diff --git a/.backportrc.json b/.backportrc.json index 3dac3eab40..22bb47f8e6 100644 --- a/.backportrc.json +++ b/.backportrc.json @@ -1,5 +1,5 @@ { "upstream": "elastic/security-docs", - "branches": [{ "name": "7.x", "checked": true }, "8.4", "8.3", "8.2", "8.1", "8.0", "7.17", "7.16", "7.15", "7.14", "7.13", "7.12", "7.11", "7.10", "7.9", "7.8"], + "branches": ["8.x", "8.18", "8.17", "8.16", "8.15", "8.14", "8.13", "8.12", "8.11", "8.10", "8.9", "8.8", "8.7", "8.6", "8.5", "8.4", "8.3", "8.2", "8.1", "8.0", "7.17", "7.16", "7.15", "7.14", "7.13", "7.12", "7.11", "7.10", "7.9", "7.8"], "labels": ["backport"] } diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS new file mode 100644 index 0000000000..fdf053be76 --- /dev/null +++ b/.github/CODEOWNERS @@ -0,0 +1,2 @@ +* @elastic/security-docs +/.github/workflows/co-docs-builder.yml @elastic/docs-engineering diff --git a/.github/ISSUE_TEMPLATE/breaking-change.yaml b/.github/ISSUE_TEMPLATE/breaking-change.yaml new file mode 100644 index 0000000000..bcf6f0be0d --- /dev/null +++ b/.github/ISSUE_TEMPLATE/breaking-change.yaml @@ -0,0 +1,40 @@ +name: "Breaking change report" +description: "Report a breaking change in Elastic Security" +title: "[BREAKING CHANGE] " +labels: "breaking-change" +body: + - type: markdown + attributes: + value: | + Hello! Use this form to report a breaking change in Elastic Security software to the [@elastic/security-docs](https://github.com/orgs/elastic/teams/security-docs) team. We will add it to the release notes for the version that introduces the breaking change. + - type: textarea + id: description + attributes: + label: Description + description: What feature will break? Any more details about how it will break? Please include any recommendations for users who were using the feature with the breaking change. + validations: + required: true + - type: dropdown + id: doc-set + attributes: + label: Which deployment types are affected? + description: ESS (classic), serverless, or both? + options: + - ESS and serverless + - ESS only + - Serverless only + - Unknown + default: 0 + validations: + required: true + - type: textarea + id: software-version + attributes: + label: Release version + description: If you selected ESS above, please list which Stack version(s) this breaking change applies to. + placeholder: | + For example: + "This breaking change applies to Stack versions 8.10 and newer." + "N/A" + validations: + required: false diff --git a/.github/ISSUE_TEMPLATE/bug-report.md b/.github/ISSUE_TEMPLATE/bug-report.md deleted file mode 100644 index 97e8dafdf3..0000000000 --- a/.github/ISSUE_TEMPLATE/bug-report.md +++ /dev/null @@ -1,12 +0,0 @@ ---- -name: Bug report -about: Report documentation bugs or fixes. -title: "[BUG]" -labels: TEAM:Docs, bug -assignees: '' - ---- - -**Description**: Summarize the problem and what text needs to be omitted, changed, or replaced. - -**URL link or topic name**: diff --git a/.github/ISSUE_TEMPLATE/bug-report.yaml b/.github/ISSUE_TEMPLATE/bug-report.yaml new file mode 100644 index 0000000000..36f30bc9a9 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/bug-report.yaml @@ -0,0 +1,58 @@ +name: "Bug report" +description: "Report a bug in the Elastic Security documentation" +title: "[BUG] " +labels: "bug" +body: + - type: markdown + attributes: + value: | + Hello! Use this form to report an Elastic Security documentation bug to the [@elastic/security-docs](https://github.com/orgs/elastic/teams/security-docs) team. + - type: textarea + id: doc-links + attributes: + label: Documentation links + description: Which doc(s) is affected? + placeholder: | + Elastic Security overview: https://www.elastic.co/guide/en/security/current/es-overview.html + validations: + required: true + - type: textarea + id: description + attributes: + label: Description + description: Describe the bug. What needs to be removed, edited, added, or replaced? Please also include instructions on how to reproduce the bug, if necessary. + validations: + required: true + - type: dropdown + id: doc-set + attributes: + label: Which documentation set(s) does this bug apply to? + description: ESS (classic), serverless, or both? + options: + - ESS and serverless + - ESS only + - Serverless only + - Unknown + default: 0 + validations: + required: true + - type: textarea + id: software-version + attributes: + label: Release version + description: If you selected ESS above, please list which Stack version(s) this bug applies to. + placeholder: | + For example: + "This bug applies to Stack versions 8.10 and newer." + "N/A" + validations: + required: false + - type: textarea + id: testing-env + attributes: + label: Testing environment + description: Please include the URL to the server or test environment, or include instructions on how to generate test data. + placeholder: | + You can find this in the Kibana dev server: https://kibana.siem.estc.dev/ + validations: + required: true diff --git a/.github/ISSUE_TEMPLATE/docs-request-internal.yaml b/.github/ISSUE_TEMPLATE/docs-request-internal.yaml new file mode 100644 index 0000000000..19839308be --- /dev/null +++ b/.github/ISSUE_TEMPLATE/docs-request-internal.yaml @@ -0,0 +1,100 @@ +name: "Doc request for a new feature or enhancement (Elastic employees only)" +description: Request documentation for a new feature or enhancement. +title: "[Request] " +body: + - type: markdown + attributes: + value: | + Hello! This form will create an issue that the Security docs team will triage and prioritize. Please do not add any labels to your issue — we'll take care of that. + - type: textarea + id: description + attributes: + label: Description + description: Describe what needs to be documented. What details do users need to know about? What are typical workflows for the feature? + placeholder: | + What: We're introducing new feature A. + Why: This feature will make X, Y, and Z easier for the user. + How: The user navigates to *Foo* → *Bar*, then clicks the *Wow* button. + validations: + required: true + - type: textarea + id: related + attributes: + label: Background & resources + description: | + Please include relevant pull requests or issues, and at least one point of contact. + Also include any test environments where we can access the feature, and list steps to generate data we can test. + value: | + * PRs: + * Issues/metas: + * Point of contact: + * Test environments: + validations: + required: true + - type: dropdown + id: doc-set + attributes: + label: Which documentation set does this change impact? + description: ESS (classic), serverless, or both? + options: + - ESS and serverless + - ESS only + - Serverless only + - Unknown + default: 0 + validations: + required: true + - type: textarea + id: version-ess + attributes: + label: ESS release + description: Please provide a release version if your request is tied to the Elastic Stack release schedule. + placeholder: | + For example: + "The functionality is being introduced in ESS version 8.18.0" + validations: + required: true + - type: input + id: release-serverless + attributes: + label: Serverless release + description: When do you expect the feature to be promoted and available in the _**serverless production environment**_? + placeholder: The week of April 1, 2024 + validations: + required: true + - type: textarea + id: doc-set-differences + attributes: + label: Feature differences + description: If you selected both ESS and serverless above, please describe how, if at all, the feature differs in each platform. + placeholder: The feature is identical in ESS and serverless. + validations: + required: true + - type: textarea + id: api-docs + attributes: + label: API docs impact + description: Please provide endpoint and parameter descriptions, and request and response examples. + placeholder: | + What: We're introducing new endpoint A. + Why: Users can send a request to endpoint A to use feature A. + How: The user provides the specific information in the request. + validations: + required: true + - type: textarea + id: prereqs + attributes: + label: Prerequisites, privileges, feature flags + description: | + What are the feature's requirements _**in both ESS and serverless**_? What subscription tiers or user role privileges are required? + Is the feature behind a feature flag, and if so, what is it? + placeholder: | + * ESS: Requires Enterprise subscription; `write` privilege for `yada-yada-*` index + * Serverless: Requires Security Analytics Complete tier and Endpoint Protection Complete add-on; X, Y, or Z user roles + * Feature flag: None + validations: + required: false + - type: markdown + attributes: + value: | + Thanks for completing this form to help us understand and plan accordingly. We'll be in touch soon! diff --git a/.github/ISSUE_TEMPLATE/documentation-issue.md b/.github/ISSUE_TEMPLATE/documentation-issue.md deleted file mode 100644 index bb4c5d2e3e..0000000000 --- a/.github/ISSUE_TEMPLATE/documentation-issue.md +++ /dev/null @@ -1,23 +0,0 @@ ---- -name: Documentation Issue -about: Describe your Elastic security documentation issue. -title: '[DOCS]' -assignees: '' - ---- - -## Description - -[insert a summary of the doc issue here. Background information is especially useful]. Include a link to the related issue or pull request. - -## Acceptance Test Criteria - -List all the ATC of each action and its intended result. -For example: As a user, when [action (e.g., viewing, clicking, selecting, etc.)] I should [insert the expected result]. - - -## Notes - -- Add all appropriate labels to the issue, especially the version number label. -- Be sure to add any necessary screenshots, code text or console commands for clarity. -- Include any conditions or caveats that may affect customers. diff --git a/.github/ISSUE_TEMPLATE/enhancement-request.yaml b/.github/ISSUE_TEMPLATE/enhancement-request.yaml new file mode 100644 index 0000000000..2c393a9f53 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/enhancement-request.yaml @@ -0,0 +1,58 @@ +name: "Request a documentation improvement" +description: Request a change to improve Elastic Security docs. +title: "[Suggestion] " +labels: "suggestion" +body: + - type: markdown + attributes: + value: | + Hello! Do you see something in our docs that needs clarification, more info, or something else we can improve? Use this form to submit a request to our [@elastic/security-docs](https://github.com/orgs/elastic/teams/security-docs) team. + - type: textarea + id: description + attributes: + label: What can we change to make the docs better? + description: Please describe what the issue is and what we can do to improve it. + placeholder: | + What: We need documentation for X. + Why: We've received support requests that indicate customers are struggling with Y in versions A and B. + validations: + required: true + - type: textarea + id: related + attributes: + label: Doc URL + description: How can we learn more about the problem? + value: | + Please include the doc URL and any other related information where applicable: + Doc URL: + Github issue link(s)/Other resources: + validations: + required: false + - type: dropdown + id: doc-set + attributes: + label: Which documentation set needs improvement? + description: ESS, serverless, or both? + options: + - ESS and serverless + - ESS only + - Serverless only + - Unknown / Not applicable + default: 0 + validations: + required: true + - type: textarea + id: software-version + attributes: + label: Software version + description: Is the problem applicable to a particular release version? If so, which one(s)? + placeholder: | + For example: + "The functionality was introduced in 8.11.0, so docs need updating for 8.11+"; + "The docs are good after version 8.10, but need updating in 8.7, 8.8, and 8.9" + validations: + required: true + - type: markdown + attributes: + value: | + Thanks for submitting this issue! For urgent issues, we encourage you to send a message in the [#security-docs](https://elastic.slack.com/archives/C013W8WME2Z) Slack channel. \ No newline at end of file diff --git a/.github/ISSUE_TEMPLATE/issue.md b/.github/ISSUE_TEMPLATE/issue.md deleted file mode 100644 index 31ddf170dd..0000000000 --- a/.github/ISSUE_TEMPLATE/issue.md +++ /dev/null @@ -1,12 +0,0 @@ -**Description** -[insert a summary of the doc issue here. Background information is especially useful]. - -**Acceptance Test Criteria** -List all the ATC of each action and its intended result. -As a user, when [action (e.g., viewing, clicking, selecting, etc.)] the [insert the expected result]. -If the doc issue includes a procedure, number the steps in sequential order. - -**Notes** -Add the **"Team:Docs"** label to new issues. -Be sure to add any necessary screenshots for clarity. -Include any conditions or caveats that may affect customers. diff --git a/.github/ISSUE_TEMPLATE/ui-copy-request.yaml b/.github/ISSUE_TEMPLATE/ui-copy-request.yaml new file mode 100644 index 0000000000..aa4fb1992c --- /dev/null +++ b/.github/ISSUE_TEMPLATE/ui-copy-request.yaml @@ -0,0 +1,97 @@ +name: "UI copy request" +description: Submit a UI copy-related request to the security documentation team. +title: "[UI copy]: " +labels: "ui-copy" +body: + - type: markdown + attributes: + value: | + Hello! Use this form to submit a UI-related issue to the [@elastic/security-docs](https://github.com/orgs/elastic/teams/security-docs) team. + - type: textarea + id: description + attributes: + label: Description + description: Summarize your request here. What is the work and how can we help? Do we need to write new copy, or edit existing copy? Feel free to include screenshots. + placeholder: | + What: We're introducing new feature A. + When: This feature will launch at the completion of project B. + Why: This feature will make X, Y, and Z easier for the user. + validations: + required: true + - type: textarea + id: related + attributes: + label: Related links / assets + description: Where can the documentation team learn more about this feature? + value: | + Please include each of the following, if applicable: + Figma link(s): + Github epic link(s): + Github issue link(s): + How to find the text in a production environment: + Testing environment information: + NOTE: To keep sensitive information such as credentials secure, do not include it in this form. + validations: + required: true + - type: dropdown + id: doc-set + attributes: + label: Which documentation set does this change impact? + description: ESS, serverless, or both? + options: + - ESS and serverless + - ESS only + - Serverless only + - Unknown / Not applicable + default: 0 + validations: + required: true + - type: textarea + id: doc-set-differences + attributes: + label: Feature differences + description: If you selected both ESS and serverless above, please describe how, if at all, the feature differs in each deployment method. + placeholder: The feature is identical in ESS and serverless. + validations: + required: true + - type: textarea + id: software-version + attributes: + label: Software version + description: Is this work targeted for a particular release version? If so, which one? + placeholder: | + For example: + "8.13.0"; + "This feature has been in production since 8.11.0"; + "N/A" + validations: + required: true + - type: textarea + id: collaborators + attributes: + label: Collaborators + description: Please include contact information for the responsible product manager, designer, and developer. + value: | + PM: + Designer: + Developer: + Others (if applicable): + validations: + required: true + - type: textarea + id: timeline + attributes: + label: Timeline / deliverables + description: When would it be ideal for for us to complete the request? What deliverables do you need, and when? If applicable, how do the release timelines for this feature differ between serverless / stateful? + placeholder: | + For example: + + We need a final draft of the new UI copy no later than December 5, ideally by December 1. No differences between serverless/ESS. + + This is an urgent request, it would be great to have updated copy for A and B ASAP, since the original copy is already in production. No differences between serverless/ESS. + validations: + required: true + - type: markdown + attributes: + value: | + Thanks for submitting this issue! For urgent issues, we encourage you to send a message in the [#security-docs](https://elastic.slack.com/archives/C013W8WME2Z) Slack channel. \ No newline at end of file diff --git a/.github/workflows/co-docs-builder.yml b/.github/workflows/co-docs-builder.yml new file mode 100644 index 0000000000..2388b1fc46 --- /dev/null +++ b/.github/workflows/co-docs-builder.yml @@ -0,0 +1,36 @@ +name: Elastic docs + +on: + pull_request_target: + # The paths property can be omitted entirely if the repo is mainly used for docs. Leaving it in can result in builds that + # have branch protection checks in place lose the ability to merge because the workflow is not starting. If this property + # is included, please ensure that branch protection checks are disabled for the repo. + paths: + # Preface with your docs dir if you need further specificity (optional) + - 'docs/serverless/**.mdx' + - 'docs/serverless/**.docnav.json' + - 'docs/serverless/**.docapi.json' + - 'docs/serverless/**.devdocs.json' + - 'docs/serverless/**.jpg' + - 'docs/serverless/**.jpeg' + - 'docs/serverless/**.svg' + - 'docs/serverless/**.png' + - 'docs/serverless/**.gif' + types: [closed, opened, synchronize, labeled] + +jobs: + publish: + if: contains(github.event.pull_request.labels.*.name, 'ci:doc-build') + uses: elastic/dev-docs-workflows/.github/workflows/docs-versioned-publish.yml@main + with: + # Refers to Vercel project + project-name: elastic-dot-co-docs-preview-docs + # Which prebuild step (dev or not) + prebuild: wordlake-docs + # Docsmobile project dir + site-repo: docs-site + secrets: + VERCEL_GITHUB_TOKEN: ${{ secrets.VERCEL_GITHUB_TOKEN_PUBLIC }} + VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN_PUBLIC }} + VERCEL_ORG_ID: ${{ secrets.VERCEL_ORG_ID_PUBLIC }} + VERCEL_PROJECT_ID: ${{ secrets.VERCEL_PROJECT_ID_ELASTIC_DOT_CO_DOCS_PRODUCTION_PUBLIC }} diff --git a/.github/workflows/delete-serverless-dir-in-backports.yml b/.github/workflows/delete-serverless-dir-in-backports.yml new file mode 100644 index 0000000000..ef25ff2e23 --- /dev/null +++ b/.github/workflows/delete-serverless-dir-in-backports.yml @@ -0,0 +1,35 @@ +name: Delete serverless directory in backports + +on: + pull_request: + branches: + - '7.*' + - '8.*' + +jobs: + check-and-delete-serverless: + runs-on: ubuntu-latest + + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Check for existence of docs/serverless directory + id: check_serverless + run: | + if [ -d "docs/serverless" ]; then + echo "SERVERLESS_EXISTS=true" >> $GITHUB_ENV + else + echo "SERVERLESS_EXISTS=false" >> $GITHUB_ENV + fi + - name: Delete docs/serverless directory if it exists + if: env.SERVERLESS_EXISTS == 'true' + run: | + rm -rf docs/serverless + git config pull.rebase true + git config --global user.name 'github-actions[bot]' + git config --global user.email 'github-actions[bot]@users.noreply.github.com' + git add . + git commit -m "Delete docs/serverless directory and its contents" + git pull origin ${{ github.head_ref }} + git push origin HEAD:${{ github.head_ref }} diff --git a/.github/workflows/docs-preview-links.yml b/.github/workflows/docs-preview-links.yml deleted file mode 100644 index 03711cfa6b..0000000000 --- a/.github/workflows/docs-preview-links.yml +++ /dev/null @@ -1,25 +0,0 @@ -name: Docs Preview Links - -on: - pull_request_target: - types: [opened] - -jobs: - doc-preview: - runs-on: ubuntu-latest - steps: - - uses: actions/github-script@v6 - name: Add doc preview links - with: - script: | - const pr = context.payload.pull_request; - const comment = `Documentation previews: - - ✨ [HTML diff](https://${context.repo.repo}_${pr.number}.docs-preview.app.elstc.co/diff) - - 📙 [Elastic Security Guide](https://${context.repo.repo}_${pr.number}.docs-preview.app.elstc.co/guide/en/security/master/index.html)`; - - github.rest.issues.createComment({ - issue_number: context.issue.number, - owner: context.repo.owner, - repo: context.repo.repo, - body: comment, - }); diff --git a/.github/workflows/docs-preview.yml b/.github/workflows/docs-preview.yml new file mode 100644 index 0000000000..56a0cf15a5 --- /dev/null +++ b/.github/workflows/docs-preview.yml @@ -0,0 +1,19 @@ + name: docs-preview + + on: + pull_request_target: + types: [opened] + + permissions: + pull-requests: write + + jobs: + doc-preview-pr: + runs-on: ubuntu-latest + steps: + - uses: elastic/docs/.github/actions/docs-preview@master + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + repo: ${{ github.event.repository.name }} + preview-path: 'guide/en/security/master/index.html' + pr: ${{ github.event.pull_request.number }} diff --git a/.gitignore b/.gitignore index ac7b1187a4..cb103a0741 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,5 @@ .DS_Store docs/html_docs /html_docs +.vscode/ +.vs/ diff --git a/.mergify.yml b/.mergify.yml index acb17ee7ce..1269dd45b3 100644 --- a/.mergify.yml +++ b/.mergify.yml @@ -13,10 +13,217 @@ pull_request_rules: git merge upstream/{{base}} git push upstream {{head}} ``` + - name: backport patches to main branch + conditions: + - merged + - label=backport-main + actions: + backport: + assignees: + - "{{ author }}" + labels: + - "backport" + branches: + - "main" + title: "[{{ destination_branch }}] {{ title }} (backport #{{ number }})" + - name: backport patches to 8.x branch + conditions: + - merged + - label=v8.19.0 + actions: + backport: + assignees: + - "{{ author }}" + branches: + - "8.x" + title: "[{{ destination_branch }}] {{ title }} (backport #{{ number }})" + labels: + - backport + - name: backport patches to 8.18 branch + conditions: + - merged + - label=v8.18.0 + actions: + backport: + assignees: + - "{{ author }}" + branches: + - "8.18" + title: "[{{ destination_branch }}] {{ title }} (backport #{{ number }})" + labels: + - backport + - name: backport patches to 8.17 branch + conditions: + - merged + - label=v8.17.0 + actions: + backport: + assignees: + - "{{ author }}" + branches: + - "8.17" + title: "[{{ destination_branch }}] {{ title }} (backport #{{ number }})" + labels: + - backport + - name: backport patches to 8.16 branch + conditions: + - merged + - label=v8.16.0 + actions: + backport: + assignees: + - "{{ author }}" + branches: + - "8.16" + title: "[{{ destination_branch }}] {{ title }} (backport #{{ number }})" + labels: + - backport + - name: backport patches to 8.15 branch + conditions: + - merged + - label=v8.15.0 + actions: + backport: + assignees: + - "{{ author }}" + branches: + - "8.15" + title: "[{{ destination_branch }}] {{ title }} (backport #{{ number }})" + labels: + - backport + - name: backport patches to 8.14 branch + conditions: + - merged + - label=v8.14.0 + actions: + backport: + assignees: + - "{{ author }}" + branches: + - "8.14" + title: "[{{ destination_branch }}] {{ title }} (backport #{{ number }})" + labels: + - backport + - name: backport patches to 8.13 branch + conditions: + - merged + - label=v8.13.0 + actions: + backport: + assignees: + - "{{ author }}" + branches: + - "8.13" + title: "[{{ destination_branch }}] {{ title }} (backport #{{ number }})" + labels: + - backport + - name: backport patches to 8.12 branch + conditions: + - merged + - label=v8.12.0 + actions: + backport: + assignees: + - "{{ author }}" + branches: + - "8.12" + title: "[{{ destination_branch }}] {{ title }} (backport #{{ number }})" + labels: + - backport + - name: backport patches to 8.11 branch + conditions: + - merged + - label=v8.11.0 + actions: + backport: + assignees: + - "{{ author }}" + branches: + - "8.11" + title: "[{{ destination_branch }}] {{ title }} (backport #{{ number }})" + labels: + - backport + - name: backport patches to 8.10 branch + conditions: + - merged + - label=v8.10.0 + actions: + backport: + assignees: + - "{{ author }}" + branches: + - "8.10" + title: "[{{ destination_branch }}] {{ title }} (backport #{{ number }})" + labels: + - backport + - name: backport patches to 8.9 branch + conditions: + - merged + - label=v8.9.0 + actions: + backport: + assignees: + - "{{ author }}" + branches: + - "8.9" + title: "[{{ destination_branch }}] {{ title }} (backport #{{ number }})" + labels: + - backport + - name: backport patches to 8.8 branch + conditions: + - merged + - label=v8.8.0 + actions: + backport: + assignees: + - "{{ author }}" + branches: + - "8.8" + title: "[{{ destination_branch }}] {{ title }} (backport #{{ number }})" + labels: + - backport + - name: backport patches to 8.7 branch + conditions: + - merged + - label=v8.7.0 + actions: + backport: + assignees: + - "{{ author }}" + branches: + - "8.7" + title: "[{{ destination_branch }}] {{ title }} (backport #{{ number }})" + labels: + - backport + - name: backport patches to 8.6 branch + conditions: + - merged + - label=v8.6.0 + actions: + backport: + assignees: + - "{{ author }}" + branches: + - "8.6" + title: "[{{ destination_branch }}] {{ title }} (backport #{{ number }})" + labels: + - backport + - name: backport patches to 8.5 branch + conditions: + - merged + - label=v8.5.0 + actions: + backport: + assignees: + - "{{ author }}" + branches: + - "8.5" + title: "[{{ destination_branch }}] {{ title }} (backport #{{ number }})" + labels: + - backport - name: backport patches to 8.4 branch conditions: - merged - - base=main - label=v8.4.0 actions: backport: @@ -30,7 +237,6 @@ pull_request_rules: - name: backport patches to 8.3 branch conditions: - merged - - base=main - label=v8.3.0 actions: backport: @@ -44,7 +250,6 @@ pull_request_rules: - name: backport patches to 8.2 branch conditions: - merged - - base=main - label=v8.2.0 actions: backport: @@ -58,7 +263,6 @@ pull_request_rules: - name: backport patches to 8.1 branch conditions: - merged - - base=main - label=v8.1.0 actions: backport: @@ -69,31 +273,29 @@ pull_request_rules: title: "[{{ destination_branch }}] {{ title }} (backport #{{ number }})" labels: - backport - - name: backport patches to 7.17 branch + - name: backport patches to 8.0 branch conditions: - merged - - base=main - - label=v7.17.0 + - label=v8.0.0 actions: backport: assignees: - "{{ author }}" branches: - - "7.17" + - "8.0" title: "[{{ destination_branch }}] {{ title }} (backport #{{ number }})" labels: - backport - - name: backport patches to 8.0 branch + - name: backport patches to 7.17 branch conditions: - merged - - base=main - - label=v8.0.0 + - label=v7.17.0 actions: backport: assignees: - "{{ author }}" branches: - - "8.0" + - "7.17" title: "[{{ destination_branch }}] {{ title }} (backport #{{ number }})" labels: - backport diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000000..3811ab9a1e --- /dev/null +++ b/LICENSE @@ -0,0 +1,402 @@ +Attribution-NonCommercial-NoDerivatives 4.0 International + +======================================================================= + +Creative Commons Corporation ("Creative Commons") is not a law firm and +does not provide legal services or legal advice. Distribution of +Creative Commons public licenses does not create a lawyer-client or +other relationship. Creative Commons makes its licenses and related +information available on an "as-is" basis. Creative Commons gives no +warranties regarding its licenses, any material licensed under their +terms and conditions, or any related information. Creative Commons +disclaims all liability for damages resulting from their use to the +fullest extent possible. + +Using Creative Commons Public Licenses + +Creative Commons public licenses provide a standard set of terms and +conditions that creators and other rights holders may use to share +original works of authorship and other material subject to copyright +and certain other rights specified in the public license below. The +following considerations are for informational purposes only, are not +exhaustive, and do not form part of our licenses. + + Considerations for licensors: Our public licenses are + intended for use by those authorized to give the public + permission to use material in ways otherwise restricted by + copyright and certain other rights. Our licenses are + irrevocable. Licensors should read and understand the terms + and conditions of the license they choose before applying it. + Licensors should also secure all rights necessary before + applying our licenses so that the public can reuse the + material as expected. Licensors should clearly mark any + material not subject to the license. This includes other CC- + licensed material, or material used under an exception or + limitation to copyright. More considerations for licensors: + wiki.creativecommons.org/Considerations_for_licensors + + Considerations for the public: By using one of our public + licenses, a licensor grants the public permission to use the + licensed material under specified terms and conditions. If + the licensor's permission is not necessary for any reason--for + example, because of any applicable exception or limitation to + copyright--then that use is not regulated by the license. Our + licenses grant only permissions under copyright and certain + other rights that a licensor has authority to grant. Use of + the licensed material may still be restricted for other + reasons, including because others have copyright or other + rights in the material. A licensor may make special requests, + such as asking that all changes be marked or described. + Although not required by our licenses, you are encouraged to + respect those requests where reasonable. More considerations + for the public: + wiki.creativecommons.org/Considerations_for_licensees + +======================================================================= + +Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 +International Public License + +By exercising the Licensed Rights (defined below), You accept and agree +to be bound by the terms and conditions of this Creative Commons +Attribution-NonCommercial-NoDerivatives 4.0 International Public +License ("Public License"). To the extent this Public License may be +interpreted as a contract, You are granted the Licensed Rights in +consideration of Your acceptance of these terms and conditions, and the +Licensor grants You such rights in consideration of benefits the +Licensor receives from making the Licensed Material available under +these terms and conditions. + + +Section 1 -- Definitions. + + a. Adapted Material means material subject to Copyright and Similar + Rights that is derived from or based upon the Licensed Material + and in which the Licensed Material is translated, altered, + arranged, transformed, or otherwise modified in a manner requiring + permission under the Copyright and Similar Rights held by the + Licensor. For purposes of this Public License, where the Licensed + Material is a musical work, performance, or sound recording, + Adapted Material is always produced where the Licensed Material is + synched in timed relation with a moving image. + + b. Copyright and Similar Rights means copyright and/or similar rights + closely related to copyright including, without limitation, + performance, broadcast, sound recording, and Sui Generis Database + Rights, without regard to how the rights are labeled or + categorized. For purposes of this Public License, the rights + specified in Section 2(b)(1)-(2) are not Copyright and Similar + Rights. + + c. Effective Technological Measures means those measures that, in the + absence of proper authority, may not be circumvented under laws + fulfilling obligations under Article 11 of the WIPO Copyright + Treaty adopted on December 20, 1996, and/or similar international + agreements. + + d. Exceptions and Limitations means fair use, fair dealing, and/or + any other exception or limitation to Copyright and Similar Rights + that applies to Your use of the Licensed Material. + + e. Licensed Material means the artistic or literary work, database, + or other material to which the Licensor applied this Public + License. + + f. Licensed Rights means the rights granted to You subject to the + terms and conditions of this Public License, which are limited to + all Copyright and Similar Rights that apply to Your use of the + Licensed Material and that the Licensor has authority to license. + + g. Licensor means the individual(s) or entity(ies) granting rights + under this Public License. + + h. NonCommercial means not primarily intended for or directed towards + commercial advantage or monetary compensation. For purposes of + this Public License, the exchange of the Licensed Material for + other material subject to Copyright and Similar Rights by digital + file-sharing or similar means is NonCommercial provided there is + no payment of monetary compensation in connection with the + exchange. + + i. Share means to provide material to the public by any means or + process that requires permission under the Licensed Rights, such + as reproduction, public display, public performance, distribution, + dissemination, communication, or importation, and to make material + available to the public including in ways that members of the + public may access the material from a place and at a time + individually chosen by them. + + j. Sui Generis Database Rights means rights other than copyright + resulting from Directive 96/9/EC of the European Parliament and of + the Council of 11 March 1996 on the legal protection of databases, + as amended and/or succeeded, as well as other essentially + equivalent rights anywhere in the world. + + k. You means the individual or entity exercising the Licensed Rights + under this Public License. Your has a corresponding meaning. + + +Section 2 -- Scope. + + a. License grant. + + 1. Subject to the terms and conditions of this Public License, + the Licensor hereby grants You a worldwide, royalty-free, + non-sublicensable, non-exclusive, irrevocable license to + exercise the Licensed Rights in the Licensed Material to: + + a. reproduce and Share the Licensed Material, in whole or + in part, for NonCommercial purposes only; and + + b. produce and reproduce, but not Share, Adapted Material + for NonCommercial purposes only. + + 2. Exceptions and Limitations. For the avoidance of doubt, where + Exceptions and Limitations apply to Your use, this Public + License does not apply, and You do not need to comply with + its terms and conditions. + + 3. Term. The term of this Public License is specified in Section + 6(a). + + 4. Media and formats; technical modifications allowed. The + Licensor authorizes You to exercise the Licensed Rights in + all media and formats whether now known or hereafter created, + and to make technical modifications necessary to do so. The + Licensor waives and/or agrees not to assert any right or + authority to forbid You from making technical modifications + necessary to exercise the Licensed Rights, including + technical modifications necessary to circumvent Effective + Technological Measures. For purposes of this Public License, + simply making modifications authorized by this Section 2(a) + (4) never produces Adapted Material. + + 5. Downstream recipients. + + a. Offer from the Licensor -- Licensed Material. Every + recipient of the Licensed Material automatically + receives an offer from the Licensor to exercise the + Licensed Rights under the terms and conditions of this + Public License. + + b. No downstream restrictions. You may not offer or impose + any additional or different terms or conditions on, or + apply any Effective Technological Measures to, the + Licensed Material if doing so restricts exercise of the + Licensed Rights by any recipient of the Licensed + Material. + + 6. No endorsement. Nothing in this Public License constitutes or + may be construed as permission to assert or imply that You + are, or that Your use of the Licensed Material is, connected + with, or sponsored, endorsed, or granted official status by, + the Licensor or others designated to receive attribution as + provided in Section 3(a)(1)(A)(i). + + b. Other rights. + + 1. Moral rights, such as the right of integrity, are not + licensed under this Public License, nor are publicity, + privacy, and/or other similar personality rights; however, to + the extent possible, the Licensor waives and/or agrees not to + assert any such rights held by the Licensor to the limited + extent necessary to allow You to exercise the Licensed + Rights, but not otherwise. + + 2. Patent and trademark rights are not licensed under this + Public License. + + 3. To the extent possible, the Licensor waives any right to + collect royalties from You for the exercise of the Licensed + Rights, whether directly or through a collecting society + under any voluntary or waivable statutory or compulsory + licensing scheme. In all other cases the Licensor expressly + reserves any right to collect such royalties, including when + the Licensed Material is used other than for NonCommercial + purposes. + + +Section 3 -- License Conditions. + +Your exercise of the Licensed Rights is expressly made subject to the +following conditions. + + a. Attribution. + + 1. If You Share the Licensed Material, You must: + + a. retain the following if it is supplied by the Licensor + with the Licensed Material: + + i. identification of the creator(s) of the Licensed + Material and any others designated to receive + attribution, in any reasonable manner requested by + the Licensor (including by pseudonym if + designated); + + ii. a copyright notice; + + iii. a notice that refers to this Public License; + + iv. a notice that refers to the disclaimer of + warranties; + + v. a URI or hyperlink to the Licensed Material to the + extent reasonably practicable; + + b. indicate if You modified the Licensed Material and + retain an indication of any previous modifications; and + + c. indicate the Licensed Material is licensed under this + Public License, and include the text of, or the URI or + hyperlink to, this Public License. + + For the avoidance of doubt, You do not have permission under + this Public License to Share Adapted Material. + + 2. You may satisfy the conditions in Section 3(a)(1) in any + reasonable manner based on the medium, means, and context in + which You Share the Licensed Material. For example, it may be + reasonable to satisfy the conditions by providing a URI or + hyperlink to a resource that includes the required + information. + + 3. If requested by the Licensor, You must remove any of the + information required by Section 3(a)(1)(A) to the extent + reasonably practicable. + + +Section 4 -- Sui Generis Database Rights. + +Where the Licensed Rights include Sui Generis Database Rights that +apply to Your use of the Licensed Material: + + a. for the avoidance of doubt, Section 2(a)(1) grants You the right + to extract, reuse, reproduce, and Share all or a substantial + portion of the contents of the database for NonCommercial purposes + only and provided You do not Share Adapted Material; + + b. if You include all or a substantial portion of the database + contents in a database in which You have Sui Generis Database + Rights, then the database in which You have Sui Generis Database + Rights (but not its individual contents) is Adapted Material; and + + c. You must comply with the conditions in Section 3(a) if You Share + all or a substantial portion of the contents of the database. + +For the avoidance of doubt, this Section 4 supplements and does not +replace Your obligations under this Public License where the Licensed +Rights include other Copyright and Similar Rights. + + +Section 5 -- Disclaimer of Warranties and Limitation of Liability. + + a. UNLESS OTHERWISE SEPARATELY UNDERTAKEN BY THE LICENSOR, TO THE + EXTENT POSSIBLE, THE LICENSOR OFFERS THE LICENSED MATERIAL AS-IS + AND AS-AVAILABLE, AND MAKES NO REPRESENTATIONS OR WARRANTIES OF + ANY KIND CONCERNING THE LICENSED MATERIAL, WHETHER EXPRESS, + IMPLIED, STATUTORY, OR OTHER. THIS INCLUDES, WITHOUT LIMITATION, + WARRANTIES OF TITLE, MERCHANTABILITY, FITNESS FOR A PARTICULAR + PURPOSE, NON-INFRINGEMENT, ABSENCE OF LATENT OR OTHER DEFECTS, + ACCURACY, OR THE PRESENCE OR ABSENCE OF ERRORS, WHETHER OR NOT + KNOWN OR DISCOVERABLE. WHERE DISCLAIMERS OF WARRANTIES ARE NOT + ALLOWED IN FULL OR IN PART, THIS DISCLAIMER MAY NOT APPLY TO YOU. + + b. TO THE EXTENT POSSIBLE, IN NO EVENT WILL THE LICENSOR BE LIABLE + TO YOU ON ANY LEGAL THEORY (INCLUDING, WITHOUT LIMITATION, + NEGLIGENCE) OR OTHERWISE FOR ANY DIRECT, SPECIAL, INDIRECT, + INCIDENTAL, CONSEQUENTIAL, PUNITIVE, EXEMPLARY, OR OTHER LOSSES, + COSTS, EXPENSES, OR DAMAGES ARISING OUT OF THIS PUBLIC LICENSE OR + USE OF THE LICENSED MATERIAL, EVEN IF THE LICENSOR HAS BEEN + ADVISED OF THE POSSIBILITY OF SUCH LOSSES, COSTS, EXPENSES, OR + DAMAGES. WHERE A LIMITATION OF LIABILITY IS NOT ALLOWED IN FULL OR + IN PART, THIS LIMITATION MAY NOT APPLY TO YOU. + + c. The disclaimer of warranties and limitation of liability provided + above shall be interpreted in a manner that, to the extent + possible, most closely approximates an absolute disclaimer and + waiver of all liability. + + +Section 6 -- Term and Termination. + + a. This Public License applies for the term of the Copyright and + Similar Rights licensed here. However, if You fail to comply with + this Public License, then Your rights under this Public License + terminate automatically. + + b. Where Your right to use the Licensed Material has terminated under + Section 6(a), it reinstates: + + 1. automatically as of the date the violation is cured, provided + it is cured within 30 days of Your discovery of the + violation; or + + 2. upon express reinstatement by the Licensor. + + For the avoidance of doubt, this Section 6(b) does not affect any + right the Licensor may have to seek remedies for Your violations + of this Public License. + + c. For the avoidance of doubt, the Licensor may also offer the + Licensed Material under separate terms or conditions or stop + distributing the Licensed Material at any time; however, doing so + will not terminate this Public License. + + d. Sections 1, 5, 6, 7, and 8 survive termination of this Public + License. + + +Section 7 -- Other Terms and Conditions. + + a. The Licensor shall not be bound by any additional or different + terms or conditions communicated by You unless expressly agreed. + + b. Any arrangements, understandings, or agreements regarding the + Licensed Material not stated herein are separate from and + independent of the terms and conditions of this Public License. + + +Section 8 -- Interpretation. + + a. For the avoidance of doubt, this Public License does not, and + shall not be interpreted to, reduce, limit, restrict, or impose + conditions on any use of the Licensed Material that could lawfully + be made without permission under this Public License. + + b. To the extent possible, if any provision of this Public License is + deemed unenforceable, it shall be automatically reformed to the + minimum extent necessary to make it enforceable. If the provision + cannot be reformed, it shall be severed from this Public License + without affecting the enforceability of the remaining terms and + conditions. + + c. No term or condition of this Public License will be waived and no + failure to comply consented to unless expressly agreed to by the + Licensor. + + d. Nothing in this Public License constitutes or may be interpreted + as a limitation upon, or waiver of, any privileges and immunities + that apply to the Licensor or You, including from the legal + processes of any jurisdiction or authority. + +======================================================================= + +Creative Commons is not a party to its public +licenses. Notwithstanding, Creative Commons may elect to apply one of +its public licenses to material it publishes and in those instances +will be considered the “Licensor.” The text of the Creative Commons +public licenses is dedicated to the public domain under the CC0 Public +Domain Dedication. Except for the limited purpose of indicating that +material is shared under a Creative Commons public license or as +otherwise permitted by the Creative Commons policies published at +creativecommons.org/policies, Creative Commons does not authorize the +use of the trademark "Creative Commons" or any other trademark or logo +of Creative Commons without its prior written consent including, +without limitation, in connection with any unauthorized modifications +to any of its public licenses or any other arrangements, +understandings, or agreements concerning use of licensed material. For +the avoidance of doubt, this paragraph does not form part of the +public licenses. + +Creative Commons may be contacted at creativecommons.org. \ No newline at end of file diff --git a/README.md b/README.md index 4e6e4a3437..7cbc2890db 100644 --- a/README.md +++ b/README.md @@ -2,23 +2,28 @@ Elastic Security Docs home page: https://www.elastic.co/guide/en/security/current/index.html -Documentation Manager: Janeen Mikell-Straughn (Github: `@jmikell821`) +Serverless docs: https://docs.elastic.co/serverless/security/what-is-security-serverless + +Documentation Manager: Janeen Roberts (Github: `@jmikell821`) -Please view this template for guidance on creating issues: https://github.com/elastic/security-docs/blob/master/.github/ISSUE_TEMPLATE/documentation-issue.md ## Contributing to Elastic Security docs -If you are an Elastic employee and would like to contribute to Elastic Security documentation: +You can open an issue using the appropriate [template](https://github.com/elastic/security-docs/issues/new/choose). + +> [!NOTE] +> Please report any **known issues** that need to be documented by creating an issue in our [private repo](https://github.com/elastic/security-docs-internal/issues) using the known issue template. -1. Please clone and fork the `security-docs` repo. -2. Open an issue using the appropriate [template](https://github.com/elastic/security-docs/tree/master/.github/ISSUE_TEMPLATE). -3. Check out the `main` branch and fetch the latest changes. -4. Check out a new branch and make your changes. -5. Save your changes and open a pull request. -6. Add the `[@elastic/security-docs](https://github.com/orgs/elastic/teams/security-docs)` team and any other appropriate members as reviewers. -7. Add the appropriate release version label, backport version label if appropriate, and team label to the PR. -8. Once the docs team approves all changes, you can merge it. If a backport version label was added to a PR for stack versions 7.14.0 and newer, mergify will automatically open a backport PR. -9. Merge the backport PR once it passes all CI checks. +To contribute directly to Elastic Security documentation: + +1. Please fork and clone the `security-docs` repo. +1. Check out the `main` branch and fetch the latest changes. +1. Check out a new branch and make your changes. +1. Save your changes and open a pull request. +1. Add all appropriate Github users as reviewers. +1. Add the appropriate release version label, backport version label if appropriate, and team label to the PR. +1. Once the docs team approves all changes, you can merge it. If a backport version label was added to a PR for stack versions 7.14.0 and newer, mergify will automatically open a backport PR. +1. Merge the backport PR once it passes all CI checks. ### Preview documentation changes @@ -27,5 +32,18 @@ When you open a pull request, preview links are automatically added as a comment You also might want to add targeted links to help reviewers find specific pages related to your PR. Preview URLs include the following pattern (replace `` with the PR number): ``` -https://security-docs_.docs-preview.app.elstc.co/guide/en/security/master/ +https://security-docs_bk_.docs-preview.app.elstc.co/guide/en/security/master/ ``` + +## License + +Shield: [![CC BY-NC-ND 4.0][cc-by-nc-nd-shield]][cc-by-nc-nd] + +This work is licensed under a +[Creative Commons Attribution-NonCommercial-NoDerivs 4.0 International License][cc-by-nc-nd]. + +[![CC BY-NC-ND 4.0][cc-by-nc-nd-image]][cc-by-nc-nd] + +[cc-by-nc-nd]: http://creativecommons.org/licenses/by-nc-nd/4.0/ +[cc-by-nc-nd-image]: https://licensebuttons.net/l/by-nc-nd/4.0/88x31.png +[cc-by-nc-nd-shield]: https://img.shields.io/badge/License-CC%20BY--NC--ND%204.0-lightgrey.svg \ No newline at end of file diff --git a/docs/cases/api/actions-api/cases-actions-api-index.asciidoc b/docs/cases/api/actions-api/cases-actions-api-index.asciidoc deleted file mode 100644 index 6b2d29a1cf..0000000000 --- a/docs/cases/api/actions-api/cases-actions-api-index.asciidoc +++ /dev/null @@ -1 +0,0 @@ -include::cases-actions-api-intro.asciidoc[] \ No newline at end of file diff --git a/docs/cases/api/actions-api/cases-actions-api-intro.asciidoc b/docs/cases/api/actions-api/cases-actions-api-intro.asciidoc deleted file mode 100644 index d490d56196..0000000000 --- a/docs/cases/api/actions-api/cases-actions-api-intro.asciidoc +++ /dev/null @@ -1,31 +0,0 @@ -[[actions-api-overview]] -[role="xpack"] -== Actions API (for pushing cases to external systems) - -You can push {es-sec} cases to these third-party systems: - -* {sn} -* {jira} (including Jira Service Desk) -* {ibm-r} -* {swimlane} - - -To push cases, you need to create a connector, which stores the information -required to communicate with the external system. - -{es-sec} uses these external APIs to send cases: - -* {sn}: https://developer.servicenow.com/dev.do#!/reference/api/rome/rest/c_ImportSetAPI[Import Set API] -+ -IMPORTANT: {sn} ITSM and SecOps connectors created in {stack} version 7.15.0 or earlier use the https://developer.servicenow.com/dev.do#!/reference/api/quebec/rest/c_TableAPI[Table API]. They are marked as deprecated after you upgrade to version 7.16.0 or later and must be <> to ensure you have access to new connector enhancements. For example, you can push incident updates from cases using connectors created in version 7.15.0 or earlier. However, pushing incident updates from rules is a newer enhancement and you must update your connector or create a new one to use it. - -* {jira}: https://developer.atlassian.com/cloud/jira/platform/rest/v2/[REST API v2] -* {ibm-r}: https://developer.ibm.com/security/resilient/rest/[Resilient REST API] -* {swimlane}: https://swimlane.com/knowledge-center/docs/developer-guide/rest-api/[Swimlane REST API] - -To send cases to an external system and keep the {es-sec-ui} updated: - -. {kibana-ref}/create-connector-api.html[Create connector]: Create the connector. -. {kibana-ref}/cases-api-create.html[Create case]: Create a case with the connector from the previous step. -. {kibana-ref}/cases-api-push.html[Push case]: Push the case to the external system. - diff --git a/docs/cases/api/cases-api/cases-api-index.asciidoc b/docs/cases/api/cases-api/cases-api-index.asciidoc deleted file mode 100644 index 19012415cb..0000000000 --- a/docs/cases/api/cases-api/cases-api-index.asciidoc +++ /dev/null @@ -1 +0,0 @@ -include::cases-api.asciidoc[] diff --git a/docs/cases/api/cases-api/cases-api.asciidoc b/docs/cases/api/cases-api/cases-api.asciidoc deleted file mode 100644 index 49fd60a650..0000000000 --- a/docs/cases/api/cases-api/cases-api.asciidoc +++ /dev/null @@ -1,11 +0,0 @@ -[[cases-api-overview]] -[role="xpack"] -== Cases API - -You can create, manage, configure, and send cases to external systems with these APIs: - -NOTE: Cases return a warning header for deprecated endpoints. The value of the warning header is in the form `299 Kibana-{kibana_version} "{warning_text}"` - -* {kibana-ref}/cases-api.html[Cases APIs]: Used to open and manage security action items. - -* {kibana-ref}/actions-and-connectors-api.html[Connector APIs]: Used to communicate with and send cases to external systems. diff --git a/docs/cases/cases-index.asciidoc b/docs/cases/cases-index.asciidoc deleted file mode 100644 index 51e53a4ac1..0000000000 --- a/docs/cases/cases-index.asciidoc +++ /dev/null @@ -1,5 +0,0 @@ -include::cases-overview.asciidoc[leveloffset=+1] - -include::cases-manage.asciidoc[leveloffset=+2] - -include::cases-ui-integrations.asciidoc[] diff --git a/docs/cases/cases-manage.asciidoc b/docs/cases/cases-manage.asciidoc deleted file mode 100644 index 917810ad4d..0000000000 --- a/docs/cases/cases-manage.asciidoc +++ /dev/null @@ -1,180 +0,0 @@ -[[cases-open-manage]] -= Open and manage cases - -You can create and manage cases using the UI or the <>. - -[float] -[[cases-ui-open]] -== Open a new case - -Open a new case to keep track of security issues and share their details with -colleagues. - -. Go to *Cases*, then click *Create case*. If no cases exist, the Cases table will be empty and you'll be prompted to create one by clicking the *Create case* button inside the table. -. Give the case a name, add relevant tags, assign a severity level, and provide a description. You can use -https://www.markdownguide.org/cheat-sheet[Markdown] syntax in the case description. -+ -NOTE: If you do not assign your case a severity level, it will be assigned *Low* by default. - -+ -TIP: You can insert a Timeline link in the case description by clicking the Timeline icon (image:images/add-timeline-button.png[Timeline icon,17,17]). - -. Choose if you want alert statuses to sync with the case's status after they are added to the case. This option is enabled by default, but you can turn it off after creating the case. -. From *External incident management*, select a <>. If you’ve previously added one, that connector displays as the default selection. Otherwise, the default setting is `No connector selected`. -. Click *Create case*. -+ -NOTE: If you've selected a connector for the case, the case is automatically pushed to the third-party system it's connected to. - - -[role="screenshot"] -image::images/cases-ui-open.png[Shows an open case] - -[float] -[[cases-ui-manage]] -== Manage existing cases - -From the Cases page, you can search existing cases and filter them by severity, tags, reporter, and status: `Open`, `In progress`, or `Closed`. General case metrics, including how long it takes to close cases, are provided above the table. - -[role="screenshot"] -image::images/cases-home-page.png[Case UI Home] - -To explore a case, click on its name. You can then: - -* <> -* Add and <> -+ -TIP: Comments can contain Markdown. For syntax help, click the Markdown icon (image:images/markdown-icon.png[Click markdown icon,17,17]) in the bottom right of the comment. - -* <> -* <> -* Modify the case's description -* <> and send updates to external systems (if you've added a connector to the case) -* Close the case or reopen it -* Edit tags -* Update the case's severity -* Refresh the case to retrieve the latest updates - -[float] -[[cases-summary]] -=== Review the case summary - -Click on an existing case to access its summary. The case summary, located under the case title, contains metrics that summarize alert information and response times. These metrics update when you attach additional unique alerts to the case, add connectors, or modify the case's status: - -* **Total alerts**: Total number of unique alerts attached to the case -* **Associated users**: Total number of unique users that are represented in the attached alerts -* **Associated hosts**: Total number of unique hosts that are represented in the attached alerts -* **Total connectors**: Total number of connectors that have been added to the case -* **Case created**: Date and time that the case was created -* **Open duration**: Time elapsed since the case was created -* **In progress duration**: How long the case has been in the `In progress` state -* **Duration from creation to close**: Time elapsed from when the case was created to when it was closed - -[role="screenshot"] -image::images/cases-summary.png[Shows you a summary of the case] - -[float] -[[cases-manage-comments]] -=== Manage case comments -To edit, delete, or quote a comment, select the appropriate option from the *More actions* menu (*…​*). - -[role="screenshot"] -image::images/cases-manage-comments.png[Shows you a summary of the case] - -[float] -[[cases-examine-alerts]] -=== Examine alerts attached to a case - -preview::[] - -To explore the alerts attached to a case, click the *Alerts* tab. In the table, alerts are organized from oldest to newest. To <>, click the *View details* button. - -[role="screenshot"] -image::images/cases-alert-tab.png[Shows you the Alerts tab] - -[float] -[[cases-lens-visualization]] -=== Add a Lens visualization - -beta[] - -Add a Lens visualization to your case to portray event and alert data through charts and graphs. - -[role="screenshot"] -image::images/add-vis-to-case.gif[Shows how to add a visualization to a case] - -To add a Lens visualization to a comment within your case: - -. Click the *Visualization* button. The **Add visualization** dialog appears.  -. Select an existing visualization from your Visualize Library or create a new visualization. - -+ - -IMPORTANT: Set an absolute time range for your visualization. This ensures your visualization doesn't change over time after you save it to your case, and provides important context for others managing the case. - -+ -. Save the visualization to your Visualize Library by clicking the *Save to library* button (optional). -.. Enter a title and description for the visualization.  -.. Choose if you want to keep the *Update panel on Security* activated. This option is activated by default and automatically adds the visualization to your Visualize Library. -. After you've finished creating your visualization, click *Save and return* to go back to your case. -. Click *Preview* to show how the visualization will appear in the case comment. -. Click *Add Comment* to add the visualization to your case.  - -NOTE: Once a visualization has been added to a case, it cannot be modified or deleted. However, you can interact with the visualization by clicking the *Open Visualization* option in the comment menu. -   -[role="screenshot"] -image::images/cases-open-vis.png[Shows where the Open Visualization option is] - -[float] -[[cases-export-import]] -== Export and import cases - -Cases can be <> and <> as saved objects using the {kib} {kibana-ref}/managing-saved-objects.html[Saved Objects] UI. - -IMPORTANT: Before importing Lens visualizations, Timelines, or alerts into a space, ensure their data is present. Without it, they won't work after being imported. - -[float] -[[cases-export]] -=== Export a case -Use the *Export* option to move cases between different Kibana instances. When you export a case, the following data is exported to a newline-delimited JSON (`.ndjson`) file: - -* Case details -* User actions -* Text string comments -* Case alerts -* Lens visualizations (exported as JSON blobs). - -To export a case: - -. Open the main menu, go to *Stack Management -> {kib}*, then select the *Saved Objects* tab. -. Search for the case by choosing a saved object type or entering the case title in the search bar. -. Select one or more cases, then click the *Export* button. -. Click *Export*. A confirmation message that your file is downloading displays. - -+ -TIP: Keep the *Include related objects* option enabled to ensure connectors are exported too. - -[role="screenshot"] -image::images/cases-export-button.png[Shows the export saved objects workflow] - -[float] -[[cases-import]] -=== Import a case - -To import a case: - -. Open the main menu, go to *Stack Management -> {kib}*, then select the *Saved Objects* tab. -. Click *Import*. -. Select the NDJSON file containing the exported case and configure the import options. -. Click *Import*. -. Review the import log and click *Done*. -+ -[IMPORTANT] -========================= - -Be mindful of the following: - -* If the imported case had connectors attached to it, you'll be prompted to re-authenticate the connectors. To do so, click *Go to connectors* on the *Import saved objects* flyout and complete the necessary steps. Alternatively, open the main menu, then go to *Stack Management -> Alerts and Insights -> Rules and Connectors -> Connectors* to access connectors. -* If the imported case had attached alerts, verify that the alerts’ source documents exist in the environment. Case features that interact with alerts (such as the Alert details flyout and rule details page) rely on the alerts’ source documents to function. - -========================= -+ diff --git a/docs/cases/cases-overview.asciidoc b/docs/cases/cases-overview.asciidoc deleted file mode 100644 index 2821561d6a..0000000000 --- a/docs/cases/cases-overview.asciidoc +++ /dev/null @@ -1,20 +0,0 @@ -[[cases-overview]] -[role="xpack"] - -= Cases - -Collect and share information about security issues by opening a case in {elastic-sec}. Cases allow you to track key investigation details, collect alerts in a central location, and more. The {elastic-sec} UI provides several ways to create and manage cases. Alternatively, you can use the <> to perform the same tasks. - -You can also send cases to these external systems by <>: - -* {sn-itsm} -* {sn-sir} -* {jira} (including Jira Service Desk) -* {ibm-r} -* {swimlane} -* {webhook-cm} - -[role="screenshot"] -image::images/cases-home-page.png[Case UI Home] - -NOTE: From {elastic-sec}, you cannot access cases created in {observability} or Stack Management. diff --git a/docs/cases/cases-ui-integrations.asciidoc b/docs/cases/cases-ui-integrations.asciidoc deleted file mode 100644 index 5471dceda4..0000000000 --- a/docs/cases/cases-ui-integrations.asciidoc +++ /dev/null @@ -1,136 +0,0 @@ -[[cases-ui-integrations]] -[role="xpack"] -== Configure external connections - -You can push {es-sec} cases to these third-party systems: - -* {sn-itsm} -* {sn-sir} -* {jira} (including Jira Service Desk) -* {ibm-r} -* {swimlane} -* {webhook-cm} - -To push cases, you need to create a connector, which stores the information required to interact with an external system. After you have created a connector, you can set {es-sec} cases to automatically close when they are sent to external systems. - -IMPORTANT: To create connectors and send cases to external systems, you need the -https://www.elastic.co/subscriptions[appropriate license], and your role needs *All* privileges for the *Action and Connectors* feature. For more information, refer to <>. - -[float] -[[create-new-connector]] -=== Create a new connector - -. Go to *Cases* -> *Edit external connection*. -+ -[role="screenshot"] -image::images/cases-ui-connector.png[Shows the page for creating connectors] -. From the *Incident management system* list, select *Add new connector*. -. Select the system to send cases to: *{sn}*, *{jira}*, *{ibm-r}*, *{swimlane}*, or *{webhook-cm}*. -. Enter your required settings. For connector configuration details, refer to: -- {kibana-ref}/servicenow-action-type.html[{sn-itsm} connector] -- {kibana-ref}/servicenow-sir-action-type.html[{sn-sir} connector] -- {kibana-ref}/jira-action-type.html[{jira} connector] -- {kibana-ref}/resilient-action-type.html[{ibm-r} connector] -- {kibana-ref}/swimlane-action-type.html[{swimlane} connector] -- {kibana-ref}/cases-webhook-action-type.html[{webhook-cm} connector] - -[float] -[[mapped-case-fields]] -=== Mapped case fields - -When you export an {elastic-sec} case to an external system, case fields are mapped to existing fields in {sn}, {jira}, {ibm-r}, and {swimlane}. For the {webhook-cm} connector, case fields can be mapped to custom or pre-existing fields in the external system you're connecting to. - -Once fields are mapped, you can push updates to external systems, and mapped fields are overwritten or appended. Retrieving data from external systems is not supported. - -|=== - -| *Case field* | *Mapped field* - -| Title - -a| The case `Title` field is mapped to corresponding fields in external systems. Mapped field values are overwritten when you push updates. - -* *{sn}*: `Short description` -* *{jira}*: `Summary` -* *{ibm-r}*: `Name` -* *{swimlane}*: `Description` - -| Description -| The case `Description` field is mapped to the `Description` field in all systems. Mapped field values are overwritten when you push updates. - -| Comments - -a| The case `Comments` field is mapped to corresponding fields in external systems. - -* *{sn}*: `Work Notes` -* *{jira}*: `Comments` -* *{ibm-r}*: `Comments` -* *{swimlane}*: `Comments` - -New and edited comments are added to incident records when pushed to {sn}, {jira}, or {ibm-r}. Comments pushed to {swimlane} are appended to the `Comment` field in {swimlane} and posted individually. - -|=== - -[[close-connector]] -[float] -[[close-sent-cases]] -=== Close sent cases automatically - -To close cases when they are sent to an external system, select -*Automatically close Security cases when pushing new incident to external system*. - -[[default-connector]] -[float] -[[change-default-connector]] -=== Change the default connector - -To change the default connector used to send cases to external systems, go to *Cases* -> *Edit external connection* and select the required connector from the Incident management system list. - -[role="screenshot"] -image::images/cases-change-default-connector.png[Shows list of available connectors] - -[[add-connector]] -[float] -=== Add connectors - -After you <>, you can add connectors to it. From the case details page, go to *External incident management system*, then select a connector. A case can have multiple connectors, but only one connector can be selected at a time. - -[role="screenshot"] -image::images/add-connectors.png[width=60%][height=60%][Shows how to add connectors] - - -[[modify-connector]] -[float] -[[modify-connector-settings]] -=== Modify connector settings - -To change the settings of an existing connector: - -. Go to *Cases* -> *Edit external connection*. -. Select the required connector from the Incident management system list. -. Click *Update *. -. In the *Edit connector* flyout, modify the connector fields as required, then click *Save & close* to save your changes. - -[role="screenshot"] -image::images/cases-modify-connector.png[] - -[float] -[[connect-security-to-jira]] -=== Tutorial: Connect {elastic-sec} to {jira} - -To learn how to connect {elastic-sec} to {jira}, check out the following tutorial. - -======= -++++ - - -
-++++ -======= diff --git a/docs/cases/images/add-connectors.png b/docs/cases/images/add-connectors.png deleted file mode 100644 index 09c7ea617d..0000000000 Binary files a/docs/cases/images/add-connectors.png and /dev/null differ diff --git a/docs/cases/images/add-timeline-button.png b/docs/cases/images/add-timeline-button.png deleted file mode 100644 index 4062c9b5f1..0000000000 Binary files a/docs/cases/images/add-timeline-button.png and /dev/null differ diff --git a/docs/cases/images/add-vis-to-case.gif b/docs/cases/images/add-vis-to-case.gif deleted file mode 100644 index f6918496e2..0000000000 Binary files a/docs/cases/images/add-vis-to-case.gif and /dev/null differ diff --git a/docs/cases/images/case-feature-privs.png b/docs/cases/images/case-feature-privs.png deleted file mode 100644 index 1a5afd5284..0000000000 Binary files a/docs/cases/images/case-feature-privs.png and /dev/null differ diff --git a/docs/cases/images/cases-alert-tab.png b/docs/cases/images/cases-alert-tab.png deleted file mode 100644 index 90354f2e42..0000000000 Binary files a/docs/cases/images/cases-alert-tab.png and /dev/null differ diff --git a/docs/cases/images/cases-change-default-connector.png b/docs/cases/images/cases-change-default-connector.png deleted file mode 100644 index a3bba68601..0000000000 Binary files a/docs/cases/images/cases-change-default-connector.png and /dev/null differ diff --git a/docs/cases/images/cases-create-case-button.png b/docs/cases/images/cases-create-case-button.png deleted file mode 100644 index 67771e429f..0000000000 Binary files a/docs/cases/images/cases-create-case-button.png and /dev/null differ diff --git a/docs/cases/images/cases-export-button.png b/docs/cases/images/cases-export-button.png deleted file mode 100644 index c1b17befac..0000000000 Binary files a/docs/cases/images/cases-export-button.png and /dev/null differ diff --git a/docs/cases/images/cases-home-page.png b/docs/cases/images/cases-home-page.png deleted file mode 100644 index 12061dd3c4..0000000000 Binary files a/docs/cases/images/cases-home-page.png and /dev/null differ diff --git a/docs/cases/images/cases-lens-vis.png b/docs/cases/images/cases-lens-vis.png deleted file mode 100644 index a71a1078fa..0000000000 Binary files a/docs/cases/images/cases-lens-vis.png and /dev/null differ diff --git a/docs/cases/images/cases-manage-comments.png b/docs/cases/images/cases-manage-comments.png deleted file mode 100644 index 8612ac725a..0000000000 Binary files a/docs/cases/images/cases-manage-comments.png and /dev/null differ diff --git a/docs/cases/images/cases-modify-connector.png b/docs/cases/images/cases-modify-connector.png deleted file mode 100644 index 714a740f8b..0000000000 Binary files a/docs/cases/images/cases-modify-connector.png and /dev/null differ diff --git a/docs/cases/images/cases-open-vis.png b/docs/cases/images/cases-open-vis.png deleted file mode 100644 index 890c856ddc..0000000000 Binary files a/docs/cases/images/cases-open-vis.png and /dev/null differ diff --git a/docs/cases/images/cases-summary.png b/docs/cases/images/cases-summary.png deleted file mode 100644 index b9d8d51100..0000000000 Binary files a/docs/cases/images/cases-summary.png and /dev/null differ diff --git a/docs/cases/images/cases-ui-connector.png b/docs/cases/images/cases-ui-connector.png deleted file mode 100644 index e5fe06aaf4..0000000000 Binary files a/docs/cases/images/cases-ui-connector.png and /dev/null differ diff --git a/docs/cases/images/cases-ui-home.png b/docs/cases/images/cases-ui-home.png deleted file mode 100644 index 9463e923b5..0000000000 Binary files a/docs/cases/images/cases-ui-home.png and /dev/null differ diff --git a/docs/cases/images/cases-ui-open.png b/docs/cases/images/cases-ui-open.png deleted file mode 100644 index 1db008f83e..0000000000 Binary files a/docs/cases/images/cases-ui-open.png and /dev/null differ diff --git a/docs/cases/images/cases-ui-sn-connector.png b/docs/cases/images/cases-ui-sn-connector.png deleted file mode 100644 index f0ff7b1412..0000000000 Binary files a/docs/cases/images/cases-ui-sn-connector.png and /dev/null differ diff --git a/docs/cloud-native-security/benchmark-rules.asciidoc b/docs/cloud-native-security/benchmark-rules.asciidoc deleted file mode 100644 index 678caa4851..0000000000 --- a/docs/cloud-native-security/benchmark-rules.asciidoc +++ /dev/null @@ -1,13 +0,0 @@ -[[benchmark-rules]] -= Benchmark rules -The Benchmark Integrations page lets you view and manage cloud security posture (CSP) benchmark rules for each of your <>. Enabled benchmark rules define the Kubernetes configuration best practices that form the basis of the data that appears on the <>. - -To find the Benchmark Integrations page, go to **Manage -> CSP Benchmarks**. From there, to view the benchmark rules associated with an integration, select that integration's name. - -image::images/benchmark-rules.png[The Benchmark rules page] - -You can then click on a benchmark rule's name to see details, including information about how to remediate failures and related links. - -You can enable or disable benchmark rules for each integration, either individually or in bulk using the *Bulk Actions* menu. By default, benchmark rules are enabled. - -NOTE: Benchmark rules are not editable. diff --git a/docs/cloud-native-security/cloud-native-security-index.asciidoc b/docs/cloud-native-security/cloud-native-security-index.asciidoc deleted file mode 100644 index a1be9eeb34..0000000000 --- a/docs/cloud-native-security/cloud-native-security-index.asciidoc +++ /dev/null @@ -1,7 +0,0 @@ -[[cloud-native-security-overview]] - -= Cloud native security -Elastic’s cloud security capabilities help you to improve your Kubernetes security posture by comparing your configuration to best practices, and help you monitor and investigate your Linux deployments inside and outside of Kubernetes. - -include::kspm.asciidoc[leveloffset=+1] -include::benchmark-rules.asciidoc[leveloffset=+1] diff --git a/docs/cloud-native-security/images/benchmark-rules.png b/docs/cloud-native-security/images/benchmark-rules.png deleted file mode 100644 index 313324b8fd..0000000000 Binary files a/docs/cloud-native-security/images/benchmark-rules.png and /dev/null differ diff --git a/docs/cloud-native-security/images/findings-page.png b/docs/cloud-native-security/images/findings-page.png deleted file mode 100644 index 2998c4f1ea..0000000000 Binary files a/docs/cloud-native-security/images/findings-page.png and /dev/null differ diff --git a/docs/cloud-native-security/images/kspm-add-agent-wizard.png b/docs/cloud-native-security/images/kspm-add-agent-wizard.png deleted file mode 100644 index d61fec7589..0000000000 Binary files a/docs/cloud-native-security/images/kspm-add-agent-wizard.png and /dev/null differ diff --git a/docs/cloud-native-security/kspm.asciidoc b/docs/cloud-native-security/kspm.asciidoc deleted file mode 100644 index 5f79050df1..0000000000 --- a/docs/cloud-native-security/kspm.asciidoc +++ /dev/null @@ -1,39 +0,0 @@ -[[kspm]] -= Kubernetes security posture management - -The Kubernetes Security Posture Management (KSPM) integration allows you to monitor how your Kubernetes clusters' configuration measures up to security benchmarks. - -To set up the integration, you'll need to first add it to an {agent} policy, then deploy the KSPM DaemonSet to the Kubernetes clusters you want to monitor. - -[discrete] -== Set up a KSPM integration -To install the integration: - -1. Go to *Dashboards -> Cloud Posture*. -2. Click *Add a CIS integration*. -3. Click *Add Kubernetes Security Posture Management*. -4. Name your integration. -5. Select whether to use the CIS or EKS Benchmarks — use CIS unless you're deploying on EKS. -6. Select the {agent} policy where you want to add the integration. -7. Click *Save and continue*, then *Add agent to your hosts*. The *Add agent* wizard appears and provides a DaemonSet manifest `.yaml` file with pre-populated configuration information, such as the `Fleet ID` and`Fleet URL`. - -image::images/kspm-add-agent-wizard.png[The KSPM integration's Add agent wizard] - -The *Add agent* wizard helps you deploy a DaemonSet on the Kubernetes clusters you wish to monitor. To do this, for each cluster: - -1. Download the manifest and make any necessary revisions to its configuration to suit the needs of your environment. -2. Apply the manifest using the `kubectl apply -f` command. For example: `kubectl apply -f elastic-agent-managed-kubernetes.yaml` - -After about a minute, an “Agent enrollment confirmed” message appears, followed by “Incoming data confirmed." You can then click *View assets* to see where the newly-collected configuration information appears throughout {kib}, including the <> and the <>. - -[[findings-page]] -[discrete] -== Findings page - -image::images/findings-page.png[The Findings page] - -The Findings page shows how the configuration of your Kubernetes clusters measures up to the standards defined on the <>. - -Findings are organized by the resource IDs of the associated Kubernetes infrastructure and include data about the infrastructure and benchmark rules. Each finding's result (which can be `pass` or `fail`) indicates whether a particular part of your Kubernetes infrastructure meets an active CSP benchmark rule. - -You can filter table data by entering queries into the KQL search bar. diff --git a/docs/dashboards/cloud-posture.asciidoc b/docs/dashboards/cloud-posture.asciidoc deleted file mode 100644 index 081fc4792d..0000000000 --- a/docs/dashboards/cloud-posture.asciidoc +++ /dev/null @@ -1,14 +0,0 @@ -[[cloud-posture-dashboard]] -= Cloud Posture dashboard - -The Cloud Posture dashboard summarizes how your Kubernetes configuration measures up to security benchmarks. - -NOTE: To learn how to collect this data, refer to <>. - -image::images/cloud-sec-dashboard.png[The Cloud Security dashboard] - -The first row of cards (Cloud Posture Score, Failed Findings, and Open Cases) summarizes your overall cloud security posture (CSP) by aggregating data from all monitored Kubernetes clusters. Each subsequent row summarizes the posture of an individual Kubernetes cluster. - -The Cloud Posture Score card shows the percentage of your findings that passed over time. Hover over the card to display when the data was collected. - -The Failed Findings card shows failed findings grouped by Center for Internet Security (CIS) benchmark categories. Click any section name to view its failed findings on the <>. diff --git a/docs/dashboards/dashboards-overview.asciidoc b/docs/dashboards/dashboards-overview.asciidoc deleted file mode 100644 index ddacfa4d30..0000000000 --- a/docs/dashboards/dashboards-overview.asciidoc +++ /dev/null @@ -1,13 +0,0 @@ -[[dashboards-overview]] - -= Dashboards - -The following sections describe the {security-app}'s prebuilt dashboards, which provide visualizations of your security environment. - -include::overview-dashboard.asciidoc[leveloffset=+1] - -include::detection-response-dashboard.asciidoc[leveloffset=+1] - -include::kubernetes-dashboard.asciidoc[leveloffset=+1] - -include::cloud-posture.asciidoc[leveloffset=+1] diff --git a/docs/dashboards/detection-response-dashboard.asciidoc b/docs/dashboards/detection-response-dashboard.asciidoc deleted file mode 100644 index 79fa7e3505..0000000000 --- a/docs/dashboards/detection-response-dashboard.asciidoc +++ /dev/null @@ -1,40 +0,0 @@ -[[detection-response-dashboard]] -= Detection & Response dashboard - -The Detection & Response dashboard provides focused visibility into the day-to-day operations of your security environment. It helps security operations managers and analysts quickly monitor recent and high priority detection alerts and cases, and identify the hosts and users associated with alerts. - -[role="screenshot"] -image::detections/images/detection-response-dashboard.png[Overview of Detection & Response dashboard] - -Interact with various dashboard elements: - -* Use the date and time picker in the upper-right to specify a time range for displaying information on the dashboard. - -* In sections that list alert counts, click a number to investigate those alerts in Timeline. - -* Click the name of a detection rule, case, host, or user to open its details page. - -The following sections are included: - -[width="100%",cols="s,"] -|============================================== - -|Alerts -|The total number of detection alerts generated within the time range, organized by status and severity. Select *View alerts* to open the Alerts page. - -|Cases -|The total number of cases created within the time range, organized by status. Select *View cases* to open the Cases page. - -|Open alerts by rule -|The top four detection rules with open alerts, organized by the severity and number of alerts for each rule. Select *View all open alerts* to open the Alerts page. - -|Recently created cases -|The four most recently created cases. Select *View recent cases* to open the Cases page. - -|Hosts by alert severity -|The hosts generating detection alerts within the time range, organized by the severity and number of alerts. Shows up to 100 hosts. - -|Users by alert severity -|The users generating detection alerts within the time range, organized by the severity and number of alerts. Shows up to 100 users. - -|============================================== diff --git a/docs/dashboards/images/cloud-sec-dashboard.png b/docs/dashboards/images/cloud-sec-dashboard.png deleted file mode 100644 index ae51940f88..0000000000 Binary files a/docs/dashboards/images/cloud-sec-dashboard.png and /dev/null differ diff --git a/docs/dashboards/images/kubernetes-dashboard.png b/docs/dashboards/images/kubernetes-dashboard.png deleted file mode 100644 index 9b4b73fd70..0000000000 Binary files a/docs/dashboards/images/kubernetes-dashboard.png and /dev/null differ diff --git a/docs/dashboards/images/metadata-tab.png b/docs/dashboards/images/metadata-tab.png deleted file mode 100644 index 8844408493..0000000000 Binary files a/docs/dashboards/images/metadata-tab.png and /dev/null differ diff --git a/docs/dashboards/images/session-data-config.png b/docs/dashboards/images/session-data-config.png deleted file mode 100644 index d3aa6af216..0000000000 Binary files a/docs/dashboards/images/session-data-config.png and /dev/null differ diff --git a/docs/dashboards/kubernetes-dashboard.asciidoc b/docs/dashboards/kubernetes-dashboard.asciidoc deleted file mode 100644 index 550e5dcde7..0000000000 --- a/docs/dashboards/kubernetes-dashboard.asciidoc +++ /dev/null @@ -1,87 +0,0 @@ -[[kubernetes-dashboard]] -= Kubernetes dashboard - -The Kubernetes dashboard provides insight into Linux process data from your Kubernetes clusters. It shows sessions in detail and in the context of your monitored infrastructure. - -image::images/kubernetes-dashboard.png[The Kubernetes dashboard, with numbered labels 1 through 3 for major sections] -The numbered sections are described below: - - 1. The charts at the top of the dashboard provide an overview of your monitored Kubernetes infrastructure. You can hide them by clicking *Hide charts*. - 2. The tree navigation menu allows you to navigate through your deployments and select the scope of the sessions table to the right. You can select any item in the menu to show its sessions. In Logical view, the menu is organized by Cluster, Namespace, Pod, and Container image. In Infrastructure view, it is organized by Cluster, Node, Pod, and Container image. - 3. The sessions table displays sessions collected from the selected element of your Kubernetes infrastructure. You can view it in fullscreen by selecting the button in the table's upper right corner. You can sort the table by any of its fields. - -You can filter the data using the KQL search bar and date picker at the top of the page. - -From the sessions table's Actions column, you can take the following investigative actions: - -- View details -- <> -- <> -- <> -- <> - -Session View displays Kubernetes metadata under the *Metadata* tab of the Detail panel: - -image::images/metadata-tab.png[The Detail panel's metadata tab] - -The *Metadata* tab is organized into these expandable sections: - -- *Metadata:* `hostname`, `id`, `ip`, `mac`, `name`, Host OS information -- *Cloud:* `instance.name`, `provider`, `region`, `account.id`, `project.id` -- *Container:* `id`, `name`, `image.name`, `image.tag`, `image.hash.all` -- *Orchestrator:* `resource.ip`, `resource.name`, `resource.type`, `namespace`, `cluster.id`, `cluster.name`, `parent.type` - - -[discrete] -[[k8s-dash-setup]] -== Setup -To collect session data for the dashboard, you'll deploy a Kubernetes DaemonSet to your clusters that implements the {endpoint-cloud-sec} integration. - -**Prerequisites**: - -- This feature requires Elastic Stack version 8.4 or newer. -- You need an active {fleet-guide}/fleet-overview.html[{fleet} Server]. -- Your Elastic deployment must have the {endpoint-cloud-sec} integration <>. -- The {endpoint-cloud-sec} integration policy must have **Include session data** set to `true`. To modify this setting, go to **Manage -> Policies**, select your policy, and find `Include session data` near the bottom of the `Policy settings` tab. - -**Support matrix**: This feature is currently available on GKE and EKS using Linux hosts and Kubernetes versions that match the following specifications: -|===================== -| | **Kubernetes versions** | **Node OSes** -|**EKS**| 1.18; 1.19; 1.20; 1.21 | Amazon Linux 2, Bottlerocket OS -|**GKE**| Regular (default channel): 1.21 and 1.22; Stable: 1.20 and 1.21; Rapid: 1.22 and 1.23 | Container-optimized OS (COS), Ubuntu -|===================== - -[discrete] -=== Download and modify the DaemonSet manifest -The DaemonSet integrates {elastic-endpoint} into your Kubernetes cluster. The {agent} is enrolled to a running {fleet-server} using the `FLEET_URL` parameter, and connected to a specific {agent} policy using the `FLEET_ENROLLMENT_TOKEN`. - -You first need to download the DaemonSet manifest `.yaml`, then modify it to include your {fleet} URL and Enrollment Token before you deploy it to the clusters you want to monitor. - -. Download the DaemonSet manifest using this command: -+ -[source,console] ----- -curl -L -O https://raw.githubusercontent.com/elastic/endpoint/main/releases/8.4.0/kubernetes/deploy/elastic-endpoint-security.yaml ----- - -. Fill in the manifest's `FLEET_URL` field with your {fleet} server's `Host URL`. To find it, go to **{kib} -> Management -> {fleet} -> Settings**. For more information, refer to {fleet-guide}/fleet-settings.html[Fleet UI settings]. -. Fill in the manifest's `FLEET_ENROLLMENT_TOKEN` field with a Fleet enrollment token. To find one, go to **{kib} -> Management -> {fleet} -> Enrollment tokens**. For more information, refer to {fleet-guide}/fleet-enrollment-tokens.html[Fleet enrollment tokens]. - - -[discrete] -=== Apply the modified manifest to your cluster or clusters - -To ensure you install {elastic-endpoint} on the desired Kubernetes cluster(s), set the default context using command: `kubectl config use-context `. -To check which contexts exist, use `kubectl config get-contexts` to list them from your local kubectl config file. An asterisk indicates the current default context. - -You can repeat the following steps for multiple contexts. - -**Example:** - -- Apply the manifest to a cluster: `kubectl apply -f elastic-endpoint-security.yaml` -- Check the DaemonSet’s status: `kubectl get pods -A` - -Once the DaemonSet is running, Elastic Endpoint will start sending Linux session data from Kubernetes to {kib}. You can then view that data from the Kubernetes dashboard. - - -IMPORTANT: This dashboard uses data from the `logs-*` index pattern, which is included by default in the <>. To collect data from multiple {es} clusters (as in a cross-cluster deployment), update `logs-*` to `*:logs-*`. diff --git a/docs/dashboards/overview-dashboard.asciidoc b/docs/dashboards/overview-dashboard.asciidoc deleted file mode 100644 index 49bfbf7d69..0000000000 --- a/docs/dashboards/overview-dashboard.asciidoc +++ /dev/null @@ -1,42 +0,0 @@ -[[overview-dashboard]] -= Overview dashboard - -The Overview dashboard provides a high-level snapshot of detections, external alerts, and event trends. It helps you assess overall system health and find anomalies that may require further investigation. - -image::images/overview-pg.png[Overview dashboard] - -[discrete] -== Live feed - -The live feed on the Overview dashboard helps you quickly access recently created cases, favorited Timelines, and the latest {elastic-sec} news. - -TIP: The *Security news* section provides the latest {elastic-sec} news to help you stay informed of new developments, learn about {elastic-sec} features, and more. - -image::images/live-feed-ov-page.png[Overview dashboard with live feed section highlighted] - -[discrete] -== Histograms - -Time-based histograms show the number of detections, alerts, and events that have occurred within the selected time range. To focus on a particular time, click and drag to select a time range, or choose a preset value. The *Stack by* menu lets you select which field is used to organize the data. For example, in the Detection alert trend histogram, stack by `kibana.alert.rule.name` to display alert counts by rule name within the specified time frame. - -TIP: Many {elastic-sec} histograms, graphs, and tables contain an *Inspect* button so you can examine the {es} queries used to retrieve data throughout the app. - -[discrete] -== Host and network events - -View event and host counts grouped by data source, such as *Auditbeat* or *{endpoint-cloud-sec}*. Expand a category to view specific counts of host or network events from the selected source. - -[role="screenshot"] -image::images/events-count.png[Host and network events on the Overview dashboard] - -[discrete] -== Threat Intelligence - -The Threat Intelligence view on the Overview dashboard provides streamlined threat intelligence data for threat detection and matching. - -The view shows the total number of ingested threat indicators, enabled threat intelligence sources, and ingested threat indicators per source. To visualize the ingested threat indicator data, click the *Source* link for a threat intelligence source. - -NOTE: For more information about connecting to threat intelligence sources, visit <>. - -[role="screenshot"] -image::images/threat-intelligence-view.png[width=65%][height=65%][Threat Intelligence view on the Overview dashboard] diff --git a/docs/detections/alerts-add-to-cases.asciidoc b/docs/detections/alerts-add-to-cases.asciidoc deleted file mode 100644 index af943e3778..0000000000 --- a/docs/detections/alerts-add-to-cases.asciidoc +++ /dev/null @@ -1,43 +0,0 @@ -[[signals-to-cases]] -== Add detection alerts to cases - -From the Alerts table, you can attach one or more alerts to a <> or <>. Alerts from any rule type can be added to a case. - -NOTE: Once you've added an alert to a case, you can only remove it through the <>. - -[role="screenshot"] -image::images/add-alert-to-case.gif[width=50%][height=50%][Animation of adding an alert to a case] - -[float] -[[signals-to-new-cases]] -=== Add alerts to a new case -To add alerts to a new case: - -. Do one of the following: -** To add a single alert to a case, select the *More actions* menu (*...*) in the Alerts table or **Take action** in the alert details flyout, then select *Add to a new case*. -** To add multiple alerts, select the alerts, then select *Add to a new case* from the *Bulk actions* menu. -. In the **Create new case** flyout, give your case a name, add relevant tags (optional), assign a severity level, and include a case description. -+ -NOTE: If you do not assign your case a severity level, it will be assigned *Low* by default. - -. Specify whether you want to sync the status of associated alerts. It is enabled by default; however, you can toggle this setting on or off at any time. If it remains enabled, the alert's status updates whenever the case's status is modified. -. Select a connector. If you've previously added one, that connector displays as the default selection. Otherwise, the default setting is `No connector selected`. -. Click *Create case* after you've completed all of the required fields. A confirmation message is displayed with an option to view the new case. Click the link in the notification or go to the Cases page to view the case. - -[role="screenshot"] -image::images/add-alert-to-new-case.png[Create case flyout with sample data filled in] - -[float] -[[signals-to-existing-cases]] -=== Add alerts to an existing case -To add alerts to an existing case: - -. Do one of the following: -** To add a single alert to a case, select the *More actions* menu (*...*) in the Alerts table or **Take action** in the alert details flyout, then select **Add to existing case**. -** To add multiple alerts, select the alerts, then select *Add to an existing case* from the *Bulk actions* menu. -. From the **Select case** dialog box, select the case to which you want to attach the alert. A confirmation message is displayed with an option to view the updated case. Click the link in the notification or go to the Cases page to view the case's details. -+ -NOTE: If you attach the alert to a case that has been configured to sync its status with associated alerts, the alert's status updates any time the case's status is modified. - -[role="screenshot"] -image::images/add-alert-to-existing-case.png[Select case dialog listing existing cases] diff --git a/docs/detections/alerts-run-osquery.asciidoc b/docs/detections/alerts-run-osquery.asciidoc deleted file mode 100644 index 95dab04a18..0000000000 --- a/docs/detections/alerts-run-osquery.asciidoc +++ /dev/null @@ -1,74 +0,0 @@ -[[alerts-run-osquery]] -== Run Osquery from a detection alert -{kibana-ref}/osquery.html[Osquery] allows you to run live queries against an alert's host to learn more about your infrastructure and operating systems. For example, with Osquery, you can search your system for indicators of compromise that might have contributed to the alert. You can then use this data to form your investigation and alert triage efforts. - -[IMPORTANT] -============ - -You must complete the following to access Osquery and run searches against your hosts: - -* Enable the {kibana-ref}/manage-osquery-integration.html[Osquery manager integration] on the host associated with the alert. -* Update your {kibana-ref}/osquery.html[role's privileges] to allow access to Osquery. -* Verify that {fleet-guide}/view-elastic-agent-status.html[{agent}'s status] is *Healthy*. Refer to {fleet-guide}/fleet-troubleshooting.html[{fleet} Troubleshooting] if it is not. -============ - -[float] -[[osquery-alert-action]] -=== Run live queries - -. Do one of the following from the Alerts table: -** Click the *View details* button to open the Alert details flyout, then click *Take action -> Run Osquery*. -** Select the *More actions* menu (*...*), then select *Run Osquery*. -. Choose to run a single query or a query pack. -. Select one or more {agent}s or groups to query. Start typing in the search field to get suggestions for {agent}s by name, ID, platform, and policy. - -+ -NOTE: The host associated with the alert is automatically selected. You can specify additional hosts to query. - -. Specify the query or pack to run: -** *Query*: Select a saved query or enter a new one in the text box. After you enter the query, you can expand the **Advanced** section to view or set {kibana-ref}/osquery.html#osquery-map-fields[mapped ECS fields] included in the results from the live query. Mapping ECS fields is optional. -** *Pack*: Select from query packs that have been loaded and activated. After you select a pack, all of the queries in the pack are displayed. -+ -TIP: Refer to {kibana-ref}/osquery.html#osquery-prebuilt-packs-queries[prebuilt packs] to learn about using and managing Elastic prebuilt packs. -+ -[role="screenshot"] -image::images/setup-query.png[width=80%][height=80%][Shows how to set up a single query] - -. Click **Submit**. Queries will timeout after 5 minutes if there are no responses. -+ -TIP: To save the query for future use, click *Save for later* and define the ID, -description, and other {kibana-ref}/osquery.html#osquery-manage-query[details]. - -[float] -[[osquery-results-single]] -=== Review single query results - -Results for single queries appear in the *Results* tab. When you run a query, the number of agents queried and query status temporarily display in a status bar above the results table. Agent responses can be `Sucessful`, `Not yet responded` (pending), and `Failed`. - -[role="screenshot"] -image::images/single-query-results.png[width=80%][height=80%][Shows query results] - -[float] -[[osquery-results-pack]] -=== Review query pack results - -Results for each query in the pack appear in the *Results* tab. Click the expand button (image:images/pack-expand-button-osquery.png[Click markdown icon,20,20]) at the far right of each query row to display query results. The number of agents that were queried and their responses are shown for each query. Agent responses are color-coded. Green is `Sucessful`, `Not yet responded` (pending) is gray, and `Failed` is red. - -[role="screenshot"] -image::images/pack-query-results.png[width=80%][height=80%][Shows query results] - -[float] -[[osquery-investigate]] -=== Investigate query results - -From the results table, you can: - -* Click the *View in Discover* button (image:images/discover-button-osquery.png[Click markdown icon,20,20]) to explore the results in Discover. -* Click the *View in Lens* button (image:images/lens-button-osquery.png[Click markdown icon,20,20]) to navigate to Lens, where you can use the drag-and-drop *Lens* editor to create visualizations. -* Click the *Timeline* button (image:images/timeline-button-osquery.png[Click markdown icon,20,20]) to investigate a single query result in Timeline or *Add to timeline investigation* to investigate all results. This option is only available for single query results. - -+ -When you open all results in Timeline, the events in Timeline are filtered based on the `action_ID` generated by the Osquery query. -+ - -* View more information about the request, such as failures, by opening the *Status* tab. diff --git a/docs/detections/alerts-ui-manage.asciidoc b/docs/detections/alerts-ui-manage.asciidoc deleted file mode 100644 index e9af95bc9f..0000000000 --- a/docs/detections/alerts-ui-manage.asciidoc +++ /dev/null @@ -1,150 +0,0 @@ -[[alerts-ui-manage]] -[role="xpack"] -== Manage detection alerts - -The Alerts page displays all <>. From the Alerts page, you can filter alerts, view alerting trends, change the status of alerts, add alerts to cases, and start investigating and analyzing alerts. - -[role="screenshot"] -image::detections/images/alert-page.png[] - -[float] -[[detection-view-and-filter-alerts]] -=== View and filter detection alerts -The Alerts page offers various ways for you to organize and triage detection alerts as you investigate suspicious events. You can: - -* View an alert's details. Click the *View details* button from the Alerts table to open the alert details flyout. Learn more at <>. -+ -[role="screenshot"] -image::images/view-alert-details.png[View details button, 200] - -* Filter for a specific rule in the KQL bar (for example, `kibana.alert.rule.name :"SSH (Secure Shell) from the Internet"`). KQL autocomplete is available for `.alerts-security.alerts-*` indices. - -* Use the date and time filter to define a specific time range. By default, this filter is set to search the last 24 hours. - -* Visualize and group alerts by specific parameters in the visualization section. Use the menu on the left to select a view type (*Trend*, *Table*, or *Treemap*), and use the menus on the right to select the ECS fields used for grouping alerts. Refer to <> for more on each view type. - -* Hover over a value in the data grid to display available inline actions, such as *Filter In*, *Filter Out*, and *Add to timeline investigation*. Click the expand button to open a full context menu of options, including *Show top values*, *Copy to Clipboard*, and *View rule details*. The available options vary based on the type of data. -+ -[role="screenshot"] -image::images/inline-actions-menu.gif[width=75%][height=75%][Animation of using the inline additional actions menu] - -* Filter alert results to include building block alerts or to only show alerts from indicator match rules by selecting the *Additional filters* drop-down. By default, <> are excluded from the Overview and Alerts pages. You can choose to include building block alerts on the Alerts page, which expands the number of alerts. -+ -NOTE: When updating alert results to include building block alerts, the Security app searches the `.alerts-security.alerts-` index for the `kibana.alert.building_block_type` field. When looking for alerts created from indicator match rules, the app searches the same index for `kibana.alert.rule.type:'threat_match'`. -+ -[role="screenshot"] -image::images/additional-filters.png[Alerts table with Additional filters menu highlighted] - -* View detection alerts generated by a specific rule. Go to *Manage* -> *Rules*, then select a rule name in the table. The rule details page displays a comprehensive view of the rule's settings, and the Alerts table under the Trend histogram displays the alerts associated with the rule, including alerts from any previous or deleted revision of that rule. - -[float] -[[customize-the-alerts-table]] -=== Customize the Alerts table -Use the toolbar buttons in the upper-left of the Alerts table to customize the columns you want displayed: - -* **Columns**: Reorder the columns. -* **_x_ fields sorted**: Sort the table by one or more columns. -* **Fields**: Select the fields to display in the table. You can also add <> to detection alerts and display them in the Alerts table. - -Click the *Full screen* button in the upper-right to view the table in full-screen mode. - -[role="screenshot"] -image::images/alert-table-toolbar-buttons.png[Alerts table with toolbar buttons highlighted] - -Use the view options drop-down in the upper-right of the Alerts table to control how alerts are displayed: - -* *Grid view*: Displays alerts in a traditional table view with columns for each field -* *Event rendered view*: Display alerts in a descriptive event flow that includes relevant details and context about the event. - -[role="screenshot"] -image::images/event-rendered-view.png[Alerts table with the Event rendered view enabled] - -TIP: If you're in the grid view, you can still view the event rendering for a specific alert by clicking the link in the *Event Summary* column, if a link is available. Some events do not have event renderings. - -[float] -[[alert-actions]] -=== Take actions on an alert -From the Alerts table or the alert details flyout, you can: - -* <> -* <> -* <> -* <> -* <> -* <> (Alert details flyout only) -* <> -* <> -* <> - -[float] -[[detection-alert-status]] -==== Change an alert's status - -You can set an alert's status to indicate whether it needs to be investigated -(*Open*), is under active investigation (*Acknowledged*), or has been resolved -(*Closed*). By default, the Alerts page displays open alerts. To filter alerts that are *Acknowledged* or *Closed*, select the appropriate status in the upper-left corner of the Alerts page. This filters all of the results displayed on the page (the Count table, Trend histogram, and Alerts table). - -To change an alert's status, do one of the following: - -* In the alert's row, click the *More actions* menu (*...*) in the Alerts table, then select the appropriate status (*Mark as open*, *Mark as acknowledged*, or *Mark as closed*). -* In the Alerts table, select all the alerts you want to change, click on the drop-down at the upper-left above the table, and then select *Mark as open*, *Mark as acknowledged*, or *Mark as closed*. -* In the alert details flyout, click *Take action* and select *Mark as open*, *Mark as acknowledged*, or *Mark as closed*. - -[role="screenshot"] -image::images/alert-change-status.gif[width=50%][height=50%][Animation of changing the status of multiple alerts] - -[float] -[[add-exception-from-alerts]] -==== Add a rule exception from an alert - -You can add exceptions to the rule that generated an alert directly from the -Alerts table. Exceptions prevent a rule from generating alerts even when its -criteria are met. - -To add an exception, click the *More actions* menu (*...