Skip to content

Commit e41f463

Browse files
AegrahAegrah
committed
Second batch
1 parent a98eb73 commit e41f463

5 files changed

+68
-62
lines changed

‎rules/linux/command_and_control_ip_forwarding_activity.toml‎

Lines changed: 14 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
[metadata]
22
creation_date = "2024/11/04"
3-
integration = ["endpoint", "sentinel_one_cloud_funnel"]
3+
integration = ["endpoint", "sentinel_one_cloud_funnel", "crowdstrike"]
44
maturity = "production"
5-
updated_date = "2025/03/20"
5+
updated_date = "2025/10/17"
66

77
[rule]
88
author = ["Elastic"]
@@ -12,7 +12,7 @@ forwarding can be used to route network traffic between different network interf
1212
pivot between networks, exfiltrate data, or establish command and control channels.
1313
"""
1414
from = "now-9m"
15-
index = ["endgame-*", "logs-endpoint.events.process*", "logs-sentinel_one_cloud_funnel.*"]
15+
index = ["endgame-*", "logs-endpoint.events.process*", "logs-sentinel_one_cloud_funnel.*", "logs-crowdstrike.fdr*"]
1616
language = "eql"
1717
license = "Elastic License v2"
1818
name = "IPv4/IPv6 Forwarding Activity"
@@ -55,21 +55,22 @@ risk_score = 21
5555
rule_id = "5a138e2e-aec3-4240-9843-56825d0bc569"
5656
severity = "low"
5757
tags = [
58-
"Domain: Endpoint",
59-
"OS: Linux",
60-
"Use Case: Threat Detection",
61-
"Tactic: Command and Control",
62-
"Data Source: Elastic Defend",
63-
"Data Source: SentinelOne",
64-
"Data Source: Elastic Endgame",
65-
"Resources: Investigation Guide",
58+
"Domain: Endpoint",
59+
"OS: Linux",
60+
"Use Case: Threat Detection",
61+
"Tactic: Command and Control",
62+
"Data Source: Elastic Defend",
63+
"Data Source: SentinelOne",
64+
"Data Source: Elastic Endgame",
65+
"Resources: Investigation Guide",
66+
"Data Source: Crowdstrike",
6667
]
6768
timestamp_override = "event.ingested"
6869
type = "eql"
6970

7071
query = '''
71-
process where host.os.type == "linux" and event.type == "start" and event.action in ("exec", "start", "exec_event") and
72-
process.parent.executable != null and process.command_line like (
72+
process where host.os.type == "linux" and event.type == "start" and event.action in ("exec", "start", "exec_event", "ProcessRollup2") and
73+
?process.parent.executable != null and process.command_line like (
7374
"*net.ipv4.ip_forward*", "*/proc/sys/net/ipv4/ip_forward*", "*net.ipv6.conf.all.forwarding*",
7475
"*/proc/sys/net/ipv6/conf/all/forwarding*"
7576
) and (

‎rules/linux/defense_evasion_hex_payload_execution_via_commandline.toml‎

Lines changed: 13 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
[metadata]
22
creation_date = "2025/04/29"
3-
integration = ["endpoint"]
3+
integration = ["endpoint", "crowdstrike"]
44
maturity = "production"
5-
updated_date = "2025/07/07"
5+
updated_date = "2025/10/17"
66

77
[rule]
88
author = ["Elastic"]
@@ -11,7 +11,7 @@ This rule detects when a process executes a command line containing hexadecimal
1111
hexadecimal encoding to obfuscate their payload and evade detection.
1212
"""
1313
from = "now-9m"
14-
index = ["logs-endpoint.events.process*"]
14+
index = ["logs-endpoint.events.process*", "logs-crowdstrike.fdr*"]
1515
language = "eql"
1616
license = "Elastic License v2"
1717
name = "Potential Hex Payload Execution via Command-Line"
@@ -78,19 +78,20 @@ For more details on Elastic Defend refer to the [helper guide](https://www.elast
7878
"""
7979
severity = "low"
8080
tags = [
81-
"Domain: Endpoint",
82-
"OS: Linux",
83-
"Use Case: Threat Detection",
84-
"Tactic: Defense Evasion",
85-
"Tactic: Execution",
86-
"Data Source: Elastic Defend",
87-
"Resources: Investigation Guide",
81+
"Domain: Endpoint",
82+
"OS: Linux",
83+
"Use Case: Threat Detection",
84+
"Tactic: Defense Evasion",
85+
"Tactic: Execution",
86+
"Data Source: Elastic Defend",
87+
"Resources: Investigation Guide",
88+
"Data Source: Crowdstrike",
8889
]
8990
timestamp_override = "event.ingested"
9091
type = "eql"
9192
query = '''
92-
process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and
93-
process.parent.executable != null and
93+
process where host.os.type == "linux" and event.type == "start" and event.action in ("exec", "ProcessRollup2") and
94+
?process.parent.executable != null and
9495
process.command_line : "*\\x*\\x*\\x*\\x*\\x*\\x*\\x*\\x*\\x*\\x*\\x*\\x*\\x*\\x*" and
9596
length(process.command_line) > 50
9697
'''

