Skip to content

Commit b392874

Browse files
w0rk3rw0rk3r
authored
Merge branch 'main' into dns_coercion
2 parents 4254243 + 3bc5708 commit b392874

12 files changed

+456
-34
lines changed

‎rules/integrations/kubernetes/execution_user_exec_to_pod.toml‎

Lines changed: 7 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
creation_date = "2022/05/17"
33
integration = ["kubernetes"]
44
maturity = "production"
5-
updated_date = "2025/01/15"
5+
updated_date = "2025/06/17"
66

77
[rule]
88
author = ["Elastic"]
@@ -23,7 +23,7 @@ false_positives = [
2323
""",
2424
]
2525
index = ["logs-kubernetes.*"]
26-
language = "kuery"
26+
language = "eql"
2727
license = "Elastic License v2"
2828
name = "Kubernetes User Exec into Pod"
2929
note = """## Triage and analysis
@@ -73,27 +73,22 @@ rule_id = "14de811c-d60f-11ec-9fd7-f661ea17fbce"
7373
severity = "medium"
7474
tags = ["Data Source: Kubernetes", "Tactic: Execution", "Resources: Investigation Guide"]
7575
timestamp_override = "event.ingested"
76-
type = "query"
77-
76+
type = "eql"
7877
query = '''
79-
event.dataset : "kubernetes.audit_logs"
80-
and kubernetes.audit.annotations.authorization_k8s_io/decision:"allow"
81-
and kubernetes.audit.verb:"create"
82-
and kubernetes.audit.objectRef.resource:"pods"
83-
and kubernetes.audit.objectRef.subresource:"exec"
78+
any where host.os.type == "linux" and event.dataset == "kubernetes.audit_logs" and
79+
kubernetes.audit.verb in ("get", "create") and kubernetes.audit.objectRef.subresource == "exec" and
80+
kubernetes.audit.stage == "ResponseComplete" and `kubernetes.audit.annotations.authorization_k8s_io/decision` == "allow"
8481
'''
8582

86-
8783
[[rule.threat]]
8884
framework = "MITRE ATT&CK"
85+
8986
[[rule.threat.technique]]
9087
id = "T1609"
9188
name = "Container Administration Command"
9289
reference = "https://attack.mitre.org/techniques/T1609/"
9390

94-
9591
[rule.threat.tactic]
9692
id = "TA0002"
9793
name = "Execution"
9894
reference = "https://attack.mitre.org/tactics/TA0002/"
99-