*) in the Alerts table, then select -*Add exception*. Alternatively, select *Take action* -> *Add rule exception* in the alert details flyout. - -For information about exceptions and how to use them, refer to -<>. - -[float] -[[signals-to-timelines]] -==== View alerts in Timeline - -To view an alert in Timeline, click the *Investigate in timeline* button in the Alerts table. Alternatively, select *Take action* -> *Investigate in timeline* in the alert details flyout. - -[role="screenshot"] -image::images/timeline-button.png[Investigate in timeline button, 300] - -TIP: When you send an alert generated by a -<> to Timeline, all matching events are -listed in the Timeline, even ones that did not reach the threshold value. For -example, if you have an alert generated by a threshold rule that detects 10 -failed login attempts, when you send that alert to Timeline, all failed login -attempts detected by the rule are listed. - -Suppose the rule that generated the alert uses a Timeline template. In this case, when you investigate the alert in Timeline, the dropzone query values defined in the template are replaced with their corresponding alert values. - -// * `host.name` -// * `host.hostname` -// * `host.domain` -// * `host.id` -// * `host.ip` -// * `client.ip` -// * `destination.ip` -// * `server.ip` -// * `source.ip` -// * `network.community_id` -// * `user.name` -// * `process.name` - -*Example* - -This Timeline template uses the `host.name: "{host.name}"` dropzone filter in -the rule. When alerts generated by the rule are investigated in Timeline, the -`{host.name}` value is replaced with the alert's `host.name` value. If the -alerts's `host.name` value is `Windows-ArsenalFC`, the Timeline dropzone query -is `host.name: "Windows-ArsenalFC"`. - -NOTE: Refer to <> for information on creating Timelines and Timeline -templates. For information on how to add Timeline templates to rules, refer to <>. diff --git a/docs/detections/alerts-view-details.asciidoc b/docs/detections/alerts-view-details.asciidoc deleted file mode 100644 index fe03e44fe3..0000000000 --- a/docs/detections/alerts-view-details.asciidoc +++ /dev/null @@ -1,132 +0,0 @@ -[[view-alert-details]] -== View detection alert details - -To inspect a detection alert, click the *View details* button from the Alerts table. The alert details flyout appears with several options to view alert data. - -[role="screenshot"] -image::images/view-alert-details.png[View details button, 200] - -The alert details flyout contains these informational tabs: - -* *Overview*: A summary of the alert, including relevant fields and selected threat intelligence details. <> -* *Threat Intel*: A list of individual threats matching the alert. <> -* *Table*: The alert data in table format. Data is organized into field-value pairs. -* *JSON*: The alert data in JSON format. - -[role="screenshot"] -image::images/alert-details-flyout.png[Alert details flyout] - -[discrete] -[[alert-details-overview]] -=== Overview tab - -The *Overview* tab summarizes the alert and shows relevant threat intelligence details. Use this information to understand what generated the alert so you can triage and resolve it. - -The *Overview* tab contains these features: - -* *Summary*: Displays general details such as the alert's status, severity, risk score, and a link to the detection rule that produced the alert. - -* *Reason statement*: Provides a description of what generated the alert and provides general alert details. You can use this to understand the alert's origin and determine if the alert is relevant to your investigation. - -* *Highlighted fields*: Surfaces the most relevant fields for the alert type. Use this to inform your triage efforts as you investigate the alert. - -* *Alert prevalence*: Shows the total number of alerts within the selected time frame that have identical values. For example, an alert prevalence of 3 for `host.name` means three alerts with the same `host.name` value exist within the time frame. -+ -Alert prevalence data can help you investigate relationships with other alerts and gain context about the events producing alerts. You can also click the alert prevalence count to explore the alerts in Timeline. -+ -IMPORTANT: Before investigating alert prevalence data in Timeline, save any Timelines you're working on to ensure you can access them later. - -* *Insights*: Shows relationships with associated alerts to help you quickly identify patterns. Refer to <> for more information. - -* *Enriched data*: Displays available threat indicator matches and threat intelligence data. This section only displays when examining alerts with intelligence data. Click the info icon to learn more about what data is collected. Refer to <> for more information. -+ -[role="screenshot"] -image::images/enriched-data-info-icon.png[Informational message on enriched data, 600] - -[discrete] -[[alert-details-insights]] -==== Insights on alerts - -The Insights section shows you how an alert is related to other alerts and offers ways to investigate related alerts. You can use this information to quickly find patterns between alerts and then take action. - -Within the Insights section, you can click on the title for each insight to expand or collapse it. - -[role="screenshot"] -image::images/insights-section.png[Insights section in Alert details flyout, 600] - -The Insights section provides the following details: - -* *Cases related to the alert* - Shows the total number and names of cases to which the alert has been added. Click a case's name to open its details. -* *Alerts related by source event* - Shows the ten most recent alerts created by the same source event. This can help you find alerts with a shared origin and provide more context about the source event. Click the *Investigate in timeline* button to examine related alerts in Timeline. -* *Alerts related by session ID* - Shows the ten most recent alerts generated during the same <>. These alerts share the same Session ID, which is a unique ID for tracking a given Linux session. -+ -beta::[] -+ -NOTE: This feature requires a https://www.elastic.co/pricing[Platinum or Enterprise subscription]. In addition, the *Include session data* setting must be enabled on your {endpoint-cloud-sec} integration policy. Refer to <> for more information. - -* *Alerts related by process ancestry* - Shows alerts that are related by process events on the same linear branch. Note that alerts generated from processes on child or related branches are not shown. To further examine alerts, click *Investigate in timeline*. -+ -beta::[] -+ -NOTE: This feature requires a https://www.elastic.co/pricing[Platinum or Enterprise subscription]. In addition, to display it within the Insights section, you must also add the following feature flag to the `kibana.yml` file: -`xpack.securitySolution.enableExperimental: ['insightsRelatedAlertsByProcessAncestry']` - -[discrete] -[[enriched-data-overview]] -==== Enriched data on alerts - -When gathering threat intelligence data for an alert, {elastic-sec} queries the alert for indicator matches from the past 30 days. The query looks for the following fields: - -- `file.hash.md5`: The MD5 hash -- `file.hash.sha1`: The SHA1 hash -- `file.hash.sha256`: The SHA256 hash -- `file.pe.imphash`: Imports in a PE file -- `file.elf.telfhash`: Imports in an ELF file -- `file.hash.ssdeep`: The SSDEEP hash -- `source.ip`: The IP address of the source (IPv4 or IPv6) -- `destination.ip`: The event's destination IP address -- `url.full`: The full URL of the event source -- `registry.path`: The full registry path, including the hive, key, and value - -If these fields aren't available, {elastic-sec} does not perform the query and does not display threat intelligence data for the alert. - -Discovered threat indicator match data is placed under the **Threat Match Detected** subsection of the Overview tab. - -[role="screenshot"] -image::images/matched-indicator-sub-sec.png[Threat Match Detected subsection with matched file hash, 600] - -All other available threat intelligence data is placed under the **Enriched with Threat Intelligence** subsection of the Overview tab. - -[role="screenshot"] -image::images/threat-intel-sub-sec.png[Enriched with Threat Intelligence subsection with matched file hash, 700] - -TIP: To learn more about the query, select the **Threat Intel** tab, then click the **Inspect** button next to the threat you want to inspect. - -Additional threat intelligence data is generated for indicator match alerts when indicators are matched with source events, as outlined by the conditions in the relevant indicator match rule. Indicator match alerts always populate the *Threat Matched Detected* section under the *Threat Intel* tab with additional threat match data. - -IMPORTANT: After upgrading to {stack} version 7.15.0 or newer from release versions 7.12.0 through 7.14.2, you need to migrate detection alerts enriched with threat intelligence data to ensure threat intelligence properly displays in {elastic-sec}. For more information, refer to instructions for <>. - -[float] -[[alert-details-threat-intel]] -=== Threat Intel tab - -The *Threat Intel* tab shows the number of individual threats matching the alert. You can expand and collapse threat details by clicking the arrow button at the end of the threat label. Each threat is labelled with values from the `matched.field` and `matched.atomic` fields and displays the threat intelligence provider. If the alert does not contain threat intelligence data, the *Threat Intel* tab displays a message that none is available. - -Matched threats are organized into several sections, described below. Within each section, matched threats are shown in reverse chronological order, with the most recent at the top. All mapped fields are displayed for each matched threat. - -* *Threat Matched Detected*: This section is solely reserved for threat indicator matches identified by an indicator match rule. Threat indicator matches are produced whenever event data matches a threat indicator field value in your indicator index. If indicator threat matches are not discovered, the section displays a message that none are available. -* *Enriched with Threat Intelligence*: This section shows indicator matches that {elastic-sec} found when querying the alert for fields with threat intelligence. You can use the date time picker to modify the query time frame, which looks at the past 30 days by default. Click the **Inspect** button, located on the far right of the threat label, to view more information on the query. If threat matches are not discovered within the selected time frame, the section displays a message that none are available. - -NOTE: The event enrichment query uses the indices specified in the `securitySolution:defaultThreatIndex` advanced setting. For more information, refer to <>. - -//// -[discrete] -=== Table tab - -The *Table* tab shows the alert details in table format. Alert details are organized into field value pairs. - -[float] -=== JSON tab - -The *JSON* tab shows the alert details in JSON format. -//// diff --git a/docs/detections/alerts-visualizations.asciidoc b/docs/detections/alerts-visualizations.asciidoc deleted file mode 100644 index ed31e4a031..0000000000 --- a/docs/detections/alerts-visualizations.asciidoc +++ /dev/null @@ -1,54 +0,0 @@ -[[visualize-alerts]] -== Visualize detection alerts - -Visualize and group detection alerts by specific parameters in the visualization section of the Alerts page. - -[role="screenshot"] -image::images/alert-page-visualizations.png[] - -Use the left menu to select a view type (*Trend*, *Table*, or *Treemap*), and use the right menus to select the ECS fields to use for grouping: - -* *Group by*: Primary field for grouping alerts. -* *Group by top* (if available): Secondary field for further subdividing grouped alerts. - -For example, you can group first by rule name (`Group by: kibana.alert.rule.name`), then by host name (`Group by top: host.name`) to visualize which detection rules generated alerts, and which hosts triggered each of those rules. For groupings with a lot of unique values, the top 1,000 results are displayed. - -NOTE: The *Group by top* option isn't available in all view types. You can also leave *Group by top* blank to group by only the primary field in *Group by*. - -To reset a view to default settings, click the settings menu (image:images/three-dot-icon.png[Settings menu icon,18,18]) in the upper-right and select *Reset group by fields* (the settings menu appears when hovering over the area). - -=== Trend -The trend view is the default visualization on the Alerts page and shows the occurrence of alerts over time. By default, it groups alerts by detection rule name (`kibana.alert.rule.name`). - -NOTE: The *Group by top* menu is unavailable for the trend view. - -[role="screenshot"] -image::images/alerts-viz-trend.png[Trend visualization for alerts] - -=== Table -The table view shows the count of alerts in each group. By default, it groups alerts first by detection rule name (`kibana.alert.rule.name`), then by host name (`host.name`). - -[role="screenshot"] -image::images/alerts-viz-table.png[Table visualization for alerts] - -=== Treemap -The treemap view shows the distribution of alerts as nested, proportionally-sized tiles. This view can help you quickly pinpoint the most prevalent and critical alerts. - -[role="screenshot"] -image::images/alerts-viz-treemap.png[Treemap visualization for alerts] - -Larger tiles represent more frequent alerts, and each tile's color is based on the alerts' risk score: - -* *Green*: Low risk (`0` - `46`) -* *Yellow*: Medium risk (`47` - `72`) -* *Orange*: High risk (`73` - `98`) -* *Red*: Critical risk (`99` - `100`) - -By default, the treemap groups alerts first by detection rule name (`kibana.alert.rule.name`), then by host name (`host.name`). This shows which rules generated the most alerts, and which hosts were responsible. - -NOTE: Depending on the amount of alerts, some tiles and text might be very small. Hover over the treemap to display information in a tooltip. - -You can click on the treemap to narrow down the alerts displayed in both the treemap and the alerts table below. Click the label above a group to display the alerts in that group, or click an individual tile to display the alerts related to that tile. This adds filters under the KQL search bar, which you can edit or remove to further customize the view. - -[role="screenshot"] -image::images/treemap-click.gif[Animation of clicking the treemap] diff --git a/docs/detections/api/det-api-index.asciidoc b/docs/detections/api/det-api-index.asciidoc deleted file mode 100644 index f9ce608488..0000000000 --- a/docs/detections/api/det-api-index.asciidoc +++ /dev/null @@ -1,27 +0,0 @@ -include::rules/rules-api-overview.asciidoc[] - -include::rules/rules-api-create.asciidoc[] - -include::rules/rules-api-get.asciidoc[] - -include::rules/rules-api-find.asciidoc[] - -include::rules/rules-api-update.asciidoc[] - -include::rules/rules-api-delete.asciidoc[] - -include::rules/rules-api-bulk-actions.asciidoc[] - -include::rules/index-api-overview.asciidoc[] - -include::rules/tags-api-overview.asciidoc[] - -include::rules/rules-api-import.asciidoc[] - -include::rules/rules-api-export.asciidoc[] - -include::rules/privileges-api-overview.asciidoc[] - -include::rules/signals-api-overview.asciidoc[] - -include::rules/rules-api-prebuilt.asciidoc[] diff --git a/docs/detections/api/exceptions-api-index.asciidoc b/docs/detections/api/exceptions-api-index.asciidoc deleted file mode 100644 index a80849aa6d..0000000000 --- a/docs/detections/api/exceptions-api-index.asciidoc +++ /dev/null @@ -1,25 +0,0 @@ -include::exceptions/exceptions-api-overview.asciidoc[] - -include::exceptions/api-create-exception-container.asciidoc[] - -include::exceptions/api-create-exception-item.asciidoc[] - -include::exceptions/api-find-exception-containers.asciidoc[] - -include::exceptions/api-find-exception-items.asciidoc[] - -include::exceptions/api-get-exception-containers.asciidoc[] - -include::exceptions/api-get-exception-items.asciidoc[] - -include::exceptions/api-update-exception-container.asciidoc[] - -include::exceptions/api-summary-exception-container.asciidoc[] - -include::exceptions/api-update-exception-item.asciidoc[] - -include::exceptions/api-delete-exception-container.asciidoc[] - -include::exceptions/api-delete-exception-item.asciidoc[] - -include::exceptions/lists-index-api-overview.asciidoc[] diff --git a/docs/detections/api/exceptions/api-create-exception-container.asciidoc b/docs/detections/api/exceptions/api-create-exception-container.asciidoc deleted file mode 100644 index 3dadd40a0f..0000000000 --- a/docs/detections/api/exceptions/api-create-exception-container.asciidoc +++ /dev/null @@ -1,113 +0,0 @@ -[[exceptions-api-create-container]] -=== Create exception container - -Creates an exception container. - -An exception container groups <> -and can be associated with rules. When an exception item's query evaluates to -`true`, rules do *not* issue alerts even when the rule's other criteria are met. - -You can assign detection rules with multiple exception containers. For more information, see <> and <>. - -IMPORTANT: All exception items added to the same container are evaluated using -`OR` logic. That is, if any of the items in a container evaluate to `true`, the -exception prevents the rule from generating an alert. Likewise, `OR` logic is -used for evaluating exceptions when more than one exception container is -assigned to a rule. To use the `AND` operator, you can define multiple clauses -(`entries`) in a single exception item. - -==== Request URL - -`POST :/api/exception_lists` - -==== Request body - -A JSON object with these fields: - -[width="100%",options="header"] -|============================================== -|Name |Type |Description |Required - -|`description` |String |Describes the exception container. |Yes -|`list_id` |String |Unique identifier. |No, automatically created when it is not -provided. -|`meta` |Object |Placeholder for metadata about the list container. |No -|`name` |String |The exception container's name. |Yes -|`namespace_type` |String a|Determines whether the exception container is available in all {kib} spaces or just the space in which it is created, where: - -* `single`: Only available in the {kib} space in which it is created. -* `agnostic`: Available in all {kib} spaces. - -|No, defaults to `single`. -|`tags` |String[] |String array containing words and phrases to help categorize -exception containers. |No -|`type` |String a|The type of exception, which must be one of these: - -* `detection`: Detection rule exception -* `endpoint`: Endpoint alert exception - -|Yes - -|============================================== - -===== Example requests - -Creates an exception container for holding trusted Linux process exception -items: - -[source,console] --------------------------------------------------- -POST api/exception_lists -{ - "description": "Excludes Linux trusted processes", - "name": "Linux process exceptions", - "list_id": "trusted-linux-processes", - "type": "detection", - "namespace_type": "single", - "tags": [ - "linux", - "processes" - ] -} --------------------------------------------------- -// KIBANA - -==== Response code - -`200`:: - Indicates a successful call. - - -==== Response payload - -The exception container object with a unique ID. - -[source,json] --------------------------------------------------- -{ - "_tags": [], - "created_at": "2020-07-13T09:33:46.187Z", - "created_by": "elastic", - "description": "Excludes Linux trusted processes", - "id": "f320c070-c4eb-11ea-80bb-11861bae2798", <1> - "list_id": "trusted-linux-processes", <2> - "name": "Linux process exceptions", - "namespace_type": "single", <3> - "tags": [ - "linux", - "processes" - ], - "tie_breaker_id": "2c08d5a5-2ecc-4d5a-acfb-0a367f25b3f3", - "type": "detection", <4> - "updated_at": "2020-07-13T09:33:46.359Z", - "updated_by": "elastic" -} --------------------------------------------------- - -These values are required to associate the exception container with detection -rules: - -<1> `id` -<2> `list_id` -<3> `namespace_type` -<4> `type` diff --git a/docs/detections/api/exceptions/api-create-exception-item.asciidoc b/docs/detections/api/exceptions/api-create-exception-item.asciidoc deleted file mode 100644 index 8c780066bd..0000000000 --- a/docs/detections/api/exceptions/api-create-exception-item.asciidoc +++ /dev/null @@ -1,383 +0,0 @@ -[[exceptions-api-create-exception-item]] -=== Create exception item - -Creates an exception item and associates it with the specified -<>. - -Refer to <> for information about creating exception items from -lists, such as a list of IP addresses or host names. - -NOTE: Before creating exception items, you must create an exception container. - -IMPORTANT: Endpoint rule exception items cannot use -<> (the `list` in the `entries` array), and the -following fields cannot be used in exception queries (as `field` values in the -`entries` object): - -* `file.Ext.quarantine_path` -* `file.Ext.quarantine_result` -* `process.entity_id` -* `process.parent.entity_id` -* `process.ancestry` - -==== Request URL - -`POST :/api/exception_lists/items` - -==== Request body - -A JSON object with these fields: - -[width="100%",options="header"] -|============================================== -|Name |Type |Description |Required - -|`comments` |comments[] a|Array of `comment` fields: - -* `comment` (string): Comments about the exception item. - -|No, defaults to empty array. - -|`description` |String |Describes the exception item. |Yes -|`entries` |<> |Array containing the -exception queries. Boolean `AND` logic is used to evaluate the relationship -between array elements. If you want to use `OR` logic, create a separate -exception item. |Yes -|`list_id` |String |ID of the associated <>. |Yes -|`item_id` |String |Unique identifier of the exception item. |No, automatically -created when it is not provided. -|`meta` |Object |Placeholder for metadata about the exception item. |No -|`name` |String |The exception item's name. |Yes. -|`namespace_type` |String a|Determines whether the exception item is available -in all {kib} spaces or just the space in which it is created, where: - -* `single`: Only available in the {kib} space in which it is created. -* `agnostic`: Available in all {kib} spaces. - -Must be the same value as its associated exception container. - -|No, defaults to `single`. -|`tags` |String[] |String array containing words and phrases to help categorize -exception items. |No -|`type` |String a|Exception query type, must be `simple`. |Yes -|`_tags` |String[] a|For endpoint rules only, defines the OS on which the -exception is implemented. Valid values are: - -* `os:windows`: Windows OS -* `os:linux`: Linux OS -* `os:macos`: Mac OS - -The array must also include an `endpoint` element (to implement the exception on Linux hosts, use: `["endpoint", "os:linux"]`). - -|For endpoint exceptions, yes. For detection exceptions, no. - -|============================================== - -[[entries-object-schema]] -===== `entries` schema - -[width="100%",options="header"] -|============================================== -|Name |Type |Description |Required - -|`field` |String |The source event field used to define the exception. Cannot -be an empty string. |Yes -|`list` |list |Object containing the -<> `id` and `type`. Only valid for -detection exception items.|No, except when using a list to define detection -exceptions. -|`operator` |String a|The operator used to determine when the exception is used. -Can be: - -* `included`: The `field` has the specified value or values. -* `excluded`: The `field` does not have specified value or values. - -|Yes - -|`type` |String a|The `type` of query: - -* `match`: Must be an exact match of the defined value. -* `match_any`: Matches any of the defined values. -* `exists`: The field exists. -* `list`: The field matches values in a list container. -* `wildcard`: Matches `value` using wildcards, such as `C:\path\*\app.exe`. Use `?` to match one character and `*` to match zero or more characters. The `field` data type must be {ref}/keyword.html#keyword-field-type[keyword], {ref}/text.html#text-field-type[text], or {ref}/keyword.html#wildcard-field-type[wildcard]. -* `nested`: Array of `entries` objects. Nested conditions are required for -excluding some Endpoint fields (<>). -<> lists all Endpoint fields that require the `nested` -type. - -|Yes - -|`value` -a|String - -String[] - -a|Field value or values: - -* String: When the `type` is `match` or `wildcard`. -* String[]: When the `type` is `match_any`. - -|Yes, except when `type` is `exists` or `list`. - -|============================================== - -IMPORTANT: When you use <> -(`"type": "list"`), you cannot use other types in the `entries` array (`match`, -`match_any`, `exists`, or `nested`). - -For endpoint exceptions, you cannot create exception items based on excluded -values (`"operator": "excluded"`). - -===== Example requests - -*Example 1* - -Adds the `maintenance-job` process to the `trusted-linux-processes` exception -container: - -[source,console] --------------------------------------------------- -POST api/lists/exception_lists/items -{ - "description": "Excludes the weekly maintenance job", - "entries": [ - { - "field": "process.name", - "operator": "included", - "type": "match", - "value": "maintenance-job" - } - ], - "list_id": "trusted-linux-processes", - "name": "Linux maintenance job", - "namespace_type": "single", - "tags": [ - "in-house processes", - "linux" - ], - "type": "simple" -} --------------------------------------------------- -// KIBANA - -*Example 2* - -Adds hosts on which the `maintenance` process is allowed to run to the -`allowed-processes` exception container: - -[source,console] --------------------------------------------------- -POST api/lists/exception_lists/items -{ - "comments": [ - {"comment": "Allows maintenance process to run on the specified machines"} - ], - "description": "Process allowlist", - "entries": [ - { - "field": "process.name", - "operator": "included", - "type": "match", - "value": "maintenance" - }, - { <1> - "field": "host.name", - "operator": "included", - "type": "match_any", - "value": [ - "liv-win-anf", - "livw-win-mel", - "linux-anfield" - ] - } - ], - "list_id": "allowed-processes", - "item_id": "allow-process-on-machines", - "name": "Host-process exclusions", - "namespace_type": "single", - "tags": [ - "hosts", - "processes" - ], - "type": "simple" -} --------------------------------------------------- -// KIBANA - -<1> Multiple array elements are evaluated using `AND` operators. - -*Example 3* - -[[endpoint-item-example]] -Creates an endpoint exception item for files with the specified SHA-1 hash -value on Windows OS: - -[source,console] --------------------------------------------------- -POST api/lists/exception_lists/items -{ - "_tags": [ - "endpoint", <1> - "os:windows" <2> - ], - "comments": [ - ] - "description": "File exception for Windows", - "entries": [ - { - "field": "file.hash.sha1", - "operator": "included", - "type": "match", - "value": "27fb21cf5db95ffca43b234affa99becc4023b9d" - } - ], - "item_id": "trusted-windows-file", - "list_id": "endpoint-exception-container", - "name": "Trusted Windows file", - "namespace_type": "agnostic", <3> - "tags": [ - ] - "type": "simple" -} --------------------------------------------------- - -<1> Indicates this item is for endpoint rules. -<2> Relevant OS. -<3> Item accessible from all {kib} spaces. - -*Example 4* - -[[list-item-example]] -Associates the `external-ip-excludes` <> -as an exception item to the `trusted-IPs` exception container: - -[source,console] --------------------------------------------------- -POST api/lists/exception_lists/items -{ - "description": "Uses the external-ip-container list to exclude trusted external IPs.", - "entries": [ - { - "field": "destination.ip", - "list": { - "id": "external-ip-excludes", <1> - "type": "ip" - }, - "operator": "included", - "type": "list" - } - ], - "list_id": "trusted-IPs", <2> - "item_id": "external-IPs", - "name": "Trusted external IPs", - "namespace_type": "single", - "tags": [ - "network", - "trusted IPs" - ], - "type": "simple" -} --------------------------------------------------- -// KIBANA - -<1> The list container that holds IP address -<>. -<2> The exception container's ID. - -[[nested-field-ex-api]] -*Example 5* - -Adds an exception for nested Endpoint fields: - -[source,console] --------------------------------------------------- -POST api/lists/exception_lists/items -{ - "description": "Excludes all processes signed by Trusted Signer, Inc.", - "entries": [ - { - "field": "process.Ext.code_signature", - "type": "nested", - "entries": [ - { - "field": "trusted", - "type": "match", - "operator": "included", - "value": "true" - }, - { - "field": "subject_name", - "type": "match", - "operator": "included", - "value": "Trusted Signer, Inc." - } - ] - } - ], - "list_id": "trusted-self-signed-processes", - "name": "In-house processes", - "namespace_type": "single", - "tags": [ - "in-house processes", - "linux" - ], - "type": "simple" -} --------------------------------------------------- - -==== Response code - -`200`:: - Indicates a successful call. - -==== Response payload - -[source,json] --------------------------------------------------- -{ - "_tags": [], - "comments": [ - { - "comment": "Allows maintenance process to run on the specified machines", - "created_at": "2020-07-14T08:36:33.172Z", - "created_by": "elastic", - "id": "f6c61b4d-31dd-4a5d-8c73-f64787d03b4d" - } - ], - "created_at": "2020-07-14T08:36:33.172Z", - "created_by": "elastic", - "description": "Process allowlist", - "entries": [ - { - "field": "process.name", - "operator": "included", - "type": "match", - "value": "maintenance" - }, - { - "field": "host.name", - "operator": "included", - "type": "match_any", - "value": [ - "liv-win-anf", - "livw-win-mel", - "linux-anfield" - ] - } - ], - "id": "1f4d38b0-c5ad-11ea-a3d8-a5b753aeeb9e", - "item_id": "allow-process-on-machines", - "list_id": "allowed-processes", - "name": "Host-process exclusions", - "namespace_type": "single", - "tags": [ - "hosts", - "processes" - ], - "tie_breaker_id": "bb04f1c7-2537-47c1-aaca-40a7c8f771d3", - "type": "simple", - "updated_at": "2020-07-14T08:36:33.339Z", - "updated_by": "elastic" -} --------------------------------------------------- diff --git a/docs/detections/api/exceptions/api-delete-exception-container.asciidoc b/docs/detections/api/exceptions/api-delete-exception-container.asciidoc deleted file mode 100644 index a11ee7d98b..0000000000 --- a/docs/detections/api/exceptions/api-delete-exception-container.asciidoc +++ /dev/null @@ -1,31 +0,0 @@ -[[exceptions-api-delete-container]] -=== Delete exception container - -Deletes an exception container. - -==== Request URL - -`DELETE :/api/exception_lists` - -===== URL query parameters - -The URL query must include one of the following: - -* `id` - `DELETE /api/exception_lists?id=` -* `list_id` - `DELETE /api/exception_lists?list_id=` - - -===== Example request - -Deletes the exception container with an `list_id` of `linux-processes`: - -[source,console] --------------------------------------------------- -DELETE api/exception_lists?list_id=linux-processes --------------------------------------------------- -// KIBANA - -==== Response code - -`200`:: - Indicates a successful call. diff --git a/docs/detections/api/exceptions/api-delete-exception-item.asciidoc b/docs/detections/api/exceptions/api-delete-exception-item.asciidoc deleted file mode 100644 index e9291409f7..0000000000 --- a/docs/detections/api/exceptions/api-delete-exception-item.asciidoc +++ /dev/null @@ -1,30 +0,0 @@ -[[exceptions-api-delete-item]] -=== Delete exception item - -Deletes an exception item. - -==== Request URL - -`DELETE :/api/exception_lists/items` - -===== URL query parameters - -The URL query must include one of the following: - -* `id` - `DELETE /api/exception_lists/items?id=` -* `item_id` - `DELETE /api/exception_lists/items?item_id=` - -===== Example request - -Deletes the exception item with an `item_id` of `external-IPs`: - -[source,console] --------------------------------------------------- -DELETE api/exception_lists/items?item_id=external-IPs --------------------------------------------------- -// KIBANA - -==== Response code - -`200`:: - Indicates a successful call. diff --git a/docs/detections/api/exceptions/api-find-exception-containers.asciidoc b/docs/detections/api/exceptions/api-find-exception-containers.asciidoc deleted file mode 100644 index a0b6e8dfd5..0000000000 --- a/docs/detections/api/exceptions/api-find-exception-containers.asciidoc +++ /dev/null @@ -1,110 +0,0 @@ -[[exceptions-api-find-exception-containers]] -=== Find exception containers - -Retrieves a paginated subset of exception containers. By default, the first -page is returned with 20 results per page. - -==== Request URL - -`GET :/api/exception_lists/_find` - -===== URL query parameters - -All parameters are optional: - -[width="100%",options="header"] -|============================================== -|Name |Type |Description - -|`page` |Integer |The page number to return. - -|`per_page` |Integer |The number of containers to return per page. - -|`sort_field` |String |Determines which field is used to sort the results. - -|`sort_order` |String |Determines the sort order, which can be `desc` or `asc`. - -|`cursor` |String |Returns the containers that come after the last container -returned in the previous call (use the `cursor` value returned in the previous -call). This parameter uses the `tie_breaker_id` field to ensure all containers -are sorted and returned correctly. -See {ref}/search-request-body.html#request-body-search-search-after[Search After] for more information. - -|`namespace_type` |String |Determines whether the returned containers are {kib} -associated with a {kib} space or available in all spaces (`agnostic` or -`single`). - -|`filter` |String a|Filters the returned results according to the value of the -specified field, using the `:` syntax, where -`` can be: - -* `name` -* `type` -* `created_by` -* `updated_by` - -|============================================== - -===== Example request - -Returns containers, sorted by `name` in descending order: - -[source,console] --------------------------------------------------- -GET api/exception_lists/_find?page=1&per_page=2&sort_field=name&sort_order=desc --------------------------------------------------- -// KIBANA - -==== Response code - -`200`:: - Indicates a successful call. - -==== Response payload - -[source,json] --------------------------------------------------- -{ - "data": [ - { - "_tags": [], - "created_at": "2020-07-14T10:47:03.421Z", - "created_by": "elastic", - "description": "Trusted external IPs", - "id": "5a7f77b0-c5bf-11ea-a3d8-a5b753aeeb9e", - "list_id": "allowed-IPs", - "name": "Trusted ext IPs", - "namespace_type": "single", - "tags": [ - "network", - "IP" - ], - "tie_breaker_id": "5b39e2f4-bcfa-4199-bcf0-b859c4b805f4", - "type": "detection", - "updated_at": "2020-07-14T10:47:03.595Z", - "updated_by": "elastic" - }, - { - "_tags": [], - "created_at": "2020-07-14T08:24:22.884Z", - "created_by": "elastic", - "description": "Excludes trusted processes", - "id": "6c03f6a0-c5ab-11ea-a3d8-a5b753aeeb9e", - "list_id": "allowed-processes", - "name": "Process exceptions", - "namespace_type": "single", - "tags": [ - "hosts", - "processes" - ], - "tie_breaker_id": "65e16c8a-0d45-4e38-8a8f-094658a5df90", - "type": "detection", - "updated_at": "2020-07-14T08:24:23.050Z", - "updated_by": "elastic" - } - ], - "page": 1, - "per_page": 2, - "total": 6 -} --------------------------------------------------- diff --git a/docs/detections/api/exceptions/api-find-exception-items.asciidoc b/docs/detections/api/exceptions/api-find-exception-items.asciidoc deleted file mode 100644 index eacf871ef9..0000000000 --- a/docs/detections/api/exceptions/api-find-exception-items.asciidoc +++ /dev/null @@ -1,141 +0,0 @@ -[[exceptions-api-find-exception-items]] -=== Find exception items - -Retrieves a paginated subset of exception items in the specified container. By -default, the first page is returned with 20 results per page. - -==== Request URL - -`GET :/api/exception_lists/items/_find` - -===== URL query parameters - -[width="100%",options="header"] -|============================================== -|Name |Type |Description |Required - -|`list_id` |String |ID of the <>. -|Yes - -|`page` |Integer |The page number to return. |No - -|`per_page` |Integer |The number of items to return per page. |No - -|`sort_field` |String |Determines which field is used to sort the results. |No - -|`sort_order` |String |Determines the sort order, which can be `desc` or `asc`. -|No -|`cursor` |String |Returns the items that come after the last item -returned in the previous call (use the `cursor` value returned in the previous -call). This parameter uses the `tie_breaker_id` field to ensure all items -are sorted and returned correctly. -See {ref}/search-request-body.html#request-body-search-search-after[Search After] for more information. |No - -|============================================== - -===== Example request - -Retrieves exception items in the `allowed-processes` container: - -[source,console] --------------------------------------------------- -GET api/exception_lists/items/_find?list_id=allowed-processes --------------------------------------------------- -// KIBANA - -==== Response code - -`200`:: - Indicates a successful call. - -==== Response payload - -[source,json] --------------------------------------------------- -{ - "data": [ - { - "_tags": [], - "comments": [ - { - "comment": "Allowed on all hosts.", - "created_at": "2020-07-14T13:40:39.804Z", - "created_by": "elastic" - } - ], - "created_at": "2020-07-14T13:40:39.804Z", - "created_by": "elastic", - "description": "Global process allowlist", - "entries": [ - { - "field": "process.name", - "operator": "included", - "type": "match", - "value": "housekeeping" - } - ], - "id": "9b25aec0-c5d7-11ea-a3d8-a5b753aeeb9e", - "item_id": "global-allow-processes", - "list_id": "allowed-processes", - "name": "Host-process global exclusion", - "namespace_type": "single", - "tags": [ - "global", - "hosts", - "processes" - ], - "tie_breaker_id": "28c6b069-8e39-4f9a-b93c-95e5a15b46c5", - "type": "simple", - "updated_at": "2020-07-14T13:40:39.980Z", - "updated_by": "elastic" - }, - { - "_tags": [], - "comments": [ - { - "comment": "Allows maintenance process to run on the specified machines", - "created_at": "2020-07-14T13:41:24.005Z", - "created_by": "elastic" - } - ], - "created_at": "2020-07-14T13:41:24.005Z", - "created_by": "elastic", - "description": "Process allowlist", - "entries": [ - { - "field": "process.name", - "operator": "included", - "type": "match", - "value": "maintenance" - }, - { - "field": "host.name", - "operator": "included", - "type": "match_any", - "value": [ - "liv-win-anf", - "livw-win-mel", - "linux-anfield" - ] - } - ], - "id": "b57e5f60-c5d7-11ea-a3d8-a5b753aeeb9e", - "item_id": "allow-process-on-machines", - "list_id": "allowed-processes", - "name": "Host-process exclusions", - "namespace_type": "single", - "tags": [ - "hosts", - "processes" - ], - "tie_breaker_id": "a1bacb3d-7ce1-4f03-80f4-d49235b6bbde", - "type": "simple", - "updated_at": "2020-07-14T13:41:24.182Z", - "updated_by": "elastic" - } - ], - "page": 1, - "per_page": 20, - "total": 2 -} --------------------------------------------------- diff --git a/docs/detections/api/exceptions/api-get-exception-containers.asciidoc b/docs/detections/api/exceptions/api-get-exception-containers.asciidoc deleted file mode 100644 index ef77d442b8..0000000000 --- a/docs/detections/api/exceptions/api-get-exception-containers.asciidoc +++ /dev/null @@ -1,54 +0,0 @@ -[[exceptions-api-get-container]] -=== Get exception container - -Retrieves an exception container using its `id` or `list_id` field. - -==== Request URL - -`GET :/api/exception_lists` - -===== URL query parameters - -The URL query must include the container's `id` or `list_id`: - -* `id` - `GET /api/exception_lists?id=` -* `list_id` - `GET /api/exception_lists?list_id=` - -===== Example request - -Retrieves the list container with a `list_id` of `allowed-processes`: - -[source,console] --------------------------------------------------- -GET api/exception_lists?list_id=internal-ip-excludes --------------------------------------------------- -// KIBANA - -==== Response code - -`200`:: - Indicates a successful call. - -==== Response payload - -[source,json] --------------------------------------------------- -{ - "_tags": [], - "created_at": "2020-07-14T08:24:22.884Z", - "created_by": "elastic", - "description": "Excludes trusted processes", - "id": "6c03f6a0-c5ab-11ea-a3d8-a5b753aeeb9e", - "list_id": "allowed-processes", - "name": "Process exceptions", - "namespace_type": "single", - "tags": [ - "hosts", - "processes" - ], - "tie_breaker_id": "65e16c8a-0d45-4e38-8a8f-094658a5df90", - "type": "detection", - "updated_at": "2020-07-14T08:24:23.050Z", - "updated_by": "elastic" -} --------------------------------------------------- diff --git a/docs/detections/api/exceptions/api-get-exception-items.asciidoc b/docs/detections/api/exceptions/api-get-exception-items.asciidoc deleted file mode 100644 index bc29508f87..0000000000 --- a/docs/detections/api/exceptions/api-get-exception-items.asciidoc +++ /dev/null @@ -1,71 +0,0 @@ -[[exceptions-api-get-item]] -=== Get exception item - -Retrieves an exception item using its `id` or `item_id` field. - -==== Request URL - -`GET :/api/exception_lists/items` - -===== URL query parameters - -The URL query must include one of the following: - -* `id` - `GET /api/exception_lists/items?id=` -* `item_id` - `GET /api/exception_lists/items?item_id=` - -===== Example requests - -Retrieves the item with an `item_id` of `global-allow-processes`: - -[source,console] --------------------------------------------------- -GET api/exception_lists/items?item_id=global-allow-processes --------------------------------------------------- -// KIBANA - -==== Response code - -`200`:: - Indicates a successful call. - -==== Response payload - -[source,json] --------------------------------------------------- -{ - "_tags": [], - "comments": [ - { - "comment": "Allowed on all hosts.", - "created_at": "2020-07-14T13:40:39.804Z", - "created_by": "elastic" - } - ], - "created_at": "2020-07-14T13:40:39.804Z", - "created_by": "elastic", - "description": "Global process allowlist", - "entries": [ - { - "field": "process.name", - "operator": "included", - "type": "match", - "value": "housekeeping" - } - ], - "id": "9b25aec0-c5d7-11ea-a3d8-a5b753aeeb9e", - "item_id": "global-allow-processes", - "list_id": "allowed-processes", - "name": "Host-process global exclusion", - "namespace_type": "single", - "tags": [ - "global", - "hosts", - "processes" - ], - "tie_breaker_id": "28c6b069-8e39-4f9a-b93c-95e5a15b46c5", - "type": "simple", - "updated_at": "2020-07-14T13:40:39.980Z", - "updated_by": "elastic" -} --------------------------------------------------- diff --git a/docs/detections/api/exceptions/api-summary-exception-container.asciidoc b/docs/detections/api/exceptions/api-summary-exception-container.asciidoc deleted file mode 100644 index 282309f701..0000000000 --- a/docs/detections/api/exceptions/api-summary-exception-container.asciidoc +++ /dev/null @@ -1,77 +0,0 @@ -[[exceptions-api-summary-exception-container]] -=== Summary exception container - -Retrieves an exception container summary. - -==== Request URL - -`POST :/api/exception_lists/summary` - -==== Request body - -A JSON object with these fields: - -[width="100%",options="header"] -|============================================== -|Name |Type |Description |Required - -|`filter` |String |Search filter clause. |Yes -|`id` |String |Exception container ID. |Yes -|`list_id` |String |Unique identifier. |Yes -|`namespace_type` |String a|Determines whether the exception container is available in all {kib} spaces or just the space in which it is created, where: - -* `single`: Only available in the {kib} space in which it is created. -* `agnostic`: Available in all {kib} spaces. - -|Yes - -|============================================== - -===== Example requests - -Gets the summary from an exception container: - -[source,console] --------------------------------------------------- -GET api/exception_lists/summary -{ - "filter": "filter-clause", - "id": "allowed-process-id", - "list_id": "allowed-processes", - "namespace_type": "single", -} --------------------------------------------------- -// KIBANA - -==== Response code - -`200`:: - Indicates a successful call. - - -==== Response payload - -A summary of the exception container: - -[source,json] --------------------------------------------------- -{ - windows: 1, - linux: 3, - macos: 2, - total: 6, -} --------------------------------------------------- - -NOTE: For a host isolation exception, the values for `windows`, `linux`, `macos`, and `total` are all the same, as each host isolation exception entry applies to all operating systems. -For example: - -[source,json] --------------------------------------------------- -{ - windows: 5, - linux: 5, - macos: 5, - total: 5, -} --------------------------------------------------- diff --git a/docs/detections/api/exceptions/api-update-exception-container.asciidoc b/docs/detections/api/exceptions/api-update-exception-container.asciidoc deleted file mode 100644 index 73a797c908..0000000000 --- a/docs/detections/api/exceptions/api-update-exception-container.asciidoc +++ /dev/null @@ -1,92 +0,0 @@ -[[exceptions-api-update-container]] -=== Update exception container - -Updates an existing exception container. - -==== Request URL - -`PUT :/api/lists` - -==== Request body - -[width="100%",options="header"] -|============================================== -|Name |Type |Description |Required - -|`description` |String |Describes the exception container. |Yes -|`id` |String |The container's unique identifier. |Yes, when the container's `list_id` field is not used. -|`list_id` |String |The `list_id` of the container you are updating. |Yes, when -the container's `id` field is not used. -|`meta` |Object |Placeholder for metadata about the list container. |No -|`name` |String |The exception container's name. |Yes -|`namespace_type` |String a|Determines whether the exception container is available in all {kib} spaces or just the space in which it is created, where: - -* `single`: Only available in the {kib} space in which it is created. -* `agnostic`: Available in all {kib} spaces. - -|No, defaults to `single`. -|`tags` |String[] |String array containing words and phrases to help categorize -exception containers. |No -|`type` |String a|The type of exception, which must be one of these: - -* `detection`: Detection rule exception -* `endpoint`: Endpoint alert exception - -|Yes - -|============================================== - - -===== Example request - -Updates the `name` and `description` fields: - -[source,console] --------------------------------------------------- -PUT api/exception_lists -{ - "description": "Trusted processes", - "name": "Trusted in-house processes EU", - "list_id": "allowed-processes", - "type": "detection", - "namespace_type": "single", - "tags": [ - "processes", - "hosts" - ] -} --------------------------------------------------- -// KIBANA - -==== Response code - -`200`:: - Indicates a successful call. - -==== Response payload - -The updated object, including the time it was updated. - -Example response: - -[source,json] --------------------------------------------------- -{ - "_tags": [], - "created_at": "2020-07-15T06:10:37.228Z", - "created_by": "elastic", - "description": "EU trusted processes", - "id": "e6c44050-c661-11ea-bab5-9d6ae015701b", - "list_id": "allowed-processes", - "name": "Trusted in-house processes- EU", - "namespace_type": "single", - "tags": [ - "processes", - "hosts" - ], - "tie_breaker_id": "f022101f-edc9-449b-992c-2c6108190423", - "type": "detection", - "updated_at": "2020-07-15T06:12:38.098Z", - "updated_by": "elastic" -} --------------------------------------------------- diff --git a/docs/detections/api/exceptions/api-update-exception-item.asciidoc b/docs/detections/api/exceptions/api-update-exception-item.asciidoc deleted file mode 100644 index 1a9a363869..0000000000 --- a/docs/detections/api/exceptions/api-update-exception-item.asciidoc +++ /dev/null @@ -1,140 +0,0 @@ -[[exceptions-api-update-item]] -=== Update exception item - -Updates an existing exception item. - -==== Request URL - -`PUT :/api/exception_lists/items` - -==== Request body - -[width="100%",options="header"] -|============================================== -|Name |Type |Description |Required - -|`comments` |comments[] a|Array of `comment` fields: - -* `comment` (string): Comments about the exception item. -* `id` (string): Existing comment ID, required for updating existing comments. -When unspecified, a new comment is created. - -|No, defaults to empty array. - -|`description` |String |Describes the exception item. |Yes -|`entries` |<> |Array containing the -exception queries. Boolean `AND` logic is used to evaluate the relationship -between array elements. If you want to use `OR` logic, create a separate -exception item. |Yes. -|`id` |String |The item's unique identifier. |Yes, when the item's `item_id` field is not used. -|`item_id` |String |The `item_id` of the item you are updating. |Yes, when -the item's `id` field is not used. -|`meta` |Object |Placeholder for metadata about the exception item. |No -|`name` |String |The exception item's name. |Yes. -|`namespace_type` |String a|Determines whether the exception item is available -in all {kib} spaces or just the space in which it is created, where: - -* `single`: Only available in the {kib} space in which it is created. -* `agnostic`: Available in all {kib} spaces. - -|No, defaults to `single`. -|`tags` |String[] |String array containing words and phrases to help categorize -exception items. |No -|`type` |String a|Exception query type, must be `simple`. |Yes - -|============================================== - - -===== Example request - -Updates the `entries` object: - -[source,console] --------------------------------------------------- -PUT api/exception_lists/items -{ - "description": "Process allowlist", - "entries": [ - { - "field": "process.name", - "operator": "included", - "type": "match", - "value": "maintenance" - }, - { - "field": "host.name", - "operator": "included", - "type": "match_any", - "value": [ - "liv-win-anf", - "livw-win-mel", - "linux-anfield", - "new-host" - ] - } - ], - "item_id": "allow-process-on-machines", - "name": "Host-process exclusions", - "namespace_type": "single", - "tags": [ - "hosts", - "processes" - ], - "type": "simple" -} --------------------------------------------------- -// KIBANA - -==== Response code - -`200`:: - Indicates a successful call. - -==== Response payload - -The updated object, including the time it was updated. - -Example response: - -[source,json] --------------------------------------------------- -{ - "_tags": [], - "comments": [], - "created_at": "2020-07-15T06:28:32.457Z", - "created_by": "elastic", - "description": "Process allowlist", - "entries": [ - { - "field": "process.name", - "operator": "included", - "type": "match", - "value": "maintenance" - }, - { - "field": "host.name", - "operator": "included", - "type": "match_any", - "value": [ - "liv-win-anf", - "livw-win-mel", - "linux-anfield", - "new-host" - ] - } - ], - "id": "67a70610-c664-11ea-bab5-9d6ae015701b", - "item_id": "allow-process-on-machines", - "list_id": "allowed-processes", - "name": "Host-process exclusions", - "namespace_type": "single", - "tags": [ - "hosts", - "processes" - ], - "tie_breaker_id": "15d7f2eb-7192-4f4b-a803-ad8a4f5efd08", - "type": "simple", - "updated_at": "2020-07-15T06:28:50.494Z", - "updated_by": "elastic" -} --------------------------------------------------- diff --git a/docs/detections/api/exceptions/exceptions-api-overview.asciidoc b/docs/detections/api/exceptions/exceptions-api-overview.asciidoc deleted file mode 100644 index 29bb71deb6..0000000000 --- a/docs/detections/api/exceptions/exceptions-api-overview.asciidoc +++ /dev/null @@ -1,55 +0,0 @@ -[[exceptions-api-overview]] -== Exceptions API - -Exceptions are associated with detection and endpoint rules, and are used to -prevent a rule from generating an alert from incoming events even when the -rule's other criteria are met. They can be used to reduce the number of false -positives, and to prevent trusted processes and network activity from -generating unnecessary alerts. - -Exceptions are made up of: - -* *Exception containers*: A container for related exceptions. In general, a -single exception container contains all the exception items relevant for -a subset of rules. For example, a container can be used to group together -network-related exceptions that are relevant for a large number of network -rules. The container can then be associated with all the relevant rules. -* *Exception items*: The query (fields, values, and logic) used to prevent -rules from generating alerts. When an exception item's query evaluates to -`true`, the rule does not generate an alert. - -For detection rules, you can also use <> to define -rule exceptions. A list holds multiple values of the same {es} data type, such -as IP addresses, which are used to determine when an exception prevents an -alert from being generated. - -IMPORTANT: You cannot use lists with endpoint rule exceptions. - -NOTE: Only exception containers can be associated with rules. You cannot -directly associate an exception item or a -<> with a rule. To use list -exceptions, create an exception item that references the relevant list -container (see this <>). - -The following diagram represents the logical relationship between rules, -detections, and lists, and shows the boolean operator used between sibling -entities: - -image::images/exceptions-logic.png[] - -IMPORTANT: Before you can create exceptions, you must create `.lists` and -`.items` indices for the {kib} space (see <>). - -[float] -=== Kibana role requirements - -To create list containers and items, the user role for the {kib} space must -have: - -* `read` and `write` index privileges for the -`.lists` and `.items` indices (the system index used for storing exception lists). -* {kib} space `All` privileges for the `Security` and `Saved Objects Management` -features (see -{kibana-ref}/xpack-spaces.html#spaces-control-user-access[Feature access based on user privileges]). - -See <> for a complete list of requirements. diff --git a/docs/detections/api/exceptions/images/exceptions-logic.png b/docs/detections/api/exceptions/images/exceptions-logic.png deleted file mode 100644 index cd6732be62..0000000000 Binary files a/docs/detections/api/exceptions/images/exceptions-logic.png and /dev/null differ diff --git a/docs/detections/api/exceptions/lists-index-api-overview.asciidoc b/docs/detections/api/exceptions/lists-index-api-overview.asciidoc deleted file mode 100644 index a5840132a8..0000000000 --- a/docs/detections/api/exceptions/lists-index-api-overview.asciidoc +++ /dev/null @@ -1,116 +0,0 @@ -[[lists-index-api-overview]] -=== Lists index endpoint - -Before using exceptions and lists, use the `index` endpoint to create `.lists` -and `.items` system indices in the relevant -{kibana-ref}/xpack-spaces.html[{kib} space]. - -For information about the permissions and privileges required to create -`.lists` and `.items` indices, see <>. - -[discrete] -=== Create index - -Creates `.lists` and `.items` indices. The indices naming convention is -`.lists-` and `.items-`. - -[discrete] -==== Request URL - -`POST :/api/lists/index` - -[discrete] -===== Example request - -Creates `.lists` and `.items` indices. - -[source,console] --------------------------------------------------- -POST api/lists/index --------------------------------------------------- -// KIBANA - -[discrete] -==== Response code - -`200`:: - Indicates a successful call. - -[discrete] -=== Get index - -Verifies `.lists` and `.items` indices exist. - -[discrete] -==== Request URL - -`GET :/api/lists/index` - -[discrete] -===== Example request - -Verifies the `lists` index for the {kib} `security` exists: - -[source,console] --------------------------------------------------- -GET api/lists/index --------------------------------------------------- -// KIBANA - -[discrete] -==== Response code - -`200`:: - Indicates a successful call. -`404`:: - Indicates no index exists. - -[discrete] -===== Example responses - -Example response when the indices exist: - -[source,json] --------------------------------------------------- -{ - "list_index": true, - "list_item_index": true -} --------------------------------------------------- - -Example response when the indices do not exist: - -[source,json] --------------------------------------------------- -{ - "message": "index .lists-default and index .items-default does not exist", - "status_code": 404 -} --------------------------------------------------- - -[discrete] -=== Delete index - -Deletes the `.lists` and `.items` indices. - -[discrete] -==== Request URL - -`DELETE :/api/lists/index` - -[discrete] -===== Example request - -Deletes the `.lists` and `.items` indices: - -[source, js] --------------------------------------------------- -DELETE api/lists/index --------------------------------------------------- -// KIBANA - -[discrete] -==== Response code - -`200`:: - Indicates a successful call. diff --git a/docs/detections/api/lists-api-index.asciidoc b/docs/detections/api/lists-api-index.asciidoc deleted file mode 100644 index 69c01778bd..0000000000 --- a/docs/detections/api/lists-api-index.asciidoc +++ /dev/null @@ -1,25 +0,0 @@ -include::lists/lists-api-overview.asciidoc[] - -include::lists/api-create-list-container.asciidoc[] - -include::lists/api-create-list-item.asciidoc[] - -include::lists/api-import-list-items.asciidoc[] - -include::lists/api-find-list-containers.asciidoc[] - -include::lists/api-find-list-items.asciidoc[] - -include::lists/api-get-list-containers.asciidoc[] - -include::lists/api-get-list-items.asciidoc[] - -include::lists/api-update-list-container.asciidoc[] - -include::lists/api-update-list-item.asciidoc[] - -include::lists/api-export-list-item.asciidoc[] - -include::lists/api-delete-list-container.asciidoc[] - -include::lists/api-delete-list-item.asciidoc[] diff --git a/docs/detections/api/lists/api-create-list-container.asciidoc b/docs/detections/api/lists/api-create-list-container.asciidoc deleted file mode 100644 index 98e1007bf3..0000000000 --- a/docs/detections/api/lists/api-create-list-container.asciidoc +++ /dev/null @@ -1,160 +0,0 @@ -[[lists-api-create-container]] -=== Create list container - -Creates a list container. - -A list container groups common <> that -define exceptions for when detection rule alerts are *not* generated even when -a rule's other criteria are met. - -All list items in the same list container refer to the same type of exception. -For example, each list item in an `ip` list container excludes an IP address. - -TIP: You can retrieve `ip` items in a list container using CIDR notation, and -`ip_range` items using a single IP value. For examples, see -<>. - -==== Request URL - -`POST :/api/lists` - -==== Request body - -A JSON object that defines the list container's properties. - -===== Required fields - -[width="100%",options="header"] -|============================================== -|Name |Type |Description - -|`description` |String |Describes the list container. -|`name` |String |The list container's name. -|`type` |String a|Specifies the {es} {ref}/mapping-types.html[data type] of -excludes the list container holds. Some common examples: - -* `keyword`: Many ECS fields are {es} {ref}/keyword.html[keywords] -* `ip`: IP addresses -* `ip_range`: {ref}/range.html[Range of IP addresses] (supports IPv4, IPv6, and -CIDR notation) -|============================================== - -===== Optional fields - -[width="100%",options="header"] -|============================================== -|Name |Type |Description - -|`deserializer` |String a|Determines how retrieved list item values are presented. -By default list items are presented using these -https://handlebarsjs.com/guide/expressions.html[Handelbar] expressions: - -* `{{{value}}}` - Single value item types, such as `ip`, `long`, `date`, `keyword`, -and `text`. -* `{{{gte}}}-{{{lte}}}` - Range value item types, such as `ip_range`, -`double_range`, `float_range`, `integer_range`, and `long_range`. -* `{{{gte}}},{{{lte}}}` - Date range values. - -For information on parsing item values when they are uploaded, see -<>. - -|`id` |String |Unique identifier. Automatically created when it is not -provided. -|`meta` |Object |Placeholder for metadata about the list container. - -|[[serializer]] `serializer` |String a|Determines how uploaded list item values -are parsed. By default, list items are parsed using these -https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_Expressions/Groups_and_Ranges[named regex groups]: - -* `(?.+)` - Single value item types, such as `ip`, `long`, `date`, `keyword`, -and `text`. -* `(?.+)-(?.+)\|(?.+)` - Range value item types, such as -`date_range`, `ip_range`, `double_range`, `float_range`, `integer_range`, and -`long_range`. - -|`version` |Integer |The list container's version number. Defaults to `1`. - -|============================================== - -===== Example requests - -Creates a list container for IP addresses: - -[source,console] --------------------------------------------------- -POST api/lists -{ - "id": "internal-ip-excludes", - "name": "Exclude internal IP addresses", - "description": "Contains list items that exclude internal IP addresses from detection rules.", - "type": "ip" -} --------------------------------------------------- -// KIBANA - -Creates a list container for a keyword: - -[source,console] --------------------------------------------------- -POST api/lists -{ - "id": "host.name-container", - "name": "Exclude hosts", - "description": "Contains list items that exclude host names from detection rules.", - "type": "keyword" -} --------------------------------------------------- -// KIBANA - -Creates a list container for `ip_range` items with custom parsing: - -[source,console] --------------------------------------------------- -POST api/lists -{ - "id": "internal-ip-range-excludes", - "name": "Exclude IP ranges", - "description": "Contains excluded IP ranges.", - "serializer": "(?.+)/(?.+)", <1> - "deserializer": "{{{gte}}}--{{{lte}}}", <2> - "type": "ip_range" -} --------------------------------------------------- -// KIBANA - -<1> Uploads IP ranges using `/` characters instead of `-` characters. The list -item or source file from which the IP ranges are uploaded must use the `/` -character to define the range. For example, `192.168.0.1/192.168.0.27`. -<2> Presents the container's retrieved IP range list items using `--` -characters. For example, `192.168.0.1--192.168.0.27`. - -==== Response code - -`200`:: - Indicates a successful call. - - -==== Response payload - -[source,json] --------------------------------------------------- -{ - "_version": "WzAsMV0=", <1> - "id": "internal-ip-excludes", - "created_at": "2020-08-11T10:08:05.289Z", - "created_by": "elastic", - "description": "Contains list items that exclude internal IP addresses from detection rule matches.", - "immutable": false, - "name": "Exclude internal IP addresses", - "tie_breaker_id": "f7951678-ad13-4d65-8d15-a4c706d4893e", - "type": "ip", - "updated_at": "2020-08-11T10:08:05.289Z", - "updated_by": "elastic", - "version": 1 -} --------------------------------------------------- - -<1> Base-64 encoded value of `if_seq_no` and `if_primary_term` parameters, used -for {ref}/optimistic-concurrency-control.html[Optimistic concurrency control]. -To ensure there are no conflicts, use this value when -<>. diff --git a/docs/detections/api/lists/api-create-list-item.asciidoc b/docs/detections/api/lists/api-create-list-item.asciidoc deleted file mode 100644 index 83e1a1971e..0000000000 --- a/docs/detections/api/lists/api-create-list-item.asciidoc +++ /dev/null @@ -1,90 +0,0 @@ -[[lists-api-create-list-item]] -=== Create list item - -Creates a list item and associates it with the specified -<>. - -All list items in the same list container must be the same type. For example, -each list item in an `ip` list container must define a specific IP address. - -NOTE: Before creating list items, you must create a list container. - -==== Request URL - -`POST :/api/lists/items` - -==== Request body - -A JSON object with these fields: - -[width="100%",options="header"] -|============================================== -|Name |Type |Description |Required - -|`id` |String |Unique identifier of the list item. |No, automatically created -when it is not provided. -|`list_id` |String |ID of the associated <>. |Yes -|`meta` |Object |Placeholder for metadata about the list item. |No -|`value` |String |The value used to evaluate exceptions. For information on how -list item exceptions are evaluated, see -<>. |Yes - -|============================================== - -===== Example requests - -Adds an IP address to the `internal-ip-excludes` list container: - -[source,console] --------------------------------------------------- -POST api/lists/items -{ - "id": "internal-ip-1", - "list_id": "internal-ip-excludes", - "value": "10.0.0.12" -} --------------------------------------------------- -// KIBANA - -Adds a host name to the `host.name-container` list container: - -[source,console] --------------------------------------------------- -POST api/lists -{ - "id": "win-prem-19", - "list_id": "host.name-container", - "value": "hostname-123" -} --------------------------------------------------- -// KIBANA - - - -==== Response code - -`200`:: - Indicates a successful call. - -==== Response payload - -[source,json] --------------------------------------------------- -{ - "_version": "WzEsMV0=", <1> - "id": "internal-ip-1", - "type": "ip", - "value": "10.0.0.12", - "created_at": "2020-08-11T10:54:46.080Z", - "created_by": "elastic", - "list_id": "internal-ip-excludes", - "tie_breaker_id": "ed3f9d84-cd85-4122-b93d-07d1de4fd8bb", - "updated_at": "2020-08-11T10:54:46.080Z", - "updated_by": "elastic" -} --------------------------------------------------- - -<1> Base-64 encoded value of `if_seq_no` and `if_primary_term` parameters, used -for {ref}/optimistic-concurrency-control.html[Optimistic concurrency control]. -To ensure there are no conflicts, use this value when -<>. diff --git a/docs/detections/api/lists/api-delete-list-container.asciidoc b/docs/detections/api/lists/api-delete-list-container.asciidoc deleted file mode 100644 index 2ecee2ea78..0000000000 --- a/docs/detections/api/lists/api-delete-list-container.asciidoc +++ /dev/null @@ -1,31 +0,0 @@ -[[lists-api-delete-container]] -=== Delete list container - -Deletes a list container. - -NOTE: When you delete a list container, all of its list items are also deleted. - -==== Request URL - -`DELETE :/api/lists` - -===== URL query parameters - -The URL query must include the list container's `id`: - -`id` - `DELETE /api/lists?id=` - -===== Example request - -Deletes the list container with an `id` of `external-ip-excludes`: - -[source,console] --------------------------------------------------- -DELETE api/lists?id=external-ip-excludes --------------------------------------------------- -// KIBANA - -==== Response code - -`200`:: - Indicates a successful call. diff --git a/docs/detections/api/lists/api-delete-list-item.asciidoc b/docs/detections/api/lists/api-delete-list-item.asciidoc deleted file mode 100644 index f3d3bb2816..0000000000 --- a/docs/detections/api/lists/api-delete-list-item.asciidoc +++ /dev/null @@ -1,38 +0,0 @@ -[[lists-api-delete-item]] -=== Delete list item - -Deletes list items. - -==== Request URL - -`DELETE :/api/lists/items` - -===== URL query parameters - -The URL query must include one of the following: - -* `id` - `DELETE /api/lists/items?id=` -* `list_id` and `value` - `DELETE /api/lists/items?list_id=&value=` - -===== Example request - -Deletes the list item with an `id` of `internal-ip-london`: - -[source,console] --------------------------------------------------- -DELETE api/lists/items?id=internal-ip-london --------------------------------------------------- -// KIBANA - -Deletes list items from an `ip` container using CIDR notation: - -[source,console] --------------------------------------------------- -DELETE api/lists/items?list_id=internal-ip-excludes&value=127.0.0.0/30 --------------------------------------------------- -// KIBANA - -==== Response code - -`200`:: - Indicates a successful call. diff --git a/docs/detections/api/lists/api-export-list-item.asciidoc b/docs/detections/api/lists/api-export-list-item.asciidoc deleted file mode 100644 index 3740c2a0f9..0000000000 --- a/docs/detections/api/lists/api-export-list-item.asciidoc +++ /dev/null @@ -1,34 +0,0 @@ -[[lists-api-export-items]] -=== Export list items - -Exports list item values from the specified list container. - -==== Request URL - -`POST :/api/lists/items/_export` - - -===== URL query parameters - -The URL query must include the list container's `id`: - -`id` - `POST /api/lists/items/_export?list_id=` - -TIP: If you want to to use cURL to export rules to a file, use the `-o` option -to specify a file name. - -===== Example request - -Exports the values of the `external-ip-excludes` list container: - -[source,console] --------------------------------------------------- -POST api/lists/items/_export?list_id=external-ip-excludes --------------------------------------------------- -// KIBANA - - -==== Response code - -`200`:: - Indicates a successful call. diff --git a/docs/detections/api/lists/api-find-list-containers.asciidoc b/docs/detections/api/lists/api-find-list-containers.asciidoc deleted file mode 100644 index 06f8eb703b..0000000000 --- a/docs/detections/api/lists/api-find-list-containers.asciidoc +++ /dev/null @@ -1,86 +0,0 @@ -[[lists-api-find-list-containers]] -=== Find list containers - -Retrieves a paginated subset of list containers. By default, the first page is -returned with 20 results per page. - -==== Request URL - -`GET :/api/lists/_find` - -===== URL query parameters - -All parameters are optional: - -[width="100%",options="header"] -|============================================== -|Name |Type |Description - -|`page` |Integer |The page number to return. - -|`per_page` |Integer |The number of list containers to return per page. - -|`sort_field` |String |Determines which field is used to sort the results. - -|`sort_order` |String |Determines the sort order, which can be `desc` or `asc`. - -|`cursor` |String |Returns the containers that come after the last container -returned in the previous call (use the `cursor` value returned in the previous -call). This parameter uses the `tie_breaker_id` field to ensure all containers -are sorted and returned correctly. -See {ref}/search-request-body.html#request-body-search-search-after[Search After] for more information. - -|`filter` |String a|Filters the returned results according to the value of the -specified field, using the `:` syntax, where -`` can be: - -* `name` -* `type` -* `created_by` -* `updated_by` - -|============================================== - -===== Example request - -Retrieves the first two `keyword` list containers, sorted by `name` in -descending order: - -[source,console] --------------------------------------------------- -GET api/lists/_find?filter=type:keyword&page=1&per_page=2&sort_field=name&sort_order=desc --------------------------------------------------- -// KIBANA - -==== Response code - -`200`:: - Indicates a successful call. - -==== Response payload - -[source,json] --------------------------------------------------- -{ - "cursor": "WzIwLFsiMTk1ZjU0ZmItMjQ0ZC00ZjlhLTlhNWItZTcyODkwMTM0N2UwIl1d", - "data": [ - { - "_version": "WzcsMV0=", - "id": "internal-ip-excludes", - "created_at": "2020-08-11T10:38:51.087Z", - "created_by": "elastic", - "description": "Contains list items that exclude internal IP addresses from detection rule matches.", - "immutable": false, - "name": "Trusted internal IP addresses", - "tie_breaker_id": "195f54fb-244d-4f9a-9a5b-e728901347e0", - "type": "ip", - "updated_at": "2020-08-11T10:42:30.205Z", - "updated_by": "elastic", - "version": 1 - } - ], - "page": 1, - "per_page": 20, - "total": 1 -} --------------------------------------------------- diff --git a/docs/detections/api/lists/api-find-list-items.asciidoc b/docs/detections/api/lists/api-find-list-items.asciidoc deleted file mode 100644 index 4076436093..0000000000 --- a/docs/detections/api/lists/api-find-list-items.asciidoc +++ /dev/null @@ -1,99 +0,0 @@ -[[lists-api-find-list-items]] -=== Find list items - -Retrieves a paginated subset of list items in the specified container. By -default, the first page is returned with 20 results per page. - -==== Request URL - -`GET :/api/lists/items/_find` - -===== URL query parameters - -[width="100%",options="header"] -|============================================== -|Name |Type |Description |Required - -|`list_id` |String |ID of the <>. |Yes - -|`page` |Integer |The page number to return. |No - -|`per_page` |Integer |The number of items to return per page. |No - -|`sort_field` |String |Determines which field is used to sort the results. |No - -|`sort_order` |String |Determines the sort order, which can be `desc` or `asc`. -|No -|`cursor` |String |Returns the items that come after the last item -returned in the previous call (use the `cursor` value returned in the previous -call). This parameter uses the `tie_breaker_id` field to ensure all items -are sorted and returned correctly. -See {ref}/search-request-body.html#request-body-search-search-after[Search After] for more information. |No - -|============================================== - -===== Example request - -Retrieves list items in the `external-ip-excludes` list container: - -[source,console] --------------------------------------------------- -GET api/lists/items/_find?list_id=external-ip-excludes --------------------------------------------------- -// KIBANA - -==== Response code - -`200`:: - Indicates a successful call. - -==== Response payload - -[source,json] --------------------------------------------------- -{ - "cursor": "WzIwLFsiZmFjZmZmOTQtNzIzZS00YmQ0LTk4ZTUtNzI2OGJjNTA3NWNmIl1d", - "data": [ - { - "_version": "WzgsMV0=", - "created_at": "2020-08-11T11:22:13.670Z", - "created_by": "elastic", - "id": "bpdB3XMBx7pemMHopQ6M", - "list_id": "internal-ip-excludes-meta", - "tie_breaker_id": "17d3befb-dc22-4b3c-a286-b5504c4fbeeb", - "type": "ip", - "updated_at": "2020-08-11T11:22:13.670Z", - "updated_by": "elastic", - "value": "127.0.0.6" - }, - { - "_version": "WzMsMV0=", - "created_at": "2020-08-11T11:22:13.669Z", - "created_by": "elastic", - "id": "aZdB3XMBx7pemMHopQ6L", - "list_id": "internal-ip-excludes-meta", - "tie_breaker_id": "26115356-c2c2-4f1c-a4ed-19b81191775a", - "type": "ip", - "updated_at": "2020-08-11T11:22:13.669Z", - "updated_by": "elastic", - "value": "127.0.0.1" - }, - ... - { - "_version": "WzksMV0=", - "created_at": "2020-08-11T11:22:13.670Z", - "created_by": "elastic", - "id": "b5dB3XMBx7pemMHopQ6M", - "list_id": "internal-ip-excludes-meta", - "tie_breaker_id": "facfff94-723e-4bd4-98e5-7268bc5075cf", - "type": "ip", - "updated_at": "2020-08-11T11:22:13.670Z", - "updated_by": "elastic", - "value": "127.0.0.7" - } - ], - "page": 1, - "per_page": 20, - "total": 11 -} --------------------------------------------------- diff --git a/docs/detections/api/lists/api-get-list-containers.asciidoc b/docs/detections/api/lists/api-get-list-containers.asciidoc deleted file mode 100644 index 6b44a26571..0000000000 --- a/docs/detections/api/lists/api-get-list-containers.asciidoc +++ /dev/null @@ -1,46 +0,0 @@ -[[lists-api-get-container]] -=== Get list container - -Retrieves a list container using its `id` field. - -==== Request URL - -`GET :/api/lists` - -===== URL query parameters - -The URL query must include the list container's `id`: - -`id` - `GET /api/lists?id=` - -===== Example request - -Retrieves the list container with a `id` of `internal-ip-excludes`: - -[source,console] --------------------------------------------------- -GET api/lists?id=internal-ip-excludes --------------------------------------------------- -// KIBANA - -==== Response code - -`200`:: - Indicates a successful call. - -==== Response payload - -[source,json] --------------------------------------------------- -{ - "id": "internal-ip-excludes", - "created_at": "2020-07-07T04:09:55.028Z", - "created_by": "Threat Hunter", - "description": "Contains list items that exclude internal IP addresses from detection rules.", - "name": "Exclude internal IP addresses", - "tie_breaker_id": "b123ab0e-d7c0-4ee5-9630-63a38641aa0c", - "type": "ip", - "updated_at": "2020-07-07T04:09:55.028Z", - "updated_by": "Threat Hunter" -} --------------------------------------------------- diff --git a/docs/detections/api/lists/api-get-list-items.asciidoc b/docs/detections/api/lists/api-get-list-items.asciidoc deleted file mode 100644 index 8d796b23e9..0000000000 --- a/docs/detections/api/lists/api-get-list-items.asciidoc +++ /dev/null @@ -1,100 +0,0 @@ -[[lists-api-get-item]] -=== Get list item - -Retrieves list items using its `id`, or its `list_id` and `value` fields. - -IMPORTANT: For `ip` and `ip_range` list containers, you can retrieve up to -10,000 list items. - -==== Request URL - -`GET :/api/lists/items` - -===== URL query parameters - -The URL query must include one of the following: - -* `id` - `GET /api/lists/items?id=` -* `list_id` and `value` - `GET /api/lists/items?list_id=&value=` - -===== Example requests - -Retrieves the list item with an `id` of `internal-ip-address`: - -[source,console] --------------------------------------------------- -GET api/lists/items?id=internal-ip-excludes --------------------------------------------------- -// KIBANA - -Retrieves the list item in the `internal-ip-excludes` container, with a `value` -of `10.0.0.1`: - -[source,console] --------------------------------------------------- -GET api/lists/items?list_id=internal-ip-excludes&value=10.0.0.1 --------------------------------------------------- -// KIBANA - -Retrieves list items from an `ip` container using CIDR notation: - -[source,console] --------------------------------------------------- -GET api/lists/items?list_id=internal-ip-excludes&value=127.0.0.0/30 --------------------------------------------------- -// KIBANA - -Retrieves list items from an `ip_range` container that include the specified IP -address: - -[source,console] --------------------------------------------------- -GET api/lists/items?list_id=internal-ip-ranges&value=192.168.1.14 --------------------------------------------------- -// KIBANA - -==== Response code - -`200`:: - Indicates a successful call. - -==== Response payload - -[source,json] --------------------------------------------------- -[ - { - "created_at": "2020-08-11T11:22:13.669Z", - "created_by": "elastic", - "id": "aZdB3XMBx7pemMHopQ6L", - "list_id": "internal-ip-excludes", - "tie_breaker_id": "26115356-c2c2-4f1c-a4ed-19b81191775a", - "type": "ip", - "updated_at": "2020-08-11T11:22:13.669Z", - "updated_by": "elastic", - "value": "127.0.0.1" - }, - { - "created_at": "2020-08-11T11:22:13.669Z", - "created_by": "elastic", - "id": "apdB3XMBx7pemMHopQ6L", - "list_id": "internal-ip-excludes", - "tie_breaker_id": "fa247f45-bf8b-48bc-b89d-5191cba096e6", - "type": "ip", - "updated_at": "2020-08-11T11:22:13.669Z", - "updated_by": "elastic", - "value": "127.0.0.2" - }, - { - "created_at": "2020-08-11T11:22:13.670Z", - "created_by": "elastic", - "id": "a5dB3XMBx7pemMHopQ6L", - "list_id": "internal-ip-excludes", - "tie_breaker_id": "60edc3e4-9a79-4bff-b7dc-096b052797f8", - "type": "ip", - "updated_at": "2020-08-11T11:22:13.670Z", - "updated_by": "elastic", - "value": "127.0.0.3" - } -] --------------------------------------------------- diff --git a/docs/detections/api/lists/api-import-list-items.asciidoc b/docs/detections/api/lists/api-import-list-items.asciidoc deleted file mode 100644 index 9ba6924b63..0000000000 --- a/docs/detections/api/lists/api-import-list-items.asciidoc +++ /dev/null @@ -1,85 +0,0 @@ -[[lists-api-import-list-items]] -=== Import list items - -Imports a list of items from a `.txt` or `.csv` file. - -You can import items to a new or existing -<>. - -==== Request URL - -`POST :/api/lists/items/_import` - -The request must include: - -* The `Content-Type: multipart/form-data` HTTP header. -* A link to the file containing the list items. - -For example, using cURL: - -[source,console] --------------------------------------------------- -curl -X POST ":/api/lists/items/_import" --u : -H 'kbn-xsrf: true' --H 'Content-Type: multipart/form-data' ---form "file=@" <1> --------------------------------------------------- -<1> The relative link to the file containing the list items. - -===== URL query parameters - -[width="100%",options="header"] -|============================================== -|Name |Type |Description |Required - -|`list_id` |String |ID of the <>. -|Required when importing to an existing container. -|`type` |String |The datatype of excludes the list container holds, which can -be either `ip` or `keyword`. |Required when importing to a new container. -|============================================== - -===== Example requests - -Adds the IP addresses in the `internal-IPs.txt` to the `internal-ip-excludes` -list container: - -[source,console] --------------------------------------------------- -curl -X POST "api/lists/items/_import?list_id=internal-ip-excludes" --H 'kbn-xsrf: true' -H 'Content-Type: multipart/form-data' ---form "file=@internal-IPs.txt" --------------------------------------------------- - -Adds the IP addresses in the `internal-IPs.txt` to a new list container: - -[source,console] --------------------------------------------------- -curl -X POST "api/lists/items/_import?type=ip" --H 'kbn-xsrf: true' -H 'Content-Type: multipart/form-data' ---form "file=@internal-IPs.txt" --------------------------------------------------- - -==== Response code - -`200`:: - Indicates a successful call. - -==== Response payload - -[source,json] --------------------------------------------------- -{ - "_version": "WzcsMV0=", - "id": "internal-ip-excludes", - "created_at": "2020-08-11T10:38:51.087Z", - "created_by": "elastic", - "description": "Contains list items that exclude internal IP addresses from detection rule matches.", - "immutable": false, - "name": "Trusted internal IP addresses", - "tie_breaker_id": "195f54fb-244d-4f9a-9a5b-e728901347e0", - "type": "ip", - "updated_at": "2020-08-11T10:42:30.205Z", - "updated_by": "elastic", - "version": 1 -} --------------------------------------------------- diff --git a/docs/detections/api/lists/api-update-list-container.asciidoc b/docs/detections/api/lists/api-update-list-container.asciidoc deleted file mode 100644 index b7c6a6436b..0000000000 --- a/docs/detections/api/lists/api-update-list-container.asciidoc +++ /dev/null @@ -1,87 +0,0 @@ -[[lists-api-update-container]] -=== Update list container - -Updates an existing list container. - -You can use `PUT` or `PATCH` methods to update list containers, where: - -* `PUT` replaces the original container and deletes fields that are not -specified. -* `PATCH` updates the specified fields. - -==== Request URL - -`PUT :/api/lists` - -`PATCH :/api/lists` - -==== Request body - -A JSON object with: - -* The `id` of the list container you want to update. -* The fields you want to modify. - -IMPORTANT: If you call `PUT` to update a rule, all unspecified fields are -deleted. You cannot modify the `id` and `type` fields. - -For `PATCH` calls, any of the fields can be modified, whereas for `PUT` calls, -some fields are required. - -[width="100%",options="header"] -|============================================== -|Name |Type |Description |Required (`PUT` calls) - -|`description` |String |Describes the list container. |Yes -|`meta` |Object |Placeholder for metadata about the list container. |No -|`name` |String |The list container's name. |Yes -|`_version` |String |Base-64 encoded value of `if_seq_no` and `if_primary_term` -parameters, used to prevent update conflicts (see -{ref}/optimistic-concurrency-control.html[Optimistic concurrency control]). |No - -|============================================== - - -===== Example request - -Updates the `name` field: - -[source,console] --------------------------------------------------- -PATCH api/lists -{ - "id": "internal-ip-excludes", - "name": "Trusted internal IP addresses", - "_version": "WzYsMV0=" -} --------------------------------------------------- -// KIBANA - -==== Response code - -`200`:: - Indicates a successful call. - -==== Response payload - -The updated object, including the time it was updated. - -Example response: - -[source,json] --------------------------------------------------- -{ - "_version": "WzcsMV0=", - "created_at": "2020-08-11T10:38:51.087Z", - "created_by": "elastic", - "description": "Contains list items that exclude internal IP addresses from detection rule matches.", - "id": "internal-ip-excludes-meta", - "immutable": false, - "name": "Trusted internal IP addresses", - "tie_breaker_id": "195f54fb-244d-4f9a-9a5b-e728901347e0", - "type": "ip", - "updated_at": "2020-08-11T10:42:30.205Z", - "updated_by": "elastic", - "version": 2 -} --------------------------------------------------- diff --git a/docs/detections/api/lists/api-update-list-item.asciidoc b/docs/detections/api/lists/api-update-list-item.asciidoc deleted file mode 100644 index d5e8c1fde9..0000000000 --- a/docs/detections/api/lists/api-update-list-item.asciidoc +++ /dev/null @@ -1,86 +0,0 @@ -[[lists-api-update-item]] -=== Update list item - -Updates an existing list item. - -You can use `PUT` or `PATCH` methods to update list items, where: - -* `PUT` replaces the original items and deletes fields that are not -specified. -* `PATCH` updates the specified fields. - -==== Request URL - -`PUT :/api/lists/items` - -`PATCH :/api/lists/items` - -==== Request body - -A JSON object with: - -* The `id` of the list item you want to update. -* The fields you want to modify. - -IMPORTANT: If you call `PUT` to update a rule, all unspecified fields are -deleted. You cannot modify the `list_id` and `id` fields. - -For `PATCH` calls, any of the fields can be modified, whereas for `PUT` calls, -some fields are required. - -[width="100%",options="header"] -|============================================== -|Name |Type |Description |Required (`PUT` calls) - -|`meta` |Object |Placeholder for metadata about the list item. |No -|`value` |String |The value used to evaluate exceptions. For information on how -list item exceptions are evaluated, see -<>. |Yes -|`_version` |String |Base-64 encoded value of `if_seq_no` and `if_primary_term` -parameters, used to prevent update conflicts (see -{ref}/optimistic-concurrency-control.html[Optimistic concurrency control]). |No - -|============================================== - - -===== Example request - -Updates the `value` field: - -[source,console] --------------------------------------------------- -PATCH api/lists/items -{ - "id": "internal-ip-1", - "value": "10.0.0.17", - "_version": "WzEsMV0=" -} --------------------------------------------------- -// KIBANA - -==== Response code - -`200`:: - Indicates a successful call. - -==== Response payload - -The updated object, including the time it was updated. - -Example response: - -[source,json] --------------------------------------------------- -{ - "_version": "WzIsMV0=", - "created_at": "2020-08-11T10:54:46.080Z", - "created_by": "elastic", - "id": "internal-ip-1", - "list_id": "internal-ip-excludes", - "tie_breaker_id": "ed3f9d84-cd85-4122-b93d-07d1de4fd8bb", - "type": "ip", - "updated_at": "2020-08-11T11:00:12.202Z", - "updated_by": "elastic", - "value": "10.0.0.17" -} --------------------------------------------------- diff --git a/docs/detections/api/lists/lists-api-overview.asciidoc b/docs/detections/api/lists/lists-api-overview.asciidoc deleted file mode 100644 index c971d8a637..0000000000 --- a/docs/detections/api/lists/lists-api-overview.asciidoc +++ /dev/null @@ -1,72 +0,0 @@ -[[lists-api-overview]] -== Lists API - -Lists can be used with detection rule <> -to define values that prevent a rule from generating alerts. - -Lists are made up of: - -* *List containers*: A container for values of the same {es} -{ref}/mapping-types.html[data type]. The following data types can be used: - -** `boolean` -** `byte` -** `date` -** `date_nanos` -** `date_range` -** `double` -** `double_range` -** `float` -** `float_range` -** `half_float` -** `integer` -** `integer_range` -** `ip` -** `ip_range` -** `keyword` -** `long` -** `long_range` -** `short` -** `text` - -* *List items*: The values used to determine whether the exception prevents an -alert from being generated. - -All list items in the same list container must be of the same data type, and -each item defines a single value. For example, an IP list container, named -`internal-ip-addresses-southport`, contains five items, where each item defines -one internal IP address: - -. `192.168.1.1` -. `192.168.1.3` -. `192.168.1.18` -. `192.168.1.12` -. `192.168.1.7` - -To use these IP addresses as values for defining rule exceptions, use the -<> to create an -<> that references the -`internal-ip-addresses-southport` list. - -NOTE: Lists cannot be added directly to rules, nor do they define the operators -used to determine when exceptions are applied (`is in list`, `is not in list`). -Use an <> to define the -operator and associate it with an <>. -You can then add the exception container to a rule's `exceptions_list` object. - -IMPORTANT: Before you can create lists, you must create `.lists` and `.items` -indices for the {kib} space (see <>). - -[float] -=== Kibana role requirements - -To create list containers and items, the user role for the {kib} space must -have: - -* `read` and `write` index privileges for the -`.lists` and `.items` indices (the system index used for storing exception lists). -* {kib} space `All` privileges for the `Security` and `Saved Objects Management` -features (see -{kibana-ref}/xpack-spaces.html#spaces-control-user-access[Feature access based on user privileges]). - -See <> for a complete list of requirements. diff --git a/docs/detections/api/rules/index-api-overview.asciidoc b/docs/detections/api/rules/index-api-overview.asciidoc deleted file mode 100644 index 10c9c1bdca..0000000000 --- a/docs/detections/api/rules/index-api-overview.asciidoc +++ /dev/null @@ -1,130 +0,0 @@ -[[index-api-overview]] -=== Index endpoint - -You use the index endpoint to create, get, and delete -`.siem-signals-` system indices in a {kib} space. - -NOTE: Signal indices store detection alerts. - -For information about the permissions and privileges required to create -`.siem-signals-` indices, see <>. - -When you create a signal index, the following -{ref}/getting-started-index-lifecycle-management.html[{ilm} ({ilm-init})] -policy is created for the signal index: -[source,js] --------------------------------------------------- -{ - "policy": { - "phases": { - "hot": { - "min_age": "0ms", - "actions": { - "rollover": { - "max_size": "50gb", - "max_age": "30d" - } - } - } - } - } -} --------------------------------------------------- - -The `policy` and `rollover_alias` use the same name as the signal index. - -NOTE: To reduce clutter on your hot tier, we highly recommend adding a {ref}/ilm-delete.html[delete action] to this {ilm-init} policy. Otherwise, the signal indices will remain on your hot tier indefinitely. - -==== Create index - -Creates a signal index. The naming convention for the index is -`.siem-signals-`. - -===== Request URL - -`POST :/api/detection_engine/index` - -====== Example request - -Creates a signal index in the {kib} `siem` space. - -[source,console] --------------------------------------------------- -POST s/siem/api/detection_engine/index --------------------------------------------------- -// KIBANA - -===== Response code - -`200`:: - Indicates a successful call. - -==== Get index - -Gets the signal index name if it exists. - -===== Request URL - -`GET :/api/detection_engine/index` - -====== Example request - -Gets the signal index for the {kib} `siem` space: - -[source,console] --------------------------------------------------- -GET s/siem/api/detection_engine/index --------------------------------------------------- -// KIBANA - -===== Response code - -`200`:: - Indicates a successful call. -`404`:: - Indicates no index exists. - -====== Example responses - -Example response when index exists: - -[source,json] --------------------------------------------------- -{ - "name": ".siem-signals-siem" -} --------------------------------------------------- - -Example response when no index exists: - -[source,json] --------------------------------------------------- -{ - "statusCode": 404, - "error": "Not Found", - "message": "index for this space does not exist" -} --------------------------------------------------- - -==== Delete index - -Deletes the signal index. - -===== Request URL - -`DELETE :/api/detection_engine/index` - -====== Example request - -Deletes the signal index for the {kib} `siem` space: - -[source, js] --------------------------------------------------- -DELETE s/siem/api/detection_engine/index --------------------------------------------------- -// KIBANA - -===== Response code - -`200`:: - Indicates a successful call. diff --git a/docs/detections/api/rules/privileges-api-overview.asciidoc b/docs/detections/api/rules/privileges-api-overview.asciidoc deleted file mode 100644 index a7e42060d2..0000000000 --- a/docs/detections/api/rules/privileges-api-overview.asciidoc +++ /dev/null @@ -1,105 +0,0 @@ -[[privileges-api-overview]] -[role="xpack"] -=== Privileges endpoint - -Retrieves whether or not the user is authenticated, and the user's {kib} space -and index privileges, which determine if the user can create an index -(`.siem-signals-*`) for the {es-sec} alerts generated by detection engine rules. - -For information about the permissions and privileges required to create -`.siem-signals-` indices, see <>. - -==== Get privileges - -Returns user privileges for the {kib} space. - -===== Request URL - -`GET :/api/detection_engine/privileges` - -====== Example requests - -Gets user privileges for the {kib} default space: - -[source,console] --------------------------------------------------- -GET api/detection_engine/privileges --------------------------------------------------- -// KIBANA - -Gets user privileges for the {kib} `siem` space: - -[source,console] --------------------------------------------------- -GET s/siem/api/detection_engine/privileges --------------------------------------------------- -// KIBANA - -===== Response code - -`200`:: - Indicates a successful call. - -====== Example response - -[source,js] --------------------------------------------------- -{ - "username": "detection-engine-admin", - "has_all_requested": false, - "cluster": { - "monitor_ml": true, - "manage_ccr": false, - "manage_index_templates": true, - "monitor_watcher": true, - "monitor_transform": true, - "read_ilm": true, - "manage_api_key": false, - "manage_security": false, - "manage_own_api_key": false, - "manage_saml": false, - "all": false, - "manage_ilm": true, - "manage_ingest_pipelines": true, - "read_ccr": false, - "manage_rollup": true, - "monitor": true, - "manage_watcher": true, - "manage": true, - "manage_transform": true, - "manage_token": false, - "manage_ml": true, - "manage_pipeline": true, - "monitor_rollup": true, - "transport_client": true, - "create_snapshot": true - }, - "index": { - ".siem-signals-detection-engine": { - "all": false, - "manage_ilm": true, - "read": false, - "create_index": true, - "read_cross_cluster": false, - "index": false, - "monitor": true, - "delete": false, - "manage": true, - "delete_index": true, - "create_doc": false, - "view_index_metadata": true, - "create": false, - "manage_follow_index": true, - "manage_leader_index": true, - "write": false - } - }, - "application": {} - "is_authenticated": true <1> - "has_encryption_key": true <2> -} --------------------------------------------------- -<1> Indicates whether the user can log in to the {es} deployment. -<2> Indicates whether the -<> is -set. diff --git a/docs/detections/api/rules/rules-api-bulk-actions.asciidoc b/docs/detections/api/rules/rules-api-bulk-actions.asciidoc deleted file mode 100644 index e56dd62544..0000000000 --- a/docs/detections/api/rules/rules-api-bulk-actions.asciidoc +++ /dev/null @@ -1,690 +0,0 @@ -:api-call: create-rule -[[bulk-actions-rules-api]] -=== Bulk rule actions - -You can bulk create, update, and delete rules. - -''' - -[discrete] -[[bulk-actions-rules-api-create]] -==== Bulk create - -IMPORTANT: This API has been deprecated since version 8.2, and is scheduled for end of life in Q4 2023. Please use the <> instead. - -WARNING: This API supports {kibana-ref}/api.html#token-api-authentication[Token-based authentication] only. - -Creates new rules. - -[discrete] -===== Request URL - -`POST :/api/detection_engine/rules/_bulk_create` - -[discrete] -===== Request body - -A JSON array of rules, where each rule contains the -<>. - -[discrete] -===== Example request - -[source,console] --------------------------------------------------- -POST api/detection_engine/rules/_bulk_create -[ - { - "rule_id": "process_started_by_ms_office_program_possible_payload", - "risk_score": 50, - "description": "Process started by MS Office program - possible payload", - "interval": "5m", - "name": "MS Office child process", - "severity": "low", - "tags": [ - "child process", - "ms office" - ], - "type": "query", - "from": "now-6m", - "query": "process.parent.name:EXCEL.EXE or process.parent.name:MSPUB.EXE or process.parent.name:OUTLOOK.EXE or process.parent.name:POWERPNT.EXE or process.parent.name:VISIO.EXE or process.parent.name:WINWORD.EXE", - "language": "kuery", - "filters": [ - { - "query": { - "match": { - "event.action": { - "query": "Process Create (rule: ProcessCreate)", - "type": "phrase" - } - } - } - } - ], - "enabled": false - }, - { - "name": "Second bulk rule", - "description": "Query with a rule_id for referencing an external id", - "rule_id": "query-rule-id-2", - "risk_score": 2, - "severity": "low", - "type": "query", - "from": "now-6m", - "query": "user.name: root or user.name: admin" - } -] --------------------------------------------------- -// KIBANA - -[discrete] -===== Response code - -`200`:: - Indicates a successful call. - -[discrete] -===== Response payload - -A JSON array that includes a unique ID for each rule. A unique rule ID is -generated for all rules that did not include a `rule_id` field. - -''' - -[discrete] -[[bulk-actions-rules-api-delete]] -==== Bulk delete - -IMPORTANT: This API has been deprecated since version 8.2, and is scheduled for end of life in Q4 2023. Please use the <> instead. - -Deletes multiple rules. - -[discrete] -===== Request URL - -`DELETE :/api/detection_engine/rules/_bulk_delete` - -[discrete] -===== Request body - -A JSON array of `id` or `rule_id` fields of the rules you want to delete. - -[discrete] -===== Example request - -[source,console] --------------------------------------------------- -DELETE api/detection_engine/rules/_bulk_delete -[ - { - "rule_id": "process_started_by_ms_office_program_possible_payload" - }, - { - "id": "51658332-a15e-4c9e-912a-67214e2e2359" - } -] --------------------------------------------------- -// KIBANA - -[discrete] -===== Response code - -`200`:: - Indicates a successful call. - -[discrete] -===== Response payload - -A JSON array containing the deleted rules. - -''' - -[discrete] -[[bulk-actions-rules-api-update]] -==== Bulk update - -IMPORTANT: This API has been deprecated since version 8.2, and is scheduled for end of life in Q4 2023. Please use the <> instead. - -WARNING: This API supports {kibana-ref}/api.html#token-api-authentication[Token-based authentication] only. - -Updates multiple rules. - -You can use `PUT` or `PATCH` methods to bulk update rules, where: - -* `PUT` replaces the original rule and deletes fields that are not specified. -* `PATCH` updates the specified fields. - -[discrete] -===== Request URL - -`PUT :/api/detection_engine/rules/_bulk_update` - -`PATCH :/api/detection_engine/rules/_bulk_update` - -[discrete] -===== Request body - -A JSON array where each element includes: - -* The `id` or `rule_id` field of the rule you want to update. -* The <> you want to modify. - -IMPORTANT: If you call `PUT` to update rules, all unspecified fields are -deleted. You cannot modify the `id` or `rule_id` values. - -For `PATCH` calls, any of the fields can be modified. For `PUT` calls, -some fields are required (see <> for a list of required -fields). - -[discrete] -===== Example request - -[source,console] --------------------------------------------------- -PATCH api/detection_engine/rules/_bulk_update -[ - { - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0001", - "reference": "https://attack.mitre.org/tactics/TA0001", - "name": "Initial Access" - }, - "technique": [ - { - "id": "T1193", - "name": "Spearphishing Attachment", - "reference": "https://attack.mitre.org/techniques/T1193" - } - ] - } - ], - "rule_id": "process_started_by_ms_office_program_possible_payload" - }, - { - "name": "New name", - "id": "56b22b65-173e-4a5b-b27a-82599cb1433e" - } -] --------------------------------------------------- -// KIBANA - -[discrete] -===== Response code - -`200`:: - Indicates a successful call. - -[discrete] -===== Response payload - -A JSON array containing the updated rules. - -''' - -[discrete] -[[bulk-actions-rules-api-action]] -==== Bulk action - -Applies a bulk action to multiple rules. The bulk action is applied to all rules that match the filter or to the list of rules by their IDs. - -[discrete] -===== Request URL - -`POST :/api/detection_engine/rules/_bulk_action` - -[discrete] -===== URL query parameters - -[width="100%",options="header"] -|============================================== -|Name |Type |Description |Required - -|`dry_run` |Boolean | Enables <> for the request call. -|No -|============================================== - -[discrete] -===== Request body - -A JSON object with the following properties: - -[width="100%",options="header"] -|============================================== -|Name |Type |Description |Required -| `query` | String | A KQL search query to match the rules. | No -| `ids` | String[] | Array of rule IDs to which a bulk action will be applied. Only valid when query property is undefined. | No -| `action` | Enum a| A bulk action -to apply. - -.Possible values: -* `enable` -* `disable` -* `delete` -* `duplicate` -* `export` -* `edit` - -| Yes -| `edit` | <> -| Edit object that describes applying an update action. - -|No. - -Yes, if action is `edit`. -|============================================== - -[[bulk-actions-rules-api-dry-run]] -[discrete] -==== Dry run mode -Enable dry run mode to verify that bulk actions can be applied to specified rules. Certain rules, such as prebuilt Elastic rules, can't be edited and will return errors in the request response. Error details will contain an explanation, the rule name and/or ID, and additional troubleshooting information. - -To enable dry run mode on a request, add the query parameter `dry_run=true` to the end of the request URL. Rules specified in the request will be temporarily updated. These updates won't be written to {es}. - - -IMPORTANT: Dry run mode is not supported for the `export` bulk action. A `400` error will be returned in the request response. - -[[bulk-edit-object-schema]] -[discrete] -==== BulkEditAction object - -* `type` field: enum. Defines what will be updated in rules. -* `value` field: any. value which will be applied in edit action. - -[discrete] -===== Possible `BulkEditAction` object values - -[width="100%",options="header"] -|============================================== -| `type` field | `value` field | Description -| `add_tags` | String[] | Add tags to rules -| `delete_tags` | String[] | Delete rules' tags -| `set_tags` | String[] | Overwrite rules' tags -| `add_index_patterns` | String[] | Add index patterns to rules -| `delete_index_patterns` | String[] | Delete rules' index patterns -| `set_index_patterns` | String[] | Overwrite rules' index patterns -| `set_timeline` | { `timeline_id`: String; `timeline_title`: String } | Overwrite rules' Timeline template -|============================================== - -<> are shown in order of oldest to newest in the `edit` array payload's property. - -[discrete] -===== Example requests - -*Example 1* - -The following request activates all rules with the `test` tag: - -[source,console] --------------------------------------------------- -POST api/detection_engine/rules/_bulk_action -{ - "query": "alert.attributes.tags: \"test\"", - "action": "enable" -} --------------------------------------------------- - -[discrete] -===== Response code - -`200`:: - Indicates a successful call. - -[discrete] -===== Response payload - -For `enable`, `disable`, `delete`, `edit`, and `duplicate` actions, a JSON object containing the action's outcome: number of failed and successful outcomes, number of rules, and number of rule objects created, deleted or updated (depending on the action). - -[source,json] --------------------------------------------------- -{ - "success":true, - "rules_count": 1, - "attributes":{ - "results":{ - "updated":[ - { - "id":"8bc7dad0-9320-11ec-9265-8b772383a08d", - "updated_at":"2022-02-21T17:05:50.883Z", - "updated_by":"elastic", - "created_at":"2022-02-21T14:14:13.801Z", - "created_by":"elastic", - "name":"DNS Tunneling [Duplicate]", - "tags":[ - "Elastic", - "Network", - "Threat Detection", - "ML" - ], - "interval":"15m", - "enabled":true, - "description":"A machine learning job detected unusually large numbers of DNS queries for a single top-level DNS domain, which is often used for DNS tunneling. DNS tunneling can be used for command-and-control, persistence, or data exfiltration activity. For example, dnscat tends to generate many DNS questions for a top-level domain as it uses the DNS protocol to tunnel data.", - "risk_score":21, - "severity":"low", - "license":"Elastic License v2", - "output_index":".siem-signals-default", - "author":[ - "Elastic" - ], - "false_positives":[ - "DNS domains that use large numbers of child domains, such as software or content distribution networks, can trigger this alert and such parent domains can be excluded." - ], - "from":"now-45m", - "rule_id":"7289bf08-4e91-4c70-bf01-e04c4c5d7756", - "max_signals":100, - "risk_score_mapping":[ - - ], - "severity_mapping":[ - - ], - "threat":[ - - ], - "to":"now", - "references":[ - "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html" - ], - "version":6, - "exceptions_list":[ - - ], - "immutable":false, - "related_integrations": [], <1> - "required_fields": [], <1> - "setup": "", <1> - "type":"machine_learning", - "anomaly_threshold":50, - "machine_learning_job_id":[ - "packetbeat_dns_tunneling" - ], - "throttle":"no_actions", - "actions":[ - - ], - "execution_summary": { <1> - "last_execution": { - "date": "2022-03-23T16:06:12.787Z", - "status": "partial failure", - "status_order": 20, - "message": "This rule attempted to query data from Elasticsearch indices listed in the \"Index pattern\" section of the rule definition, but no matching index was found.", - "metrics": { - "total_search_duration_ms": 135, - "total_indexing_duration_ms": 15, - "execution_gap_duration_s": 0, - } - } - } - } - ], - "created":[ - - ], - "deleted":[ - - ] - }, - "summary":{ - "failed":0, - "succeeded":1, - "total":1 - } - } -} --------------------------------------------------- - -<1> dev:[] These fields are under development and their usage or schema may change: `related_integrations`, `required_fields`, `setup`, and `execution_summary`. - - -For an `export` action, an `.ndjson` file containing exported rules. - - -*Example 2, Partial failure* - -The following request adds tags `tag-1` and `tag-2` to the rules that have the IDs sent in the payload: -[source,console] --------------------------------------------------- -POST api/detection_engine/rules/_bulk_action -{ - "ids":[ - "8bc7dad0-9320-11ec-9265-8b772383a08d", - "8e5c1a40-9320-11ec-9265-8b772383a08d", - ], - "action": "edit", - "edit": [{ action: "add_tags", value:["tag-1", "tag-2"] }] -} --------------------------------------------------- - -[discrete] -===== Response code - -`500`:: - Indicates partial bulk action failure. - -[discrete] -===== Response payload - -If processing of any rule fails, a partial error outputs the ID and/or name of the affected rule and the corresponding error, as well as successfully processed rules (in the same format as a successful 200 request). - -[discrete] -==== Example payload - -[source,json] --------------------------------------------------- -{ - "message": "Bulk edit partially failed", - "status_code": 500, - "attributes": { - "errors": [ - { - "message": "Index patterns can't be added. Machine learning rule doesn't have index patterns property", - "status_code": 500, - "rules": [ - { - "id": "8bc7dad0-9320-11ec-9265-8b772383a08d", - "name": "DNS Tunneling [Duplicate]" - } - ] - } - ], - "results": { - "updated": [ - { - "id": "8e5c1a40-9320-11ec-9265-8b772383a08d", - "updated_at": "2022-02-21T16:56:22.818Z", - "updated_by": "elastic", - "created_at": "2022-02-21T14:14:17.883Z", - "created_by": "elastic", - "name": "External Alerts [Duplicate]", - "tags": [ - "Elastic", - "Network", - "Windows", - "APM", - "macOS", - "Linux" - ], - "interval": "5m", - "enabled": true, - "description": "Generates a detection alert for each external alert written to the configured indices. Enabling this rule allows you to immediately begin investigating external alerts in the app.", - "risk_score": 47, - "severity": "medium", - "license": "Elastic License v2", - "output_index": ".siem-signals-default", - "rule_name_override": "message", - "timestamp_override": "event.ingested", - "author": [ - "Elastic" - ], - "false_positives": [], - "from": "now-6m", - "rule_id": "941faf98-0cdc-4569-b16d-4af962914d61", - "max_signals": 10000, - "risk_score_mapping": [ - { - "field": "event.risk_score", - "value": "", - "operator": "equals" - } - ], - "severity_mapping": [ - { - "severity": "low", - "field": "event.severity", - "value": "21", - "operator": "equals" - }, - { - "severity": "medium", - "field": "event.severity", - "value": "47", - "operator": "equals" - }, - { - "severity": "high", - "field": "event.severity", - "value": "73", - "operator": "equals" - }, - { - "severity": "critical", - "field": "event.severity", - "value": "99", - "operator": "equals" - } - ], - "threat": [], - "to": "now", - "references": [], - "version": 5, - "exceptions_list": [], - "immutable": false, - "related_integrations": [], <1> - "required_fields": [], <1> - "setup": "", <1> - "type": "query", - "language": "kuery", - "index": [ - "apm-*-transaction*", - "traces-apm*", - "auditbeat-*", - "filebeat-*", - "logs-*", - "packetbeat-*", - "winlogbeat-*", - "added-by-id-*" - ], - "query": "event.kind:alert and not event.module:(endgame or endpoint)\n", - "throttle": "no_actions", - "actions": [], - "execution_summary": { <1> - "last_execution": { - "date": "2022-03-23T16:06:12.787Z", - "status": "partial failure", - "status_order": 20, - "message": "This rule attempted to query data from Elasticsearch indices listed in the \"Index pattern\" section of the rule definition, but no matching index was found.", - "metrics": { - "total_search_duration_ms": 135, - "total_indexing_duration_ms": 15, - "execution_gap_duration_s": 0, - } - } - } - } - ], - "created": [], - "deleted": [] - }, - "summary": { - "failed": 1, - "succeeded": 1, - "total": 2 - } - } -} --------------------------------------------------- - -<1> dev:[] These fields are under development and their usage or schema may change: `related_integrations`, `required_fields`, `setup`, and `execution_summary`. - -*Example 3, Dry run* - -The following request will validate that the `add_index_patterns` bulk action can be successfully applied to three rules. Each rule (specified by its rule ID) is different: one is a prebuilt Elastic rule, another is a custom machine learning rule, and another is a custom query rule. Because dry run mode is enabled, changes to these rules will not be permanent or saved to {es}. - - -[source,console] --------------------------------------------------- -POST api/detection_engine/rules/_bulk_action?dry_run=true -{ - "action": "edit", - "edit": [ - { - "value": [ - "test-*" - ], - "type": "add_index_patterns" - } - ], - "ids": ["81aa0480-06af-11ed-94fb-dd1a0597d8d2", "dc015d10-0831-11ed-ac8b-05a222bd8d4a", "de8f5af0-0831-11ed-ac8b-05a222bd8d4a"] -} --------------------------------------------------- - -[discrete] -===== Response code - -`500`:: - Indicates a partial bulk action failure. - -[discrete] -===== Response payload - -The `attributes.errors` section of the response shows that two rules failed to update and one succeeded. The same results would be returned if you ran the request without dry run mode enabled. -Notice that there are no arrays in `attributes.results`. In dry run mode, rule updates are not applied and saved to {es}, so the endpoint wouldn't return results for rules that have been `updated`, `created`, or `deleted`. - -[discrete] -===== Response body - -[source,json] --------------------------------------------------- -{ - "message": "Bulk edit partially failed", - "status_code": 500, - "attributes": { - "errors": [ - { - "message": "Elastic rule can't be edited", - "status_code": 500, - "err_code": "IMMUTABLE", - "rules": [ - { - "id": "81aa0480-06af-11ed-94fb-dd1a0597d8d2", - "name": "Unusual AWS Command for a User" - } - ] - }, - { - "message": "Machine learning rule doesn't have index patterns", - "status_code": 500, - "err_code": "MACHINE_LEARNING_INDEX_PATTERN", - "rules": [ - { - "id": "dc015d10-0831-11ed-ac8b-05a222bd8d4a", - "name": "Suspicious Powershell Script [Duplicate]" - } - ] - } - ], - "results": { - "updated": [], - "created": [], - "deleted": [] - }, - "summary": { - "failed": 2, - "succeeded": 1, - "total": 3 - } - } -} --------------------------------------------------- diff --git a/docs/detections/api/rules/rules-api-create.asciidoc b/docs/detections/api/rules/rules-api-create.asciidoc deleted file mode 100644 index f24a700055..0000000000 --- a/docs/detections/api/rules/rules-api-create.asciidoc +++ /dev/null @@ -1,1130 +0,0 @@ -[[rules-api-create]] -=== Create rule - -WARNING: This API supports {kibana-ref}/api.html#token-api-authentication[Token-based authentication] only. - -Creates a new detection rule. - -You can create the following types of rules: - -* *Custom query*: Searches the defined indices and creates an alert when -a document matches the rule's KQL query. -* *Event correlation*: Searches the defined indices and creates an alert when results match an -{ref}/eql.html[Event Query Language (EQL)] query. -* *Threshold*: Searches the defined indices and creates an alert when the -number of times the specified field's value meets the threshold during a single -execution. When there are multiple values that meet the threshold, an alert is -generated for each value. -+ -For example, if the threshold `field` is `source.ip` and its `value` is `10`, an -alert is generated for every source IP address that appears in at least 10 of -the rule's search results. If you're interested, see -{ref}/search-aggregations-bucket-terms-aggregation.html[Terms Aggregation] for -more information. -* *Indicator match*: Creates an alert when fields match values defined in the -specified {ref}/indices-create-index.html[{es} index]. For example, you can -create an index for IP addresses and use this index to create an alert whenever -an event's `destination.ip` equals a value in the index. The index's field -mappings should be {ecs-ref}[ECS-compliant]. -* *{ml-cap} rules*: Creates an alert when a {ml} job discovers an anomaly above -the defined threshold (see <>). - -IMPORTANT: To create {ml} rules, you must have the -https://www.elastic.co/subscriptions[appropriate license] or use a -{ess-trial}[cloud deployment]. Additionally, for the {ml} rule to function -correctly, the associated {ml} job must be running. - -To retrieve {ml} job IDs, which are required to create {ml} jobs, call the -{ref}/ml-get-job.html[{es} Get jobs API]. {ml-cap} jobs that contain `siem` in -the `groups` field can be used to create rules: - -[source,json] --------------------------------------------------- -... -"job_id": "linux_anomalous_network_activity_ecs", -"job_type": "anomaly_detector", -"job_version": "7.7.0", -"groups": [ - "auditbeat", - "process", - "siem" -], -... --------------------------------------------------- - -Additionally, you can set up notifications for when rules create alerts. The -notifications use the {kib} {kibana-ref}/alerting-getting-started.html[Alerting and Actions framework]. -Each action type requires a connector. Connectors store the information -required to send notifications via external systems. The following connector types are -supported for rule notifications: - -* Slack -* Email -* PagerDuty -* Webhook -* Microsoft Teams -* {ibm-r} -* {jira} -* {sn} ITSM - -NOTE: For more information on PagerDuty fields, see -https://developer.pagerduty.com/docs/events-api-v2/trigger-events/[Send a v2 Event]. - -To retrieve connector IDs, which are required to configure rule notifications, -call the {kib} {kibana-ref}/saved-objects-api-find.html[Find objects API] with -`"type": "action"` in the request payload. - -For detailed information on {kib} actions and alerting, and additional API -calls, see: - -* https://github.com/elastic/kibana/tree/master/x-pack/plugins/alerts -* https://github.com/elastic/kibana/tree/master/x-pack/plugins/actions - -==== Request URL - -`POST :/api/detection_engine/rules` - -==== Request body - -A JSON object that defines the rule's values: - -* <> -* <> -* <> -* <> -* <> -* <> -* <> -* <> -* <> -* <> -* <> -* <> - -[[ref-fields-all]] -===== Required fields for all rule types - -[width="100%",options="header"] -|============================================== -|Name |Type |Description - -|description |String |The rule's description. - -|name |String |The rule's name. - -|risk_score |Integer a|A numerical representation of the alert's severity from -0 to 100, where: - -* `0` - `21` represents low severity -* `22` - `47` represents medium severity -* `48` - `73` represents high severity -* `74` - `100` represents critical severity - -|severity |String a|Severity level of alerts produced by the rule, which must -be one of the following: - -* `low`: Alerts that are of interest but generally not considered to be -security incidents -* `medium`: Alerts that require investigation -* `high`: Alerts that require immediate investigation -* `critical`: Alerts that indicate it is highly likely a security incident has -occurred - -|type |String a|Data type on which the rule is based: - -* `eql`: EQL query (see {ref}/eql.html[Event Query Language]). -* `query`: query with or without additional filters. -* `saved_query`: saved search, identified in the `saved_id` field. -* `machine_learning`: rule based on a {ml} job's anomaly scores. -* `threat_match`: rule that matches event values with values in the specified -{es} index. -* `threshold`: rule based on the number of times a `query` matches the -specified field. - -|============================================== - -[[req-fields-query-threshold]] -===== Required field for query, indicator match and threshold rules - -[width="100%",options="header"] -|============================================== -|Name |Type |Description - -|query |String a|{kibana-ref}/search.html[Query] used by the rule to create -alerts. For indicator match rules, only the query's results are used to determine -whether an alert is generated. - -|============================================== - -[[req-fields-threshold]] -===== Required field for threshold rules - -[width="100%",options="header"] -|============================================== -|Name |Type |Description - -|threshold |Object a|Defines the field and threshold value for when alerts -are generated, where: - -* `cardinality` (Array of length 1): The field on which the cardinality is applied. -* `cardinality.field` (string, required): The field on which to calculate and compare the -cardinality. -* `cardinality.value` (integer, required): The threshold value from which an alert is -generated based on unique number of values of `cardinality.field`. -* `field` (string or string[], required): The field on which the threshold is applied. If -you specify an empty array (`[]`), alerts are generated when the query returns -at least the number of results specified in the `value` field. -* `value` (integer, required): The threshold value from which an alert is -generated. - -|============================================== - -[[req-fields-saved-query]] -===== Required field for saved query rules - -[width="100%",options="header"] -|============================================== -|Name |Type |Description - -|saved_id |String |Kibana saved search used by the rule to create alerts. - -|============================================== - -[[req-fields-eql]] -===== Required field for event correlation rules - -[width="100%",options="header"] -|============================================== -|Name |Type |Description - -|language |String |Must be `eql`. - -|============================================== - -[[req-fields-ml]] -===== Required fields for machine learning rules - -[width="100%",options="header"] -|============================================== -|Name |Type |Description - -|anomaly_threshold |Integer |Anomaly score threshold above which the rule -creates an alert. Valid values are from `0` to `100`. - -|machine_learning_job_id |String[] |{ml-cap} job ID(s) the rule monitors for -anomaly scores. - -|============================================== - -[[req-fields-threat-match]] -===== Required fields for indicator match rules - -[width="100%",options="header"] -|============================================== -|Name |Type |Description - -|threat_index |String[] |{es} indices used to check which field values generate -alerts. - -|threat_query |String |Query used to determine which fields in the {es} index -are used for generating alerts. - -|threat_mapping |Object[] a|Array of `entries` objects that define mappings -between the source event fields and the values in the {es} threat index. Each -`entries` object must contain these fields: - -* `field`: field from the event indices on which the rule runs -* `type`: must be `mapping` -* `value`: field from the {es} threat index - -You can use Boolean `and` and `or` logic to define the conditions for when -matching fields and values generate alerts. Sibling `entries` objects -are evaluated using `or` logic, whereas multiple entries in a single `entries` -object use `and` logic. See <> for an example that -uses both `and` and `or` logic. - -|============================================== - -[[opt-fields-all]] -===== Optional fields for all rule types - -[width="100%",options="header"] -|============================================== -|Name |Type |Description - -|actions |<> |Array defining the automated -actions (notifications) taken when alerts are generated. - -|author |String[] |The rule's author. - -|building_block_type |String |Determines if the rule acts as a building block. -By default, building-block alerts are not displayed in the UI. These rules are -used as a foundation for other rules that do generate alerts. Its value must be -`default`. For more information, refer to <>. - -|enabled |Boolean |Determines whether the rule is enabled. Defaults to `true`. - -|false_positives |String[] |String array used to describe common reasons why -the rule may issue false-positive alerts. Defaults to an empty array. - -[[detection-rules-from]] -|from |String |Time from which data is analyzed each time the rule executes, -using a {ref}/common-options.html#date-math[date math range]. For example, -`now-4200s` means the rule analyzes data from 70 minutes before its start -time. Defaults to `now-6m` (analyzes data from 6 minutes before the start -time). - -|interval |String |Frequency of rule execution, using a -{ref}/common-options.html#date-math[date math range]. For example, `"1h"` -means the rule runs every hour. Defaults to `5m` (5 minutes). - -|license |String |The rule's license. - -|max_signals |Integer |Maximum number of alerts the rule can create during a -single execution. Defaults to `100`. - -|meta |Object a|Placeholder for metadata about the rule. - -*NOTE*: This field is overwritten when you save changes to the rule's settings. - -|note |String |Notes to help investigate alerts produced by the rule. - -|output_index |String |Index to which alerts created by the rule are saved. -If unspecified alerts are saved to `.siem-signals-` index, -where `` is the name of the {kib} space in which the rule exists. - -|references |String[] |Array containing notes about or references to -relevant information about the rule. Defaults to an empty array. - -|rule_id |String |Unique ID used to identify rules. For example, when a rule -is converted from a third-party security solution. Automatically created when -it is not provided. - -|tags |String[] |String array containing words and phrases to help categorize, -filter, and search rules. Defaults to an empty array. - -|threat |<> |Object containing attack -information about the type of threat the rule monitors, see -{ecs-ref}/ecs-threat.html[ECS threat fields]. Defaults to an empty array. - -|throttle |String a|Determines how often actions are taken: - -* `no_actions`: Never -* `rule`: Every time new alerts are detected -* `1h`: Every hour -* `1d`: Every day -* `7d`: Every week - -Required when `actions` are used to send notifications. - -|version |Integer |The rule's version number. Defaults to `1`. - -|============================================== - -[[opt-fields-query-eql]] -===== Optional fields for query, indicator match, and event correlation rules - -[width="100%",options="header"] -|============================================== -|Name |Type |Description - -|exceptions_list |Object[] a|Array of -<>, which define -exceptions that prevent the rule from generating alerts even when its other -criteria are met. The object has these fields: - -* `id` (string, required): ID of the exception container. -* `list_id` (string, required): List ID of the exception container. -* `namespace_type` (string required): Determines whether the exceptions are -valid in only the rule's {kib} space (`single`) or in all {kib} spaces -(`agnostic`). -* `type` (string, required): The exception type, which must be either -a detection rule exception (`detection`) or an endpoint exception (`endpoint`). -|============================================== - -[[opt-fields-threat-match]] -===== Optional fields for indicator match rules - -[width="100%",options="header"] -|============================================== -|Name |Type |Description - -|threat_filters |Object[] -|{ref}/query-filter-context.html[Query and filter context] array used to filter -documents from the {es} index containing the threat values. - -|threat_indicator_path |String -|Much like an ingest processor, users can use this field to define where their threat indicator can be found on their indicator documents. Defaults to `threatintel.indicator`. -|============================================== - -[[opt-fields-query-threshold]] -===== Optional fields for query, indicator match, and threshold rules - -[width="100%",options="header"] -|============================================== -|Name |Type |Description - -|language |String |Determines the query language, which must be -`kuery` or `lucene`. Defaults to `kuery`. -|============================================== - -[[opt-fields-eql-query-threshold]] -===== Optional fields for event correlation, query, and threshold rules - -[width="100%",options="header"] -|============================================== -|Name |Type |Description - -|filters |Object[] |The {ref}/query-filter-context.html[query and filter -context] array used to define the conditions for when alerts are created from -events. Defaults to an empty array. - -|index |String[] |Indices on which the rule functions. Defaults to the -Security Solution indices defined on the {kib} Advanced Settings page -(*Kibana* → *Stack Management* → *Advanced Settings* → -`securitySolution:defaultIndex`). - -|risk_score_mapping |Object[] a|Overrides generated alerts' `risk_score` with -a value from the source event: - -* `field` (string, required): Source event field used to override the default -`risk_score`. This field must be an integer. -* `operator` (string, required): Must be `equals`. -* `value`(string, required): Must be an empty string (`""`). - -|rule_name_override |String |Sets which field in the source event is used to -populate the alert's `signal.rule.name` value (in the UI, this value is -displayed on the *Rules* page in the *Rule* column). When unspecified, the -rule's `name` value is used. The source field must be a string data type. - -|severity_mapping |Object[] a|Overrides generated alerts' `severity` with -values from the source event: - -* `field` (string, required): Source event field used to override the default -`severity`. -* `operator` (string, required): Must be `equals`. -* `severity` (string, required): Mapped severity value, must be `low`, -`medium`, `high`, or `critical`. -* `value`(string, required): Field value used to determine the `severity`. - -|timestamp_override |String |Sets the time field used to query indices. -When unspecified, rules query the `@timestamp` field. The source field -must be an {es} date data type. - -|============================================== - -[[opt-fields-eql-create]] -===== Optional fields for event correlation rules - -[width="100%",options="header"] -|============================================== -|Name |Type |Description - -|event_category_field |String -|Contains the event classification, such as `process`, `file`, or `network`. This field is typically mapped as a field type in the {ref}/keyword.html[keyword family]. Defaults to the `event.category` ECS field. - -|tiebreaker_field |String -|Sets a secondary field for sorting events (in ascending, lexicographic order) if they have the same timestamp. - -|timestamp_field |String -|Contains the event timestamp used for sorting a sequence of events. This is different from `timestamp_override`, which is used for querying events within a range. Defaults to the `@timestamp` ECS field. - -|============================================== - -[[actions-object-schema]] -===== `actions` schema - -All fields are required: - -[width="100%",options="header"] -|============================================== -|Name |Type |Description - -|action_type_id |String a|The connector type used for sending notifications, can -be: - -* `.slack` -* `.email` -* `.pagerduty` -* `.webhook` - -|group |String |Optionally groups actions by use cases. Use `default` for alert -notifications. - -|id |String |The connector ID. - -|params |Object a|Object containing the allowed connector fields, which varies according to the connector type: - -* For Slack: -** `message` (string, required): The notification message. -* For email: -** `to`, `cc`, `bcc` (string): Email addresses to which the notifications are -sent. At least one field must have a value. -** `subject` (string, optional): Email subject line. -** `message` (string, required): Email body text. -* For Webhook: -** `body` (string, required): JSON payload. -* For PagerDuty: -** `severity` (string, required): Severity of on the alert notification, can -be: `Critical`, `Error`, `Warning` or `Info`. -** `eventAction` (string, required): Event https://v2.developer.pagerduty.com/docs/events-api-v2#event-action[action type], which can be `trigger`, -`resolve`, or `acknowledge`. -** `dedupKey` (string, optional): Groups alert notifications with the same -PagerDuty alert. -** `timestamp` (DateTime, optional): https://v2.developer.pagerduty.com/v2/docs/types#datetime[ISO-8601 format timestamp]. -** `component` (string, optional): Source machine component responsible for the -event, for example `security-solution`. -** `group` (string, optional): Enables logical grouping of service components. -** `source` (string, optional): The affected system. Defaults to the {kib} -saved object ID of the action. -** `summary` (string, options): Summary of the event. Defaults to -`No summary provided`. Maximum length is 1024 characters. -** `class` (string, optional): Value indicating the class/type of the event. - -|============================================== - -All text fields (such as `message` fields) can contain placeholders for rule -and alert details: - -* `{{state.signals_count}}`: Number of alerts detected -* `{{context.alerts}}`: Array of detected alerts -* `{{{context.results_link}}}`: URL to the alerts in {kib} -* `{{context.rule.anomaly_threshold}}`: Anomaly threshold score above which -alerts are generated ({ml} rules only) -* `{{context.rule.description}}`: Rule description -* `{{context.rule.false_positives}}`: Rule false positives -* `{{context.rule.filters}}`: Rule filters (query rules only) -* `{{context.rule.id}}`: Unique rule ID returned after creating the rule -* `{{context.rule.index}}`: Indices rule runs on (query rules only) -* `{{context.rule.language}}`: Rule query language (query rules only) -* `{{context.rule.machine_learning_job_id}}`: ID of associated {ml} job ({ml} -rules only) -* `{{context.rule.max_signals}}`: Maximum allowed number of alerts per rule -execution -* `{{context.rule.name}}`: Rule name -* `{{context.rule.output_index}}`: Index to which alerts are written -* `{{context.rule.query}}`: Rule query (query rules only) -* `{{context.rule.references}}`: Rule references -* `{{context.rule.risk_score}}`: Rule risk score -* `{{context.rule.rule_id}}`: Generated or user-defined rule ID that can be -used as an identifier across systems -* `{{context.rule.saved_id}}`: Saved search ID -* `{{context.rule.severity}}`: Rule severity -* `{{context.rule.threat}}`: Rule threat framework -* `{{context.rule.threshold}}`: Rule threshold values (threshold rules only) -* `{{context.rule.timeline_id}}`: Associated timeline ID -* `{{context.rule.timeline_title}}`: Associated timeline name -* `{{context.rule.type}}`: Rule type -* `{{context.rule.version}}`: Rule version - -[[threats-object-create]] -===== `threat` schema - -All fields are required: - -[width="100%",options="header"] -|============================================== -|Name |Type |Description - -|framework |String |Relevant attack framework. - -|tactic |Object a|Object containing information on the attack type: - -* `id` - string, required -* `name` - string, required -* `reference` - string, required - -|technique |Array a|Array containing information on the attack techniques (optional): - -* `id` - string, required -* `name` - string, required -* `reference` - string, required -* `subtechnique` - Array, optional - -|subtechnique |Array a|Array containing more specific information on the attack technique: - -* `id` - string, required -* `name` - string, required -* `reference` - string, required - -|============================================== - -NOTE: Only threats described using the MITRE ATT&CK^TM^ framework are displayed -in the UI (*Manage* -> *Rules* -> *_Rule name_*). - -===== Example requests - -*Example 1* - -Query rule that searches for processes started by MS Office: - -[source,console] --------------------------------------------------- -POST api/detection_engine/rules -{ - "rule_id": "process_started_by_ms_office_program", - "risk_score": 50, - "description": "Process started by MS Office program - possible payload", - "interval": "1h", <1> - "name": "MS Office child process", - "severity": "low", - "tags": [ - "child process", - "ms office" - ], - "type": "query", - "from": "now-70m", <2> - "query": "process.parent.name:EXCEL.EXE or process.parent.name:MSPUB.EXE or process.parent.name:OUTLOOK.EXE or process.parent.name:POWERPNT.EXE or process.parent.name:VISIO.EXE or process.parent.name:WINWORD.EXE", - "language": "kuery", - "filters": [ - { - "query": { - "match": { - "event.action": { - "query": "Process Create (rule: ProcessCreate)", - "type": "phrase" - } - } - } - } - ], - "enabled": false -} --------------------------------------------------- -// KIBANA - -<1> The rule runs every hour. -<2> When the rule runs it analyzes data from 70 minutes before its start time. - -If the rule starts to run at 15:00, it analyzes data from 13:50 until 15:00. -When it runs next, at 16:00, it will analyze data from 14:50 until 16:00. - -*Example 2* - -Threshold rule that detects multiple failed login attempts to a Windows host -from the same external source IP address, and maps the `severity` value to -custom source event fields: - -[source,console] --------------------------------------------------- -POST api/detection_engine/rules -{ - "description": "Detects when there are 20 or more failed login attempts from the same IP address with a 2 minute time frame.", - "enabled": true, - "exceptions_list": [ <1> - { - "id": "int-ips", - "namespace_type": "single", - "type": "detection" - } - ], - "from": "now-180s", - "index": [ - "winlogbeat-*" - ], - "interval": "2m", - "name": "Windows server prml-19", - "query": "host.name:prml-19 and event.category:authentication and event.outcome:failure", - "risk_score": 30, - "rule_id": "liv-win-ser-logins", - "severity": "low", - "severity_mapping": [ <2> - { - "field": "source.geo.city_name", - "operator": "equals", - "severity": "low", - "value": "Manchester" - }, - { - "field": "source.geo.city_name", - "operator": "equals", - "severity": "medium", - "value": "London" - }, - { - "field": "source.geo.city_name", - "operator": "equals", - "severity": "high", - "value": "Birmingham" - }, - { - "field": "source.geo.city_name", - "operator": "equals", - "severity": "critical", - "value": "Wallingford" - } - ], - "tags": [ - "Brute force" - ], - "threshold": { <3> - "field": "source.ip", - "value": 20 - }, - "type": "threshold" -} --------------------------------------------------- -// KIBANA - -<1> Exception list container used to exclude internal IP addresses. -<2> Alert severity levels are mapped according to the defined field values. -<3> Alerts are generated when the same source IP address is discovered in at -least 20 results. - -*Example 3* - -{ml-cap} rule that creates alerts, and sends Slack notifications, when the -`linux_anomalous_network_activity_ecs` {ml} job discovers anomalies with a -threshold of 70 or above: - -[source,console] --------------------------------------------------- -POST api/detection_engine/rules -{ - "anomaly_threshold": 70, - "rule_id": "ml_linux_network_high_threshold", - "risk_score": 70, - "machine_learning_job_id": "linux_anomalous_network_activity_ecs", - "description": "Generates alerts when the job discovers anomalies over 70", - "interval": "5m", - "name": "Anomalous Linux network activity", - "note": "Shut down the internet.", - "severity": "high", - "tags": [ - "machine learning", - "Linux" - ], - "type": "machine_learning", - "from": "now-6m", - "enabled": true, - "throttle": "rule", - "actions": [ - { - "action_type_id": ".slack", - "group": "default", - "id": "5ad22cd5-5e6e-4c6c-a81a-54b626a4cec5", - "params": { - "message": "Urgent: {{context.rule.description}}" - } - } - ] -} --------------------------------------------------- -// KIBANA - -*Example 4* - -Event correlation rule that creates alerts when the Windows `rundll32.exe` process makes -unusual network connections: - -[source,console] --------------------------------------------------- -POST api/detection_engine/rules -{ - "rule_id": "eql-outbound-rundll32-connections", - "risk_score": 21, - "description": "Unusual rundll32.exe network connection", - "name": "rundll32.exe network connection", - "severity": "low", - "tags": [ - "EQL", - "Windows", - "rundll32.exe" - ], - "type": "eql", - "language": "eql", - "query": "sequence by process.entity_id with maxspan=2h [process where event.type in (\"start\", \"process_started\") and (process.name == \"rundll32.exe\" or process.pe.original_file_name == \"rundll32.exe\") and ((process.args == \"rundll32.exe\" and process.args_count == 1) or (process.args != \"rundll32.exe\" and process.args_count == 0))] [network where event.type == \"connection\" and (process.name == \"rundll32.exe\" or process.pe.original_file_name == \"rundll32.exe\")]" -} --------------------------------------------------- -// KIBANA - -[[threat-match-example]] -*Example 5* - -Indicator match rule that creates an alert when one of the following is true: - -* The event's destination IP address *and* port number matches destination IP -*and* port values in the `threat_index` index. -* The event's source IP address matches a host IP address value in the -`threat_index` index. - -[source,console] --------------------------------------------------- -POST api/detection_engine/rules -{ - "type": "threat_match", - "index": [ - "packetbeat-*" - ], - "query": "destination.ip:* or host.ip:*", - "threat_index": [ - "ip-threat-list" <1> - ], - "threat_query": "*:*", <2> - "threat_mapping": [ - { - "entries": [ <3> - { - "field": "destination.ip", - "type": "mapping", - "value": "destination.ip" - }, - { - "field": "destination.port", - "type": "mapping", - "value": "destination.port" - } - ] - }, - { - "entries": [ <4> - { - "field": "source.ip", - "type": "mapping", - "value": "host.ip" - } - ] - } - ], - "risk_score": 50, - "severity": "medium", - "name": "Bad IP threat match", - "description": "Checks for bad IP addresses listed in the ip-threat-list index" -} --------------------------------------------------- -// KIBANA - -<1> The {es} index used for matching threat values. -<2> Query defining which threat index fields are used for matching values. In -this example, all values from the `ip-threat-list` index are used. -<3> Multiple objects in a single `entries` element are evaluated using `and` -logic. In this example, both the event's `destination.ip` and -`destination.port` values must match the corresponding field values in the -`ip-threat-list`. -<4> Sibling `entries` are evaluated using `or` logic. An alert is generated when -at least one `entries` object evaluates to `true`. - -==== Response code - -`200`:: - Indicates a successful call. - -==== Response payload - -A JSON object that includes a unique ID, the time the rule was created, and its -version number. If the request payload did not include a `rule_id` field, a -unique rule ID is also generated. - -Example response for a query rule: - -[source,json] --------------------------------------------------- -{ - "created_at": "2020-04-07T14:51:09.755Z", - "updated_at": "2020-04-07T14:51:09.970Z", - "created_by": "elastic", - "description": "Process started by MS Office program - possible payload", - "enabled": false, - "false_positives": [], - "from": "now-70m", - "id": "6541b99a-dee9-4f6d-a86d-dbd1869d73b1", - "immutable": false, - "interval": "1h", - "rule_id": "process_started_by_ms_office_program", - "output_index": ".siem-signals-default", - "max_signals": 100, - "risk_score": 50, - "name": "MS Office child process", - "references": [], - "severity": "low", - "updated_by": "elastic", - "tags": [ - "child process", - "ms office" - ], - "to": "now", - "type": "query", - "threat": [], - "version": 1, - "actions": [], - "filters": [ - { - "query": { - "match": { - "event.action": { - "query": "Process Create (rule: ProcessCreate)", - "type": "phrase" - } - } - } - } - ], - "throttle": "no_actions", - "query": "process.parent.name:EXCEL.EXE or process.parent.name:MSPUB.EXE or process.parent.name:OUTLOOK.EXE or process.parent.name:POWERPNT.EXE or process.parent.name:VISIO.EXE or process.parent.name:WINWORD.EXE", - "language": "kuery", - "related_integrations": [], <1> - "required_fields": [], <1> - "setup": "" <1> -} --------------------------------------------------- -<1> dev:[] These fields are under development and their usage may change: `related_integrations`, `required_fields`, and `setup`. - - -Example response for a {ml} job rule: - -[source,json] --------------------------------------------------- -{ - "created_at": "2020-04-07T14:45:15.679Z", - "updated_at": "2020-04-07T14:45:15.892Z", - "created_by": "elastic", - "description": "Generates alerts when the job discovers anomalies over 70", - "enabled": true, - "false_positives": [], - "from": "now-6m", - "id": "83876f66-3a57-4a99-bf37-416494c80f3b", - "immutable": false, - "interval": "5m", - "rule_id": "ml_linux_network_high_threshold", - "output_index": ".siem-signals-default", - "max_signals": 100, - "risk_score": 70, - "name": "Anomalous Linux network activity", - "references": [], - "severity": "high", - "updated_by": "elastic", - "tags": [ - "machine learning", - "Linux" - ], - "to": "now", - "type": "machine_learning", - "threat": [], - "version": 1, - "actions": [ - { - "action_type_id": ".slack", - "group": "default", - "id": "5ad22cd5-5e6e-4c6c-a81a-54b626a4cec5", - "params": { - "message": "Urgent: {{context.rule.description}}" - } - } - ], - "throttle": "rule", - "note": "Shut down the internet.", - "status": "going to run", - "status_date": "2020-04-07T14:45:21.685Z", - "anomaly_threshold": 70, - "machine_learning_job_id": "linux_anomalous_network_activity_ecs", - "related_integrations": [], <1> - "required_fields": [], <1> - "setup": "" <1> -} --------------------------------------------------- -<1> dev:[] These fields are under development and their usage may change: `related_integrations`, `required_fields`, and `setup`. - -Example response for a threshold rule: - -[source,json] --------------------------------------------------- -{ - "author": [], - "created_at": "2020-07-22T10:27:23.486Z", - "updated_at": "2020-07-22T10:27:23.673Z", - "created_by": "elastic", - "description": "Detects when there are 20 or more failed login attempts from the same IP address with a 2 minute time frame.", - "enabled": true, - "false_positives": [], - "from": "now-180s", - "id": "15dbde26-b627-4d74-bb1f-a5e0ed9e4993", - "immutable": false, - "interval": "2m", - "rule_id": "liv-win-ser-logins", - "output_index": ".siem-signals-default", - "max_signals": 100, - "risk_score": 30, - "risk_score_mapping": [], - "name": "Windows server prml-19", - "references": [], - "severity": "low", - "severity_mapping": [ - { - "field": "source.geo.city_name", - "operator": "equals", - "severity": "low", - "value": "Manchester" - }, - { - "field": "source.geo.city_name", - "operator": "equals", - "severity": "medium", - "value": "London" - }, - { - "field": "source.geo.city_name", - "operator": "equals", - "severity": "high", - "value": "Birmingham" - }, - { - "field": "source.geo.city_name", - "operator": "equals", - "severity": "critical", - "value": "Wallingford" - } - ], - "updated_by": "elastic", - "tags": [ - "Brute force" - ], - "to": "now", - "type": "threshold", - "threat": [], - "version": 1, - "exceptions_list": [ - { - "id": "int-ips", - "namespace_type": "single", - "type": "detection" - } - ], - "actions": [], - "index": [ - "winlogbeat-*" - ], - "throttle": "no_actions", - "query": "host.name:prml-19 and event.category:authentication and event.outcome:failure", - "language": "kuery", - "threshold": { - "field": "source.ip", - "value": 20 - }, - "related_integrations": [], <1> - "required_fields": [], <1> - "setup": "" <1> -} --------------------------------------------------- -<1> dev:[] These fields are under development and their usage may change: `related_integrations`, `required_fields`, and `setup`. - -Example response for an EQL rule: - -[source,json] --------------------------------------------------- -{ - "author": [], - "created_at": "2020-10-05T09:06:16.392Z", - "updated_at": "2020-10-05T09:06:16.403Z", - "created_by": "elastic", - "description": "Unusual rundll32.exe network connection", - "enabled": true, - "false_positives": [], - "from": "now-6m", - "id": "93808cae-b05b-4dc9-8479-73574b50f8b1", - "immutable": false, - "interval": "5m", - "rule_id": "eql-outbound-rundll32-connections", - "output_index": ".siem-signals-default", - "max_signals": 100, - "risk_score": 21, - "risk_score_mapping": [], - "name": "rundll32.exe network connection", - "references": [], - "severity": "low", - "severity_mapping": [], - "updated_by": "elastic", - "tags": [ - "EQL", - "Windows", - "rundll32.exe" - ], - "to": "now", - "type": "eql", - "threat": [], - "version": 1, - "exceptions_list": [], - "actions": [], - "throttle": "no_actions", - "query": "sequence by process.entity_id with maxspan=2h [process where event.type in (\"start\", \"process_started\") and (process.name == \"rundll32.exe\" or process.pe.original_file_name == \"rundll32.exe\") and ((process.args == \"rundll32.exe\" and process.args_count == 1) or (process.args != \"rundll32.exe\" and process.args_count == 0))] [network where event.type == \"connection\" and (process.name == \"rundll32.exe\" or process.pe.original_file_name == \"rundll32.exe\")]", - "language": "eql", - "related_integrations": [], <1> - "required_fields": [], <1> - "setup": "" <1> -} --------------------------------------------------- -<1> dev:[] These fields are under development and their usage may change: `related_integrations`, `required_fields`, and `setup`. - -Example response for an indicator match rule: - -[source,json] --------------------------------------------------- -{ - "author": [], - "created_at": "2020-10-06T07:07:58.227Z", - "updated_at": "2020-10-06T07:07:58.237Z", - "created_by": "elastic", - "description": "Checks for bad IP addresses listed in the ip-threat-list index", - "enabled": true, - "false_positives": [], - "from": "now-6m", - "id": "d5daa13f-81fb-4b13-be2f-31011e1d9ae1", - "immutable": false, - "interval": "5m", - "rule_id": "608501e4-c768-4f64-9326-cec55b5d439b", - "output_index": ".siem-signals-default", - "max_signals": 100, - "risk_score": 50, - "risk_score_mapping": [], - "name": "Bad IP threat match", - "references": [], - "severity": "medium", - "severity_mapping": [], - "updated_by": "elastic", - "tags": [], - "to": "now", - "type": "threat_match", - "threat": [], - "version": 1, - "exceptions_list": [], - "actions": [], - "index": [ - "packetbeat-*" - ], - "throttle": "no_actions", - "query": "destination.ip:* or host.ip:*", - "language": "kuery", - "threat_query": "*:*", - "threat_index": [ - "ip-threat-list" - ], - "threat_mapping": [ - { - "entries": [ - { - "field": "destination.ip", - "type": "mapping", - "value": "destination.ip" - }, - { - "field": "destination.port", - "type": "mapping", - "value": "destination.port" - } - ] - }, - { - "entries": [ - { - "field": "source.ip", - "type": "mapping", - "value": "host.ip" - } - ] - } - ], - "related_integrations": [], <1> - "required_fields": [], <1> - "setup": "" <1> -} --------------------------------------------------- -<1> dev:[] These fields are under development and their usage may change: `related_integrations`, `required_fields`, and `setup`. diff --git a/docs/detections/api/rules/rules-api-delete.asciidoc b/docs/detections/api/rules/rules-api-delete.asciidoc deleted file mode 100644 index 588c53cd48..0000000000 --- a/docs/detections/api/rules/rules-api-delete.asciidoc +++ /dev/null @@ -1,30 +0,0 @@ -[[rules-api-delete]] -=== Delete rule - -Deletes a single rule using the `rule_id` or `id` field. - -==== Request URL - -`DELETE :/api/detection_engine/rules` - -===== URL query parameters - -The URL query must include one of the following: - -* `id` - `DELETE /api/detection_engine/rules?id=` -* `rule_id`- `DELETE /api/detection_engine/rules?rule_id=` - -===== Example request - -Deletes the rule with an `id` value of `16947168-5405-453d-a8b5-aadad357af42`: - -[source,console] --------------------------------------------------- -DELETE api/detection_engine/rules?id=16947168-5405-453d-a8b5-aadad357af42 --------------------------------------------------- -// KIBANA - -==== Response code - -`200`:: - Indicates a successful call. diff --git a/docs/detections/api/rules/rules-api-export.asciidoc b/docs/detections/api/rules/rules-api-export.asciidoc deleted file mode 100644 index 971459a2a4..0000000000 --- a/docs/detections/api/rules/rules-api-export.asciidoc +++ /dev/null @@ -1,93 +0,0 @@ -[[rules-api-export]] -=== Export rules - -Exports rules to an `.ndjson` file. The following configuration items are also included in the `.ndjson` file: - -* Actions -* Exception lists - -You cannot export prebuilt rules, but they are available at https://github.com/elastic/detection-rules/tree/main/rules/. - -[IMPORTANT] -================= -Although detection rule actions are included in the exported file, the connectors used by the actions are not included. Use the {kibana-ref}/managing-saved-objects.html#managing-saved-objects-export-objects[Saved Objects] UI in Kibana (*Stack Management* -> *Kibana* -> *Saved Objects*) or the Saved Objects APIs (experimental) to {kibana-ref}/saved-objects-api-export.html[export] and {kibana-ref}/saved-objects-api-import.html[import] any necessary connectors _before_ you export and import the detection rules. - -Similarly, any value lists used for rule exceptions are not included in rule exports or imports. Use the <> UI (*Manage* -> *Rules* -> *Import value lists*) to export and import value lists separately. -================= - -==== Request URL - -`POST :/api/detection_engine/rules/_export` - - -===== URL query parameters - -[width="100%",options="header"] -|============================================== -|Name |Type |Description |Required - -|`exclude_export_details` |Boolean |Determines whether a summary of the -exported rules is returned.|No, defaults to `false`. -|`file_name` |String |File name for saving the exported rules. |No, defaults to -`export.ndjson` -|============================================== - -TIP: When using cURL to export rules to a file, use the `-O` and `-J` options -to save the rules to the file name specified in the URL. - -==== Request body - -An optional JSON `objects` array containing the `rule_id` fields of the rules -you want to export: - -[width="100%",options="header"] -|============================================== -|Name |Type |Description |Required - -|`objects` |String[] |Array of `rule_id` fields. |No, exports all rules when -unspecified. -|============================================== - - -===== Example request - -Exports two rules without details and saves them to the `exported_rules.ndjson` -file: - -[source,console] --------------------------------------------------- -POST api/detection_engine/rules/_export?exclude_export_details=true&file_name=exported_rules.ndjson -{ - "objects": [ - { - "rule_id":"343580b5-c811-447c-8d2d-2ccf052c6900" - }, - { - "rule_id":"2938c9fa-53eb-4c04-b79c-33cbf041b18d" - } - ] -} --------------------------------------------------- -// KIBANA - - -==== Response code - -`200`:: - Indicates a successful call. - -===== Response payload - -An `.ndjson` file containing the returned rules. - -Each line in the file represents an object (a rule, exception list parent container, or exception list item), and the last line includes a summary of what was exported. - -Example response payload: - -[source,json] --------------------------------------------------- -{"id":"d4db8800-30df-11ec-88a5-fb21b48c9b4e","rule_id":"query-with-single-exception-list"[....]} // Rule -{"id":"cd62f410-30de-11ec-88a5-fb21b48c9b4e","list_id":"simple_list"[...]} // Exception list parent container -{"id":"e54ffbe0-30de-11ec-88a5-fb21b48c9b4e","item_id":"my-exception-item","list_id":"simple_list"[...]} // Exception list item -{"exported_rules_count":1,"missing_rules":[],"missing_rules_count":0,"exported_exception_list_count":1,"exported_exception_list_item_count":1,"missing_exception_list_item_count":0,"missing_exception_list_items":[],"missing_exception_lists":[],"missing_exception_lists_count":0} // Export summary --------------------------------------------------- diff --git a/docs/detections/api/rules/rules-api-find.asciidoc b/docs/detections/api/rules/rules-api-find.asciidoc deleted file mode 100644 index fb5e181568..0000000000 --- a/docs/detections/api/rules/rules-api-find.asciidoc +++ /dev/null @@ -1,142 +0,0 @@ -[[rules-api-find]] -=== Find rules - -Retrieves a paginated subset of detection rules. By default, the first -page is returned with 20 results per page. - -==== Request URL - -`GET :/api/detection_engine/rules/_find` - -===== URL query parameters - -All parameters are optional: - -[width="100%",options="header"] -|============================================== -|Name |Type |Description - -|`page` |Integer |The page number to return. - -|`per_page` |Integer |The number of rules to return per page. - -|`sort_field` |String |Determines which field is used to sort the results. - -|`sort_order` |String |Determines the sort order, which can be `desc` or `asc`. - -|`filter` |String a|Filters the returned results according to the value of the -specified field, using the `alert.attributes.:` -syntax, where `` can be: - -* `name` -* `enabled` -* `tags` -* `createdBy` -* `interval` -* `updatedBy` - -NOTE: Even though the JSON rule object uses `created_by` and `updated_by` -fields, you must use `createdBy` and `updatedBy` fields in the filter. -|============================================== - -===== Example request - -Retrieves the first five rules with the word `windows` in their names, sorted -in ascending order: - -[source,console] --------------------------------------------------- -GET api/detection_engine/rules/_find?page=1&per_page=5&sort_field=enabled&sort_order=asc&filter=alert.attributes.name:windows --------------------------------------------------- -// KIBANA - -==== Response code - -`200`:: - Indicates a successful call. - -==== Response payload - -A JSON object containing a summary and the returned rules. - -Example response: - -[source,json] --------------------------------------------------- -{ - "page": 1, - "perPage": 5, - "total": 4, - "data": [ - { - "created_at": "2020-02-02T10:05:19.613Z", - "updated_at": "2020-02-02T10:05:19.830Z", - "created_by": "elastic", - "description": "Identifies a PowerShell process launched by either cscript.exe or wscript.exe. Observing Windows scripting processes executing a PowerShell script, may be indicative of malicious activity.", - "enabled": false, - "false_positives": [], - "from": "now-6m", - "id": "89761517-fdb0-4223-b67b-7621acc48f9e", - "immutable": true, - "index": [ - "winlogbeat-*" - ], - "interval": "5m", - "rule_id": "f545ff26-3c94-4fd0-bd33-3c7f95a3a0fc", - "language": "kuery", - "output_index": ".siem-signals-siem-test", - "max_signals": 33, - "risk_score": 21, - "name": "Windows Script Executing PowerShell", - "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.parent.name:(\"wscript.exe\" or \"cscript.exe\") and process.name:\"powershell.exe\"", - "references": [], - "severity": "low", - "updated_by": "elastic", - "tags": [ - "Elastic", - "Windows" - ], - "to": "now", - "related_integrations": [], <1> - "required_fields": [], <1> - "setup": "", <1> - "type": "query", - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0002", - "name": "Execution", - "reference": "https://attack.mitre.org/tactics/TA0002/" - }, - "technique": [ - { - "id": "T1193", - "name": "Spearphishing Attachment", - "reference": "https://attack.mitre.org/techniques/T1193/" - } - ] - } - ], - "execution_summary": { <1> - "last_execution": { - "date": "2022-03-23T16:06:12.787Z", - "status": "partial failure", - "status_order": 20, - "message": "This rule attempted to query data from Elasticsearch indices listed in the \"Index pattern\" section of the rule definition, but no matching index was found.", - "metrics": { - "total_search_duration_ms": 135, - "total_indexing_duration_ms": 15, - "execution_gap_duration_s": 0, - } - } - }, - "version": 1 - }, - ... - ] -} - --------------------------------------------------- - -<1> dev:[] These fields are under development and their usage or schema may change: `related_integrations`, `required_fields`, `setup`, and `execution_summary`. diff --git a/docs/detections/api/rules/rules-api-get.asciidoc b/docs/detections/api/rules/rules-api-get.asciidoc deleted file mode 100644 index 9b0364bec5..0000000000 --- a/docs/detections/api/rules/rules-api-get.asciidoc +++ /dev/null @@ -1,117 +0,0 @@ -[[rules-api-get]] -=== Get rule - -Retrieves a single rule using the `rule_id` or `id` field. - -==== Request URL - -`GET :/api/detection_engine/rules` - -===== URL query parameters - -The URL query must include one of the following: - -* `id` - `GET /api/detection_engine/rules?id=` -* `rule_id` - `GET /api/detection_engine/rules?rule_id=` - -===== Example request - -Retrieves the rule with an `id` value of `c41d170b-8ba6-4de6-b8ec-76440a35ace3`: - -[source,console] --------------------------------------------------- -GET api/detection_engine/rules?id=c41d170b-8ba6-4de6-b8ec-76440a35ace3 --------------------------------------------------- -// KIBANA - -==== Response code - -`200`:: - Indicates a successful call. - -==== Response payload - -The returned rule's JSON object. - -Example response: - -[source,json] --------------------------------------------------- -{ - "created_at": "2020-02-03T11:19:04.259Z", - "updated_at": "2020-02-03T11:19:04.462Z", - "created_by": "elastic", - "description": "Process started by MS Office program in user folder", - "enabled": false, - "false_positives": [], - "filters": [ - { - "query": { - "match": { - "event.action": { - "query": "Process Create (rule: ProcessCreate)", - "type": "phrase" - } - } - } - } - ], - "from": "now-4200s", - "id": "c41d170b-8ba6-4de6-b8ec-76440a35ace3", - "immutable": false, - "interval": "1h", - "rule_id": "process_started_by_ms_office_user_folder", - "related_integrations": [], <1> - "required_fields": [], <1> - "setup": "", <1> - "language": "kuery", - "output_index": ".siem-signals-siem-test", - "max_signals": 100, - "risk_score": 21, - "name": "MS Office child process", - "query": "process.parent.name:EXCEL.EXE or process.parent.name:MSPUB.EXE or process.parent.name:OUTLOOK.EXE or process.parent.name:POWERPNT.EXE or process.parent.name:VISIO.EXE or process.parent.name:WINWORD.EXE", - "references": [], - "severity": "low", - "updated_by": "elastic", - "tags": [ - "child process", - "ms office" - ], - "to": "now-300s", - "type": "query", - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0001", - "reference": "https://attack.mitre.org/tactics/TA0001", - "name": "Initial Access" - }, - "technique": [ - { - "id": "T1193", - "name": "Spearphishing Attachment", - "reference": "https://attack.mitre.org/techniques/T1193" - } - ] - } - ], - "execution_summary": { <1> - "last_execution": { - "date": "2022-03-23T16:06:12.787Z", - "status": "partial failure", - "status_order": 20, - "message": "This rule attempted to query data from Elasticsearch indices listed in the \"Index pattern\" section of the rule definition, but no matching index was found.", - "metrics": { - "total_search_duration_ms": 135, - "total_indexing_duration_ms": 15, - "execution_gap_duration_s": 0, - } - } - }, - "version": 1 -} - --------------------------------------------------- - -<1> dev:[] These fields are under development and their usage or schema may change: `related_integrations`, `required_fields`, `setup`, and `execution_summary`. diff --git a/docs/detections/api/rules/rules-api-import.asciidoc b/docs/detections/api/rules/rules-api-import.asciidoc deleted file mode 100644 index e063fbe320..0000000000 --- a/docs/detections/api/rules/rules-api-import.asciidoc +++ /dev/null @@ -1,83 +0,0 @@ -[[rules-api-import]] -=== Import rules - -Imports rules from an `.ndjson` file. The following configuration items are also included in the `.ndjson` file: - -* Actions -* Exception lists - -NOTE: This API supports {kibana-ref}/api.html#token-api-authentication[Token-based authentication] only. - -NOTE: You need at least `Read` privileges for the `Action and Connectors` feature to import rules with actions. If you're importing rules without actions, `Action and Connectors` feature privileges are not required. Refer to <> for more information. - -[IMPORTANT] -================= -Although detection rule actions are included in the exported file, the connectors used by the actions are not included. Use the {kibana-ref}/managing-saved-objects.html#managing-saved-objects-export-objects[Saved Objects] UI in Kibana (*Stack Management* -> *Kibana* -> *Saved Objects*) or the Saved Objects APIs (experimental) to {kibana-ref}/saved-objects-api-export.html[export] and {kibana-ref}/saved-objects-api-import.html[import] any necessary connectors _before_ you export and import the detection rules. - -Similarly, any value lists used for rule exceptions are not included in rule exports or imports. Use the <> UI (*Manage* -> *Rules* -> *Import value lists*) to export and import value lists separately. -================= - -==== Request URL - -`POST :/api/detection_engine/rules/_import` - -The request must include: - -* The `Content-Type: multipart/form-data` HTTP header. -* A link to the `.ndjson` file containing the rules. - -For example, using cURL: - -[source,console] --------------------------------------------------- -curl -X POST "/api/detection_engine/rules/_import" --u : -H 'kbn-xsrf: true' --H 'Content-Type: multipart/form-data' ---form "file=@" <1> --------------------------------------------------- -<1> The relative link to the `.ndjson` file containing the rules. - -===== URL query parameters - -[width="100%",options="header"] -|============================================== -|Name |Type |Description |Required - -|`overwrite` |Boolean |Determines whether existing rules with the same -`rule_id` are overwritten. |No, defaults to `false`. -|`overwrite_exceptions` |Boolean |Determines whether existing exception lists -with the same `list_id` are overwritten. Both the exception list container and -its items are overwritten. |No, defaults to `false`. -|============================================== - -===== Example request - -Imports the rules in the `detection_rules.ndjson` file and overwrites -existing rules with the same `rule_id` values: - -[source,console] --------------------------------------------------- -curl -X POST "api/detection_engine/rules/_import?overwrite=true" --H 'kbn-xsrf: true' -H 'Content-Type: multipart/form-data' ---form "file=@detection_rules.ndjson" --------------------------------------------------- - -==== Response code - -`200`:: - Indicates a successful call. - -===== Example response - -[source,json] --------------------------------------------------- -{ - "success": true, - "success_count": 1, - "rules_count": 1, - "errors": [], - "exceptions_errors": [], - "exceptions_success": true, - "exceptions_success_count": 0 -} --------------------------------------------------- diff --git a/docs/detections/api/rules/rules-api-overview.asciidoc b/docs/detections/api/rules/rules-api-overview.asciidoc deleted file mode 100644 index 2b66a945c1..0000000000 --- a/docs/detections/api/rules/rules-api-overview.asciidoc +++ /dev/null @@ -1,47 +0,0 @@ -[[rule-api-overview]] -[role="xpack"] -== Detections API - -You can create rules that automatically turn events and external alerts sent to -{es-sec} into detection alerts. These alerts are displayed on the Detections -page. - -For more information on detection alerts and the differences between events, -external alerts, and detection alerts, see -<>. - -The API has these endpoints: - -* `:/api/detection_engine/rules` - Detection rules CRUD functions -* `:/api/detection_engine/index` - Signal index operations -(used to store detection alerts) -* `:/api/detection_engine/tags` - Aggregates and returns rule -tags -* `:/api/detection_engine/rules/_import` - Imports rules from an -`.ndjson` file -* `:/api/detection_engine/rules/_export` - Exports rules to an -`.ndjson` file -* `:/api/detection_engine/privileges` - Returns the user's -{kib} space and signal index permissions, and whether the user is authenticated -* `:/api/detection_engine/signals` - Aggregates, queries, and -returns alerts, and updates their statuses -* `:/api/detection_engine/rules/prepackaged` - Loads and retrieves -the status of Elastic <> - -TIP: You can view and download a Detections API Postman collection -https://github.com/elastic/examples/tree/master/Security%20Analytics/SIEM-examples/Detections-API[here]. - -[float] -=== Kibana role requirements - -To create and run rules, the user role for the {kib} space must have: - -* {kib} space `All` privileges for the `Security` and `Saved Objects Management` -features (see -{kibana-ref}/xpack-spaces.html#spaces-control-user-access[Feature access based on user privileges]). -* `read` and `write` privileges for the `.siem-signals-*` index (the system index -used for storing detection alerts created from rules). - - - -See <> for a complete list of requirements. diff --git a/docs/detections/api/rules/rules-api-prebuilt.asciidoc b/docs/detections/api/rules/rules-api-prebuilt.asciidoc deleted file mode 100644 index dbe1b3c3db..0000000000 --- a/docs/detections/api/rules/rules-api-prebuilt.asciidoc +++ /dev/null @@ -1,80 +0,0 @@ -[[prebuilt-rules-api]] -[role="xpack"] -=== Prebuilt rules - -The prepackaged endpoint is for retrieving rule statuses and loading Elastic -prebuilt detection rules. - -==== Load prebuilt rules - -Loads and updates Elastic prebuilt rules. - -NOTE: By default, all loaded prebuilt rules are disabled. - -===== Request URL - -`PUT :/api/detection_engine/rules/prepackaged` - -====== Example request - -[source,console] --------------------------------------------------- -PUT api/detection_engine/rules/prepackaged --------------------------------------------------- -// KIBANA - -===== Response code - -`200`:: - Indicates a successful call. - -====== Response payload - -A JSON object listing the number of loaded and updated prebuilt rules. - -Example response: - -[source,json] --------------------------------------------------- -{ - "rules_installed": 112, - "rules_updated": 0 -} --------------------------------------------------- - -==== Get rule status - -Returns rule statuses. - -===== Request URL - -`GET :/api/detection_engine/rules/prepackaged/_status` - -====== Example request - -[source,console] --------------------------------------------------- -GET api/detection_engine/rules/prepackaged/_status --------------------------------------------------- -// KIBANA - -===== Response code - -`200`:: - Indicates a successful call. - -====== Response payload - -A JSON object listing rule statuses. - -Example response: - -[source,json] --------------------------------------------------- -{ - "rules_custom_installed": 0, - "rules_installed": 0, - "rules_not_installed": 112, - "rules_not_updated": 0 -} --------------------------------------------------- diff --git a/docs/detections/api/rules/rules-api-update.asciidoc b/docs/detections/api/rules/rules-api-update.asciidoc deleted file mode 100644 index f6830c795d..0000000000 --- a/docs/detections/api/rules/rules-api-update.asciidoc +++ /dev/null @@ -1,550 +0,0 @@ -[[rules-api-update]] -=== Update rule - -WARNING: This API supports {kibana-ref}/api.html#token-api-authentication[Token-based authentication] only. - -Updates an existing detection rule. - -You can use `PUT` or `PATCH` methods to update rules, where: - -* `PUT` replaces the original rule and deletes fields that are not specified. -* `PATCH` updates the specified fields. - -==== Request URL - -`PUT :/api/detection_engine/rules` - -`PATCH :/api/detection_engine/rules` - -==== Request body - -A JSON object with: - -* The `id` or `rule_id` field of the rule you want to update. -* The fields you want to modify. - -IMPORTANT: If you call `PUT` to update a rule, all unspecified fields are -deleted. You cannot modify the `id` or `rule_id` values. - -For `PATCH` calls any of the fields can be modified, whereas for `PUT` calls -some fields are required. - -===== Fields required for `PUT` calls - -[width="100%",options="header"] -|============================================== -|Name |Type |Description - -|description |String |The rule's description. - -|name |String |The rule's name. - -|risk_score |Integer a|A numerical representation of the alert's severity from -0 to 100, where: - -* `0` - `21` represents low severity -* `22` - `47` represents medium severity -* `48` - `73` represents high severity -* `74` - `100` represents critical severity - -|severity |String a|Severity level of alerts produced by the rule, which must -be one of the following: - -* `low`: Alerts that are of interest but generally not considered to be -security incidents -* `medium`: Alerts that require investigation -* `high`: Alerts that require immediate investigation -* `critical`: Alerts that indicate it is highly likely a security incident has -occurred - -|type |String a|Data type on which the rule is based: - -* `eql`: EQL query (see {ref}/eql.html[Event Query Language]). -* `query`: query with or without additional filters. -* `saved_query`: saved search, identified in the `saved_id` field. -* `machine_learning`: rule based on a {ml} job's anomaly scores. -* `threat_match`: rule that matches event values with values in the specified -{es} index. -* `threshold`: rule based on the number of times a `query` matches the -specified field. - -|============================================== - -===== Field required for query, threat-match and threshold rules `PUT` calls - -[width="100%",options="header"] -|============================================== -|Name |Type |Description - -|query |String a|{kibana-ref}/search.html[Query] used by the rule to create -alerts. For threat-match rules, only the query's results are used to determine -whether an alert is generated. - -|============================================== - -===== Field required for threshold rules `PUT` calls - -[width="100%",options="header"] -|============================================== -|Name |Type |Description - -|threshold |Object a|Defines the field and threshold value for when alerts -are generated, where: - -* `cardinality` (Array of length 1): The field on which the cardinality is applied. -* `cardinality.field` (string, required): The field on which to calculate and compare the -cardinality. -* `cardinality.value` (integer, required): The threshold value from which an alert is -generated based on unique number of values of `cardinality.field`. -* `field` (string or string[], required): The field on which the threshold is applied. If -you specify an empty array (`[]`), alerts are generated when the query returns -at least the number of results specified in the `value` field. -* `value` (integer, required): The threshold value from which an alert is -generated. - -|============================================== - -===== Field required for saved-query rules `PUT` calls - -[width="100%",options="header"] -|============================================== -|Name |Type |Description - -|saved_id |String |Kibana saved search used by the rule to create alerts. - -|============================================== - -===== Field required for EQL rules `PUT` calls - -[width="100%",options="header"] -|============================================== -|Name |Type |Description - -|language |String |Must be `eql`. - -|============================================== - -===== Fields required for machine-learning rules `PUT` calls - -[width="100%",options="header"] -|============================================== -|Name |Type |Description - -|anomaly_threshold |Integer |Anomaly score threshold above which the rule -creates an alert. Valid values are from `0` to `100`. - -|machine_learning_job_id |String |{ml-cap} job ID the rule monitors for -anomaly scores. - -|============================================== - -===== Fields required for threat-match rules `PUT` calls - -[width="100%",options="header"] -|============================================== -|Name |Type |Description - -|threat_index |String[] |{es} indices used to check which field values generate -alerts. - -|threat_query |String |Query used to determine which fields in the {es} index -are used for generating alerts. - -|threat_mapping |Object[] a|Array of `entries` objects that define mappings -between the source event fields and the values in the {es} threat index. Each -`entries` object must contain these fields: - -* `field`: field from the event indices on which the rule runs -* `type`: must be `mapping` -* `value`: field from the {es} threat index - -You can use Boolean `and` and `or` logic to define the conditions for when -matching fields and values generate alerts. Sibling `entries` objects -are evaluated using `or` logic, whereas multiple entries in a single `entries` -object use `and` logic. See <> for an example that -uses both `and` and `or` logic. - -|============================================== - -===== Optional fields for all rule types - -[width="100%",options="header"] -|============================================== -|Name |Type |Description - -|actions |<> |Array defining the automated -actions (notifications) taken when alerts are generated. - -|author |String[] |The rule's author. - -|building_block_type |String |Determines if the rule acts as a building block. -By default, building-block alerts are not displayed in the UI. These rules are -used as a foundation for other rules that do generate alerts. Its value must be -`default`. For more information, refer to <>. - -|enabled |Boolean |Determines whether the rule is enabled. Defaults to `true`. - -|false_positives |String[] |String array used to describe common reasons why -the rule may issue false-positive alerts. Defaults to an empty array. - -[[detection-rules-from]] -|from |String |Time from which data is analyzed each time the rule executes, -using a {ref}/common-options.html#date-math[date math range]. For example, -`now-4200s` means the rule analyzes data from 70 minutes before its start -time. Defaults to `now-6m` (analyzes data from 6 minutes before the start -time). - -|interval |String |Frequency of rule execution, using a -{ref}/common-options.html#date-math[date math range]. For example, `"1h"` -means the rule runs every hour. Defaults to `5m` (5 minutes). - -|license |String |The rule's license. - -|max_signals |Integer |Maximum number of alerts the rule can create during a -single execution. Defaults to `100`. - -|meta |Object a|Placeholder for metadata about the rule. - -*NOTE*: This field is overwritten when you save changes to the rule's settings. - -|note |String |Notes to help investigate alerts produced by the rule. - -|output_index |String |Index to which alerts created by the rule are saved. -If unspecified alerts are saved to `.siem-signals-` index, -where `` is the name of the {kib} space in which the rule exists. - -|references |String[] |Array containing notes about or references to -relevant information about the rule. Defaults to an empty array. - -|tags |String[] |String array containing words and phrases to help categorize, -filter, and search rules. Defaults to an empty array. - -|threat |<> |Object containing attack -information about the type of threat the rule monitors, see -{ecs-ref}/ecs-threat.html[ECS threat fields]. Defaults to an empty array. - -|throttle |String a|Determines how often actions are taken: - -* `no_actions`: Never -* `rule`: Every time new alerts are detected -* `1h`: Every hour -* `1d`: Every day -* `7d`: Every week - -Required when `actions` are used to send notifications. - -|version |Integer a|The rule's version number. If this is not provided, the -rule's version number is incremented by 1. - -`PATCH` calls enabling and disabling the rule do not increment its version -number. - -|============================================== - -===== Optional fields for query, threat-match and EQL rules - -[width="100%",options="header"] -|============================================== -|Name |Type |Description - -|exceptions_list |Object[] a|Array of -<>, which define -exceptions that prevent the rule from generating alerts even when its other -criteria are met. The object has these fields: - -* `id` (string, required): ID of the exception container. -* `list_id` (string, required): List ID of the exception container. -* `namespace_type` (string required): Determines whether the exceptions are -valid in only the rule's {kib} space (`single`) or in all {kib} spaces -(`agnostic`). -* `type` (string, required): The exception type, which must be either -a detection rule exception (`detection`) or an endpoint exception (`endpoint`). -|============================================== - -===== Optional fields for threat-match rules - -[width="100%",options="header"] -|============================================== -|Name |Type |Description - -|threat_filters |Object[] -|{ref}/query-filter-context.html[Query and filter context] array used to filter -documents from the {es} index containing the threat values. - -|threat_indicator_path |String -|Much like an ingest processor, users can use this field to define where their threat indicator can be found on their indicator documents. Defaults to `threatintel.indicator`. -|============================================== - -===== Optional fields for query, threat-match and threshold rules - -[width="100%",options="header"] -|============================================== -|Name |Type |Description - -|language |String |Determines the query language, which must be -`kuery` or `lucene`. Defaults to `kuery`. -|============================================== - -===== Optional fields for EQL, query and threshold rules - -[width="100%",options="header"] -|============================================== -|Name |Type |Description - -|filters |Object[] |The {ref}/query-filter-context.html[query and filter -context] array used to define the conditions for when alerts are created from -events. Defaults to an empty array. - -|index |String[] |Indices on which the rule functions. Defaults to the -Security Solution indices defined on the {kib} Advanced Settings page -(*Kibana* → *Stack Management* → *Advanced Settings* → -`securitySolution:defaultIndex`). - -|risk_score_mapping |Object[] a|Overrides generated alerts' `risk_score` with -a value from the source event: - -* `field` (string, required): Source event field used to override the default -`risk_score`. This field must be an integer. -* `operator` (string, required): Must be `equals`. -* `value`(string, required): Must be an empty string (`""`). - -|rule_name_override |String |Sets which field in the source event is used to -populate the alert's `signal.rule.name` value (in the UI, this value is -displayed on the *Rules* page in the *Rule* column). When unspecified, the -rule's `name` value is used. The source field must be a string data type. - -|severity_mapping |Object[] a|Overrides generated alerts' `severity` with -values from the source event: - -* `field` (string, required): Source event field used to override the default -`severity`. -* `operator` (string, required): Must be `equals`. -* `severity` (string, required): Mapped severity value, must be `low`, -`medium`, `high`, or `critical`. -* `value`(string, required): Field value used to determine the `severity`. - -|timestamp_override |String |Sets the time field used to query indices. -When unspecified, rules query the `@timestamp` field. The source field -must be an {es} date data type. - -|============================================== - -[[opt-fields-eql-update]] -===== Optional fields for EQL rules - -[width="100%",options="header"] -|============================================== -|Name |Type |Description - -|event_category_field |String -|Contains the event classification, such as `process`, `file`, or `network`. This field is typically mapped as a field type in the {ref}/keyword.html[keyword family]. Defaults to the `event.category` ECS field. - -|tiebreaker_field |String -|Sets a secondary field for sorting events (in ascending, lexicographic order) if they have the same timestamp. - -|timestamp_field |String -|Contains the event timestamp used for sorting a sequence of events. This is different from `timestamp_override`, which is used for querying events within a range. Defaults to the `@timestamp` ECS field. - -|============================================== - -[[actions-object-schema-update]] -===== `actions` schema - -These fields are required when calling `PUT` to modify the `actions` object: - -[width="100%",options="header"] -|============================================== -|Name |Type |Description - -|action_type_id |String a|The action type used for sending notifications, can -be: - -* `.slack` -* `.email` -* `.pagerduty` -* `.webhook` - -|group |String |Optionally groups actions by use cases. Use `default` for alert -notifications. - -|id |String |The connector ID. - -|params |Object a|Object containing the allowed connector fields, which varies according to the connector type: - -* For Slack: -** `message` (string, required): The notification message. -* For email: -** `to`, `cc`, `bcc` (string): Email addresses to which the notifications are -sent. At least one field must have a value. -** `subject` (string, optional): Email subject line. -** `message` (string, required): Email body text. -* For Webhook: -** `body` (string, required): JSON payload. -* For PagerDuty: -** `severity` (string, required): Severity of on the alert notification, can -be: `Critical`, `Error`, `Warning` or `Info`. -** `eventAction` (string, required): Event https://v2.developer.pagerduty.com/docs/events-api-v2#event-action[action type], which can be `trigger`, -`resolve`, or `acknowledge`. -** `dedupKey` (string, optional): Groups alert notifications with the same -PagerDuty alert. -** `timestamp` (DateTime, optional): https://v2.developer.pagerduty.com/v2/docs/types#datetime[ISO-8601 format timestamp]. -** `component` (string, optional): Source machine component responsible for the -event, for example `security-solution`. -** `group` (string, optional): Enables logical grouping of service components. -** `source` (string, optional): The affected system. Defaults to the {kib} -saved object ID of the action. -** `summary` (string, options): Summary of the event. Defaults to -`No summary provided`. Maximum length is 1024 characters. -** `class` (string, optional): Value indicating the class/type of the event. - -|============================================== - - -[[threats-object-update]] -===== `threat` schema - -These fields are required when calling `PUT` to modify the `threat` object: - -[width="100%",options="header"] -|============================================== -|Name |Type |Description - -|framework |String |Relevant attack framework. - -|tactic |Object a|Object containing information on the attack type: - -* `id` - string, required -* `name` - string, required -* `reference` - string, required - -|technique |Object a|Object containing information on the attack -technique: - -* `id` - string, required -* `name` - string, required -* `reference` - string, required - -|============================================== - -NOTE: Only threats described using the MITRE ATT&CK^TM^ framework are displayed -in the UI (*Manage* -> *Rules* -> *_Rule name_*). - -===== Example request - -Updates the `threat` object: - -[source,console] --------------------------------------------------- -PATCH api/detection_engine/rules -{ - "rule_id": "process_started_by_ms_office_program_possible_payload", - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0001", - "reference": "https://attack.mitre.org/tactics/TA0001", - "name": "Initial Access" - }, - "technique": [ - { - "id": "T1193", - "name": "Spearphishing Attachment", - "reference": "https://attack.mitre.org/techniques/T1193" - } - ] - } - ] -} --------------------------------------------------- -// KIBANA - -==== Response code - -`200`:: - Indicates a successful call. - -==== Response payload - -The rule's updated JSON object, including the time the rule was updated and an -incremented version number. - -Example response: - -[source,json] --------------------------------------------------- -{ - "created_at": "2020-01-05T09:56:11.805Z", - "updated_at": "2020-01-05T09:59:59.129Z", - "created_by": "elastic", - "description": "Process started by MS Office program - possible payload", - "enabled": false, - "false_positives": [], - "filters": [ - { - "query": { - "match": { - "event.action": { - "query": "Process Create (rule: ProcessCreate)", - "type": "phrase" - } - } - } - } - ], - "from": "now-6m", - "id": "4f228868-9928-47e4-9785-9a1a9b520c7f", - "interval": "5m", - "rule_id": "process_started_by_ms_office_program_possible_payload", - "language": "kuery", - "output_index": ".siem-signals-default", - "max_signals": 100, - "risk_score": 50, - "name": "MS Office child process", - "query": "process.parent.name:EXCEL.EXE or process.parent.name:MSPUB.EXE or process.parent.name:OUTLOOK.EXE or process.parent.name:POWERPNT.EXE or process.parent.name:VISIO.EXE or process.parent.name:WINWORD.EXE", - "references": [], - "severity": "low", - "updated_by": "elastic", - "tags": [ - "child process", - "ms office" - ], - "related_integrations": [], <1> - "required_fields": [], <1> - "setup": "", <1> - "type": "query", - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0001", - "reference": "https://attack.mitre.org/tactics/TA0001", - "name": "Initial Access" - }, - "technique": [ - { - "id": "T1193", - "name": "Spearphishing Attachment", - "reference": "https://attack.mitre.org/techniques/T1193" - } - ] - } - ], - "execution_summary": { <1> - "last_execution": { - "date": "2022-03-23T16:06:12.787Z", - "status": "partial failure", - "status_order": 20, - "message": "This rule attempted to query data from Elasticsearch indices listed in the \"Index pattern\" section of the rule definition, but no matching index was found.", - "metrics": { - "total_search_duration_ms": 135, - "total_indexing_duration_ms": 15, - "execution_gap_duration_s": 0, - } - } - }, - "version": 2 -} --------------------------------------------------- - -<1> dev:[] These fields are under development and their usage or schema may change: `related_integrations`, `required_fields`, `setup`, and `execution_summary`. diff --git a/docs/detections/api/rules/signals-api-overview.asciidoc b/docs/detections/api/rules/signals-api-overview.asciidoc deleted file mode 100644 index d3e8ee19e9..0000000000 --- a/docs/detections/api/rules/signals-api-overview.asciidoc +++ /dev/null @@ -1,247 +0,0 @@ -[[signals-api-overview]] -[role="xpack"] -=== Signals endpoint - -The signals endpoint is for retrieving, aggregating, and updating detection -alerts. For detailed information on how to retrieve and aggregate results from -the indices, see: - -* {ref}/getting-started-search.html[Start searching indices] -* {ref}/search-aggregations.html[Aggregations] -* {ref}/query-dsl.html[Query DSL] - -==== Get alerts - -Aggregates and returns alerts. - -===== Request URL - -`POST :/api/detection_engine/signals/search` - -===== Request body - -A query DSL that determines which results are returned. - -====== Example request - -Gets aggregated results of all open alerts with a risk score equal to or -greater than 70. It also returns the timestamps of the oldest and -newest alerts that meet the query's criteria. - -[source,console] --------------------------------------------------- -POST api/detection_engine/signals/search -{ - "aggs": { - "latest": { - "max": { - "field": "@timestamp" - } - }, - "oldest": { - "min": { - "field": "@timestamp" - } - } - }, - "query": { - "bool": { - "filter": [ - { - "match": { - "signal.status": "open" - } - }, - { - "range": { - "signal.rule.risk_score": { - "gte": 70 - } - } - } - ] - } - } -} --------------------------------------------------- - -Gets all in-progress alerts with a risk score equal to or -greater than 70. - -[source,console] --------------------------------------------------- -POST api/detection_engine/signals/search -{ - "query": { - "bool": { - "filter": [ - { - "match": { - "signal.status": "in-progress" - } - }, - { - "range": { - "signal.rule.risk_score": { - "gte": 70 - } - } - } - ] - } - } -} --------------------------------------------------- -// KIBANA - -===== Response code - -`200`:: - Indicates a successful call. - -====== Response payload - -A JSON object with the aggregated values and requested alerts. - -Example response: - -[source,json] --------------------------------------------------- -{ - "took": 3, - "timed_out": false, - "_shards": { - "total": 1, - "successful": 1, - "skipped": 0, - "failed": 0 - }, - "hits": { - "total": { - "value": 8794, - "relation": "eq" - }, - "max_score": null, - "hits": [] - }, - "aggregations": { - "oldest": { - "value": 1576601119930, - "value_as_string": "2019-12-17T16:45:19.930Z" - }, - "latest": { - "value": 1576634706400, - "value_as_string": "2019-12-18T02:05:06.400Z" - } - } -} --------------------------------------------------- - -==== Set alert status - -Sets the status of one or more alert. - -===== Request URL - -`POST :/api/detection_engine/signals/status` - -===== Request body - -A JSON object with either a `query` or `signals_id` field: - -[width="100%",options="header"] -|============================================== -|Name |Type |Description |Required - -|`signal_ids` |String[] |Array of alert IDs. |Yes, when the `query` field is -not used. - -|`query` |Query DSL |Query that determines which alerts are updated. |Yes, when -the `signal_ids` field is not used. - -|`status` |String |The new status, which can be `open`, `in-progress` or -`closed`. |Yes. - -|============================================== - -====== Example requests - -Closes alerts with `signal_ids`: - -[source,console] --------------------------------------------------- -POST api/detection_engine/signals/status -{ - "signal_ids": [ - "694156bbe6a487e06d049bd6019bd49fec4172cfb33f5d81c3b4a977f0026fba", - "f4d1c62c4e8946c835cb497329127803c09b955de49a8fa186be3899522667b0" - ], - "status": "closed" -} --------------------------------------------------- -// KIBANA - -Closes alerts that are over a month old and have a risk score less than or -equal to 20: - -[source,json] --------------------------------------------------- -POST api/detection_engine/signals/status -{ - "query": { - "bool": { - "filter": [ - { - "range": { - "signal.rule.risk_score": { - "lte": 20 - } - } - }, - { - "range": { - "@timestamp": { - "lte": "now-M" - } - } - } - ] - } - }, - "status": "closed" -} --------------------------------------------------- -// KIBANA - -===== Response code - -`200`:: - Indicates a successful call. - -====== Response payload - -A JSON object containing the number of updated alerts. - -Example response: - -[source,json] --------------------------------------------------- -{ - "took": 9594, - "timed_out": false, - "total": 8794, - "updated": 8794, - "deleted": 0, - "batches": 9, - "version_conflicts": 0, - "noops": 0, - "retries": { - "bulk": 0, - "search": 0 - }, - "throttled_millis": 0, - "requests_per_second": -1, - "throttled_until_millis": 0, - "failures": [] -} --------------------------------------------------- diff --git a/docs/detections/api/rules/tags-api-overview.asciidoc b/docs/detections/api/rules/tags-api-overview.asciidoc deleted file mode 100644 index 7d4bcbb68a..0000000000 --- a/docs/detections/api/rules/tags-api-overview.asciidoc +++ /dev/null @@ -1,44 +0,0 @@ -[[tags-api-overview]] -[role="xpack"] -=== Tags endpoint - -Aggregates and returns all rule tags. - -==== Get tags - -Aggregates and returns all unique tags from all rules. - -===== Request URL - -`GET :/api/detection_engine/tags` - -====== Example request - -Gets tags for all rules in the {kib} default space: - -[source,console] --------------------------------------------------- -GET api/detection_engine/tags --------------------------------------------------- -// KIBANA - -===== Response code - -`200`:: - Indicates a successful call. - -====== Example response - -[source,json] --------------------------------------------------- -[ - "zeek", - "suricata", - "windows", - "linux", - "network", - "initial access", - "remote access", - "phishing" -] --------------------------------------------------- diff --git a/docs/detections/api/signals-migration-api.asciidoc b/docs/detections/api/signals-migration-api.asciidoc deleted file mode 100644 index a6dac567fe..0000000000 --- a/docs/detections/api/signals-migration-api.asciidoc +++ /dev/null @@ -1,235 +0,0 @@ -[[signals-migration-api]] -[role="xpack"] -== Detection Alerts Migration API - -After an upgrade of {kib}, the latest {es-sec} features will be available for any new <> that are generated. However, in order to enable new features on existing detection alerts, migration may be necessary. See <> for instructions specific to your upgrade. - -Migrating detection alerts is performed at the index level and requires the following steps: - -1. <> -2. <> -3. <> -4. <> (optional) - -[[migration-1]] -[float] -=== Determine which indices to migrate -You can use the Migration Status API to determine which indices contain detection alerts of a particular age, along with migration info for each of those indices. - -[float] -==== Request - -`GET :/api/detection_engine/signals/migration_status?from=now-30d` - -[float] -==== Request query parameters - -[width="100%",options="header"] -|============================================== -|Name |Type |Description - -|`from` |datemath|Maximum age of qualifying detection alerts -|============================================== - -[float] -==== Response example - -[source,json] --------------------------------------------------- -{ - "indices": [ - { - "index": ".siem-signals-default-000002", - "version": 15, - "signal_versions": [ - { - "version": 15, - "count": 100 - }, - { - "version": 16, - "count": 87 - } - ], - "migrations": [ - { - "id": "924f7c50-505f-11eb-ae0a-3fa2e626a51d", - "status": "pending", - "version": 16, - "updated": "2021-01-06T20:41:37.173Z" - } - ], - "is_outdated": true - }, - { - "index": ".siem-signals-default-000003", - "version": 16, - "signal_versions": [ - { - "version": 16, - "count": 54 - } - ], - "migrations": [], - "is_outdated": false - } - ] -} --------------------------------------------------- -The above response shows two indices: `.siem-signals-default-000002` is outdated, with multiple versions of detection alerts and a pending migration, and `.siem-signals-default-000003`, which is up to date as the current write index. - -NOTE: Indices that do not contain detection alerts in the specified range will be filtered from the response. - -With the above info, we can compile a list of indices that we wish to migrate. - -*Find outdated detection alerts with threat intelligence data* - -After upgrading to {stack} version 7.15.x from release versions 7.12.0 through 7.14.2, you need to migrate detection alerts enriched with threat intelligence data to ensure threat intelligence properly displays in {elastic-sec}. Run this query to find outdated detection alerts with threat intelligence data: - -[source,json] --------------------------------------------------- -GET .siem-signals-{KIBANA SPACE ID}/_search -{ - "query": { - "nested": { - "path": "threat.indicator", - "query": { - "exists": { - "field": "threat.indicator.matched.