = to_ip(source.ip)
115115
116116
// correlation condition
117117
| where
118118
Esql.source_ip_network_alert_case_count_distinct > 0
119119
and Esql.event_dataset_count_distinct >= 2
120120
and (Esql.source_ip_mail_access_case_count_distinct > 0 or Esql.source_ip_azure_signin_case_count_distinct > 0)
121121
and Esql.event_count <= 100
122-
123122
'''
124123

125124

rules/integrations/aws/discovery_ec2_multi_region_describe_instances.toml

Lines changed: 8 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -86,39 +86,38 @@ timestamp_override = "event.ingested"
8686
type = "esql"
8787

8888
query = '''
89-
FROM logs-aws.cloudtrail-*
89+
from logs-aws.cloudtrail-*
9090
9191
// filter for DescribeInstances API calls
9292
| where event.dataset == "aws.cloudtrail"
9393
and event.provider == "ec2.amazonaws.com"
9494
and event.action == "DescribeInstances"
9595
9696
// truncate the timestamp to a 30-second window
97-
| eval Esql.time_window_date_trunc = DATE_TRUNC(30 seconds, @timestamp)
97+
| eval Esql.time_window_date_trunc = date_trunc(30 seconds, @timestamp)
9898
9999
// keep only the relevant raw fields
100100
| keep Esql.time_window_date_trunc, aws.cloudtrail.user_identity.arn, cloud.region
101101
102102
// count the number of unique regions and total API calls within the 30-second window
103103
| stats
104-
Esql.cloud_region_count_distinct = COUNT_DISTINCT(cloud.region),
105-
Esql.event_count = COUNT(*)
104+
Esql.cloud_region_count_distinct = count_distinct(cloud.region),
105+
Esql.event_count = count(*)
106106
by Esql.time_window_date_trunc, aws.cloudtrail.user_identity.arn
107107
108108
// filter for resources making DescribeInstances API calls in more than 10 regions within the 30-second window
109109
| where Esql.cloud_region_count_distinct >= 10 and Esql.event_count >= 10
110110
111111
// sort the results by time window in descending order
112112
| sort Esql.time_window_date_trunc desc
113-
114113
'''
115114

116115
[rule.investigation_fields]
117116
field_names = [
118-
"aws.cloudtrail.user_identity.arn",
119-
"target_time_window",
120-
"region_count",
121-
"window_count"
117+
"aws.cloudtrail.user_identity.arn",
118+
"target_time_window",
119+
"region_count",
120+
"window_count"
122121
]
123122

124123
[[rule.threat]]

rules/integrations/aws/discovery_ec2_multiple_discovery_api_calls_via_cli.toml

Lines changed: 8 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -80,10 +80,10 @@ timestamp_override = "event.ingested"
8080
type = "esql"
8181

8282
query = '''
83-
FROM logs-aws.cloudtrail*
83+
from logs-aws.cloudtrail*
8484
8585
// create time window buckets of 10 seconds
86-
| eval Esql.time_window_date_trunc = DATE_TRUNC(10 seconds, @timestamp)
86+
| eval Esql.time_window_date_trunc = date_trunc(10 seconds, @timestamp)
8787
| where
8888
event.dataset == "aws.cloudtrail"
8989
@@ -111,30 +111,29 @@ FROM logs-aws.cloudtrail*
111111
112112
// filter for Describe, Get, List, and Generate API calls
113113
| where true in (
114-
STARTS_WITH(event.action, "Describe"),
115-
STARTS_WITH(event.action, "Get"),
116-
STARTS_WITH(event.action, "List"),
117-
STARTS_WITH(event.action, "Generate")
114+
starts_with(event.action, "Describe"),
115+
starts_with(event.action, "Get"),
116+
starts_with(event.action, "List"),
117+
starts_with(event.action, "Generate")
118118
)
119119
120120
// extract owner, identity type, and actor from the ARN
121121
| dissect aws.cloudtrail.user_identity.arn "%{}::%{Esql_priv.aws_cloudtrail_user_identity_arn_owner}:%{Esql.aws_cloudtrail_user_identity_arn_type}/%{Esql.aws_cloudtrail_user_identity_arn_roles}"
122-
| where STARTS_WITH(Esql.aws_cloudtrail_user_identity_arn_roles, "AWSServiceRoleForConfig") != true
122+
| where starts_with(Esql.aws_cloudtrail_user_identity_arn_roles, "AWSServiceRoleForConfig") != true
123123
124124
// keep relevant fields (preserving ECS fields and computed time window)
125125
| keep @timestamp, Esql.time_window_date_trunc, event.action, aws.cloudtrail.user_identity.arn
126126
127127
// count the number of unique API calls per time window and actor
128128
| stats
129-
Esql.event_action_count_distinct = COUNT_DISTINCT(event.action)
129+
Esql.event_action_count_distinct = count_distinct(event.action)
130130
by Esql.time_window_date_trunc, aws.cloudtrail.user_identity.arn
131131
132132
// filter for more than 5 unique API calls per 10s window
133133
| where Esql.event_action_count_distinct > 5
134134
135135
// sort the results by the number of unique API calls in descending order
136136
| sort Esql.event_action_count_distinct desc
137-
138137
'''
139138

