Skip to content

[New/Tuning] Several New Linux Rules #5531

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
Aegrah merged 9 commits into from
Jan 8, 2026
Merged

[New/Tuning] Several New Linux Rules #5531

Aegrah merged 9 commits into from
Jan 8, 2026

Conversation

@Aegrah
Copy link
Contributor

@Aegrah Aegrah commented Jan 7, 2026

Summary

Creating several new Linux rules, to cover gaps related to wget file exfiltration, dmidecode system reconnaissance from a shell process (seen in DinodasRAT), and rules related to video/audio/screenshot capturing.

@Aegrah Aegrah self-assigned this Jan 7, 2026
@Aegrah Aegrah added OS: Linux Rule: New Proposal for new rule Team: TRADE labels Jan 7, 2026
@github-actions
Copy link
Contributor

github-actions bot commented Jan 7, 2026

Rule: New - Guidelines

These guidelines serve as a reminder set of considerations when proposing a new rule.

Documentation and Context

  • Detailed description of the rule.
  • List any new fields required in ECS/data sources.
  • Link related issues or PRs.
  • Include references.

Rule Metadata Checks

  • creation_date matches the date of creation PR initially merged.
  • min_stack_version should support the widest stack versions.
  • name and description should be descriptive and not include typos.
  • query should be inclusive, not overly exclusive, considering performance for diverse environments. Non ecs fields should be added to non-ecs-schema.json if not available in an integration.
  • min_stack_comments and min_stack_version should be included if the rule is only compatible starting from a specific stack version.
  • index pattern should be neither too specific nor too vague, ensuring it accurately matches the relevant data stream (e.g., use logs-endpoint.process-* for process data).
  • integration should align with the index. If the integration is newly introduced, ensure the manifest, schemas, and new_rule.yaml template are updated.
  • setup should include the necessary steps to configure the integration.
  • note should include any additional information (e.g. Triage and analysis investigation guides, timeline templates).
  • tags should be relevant to the threat and align/added to the EXPECTED_RULE_TAGS in the definitions.py file.
  • threat, techniques, and subtechniques should map to ATT&CK always if possible.

New BBR Rules

  • building_block_type should be included if the rule is a building block and the rule should be located in the rules_building_block folder.
  • bypass_bbr_timing should be included if adding custom lookback timing to the rule.

Testing and Validation

  • Provide evidence of testing and detecting the expected threat.
  • Check for existence of coverage to prevent duplication.

@tradebot-elastic
Copy link

tradebot-elastic commented Jan 7, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Linux Audio Recording Activity Detected (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System Information Discovery via dmidecode from Parent Shell (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Data Exfiltration Through Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Linux Video Recording or Screenshot Activity Detected (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Data Exfiltration Through Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Jan 7, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Linux Audio Recording Activity Detected (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System Information Discovery via dmidecode from Parent Shell (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Data Exfiltration Through Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Linux Video Recording or Screenshot Activity Detected (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Data Exfiltration Through Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Jan 7, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Linux Audio Recording Activity Detected (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Data Exfiltration Through Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Linux Video Recording or Screenshot Activity Detected (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Data Exfiltration Through Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System Information Discovery via dmidecode from Parent Shell (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

Mikaayenson
Mikaayenson approved these changes Jan 7, 2026
View reviewed changes
rules/linux/exfiltration_potential_wget_data_exfiltration.toml
rule_id = "8d8c0b55-ef27-4c20-959f-fa8dd3ac25e6"
setup = """## Setup

This rule requires data coming in from Elastic Defend.
Copy link
Contributor

@Mikaayenson Mikaayenson Jan 7, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Perhaps we don't need other datasources if it requires Defend (e.g. beats)?

Copy link
Contributor Author

@Aegrah Aegrah Jan 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I added the default setup template for Defend, because most users will be using this. We don't have standardized ones for sentinelone/crowdstrike/endgame, and it doesn't require any specific flags for auditd/auditd manager to work OOTB

Aegrah and others added 2 commits January 8, 2026 11:12
@tradebot-elastic
Copy link

tradebot-elastic commented Jan 8, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Linux Audio Recording Activity Detected (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Data Exfiltration Through Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Linux Video Recording or Screenshot Activity Detected (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Data Exfiltration Through Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System Information Discovery via dmidecode from Parent Shell (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Jan 8, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Linux Audio Recording Activity Detected (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Data Exfiltration Through Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Linux User or Group Deletion (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Linux Video Recording or Screenshot Activity Detected (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Data Exfiltration Through Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System Information Discovery via dmidecode from Parent Shell (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

eric-forte-elastic
eric-forte-elastic approved these changes Jan 8, 2026
View reviewed changes
Copy link
Contributor

@eric-forte-elastic eric-forte-elastic left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Manual review, looks good to me! 👍

@tradebot-elastic
Copy link

tradebot-elastic commented Jan 8, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Linux Audio Recording Activity Detected (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Data Exfiltration Through Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Linux User or Group Deletion (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Linux Video Recording or Screenshot Activity Detected (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Data Exfiltration Through Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System Information Discovery via dmidecode from Parent Shell (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@Aegrah Aegrah merged commit 11769a4 into main Jan 8, 2026
14 checks passed
@Aegrah Aegrah deleted the new-rules-linux-dr branch January 8, 2026 15:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Mikaayenson Mikaayenson Mikaayenson approved these changes

@eric-forte-elastic eric-forte-elastic eric-forte-elastic approved these changes

@DefSecSentinel DefSecSentinel Awaiting requested review from DefSecSentinel

@Samirbous Samirbous Awaiting requested review from Samirbous

@shashank-elastic shashank-elastic Awaiting requested review from shashank-elastic

@terrancedejesus terrancedejesus Awaiting requested review from terrancedejesus

Assignees

@Aegrah Aegrah

Labels

backport: auto Domain: Endpoint OS: Linux Rule: New Proposal for new rule Team: TRADE

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@Aegrah @tradebot-elastic @Mikaayenson @eric-forte-elastic