*" - } - } - } - } -} --------------------------------------------------- - - -[[migration-2]] -[float] -=== Initiate migrations - -Migrations are initiated per index. While the process is neither destructive nor interferes with existing data, it may be resource-intensive. As such, it is recommended that you plan your migrations accordingly. - -[float] -==== Request - -`POST :/api/detection_engine/signals/migration` - -[float] -==== Request body - -[width="100%",options="header"] -|============================================== -|Name |Type |Description | Required - -|`index` |String[]|Array of index names to migrate|Yes -|`size`|Integer|Number of alerts to migrate per batch. Corresponds to the `source.size` option on the {ref}/docs-reindex.html[Reindex API]|No -|`requests_per_second`|Integer|The throttle for the migration task in sub-requests per second. Corresponds to `requests_per_second` on the {ref}/docs-reindex.html[Reindex API]| No -|`slices`|Integer|The number of subtasks for the migration task. Corresponds to `slices` on the {ref}/docs-reindex.html[Reindex API]|No -|============================================== - -[float] -==== Response example - -[source,json] --------------------------------------------------- -{ - "indices": [ - { - "index": ".siem-signals-default-000001", - "migration_id": "923f7c50-505f-11eb-ae0a-3fa2e626a51d", - "migration_index": ".siem-signals-default-000001-r000016" - } - ] -} --------------------------------------------------- -The response will include, for each index specified, an ID and destination index for the migration, and an error if unsuccessful. - -[[migration-3]] -[float] -=== Finalize migrations - -The finalization endpoint replaces the original index's alias with the successfully migrated index's alias. The endpoint is idempotent; therefore, it can safely be used to poll a given migration and, upon completion, finalize it. - -NOTE: The original indices are not removed as part of this step. After verifying the integrity of the migrated index, you can use the <> endpoint to apply a 30-day deletion policy to the original, outdated index. - -NOTE: If an unsuccessful migration is finalized, a deletion policy will be applied to its index, causing it to be deleted after 30 days. - -[float] -==== Request - -`POST :/api/detection_engine/signals/finalize_migration` - -[float] -==== Request body - -[width="100%",options="header"] -|============================================== -|Name |Type |Description | Required - -|`migration_ids` |String[]|Array of `migration_id`s to finalize|Yes -|============================================== - -[float] -==== Response example - -[source,json] --------------------------------------------------- -{ - "migrations": [ - { - "id": "924f7c50-505f-11eb-ae0a-3fa2e626a51d", - "completed": true, - "destinationIndex": ".siem-signals-default-000002-r000016", - "status": "success", - "sourceIndex": ".siem-signals-default-000002", - "version": 16, - "updated": "2021-01-06T22:05:56.859Z" - } - ] -} --------------------------------------------------- -Finalized migrations will show a response of `completed: true`, with a corresponding `status`. If the migration is still running when you attempt to finalize it, its response will show as `completed: false`. - -[float] -[[migration-4]] -=== Migration cleanup - -Migrations favor data integrity over shard size. Consequently, unused or orphaned indices are artifacts of the migration process. A successful migration will result in both the old and new indices being present. As such, the old, orphaned index can (and likely should) be deleted. - -While you can delete these indices manually, the endpoint accomplishes this task by applying a deletion policy to the relevant index, causing it to be deleted after 30 days. It also deletes other artifacts specific to the migration implementation. - -[float] -==== Request - -`DELETE :/api/detection_engine/signals/migration` - -[float] -==== Request body - -[width="100%",options="header"] -|============================================== -|Name |Type |Description | Required - -|`migration_ids` |String[]|Array of `migration_id`s to finalize|Yes -|============================================== - -[float] -==== Response example - -[source,json] --------------------------------------------------- - { - "migrations": [ - { - "id": "924f7c50-505f-11eb-ae0a-3fa2e626a51d", - "destinationIndex": ".siem-signals-default-000002-r000016", - "status": "success", - "sourceIndex": ".siem-signals-default-000002", - "version": 16, - "updated": "2021-01-06T22:05:56.859Z" - } - ] -} --------------------------------------------------- -The response will include all migrations that were successfully deleted. diff --git a/docs/detections/building-block-rule.asciidoc b/docs/detections/building-block-rule.asciidoc deleted file mode 100644 index c4afa52d90..0000000000 --- a/docs/detections/building-block-rule.asciidoc +++ /dev/null @@ -1,34 +0,0 @@ -[[building-block-rule]] -[role="xpack"] -== About building block rules - -Create building block rules when you do not want to see their generated alerts -in the UI. This is useful when you want: - -* A record of low-risk alerts without producing noise in the Alerts table. -* Rules that execute on the alert indices (`.alerts-security.alerts-`). -You can then use building block rules to create hidden alerts that act as a -basis for an 'ordinary' rule to generate visible alerts. - -[float] -=== Set up rules that run on alert indices - -To create a rule that searches alert indices, in the *Index patterns* field, -add the index pattern for alert indices: - -[role="screenshot"] -image::images/alert-indices-ui.png[] - -[float] - -=== View building block alerts in the UI - -By default, building block alerts are excluded from the Overview and Alerts pages. -You can choose to include building block alerts on the Alerts page, which expands the number of alerts. - -. Go to *Alerts*. -. In the Alerts table, select *Additional filters* -> -*Include building block alerts*, located on the far-right. - -NOTE: On a building block rule details page, the rule's alerts are displayed (by -default, *Include building block alerts* is selected). diff --git a/docs/detections/detection-engine-intro.asciidoc b/docs/detections/detection-engine-intro.asciidoc deleted file mode 100644 index 8c3972c85c..0000000000 --- a/docs/detections/detection-engine-intro.asciidoc +++ /dev/null @@ -1,220 +0,0 @@ -[[detection-engine-overview]] -[role="xpack"] - -= Detections and alerts - -Use the detection engine to create and manage rules and view the alerts -these rules create. Rules periodically search indices (such as `logs-*` and -`filebeat-*`) for suspicious source events and create alerts when a rule's -conditions are met. When an alert is created, its status is `Open`. To help -track investigations, an alert's <> can be set as -`Open`, `Acknowledged`, or `Closed`. - -[role="screenshot"] -image::images/alert-page.png[Alerts page] - -In addition to creating <>, enable -<> to immediately start detecting -suspicious activity. For detailed information on all the prebuilt rules, see the -<> section. Once the prebuilt rules are loaded and -running, <> and <> explain -how to modify the rules to reduce false positives and get a better set of -actionable alerts. You can also use exceptions and value lists when creating or -modifying your own rules. - -There are two special prebuilt rules you need to know about: - -* <>: -Automatically creates an alert from all incoming Elastic Endpoint alerts. To -receive Elastic Endpoint alerts, you must install the Endpoint agent on your -hosts (see <>). -+ -When this rule is enabled, the following Endpoint events are displayed as -detection alerts: -+ -** Malware Prevention Alert -** Malware Detection Alert -+ -NOTE: When you load the prebuilt rules, this is the only rule that is enabled -by default. - -* <>: Automatically creates an alert for -all incoming third-party system alerts (for example, Suricata alerts). - -If you want to receive notifications via external systems, such as Slack or -email, when alerts are created, use the {kib} -{kibana-ref}/alerting-getting-started.html[Alerting and Actions] framework. - -NOTE: To use {kib} Alerting for detection alert notifications, you need the -https://www.elastic.co/subscriptions[appropriate license]. - -After rules have started running, you can monitor their executions to verify -they are functioning correctly, as well as view, manage, and troubleshoot -alerts (see <> and <>). - -You can create and manage rules and alerts via the UI or the -<>. - -[IMPORTANT] -============== -To make sure you can access Detections and manage rules, see -<>. -============== - -[float] -[[cold-tier-detections]] -== Compatibility with cold tier nodes - -Cold tier is a {ref}/data-tiers.html[data tier] that holds time series data that is accessed only occasionally. In {stack} version >=7.11.0, {es-sec} supports cold tier data for the following {es} indices: - -* Index patterns specified in `securitySolution:defaultIndex` -* Index patterns specified in the definitions of detection rules, except for indicator match rules -* Index patterns specified in the data sources selector on various {es-sec-app} pages - -{es-sec} does *NOT* support cold tier data for the following {es} indices: - -* Index patterns controlled by {elastic-sec}, including alerts and list indices -* Index patterns specified in indicator match rules - -Using cold tier data for unsupported indices may result in detection rule timeouts and overall performance degradation. - -[float] -[[support-indicator-rules]] -== Limited support for indicator match rules - -Indicator match rules provide a powerful capability to search your security data; however, their queries can consume significant deployment resources. When creating an <>, we recommend limiting the time range of the indicator index query to the minimum period necessary for the desired rule coverage. For example, the default indicator index query `@timestamp > "now-30d/d"` searches specified indicator indices for indicators ingested during the past 30 days and rounds the query start time down to the nearest day (resolves to UTC `00:00:00`). Without this limitation, the rule will include all of the indicators in your indicator indices, which may extend the time it takes for the indicator index query to complete. - -In addition, the following support restrictions are in place: - -* {es-sec} does not support the use of frozen tier data with indicator match rules. -* The use of cross-cluster search with indicator match rules is not supported. -* Indicator match rules with an additional look-back time value greater than 24 hours are not supported. - -[float] -[[det-engine-terminology]] -== Terminology - -Actions:: -Sends notifications via other systems when a detection alert is created, such -as email, Slack, PagerDuty, and Webhook. - -[[detection-alert-def]] -Detection alerts:: -{es-sec} produced alerts. Detection alerts are never received from external -systems. When a rule's conditions are met, {es-sec} writes a detection alert to -an Elasticsearch alerts index. -+ -[NOTE] -============== -Detection alert indices are created for each {kib} space. The naming convention -is: `.alerts-security.alerts-`. For the default space, the alerts index is -named `.alerts-security.alerts-default`. -============== - -Detection rules:: -Background tasks that run periodically and produce alerts when suspicious -activity is detected. - -[[term-sec-indices]] -{es-sec} indices:: -Indices containing host and network source events (such as -`packetbeat-*`, `log-*`, and `winlogbeat-*`). When you <>, the default index pattern corresponds to the <> in the `securitySolution:defaultIndex`. - -Endpoint exceptions:: -<> added to both rules and Endpoint agents on -hosts. Endpoint exceptions can only be added when: - -* Endpoint agents are installed on the hosts. -* The Elastic Endpoint Security rule is activated. - -[[term-exceptions]] -Exceptions:: -Added to rules to prevent specific source event field values from generating -alerts. - -External alerts:: -Alerts {es-sec} receives from external systems, such as Suricata. - -Indicator indices:: -Indices containing suspect field values. <> use these -indices to compare their field values with source event values contained in -<>. - -[float] -[[detections-permissions]] -== Detections configuration and index privilege prerequisites - -<> provides detailed information on all the -permissions required to initiate and use the Detections feature. - -[discrete] -[[malware-prevention]] -== Malware prevention - -Malware, short for malicious software, is any software program designed to damage or execute unauthorized actions on a -computer system. Examples of malware include viruses, worms, Trojan horses, adware, scareware, and spyware. Some -malware, such as viruses, can severely damage a computer's hard drive by deleting files or directory information. Other -malware, such as spyware, can obtain user data without their knowledge. - -Malware may be stealthy and appear as legitimate executable code, scripts, active content, and other software. It is also -often embedded in non-malicious files, non-suspicious websites, and standard programs — sometimes making the root -source difficult to identify. If infected and not resolved promptly, malware can cause irreparable damage to a computer -network. - -For information on how to enable malware protection on your host, see <>. - -[discrete] -[[machine-learning-model]] -=== Machine learning model - -To determine if a file is malicious or benign, a machine learning model looks for static attributes of files (without executing -the file) that include file structure, layout, and content. This includes information such as file header data, imports, exports, -section names, and file size. These attributes are extracted from millions of benign and malicious file samples, which then -are passed to a machine-learning algorithm that distinguishes a benign file from a malicious one. The machine learning -model is updated as new data is procured and analyzed. - -[discrete] -=== Threshold - -A malware threshold determines the action the agent should take if malware is detected. The Elastic Agent uses a recommended threshold level that generates a balanced number of alerts with a low probability of undetected malware. This threshold also minimizes the number of false positive alerts. - -[discrete] -[[ransomware-prevention]] -== Ransomware prevention - -Ransomware is computer malware that installs discreetly on a user's computer and encrypts data until a specified amount of money (ransom) is paid. Ransomware is usually similar to other malware in its delivery and execution, infecting systems -through spear-phishing or drive-by downloads. If not resolved immediately, ransomware can cause irreparable damage to an entire computer network. - -Behavioral ransomware prevention on the Elastic Endpoint detects and stops ransomware attacks on Windows systems by analyzing data from low-level system processes, and is effective across an array of widespread ransomware families — including those targeting the system’s master boot record. - -For information on how to enable ransomware protection on your host, see <>. - -NOTE: Ransomware prevention is a paid feature and is enabled by default if you have a https://www.elastic.co/pricing[Platinum or Enterprise license]. - -[float] -=== Resolve UI error messages - -Depending on your privileges and whether detection system indices have already -been created for the {kib} space, you might get one of these error messages when you -open the *Alerts* or *Rules* page: - -* *`Let’s set up your detection engine`* -+ -If you get this message, a user with specific privileges must visit the -*Alerts* or *Rules* page before you can view detection alerts and rules. -Refer to <> for a list of all the requirements. -+ -NOTE: For *self-managed* {stack} deployments only, this message may be displayed -when the -<> -setting has not been added to the `kibana.yml` file. For more information, refer to <>. - -* *`Detection engine permissions required`* -+ -If you get this message, you do not have the -<> to view the *Detections* feature, -and you should contact your {kib} administrator. -+ -NOTE: For *self-managed* {stack} deployments only, this message may be -displayed when the <> -setting is not enabled in the `elasticsearch.yml` file. For more information, refer to <>. diff --git a/docs/detections/detections-index.asciidoc b/docs/detections/detections-index.asciidoc deleted file mode 100644 index e5935dd5cc..0000000000 --- a/docs/detections/detections-index.asciidoc +++ /dev/null @@ -1,41 +0,0 @@ -include::machine-learning/machine-learning.asciidoc[] - -include::machine-learning/tune-anomaly-results.asciidoc[] - -include::detection-engine-intro.asciidoc[] - -include::rules-ui-create.asciidoc[] - -include::rules-ui-manage.asciidoc[] - -include::rules-ui-monitor.asciidoc[] - -include::detections-ui-exceptions.asciidoc[] - -include::building-block-rule.asciidoc[] - -include::alerts-ui-manage.asciidoc[] - -include::alerts-visualizations.asciidoc[leveloffset=+1] - -include::alerts-view-details.asciidoc[leveloffset=+1] - -include::alerts-add-to-cases.asciidoc[leveloffset=+1] - -include::alerts-run-osquery.asciidoc[] - -include::visual-event-analyzer.asciidoc[] - -include::session-view.asciidoc[] - -include::query-alert-indices.asciidoc[] - -include::prebuilt-rules/tune-rule-signals.asciidoc[] - -include::prebuilt-rules/prebuilt-rules-changelog.asciidoc[] - -include::prebuilt-rules/prebuilt-rules-reference.asciidoc[] - -include::prebuilt-rules/rule-desc-index.asciidoc[] - -include::prebuilt-rules/prebuilt-rules-downloadable-updates.asciidoc[] diff --git a/docs/detections/detections-ui-exceptions.asciidoc b/docs/detections/detections-ui-exceptions.asciidoc deleted file mode 100644 index 6e3a84e564..0000000000 --- a/docs/detections/detections-ui-exceptions.asciidoc +++ /dev/null @@ -1,312 +0,0 @@ -[[detections-ui-exceptions]] -[role="xpack"] -== Rule exceptions and value lists - -To prevent the creation of unwanted alerts, you can add exceptions to any rule. Exceptions contain the source event conditions that determine when -alerts are not generated. They provide a convenient way of allowing trusted -processes and network activity to function without producing unnecessary noise. - -You can add multiple exceptions to one rule. - -In addition to defining exception queries for source event values, you can use rule -exceptions with value lists. Value lists are lists of items with -the same {es} {ref}/mapping-types.html[data type]. You can create value lists -with these types: - -* `Keywords` (many {ecs-ref}/ecs-field-reference.html[ECS fields] are keywords) -* `IP Addresses` -* `IP Ranges` -* `Text` - -After creating value lists, you can use `is in list` and `is not in list` -operators to define exceptions. - -IMPORTANT: Operators `is in list` and `is not in list` are not available for -threshold and event correlation rules. - -TIP: You can also use value lists as the <> when creating an indicator match rule. - -[float] -[[manage-value-lists]] -== Create value lists - -To create a value list: - -. Prepare a `txt` or `csv` file with all the values you want to use for -determining exceptions from a single list. If you use a `txt` file, new lines -act as value delimiters. -+ -[IMPORTANT] -========================= -* All values in the file must be of the same {es} type. - -* Wildcards are not supported in rule exceptions or value lists. Values must be literal values. -========================= - -. Go to *Manage* -> *Rules*. -. Click *Import value lists*. The *Import value lists* window opens. -+ -[role="screenshot"] -image::images/upload-lists-ui.png[Import value lists flyout,75%] - -. Select the list type (*Keywords*, *IP addresses*, *IP ranges*, or *Text*) from the *Type of value list* drop-down. -. Drag or select the `csv` or `txt` file that contains the values. -. Click *Import list*. - -NOTE: When the name of the file you are importing already exists, the values in -the new file are appended to the previously imported values. - -[[edit-value-lists]] -[discrete] -=== Manage value lists - -To view, delete, or export existing value lists: - -. Go to *Manage* -> *Rules*. -. Click *Import value lists*. The *Import value lists* window opens. -. In the *Value lists* table, click the required action button. -+ -[role="screenshot"] -image::images/manage-value-list.png[Import value list flyout with action buttons highlighted,75%] - -[float] -[[detection-rule-exceptions]] -=== Add exceptions to a rule - -You can add exceptions to a rule from the rule details page or the Alerts table. -When you add an exception, you can also close all alerts that meet the -exception's criteria. - -[IMPORTANT] -============== -* To ensure an exception is successfully applied, make sure that the fields you've defined for the exception query are correctly and consistently mapped in their respective indices. Refer to {ecs-ref}[ECS] to learn more about supported mappings. - -* Be careful when adding exceptions to <> rules. Exceptions are evaluated against every event in the sequence, and when the exception matches _all_ event(s) in the sequence, alerts _are not_ generated. If the exception only matches _some_ of the events in the sequence, alerts _are_ generated. -+ -To exclude values from a -specific event in the sequence, update the rule's EQL statement. For example: -+ -[source,eql] ----- -`sequence - [file where file.extension == "exe" - and file.name != "app-name.exe"] - [process where true - and process.name != "process-name.exe"]` ----- -============== - -. Do one of the following: -+ --- -* To add an exception from the rule details page: -.. Go to the rule details page of the rule to which you want to add an -exception (*Manage* -> *Rules* -> *__*). -.. Scroll down below the rule details and select the *Exceptions* tab. -+ -[role="screenshot"] -image::images/exception-histogram.png[Detail of Exceptions tab, 75%] -.. Click *Add new exception* -> *Add rule exception*. - -* To add an exception from the Alerts table: -.. Go to *Alerts*. -.. Scroll down to the Alerts table, go to the alert you want to create an exception for, click the *More Actions* menu (*...*), then select *Add rule exception*. - -The *Add Rule Exception* flyout opens (the example below was opened from the Alerts table): --- -+ -[role="screenshot"] -image::images/add-exception-ui.png[] -. Use the following settings to add conditions that define when the exception prevents alerts. In the example above, the exception prevents the rule from generating alerts when the -`svchost.exe` process runs on agent hostname `siem-kibana`. - - .. *Field*: Select a field to identify the event being filtered. - - .. *Operator*: Select an operator to define the condition: - * `is` | `is not` — Must be an exact match of the defined value. - * `is one of` | `is not one of` — Matches any of the defined values. - * `exists` | `does not exist` — The field exists. - * `is in list` | `is not in list` — Matches values in a value list. -+ -[NOTE] -======= -* An exception defined by a value list must use `is in list` or `is not in list` in all conditions. -* Wildcards are not supported in value lists. -======= - * `matches` | `does not match` — Allows you to use wildcards in *Value*, such as `C:\path\*\app.exe`. Available wildcards are `?` (match one character) and `*` (match zero or more characters). The selected *Field* data type must be {ref}/keyword.html#keyword-field-type[keyword], {ref}/text.html#text-field-type[text], or {ref}/keyword.html#wildcard-field-type[wildcard]. -+ -IMPORTANT: Using wildcards can impact performance. To create a more efficient exception using wildcards, use multiple conditions and make them as specific as possible. For example, adding conditions using `process.name` or `file.name` can help limit the scope of wildcard matching. - - .. *Value*: Enter the value associated with the *Field*. To enter multiple values (when using `is one of` or `is not one of`), enter each value, then press **Return**. - -. Click *AND* or *OR* to create multiple conditions and define their relationships. - -. Click *Add nested condition* to create conditions using nested fields. This is only required for -<>. For all other fields, nested conditions should not be used. - -. (Optional) Enter a comment describing the exception. - -. Select one of the following alert actions: - -* *Close this alert*: Closes the alert when the exception is added. This option -is only available when adding exceptions from the Alerts table. -* *Close all alerts that match this exception and were generated by this rule*: -Closes all alerts that match the exception's conditions and were generated only by the current rule. -+ -. Click *Add Rule Exception*. - -[float] -[[endpoint-rule-exceptions]] -=== Add {elastic-endpoint} exceptions - -Like detection rule exceptions, you can add Endpoint agent exceptions either by editing the Elastic Endpoint Security rule or by adding them as an action on alerts generated by the Endpoint Security rule. {elastic-endpoint} alerts have the following fields: - -* `kibana.alert.original_event.module determined:endpoint` -* `kibana.alert.original_event.kind:alert` - -You can also add Endpoint exceptions to rules that are associated with {elastic-endpoint} rule exceptions. To associate rules, when creating or editing a rule, select the <> option. - -[IMPORTANT] -===== -When you add an exception to the -<> rule, you can select to -add the exception to the endpoint. When selected, the exception is added to -both the detection rule *and* the {elastic-endpoint} agent on your hosts. - -{ref}/binary.html[Binary fields] are not supported in detection rule exceptions. -===== - -[IMPORTANT] -============= -Exceptions added to the Elastic Endpoint Security rule affect all alerts sent -from the Endpoint agent. Be careful not to unintentionally prevent some Endpoint -alerts. - -Additionally, to add an Endpoint exception to the Elastic Endpoint Security rule, there must be at least one Endpoint Security alert generated in the system. For non-production use, if no alerts exist, you can trigger a test alert using malware emulation techniques or tools such as the Anti Malware Testfile from the https://www.eicar.org/[European Institute for Computer Anti-Virus Research (EICAR)]. -============= - -. Do one of the following: -+ --- -* To add an Endpoint exception from the rule details page: -.. Go to the rule details page (*Manage* -> *Rules*), and then search for and select the Elastic *Endpoint Security* rule. -.. Scroll down to the *Trend* histogram and select the *Exceptions* tab. -.. Click *Add new exception* -> *Add Endpoint exception*. -* To add an Endpoint exception from the Alerts table: -.. Go to *Alerts*. -.. Scroll down to the Alerts table, and from an {elastic-endpoint} -alert, click the *More actions* menu (*...*), then select *Add Endpoint exception*. --- -+ -The *Add Endpoint Exception* flyout opens, from either the rule details page or the Alerts table. -+ -[role="screenshot"] -image::images/endpoint-add-exp.png[] -. If required, modify the conditions. -+ -NOTE: Refer to <> for more information on when nested conditions are required. - -. You can select any of the following: - -* *Close this alert*: Closes the alert when the exception is added. This option -is only available when adding exceptions from the Alerts table. -* *Close all alerts that match this exception and were generated by this rule*: -Closes all alerts that match the exception's conditions. - -. Click *Add Endpoint Exception*. An exception is created for both the detection rule and the {elastic-endpoint}. - -[float] -[[ex-nested-conditions]] -=== Exceptions with nested conditions - -Some Endpoint objects contain nested fields, and the only way to ensure you are -excluding the correct fields is with nested conditions. One example is the -`process.Ext` object: - -[source, json] --------------------------------------------------- -{ - "ancestry": [], - "code_signature": { - "trusted": true, - "subject_name": "LFC", - "exists": true, - "status": "trusted" - }, - "user": "WDAGUtilityAccount", - "token": { - "elevation": true, - "integrity_level_name": "high", - "domain": "27FB305D-3838-4", - "user": "WDAGUtilityAccount", - "elevation_type": "default", - "sid": "S-1-5-21-2047949552-857980807-821054962-504" - } -} --------------------------------------------------- - - -TIP: `code_signature.subject_name` refers to the process signature not the -process name. - -[[nested-field-list]] -Only these objects require nested conditions to ensure the exception functions -correctly: - -* `Endpoint.policy.applied.artifacts.global.identifiers` -* `Endpoint.policy.applied.artifacts.user.identifiers` -* `Target.dll.Ext.code_signature` -* `Target.process.Ext.code_signature` -* `Target.process.Ext.token.privileges` -* `Target.process.parent.Ext.code_signature` -* `Target.process.thread.Ext.token.privileges` -* `dll.Ext.code_signature` -* `file.Ext.code_signature` -* `file.Ext.macro.errors` -* `file.Ext.macro.stream` -* `process.Ext.code_signature` -* `process.Ext.token.privileges` -* `process.parent.Ext.code_signature` -* `process.thread.Ext.token.privileges` - - -[discrete] -==== Nested condition example - -Creates an exception that excludes all LFC-signed trusted processes: - -[role="screenshot"] -image::images/nested-exp.png[] - -[float] -[[manage-exceptions]] -=== View and manage exception lists - -The Exception lists table enables you to view and manage all exceptions that have been assigned to rules. To view the Exception lists table, go to *Manage* -> *Exception lists*. - -[role="screenshot"] -image::images/exceptions-page.png[] - -Exceptions are automatically grouped into exception lists. The table displays each exception list on an individual row, with the most recently created list at the top. Each row contains information such as the name of the rule to which the exception list is assigned, the dates when the list was created and last edited, and options to export or delete it. - -TIP: To view details of the rule the exception list is assigned to, click the link in the `Rules assigned to` column. - -To filter exception lists by a specific value, enter a query in the https://elastic.github.io/eui/#/forms/search-bar[Search bar]. You can search the following attributes: - -* `name` -* `list_id` -* `created_by` -* `type` -* `tags` - -If no attribute is selected, the app searches the list name by default. - -To export or delete an exception list, select the required action button on the appropriate list. Note that: - -* Exception lists are exported to `.ndjson` files. -* Exception lists are also exported as part of any exported detection rules configured with exceptions. Refer to <>. -* If an exception list is linked to any rules, you'll get a warning asking you to confirm the deletion. If no rules are linked, the list is deleted without confirmation. - -[role="screenshot"] -image::images/actions-exception-list.png[Detail of Exception lists table with export and delete buttons highlighted,400] - diff --git a/docs/detections/images/about-rule-pane.png b/docs/detections/images/about-rule-pane.png deleted file mode 100644 index f3a11705f4..0000000000 Binary files a/docs/detections/images/about-rule-pane.png and /dev/null differ diff --git a/docs/detections/images/actions-exception-list.png b/docs/detections/images/actions-exception-list.png deleted file mode 100644 index 40f6b9da13..0000000000 Binary files a/docs/detections/images/actions-exception-list.png and /dev/null differ diff --git a/docs/detections/images/add-alert-to-case.gif b/docs/detections/images/add-alert-to-case.gif deleted file mode 100644 index 5141258e0a..0000000000 Binary files a/docs/detections/images/add-alert-to-case.gif and /dev/null differ diff --git a/docs/detections/images/add-alert-to-existing-case.png b/docs/detections/images/add-alert-to-existing-case.png deleted file mode 100644 index 6d963936c6..0000000000 Binary files a/docs/detections/images/add-alert-to-existing-case.png and /dev/null differ diff --git a/docs/detections/images/add-alert-to-new-case.png b/docs/detections/images/add-alert-to-new-case.png deleted file mode 100644 index 622c6aba7a..0000000000 Binary files a/docs/detections/images/add-alert-to-new-case.png and /dev/null differ diff --git a/docs/detections/images/add-exception-ui.png b/docs/detections/images/add-exception-ui.png deleted file mode 100644 index 8768507e12..0000000000 Binary files a/docs/detections/images/add-exception-ui.png and /dev/null differ diff --git a/docs/detections/images/additional-filters.png b/docs/detections/images/additional-filters.png deleted file mode 100644 index d21a162c12..0000000000 Binary files a/docs/detections/images/additional-filters.png and /dev/null differ diff --git a/docs/detections/images/alert-change-status.gif b/docs/detections/images/alert-change-status.gif deleted file mode 100644 index 1f1338d212..0000000000 Binary files a/docs/detections/images/alert-change-status.gif and /dev/null differ diff --git a/docs/detections/images/alert-details-flyout.png b/docs/detections/images/alert-details-flyout.png deleted file mode 100644 index 096f0410b6..0000000000 Binary files a/docs/detections/images/alert-details-flyout.png and /dev/null differ diff --git a/docs/detections/images/alert-indices-ui.png b/docs/detections/images/alert-indices-ui.png deleted file mode 100644 index cb79c92495..0000000000 Binary files a/docs/detections/images/alert-indices-ui.png and /dev/null differ diff --git a/docs/detections/images/alert-page-visualizations.png b/docs/detections/images/alert-page-visualizations.png deleted file mode 100644 index d03da894e8..0000000000 Binary files a/docs/detections/images/alert-page-visualizations.png and /dev/null differ diff --git a/docs/detections/images/alert-page.png b/docs/detections/images/alert-page.png deleted file mode 100644 index 54244edc8a..0000000000 Binary files a/docs/detections/images/alert-page.png and /dev/null differ diff --git a/docs/detections/images/alert-pill.png b/docs/detections/images/alert-pill.png deleted file mode 100644 index 047844e1b7..0000000000 Binary files a/docs/detections/images/alert-pill.png and /dev/null differ diff --git a/docs/detections/images/alert-table-columns-and-size.gif b/docs/detections/images/alert-table-columns-and-size.gif deleted file mode 100644 index 36db2d336a..0000000000 Binary files a/docs/detections/images/alert-table-columns-and-size.gif and /dev/null differ diff --git a/docs/detections/images/alert-table-toolbar-buttons.png b/docs/detections/images/alert-table-toolbar-buttons.png deleted file mode 100644 index fdb6deaee5..0000000000 Binary files a/docs/detections/images/alert-table-toolbar-buttons.png and /dev/null differ diff --git a/docs/detections/images/alerts-viz-table.png b/docs/detections/images/alerts-viz-table.png deleted file mode 100644 index 4ae16a4f3f..0000000000 Binary files a/docs/detections/images/alerts-viz-table.png and /dev/null differ diff --git a/docs/detections/images/alerts-viz-treemap.png b/docs/detections/images/alerts-viz-treemap.png deleted file mode 100644 index 52c7126c84..0000000000 Binary files a/docs/detections/images/alerts-viz-treemap.png and /dev/null differ diff --git a/docs/detections/images/alerts-viz-trend.png b/docs/detections/images/alerts-viz-trend.png deleted file mode 100644 index 3651223b7f..0000000000 Binary files a/docs/detections/images/alerts-viz-trend.png and /dev/null differ diff --git a/docs/detections/images/all-rules.png b/docs/detections/images/all-rules.png deleted file mode 100644 index a663d866c9..0000000000 Binary files a/docs/detections/images/all-rules.png and /dev/null differ diff --git a/docs/detections/images/analyze-event-button.png b/docs/detections/images/analyze-event-button.png deleted file mode 100644 index 4c4e122ef1..0000000000 Binary files a/docs/detections/images/analyze-event-button.png and /dev/null differ diff --git a/docs/detections/images/analyze-event-timeline.png b/docs/detections/images/analyze-event-timeline.png deleted file mode 100644 index 63ec738c2a..0000000000 Binary files a/docs/detections/images/analyze-event-timeline.png and /dev/null differ diff --git a/docs/detections/images/analyze-event-view.png b/docs/detections/images/analyze-event-view.png deleted file mode 100644 index cedad385fb..0000000000 Binary files a/docs/detections/images/analyze-event-view.png and /dev/null differ diff --git a/docs/detections/images/analyze-event.png b/docs/detections/images/analyze-event.png deleted file mode 100644 index 20062e50e4..0000000000 Binary files a/docs/detections/images/analyze-event.png and /dev/null differ diff --git a/docs/detections/images/analyzer_KQL_query.png b/docs/detections/images/analyzer_KQL_query.png deleted file mode 100644 index 6fc2f7eab1..0000000000 Binary files a/docs/detections/images/analyzer_KQL_query.png and /dev/null differ diff --git a/docs/detections/images/available-action-types.png b/docs/detections/images/available-action-types.png deleted file mode 100644 index 94f700c7e6..0000000000 Binary files a/docs/detections/images/available-action-types.png and /dev/null differ diff --git a/docs/detections/images/create-new-rule.png b/docs/detections/images/create-new-rule.png deleted file mode 100644 index c3308ca313..0000000000 Binary files a/docs/detections/images/create-new-rule.png and /dev/null differ diff --git a/docs/detections/images/customize-event-renderer-page.png b/docs/detections/images/customize-event-renderer-page.png deleted file mode 100644 index 93b8a08462..0000000000 Binary files a/docs/detections/images/customize-event-renderer-page.png and /dev/null differ diff --git a/docs/detections/images/customize-event-renderer.png b/docs/detections/images/customize-event-renderer.png deleted file mode 100644 index ed36b33378..0000000000 Binary files a/docs/detections/images/customize-event-renderer.png and /dev/null differ diff --git a/docs/detections/images/delete-list.png b/docs/detections/images/delete-list.png deleted file mode 100644 index 83f05bb84c..0000000000 Binary files a/docs/detections/images/delete-list.png and /dev/null differ diff --git a/docs/detections/images/detection-response-dashboard.png b/docs/detections/images/detection-response-dashboard.png deleted file mode 100644 index ae2e9cd18f..0000000000 Binary files a/docs/detections/images/detection-response-dashboard.png and /dev/null differ diff --git a/docs/detections/images/detections-ui.png b/docs/detections/images/detections-ui.png deleted file mode 100644 index 39efb0da80..0000000000 Binary files a/docs/detections/images/detections-ui.png and /dev/null differ diff --git a/docs/detections/images/discover-button-osquery.png b/docs/detections/images/discover-button-osquery.png deleted file mode 100644 index 599f3f3578..0000000000 Binary files a/docs/detections/images/discover-button-osquery.png and /dev/null differ diff --git a/docs/detections/images/document-summary-section.png b/docs/detections/images/document-summary-section.png deleted file mode 100644 index 774e72f77b..0000000000 Binary files a/docs/detections/images/document-summary-section.png and /dev/null differ diff --git a/docs/detections/images/endpoint-add-exp.png b/docs/detections/images/endpoint-add-exp.png deleted file mode 100644 index f6af20df46..0000000000 Binary files a/docs/detections/images/endpoint-add-exp.png and /dev/null differ diff --git a/docs/detections/images/enriched-data-info-icon.png b/docs/detections/images/enriched-data-info-icon.png deleted file mode 100644 index 41712b9b1a..0000000000 Binary files a/docs/detections/images/enriched-data-info-icon.png and /dev/null differ diff --git a/docs/detections/images/eql-rule-query-example.png b/docs/detections/images/eql-rule-query-example.png deleted file mode 100644 index 91600ff923..0000000000 Binary files a/docs/detections/images/eql-rule-query-example.png and /dev/null differ diff --git a/docs/detections/images/eql-settings-icon.png b/docs/detections/images/eql-settings-icon.png deleted file mode 100644 index caa4b8e913..0000000000 Binary files a/docs/detections/images/eql-settings-icon.png and /dev/null differ diff --git a/docs/detections/images/event-details.png b/docs/detections/images/event-details.png deleted file mode 100644 index d474bb22e9..0000000000 Binary files a/docs/detections/images/event-details.png and /dev/null differ diff --git a/docs/detections/images/event-names.png b/docs/detections/images/event-names.png deleted file mode 100644 index c8dfc673a7..0000000000 Binary files a/docs/detections/images/event-names.png and /dev/null differ diff --git a/docs/detections/images/event-panel.png b/docs/detections/images/event-panel.png deleted file mode 100644 index cdd470a564..0000000000 Binary files a/docs/detections/images/event-panel.png and /dev/null differ diff --git a/docs/detections/images/event-rendered-view.png b/docs/detections/images/event-rendered-view.png deleted file mode 100644 index 018d1cbf03..0000000000 Binary files a/docs/detections/images/event-rendered-view.png and /dev/null differ diff --git a/docs/detections/images/event-type.png b/docs/detections/images/event-type.png deleted file mode 100644 index 13abf34abc..0000000000 Binary files a/docs/detections/images/event-type.png and /dev/null differ diff --git a/docs/detections/images/exception-histogram.png b/docs/detections/images/exception-histogram.png deleted file mode 100644 index d2bef9a51d..0000000000 Binary files a/docs/detections/images/exception-histogram.png and /dev/null differ diff --git a/docs/detections/images/exception-list.png b/docs/detections/images/exception-list.png deleted file mode 100644 index a2fe7f84aa..0000000000 Binary files a/docs/detections/images/exception-list.png and /dev/null differ diff --git a/docs/detections/images/exception-ui-query.png b/docs/detections/images/exception-ui-query.png deleted file mode 100644 index fa57bf056a..0000000000 Binary files a/docs/detections/images/exception-ui-query.png and /dev/null differ diff --git a/docs/detections/images/exceptions-page.png b/docs/detections/images/exceptions-page.png deleted file mode 100644 index 871c2b8906..0000000000 Binary files a/docs/detections/images/exceptions-page.png and /dev/null differ diff --git a/docs/detections/images/exceptions-ui-list.png b/docs/detections/images/exceptions-ui-list.png deleted file mode 100644 index f2ef6f5596..0000000000 Binary files a/docs/detections/images/exceptions-ui-list.png and /dev/null differ diff --git a/docs/detections/images/export-list.png b/docs/detections/images/export-list.png deleted file mode 100644 index f5f603de51..0000000000 Binary files a/docs/detections/images/export-list.png and /dev/null differ diff --git a/docs/detections/images/filter-icon.png b/docs/detections/images/filter-icon.png deleted file mode 100644 index fb75463d13..0000000000 Binary files a/docs/detections/images/filter-icon.png and /dev/null differ diff --git a/docs/detections/images/full-screen-analyzer.png b/docs/detections/images/full-screen-analyzer.png deleted file mode 100644 index a8f78cb27e..0000000000 Binary files a/docs/detections/images/full-screen-analyzer.png and /dev/null differ diff --git a/docs/detections/images/graphical-view.png b/docs/detections/images/graphical-view.png deleted file mode 100644 index 61c67e9dff..0000000000 Binary files a/docs/detections/images/graphical-view.png and /dev/null differ diff --git a/docs/detections/images/incompatible-field-mappings.png b/docs/detections/images/incompatible-field-mappings.png deleted file mode 100644 index 2f13fb75c9..0000000000 Binary files a/docs/detections/images/incompatible-field-mappings.png and /dev/null differ diff --git a/docs/detections/images/indicator-rule-example.png b/docs/detections/images/indicator-rule-example.png deleted file mode 100644 index c26fb98d51..0000000000 Binary files a/docs/detections/images/indicator-rule-example.png and /dev/null differ diff --git a/docs/detections/images/indicator_value_list.png b/docs/detections/images/indicator_value_list.png deleted file mode 100644 index bbc8f064eb..0000000000 Binary files a/docs/detections/images/indicator_value_list.png and /dev/null differ diff --git a/docs/detections/images/inline-actions-menu.gif b/docs/detections/images/inline-actions-menu.gif deleted file mode 100644 index 66a74a6890..0000000000 Binary files a/docs/detections/images/inline-actions-menu.gif and /dev/null differ diff --git a/docs/detections/images/insights-section.png b/docs/detections/images/insights-section.png deleted file mode 100644 index 7acc410143..0000000000 Binary files a/docs/detections/images/insights-section.png and /dev/null differ diff --git a/docs/detections/images/install-prebuilt-rules.png b/docs/detections/images/install-prebuilt-rules.png deleted file mode 100644 index 84b5ce514f..0000000000 Binary files a/docs/detections/images/install-prebuilt-rules.png and /dev/null differ diff --git a/docs/detections/images/install-prebuilt-settings.png b/docs/detections/images/install-prebuilt-settings.png deleted file mode 100644 index bfaef88d54..0000000000 Binary files a/docs/detections/images/install-prebuilt-settings.png and /dev/null differ diff --git a/docs/detections/images/kql-agent-type.png b/docs/detections/images/kql-agent-type.png deleted file mode 100644 index 2e5bec8530..0000000000 Binary files a/docs/detections/images/kql-agent-type.png and /dev/null differ diff --git a/docs/detections/images/lens-button-osquery.png b/docs/detections/images/lens-button-osquery.png deleted file mode 100644 index 92c79f0f20..0000000000 Binary files a/docs/detections/images/lens-button-osquery.png and /dev/null differ diff --git a/docs/detections/images/manage-value-list.png b/docs/detections/images/manage-value-list.png deleted file mode 100644 index 3da91109f5..0000000000 Binary files a/docs/detections/images/manage-value-list.png and /dev/null differ diff --git a/docs/detections/images/markdown-icon.png b/docs/detections/images/markdown-icon.png deleted file mode 100644 index b0f8c99433..0000000000 Binary files a/docs/detections/images/markdown-icon.png and /dev/null differ diff --git a/docs/detections/images/matched-indicator-sub-sec.png b/docs/detections/images/matched-indicator-sub-sec.png deleted file mode 100644 index 80e83dc8d2..0000000000 Binary files a/docs/detections/images/matched-indicator-sub-sec.png and /dev/null differ diff --git a/docs/detections/images/monitor-table.png b/docs/detections/images/monitor-table.png deleted file mode 100644 index 0d7096be09..0000000000 Binary files a/docs/detections/images/monitor-table.png and /dev/null differ diff --git a/docs/detections/images/more-action-button.png b/docs/detections/images/more-action-button.png deleted file mode 100644 index 4111b0322c..0000000000 Binary files a/docs/detections/images/more-action-button.png and /dev/null differ diff --git a/docs/detections/images/nested-exp.png b/docs/detections/images/nested-exp.png deleted file mode 100644 index f6af20df46..0000000000 Binary files a/docs/detections/images/nested-exp.png and /dev/null differ diff --git a/docs/detections/images/node-legend.png b/docs/detections/images/node-legend.png deleted file mode 100644 index 1e661673a2..0000000000 Binary files a/docs/detections/images/node-legend.png and /dev/null differ diff --git a/docs/detections/images/pack-expand-button-osquery.png b/docs/detections/images/pack-expand-button-osquery.png deleted file mode 100644 index 11e2015640..0000000000 Binary files a/docs/detections/images/pack-expand-button-osquery.png and /dev/null differ diff --git a/docs/detections/images/pack-query-results.png b/docs/detections/images/pack-query-results.png deleted file mode 100644 index b699db2e8c..0000000000 Binary files a/docs/detections/images/pack-query-results.png and /dev/null differ diff --git a/docs/detections/images/prebuilt-integration.png b/docs/detections/images/prebuilt-integration.png deleted file mode 100644 index cd178019b9..0000000000 Binary files a/docs/detections/images/prebuilt-integration.png and /dev/null differ diff --git a/docs/detections/images/preview-rule.png b/docs/detections/images/preview-rule.png deleted file mode 100644 index 052716a12d..0000000000 Binary files a/docs/detections/images/preview-rule.png and /dev/null differ diff --git a/docs/detections/images/process-details.png b/docs/detections/images/process-details.png deleted file mode 100644 index f3ff290ff1..0000000000 Binary files a/docs/detections/images/process-details.png and /dev/null differ diff --git a/docs/detections/images/process-list.png b/docs/detections/images/process-list.png deleted file mode 100644 index e68f76e4a0..0000000000 Binary files a/docs/detections/images/process-list.png and /dev/null differ diff --git a/docs/detections/images/process-schema.png b/docs/detections/images/process-schema.png deleted file mode 100644 index 9838ef4f69..0000000000 Binary files a/docs/detections/images/process-schema.png and /dev/null differ diff --git a/docs/detections/images/reason-section.png b/docs/detections/images/reason-section.png deleted file mode 100644 index 42ffa3c677..0000000000 Binary files a/docs/detections/images/reason-section.png and /dev/null differ diff --git a/docs/detections/images/risk-source-field-ui.png b/docs/detections/images/risk-source-field-ui.png deleted file mode 100644 index 3d83e00956..0000000000 Binary files a/docs/detections/images/risk-source-field-ui.png and /dev/null differ diff --git a/docs/detections/images/rule-actions.png b/docs/detections/images/rule-actions.png deleted file mode 100644 index e2f38794ee..0000000000 Binary files a/docs/detections/images/rule-actions.png and /dev/null differ diff --git a/docs/detections/images/rule-details-prerequisites.png b/docs/detections/images/rule-details-prerequisites.png deleted file mode 100644 index 3579ac86c2..0000000000 Binary files a/docs/detections/images/rule-details-prerequisites.png and /dev/null differ diff --git a/docs/detections/images/rule-execution-logs.png b/docs/detections/images/rule-execution-logs.png deleted file mode 100644 index c97b77e40b..0000000000 Binary files a/docs/detections/images/rule-execution-logs.png and /dev/null differ diff --git a/docs/detections/images/rule-query-example.png b/docs/detections/images/rule-query-example.png deleted file mode 100644 index 98262d75f2..0000000000 Binary files a/docs/detections/images/rule-query-example.png and /dev/null differ diff --git a/docs/detections/images/rule-start-ml-job.png b/docs/detections/images/rule-start-ml-job.png deleted file mode 100644 index 01f5ebdee6..0000000000 Binary files a/docs/detections/images/rule-start-ml-job.png and /dev/null differ diff --git a/docs/detections/images/rules-table-related-integrations.png b/docs/detections/images/rules-table-related-integrations.png deleted file mode 100644 index d79e6ddd3f..0000000000 Binary files a/docs/detections/images/rules-table-related-integrations.png and /dev/null differ diff --git a/docs/detections/images/saved-query-menu.png b/docs/detections/images/saved-query-menu.png deleted file mode 100644 index 9d52b932ec..0000000000 Binary files a/docs/detections/images/saved-query-menu.png and /dev/null differ diff --git a/docs/detections/images/schedule-rule.png b/docs/detections/images/schedule-rule.png deleted file mode 100644 index 1a856cac48..0000000000 Binary files a/docs/detections/images/schedule-rule.png and /dev/null differ diff --git a/docs/detections/images/selected-action-type.png b/docs/detections/images/selected-action-type.png deleted file mode 100644 index c976231703..0000000000 Binary files a/docs/detections/images/selected-action-type.png and /dev/null differ diff --git a/docs/detections/images/session-view-action-icon-detail.png b/docs/detections/images/session-view-action-icon-detail.png deleted file mode 100644 index 4646f7e454..0000000000 Binary files a/docs/detections/images/session-view-action-icon-detail.png and /dev/null differ diff --git a/docs/detections/images/session-view-exec-user-change-badge.png b/docs/detections/images/session-view-exec-user-change-badge.png deleted file mode 100644 index f95707bd1e..0000000000 Binary files a/docs/detections/images/session-view-exec-user-change-badge.png and /dev/null differ diff --git a/docs/detections/images/session-view-hosts-page-sessions-tab-labeled.png b/docs/detections/images/session-view-hosts-page-sessions-tab-labeled.png deleted file mode 100644 index 5c8a296218..0000000000 Binary files a/docs/detections/images/session-view-hosts-page-sessions-tab-labeled.png and /dev/null differ diff --git a/docs/detections/images/session-view-script-button.png b/docs/detections/images/session-view-script-button.png deleted file mode 100644 index 9ddea9446e..0000000000 Binary files a/docs/detections/images/session-view-script-button.png and /dev/null differ diff --git a/docs/detections/images/session-view-terminal-labeled.png b/docs/detections/images/session-view-terminal-labeled.png deleted file mode 100644 index 13c73238c7..0000000000 Binary files a/docs/detections/images/session-view-terminal-labeled.png and /dev/null differ diff --git a/docs/detections/images/setup-query.png b/docs/detections/images/setup-query.png deleted file mode 100644 index b4c8b1c4da..0000000000 Binary files a/docs/detections/images/setup-query.png and /dev/null differ diff --git a/docs/detections/images/severity-mapping-ui.png b/docs/detections/images/severity-mapping-ui.png deleted file mode 100644 index 9d65e46de2..0000000000 Binary files a/docs/detections/images/severity-mapping-ui.png and /dev/null differ diff --git a/docs/detections/images/single-query-results.png b/docs/detections/images/single-query-results.png deleted file mode 100644 index 963efdf438..0000000000 Binary files a/docs/detections/images/single-query-results.png and /dev/null differ diff --git a/docs/detections/images/table-view-options.png b/docs/detections/images/table-view-options.png deleted file mode 100644 index acc988b01d..0000000000 Binary files a/docs/detections/images/table-view-options.png and /dev/null differ diff --git a/docs/detections/images/threat-intel-sub-sec.png b/docs/detections/images/threat-intel-sub-sec.png deleted file mode 100644 index 92d70a0d93..0000000000 Binary files a/docs/detections/images/threat-intel-sub-sec.png and /dev/null differ diff --git a/docs/detections/images/threat-math-rule-query-example.png b/docs/detections/images/threat-math-rule-query-example.png deleted file mode 100644 index 2040ffd6c6..0000000000 Binary files a/docs/detections/images/threat-math-rule-query-example.png and /dev/null differ diff --git a/docs/detections/images/three-dot-icon.png b/docs/detections/images/three-dot-icon.png deleted file mode 100644 index 2f106edb7c..0000000000 Binary files a/docs/detections/images/three-dot-icon.png and /dev/null differ diff --git a/docs/detections/images/timeline-button-osquery.png b/docs/detections/images/timeline-button-osquery.png deleted file mode 100644 index 61186c09eb..0000000000 Binary files a/docs/detections/images/timeline-button-osquery.png and /dev/null differ diff --git a/docs/detections/images/timeline-button.png b/docs/detections/images/timeline-button.png deleted file mode 100644 index 3fc4ef7d22..0000000000 Binary files a/docs/detections/images/timeline-button.png and /dev/null differ diff --git a/docs/detections/images/timestamp-override.png b/docs/detections/images/timestamp-override.png deleted file mode 100644 index 615a7db008..0000000000 Binary files a/docs/detections/images/timestamp-override.png and /dev/null differ diff --git a/docs/detections/images/treemap-click.gif b/docs/detections/images/treemap-click.gif deleted file mode 100644 index bb5b96dac4..0000000000 Binary files a/docs/detections/images/treemap-click.gif and /dev/null differ diff --git a/docs/detections/images/upload-lists-ui.png b/docs/detections/images/upload-lists-ui.png deleted file mode 100644 index 3297c4d0d3..0000000000 Binary files a/docs/detections/images/upload-lists-ui.png and /dev/null differ diff --git a/docs/detections/images/view-alert-details.png b/docs/detections/images/view-alert-details.png deleted file mode 100644 index b777b0d25b..0000000000 Binary files a/docs/detections/images/view-alert-details.png and /dev/null differ diff --git a/docs/detections/machine-learning/images/cloned-job-details.png b/docs/detections/machine-learning/images/cloned-job-details.png deleted file mode 100644 index d331277668..0000000000 Binary files a/docs/detections/machine-learning/images/cloned-job-details.png and /dev/null differ diff --git a/docs/detections/machine-learning/images/filter-add-item.png b/docs/detections/machine-learning/images/filter-add-item.png deleted file mode 100644 index 004380ad3a..0000000000 Binary files a/docs/detections/machine-learning/images/filter-add-item.png and /dev/null differ diff --git a/docs/detections/machine-learning/images/ml-rule-threshold.png b/docs/detections/machine-learning/images/ml-rule-threshold.png deleted file mode 100644 index 98b1beeeeb..0000000000 Binary files a/docs/detections/machine-learning/images/ml-rule-threshold.png and /dev/null differ diff --git a/docs/detections/machine-learning/images/ml-ui.png b/docs/detections/machine-learning/images/ml-ui.png deleted file mode 100644 index 38175f899a..0000000000 Binary files a/docs/detections/machine-learning/images/ml-ui.png and /dev/null differ diff --git a/docs/detections/machine-learning/images/rule-scope.png b/docs/detections/machine-learning/images/rule-scope.png deleted file mode 100644 index 5179ea992d..0000000000 Binary files a/docs/detections/machine-learning/images/rule-scope.png and /dev/null differ diff --git a/docs/detections/machine-learning/images/start-job-window.png b/docs/detections/machine-learning/images/start-job-window.png deleted file mode 100644 index 12c63d0be6..0000000000 Binary files a/docs/detections/machine-learning/images/start-job-window.png and /dev/null differ diff --git a/docs/detections/machine-learning/machine-learning.asciidoc b/docs/detections/machine-learning/machine-learning.asciidoc deleted file mode 100644 index 93eb30cab0..0000000000 --- a/docs/detections/machine-learning/machine-learning.asciidoc +++ /dev/null @@ -1,71 +0,0 @@ -[[machine-learning]] -[role="xpack"] -= Anomaly Detection with Machine Learning - -{ml-docs}/ml-ad-overview.html[{ml-cap}] functionality is available when -you have the appropriate subscription, are using a *{ess-trial}[cloud deployment]*, -or are testing out a *Free Trial*. Refer to <>. - -You can view the details of detected anomalies within the `Anomalies` table -widget shown on the Hosts, Network, and associated details pages, or even narrow -to the specific date range of an anomaly from the `Max anomaly score by job` field -in the overview of the details pages for hosts and IPs. These interfaces also -offer the ability to drag and drop details of the anomaly to Timeline, such as -the `Entity` itself, or any of the associated `Influencers`. - - -[float] -[[manage-jobs]] -== Manage machine learning jobs -For users with the `machine_learning_admin` role, the `ML job settings` -interface on the *Alerts*, *Rules*, and *Exception lists* pages can be used for for viewing, starting, and stopping {es-sec} machine learning jobs. - -[role="screenshot"] -image::images/ml-ui.png[] - -TIP: To add a custom job to the `ML job settings` interface, add `Security` to -the job's `Groups` field (*{kib}* -> *{ml-cap}* -> *Create/Edit job* -> *Job -details*). - -[float] -[[included-jobs]] -=== Prebuilt jobs - -{es-sec} comes with prebuilt {ml} {anomaly-jobs} for automatically detecting -host and network anomalies. The jobs are displayed in the `Anomaly Detection` -interface. They are available when either: - -* You ship data using https://www.elastic.co/products/beats[Beats] or the -<>, and {kib} is configured with the required index -patterns (such as `auditbeat-*`, `filebeat-*`, `packetbeat-*`, or `winlogbeat-*` -in *{kib}* -> *{stack-manage-app}* -> *Data Views*). - -Or - -* Your shipped data is ECS-compliant, and {kib} is configured with the shipped -data's index patterns in *{kib}* -> *{stack-manage-app}* -> *Data Views*. - -<> describes all available {ml} jobs and lists which ECS -fields are required on your hosts when you are not using {beats} or the {agent} -to ship your data. For information on tuning anomaly results to reduce the -number of false positives, see <>. - -NOTE: Machine learning jobs look back and analyze two weeks of historical data -prior to the time they are enabled. After jobs are enabled, they continuously -analyze incoming data. When jobs are stopped and restarted within the two-week -time frame, previously analyzed data is not processed again. - -[float] -[[view-anomalies]] -== View detected anomalies -To view the `Anomalies` table widget and `Max Anomaly Score By Job` details, -the user must have the `machine_learning_admin` or `machine_learning_user` role. - -NOTE: To adjust the `score` threshold that determines which anomalies are shown, -you can modify -*{kib}* -> *{stack-manage-app}* -> *Advanced Settings* -> *`securitySolution:defaultAnomalyScore`*. - -[[prebuilt-ml-jobs]] -== Prebuilt job reference - -include::{ml-dir}/anomaly-detection/ootb-ml-jobs-siem.asciidoc[tag=siem-jobs] diff --git a/docs/detections/machine-learning/tune-anomaly-results.asciidoc b/docs/detections/machine-learning/tune-anomaly-results.asciidoc deleted file mode 100644 index b922f8ef16..0000000000 --- a/docs/detections/machine-learning/tune-anomaly-results.asciidoc +++ /dev/null @@ -1,143 +0,0 @@ -[[tuning-anomaly-results]] -== Optimizing anomaly results - -To gain clearer insights into real threats, you can tune the anomaly results. The following procedures help to reduce the number of false positives: - -* <> -* <> - -[float] -[[rarely-used-processes]] -=== Filter out anomalies from rarely used applications and processes - -When anomalies include results from a known process that only runs occasionally, -you can filter out the unwanted results. - -For example, to filter out results from a housekeeping process, named -`maintenanceservice.exe`, that only executes occasionally you need to: - -. <> -. <> -. <> (optional) - -[float] -[[create-fiter-list]] -==== Create a filter list - -. Go to *Machine Learning* -> *Anomaly Detection* -> *Settings*. -. Click *Filter Lists* and then *New*. -+ -The *Create new filter list* pane is displayed. -. Enter a filter list ID. -. Enter a description for the filter list (optional). -. Click *Add item*. -. In the *Items* textbox, enter the name of the process for which you want to -filter out anomaly results (`maintenanceservice.exe` in our example). -+ -[role="screenshot"] -image::filter-add-item.png[] -. Click *Add* and then *Save*. -+ -The new filter appears in the Filter List and can be added to relevant jobs. - -[float] -[[add-job-filter]] -==== Add the filter to the relevant job - -. Go to *Machine Learning* -> *Anomaly Detection* -> *Anomaly Explorer*. -. Navigate to the job results for which the filter is required. If the job results -are not listed, click *Edit job selection* and select the relevant job. -. In the *actions* column, click the gear icon and then select _Configure rules_. -+ -The *Create Rule* window is displayed. -+ -[role="screenshot"] -image::rule-scope.png[] -. Select: -.. _Add a filter list to limit where the rule applies_. -.. The _WHEN_ statement for the relevant detector (`process.name` in our -example). -.. The _IS IN_ statement. -.. The filter you created as part of the <> procedure. -+ -TIP: For more information, see -{ml-docs}/ml-configuring-detector-custom-rules.html[Customizing detectors with custom rules]. - -. Click *Save*. - -NOTE: Changes to rules only affect new results. All anomalies found by the job -before the filter was added are still displayed. - -[float] -[[clone-job]] -==== Clone and rerun the job - -If you want to remove all the previously detected results for the process, you -must clone and run the cloned job. - -IMPORTANT: Running the cloned job can take some time. Only run the job after you -have completed all job rule changes. - -. Go to *Machine Learning* -> *Anomaly Detection* -> *Job Management*. -. Navigate to the job for which you configured the rule. -. Optionally, expand the job row and click *JSON* to verify the configured filter -appears under `custom rules` in the JSON code. -. In the *actions* column, click the more (three dots) icon and select _Clone job_. -+ -The *Configure datafeed* page is displayed. -. Click *Data Preview* and check the data is displayed without errors. -. Click *Next* until the *Job details* page is displayed. -. Enter a Job ID for the cloned job that indicates it is an iteration of the -original one. For example, append a number or a username to the original job -name, such as `windows-rare-network-process-2`. -+ -[role="screenshot"] -image::cloned-job-details.png[] -. Click *Next* and check the job validates without errors. You can ignore -warnings about multiple influencers. -. Click *Next* and then *Create job*. -+ -The *Start * window is displayed. -+ -[role="screenshot"] -image::start-job-window.png[] -. Select the point of time from which the job will analyze anomalies. -. Click *Start*. -+ -After a while, results will start to appear on the *Anomaly Explorer* page. - -[float] -[[define-rule-threshold]] -=== Define an anomaly threshold for a job - -Certain jobs use a high-count function to look for unusual spikes in -process events. For some processes, a burst of activity is a normal, such as -automation and housekeeping jobs running on server fleets. However, sometimes a -high-delta event count is unlikely to be the result of routine behavior. In -these cases, you can define a minimum threshold for when a high-event count is -considered an anomaly. - -Depending on your anomaly detection results, you may want to set a -minimum event count threshold for the `packetbeat_dns_tunneling` job: - - -. Go to *Machine Learning* -> *Anomaly Detection* -> *Anomaly Explorer*. -. Navigate to the job results for the `packetbeat_dns_tunneling` job. If the -job results are not listed, click *Edit job selection* and select -`packetbeat_dns_tunneling`. -. In the *actions* column, click the gear icon and then select -_Configure rules_. -+ -The *Create Rule* window is displayed. -+ -[role="screenshot"] -image::ml-rule-threshold.png[] -. Select _Add numeric conditions for when the rule applies_ and the following -`when` statement: -+ -_WHEN actual IS GREATER THAN _ -+ -Where `` is the threshold above which anomalies are detected. -. Click *Save*. -. To apply the new threshold, rerun the job (*Job Management* -> *Actions* -> -*Start datafeed*). \ No newline at end of file diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-anomalous-process-for-a-linux-population.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-anomalous-process-for-a-linux-population.asciidoc deleted file mode 100644 index 81a58dabc5..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-anomalous-process-for-a-linux-population.asciidoc +++ /dev/null @@ -1,53 +0,0 @@ -[[prebuilt-rule-0-13-1-anomalous-process-for-a-linux-population]] -=== Anomalous Process For a Linux Population - -Searches for rare processes running on multiple Linux hosts in an entire fleet or network. This reduces the detection of false positives since automated maintenance processes usually only run occasionally on a single machine but are common to all or many hosts in a fleet. - -*Rule type*: machine_learning - -*Rule indices*: None - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 15m - -*Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html - -*Tags*: - -* Elastic -* Host -* Linux -* Threat Detection -* ML - -*Version*: 6 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Triage and analysis - -### Investigating an Unusual Linux Process -Detection alerts from this rule indicate the presence of a Linux process that is rare and unusual for all of the monitored Linux hosts for which Auditbeat data is available. Here are some possible avenues of investigation: -- Consider the user as identified by the username field. Is this program part of an expected workflow for the user who ran this program on this host? -- Examine the history of execution. If this process manifested only very recently, it might be part of a new software package. If it has a consistent cadence - for example if it runs monthly or quarterly - it might be part of a monthly or quarterly business process. -- Examine the process arguments, title and working directory. These may provide indications as to the source of the program or the nature of the tasks it is performing. ----------------------------------- diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-anomalous-process-for-a-windows-population.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-anomalous-process-for-a-windows-population.asciidoc deleted file mode 100644 index 6f445a1125..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-anomalous-process-for-a-windows-population.asciidoc +++ /dev/null @@ -1,56 +0,0 @@ -[[prebuilt-rule-0-13-1-anomalous-process-for-a-windows-population]] -=== Anomalous Process For a Windows Population - -Searches for rare processes running on multiple hosts in an entire fleet or network. This reduces the detection of false positives since automated maintenance processes usually only run occasionally on a single machine but are common to all or many hosts in a fleet. - -*Rule type*: machine_learning - -*Rule indices*: None - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 15m - -*Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* ML - -*version*: 6 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Triage and analysis - -### Investigating an Unusual Windows Process -Detection alerts from this rule indicate the presence of a Windows process that is rare and unusual for all of the Windows hosts for which Winlogbeat data is available. Here are some possible avenues of investigation: -- Consider the user as identified by the username field. Is this program part of an expected workflow for the user who ran this program on this host? -- Examine the history of execution. If this process manifested only very recently, it might be part of a new software package. If it has a consistent cadence - for example if it runs monthly or quarterly - it might be part of a monthly or quarterly business process. -- Examine the process metadata like the values of the Company, Description and Product fields which may indicate whether the program is associated with an expected software vendor or package. -- Examine arguments and working directory. These may provide indications as to the source of the program or the nature of the tasks it is performing. -- Consider the same for the parent process. If the parent process is a legitimate system utility or service, this could be related to software updates or system management. If the parent process is something user-facing like an Office application, this process could be more suspicious. -- If you have file hash values in the event data, and you suspect malware, you can optionally run a search for the file hash to see if the file is identified as malware by anti-malware tools. ----------------------------------- diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-anomalous-windows-process-creation.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-anomalous-windows-process-creation.asciidoc deleted file mode 100644 index 85bc6b3e7f..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-anomalous-windows-process-creation.asciidoc +++ /dev/null @@ -1,39 +0,0 @@ -[[prebuilt-rule-0-13-1-anomalous-windows-process-creation]] -=== Anomalous Windows Process Creation - -Identifies unusual parent-child process relationships that can indicate malware execution or persistence mechanisms. Malicious scripts often call on other applications and processes as part of their exploit payload. For example, when a malicious Office document runs scripts as part of an exploit payload, Excel or Word may start a script interpreter process, which, in turn, runs a script that downloads and executes malware. Another common scenario is Outlook running an unusual process when malware is downloaded in an email. Monitoring and identifying anomalous process relationships is a method of detecting new and emerging malware that is not yet recognized by anti-virus scanners. - -*Rule type*: machine_learning - -*Rule indices*: None - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 15m - -*Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* ML - -*version*: 5 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-apple-script-execution-followed-by-network-connection.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-apple-script-execution-followed-by-network-connection.asciidoc deleted file mode 100644 index 32cdbea949..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-apple-script-execution-followed-by-network-connection.asciidoc +++ /dev/null @@ -1,79 +0,0 @@ -[[prebuilt-rule-0-13-1-apple-script-execution-followed-by-network-connection]] -=== Apple Script Execution followed by Network Connection - -Detects execution via the Apple script interpreter (osascript) followed by a network connection from the same process within a short time period. Adversaries may use malicious scripts for execution and command and control. - -*Rule type*: eql - -*Rule indices*: - -* auditbeat-* -* logs-endpoint.events.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: None - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://developer.apple.com/library/archive/documentation/LanguagesUtilities/Conceptual/MacAutomationScriptingGuide/index.html -* https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml - -*Tags*: - -* Elastic -* Host -* macOS -* Threat Detection -* Command and Control -* Execution - -*version*: 3 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -sequence by host.id, process.entity_id with maxspan=30s - [process where event.type == "start" and process.name == "osascript"] - [network where event.type != "end" and process.name == "osascript" and destination.ip != "::1" and - not cidrmatch(destination.ip, - "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32", - "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24", "192.31.196.0/24", - "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10", "192.175.48.0/24", - "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1", "FE80::/10", "FF00::/8")] - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Execution -** ID: TA0002 -** Reference URL: https://attack.mitre.org/tactics/TA0002/ -* Technique: -** Name: Command and Scripting Interpreter -** ID: T1059 -** Reference URL: https://attack.mitre.org/techniques/T1059/ -* Tactic: -** Name: Command and Control -** ID: TA0011 -** Reference URL: https://attack.mitre.org/tactics/TA0011/ -* Technique: -** Name: Ingress Tool Transfer -** ID: T1105 -** Reference URL: https://attack.mitre.org/techniques/T1105/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-attempts-to-brute-force-a-microsoft-365-user-account.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-attempts-to-brute-force-a-microsoft-365-user-account.asciidoc deleted file mode 100644 index 3a6e6a5222..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-attempts-to-brute-force-a-microsoft-365-user-account.asciidoc +++ /dev/null @@ -1,72 +0,0 @@ -[[prebuilt-rule-0-13-1-attempts-to-brute-force-a-microsoft-365-user-account]] -=== Attempts to Brute Force a Microsoft 365 User Account - -Identifies attempts to brute force a Microsoft 365 user account. An adversary may attempt a brute force attack to obtain unauthorized access to user accounts. - -*Rule type*: threshold - -*Rule indices*: - -* filebeat-* -* logs-o365* - -*Severity*: high - -*Risk score*: 73 - -*Runs every*: None - -*Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Cloud -* Microsoft 365 -* Continuous Monitoring -* SecOps -* Identity and Access - -*Version*: 4 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Config - -The Microsoft 365 Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -event.dataset:o365.audit and event.provider:(Exchange or AzureActiveDirectory) and event.category:authentication and -event.action:("UserLoginFailed" or "PasswordLogonInitialAuthUsingPassword") and event.outcome:failure - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Credential Access -** ID: TA0006 -** Reference URL: https://attack.mitre.org/tactics/TA0006/ -* Technique: -** Name: Brute Force -** ID: T1110 -** Reference URL: https://attack.mitre.org/techniques/T1110/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-attempts-to-brute-force-an-okta-user-account.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-attempts-to-brute-force-an-okta-user-account.asciidoc deleted file mode 100644 index 31d6a57b2c..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-attempts-to-brute-force-an-okta-user-account.asciidoc +++ /dev/null @@ -1,76 +0,0 @@ -[[prebuilt-rule-0-13-1-attempts-to-brute-force-an-okta-user-account]] -=== Attempts to Brute Force an Okta User Account - -Identifies when an Okta user account is locked out 3 times within a 3 hour window. An adversary may attempt a brute force or password spraying attack to obtain unauthorized access to user accounts. The default Okta authentication policy ensures that a user account is locked out after 10 failed authentication attempts. - -*Rule type*: threshold - -*Rule indices*: - -* filebeat-* -* logs-okta* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: None - -*Searches indices from*: now-180m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://developer.okta.com/docs/reference/api/system-log/ -* https://developer.okta.com/docs/reference/api/event-types/ - -*Tags*: - -* Elastic -* Identity -* Okta -* Continuous Monitoring -* SecOps -* Identity and Access - -*version*: 5 - -*Rule authors*: - -* Elastic -* @BenB196 -* Austin Songer - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Config - -The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -event.dataset:okta.system and event.action:user.account.lock - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Credential Access -** ID: TA0006 -** Reference URL: https://attack.mitre.org/tactics/TA0006/ -* Technique: -** Name: Brute Force -** ID: T1110 -** Reference URL: https://attack.mitre.org/techniques/T1110/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-aws-ec2-vm-export-failure.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-aws-ec2-vm-export-failure.asciidoc deleted file mode 100644 index b0f6e0c81d..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-aws-ec2-vm-export-failure.asciidoc +++ /dev/null @@ -1,81 +0,0 @@ -[[prebuilt-rule-0-13-1-aws-ec2-vm-export-failure]] -=== AWS EC2 VM Export Failure - -Identifies an attempt to export an AWS EC2 instance. A virtual machine (VM) export may indicate an attempt to extract or exfiltrate information. - -*Rule type*: query - -*Rule indices*: - -* filebeat-* -* logs-aws* - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 10m - -*Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://docs.aws.amazon.com/vm-import/latest/userguide/vmexport.html#export-instance - -*Tags*: - -* Elastic -* Cloud -* AWS -* Continuous Monitoring -* SecOps -* Asset Visibility - -*Version*: 1 - -*Rule authors*: - -* Elastic -* Austin Songer - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Config -The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -event.dataset:aws.cloudtrail and event.provider:ec2.amazonaws.com and event.action:CreateInstanceExportTask and event.outcome:failure - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Exfiltration -** ID: TA0010 -** Reference URL: https://attack.mitre.org/tactics/TA0010/ -* Technique: -** Name: Transfer Data to Cloud Account -** ID: T1537 -** Reference URL: https://attack.mitre.org/techniques/T1537/ -* Tactic: -** Name: Collection -** ID: TA0009 -** Reference URL: https://attack.mitre.org/tactics/TA0009/ -* Technique: -** Name: Data from Local System -** ID: T1005 -** Reference URL: https://attack.mitre.org/techniques/T1005/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-command-prompt-network-connection.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-command-prompt-network-connection.asciidoc deleted file mode 100644 index e71e1e7b43..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-command-prompt-network-connection.asciidoc +++ /dev/null @@ -1,79 +0,0 @@ -[[prebuilt-rule-0-13-1-command-prompt-network-connection]] -=== Command Prompt Network Connection - -Identifies cmd.exe making a network connection. Adversaries could abuse cmd.exe to download or execute malware from a remote URL. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: None - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Execution - -*version*: 7 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -sequence by process.entity_id - [process where process.name : "cmd.exe" and event.type == "start"] - [network where process.name : "cmd.exe" and - not cidrmatch(destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", - "192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", - "192.0.0.171/32", "192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24", - "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10", "192.175.48.0/24", - "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1", - "FE80::/10", "FF00::/8")] - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Execution -** ID: TA0002 -** Reference URL: https://attack.mitre.org/tactics/TA0002/ -* Technique: -** Name: Command and Scripting Interpreter -** ID: T1059 -** Reference URL: https://attack.mitre.org/techniques/T1059/ -* Tactic: -** Name: Command and Control -** ID: TA0011 -** Reference URL: https://attack.mitre.org/tactics/TA0011/ -* Technique: -** Name: Ingress Tool Transfer -** ID: T1105 -** Reference URL: https://attack.mitre.org/techniques/T1105/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-component-object-model-hijacking.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-component-object-model-hijacking.asciidoc deleted file mode 100644 index 666bfa07aa..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-component-object-model-hijacking.asciidoc +++ /dev/null @@ -1,79 +0,0 @@ -[[prebuilt-rule-0-13-1-component-object-model-hijacking]] -=== Component Object Model Hijacking - -Identifies Component Object Model (COM) hijacking via registry modification. Adversaries may establish persistence by executing malicious content triggered by hijacked references to COM objects. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: None - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/ - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Persistence - -*Version*: 4 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -registry where - /* uncomment once length is stable length(bytes_written_string) > 0 and */ - (registry.path : "HK*}\\InprocServer32\\" and registry.data.strings: ("scrobj.dll", "C:\\*\\scrobj.dll") and - not registry.path : "*\\{06290BD*-48AA-11D2-8432-006008C3FBFC}\\*") - or - /* in general COM Registry changes on Users Hive is less noisy and worth alerting */ - (registry.path : ("HKEY_USERS\\*Classes\\*\\InprocServer32\\", - "HKEY_USERS\\*Classes\\*\\LocalServer32\\", - "HKEY_USERS\\*Classes\\*\\DelegateExecute\\", - "HKEY_USERS\\*Classes\\*\\TreatAs\\", - "HKEY_USERS\\*Classes\\CLSID\\*\\ScriptletURL\\") and - /* not necessary but good for filtering privileged installations */ - user.domain != "NT AUTHORITY") - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Persistence -** ID: TA0003 -** Reference URL: https://attack.mitre.org/tactics/TA0003/ -* Technique: -** Name: Event Triggered Execution -** ID: T1546 -** Reference URL: https://attack.mitre.org/techniques/T1546/ -* Sub-technique: -** Name: Component Object Model Hijacking -** ID: T1546.015 -** Reference URL: https://attack.mitre.org/techniques/T1546/015/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-connection-to-external-network-via-telnet.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-connection-to-external-network-via-telnet.asciidoc deleted file mode 100644 index a8cae7201d..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-connection-to-external-network-via-telnet.asciidoc +++ /dev/null @@ -1,70 +0,0 @@ -[[prebuilt-rule-0-13-1-connection-to-external-network-via-telnet]] -=== Connection to External Network via Telnet - -Telnet provides a command line interface for communication with a remote device or server. This rule identifies Telnet network connections to publicly routable IP addresses. - -*Rule type*: eql - -*Rule indices*: - -* auditbeat-* -* logs-endpoint.events.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: None - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml - -*Tags*: - -* Elastic -* Host -* Linux -* Threat Detection -* Lateral Movement - -*version*: 6 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -sequence by process.entity_id - [process where process.name == "telnet" and event.type == "start"] - [network where process.name == "telnet" and - not cidrmatch(destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", - "192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", - "192.0.0.171/32", "192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24", - "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10", "192.175.48.0/24", - "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1", - "FE80::/10", "FF00::/8")] - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Lateral Movement -** ID: TA0008 -** Reference URL: https://attack.mitre.org/tactics/TA0008/ -* Technique: -** Name: Remote Services -** ID: T1021 -** Reference URL: https://attack.mitre.org/techniques/T1021/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-connection-to-internal-network-via-telnet.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-connection-to-internal-network-via-telnet.asciidoc deleted file mode 100644 index ef3ee10b41..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-connection-to-internal-network-via-telnet.asciidoc +++ /dev/null @@ -1,70 +0,0 @@ -[[prebuilt-rule-0-13-1-connection-to-internal-network-via-telnet]] -=== Connection to Internal Network via Telnet - -Telnet provides a command line interface for communication with a remote device or server. This rule identifies Telnet network connections to non-publicly routable IP addresses. - -*Rule type*: eql - -*Rule indices*: - -* auditbeat-* -* logs-endpoint.events.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: None - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml - -*Tags*: - -* Elastic -* Host -* Linux -* Threat Detection -* Lateral Movement - -*version*: 6 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -sequence by process.entity_id - [process where process.name == "telnet" and event.type == "start"] - [network where process.name == "telnet" and - cidrmatch(destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", - "192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", - "192.0.0.171/32", "192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24", - "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10", "192.175.48.0/24", - "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1", - "FE80::/10", "FF00::/8")] - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Lateral Movement -** ID: TA0008 -** Reference URL: https://attack.mitre.org/tactics/TA0008/ -* Technique: -** Name: Remote Services -** ID: T1021 -** Reference URL: https://attack.mitre.org/techniques/T1021/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-dns-activity-to-the-internet.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-dns-activity-to-the-internet.asciidoc deleted file mode 100644 index 91290fbfdd..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-dns-activity-to-the-internet.asciidoc +++ /dev/null @@ -1,92 +0,0 @@ -[[prebuilt-rule-0-13-1-dns-activity-to-the-internet]] -=== DNS Activity to the Internet - -This rule detects when an internal network client sends DNS traffic directly to the Internet. This is atypical behavior for a managed network, and can be indicative of malware, exfiltration, command and control, or, simply, misconfiguration. This DNS activity also impacts your organization's ability to provide enterprise monitoring and logging of DNS, and opens your network to a variety of abuses and malicious communications. - -*Rule type*: query - -*Rule indices*: - -* filebeat-* -* packetbeat-* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: None - -*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.us-cert.gov/ncas/alerts/TA15-240A -* https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-81-2.pdf -* https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml - -*Tags*: - -* Elastic -* Network -* Threat Detection -* Command and Control - -*version*: 9 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -event.category:(network or network_traffic) and (event.type:connection or type:dns) and (destination.port:53 or event.dataset:zeek.dns) - and source.ip:( - 10.0.0.0/8 or - 172.16.0.0/12 or - 192.168.0.0/16 - ) and - not destination.ip:( - 10.0.0.0/8 or - 127.0.0.0/8 or - 169.254.0.0/16 or - 172.16.0.0/12 or - 192.0.0.0/24 or - 192.0.0.0/29 or - 192.0.0.8/32 or - 192.0.0.9/32 or - 192.0.0.10/32 or - 192.0.0.170/32 or - 192.0.0.171/32 or - 192.0.2.0/24 or - 192.31.196.0/24 or - 192.52.193.0/24 or - 192.168.0.0/16 or - 192.88.99.0/24 or - 224.0.0.0/4 or - 100.64.0.0/10 or - 192.175.48.0/24 or - 198.18.0.0/15 or - 198.51.100.0/24 or - 203.0.113.0/24 or - 240.0.0.0/4 or - "::1" or - "FE80::/10" or - "FF00::/8" - ) - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Command and Control -** ID: TA0011 -** Reference URL: https://attack.mitre.org/tactics/TA0011/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-high-number-of-okta-user-password-reset-or-unlock-attempts.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-high-number-of-okta-user-password-reset-or-unlock-attempts.asciidoc deleted file mode 100644 index 14dc2fa3f9..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-high-number-of-okta-user-password-reset-or-unlock-attempts.asciidoc +++ /dev/null @@ -1,96 +0,0 @@ -[[prebuilt-rule-0-13-1-high-number-of-okta-user-password-reset-or-unlock-attempts]] -=== High Number of Okta User Password Reset or Unlock Attempts - -Identifies a high number of Okta user password reset or account unlock attempts. An adversary may attempt to obtain unauthorized access to Okta user accounts using these methods and attempt to blend in with normal activity in their target's environment and evade detection. - -*Rule type*: threshold - -*Rule indices*: - -* filebeat-* -* logs-okta* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: None - -*Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://developer.okta.com/docs/reference/api/system-log/ -* https://developer.okta.com/docs/reference/api/event-types/ - -*Tags*: - -* Elastic -* Identity -* Okta -* Continuous Monitoring -* SecOps -* Identity and Access - -*version*: 5 - -*Rule authors*: - -* Elastic -* @BenB196 -* Austin Songer - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Config - -The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -event.dataset:okta.system and - event.action:(system.email.account_unlock.sent_message or system.email.password_reset.sent_message or - system.sms.send_account_unlock_message or system.sms.send_password_reset_message or - system.voice.send_account_unlock_call or system.voice.send_password_reset_call or - user.account.unlock_token) - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Defense Evasion -** ID: TA0005 -** Reference URL: https://attack.mitre.org/tactics/TA0005/ -* Technique: -** Name: Valid Accounts -** ID: T1078 -** Reference URL: https://attack.mitre.org/techniques/T1078/ -* Tactic: -** Name: Persistence -** ID: TA0003 -** Reference URL: https://attack.mitre.org/tactics/TA0003/ -* Technique: -** Name: Valid Accounts -** ID: T1078 -** Reference URL: https://attack.mitre.org/techniques/T1078/ -* Tactic: -** Name: Initial Access -** ID: TA0001 -** Reference URL: https://attack.mitre.org/tactics/TA0001/ -* Technique: -** Name: Valid Accounts -** ID: T1078 -** Reference URL: https://attack.mitre.org/techniques/T1078/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-macos-installer-spawns-network-event.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-macos-installer-spawns-network-event.asciidoc deleted file mode 100644 index 1f6caa1505..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-macos-installer-spawns-network-event.asciidoc +++ /dev/null @@ -1,85 +0,0 @@ -[[prebuilt-rule-0-13-1-macos-installer-spawns-network-event]] -=== macOS Installer Spawns Network Event - -Identifies when the built in macOS Installer program generates a network event after attempting to install a .pkg file. This activity has been observed being leveraged by malware. - -*Rule type*: eql - -*Rule indices*: - -* logs-endpoint.events.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: None - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://redcanary.com/blog/clipping-silver-sparrows-wings -* https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml - -*Tags*: - -* Elastic -* Host -* macOS -* Threat Detection -* Execution - -*version*: 2 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -sequence by process.entity_id with maxspan=1m - [process where event.type == "start" and host.os.family == "macos" and - process.parent.executable in ("/usr/sbin/installer", "/System/Library/CoreServices/Installer.app/Contents/MacOS/Installer") ] - [network where not cidrmatch(destination.ip, - "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32", - "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24", "192.31.196.0/24", - "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10", "192.175.48.0/24", - "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1", "FE80::/10", "FF00::/8")] - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Execution -** ID: TA0002 -** Reference URL: https://attack.mitre.org/tactics/TA0002/ -* Technique: -** Name: Command and Scripting Interpreter -** ID: T1059 -** Reference URL: https://attack.mitre.org/techniques/T1059/ -* Sub-technique: -** Name: JavaScript/JScript -** ID: T1059.007 -** Reference URL: https://attack.mitre.org/techniques/T1059/007/ -* Tactic: -** Name: Command and Control -** ID: TA0011 -** Reference URL: https://attack.mitre.org/tactics/TA0011/ -* Technique: -** Name: Application Layer Protocol -** ID: T1071 -** Reference URL: https://attack.mitre.org/techniques/T1071/ -* Sub-technique: -** Name: Web Protocols -** ID: T1071.001 -** Reference URL: https://attack.mitre.org/techniques/T1071/001/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-modification-of-amsienable-registry-key.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-modification-of-amsienable-registry-key.asciidoc deleted file mode 100644 index 6c72cb8cee..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-modification-of-amsienable-registry-key.asciidoc +++ /dev/null @@ -1,70 +0,0 @@ -[[prebuilt-rule-0-13-1-modification-of-amsienable-registry-key]] -=== Modification of AmsiEnable Registry Key - -Jscript tries to query the AmsiEnable registry key from the HKEY_USERS registry hive before initializing Antimalware Scan Interface (AMSI). If this key is set to 0, AMSI is not enabled for the Jscript process. An adversary can modify this key to disable AMSI protections. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: high - -*Risk score*: 73 - -*Runs every*: None - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://hackinparis.com/data/slides/2019/talks/HIP2019-Dominic_Chell-Cracking_The_Perimeter_With_Sharpshooter.pdf -* https://docs.microsoft.com/en-us/windows/win32/amsi/antimalware-scan-interface-portal - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Defense Evasion - -*Version*: 1 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -registry where event.type in ("creation", "change") and - registry.path: "HKEY_USERS\\*\\Software\\Microsoft\\Windows Script\\Settings\\AmsiEnable" and - registry.data.strings: "0" - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Defense Evasion -** ID: TA0005 -** Reference URL: https://attack.mitre.org/tactics/TA0005/ -* Technique: -** Name: Impair Defenses -** ID: T1562 -** Reference URL: https://attack.mitre.org/techniques/T1562/ -* Sub-technique: -** Name: Disable or Modify Tools -** ID: T1562.001 -** Reference URL: https://attack.mitre.org/techniques/T1562/001/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-network-connection-via-certutil.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-network-connection-via-certutil.asciidoc deleted file mode 100644 index eb7c64c751..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-network-connection-via-certutil.asciidoc +++ /dev/null @@ -1,71 +0,0 @@ -[[prebuilt-rule-0-13-1-network-connection-via-certutil]] -=== Network Connection via Certutil - -Identifies certutil.exe making a network connection. Adversaries could abuse certutil.exe to download a certificate, or malware, from a remote URL. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: None - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Command and Control - -*version*: 6 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -sequence by process.entity_id - [process where process.name : "certutil.exe" and event.type == "start"] - [network where process.name : "certutil.exe" and - not cidrmatch(destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", - "192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", - "192.0.0.171/32", "192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24", - "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10", "192.175.48.0/24", - "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1", - "FE80::/10", "FF00::/8")] - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Command and Control -** ID: TA0011 -** Reference URL: https://attack.mitre.org/tactics/TA0011/ -* Technique: -** Name: Ingress Tool Transfer -** ID: T1105 -** Reference URL: https://attack.mitre.org/techniques/T1105/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-network-connection-via-compiled-html-file.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-network-connection-via-compiled-html-file.asciidoc deleted file mode 100644 index c4f8c2249e..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-network-connection-via-compiled-html-file.asciidoc +++ /dev/null @@ -1,78 +0,0 @@ -[[prebuilt-rule-0-13-1-network-connection-via-compiled-html-file]] -=== Network Connection via Compiled HTML File - -Compiled HTML files (.chm) are commonly distributed as part of the Microsoft HTML Help system. Adversaries may conceal malicious code in a CHM file and deliver it to a victim for execution. CHM content is loaded by the HTML Help executable program (hh.exe). - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: None - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Execution - -*version*: 8 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -sequence by process.entity_id - [process where process.name : "hh.exe" and event.type == "start"] - [network where process.name : "hh.exe" and - not cidrmatch(destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", - "192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", - "192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4", - "100.64.0.0/10", "192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1", - "FE80::/10", "FF00::/8")] - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Execution -** ID: TA0002 -** Reference URL: https://attack.mitre.org/tactics/TA0002/ -* Tactic: -** Name: Defense Evasion -** ID: TA0005 -** Reference URL: https://attack.mitre.org/tactics/TA0005/ -* Technique: -** Name: Signed Binary Proxy Execution -** ID: T1218 -** Reference URL: https://attack.mitre.org/techniques/T1218/ -* Sub-technique: -** Name: Compiled HTML File -** ID: T1218.001 -** Reference URL: https://attack.mitre.org/techniques/T1218/001/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-network-connection-via-msxsl.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-network-connection-via-msxsl.asciidoc deleted file mode 100644 index 5233b2fb71..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-network-connection-via-msxsl.asciidoc +++ /dev/null @@ -1,70 +0,0 @@ -[[prebuilt-rule-0-13-1-network-connection-via-msxsl]] -=== Network Connection via MsXsl - -Identifies msxsl.exe making a network connection. This may indicate adversarial activity as msxsl.exe is often leveraged by adversaries to execute malicious scripts and evade detection. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: None - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Defense Evasion - -*version*: 7 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -sequence by process.entity_id - [process where process.name : "msxsl.exe" and event.type == "start"] - [network where process.name : "msxsl.exe" and - not cidrmatch(destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", - "192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", - "192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4", - "100.64.0.0/10", "192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1", - "FE80::/10", "FF00::/8")] - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Defense Evasion -** ID: TA0005 -** Reference URL: https://attack.mitre.org/tactics/TA0005/ -* Technique: -** Name: XSL Script Processing -** ID: T1220 -** Reference URL: https://attack.mitre.org/techniques/T1220/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-network-connection-via-registration-utility.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-network-connection-via-registration-utility.asciidoc deleted file mode 100644 index 343f916aae..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-network-connection-via-registration-utility.asciidoc +++ /dev/null @@ -1,84 +0,0 @@ -[[prebuilt-rule-0-13-1-network-connection-via-registration-utility]] -=== Network Connection via Registration Utility - -Identifies the native Windows tools regsvr32.exe, regsvr64.exe, RegSvcs.exe, or RegAsm.exe making a network connection. This may be indicative of an attacker bypassing allowlists or running arbitrary scripts via a signed Microsoft binary. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: None - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Execution - -*version*: 9 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -sequence by process.entity_id - [process where event.type == "start" and - process.name : ("regsvr32.exe", "RegAsm.exe", "RegSvcs.exe") and - not ( - user.id == "S-1-5-18" and - (process.parent.name : "msiexec.exe" or process.parent.executable : ("C:\\Program Files (x86)\\*.exe", "C:\\Program Files\\*.exe")) - ) - ] - [network where process.name : ("regsvr32.exe", "RegAsm.exe", "RegSvcs.exe") and - not cidrmatch(destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", - "192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", - "192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4", - "100.64.0.0/10", "192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1", - "FE80::/10", "FF00::/8") and network.protocol != "dns"] - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Execution -** ID: TA0002 -** Reference URL: https://attack.mitre.org/tactics/TA0002/ -* Tactic: -** Name: Defense Evasion -** ID: TA0005 -** Reference URL: https://attack.mitre.org/tactics/TA0005/ -* Technique: -** Name: Signed Binary Proxy Execution -** ID: T1218 -** Reference URL: https://attack.mitre.org/techniques/T1218/ -* Sub-technique: -** Name: Regsvr32 -** ID: T1218.010 -** Reference URL: https://attack.mitre.org/techniques/T1218/010/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-network-connection-via-signed-binary.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-network-connection-via-signed-binary.asciidoc deleted file mode 100644 index 2ee6cc2c37..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-network-connection-via-signed-binary.asciidoc +++ /dev/null @@ -1,77 +0,0 @@ -[[prebuilt-rule-0-13-1-network-connection-via-signed-binary]] -=== Network Connection via Signed Binary - -Binaries signed with trusted digital certificates can execute on Windows systems protected by digital signature validation. Adversaries may use these binaries to 'live off the land' and execute malicious files that could bypass application allowlists and signature validation. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: None - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Defense Evasion - -*version*: 8 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -sequence by process.entity_id - [process where (process.name : "expand.exe" or process.name : "extrac.exe" or - process.name : "ieexec.exe" or process.name : "makecab.exe") and - event.type == "start"] - [network where (process.name : "expand.exe" or process.name : "extrac.exe" or - process.name : "ieexec.exe" or process.name : "makecab.exe") and - not cidrmatch(destination.ip, - "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32", - "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24", "192.31.196.0/24", - "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10", "192.175.48.0/24", - "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1", "FE80::/10", "FF00::/8")] - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Defense Evasion -** ID: TA0005 -** Reference URL: https://attack.mitre.org/tactics/TA0005/ -* Technique: -** Name: Signed Binary Proxy Execution -** ID: T1218 -** Reference URL: https://attack.mitre.org/techniques/T1218/ -* Tactic: -** Name: Execution -** ID: TA0002 -** Reference URL: https://attack.mitre.org/tactics/TA0002/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-network-traffic-to-rare-destination-country.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-network-traffic-to-rare-destination-country.asciidoc deleted file mode 100644 index f922a517df..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-network-traffic-to-rare-destination-country.asciidoc +++ /dev/null @@ -1,38 +0,0 @@ -[[prebuilt-rule-0-13-1-network-traffic-to-rare-destination-country]] -=== Network Traffic to Rare Destination Country - -A machine learning job detected a rare destination country name in the network logs. This can be due to initial access, persistence, command-and-control, or exfiltration activity. For example, when a user clicks on a link in a phishing email or opens a malicious document, a request may be sent to download and run a payload from a server in a country which does not normally appear in network traffic or business work-flows. Malware instances and persistence mechanisms may communicate with command-and-control (C2) infrastructure in their country of origin, which may be an unusual destination country for the source network. - -*Rule type*: machine_learning - -*Rule indices*: None - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 15m - -*Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html - -*Tags*: - -* Elastic -* Network -* Threat Detection -* ML - -*version*: 2 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-rdp-remote-desktop-protocol-from-the-internet.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-rdp-remote-desktop-protocol-from-the-internet.asciidoc deleted file mode 100644 index d361594502..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-rdp-remote-desktop-protocol-from-the-internet.asciidoc +++ /dev/null @@ -1,108 +0,0 @@ -[[prebuilt-rule-0-13-1-rdp-remote-desktop-protocol-from-the-internet]] -=== RDP (Remote Desktop Protocol) from the Internet - -This rule detects network events that may indicate the use of RDP traffic from the Internet. RDP is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or back-door vector. - -*Rule type*: query - -*Rule indices*: - -* filebeat-* -* packetbeat-* -* logs-endpoint.events.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: None - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml - -*Tags*: - -* Elastic -* Host -* Network -* Threat Detection -* Command and Control - -*version*: 9 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -event.category:(network or network_traffic) and network.transport:tcp and (destination.port:3389 or event.dataset:zeek.rdp) and - not source.ip:( - 10.0.0.0/8 or - 127.0.0.0/8 or - 169.254.0.0/16 or - 172.16.0.0/12 or - 192.0.0.0/24 or - 192.0.0.0/29 or - 192.0.0.8/32 or - 192.0.0.9/32 or - 192.0.0.10/32 or - 192.0.0.170/32 or - 192.0.0.171/32 or - 192.0.2.0/24 or - 192.31.196.0/24 or - 192.52.193.0/24 or - 192.168.0.0/16 or - 192.88.99.0/24 or - 224.0.0.0/4 or - 100.64.0.0/10 or - 192.175.48.0/24 or - 198.18.0.0/15 or - 198.51.100.0/24 or - 203.0.113.0/24 or - 240.0.0.0/4 or - "::1" or - "FE80::/10" or - "FF00::/8" - ) and - destination.ip:( - 10.0.0.0/8 or - 172.16.0.0/12 or - 192.168.0.0/16 - ) - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Command and Control -** ID: TA0011 -** Reference URL: https://attack.mitre.org/tactics/TA0011/ -* Tactic: -** Name: Lateral Movement -** ID: TA0008 -** Reference URL: https://attack.mitre.org/tactics/TA0008/ -* Technique: -** Name: Remote Services -** ID: T1021 -** Reference URL: https://attack.mitre.org/techniques/T1021/ -* Tactic: -** Name: Initial Access -** ID: TA0001 -** Reference URL: https://attack.mitre.org/tactics/TA0001/ -* Technique: -** Name: Exploit Public-Facing Application -** ID: T1190 -** Reference URL: https://attack.mitre.org/techniques/T1190/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-roshal-archive-rar-or-powershell-file-downloaded-from-the-internet.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-roshal-archive-rar-or-powershell-file-downloaded-from-the-internet.asciidoc deleted file mode 100644 index 483a066732..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-roshal-archive-rar-or-powershell-file-downloaded-from-the-internet.asciidoc +++ /dev/null @@ -1,106 +0,0 @@ -[[prebuilt-rule-0-13-1-roshal-archive-rar-or-powershell-file-downloaded-from-the-internet]] -=== Roshal Archive (RAR) or PowerShell File Downloaded from the Internet - -Detects a Roshal Archive (RAR) file or PowerShell script downloaded from the internet by an internal host. Gaining initial access to a system and then downloading encoded or encrypted tools to move laterally is a common practice for adversaries as a way to protect their more valuable tools and TTPs. This may be atypical behavior for a managed network and can be indicative of malware, exfiltration, or command and control. - -*Rule type*: query - -*Rule indices*: - -* packetbeat-* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: None - -*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html -* https://www.justice.gov/opa/press-release/file/1084361/download -* https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml - -*Tags*: - -* Elastic -* Network -* Threat Detection -* Command and Control - -*version*: 5 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Threat intel - -This activity has been observed in FIN7 campaigns. ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -event.category:(network or network_traffic) and network.protocol:http and - (url.extension:(ps1 or rar) or url.path:(*.ps1 or *.rar)) and - not destination.ip:( - 10.0.0.0/8 or - 127.0.0.0/8 or - 169.254.0.0/16 or - 172.16.0.0/12 or - 192.0.0.0/24 or - 192.0.0.0/29 or - 192.0.0.8/32 or - 192.0.0.9/32 or - 192.0.0.10/32 or - 192.0.0.170/32 or - 192.0.0.171/32 or - 192.0.2.0/24 or - 192.31.196.0/24 or - 192.52.193.0/24 or - 192.168.0.0/16 or - 192.88.99.0/24 or - 224.0.0.0/4 or - 100.64.0.0/10 or - 192.175.48.0/24 or - 198.18.0.0/15 or - 198.51.100.0/24 or - 203.0.113.0/24 or - 240.0.0.0/4 or - "::1" or - "FE80::/10" or - "FF00::/8" - ) and - source.ip:( - 10.0.0.0/8 or - 172.16.0.0/12 or - 192.168.0.0/16 - ) - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Command and Control -** ID: TA0011 -** Reference URL: https://attack.mitre.org/tactics/TA0011/ -* Technique: -** Name: Ingress Tool Transfer -** ID: T1105 -** Reference URL: https://attack.mitre.org/techniques/T1105/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-rpc-remote-procedure-call-from-the-internet.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-rpc-remote-procedure-call-from-the-internet.asciidoc deleted file mode 100644 index c316678b3d..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-rpc-remote-procedure-call-from-the-internet.asciidoc +++ /dev/null @@ -1,96 +0,0 @@ -[[prebuilt-rule-0-13-1-rpc-remote-procedure-call-from-the-internet]] -=== RPC (Remote Procedure Call) from the Internet - -This rule detects network events that may indicate the use of RPC traffic from the Internet. RPC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or back-door vector. - -*Rule type*: query - -*Rule indices*: - -* filebeat-* -* packetbeat-* -* logs-endpoint.events.