‎rules/linux/defense_evasion_sysctl_kernel_feature_activity.toml‎

Lines changed: 14 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
[metadata]
22
creation_date = "2025/04/29"
3-
integration = ["endpoint"]
3+
integration = ["endpoint", "crowdstrike"]
44
maturity = "production"
5-
updated_date = "2025/07/07"
5+
updated_date = "2025/10/17"
66

77
[rule]
88
author = ["Elastic"]
@@ -14,7 +14,8 @@ NMI watchdog by setting kernel.nmi_watchdog to 0. These changes may be used to i
1414
"""
1515
from = "now-9m"
1616
index = [
17-
"logs-endpoint.events.process*",
17+
"logs-endpoint.events.process*",
18+
"logs-crowdstrike.fdr*",
1819
]
1920
language = "eql"
2021
license = "Elastic License v2"
@@ -59,18 +60,19 @@ risk_score = 21
5960
rule_id = "3aff6ab1-18bd-427e-9d4c-c5732110c261"
6061
severity = "low"
6162
tags = [
62-
"Domain: Endpoint",
63-
"OS: Linux",
64-
"Use Case: Threat Detection",
65-
"Tactic: Defense Evasion",
66-
"Tactic: Discovery",
67-
"Data Source: Elastic Defend",
68-
"Resources: Investigation Guide",
63+
"Domain: Endpoint",
64+
"OS: Linux",
65+
"Use Case: Threat Detection",
66+
"Tactic: Defense Evasion",
67+
"Tactic: Discovery",
68+
"Data Source: Elastic Defend",
69+
"Resources: Investigation Guide",
70+
"Data Source: Crowdstrike",
6971
]
7072
timestamp_override = "event.ingested"
7173
type = "eql"
7274
query = '''
73-
process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and
75+
process where host.os.type == "linux" and event.type == "start" and event.action in ("exec", "ProcessRollup2") and
7476
process.command_line : (
7577
"*/etc/sysctl.conf*", "*/etc/sysctl.d/*", "*/proc/sys/kernel/nmi_watchdog*",
7678
"*/proc/sys/vm/nr_hugepages*", "*/proc/sys/kernel/yama/ptrace_scope*",
@@ -80,7 +82,7 @@ process.command_line : (
8082
"*kernel.nmi_watchdog*", "*vm.nr_hugepages*", "*vm.drop_caches*",
8183
"*kernel.sysrq*"
8284
) and
83-
process.parent.executable != null and
85+
?process.parent.executable != null and
8486
(
8587
(process.name == "tee" and process.args like "-*a*") or // also detects --append
8688
(process.name == "cat" and not process.parent.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish")) or

‎rules/linux/exfiltration_potential_curl_data_exfiltration.toml‎

Lines changed: 12 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
[metadata]
22
creation_date = "2025/04/29"
3-
integration = ["endpoint"]
3+
integration = ["endpoint", "crowdstrike"]
44
maturity = "production"
5-
updated_date = "2025/07/07"
5+
updated_date = "2025/10/17"
66

