Skip to content

Commit 9ed682c

Browse files
AegrahAegrah
committed
Batch 2
1 parent e41f463 commit 9ed682c

15 files changed

+191
-170
lines changed

‎rules/linux/command_and_control_aws_cli_endpoint_url_used.toml‎

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,16 @@
11
[metadata]
22
creation_date = "2024/08/21"
3-
integration = ["endpoint"]
3+
integration = ["endpoint", "crowdstrike"]
44
maturity = "production"
5-
updated_date = "2025/01/15"
5+
updated_date = "2025/10/17"
66

77
[rule]
88
author = ["Elastic"]
99
description = """
1010
Detects the use of the AWS CLI with the `--endpoint-url` argument, which allows users to specify a custom endpoint URL for AWS services. This can be leveraged by adversaries to redirect API requests to non-standard or malicious endpoints, potentially bypassing typical security controls and logging mechanisms. This behavior may indicate an attempt to interact with unauthorized or compromised infrastructure, exfiltrate data, or perform other malicious activities under the guise of legitimate AWS operations.
1111
"""
1212
from = "now-9m"
13-
index = ["logs-endpoint.events.process-*"]
13+
index = ["logs-endpoint.events.process-*", "logs-crowdstrike.fdr*"]
1414
language = "kuery"
1515
license = "Elastic License v2"
1616
name = "AWS CLI Command with Custom Endpoint URL"
@@ -21,12 +21,13 @@ risk_score = 47
2121
rule_id = "349276c0-5fcf-11ef-b1a9-f661ea17fbce"
2222
severity = "medium"
2323
tags = [
24-
"Data Source: Elastic Defend",
25-
"Domain: Endpoint",
26-
"OS: Linux",
27-
"Use Case: Threat Detection",
28-
"Tactic: Command and Control",
29-
"Resources: Investigation Guide",
24+
"Data Source: Elastic Defend",
25+
"Domain: Endpoint",
26+
"OS: Linux",
27+
"Use Case: Threat Detection",
28+
"Tactic: Command and Control",
29+
"Resources: Investigation Guide",
30+
"Data Source: Crowdstrike",
3031
]
3132
type = "new_terms"
3233
timestamp_override = "event.ingested"

‎rules/linux/defense_evasion_ld_preload_cmdline.toml‎

Lines changed: 12 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
[metadata]
22
creation_date = "2025/04/30"
3-
integration = ["endpoint"]
3+
integration = ["endpoint", "crowdstrike"]
44
maturity = "production"
5-
updated_date = "2025/07/07"
5+
updated_date = "2025/10/17"
66

77
[rule]
88
author = ["Elastic"]
@@ -12,7 +12,7 @@ This behavior is unusual and may indicate an attempt to hijack the execution flo
1212
this technique to evade defenses, escalate privileges, or maintain persistence on a system.
1313
"""
1414
from = "now-9m"
15-
index = ["logs-endpoint.events.process*"]
15+
index = ["logs-endpoint.events.process*", "logs-crowdstrike.fdr*"]
1616
language = "kuery"
1717
license = "Elastic License v2"
1818
name = "Unusual LD_PRELOAD/LD_LIBRARY_PATH Command Line Arguments"
@@ -80,18 +80,19 @@ For more details on Elastic Defend refer to the [helper guide](https://www.elast
8080
"""
8181
severity = "low"
8282
tags = [
83-
"Domain: Endpoint",
84-
"OS: Linux",
85-
"Use Case: Threat Detection",
86-
"Tactic: Defense Evasion",
87-
"Tactic: Persistence",
88-
"Data Source: Elastic Defend",
89-
"Resources: Investigation Guide",
83+
"Domain: Endpoint",
84+
"OS: Linux",
85+
"Use Case: Threat Detection",
86+
"Tactic: Defense Evasion",
87+
"Tactic: Persistence",
88+
"Data Source: Elastic Defend",
89+
"Resources: Investigation Guide",
90+
"Data Source: Crowdstrike",
9091
]
9192
timestamp_override = "event.ingested"
9293
type = "new_terms"
9394
query = '''
94-
host.os.type:linux and event.category:process and event.type:start and event.action:exec and
95+
host.os.type:linux and event.category:process and event.type:start and event.action:(exec or ProcessRollup2) and
9596
process.parent.name:(* and not (
9697
awk or bwrap or cylancesvc or dbus-run-session or java or julia or make or matlab_helper or ninja or noproc_sandbox or
9798
nxrunner or nxserver or perl or rear or sapcontrol or setsid or spoold or sshd or steam or su or sudo or titanagent or