* - -*Severity*: high - -*Risk score*: 73 - -*Runs every*: None - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml - -*Tags*: - -* Elastic -* Host -* Network -* Threat Detection -* Initial Access - -*version*: 9 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -event.category:(network or network_traffic) and network.transport:tcp and (destination.port:135 or event.dataset:zeek.dce_rpc) and - not source.ip:( - 10.0.0.0/8 or - 127.0.0.0/8 or - 169.254.0.0/16 or - 172.16.0.0/12 or - 192.0.0.0/24 or - 192.0.0.0/29 or - 192.0.0.8/32 or - 192.0.0.9/32 or - 192.0.0.10/32 or - 192.0.0.170/32 or - 192.0.0.171/32 or - 192.0.2.0/24 or - 192.31.196.0/24 or - 192.52.193.0/24 or - 192.168.0.0/16 or - 192.88.99.0/24 or - 224.0.0.0/4 or - 100.64.0.0/10 or - 192.175.48.0/24 or - 198.18.0.0/15 or - 198.51.100.0/24 or - 203.0.113.0/24 or - 240.0.0.0/4 or - "::1" or - "FE80::/10" or - "FF00::/8" - ) and - destination.ip:( - 10.0.0.0/8 or - 172.16.0.0/12 or - 192.168.0.0/16 - ) - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Initial Access -** ID: TA0001 -** Reference URL: https://attack.mitre.org/tactics/TA0001/ -* Technique: -** Name: Exploit Public-Facing Application -** ID: T1190 -** Reference URL: https://attack.mitre.org/techniques/T1190/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-rpc-remote-procedure-call-to-the-internet.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-rpc-remote-procedure-call-to-the-internet.asciidoc deleted file mode 100644 index 6407f1c21b..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-rpc-remote-procedure-call-to-the-internet.asciidoc +++ /dev/null @@ -1,96 +0,0 @@ -[[prebuilt-rule-0-13-1-rpc-remote-procedure-call-to-the-internet]] -=== RPC (Remote Procedure Call) to the Internet - -This rule detects network events that may indicate the use of RPC traffic to the Internet. RPC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or back-door vector. - -*Rule type*: query - -*Rule indices*: - -* filebeat-* -* packetbeat-* -* logs-endpoint.events.* - -*Severity*: high - -*Risk score*: 73 - -*Runs every*: None - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml - -*Tags*: - -* Elastic -* Host -* Network -* Threat Detection -* Initial Access - -*version*: 9 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -event.category:(network or network_traffic) and network.transport:tcp and (destination.port:135 or event.dataset:zeek.dce_rpc) and - source.ip:( - 10.0.0.0/8 or - 172.16.0.0/12 or - 192.168.0.0/16 - ) and - not destination.ip:( - 10.0.0.0/8 or - 127.0.0.0/8 or - 169.254.0.0/16 or - 172.16.0.0/12 or - 192.0.0.0/24 or - 192.0.0.0/29 or - 192.0.0.8/32 or - 192.0.0.9/32 or - 192.0.0.10/32 or - 192.0.0.170/32 or - 192.0.0.171/32 or - 192.0.2.0/24 or - 192.31.196.0/24 or - 192.52.193.0/24 or - 192.168.0.0/16 or - 192.88.99.0/24 or - 224.0.0.0/4 or - 100.64.0.0/10 or - 192.175.48.0/24 or - 198.18.0.0/15 or - 198.51.100.0/24 or - 203.0.113.0/24 or - 240.0.0.0/4 or - "::1" or - "FE80::/10" or - "FF00::/8" - ) - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Initial Access -** ID: TA0001 -** Reference URL: https://attack.mitre.org/tactics/TA0001/ -* Technique: -** Name: Exploit Public-Facing Application -** ID: T1190 -** Reference URL: https://attack.mitre.org/techniques/T1190/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-spike-in-firewall-denies.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-spike-in-firewall-denies.asciidoc deleted file mode 100644 index 9a8c4a1b93..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-spike-in-firewall-denies.asciidoc +++ /dev/null @@ -1,38 +0,0 @@ -[[prebuilt-rule-0-13-1-spike-in-firewall-denies]] -=== Spike in Firewall Denies - -A machine learning job detected an unusually large spike in network traffic that was denied by network access control lists (ACLs) or firewall rules. Such a burst of denied traffic is usually caused by either 1) a mis-configured application or firewall or 2) suspicious or malicious activity. Unsuccessful attempts at network transit, in order to connect to command-and-control (C2), or engage in data exfiltration, may produce a burst of failed connections. This could also be due to unusually large amounts of reconnaissance or enumeration traffic. Denial-of-service attacks or traffic floods may also produce such a surge in traffic. - -*Rule type*: machine_learning - -*Rule indices*: None - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 15m - -*Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html - -*Tags*: - -* Elastic -* Network -* Threat Detection -* ML - -*version*: 2 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-spike-in-network-traffic-to-a-country.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-spike-in-network-traffic-to-a-country.asciidoc deleted file mode 100644 index f2fa5e4615..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-spike-in-network-traffic-to-a-country.asciidoc +++ /dev/null @@ -1,38 +0,0 @@ -[[prebuilt-rule-0-13-1-spike-in-network-traffic-to-a-country]] -=== Spike in Network Traffic To a Country - -A machine learning job detected an unusually large spike in network activity to one destination country in the network logs. This could be due to unusually large amounts of reconnaissance or enumeration traffic. Data exfiltration activity may also produce such a surge in traffic to a destination country which does not normally appear in network traffic or business work-flows. Malware instances and persistence mechanisms may communicate with command-and-control (C2) infrastructure in their country of origin, which may be an unusual destination country for the source network. - -*Rule type*: machine_learning - -*Rule indices*: None - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 15m - -*Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html - -*Tags*: - -* Elastic -* Network -* Threat Detection -* ML - -*version*: 2 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-spike-in-network-traffic.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-spike-in-network-traffic.asciidoc deleted file mode 100644 index 21f723c49c..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-spike-in-network-traffic.asciidoc +++ /dev/null @@ -1,38 +0,0 @@ -[[prebuilt-rule-0-13-1-spike-in-network-traffic]] -=== Spike in Network Traffic - -A machine learning job detected an unusually large spike in network traffic. Such a burst of traffic, if not caused by a surge in business activity, can be due to suspicious or malicious activity. Large-scale data exfiltration may produce a burst of network traffic; this could also be due to unusually large amounts of reconnaissance or enumeration traffic. Denial-of-service attacks or traffic floods may also produce such a surge in traffic. - -*Rule type*: machine_learning - -*Rule indices*: None - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 15m - -*Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html - -*Tags*: - -* Elastic -* Network -* Threat Detection -* ML - -*version*: 2 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-suspicious-dll-loaded-for-persistence-or-privilege-escalation.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-suspicious-dll-loaded-for-persistence-or-privilege-escalation.asciidoc deleted file mode 100644 index 427bc5e124..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-suspicious-dll-loaded-for-persistence-or-privilege-escalation.asciidoc +++ /dev/null @@ -1,103 +0,0 @@ -[[prebuilt-rule-0-13-1-suspicious-dll-loaded-for-persistence-or-privilege-escalation]] -=== Suspicious DLL Loaded for Persistence or Privilege Escalation - -Identifies the loading of a non Microsoft signed DLL that is missing on a default Windows install (phantom DLL) or one that can be loaded from a different location by a native Windows process. This may be abused to persist or elevate privileges via privileged file write vulnerabilities. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: high - -*Risk score*: 73 - -*Runs every*: None - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://itm4n.github.io/windows-dll-hijacking-clarified/ -* http://remoteawesomethoughts.blogspot.com/2019/05/windows-10-task-schedulerservice.html -* https://googleprojectzero.blogspot.com/2018/04/windows-exploitation-tricks-exploiting.html -* https://shellz.club/edgegdi-dll-for-persistence-and-lateral-movement/ -* https://windows-internals.com/faxing-your-way-to-system/ -* http://waleedassar.blogspot.com/2013/01/wow64logdll.html - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Persistence -* Privilege Escalation - -*version*: 2 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -library where dll.name : - ( - "wlbsctrl.dll", - "wbemcomn.dll", - "WptsExtensions.dll", - "Tsmsisrv.dll", - "TSVIPSrv.dll", - "Msfte.dll", - "wow64log.dll", - "WindowsCoreDeviceInfo.dll", - "Ualapi.dll", - "wlanhlp.dll", - "phoneinfo.dll", - "EdgeGdi.dll", - "cdpsgshims.dll", - "windowsperformancerecordercontrol.dll", - "diagtrack_win.dll" - ) and -not (dll.code_signature.subject_name : ("Microsoft Windows", "Microsoft Corporation") and dll.code_signature.status : "trusted") - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Privilege Escalation -** ID: TA0004 -** Reference URL: https://attack.mitre.org/tactics/TA0004/ -* Technique: -** Name: Hijack Execution Flow -** ID: T1574 -** Reference URL: https://attack.mitre.org/techniques/T1574/ -* Sub-technique: -** Name: DLL Side-Loading -** ID: T1574.002 -** Reference URL: https://attack.mitre.org/techniques/T1574/002/ -* Tactic: -** Name: Persistence -** ID: TA0003 -** Reference URL: https://attack.mitre.org/tactics/TA0003/ -* Technique: -** Name: Hijack Execution Flow -** ID: T1574 -** Reference URL: https://attack.mitre.org/techniques/T1574/ -* Sub-technique: -** Name: DLL Search Order Hijacking -** ID: T1574.001 -** Reference URL: https://attack.mitre.org/techniques/T1574/001/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-suspicious-execution-from-a-mounted-device.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-suspicious-execution-from-a-mounted-device.asciidoc deleted file mode 100644 index 64f86e2991..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-suspicious-execution-from-a-mounted-device.asciidoc +++ /dev/null @@ -1,92 +0,0 @@ -[[prebuilt-rule-0-13-1-suspicious-execution-from-a-mounted-device]] -=== Suspicious Execution from a Mounted Device - -Identifies when a script interpreter or signed binary is launched via a non-standard working directory. An attacker may use this technique to evade defenses. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: None - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/ -* https://www.volexity.com/blog/2021/05/27/suspected-apt29-operation-launches-election-fraud-themed-phishing-campaigns/ - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Defense Evasion - -*Version*: 1 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type == "start" and process.executable : "C:\\*" and - (process.working_directory : "?:\\" and not process.working_directory: "C:\\") and - process.parent.name : "explorer.exe" and - process.name : ("rundll32.exe", "mshta.exe", "powershell.exe", "pwsh.exe", "cmd.exe", "regsvr32.exe", - "cscript.exe", "wscript.exe") - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Defense Evasion -** ID: TA0005 -** Reference URL: https://attack.mitre.org/tactics/TA0005/ -* Technique: -** Name: Signed Binary Proxy Execution -** ID: T1218 -** Reference URL: https://attack.mitre.org/techniques/T1218/ -* Sub-technique: -** Name: Rundll32 -** ID: T1218.011 -** Reference URL: https://attack.mitre.org/techniques/T1218/011/ -* Sub-technique: -** Name: Mshta -** ID: T1218.005 -** Reference URL: https://attack.mitre.org/techniques/T1218/005/ -* Sub-technique: -** Name: Regsvr32 -** ID: T1218.010 -** Reference URL: https://attack.mitre.org/techniques/T1218/010/ -* Tactic: -** Name: Execution -** ID: TA0002 -** Reference URL: https://attack.mitre.org/tactics/TA0002/ -* Technique: -** Name: Command and Scripting Interpreter -** ID: T1059 -** Reference URL: https://attack.mitre.org/techniques/T1059/ -* Sub-technique: -** Name: PowerShell -** ID: T1059.001 -** Reference URL: https://attack.mitre.org/techniques/T1059/001/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-unusual-linux-network-port-activity.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-unusual-linux-network-port-activity.asciidoc deleted file mode 100644 index 6bd78e2afb..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-unusual-linux-network-port-activity.asciidoc +++ /dev/null @@ -1,39 +0,0 @@ -[[prebuilt-rule-0-13-1-unusual-linux-network-port-activity]] -=== Unusual Linux Network Port Activity - -Identifies unusual destination port activity that can indicate command-and-control, persistence mechanism, or data exfiltration activity. Rarely used destination port activity is generally unusual in Linux fleets, and can indicate unauthorized access or threat actor activity. - -*Rule type*: machine_learning - -*Rule indices*: None - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 15m - -*Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html - -*Tags*: - -* Elastic -* Host -* Linux -* Threat Detection -* ML - -*version*: 5 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-unusual-linux-process-calling-the-metadata-service.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-unusual-linux-process-calling-the-metadata-service.asciidoc deleted file mode 100644 index 6fcc52206b..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-unusual-linux-process-calling-the-metadata-service.asciidoc +++ /dev/null @@ -1,37 +0,0 @@ -[[prebuilt-rule-0-13-1-unusual-linux-process-calling-the-metadata-service]] -=== Unusual Linux Process Calling the Metadata Service - -Looks for anomalous access to the metadata service by an unusual process. The metadata service may be targeted in order to harvest credentials or user data scripts containing secrets. - -*Rule type*: machine_learning - -*Rule indices*: None - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 15m - -*Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Host -* Linux -* Threat Detection -* ML - -*version*: 3 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-unusual-linux-user-calling-the-metadata-service.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-unusual-linux-user-calling-the-metadata-service.asciidoc deleted file mode 100644 index 5e06874176..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-unusual-linux-user-calling-the-metadata-service.asciidoc +++ /dev/null @@ -1,37 +0,0 @@ -[[prebuilt-rule-0-13-1-unusual-linux-user-calling-the-metadata-service]] -=== Unusual Linux User Calling the Metadata Service - -Looks for anomalous access to the cloud platform metadata service by an unusual user. The metadata service may be targeted in order to harvest credentials or user data scripts containing secrets. - -*Rule type*: machine_learning - -*Rule indices*: None - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 15m - -*Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Host -* Linux -* Threat Detection -* ML - -*version*: 3 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-unusual-linux-username.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-unusual-linux-username.asciidoc deleted file mode 100644 index a1c3b354f8..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-unusual-linux-username.asciidoc +++ /dev/null @@ -1,53 +0,0 @@ -[[prebuilt-rule-0-13-1-unusual-linux-username]] -=== Unusual Linux Username - -A machine learning job detected activity for a username that is not normally active, which can indicate unauthorized changes, activity by unauthorized users, lateral movement, or compromised credentials. In many organizations, new usernames are not often created apart from specific types of system activities, such as creating new accounts for new employees. These user accounts quickly become active and routine. Events from rarely used usernames can point to suspicious activity. Additionally, automated Linux fleets tend to see activity from rarely used usernames only when personnel log in to make authorized or unauthorized changes, or threat actors have acquired credentials and log in for malicious purposes. Unusual usernames can also indicate pivoting, where compromised credentials are used to try and move laterally from one host to another. - -*Rule type*: machine_learning - -*Rule indices*: None - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 15m - -*Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html - -*Tags*: - -* Elastic -* Host -* Linux -* Threat Detection -* ML - -*version*: 6 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Triage and analysis - -### Investigating an Unusual Linux User -Detection alerts from this rule indicate activity for a Linux user name that is rare and unusual. Here are some possible avenues of investigation: -- Consider the user as identified by the username field. Is this program part of an expected workflow for the user who ran this program on this host? Could this be related to troubleshooting or debugging activity by a developer or site reliability engineer? -- Examine the history of user activity. If this user manifested only very recently, it might be a service account for a new software package. If it has a consistent cadence - for example if it runs monthly or quarterly - it might be part of a monthly or quarterly business process. -- Examine the process arguments, title and working directory. These may provide indications as to the source of the program or the nature of the tasks that the user is performing. ----------------------------------- diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-unusual-network-connection-via-dllhost.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-unusual-network-connection-via-dllhost.asciidoc deleted file mode 100644 index 66f69bb46d..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-unusual-network-connection-via-dllhost.asciidoc +++ /dev/null @@ -1,72 +0,0 @@ -[[prebuilt-rule-0-13-1-unusual-network-connection-via-dllhost]] -=== Unusual Network Connection via DllHost - -Identifies unusual instances of dllhost.exe making outbound network connections. This may indicate adversarial Command and Control activity. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: None - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/ -* https://www.volexity.com/blog/2021/05/27/suspected-apt29-operation-launches-election-fraud-themed-phishing-campaigns/ -* https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Defense Evasion - -*Version*: 1 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -sequence by host.id, process.entity_id with maxspan=1m - [process where event.type in ("start", "process_started") and process.name : "dllhost.exe" and process.args_count == 1] - [network where process.name : "dllhost.exe" and - not cidrmatch(destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", - "192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24", - "192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10", - "192.175.48.0/24", "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1", "FE80::/10", - "FF00::/8")] - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Defense Evasion -** ID: TA0005 -** Reference URL: https://attack.mitre.org/tactics/TA0005/ -* Technique: -** Name: Signed Binary Proxy Execution -** ID: T1218 -** Reference URL: https://attack.mitre.org/techniques/T1218/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-unusual-network-connection-via-rundll32.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-unusual-network-connection-via-rundll32.asciidoc deleted file mode 100644 index ee99a7655a..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-unusual-network-connection-via-rundll32.asciidoc +++ /dev/null @@ -1,74 +0,0 @@ -[[prebuilt-rule-0-13-1-unusual-network-connection-via-rundll32]] -=== Unusual Network Connection via RunDLL32 - -Identifies unusual instances of rundll32.exe making outbound network connections. This may indicate adversarial Command and Control activity. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: None - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Defense Evasion - -*version*: 10 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -sequence by host.id, process.entity_id with maxspan=1m - [process where event.type in ("start", "process_started") and process.name : "rundll32.exe" and process.args_count == 1] - [network where process.name : "rundll32.exe" and - not cidrmatch(destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", - "192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", - "192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4", - "100.64.0.0/10", "192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1", - "FE80::/10", "FF00::/8")] - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Defense Evasion -** ID: TA0005 -** Reference URL: https://attack.mitre.org/tactics/TA0005/ -* Technique: -** Name: Signed Binary Proxy Execution -** ID: T1218 -** Reference URL: https://attack.mitre.org/techniques/T1218/ -* Sub-technique: -** Name: Rundll32 -** ID: T1218.011 -** Reference URL: https://attack.mitre.org/techniques/T1218/011/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-unusual-process-for-a-linux-host.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-unusual-process-for-a-linux-host.asciidoc deleted file mode 100644 index 84f832417a..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-unusual-process-for-a-linux-host.asciidoc +++ /dev/null @@ -1,53 +0,0 @@ -[[prebuilt-rule-0-13-1-unusual-process-for-a-linux-host]] -=== Unusual Process For a Linux Host - -Identifies rare processes that do not usually run on individual hosts, which can indicate execution of unauthorized services, malware, or persistence mechanisms. Processes are considered rare when they only run occasionally as compared with other processes running on the host. - -*Rule type*: machine_learning - -*Rule indices*: None - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 15m - -*Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html - -*Tags*: - -* Elastic -* Host -* Linux -* Threat Detection -* ML - -*version*: 6 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Triage and analysis - -### Investigating an Unusual Linux Process -Detection alerts from this rule indicate the presence of a Linux process that is rare and unusual for the host it ran on. Here are some possible avenues of investigation: -- Consider the user as identified by the username field. Is this program part of an expected workflow for the user who ran this program on this host? -- Examine the history of execution. If this process manifested only very recently, it might be part of a new software package. If it has a consistent cadence - for example if it runs monthly or quarterly - it might be part of a monthly or quarterly business process. -- Examine the process arguments, title and working directory. These may provide indications as to the source of the program or the nature of the tasks it is performing. ----------------------------------- diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-unusual-process-for-a-windows-host.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-unusual-process-for-a-windows-host.asciidoc deleted file mode 100644 index 86685fe61c..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-unusual-process-for-a-windows-host.asciidoc +++ /dev/null @@ -1,56 +0,0 @@ -[[prebuilt-rule-0-13-1-unusual-process-for-a-windows-host]] -=== Unusual Process For a Windows Host - -Identifies rare processes that do not usually run on individual hosts, which can indicate execution of unauthorized services, malware, or persistence mechanisms. Processes are considered rare when they only run occasionally as compared with other processes running on the host. - -*Rule type*: machine_learning - -*Rule indices*: None - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 15m - -*Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* ML - -*version*: 6 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Triage and analysis - -### Investigating an Unusual Windows Process -Detection alerts from this rule indicate the presence of a Windows process that is rare and unusual for the host it ran on. Here are some possible avenues of investigation: -- Consider the user as identified by the username field. Is this program part of an expected workflow for the user who ran this program on this host? -- Examine the history of execution. If this process manifested only very recently, it might be part of a new software package. If it has a consistent cadence - for example if it runs monthly or quarterly - it might be part of a monthly or quarterly business process. -- Examine the process metadata like the values of the Company, Description and Product fields which may indicate whether the program is associated with an expected software vendor or package. -- Examine arguments and working directory. These may provide indications as to the source of the program or the nature of the tasks it is performing. -- Consider the same for the parent process. If the parent process is a legitimate system utility or service, this could be related to software updates or system management. If the parent process is something user-facing like an Office application, this process could be more suspicious. -- If you have file hash values in the event data, and you suspect malware, you can optionally run a search for the file hash to see if the file is identified as malware by anti-malware tools. ----------------------------------- diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-unusual-windows-network-activity.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-unusual-windows-network-activity.asciidoc deleted file mode 100644 index e5cd92a2e7..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-unusual-windows-network-activity.asciidoc +++ /dev/null @@ -1,57 +0,0 @@ -[[prebuilt-rule-0-13-1-unusual-windows-network-activity]] -=== Unusual Windows Network Activity - -Identifies Windows processes that do not usually use the network but have unexpected network activity, which can indicate command-and-control, lateral movement, persistence, or data exfiltration activity. A process with unusual network activity can denote process exploitation or injection, where the process is used to run persistence mechanisms that allow a malicious actor remote access or control of the host, data exfiltration, and execution of unauthorized network applications. - -*Rule type*: machine_learning - -*Rule indices*: None - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 15m - -*Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* ML - -*version*: 6 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Triage and analysis - -### Investigating Unusual Network Activity -Detection alerts from this rule indicate the presence of network activity from a Windows process for which network activity is very unusual. Here are some possible avenues of investigation: -- Consider the IP addresses, protocol and ports. Are these used by normal but infrequent network workflows? Are they expected or unexpected? -- If the destination IP address is remote or external, does it associate with an expected domain, organization or geography? Note: avoid interacting directly with suspected malicious IP addresses. -- Consider the user as identified by the username field. Is this network activity part of an expected workflow for the user who ran the program? -- Examine the history of execution. If this process manifested only very recently, it might be part of a new software package. If it has a consistent cadence - for example if it runs monthly or quarterly - it might be part of a monthly or quarterly business process. -- Examine the process arguments, title and working directory. These may provide indications as to the source of the program or the nature of the tasks it is performing. -- Consider the same for the parent process. If the parent process is a legitimate system utility or service, this could be related to software updates or system management. If the parent process is something user-facing like an Office application, this process could be more suspicious. -- If you have file hash values in the event data, and you suspect malware, you can optionally run a search for the file hash to see if the file is identified as malware by anti-malware tools. ----------------------------------- diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-unusual-windows-path-activity.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-unusual-windows-path-activity.asciidoc deleted file mode 100644 index 7e0fcc1c41..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-unusual-windows-path-activity.asciidoc +++ /dev/null @@ -1,39 +0,0 @@ -[[prebuilt-rule-0-13-1-unusual-windows-path-activity]] -=== Unusual Windows Path Activity - -Identifies processes started from atypical folders in the file system, which might indicate malware execution or persistence mechanisms. In corporate Windows environments, software installation is centrally managed and it is unusual for programs to be executed from user or temporary directories. Processes executed from these locations can denote that a user downloaded software directly from the Internet or a malicious script or macro executed malware. - -*Rule type*: machine_learning - -*Rule indices*: None - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 15m - -*Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* ML - -*version*: 5 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-unusual-windows-process-calling-the-metadata-service.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-unusual-windows-process-calling-the-metadata-service.asciidoc deleted file mode 100644 index f5c349844d..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-unusual-windows-process-calling-the-metadata-service.asciidoc +++ /dev/null @@ -1,37 +0,0 @@ -[[prebuilt-rule-0-13-1-unusual-windows-process-calling-the-metadata-service]] -=== Unusual Windows Process Calling the Metadata Service - -Looks for anomalous access to the metadata service by an unusual process. The metadata service may be targeted in order to harvest credentials or user data scripts containing secrets. - -*Rule type*: machine_learning - -*Rule indices*: None - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 15m - -*Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* ML - -*version*: 3 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-unusual-windows-user-calling-the-metadata-service.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-unusual-windows-user-calling-the-metadata-service.asciidoc deleted file mode 100644 index 9e2ab26a38..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-unusual-windows-user-calling-the-metadata-service.asciidoc +++ /dev/null @@ -1,37 +0,0 @@ -[[prebuilt-rule-0-13-1-unusual-windows-user-calling-the-metadata-service]] -=== Unusual Windows User Calling the Metadata Service - -Looks for anomalous access to the cloud platform metadata service by an unusual user. The metadata service may be targeted in order to harvest credentials or user data scripts containing secrets. - -*Rule type*: machine_learning - -*Rule indices*: None - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 15m - -*Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* ML - -*version*: 3 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-unusual-windows-username.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-unusual-windows-username.asciidoc deleted file mode 100644 index 7fe406c442..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-unusual-windows-username.asciidoc +++ /dev/null @@ -1,54 +0,0 @@ -[[prebuilt-rule-0-13-1-unusual-windows-username]] -=== Unusual Windows Username - -A machine learning job detected activity for a username that is not normally active, which can indicate unauthorized changes, activity by unauthorized users, lateral movement, or compromised credentials. In many organizations, new usernames are not often created apart from specific types of system activities, such as creating new accounts for new employees. These user accounts quickly become active and routine. Events from rarely used usernames can point to suspicious activity. Additionally, automated Linux fleets tend to see activity from rarely used usernames only when personnel log in to make authorized or unauthorized changes, or threat actors have acquired credentials and log in for malicious purposes. Unusual usernames can also indicate pivoting, where compromised credentials are used to try and move laterally from one host to another. - -*Rule type*: machine_learning - -*Rule indices*: None - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 15m - -*Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* ML - -*version*: 6 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Triage and analysis - -### Investigating an Unusual Windows User -Detection alerts from this rule indicate activity for a Windows user name that is rare and unusual. Here are some possible avenues of investigation: -- Consider the user as identified by the username field. Is this program part of an expected workflow for the user who ran this program on this host? Could this be related to occasional troubleshooting or support activity? -- Examine the history of user activity. If this user manifested only very recently, it might be a service account for a new software package. If it has a consistent cadence - for example if it runs monthly or quarterly - it might be part of a monthly or quarterly business process. -- Examine the process arguments, title and working directory. These may provide indications as to the source of the program or the nature of the tasks that the user is performing. -- Consider the same for the parent process. If the parent process is a legitimate system utility or service, this could be related to software updates or system management. If the parent process is something user-facing like an Office application, this process could be more suspicious. ----------------------------------- diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-vnc-virtual-network-computing-from-the-internet.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-vnc-virtual-network-computing-from-the-internet.asciidoc deleted file mode 100644 index 377349c57e..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-vnc-virtual-network-computing-from-the-internet.asciidoc +++ /dev/null @@ -1,104 +0,0 @@ -[[prebuilt-rule-0-13-1-vnc-virtual-network-computing-from-the-internet]] -=== VNC (Virtual Network Computing) from the Internet - -This rule detects network events that may indicate the use of VNC traffic from the Internet. VNC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or back-door vector. - -*Rule type*: query - -*Rule indices*: - -* filebeat-* -* packetbeat-* -* logs-endpoint.events.* - -*Severity*: high - -*Risk score*: 73 - -*Runs every*: None - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml - -*Tags*: - -* Elastic -* Host -* Network -* Threat Detection -* Command and Control - -*version*: 9 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -event.category:(network or network_traffic) and network.transport:tcp and destination.port >= 5800 and destination.port <= 5810 and - not source.ip:( - 10.0.0.0/8 or - 127.0.0.0/8 or - 169.254.0.0/16 or - 172.16.0.0/12 or - 192.0.0.0/24 or - 192.0.0.0/29 or - 192.0.0.8/32 or - 192.0.0.9/32 or - 192.0.0.10/32 or - 192.0.0.170/32 or - 192.0.0.171/32 or - 192.0.2.0/24 or - 192.31.196.0/24 or - 192.52.193.0/24 or - 192.168.0.0/16 or - 192.88.99.0/24 or - 224.0.0.0/4 or - 100.64.0.0/10 or - 192.175.48.0/24 or - 198.18.0.0/15 or - 198.51.100.0/24 or - 203.0.113.0/24 or - 240.0.0.0/4 or - "::1" or - "FE80::/10" or - "FF00::/8" - ) and - destination.ip:( - 10.0.0.0/8 or - 172.16.0.0/12 or - 192.168.0.0/16 - ) - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Command and Control -** ID: TA0011 -** Reference URL: https://attack.mitre.org/tactics/TA0011/ -* Technique: -** Name: Remote Access Software -** ID: T1219 -** Reference URL: https://attack.mitre.org/techniques/T1219/ -* Tactic: -** Name: Initial Access -** ID: TA0001 -** Reference URL: https://attack.mitre.org/tactics/TA0001/ -* Technique: -** Name: Exploit Public-Facing Application -** ID: T1190 -** Reference URL: https://attack.mitre.org/techniques/T1190/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-vnc-virtual-network-computing-to-the-internet.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-vnc-virtual-network-computing-to-the-internet.asciidoc deleted file mode 100644 index b27b700648..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rule-0-13-1-vnc-virtual-network-computing-to-the-internet.asciidoc +++ /dev/null @@ -1,96 +0,0 @@ -[[prebuilt-rule-0-13-1-vnc-virtual-network-computing-to-the-internet]] -=== VNC (Virtual Network Computing) to the Internet - -This rule detects network events that may indicate the use of VNC traffic to the Internet. VNC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or back-door vector. - -*Rule type*: query - -*Rule indices*: - -* filebeat-* -* packetbeat-* -* logs-endpoint.events.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: None - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml - -*Tags*: - -* Elastic -* Host -* Network -* Threat Detection -* Command and Control - -*version*: 9 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -event.category:(network or network_traffic) and network.transport:tcp and destination.port >= 5800 and destination.port <= 5810 and - source.ip:( - 10.0.0.0/8 or - 172.16.0.0/12 or - 192.168.0.0/16 - ) and - not destination.ip:( - 10.0.0.0/8 or - 127.0.0.0/8 or - 169.254.0.0/16 or - 172.16.0.0/12 or - 192.0.0.0/24 or - 192.0.0.0/29 or - 192.0.0.8/32 or - 192.0.0.9/32 or - 192.0.0.10/32 or - 192.0.0.170/32 or - 192.0.0.171/32 or - 192.0.2.0/24 or - 192.31.196.0/24 or - 192.52.193.0/24 or - 192.168.0.0/16 or - 192.88.99.0/24 or - 224.0.0.0/4 or - 100.64.0.0/10 or - 192.175.48.0/24 or - 198.18.0.0/15 or - 198.51.100.0/24 or - 203.0.113.0/24 or - 240.0.0.0/4 or - "::1" or - "FE80::/10" or - "FF00::/8" - ) - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Command and Control -** ID: TA0011 -** Reference URL: https://attack.mitre.org/tactics/TA0011/ -* Technique: -** Name: Remote Access Software -** ID: T1219 -** Reference URL: https://attack.mitre.org/techniques/T1219/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rules-0-13-1-appendix.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rules-0-13-1-appendix.asciidoc deleted file mode 100644 index 089b3559e4..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rules-0-13-1-appendix.asciidoc +++ /dev/null @@ -1,51 +0,0 @@ -["appendix",role="exclude",id="prebuilt-rule-0-13-1-prebuilt-rules-0-13-1-appendix"] -= Downloadable rule update v0.13.1 - -This section lists all updates associated with version 0.13.1 of the Fleet integration *Prebuilt Security Detection Rules*. - - -include::prebuilt-rule-0-13-1-aws-ec2-vm-export-failure.asciidoc[] -include::prebuilt-rule-0-13-1-modification-of-amsienable-registry-key.asciidoc[] -include::prebuilt-rule-0-13-1-suspicious-execution-from-a-mounted-device.asciidoc[] -include::prebuilt-rule-0-13-1-unusual-network-connection-via-dllhost.asciidoc[] -include::prebuilt-rule-0-13-1-anomalous-process-for-a-linux-population.asciidoc[] -include::prebuilt-rule-0-13-1-anomalous-process-for-a-windows-population.asciidoc[] -include::prebuilt-rule-0-13-1-anomalous-windows-process-creation.asciidoc[] -include::prebuilt-rule-0-13-1-apple-script-execution-followed-by-network-connection.asciidoc[] -include::prebuilt-rule-0-13-1-attempts-to-brute-force-a-microsoft-365-user-account.asciidoc[] -include::prebuilt-rule-0-13-1-attempts-to-brute-force-an-okta-user-account.asciidoc[] -include::prebuilt-rule-0-13-1-command-prompt-network-connection.asciidoc[] -include::prebuilt-rule-0-13-1-component-object-model-hijacking.asciidoc[] -include::prebuilt-rule-0-13-1-connection-to-external-network-via-telnet.asciidoc[] -include::prebuilt-rule-0-13-1-connection-to-internal-network-via-telnet.asciidoc[] -include::prebuilt-rule-0-13-1-dns-activity-to-the-internet.asciidoc[] -include::prebuilt-rule-0-13-1-high-number-of-okta-user-password-reset-or-unlock-attempts.asciidoc[] -include::prebuilt-rule-0-13-1-macos-installer-spawns-network-event.asciidoc[] -include::prebuilt-rule-0-13-1-network-connection-via-certutil.asciidoc[] -include::prebuilt-rule-0-13-1-network-connection-via-compiled-html-file.asciidoc[] -include::prebuilt-rule-0-13-1-network-connection-via-msxsl.asciidoc[] -include::prebuilt-rule-0-13-1-network-connection-via-registration-utility.asciidoc[] -include::prebuilt-rule-0-13-1-network-connection-via-signed-binary.asciidoc[] -include::prebuilt-rule-0-13-1-network-traffic-to-rare-destination-country.asciidoc[] -include::prebuilt-rule-0-13-1-rdp-remote-desktop-protocol-from-the-internet.asciidoc[] -include::prebuilt-rule-0-13-1-roshal-archive-rar-or-powershell-file-downloaded-from-the-internet.asciidoc[] -include::prebuilt-rule-0-13-1-rpc-remote-procedure-call-from-the-internet.asciidoc[] -include::prebuilt-rule-0-13-1-rpc-remote-procedure-call-to-the-internet.asciidoc[] -include::prebuilt-rule-0-13-1-spike-in-firewall-denies.asciidoc[] -include::prebuilt-rule-0-13-1-spike-in-network-traffic.asciidoc[] -include::prebuilt-rule-0-13-1-spike-in-network-traffic-to-a-country.asciidoc[] -include::prebuilt-rule-0-13-1-suspicious-dll-loaded-for-persistence-or-privilege-escalation.asciidoc[] -include::prebuilt-rule-0-13-1-unusual-linux-network-port-activity.asciidoc[] -include::prebuilt-rule-0-13-1-unusual-linux-process-calling-the-metadata-service.asciidoc[] -include::prebuilt-rule-0-13-1-unusual-linux-user-calling-the-metadata-service.asciidoc[] -include::prebuilt-rule-0-13-1-unusual-linux-username.asciidoc[] -include::prebuilt-rule-0-13-1-unusual-network-connection-via-rundll32.asciidoc[] -include::prebuilt-rule-0-13-1-unusual-process-for-a-linux-host.asciidoc[] -include::prebuilt-rule-0-13-1-unusual-process-for-a-windows-host.asciidoc[] -include::prebuilt-rule-0-13-1-unusual-windows-network-activity.asciidoc[] -include::prebuilt-rule-0-13-1-unusual-windows-path-activity.asciidoc[] -include::prebuilt-rule-0-13-1-unusual-windows-process-calling-the-metadata-service.asciidoc[] -include::prebuilt-rule-0-13-1-unusual-windows-user-calling-the-metadata-service.asciidoc[] -include::prebuilt-rule-0-13-1-unusual-windows-username.asciidoc[] -include::prebuilt-rule-0-13-1-vnc-virtual-network-computing-from-the-internet.asciidoc[] -include::prebuilt-rule-0-13-1-vnc-virtual-network-computing-to-the-internet.asciidoc[] \ No newline at end of file diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rules-0-13-1-summary.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rules-0-13-1-summary.asciidoc deleted file mode 100644 index 90c4d0df89..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-1/prebuilt-rules-0-13-1-summary.asciidoc +++ /dev/null @@ -1,102 +0,0 @@ -[[prebuilt-rule-0-13-1-prebuilt-rules-0-13-1-summary]] -[role="xpack"] -== Update v0.13.1 - -This section lists all updates associated with version 0.13.1 of the Fleet integration *Prebuilt Security Detection Rules*. - - -[width="100%",options="header"] -|============================================== -|Rule |Description |Status |Version - -|<> | Identifies an attempt to export an AWS EC2 instance. A virtual machine (VM) export may indicate an attempt to extract or exfiltrate information. | new | 1 - -|<> | Jscript tries to query the AmsiEnable registry key from the HKEY_USERS registry hive before initializing Antimalware Scan Interface (AMSI). If this key is set to 0, AMSI is not enabled for the Jscript process. An adversary can modify this key to disable AMSI protections. | new | 1 - -|<> | Identifies when a script interpreter or signed binary is launched via a non-standard working directory. An attacker may use this technique to evade defenses. | new | 1 - -|<> | Identifies unusual instances of dllhost.exe making outbound network connections. This may indicate adversarial Command and Control activity. | new | 1 - -|<> | Searches for rare processes running on multiple Linux hosts in an entire fleet or network. This reduces the detection of false positives since automated maintenance processes usually only run occasionally on a single machine but are common to all or many hosts in a fleet. | update | 6 - -|<> | Searches for rare processes running on multiple hosts in an entire fleet or network. This reduces the detection of false positives since automated maintenance processes usually only run occasionally on a single machine but are common to all or many hosts in a fleet. | update | 6 - -|<> | Identifies unusual parent-child process relationships that can indicate malware execution or persistence mechanisms. Malicious scripts often call on other applications and processes as part of their exploit payload. For example, when a malicious Office document runs scripts as part of an exploit payload, Excel or Word may start a script interpreter process, which, in turn, runs a script that downloads and executes malware. Another common scenario is Outlook running an unusual process when malware is downloaded in an email. Monitoring and identifying anomalous process relationships is a method of detecting new and emerging malware that is not yet recognized by anti-virus scanners. | update | 5 - -|<> | Detects execution via the Apple script interpreter (osascript) followed by a network connection from the same process within a short time period. Adversaries may use malicious scripts for execution and command and control. | update | 3 - -|<> | Identifies attempts to brute force a Microsoft 365 user account. An adversary may attempt a brute force attack to obtain unauthorized access to user accounts. | update | 4 - -|<> | Identifies when an Okta user account is locked out 3 times within a 3 hour window. An adversary may attempt a brute force or password spraying attack to obtain unauthorized access to user accounts. The default Okta authentication policy ensures that a user account is locked out after 10 failed authentication attempts. | update | 5 - -|<> | Identifies cmd.exe making a network connection. Adversaries could abuse cmd.exe to download or execute malware from a remote URL. | update | 7 - -|<> | Identifies Component Object Model (COM) hijacking via registry modification. Adversaries may establish persistence by executing malicious content triggered by hijacked references to COM objects. | update | 4 - -|<> | Telnet provides a command line interface for communication with a remote device or server. This rule identifies Telnet network connections to publicly routable IP addresses. | update | 6 - -|<> | Telnet provides a command line interface for communication with a remote device or server. This rule identifies Telnet network connections to non-publicly routable IP addresses. | update | 6 - -|<> | This rule detects when an internal network client sends DNS traffic directly to the Internet. This is atypical behavior for a managed network, and can be indicative of malware, exfiltration, command and control, or, simply, misconfiguration. This DNS activity also impacts your organization's ability to provide enterprise monitoring and logging of DNS, and opens your network to a variety of abuses and malicious communications. | update | 9 - -|<> | Identifies a high number of Okta user password reset or account unlock attempts. An adversary may attempt to obtain unauthorized access to Okta user accounts using these methods and attempt to blend in with normal activity in their target's environment and evade detection. | update | 5 - -|<> | Identifies when the built in macOS Installer program generates a network event after attempting to install a .pkg file. This activity has been observed being leveraged by malware. | update | 2 - -|<> | Identifies certutil.exe making a network connection. Adversaries could abuse certutil.exe to download a certificate, or malware, from a remote URL. | update | 6 - -|<> | Compiled HTML files (.chm) are commonly distributed as part of the Microsoft HTML Help system. Adversaries may conceal malicious code in a CHM file and deliver it to a victim for execution. CHM content is loaded by the HTML Help executable program (hh.exe). | update | 8 - -|<> | Identifies msxsl.exe making a network connection. This may indicate adversarial activity as msxsl.exe is often leveraged by adversaries to execute malicious scripts and evade detection. | update | 7 - -|<> | Identifies the native Windows tools regsvr32.exe, regsvr64.exe, RegSvcs.exe, or RegAsm.exe making a network connection. This may be indicative of an attacker bypassing allowlists or running arbitrary scripts via a signed Microsoft binary. | update | 9 - -|<> | Binaries signed with trusted digital certificates can execute on Windows systems protected by digital signature validation. Adversaries may use these binaries to 'live off the land' and execute malicious files that could bypass application allowlists and signature validation. | update | 8 - -|<> | A machine learning job detected a rare destination country name in the network logs. This can be due to initial access, persistence, command-and-control, or exfiltration activity. For example, when a user clicks on a link in a phishing email or opens a malicious document, a request may be sent to download and run a payload from a server in a country which does not normally appear in network traffic or business work-flows. Malware instances and persistence mechanisms may communicate with command-and-control (C2) infrastructure in their country of origin, which may be an unusual destination country for the source network. | update | 2 - -|<> | This rule detects network events that may indicate the use of RDP traffic from the Internet. RDP is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or back-door vector. | update | 9 - -|<> | Detects a Roshal Archive (RAR) file or PowerShell script downloaded from the internet by an internal host. Gaining initial access to a system and then downloading encoded or encrypted tools to move laterally is a common practice for adversaries as a way to protect their more valuable tools and TTPs. This may be atypical behavior for a managed network and can be indicative of malware, exfiltration, or command and control. | update | 5 - -|<> | This rule detects network events that may indicate the use of RPC traffic from the Internet. RPC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or back-door vector. | update | 9 - -|<> | This rule detects network events that may indicate the use of RPC traffic to the Internet. RPC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or back-door vector. | update | 9 - -|<> | A machine learning job detected an unusually large spike in network traffic that was denied by network access control lists (ACLs) or firewall rules. Such a burst of denied traffic is usually caused by either 1) a mis-configured application or firewall or 2) suspicious or malicious activity. Unsuccessful attempts at network transit, in order to connect to command-and-control (C2), or engage in data exfiltration, may produce a burst of failed connections. This could also be due to unusually large amounts of reconnaissance or enumeration traffic. Denial-of-service attacks or traffic floods may also produce such a surge in traffic. | update | 2 - -|<> | A machine learning job detected an unusually large spike in network traffic. Such a burst of traffic, if not caused by a surge in business activity, can be due to suspicious or malicious activity. Large-scale data exfiltration may produce a burst of network traffic; this could also be due to unusually large amounts of reconnaissance or enumeration traffic. Denial-of-service attacks or traffic floods may also produce such a surge in traffic. | update | 2 - -|<> | A machine learning job detected an unusually large spike in network activity to one destination country in the network logs. This could be due to unusually large amounts of reconnaissance or enumeration traffic. Data exfiltration activity may also produce such a surge in traffic to a destination country which does not normally appear in network traffic or business work-flows. Malware instances and persistence mechanisms may communicate with command-and-control (C2) infrastructure in their country of origin, which may be an unusual destination country for the source network. | update | 2 - -|<> | Identifies the loading of a non Microsoft signed DLL that is missing on a default Windows install (phantom DLL) or one that can be loaded from a different location by a native Windows process. This may be abused to persist or elevate privileges via privileged file write vulnerabilities. | update | 2 - -|<> | Identifies unusual destination port activity that can indicate command-and-control, persistence mechanism, or data exfiltration activity. Rarely used destination port activity is generally unusual in Linux fleets, and can indicate unauthorized access or threat actor activity. | update | 5 - -|<> | Looks for anomalous access to the metadata service by an unusual process. The metadata service may be targeted in order to harvest credentials or user data scripts containing secrets. | update | 3 - -|<> | Looks for anomalous access to the cloud platform metadata service by an unusual user. The metadata service may be targeted in order to harvest credentials or user data scripts containing secrets. | update | 3 - -|<> | A machine learning job detected activity for a username that is not normally active, which can indicate unauthorized changes, activity by unauthorized users, lateral movement, or compromised credentials. In many organizations, new usernames are not often created apart from specific types of system activities, such as creating new accounts for new employees. These user accounts quickly become active and routine. Events from rarely used usernames can point to suspicious activity. Additionally, automated Linux fleets tend to see activity from rarely used usernames only when personnel log in to make authorized or unauthorized changes, or threat actors have acquired credentials and log in for malicious purposes. Unusual usernames can also indicate pivoting, where compromised credentials are used to try and move laterally from one host to another. | update | 6 - -|<> | Identifies unusual instances of rundll32.exe making outbound network connections. This may indicate adversarial Command and Control activity. | update | 10 - -|<> | Identifies rare processes that do not usually run on individual hosts, which can indicate execution of unauthorized services, malware, or persistence mechanisms. Processes are considered rare when they only run occasionally as compared with other processes running on the host. | update | 6 - -|<> | Identifies rare processes that do not usually run on individual hosts, which can indicate execution of unauthorized services, malware, or persistence mechanisms. Processes are considered rare when they only run occasionally as compared with other processes running on the host. | update | 6 - -|<> | Identifies Windows processes that do not usually use the network but have unexpected network activity, which can indicate command-and-control, lateral movement, persistence, or data exfiltration activity. A process with unusual network activity can denote process exploitation or injection, where the process is used to run persistence mechanisms that allow a malicious actor remote access or control of the host, data exfiltration, and execution of unauthorized network applications. | update | 6 - -|<> | Identifies processes started from atypical folders in the file system, which might indicate malware execution or persistence mechanisms. In corporate Windows environments, software installation is centrally managed and it is unusual for programs to be executed from user or temporary directories. Processes executed from these locations can denote that a user downloaded software directly from the Internet or a malicious script or macro executed malware. | update | 5 - -|<> | Looks for anomalous access to the metadata service by an unusual process. The metadata service may be targeted in order to harvest credentials or user data scripts containing secrets. | update | 3 - -|<> | Looks for anomalous access to the cloud platform metadata service by an unusual user. The metadata service may be targeted in order to harvest credentials or user data scripts containing secrets. | update | 3 - -|<> | A machine learning job detected activity for a username that is not normally active, which can indicate unauthorized changes, activity by unauthorized users, lateral movement, or compromised credentials. In many organizations, new usernames are not often created apart from specific types of system activities, such as creating new accounts for new employees. These user accounts quickly become active and routine. Events from rarely used usernames can point to suspicious activity. Additionally, automated Linux fleets tend to see activity from rarely used usernames only when personnel log in to make authorized or unauthorized changes, or threat actors have acquired credentials and log in for malicious purposes. Unusual usernames can also indicate pivoting, where compromised credentials are used to try and move laterally from one host to another. | update | 6 - -|<> | This rule detects network events that may indicate the use of VNC traffic from the Internet. VNC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or back-door vector. | update | 9 - -|<> | This rule detects network events that may indicate the use of VNC traffic to the Internet. VNC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or back-door vector. | update | 9 - -|============================================== diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rule-0-13-2-attempts-to-brute-force-a-microsoft-365-user-account.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rule-0-13-2-attempts-to-brute-force-a-microsoft-365-user-account.asciidoc deleted file mode 100644 index 57c087d1ad..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rule-0-13-2-attempts-to-brute-force-a-microsoft-365-user-account.asciidoc +++ /dev/null @@ -1,78 +0,0 @@ -[[prebuilt-rule-0-13-2-attempts-to-brute-force-a-microsoft-365-user-account]] -=== Attempts to Brute Force a Microsoft 365 User Account - -Identifies attempts to brute force a Microsoft 365 user account. An adversary may attempt a brute force attack to obtain unauthorized access to user accounts. - -*Rule type*: threshold - -*Rule indices*: - -* filebeat-* -* logs-o365* - -*Severity*: high - -*Risk score*: 73 - -*Runs every*: 5m - -*Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://blueteamblog.com/7-ways-to-monitor-your-office-365-logs-using-siem - -*Tags*: - -* Elastic -* Cloud -* Microsoft 365 -* Continuous Monitoring -* SecOps -* Identity and Access - -*Version*: 5 - -*Rule authors*: - -* Elastic -* Willem D'Haese -* Austin Songer - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Config - -The Microsoft 365 Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -event.dataset:o365.audit and event.provider:(AzureActiveDirectory or Exchange) and - event.category:authentication and event.action:(UserLoginFailed or PasswordLogonInitialAuthUsingPassword) and - not o365.audit.LogonError:(UserAccountNotFound or EntitlementGrantsNotFound or UserStrongAuthEnrollmentRequired or - UserStrongAuthClientAuthNRequired or InvalidReplyTo) and event.outcome:failure - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Credential Access -** ID: TA0006 -** Reference URL: https://attack.mitre.org/tactics/TA0006/ -* Technique: -** Name: Brute Force -** ID: T1110 -** Reference URL: https://attack.mitre.org/techniques/T1110/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rule-0-13-2-aws-ec2-full-network-packet-capture-detected.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rule-0-13-2-aws-ec2-full-network-packet-capture-detected.asciidoc deleted file mode 100644 index ab454be315..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rule-0-13-2-aws-ec2-full-network-packet-capture-detected.asciidoc +++ /dev/null @@ -1,85 +0,0 @@ -[[prebuilt-rule-0-13-2-aws-ec2-full-network-packet-capture-detected]] -=== AWS EC2 Full Network Packet Capture Detected - -Identifies potential Traffic Mirroring in an Amazon Elastic Compute Cloud (EC2) instance. Traffic Mirroring is an Amazon VPC feature that you can use to copy network traffic from an elastic network interface. This feature can potentially be abused to exfiltrate sensitive data from unencrypted internal traffic. - -*Rule type*: query - -*Rule indices*: - -* filebeat-* -* logs-aws* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 10m - -*Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_TrafficMirrorFilter.html -* https://github.com/easttimor/aws-incident-response - -*Tags*: - -* Elastic -* Cloud -* AWS -* Continuous Monitoring -* SecOps -* Network Security - -*Version*: 1 - -*Rule authors*: - -* Elastic -* Austin Songer - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Config - -The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -event.dataset:aws.cloudtrail and event.provider:ec2.amazonaws.com and -event.action:(CreateTrafficMirrorFilter or CreateTrafficMirrorFilterRule or CreateTrafficMirrorSession or CreateTrafficMirrorTarget) and -event.outcome:success - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Exfiltration -** ID: TA0010 -** Reference URL: https://attack.mitre.org/tactics/TA0010/ -* Technique: -** Name: Automated Exfiltration -** ID: T1020 -** Reference URL: https://attack.mitre.org/techniques/T1020/ -* Tactic: -** Name: Collection -** ID: TA0009 -** Reference URL: https://attack.mitre.org/tactics/TA0009/ -* Technique: -** Name: Data Staged -** ID: T1074 -** Reference URL: https://attack.mitre.org/techniques/T1074/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rule-0-13-2-aws-ec2-vm-export-failure.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rule-0-13-2-aws-ec2-vm-export-failure.asciidoc deleted file mode 100644 index e97fe96956..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rule-0-13-2-aws-ec2-vm-export-failure.asciidoc +++ /dev/null @@ -1,82 +0,0 @@ -[[prebuilt-rule-0-13-2-aws-ec2-vm-export-failure]] -=== AWS EC2 VM Export Failure - -Identifies an attempt to export an AWS EC2 instance. A virtual machine (VM) export may indicate an attempt to extract or exfiltrate information. - -*Rule type*: query - -*Rule indices*: - -* filebeat-* -* logs-aws* - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 10m - -*Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://docs.aws.amazon.com/vm-import/latest/userguide/vmexport.html#export-instance - -*Tags*: - -* Elastic -* Cloud -* AWS -* Continuous Monitoring -* SecOps -* Asset Visibility - -*Version*: 2 - -*Rule authors*: - -* Elastic -* Austin Songer - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Config - -The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -event.dataset:aws.cloudtrail and event.provider:ec2.amazonaws.com and event.action:CreateInstanceExportTask and event.outcome:failure - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Exfiltration -** ID: TA0010 -** Reference URL: https://attack.mitre.org/tactics/TA0010/ -* Technique: -** Name: Transfer Data to Cloud Account -** ID: T1537 -** Reference URL: https://attack.mitre.org/techniques/T1537/ -* Tactic: -** Name: Collection -** ID: TA0009 -** Reference URL: https://attack.mitre.org/tactics/TA0009/ -* Technique: -** Name: Data from Local System -** ID: T1005 -** Reference URL: https://attack.mitre.org/techniques/T1005/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rule-0-13-2-aws-rds-instance-creation.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rule-0-13-2-aws-rds-instance-creation.asciidoc deleted file mode 100644 index b1c4978137..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rule-0-13-2-aws-rds-instance-creation.asciidoc +++ /dev/null @@ -1,69 +0,0 @@ -[[prebuilt-rule-0-13-2-aws-rds-instance-creation]] -=== AWS RDS Instance Creation - -Identifies the creation of an Amazon Relational Database Service (RDS) Aurora database instance. - -*Rule type*: query - -*Rule indices*: - -* filebeat-* -* logs-aws* - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 10m - -*Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateDBInstance.html - -*Tags*: - -* Elastic -* Cloud -* AWS -* Continuous Monitoring -* SecOps -* Asset Visibility - -*Version*: 1 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Config - -The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -event.dataset:aws.cloudtrail and event.provider:rds.amazonaws.com and event.action:CreateDBInstance and event.outcome:success - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Persistence -** ID: TA0003 -** Reference URL: https://attack.mitre.org/tactics/TA0003/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rule-0-13-2-aws-rds-security-group-creation.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rule-0-13-2-aws-rds-security-group-creation.asciidoc deleted file mode 100644 index 658a742064..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rule-0-13-2-aws-rds-security-group-creation.asciidoc +++ /dev/null @@ -1,78 +0,0 @@ -[[prebuilt-rule-0-13-2-aws-rds-security-group-creation]] -=== AWS RDS Security Group Creation - -Identifies the creation of an Amazon Relational Database Service (RDS) Security Group. - -*Rule type*: query - -*Rule indices*: - -* filebeat-* -* logs-aws* - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 10m - -*Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateDBSecurityGroup.html - -*Tags*: - -* Elastic -* Cloud -* AWS -* Continuous Monitoring -* SecOps -* Monitoring - -*Version*: 1 - -*Rule authors*: - -* Elastic -* Austin Songer - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Config - -The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -event.dataset:aws.cloudtrail and event.provider:rds.amazonaws.com and event.action:CreateDBSecurityGroup and event.outcome:success - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Persistence -** ID: TA0003 -** Reference URL: https://attack.mitre.org/tactics/TA0003/ -* Technique: -** Name: Create Account -** ID: T1136 -** Reference URL: https://attack.mitre.org/techniques/T1136/ -* Sub-technique: -** Name: Cloud Account -** ID: T1136.003 -** Reference URL: https://attack.mitre.org/techniques/T1136/003/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rule-0-13-2-aws-rds-security-group-deletion.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rule-0-13-2-aws-rds-security-group-deletion.asciidoc deleted file mode 100644 index da3b0d6c85..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rule-0-13-2-aws-rds-security-group-deletion.asciidoc +++ /dev/null @@ -1,74 +0,0 @@ -[[prebuilt-rule-0-13-2-aws-rds-security-group-deletion]] -=== AWS RDS Security Group Deletion - -Identifies the deletion of an Amazon Relational Database Service (RDS) Security Group. - -*Rule type*: query - -*Rule indices*: - -* filebeat-* -* logs-aws* - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 10m - -*Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DeleteDBSecurityGroup.html - -*Tags*: - -* Elastic -* Cloud -* AWS -* Continuous Monitoring -* SecOps -* Monitoring - -*Version*: 1 - -*Rule authors*: - -* Elastic -* Austin Songer - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Config - -The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -event.dataset:aws.cloudtrail and event.provider:rds.amazonaws.com and event.action:DeleteDBSecurityGroup and event.outcome:success - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Impact -** ID: TA0040 -** Reference URL: https://attack.mitre.org/tactics/TA0040/ -* Technique: -** Name: Account Access Removal -** ID: T1531 -** Reference URL: https://attack.mitre.org/techniques/T1531/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rule-0-13-2-aws-rds-snapshot-export.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rule-0-13-2-aws-rds-snapshot-export.asciidoc deleted file mode 100644 index 9d1bba97ce..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rule-0-13-2-aws-rds-snapshot-export.asciidoc +++ /dev/null @@ -1,69 +0,0 @@ -[[prebuilt-rule-0-13-2-aws-rds-snapshot-export]] -=== AWS RDS Snapshot Export - -Identifies the export of an Amazon Relational Database Service (RDS) Aurora database snapshot. - -*Rule type*: query - -*Rule indices*: - -* filebeat-* -* logs-aws* - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 10m - -*Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_StartExportTask.html - -*Tags*: - -* Elastic -* Cloud -* AWS -* Continuous Monitoring -* SecOps -* Asset Visibility - -*Version*: 1 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Config - -The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -event.dataset:aws.cloudtrail and event.provider:rds.amazonaws.com and event.action:StartExportTask and event.outcome:success - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Exfiltration -** ID: TA0010 -** Reference URL: https://attack.mitre.org/tactics/TA0010/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rule-0-13-2-aws-route-53-domain-transfer-lock-disabled.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rule-0-13-2-aws-route-53-domain-transfer-lock-disabled.asciidoc deleted file mode 100644 index bc325debb2..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rule-0-13-2-aws-route-53-domain-transfer-lock-disabled.asciidoc +++ /dev/null @@ -1,79 +0,0 @@ -[[prebuilt-rule-0-13-2-aws-route-53-domain-transfer-lock-disabled]] -=== AWS Route 53 Domain Transfer Lock Disabled - -Identifies when a transfer lock was removed from a Route 53 domain. It is recommended to refrain from performing this action unless intending to transfer the domain to a different registrar. - -*Rule type*: query - -*Rule indices*: - -* filebeat-* -* logs-aws* - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 10m - -*Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://docs.aws.amazon.com/Route53/latest/APIReference/API_Operations_Amazon_Route_53.html -* https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_DisableDomainTransferLock.html - -*Tags*: - -* Elastic -* Cloud -* AWS -* Continuous Monitoring -* SecOps -* Asset Visibility - -*Version*: 1 - -*Rule authors*: - -* Elastic -* Austin Songer - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Config - -The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -event.dataset:aws.cloudtrail and event.provider:route53.amazonaws.com and event.action:DisableDomainTransferLock and event.outcome:success - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Persistence -** ID: TA0003 -** Reference URL: https://attack.mitre.org/tactics/TA0003/ -* Technique: -** Name: Account Manipulation -** ID: T1098 -** Reference URL: https://attack.mitre.org/techniques/T1098/ -* Tactic: -** Name: Credential Access -** ID: TA0006 -** Reference URL: https://attack.mitre.org/tactics/TA0006/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rule-0-13-2-aws-route-53-domain-transferred-to-another-account.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rule-0-13-2-aws-route-53-domain-transferred-to-another-account.asciidoc deleted file mode 100644 index 58dafb8e99..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rule-0-13-2-aws-route-53-domain-transferred-to-another-account.asciidoc +++ /dev/null @@ -1,78 +0,0 @@ -[[prebuilt-rule-0-13-2-aws-route-53-domain-transferred-to-another-account]] -=== AWS Route 53 Domain Transferred to Another Account - -Identifies when a request has been made to transfer a Route 53 domain to another AWS account. - -*Rule type*: query - -*Rule indices*: - -* filebeat-* -* logs-aws* - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 10m - -*Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://docs.aws.amazon.com/Route53/latest/APIReference/API_Operations_Amazon_Route_53.html - -*Tags*: - -* Elastic -* Cloud -* AWS -* Continuous Monitoring -* SecOps -* Asset Visibility - -*Version*: 1 - -*Rule authors*: - -* Elastic -* Austin Songer - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Config - -The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -event.dataset:aws.cloudtrail and event.provider:route53.amazonaws.com and event.action:TransferDomainToAnotherAwsAccount and event.outcome:success - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Persistence -** ID: TA0003 -** Reference URL: https://attack.mitre.org/tactics/TA0003/ -* Technique: -** Name: Account Manipulation -** ID: T1098 -** Reference URL: https://attack.mitre.org/techniques/T1098/ -* Tactic: -** Name: Credential Access -** ID: TA0006 -** Reference URL: https://attack.mitre.org/tactics/TA0006/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rule-0-13-2-azure-service-principal-credentials-added.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rule-0-13-2-azure-service-principal-credentials-added.asciidoc deleted file mode 100644 index 3c36aaa904..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rule-0-13-2-azure-service-principal-credentials-added.asciidoc +++ /dev/null @@ -1,74 +0,0 @@ -[[prebuilt-rule-0-13-2-azure-service-principal-credentials-added]] -=== Azure Service Principal Credentials Added - -Identifies when new Service Principal credentials have been added in Azure. In most organizations, credentials will be added to service principals infrequently. Hijacking an application (by adding a rogue secret or certificate) with granted permissions will allow the attacker to access data that is normally protected by MFA requirements. - -*Rule type*: query - -*Rule indices*: - -* filebeat-* -* logs-azure* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 10m - -*Searches indices from*: now-25m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.fireeye.com/content/dam/collateral/en/wp-m-unc2452.pdf - -*Tags*: - -* Elastic -* Cloud -* Azure -* Continuous Monitoring -* SecOps -* Identity and Access - -*Version*: 1 - -*Rule authors*: - -* Elastic -* Austin Songer - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Config - -The Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -event.dataset:azure.auditlogs and azure.auditlogs.operation_name:"Add service principal credentials." and event.outcome:(success or Success) - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Impact -** ID: TA0040 -** Reference URL: https://attack.mitre.org/tactics/TA0040/ -* Technique: -** Name: Resource Hijacking -** ID: T1496 -** Reference URL: https://attack.mitre.org/techniques/T1496/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rule-0-13-2-disabling-windows-defender-security-settings-via-powershell.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rule-0-13-2-disabling-windows-defender-security-settings-via-powershell.asciidoc deleted file mode 100644 index eb16de1a01..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rule-0-13-2-disabling-windows-defender-security-settings-via-powershell.asciidoc +++ /dev/null @@ -1,69 +0,0 @@ -[[prebuilt-rule-0-13-2-disabling-windows-defender-security-settings-via-powershell]] -=== Disabling Windows Defender Security Settings via PowerShell - -Identifies use of the Set-MpPreference PowerShell command to disable or weaken certain Windows Defender settings. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://docs.microsoft.com/en-us/powershell/module/defender/set-mppreference?view=windowsserver2019-ps - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Defense Evasion - -*Version*: 1 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type == "start" and - (process.name : ("powershell.exe", "pwsh.exe") or process.pe.original_file_name == "PowerShell.EXE") and - process.args : "Set-MpPreference" and process.args : ("-Disable*", "Disabled", "NeverSend", "-Exclusion*") - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Defense Evasion -** ID: TA0005 -** Reference URL: https://attack.mitre.org/tactics/TA0005/ -* Technique: -** Name: Impair Defenses -** ID: T1562 -** Reference URL: https://attack.mitre.org/techniques/T1562/ -* Sub-technique: -** Name: Disable or Modify Tools -** ID: T1562.001 -** Reference URL: https://attack.mitre.org/techniques/T1562/001/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rule-0-13-2-enable-host-network-discovery-via-netsh.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rule-0-13-2-enable-host-network-discovery-via-netsh.asciidoc deleted file mode 100644 index 6c7f1e99fe..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rule-0-13-2-enable-host-network-discovery-via-netsh.asciidoc +++ /dev/null @@ -1,67 +0,0 @@ -[[prebuilt-rule-0-13-2-enable-host-network-discovery-via-netsh]] -=== Enable Host Network Discovery via Netsh - -Identifies use of the netsh.exe program to enable host discovery via the network. Attackers can use this command-line tool to weaken the host firewall settings. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Defense Evasion - -*Version*: 1 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type == "start" and -process.name : "netsh.exe" and -process.args : ("firewall", "advfirewall") and process.args : "group=Network Discovery" and process.args : "enable=Yes" - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Defense Evasion -** ID: TA0005 -** Reference URL: https://attack.mitre.org/tactics/TA0005/ -* Technique: -** Name: Impair Defenses -** ID: T1562 -** Reference URL: https://attack.mitre.org/techniques/T1562/ -* Sub-technique: -** Name: Disable or Modify Tools -** ID: T1562.001 -** Reference URL: https://attack.mitre.org/techniques/T1562/001/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rule-0-13-2-persistence-via-folder-action-script.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rule-0-13-2-persistence-via-folder-action-script.asciidoc deleted file mode 100644 index ab7865f796..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rule-0-13-2-persistence-via-folder-action-script.asciidoc +++ /dev/null @@ -1,73 +0,0 @@ -[[prebuilt-rule-0-13-2-persistence-via-folder-action-script]] -=== Persistence via Folder Action Script - -A Folder Action script is executed when the folder to which it is attached has items added or removed, or when its window is opened, closed, moved, or resized. Adversaries may abuse this feature to establish persistence by utilizing a malicious script. - -*Rule type*: eql - -*Rule indices*: - -* auditbeat-* -* logs-endpoint.events.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://posts.specterops.io/folder-actions-for-persistence-on-macos-8923f222343d - -*Tags*: - -* Elastic -* Host -* macOS -* Threat Detection -* Execution -* Persistence - -*Version*: 3 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -sequence by host.id with maxspan=5s - [process where event.type in ("start", "process_started", "info") and process.name == "com.apple.foundation.UserScriptService"] by process.pid - [process where event.type in ("start", "process_started") and process.name in ("osascript", "sh")] by process.parent.pid - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Persistence -** ID: TA0003 -** Reference URL: https://attack.mitre.org/tactics/TA0003/ -* Technique: -** Name: Boot or Logon Initialization Scripts -** ID: T1037 -** Reference URL: https://attack.mitre.org/techniques/T1037/ -* Tactic: -** Name: Execution -** ID: TA0002 -** Reference URL: https://attack.mitre.org/tactics/TA0002/ -* Technique: -** Name: Command and Scripting Interpreter -** ID: T1059 -** Reference URL: https://attack.mitre.org/techniques/T1059/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rule-0-13-2-potential-dll-side-loading-via-microsoft-antimalware-service-executable.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rule-0-13-2-potential-dll-side-loading-via-microsoft-antimalware-service-executable.asciidoc deleted file mode 100644 index d3d4425617..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rule-0-13-2-potential-dll-side-loading-via-microsoft-antimalware-service-executable.asciidoc +++ /dev/null @@ -1,72 +0,0 @@ -[[prebuilt-rule-0-13-2-potential-dll-side-loading-via-microsoft-antimalware-service-executable]] -=== Potential DLL Side-Loading via Microsoft Antimalware Service Executable - -Identifies a Windows trusted program that is known to be vulnerable to DLL Search Order Hijacking starting after being renamed or from a non-standard path. This is uncommon behavior and may indicate an attempt to evade defenses via side-loading a malicious DLL within the memory space of one of those processes. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: high - -*Risk score*: 73 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://news.sophos.com/en-us/2021/07/04/independence-day-revil-uses-supply-chain-exploit-to-attack-hundreds-of-businesses/ - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Defense Evasion - -*Version*: 1 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type == "start" and - (process.pe.original_file_name == "MsMpEng.exe" and not process.name : "MsMpEng.exe") or - (process.name : "MsMpEng.exe" and not - process.executable : ("?:\\ProgramData\\Microsoft\\Windows Defender\\*.exe", - "?:\\Program Files\\Windows Defender\\*.exe", - "?:\\Program Files (x86)\\Windows Defender\\*.exe")) - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Defense Evasion -** ID: TA0005 -** Reference URL: https://attack.mitre.org/tactics/TA0005/ -* Technique: -** Name: Hijack Execution Flow -** ID: T1574 -** Reference URL: https://attack.mitre.org/techniques/T1574/ -* Sub-technique: -** Name: DLL Side-Loading -** ID: T1574.002 -** Reference URL: https://attack.mitre.org/techniques/T1574/002/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rule-0-13-2-potential-password-spraying-of-microsoft-365-user-accounts.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rule-0-13-2-potential-password-spraying-of-microsoft-365-user-accounts.asciidoc deleted file mode 100644 index db983f1937..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rule-0-13-2-potential-password-spraying-of-microsoft-365-user-accounts.asciidoc +++ /dev/null @@ -1,72 +0,0 @@ -[[prebuilt-rule-0-13-2-potential-password-spraying-of-microsoft-365-user-accounts]] -=== Potential Password Spraying of Microsoft 365 User Accounts - -Identifies a high number (25) of failed Microsoft 365 user authentication attempts from a single IP address within 30 minutes, which could be indicative of a password spraying attack. An adversary may attempt a password spraying attack to obtain unauthorized access to user accounts. - -*Rule type*: threshold - -*Rule indices*: - -* filebeat-* -* logs-o365* - -*Severity*: high - -*Risk score*: 73 - -*Runs every*: 5m - -*Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Cloud -* Microsoft 365 -* Continuous Monitoring -* SecOps -* Identity and Access - -*Version*: 4 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Config - -The Microsoft 365 Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -event.dataset:o365.audit and event.provider:(Exchange or AzureActiveDirectory) and event.category:authentication and -event.action:("UserLoginFailed" or "PasswordLogonInitialAuthUsingPassword") and event.outcome:failure - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Credential Access -** ID: TA0006 -** Reference URL: https://attack.mitre.org/tactics/TA0006/ -* Technique: -** Name: Brute Force -** ID: T1110 -** Reference URL: https://attack.mitre.org/techniques/T1110/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rule-0-13-2-potential-printnightmare-exploit-registry-modification.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rule-0-13-2-potential-printnightmare-exploit-registry-modification.asciidoc deleted file mode 100644 index 08cbf2de1c..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rule-0-13-2-potential-printnightmare-exploit-registry-modification.asciidoc +++ /dev/null @@ -1,68 +0,0 @@ -[[prebuilt-rule-0-13-2-potential-printnightmare-exploit-registry-modification]] -=== Potential PrintNightmare Exploit Registry Modification - -Detects attempts to exploit privilege escalation vulnerabilities related to the Print Spooler service. For more information refer to CVE-2021-34527 and verify that the impacted system is investigated. - -*Rule type*: eql - -*Rule indices*: - -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: high - -*Risk score*: 73 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527 -* https://github.com/afwu/PrintNightmare - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Privilege Escalation - -*Version*: 1 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -/* This rule is not compatible with Sysmon due to schema issues */ - -registry where process.name : "spoolsv.exe" and - (registry.path : "HKLM\\SYSTEM\\ControlSet*\\Control\\Print\\Environments\\Windows*\\Drivers\\Version-3\\mimikatz*\\Data File" or - (registry.path : "HKLM\\SYSTEM\\ControlSet*\\Control\\Print\\Environments\\Windows*\\Drivers\\Version-3\\*\\Configuration File" and - registry.data.strings : ("kernelbase.dll", "ntdll.dll", "kernel32.dll", "winhttp.dll", "user32.dll"))) - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Privilege Escalation -** ID: TA0004 -** Reference URL: https://attack.mitre.org/tactics/TA0004/ -* Technique: -** Name: Exploitation for Privilege Escalation -** ID: T1068 -** Reference URL: https://attack.mitre.org/techniques/T1068/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rule-0-13-2-potential-printnightmare-file-modification.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rule-0-13-2-potential-printnightmare-file-modification.asciidoc deleted file mode 100644 index f5033af73a..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rule-0-13-2-potential-printnightmare-file-modification.asciidoc +++ /dev/null @@ -1,68 +0,0 @@ -[[prebuilt-rule-0-13-2-potential-printnightmare-file-modification]] -=== Potential PrintNightmare File Modification - -Detects the creation or modification of a print driver with an unusual file name. This may indicate attempts to exploit privilege escalation vulnerabilities related to the Print Spooler service. For more information refer to CVE-2021-34527 and verify that the impacted system is investigated. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: high - -*Risk score*: 73 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527 -* https://github.com/afwu/PrintNightmare - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Privilege Escalation - -*Version*: 1 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -/* This rule is compatible with both Sysmon and Elastic Endpoint */ - -file where process.name : "spoolsv.exe" and - file.name : ("kernelbase.dll", "ntdll.dll", "kernel32.dll", "winhttp.dll", "user32.dll") and - file.path : "?:\\Windows\\System32\\spool\\drivers\\x64\\3\\*" - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Privilege Escalation -** ID: TA0004 -** Reference URL: https://attack.mitre.org/tactics/TA0004/ -* Technique: -** Name: Exploitation for Privilege Escalation -** ID: T1068 -** Reference URL: https://attack.mitre.org/techniques/T1068/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rule-0-13-2-shell-execution-via-apple-scripting.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rule-0-13-2-shell-execution-via-apple-scripting.asciidoc deleted file mode 100644 index 8b1c0c576f..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rule-0-13-2-shell-execution-via-apple-scripting.asciidoc +++ /dev/null @@ -1,65 +0,0 @@ -[[prebuilt-rule-0-13-2-shell-execution-via-apple-scripting]] -=== Shell Execution via Apple Scripting - -Identifies the execution of the shell process (sh) via scripting (JXA or AppleScript). Adversaries may use the doShellScript functionality in JXA or do shell script in AppleScript to execute system commands. - -*Rule type*: eql - -*Rule indices*: - -* auditbeat-* -* logs-endpoint.events.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://developer.apple.com/library/archive/technotes/tn2065/_index.html -* https://objectivebythesea.com/v2/talks/OBTS_v2_Thomas.pdf - -*Tags*: - -* Elastic -* Host -* macOS -* Threat Detection -* Execution - -*Version*: 3 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -sequence by host.id with maxspan=5s - [process where event.type in ("start", "process_started", "info") and process.name == "osascript"] by process.pid - [process where event.type in ("start", "process_started") and process.name == "sh" and process.args == "-c"] by process.parent.pid - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Execution -** ID: TA0002 -** Reference URL: https://attack.mitre.org/tactics/TA0002/ -* Technique: -** Name: Command and Scripting Interpreter -** ID: T1059 -** Reference URL: https://attack.mitre.org/techniques/T1059/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rule-0-13-2-smb-windows-file-sharing-activity-to-the-internet.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rule-0-13-2-smb-windows-file-sharing-activity-to-the-internet.asciidoc deleted file mode 100644 index 8a6fe28ff6..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rule-0-13-2-smb-windows-file-sharing-activity-to-the-internet.asciidoc +++ /dev/null @@ -1,104 +0,0 @@ -[[prebuilt-rule-0-13-2-smb-windows-file-sharing-activity-to-the-internet]] -=== SMB (Windows File Sharing) Activity to the Internet - -This rule detects network events that may indicate the use of Windows file sharing (also called SMB or CIFS) traffic to the Internet. SMB is commonly used within networks to share files, printers, and other system resources amongst trusted systems. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or back-door vector or for data exfiltration. - -*Rule type*: query - -*Rule indices*: - -* filebeat-* -* packetbeat-* -* logs-endpoint.events.* - -*Severity*: high - -*Risk score*: 73 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml - -*Tags*: - -* Elastic -* Host -* Network -* Threat Detection -* Initial Access - -*Version*: 9 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -event.category:(network or network_traffic) and network.transport:tcp and (destination.port:(139 or 445) or event.dataset:zeek.smb) and - source.ip:( - 10.0.0.0/8 or - 172.16.0.0/12 or - 192.168.0.0/16 - ) and - not destination.ip:( - 10.0.0.0/8 or - 127.0.0.0/8 or - 169.254.0.0/16 or - 172.16.0.0/12 or - 192.0.0.0/24 or - 192.0.0.0/29 or - 192.0.0.8/32 or - 192.0.0.9/32 or - 192.0.0.10/32 or - 192.0.0.170/32 or - 192.0.0.171/32 or - 192.0.2.0/24 or - 192.31.196.0/24 or - 192.52.193.0/24 or - 192.168.0.0/16 or - 192.88.99.0/24 or - 224.0.0.0/4 or - 100.64.0.0/10 or - 192.175.48.0/24 or - 198.18.0.0/15 or - 198.51.100.0/24 or - 203.0.113.0/24 or - 240.0.0.0/4 or - "::1" or - "FE80::/10" or - "FF00::/8" - ) - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Initial Access -** ID: TA0001 -** Reference URL: https://attack.mitre.org/tactics/TA0001/ -* Technique: -** Name: Exploit Public-Facing Application -** ID: T1190 -** Reference URL: https://attack.mitre.org/techniques/T1190/ -* Tactic: -** Name: Exfiltration -** ID: TA0010 -** Reference URL: https://attack.mitre.org/tactics/TA0010/ -* Technique: -** Name: Exfiltration Over Alternative Protocol -** ID: T1048 -** Reference URL: https://attack.mitre.org/techniques/T1048/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rule-0-13-2-suspicious-print-spooler-file-deletion.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rule-0-13-2-suspicious-print-spooler-file-deletion.asciidoc deleted file mode 100644 index fb0960f473..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rule-0-13-2-suspicious-print-spooler-file-deletion.asciidoc +++ /dev/null @@ -1,66 +0,0 @@ -[[prebuilt-rule-0-13-2-suspicious-print-spooler-file-deletion]] -=== Suspicious Print Spooler File Deletion - -Detects deletion of print driver files by an unusual process. This may indicate a clean up attempt post successful privilege escalation via Print Spooler service related vulnerabilities. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527 -* https://github.com/afwu/PrintNightmare - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Privilege Escalation - -*Version*: 1 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -file where event.type : "deletion" and - not process.name : ("spoolsv.exe", "dllhost.exe", "explorer.exe") and - file.path : "?:\\Windows\\System32\\spool\\drivers\\x64\\3\\*.dll" - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Privilege Escalation -** ID: TA0004 -** Reference URL: https://attack.mitre.org/tactics/TA0004/ -* Technique: -** Name: Exploitation for Privilege Escalation -** ID: T1068 -** Reference URL: https://attack.mitre.org/techniques/T1068/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rule-0-13-2-unusual-print-spooler-child-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rule-0-13-2-unusual-print-spooler-child-process.asciidoc deleted file mode 100644 index 0f371c01b1..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rule-0-13-2-unusual-print-spooler-child-process.asciidoc +++ /dev/null @@ -1,73 +0,0 @@ -[[prebuilt-rule-0-13-2-unusual-print-spooler-child-process]] -=== Unusual Print Spooler Child Process - -Detects unusual Print Spooler service (spoolsv.exe) child processes. This may indicate an attempt to exploit privilege escalation vulnerabilities related to the Printing Service on Windows. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527 -* https://github.com/afwu/PrintNightmare - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Privilege Escalation - -*Version*: 1 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type == "start" and - process.parent.name : "spoolsv.exe" and user.id : "S-1-5-18" and - - /* exclusions for FP control below */ - not process.name : ("splwow64.exe", "PDFCreator.exe", "acrodist.exe", "spoolsv.exe", "msiexec.exe", "route.exe", "WerFault.exe") and - not process.command_line : "*\\WINDOWS\\system32\\spool\\DRIVERS*" and - not (process.name : "net.exe" and process.command_line : ("*stop*", "*start*")) and - not (process.name : ("cmd.exe", "powershell.exe") and process.command_line : ("*.spl*", "*program files*", "*route add*")) and - not (process.name : "netsh.exe" and process.command_line : ("*add portopening*", "*rule name*")) and - not (process.name : "regsvr32.exe" and process.command_line : "*PrintConfig.dll*") - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Privilege Escalation -** ID: TA0004 -** Reference URL: https://attack.mitre.org/tactics/TA0004/ -* Technique: -** Name: Exploitation for Privilege Escalation -** ID: T1068 -** Reference URL: https://attack.mitre.org/techniques/T1068/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rules-0-13-2-appendix.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rules-0-13-2-appendix.asciidoc deleted file mode 100644 index 6522e1a542..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rules-0-13-2-appendix.asciidoc +++ /dev/null @@ -1,27 +0,0 @@ -["appendix",role="exclude",id="prebuilt-rule-0-13-2-prebuilt-rules-0-13-2-appendix"] -= Downloadable rule update v0.13.2 - -This section lists all updates associated with version 0.13.2 of the Fleet integration *Prebuilt Security Detection Rules*. - - -include::prebuilt-rule-0-13-2-aws-ec2-full-network-packet-capture-detected.asciidoc[] -include::prebuilt-rule-0-13-2-aws-rds-snapshot-export.asciidoc[] -include::prebuilt-rule-0-13-2-aws-rds-security-group-deletion.asciidoc[] -include::prebuilt-rule-0-13-2-aws-rds-security-group-creation.asciidoc[] -include::prebuilt-rule-0-13-2-aws-rds-instance-creation.asciidoc[] -include::prebuilt-rule-0-13-2-aws-route-53-domain-transfer-lock-disabled.asciidoc[] -include::prebuilt-rule-0-13-2-aws-route-53-domain-transferred-to-another-account.asciidoc[] -include::prebuilt-rule-0-13-2-azure-service-principal-credentials-added.asciidoc[] -include::prebuilt-rule-0-13-2-disabling-windows-defender-security-settings-via-powershell.asciidoc[] -include::prebuilt-rule-0-13-2-enable-host-network-discovery-via-netsh.asciidoc[] -include::prebuilt-rule-0-13-2-potential-dll-side-loading-via-microsoft-antimalware-service-executable.asciidoc[] -include::prebuilt-rule-0-13-2-potential-printnightmare-file-modification.asciidoc[] -include::prebuilt-rule-0-13-2-potential-printnightmare-exploit-registry-modification.asciidoc[] -include::prebuilt-rule-0-13-2-suspicious-print-spooler-file-deletion.asciidoc[] -include::prebuilt-rule-0-13-2-unusual-print-spooler-child-process.asciidoc[] -include::prebuilt-rule-0-13-2-aws-ec2-vm-export-failure.asciidoc[] -include::prebuilt-rule-0-13-2-shell-execution-via-apple-scripting.asciidoc[] -include::prebuilt-rule-0-13-2-persistence-via-folder-action-script.asciidoc[] -include::prebuilt-rule-0-13-2-attempts-to-brute-force-a-microsoft-365-user-account.asciidoc[] -include::prebuilt-rule-0-13-2-potential-password-spraying-of-microsoft-365-user-accounts.asciidoc[] -include::prebuilt-rule-0-13-2-smb-windows-file-sharing-activity-to-the-internet.asciidoc[] diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rules-0-13-2-summary.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rules-0-13-2-summary.asciidoc deleted file mode 100644 index 2d7e1b151f..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-2/prebuilt-rules-0-13-2-summary.asciidoc +++ /dev/null @@ -1,59 +0,0 @@ -[[prebuilt-rule-0-13-2-prebuilt-rules-0-13-2-summary]] -[role="xpack"] -== Update v0.13.2 - -This section lists all updates associated with version 0.13.2 of the Fleet integration *Prebuilt Security Detection Rules*. - -Included in this release are 3 new rules for the recently observed -https://www.elastic.co/blog/elastic-security-prevents-100-percent-of-revil-ransomware-samples[REvil] -activity as well as 4 new rules covering the recent -https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527[PrintNightmare] vulnerability. - - -[width="100%",options="header"] -|============================================== -|Rule |Description |Status |Version - -|<> | Identifies potential Traffic Mirroring in an Amazon Elastic Compute Cloud (EC2) instance. Traffic Mirroring is an Amazon VPC feature that you can use to copy network traffic from an elastic network interface. This feature can potentially be abused to exfiltrate sensitive data from unencrypted internal traffic. | new | 1 - -|<> | Identifies the export of an Amazon Relational Database Service (RDS) Aurora database snapshot. | new | 1 - -|<> | Identifies the deletion of an Amazon Relational Database Service (RDS) Security Group. | new | 1 - -|<> | Identifies the creation of an Amazon Relational Database Service (RDS) Security Group. | new | 1 - -|<> | Identifies the creation of an Amazon Relational Database Service (RDS) Aurora database instance. | new | 1 - -|<> | Identifies when a transfer lock was removed from a Route 53 domain. It is recommended to refrain from performing this action unless intending to transfer the domain to a different registrar. | new | 1 - -|<> | Identifies when a request has been made to transfer a Route 53 domain to another AWS account. | new | 1 - -|<> | Identifies when new Service Principal credentials have been added in Azure. In most organizations, credentials will be added to service principals infrequently. Hijacking an application (by adding a rogue secret or certificate) with granted permissions will allow the attacker to access data that is normally protected by MFA requirements. | new | 1 - -|<> | Identifies use of the Set-MpPreference PowerShell command to disable or weaken certain Windows Defender settings. | new | 1 - -|<> | Identifies use of the netsh.exe program to enable host discovery via the network. Attackers can use this command-line tool to weaken the host firewall settings. | new | 1 - -|<> | Identifies a Windows trusted program that is known to be vulnerable to DLL Search Order Hijacking starting after being renamed or from a non-standard path. This is uncommon behavior and may indicate an attempt to evade defenses via side-loading a malicious DLL within the memory space of one of those processes. | new | 1 - -|<> | Detects the creation or modification of a print driver with an unusual file name. This may indicate attempts to exploit privilege escalation vulnerabilities related to the Print Spooler service. For more information refer to CVE-2021-34527 and verify that the impacted system is investigated. | new | 1 - -|<> | Detects attempts to exploit privilege escalation vulnerabilities related to the Print Spooler service. For more information refer to CVE-2021-34527 and verify that the impacted system is investigated. | new | 1 - -|<> | Detects deletion of print driver files by an unusual process. This may indicate a clean up attempt post successful privilege escalation via Print Spooler service related vulnerabilities. | new | 1 - -|<> | Detects unusual Print Spooler service (spoolsv.exe) child processes. This may indicate an attempt to exploit privilege escalation vulnerabilities related to the Printing Service on Windows. | new | 1 - -|<> | Identifies an attempt to export an AWS EC2 instance. A virtual machine (VM) export may indicate an attempt to extract or exfiltrate information. | update | 2 - -|<> | Identifies the execution of the shell process (sh) via scripting (JXA or AppleScript). Adversaries may use the doShellScript functionality in JXA or do shell script in AppleScript to execute system commands. | update | 3 - -|<> | A Folder Action script is executed when the folder to which it is attached has items added or removed, or when its window is opened, closed, moved, or resized. Adversaries may abuse this feature to establish persistence by utilizing a malicious script. | update | 3 - -|<> | Identifies attempts to brute force a Microsoft 365 user account. An adversary may attempt a brute force attack to obtain unauthorized access to user accounts. | update | 5 - -|<> | Identifies a high number (25) of failed Microsoft 365 user authentication attempts from a single IP address within 30 minutes, which could be indicative of a password spraying attack. An adversary may attempt a password spraying attack to obtain unauthorized access to user accounts. | update | 4 - -|<> | This rule detects network events that may indicate the use of Windows file sharing (also called SMB or CIFS) traffic to the Internet. SMB is commonly used within networks to share files, printers, and other system resources amongst trusted systems. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or back-door vector or for data exfiltration. | update | 9 - -|============================================== diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-cobalt-strike-command-and-control-beacon.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-cobalt-strike-command-and-control-beacon.asciidoc deleted file mode 100644 index fc4ba06e9a..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-cobalt-strike-command-and-control-beacon.asciidoc +++ /dev/null @@ -1,83 +0,0 @@ -[[prebuilt-rule-0-13-3-cobalt-strike-command-and-control-beacon]] -=== Cobalt Strike Command and Control Beacon - -Cobalt Strike is a threat emulation platform commonly modified and used by adversaries to conduct network attack and exploitation campaigns. This rule detects a network activity algorithm leveraged by Cobalt Strike implant beacons for command and control. - -*Rule type*: query - -*Rule indices*: - -* auditbeat-* -* filebeat-* -* packetbeat-* -* logs-endpoint.events.* - -*Severity*: high - -*Risk score*: 73 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://blog.morphisec.com/fin7-attacks-restaurant-industry -* https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html - -*Tags*: - -* Elastic -* Network -* Threat Detection -* Command and Control -* Host - -*Version*: 6 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Threat intel - -This activity has been observed in FIN7 campaigns. ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -event.category:(network OR network_traffic) AND type:(tls OR http) AND network.transport:tcp AND destination.domain:/[a-z]{3}.stage.[0-9]{8}\..*/ - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Command and Control -** ID: TA0011 -** Reference URL: https://attack.mitre.org/tactics/TA0011/ -* Technique: -** Name: Application Layer Protocol -** ID: T1071 -** Reference URL: https://attack.mitre.org/techniques/T1071/ -* Technique: -** Name: Dynamic Resolution -** ID: T1568 -** Reference URL: https://attack.mitre.org/techniques/T1568/ -* Sub-technique: -** Name: Domain Generation Algorithms -** ID: T1568.002 -** Reference URL: https://attack.mitre.org/techniques/T1568/002/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-default-cobalt-strike-team-server-certificate.