Skip to content

Commit 9585c03

Browse files
w0rk3rw0rk3r
authored
Merge branch 'main' into Samirbous-patch-1
2 parents 6900cd1 + 0340335 commit 9585c03

12 files changed

+520
-73
lines changed

‎rules/linux/command_and_control_frequent_egress_netcon_from_sus_executable.toml‎

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
[metadata]
2+
creation_date = "2025/02/20"
3+
integration = ["endpoint"]
4+
maturity = "production"
5+
min_stack_comments = "ES|QL rule type in technical preview as of 8.13"
6+
min_stack_version = "8.13.0"
7+
updated_date = "2025/02/20"
8+
9+
[rule]
10+
author = ["Elastic"]
11+
description = """
12+
This rule detects a high number of egress network connections from an unusual executable on a Linux system.
13+
This could indicate a command and control (C2) communication attempt, a brute force attack via a malware
14+
infection, or other malicious activity. ES|QL rules have limited fields available in its alert documents.
15+
Make sure to review the original documents to aid in the investigation of this alert.
16+
"""
17+
from = "now-61m"
18+
interval = "1h"
19+
language = "esql"
20+
license = "Elastic License v2"
21+
name = "High Number of Egress Network Connections from Unusual Executable"
22+
risk_score = 47
23+
rule_id = "1fa350e0-0aa2-4055-bf8f-ab8b59233e59"
24+
setup = """## Setup
25+
26+
This rule requires data coming in from Elastic Defend.
27+
28+
### Elastic Defend Integration Setup
29+
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
30+
31+
#### Prerequisite Requirements:
32+
- Fleet is required for Elastic Defend.
33+
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
34+
35+
#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
36+
- Go to the Kibana home page and click "Add integrations".
37+
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
38+
- Click "Add Elastic Defend".
39+
- Configure the integration name and optionally add a description.
40+
- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
41+
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
42+
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
43+
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
44+
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
45+
- Click "Save and Continue".
46+
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
47+
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
48+
"""
49+
severity = "medium"
50+
tags = [
51+
"Domain: Endpoint",
52+
"OS: Linux",
53+
"Use Case: Threat Detection",
54+
"Tactic: Command and Control",
55+
"Data Source: Elastic Defend",
56+
]
57+
timestamp_override = "event.ingested"
58+
type = "esql"
59+
query = '''
60+
from logs-endpoint.events.network-*
61+
| keep @timestamp, host.os.type, event.type, event.action, process.name, process.executable, destination.ip, agent.id
62+
| where @timestamp > now() - 1 hours
63+
| where host.os.type == "linux" and event.type == "start" and event.action == "connection_attempted" and (
64+
(
65+
process.executable like "/tmp/*" or
66+
process.executable like "/var/tmp/*" or
67+
process.executable like "/dev/shm/*"
68+
) or
69+
(process.name like ".*")
70+
) and not (
71+
CIDR_MATCH(
72+
destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32",
73+
"192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24",
74+
"224.0.0.0/4", "100.64.0.0/10", "192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "224.0.0.0/4", "240.0.0.0/4", "::1",
75+
"FE80::/10", "FF00::/8"
76+
) or
77+
process.executable like "/nix/store/*" or
78+
process.executable like "/tmp/newroot/*" or
79+
process.executable like "/tmp/.mount*" or
80+
process.executable like "/tmp/go-build*"
81+
)
82+
| stats cc = count(), agent_count = count_distinct(agent.id) by process.executable
83+
| where agent_count == 1 and cc > 15
84+
| sort cc asc
85+
| limit 100
86+
'''
87+
88+
[[rule.threat]]
89+
framework = "MITRE ATT&CK"
90+
91+
[[rule.threat.technique]]
92+
id = "T1071"
93+
name = "Application Layer Protocol"
94+
reference = "https://attack.mitre.org/techniques/T1071/"
95+
96+
[rule.threat.tactic]
97+
id = "TA0011"
98+
name = "Command and Control"
99+
reference = "https://attack.mitre.org/tactics/TA0011/"