140139

rules/integrations/aws/discovery_servicequotas_multi_region_service_quota_requests.toml

Lines changed: 38 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,40 @@ from = "now-9m"
1515
language = "esql"
1616
license = "Elastic License v2"
1717
name = "AWS Service Quotas Multi-Region `GetServiceQuota` Requests"
18+
note = """## Triage and analysis
19+
20+
> **Disclaimer**:
21+
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
22+
23+
### Investigating AWS Service Quotas Multi-Region `GetServiceQuota` Requests
24+
25+
AWS Service Quotas manage resource limits across AWS services, crucial for maintaining operational boundaries. Adversaries may exploit `GetServiceQuota` API calls to probe AWS infrastructure, seeking vulnerabilities for deploying threats like cryptocurrency miners. The detection rule identifies unusual multi-region queries for EC2 quotas, signaling potential credential compromise or unauthorized access attempts.
26+
27+
### Possible investigation steps
28+
29+
- Review the AWS CloudTrail logs to identify the specific user or role associated with the `aws.cloudtrail.user_identity.arn` field that triggered the alert. Determine if this user or role should have access to multiple regions.
30+
- Examine the `cloud.region` field to identify which regions were accessed and verify if these regions are typically used by your organization. Investigate any unfamiliar regions for unauthorized activity.
31+
- Check the AWS IAM policies and permissions associated with the identified user or role to ensure they align with the principle of least privilege. Look for any recent changes or anomalies in permissions.
32+
- Investigate the source IP addresses and locations from which the `GetServiceQuota` API calls were made to determine if they match expected patterns for your organization. Look for any unusual or suspicious IP addresses.
33+
- Review recent activity logs for the identified user or role to detect any other unusual or unauthorized actions, such as attempts to launch EC2 instances or access other AWS services.
34+
- If a compromise is suspected, consider rotating the credentials for the affected user or role and implementing additional security measures, such as multi-factor authentication (MFA) and enhanced monitoring.
35+
36+
### False positive analysis
37+
38+
- Legitimate multi-region operations: Organizations with a global presence may have legitimate reasons for querying EC2 service quotas across multiple regions. To handle this, users can create exceptions for known accounts or roles that regularly perform such operations.
39+
- Automated infrastructure management tools: Some tools or scripts designed for infrastructure management might perform multi-region `GetServiceQuota` requests as part of their normal operation. Users should identify these tools and exclude their activity from triggering alerts by whitelisting their associated user identities or ARNs.
40+
- Testing and development activities: Developers or testers might intentionally perform multi-region queries during testing phases. Users can mitigate false positives by setting up temporary exceptions for specific time frames or user identities involved in testing.
41+
- Cloud service providers or partners: Third-party services or partners managing AWS resources on behalf of an organization might generate similar patterns. Users should establish trust relationships and exclude these entities from detection by verifying their activities and adding them to an exception list.
42+
43+
### Response and remediation
44+
45+
- Immediately isolate the AWS account or IAM user identified in the alert to prevent further unauthorized access. This can be done by disabling the access keys or suspending the account temporarily.
46+
- Conduct a thorough review of the AWS CloudTrail logs for the identified user or resource to determine the extent of the unauthorized activity and identify any other potentially compromised resources.
47+
- Rotate all access keys and passwords associated with the compromised account or IAM user to prevent further unauthorized access.
48+
- Implement additional security measures such as enabling multi-factor authentication (MFA) for all IAM users and roles to enhance account security.
49+
- Notify the security operations team and relevant stakeholders about the potential compromise and the steps being taken to remediate the issue.
50+
- If evidence of compromise is confirmed, consider engaging AWS Support or a third-party incident response team for further investigation and assistance.
51+
- Review and update IAM policies and permissions to ensure the principle of least privilege is enforced, reducing the risk of future unauthorized access attempts."""
1852
references = [
1953
"https://www.sentinelone.com/labs/exploring-fbot-python-based-malware-targeting-cloud-and-payment-services/",
2054
"https://docs.aws.amazon.com/servicequotas/2019-06-24/apireference/API_GetServiceQuota.html",
@@ -35,7 +69,7 @@ timestamp_override = "event.ingested"
3569
type = "esql"
3670