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-default-cobalt-strike-team-server-certificate.asciidoc deleted file mode 100644 index 9035eee20f..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-default-cobalt-strike-team-server-certificate.asciidoc +++ /dev/null @@ -1,85 +0,0 @@ -[[prebuilt-rule-0-13-3-default-cobalt-strike-team-server-certificate]] -=== Default Cobalt Strike Team Server Certificate - -This rule detects the use of the default Cobalt Strike Team Server TLS certificate. Cobalt Strike is software for Adversary Simulations and Red Team Operations which are security assessments that replicate the tactics and techniques of an advanced adversary in a network. Modifications to the Packetbeat configuration can be made to include MD5 and SHA256 hashing algorithms (the default is SHA1) - see the Reference section for additional information on module configuration. - -*Rule type*: query - -*Rule indices*: - -* auditbeat-* -* filebeat-* -* packetbeat-* -* logs-endpoint.events.* - -*Severity*: critical - -*Risk score*: 99 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://attack.mitre.org/software/S0154/ -* https://www.cobaltstrike.com/help-setup-collaboration -* https://www.elastic.co/guide/en/beats/packetbeat/current/configuration-tls.html -* https://www.elastic.co/guide/en/beats/filebeat/7.9/filebeat-module-suricata.html -* https://www.elastic.co/guide/en/beats/filebeat/7.9/filebeat-module-zeek.html - -*Tags*: - -* Command and Control -* Post-Execution -* Threat Detection -* Elastic -* Network -* Host - -*Version*: 5 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Threat intel - -While Cobalt Strike is intended to be used for penetration tests and IR training, it is frequently used by actual threat actors (TA) such as APT19, APT29, APT32, APT41, FIN6, DarkHydrus, CopyKittens, Cobalt Group, Leviathan, and many other unnamed criminal TAs. This rule uses high-confidence atomic indicators, alerts should be investigated rapidly. ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -event.category:(network or network_traffic) and (tls.server.hash.md5:950098276A495286EB2A2556FBAB6D83 or - tls.server.hash.sha1:6ECE5ECE4192683D2D84E25B0BA7E04F9CB7EB7C or - tls.server.hash.sha256:87F2085C32B6A2CC709B365F55873E207A9CAA10BFFECF2FD16D3CF9D94D390C) - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Command and Control -** ID: TA0011 -** Reference URL: https://attack.mitre.org/tactics/TA0011/ -* Technique: -** Name: Application Layer Protocol -** ID: T1071 -** Reference URL: https://attack.mitre.org/techniques/T1071/ -* Sub-technique: -** Name: Web Protocols -** ID: T1071.001 -** Reference URL: https://attack.mitre.org/techniques/T1071/001/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-disable-windows-event-and-security-logs-using-built-in-tools.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-disable-windows-event-and-security-logs-using-built-in-tools.asciidoc deleted file mode 100644 index a2062f8a35..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-disable-windows-event-and-security-logs-using-built-in-tools.asciidoc +++ /dev/null @@ -1,74 +0,0 @@ -[[prebuilt-rule-0-13-3-disable-windows-event-and-security-logs-using-built-in-tools]] -=== Disable Windows Event and Security Logs Using Built-in Tools - -Identifies attempts to disable EventLog via the logman Windows utility, PowerShell, or auditpol. This is often done by attackers in an attempt to evade detection on a system. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/logman - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Defense Evasion - -*Version*: 1 - -*Rule authors*: - -* Elastic -* Ivan Ninichuck -* Austin Songer - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type in ("start", "process_started") and - - ((process.name:"logman.exe" or process.pe.original_file_name == "Logman.exe") and - process.args : "EventLog-*" and process.args : ("stop", "delete")) or - - ((process.name : ("pwsh.exe", "powershell.exe", "powershell_ise.exe") or process.pe.original_file_name in - ("pwsh.exe", "powershell.exe", "powershell_ise.exe")) and - process.args : "Set-Service" and process.args: "EventLog" and process.args : "Disabled") or - - ((process.name:"auditpol.exe" or process.pe.original_file_name == "AUDITPOL.EXE") and process.args : "/success:disable") - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Defense Evasion -** ID: TA0005 -** Reference URL: https://attack.mitre.org/tactics/TA0005/ -* Technique: -** Name: Indicator Removal on Host -** ID: T1070 -** Reference URL: https://attack.mitre.org/techniques/T1070/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-dns-activity-to-the-internet.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-dns-activity-to-the-internet.asciidoc deleted file mode 100644 index 5329e25a8e..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-dns-activity-to-the-internet.asciidoc +++ /dev/null @@ -1,95 +0,0 @@ -[[prebuilt-rule-0-13-3-dns-activity-to-the-internet]] -=== DNS Activity to the Internet - -This rule detects when an internal network client sends DNS traffic directly to the Internet. This is atypical behavior for a managed network, and can be indicative of malware, exfiltration, command and control, or, simply, misconfiguration. This DNS activity also impacts your organization's ability to provide enterprise monitoring and logging of DNS, and opens your network to a variety of abuses and malicious communications. - -*Rule type*: query - -*Rule indices*: - -* auditbeat-* -* filebeat-* -* packetbeat-* -* logs-endpoint.events.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.us-cert.gov/ncas/alerts/TA15-240A -* https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-81-2.pdf -* https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml - -*Tags*: - -* Elastic -* Network -* Threat Detection -* Command and Control -* Host - -*Version*: 10 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -event.category:(network or network_traffic) and (event.type:connection or type:dns) and (destination.port:53 or event.dataset:zeek.dns) - and source.ip:( - 10.0.0.0/8 or - 172.16.0.0/12 or - 192.168.0.0/16 - ) and - not destination.ip:( - 10.0.0.0/8 or - 127.0.0.0/8 or - 169.254.0.0/16 or - 172.16.0.0/12 or - 192.0.0.0/24 or - 192.0.0.0/29 or - 192.0.0.8/32 or - 192.0.0.9/32 or - 192.0.0.10/32 or - 192.0.0.170/32 or - 192.0.0.171/32 or - 192.0.2.0/24 or - 192.31.196.0/24 or - 192.52.193.0/24 or - 192.168.0.0/16 or - 192.88.99.0/24 or - 224.0.0.0/4 or - 100.64.0.0/10 or - 192.175.48.0/24 or - 198.18.0.0/15 or - 198.51.100.0/24 or - 203.0.113.0/24 or - 240.0.0.0/4 or - "::1" or - "FE80::/10" or - "FF00::/8" - ) - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Command and Control -** ID: TA0011 -** Reference URL: https://attack.mitre.org/tactics/TA0011/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-execution-of-file-written-or-modified-by-microsoft-office.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-execution-of-file-written-or-modified-by-microsoft-office.asciidoc deleted file mode 100644 index 456c8f0621..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-execution-of-file-written-or-modified-by-microsoft-office.asciidoc +++ /dev/null @@ -1,84 +0,0 @@ -[[prebuilt-rule-0-13-3-execution-of-file-written-or-modified-by-microsoft-office]] -=== Execution of File Written or Modified by Microsoft Office - -Identifies an executable created by a Microsoft Office application and subsequently executed. These processes are often launched via scripts inside documents or during exploitation of MS Office applications. - -*Rule type*: eql - -*Rule indices*: - -* logs-endpoint.events.* -* winlogbeat-* -* logs-windows.* - -*Severity*: high - -*Risk score*: 21 - -*Runs every*: 60m - -*Searches indices from*: now-120m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Execution - -*Version*: 4 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -sequence with maxspan=2h - [file where event.type != "deletion" and file.extension : "exe" and - (process.name : "WINWORD.EXE" or - process.name : "EXCEL.EXE" or - process.name : "OUTLOOK.EXE" or - process.name : "POWERPNT.EXE" or - process.name : "eqnedt32.exe" or - process.name : "fltldr.exe" or - process.name : "MSPUB.EXE" or - process.name : "MSACCESS.EXE") - ] by host.id, file.path - [process where event.type in ("start", "process_started")] by host.id, process.executable - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Execution -** ID: TA0002 -** Reference URL: https://attack.mitre.org/tactics/TA0002/ -* Tactic: -** Name: Initial Access -** ID: TA0001 -** Reference URL: https://attack.mitre.org/tactics/TA0001/ -* Technique: -** Name: Phishing -** ID: T1566 -** Reference URL: https://attack.mitre.org/techniques/T1566/ -* Sub-technique: -** Name: Spearphishing Attachment -** ID: T1566.001 -** Reference URL: https://attack.mitre.org/techniques/T1566/001/ -* Sub-technique: -** Name: Spearphishing Link -** ID: T1566.002 -** Reference URL: https://attack.mitre.org/techniques/T1566/002/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-execution-of-file-written-or-modified-by-pdf-reader.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-execution-of-file-written-or-modified-by-pdf-reader.asciidoc deleted file mode 100644 index 26cc0b37c0..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-execution-of-file-written-or-modified-by-pdf-reader.asciidoc +++ /dev/null @@ -1,86 +0,0 @@ -[[prebuilt-rule-0-13-3-execution-of-file-written-or-modified-by-pdf-reader]] -=== Execution of File Written or Modified by PDF Reader - -Identifies a suspicious file that was written by a PDF reader application and subsequently executed. These processes are often launched via exploitation of PDF applications. - -*Rule type*: eql - -*Rule indices*: - -* logs-endpoint.events.* -* winlogbeat-* -* logs-windows.* - -*Severity*: high - -*Risk score*: 21 - -*Runs every*: 60m - -*Searches indices from*: now-120m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Execution - -*Version*: 4 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -sequence with maxspan=2h - [file where event.type != "deletion" and file.extension : "exe" and - (process.name : "AcroRd32.exe" or - process.name : "rdrcef.exe" or - process.name : "FoxitPhantomPDF.exe" or - process.name : "FoxitReader.exe") and - not (file.name : "FoxitPhantomPDF.exe" or - file.name : "FoxitPhantomPDFUpdater.exe" or - file.name : "FoxitReader.exe" or - file.name : "FoxitReaderUpdater.exe" or - file.name : "AcroRd32.exe" or - file.name : "rdrcef.exe") - ] by host.id, file.path - [process where event.type in ("start", "process_started")] by host.id, process.executable - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Execution -** ID: TA0002 -** Reference URL: https://attack.mitre.org/tactics/TA0002/ -* Tactic: -** Name: Initial Access -** ID: TA0001 -** Reference URL: https://attack.mitre.org/tactics/TA0001/ -* Technique: -** Name: Phishing -** ID: T1566 -** Reference URL: https://attack.mitre.org/techniques/T1566/ -* Sub-technique: -** Name: Spearphishing Attachment -** ID: T1566.001 -** Reference URL: https://attack.mitre.org/techniques/T1566/001/ -* Sub-technique: -** Name: Spearphishing Link -** ID: T1566.002 -** Reference URL: https://attack.mitre.org/techniques/T1566/002/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-external-alerts.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-external-alerts.asciidoc deleted file mode 100644 index c70ec3f9f6..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-external-alerts.asciidoc +++ /dev/null @@ -1,55 +0,0 @@ -[[prebuilt-rule-0-13-3-external-alerts]] -=== External Alerts - -Generates a detection alert for each external alert written to the configured indices. Enabling this rule allows you to immediately begin investigating external alerts in the app. - -*Rule type*: query - -*Rule indices*: - -* apm-*-transaction* -* traces-apm* -* auditbeat-* -* filebeat-* -* logs-* -* packetbeat-* -* winlogbeat-* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 10000 - -*References*: None - -*Tags*: - -* Elastic -* Network -* Windows -* APM -* macOS -* Linux - -*Version*: 4 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -event.kind:alert and not event.module:(endgame or endpoint) - ----------------------------------- diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-external-ip-lookup-fron-non-browser-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-external-ip-lookup-fron-non-browser-process.asciidoc deleted file mode 100644 index 1983bafb37..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-external-ip-lookup-fron-non-browser-process.asciidoc +++ /dev/null @@ -1,103 +0,0 @@ -[[prebuilt-rule-0-13-3-external-ip-lookup-fron-non-browser-process]] -=== External IP Lookup fron Non-Browser Process - -Identifies domains commonly used by adversaries for post-exploitation IP lookups. It is common for adversaries to test for Internet access and acquire their external IP address after they have gained access to a system. Among others, this has been observed in campaigns leveraging the information stealer, Trickbot. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://community.jisc.ac.uk/blogs/csirt/article/trickbot-analysis-and-mitigation -* https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Discovery - -*Version*: 5 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -network where network.protocol == "dns" and - process.name != null and user.id not in ("S-1-5-19", "S-1-5-20") and - event.action == "lookup_requested" and - /* Add new external IP lookup services here */ - dns.question.name : - ( - "*api.ipify.org", - "*freegeoip.app", - "*checkip.amazonaws.com", - "*checkip.dyndns.org", - "*freegeoip.app", - "*icanhazip.com", - "*ifconfig.*", - "*ipecho.net", - "*ipgeoapi.com", - "*ipinfo.io", - "*ip.anysrc.net", - "*myexternalip.com", - "*myipaddress.com", - "*showipaddress.com", - "*whatismyipaddress.com", - "*wtfismyip.com", - "*ipapi.co", - "*ip-lookup.net", - "*ipstack.com" - ) and - /* Insert noisy false positives here */ - not process.executable : - ( - "?:\\Program Files\\*.exe", - "?:\\Program Files (x86)\\*.exe", - "?:\\Windows\\System32\\WWAHost.exe", - "?:\\Windows\\System32\\smartscreen.exe", - "?:\\Windows\\System32\\MicrosoftEdgeCP.exe", - "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe", - "?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe", - "?:\\Users\\*\\AppData\\Local\\Programs\\Fiddler\\Fiddler.exe", - "?:\\Users\\*\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe", - "?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe" - ) - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Discovery -** ID: TA0007 -** Reference URL: https://attack.mitre.org/tactics/TA0007/ -* Technique: -** Name: System Network Configuration Discovery -** ID: T1016 -** Reference URL: https://attack.mitre.org/techniques/T1016/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-google-workspace-mfa-enforcement-disabled.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-google-workspace-mfa-enforcement-disabled.asciidoc deleted file mode 100644 index e4fda1843f..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-google-workspace-mfa-enforcement-disabled.asciidoc +++ /dev/null @@ -1,71 +0,0 @@ -[[prebuilt-rule-0-13-3-google-workspace-mfa-enforcement-disabled]] -=== Google Workspace MFA Enforcement Disabled - -Detects when multi-factor authentication (MFA) enforcement is disabled for Google Workspace users. An adversary may disable MFA enforcement in order to weaken an organization’s security controls. - -*Rule type*: query - -*Rule indices*: - -* filebeat-* -* logs-google_workspace* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 10m - -*Searches indices from*: now-130m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://support.google.com/a/answer/9176657?hl=en# - -*Tags*: - -* Elastic -* Cloud -* Google Workspace -* Continuous Monitoring -* SecOps -* Configuration Audit - -*Version*: 5 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown, subs="attributes"] ----------------------------------- -## Config - -The Google Workspace Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. - -### Important Information Regarding Google Workspace Event Lag Times -- As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs. -- This rule is configured to run every 10 minutes with a lookback time of 130 minutes. -- To reduce the risk of false negatives, consider reducing the interval that the Google Workspace (formerly G Suite) Filebeat module polls Google's reporting API for new events. -- By default, `var.interval` is set to 2 hours (2h). Consider changing this interval to a lower value, such as 10 minutes (10m). -- See the following references for further information. - - https://support.google.com/a/answer/7061566 - - https://www.elastic.co/guide/en/beats/filebeat/{branch}/filebeat-module-google_workspace.html ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -event.dataset:(gsuite.admin or google_workspace.admin) and event.provider:admin and event.category:iam and event.action:ENFORCE_STRONG_AUTHENTICATION and (gsuite.admin.new_value:false or google_workspace.admin.new_value:false) - ----------------------------------- diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-google-workspace-password-policy-modified.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-google-workspace-password-policy-modified.asciidoc deleted file mode 100644 index 43412eb473..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-google-workspace-password-policy-modified.asciidoc +++ /dev/null @@ -1,87 +0,0 @@ -[[prebuilt-rule-0-13-3-google-workspace-password-policy-modified]] -=== Google Workspace Password Policy Modified - -Detects when a Google Workspace password policy is modified. An adversary may attempt to modify a password policy in order to weaken an organization’s security controls. - -*Rule type*: query - -*Rule indices*: - -* filebeat-* -* logs-google_workspace* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 10m - -*Searches indices from*: now-130m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Cloud -* Google Workspace -* Continuous Monitoring -* SecOps -* Identity and Access - -*Version*: 5 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown, subs="attributes"] ----------------------------------- -## Config - -The Google Workspace Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. - -### Important Information Regarding Google Workspace Event Lag Times -- As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs. -- This rule is configured to run every 10 minutes with a lookback time of 130 minutes. -- To reduce the risk of false negatives, consider reducing the interval that the Google Workspace (formerly G Suite) Filebeat module polls Google's reporting API for new events. -- By default, `var.interval` is set to 2 hours (2h). Consider changing this interval to a lower value, such as 10 minutes (10m). -- See the following references for further information. - - https://support.google.com/a/answer/7061566 - - https://www.elastic.co/guide/en/beats/filebeat/{branch}/filebeat-module-google_workspace.html ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -event.dataset:(gsuite.admin or google_workspace.admin) and - event.provider:admin and event.category:iam and - event.action:(CHANGE_APPLICATION_SETTING or CREATE_APPLICATION_SETTING) and - gsuite.admin.setting.name:( - "Password Management - Enforce strong password" or - "Password Management - Password reset frequency" or - "Password Management - Enable password reuse" or - "Password Management - Enforce password policy at next login" or - "Password Management - Minimum password length" or - "Password Management - Maximum password length" - ) or - google_workspace.admin.setting.name:( - "Password Management - Enforce strong password" or - "Password Management - Password reset frequency" or - "Password Management - Enable password reuse" or - "Password Management - Enforce password policy at next login" or - "Password Management - Minimum password length" or - "Password Management - Maximum password length" - ) - ----------------------------------- diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-halfbaked-command-and-control-beacon.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-halfbaked-command-and-control-beacon.asciidoc deleted file mode 100644 index 6073a504e6..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-halfbaked-command-and-control-beacon.asciidoc +++ /dev/null @@ -1,85 +0,0 @@ -[[prebuilt-rule-0-13-3-halfbaked-command-and-control-beacon]] -=== Halfbaked Command and Control Beacon - -Halfbaked is a malware family used to establish persistence in a contested network. This rule detects a network activity algorithm leveraged by Halfbaked implant beacons for command and control. - -*Rule type*: query - -*Rule indices*: - -* auditbeat-* -* filebeat-* -* packetbeat-* -* logs-endpoint.events.* - -*Severity*: high - -*Risk score*: 73 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html -* https://attack.mitre.org/software/S0151/ - -*Tags*: - -* Elastic -* Network -* Threat Detection -* Command and Control -* Host - -*Version*: 6 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Threat intel - -This activity has been observed in FIN7 campaigns. ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -event.category:(network OR network_traffic) AND network.protocol:http AND - network.transport:tcp AND url.full:/http:\/\/[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}\/cd/ AND - destination.port:(53 OR 80 OR 8080 OR 443) - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Command and Control -** ID: TA0011 -** Reference URL: https://attack.mitre.org/tactics/TA0011/ -* Technique: -** Name: Application Layer Protocol -** ID: T1071 -** Reference URL: https://attack.mitre.org/techniques/T1071/ -* Technique: -** Name: Dynamic Resolution -** ID: T1568 -** Reference URL: https://attack.mitre.org/techniques/T1568/ -* Sub-technique: -** Name: Domain Generation Algorithms -** ID: T1568.002 -** Reference URL: https://attack.mitre.org/techniques/T1568/002/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-inbound-connection-to-an-unsecure-elasticsearch-node.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-inbound-connection-to-an-unsecure-elasticsearch-node.asciidoc deleted file mode 100644 index 1833dd96c3..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-inbound-connection-to-an-unsecure-elasticsearch-node.asciidoc +++ /dev/null @@ -1,75 +0,0 @@ -[[prebuilt-rule-0-13-3-inbound-connection-to-an-unsecure-elasticsearch-node]] -=== Inbound Connection to an Unsecure Elasticsearch Node - -Identifies Elasticsearch nodes that do not have Transport Layer Security (TLS), and/or lack authentication, and are accepting inbound network connections over the default Elasticsearch port. - -*Rule type*: query - -*Rule indices*: - -* auditbeat-* -* filebeat-* -* packetbeat-* -* logs-endpoint.events.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.elastic.co/guide/en/elasticsearch/reference/current/configuring-security.html -* https://www.elastic.co/guide/en/beats/packetbeat/current/packetbeat-http-options.html#_send_all_headers - -*Tags*: - -* Elastic -* Network -* Threat Detection -* Initial Access -* Host - -*Version*: 5 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Config - -This rule requires the addition of port `9200` and `send_all_headers` to the `HTTP` protocol configuration in `packetbeat.yml`. See the References section for additional configuration documentation. ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -event.category:network_traffic AND network.protocol:http AND status:OK AND destination.port:9200 AND network.direction:inbound AND NOT http.response.headers.content-type:"image/x-icon" AND NOT _exists_:http.request.headers.authorization - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Initial Access -** ID: TA0001 -** Reference URL: https://attack.mitre.org/tactics/TA0001/ -* Technique: -** Name: Exploit Public-Facing Application -** ID: T1190 -** Reference URL: https://attack.mitre.org/techniques/T1190/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-ipsec-nat-traversal-port-activity.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-ipsec-nat-traversal-port-activity.asciidoc deleted file mode 100644 index feb715e7d6..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-ipsec-nat-traversal-port-activity.asciidoc +++ /dev/null @@ -1,59 +0,0 @@ -[[prebuilt-rule-0-13-3-ipsec-nat-traversal-port-activity]] -=== IPSEC NAT Traversal Port Activity - -This rule detects events that could be describing IPSEC NAT Traversal traffic. IPSEC is a VPN technology that allows one system to talk to another using encrypted tunnels. NAT Traversal enables these tunnels to communicate over the Internet where one of the sides is behind a NAT router gateway. This may be common on your network, but this technique is also used by threat actors to avoid detection. - -*Rule type*: query - -*Rule indices*: - -* auditbeat-* -* filebeat-* -* packetbeat-* -* logs-endpoint.events.* - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Host -* Network -* Threat Detection -* Command and Control -* Host - -*Version*: 8 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -event.category:(network or network_traffic) and network.transport:udp and destination.port:4500 - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Command and Control -** ID: TA0011 -** Reference URL: https://attack.mitre.org/tactics/TA0011/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-mfa-disabled-for-google-workspace-organization.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-mfa-disabled-for-google-workspace-organization.asciidoc deleted file mode 100644 index fbc9fd70e6..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-mfa-disabled-for-google-workspace-organization.asciidoc +++ /dev/null @@ -1,69 +0,0 @@ -[[prebuilt-rule-0-13-3-mfa-disabled-for-google-workspace-organization]] -=== MFA Disabled for Google Workspace Organization - -Detects when multi-factor authentication (MFA) is disabled for a Google Workspace organization. An adversary may attempt to modify a password policy in order to weaken an organization’s security controls. - -*Rule type*: query - -*Rule indices*: - -* filebeat-* -* logs-google_workspace* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 10m - -*Searches indices from*: now-130m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Cloud -* Google Workspace -* Continuous Monitoring -* SecOps -* Identity and Access - -*Version*: 5 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown, subs="attributes"] ----------------------------------- -## Config - -The Google Workspace Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. - -### Important Information Regarding Google Workspace Event Lag Times -- As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs. -- This rule is configured to run every 10 minutes with a lookback time of 130 minutes. -- To reduce the risk of false negatives, consider reducing the interval that the Google Workspace (formerly G Suite) Filebeat module polls Google's reporting API for new events. -- By default, `var.interval` is set to 2 hours (2h). Consider changing this interval to a lower value, such as 10 minutes (10m). -- See the following references for further information. - - https://support.google.com/a/answer/7061566 - - https://www.elastic.co/guide/en/beats/filebeat/{branch}/filebeat-module-google_workspace.html ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -event.dataset:(gsuite.admin or google_workspace.admin) and event.provider:admin and event.category:iam and event.action:(ENFORCE_STRONG_AUTHENTICATION or ALLOW_STRONG_AUTHENTICATION) and (gsuite.admin.new_value:false or google_workspace.admin.new_value:false) - ----------------------------------- diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-mshta-making-network-connections.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-mshta-making-network-connections.asciidoc deleted file mode 100644 index fba3ea3287..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-mshta-making-network-connections.asciidoc +++ /dev/null @@ -1,71 +0,0 @@ -[[prebuilt-rule-0-13-3-mshta-making-network-connections]] -=== Mshta Making Network Connections - -Identifies Mshta.exe making outbound network connections. This may indicate adversarial activity as Mshta is often leveraged by adversaries to execute malicious scripts and evade detection. - -*Rule type*: eql - -*Rule indices*: - -* logs-endpoint.events.* -* winlogbeat-* -* logs-windows.* - -*Severity*: medium - -*Risk score*: 21 - -*Runs every*: 5m - -*Searches indices from*: now-20m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Defense Evasion - -*Version*: 4 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -sequence by process.entity_id with maxspan=10m - [process where event.type in ("start", "process_started") and process.name : "mshta.exe" and - not process.parent.name : "Microsoft.ConfigurationManagement.exe" and - not (process.parent.executable : "C:\\Amazon\\Amazon Assistant\\amazonAssistantService.exe" or - process.parent.executable : "C:\\TeamViewer\\TeamViewer.exe") and - not process.args : "ADSelfService_Enroll.hta"] - [network where process.name : "mshta.exe"] - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Defense Evasion -** ID: TA0005 -** Reference URL: https://attack.mitre.org/tactics/TA0005/ -* Technique: -** Name: Signed Binary Proxy Execution -** ID: T1218 -** Reference URL: https://attack.mitre.org/techniques/T1218/ -* Sub-technique: -** Name: Mshta -** ID: T1218.005 -** Reference URL: https://attack.mitre.org/techniques/T1218/005/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-o365-excessive-single-sign-on-logon-errors.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-o365-excessive-single-sign-on-logon-errors.asciidoc deleted file mode 100644 index cee2457fe1..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-o365-excessive-single-sign-on-logon-errors.asciidoc +++ /dev/null @@ -1,72 +0,0 @@ -[[prebuilt-rule-0-13-3-o365-excessive-single-sign-on-logon-errors]] -=== O365 Excessive Single Sign-On Logon Errors - -Identifies accounts with a high number of single sign-on (SSO) logon errors. Excessive logon errors may indicate an attempt to brute force a password or single sign-on token. - -*Rule type*: threshold - -*Rule indices*: - -* filebeat-* -* logs-o365* - -*Severity*: high - -*Risk score*: 73 - -*Runs every*: 5m - -*Searches indices from*: now-20m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Cloud -* Microsoft 365 -* Continuous Monitoring -* SecOps -* Identity and Access - -*Version*: 1 - -*Rule authors*: - -* Elastic -* Austin Songer - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Config - -The Microsoft 365 Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -event.dataset:o365.audit and event.provider:AzureActiveDirectory and event.category:web and o365.audit.LogonError:"SsoArtifactInvalidOrExpired" - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Credential Access -** ID: TA0006 -** Reference URL: https://attack.mitre.org/tactics/TA0006/ -* Technique: -** Name: Brute Force -** ID: T1110 -** Reference URL: https://attack.mitre.org/techniques/T1110/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-parent-process-pid-spoofing.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-parent-process-pid-spoofing.asciidoc deleted file mode 100644 index f572ae207f..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-parent-process-pid-spoofing.asciidoc +++ /dev/null @@ -1,87 +0,0 @@ -[[prebuilt-rule-0-13-3-parent-process-pid-spoofing]] -=== Parent Process PID Spoofing - -Identifies parent process spoofing used to thwart detection. Adversaries may spoof the parent process identifier (PPID) of a new process to evade process-monitoring defenses or to elevate privileges. - -*Rule type*: eql - -*Rule indices*: - -* logs-endpoint.events.* - -*Severity*: high - -*Risk score*: 73 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://blog.didierstevens.com/2017/03/20/ - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Defense Evasion - -*Version*: 1 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -/* This rule is compatible with Elastic Endpoint only */ - -sequence by host.id, user.id with maxspan=5m - [process where event.type == "start" and - process.Ext.token.integrity_level_name != "system" and - ( - process.pe.original_file_name : ("winword.exe", "excel.exe", "outlook.exe", "powerpnt.exe", "eqnedt32.exe", - "fltldr.exe", "mspub.exe", "msaccess.exe", "powershell.exe", "pwsh.exe", - "cscript.exe", "wscript.exe", "rundll32.exe", "regsvr32.exe", "msbuild.exe", - "mshta.exe", "wmic.exe", "cmstp.exe", "msxsl.exe") or - process.executable : ("?:\\Users\\*.exe", - "?:\\ProgramData\\*.exe", - "?:\\Windows\\Microsoft.NET\\*.exe", - "?:\\Windows\\Temp\\*.exe", - "?:\\Windows\\Tasks\\*") or - process.code_signature.trusted != true - ) - ] by process.pid - [process where event.type == "start" and process.parent.Ext.real.pid > 0 and - /* process.parent.Ext.real.pid is only populated if the parent process pid doesn't match */ - - not (process.name : "msedge.exe" and process.parent.name : "sihost.exe") - ] by process.parent.Ext.real.pid - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Defense Evasion -** ID: TA0005 -** Reference URL: https://attack.mitre.org/tactics/TA0005/ -* Technique: -** Name: Access Token Manipulation -** ID: T1134 -** Reference URL: https://attack.mitre.org/techniques/T1134/ -* Sub-technique: -** Name: Parent PID Spoofing -** ID: T1134.004 -** Reference URL: https://attack.mitre.org/techniques/T1134/004/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-possible-fin7-dga-command-and-control-behavior.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-possible-fin7-dga-command-and-control-behavior.asciidoc deleted file mode 100644 index ff97557d8a..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-possible-fin7-dga-command-and-control-behavior.asciidoc +++ /dev/null @@ -1,83 +0,0 @@ -[[prebuilt-rule-0-13-3-possible-fin7-dga-command-and-control-behavior]] -=== Possible FIN7 DGA Command and Control Behavior - -This rule detects a known command and control pattern in network events. The FIN7 threat group is known to use this command and control technique, while maintaining persistence in their target's network. - -*Rule type*: query - -*Rule indices*: - -* auditbeat-* -* filebeat-* -* packetbeat-* -* logs-endpoint.events.* - -*Severity*: high - -*Risk score*: 73 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html - -*Tags*: - -* Elastic -* Network -* Threat Detection -* Command and Control -* Host - -*Version*: 6 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Triage and analysis - -In the event this rule identifies benign domains in your environment, the `destination.domain` field in the rule can be modified to include those domains. Example: `...AND NOT destination.domain:(zoom.us OR benign.domain1 OR benign.domain2)`. ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -event.category:(network OR network_traffic) AND type:(tls OR http) AND network.transport:tcp -AND destination.domain:/[a-zA-Z]{4,5}\.(pw|us|club|info|site|top)/ AND NOT destination.domain:zoom.us - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Command and Control -** ID: TA0011 -** Reference URL: https://attack.mitre.org/tactics/TA0011/ -* Technique: -** Name: Application Layer Protocol -** ID: T1071 -** Reference URL: https://attack.mitre.org/techniques/T1071/ -* Technique: -** Name: Dynamic Resolution -** ID: T1568 -** Reference URL: https://attack.mitre.org/techniques/T1568/ -* Sub-technique: -** Name: Domain Generation Algorithms -** ID: T1568.002 -** Reference URL: https://attack.mitre.org/techniques/T1568/002/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-rare-aws-error-code.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-rare-aws-error-code.asciidoc deleted file mode 100644 index 3d1dae0f4c..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-rare-aws-error-code.asciidoc +++ /dev/null @@ -1,57 +0,0 @@ -[[prebuilt-rule-0-13-3-rare-aws-error-code]] -=== Rare AWS Error Code - -A machine learning job detected an unusual error in a CloudTrail message. These can be byproducts of attempted or successful persistence, privilege escalation, defense evasion, discovery, lateral movement, or collection. - -*Rule type*: machine_learning - -*Rule indices*: None - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 15m - -*Searches indices from*: now-2h ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html - -*Tags*: - -* Elastic -* Cloud -* AWS -* ML - -*Version*: 5 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Config - -The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. - -## Triage and analysis - -Investigating Unusual CloudTrail Error Activity ### -Detection alerts from this rule indicate a rare and unusual error code that was associated with the response to an AWS API command or method call. Here are some possible avenues of investigation: -- Examine the history of the error. Has it manifested before? If the error, which is visible in the `aws.cloudtrail.error_code field`, manifested only very recently, it might be related to recent changes in an automation module or script. -- Examine the request parameters. These may provide indications as to the nature of the task being performed when the error occurred. Is the error related to unsuccessful attempts to enumerate or access objects, data, or secrets? If so, this can sometimes be a byproduct of discovery, privilege escalation, or lateral movement attempts. -- Consider the user as identified by the `user.name` field. Is this activity part of an expected workflow for the user context? Examine the user identity in the `aws.cloudtrail.user_identity.arn` field and the access key id in the `aws.cloudtrail.user_identity.access_key_id` field which can help identify the precise user context. The user agent details in the `user_agent.original` field may also indicate what kind of a client made the request. -- Consider the source IP address and geolocation for the calling user who issued the command. Do they look normal for the calling user? If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts or could it be sourcing from an EC2 instance not under your control? If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles? Are there any other alerts or signs of suspicious activity involving this instance? ----------------------------------- diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-rdp-remote-desktop-protocol-from-the-internet.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-rdp-remote-desktop-protocol-from-the-internet.asciidoc deleted file mode 100644 index df775eb5ca..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-rdp-remote-desktop-protocol-from-the-internet.asciidoc +++ /dev/null @@ -1,110 +0,0 @@ -[[prebuilt-rule-0-13-3-rdp-remote-desktop-protocol-from-the-internet]] -=== RDP (Remote Desktop Protocol) from the Internet - -This rule detects network events that may indicate the use of RDP traffic from the Internet. RDP is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or back-door vector. - -*Rule type*: query - -*Rule indices*: - -* auditbeat-* -* filebeat-* -* packetbeat-* -* logs-endpoint.events.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml - -*Tags*: - -* Elastic -* Host -* Network -* Threat Detection -* Command and Control -* Host - -*Version*: 10 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -event.category:(network or network_traffic) and network.transport:tcp and (destination.port:3389 or event.dataset:zeek.rdp) and - not source.ip:( - 10.0.0.0/8 or - 127.0.0.0/8 or - 169.254.0.0/16 or - 172.16.0.0/12 or - 192.0.0.0/24 or - 192.0.0.0/29 or - 192.0.0.8/32 or - 192.0.0.9/32 or - 192.0.0.10/32 or - 192.0.0.170/32 or - 192.0.0.171/32 or - 192.0.2.0/24 or - 192.31.196.0/24 or - 192.52.193.0/24 or - 192.168.0.0/16 or - 192.88.99.0/24 or - 224.0.0.0/4 or - 100.64.0.0/10 or - 192.175.48.0/24 or - 198.18.0.0/15 or - 198.51.100.0/24 or - 203.0.113.0/24 or - 240.0.0.0/4 or - "::1" or - "FE80::/10" or - "FF00::/8" - ) and - destination.ip:( - 10.0.0.0/8 or - 172.16.0.0/12 or - 192.168.0.0/16 - ) - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Command and Control -** ID: TA0011 -** Reference URL: https://attack.mitre.org/tactics/TA0011/ -* Tactic: -** Name: Lateral Movement -** ID: TA0008 -** Reference URL: https://attack.mitre.org/tactics/TA0008/ -* Technique: -** Name: Remote Services -** ID: T1021 -** Reference URL: https://attack.mitre.org/techniques/T1021/ -* Tactic: -** Name: Initial Access -** ID: TA0001 -** Reference URL: https://attack.mitre.org/tactics/TA0001/ -* Technique: -** Name: Exploit Public-Facing Application -** ID: T1190 -** Reference URL: https://attack.mitre.org/techniques/T1190/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-roshal-archive-rar-or-powershell-file-downloaded-from-the-internet.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-roshal-archive-rar-or-powershell-file-downloaded-from-the-internet.asciidoc deleted file mode 100644 index cd1051b3d3..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-roshal-archive-rar-or-powershell-file-downloaded-from-the-internet.asciidoc +++ /dev/null @@ -1,110 +0,0 @@ -[[prebuilt-rule-0-13-3-roshal-archive-rar-or-powershell-file-downloaded-from-the-internet]] -=== Roshal Archive (RAR) or PowerShell File Downloaded from the Internet - -Detects a Roshal Archive (RAR) file or PowerShell script downloaded from the internet by an internal host. Gaining initial access to a system and then downloading encoded or encrypted tools to move laterally is a common practice for adversaries as a way to protect their more valuable tools and TTPs. This may be atypical behavior for a managed network and can be indicative of malware, exfiltration, or command and control. - -*Rule type*: query - -*Rule indices*: - -* auditbeat-* -* filebeat-* -* packetbeat-* -* logs-endpoint.events.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html -* https://www.justice.gov/opa/press-release/file/1084361/download -* https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml - -*Tags*: - -* Elastic -* Network -* Threat Detection -* Command and Control -* Host - -*Version*: 6 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Threat intel - -This activity has been observed in FIN7 campaigns. ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -event.category:(network or network_traffic) and network.protocol:http and - (url.extension:(ps1 or rar) or url.path:(*.ps1 or *.rar)) and - not destination.ip:( - 10.0.0.0/8 or - 127.0.0.0/8 or - 169.254.0.0/16 or - 172.16.0.0/12 or - 192.0.0.0/24 or - 192.0.0.0/29 or - 192.0.0.8/32 or - 192.0.0.9/32 or - 192.0.0.10/32 or - 192.0.0.170/32 or - 192.0.0.171/32 or - 192.0.2.0/24 or - 192.31.196.0/24 or - 192.52.193.0/24 or - 192.168.0.0/16 or - 192.88.99.0/24 or - 224.0.0.0/4 or - 100.64.0.0/10 or - 192.175.48.0/24 or - 198.18.0.0/15 or - 198.51.100.0/24 or - 203.0.113.0/24 or - 240.0.0.0/4 or - "::1" or - "FE80::/10" or - "FF00::/8" - ) and - source.ip:( - 10.0.0.0/8 or - 172.16.0.0/12 or - 192.168.0.0/16 - ) - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Command and Control -** ID: TA0011 -** Reference URL: https://attack.mitre.org/tactics/TA0011/ -* Technique: -** Name: Ingress Tool Transfer -** ID: T1105 -** Reference URL: https://attack.mitre.org/techniques/T1105/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-rpc-remote-procedure-call-from-the-internet.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-rpc-remote-procedure-call-from-the-internet.asciidoc deleted file mode 100644 index 965d0bc6c8..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-rpc-remote-procedure-call-from-the-internet.asciidoc +++ /dev/null @@ -1,98 +0,0 @@ -[[prebuilt-rule-0-13-3-rpc-remote-procedure-call-from-the-internet]] -=== RPC (Remote Procedure Call) from the Internet - -This rule detects network events that may indicate the use of RPC traffic from the Internet. RPC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or back-door vector. - -*Rule type*: query - -*Rule indices*: - -* auditbeat-* -* filebeat-* -* packetbeat-* -* logs-endpoint.events.* - -*Severity*: high - -*Risk score*: 73 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml - -*Tags*: - -* Elastic -* Host -* Network -* Threat Detection -* Initial Access -* Host - -*Version*: 10 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -event.category:(network or network_traffic) and network.transport:tcp and (destination.port:135 or event.dataset:zeek.dce_rpc) and - not source.ip:( - 10.0.0.0/8 or - 127.0.0.0/8 or - 169.254.0.0/16 or - 172.16.0.0/12 or - 192.0.0.0/24 or - 192.0.0.0/29 or - 192.0.0.8/32 or - 192.0.0.9/32 or - 192.0.0.10/32 or - 192.0.0.170/32 or - 192.0.0.171/32 or - 192.0.2.0/24 or - 192.31.196.0/24 or - 192.52.193.0/24 or - 192.168.0.0/16 or - 192.88.99.0/24 or - 224.0.0.0/4 or - 100.64.0.0/10 or - 192.175.48.0/24 or - 198.18.0.0/15 or - 198.51.100.0/24 or - 203.0.113.0/24 or - 240.0.0.0/4 or - "::1" or - "FE80::/10" or - "FF00::/8" - ) and - destination.ip:( - 10.0.0.0/8 or - 172.16.0.0/12 or - 192.168.0.0/16 - ) - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Initial Access -** ID: TA0001 -** Reference URL: https://attack.mitre.org/tactics/TA0001/ -* Technique: -** Name: Exploit Public-Facing Application -** ID: T1190 -** Reference URL: https://attack.mitre.org/techniques/T1190/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-rpc-remote-procedure-call-to-the-internet.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-rpc-remote-procedure-call-to-the-internet.asciidoc deleted file mode 100644 index d76e7a729d..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-rpc-remote-procedure-call-to-the-internet.asciidoc +++ /dev/null @@ -1,98 +0,0 @@ -[[prebuilt-rule-0-13-3-rpc-remote-procedure-call-to-the-internet]] -=== RPC (Remote Procedure Call) to the Internet - -This rule detects network events that may indicate the use of RPC traffic to the Internet. RPC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or back-door vector. - -*Rule type*: query - -*Rule indices*: - -* auditbeat-* -* filebeat-* -* packetbeat-* -* logs-endpoint.events.* - -*Severity*: high - -*Risk score*: 73 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml - -*Tags*: - -* Elastic -* Host -* Network -* Threat Detection -* Initial Access -* Host - -*Version*: 10 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -event.category:(network or network_traffic) and network.transport:tcp and (destination.port:135 or event.dataset:zeek.dce_rpc) and - source.ip:( - 10.0.0.0/8 or - 172.16.0.0/12 or - 192.168.0.0/16 - ) and - not destination.ip:( - 10.0.0.0/8 or - 127.0.0.0/8 or - 169.254.0.0/16 or - 172.16.0.0/12 or - 192.0.0.0/24 or - 192.0.0.0/29 or - 192.0.0.8/32 or - 192.0.0.9/32 or - 192.0.0.10/32 or - 192.0.0.170/32 or - 192.0.0.171/32 or - 192.0.2.0/24 or - 192.31.196.0/24 or - 192.52.193.0/24 or - 192.168.0.0/16 or - 192.88.99.0/24 or - 224.0.0.0/4 or - 100.64.0.0/10 or - 192.175.48.0/24 or - 198.18.0.0/15 or - 198.51.100.0/24 or - 203.0.113.0/24 or - 240.0.0.0/4 or - "::1" or - "FE80::/10" or - "FF00::/8" - ) - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Initial Access -** ID: TA0001 -** Reference URL: https://attack.mitre.org/tactics/TA0001/ -* Technique: -** Name: Exploit Public-Facing Application -** ID: T1190 -** Reference URL: https://attack.mitre.org/techniques/T1190/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-smb-windows-file-sharing-activity-to-the-internet.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-smb-windows-file-sharing-activity-to-the-internet.asciidoc deleted file mode 100644 index fd86fc71fc..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-smb-windows-file-sharing-activity-to-the-internet.asciidoc +++ /dev/null @@ -1,106 +0,0 @@ -[[prebuilt-rule-0-13-3-smb-windows-file-sharing-activity-to-the-internet]] -=== SMB (Windows File Sharing) Activity to the Internet - -This rule detects network events that may indicate the use of Windows file sharing (also called SMB or CIFS) traffic to the Internet. SMB is commonly used within networks to share files, printers, and other system resources amongst trusted systems. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or back-door vector or for data exfiltration. - -*Rule type*: query - -*Rule indices*: - -* auditbeat-* -* filebeat-* -* packetbeat-* -* logs-endpoint.events.* - -*Severity*: high - -*Risk score*: 73 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml - -*Tags*: - -* Elastic -* Host -* Network -* Threat Detection -* Initial Access -* Host - -*Version*: 10 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -event.category:(network or network_traffic) and network.transport:tcp and (destination.port:(139 or 445) or event.dataset:zeek.smb) and - source.ip:( - 10.0.0.0/8 or - 172.16.0.0/12 or - 192.168.0.0/16 - ) and - not destination.ip:( - 10.0.0.0/8 or - 127.0.0.0/8 or - 169.254.0.0/16 or - 172.16.0.0/12 or - 192.0.0.0/24 or - 192.0.0.0/29 or - 192.0.0.8/32 or - 192.0.0.9/32 or - 192.0.0.10/32 or - 192.0.0.170/32 or - 192.0.0.171/32 or - 192.0.2.0/24 or - 192.31.196.0/24 or - 192.52.193.0/24 or - 192.168.0.0/16 or - 192.88.99.0/24 or - 224.0.0.0/4 or - 100.64.0.0/10 or - 192.175.48.0/24 or - 198.18.0.0/15 or - 198.51.100.0/24 or - 203.0.113.0/24 or - 240.0.0.0/4 or - "::1" or - "FE80::/10" or - "FF00::/8" - ) - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Initial Access -** ID: TA0001 -** Reference URL: https://attack.mitre.org/tactics/TA0001/ -* Technique: -** Name: Exploit Public-Facing Application -** ID: T1190 -** Reference URL: https://attack.mitre.org/techniques/T1190/ -* Tactic: -** Name: Exfiltration -** ID: TA0010 -** Reference URL: https://attack.mitre.org/tactics/TA0010/ -* Technique: -** Name: Exfiltration Over Alternative Protocol -** ID: T1048 -** Reference URL: https://attack.mitre.org/techniques/T1048/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-smtp-on-port-26-tcp.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-smtp-on-port-26-tcp.asciidoc deleted file mode 100644 index 242ad504e0..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-smtp-on-port-26-tcp.asciidoc +++ /dev/null @@ -1,70 +0,0 @@ -[[prebuilt-rule-0-13-3-smtp-on-port-26-tcp]] -=== SMTP on Port 26/TCP - -This rule detects events that may indicate use of SMTP on TCP port 26. This port is commonly used by several popular mail transfer agents to deconflict with the default SMTP port 25. This port has also been used by a malware family called BadPatch for command and control of Windows systems. - -*Rule type*: query - -*Rule indices*: - -* auditbeat-* -* filebeat-* -* packetbeat-* -* logs-endpoint.events.* - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://unit42.paloaltonetworks.com/unit42-badpatch/ -* https://isc.sans.edu/forums/diary/Next+up+whats+up+with+TCP+port+26/25564/ - -*Tags*: - -* Elastic -* Host -* Network -* Threat Detection -* Command and Control -* Host - -*Version*: 8 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -event.category:(network or network_traffic) and network.transport:tcp and (destination.port:26 or (event.dataset:zeek.smtp and destination.port:26)) - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Command and Control -** ID: TA0011 -** Reference URL: https://attack.mitre.org/tactics/TA0011/ -* Tactic: -** Name: Exfiltration -** ID: TA0010 -** Reference URL: https://attack.mitre.org/tactics/TA0010/ -* Technique: -** Name: Exfiltration Over Alternative Protocol -** ID: T1048 -** Reference URL: https://attack.mitre.org/techniques/T1048/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-spike-in-aws-error-messages.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-spike-in-aws-error-messages.asciidoc deleted file mode 100644 index 8d5e6605f8..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-spike-in-aws-error-messages.asciidoc +++ /dev/null @@ -1,57 +0,0 @@ -[[prebuilt-rule-0-13-3-spike-in-aws-error-messages]] -=== Spike in AWS Error Messages - -A machine learning job detected a significant spike in the rate of a particular error in the CloudTrail messages. Spikes in error messages may accompany attempts at privilege escalation, lateral movement, or discovery. - -*Rule type*: machine_learning - -*Rule indices*: None - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 15m - -*Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html - -*Tags*: - -* Elastic -* Cloud -* AWS -* ML - -*Version*: 5 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Config - -The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. - -## Triage and analysis - -### Investigating Spikes in CloudTrail Errors -Detection alerts from this rule indicate a large spike in the number of CloudTrail log messages that contain a particular error message. The error message in question was associated with the response to an AWS API command or method call. Here are some possible avenues of investigation: -- Examine the history of the error. Has it manifested before? If the error, which is visible in the `aws.cloudtrail.error_message` field, manifested only very recently, it might be related to recent changes in an automation module or script. -- Examine the request parameters. These may provide indications as to the nature of the task being performed when the error occurred. Is the error related to unsuccessful attempts to enumerate or access objects, data or secrets? If so, this can sometimes be a byproduct of discovery, privilege escalation or lateral movement attempts. -- Consider the user as identified by the user.name field. Is this activity part of an expected workflow for the user context? Examine the user identity in the `aws.cloudtrail.user_identity.arn` field and the access key id in the `aws.cloudtrail.user_identity.access_key_id` field which can help identify the precise user context. The user agent details in the `user_agent.original` field may also indicate what kind of a client made the request. -- Consider the source IP address and geolocation for the calling user who issued the command. Do they look normal for the calling user? If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts or could it be sourcing from an EC2 instance not under your control? If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles? Are there any other alerts or signs of suspicious activity involving this instance? ----------------------------------- diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-suspicious-certutil-commands.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-suspicious-certutil-commands.asciidoc deleted file mode 100644 index 3d392ba655..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-suspicious-certutil-commands.asciidoc +++ /dev/null @@ -1,68 +0,0 @@ -[[prebuilt-rule-0-13-3-suspicious-certutil-commands]] -=== Suspicious CertUtil Commands - -Identifies suspicious commands being used with certutil.exe. CertUtil is a native Windows component which is part of Certificate Services. CertUtil is often abused by attackers to live off the land for stealthier command and control or data exfiltration. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://twitter.com/Moriarty_Meng/status/984380793383370752 -* https://twitter.com/egre55/status/1087685529016193025 -* https://www.sysadmins.lv/blog-en/certutil-tips-and-tricks-working-with-x509-file-format.aspx -* https://docs.microsoft.com/en-us/archive/blogs/pki/basic-crl-checking-with-certutil - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Defense Evasion - -*Version*: 9 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type == "start" and - (process.name : "certutil.exe" or process.pe.original_file_name == "CertUtil.exe") and - process.args : ("?decode", "?encode", "?urlcache", "?verifyctl", "?encodehex", "?decodehex") - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Defense Evasion -** ID: TA0005 -** Reference URL: https://attack.mitre.org/tactics/TA0005/ -* Technique: -** Name: Deobfuscate/Decode Files or Information -** ID: T1140 -** Reference URL: https://attack.mitre.org/techniques/T1140/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-telnet-port-activity.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-telnet-port-activity.asciidoc deleted file mode 100644 index 5e70a1aba6..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-telnet-port-activity.asciidoc +++ /dev/null @@ -1,75 +0,0 @@ -[[prebuilt-rule-0-13-3-telnet-port-activity]] -=== Telnet Port Activity - -This rule detects network events that may indicate the use of Telnet traffic. Telnet is commonly used by system administrators to remotely control older or embed ed systems using the command line shell. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or back-door vector. As a plain-text protocol, it may also expose usernames and passwords to anyone capable of observing the traffic. - -*Rule type*: query - -*Rule indices*: - -* auditbeat-* -* filebeat-* -* packetbeat-* -* logs-endpoint.events.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Host -* Network -* Threat Detection -* Command and Control -* Host - -*Version*: 8 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -event.category:(network or network_traffic) and network.transport:tcp and destination.port:23 - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Command and Control -** ID: TA0011 -** Reference URL: https://attack.mitre.org/tactics/TA0011/ -* Tactic: -** Name: Lateral Movement -** ID: TA0008 -** Reference URL: https://attack.mitre.org/tactics/TA0008/ -* Technique: -** Name: Remote Services -** ID: T1021 -** Reference URL: https://attack.mitre.org/techniques/T1021/ -* Tactic: -** Name: Initial Access -** ID: TA0001 -** Reference URL: https://attack.mitre.org/tactics/TA0001/ -* Technique: -** Name: Exploit Public-Facing Application -** ID: T1190 -** Reference URL: https://attack.mitre.org/techniques/T1190/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-unusual-aws-command-for-a-user.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-unusual-aws-command-for-a-user.asciidoc deleted file mode 100644 index bd3579dc07..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-unusual-aws-command-for-a-user.asciidoc +++ /dev/null @@ -1,59 +0,0 @@ -[[prebuilt-rule-0-13-3-unusual-aws-command-for-a-user]] -=== Unusual AWS Command for a User - -A machine learning job detected an AWS API command that, while not inherently suspicious or abnormal, is being made by a user context that does not normally use the command. This can be the result of compromised credentials or keys as someone uses a valid account to persist, move laterally, or exfil data. - -*Rule type*: machine_learning - -*Rule indices*: None - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 15m - -*Searches indices from*: now-2h ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html - -*Tags*: - -* Elastic -* Cloud -* AWS -* ML - -*Version*: 5 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Config - -The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. - -## Triage and analysis - -### Investigating an Unusual CloudTrail Event - -Detection alerts from this rule indicate an AWS API command or method call that is rare and unusual for the calling IAM user. Here are some possible avenues of investigation: -- Consider the user as identified by the `user.name` field. Is this command part of an expected workflow for the user context? Examine the user identity in the `aws.cloudtrail.user_identity.arn` field and the access key id in the `aws.cloudtrail.user_identity.access_key_id` field which can help identify the precise user context. The user agent details in the `user_agent.original` field may also indicate what kind of a client made the request. -- Consider the source IP address and geolocation for the calling user who issued the command. Do they look normal for the calling user? If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts or could it be sourcing from an EC2 instance not under your control? If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles? Are there any other alerts or signs of suspicious activity involving this instance? -- Consider the time of day. If the user is a human, not a program or script, did the activity take place during a normal time of day? -- Examine the history of the command. If the command, which is visible in the `event.action field`, manifested only very recently, it might be part of a new automation module or script. If it has a consistent cadence - for example, if it appears in small numbers on a weekly or monthly cadence it might be part of a housekeeping or maintenance process. -- Examine the request parameters. These may provide indications as to the source of the program or the nature of the tasks it is performing. ----------------------------------- diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-unusual-child-processes-of-rundll32.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-unusual-child-processes-of-rundll32.asciidoc deleted file mode 100644 index f7f7a4ef83..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-unusual-child-processes-of-rundll32.asciidoc +++ /dev/null @@ -1,71 +0,0 @@ -[[prebuilt-rule-0-13-3-unusual-child-processes-of-rundll32]] -=== Unusual Child Processes of RunDLL32 - -Identifies child processes of unusual instances of RunDLL32 where the command line parameters were suspicious. Misuse of RunDLL32 could indicate malicious activity. - -*Rule type*: eql - -*Rule indices*: - -* logs-endpoint.events.* -* winlogbeat-* -* logs-windows.* - -*Severity*: high - -*Risk score*: 21 - -*Runs every*: 30m - -*Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Defense Evasion - -*Version*: 4 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -sequence with maxspan=1h - [process where event.type in ("start", "process_started") and - (process.name : "rundll32.exe" or process.pe.original_file_name == "RUNDLL32.EXE") and - process.args_count == 1 - ] by process.entity_id - [process where event.type in ("start", "process_started") and process.parent.name : "rundll32.exe" - ] by process.parent.entity_id - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Defense Evasion -** ID: TA0005 -** Reference URL: https://attack.mitre.org/tactics/TA0005/ -* Technique: -** Name: Signed Binary Proxy Execution -** ID: T1218 -** Reference URL: https://attack.mitre.org/techniques/T1218/ -* Sub-technique: -** Name: Rundll32 -** ID: T1218.011 -** Reference URL: https://attack.mitre.org/techniques/T1218/011/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-unusual-city-for-an-aws-command.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-unusual-city-for-an-aws-command.asciidoc deleted file mode 100644 index 68934e8701..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-unusual-city-for-an-aws-command.asciidoc +++ /dev/null @@ -1,58 +0,0 @@ -[[prebuilt-rule-0-13-3-unusual-city-for-an-aws-command]] -=== Unusual City For an AWS Command - -A machine learning job detected AWS command activity that, while not inherently suspicious or abnormal, is sourcing from a geolocation (city) that is unusual for the command. This can be the result of compromised credentials or keys being used by a threat actor in a different geography then the authorized user(s). - -*Rule type*: machine_learning - -*Rule indices*: None - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 15m - -*Searches indices from*: now-2h ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html - -*Tags*: - -* Elastic -* Cloud -* AWS -* ML - -*Version*: 5 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Config - -The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. - -## Triage and analysis - -### Investigating an Unusual CloudTrail Event -Detection alerts from this rule indicate an AWS API command or method call that is rare and unusual for the geolocation of the source IP address. Here are some possible avenues of investigation: -- Consider the source IP address and geolocation for the calling user who issued the command. Do they look normal for the calling user? If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts or could it be sourcing from an EC2 instance not under your control? If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles? Are there any other alerts or signs of suspicious activity involving this instance? -- Consider the user as identified by the `user.name` field. Is this command part of an expected workflow for the user context? Examine the user identity in the `aws.cloudtrail.user_identity.arn` field and the access key id in the `aws.cloudtrail.user_identity.access_key_id` field which can help identify the precise user context. The user agent details in the `user_agent.original` field may also indicate what kind of a client made the request. -- Consider the time of day. If the user is a human, not a program or script, did the activity take place during a normal time of day? -- Examine the history of the command. If the command, which is visible in the `event.action field`, manifested only very recently, it might be part of a new automation module or script. If it has a consistent cadence - for example, if it appears in small numbers on a weekly or monthly cadence it might be part of a housekeeping or maintenance process. -- Examine the request parameters. These may provide indications as to the source of the program or the nature of the tasks it is performing. ----------------------------------- diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-unusual-country-for-an-aws-command.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-unusual-country-for-an-aws-command.asciidoc deleted file mode 100644 index 5f64a75a9b..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-unusual-country-for-an-aws-command.asciidoc +++ /dev/null @@ -1,58 +0,0 @@ -[[prebuilt-rule-0-13-3-unusual-country-for-an-aws-command]] -=== Unusual Country For an AWS Command - -A machine learning job detected AWS command activity that, while not inherently suspicious or abnormal, is sourcing from a geolocation (country) that is unusual for the command. This can be the result of compromised credentials or keys being used by a threat actor in a different geography then the authorized user(s). - -*Rule type*: machine_learning - -*Rule indices*: None - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 15m - -*Searches indices from*: now-2h ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html - -*Tags*: - -* Elastic -* Cloud -* AWS -* ML - -*Version*: 5 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Config - -The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. - -## Triage and analysis - -### Investigating an Unusual CloudTrail Event -Detection alerts from this rule indicate an AWS API command or method call that is rare and unusual for the geolocation of the source IP address. Here are some possible avenues of investigation: -- Consider the source IP address and geolocation for the calling user who issued the command. Do they look normal for the calling user? If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts or could it be sourcing from an EC2 instance not under your control? If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles? Are there any other alerts or signs of suspicious activity involving this instance? -- Consider the user as identified by the `user.name` field. Is this command part of an expected workflow for the user context? Examine the user identity in the `aws.cloudtrail.user_identity.arn` field and the access key id in the `aws.cloudtrail.user_identity.access_key_id` field which can help identify the precise user context. The user agent details in the `user_agent.original` field may also indicate what kind of a client made the request. -- Consider the time of day. If the user is a human, not a program or script, did the activity take place during a normal time of day? -- Examine the history of the command. If the command, which is visible in the `event.action field`, manifested only very recently, it might be part of a new automation module or script. If it has a consistent cadence - for example, if it appears in small numbers on a weekly or monthly cadence it might be part of a housekeeping or maintenance process. -- Examine the request parameters. These may provide indications as to the source of the program or the nature of the tasks it is performing. ----------------------------------- diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-unusual-print-spooler-child-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-unusual-print-spooler-child-process.asciidoc deleted file mode 100644 index ce70ecc5e2..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-unusual-print-spooler-child-process.asciidoc +++ /dev/null @@ -1,73 +0,0 @@ -[[prebuilt-rule-0-13-3-unusual-print-spooler-child-process]] -=== Unusual Print Spooler Child Process - -Detects unusual Print Spooler service (spoolsv.exe) child processes. This may indicate an attempt to exploit privilege escalation vulnerabilities related to the Printing Service on Windows. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527 -* https://github.com/afwu/PrintNightmare - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Privilege Escalation - -*Version*: 2 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type == "start" and - process.parent.name : "spoolsv.exe" and user.id : "S-1-5-18" and - - /* exclusions for FP control below */ - not process.name : ("splwow64.exe", "PDFCreator.exe", "acrodist.exe", "spoolsv.exe", "msiexec.exe", "route.exe", "WerFault.exe") and - not process.command_line : "*\\WINDOWS\\system32\\spool\\DRIVERS*" and - not (process.name : "net.exe" and process.command_line : ("*stop*", "*start*")) and - not (process.name : ("cmd.exe", "powershell.exe") and process.command_line : ("*.spl*", "*\\program files*", "*route add*")) and - not (process.name : "netsh.exe" and process.command_line : ("*add portopening*", "*rule name*")) and - not (process.name : "regsvr32.exe" and process.command_line : "*PrintConfig.dll*") - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Privilege Escalation -** ID: TA0004 -** Reference URL: https://attack.mitre.org/tactics/TA0004/ -* Technique: -** Name: Exploitation for Privilege Escalation -** ID: T1068 -** Reference URL: https://attack.mitre.org/techniques/T1068/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-vnc-virtual-network-computing-from-the-internet.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-vnc-virtual-network-computing-from-the-internet.asciidoc deleted file mode 100644 index d8f48be5f1..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-vnc-virtual-network-computing-from-the-internet.asciidoc +++ /dev/null @@ -1,106 +0,0 @@ -[[prebuilt-rule-0-13-3-vnc-virtual-network-computing-from-the-internet]] -=== VNC (Virtual Network Computing) from the Internet - -This rule detects network events that may indicate the use of VNC traffic from the Internet. VNC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or back-door vector. - -*Rule type*: query - -*Rule indices*: - -* auditbeat-* -* filebeat-* -* packetbeat-* -* logs-endpoint.events.* - -*Severity*: high - -*Risk score*: 73 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml - -*Tags*: - -* Elastic -* Host -* Network -* Threat Detection -* Command and Control -* Host - -*Version*: 10 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -event.category:(network or network_traffic) and network.transport:tcp and destination.port >= 5800 and destination.port <= 5810 and - not source.ip:( - 10.0.0.0/8 or - 127.0.0.0/8 or - 169.254.0.0/16 or - 172.16.0.0/12 or - 192.0.0.0/24 or - 192.0.0.0/29 or - 192.0.0.8/32 or - 192.0.0.9/32 or - 192.0.0.10/32 or - 192.0.0.170/32 or - 192.0.0.171/32 or - 192.0.2.0/24 or - 192.31.196.0/24 or - 192.52.193.0/24 or - 192.168.0.0/16 or - 192.88.99.0/24 or - 224.0.0.0/4 or - 100.64.0.0/10 or - 192.175.48.0/24 or - 198.18.0.0/15 or - 198.51.100.0/24 or - 203.0.113.0/24 or - 240.0.0.0/4 or - "::1" or - "FE80::/10" or - "FF00::/8" - ) and - destination.ip:( - 10.0.0.0/8 or - 172.16.0.0/12 or - 192.168.0.0/16 - ) - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Command and Control -** ID: TA0011 -** Reference URL: https://attack.mitre.org/tactics/TA0011/ -* Technique: -** Name: Remote Access Software -** ID: T1219 -** Reference URL: https://attack.mitre.org/techniques/T1219/ -* Tactic: -** Name: Initial Access -** ID: TA0001 -** Reference URL: https://attack.mitre.org/tactics/TA0001/ -* Technique: -** Name: Exploit Public-Facing Application -** ID: T1190 -** Reference URL: https://attack.mitre.org/techniques/T1190/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-vnc-virtual-network-computing-to-the-internet.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-vnc-virtual-network-computing-to-the-internet.asciidoc deleted file mode 100644 index cfee78a7c2..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-vnc-virtual-network-computing-to-the-internet.asciidoc +++ /dev/null @@ -1,98 +0,0 @@ -[[prebuilt-rule-0-13-3-vnc-virtual-network-computing-to-the-internet]] -=== VNC (Virtual Network Computing) to the Internet - -This rule detects network events that may indicate the use of VNC traffic to the Internet. VNC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or back-door vector. - -*Rule type*: query - -*Rule indices*: - -* auditbeat-* -* filebeat-* -* packetbeat-* -* logs-endpoint.events.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml - -*Tags*: - -* Elastic -* Host -* Network -* Threat Detection -* Command and Control -* Host - -*Version*: 10 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -event.category:(network or network_traffic) and network.transport:tcp and destination.port >= 5800 and destination.port <= 5810 and - source.ip:( - 10.0.0.0/8 or - 172.16.0.0/12 or - 192.168.0.0/16 - ) and - not destination.ip:( - 10.0.0.0/8 or - 127.0.0.0/8 or - 169.254.0.0/16 or - 172.16.0.0/12 or - 192.0.0.0/24 or - 192.0.0.0/29 or - 192.0.0.8/32 or - 192.0.0.9/32 or - 192.0.0.10/32 or - 192.0.0.170/32 or - 192.0.0.171/32 or - 192.0.2.0/24 or - 192.31.196.0/24 or - 192.52.193.0/24 or - 192.168.0.0/16 or - 192.88.99.0/24 or - 224.0.0.0/4 or - 100.64.0.0/10 or - 192.175.48.0/24 or - 198.18.0.0/15 or - 198.51.100.0/24 or - 203.0.113.0/24 or - 240.0.0.0/4 or - "::1" or - "FE80::/10" or - "FF00::/8" - ) - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Command and Control -** ID: TA0011 -** Reference URL: https://attack.mitre.org/tactics/TA0011/ -* Technique: -** Name: Remote Access Software -** ID: T1219 -** Reference URL: https://attack.mitre.org/techniques/T1219/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-web-application-suspicious-activity-no-user-agent.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-web-application-suspicious-activity-no-user-agent.asciidoc deleted file mode 100644 index e8196ca2c2..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-web-application-suspicious-activity-no-user-agent.asciidoc +++ /dev/null @@ -1,48 +0,0 @@ -[[prebuilt-rule-0-13-3-web-application-suspicious-activity-no-user-agent]] -=== Web Application Suspicious Activity: No User Agent - -A request to a web application server contained no identifying user agent string. - -*Rule type*: query - -*Rule indices*: - -* apm-*-transaction* -* traces-apm* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://en.wikipedia.org/wiki/User_agent - -*Tags*: - -* Elastic -* APM - -*Version*: 7 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -url.path:* - ----------------------------------- diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-web-application-suspicious-activity-post-request-declined.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-web-application-suspicious-activity-post-request-declined.asciidoc deleted file mode 100644 index 799bc722ed..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-web-application-suspicious-activity-post-request-declined.asciidoc +++ /dev/null @@ -1,48 +0,0 @@ -[[prebuilt-rule-0-13-3-web-application-suspicious-activity-post-request-declined]] -=== Web Application Suspicious Activity: POST Request Declined - -A POST request to web application returned a 403 response, which indicates the web application declined to process the request because the action requested was not allowed - -*Rule type*: query - -*Rule indices*: - -* apm-*-transaction* -* traces-apm* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://en.wikipedia.org/wiki/HTTP_403 - -*Tags*: - -* Elastic -* APM - -*Version*: 7 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -http.response.status_code:403 and http.request.method:post - ----------------------------------- diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-web-application-suspicious-activity-sqlmap-user-agent.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-web-application-suspicious-activity-sqlmap-user-agent.asciidoc deleted file mode 100644 index fce91625b6..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-web-application-suspicious-activity-sqlmap-user-agent.asciidoc +++ /dev/null @@ -1,48 +0,0 @@ -[[prebuilt-rule-0-13-3-web-application-suspicious-activity-sqlmap-user-agent]] -=== Web Application Suspicious Activity: sqlmap User Agent - -This is an example of how to detect an unwanted web client user agent. This search matches the user agent for sqlmap 1.3.11, which is a popular FOSS tool for testing web applications for SQL injection vulnerabilities. - -*Rule type*: query - -*Rule indices*: - -* apm-*-transaction* -* traces-apm* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* http://sqlmap.org/ - -*Tags*: - -* Elastic -* APM - -*Version*: 7 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -user_agent.original:"sqlmap/1.3.11#stable (http://sqlmap.org)" - ----------------------------------- diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-web-application-suspicious-activity-unauthorized-method.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-web-application-suspicious-activity-unauthorized-method.asciidoc deleted file mode 100644 index b9a9ddf0db..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-web-application-suspicious-activity-unauthorized-method.asciidoc +++ /dev/null @@ -1,48 +0,0 @@ -[[prebuilt-rule-0-13-3-web-application-suspicious-activity-unauthorized-method]] -=== Web Application Suspicious Activity: Unauthorized Method - -A request to web application returned a 405 response which indicates the web application declined to process the request because the HTTP method is not allowed for the resource - -*Rule type*: query - -*Rule indices*: - -* apm-*-transaction* -* traces-apm* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://en.wikipedia.org/wiki/HTTP_405 - -*Tags*: - -* Elastic -* APM - -*Version*: 7 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -http.response.status_code:405 - ----------------------------------- diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-windows-defender-exclusions-added-via-powershell.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-windows-defender-exclusions-added-via-powershell.asciidoc deleted file mode 100644 index dd0ce24cb3..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-windows-defender-exclusions-added-via-powershell.asciidoc +++ /dev/null @@ -1,95 +0,0 @@ -[[prebuilt-rule-0-13-3-windows-defender-exclusions-added-via-powershell]] -=== Windows Defender Exclusions Added via PowerShell - -Identifies modifications to the Windows Defender configuration settings using PowerShell to add exclusions at the folder directory or process level. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.bitdefender.com/files/News/CaseStudies/study/400/Bitdefender-PR-Whitepaper-MosaicLoader-creat5540-en-EN.pdf - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Defense Evasion - -*Version*: 1 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Triage and analysis - -Detections should be investigated to identify if the activity corresponds to legitimate activity used to put in exceptions for Windows Defender. As this rule detects post-exploitation process activity, investigations into this should be prioritized ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type == "start" and - (process.name : ("powershell.exe", "pwsh.exe") or process.pe.original_file_name : ("powershell.exe", "pwsh.exe")) and - process.args : ("*Add-MpPreference*-Exclusion*", "*Set-MpPreference*-Exclusion*") - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Defense Evasion -** ID: TA0005 -** Reference URL: https://attack.mitre.org/tactics/TA0005/ -* Technique: -** Name: Impair Defenses -** ID: T1562 -** Reference URL: https://attack.mitre.org/techniques/T1562/ -* Sub-technique: -** Name: Indicator Blocking -** ID: T1562.006 -** Reference URL: https://attack.mitre.org/techniques/T1562/006/ -* Sub-technique: -** Name: Disable or Modify Tools -** ID: T1562.001 -** Reference URL: https://attack.mitre.org/techniques/T1562/001/ -* Tactic: -** Name: Execution -** ID: TA0002 -** Reference URL: https://attack.mitre.org/tactics/TA0002/ -* Technique: -** Name: Command and Scripting Interpreter -** ID: T1059 -** Reference URL: https://attack.mitre.org/techniques/T1059/ -* Sub-technique: -** Name: PowerShell -** ID: T1059.001 -** Reference URL: https://attack.mitre.org/techniques/T1059/001/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rules-0-13-3-appendix.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rules-0-13-3-appendix.asciidoc deleted file mode 100644 index 810940e940..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rules-0-13-3-appendix.asciidoc +++ /dev/null @@ -1,46 +0,0 @@ -["appendix",role="exclude",id="prebuilt-rule-0-13-3-prebuilt-rules-0-13-3-appendix"] -= Downloadable rule update v0.13.3 - -This section lists all updates associated with version 0.13.3 of the Fleet integration *Prebuilt Security Detection Rules*. - - -include::prebuilt-rule-0-13-3-o365-excessive-single-sign-on-logon-errors.asciidoc[] -include::prebuilt-rule-0-13-3-windows-defender-exclusions-added-via-powershell.asciidoc[] -include::prebuilt-rule-0-13-3-disable-windows-event-and-security-logs-using-built-in-tools.asciidoc[] -include::prebuilt-rule-0-13-3-parent-process-pid-spoofing.asciidoc[] -include::prebuilt-rule-0-13-3-web-application-suspicious-activity-post-request-declined.asciidoc[] -include::prebuilt-rule-0-13-3-web-application-suspicious-activity-unauthorized-method.asciidoc[] -include::prebuilt-rule-0-13-3-web-application-suspicious-activity-no-user-agent.asciidoc[] -include::prebuilt-rule-0-13-3-web-application-suspicious-activity-sqlmap-user-agent.asciidoc[] -include::prebuilt-rule-0-13-3-spike-in-aws-error-messages.asciidoc[] -include::prebuilt-rule-0-13-3-rare-aws-error-code.asciidoc[] -include::prebuilt-rule-0-13-3-unusual-city-for-an-aws-command.asciidoc[] -include::prebuilt-rule-0-13-3-unusual-country-for-an-aws-command.asciidoc[] -include::prebuilt-rule-0-13-3-unusual-aws-command-for-a-user.asciidoc[] -include::prebuilt-rule-0-13-3-google-workspace-mfa-enforcement-disabled.asciidoc[] -include::prebuilt-rule-0-13-3-google-workspace-password-policy-modified.asciidoc[] -include::prebuilt-rule-0-13-3-mfa-disabled-for-google-workspace-organization.asciidoc[] -include::prebuilt-rule-0-13-3-cobalt-strike-command-and-control-beacon.asciidoc[] -include::prebuilt-rule-0-13-3-default-cobalt-strike-team-server-certificate.asciidoc[] -include::prebuilt-rule-0-13-3-dns-activity-to-the-internet.asciidoc[] -include::prebuilt-rule-0-13-3-roshal-archive-rar-or-powershell-file-downloaded-from-the-internet.asciidoc[] -include::prebuilt-rule-0-13-3-possible-fin7-dga-command-and-control-behavior.asciidoc[] -include::prebuilt-rule-0-13-3-halfbaked-command-and-control-beacon.asciidoc[] -include::prebuilt-rule-0-13-3-ipsec-nat-traversal-port-activity.asciidoc[] -include::prebuilt-rule-0-13-3-smtp-on-port-26-tcp.asciidoc[] -include::prebuilt-rule-0-13-3-rdp-remote-desktop-protocol-from-the-internet.asciidoc[] -include::prebuilt-rule-0-13-3-telnet-port-activity.asciidoc[] -include::prebuilt-rule-0-13-3-vnc-virtual-network-computing-from-the-internet.asciidoc[] -include::prebuilt-rule-0-13-3-vnc-virtual-network-computing-to-the-internet.asciidoc[] -include::prebuilt-rule-0-13-3-rpc-remote-procedure-call-from-the-internet.asciidoc[] -include::prebuilt-rule-0-13-3-rpc-remote-procedure-call-to-the-internet.asciidoc[] -include::prebuilt-rule-0-13-3-smb-windows-file-sharing-activity-to-the-internet.asciidoc[] -include::prebuilt-rule-0-13-3-inbound-connection-to-an-unsecure-elasticsearch-node.asciidoc[] -include::prebuilt-rule-0-13-3-external-alerts.asciidoc[] -include::prebuilt-rule-0-13-3-mshta-making-network-connections.asciidoc[] -include::prebuilt-rule-0-13-3-unusual-child-processes-of-rundll32.asciidoc[] -include::prebuilt-rule-0-13-3-suspicious-certutil-commands.asciidoc[] -include::prebuilt-rule-0-13-3-external-ip-lookup-fron-non-browser-process.asciidoc[] -include::prebuilt-rule-0-13-3-execution-of-file-written-or-modified-by-microsoft-office.asciidoc[] -include::prebuilt-rule-0-13-3-execution-of-file-written-or-modified-by-pdf-reader.asciidoc[] -include::prebuilt-rule-0-13-3-unusual-print-spooler-child-process.asciidoc[] diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rules-0-13-3-summary.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rules-0-13-3-summary.asciidoc deleted file mode 100644 index f30b50d086..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rules-0-13-3-summary.asciidoc +++ /dev/null @@ -1,92 +0,0 @@ -[[prebuilt-rule-0-13-3-prebuilt-rules-0-13-3-summary]] -[role="xpack"] -== Update v0.13.3 - -This section lists all updates associated with version 0.13.3 of the Fleet integration *Prebuilt Security Detection Rules*. - - -[width="100%",options="header"] -|============================================== -|Rule |Description |Status |Version - -|<> | Identifies accounts with a high number of single sign-on (SSO) logon errors. Excessive logon errors may indicate an attempt to brute force a password or single sign-on token. | new | 1 - -|<> | Identifies modifications to the Windows Defender configuration settings using PowerShell to add exclusions at the folder directory or process level. | new | 1 - -|<> | Identifies attempts to disable EventLog via the logman Windows utility, PowerShell, or auditpol. This is often done by attackers in an attempt to evade detection on a system. | new | 1 - -|<> | Identifies parent process spoofing used to thwart detection. Adversaries may spoof the parent process identifier (PPID) of a new process to evade process-monitoring defenses or to elevate privileges. | new | 1 - -|<> | A POST request to web application returned a 403 response, which indicates the web application declined to process the request because the action requested was not allowed | update | 7 - -|<> | A request to web application returned a 405 response which indicates the web application declined to process the request because the HTTP method is not allowed for the resource | update | 7 - -|<> | A request to a web application server contained no identifying user agent string. | update | 7 - -|<> | This is an example of how to detect an unwanted web client user agent. This search matches the user agent for sqlmap 1.3.11, which is a popular FOSS tool for testing web applications for SQL injection vulnerabilities. | update | 7 - -|<> | A machine learning job detected a significant spike in the rate of a particular error in the CloudTrail messages. Spikes in error messages may accompany attempts at privilege escalation, lateral movement, or discovery. | update | 5 - -|<> | A machine learning job detected an unusual error in a CloudTrail message. These can be byproducts of attempted or successful persistence, privilege escalation, defense evasion, discovery, lateral movement, or collection. | update | 5 - -|<> | A machine learning job detected AWS command activity that, while not inherently suspicious or abnormal, is sourcing from a geolocation (city) that is unusual for the command. This can be the result of compromised credentials or keys being used by a threat actor in a different geography then the authorized user(s). | update | 5 - -|<> | A machine learning job detected AWS command activity that, while not inherently suspicious or abnormal, is sourcing from a geolocation (country) that is unusual for the command. This can be the result of compromised credentials or keys being used by a threat actor in a different geography then the authorized user(s). | update | 5 - -|<> | A machine learning job detected an AWS API command that, while not inherently suspicious or abnormal, is being made by a user context that does not normally use the command. This can be the result of compromised credentials or keys as someone uses a valid account to persist, move laterally, or exfil data. | update | 5 - -|<> | Detects when multi-factor authentication (MFA) enforcement is disabled for Google Workspace users. An adversary may disable MFA enforcement in order to weaken an organization’s security controls. | update | 5 - -|<> | Detects when a Google Workspace password policy is modified. An adversary may attempt to modify a password policy in order to weaken an organization’s security controls. | update | 5 - -|<> | Detects when multi-factor authentication (MFA) is disabled for a Google Workspace organization. An adversary may attempt to modify a password policy in order to weaken an organization’s security controls. | update | 5 - -|<> | Cobalt Strike is a threat emulation platform commonly modified and used by adversaries to conduct network attack and exploitation campaigns. This rule detects a network activity algorithm leveraged by Cobalt Strike implant beacons for command and control. | update | 6 - -|<> | This rule detects the use of the default Cobalt Strike Team Server TLS certificate. Cobalt Strike is software for Adversary Simulations and Red Team Operations which are security assessments that replicate the tactics and techniques of an advanced adversary in a network. Modifications to the Packetbeat configuration can be made to include MD5 and SHA256 hashing algorithms (the default is SHA1) - see the Reference section for additional information on module configuration. | update | 5 - -|<> | This rule detects when an internal network client sends DNS traffic directly to the Internet. This is atypical behavior for a managed network, and can be indicative of malware, exfiltration, command and control, or, simply, misconfiguration. This DNS activity also impacts your organization's ability to provide enterprise monitoring and logging of DNS, and opens your network to a variety of abuses and malicious communications. | update | 10 - -|<> | Detects a Roshal Archive (RAR) file or PowerShell script downloaded from the internet by an internal host. Gaining initial access to a system and then downloading encoded or encrypted tools to move laterally is a common practice for adversaries as a way to protect their more valuable tools and TTPs. This may be atypical behavior for a managed network and can be indicative of malware, exfiltration, or command and control. | update | 6 - -|<> | This rule detects a known command and control pattern in network events. The FIN7 threat group is known to use this command and control technique, while maintaining persistence in their target's network. | update | 6 - -|<> | Halfbaked is a malware family used to establish persistence in a contested network. This rule detects a network activity algorithm leveraged by Halfbaked implant beacons for command and control. | update | 6 - -|<> | This rule detects events that could be describing IPSEC NAT Traversal traffic. IPSEC is a VPN technology that allows one system to talk to another using encrypted tunnels. NAT Traversal enables these tunnels to communicate over the Internet where one of the sides is behind a NAT router gateway. This may be common on your network, but this technique is also used by threat actors to avoid detection. | update | 8 - -|<> | This rule detects events that may indicate use of SMTP on TCP port 26. This port is commonly used by several popular mail transfer agents to deconflict with the default SMTP port 25. This port has also been used by a malware family called BadPatch for command and control of Windows systems. | update | 8 - -|<> | This rule detects network events that may indicate the use of RDP traffic from the Internet. RDP is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or back-door vector. | update | 10 - -|<> | This rule detects network events that may indicate the use of Telnet traffic. Telnet is commonly used by system administrators to remotely control older or embed ed systems using the command line shell. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or back-door vector. As a plain-text protocol, it may also expose usernames and passwords to anyone capable of observing the traffic. | update | 8 - -|<> | This rule detects network events that may indicate the use of VNC traffic from the Internet. VNC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or back-door vector. | update | 10 - -|<> | This rule detects network events that may indicate the use of VNC traffic to the Internet. VNC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or back-door vector. | update | 10 - -|<> | This rule detects network events that may indicate the use of RPC traffic from the Internet. RPC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or back-door vector. | update | 10 - -|<> | This rule detects network events that may indicate the use of RPC traffic to the Internet. RPC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or back-door vector. | update | 10 - -|<> | This rule detects network events that may indicate the use of Windows file sharing (also called SMB or CIFS) traffic to the Internet. SMB is commonly used within networks to share files, printers, and other system resources amongst trusted systems. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or back-door vector or for data exfiltration. | update | 10 - -|<> | Identifies Elasticsearch nodes that do not have Transport Layer Security (TLS), and/or lack authentication, and are accepting inbound network connections over the default Elasticsearch port. | update | 5 - -|<> | Generates a detection alert for each external alert written to the configured indices. Enabling this rule allows you to immediately begin investigating external alerts in the app. | update | 4 - -|<> | Identifies Mshta.exe making outbound network connections. This may indicate adversarial activity as Mshta is often leveraged by adversaries to execute malicious scripts and evade detection. | update | 4 - -|<> | Identifies child processes of unusual instances of RunDLL32 where the command line parameters were suspicious. Misuse of RunDLL32 could indicate malicious activity. | update | 4 - -|<> | Identifies suspicious commands being used with certutil.exe. CertUtil is a native Windows component which is part of Certificate Services. CertUtil is often abused by attackers to live off the land for stealthier command and control or data exfiltration. | update | 9 - -|<> | Identifies domains commonly used by adversaries for post-exploitation IP lookups. It is common for adversaries to test for Internet access and acquire their external IP address after they have gained access to a system. Among others, this has been observed in campaigns leveraging the information stealer, Trickbot. | update | 5 - -|<> | Identifies an executable created by a Microsoft Office application and subsequently executed. These processes are often launched via scripts inside documents or during exploitation of MS Office applications. | update | 4 - -|<> | Identifies a suspicious file that was written by a PDF reader application and subsequently executed. These processes are often launched via exploitation of PDF applications. | update | 4 - -|<> | Detects unusual Print Spooler service (spoolsv.exe) child processes. This may indicate an attempt to exploit privilege escalation vulnerabilities related to the Printing Service on Windows. | update | 2 - -|============================================== diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-anomalous-kernel-module-activity.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-anomalous-kernel-module-activity.asciidoc deleted file mode 100644 index eec45a51a1..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-anomalous-kernel-module-activity.asciidoc +++ /dev/null @@ -1,52 +0,0 @@ -[[prebuilt-rule-0-14-1-anomalous-kernel-module-activity]] -=== Anomalous Kernel Module Activity - -Looks for unusual kernel module activity. Kernel modules are sometimes used by malware and persistence mechanisms for stealth. - -*Rule type*: machine_learning - -*Rule indices*: None - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 15m - -*Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Host -* Linux -* Threat Detection -* ML - -*Version*: 4 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Persistence -** ID: TA0003 -** Reference URL: https://attack.mitre.org/tactics/TA0003/ -* Technique: -** Name: Boot or Logon Autostart Execution -** ID: T1547 -** Reference URL: https://attack.mitre.org/techniques/T1547/ -* Sub-technique: -** Name: Kernel Modules and Extensions -** ID: T1547.006 -** Reference URL: https://attack.mitre.org/techniques/T1547/006/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-anomalous-linux-compiler-activity.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-anomalous-linux-compiler-activity.asciidoc deleted file mode 100644 index 97b3e70514..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-anomalous-linux-compiler-activity.asciidoc +++ /dev/null @@ -1,37 +0,0 @@ -[[prebuilt-rule-0-14-1-anomalous-linux-compiler-activity]] -=== Anomalous Linux Compiler Activity - -Looks for compiler activity by a user context which does not normally run compilers. This can be the result of ad-hoc software changes or unauthorized software deployment. This can also be due to local privilege elevation via locally run exploits or malware activity. - -*Rule type*: machine_learning - -*Rule indices*: None - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 15m - -*Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Host -* Linux -* Threat Detection -* ML - -*Version*: 3 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-anomalous-process-for-a-linux-population.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-anomalous-process-for-a-linux-population.asciidoc deleted file mode 100644 index 4f7da7f827..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-anomalous-process-for-a-linux-population.asciidoc +++ /dev/null @@ -1,53 +0,0 @@ -[[prebuilt-rule-0-14-1-anomalous-process-for-a-linux-population]] -=== Anomalous Process For a Linux Population - -Searches for rare processes running on multiple Linux hosts in an entire fleet or network. This reduces the detection of false positives since automated maintenance processes usually only run occasionally on a single machine but are common to all or many hosts in a fleet. - -*Rule type*: machine_learning - -*Rule indices*: None - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 15m - -*Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html - -*Tags*: - -* Elastic -* Host -* Linux -* Threat Detection -* ML - -*Version*: 7 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Triage and analysis - -### Investigating an Unusual Linux Process -Detection alerts from this rule indicate the presence of a Linux process that is rare and unusual for all of the monitored Linux hosts for which Auditbeat data is available. Here are some possible avenues of investigation: -- Consider the user as identified by the username field. Is this program part of an expected workflow for the user who ran this program on this host? -- Examine the history of execution. If this process only manifested recently, it might be part of a new software package. If it has a consistent cadence (for example if it runs monthly or quarterly), it might be part of a monthly or quarterly business process. -- Examine the process arguments, title and working directory. These may provide indications as to the source of the program or the nature of the tasks it is performing. ----------------------------------- diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-anomalous-process-for-a-windows-population.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-anomalous-process-for-a-windows-population.asciidoc deleted file mode 100644 index 94b04934c7..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-anomalous-process-for-a-windows-population.asciidoc +++ /dev/null @@ -1,56 +0,0 @@ -[[prebuilt-rule-0-14-1-anomalous-process-for-a-windows-population]] -=== Anomalous Process For a Windows Population - -Searches for rare processes running on multiple hosts in an entire fleet or network. This reduces the detection of false positives since automated maintenance processes usually only run occasionally on a single machine but are common to all or many hosts in a fleet. - -*Rule type*: machine_learning - -*Rule indices*: None - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 15m - -*Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* ML - -*Version*: 7 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Triage and analysis - -### Investigating an Unusual Windows Process -Detection alerts from this rule indicate the presence of a Windows process that is rare and unusual for all of the Windows hosts for which Winlogbeat data is available. Here are some possible avenues of investigation: -- Consider the user as identified by the username field. Is this program part of an expected workflow for the user who ran this program on this host? -- Examine the history of execution. If this process only manifested recently, it might be part of a new software package. If it has a consistent cadence (for example if it runs monthly or quarterly), it might be part of a monthly or quarterly business process. -- Examine the process metadata like the values of the Company, Description and Product fields which may indicate whether the program is associated with an expected software vendor or package. -- Examine arguments and working directory. These may provide indications as to the source of the program or the nature of the tasks it is performing. -- Consider the same for the parent process. If the parent process is a legitimate system utility or service, this could be related to software updates or system management. If the parent process is something user-facing like an Office application, this process could be more suspicious. -- If you have file hash values in the event data, and you suspect malware, you can optionally run a search for the file hash to see if the file is identified as malware by anti-malware tools. ----------------------------------- diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-application-added-to-google-workspace-domain.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-application-added-to-google-workspace-domain.asciidoc deleted file mode 100644 index 9813e3ddf0..