77
[rule]
88
author = ["Elastic"]
@@ -13,7 +13,7 @@ actors have been seen utilizing curl to upload this archive file with the collec
1313
way while not inherently malicious should be considered highly abnormal and suspicious activity.
1414
"""
1515
from = "now-9m"
16-
index = ["logs-endpoint.events.process*"]
16+
index = ["logs-endpoint.events.process*", "logs-crowdstrike.fdr*"]
1717
language = "eql"
1818
license = "Elastic License v2"
1919
name = "Potential Data Exfiltration Through Curl"
@@ -95,18 +95,19 @@ For more information on capturing environment variables refer to the [helper gui
9595
"""
9696
severity = "medium"
9797
tags = [
98-
"Domain: Endpoint",
99-
"OS: Linux",
100-
"Use Case: Threat Detection",
101-
"Tactic: Exfiltration",
102-
"Data Source: Elastic Defend",
103-
"Resources: Investigation Guide",
98+
"Domain: Endpoint",
99+
"OS: Linux",
100+
"Use Case: Threat Detection",
101+
"Tactic: Exfiltration",
102+
"Data Source: Elastic Defend",
103+
"Resources: Investigation Guide",
104+
"Data Source: Crowdstrike",
104105
]
105106
timestamp_override = "event.ingested"
106107
type = "eql"
107108
query = '''
108-
process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and process.name == "curl" and
109-
process.parent.executable != null and (process.args in ("-F", "-T", "-d") or process.args like "--data*") and
109+
process where host.os.type == "linux" and event.type == "start" and event.action in ("exec", "ProcessRollup2") and process.name == "curl" and
110+
?process.parent.executable != null and (process.args in ("-F", "-T", "-d") or process.args like "--data*") and
110111
process.command_line like~ ("*@/*.zip*", "*@/*.gz*", "*@/*.tgz*", "*b64=@*", "*=<*") and
111112
process.command_line like~ "*http*"
112113
'''

‎rules/linux/impact_memory_swap_modification.toml‎

Lines changed: 15 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
[metadata]
22
creation_date = "2024/11/04"
3-
integration = ["endpoint", "sentinel_one_cloud_funnel"]
3+
integration = ["endpoint", "sentinel_one_cloud_funnel", "crowdstrike"]
44
maturity = "production"
5-
updated_date = "2025/03/20"
5+
updated_date = "2025/10/17"
66

77
[rule]
88
author = ["Elastic"]
@@ -12,7 +12,7 @@ the system's memory and potentially impact the system's performance. This behavi
1212
deploys miner software such as XMRig.
1313
"""
1414
from = "now-9m"
15-
index = ["endgame-*", "logs-endpoint.events.process*", "logs-sentinel_one_cloud_funnel.*"]
15+
index = ["endgame-*", "logs-endpoint.events.process*", "logs-sentinel_one_cloud_funnel.*", "logs-crowdstrike.fdr*"]
1616
language = "eql"
1717
license = "Elastic License v2"
1818
name = "Memory Swap Modification"
@@ -82,22 +82,23 @@ For more details on Elastic Defend refer to the [helper guide](https://www.elast
8282
"""
8383
severity = "low"
8484
tags = [
85-
"Domain: Endpoint",
86-
"OS: Linux",
87-
"Use Case: Threat Detection",
88-
"Tactic: Impact",
89-
"Tactic: Execution",
90-
"Data Source: Elastic Defend",
91-
"Data Source: SentinelOne",
92-
"Data Source: Elastic Endgame",
93-
"Resources: Investigation Guide",
85+
"Domain: Endpoint",
86+
"OS: Linux",
87+
"Use Case: Threat Detection",
88+
"Tactic: Impact",
89+
"Tactic: Execution",
90+
"Data Source: Elastic Defend",
91+
"Data Source: SentinelOne",
92+
"Data Source: Elastic Endgame",
93+
"Resources: Investigation Guide",
94+
"Data Source: Crowdstrike",
9495
]
9596
timestamp_override = "event.ingested"
9697
type = "eql"
9798

9899
query = '''
99-
process where host.os.type == "linux" and event.type == "start" and event.action in ("exec", "exec_event", "start") and
100-
process.parent.executable != null and
100+
process where host.os.type == "linux" and event.type == "start" and event.action in ("exec", "exec_event", "start", "ProcessRollup2") and
101+
?process.parent.executable != null and
101102
process.name in ("swapon", "swapoff") or (
102103
process.command_line like ("*vm.swappiness*", "*/proc/sys/vm/swappiness*") and (
103104
(process.name == "sysctl" and process.args like ("*-w*", "*--write*", "*=*")) or

0 commit comments

Comments
 (0)