‎rules/linux/discovery_virtual_machine_fingerprinting.toml‎

Lines changed: 11 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
[metadata]
22
creation_date = "2020/04/27"
3-
integration = ["endpoint"]
3+
integration = ["endpoint", "crowdstrike"]
44
maturity = "production"
5-
updated_date = "2025/01/15"
5+
updated_date = "2025/10/17"
66

77
[rule]
88
author = ["Elastic"]
@@ -18,7 +18,7 @@ false_positives = [
1818
""",
1919
]
2020
from = "now-9m"
21-
index = ["auditbeat-*", "logs-endpoint.events.*", "endgame-*"]
21+
index = ["auditbeat-*", "logs-endpoint.events.*", "endgame-*", "logs-crowdstrike.fdr*"]
2222
language = "kuery"
2323
license = "Elastic License v2"
2424
name = "Virtual Machine Fingerprinting"
@@ -63,13 +63,14 @@ Auditbeat is a lightweight shipper that you can install on your servers to audit
6363
"""
6464
severity = "high"
6565
tags = [
66-
"Domain: Endpoint",
67-
"OS: Linux",
68-
"Use Case: Threat Detection",
69-
"Tactic: Discovery",
70-
"Data Source: Elastic Endgame",
71-
"Data Source: Elastic Defend",
72-
"Resources: Investigation Guide",
66+
"Domain: Endpoint",
67+
"OS: Linux",
68+
"Use Case: Threat Detection",
69+
"Tactic: Discovery",
70+
"Data Source: Elastic Endgame",
71+
"Data Source: Elastic Defend",
72+
"Resources: Investigation Guide",
73+
"Data Source: Crowdstrike",
7374
]
7475
timestamp_override = "event.ingested"
7576
type = "query"

‎rules/linux/execution_cupsd_foomatic_rip_lp_user_execution.toml‎

Lines changed: 13 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
[metadata]
22
creation_date = "2024/09/27"
3-
integration = ["endpoint"]
3+
integration = ["endpoint", "crowdstrike"]
44
maturity = "production"
5-
updated_date = "2025/02/04"
5+
updated_date = "2025/10/17"
66

77
[rule]
88
author = ["Elastic"]
@@ -15,7 +15,7 @@ through crafted UDP packets or network spoofing. This can result in arbitrary co
1515
initiated.
1616
"""
1717
from = "now-9m"
18-
index = ["endgame-*", "logs-endpoint.events.process*"]
18+
index = ["endgame-*", "logs-endpoint.events.process*", "logs-crowdstrike.fdr*"]
1919
language = "eql"
2020
license = "Elastic License v2"
2121
name = "Printer User (lp) Shell Execution"
@@ -99,20 +99,21 @@ For more details on Elastic Defend refer to the [helper guide](https://www.elast
9999
"""
100100
severity = "high"
101101
tags = [
102-
"Domain: Endpoint",
103-
"OS: Linux",
104-
"Use Case: Threat Detection",
105-
"Use Case: Vulnerability",
106-
"Tactic: Execution",
107-
"Data Source: Elastic Defend",
108-
"Data Source: Elastic Endgame",
109-
"Resources: Investigation Guide",
102+
"Domain: Endpoint",
103+
"OS: Linux",
104+
"Use Case: Threat Detection",
105+
"Use Case: Vulnerability",
106+
"Tactic: Execution",
107+
"Data Source: Elastic Defend",
108+
"Data Source: Elastic Endgame",
109+
"Resources: Investigation Guide",
110+
"Data Source: Crowdstrike",
110111
]
111112
timestamp_override = "event.ingested"
112113
type = "eql"
113114
query = '''
114115
process where host.os.type == "linux" and event.type == "start" and
115-
event.action in ("exec", "exec_event") and user.name == "lp" and
116+
event.action in ("exec", "exec_event", "ProcessRollup2") and user.name == "lp" and
116117
process.parent.name in ("cupsd", "foomatic-rip", "bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and
117118
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and not (
118119
process.command_line like (