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-application-added-to-google-workspace-domain.asciidoc +++ /dev/null @@ -1,71 +0,0 @@ -[[prebuilt-rule-0-14-1-application-added-to-google-workspace-domain]] -=== Application Added to Google Workspace Domain - -Detects when a Google marketplace application is added to the Google Workspace domain. An adversary may add a malicious application to an organization’s Google Workspace domain in order to maintain a presence in their target’s organization and steal data. - -*Rule type*: query - -*Rule indices*: - -* filebeat-* -* logs-google_workspace* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 10m - -*Searches indices from*: now-130m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://support.google.com/a/answer/6328701?hl=en# - -*Tags*: - -* Elastic -* Cloud -* Google Workspace -* Continuous Monitoring -* SecOps -* Configuration Audit - -*Version*: 5 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown, subs="attributes"] ----------------------------------- -## Config - -The Google Workspace Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. - -### Important Information Regarding Google Workspace Event Lag Times -- As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs. -- This rule is configured to run every 10 minutes with a lookback time of 130 minutes. -- To reduce the risk of false negatives, consider reducing the interval that the Google Workspace (formerly G Suite) Filebeat module polls Google's reporting API for new events. -- By default, `var.interval` is set to 2 hours (2h). Consider changing this interval to a lower value, such as 10 minutes (10m). -- See the following references for further information: - - https://support.google.com/a/answer/7061566 - - https://www.elastic.co/guide/en/beats/filebeat/{branch}/filebeat-module-google_workspace.html ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -event.dataset:(gsuite.admin or google_workspace.admin) and event.provider:admin and event.category:iam and event.action:ADD_APPLICATION - ----------------------------------- diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-aws-ec2-full-network-packet-capture-detected.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-aws-ec2-full-network-packet-capture-detected.asciidoc deleted file mode 100644 index 6439148434..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-aws-ec2-full-network-packet-capture-detected.asciidoc +++ /dev/null @@ -1,85 +0,0 @@ -[[prebuilt-rule-0-14-1-aws-ec2-full-network-packet-capture-detected]] -=== AWS EC2 Full Network Packet Capture Detected - -Identifies potential Traffic Mirroring in an Amazon Elastic Compute Cloud (EC2) instance. Traffic Mirroring is an Amazon VPC feature that you can use to copy network traffic from an Elastic network interface. This feature can potentially be abused to exfiltrate sensitive data from unencrypted internal traffic. - -*Rule type*: query - -*Rule indices*: - -* filebeat-* -* logs-aws* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 10m - -*Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_TrafficMirrorFilter.html -* https://github.com/easttimor/aws-incident-response - -*Tags*: - -* Elastic -* Cloud -* AWS -* Continuous Monitoring -* SecOps -* Network Security - -*Version*: 2 - -*Rule authors*: - -* Elastic -* Austin Songer - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Config - -The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -event.dataset:aws.cloudtrail and event.provider:ec2.amazonaws.com and -event.action:(CreateTrafficMirrorFilter or CreateTrafficMirrorFilterRule or CreateTrafficMirrorSession or CreateTrafficMirrorTarget) and -event.outcome:success - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Exfiltration -** ID: TA0010 -** Reference URL: https://attack.mitre.org/tactics/TA0010/ -* Technique: -** Name: Automated Exfiltration -** ID: T1020 -** Reference URL: https://attack.mitre.org/techniques/T1020/ -* Tactic: -** Name: Collection -** ID: TA0009 -** Reference URL: https://attack.mitre.org/tactics/TA0009/ -* Technique: -** Name: Data Staged -** ID: T1074 -** Reference URL: https://attack.mitre.org/techniques/T1074/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-aws-rds-security-group-creation.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-aws-rds-security-group-creation.asciidoc deleted file mode 100644 index f09ff23026..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-aws-rds-security-group-creation.asciidoc +++ /dev/null @@ -1,78 +0,0 @@ -[[prebuilt-rule-0-14-1-aws-rds-security-group-creation]] -=== AWS RDS Security Group Creation - -Identifies the creation of an Amazon Relational Database Service (RDS) Security group. - -*Rule type*: query - -*Rule indices*: - -* filebeat-* -* logs-aws* - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 10m - -*Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateDBSecurityGroup.html - -*Tags*: - -* Elastic -* Cloud -* AWS -* Continuous Monitoring -* SecOps -* Monitoring - -*Version*: 2 - -*Rule authors*: - -* Elastic -* Austin Songer - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Config - -The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -event.dataset:aws.cloudtrail and event.provider:rds.amazonaws.com and event.action:CreateDBSecurityGroup and event.outcome:success - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Persistence -** ID: TA0003 -** Reference URL: https://attack.mitre.org/tactics/TA0003/ -* Technique: -** Name: Create Account -** ID: T1136 -** Reference URL: https://attack.mitre.org/techniques/T1136/ -* Sub-technique: -** Name: Cloud Account -** ID: T1136.003 -** Reference URL: https://attack.mitre.org/techniques/T1136/003/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-aws-rds-security-group-deletion.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-aws-rds-security-group-deletion.asciidoc deleted file mode 100644 index c9ff0d4cf0..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-aws-rds-security-group-deletion.asciidoc +++ /dev/null @@ -1,74 +0,0 @@ -[[prebuilt-rule-0-14-1-aws-rds-security-group-deletion]] -=== AWS RDS Security Group Deletion - -Identifies the deletion of an Amazon Relational Database Service (RDS) Security group. - -*Rule type*: query - -*Rule indices*: - -* filebeat-* -* logs-aws* - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 10m - -*Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DeleteDBSecurityGroup.html - -*Tags*: - -* Elastic -* Cloud -* AWS -* Continuous Monitoring -* SecOps -* Monitoring - -*Version*: 2 - -*Rule authors*: - -* Elastic -* Austin Songer - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Config - -The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -event.dataset:aws.cloudtrail and event.provider:rds.amazonaws.com and event.action:DeleteDBSecurityGroup and event.outcome:success - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Impact -** ID: TA0040 -** Reference URL: https://attack.mitre.org/tactics/TA0040/ -* Technique: -** Name: Account Access Removal -** ID: T1531 -** Reference URL: https://attack.mitre.org/techniques/T1531/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-aws-security-group-configuration-change-detection.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-aws-security-group-configuration-change-detection.asciidoc deleted file mode 100644 index c46c22f2c4..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-aws-security-group-configuration-change-detection.asciidoc +++ /dev/null @@ -1,76 +0,0 @@ -[[prebuilt-rule-0-14-1-aws-security-group-configuration-change-detection]] -=== AWS Security Group Configuration Change Detection - -Identifies a change to an AWS Security Group Configuration. A security group is like a virtul firewall and modifying configurations may allow unauthorized access. Threat actors may abuse this to establish persistence, exfiltrate data, or pivot in a AWS environment. - -*Rule type*: query - -*Rule indices*: - -* filebeat-* -* logs-aws* - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 10m - -*Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/ec2-security-groups.html - -*Tags*: - -* Elastic -* Cloud -* AWS -* Continuous Monitoring -* SecOps -* Network Security - -*Version*: 1 - -*Rule authors*: - -* Elastic -* Austin Songer - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Config - -The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -event.dataset:aws.cloudtrail and event.provider:iam.amazonaws.com and event.action:(AuthorizeSecurityGroupEgress or -CreateSecurityGroup or ModifyInstanceAttribute or ModifySecurityGroupRules or RevokeSecurityGroupEgress or -RevokeSecurityGroupIngress) and event.outcome:success - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Persistence -** ID: TA0003 -** Reference URL: https://attack.mitre.org/tactics/TA0003/ -* Tactic: -** Name: Defense Evasion -** ID: TA0005 -** Reference URL: https://attack.mitre.org/tactics/TA0005/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-azure-active-directory-high-risk-sign-in.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-azure-active-directory-high-risk-sign-in.asciidoc deleted file mode 100644 index 2b258bf65d..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-azure-active-directory-high-risk-sign-in.asciidoc +++ /dev/null @@ -1,78 +0,0 @@ -[[prebuilt-rule-0-14-1-azure-active-directory-high-risk-sign-in]] -=== Azure Active Directory High Risk Sign-in - -Identifies high risk Azure Active Directory (AD) sign-ins by leveraging Microsoft's Identity Protection machine learning and heuristics. Identity Protection categorizes risk into three tiers: low, medium, and high. While Microsoft does not provide specific details about how risk is calculated, each level brings higher confidence that the user or sign-in is compromised. - -*Rule type*: query - -*Rule indices*: - -* filebeat-* -* logs-azure* - -*Severity*: high - -*Risk score*: 73 - -*Runs every*: 5m - -*Searches indices from*: now-25m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-risk -* https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection -* https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-investigate-risk - -*Tags*: - -* Elastic -* Cloud -* Azure -* Continuous Monitoring -* SecOps -* Identity and Access - -*Version*: 3 - -*Rule authors*: - -* Elastic -* Willem D'Haese - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Config - -The Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -event.dataset:azure.signinlogs and - (azure.signinlogs.properties.risk_level_during_signin:high or azure.signinlogs.properties.risk_level_aggregated:high) and - event.outcome:(success or Success) - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Initial Access -** ID: TA0001 -** Reference URL: https://attack.mitre.org/tactics/TA0001/ -* Technique: -** Name: Valid Accounts -** ID: T1078 -** Reference URL: https://attack.mitre.org/techniques/T1078/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-bash-shell-profile-modification.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-bash-shell-profile-modification.asciidoc deleted file mode 100644 index 51d78690fe..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-bash-shell-profile-modification.asciidoc +++ /dev/null @@ -1,90 +0,0 @@ -[[prebuilt-rule-0-14-1-bash-shell-profile-modification]] -=== Bash Shell Profile Modification - -Both ~/.bash_profile and ~/.bashrc are files containing shell commands that are run when Bash is invoked. These files are executed in a user's context, either interactively or non-interactively, when a user logs in so that their environment is set correctly. Adversaries may abuse this to establish persistence by executing malicious content triggered by a user’s shell. - -*Rule type*: query - -*Rule indices*: - -* logs-endpoint.events.* -* auditbeat-* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.anomali.com/blog/pulling-linux-rabbit-rabbot-malware-out-of-a-hat - -*Tags*: - -* Elastic -* Host -* macOS -* Linux -* Threat Detection -* Persistence - -*Version*: 2 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -event.category:file and event.type:change and - process.name:(* and not (sudo or - vim or - zsh or - env or - nano or - bash or - Terminal or - xpcproxy or - login or - cat or - cp or - launchctl or - java)) and - not process.executable:(/Applications/* or /private/var/folders/* or /usr/local/*) and - file.path:(/private/etc/rc.local or - /etc/rc.local or - /home/*/.profile or - /home/*/.profile1 or - /home/*/.bash_profile or - /home/*/.bash_profile1 or - /home/*/.bashrc or - /Users/*/.bash_profile or - /Users/*/.zshenv) - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Persistence -** ID: TA0003 -** Reference URL: https://attack.mitre.org/tactics/TA0003/ -* Technique: -** Name: Event Triggered Execution -** ID: T1546 -** Reference URL: https://attack.mitre.org/techniques/T1546/ -* Sub-technique: -** Name: Unix Shell Configuration Modification -** ID: T1546.004 -** Reference URL: https://attack.mitre.org/techniques/T1546/004/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-bypass-uac-via-event-viewer.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-bypass-uac-via-event-viewer.asciidoc deleted file mode 100644 index ef745ff4dc..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-bypass-uac-via-event-viewer.asciidoc +++ /dev/null @@ -1,71 +0,0 @@ -[[prebuilt-rule-0-14-1-bypass-uac-via-event-viewer]] -=== Bypass UAC via Event Viewer - -Identifies User Account Control (UAC) bypass via eventvwr.exe. Attackers bypass UAC to stealthily execute code with elevated permissions. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: high - -*Risk score*: 73 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Privilege Escalation - -*Version*: 9 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type in ("start", "process_started") and - process.parent.name : "eventvwr.exe" and - not process.executable : - ("?:\\Windows\\SysWOW64\\mmc.exe", - "?:\\Windows\\System32\\mmc.exe", - "?:\\Windows\\SysWOW64\\WerFault.exe", - "?:\\Windows\\System32\\WerFault.exe") - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Privilege Escalation -** ID: TA0004 -** Reference URL: https://attack.mitre.org/tactics/TA0004/ -* Technique: -** Name: Abuse Elevation Control Mechanism -** ID: T1548 -** Reference URL: https://attack.mitre.org/techniques/T1548/ -* Sub-technique: -** Name: Bypass User Account Control -** ID: T1548.002 -** Reference URL: https://attack.mitre.org/techniques/T1548/002/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-default-cobalt-strike-team-server-certificate.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-default-cobalt-strike-team-server-certificate.asciidoc deleted file mode 100644 index 667245a995..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-default-cobalt-strike-team-server-certificate.asciidoc +++ /dev/null @@ -1,85 +0,0 @@ -[[prebuilt-rule-0-14-1-default-cobalt-strike-team-server-certificate]] -=== Default Cobalt Strike Team Server Certificate - -This rule detects the use of the default Cobalt Strike Team Server TLS certificate. Cobalt Strike is software for Adversary Simulations and Red Team Operations which are security assessments that replicate the tactics and techniques of an advanced adversary in a network. Modifications to the Packetbeat configuration can be made to include MD5 and SHA256 hashing algorithms (the default is SHA1). See the References section for additional information on module configuration. - -*Rule type*: query - -*Rule indices*: - -* auditbeat-* -* filebeat-* -* packetbeat-* -* logs-endpoint.events.* - -*Severity*: critical - -*Risk score*: 99 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://attack.mitre.org/software/S0154/ -* https://www.cobaltstrike.com/help-setup-collaboration -* https://www.elastic.co/guide/en/beats/packetbeat/current/configuration-tls.html -* https://www.elastic.co/guide/en/beats/filebeat/7.9/filebeat-module-suricata.html -* https://www.elastic.co/guide/en/beats/filebeat/7.9/filebeat-module-zeek.html - -*Tags*: - -* Command and Control -* Post-Execution -* Threat Detection -* Elastic -* Network -* Host - -*Version*: 6 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Threat intel - -While Cobalt Strike is intended to be used for penetration tests and IR training, it is frequently used by actual threat actors (TA) such as APT19, APT29, APT32, APT41, FIN6, DarkHydrus, CopyKittens, Cobalt Group, Leviathan, and many other unnamed criminal TAs. This rule uses high-confidence atomic indicators, so alerts should be investigated rapidly. ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -event.category:(network or network_traffic) and (tls.server.hash.md5:950098276A495286EB2A2556FBAB6D83 or - tls.server.hash.sha1:6ECE5ECE4192683D2D84E25B0BA7E04F9CB7EB7C or - tls.server.hash.sha256:87F2085C32B6A2CC709B365F55873E207A9CAA10BFFECF2FD16D3CF9D94D390C) - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Command and Control -** ID: TA0011 -** Reference URL: https://attack.mitre.org/tactics/TA0011/ -* Technique: -** Name: Application Layer Protocol -** ID: T1071 -** Reference URL: https://attack.mitre.org/techniques/T1071/ -* Sub-technique: -** Name: Web Protocols -** ID: T1071.001 -** Reference URL: https://attack.mitre.org/techniques/T1071/001/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-disabling-user-account-control-via-registry-modification.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-disabling-user-account-control-via-registry-modification.asciidoc deleted file mode 100644 index 6f2019cae7..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-disabling-user-account-control-via-registry-modification.asciidoc +++ /dev/null @@ -1,88 +0,0 @@ -[[prebuilt-rule-0-14-1-disabling-user-account-control-via-registry-modification]] -=== Disabling User Account Control via Registry Modification - -User Account Control (UAC) can help mitigate the impact of malware on Windows hosts. With UAC, apps and tasks always run in the security context of a non-administrator account, unless an administrator specifically authorizes administrator-level access to the system. This rule identifies registry value changes to bypass User Access Control (UAC) protection. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.greyhathacker.net/?p=796 -* https://docs.microsoft.com/en-us/windows/security/identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings -* https://docs.microsoft.com/en-us/windows/security/identity-protection/user-account-control/user-account-control-overview - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Privilege Escalation - -*Version*: 2 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -registry where event.type == "change" and - registry.path : - ( - "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA", - "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\ConsentPromptBehaviorAdmin", - "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\PromptOnSecureDesktop" - ) and - registry.data.strings : "0" - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Privilege Escalation -** ID: TA0004 -** Reference URL: https://attack.mitre.org/tactics/TA0004/ -* Technique: -** Name: Abuse Elevation Control Mechanism -** ID: T1548 -** Reference URL: https://attack.mitre.org/techniques/T1548/ -* Sub-technique: -** Name: Bypass User Account Control -** ID: T1548.002 -** Reference URL: https://attack.mitre.org/techniques/T1548/002/ -* Tactic: -** Name: Defense Evasion -** ID: TA0005 -** Reference URL: https://attack.mitre.org/tactics/TA0005/ -* Technique: -** Name: Abuse Elevation Control Mechanism -** ID: T1548 -** Reference URL: https://attack.mitre.org/techniques/T1548/ -* Sub-technique: -** Name: Bypass User Account Control -** ID: T1548.002 -** Reference URL: https://attack.mitre.org/techniques/T1548/002/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-dns-activity-to-the-internet.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-dns-activity-to-the-internet.asciidoc deleted file mode 100644 index ecaca1da8c..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-dns-activity-to-the-internet.asciidoc +++ /dev/null @@ -1,95 +0,0 @@ -[[prebuilt-rule-0-14-1-dns-activity-to-the-internet]] -=== DNS Activity to the Internet - -This rule detects when an internal network client sends DNS traffic directly to the Internet. This is atypical behavior for a managed network and can be indicative of malware, exfiltration, command and control, or simply misconfiguration. This DNS activity also impacts your organization's ability to provide enterprise monitoring and logging of DNS and it opens your network to a variety of abuses and malicious communications. - -*Rule type*: query - -*Rule indices*: - -* auditbeat-* -* filebeat-* -* packetbeat-* -* logs-endpoint.events.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.us-cert.gov/ncas/alerts/TA15-240A -* https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-81-2.pdf -* https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml - -*Tags*: - -* Elastic -* Network -* Threat Detection -* Command and Control -* Host - -*Version*: 11 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -event.category:(network or network_traffic) and (event.type:connection or type:dns) and (destination.port:53 or event.dataset:zeek.dns) - and source.ip:( - 10.0.0.0/8 or - 172.16.0.0/12 or - 192.168.0.0/16 - ) and - not destination.ip:( - 10.0.0.0/8 or - 127.0.0.0/8 or - 169.254.0.0/16 or - 172.16.0.0/12 or - 192.0.0.0/24 or - 192.0.0.0/29 or - 192.0.0.8/32 or - 192.0.0.9/32 or - 192.0.0.10/32 or - 192.0.0.170/32 or - 192.0.0.171/32 or - 192.0.2.0/24 or - 192.31.196.0/24 or - 192.52.193.0/24 or - 192.168.0.0/16 or - 192.88.99.0/24 or - 224.0.0.0/4 or - 100.64.0.0/10 or - 192.175.48.0/24 or - 198.18.0.0/15 or - 198.51.100.0/24 or - 203.0.113.0/24 or - 240.0.0.0/4 or - "::1" or - "FE80::/10" or - "FF00::/8" - ) - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Command and Control -** ID: TA0011 -** Reference URL: https://attack.mitre.org/tactics/TA0011/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-domain-added-to-google-workspace-trusted-domains.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-domain-added-to-google-workspace-trusted-domains.asciidoc deleted file mode 100644 index 027bdc0a5c..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-domain-added-to-google-workspace-trusted-domains.asciidoc +++ /dev/null @@ -1,71 +0,0 @@ -[[prebuilt-rule-0-14-1-domain-added-to-google-workspace-trusted-domains]] -=== Domain Added to Google Workspace Trusted Domains - -Detects when a domain is added to the list of trusted Google Workspace domains. An adversary may add a trusted domain in order to collect and exfiltrate data from their target’s organization with less restrictive security controls. - -*Rule type*: query - -*Rule indices*: - -* filebeat-* -* logs-google_workspace* - -*Severity*: high - -*Risk score*: 73 - -*Runs every*: 10m - -*Searches indices from*: now-130m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://support.google.com/a/answer/6160020?hl=en - -*Tags*: - -* Elastic -* Cloud -* Google Workspace -* Continuous Monitoring -* SecOps -* Configuration Audit - -*Version*: 5 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown, subs="attributes"] ----------------------------------- -## Config - -The Google Workspace Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. - -### Important Information Regarding Google Workspace Event Lag Times -- As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs. -- This rule is configured to run every 10 minutes with a lookback time of 130 minutes. -- To reduce the risk of false negatives, consider reducing the interval that the Google Workspace (formerly G Suite) Filebeat module polls Google's reporting API for new events. -- By default, `var.interval` is set to 2 hours (2h). Consider changing this interval to a lower value, such as 10 minutes (10m). -- See the following references for further information: - - https://support.google.com/a/answer/7061566 - - https://www.elastic.co/guide/en/beats/filebeat/{branch}/filebeat-module-google_workspace.html ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -event.dataset:(gsuite.admin or google_workspace.admin) and event.provider:admin and event.category:iam and event.action:ADD_TRUSTED_DOMAINS - ----------------------------------- diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-execution-of-file-written-or-modified-by-microsoft-office.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-execution-of-file-written-or-modified-by-microsoft-office.asciidoc deleted file mode 100644 index 3407e83185..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-execution-of-file-written-or-modified-by-microsoft-office.asciidoc +++ /dev/null @@ -1,84 +0,0 @@ -[[prebuilt-rule-0-14-1-execution-of-file-written-or-modified-by-microsoft-office]] -=== Execution of File Written or Modified by Microsoft Office - -Identifies an executable created by a Microsoft Office application and subsequently executed. These processes are often launched via scripts inside documents or during exploitation of Microsoft Office applications. - -*Rule type*: eql - -*Rule indices*: - -* logs-endpoint.events.* -* winlogbeat-* -* logs-windows.* - -*Severity*: high - -*Risk score*: 21 - -*Runs every*: 60m - -*Searches indices from*: now-120m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Execution - -*Version*: 5 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -sequence with maxspan=2h - [file where event.type != "deletion" and file.extension : "exe" and - (process.name : "WINWORD.EXE" or - process.name : "EXCEL.EXE" or - process.name : "OUTLOOK.EXE" or - process.name : "POWERPNT.EXE" or - process.name : "eqnedt32.exe" or - process.name : "fltldr.exe" or - process.name : "MSPUB.EXE" or - process.name : "MSACCESS.EXE") - ] by host.id, file.path - [process where event.type in ("start", "process_started")] by host.id, process.executable - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Execution -** ID: TA0002 -** Reference URL: https://attack.mitre.org/tactics/TA0002/ -* Tactic: -** Name: Initial Access -** ID: TA0001 -** Reference URL: https://attack.mitre.org/tactics/TA0001/ -* Technique: -** Name: Phishing -** ID: T1566 -** Reference URL: https://attack.mitre.org/techniques/T1566/ -* Sub-technique: -** Name: Spearphishing Attachment -** ID: T1566.001 -** Reference URL: https://attack.mitre.org/techniques/T1566/001/ -* Sub-technique: -** Name: Spearphishing Link -** ID: T1566.002 -** Reference URL: https://attack.mitre.org/techniques/T1566/002/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-exporting-exchange-mailbox-via-powershell.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-exporting-exchange-mailbox-via-powershell.asciidoc deleted file mode 100644 index 25a1b20883..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-exporting-exchange-mailbox-via-powershell.asciidoc +++ /dev/null @@ -1,69 +0,0 @@ -[[prebuilt-rule-0-14-1-exporting-exchange-mailbox-via-powershell]] -=== Exporting Exchange Mailbox via PowerShell - -Identifies the use of the Exchange PowerShell cmdlet, New-MailBoxExportRequest, to export the contents of a primary mailbox or archive to a .pst file. Adversaries may target user email to collect sensitive information. - -*Rule type*: eql - -*Rule indices*: - -* logs-endpoint.events.* -* winlogbeat-* -* logs-windows.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/ -* https://docs.microsoft.com/en-us/powershell/module/exchange/new-mailboxexportrequest?view=exchange-ps - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Collection - -*Version*: 4 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type in ("start", "process_started") and - process.name: ("powershell.exe", "pwsh.exe") and process.args : "New-MailboxExportRequest*" - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Collection -** ID: TA0009 -** Reference URL: https://attack.mitre.org/tactics/TA0009/ -* Technique: -** Name: Email Collection -** ID: T1114 -** Reference URL: https://attack.mitre.org/techniques/T1114/ -* Technique: -** Name: Data from Local System -** ID: T1005 -** Reference URL: https://attack.mitre.org/techniques/T1005/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-external-ip-lookup-from-non-browser-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-external-ip-lookup-from-non-browser-process.asciidoc deleted file mode 100644 index b9f13e0e45..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-external-ip-lookup-from-non-browser-process.asciidoc +++ /dev/null @@ -1,103 +0,0 @@ -[[prebuilt-rule-0-14-1-external-ip-lookup-from-non-browser-process]] -=== External IP Lookup from Non-Browser Process - -Identifies domains commonly used by adversaries for post-exploitation IP lookups. It is common for adversaries to test for Internet access and acquire their external IP address after they have gained access to a system. Among others, this has been observed in campaigns leveraging the information stealer, Trickbot. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://community.jisc.ac.uk/blogs/csirt/article/trickbot-analysis-and-mitigation -* https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Discovery - -*Version*: 6 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -network where network.protocol == "dns" and - process.name != null and user.id not in ("S-1-5-19", "S-1-5-20") and - event.action == "lookup_requested" and - /* Add new external IP lookup services here */ - dns.question.name : - ( - "*api.ipify.org", - "*freegeoip.app", - "*checkip.amazonaws.com", - "*checkip.dyndns.org", - "*freegeoip.app", - "*icanhazip.com", - "*ifconfig.*", - "*ipecho.net", - "*ipgeoapi.com", - "*ipinfo.io", - "*ip.anysrc.net", - "*myexternalip.com", - "*myipaddress.com", - "*showipaddress.com", - "*whatismyipaddress.com", - "*wtfismyip.com", - "*ipapi.co", - "*ip-lookup.net", - "*ipstack.com" - ) and - /* Insert noisy false positives here */ - not process.executable : - ( - "?:\\Program Files\\*.exe", - "?:\\Program Files (x86)\\*.exe", - "?:\\Windows\\System32\\WWAHost.exe", - "?:\\Windows\\System32\\smartscreen.exe", - "?:\\Windows\\System32\\MicrosoftEdgeCP.exe", - "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe", - "?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe", - "?:\\Users\\*\\AppData\\Local\\Programs\\Fiddler\\Fiddler.exe", - "?:\\Users\\*\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe", - "?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe" - ) - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Discovery -** ID: TA0007 -** Reference URL: https://attack.mitre.org/tactics/TA0007/ -* Technique: -** Name: System Network Configuration Discovery -** ID: T1016 -** Reference URL: https://attack.mitre.org/techniques/T1016/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-finder-sync-plugin-registered-and-enabled.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-finder-sync-plugin-registered-and-enabled.asciidoc deleted file mode 100644 index 163085b650..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-finder-sync-plugin-registered-and-enabled.asciidoc +++ /dev/null @@ -1,76 +0,0 @@ -[[prebuilt-rule-0-14-1-finder-sync-plugin-registered-and-enabled]] -=== Finder Sync Plugin Registered and Enabled - -Finder Sync plugins enable users to extend Finder’s functionality by modifying the user interface. Adversaries may abuse this feature by adding a rogue Finder Plugin to repeatedly execute malicious payloads for persistence. - -*Rule type*: eql - -*Rule indices*: - -* auditbeat-* -* logs-endpoint.events.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://github.com/specterops/presentations/raw/master/Leo%20Pitt/Hey_Im_Still_in_Here_Modern_macOS_Persistence_SO-CON2020.pdf - -*Tags*: - -* Elastic -* Host -* macOS -* Threat Detection -* Persistence - -*Version*: 2 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -sequence by host.id, user.id with maxspan = 5s - [process where event.type in ("start", "process_started") and process.name : "pluginkit" and process.args : "-a"] - [process where event.type in ("start", "process_started") and process.name : "pluginkit" and - process.args : "-e" and process.args : "use" and process.args : "-i" and - not process.args : - ( - "com.google.GoogleDrive.FinderSyncAPIExtension", - "com.google.drivefs.findersync", - "com.boxcryptor.osx.Rednif", - "com.adobe.accmac.ACCFinderSync", - "com.microsoft.OneDrive.FinderSync", - "com.insynchq.Insync.Insync-Finder-Integration", - "com.box.desktop.findersyncext" - ) - ] - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Persistence -** ID: TA0003 -** Reference URL: https://attack.mitre.org/tactics/TA0003/ -* Technique: -** Name: Create or Modify System Process -** ID: T1543 -** Reference URL: https://attack.mitre.org/techniques/T1543/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-google-workspace-admin-role-assigned-to-a-user.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-google-workspace-admin-role-assigned-to-a-user.asciidoc deleted file mode 100644 index 7c2385d36e..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-google-workspace-admin-role-assigned-to-a-user.asciidoc +++ /dev/null @@ -1,82 +0,0 @@ -[[prebuilt-rule-0-14-1-google-workspace-admin-role-assigned-to-a-user]] -=== Google Workspace Admin Role Assigned to a User - -Detects when an admin role is assigned to a Google Workspace user. An adversary may assign an admin role to a user in order to elevate the permissions of another user account and persist in their target’s environment. - -*Rule type*: query - -*Rule indices*: - -* filebeat-* -* logs-google_workspace* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 10m - -*Searches indices from*: now-130m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://support.google.com/a/answer/172176?hl=en - -*Tags*: - -* Elastic -* Cloud -* Google Workspace -* Continuous Monitoring -* SecOps -* Identity and Access - -*Version*: 5 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown, subs="attributes"] ----------------------------------- -## Config - -The Google Workspace Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. - -### Important Information Regarding Google Workspace Event Lag Times -- As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs. -- This rule is configured to run every 10 minutes with a lookback time of 130 minutes. -- To reduce the risk of false negatives, consider reducing the interval that the Google Workspace (formerly G Suite) Filebeat module polls Google's reporting API for new events. -- By default, `var.interval` is set to 2 hours (2h). Consider changing this interval to a lower value, such as 10 minutes (10m). -- See the following references for further information: - - https://support.google.com/a/answer/7061566 - - https://www.elastic.co/guide/en/beats/filebeat/{branch}/filebeat-module-google_workspace.html ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -event.dataset:(gsuite.admin or google_workspace.admin) and event.provider:admin and event.category:iam and event.action:ASSIGN_ROLE - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Persistence -** ID: TA0003 -** Reference URL: https://attack.mitre.org/tactics/TA0003/ -* Technique: -** Name: Account Manipulation -** ID: T1098 -** Reference URL: https://attack.mitre.org/techniques/T1098/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-google-workspace-admin-role-deletion.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-google-workspace-admin-role-deletion.asciidoc deleted file mode 100644 index 26d2f1a43e..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-google-workspace-admin-role-deletion.asciidoc +++ /dev/null @@ -1,71 +0,0 @@ -[[prebuilt-rule-0-14-1-google-workspace-admin-role-deletion]] -=== Google Workspace Admin Role Deletion - -Detects when a custom admin role is deleted. An adversary may delete a custom admin role in order to impact the permissions or capabilities of system administrators. - -*Rule type*: query - -*Rule indices*: - -* filebeat-* -* logs-google_workspace* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 10m - -*Searches indices from*: now-130m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://support.google.com/a/answer/2406043?hl=en - -*Tags*: - -* Elastic -* Cloud -* Google Workspace -* Continuous Monitoring -* SecOps -* Identity and Access - -*Version*: 5 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown, subs="attributes"] ----------------------------------- -## Config - -The Google Workspace Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. - -### Important Information Regarding Google Workspace Event Lag Times -- As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs. -- This rule is configured to run every 10 minutes with a lookback time of 130 minutes. -- To reduce the risk of false negatives, consider reducing the interval that the Google Workspace (formerly G Suite) Filebeat module polls Google's reporting API for new events. -- By default, `var.interval` is set to 2 hours (2h). Consider changing this interval to a lower value, such as 10 minutes (10m). -- See the following references for further information: - - https://support.google.com/a/answer/7061566 - - https://www.elastic.co/guide/en/beats/filebeat/{branch}/filebeat-module-google_workspace.html ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -event.dataset:(gsuite.admin or google_workspace.admin) and event.provider:admin and event.category:iam and event.action:DELETE_ROLE - ----------------------------------- diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-google-workspace-api-access-granted-via-domain-wide-delegation-of-authority.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-google-workspace-api-access-granted-via-domain-wide-delegation-of-authority.asciidoc deleted file mode 100644 index ae43d5c0f5..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-google-workspace-api-access-granted-via-domain-wide-delegation-of-authority.asciidoc +++ /dev/null @@ -1,82 +0,0 @@ -[[prebuilt-rule-0-14-1-google-workspace-api-access-granted-via-domain-wide-delegation-of-authority]] -=== Google Workspace API Access Granted via Domain-Wide Delegation of Authority - -Detects when a domain-wide delegation of authority is granted to a service account. Domain-wide delegation can be configured to grant third-party and internal applications to access the data of Google Workspace users. An adversary may configure domain-wide delegation to maintain access to their target’s data. - -*Rule type*: query - -*Rule indices*: - -* filebeat-* -* logs-google_workspace* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 10m - -*Searches indices from*: now-130m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://developers.google.com/admin-sdk/directory/v1/guides/delegation - -*Tags*: - -* Elastic -* Cloud -* Google Workspace -* Continuous Monitoring -* SecOps -* Identity and Access - -*Version*: 5 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown, subs="attributes"] ----------------------------------- -## Config - -The Google Workspace Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. - -### Important Information Regarding Google Workspace Event Lag Times -- As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs. -- This rule is configured to run every 10 minutes with a lookback time of 130 minutes. -- To reduce the risk of false negatives, consider reducing the interval that the Google Workspace (formerly G Suite) Filebeat module polls Google's reporting API for new events. -- By default, `var.interval` is set to 2 hours (2h). Consider changing this interval to a lower value, such as 10 minutes (10m). -- See the following references for further information: - - https://support.google.com/a/answer/7061566 - - https://www.elastic.co/guide/en/beats/filebeat/{branch}/filebeat-module-google_workspace.html ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -event.dataset:(gsuite.admin or google_workspace.admin) and event.provider:admin and event.category:iam and event.action:AUTHORIZE_API_CLIENT_ACCESS - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Persistence -** ID: TA0003 -** Reference URL: https://attack.mitre.org/tactics/TA0003/ -* Technique: -** Name: Account Manipulation -** ID: T1098 -** Reference URL: https://attack.mitre.org/techniques/T1098/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-google-workspace-custom-admin-role-created.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-google-workspace-custom-admin-role-created.asciidoc deleted file mode 100644 index fad40e72f5..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-google-workspace-custom-admin-role-created.asciidoc +++ /dev/null @@ -1,82 +0,0 @@ -[[prebuilt-rule-0-14-1-google-workspace-custom-admin-role-created]] -=== Google Workspace Custom Admin Role Created - -Detects when a custom admin role is created in Google Workspace. An adversary may create a custom admin role in order to elevate the permissions of other user accounts and persist in their target’s environment. - -*Rule type*: query - -*Rule indices*: - -* filebeat-* -* logs-google_workspace* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 10m - -*Searches indices from*: now-130m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://support.google.com/a/answer/2406043?hl=en - -*Tags*: - -* Elastic -* Cloud -* Google Workspace -* Continuous Monitoring -* SecOps -* Identity and Access - -*Version*: 5 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown, subs="attributes"] ----------------------------------- -## Config - -The Google Workspace Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. - -### Important Information Regarding Google Workspace Event Lag Times -- As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs. -- This rule is configured to run every 10 minutes with a lookback time of 130 minutes. -- To reduce the risk of false negatives, consider reducing the interval that the Google Workspace (formerly G Suite) Filebeat module polls Google's reporting API for new events. -- By default, `var.interval` is set to 2 hours (2h). Consider changing this interval to a lower value, such as 10 minutes (10m). -- See the following references for further information: - - https://support.google.com/a/answer/7061566 - - https://www.elastic.co/guide/en/beats/filebeat/{branch}/filebeat-module-google_workspace.html ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -event.dataset:(gsuite.admin or google_workspace.admin) and event.provider:admin and event.category:iam and event.action:CREATE_ROLE - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Persistence -** ID: TA0003 -** Reference URL: https://attack.mitre.org/tactics/TA0003/ -* Technique: -** Name: Account Manipulation -** ID: T1098 -** Reference URL: https://attack.mitre.org/techniques/T1098/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-google-workspace-mfa-enforcement-disabled.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-google-workspace-mfa-enforcement-disabled.asciidoc deleted file mode 100644 index 0490ff1bda..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-google-workspace-mfa-enforcement-disabled.asciidoc +++ /dev/null @@ -1,71 +0,0 @@ -[[prebuilt-rule-0-14-1-google-workspace-mfa-enforcement-disabled]] -=== Google Workspace MFA Enforcement Disabled - -Detects when multi-factor authentication (MFA) enforcement is disabled for Google Workspace users. An adversary may disable MFA enforcement in order to weaken an organization’s security controls. - -*Rule type*: query - -*Rule indices*: - -* filebeat-* -* logs-google_workspace* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 10m - -*Searches indices from*: now-130m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://support.google.com/a/answer/9176657?hl=en# - -*Tags*: - -* Elastic -* Cloud -* Google Workspace -* Continuous Monitoring -* SecOps -* Configuration Audit - -*Version*: 6 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown, subs="attributes"] ----------------------------------- -## Config - -The Google Workspace Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. - -### Important Information Regarding Google Workspace Event Lag Times -- As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs. -- This rule is configured to run every 10 minutes with a lookback time of 130 minutes. -- To reduce the risk of false negatives, consider reducing the interval that the Google Workspace (formerly G Suite) Filebeat module polls Google's reporting API for new events. -- By default, `var.interval` is set to 2 hours (2h). Consider changing this interval to a lower value, such as 10 minutes (10m). -- See the following references for further information: - - https://support.google.com/a/answer/7061566 - - https://www.elastic.co/guide/en/beats/filebeat/{branch}/filebeat-module-google_workspace.html ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -event.dataset:(gsuite.admin or google_workspace.admin) and event.provider:admin and event.category:iam and event.action:ENFORCE_STRONG_AUTHENTICATION and (gsuite.admin.new_value:false or google_workspace.admin.new_value:false) - ----------------------------------- diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-google-workspace-password-policy-modified.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-google-workspace-password-policy-modified.asciidoc deleted file mode 100644 index ab2455a0b7..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-google-workspace-password-policy-modified.asciidoc +++ /dev/null @@ -1,87 +0,0 @@ -[[prebuilt-rule-0-14-1-google-workspace-password-policy-modified]] -=== Google Workspace Password Policy Modified - -Detects when a Google Workspace password policy is modified. An adversary may attempt to modify a password policy in order to weaken an organization’s security controls. - -*Rule type*: query - -*Rule indices*: - -* filebeat-* -* logs-google_workspace* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 10m - -*Searches indices from*: now-130m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Cloud -* Google Workspace -* Continuous Monitoring -* SecOps -* Identity and Access - -*Version*: 6 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown, subs="attributes"] ----------------------------------- -## Config - -The Google Workspace Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. - -### Important Information Regarding Google Workspace Event Lag Times -- As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs. -- This rule is configured to run every 10 minutes with a lookback time of 130 minutes. -- To reduce the risk of false negatives, consider reducing the interval that the Google Workspace (formerly G Suite) Filebeat module polls Google's reporting API for new events. -- By default, `var.interval` is set to 2 hours (2h). Consider changing this interval to a lower value, such as 10 minutes (10m). -- See the following references for further information: - - https://support.google.com/a/answer/7061566 - - https://www.elastic.co/guide/en/beats/filebeat/{branch}/filebeat-module-google_workspace.html ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -event.dataset:(gsuite.admin or google_workspace.admin) and - event.provider:admin and event.category:iam and - event.action:(CHANGE_APPLICATION_SETTING or CREATE_APPLICATION_SETTING) and - gsuite.admin.setting.name:( - "Password Management - Enforce strong password" or - "Password Management - Password reset frequency" or - "Password Management - Enable password reuse" or - "Password Management - Enforce password policy at next login" or - "Password Management - Minimum password length" or - "Password Management - Maximum password length" - ) or - google_workspace.admin.setting.name:( - "Password Management - Enforce strong password" or - "Password Management - Password reset frequency" or - "Password Management - Enable password reuse" or - "Password Management - Enforce password policy at next login" or - "Password Management - Minimum password length" or - "Password Management - Maximum password length" - ) - ----------------------------------- diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-google-workspace-role-modified.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-google-workspace-role-modified.asciidoc deleted file mode 100644 index d175dd11b7..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-google-workspace-role-modified.asciidoc +++ /dev/null @@ -1,82 +0,0 @@ -[[prebuilt-rule-0-14-1-google-workspace-role-modified]] -=== Google Workspace Role Modified - -Detects when a custom admin role or its permissions are modified. An adversary may modify a custom admin role in order to elevate the permissions of other user accounts and persist in their target’s environment. - -*Rule type*: query - -*Rule indices*: - -* filebeat-* -* logs-google_workspace* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 10m - -*Searches indices from*: now-130m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://support.google.com/a/answer/2406043?hl=en - -*Tags*: - -* Elastic -* Cloud -* Google Workspace -* Continuous Monitoring -* SecOps -* Identity and Access - -*Version*: 5 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown, subs="attributes"] ----------------------------------- -## Config - -The Google Workspace Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. - -### Important Information Regarding Google Workspace Event Lag Times -- As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs. -- This rule is configured to run every 10 minutes with a lookback time of 130 minutes. -- To reduce the risk of false negatives, consider reducing the interval that the Google Workspace (formerly G Suite) Filebeat module polls Google's reporting API for new events. -- By default, `var.interval` is set to 2 hours (2h). Consider changing this interval to a lower value, such as 10 minutes (10m). -- See the following references for further information: - - https://support.google.com/a/answer/7061566 - - https://www.elastic.co/guide/en/beats/filebeat/{branch}/filebeat-module-google_workspace.html ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -event.dataset:(gsuite.admin or google_workspace.admin) and event.provider:admin and event.category:iam and event.action:(ADD_PRIVILEGE or UPDATE_ROLE) - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Persistence -** ID: TA0003 -** Reference URL: https://attack.mitre.org/tactics/TA0003/ -* Technique: -** Name: Account Manipulation -** ID: T1098 -** Reference URL: https://attack.mitre.org/techniques/T1098/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-macos-installer-spawns-network-event.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-macos-installer-spawns-network-event.asciidoc deleted file mode 100644 index 4855e72d45..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-macos-installer-spawns-network-event.asciidoc +++ /dev/null @@ -1,85 +0,0 @@ -[[prebuilt-rule-0-14-1-macos-installer-spawns-network-event]] -=== macOS Installer Spawns Network Event - -Identifies when the built in macOS Installer program generates a network event after attempting to install a .pkg file. This activity has been observed being leveraged by malware. - -*Rule type*: eql - -*Rule indices*: - -* logs-endpoint.events.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://redcanary.com/blog/clipping-silver-sparrows-wings -* https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml - -*Tags*: - -* Elastic -* Host -* macOS -* Threat Detection -* Execution - -*Version*: 3 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -sequence by process.entity_id with maxspan=1m - [process where event.type == "start" and host.os.family == "macos" and - process.parent.executable in ("/usr/sbin/installer", "/System/Library/CoreServices/Installer.app/Contents/MacOS/Installer") ] - [network where not cidrmatch(destination.ip, - "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32", - "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24", "192.31.196.0/24", - "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10", "192.175.48.0/24", - "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1", "FE80::/10", "FF00::/8")] - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Execution -** ID: TA0002 -** Reference URL: https://attack.mitre.org/tactics/TA0002/ -* Technique: -** Name: Command and Scripting Interpreter -** ID: T1059 -** Reference URL: https://attack.mitre.org/techniques/T1059/ -* Sub-technique: -** Name: JavaScript -** ID: T1059.007 -** Reference URL: https://attack.mitre.org/techniques/T1059/007/ -* Tactic: -** Name: Command and Control -** ID: TA0011 -** Reference URL: https://attack.mitre.org/tactics/TA0011/ -* Technique: -** Name: Application Layer Protocol -** ID: T1071 -** Reference URL: https://attack.mitre.org/techniques/T1071/ -* Sub-technique: -** Name: Web Protocols -** ID: T1071.001 -** Reference URL: https://attack.mitre.org/techniques/T1071/001/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-mfa-disabled-for-google-workspace-organization.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-mfa-disabled-for-google-workspace-organization.asciidoc deleted file mode 100644 index 02b960b2c1..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-mfa-disabled-for-google-workspace-organization.asciidoc +++ /dev/null @@ -1,69 +0,0 @@ -[[prebuilt-rule-0-14-1-mfa-disabled-for-google-workspace-organization]] -=== MFA Disabled for Google Workspace Organization - -Detects when multi-factor authentication (MFA) is disabled for a Google Workspace organization. An adversary may attempt to modify a password policy in order to weaken an organization’s security controls. - -*Rule type*: query - -*Rule indices*: - -* filebeat-* -* logs-google_workspace* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 10m - -*Searches indices from*: now-130m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Cloud -* Google Workspace -* Continuous Monitoring -* SecOps -* Identity and Access - -*Version*: 6 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown, subs="attributes"] ----------------------------------- -## Config - -The Google Workspace Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. - -### Important Information Regarding Google Workspace Event Lag Times -- As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs. -- This rule is configured to run every 10 minutes with a lookback time of 130 minutes. -- To reduce the risk of false negatives, consider reducing the interval that the Google Workspace (formerly G Suite) Filebeat module polls Google's reporting API for new events. -- By default, `var.interval` is set to 2 hours (2h). Consider changing this interval to a lower value, such as 10 minutes (10m). -- See the following references for further information: - - https://support.google.com/a/answer/7061566 - - https://www.elastic.co/guide/en/beats/filebeat/{branch}/filebeat-module-google_workspace.html ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -event.dataset:(gsuite.admin or google_workspace.admin) and event.provider:admin and event.category:iam and event.action:(ENFORCE_STRONG_AUTHENTICATION or ALLOW_STRONG_AUTHENTICATION) and (gsuite.admin.new_value:false or google_workspace.admin.new_value:false) - ----------------------------------- diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-modification-of-amsienable-registry-key.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-modification-of-amsienable-registry-key.asciidoc deleted file mode 100644 index fa20adbda6..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-modification-of-amsienable-registry-key.asciidoc +++ /dev/null @@ -1,70 +0,0 @@ -[[prebuilt-rule-0-14-1-modification-of-amsienable-registry-key]] -=== Modification of AmsiEnable Registry Key - -JScript tries to query the AmsiEnable registry key from the HKEY_USERS registry hive before initializing Antimalware Scan Interface (AMSI). If this key is set to 0, AMSI is not enabled for the JScript process. An adversary can modify this key to disable AMSI protections. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: high - -*Risk score*: 73 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://hackinparis.com/data/slides/2019/talks/HIP2019-Dominic_Chell-Cracking_The_Perimeter_With_Sharpshooter.pdf -* https://docs.microsoft.com/en-us/windows/win32/amsi/antimalware-scan-interface-portal - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Defense Evasion - -*Version*: 2 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -registry where event.type in ("creation", "change") and - registry.path: "HKEY_USERS\\*\\Software\\Microsoft\\Windows Script\\Settings\\AmsiEnable" and - registry.data.strings: "0" - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Defense Evasion -** ID: TA0005 -** Reference URL: https://attack.mitre.org/tactics/TA0005/ -* Technique: -** Name: Impair Defenses -** ID: T1562 -** Reference URL: https://attack.mitre.org/techniques/T1562/ -* Sub-technique: -** Name: Disable or Modify Tools -** ID: T1562.001 -** Reference URL: https://attack.mitre.org/techniques/T1562/001/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-modification-of-dynamic-linker-preload-shared-object.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-modification-of-dynamic-linker-preload-shared-object.asciidoc deleted file mode 100644 index 7e3bfd96e6..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-modification-of-dynamic-linker-preload-shared-object.asciidoc +++ /dev/null @@ -1,66 +0,0 @@ -[[prebuilt-rule-0-14-1-modification-of-dynamic-linker-preload-shared-object]] -=== Modification of Dynamic Linker Preload Shared Object - -Identifies modification of the dynamic linker preload shared object (ld.so.preload). Adversaries may execute malicious payloads by hijacking the dynamic linker used to load libraries. - -*Rule type*: query - -*Rule indices*: - -* auditbeat-* -* logs-endpoint.events.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang - -*Tags*: - -* Elastic -* Host -* Linux -* Threat Detection -* Privilege Escalation - -*Version*: 2 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -event.category:file and not event.type:deletion and file.path:/etc/ld.so.preload - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Privilege Escalation -** ID: TA0004 -** Reference URL: https://attack.mitre.org/tactics/TA0004/ -* Technique: -** Name: Hijack Execution Flow -** ID: T1574 -** Reference URL: https://attack.mitre.org/techniques/T1574/ -* Sub-technique: -** Name: Dynamic Linker Hijacking -** ID: T1574.006 -** Reference URL: https://attack.mitre.org/techniques/T1574/006/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-mshta-making-network-connections.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-mshta-making-network-connections.asciidoc deleted file mode 100644 index 6d10503ed8..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-mshta-making-network-connections.asciidoc +++ /dev/null @@ -1,71 +0,0 @@ -[[prebuilt-rule-0-14-1-mshta-making-network-connections]] -=== Mshta Making Network Connections - -Identifies Mshta.exe making outbound network connections. This may indicate adversarial activity, as Mshta is often leveraged by adversaries to execute malicious scripts and evade detection. - -*Rule type*: eql - -*Rule indices*: - -* logs-endpoint.events.* -* winlogbeat-* -* logs-windows.* - -*Severity*: medium - -*Risk score*: 21 - -*Runs every*: 5m - -*Searches indices from*: now-20m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Defense Evasion - -*Version*: 5 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -sequence by process.entity_id with maxspan=10m - [process where event.type in ("start", "process_started") and process.name : "mshta.exe" and - not process.parent.name : "Microsoft.ConfigurationManagement.exe" and - not (process.parent.executable : "C:\\Amazon\\Amazon Assistant\\amazonAssistantService.exe" or - process.parent.executable : "C:\\TeamViewer\\TeamViewer.exe") and - not process.args : "ADSelfService_Enroll.hta"] - [network where process.name : "mshta.exe"] - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Defense Evasion -** ID: TA0005 -** Reference URL: https://attack.mitre.org/tactics/TA0005/ -* Technique: -** Name: Signed Binary Proxy Execution -** ID: T1218 -** Reference URL: https://attack.mitre.org/techniques/T1218/ -* Sub-technique: -** Name: Mshta -** ID: T1218.005 -** Reference URL: https://attack.mitre.org/techniques/T1218/005/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-new-activesyncalloweddeviceid-added-via-powershell.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-new-activesyncalloweddeviceid-added-via-powershell.asciidoc deleted file mode 100644 index bc1e3842a0..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-new-activesyncalloweddeviceid-added-via-powershell.asciidoc +++ /dev/null @@ -1,69 +0,0 @@ -[[prebuilt-rule-0-14-1-new-activesyncalloweddeviceid-added-via-powershell]] -=== New ActiveSyncAllowedDeviceID Added via PowerShell - -Identifies the use of the Exchange PowerShell cmdlet, Set-CASMailbox, to add a new ActiveSync allowed device. Adversaries may target user email to collect sensitive information. - -*Rule type*: eql - -*Rule indices*: - -* logs-endpoint.events.* -* winlogbeat-* -* logs-windows.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/ -* https://docs.microsoft.com/en-us/powershell/module/exchange/set-casmailbox?view=exchange-ps - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Collection - -*Version*: 4 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type in ("start", "process_started") and - process.name: ("powershell.exe", "pwsh.exe") and process.args : "Set-CASMailbox*ActiveSyncAllowedDeviceIDs*" - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Collection -** ID: TA0009 -** Reference URL: https://attack.mitre.org/tactics/TA0009/ -* Technique: -** Name: Email Collection -** ID: T1114 -** Reference URL: https://attack.mitre.org/techniques/T1114/ -* Technique: -** Name: Data from Local System -** ID: T1005 -** Reference URL: https://attack.mitre.org/techniques/T1005/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-ntds-or-sam-database-file-copied.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-ntds-or-sam-database-file-copied.asciidoc deleted file mode 100644 index 652ebdf0a0..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-ntds-or-sam-database-file-copied.asciidoc +++ /dev/null @@ -1,72 +0,0 @@ -[[prebuilt-rule-0-14-1-ntds-or-sam-database-file-copied]] -=== NTDS or SAM Database File Copied - -Identifies a copy operation of the Active Directory Domain Database (ntds.dit) or Security Account Manager (SAM) files. Those files contain sensitive information including hashed domain and/or local credentials. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: high - -*Risk score*: 73 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 33 - -*References*: - -* https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/ -* https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-3---esentutlexe-sam-copy - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Credential Access - -*Version*: 4 - -*Rule authors*: - -* Elastic -* Austin Songer - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type in ("start", "process_started") and - ( - (process.pe.original_file_name in ("Cmd.Exe", "PowerShell.EXE", "XCOPY.EXE") and - process.args : ("copy", "xcopy", "Copy-Item", "move", "cp", "mv") - ) or - (process.pe.original_file_name : "esentutl.exe" and process.args : ("*/y*", "*/vss*", "*/d*")) - ) and - process.args : ("*\\ntds.dit", "*\\config\\SAM", "\\*\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy*\\*", "*/system32/config/SAM*") - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Credential Access -** ID: TA0006 -** Reference URL: https://attack.mitre.org/tactics/TA0006/ -* Technique: -** Name: OS Credential Dumping -** ID: T1003 -** Reference URL: https://attack.mitre.org/techniques/T1003/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-o365-excessive-single-sign-on-logon-errors.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-o365-excessive-single-sign-on-logon-errors.asciidoc deleted file mode 100644 index 0d5291a1d0..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-o365-excessive-single-sign-on-logon-errors.asciidoc +++ /dev/null @@ -1,72 +0,0 @@ -[[prebuilt-rule-0-14-1-o365-excessive-single-sign-on-logon-errors]] -=== O365 Excessive Single Sign-On Logon Errors - -Identifies accounts with a high number of single sign-on (SSO) logon errors. Excessive logon errors may indicate an attempt to brute force a password or SSO token. - -*Rule type*: threshold - -*Rule indices*: - -* filebeat-* -* logs-o365* - -*Severity*: high - -*Risk score*: 73 - -*Runs every*: 5m - -*Searches indices from*: now-20m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Cloud -* Microsoft 365 -* Continuous Monitoring -* SecOps -* Identity and Access - -*Version*: 2 - -*Rule authors*: - -* Elastic -* Austin Songer - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Config - -The Microsoft 365 Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -event.dataset:o365.audit and event.provider:AzureActiveDirectory and event.category:web and o365.audit.LogonError:"SsoArtifactInvalidOrExpired" - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Credential Access -** ID: TA0006 -** Reference URL: https://attack.mitre.org/tactics/TA0006/ -* Technique: -** Name: Brute Force -** ID: T1110 -** Reference URL: https://attack.mitre.org/techniques/T1110/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-persistence-via-docker-shortcut-modification.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-persistence-via-docker-shortcut-modification.asciidoc deleted file mode 100644 index 109a742cd8..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-persistence-via-docker-shortcut-modification.asciidoc +++ /dev/null @@ -1,64 +0,0 @@ -[[prebuilt-rule-0-14-1-persistence-via-docker-shortcut-modification]] -=== Persistence via Docker Shortcut Modification - -An adversary can establish persistence by modifying an existing macOS dock property list in order to execute a malicious application instead of the intended one when invoked. - -*Rule type*: query - -*Rule indices*: - -* auditbeat-* -* logs-endpoint.events.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://github.com/specterops/presentations/raw/master/Leo%20Pitt/Hey_Im_Still_in_Here_Modern_macOS_Persistence_SO-CON2020.pdf - -*Tags*: - -* Elastic -* Host -* macOS -* Threat Detection -* Persistence - -*Version*: 2 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -event.category : file and event.action : modification and - file.path : /Users/*/Library/Preferences/com.apple.dock.plist and - not process.name : (xpcproxy or cfprefsd or plutil or jamf or PlistBuddy or InstallerRemotePluginService) - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Persistence -** ID: TA0003 -** Reference URL: https://attack.mitre.org/tactics/TA0003/ -* Technique: -** Name: Create or Modify System Process -** ID: T1543 -** Reference URL: https://attack.mitre.org/techniques/T1543/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-potential-privacy-control-bypass-via-tccdb-modification.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-potential-privacy-control-bypass-via-tccdb-modification.asciidoc deleted file mode 100644 index 18a5a8717b..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-potential-privacy-control-bypass-via-tccdb-modification.asciidoc +++ /dev/null @@ -1,69 +0,0 @@ -[[prebuilt-rule-0-14-1-potential-privacy-control-bypass-via-tccdb-modification]] -=== Potential Privacy Control Bypass via TCCDB Modification - -Identifies the use of sqlite3 to directly modify the Transparency, Consent, and Control (TCC) SQLite database. This may indicate an attempt to bypass macOS privacy controls, including access to sensitive resources like the system camera, microphone, address book, and calendar. - -*Rule type*: eql - -*Rule indices*: - -* auditbeat-* -* logs-endpoint.events.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://applehelpwriter.com/2016/08/29/discovering-how-dropbox-hacks-your-mac/ -* https://github.com/bp88/JSS-Scripts/blob/master/TCC.db%20Modifier.sh -* https://medium.com/@mattshockl/cve-2020-9934-bypassing-the-os-x-transparency-consent-and-control-tcc-framework-for-4e14806f1de8 - -*Tags*: - -* Elastic -* Host -* macOS -* Threat Detection -* Defense Evasion - -*Version*: 2 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type in ("start", "process_started") and process.name : "sqlite*" and - process.args : "/*/Application Support/com.apple.TCC/TCC.db" - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Defense Evasion -** ID: TA0005 -** Reference URL: https://attack.mitre.org/tactics/TA0005/ -* Technique: -** Name: Impair Defenses -** ID: T1562 -** Reference URL: https://attack.mitre.org/techniques/T1562/ -* Sub-technique: -** Name: Disable or Modify Tools -** ID: T1562.001 -** Reference URL: https://attack.mitre.org/techniques/T1562/001/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-rare-aws-error-code.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-rare-aws-error-code.asciidoc deleted file mode 100644 index 092c98610e..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-rare-aws-error-code.asciidoc +++ /dev/null @@ -1,57 +0,0 @@ -[[prebuilt-rule-0-14-1-rare-aws-error-code]] -=== Rare AWS Error Code - -A machine learning job detected an unusual error in a CloudTrail message. These can be byproducts of attempted or successful persistence, privilege escalation, defense evasion, discovery, lateral movement, or collection. - -*Rule type*: machine_learning - -*Rule indices*: None - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 15m - -*Searches indices from*: now-2h ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html - -*Tags*: - -* Elastic -* Cloud -* AWS -* ML - -*Version*: 6 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Config - -The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. - -## Triage and analysis - -Investigating Unusual CloudTrail Error Activity ### -Detection alerts from this rule indicate a rare and unusual error code that was associated with the response to an AWS API command or method call. Here are some possible avenues of investigation: -- Examine the history of the error. Has it manifested before? If the error, which is visible in the `aws.cloudtrail.error_code field`, only manifested recently, it might be related to recent changes in an automation module or script. -- Examine the request parameters. These may provide indications as to the nature of the task being performed when the error occurred. Is the error related to unsuccessful attempts to enumerate or access objects, data, or secrets? If so, this can sometimes be a byproduct of discovery, privilege escalation, or lateral movement attempts. -- Consider the user as identified by the `user.name` field. Is this activity part of an expected workflow for the user context? Examine the user identity in the `aws.cloudtrail.user_identity.arn` field and the access key id in the `aws.cloudtrail.user_identity.access_key_id` field, which can help identify the precise user context. The user agent details in the `user_agent.original` field may also indicate what kind of a client made the request. -- Consider the source IP address and geolocation for the calling user who issued the command. Do they look normal for the calling user? If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts, or could it be sourcing from an EC2 instance not under your control? If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles? Are there any other alerts or signs of suspicious activity involving this instance? ----------------------------------- diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-rdp-remote-desktop-protocol-from-the-internet.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-rdp-remote-desktop-protocol-from-the-internet.asciidoc deleted file mode 100644 index a78e7dc7b9..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-rdp-remote-desktop-protocol-from-the-internet.asciidoc +++ /dev/null @@ -1,110 +0,0 @@ -[[prebuilt-rule-0-14-1-rdp-remote-desktop-protocol-from-the-internet]] -=== RDP (Remote Desktop Protocol) from the Internet - -This rule detects network events that may indicate the use of RDP traffic from the Internet. RDP is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector. - -*Rule type*: query - -*Rule indices*: - -* auditbeat-* -* filebeat-* -* packetbeat-* -* logs-endpoint.events.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml - -*Tags*: - -* Elastic -* Host -* Network -* Threat Detection -* Command and Control -* Host - -*Version*: 11 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -event.category:(network or network_traffic) and network.transport:tcp and (destination.port:3389 or event.dataset:zeek.rdp) and - not source.ip:( - 10.0.0.0/8 or - 127.0.0.0/8 or - 169.254.0.0/16 or - 172.16.0.0/12 or - 192.0.0.0/24 or - 192.0.0.0/29 or - 192.0.0.8/32 or - 192.0.0.9/32 or - 192.0.0.10/32 or - 192.0.0.170/32 or - 192.0.0.171/32 or - 192.0.2.0/24 or - 192.31.196.0/24 or - 192.52.193.0/24 or - 192.168.0.0/16 or - 192.88.99.0/24 or - 224.0.0.0/4 or - 100.64.0.0/10 or - 192.175.48.0/24 or - 198.18.0.0/15 or - 198.51.100.0/24 or - 203.0.113.0/24 or - 240.0.0.0/4 or - "::1" or - "FE80::/10" or - "FF00::/8" - ) and - destination.ip:( - 10.0.0.0/8 or - 172.16.0.0/12 or - 192.168.0.0/16 - ) - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Command and Control -** ID: TA0011 -** Reference URL: https://attack.mitre.org/tactics/TA0011/ -* Tactic: -** Name: Lateral Movement -** ID: TA0008 -** Reference URL: https://attack.mitre.org/tactics/TA0008/ -* Technique: -** Name: Remote Services -** ID: T1021 -** Reference URL: https://attack.mitre.org/techniques/T1021/ -* Tactic: -** Name: Initial Access -** ID: TA0001 -** Reference URL: https://attack.mitre.org/tactics/TA0001/ -* Technique: -** Name: Exploit Public-Facing Application -** ID: T1190 -** Reference URL: https://attack.mitre.org/techniques/T1190/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-roshal-archive-rar-or-powershell-file-downloaded-from-the-internet.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-roshal-archive-rar-or-powershell-file-downloaded-from-the-internet.asciidoc deleted file mode 100644 index 1bb2e71b07..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-roshal-archive-rar-or-powershell-file-downloaded-from-the-internet.asciidoc +++ /dev/null @@ -1,110 +0,0 @@ -[[prebuilt-rule-0-14-1-roshal-archive-rar-or-powershell-file-downloaded-from-the-internet]] -=== Roshal Archive (RAR) or PowerShell File Downloaded from the Internet - -Detects a Roshal Archive (RAR) file or PowerShell script downloaded from the internet by an internal host. Gaining initial access to a system and then downloading encoded or encrypted tools to move laterally is a common practice for adversaries as a way to protect their more valuable tools and TTPs (tactics, techniques, and procedures). This may be atypical behavior for a managed network and can be indicative of malware, exfiltration, or command and control. - -*Rule type*: query - -*Rule indices*: - -* auditbeat-* -* filebeat-* -* packetbeat-* -* logs-endpoint.events.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html -* https://www.justice.gov/opa/press-release/file/1084361/download -* https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml - -*Tags*: - -* Elastic -* Network -* Threat Detection -* Command and Control -* Host - -*Version*: 7 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Threat intel - -This activity has been observed in FIN7 campaigns. ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -event.category:(network or network_traffic) and network.protocol:http and - (url.extension:(ps1 or rar) or url.path:(*.ps1 or *.rar)) and - not destination.ip:( - 10.0.0.0/8 or - 127.0.0.0/8 or - 169.254.0.0/16 or - 172.16.0.0/12 or - 192.0.0.0/24 or - 192.0.0.0/29 or - 192.0.0.8/32 or - 192.0.0.9/32 or - 192.0.0.10/32 or - 192.0.0.170/32 or - 192.0.0.171/32 or - 192.0.2.0/24 or - 192.31.196.0/24 or - 192.52.193.0/24 or - 192.168.0.0/16 or - 192.88.99.0/24 or - 224.0.0.0/4 or - 100.64.0.0/10 or - 192.175.48.0/24 or - 198.18.0.0/15 or - 198.51.100.0/24 or - 203.0.113.0/24 or - 240.0.0.0/4 or - "::1" or - "FE80::/10" or - "FF00::/8" - ) and - source.ip:( - 10.0.0.0/8 or - 172.16.0.0/12 or - 192.168.0.0/16 - ) - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Command and Control -** ID: TA0011 -** Reference URL: https://attack.mitre.org/tactics/TA0011/ -* Technique: -** Name: Ingress Tool Transfer -** ID: T1105 -** Reference URL: https://attack.mitre.org/techniques/T1105/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-rpc-remote-procedure-call-from-the-internet.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-rpc-remote-procedure-call-from-the-internet.asciidoc deleted file mode 100644 index dfe753e73e..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-rpc-remote-procedure-call-from-the-internet.asciidoc +++ /dev/null @@ -1,98 +0,0 @@ -[[prebuilt-rule-0-14-1-rpc-remote-procedure-call-from-the-internet]] -=== RPC (Remote Procedure Call) from the Internet - -This rule detects network events that may indicate the use of RPC traffic from the Internet. RPC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector. - -*Rule type*: query - -*Rule indices*: - -* auditbeat-* -* filebeat-* -* packetbeat-* -* logs-endpoint.events.* - -*Severity*: high - -*Risk score*: 73 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml - -*Tags*: - -* Elastic -* Host -* Network -* Threat Detection -* Initial Access -* Host - -*Version*: 11 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -event.category:(network or network_traffic) and network.transport:tcp and (destination.port:135 or event.dataset:zeek.dce_rpc) and - not source.ip:( - 10.0.0.0/8 or - 127.0.0.0/8 or - 169.254.0.0/16 or - 172.16.0.0/12 or - 192.0.0.0/24 or - 192.0.0.0/29 or - 192.0.0.8/32 or - 192.0.0.9/32 or - 192.0.0.10/32 or - 192.0.0.170/32 or - 192.0.0.171/32 or - 192.0.2.0/24 or - 192.31.196.0/24 or - 192.52.193.0/24 or - 192.168.0.0/16 or - 192.88.99.0/24 or - 224.0.0.0/4 or - 100.64.0.0/10 or - 192.175.48.0/24 or - 198.18.0.0/15 or - 198.51.100.0/24 or - 203.0.113.0/24 or - 240.0.0.0/4 or - "::1" or - "FE80::/10" or - "FF00::/8" - ) and - destination.ip:( - 10.0.0.0/8 or - 172.16.0.0/12 or - 192.168.0.0/16 - ) - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Initial Access -** ID: TA0001 -** Reference URL: https://attack.mitre.org/tactics/TA0001/ -* Technique: -** Name: Exploit Public-Facing Application -** ID: T1190 -** Reference URL: https://attack.mitre.org/techniques/T1190/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-rpc-remote-procedure-call-to-the-internet.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-rpc-remote-procedure-call-to-the-internet.asciidoc deleted file mode 100644 index b4dd0c3283..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-rpc-remote-procedure-call-to-the-internet.asciidoc +++ /dev/null @@ -1,98 +0,0 @@ -[[prebuilt-rule-0-14-1-rpc-remote-procedure-call-to-the-internet]] -=== RPC (Remote Procedure Call) to the Internet - -This rule detects network events that may indicate the use of RPC traffic to the Internet. RPC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector. - -*Rule type*: query - -*Rule indices*: - -* auditbeat-* -* filebeat-* -* packetbeat-* -* logs-endpoint.events.* - -*Severity*: high - -*Risk score*: 73 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml - -*Tags*: - -* Elastic -* Host -* Network -* Threat Detection -* Initial Access -* Host - -*Version*: 11 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -event.category:(network or network_traffic) and network.transport:tcp and (destination.port:135 or event.dataset:zeek.dce_rpc) and - source.ip:( - 10.0.0.0/8 or - 172.16.0.0/12 or - 192.168.0.0/16 - ) and - not destination.ip:( - 10.0.0.0/8 or - 127.0.0.0/8 or - 169.254.0.0/16 or - 172.16.0.0/12 or - 192.0.0.0/24 or - 192.0.0.0/29 or - 192.0.0.8/32 or - 192.0.0.9/32 or - 192.0.0.10/32 or - 192.0.0.170/32 or - 192.0.0.171/32 or - 192.0.2.0/24 or - 192.31.196.0/24 or - 192.52.193.0/24 or - 192.168.0.0/16 or - 192.88.99.0/24 or - 224.0.0.0/4 or - 100.64.0.0/10 or - 192.175.48.0/24 or - 198.18.0.0/15 or - 198.51.100.0/24 or - 203.0.113.0/24 or - 240.0.0.0/4 or - "::1" or - "FE80::/10" or - "FF00::/8" - ) - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Initial Access -** ID: TA0001 -** Reference URL: https://attack.mitre.org/tactics/TA0001/ -* Technique: -** Name: Exploit Public-Facing Application -** ID: T1190 -** Reference URL: https://attack.mitre.org/techniques/T1190/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-smb-windows-file-sharing-activity-to-the-internet.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-smb-windows-file-sharing-activity-to-the-internet.asciidoc deleted file mode 100644 index 3d7a280007..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-smb-windows-file-sharing-activity-to-the-internet.asciidoc +++ /dev/null @@ -1,106 +0,0 @@ -[[prebuilt-rule-0-14-1-smb-windows-file-sharing-activity-to-the-internet]] -=== SMB (Windows File Sharing) Activity to the Internet - -This rule detects network events that may indicate the use of Windows file sharing (also called SMB or CIFS) traffic to the Internet. SMB is commonly used within networks to share files, printers, and other system resources amongst trusted systems. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector or for data exfiltration. - -*Rule type*: query - -*Rule indices*: - -* auditbeat-* -* filebeat-* -* packetbeat-* -* logs-endpoint.events.* - -*Severity*: high - -*Risk score*: 73 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml - -*Tags*: - -* Elastic -* Host -* Network -* Threat Detection -* Initial Access -* Host - -*Version*: 11 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -event.category:(network or network_traffic) and network.transport:tcp and (destination.port:(139 or 445) or event.dataset:zeek.smb) and - source.ip:( - 10.0.0.0/8 or - 172.16.0.0/12 or - 192.168.0.0/16 - ) and - not destination.ip:( - 10.0.0.0/8 or - 127.0.0.0/8 or - 169.254.0.0/16 or - 172.16.0.0/12 or - 192.0.0.0/24 or - 192.0.0.0/29 or - 192.0.0.8/32 or - 192.0.0.9/32 or - 192.0.0.10/32 or - 192.0.0.170/32 or - 192.0.0.171/32 or - 192.0.2.0/24 or - 192.31.196.0/24 or - 192.52.193.0/24 or - 192.168.0.0/16 or - 192.88.99.0/24 or - 224.0.0.0/4 or - 100.64.0.0/10 or - 192.175.48.0/24 or - 198.18.0.0/15 or - 198.51.100.0/24 or - 203.0.113.0/24 or - 240.0.0.0/4 or - "::1" or - "FE80::/10" or - "FF00::/8" - ) - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Initial Access -** ID: TA0001 -** Reference URL: https://attack.mitre.org/tactics/TA0001/ -* Technique: -** Name: Exploit Public-Facing Application -** ID: T1190 -** Reference URL: https://attack.mitre.org/techniques/T1190/ -* Tactic: -** Name: Exfiltration -** ID: TA0010 -** Reference URL: https://attack.mitre.org/tactics/TA0010/ -* Technique: -** Name: Exfiltration Over Alternative Protocol -** ID: T1048 -** Reference URL: https://attack.mitre.org/techniques/T1048/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-spike-in-aws-error-messages.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-spike-in-aws-error-messages.asciidoc deleted file mode 100644 index 1df248398b..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-spike-in-aws-error-messages.asciidoc +++ /dev/null @@ -1,57 +0,0 @@ -[[prebuilt-rule-0-14-1-spike-in-aws-error-messages]] -=== Spike in AWS Error Messages - -A machine learning job detected a significant spike in the rate of a particular error in the CloudTrail messages. Spikes in error messages may accompany attempts at privilege escalation, lateral movement, or discovery. - -*Rule type*: machine_learning - -*Rule indices*: None - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 15m - -*Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html - -*Tags*: - -* Elastic -* Cloud -* AWS -* ML - -*Version*: 6 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Config - -The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. - -## Triage and analysis - -### Investigating Spikes in CloudTrail Errors -Detection alerts from this rule indicate a large spike in the number of CloudTrail log messages that contain a particular error message. The error message in question was associated with the response to an AWS API command or method call. Here are some possible avenues of investigation: -- Examine the history of the error. Has it manifested before? If the error, which is visible in the `aws.cloudtrail.error_message` field, only manifested recently, it might be related to recent changes in an automation module or script. -- Examine the request parameters. These may provide indications as to the nature of the task being performed when the error occurred. Is the error related to unsuccessful attempts to enumerate or access objects, data, or secrets? If so, this can sometimes be a byproduct of discovery, privilege escalation or lateral movement attempts. -- Consider the user as identified by the user.name field. Is this activity part of an expected workflow for the user context? Examine the user identity in the `aws.cloudtrail.user_identity.arn` field and the access key id in the `aws.cloudtrail.user_identity.access_key_id` field, which can help identify the precise user context. The user agent details in the `user_agent.original` field may also indicate what kind of a client made the request. -- Consider the source IP address and geolocation for the calling user who issued the command. Do they look normal for the calling user? If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts, or could it be sourcing from an EC2 instance not under your control? If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles? Are there any other alerts or signs of suspicious activity involving this instance? ----------------------------------- diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-spike-in-network-traffic.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-spike-in-network-traffic.asciidoc deleted file mode 100644 index 1d552c4b41..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-spike-in-network-traffic.asciidoc +++ /dev/null @@ -1,38 +0,0 @@ -[[prebuilt-rule-0-14-1-spike-in-network-traffic]] -=== Spike in Network Traffic - -A machine learning job detected an unusually large spike in network traffic. Such a burst of traffic, if not caused by a surge in business activity, can be due to suspicious or malicious activity. Large-scale data exfiltration may produce a burst of network traffic; this could also be due to unusually large amounts of reconnaissance or enumeration traffic. Denial-of-service attacks or traffic floods may also produce such a surge in traffic. - -*Rule type*: machine_learning - -*Rule indices*: None - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 15m - -*Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html - -*Tags*: - -* Elastic -* Network -* Threat Detection -* ML - -*Version*: 3 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-suspicious-jar-child-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-suspicious-jar-child-process.asciidoc deleted file mode 100644 index 161fdf6dee..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-suspicious-jar-child-process.asciidoc +++ /dev/null @@ -1,71 +0,0 @@ -[[prebuilt-rule-0-14-1-suspicious-jar-child-process]] -=== Suspicious JAR Child Process - -Identifies suspicious child processes of a Java Archive (JAR) file. JAR files may be used to deliver malware in order to evade detection. - -*Rule type*: eql - -*Rule indices*: - -* auditbeat-* -* logs-endpoint.events.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Host -* Linux -* macOS -* Threat Detection -* Execution - -*Version*: 2 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type in ("start", "process_started") and - process.parent.name : "java" and - process.name : ("sh", "bash", "dash", "ksh", "tcsh", "zsh", "curl", "wget") and - process.args : "-jar" and process.args : "*.jar" and - /* Add any FP's here */ - not process.executable : ("/Users/*/.sdkman/*", "/Library/Java/JavaVirtualMachines/*") and - not process.args : ("/usr/local/*", "/Users/*/github.com/*", "/Users/*/src/*") - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Execution -** ID: TA0002 -** Reference URL: https://attack.mitre.org/tactics/TA0002/ -* Technique: -** Name: Command and Scripting Interpreter -** ID: T1059 -** Reference URL: https://attack.mitre.org/techniques/T1059/ -* Sub-technique: -** Name: JavaScript -** ID: T1059.007 -** Reference URL: https://attack.mitre.org/techniques/T1059/007/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-suspicious-wmi-image-load-from-ms-office.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-suspicious-wmi-image-load-from-ms-office.asciidoc deleted file mode 100644 index 57d20367c1..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-suspicious-wmi-image-load-from-ms-office.asciidoc +++ /dev/null @@ -1,66 +0,0 @@ -[[prebuilt-rule-0-14-1-suspicious-wmi-image-load-from-ms-office]] -=== Suspicious WMI Image Load from MS Office - -Identifies a suspicious image load (wmiutils.dll) from Microsoft Office processes. This behavior may indicate adversarial activity where child processes are spawned via Windows Management Instrumentation (WMI). This technique can be used to execute code and evade traditional parent/child processes spawned from Microsoft Office products. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16 - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Execution - -*Version*: 4 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -library where process.name : ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "MSPUB.EXE", "MSACCESS.EXE") and - event.action : "load" and - event.category : "library" and - dll.name : "wmiutils.dll" - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Execution -** ID: TA0002 -** Reference URL: https://attack.mitre.org/tactics/TA0002/ -* Technique: -** Name: Windows Management Instrumentation -** ID: T1047 -** Reference URL: https://attack.mitre.org/techniques/T1047/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-telnet-port-activity.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-telnet-port-activity.asciidoc deleted file mode 100644 index e96b49b5b4..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-telnet-port-activity.asciidoc +++ /dev/null @@ -1,75 +0,0 @@ -[[prebuilt-rule-0-14-1-telnet-port-activity]] -=== Telnet Port Activity - -This rule detects network events that may indicate the use of Telnet traffic. Telnet is commonly used by system administrators to remotely control older or embedded systems using the command line shell. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector. As a plain-text protocol, it may also expose usernames and passwords to anyone capable of observing the traffic. - -*Rule type*: query - -*Rule indices*: - -* auditbeat-* -* filebeat-* -* packetbeat-* -* logs-endpoint.events.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Host -* Network -* Threat Detection -* Command and Control -* Host - -*Version*: 9 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -event.category:(network or network_traffic) and network.transport:tcp and destination.port:23 - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Command and Control -** ID: TA0011 -** Reference URL: https://attack.mitre.org/tactics/TA0011/ -* Tactic: -** Name: Lateral Movement -** ID: TA0008 -** Reference URL: https://attack.mitre.org/tactics/TA0008/ -* Technique: -** Name: Remote Services -** ID: T1021 -** Reference URL: https://attack.mitre.org/techniques/T1021/ -* Tactic: -** Name: Initial Access -** ID: TA0001 -** Reference URL: https://attack.mitre.org/tactics/TA0001/ -* Technique: -** Name: Exploit Public-Facing Application -** ID: T1190 -** Reference URL: https://attack.mitre.org/techniques/T1190/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-uac-bypass-attempt-via-elevated-com-internet-explorer-add-on-installer.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-uac-bypass-attempt-via-elevated-com-internet-explorer-add-on-installer.asciidoc deleted file mode 100644 index 459978b7b8..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-uac-bypass-attempt-via-elevated-com-internet-explorer-add-on-installer.asciidoc +++ /dev/null @@ -1,72 +0,0 @@ -[[prebuilt-rule-0-14-1-uac-bypass-attempt-via-elevated-com-internet-explorer-add-on-installer]] -=== UAC Bypass Attempt via Elevated COM Internet Explorer Add-On Installer - -Identifies User Account Control (UAC) bypass attempts by abusing an elevated COM Interface to launch a malicious program. Attackers may attempt to bypass UAC to stealthily execute code with elevated permissions. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://swapcontext.blogspot.com/2020/11/uac-bypasses-from-comautoapprovallist.html - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Privilege Escalation - -*Version*: 4 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type in ("start", "process_started") and - process.executable : "C:\\*\\AppData\\*\\Temp\\IDC*.tmp\\*.exe" and - process.parent.name : "ieinstal.exe" and process.parent.args : "-Embedding" - - /* uncomment once in winlogbeat */ - /* and not (process.code_signature.subject_name == "Microsoft Corporation" and process.code_signature.trusted == true) */ - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Privilege Escalation -** ID: TA0004 -** Reference URL: https://attack.mitre.org/tactics/TA0004/ -* Technique: -** Name: Abuse Elevation Control Mechanism -** ID: T1548 -** Reference URL: https://attack.mitre.org/techniques/T1548/ -* Sub-technique: -** Name: Bypass User Account Control -** ID: T1548.002 -** Reference URL: https://attack.mitre.org/techniques/T1548/002/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-uac-bypass-attempt-via-privileged-ifileoperation-com-interface.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-uac-bypass-attempt-via-privileged-ifileoperation-com-interface.asciidoc deleted file mode 100644 index 156b8e1944..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-uac-bypass-attempt-via-privileged-ifileoperation-com-interface.asciidoc +++ /dev/null @@ -1,71 +0,0 @@ -[[prebuilt-rule-0-14-1-uac-bypass-attempt-via-privileged-ifileoperation-com-interface]] -=== UAC Bypass Attempt via Privileged IFileOperation COM Interface - -Identifies attempts to bypass User Account Control (UAC) via DLL side-loading. Attackers may attempt to bypass UAC to stealthily execute code with elevated permissions. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: high - -*Risk score*: 73 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://github.com/hfiref0x/UACME - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Privilege Escalation - -*Version*: 4 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -file where event.type : "change" and process.name : "dllhost.exe" and - /* Known modules names side loaded into process running with high or system integrity level for UAC Bypass, update here for new modules */ - file.name : ("wow64log.dll", "comctl32.dll", "DismCore.dll", "OskSupport.dll", "duser.dll", "Accessibility.ni.dll") and - /* has no impact on rule logic just to avoid OS install related FPs */ - not file.path : ("C:\\Windows\\SoftwareDistribution\\*", "C:\\Windows\\WinSxS\\*") - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Privilege Escalation -** ID: TA0004 -** Reference URL: https://attack.mitre.org/tactics/TA0004/ -* Technique: -** Name: Abuse Elevation Control Mechanism -** ID: T1548 -** Reference URL: https://attack.mitre.org/techniques/T1548/ -* Sub-technique: -** Name: Bypass User Account Control -** ID: T1548.002 -** Reference URL: https://attack.mitre.org/techniques/T1548/002/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-uac-bypass-attempt-via-windows-directory-masquerading.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-uac-bypass-attempt-via-windows-directory-masquerading.asciidoc deleted file mode 100644 index ac98bb16eb..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-uac-bypass-attempt-via-windows-directory-masquerading.asciidoc +++ /dev/null @@ -1,68 +0,0 @@ -[[prebuilt-rule-0-14-1-uac-bypass-attempt-via-windows-directory-masquerading]] -=== UAC Bypass Attempt via Windows Directory Masquerading - -Identifies an attempt to bypass User Account Control (UAC) by masquerading as a Microsoft trusted Windows directory. Attackers may bypass UAC to stealthily execute code with elevated permissions. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: high - -*Risk score*: 73 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://medium.com/tenable-techblog/uac-bypass-by-mocking-trusted-directories-24a96675f6e - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Privilege Escalation - -*Version*: 4 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type in ("start", "process_started") and - process.args : ("C:\\Windows \\system32\\*.exe", "C:\\Windows \\SysWOW64\\*.exe") - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Privilege Escalation -** ID: TA0004 -** Reference URL: https://attack.mitre.org/tactics/TA0004/ -* Technique: -** Name: Abuse Elevation Control Mechanism -** ID: T1548 -** Reference URL: https://attack.mitre.org/techniques/T1548/ -* Sub-technique: -** Name: Bypass User Account Control -** ID: T1548.002 -** Reference URL: https://attack.mitre.org/techniques/T1548/002/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-uac-bypass-attempt-with-ieditionupgrademanager-elevated-com-interface.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-uac-bypass-attempt-with-ieditionupgrademanager-elevated-com-interface.asciidoc deleted file mode 100644 index 8c22dace00..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-uac-bypass-attempt-with-ieditionupgrademanager-elevated-com-interface.asciidoc +++ /dev/null @@ -1,70 +0,0 @@ -[[prebuilt-rule-0-14-1-uac-bypass-attempt-with-ieditionupgrademanager-elevated-com-interface]] -=== UAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface - -Identifies attempts to bypass User Account Control (UAC) by abusing an elevated COM Interface to launch a rogue Windows ClipUp program. Attackers may attempt to bypass UAC to stealthily execute code with elevated permissions. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: high - -*Risk score*: 73 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://github.com/hfiref0x/UACME - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Privilege Escalation - -*Version*: 4 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type in ("start", "process_started") and process.name : "Clipup.exe" and - not process.executable : "C:\\Windows\\System32\\ClipUp.exe" and process.parent.name : "dllhost.exe" and - /* CLSID of the Elevated COM Interface IEditionUpgradeManager */ - process.parent.args : "/Processid:{BD54C901-076B-434E-B6C7-17C531F4AB41}" - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Privilege Escalation -** ID: TA0004 -** Reference URL: https://attack.mitre.org/tactics/TA0004/ -* Technique: -** Name: Abuse Elevation Control Mechanism -** ID: T1548 -** Reference URL: https://attack.mitre.org/techniques/T1548/ -* Sub-technique: -** Name: Bypass User Account Control -** ID: T1548.002 -** Reference URL: https://attack.mitre.org/techniques/T1548/002/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-uac-bypass-via-diskcleanup-scheduled-task-hijack.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-uac-bypass-via-diskcleanup-scheduled-task-hijack.asciidoc deleted file mode 100644 index 76c609df78..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-uac-bypass-via-diskcleanup-scheduled-task-hijack.asciidoc +++ /dev/null @@ -1,69 +0,0 @@ -[[prebuilt-rule-0-14-1-uac-bypass-via-diskcleanup-scheduled-task-hijack]] -=== UAC Bypass via DiskCleanup Scheduled Task Hijack - -Identifies User Account Control (UAC) bypass via hijacking DiskCleanup Scheduled Task. Attackers bypass UAC to stealthily execute code with elevated permissions. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Privilege Escalation - -*Version*: 6 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type == "start" and - process.args : "/autoclean" and process.args : "/d" and - not process.executable : ("C:\\Windows\\System32\\cleanmgr.exe", - "C:\\Windows\\SysWOW64\\cleanmgr.exe", - "C:\\Windows\\System32\\taskhostw.exe") - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Privilege Escalation -** ID: TA0004 -** Reference URL: https://attack.mitre.org/tactics/TA0004/ -* Technique: -** Name: Abuse Elevation Control Mechanism -** ID: T1548 -** Reference URL: https://attack.mitre.org/techniques/T1548/ -* Sub-technique: -** Name: Bypass User Account Control -** ID: T1548.002 -** Reference URL: https://attack.mitre.org/techniques/T1548/002/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-uac-bypass-via-icmluautil-elevated-com-interface.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-uac-bypass-via-icmluautil-elevated-com-interface.asciidoc deleted file mode 100644 index 3075eba755..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-uac-bypass-via-icmluautil-elevated-com-interface.asciidoc +++ /dev/null @@ -1,68 +0,0 @@ -[[prebuilt-rule-0-14-1-uac-bypass-via-icmluautil-elevated-com-interface]] -=== UAC Bypass via ICMLuaUtil Elevated COM Interface - -Identifies User Account Control (UAC) bypass attempts via the ICMLuaUtil Elevated COM interface. Attackers may attempt to bypass UAC to stealthily execute code with elevated permissions. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: high - -*Risk score*: 73 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Privilege Escalation - -*Version*: 4 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type in ("start", "process_started") and - process.parent.name == "dllhost.exe" and - process.parent.args in ("/Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}", "/Processid:{D2E7041B-2927-42FB-8E9F-7CE93B6DC937}") and - process.pe.original_file_name != "WerFault.exe" - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Privilege Escalation -** ID: TA0004 -** Reference URL: https://attack.mitre.org/tactics/TA0004/ -* Technique: -** Name: Abuse Elevation Control Mechanism -** ID: T1548 -** Reference URL: https://attack.mitre.org/techniques/T1548/ -* Sub-technique: -** Name: Bypass User Account Control -** ID: T1548.002 -** Reference URL: https://attack.mitre.org/techniques/T1548/002/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-uac-bypass-via-windows-firewall-snap-in-hijack.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-uac-bypass-via-windows-firewall-snap-in-hijack.asciidoc deleted file mode 100644 index e7196ec65a..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-uac-bypass-via-windows-firewall-snap-in-hijack.asciidoc +++ /dev/null @@ -1,71 +0,0 @@ -[[prebuilt-rule-0-14-1-uac-bypass-via-windows-firewall-snap-in-hijack]] -=== UAC Bypass via Windows Firewall Snap-In Hijack - -Identifies attempts to bypass User Account Control (UAC) by hijacking the Microsoft Management Console (MMC) Windows Firewall snap-in. Attackers bypass UAC to stealthily execute code with elevated permissions. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://github.com/AzAgarampur/byeintegrity-uac - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Privilege Escalation - -*Version*: 4 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type in ("start", "process_started") and - process.parent.name == "mmc.exe" and - /* process.Ext.token.integrity_level_name == "high" can be added in future for tuning */ - /* args of the Windows Firewall SnapIn */ - process.parent.args == "WF.msc" and process.name != "WerFault.exe" - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Privilege Escalation -** ID: TA0004 -** Reference URL: https://attack.mitre.org/tactics/TA0004/ -* Technique: -** Name: Abuse Elevation Control Mechanism -** ID: T1548 -** Reference URL: https://attack.mitre.org/techniques/T1548/ -* Sub-technique: -** Name: Bypass User Account Control -** ID: T1548.002 -** Reference URL: https://attack.mitre.org/techniques/T1548/002/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-unusual-aws-command-for-a-user.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-unusual-aws-command-for-a-user.asciidoc deleted file mode 100644 index b4ad81a8e9..