3771
query = '''
38-
FROM logs-aws.cloudtrail-*
72+
from logs-aws.cloudtrail-*
3973
4074
// filter for GetServiceQuota API calls
4175
| where
@@ -44,7 +78,7 @@ FROM logs-aws.cloudtrail-*
4478
and event.action == "GetServiceQuota"
4579
4680
// truncate the timestamp to a 30-second window
47-
| eval Esql.time_window_date_trunc = DATE_TRUNC(30 seconds, @timestamp)
81+
| eval Esql.time_window_date_trunc = date_trunc(30 seconds, @timestamp)
4882
4983
// dissect request parameters to extract service and quota code
5084
| dissect aws.cloudtrail.request_parameters "{%{?Esql.aws_cloudtrail_request_parameters_service_code_key}=%{Esql.aws_cloudtrail_request_parameters_service_code}, %{?quota_code_key}=%{Esql.aws_cloudtrail_request_parameters_quota_code}}"
@@ -62,8 +96,8 @@ FROM logs-aws.cloudtrail-*
6296
6397
// count the number of unique regions and total API calls within the time window
6498
| stats
65-
Esql.cloud_region_count_distinct = COUNT_DISTINCT(cloud.region),
66-
Esql.event_count = COUNT(*)
99+
Esql.cloud_region_count_distinct = count_distinct(cloud.region),
100+
Esql.event_count = count(*)
67101
by Esql.time_window_date_trunc, aws.cloudtrail.user_identity.arn
68102
69103
// filter for API calls in more than 10 regions within the 30-second window
@@ -73,42 +107,8 @@ FROM logs-aws.cloudtrail-*
73107
74108
// sort by time window descending
75109
| sort Esql.time_window_date_trunc desc
76-
77110
'''
78-
note = """## Triage and analysis
79-
80-
> **Disclaimer**:
81-
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
82-
83-
### Investigating AWS Service Quotas Multi-Region `GetServiceQuota` Requests
84-
85-
AWS Service Quotas manage resource limits across AWS services, crucial for maintaining operational boundaries. Adversaries may exploit `GetServiceQuota` API calls to probe AWS infrastructure, seeking vulnerabilities for deploying threats like cryptocurrency miners. The detection rule identifies unusual multi-region queries for EC2 quotas, signaling potential credential compromise or unauthorized access attempts.
86-
87-
### Possible investigation steps
88-
89-
- Review the AWS CloudTrail logs to identify the specific user or role associated with the `aws.cloudtrail.user_identity.arn` field that triggered the alert. Determine if this user or role should have access to multiple regions.
90-
- Examine the `cloud.region` field to identify which regions were accessed and verify if these regions are typically used by your organization. Investigate any unfamiliar regions for unauthorized activity.
91-
- Check the AWS IAM policies and permissions associated with the identified user or role to ensure they align with the principle of least privilege. Look for any recent changes or anomalies in permissions.
92-
- Investigate the source IP addresses and locations from which the `GetServiceQuota` API calls were made to determine if they match expected patterns for your organization. Look for any unusual or suspicious IP addresses.
93-
- Review recent activity logs for the identified user or role to detect any other unusual or unauthorized actions, such as attempts to launch EC2 instances or access other AWS services.
94-
- If a compromise is suspected, consider rotating the credentials for the affected user or role and implementing additional security measures, such as multi-factor authentication (MFA) and enhanced monitoring.
95-
96-
### False positive analysis
97111