‎rules/linux/discovery_kubeconfig_file_discovery.toml‎

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
[metadata]
2+
creation_date = "2025/06/17"
3+
integration = ["endpoint"]
4+
maturity = "production"
5+
updated_date = "2025/06/17"
6+
7+
[rule]
8+
author = ["Elastic"]
9+
description = """
10+
The kubeconfig file is a critical component in Kubernetes environments, containing configuration
11+
details for accessing and managing Kubernetes clusters. Attackers may attempt to get access to,
12+
create, or modify kubeconfig files to gain unauthorized initial access to Kubernetes clusters or
13+
move laterally within the cluster. This rule detects process discovery executions that involve
14+
kubeconfig files, particularly those executed from common shell environments or world-writeable
15+
directories.
16+
"""
17+
from = "now-9m"
18+
index = [
19+
"logs-endpoint.events.process*",
20+
]
21+
language = "eql"
22+
license = "Elastic License v2"
23+
name = "Kubeconfig File Discovery"
24+
references = [
25+
"https://kubernetes-threat-matrix.redguard.ch/initial-access/kubeconfig-file/",
26+
"https://kubenomicon.com/Initial_access/Kubeconfig_file.html",
27+
]
28+
risk_score = 21
29+
rule_id = "9a6f5d74-c7e7-4a8b-945e-462c102daee4"
30+
setup = """## Setup
31+
32+
This rule requires data coming in from Elastic Defend.
33+
34+
### Elastic Defend Integration Setup
35+
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
36+
37+
#### Prerequisite Requirements:
38+
- Fleet is required for Elastic Defend.
39+
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
40+
41+
#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
42+
- Go to the Kibana home page and click "Add integrations".
43+
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
44+
- Click "Add Elastic Defend".
45+
- Configure the integration name and optionally add a description.
46+
- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
47+
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
48+
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
49+
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
50+
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
51+
- Click "Save and Continue".
52+
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
53+
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
54+
"""
55+
severity = "low"
56+
tags = [
57+
"Domain: Endpoint",
58+
"Domain: Container",
59+
"OS: Linux",
60+
"Use Case: Threat Detection",
61+
"Tactic: Discovery",
62+
"Data Source: Elastic Defend",
63+
]
64+
timestamp_override = "event.ingested"
65+
type = "eql"
66+
query = '''
67+
process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and (
68+
process.parent.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") or
69+
(
70+
process.parent.executable like ("/tmp/*", "/var/tmp/*", "/dev/shm/*", "/root/*", "/home/*") or
71+
process.parent.name like (".*", "*.sh")
72+
)
73+
) and
74+
(
75+
(
76+
process.working_directory like ("/etc/kubernetes", "/root/.kube", "/home/*/.kube") and
77+
process.args in ("kubeconfig", "admin.conf", "super-admin.conf", "kubelet.conf", "controller-manager.conf", "scheduler.conf")
78+
) or
79+
process.args like (
80+
"/etc/kubernetes/admin.conf",
81+
"/etc/kubernetes/super-admin.conf",
82+
"/etc/kubernetes/kubelet.conf",
83+
"/etc/kubernetes/controller-manager.conf",
84+
"/etc/kubernetes/scheduler.conf",
85+
"/home/*/.kube/config",
86+
"/root/.kube/config",
87+
"/var/lib/*/kubeconfig"
88+
)
89+
) and not process.name in ("stat", "md5sum", "dirname")
90+
'''
91+
92+
[[rule.threat]]
93+
framework = "MITRE ATT&CK"
94+
95+
[[rule.threat.technique]]
96+
id = "T1613"
97+
name = "Container and Resource Discovery"
98+
reference = "https://attack.mitre.org/techniques/T1613/"
99+
100+
[rule.threat.tactic]
101+
id = "TA0007"
102+
name = "Discovery"
103+
reference = "https://attack.mitre.org/tactics/TA0007/"

‎rules/linux/discovery_kubectl_permission_discovery.toml‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
[metadata]
2+
creation_date = "2025/06/17"
3+
integration = ["endpoint"]
4+
maturity = "production"
5+
updated_date = "2025/06/17"
6+
7+
[rule]
8+
author = ["Elastic"]
9+
description = """
10+
This rule detects the use of the "kubectl auth --can-i" command, which is used to check permissions in Kubernetes clusters.
11+
Attackers may use this command to enumerate permissions and discover potential misconfigurations in the cluster, allowing
12+
them to gain unauthorized access or escalate privileges.
13+
"""
14+
from = "now-9m"
15+
index = [
16+
"logs-endpoint.events.process*",
17+
]
18+
language = "eql"
19+
license = "Elastic License v2"
20+
name = "Kubectl Permission Discovery"
21+
references = [
22+
"https://kubernetes.io/docs/reference/kubectl/generated/kubectl_auth/kubectl_auth_can-i/",
23+
]
24+
risk_score = 21
25+
rule_id = "1600f9e2-5be6-4742-8593-1ba50cd94069"
26+
setup = """## Setup
27+
28+
This rule requires data coming in from Elastic Defend.
29+
30+
### Elastic Defend Integration Setup
31+
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
32+
33+
#### Prerequisite Requirements:
34+
- Fleet is required for Elastic Defend.
35+
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
36+
37+
#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
38+
- Go to the Kibana home page and click "Add integrations".
39+
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
40+
- Click "Add Elastic Defend".
41+
- Configure the integration name and optionally add a description.
42+
- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
43+
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
44+
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
45+
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
46+
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
47+
- Click "Save and Continue".
48+
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
49+
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
50+
"""
51+
severity = "low"
52+
tags = [
53+
"Domain: Endpoint",
54+
"Domain: Container",
55+
"OS: Linux",
56+
"Use Case: Threat Detection",
57+
"Tactic: Discovery",
58+
"Data Source: Elastic Defend",
59+
]
60+
timestamp_override = "event.ingested"
61+
type = "eql"
62+
query = '''
63+
process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and
64+
process.name == "kubectl" and process.args == "auth" and process.args == "can-i"
65+
'''
66+
67+
[[rule.threat]]
68+
framework = "MITRE ATT&CK"
69+
70+
[[rule.threat.technique]]
71+
id = "T1613"
72+
name = "Container and Resource Discovery"
73+
reference = "https://attack.mitre.org/techniques/T1613/"
74+
75+
[rule.threat.tactic]
76+
id = "TA0007"
77+
name = "Discovery"
78+
reference = "https://attack.mitre.org/tactics/TA0007/"