‎rules/linux/impact_potential_bruteforce_malware_infection.toml‎

Lines changed: 124 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,124 @@
1+
[metadata]
2+
creation_date = "2025/02/20"
3+
integration = ["endpoint"]
4+
maturity = "production"
5+
min_stack_comments = "ES|QL rule type in technical preview as of 8.13"
6+
min_stack_version = "8.13.0"
7+
updated_date = "2025/02/20"
8+
9+
[rule]
10+
author = ["Elastic"]
11+
description = """
12+
This detection identifies a Linux host that has potentially been infected with malware and is being used to conduct
13+
brute-force attacks against external systems over SSH (port 22 and common alternative SSH ports). The detection
14+
looks for a high volume of outbound connection attempts to non-private IP addresses from a single process. A
15+
compromised host may be part of a botnet or controlled by an attacker, attempting to gain unauthorized access
16+
to remote systems. This behavior is commonly observed in SSH brute-force campaigns where malware hijacks
17+
vulnerable machines to expand its attack surface. ES|QL rules have limited fields available in its alert documents.
18+
Make sure to review the original documents to aid in the investigation of this alert.
19+
"""
20+
from = "now-61m"
21+
interval = "1h"
22+
language = "esql"
23+
license = "Elastic License v2"
24+
name = "Potential Malware-Driven SSH Brute Force Attempt"
25+
risk_score = 47
26+
rule_id = "77122db4-5876-4127-b91b-6c179eb21f88"
27+
setup = """## Setup
28+
29+
This rule requires data coming in from Elastic Defend.
30+
31+
### Elastic Defend Integration Setup
32+
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
33+
34+
#### Prerequisite Requirements:
35+
- Fleet is required for Elastic Defend.
36+
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
37+
38+
#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
39+
- Go to the Kibana home page and click "Add integrations".
40+
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
41+
- Click "Add Elastic Defend".
42+
- Configure the integration name and optionally add a description.
43+
- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
44+
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
45+
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
46+
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
47+
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
48+
- Click "Save and Continue".
49+
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
50+
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
51+
"""
52+
severity = "medium"
53+
tags = [
54+
"Domain: Endpoint",
55+
"OS: Linux",
56+
"Use Case: Threat Detection",
57+
"Tactic: Impact",
58+
"Tactic: Execution",
59+
"Tactic: Command and Control",
60+
"Data Source: Elastic Defend",
61+
]
62+
timestamp_override = "event.ingested"
63+
type = "esql"
64+
query = '''
65+
from logs-endpoint.events.network-*
66+
| keep @timestamp, host.os.type, event.type, event.action, destination.port, process.executable, destination.ip, agent.id
67+
| where @timestamp > now() - 1 hours
68+
| where host.os.type == "linux" and event.type == "start" and event.action == "connection_attempted" and
69+
destination.port in (22, 222, 2222, 10022, 2022, 2200, 62612, 8022) and not
70+
CIDR_MATCH(
71+
destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32",
72+
"192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24",
73+
"224.0.0.0/4", "100.64.0.0/10", "192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "224.0.0.0/4", "240.0.0.0/4", "::1",
74+
"FE80::/10", "FF00::/8"
75+
)
76+
| stats cc = count(), agent_count = count_distinct(agent.id) by process.executable, destination.port
77+
| where agent_count == 1 and cc > 15
78+
| sort cc asc
79+
| limit 100
80+
'''
81+
82+
[[rule.threat]]
83+
framework = "MITRE ATT&CK"
84+
85+
[rule.threat.tactic]
86+
name = "Impact"
87+
id = "TA0040"
88+
reference = "https://attack.mitre.org/tactics/TA0040/"
89+
90+
[[rule.threat.technique]]
91+
name = "Resource Hijacking"
92+
id = "T1496"
93+
reference = "https://attack.mitre.org/techniques/T1496/"
94+
95+
[[rule.threat]]
96+
framework = "MITRE ATT&CK"
97+
98+
[rule.threat.tactic]
99+
name = "Execution"
100+
id = "TA0002"
101+
reference = "https://attack.mitre.org/tactics/TA0002/"
102+
103+
[[rule.threat.technique]]
104+
name = "Command and Scripting Interpreter"
105+
id = "T1059"
106+
reference = "https://attack.mitre.org/techniques/T1059/"
107+
108+
[[rule.threat.technique.subtechnique]]
109+
name = "Unix Shell"
110+
id = "T1059.004"
111+
reference = "https://attack.mitre.org/techniques/T1059/004/"
112+
113+
[[rule.threat]]
114+
framework = "MITRE ATT&CK"
115+
116+
[rule.threat.tactic]
117+
id = "TA0011"
118+
name = "Command and Control"
119+
reference = "https://attack.mitre.org/tactics/TA0011/"
120+
121+
[[rule.threat.technique]]
122+
id = "T1071"
123+
name = "Application Layer Protocol"
124+
reference = "https://attack.mitre.org/techniques/T1071/"