98-
- Legitimate multi-region operations: Organizations with a global presence may have legitimate reasons for querying EC2 service quotas across multiple regions. To handle this, users can create exceptions for known accounts or roles that regularly perform such operations.
99-
- Automated infrastructure management tools: Some tools or scripts designed for infrastructure management might perform multi-region `GetServiceQuota` requests as part of their normal operation. Users should identify these tools and exclude their activity from triggering alerts by whitelisting their associated user identities or ARNs.
100-
- Testing and development activities: Developers or testers might intentionally perform multi-region queries during testing phases. Users can mitigate false positives by setting up temporary exceptions for specific time frames or user identities involved in testing.
101-
- Cloud service providers or partners: Third-party services or partners managing AWS resources on behalf of an organization might generate similar patterns. Users should establish trust relationships and exclude these entities from detection by verifying their activities and adding them to an exception list.
102-
103-
### Response and remediation
104-
105-
- Immediately isolate the AWS account or IAM user identified in the alert to prevent further unauthorized access. This can be done by disabling the access keys or suspending the account temporarily.
106-
- Conduct a thorough review of the AWS CloudTrail logs for the identified user or resource to determine the extent of the unauthorized activity and identify any other potentially compromised resources.
107-
- Rotate all access keys and passwords associated with the compromised account or IAM user to prevent further unauthorized access.
108-
- Implement additional security measures such as enabling multi-factor authentication (MFA) for all IAM users and roles to enhance account security.
109-
- Notify the security operations team and relevant stakeholders about the potential compromise and the steps being taken to remediate the issue.
110-
- If evidence of compromise is confirmed, consider engaging AWS Support or a third-party incident response team for further investigation and assistance.
111-
- Review and update IAM policies and permissions to ensure the principle of least privilege is enforced, reducing the risk of future unauthorized access attempts."""
112112

113113
[[rule.threat]]
114114
framework = "MITRE ATT&CK"

rules/integrations/aws/exfiltration_ec2_ebs_snapshot_shared_with_another_account.toml

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -21,8 +21,7 @@ interval = "5m"
2121
language = "esql"
2222
license = "Elastic License v2"
2323
name = "AWS EC2 EBS Snapshot Shared or Made Public"
24-
note = """
25-
## Triage and analysis
24+
note = """## Triage and analysis
2625
2726
### Investigating AWS EC2 EBS Snapshot Shared or Made Public
2827
@@ -80,7 +79,7 @@ timestamp_override = "event.ingested"
8079
type = "esql"
8180

8281
query = '''
83-
FROM logs-aws.cloudtrail-* METADATA _id, _version, _index
82+
from logs-aws.cloudtrail-* metadata _id, _version, _index
8483
| where
8584
event.provider == "ec2.amazonaws.com"
8685
and event.action == "ModifySnapshotAttribute"
@@ -95,7 +94,7 @@ FROM logs-aws.cloudtrail-* METADATA _id, _version, _index
9594
Esql.aws_cloudtrail_request_parameters_operation_type == "add"
9695
and cloud.account.id != Esql_priv.aws_cloudtrail_request_parameters_user_id
9796
98-
// Keep ECS and derived fields
97+
// keep ECS and derived fields
9998
| keep
10099
@timestamp,
101100
aws.cloudtrail.user_identity.arn,
@@ -106,7 +105,6 @@ FROM logs-aws.cloudtrail-* METADATA _id, _version, _index
106105
Esql.aws_cloudtrail_request_parameters_operation_type,
107106
Esql_priv.aws_cloudtrail_request_parameters_user_id,
108107
source.ip
109-
110108
'''
111109

112110

0 commit comments

Comments
 (0)