‎rules/linux/execution_container_management_binary_launched_inside_container.toml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
creation_date = "2025/03/12"
33
integration = ["endpoint"]
44
maturity = "production"
5-
updated_date = "2025/03/12"
5+
updated_date = "2025/06/17"
66

77
[rule]
88
author = ["Elastic"]
@@ -65,8 +65,9 @@ timestamp_override = "event.ingested"
6565
type = "eql"
6666
query = '''
6767
process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and
68-
process.entry_leader.entry_meta.type == "container" and
69-
process.name in ("dockerd", "docker", "kubelet", "kube-proxy", "kubectl", "containerd", "runc", "systemd", "crictl")
68+
process.entry_leader.entry_meta.type == "container" and process.interactive == true and
69+
process.name in ("dockerd", "docker", "kubelet", "kube-proxy", "kubectl", "containerd", "systemd", "crictl") and
70+
not process.parent.executable in ("/sbin/init", "/usr/bin/dockerd")
7071
'''
7172
note = """## Triage and analysis
7273

‎rules/linux/lateral_movement_kubeconfig_file_activity.toml‎

Lines changed: 118 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,118 @@
1+
[metadata]
2+
creation_date = "2025/06/17"
3+
integration = ["endpoint"]
4+
maturity = "production"
5+
updated_date = "2025/06/17"
6+
7+
[rule]
8+
author = ["Elastic"]
9+
description = """
10+
The kubeconfig file is a critical component in Kubernetes environments, containing configuration
11+
details for accessing and managing Kubernetes clusters. Attackers may attempt to get access to,
12+
create or modify kubeconfig files to gain unauthorized initial access to Kubernetes clusters or
13+
move laterally within the cluster.
14+
"""
15+
from = "now-9m"
16+
index = ["logs-endpoint.events.file*"]
17+
language = "eql"
18+
license = "Elastic License v2"
19+
name = "Kubeconfig File Creation or Modification"
20+
references = [
21+
"https://kubernetes-threat-matrix.redguard.ch/initial-access/kubeconfig-file/",
22+
"https://kubenomicon.com/Initial_access/Kubeconfig_file.html",
23+
]
24+
risk_score = 47
25+
rule_id = "b11116fd-023c-4718-aeb8-fa9d283fc53b"
26+
setup = """## Setup
27+
28+
This rule requires data coming in from Elastic Defend.
29+
30+
### Elastic Defend Integration Setup
31+
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
32+
33+
#### Prerequisite Requirements:
34+
- Fleet is required for Elastic Defend.
35+
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
36+
37+
#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
38+
- Go to the Kibana home page and click "Add integrations".
39+
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
40+
- Click "Add Elastic Defend".
41+
- Configure the integration name and optionally add a description.
42+
- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
43+
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
44+
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
45+
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
46+
47+
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
48+
- Click "Save and Continue".
49+
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
50+
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