‎rules/linux/execution_perl_tty_shell.toml‎

Lines changed: 11 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
[metadata]
22
creation_date = "2020/04/16"
3-
integration = ["endpoint"]
3+
integration = ["endpoint", "crowdstrike"]
44
maturity = "production"
5-
updated_date = "2025/01/15"
5+
updated_date = "2025/10/17"
66

77
[rule]
88
author = ["Elastic"]
@@ -11,7 +11,7 @@ Identifies when a terminal (tty) is spawned via Perl. Attackers may upgrade a si
1111
interactive tty after obtaining initial access to a host.
1212
"""
1313
from = "now-9m"
14-
index = ["auditbeat-*", "logs-endpoint.events.*", "endgame-*"]
14+
index = ["auditbeat-*", "logs-endpoint.events.*", "endgame-*", "logs-crowdstrike.fdr*"]
1515
language = "kuery"
1616
license = "Elastic License v2"
1717
name = "Interactive Terminal Spawned via Perl"
@@ -56,13 +56,14 @@ Auditbeat is a lightweight shipper that you can install on your servers to audit
5656
"""
5757
severity = "high"
5858
tags = [
59-
"Domain: Endpoint",
60-
"OS: Linux",
61-
"Use Case: Threat Detection",
62-
"Tactic: Execution",
63-
"Data Source: Elastic Endgame",
64-
"Data Source: Elastic Defend",
65-
"Resources: Investigation Guide",
59+
"Domain: Endpoint",
60+
"OS: Linux",
61+
"Use Case: Threat Detection",
62+
"Tactic: Execution",
63+
"Data Source: Elastic Endgame",
64+
"Data Source: Elastic Defend",
65+
"Resources: Investigation Guide",
66+
"Data Source: Crowdstrike",
6667
]
6768
timestamp_override = "event.ingested"
6869
type = "query"

‎rules/linux/execution_suspicious_mkfifo_execution.toml‎

Lines changed: 12 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
[metadata]
22
creation_date = "2025/04/30"
3-
integration = ["endpoint"]
3+
integration = ["endpoint", "crowdstrike"]
44
maturity = "production"
5-
updated_date = "2025/07/07"
5+
updated_date = "2025/10/17"
66

77
[rule]
88
author = ["Elastic"]
@@ -13,7 +13,7 @@ rule type, this rule can identify uncommon process command lines that may indica
1313
named pipe.
1414
"""
1515
from = "now-9m"
16-
index = ["logs-endpoint.events.process*"]
16+
index = ["logs-endpoint.events.process*", "logs-crowdstrike.fdr*"]
1717
language = "kuery"
1818
license = "Elastic License v2"
1919
name = "Suspicious Named Pipe Creation"
@@ -81,18 +81,19 @@ For more details on Elastic Defend refer to the [helper guide](https://www.elast
8181
"""
8282
severity = "low"
8383
tags = [
84-
"Domain: Endpoint",
85-
"OS: Linux",
86-
"Use Case: Threat Detection",
87-
"Tactic: Execution",
88-
"Tactic: Command and Control",
89-
"Data Source: Elastic Defend",
90-
"Resources: Investigation Guide",
84+
"Domain: Endpoint",
85+
"OS: Linux",
86+
"Use Case: Threat Detection",
87+
"Tactic: Execution",
88+
"Tactic: Command and Control",
89+
"Data Source: Elastic Defend",
90+
"Resources: Investigation Guide",
91+
"Data Source: Crowdstrike",
9192
]
9293
timestamp_override = "event.ingested"
9394
type = "new_terms"
9495
query = '''
95-
host.os.type:linux and event.category:process and event.type:start and event.action:exec and process.name:mkfifo and
96+
host.os.type:linux and event.category:process and event.type:start and event.action:(exec or ProcessRollup2) and process.name:mkfifo and
9697
process.parent.name:(bash or csh or dash or fish or ksh or sh or tcsh or zsh) and
9798
process.args:((/dev/shm/* or /tmp/* or /var/tmp/*) and not /*fifo*)
9899
'''