‎rules/linux/lateral_movement_remote_file_creation_world_writeable_dir.toml‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
[metadata]
2+
creation_date = "2025/02/20"
3+
integration = ["endpoint"]
4+
maturity = "production"
5+
updated_date = "2025/02/20"
6+
7+
[rule]
8+
author = ["Elastic"]
9+
description = """
10+
This rule detects the creation of a file in a world-writeable directory through a service that is
11+
commonly used for file transfer. This behavior is often associated with lateral movement and can
12+
be an indicator of an attacker attempting to move laterally within a network.
13+
"""
14+
from = "now-9m"
15+
index = ["logs-endpoint.events.file*", "auditbeat-*"]
16+
language = "eql"
17+
license = "Elastic License v2"
18+
name = "Remote File Creation in World Writeable Directory"
19+
risk_score = 47
20+
rule_id = "3e528511-7316-4a6e-83da-61b5f1c07fd4"
21+
setup = """## Setup
22+
23+
This rule requires data coming in from one of the following integrations:
24+
- Elastic Defend
25+
- Auditbeat
26+
27+
### Elastic Defend Integration Setup
28+
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
29+
30+
#### Prerequisite Requirements:
31+
- Fleet is required for Elastic Defend.
32+
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
33+
34+
#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
35+
- Go to the Kibana home page and click "Add integrations".
36+
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
37+
- Click "Add Elastic Defend".
38+
- Configure the integration name and optionally add a description.
39+
- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
40+
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
41+
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
42+
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
43+
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
44+
- Click "Save and Continue".
45+
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
46+
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
47+
48+
### Auditbeat Setup
49+
Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
50+
51+
#### The following steps should be executed in order to add the Auditbeat on a Linux System:
52+
- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
53+
- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html).
54+
- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html).
55+
- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html).
56+
- For complete “Setup and Run Auditbeat” information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html).
57+
"""
58+
severity = "medium"
59+
tags = [
60+
"Domain: Endpoint",
61+
"OS: Linux",
62+
"Use Case: Threat Detection",
63+
"Tactic: Lateral Movement",
64+
"Data Source: Elastic Defend",
65+
]
66+
timestamp_override = "event.ingested"
67+
type = "eql"
68+
query = '''
69+
file where host.os.type == "linux" and event.action == "creation" and
70+
process.name in ("scp", "sshd", "ssh", "ftp", "sftp", "vsftpd", "sftp-server", "rsync") and
71+
file.path like~ ("/tmp*", "/var/tmp*", "/dev/shm/*", "/home/.*") and user.id != "0"
72+
'''
73+
74+
[[rule.threat]]
75+
framework = "MITRE ATT&CK"
76+
77+
[[rule.threat.technique]]
78+
id = "T1021"
79+
name = "Remote Services"
80+
reference = "https://attack.mitre.org/techniques/T1021/"
81+
82+
[[rule.threat.technique.subtechnique]]
83+
id = "T1021.004"
84+
name = "SSH"
85+
reference = "https://attack.mitre.org/techniques/T1021/004/"
86+
87+
[[rule.threat.technique]]
88+
id = "T1570"
89+
name = "Lateral Tool Transfer"
90+
reference = "https://attack.mitre.org/techniques/T1570/"
91+
92+
[rule.threat.tactic]
93+
id = "TA0008"
94+
name = "Lateral Movement"
95+
reference = "https://attack.mitre.org/tactics/TA0008/"

0 commit comments

Comments
 (0)