51+
"""
52+
severity = "medium"
53+
tags = [
54+
"Domain: Endpoint",
55+
"Domain: Container",
56+
"OS: Linux",
57+
"Use Case: Threat Detection",
58+
"Tactic: Lateral Movement",
59+
"Tactic: Defense Evasion",
60+
"Tactic: Initial Access",
61+
"Data Source: Elastic Defend"
62+
]
63+
timestamp_override = "event.ingested"
64+
type = "eql"
65+
query = '''
66+
file where host.os.type == "linux" and event.type != "deletion" and file.path like (
67+
"/root/.kube/config",
68+
"/home/*/.kube/config",
69+
"/etc/kubernetes/admin.conf",
70+
"/etc/kubernetes/super-admin.conf",
71+
"/etc/kubernetes/kubelet.conf",
72+
"/etc/kubernetes/controller-manager.conf",
73+
"/etc/kubernetes/scheduler.conf",
74+
"/var/lib/*/kubeconfig"
75+
) and not (
76+
process.name in ("kubeadm", "kubelet", "vcluster", "minikube") or
77+
(process.name == "sed" and file.Ext.original.name like "sed*")
78+
)
79+
'''
80+
81+
[[rule.threat]]
82+
framework = "MITRE ATT&CK"
83+
84+
[[rule.threat.technique]]
85+
id = "T1550"
86+
name = "Use Alternate Authentication Material"
87+
reference = "https://attack.mitre.org/techniques/T1550/"
88+
89+
[rule.threat.tactic]
90+
id = "TA0008"
91+
name = "Lateral Movement"
92+
reference = "https://attack.mitre.org/tactics/TA0008/"
93+
94+
[[rule.threat]]
95+
framework = "MITRE ATT&CK"
96+
97+
[[rule.threat.technique]]
98+
id = "T1550"
99+
name = "Use Alternate Authentication Material"
100+
reference = "https://attack.mitre.org/techniques/T1550/"
101+
102+
[rule.threat.tactic]
103+
id = "TA0005"
104+
name = "Defense Evasion"
105+
reference = "https://attack.mitre.org/tactics/TA0005/"
106+
107+
[[rule.threat]]
108+
framework = "MITRE ATT&CK"
109+
110+
[rule.threat.tactic]
111+
id = "TA0001"
112+
name = "Initial Access"
113+
reference = "https://attack.mitre.org/tactics/TA0001/"
114+
115+
[[rule.threat.technique]]
116+
id = "T1078"
117+
name = "Valid Accounts"
118+
reference = "https://attack.mitre.org/techniques/T1078/"

‎rules/windows/command_and_control_outlook_home_page.toml‎

Lines changed: 4 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
creation_date = "2024/08/01"
33
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel"]
44
maturity = "production"
5-
updated_date = "2025/03/20"
5+
updated_date = "2025/06/12"
66

77
[rule]
88
author = ["Elastic"]
@@ -82,12 +82,9 @@ type = "eql"
8282
query = '''
8383
registry where host.os.type == "windows" and event.action != "deletion" and registry.value : "URL" and
8484
registry.path : (
85-
"HKCU\\*\\SOFTWARE\\Microsoft\\Office\\*\\Outlook\\Webview\\Inbox\\URL",
86-
"HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Office\\*\\Outlook\\Webview\\Inbox\\URL",
87-
"HKU\\*\\SOFTWARE\\Microsoft\\Office\\*\\Outlook\\Webview\\Inbox\\URL",
88-
"\\REGISTRY\\USER\\*\\SOFTWARE\\Microsoft\\Office\\*\\Outlook\\Webview\\Inbox\\URL",
89-
"USER\\*\\SOFTWARE\\Microsoft\\Office\\*\\Outlook\\Webview\\Inbox\\URL"
90-
) and registry.data.strings : "*http*"
85+
"*\\SOFTWARE\\Microsoft\\Office\\*\\Outlook\\Webview\\*",
86+
"*\\SOFTWARE\\Microsoft\\Office\\*\\Outlook\\Today\\*"
87+
) and registry.data.strings : "*://*"
9188
'''
9289

9390

0 commit comments

Comments
 (0)