‎rules/linux/execution_unusual_kthreadd_execution.toml‎

Lines changed: 11 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
[metadata]
22
creation_date = "2025/04/30"
3-
integration = ["endpoint"]
3+
integration = ["endpoint", "crowdstrike"]
44
maturity = "production"
5-
updated_date = "2025/07/07"
5+
updated_date = "2025/10/17"
66

77
[rule]
88
author = ["Elastic"]
@@ -12,7 +12,7 @@ kernel space via kthreadd to perform actions on the host and evade detection. Th
1212
rule can identify uncommon child processes that may indicate the presence of a malicious process.
1313
"""
1414
from = "now-9m"
15-
index = ["logs-endpoint.events.process*"]
15+
index = ["logs-endpoint.events.process*", "logs-crowdstrike.fdr*"]
1616
language = "kuery"
1717
license = "Elastic License v2"
1818
name = "Unusual Execution from Kernel Thread (kthreadd) Parent"
@@ -82,17 +82,18 @@ For more details on Elastic Defend refer to the [helper guide](https://www.elast
8282
"""
8383
severity = "medium"
8484
tags = [
85-
"Domain: Endpoint",
86-
"OS: Linux",
87-
"Use Case: Threat Detection",
88-
"Tactic: Execution",
89-
"Data Source: Elastic Defend",
90-
"Resources: Investigation Guide",
85+
"Domain: Endpoint",
86+
"OS: Linux",
87+
"Use Case: Threat Detection",
88+
"Tactic: Execution",
89+
"Data Source: Elastic Defend",
90+
"Resources: Investigation Guide",
91+
"Data Source: Crowdstrike",
9192
]
9293
timestamp_override = "event.ingested"
9394
type = "new_terms"
9495
query = '''
95-
host.os.type:linux and event.category:process and event.type:start and event.action:exec and process.parent.name:kthreadd and (
96+
host.os.type:linux and event.category:process and event.type:start and event.action:(exec or ProcessRollup2) and process.parent.name:kthreadd and (
9697
process.executable:(/dev/shm/* or /tmp/* or /var/tmp/* or /var/www/*) or
9798
process.name:(bash or csh or curl or dash or fish or id or ksh or nohup or setsid or sh or tcsh or wget or whoami or zsh)
9899
) and

‎rules/linux/impact_process_kill_threshold.toml‎

Lines changed: 12 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,14 @@
11
[metadata]
22
creation_date = "2022/07/27"
3-
integration = ["endpoint", "auditd_manager"]
3+
integration = ["endpoint", "auditd_manager", "crowdstrike"]
44
maturity = "production"
5-
updated_date = "2024/05/21"
5+
updated_date = "2025/10/17"
66

77
[rule]
88
author = ["Elastic"]
99
description = "This rule identifies a high number (10) of process terminations via pkill from the same host within a short time period.\n"
1010
from = "now-9m"
11-
index = ["logs-endpoint.events.*", "endgame-*", "auditbeat-*", "logs-auditd_manager.auditd-*"]
11+
index = ["logs-endpoint.events.*", "endgame-*", "auditbeat-*", "logs-auditd_manager.auditd-*", "logs-crowdstrike.fdr*"]
1212
language = "kuery"
1313
license = "Elastic License v2"
1414
name = "High Number of Process Terminations"
@@ -74,14 +74,15 @@ For more details on Elastic Defend refer to the [helper guide](https://www.elast
7474
"""
7575
severity = "medium"
7676
tags = [
77-
"Domain: Endpoint",
78-
"OS: Linux",
79-
"Use Case: Threat Detection",
80-
"Tactic: Impact",
81-
"Resources: Investigation Guide",
82-
"Data Source: Elastic Endgame",
83-
"Data Source: Elastic Defend",
84-
"Data Source: Auditd Manager",
77+
"Domain: Endpoint",
78+
"OS: Linux",
79+
"Use Case: Threat Detection",
80+
"Tactic: Impact",
81+
"Resources: Investigation Guide",
82+
"Data Source: Elastic Endgame",
83+
"Data Source: Elastic Defend",
84+
"Data Source: Auditd Manager",
85+
"Data Source: Crowdstrike",
8586
]
8687
timestamp_override = "event.ingested"
8788
type = "threshold"

0 commit comments

Comments
 (0)