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-unusual-aws-command-for-a-user.asciidoc +++ /dev/null @@ -1,59 +0,0 @@ -[[prebuilt-rule-0-14-1-unusual-aws-command-for-a-user]] -=== Unusual AWS Command for a User - -A machine learning job detected an AWS API command that, while not inherently suspicious or abnormal, is being made by a user context that does not normally use the command. This can be the result of compromised credentials or keys as someone uses a valid account to persist, move laterally, or exfiltrate data. - -*Rule type*: machine_learning - -*Rule indices*: None - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 15m - -*Searches indices from*: now-2h ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html - -*Tags*: - -* Elastic -* Cloud -* AWS -* ML - -*Version*: 6 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Config - -The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. - -## Triage and analysis - -### Investigating an Unusual CloudTrail Event - -Detection alerts from this rule indicate an AWS API command or method call that is rare and unusual for the calling IAM user. Here are some possible avenues of investigation: -- Consider the user as identified by the `user.name` field. Is this command part of an expected workflow for the user context? Examine the user identity in the `aws.cloudtrail.user_identity.arn` field and the access key id in the `aws.cloudtrail.user_identity.access_key_id` field, which can help identify the precise user context. The user agent details in the `user_agent.original` field may also indicate what kind of a client made the request. -- Consider the source IP address and geolocation for the calling user who issued the command. Do they look normal for the calling user? If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts, or could it be sourcing from an EC2 instance not under your control? If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles? Are there any other alerts or signs of suspicious activity involving this instance? -- Consider the time of day. If the user is a human, not a program or script, did the activity take place during a normal time of day? -- Examine the history of the command. If the command, which is visible in the `event.action field`, only manifested recently, it might be part of a new automation module or script. If it has a consistent cadence (for example, if it appears in small numbers on a weekly or monthly cadence), it might be part of a housekeeping or maintenance process. -- Examine the request parameters. These may provide indications as to the source of the program or the nature of the tasks it is performing. ----------------------------------- diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-unusual-city-for-an-aws-command.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-unusual-city-for-an-aws-command.asciidoc deleted file mode 100644 index 002336b561..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-unusual-city-for-an-aws-command.asciidoc +++ /dev/null @@ -1,58 +0,0 @@ -[[prebuilt-rule-0-14-1-unusual-city-for-an-aws-command]] -=== Unusual City For an AWS Command - -A machine learning job detected AWS command activity that, while not inherently suspicious or abnormal, is sourcing from a geolocation (city) that is unusual for the command. This can be the result of compromised credentials or keys being used by a threat actor in a different geography than the authorized user(s). - -*Rule type*: machine_learning - -*Rule indices*: None - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 15m - -*Searches indices from*: now-2h ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html - -*Tags*: - -* Elastic -* Cloud -* AWS -* ML - -*Version*: 6 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Config - -The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. - -## Triage and analysis - -### Investigating an Unusual CloudTrail Event -Detection alerts from this rule indicate an AWS API command or method call that is rare and unusual for the geolocation of the source IP address. Here are some possible avenues of investigation: -- Consider the source IP address and geolocation for the calling user who issued the command. Do they look normal for the calling user? If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts, or could it be sourcing from an EC2 instance not under your control? If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles? Are there any other alerts or signs of suspicious activity involving this instance? -- Consider the user as identified by the `user.name` field. Is this command part of an expected workflow for the user context? Examine the user identity in the `aws.cloudtrail.user_identity.arn` field and the access key id in the `aws.cloudtrail.user_identity.access_key_id` field, which can help identify the precise user context. The user agent details in the `user_agent.original` field may also indicate what kind of a client made the request. -- Consider the time of day. If the user is a human, not a program or script, did the activity take place during a normal time of day? -- Examine the history of the command. If the command, which is visible in the `event.action field`, only manifested recently, it might be part of a new automation module or script. If it has a consistent cadence (for example, if it appears in small numbers on a weekly or monthly cadence), it might be part of a housekeeping or maintenance process. -- Examine the request parameters. These may provide indications as to the source of the program or the nature of the tasks it is performing. ----------------------------------- diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-unusual-country-for-an-aws-command.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-unusual-country-for-an-aws-command.asciidoc deleted file mode 100644 index 33bb2c358a..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-unusual-country-for-an-aws-command.asciidoc +++ /dev/null @@ -1,58 +0,0 @@ -[[prebuilt-rule-0-14-1-unusual-country-for-an-aws-command]] -=== Unusual Country For an AWS Command - -A machine learning job detected AWS command activity that, while not inherently suspicious or abnormal, is sourcing from a geolocation (country) that is unusual for the command. This can be the result of compromised credentials or keys being used by a threat actor in a different geography than the authorized user(s). - -*Rule type*: machine_learning - -*Rule indices*: None - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 15m - -*Searches indices from*: now-2h ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html - -*Tags*: - -* Elastic -* Cloud -* AWS -* ML - -*Version*: 6 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Config - -The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. - -## Triage and analysis - -### Investigating an Unusual CloudTrail Event -Detection alerts from this rule indicate an AWS API command or method call that is rare and unusual for the geolocation of the source IP address. Here are some possible avenues of investigation: -- Consider the source IP address and geolocation for the calling user who issued the command. Do they look normal for the calling user? If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts, or could it be sourcing from an EC2 instance not under your control? If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles? Are there any other alerts or signs of suspicious activity involving this instance? -- Consider the user as identified by the `user.name` field. Is this command part of an expected workflow for the user context? Examine the user identity in the `aws.cloudtrail.user_identity.arn` field and the access key id in the `aws.cloudtrail.user_identity.access_key_id` field, which can help identify the precise user context. The user agent details in the `user_agent.original` field may also indicate what kind of a client made the request. -- Consider the time of day. If the user is a human, not a program or script, did the activity take place during a normal time of day? -- Examine the history of the command. If the command, which is visible in the `event.action field`, only manifested recently, it might be part of a new automation module or script. If it has a consistent cadence (for example, if it appears in small numbers on a weekly or monthly cadence), it might be part of a housekeeping or maintenance process. -- Examine the request parameters. These may provide indications as to the source of the program or the nature of the tasks it is performing. ----------------------------------- diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-unusual-linux-network-activity.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-unusual-linux-network-activity.asciidoc deleted file mode 100644 index a5c45ee52d..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-unusual-linux-network-activity.asciidoc +++ /dev/null @@ -1,55 +0,0 @@ -[[prebuilt-rule-0-14-1-unusual-linux-network-activity]] -=== Unusual Linux Network Activity - -Identifies Linux processes that do not usually use the network but have unexpected network activity, which can indicate command-and-control, lateral movement, persistence, or data exfiltration activity. A process with unusual network activity can denote process exploitation or injection, where the process is used to run persistence mechanisms that allow a malicious actor remote access or control of the host, data exfiltration, and execution of unauthorized network applications. - -*Rule type*: machine_learning - -*Rule indices*: None - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 15m - -*Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html - -*Tags*: - -* Elastic -* Host -* Linux -* Threat Detection -* ML - -*Version*: 6 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Triage and analysis - -### Investigating Unusual Network Activity -Detection alerts from this rule indicate the presence of network activity from a Linux process for which network activity is rare and unusual. Here are some possible avenues of investigation: -- Consider the IP addresses and ports. Are these used by normal but infrequent network workflows? Are they expected or unexpected? -- If the destination IP address is remote or external, does it associate with an expected domain, organization or geography? Note: avoid interacting directly with suspected malicious IP addresses. -- Consider the user as identified by the username field. Is this network activity part of an expected workflow for the user who ran the program? -- Examine the history of execution. If this process only manifested recently, it might be part of a new software package. If it has a consistent cadence (for example if it runs monthly or quarterly), it might be part of a monthly or quarterly business or maintenance process. -- Examine the process arguments, title and working directory. These may provide indications as to the source of the program or the nature of the tasks it is performing. ----------------------------------- diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-unusual-linux-username.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-unusual-linux-username.asciidoc deleted file mode 100644 index d4e551f9ea..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-unusual-linux-username.asciidoc +++ /dev/null @@ -1,53 +0,0 @@ -[[prebuilt-rule-0-14-1-unusual-linux-username]] -=== Unusual Linux Username - -A machine learning job detected activity for a username that is not normally active, which can indicate unauthorized changes, activity by unauthorized users, lateral movement, or compromised credentials. In many organizations, new usernames are not often created apart from specific types of system activities, such as creating new accounts for new employees. These user accounts quickly become active and routine. Events from rarely used usernames can point to suspicious activity. Additionally, automated Linux fleets tend to see activity from rarely used usernames only when personnel log in to make authorized or unauthorized changes, or threat actors have acquired credentials and log in for malicious purposes. Unusual usernames can also indicate pivoting, where compromised credentials are used to try and move laterally from one host to another. - -*Rule type*: machine_learning - -*Rule indices*: None - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 15m - -*Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html - -*Tags*: - -* Elastic -* Host -* Linux -* Threat Detection -* ML - -*Version*: 7 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Triage and analysis - -### Investigating an Unusual Linux User -Detection alerts from this rule indicate activity for a Linux user name that is rare and unusual. Here are some possible avenues of investigation: -- Consider the user as identified by the username field. Is this program part of an expected workflow for the user who ran this program on this host? Could this be related to troubleshooting or debugging activity by a developer or site reliability engineer? -- Examine the history of user activity. If this user only manifested recently, it might be a service account for a new software package. If it has a consistent cadence (for example if it runs monthly or quarterly), it might be part of a monthly or quarterly business process. -- Examine the process arguments, title and working directory. These may provide indications as to the source of the program or the nature of the tasks that the user is performing. ----------------------------------- diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-unusual-parent-child-relationship.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-unusual-parent-child-relationship.asciidoc deleted file mode 100644 index 7dce37392f..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-unusual-parent-child-relationship.asciidoc +++ /dev/null @@ -1,97 +0,0 @@ -[[prebuilt-rule-0-14-1-unusual-parent-child-relationship]] -=== Unusual Parent-Child Relationship - -Identifies Windows programs run from unexpected parent processes. This could indicate masquerading or other strange activity on a system. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://github.com/sbousseaden/Slides/blob/master/Hunting MindMaps/PNG/Windows Processes%20TH.map.png -* https://www.andreafortuna.org/2017/06/15/standard-windows-processes-a-brief-reference/ - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Privilege Escalation - -*Version*: 9 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type in ("start", "process_started") and -process.parent.name != null and - ( - /* suspicious parent processes */ - (process.name:"autochk.exe" and not process.parent.name:"smss.exe") or - (process.name:("fontdrvhost.exe", "dwm.exe") and not process.parent.name:("wininit.exe", "winlogon.exe")) or - (process.name:("consent.exe", "RuntimeBroker.exe", "TiWorker.exe") and not process.parent.name:"svchost.exe") or - (process.name:"SearchIndexer.exe" and not process.parent.name:"services.exe") or - (process.name:"SearchProtocolHost.exe" and not process.parent.name:("SearchIndexer.exe", "dllhost.exe")) or - (process.name:"dllhost.exe" and not process.parent.name:("services.exe", "svchost.exe")) or - (process.name:"smss.exe" and not process.parent.name:("System", "smss.exe")) or - (process.name:"csrss.exe" and not process.parent.name:("smss.exe", "svchost.exe")) or - (process.name:"wininit.exe" and not process.parent.name:"smss.exe") or - (process.name:"winlogon.exe" and not process.parent.name:"smss.exe") or - (process.name:("lsass.exe", "LsaIso.exe") and not process.parent.name:"wininit.exe") or - (process.name:"LogonUI.exe" and not process.parent.name:("wininit.exe", "winlogon.exe")) or - (process.name:"services.exe" and not process.parent.name:"wininit.exe") or - (process.name:"svchost.exe" and not process.parent.name:("MsMpEng.exe", "services.exe")) or - (process.name:"spoolsv.exe" and not process.parent.name:"services.exe") or - (process.name:"taskhost.exe" and not process.parent.name:("services.exe", "svchost.exe")) or - (process.name:"taskhostw.exe" and not process.parent.name:("services.exe", "svchost.exe")) or - (process.name:"userinit.exe" and not process.parent.name:("dwm.exe", "winlogon.exe")) or - (process.name:("wmiprvse.exe", "wsmprovhost.exe", "winrshost.exe") and not process.parent.name:"svchost.exe") or - /* suspicious child processes */ - (process.parent.name:("SearchProtocolHost.exe", "taskhost.exe", "csrss.exe") and not process.name:("werfault.exe", "wermgr.exe", "WerFaultSecure.exe")) or - (process.parent.name:"autochk.exe" and not process.name:("chkdsk.exe", "doskey.exe", "WerFault.exe")) or - (process.parent.name:"smss.exe" and not process.name:("autochk.exe", "smss.exe", "csrss.exe", "wininit.exe", "winlogon.exe", "setupcl.exe", "WerFault.exe")) or - (process.parent.name:"wermgr.exe" and not process.name:("WerFaultSecure.exe", "wermgr.exe", "WerFault.exe")) or - (process.parent.name:"conhost.exe" and not process.name:("mscorsvw.exe", "wermgr.exe", "WerFault.exe", "WerFaultSecure.exe")) - ) - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Privilege Escalation -** ID: TA0004 -** Reference URL: https://attack.mitre.org/tactics/TA0004/ -* Technique: -** Name: Process Injection -** ID: T1055 -** Reference URL: https://attack.mitre.org/techniques/T1055/ -* Sub-technique: -** Name: Process Hollowing -** ID: T1055.012 -** Reference URL: https://attack.mitre.org/techniques/T1055/012/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-unusual-process-for-a-linux-host.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-unusual-process-for-a-linux-host.asciidoc deleted file mode 100644 index 814eb7642a..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-unusual-process-for-a-linux-host.asciidoc +++ /dev/null @@ -1,53 +0,0 @@ -[[prebuilt-rule-0-14-1-unusual-process-for-a-linux-host]] -=== Unusual Process For a Linux Host - -Identifies rare processes that do not usually run on individual hosts, which can indicate execution of unauthorized services, malware, or persistence mechanisms. Processes are considered rare when they only run occasionally as compared with other processes running on the host. - -*Rule type*: machine_learning - -*Rule indices*: None - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 15m - -*Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html - -*Tags*: - -* Elastic -* Host -* Linux -* Threat Detection -* ML - -*Version*: 7 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Triage and analysis - -### Investigating an Unusual Linux Process -Detection alerts from this rule indicate the presence of a Linux process that is rare and unusual for the host it ran on. Here are some possible avenues of investigation: -- Consider the user as identified by the username field. Is this program part of an expected workflow for the user who ran this program on this host? -- Examine the history of execution. If this process only manifested recently, it might be part of a new software package. If it has a consistent cadence (for example if it runs monthly or quarterly), it might be part of a monthly or quarterly business process. -- Examine the process arguments, title and working directory. These may provide indications as to the source of the program or the nature of the tasks it is performing. ----------------------------------- diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-unusual-process-for-a-windows-host.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-unusual-process-for-a-windows-host.asciidoc deleted file mode 100644 index 1f1460a274..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-unusual-process-for-a-windows-host.asciidoc +++ /dev/null @@ -1,56 +0,0 @@ -[[prebuilt-rule-0-14-1-unusual-process-for-a-windows-host]] -=== Unusual Process For a Windows Host - -Identifies rare processes that do not usually run on individual hosts, which can indicate execution of unauthorized services, malware, or persistence mechanisms. Processes are considered rare when they only run occasionally as compared with other processes running on the host. - -*Rule type*: machine_learning - -*Rule indices*: None - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 15m - -*Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* ML - -*Version*: 7 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Triage and analysis - -### Investigating an Unusual Windows Process -Detection alerts from this rule indicate the presence of a Windows process that is rare and unusual for the host it ran on. Here are some possible avenues of investigation: -- Consider the user as identified by the username field. Is this program part of an expected workflow for the user who ran this program on this host? -- Examine the history of execution. If this process only manifested recently, it might be part of a new software package. If it has a consistent cadence (for example if it runs monthly or quarterly), it might be part of a monthly or quarterly business process. -- Examine the process metadata like the values of the Company, Description and Product fields which may indicate whether the program is associated with an expected software vendor or package. -- Examine arguments and working directory. These may provide indications as to the source of the program or the nature of the tasks it is performing. -- Consider the same for the parent process. If the parent process is a legitimate system utility or service, this could be related to software updates or system management. If the parent process is something user-facing like an Office application, this process could be more suspicious. -- If you have file hash values in the event data, and you suspect malware, you can optionally run a search for the file hash to see if the file is identified as malware by anti-malware tools. ----------------------------------- diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-unusual-windows-network-activity.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-unusual-windows-network-activity.asciidoc deleted file mode 100644 index 164b8f8fb4..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-unusual-windows-network-activity.asciidoc +++ /dev/null @@ -1,57 +0,0 @@ -[[prebuilt-rule-0-14-1-unusual-windows-network-activity]] -=== Unusual Windows Network Activity - -Identifies Windows processes that do not usually use the network but have unexpected network activity, which can indicate command-and-control, lateral movement, persistence, or data exfiltration activity. A process with unusual network activity can denote process exploitation or injection, where the process is used to run persistence mechanisms that allow a malicious actor remote access or control of the host, data exfiltration, and execution of unauthorized network applications. - -*Rule type*: machine_learning - -*Rule indices*: None - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 15m - -*Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* ML - -*Version*: 7 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Triage and analysis - -### Investigating Unusual Network Activity -Detection alerts from this rule indicate the presence of network activity from a Windows process for which network activity is very unusual. Here are some possible avenues of investigation: -- Consider the IP addresses, protocol and ports. Are these used by normal but infrequent network workflows? Are they expected or unexpected? -- If the destination IP address is remote or external, does it associate with an expected domain, organization or geography? Note: avoid interacting directly with suspected malicious IP addresses. -- Consider the user as identified by the username field. Is this network activity part of an expected workflow for the user who ran the program? -- Examine the history of execution. If this process only manifested recently, it might be part of a new software package. If it has a consistent cadence (for example if it runs monthly or quarterly), it might be part of a monthly or quarterly business process. -- Examine the process arguments, title and working directory. These may provide indications as to the source of the program or the nature of the tasks it is performing. -- Consider the same for the parent process. If the parent process is a legitimate system utility or service, this could be related to software updates or system management. If the parent process is something user-facing like an Office application, this process could be more suspicious. -- If you have file hash values in the event data, and you suspect malware, you can optionally run a search for the file hash to see if the file is identified as malware by anti-malware tools. ----------------------------------- diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-unusual-windows-username.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-unusual-windows-username.asciidoc deleted file mode 100644 index 090987f9b5..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-unusual-windows-username.asciidoc +++ /dev/null @@ -1,54 +0,0 @@ -[[prebuilt-rule-0-14-1-unusual-windows-username]] -=== Unusual Windows Username - -A machine learning job detected activity for a username that is not normally active, which can indicate unauthorized changes, activity by unauthorized users, lateral movement, or compromised credentials. In many organizations, new usernames are not often created apart from specific types of system activities, such as creating new accounts for new employees. These user accounts quickly become active and routine. Events from rarely used usernames can point to suspicious activity. Additionally, automated Linux fleets tend to see activity from rarely used usernames only when personnel log in to make authorized or unauthorized changes, or threat actors have acquired credentials and log in for malicious purposes. Unusual usernames can also indicate pivoting, where compromised credentials are used to try and move laterally from one host to another. - -*Rule type*: machine_learning - -*Rule indices*: None - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 15m - -*Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* ML - -*Version*: 7 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Triage and analysis - -### Investigating an Unusual Windows User -Detection alerts from this rule indicate activity for a Windows user name that is rare and unusual. Here are some possible avenues of investigation: -- Consider the user as identified by the username field. Is this program part of an expected workflow for the user who ran this program on this host? Could this be related to occasional troubleshooting or support activity? -- Examine the history of user activity. If this user only manifested recently, it might be a service account for a new software package. If it has a consistent cadence (for example if it runs monthly or quarterly), it might be part of a monthly or quarterly business process. -- Examine the process arguments, title and working directory. These may provide indications as to the source of the program or the nature of the tasks that the user is performing. -- Consider the same for the parent process. If the parent process is a legitimate system utility or service, this could be related to software updates or system management. If the parent process is something user-facing like an Office application, this process could be more suspicious. ----------------------------------- diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-vnc-virtual-network-computing-from-the-internet.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-vnc-virtual-network-computing-from-the-internet.asciidoc deleted file mode 100644 index 8cc47d6e34..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-vnc-virtual-network-computing-from-the-internet.asciidoc +++ /dev/null @@ -1,106 +0,0 @@ -[[prebuilt-rule-0-14-1-vnc-virtual-network-computing-from-the-internet]] -=== VNC (Virtual Network Computing) from the Internet - -This rule detects network events that may indicate the use of VNC traffic from the Internet. VNC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector. - -*Rule type*: query - -*Rule indices*: - -* auditbeat-* -* filebeat-* -* packetbeat-* -* logs-endpoint.events.* - -*Severity*: high - -*Risk score*: 73 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml - -*Tags*: - -* Elastic -* Host -* Network -* Threat Detection -* Command and Control -* Host - -*Version*: 11 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -event.category:(network or network_traffic) and network.transport:tcp and destination.port >= 5800 and destination.port <= 5810 and - not source.ip:( - 10.0.0.0/8 or - 127.0.0.0/8 or - 169.254.0.0/16 or - 172.16.0.0/12 or - 192.0.0.0/24 or - 192.0.0.0/29 or - 192.0.0.8/32 or - 192.0.0.9/32 or - 192.0.0.10/32 or - 192.0.0.170/32 or - 192.0.0.171/32 or - 192.0.2.0/24 or - 192.31.196.0/24 or - 192.52.193.0/24 or - 192.168.0.0/16 or - 192.88.99.0/24 or - 224.0.0.0/4 or - 100.64.0.0/10 or - 192.175.48.0/24 or - 198.18.0.0/15 or - 198.51.100.0/24 or - 203.0.113.0/24 or - 240.0.0.0/4 or - "::1" or - "FE80::/10" or - "FF00::/8" - ) and - destination.ip:( - 10.0.0.0/8 or - 172.16.0.0/12 or - 192.168.0.0/16 - ) - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Command and Control -** ID: TA0011 -** Reference URL: https://attack.mitre.org/tactics/TA0011/ -* Technique: -** Name: Remote Access Software -** ID: T1219 -** Reference URL: https://attack.mitre.org/techniques/T1219/ -* Tactic: -** Name: Initial Access -** ID: TA0001 -** Reference URL: https://attack.mitre.org/tactics/TA0001/ -* Technique: -** Name: Exploit Public-Facing Application -** ID: T1190 -** Reference URL: https://attack.mitre.org/techniques/T1190/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-vnc-virtual-network-computing-to-the-internet.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-vnc-virtual-network-computing-to-the-internet.asciidoc deleted file mode 100644 index c9a150e016..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-vnc-virtual-network-computing-to-the-internet.asciidoc +++ /dev/null @@ -1,98 +0,0 @@ -[[prebuilt-rule-0-14-1-vnc-virtual-network-computing-to-the-internet]] -=== VNC (Virtual Network Computing) to the Internet - -This rule detects network events that may indicate the use of VNC traffic to the Internet. VNC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector. - -*Rule type*: query - -*Rule indices*: - -* auditbeat-* -* filebeat-* -* packetbeat-* -* logs-endpoint.events.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml - -*Tags*: - -* Elastic -* Host -* Network -* Threat Detection -* Command and Control -* Host - -*Version*: 11 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -event.category:(network or network_traffic) and network.transport:tcp and destination.port >= 5800 and destination.port <= 5810 and - source.ip:( - 10.0.0.0/8 or - 172.16.0.0/12 or - 192.168.0.0/16 - ) and - not destination.ip:( - 10.0.0.0/8 or - 127.0.0.0/8 or - 169.254.0.0/16 or - 172.16.0.0/12 or - 192.0.0.0/24 or - 192.0.0.0/29 or - 192.0.0.8/32 or - 192.0.0.9/32 or - 192.0.0.10/32 or - 192.0.0.170/32 or - 192.0.0.171/32 or - 192.0.2.0/24 or - 192.31.196.0/24 or - 192.52.193.0/24 or - 192.168.0.0/16 or - 192.88.99.0/24 or - 224.0.0.0/4 or - 100.64.0.0/10 or - 192.175.48.0/24 or - 198.18.0.0/15 or - 198.51.100.0/24 or - 203.0.113.0/24 or - 240.0.0.0/4 or - "::1" or - "FE80::/10" or - "FF00::/8" - ) - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Command and Control -** ID: TA0011 -** Reference URL: https://attack.mitre.org/tactics/TA0011/ -* Technique: -** Name: Remote Access Software -** ID: T1219 -** Reference URL: https://attack.mitre.org/techniques/T1219/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-web-application-suspicious-activity-post-request-declined.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-web-application-suspicious-activity-post-request-declined.asciidoc deleted file mode 100644 index a245905edc..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-web-application-suspicious-activity-post-request-declined.asciidoc +++ /dev/null @@ -1,48 +0,0 @@ -[[prebuilt-rule-0-14-1-web-application-suspicious-activity-post-request-declined]] -=== Web Application Suspicious Activity: POST Request Declined - -A POST request to a web application returned a 403 response, which indicates the web application declined to process the request because the action requested was not allowed. - -*Rule type*: query - -*Rule indices*: - -* apm-*-transaction* -* traces-apm* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://en.wikipedia.org/wiki/HTTP_403 - -*Tags*: - -* Elastic -* APM - -*Version*: 8 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -http.response.status_code:403 and http.request.method:post - ----------------------------------- diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-web-application-suspicious-activity-unauthorized-method.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-web-application-suspicious-activity-unauthorized-method.asciidoc deleted file mode 100644 index b72c873dd0..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-web-application-suspicious-activity-unauthorized-method.asciidoc +++ /dev/null @@ -1,48 +0,0 @@ -[[prebuilt-rule-0-14-1-web-application-suspicious-activity-unauthorized-method]] -=== Web Application Suspicious Activity: Unauthorized Method - -A request to a web application returned a 405 response, which indicates the web application declined to process the request because the HTTP method is not allowed for the resource. - -*Rule type*: query - -*Rule indices*: - -* apm-*-transaction* -* traces-apm* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://en.wikipedia.org/wiki/HTTP_405 - -*Tags*: - -* Elastic -* APM - -*Version*: 8 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -http.response.status_code:405 - ----------------------------------- diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-webshell-detection-script-process-child-of-common-web-processes.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-webshell-detection-script-process-child-of-common-web-processes.asciidoc deleted file mode 100644 index 76243b461c..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-webshell-detection-script-process-child-of-common-web-processes.asciidoc +++ /dev/null @@ -1,87 +0,0 @@ -[[prebuilt-rule-0-14-1-webshell-detection-script-process-child-of-common-web-processes]] -=== Webshell Detection: Script Process Child of Common Web Processes - -Identifies suspicious commands executed via a web server, which may suggest a vulnerability and remote shell access. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: high - -*Risk score*: 73 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.microsoft.com/security/blog/2020/02/04/ghost-in-the-shell-investigating-web-shell-attacks/ - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Persistence - -*Version*: 1 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Triage and analysis - -Detections should be investigated to identify if the activity corresponds to legitimate activity. As this rule detects post-exploitation process activity, investigations into this should be prioritized. ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type == "start" and - process.parent.name : ("w3wp.exe", "httpd.exe", "nginx.exe", "php.exe", "php-cgi.exe", "tomcat.exe") and - process.name : ("cmd.exe", "cscript.exe", "powershell.exe", "pwsh.exe", "wmic.exe", "wscript.exe") - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Persistence -** ID: TA0003 -** Reference URL: https://attack.mitre.org/tactics/TA0003/ -* Technique: -** Name: Server Software Component -** ID: T1505 -** Reference URL: https://attack.mitre.org/techniques/T1505/ -* Sub-technique: -** Name: Web Shell -** ID: T1505.003 -** Reference URL: https://attack.mitre.org/techniques/T1505/003/ -* Tactic: -** Name: Initial Access -** ID: TA0001 -** Reference URL: https://attack.mitre.org/tactics/TA0001/ -* Technique: -** Name: Exploit Public-Facing Application -** ID: T1190 -** Reference URL: https://attack.mitre.org/techniques/T1190/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-whitespace-padding-in-process-command-line.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-whitespace-padding-in-process-command-line.asciidoc deleted file mode 100644 index 406ff85eab..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-whitespace-padding-in-process-command-line.asciidoc +++ /dev/null @@ -1,74 +0,0 @@ -[[prebuilt-rule-0-14-1-whitespace-padding-in-process-command-line]] -=== Whitespace Padding in Process Command Line - -Identifies process execution events where the command line value contains a long sequence of whitespace characters or multiple occurrences of contiguous whitespace. Attackers may attempt to evade signature-based detections by padding their malicious command with unnecessary whitespace characters. These observations should be investigated for malicious behavior. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://twitter.com/JohnLaTwC/status/1419251082736201737 - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Defense Evasion - -*Version*: 1 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Triage and analysis - -- Analyze the command line of the process in question for evidence of malicious code execution. -- Review the ancestry and child processes spawned by the process in question for indicators of further malicious code execution. ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type in ("start", "process_started") and - process.command_line regex ".*[ ]{20,}.*" or - - /* this will match on 3 or more separate occurrences of 5+ contiguous whitespace characters */ - process.command_line regex ".*(.*[ ]{5,}[^ ]*){3,}.*" - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Defense Evasion -** ID: TA0005 -** Reference URL: https://attack.mitre.org/tactics/TA0005/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-windows-defender-disabled-via-registry-modification.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-windows-defender-disabled-via-registry-modification.asciidoc deleted file mode 100644 index 5f069a0e62..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-windows-defender-disabled-via-registry-modification.asciidoc +++ /dev/null @@ -1,85 +0,0 @@ -[[prebuilt-rule-0-14-1-windows-defender-disabled-via-registry-modification]] -=== Windows Defender Disabled via Registry Modification - -Identifies modifications to the Windows Defender registry settings to disable the service or set the service to be started manually. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://thedfirreport.com/2020/12/13/defender-control/ - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Defense Evasion - -*Version*: 3 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Triage and analysis - -Detections should be investigated to identify if the hosts and users are authorized to use this tool. As this rule detects post-exploitation process activity, investigations into this should be prioritized. ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -registry where event.type in ("creation", "change") and - ((registry.path:"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\DisableAntiSpyware" and - registry.data.strings:"1") or - (registry.path:"HKLM\\System\\ControlSet*\\Services\\WinDefend\\Start" and - registry.data.strings in ("3", "4"))) - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Defense Evasion -** ID: TA0005 -** Reference URL: https://attack.mitre.org/tactics/TA0005/ -* Technique: -** Name: Impair Defenses -** ID: T1562 -** Reference URL: https://attack.mitre.org/techniques/T1562/ -* Sub-technique: -** Name: Indicator Blocking -** ID: T1562.006 -** Reference URL: https://attack.mitre.org/techniques/T1562/006/ -* Sub-technique: -** Name: Disable or Modify Tools -** ID: T1562.001 -** Reference URL: https://attack.mitre.org/techniques/T1562/001/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-windows-defender-exclusions-added-via-powershell.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-windows-defender-exclusions-added-via-powershell.asciidoc deleted file mode 100644 index 08c5578880..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-windows-defender-exclusions-added-via-powershell.asciidoc +++ /dev/null @@ -1,95 +0,0 @@ -[[prebuilt-rule-0-14-1-windows-defender-exclusions-added-via-powershell]] -=== Windows Defender Exclusions Added via PowerShell - -Identifies modifications to the Windows Defender configuration settings using PowerShell to add exclusions at the folder directory or process level. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.bitdefender.com/files/News/CaseStudies/study/400/Bitdefender-PR-Whitepaper-MosaicLoader-creat5540-en-EN.pdf - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Defense Evasion - -*Version*: 2 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Triage and analysis - -Detections should be investigated to identify if the activity corresponds to legitimate activity used to put in exceptions for Windows Defender. As this rule detects post-exploitation process activity, investigations into this should be prioritized. ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type == "start" and - (process.name : ("powershell.exe", "pwsh.exe") or process.pe.original_file_name : ("powershell.exe", "pwsh.exe")) and - process.args : ("*Add-MpPreference*-Exclusion*", "*Set-MpPreference*-Exclusion*") - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Defense Evasion -** ID: TA0005 -** Reference URL: https://attack.mitre.org/tactics/TA0005/ -* Technique: -** Name: Impair Defenses -** ID: T1562 -** Reference URL: https://attack.mitre.org/techniques/T1562/ -* Sub-technique: -** Name: Indicator Blocking -** ID: T1562.006 -** Reference URL: https://attack.mitre.org/techniques/T1562/006/ -* Sub-technique: -** Name: Disable or Modify Tools -** ID: T1562.001 -** Reference URL: https://attack.mitre.org/techniques/T1562/001/ -* Tactic: -** Name: Execution -** ID: TA0002 -** Reference URL: https://attack.mitre.org/tactics/TA0002/ -* Technique: -** Name: Command and Scripting Interpreter -** ID: T1059 -** Reference URL: https://attack.mitre.org/techniques/T1059/ -* Sub-technique: -** Name: PowerShell -** ID: T1059.001 -** Reference URL: https://attack.mitre.org/techniques/T1059/001/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-windows-network-enumeration.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-windows-network-enumeration.asciidoc deleted file mode 100644 index af2b33e6a5..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-windows-network-enumeration.asciidoc +++ /dev/null @@ -1,78 +0,0 @@ -[[prebuilt-rule-0-14-1-windows-network-enumeration]] -=== Windows Network Enumeration - -Identifies attempts to enumerate hosts in a network using the built-in Windows net.exe tool. - -*Rule type*: eql - -*Rule indices*: - -* logs-endpoint.events.* -* winlogbeat-* -* logs-windows.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Discovery - -*Version*: 4 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type in ("start", "process_started") and - ((process.name : "net.exe" or process.pe.original_file_name == "net.exe") or - ((process.name : "net1.exe" or process.pe.original_file_name == "net1.exe") and - not process.parent.name : "net.exe")) and - (process.args : "view" or (process.args : "time" and process.args : "\\\\*")) - - - /* expand when ancestry is available - and not descendant of [process where event.type == ("start", "process_started") and process.name : "cmd.exe" and - ((process.parent.name : "userinit.exe") or - (process.parent.name : "gpscript.exe") or - (process.parent.name : "explorer.exe" and - process.args : "C:\\*\\Start Menu\\Programs\\Startup\\*.bat*"))] - */ - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Discovery -** ID: TA0007 -** Reference URL: https://attack.mitre.org/tactics/TA0007/ -* Technique: -** Name: Remote System Discovery -** ID: T1018 -** Reference URL: https://attack.mitre.org/techniques/T1018/ -* Technique: -** Name: Network Share Discovery -** ID: T1135 -** Reference URL: https://attack.mitre.org/techniques/T1135/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rules-0-14-1-appendix.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rules-0-14-1-appendix.asciidoc deleted file mode 100644 index 02986b759b..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rules-0-14-1-appendix.asciidoc +++ /dev/null @@ -1,80 +0,0 @@ -["appendix",role="exclude",id="prebuilt-rule-0-14-1-prebuilt-rules-0-14-1-appendix"] -= Downloadable rule update v0.14.1 - -This section lists all updates associated with version 0.14.1 of the Fleet integration *Prebuilt Security Detection Rules*. - - -include::prebuilt-rule-0-14-1-aws-security-group-configuration-change-detection.asciidoc[] -include::prebuilt-rule-0-14-1-whitespace-padding-in-process-command-line.asciidoc[] -include::prebuilt-rule-0-14-1-webshell-detection-script-process-child-of-common-web-processes.asciidoc[] -include::prebuilt-rule-0-14-1-web-application-suspicious-activity-post-request-declined.asciidoc[] -include::prebuilt-rule-0-14-1-web-application-suspicious-activity-unauthorized-method.asciidoc[] -include::prebuilt-rule-0-14-1-suspicious-jar-child-process.asciidoc[] -include::prebuilt-rule-0-14-1-bash-shell-profile-modification.asciidoc[] -include::prebuilt-rule-0-14-1-aws-ec2-full-network-packet-capture-detected.asciidoc[] -include::prebuilt-rule-0-14-1-aws-rds-security-group-deletion.asciidoc[] -include::prebuilt-rule-0-14-1-spike-in-aws-error-messages.asciidoc[] -include::prebuilt-rule-0-14-1-rare-aws-error-code.asciidoc[] -include::prebuilt-rule-0-14-1-unusual-city-for-an-aws-command.asciidoc[] -include::prebuilt-rule-0-14-1-unusual-country-for-an-aws-command.asciidoc[] -include::prebuilt-rule-0-14-1-unusual-aws-command-for-a-user.asciidoc[] -include::prebuilt-rule-0-14-1-aws-rds-security-group-creation.asciidoc[] -include::prebuilt-rule-0-14-1-azure-active-directory-high-risk-sign-in.asciidoc[] -include::prebuilt-rule-0-14-1-application-added-to-google-workspace-domain.asciidoc[] -include::prebuilt-rule-0-14-1-domain-added-to-google-workspace-trusted-domains.asciidoc[] -include::prebuilt-rule-0-14-1-google-workspace-admin-role-deletion.asciidoc[] -include::prebuilt-rule-0-14-1-google-workspace-mfa-enforcement-disabled.asciidoc[] -include::prebuilt-rule-0-14-1-google-workspace-password-policy-modified.asciidoc[] -include::prebuilt-rule-0-14-1-mfa-disabled-for-google-workspace-organization.asciidoc[] -include::prebuilt-rule-0-14-1-google-workspace-admin-role-assigned-to-a-user.asciidoc[] -include::prebuilt-rule-0-14-1-google-workspace-api-access-granted-via-domain-wide-delegation-of-authority.asciidoc[] -include::prebuilt-rule-0-14-1-google-workspace-custom-admin-role-created.asciidoc[] -include::prebuilt-rule-0-14-1-google-workspace-role-modified.asciidoc[] -include::prebuilt-rule-0-14-1-o365-excessive-single-sign-on-logon-errors.asciidoc[] -include::prebuilt-rule-0-14-1-modification-of-dynamic-linker-preload-shared-object.asciidoc[] -include::prebuilt-rule-0-14-1-potential-privacy-control-bypass-via-tccdb-modification.asciidoc[] -include::prebuilt-rule-0-14-1-macos-installer-spawns-network-event.asciidoc[] -include::prebuilt-rule-0-14-1-persistence-via-docker-shortcut-modification.asciidoc[] -include::prebuilt-rule-0-14-1-finder-sync-plugin-registered-and-enabled.asciidoc[] -include::prebuilt-rule-0-14-1-spike-in-network-traffic.asciidoc[] -include::prebuilt-rule-0-14-1-anomalous-linux-compiler-activity.asciidoc[] -include::prebuilt-rule-0-14-1-anomalous-kernel-module-activity.asciidoc[] -include::prebuilt-rule-0-14-1-unusual-linux-network-activity.asciidoc[] -include::prebuilt-rule-0-14-1-anomalous-process-for-a-linux-population.asciidoc[] -include::prebuilt-rule-0-14-1-unusual-linux-username.asciidoc[] -include::prebuilt-rule-0-14-1-unusual-process-for-a-linux-host.asciidoc[] -include::prebuilt-rule-0-14-1-unusual-process-for-a-windows-host.asciidoc[] -include::prebuilt-rule-0-14-1-unusual-windows-network-activity.asciidoc[] -include::prebuilt-rule-0-14-1-anomalous-process-for-a-windows-population.asciidoc[] -include::prebuilt-rule-0-14-1-unusual-windows-username.asciidoc[] -include::prebuilt-rule-0-14-1-default-cobalt-strike-team-server-certificate.asciidoc[] -include::prebuilt-rule-0-14-1-dns-activity-to-the-internet.asciidoc[] -include::prebuilt-rule-0-14-1-roshal-archive-rar-or-powershell-file-downloaded-from-the-internet.asciidoc[] -include::prebuilt-rule-0-14-1-rdp-remote-desktop-protocol-from-the-internet.asciidoc[] -include::prebuilt-rule-0-14-1-telnet-port-activity.asciidoc[] -include::prebuilt-rule-0-14-1-vnc-virtual-network-computing-from-the-internet.asciidoc[] -include::prebuilt-rule-0-14-1-vnc-virtual-network-computing-to-the-internet.asciidoc[] -include::prebuilt-rule-0-14-1-rpc-remote-procedure-call-from-the-internet.asciidoc[] -include::prebuilt-rule-0-14-1-rpc-remote-procedure-call-to-the-internet.asciidoc[] -include::prebuilt-rule-0-14-1-smb-windows-file-sharing-activity-to-the-internet.asciidoc[] -include::prebuilt-rule-0-14-1-exporting-exchange-mailbox-via-powershell.asciidoc[] -include::prebuilt-rule-0-14-1-new-activesyncalloweddeviceid-added-via-powershell.asciidoc[] -include::prebuilt-rule-0-14-1-ntds-or-sam-database-file-copied.asciidoc[] -include::prebuilt-rule-0-14-1-modification-of-amsienable-registry-key.asciidoc[] -include::prebuilt-rule-0-14-1-windows-defender-disabled-via-registry-modification.asciidoc[] -include::prebuilt-rule-0-14-1-windows-defender-exclusions-added-via-powershell.asciidoc[] -include::prebuilt-rule-0-14-1-mshta-making-network-connections.asciidoc[] -include::prebuilt-rule-0-14-1-windows-network-enumeration.asciidoc[] -include::prebuilt-rule-0-14-1-external-ip-lookup-from-non-browser-process.asciidoc[] -include::prebuilt-rule-0-14-1-execution-of-file-written-or-modified-by-microsoft-office.asciidoc[] -include::prebuilt-rule-0-14-1-suspicious-wmi-image-load-from-ms-office.asciidoc[] -include::prebuilt-rule-0-14-1-disabling-user-account-control-via-registry-modification.asciidoc[] -include::prebuilt-rule-0-14-1-uac-bypass-attempt-with-ieditionupgrademanager-elevated-com-interface.asciidoc[] -include::prebuilt-rule-0-14-1-uac-bypass-attempt-via-elevated-com-internet-explorer-add-on-installer.asciidoc[] -include::prebuilt-rule-0-14-1-uac-bypass-via-icmluautil-elevated-com-interface.asciidoc[] -include::prebuilt-rule-0-14-1-uac-bypass-via-diskcleanup-scheduled-task-hijack.asciidoc[] -include::prebuilt-rule-0-14-1-uac-bypass-attempt-via-privileged-ifileoperation-com-interface.asciidoc[] -include::prebuilt-rule-0-14-1-bypass-uac-via-event-viewer.asciidoc[] -include::prebuilt-rule-0-14-1-uac-bypass-attempt-via-windows-directory-masquerading.asciidoc[] -include::prebuilt-rule-0-14-1-uac-bypass-via-windows-firewall-snap-in-hijack.asciidoc[] -include::prebuilt-rule-0-14-1-unusual-parent-child-relationship.asciidoc[] diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rules-0-14-1-summary.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rules-0-14-1-summary.asciidoc deleted file mode 100644 index cadb946ad6..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rules-0-14-1-summary.asciidoc +++ /dev/null @@ -1,160 +0,0 @@ -[[prebuilt-rule-0-14-1-prebuilt-rules-0-14-1-summary]] -[role="xpack"] -== Update v0.14.1 - -This section lists all updates associated with version 0.14.1 of the Fleet integration *Prebuilt Security Detection Rules*. - - -[width="100%",options="header"] -|============================================== -|Rule |Description |Status |Version - -|<> | Identifies a change to an AWS Security Group Configuration. A security group is like a virtul firewall and modifying configurations may allow unauthorized access. Threat actors may abuse this to establish persistence, exfiltrate data, or pivot in a AWS environment. | new | 1 - -|<> | Identifies process execution events where the command line value contains a long sequence of whitespace characters or multiple occurrences of contiguous whitespace. Attackers may attempt to evade signature-based detections by padding their malicious command with unnecessary whitespace characters. These observations should be investigated for malicious behavior. | new | 1 - -|<> | Identifies suspicious commands executed via a web server, which may suggest a vulnerability and remote shell access. | new | 1 - -|<> | A POST request to a web application returned a 403 response, which indicates the web application declined to process the request because the action requested was not allowed. | update | 8 - -|<> | A request to a web application returned a 405 response, which indicates the web application declined to process the request because the HTTP method is not allowed for the resource. | update | 8 - -|<> | Identifies suspicious child processes of a Java Archive (JAR) file. JAR files may be used to deliver malware in order to evade detection. | update | 2 - -|<> | Both ~/.bash_profile and ~/.bashrc are files containing shell commands that are run when Bash is invoked. These files are executed in a user's context, either interactively or non-interactively, when a user logs in so that their environment is set correctly. Adversaries may abuse this to establish persistence by executing malicious content triggered by a user’s shell. | update | 2 - -|<> | Identifies potential Traffic Mirroring in an Amazon Elastic Compute Cloud (EC2) instance. Traffic Mirroring is an Amazon VPC feature that you can use to copy network traffic from an Elastic network interface. This feature can potentially be abused to exfiltrate sensitive data from unencrypted internal traffic. | update | 2 - -|<> | Identifies the deletion of an Amazon Relational Database Service (RDS) Security group. | update | 2 - -|<> | A machine learning job detected a significant spike in the rate of a particular error in the CloudTrail messages. Spikes in error messages may accompany attempts at privilege escalation, lateral movement, or discovery. | update | 6 - -|<> | A machine learning job detected an unusual error in a CloudTrail message. These can be byproducts of attempted or successful persistence, privilege escalation, defense evasion, discovery, lateral movement, or collection. | update | 6 - -|<> | A machine learning job detected AWS command activity that, while not inherently suspicious or abnormal, is sourcing from a geolocation (city) that is unusual for the command. This can be the result of compromised credentials or keys being used by a threat actor in a different geography than the authorized user(s). | update | 6 - -|<> | A machine learning job detected AWS command activity that, while not inherently suspicious or abnormal, is sourcing from a geolocation (country) that is unusual for the command. This can be the result of compromised credentials or keys being used by a threat actor in a different geography than the authorized user(s). | update | 6 - -|<> | A machine learning job detected an AWS API command that, while not inherently suspicious or abnormal, is being made by a user context that does not normally use the command. This can be the result of compromised credentials or keys as someone uses a valid account to persist, move laterally, or exfiltrate data. | update | 6 - -|<> | Identifies the creation of an Amazon Relational Database Service (RDS) Security group. | update | 2 - -|<> | Identifies high risk Azure Active Directory (AD) sign-ins by leveraging Microsoft's Identity Protection machine learning and heuristics. Identity Protection categorizes risk into three tiers: low, medium, and high. While Microsoft does not provide specific details about how risk is calculated, each level brings higher confidence that the user or sign-in is compromised. | update | 3 - -|<> | Detects when a Google marketplace application is added to the Google Workspace domain. An adversary may add a malicious application to an organization’s Google Workspace domain in order to maintain a presence in their target’s organization and steal data. | update | 5 - -|<> | Detects when a domain is added to the list of trusted Google Workspace domains. An adversary may add a trusted domain in order to collect and exfiltrate data from their target’s organization with less restrictive security controls. | update | 5 - -|<> | Detects when a custom admin role is deleted. An adversary may delete a custom admin role in order to impact the permissions or capabilities of system administrators. | update | 5 - -|<> | Detects when multi-factor authentication (MFA) enforcement is disabled for Google Workspace users. An adversary may disable MFA enforcement in order to weaken an organization’s security controls. | update | 6 - -|<> | Detects when a Google Workspace password policy is modified. An adversary may attempt to modify a password policy in order to weaken an organization’s security controls. | update | 6 - -|<> | Detects when multi-factor authentication (MFA) is disabled for a Google Workspace organization. An adversary may attempt to modify a password policy in order to weaken an organization’s security controls. | update | 6 - -|<> | Detects when an admin role is assigned to a Google Workspace user. An adversary may assign an admin role to a user in order to elevate the permissions of another user account and persist in their target’s environment. | update | 5 - -|<> | Detects when a domain-wide delegation of authority is granted to a service account. Domain-wide delegation can be configured to grant third-party and internal applications to access the data of Google Workspace users. An adversary may configure domain-wide delegation to maintain access to their target’s data. | update | 5 - -|<> | Detects when a custom admin role is created in Google Workspace. An adversary may create a custom admin role in order to elevate the permissions of other user accounts and persist in their target’s environment. | update | 5 - -|<> | Detects when a custom admin role or its permissions are modified. An adversary may modify a custom admin role in order to elevate the permissions of other user accounts and persist in their target’s environment. | update | 5 - -|<> | Identifies accounts with a high number of single sign-on (SSO) logon errors. Excessive logon errors may indicate an attempt to brute force a password or SSO token. | update | 2 - -|<> | Identifies modification of the dynamic linker preload shared object (ld.so.preload). Adversaries may execute malicious payloads by hijacking the dynamic linker used to load libraries. | update | 2 - -|<> | Identifies the use of sqlite3 to directly modify the Transparency, Consent, and Control (TCC) SQLite database. This may indicate an attempt to bypass macOS privacy controls, including access to sensitive resources like the system camera, microphone, address book, and calendar. | update | 2 - -|<> | Identifies when the built in macOS Installer program generates a network event after attempting to install a .pkg file. This activity has been observed being leveraged by malware. | update | 3 - -|<> | An adversary can establish persistence by modifying an existing macOS dock property list in order to execute a malicious application instead of the intended one when invoked. | update | 2 - -|<> | Finder Sync plugins enable users to extend Finder’s functionality by modifying the user interface. Adversaries may abuse this feature by adding a rogue Finder Plugin to repeatedly execute malicious payloads for persistence. | update | 2 - -|<> | A machine learning job detected an unusually large spike in network traffic. Such a burst of traffic, if not caused by a surge in business activity, can be due to suspicious or malicious activity. Large-scale data exfiltration may produce a burst of network traffic; this could also be due to unusually large amounts of reconnaissance or enumeration traffic. Denial-of-service attacks or traffic floods may also produce such a surge in traffic. | update | 3 - -|<> | Looks for compiler activity by a user context which does not normally run compilers. This can be the result of ad-hoc software changes or unauthorized software deployment. This can also be due to local privilege elevation via locally run exploits or malware activity. | update | 3 - -|<> | Looks for unusual kernel module activity. Kernel modules are sometimes used by malware and persistence mechanisms for stealth. | update | 4 - -|<> | Identifies Linux processes that do not usually use the network but have unexpected network activity, which can indicate command-and-control, lateral movement, persistence, or data exfiltration activity. A process with unusual network activity can denote process exploitation or injection, where the process is used to run persistence mechanisms that allow a malicious actor remote access or control of the host, data exfiltration, and execution of unauthorized network applications. | update | 6 - -|<> | Searches for rare processes running on multiple Linux hosts in an entire fleet or network. This reduces the detection of false positives since automated maintenance processes usually only run occasionally on a single machine but are common to all or many hosts in a fleet. | update | 7 - -|<> | A machine learning job detected activity for a username that is not normally active, which can indicate unauthorized changes, activity by unauthorized users, lateral movement, or compromised credentials. In many organizations, new usernames are not often created apart from specific types of system activities, such as creating new accounts for new employees. These user accounts quickly become active and routine. Events from rarely used usernames can point to suspicious activity. Additionally, automated Linux fleets tend to see activity from rarely used usernames only when personnel log in to make authorized or unauthorized changes, or threat actors have acquired credentials and log in for malicious purposes. Unusual usernames can also indicate pivoting, where compromised credentials are used to try and move laterally from one host to another. | update | 7 - -|<> | Identifies rare processes that do not usually run on individual hosts, which can indicate execution of unauthorized services, malware, or persistence mechanisms. Processes are considered rare when they only run occasionally as compared with other processes running on the host. | update | 7 - -|<> | Identifies rare processes that do not usually run on individual hosts, which can indicate execution of unauthorized services, malware, or persistence mechanisms. Processes are considered rare when they only run occasionally as compared with other processes running on the host. | update | 7 - -|<> | Identifies Windows processes that do not usually use the network but have unexpected network activity, which can indicate command-and-control, lateral movement, persistence, or data exfiltration activity. A process with unusual network activity can denote process exploitation or injection, where the process is used to run persistence mechanisms that allow a malicious actor remote access or control of the host, data exfiltration, and execution of unauthorized network applications. | update | 7 - -|<> | Searches for rare processes running on multiple hosts in an entire fleet or network. This reduces the detection of false positives since automated maintenance processes usually only run occasionally on a single machine but are common to all or many hosts in a fleet. | update | 7 - -|<> | A machine learning job detected activity for a username that is not normally active, which can indicate unauthorized changes, activity by unauthorized users, lateral movement, or compromised credentials. In many organizations, new usernames are not often created apart from specific types of system activities, such as creating new accounts for new employees. These user accounts quickly become active and routine. Events from rarely used usernames can point to suspicious activity. Additionally, automated Linux fleets tend to see activity from rarely used usernames only when personnel log in to make authorized or unauthorized changes, or threat actors have acquired credentials and log in for malicious purposes. Unusual usernames can also indicate pivoting, where compromised credentials are used to try and move laterally from one host to another. | update | 7 - -|<> | This rule detects the use of the default Cobalt Strike Team Server TLS certificate. Cobalt Strike is software for Adversary Simulations and Red Team Operations which are security assessments that replicate the tactics and techniques of an advanced adversary in a network. Modifications to the Packetbeat configuration can be made to include MD5 and SHA256 hashing algorithms (the default is SHA1). See the References section for additional information on module configuration. | update | 6 - -|<> | This rule detects when an internal network client sends DNS traffic directly to the Internet. This is atypical behavior for a managed network and can be indicative of malware, exfiltration, command and control, or simply misconfiguration. This DNS activity also impacts your organization's ability to provide enterprise monitoring and logging of DNS and it opens your network to a variety of abuses and malicious communications. | update | 11 - -|<> | Detects a Roshal Archive (RAR) file or PowerShell script downloaded from the internet by an internal host. Gaining initial access to a system and then downloading encoded or encrypted tools to move laterally is a common practice for adversaries as a way to protect their more valuable tools and TTPs (tactics, techniques, and procedures). This may be atypical behavior for a managed network and can be indicative of malware, exfiltration, or command and control. | update | 7 - -|<> | This rule detects network events that may indicate the use of RDP traffic from the Internet. RDP is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector. | update | 11 - -|<> | This rule detects network events that may indicate the use of Telnet traffic. Telnet is commonly used by system administrators to remotely control older or embedded systems using the command line shell. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector. As a plain-text protocol, it may also expose usernames and passwords to anyone capable of observing the traffic. | update | 9 - -|<> | This rule detects network events that may indicate the use of VNC traffic from the Internet. VNC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector. | update | 11 - -|<> | This rule detects network events that may indicate the use of VNC traffic to the Internet. VNC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector. | update | 11 - -|<> | This rule detects network events that may indicate the use of RPC traffic from the Internet. RPC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector. | update | 11 - -|<> | This rule detects network events that may indicate the use of RPC traffic to the Internet. RPC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector. | update | 11 - -|<> | This rule detects network events that may indicate the use of Windows file sharing (also called SMB or CIFS) traffic to the Internet. SMB is commonly used within networks to share files, printers, and other system resources amongst trusted systems. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector or for data exfiltration. | update | 11 - -|<> | Identifies the use of the Exchange PowerShell cmdlet, New-MailBoxExportRequest, to export the contents of a primary mailbox or archive to a .pst file. Adversaries may target user email to collect sensitive information. | update | 4 - -|<> | Identifies the use of the Exchange PowerShell cmdlet, Set-CASMailbox, to add a new ActiveSync allowed device. Adversaries may target user email to collect sensitive information. | update | 4 - -|<> | Identifies a copy operation of the Active Directory Domain Database (ntds.dit) or Security Account Manager (SAM) files. Those files contain sensitive information including hashed domain and/or local credentials. | update | 4 - -|<> | JScript tries to query the AmsiEnable registry key from the HKEY_USERS registry hive before initializing Antimalware Scan Interface (AMSI). If this key is set to 0, AMSI is not enabled for the JScript process. An adversary can modify this key to disable AMSI protections. | update | 2 - -|<> | Identifies modifications to the Windows Defender registry settings to disable the service or set the service to be started manually. | update | 3 - -|<> | Identifies modifications to the Windows Defender configuration settings using PowerShell to add exclusions at the folder directory or process level. | update | 2 - -|<> | Identifies Mshta.exe making outbound network connections. This may indicate adversarial activity, as Mshta is often leveraged by adversaries to execute malicious scripts and evade detection. | update | 5 - -|<> | Identifies attempts to enumerate hosts in a network using the built-in Windows net.exe tool. | update | 4 - -|<> | Identifies domains commonly used by adversaries for post-exploitation IP lookups. It is common for adversaries to test for Internet access and acquire their external IP address after they have gained access to a system. Among others, this has been observed in campaigns leveraging the information stealer, Trickbot. | update | 6 - -|<> | Identifies an executable created by a Microsoft Office application and subsequently executed. These processes are often launched via scripts inside documents or during exploitation of Microsoft Office applications. | update | 5 - -|<> | Identifies a suspicious image load (wmiutils.dll) from Microsoft Office processes. This behavior may indicate adversarial activity where child processes are spawned via Windows Management Instrumentation (WMI). This technique can be used to execute code and evade traditional parent/child processes spawned from Microsoft Office products. | update | 4 - -|<> | User Account Control (UAC) can help mitigate the impact of malware on Windows hosts. With UAC, apps and tasks always run in the security context of a non-administrator account, unless an administrator specifically authorizes administrator-level access to the system. This rule identifies registry value changes to bypass User Access Control (UAC) protection. | update | 2 - -|<> | Identifies attempts to bypass User Account Control (UAC) by abusing an elevated COM Interface to launch a rogue Windows ClipUp program. Attackers may attempt to bypass UAC to stealthily execute code with elevated permissions. | update | 4 - -|<> | Identifies User Account Control (UAC) bypass attempts by abusing an elevated COM Interface to launch a malicious program. Attackers may attempt to bypass UAC to stealthily execute code with elevated permissions. | update | 4 - -|<> | Identifies User Account Control (UAC) bypass attempts via the ICMLuaUtil Elevated COM interface. Attackers may attempt to bypass UAC to stealthily execute code with elevated permissions. | update | 4 - -|<> | Identifies User Account Control (UAC) bypass via hijacking DiskCleanup Scheduled Task. Attackers bypass UAC to stealthily execute code with elevated permissions. | update | 6 - -|<> | Identifies attempts to bypass User Account Control (UAC) via DLL side-loading. Attackers may attempt to bypass UAC to stealthily execute code with elevated permissions. | update | 4 - -|<> | Identifies User Account Control (UAC) bypass via eventvwr.exe. Attackers bypass UAC to stealthily execute code with elevated permissions. | update | 9 - -|<> | Identifies an attempt to bypass User Account Control (UAC) by masquerading as a Microsoft trusted Windows directory. Attackers may bypass UAC to stealthily execute code with elevated permissions. | update | 4 - -|<> | Identifies attempts to bypass User Account Control (UAC) by hijacking the Microsoft Management Console (MMC) Windows Firewall snap-in. Attackers bypass UAC to stealthily execute code with elevated permissions. | update | 4 - -|<> | Identifies Windows programs run from unexpected parent processes. This could indicate masquerading or other strange activity on a system. | update | 9 - -|============================================== diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-abnormally-large-dns-response.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-abnormally-large-dns-response.asciidoc deleted file mode 100644 index ede4346622..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-abnormally-large-dns-response.asciidoc +++ /dev/null @@ -1,107 +0,0 @@ -[[prebuilt-rule-0-14-2-abnormally-large-dns-response]] -=== Abnormally Large DNS Response - -Specially crafted DNS requests can manipulate a known overflow vulnerability in some Windows DNS servers which result in Remote Code Execution (RCE) or a Denial of Service (DoS) from crashing the service. - -*Rule type*: query - -*Rule indices*: - -* packetbeat-* -* filebeat-* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://research.checkpoint.com/2020/resolving-your-way-into-domain-admin-exploiting-a-17-year-old-bug-in-windows-dns-servers/ -* https://msrc-blog.microsoft.com/2020/07/14/july-2020-security-update-cve-2020-1350-vulnerability-in-windows-domain-name-system-dns-server/ -* https://github.com/maxpl0it/CVE-2020-1350-DoS - -*Tags*: - -* Elastic -* Network -* Threat Detection -* Lateral Movement - -*Version*: 5 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Triage and analysis - -### Investigating Large DNS Responses -Detection alerts from this rule indicate possible anomalous activity around large byte DNS responses from a Windows DNS -server. This detection rule was created based on activity represented in exploitation of vulnerability (CVE-2020-1350) -also known as [SigRed](https://www.elastic.co/blog/detection-rules-for-sigred-vulnerability) during July 2020. - -#### Possible investigation steps: -- This specific rule is sourced from network log activity such as DNS or network level data. It's important to validate -the source of the incoming traffic and determine if this activity has been observed previously within an environment. -- Activity can be further investigated and validated by reviewing available corresponding Intrusion Detection Signatures (IDS) alerts associated with activity. -- Further examination can be made by reviewing the `dns.question_type` network fieldset with a protocol analyzer, such as Zeek, Packetbeat, or Suricata, for `SIG` or `RRSIG` data. -- Validate the patch level and OS of the targeted DNS server to validate the observed activity was not large-scale Internet vulnerability scanning. -- Validate that the source of the network activity was not from an authorized vulnerability scan or compromise assessment. - -#### False Positive Analysis -- Based on this rule which looks for a threshold of 60k bytes, it is possible for activity to be generated under 65k bytes -and related to legitimate behavior. In packet capture files received by the [SANS Internet Storm Center](https://isc.sans.edu/forums/diary/PATCH+NOW+SIGRed+CVE20201350+Microsoft+DNS+Server+Vulnerability/26356/), byte responses -were all observed as greater than 65k bytes. -- This activity has the ability to be triggered from compliance/vulnerability scanning or compromise assessment, it's -important to determine the source of the activity and potential whitelist the source host - - -### Related Rules -- Unusual Child Process of dns.exe -- Unusual File Modification by dns.exe - -### Response and Remediation -- Review and implement the above detection logic within your environment using technology such as Endpoint security, Winlogbeat, Packetbeat, or network security monitoring (NSM) platforms such as Zeek or Suricata. -- Ensure that you have deployed the latest Microsoft [Security Update](https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1350) (Monthly Rollup or Security Only) and restart the -patched machines. If unable to patch immediately: Microsoft [released](https://support.microsoft.com/en-us/help/4569509/windows-dns-server-remote-code-execution-vulnerability) a registry-based workaround that doesn’t require a -restart. This can be used as a temporary solution before the patch is applied. -- Maintain backups of your critical systems to aid in quick recovery. -- Perform routine vulnerability scans of your systems, monitor [CISA advisories](https://us-cert.cisa.gov/ncas/current-activity) and patch identified vulnerabilities. -- If observed true positive activity, implement a remediation plan and monitor host-based artifacts for additional post-exploitation behavior. - ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -event.category:(network or network_traffic) and destination.port:53 and - (event.dataset:zeek.dns or type:dns or event.type:connection) and network.bytes > 60000 - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Lateral Movement -** ID: TA0008 -** Reference URL: https://attack.mitre.org/tactics/TA0008/ -* Technique: -** Name: Exploitation of Remote Services -** ID: T1210 -** Reference URL: https://attack.mitre.org/techniques/T1210/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-adfind-command-activity.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-adfind-command-activity.asciidoc deleted file mode 100644 index 249b14b2b2..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-adfind-command-activity.asciidoc +++ /dev/null @@ -1,139 +0,0 @@ -[[prebuilt-rule-0-14-2-adfind-command-activity]] -=== AdFind Command Activity - -This rule detects the Active Directory query tool, AdFind.exe. AdFind has legitimate purposes, but it is frequently leveraged by threat actors to perform post-exploitation Active Directory reconnaissance. The AdFind tool has been observed in Trickbot, Ryuk, Maze, and FIN6 campaigns. For Winlogbeat, this rule requires Sysmon. - -*Rule type*: eql - -*Rule indices*: - -* logs-endpoint.events.* -* winlogbeat-* -* logs-windows.* - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* http://www.joeware.net/freetools/tools/adfind/ -* https://thedfirreport.com/2020/05/08/adfind-recon/ -* https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html -* https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware -* https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html -* https://usa.visa.com/dam/VCOM/global/support-legal/documents/fin6-cybercrime-group-expands-threat-To-ecommerce-merchants.pdf - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Discovery - -*Version*: 5 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Triage and analysis - -### Investigating AdFind Command Activity - -[AdFind](http://www.joeware.net/freetools/tools/adfind/) is a freely available command-line tool used to retrieve information from -Activity Directory (AD). Network discovery and enumeration tools like `AdFind` are useful to adversaries in the same ways -they are effective for network administrators. This tool provides quick ability to scope AD person/computer objects and -understand subnets and domain information. There are many [examples](https://thedfirreport.com/category/adfind/) -observed where this tool has been adopted by ransomware and criminal groups and used in compromises. - -#### Possible investigation steps: -- `AdFind` is a legitimate Active Directory enumeration tool used by network administrators, it's important to understand -the source of the activity. This could involve identifying the account using `AdFind` and determining based on the command-lines -what information was retrieved, then further determining if these actions are in scope of that user's traditional responsibilities. -- In multiple public references, `AdFind` is leveraged after initial access is achieved, review previous activity on impacted -machine looking for suspicious indicators such as previous anti-virus/EDR alerts, phishing emails received, or network traffic -to suspicious infrastructure - -### False Positive Analysis -- This rule has the high chance to produce false positives as it is a legitimate tool used by network administrators. One -option could be whitelisting specific users or groups who use the tool as part of their daily responsibilities. This can -be done by leveraging the exception workflow in the Kibana Security App or Elasticsearch API to tune this rule to your environment -- Malicious behavior with `AdFind` should be investigated as part of a step within an attack chain. It doesn't happen in -isolation, so reviewing previous logs/activity from impacted machines could be very telling. - -### Related Rules -- Windows Network Enumeration -- Enumeration of Administrator Accounts -- Enumeration Command Spawned via WMIPrvSE - -### Response and Remediation -- Immediate response should be taken to validate activity, investigate and potentially isolate activity to prevent further -post-compromise behavior -- It's important to understand that `AdFind` is an Active Directory enumeration tool and can be used for malicious or legitimate -purposes, so understanding the intent behind the activity will help determine the appropropriate response. - ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type in ("start", "process_started") and - (process.name : "AdFind.exe" or process.pe.original_file_name == "AdFind.exe") and - process.args : ("objectcategory=computer", "(objectcategory=computer)", - "objectcategory=person", "(objectcategory=person)", - "objectcategory=subnet", "(objectcategory=subnet)", - "objectcategory=group", "(objectcategory=group)", - "objectcategory=organizationalunit", "(objectcategory=organizationalunit)", - "objectcategory=attributeschema", "(objectcategory=attributeschema)", - "domainlist", "dcmodes", "adinfo", "dclist", "computers_pwnotreqd", "trustdmp") - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Discovery -** ID: TA0007 -** Reference URL: https://attack.mitre.org/tactics/TA0007/ -* Technique: -** Name: Permission Groups Discovery -** ID: T1069 -** Reference URL: https://attack.mitre.org/techniques/T1069/ -* Sub-technique: -** Name: Domain Groups -** ID: T1069.002 -** Reference URL: https://attack.mitre.org/techniques/T1069/002/ -* Technique: -** Name: Account Discovery -** ID: T1087 -** Reference URL: https://attack.mitre.org/techniques/T1087/ -* Sub-technique: -** Name: Domain Account -** ID: T1087.002 -** Reference URL: https://attack.mitre.org/techniques/T1087/002/ -* Technique: -** Name: Domain Trust Discovery -** ID: T1482 -** Reference URL: https://attack.mitre.org/techniques/T1482/ -* Technique: -** Name: Remote System Discovery -** ID: T1018 -** Reference URL: https://attack.mitre.org/techniques/T1018/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-aws-elasticache-security-group-created.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-aws-elasticache-security-group-created.asciidoc deleted file mode 100644 index 4d743966af..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-aws-elasticache-security-group-created.asciidoc +++ /dev/null @@ -1,78 +0,0 @@ -[[prebuilt-rule-0-14-2-aws-elasticache-security-group-created]] -=== AWS ElastiCache Security Group Created - -Identifies when an ElastiCache security group has been created. - -*Rule type*: query - -*Rule indices*: - -* filebeat-* -* logs-aws* - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 10m - -*Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_CreateCacheSecurityGroup.html - -*Tags*: - -* Elastic -* Cloud -* AWS -* Continuous Monitoring -* SecOps -* Monitoring - -*Version*: 1 - -*Rule authors*: - -* Austin Songer - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Config - -The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -event.dataset:aws.cloudtrail and event.provider:elasticache.amazonaws.com and event.action:"Create Cache Security Group" and -event.outcome:success - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Defense Evasion -** ID: TA0005 -** Reference URL: https://attack.mitre.org/tactics/TA0005/ -* Technique: -** Name: Impair Defenses -** ID: T1562 -** Reference URL: https://attack.mitre.org/techniques/T1562/ -* Sub-technique: -** Name: Disable or Modify Cloud Firewall -** ID: T1562.007 -** Reference URL: https://attack.mitre.org/techniques/T1562/007/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-aws-elasticache-security-group-modified-or-deleted.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-aws-elasticache-security-group-modified-or-deleted.asciidoc deleted file mode 100644 index c6db626dce..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-aws-elasticache-security-group-modified-or-deleted.asciidoc +++ /dev/null @@ -1,79 +0,0 @@ -[[prebuilt-rule-0-14-2-aws-elasticache-security-group-modified-or-deleted]] -=== AWS ElastiCache Security Group Modified or Deleted - -Identifies when an ElastiCache security group has been modified or deleted. - -*Rule type*: query - -*Rule indices*: - -* filebeat-* -* logs-aws* - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 10m - -*Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/Welcome.html - -*Tags*: - -* Elastic -* Cloud -* AWS -* Continuous Monitoring -* SecOps -* Monitoring - -*Version*: 1 - -*Rule authors*: - -* Austin Songer - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Config - -The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -event.dataset:aws.cloudtrail and event.provider:elasticache.amazonaws.com and event.action:("Delete Cache Security Group" or -"Authorize Cache Security Group Ingress" or "Revoke Cache Security Group Ingress" or "AuthorizeCacheSecurityGroupEgress" or -"RevokeCacheSecurityGroupEgress") and event.outcome:success - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Defense Evasion -** ID: TA0005 -** Reference URL: https://attack.mitre.org/tactics/TA0005/ -* Technique: -** Name: Impair Defenses -** ID: T1562 -** Reference URL: https://attack.mitre.org/techniques/T1562/ -* Sub-technique: -** Name: Disable or Modify Cloud Firewall -** ID: T1562.007 -** Reference URL: https://attack.mitre.org/techniques/T1562/007/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-aws-rds-instance-creation.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-aws-rds-instance-creation.asciidoc deleted file mode 100644 index 8726763604..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-aws-rds-instance-creation.asciidoc +++ /dev/null @@ -1,70 +0,0 @@ -[[prebuilt-rule-0-14-2-aws-rds-instance-creation]] -=== AWS RDS Instance Creation - -Identifies the creation of an Amazon Relational Database Service (RDS) Aurora database instance. - -*Rule type*: query - -*Rule indices*: - -* filebeat-* -* logs-aws* - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 10m - -*Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateDBInstance.html - -*Tags*: - -* Elastic -* Cloud -* AWS -* Continuous Monitoring -* SecOps -* Asset Visibility - -*Version*: 2 - -*Rule authors*: - -* Elastic -* Austin Songer - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Config - -The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -event.dataset:aws.cloudtrail and event.provider:rds.amazonaws.com and event.action:CreateDBInstance and event.outcome:success - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Persistence -** ID: TA0003 -** Reference URL: https://attack.mitre.org/tactics/TA0003/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-aws-rds-snapshot-export.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-aws-rds-snapshot-export.asciidoc deleted file mode 100644 index e515b50626..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-aws-rds-snapshot-export.asciidoc +++ /dev/null @@ -1,70 +0,0 @@ -[[prebuilt-rule-0-14-2-aws-rds-snapshot-export]] -=== AWS RDS Snapshot Export - -Identifies the export of an Amazon Relational Database Service (RDS) Aurora database snapshot. - -*Rule type*: query - -*Rule indices*: - -* filebeat-* -* logs-aws* - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 10m - -*Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_StartExportTask.html - -*Tags*: - -* Elastic -* Cloud -* AWS -* Continuous Monitoring -* SecOps -* Asset Visibility - -*Version*: 2 - -*Rule authors*: - -* Elastic -* Austin Songer - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Config - -The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -event.dataset:aws.cloudtrail and event.provider:rds.amazonaws.com and event.action:StartExportTask and event.outcome:success - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Exfiltration -** ID: TA0010 -** Reference URL: https://attack.mitre.org/tactics/TA0010/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-aws-route-table-modified-or-deleted.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-aws-route-table-modified-or-deleted.asciidoc deleted file mode 100644 index 23086a7cda..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-aws-route-table-modified-or-deleted.asciidoc +++ /dev/null @@ -1,77 +0,0 @@ -[[prebuilt-rule-0-14-2-aws-route-table-modified-or-deleted]] -=== AWS Route Table Modified or Deleted - -Identifies when an AWS Route Table has been modified or deleted. - -*Rule type*: query - -*Rule indices*: - -* filebeat-* -* logs-aws* - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 10m - -*Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://github.com/easttimor/aws-incident-response#network-routing -* https://docs.datadoghq.com/security_platform/default_rules/cloudtrail-aws-route-table-modified -* https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ReplaceRoute.html -* https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ReplaceRouteTableAssociation -* https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteRouteTable.html -* https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteRoute.html -* https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisassociateRouteTable.html - -*Tags*: - -* Elastic -* Cloud -* AWS -* Continuous Monitoring -* SecOps -* Network Security - -*Version*: 1 - -*Rule authors*: - -* Elastic -* Austin Songer - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Config - -The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -event.dataset:aws.cloudtrail and event.provider:cloudtrail.amazonaws.com and event.action:(ReplaceRoute or ReplaceRouteTableAssociation or -DeleteRouteTable or DeleteRoute or DisassociateRouteTable) and event.outcome:success - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Persistence -** ID: TA0003 -** Reference URL: https://attack.mitre.org/tactics/TA0003/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-aws-security-group-configuration-change-detection.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-aws-security-group-configuration-change-detection.asciidoc deleted file mode 100644 index e9227879ce..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-aws-security-group-configuration-change-detection.asciidoc +++ /dev/null @@ -1,84 +0,0 @@ -[[prebuilt-rule-0-14-2-aws-security-group-configuration-change-detection]] -=== AWS Security Group Configuration Change Detection - -Identifies a change to an AWS Security Group Configuration. A security group is like a virtual firewall, and modifying configurations may allow unauthorized access. Threat actors may abuse this to establish persistence, exfiltrate data, or pivot in an AWS environment. - -*Rule type*: query - -*Rule indices*: - -* filebeat-* -* logs-aws* - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 10m - -*Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/ec2-security-groups.html - -*Tags*: - -* Elastic -* Cloud -* AWS -* Continuous Monitoring -* SecOps -* Network Security - -*Version*: 2 - -*Rule authors*: - -* Elastic -* Austin Songer - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Config - -The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -event.dataset:aws.cloudtrail and event.provider:iam.amazonaws.com and event.action:(AuthorizeSecurityGroupEgress or -CreateSecurityGroup or ModifyInstanceAttribute or ModifySecurityGroupRules or RevokeSecurityGroupEgress or -RevokeSecurityGroupIngress) and event.outcome:success - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Persistence -** ID: TA0003 -** Reference URL: https://attack.mitre.org/tactics/TA0003/ -* Tactic: -** Name: Defense Evasion -** ID: TA0005 -** Reference URL: https://attack.mitre.org/tactics/TA0005/ -* Technique: -** Name: Impair Defenses -** ID: T1562 -** Reference URL: https://attack.mitre.org/techniques/T1562/ -* Sub-technique: -** Name: Disable or Modify Cloud Firewall -** ID: T1562.007 -** Reference URL: https://attack.mitre.org/techniques/T1562/007/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-aws-sts-getsessiontoken-abuse.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-aws-sts-getsessiontoken-abuse.asciidoc deleted file mode 100644 index 4fb8e75d2b..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-aws-sts-getsessiontoken-abuse.asciidoc +++ /dev/null @@ -1,86 +0,0 @@ -[[prebuilt-rule-0-14-2-aws-sts-getsessiontoken-abuse]] -=== AWS STS GetSessionToken Abuse - -Identifies the suspicious use of GetSessionToken. Tokens could be created and used by attackers to move laterally and escalate privileges. - -*Rule type*: query - -*Rule indices*: - -* filebeat-* -* logs-aws* - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 5m - -*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://docs.aws.amazon.com/STS/latest/APIReference/API_GetSessionToken.html - -*Tags*: - -* Elastic -* Cloud -* AWS -* Continuous Monitoring -* SecOps -* Identity and Access - -*Version*: 1 - -*Rule authors*: - -* Austin Songer - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Config - -The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -event.dataset:aws.cloudtrail and event.provider:sts.amazonaws.com and event.action:GetSessionToken and -aws.cloudtrail.user_identity.type:IAMUser and event.outcome:success - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Privilege Escalation -** ID: TA0004 -** Reference URL: https://attack.mitre.org/tactics/TA0004/ -* Technique: -** Name: Abuse Elevation Control Mechanism -** ID: T1548 -** Reference URL: https://attack.mitre.org/techniques/T1548/ -* Tactic: -** Name: Lateral Movement -** ID: TA0008 -** Reference URL: https://attack.mitre.org/tactics/TA0008/ -* Technique: -** Name: Use Alternate Authentication Material -** ID: T1550 -** Reference URL: https://attack.mitre.org/techniques/T1550/ -* Sub-technique: -** Name: Application Access Token -** ID: T1550.001 -** Reference URL: https://attack.mitre.org/techniques/T1550/001/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-azure-frontdoor-web-application-firewall-waf-policy-deleted.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-azure-frontdoor-web-application-firewall-waf-policy-deleted.asciidoc deleted file mode 100644 index a484f41a47..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-azure-frontdoor-web-application-firewall-waf-policy-deleted.asciidoc +++ /dev/null @@ -1,77 +0,0 @@ -[[prebuilt-rule-0-14-2-azure-frontdoor-web-application-firewall-waf-policy-deleted]] -=== Azure Frontdoor Web Application Firewall (WAF) Policy Deleted - -Identifies the deletion of a Frontdoor Web Application Firewall (WAF) Policy in Azure. An adversary may delete a Frontdoor Web Application Firewall (WAF) Policy in an attempt to evade defenses and/or to eliminate barriers in carrying out their initiative. - -*Rule type*: query - -*Rule indices*: - -* filebeat-* -* logs-azure* - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 5m - -*Searches indices from*: now-25m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#networking - -*Tags*: - -* Elastic -* Cloud -* Azure -* Continuous Monitoring -* SecOps -* Network Security - -*Version*: 1 - -*Rule authors*: - -* Austin Songer - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Config - -The Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -event.dataset:azure.activitylogs and azure.activitylogs.operation_name:"MICROSOFT.NETWORK/FRONTDOORWEBAPPLICATIONFIREWALLPOLICIES/DELETE" and event.outcome:(Success or success) - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Defense Evasion -** ID: TA0005 -** Reference URL: https://attack.mitre.org/tactics/TA0005/ -* Technique: -** Name: Impair Defenses -** ID: T1562 -** Reference URL: https://attack.mitre.org/techniques/T1562/ -* Sub-technique: -** Name: Disable or Modify Tools -** ID: T1562.001 -** Reference URL: https://attack.mitre.org/techniques/T1562/001/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-clearing-windows-event-logs.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-clearing-windows-event-logs.asciidoc deleted file mode 100644 index 5449650b50..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-clearing-windows-event-logs.asciidoc +++ /dev/null @@ -1,68 +0,0 @@ -[[prebuilt-rule-0-14-2-clearing-windows-event-logs]] -=== Clearing Windows Event Logs - -Identifies attempts to clear or disable Windows event log stores using Windows wevetutil command. This is often done by attackers in an attempt to evade detection or destroy forensic evidence on a system. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Defense Evasion - -*Version*: 10 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type in ("process_started", "start") and - (process.name : "wevtutil.exe" or process.pe.original_file_name == "wevtutil.exe") and - process.args : ("/e:false", "cl", "clear-log") or - process.name : "powershell.exe" and process.args : "Clear-EventLog" - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Defense Evasion -** ID: TA0005 -** Reference URL: https://attack.mitre.org/tactics/TA0005/ -* Technique: -** Name: Indicator Removal on Host -** ID: T1070 -** Reference URL: https://attack.mitre.org/techniques/T1070/ -* Sub-technique: -** Name: Clear Windows Event Logs -** ID: T1070.001 -** Reference URL: https://attack.mitre.org/techniques/T1070/001/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-connection-to-commonly-abused-web-services.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-connection-to-commonly-abused-web-services.asciidoc deleted file mode 100644 index 166f612e9e..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-connection-to-commonly-abused-web-services.asciidoc +++ /dev/null @@ -1,122 +0,0 @@ -[[prebuilt-rule-0-14-2-connection-to-commonly-abused-web-services]] -=== Connection to Commonly Abused Web Services - -Adversaries may implement command and control communications that use common web services in order to hide their activity. This attack technique is typically targeted to an organization and uses web services common to the victim network which allows the adversary to blend into legitimate traffic. activity. These popular services are typically targeted since they have most likely been used before a compromise and allow adversaries to blend in the network. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Command and Control - -*Version*: 5 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -network where network.protocol == "dns" and - process.name != null and user.id not in ("S-1-5-18", "S-1-5-19", "S-1-5-20") and - /* Add new WebSvc domains here */ - dns.question.name : - ( - "raw.githubusercontent.*", - "*.pastebin.*", - "*drive.google.*", - "*docs.live.*", - "*api.dropboxapi.*", - "*dropboxusercontent.*", - "*onedrive.*", - "*4shared.*", - "*.file.io", - "*filebin.net", - "*slack-files.com", - "*ghostbin.*", - "*ngrok.*", - "*portmap.*", - "*serveo.net", - "*localtunnel.me", - "*pagekite.me", - "*localxpose.io", - "*notabug.org", - "rawcdn.githack.*", - "paste.nrecom.net", - "zerobin.net", - "controlc.com", - "requestbin.net" - ) and - /* Insert noisy false positives here */ - not process.executable : - ( - "?:\\Program Files\\*.exe", - "?:\\Program Files (x86)\\*.exe", - "?:\\Windows\\System32\\WWAHost.exe", - "?:\\Windows\\System32\\smartscreen.exe", - "?:\\Windows\\System32\\MicrosoftEdgeCP.exe", - "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe", - "?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe", - "?:\\Users\\*\\AppData\\Local\\Programs\\Fiddler\\Fiddler.exe", - "?:\\Users\\*\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe", - "?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe", - "?:\\Windows\\system32\\mobsync.exe", - "?:\\Windows\\SysWOW64\\mobsync.exe" - ) - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Command and Control -** ID: TA0011 -** Reference URL: https://attack.mitre.org/tactics/TA0011/ -* Technique: -** Name: Web Service -** ID: T1102 -** Reference URL: https://attack.mitre.org/techniques/T1102/ -* Tactic: -** Name: Exfiltration -** ID: TA0010 -** Reference URL: https://attack.mitre.org/tactics/TA0010/ -* Technique: -** Name: Exfiltration Over Web Service -** ID: T1567 -** Reference URL: https://attack.mitre.org/techniques/T1567/ -* Sub-technique: -** Name: Exfiltration to Code Repository -** ID: T1567.001 -** Reference URL: https://attack.mitre.org/techniques/T1567/001/ -* Sub-technique: -** Name: Exfiltration to Cloud Storage -** ID: T1567.002 -** Reference URL: https://attack.mitre.org/techniques/T1567/002/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-control-panel-process-with-unusual-arguments.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-control-panel-process-with-unusual-arguments.asciidoc deleted file mode 100644 index 8c00d8d306..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-control-panel-process-with-unusual-arguments.asciidoc +++ /dev/null @@ -1,82 +0,0 @@ -[[prebuilt-rule-0-14-2-control-panel-process-with-unusual-arguments]] -=== Control Panel Process with Unusual Arguments - -Identifies unusual instances of Control Panel with suspicious keywords or paths in the process command line value. Adversaries may abuse Control.exe to proxy execution of malicious code. - -*Rule type*: eql - -*Rule indices*: - -* logs-endpoint.events.* -* winlogbeat-* -* logs-windows.* - -*Severity*: high - -*Risk score*: 73 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.joesandbox.com/analysis/476188/1/html - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Defense Evasion - -*Version*: 1 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type in ("start", "process_started") and - process.executable : ("?:\\Windows\\SysWOW64\\control.exe", "?:\\Windows\\System32\\control.exe") and - process.command_line : - ("*.jpg*", - "*.png*", - "*.gif*", - "*.bmp*", - "*.jpeg*", - "*.TIFF*", - "*.inf*", - "*.dat*", - "*.cpl:*/*", - "*../../..*", - "*/AppData/Local/*", - "*:\\Users\\Public\\*", - "*\\AppData\\Local\\*") - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Defense Evasion -** ID: TA0005 -** Reference URL: https://attack.mitre.org/tactics/TA0005/ -* Technique: -** Name: Signed Binary Proxy Execution -** ID: T1218 -** Reference URL: https://attack.mitre.org/techniques/T1218/ -* Sub-technique: -** Name: Control Panel -** ID: T1218.002 -** Reference URL: https://attack.mitre.org/techniques/T1218/002/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-creation-of-a-hidden-local-user-account.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-creation-of-a-hidden-local-user-account.asciidoc deleted file mode 100644 index 020e566575..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-creation-of-a-hidden-local-user-account.asciidoc +++ /dev/null @@ -1,68 +0,0 @@ -[[prebuilt-rule-0-14-2-creation-of-a-hidden-local-user-account]] -=== Creation of a Hidden Local User Account - -Identifies the creation of a hidden local user account by appending the dollar sign to the account name. This is sometimes done by attackers to increase access to a system and avoid appearing in the results of accounts listing using the net users command. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: high - -*Risk score*: 73 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://blog.menasec.net/2019/02/threat-hunting-6-hiding-in-plain-sights_8.html -* https://github.com/CyberMonitor/APT_CyberCriminal_Campagin_Collections/tree/master/2020/2020.12.15.Lazarus_Campaign - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Persistence - -*Version*: 2 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -registry where registry.path : "HKLM\\SAM\\SAM\\Domains\\Account\\Users\\Names\\*$\\" - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Persistence -** ID: TA0003 -** Reference URL: https://attack.mitre.org/tactics/TA0003/ -* Technique: -** Name: Create Account -** ID: T1136 -** Reference URL: https://attack.mitre.org/techniques/T1136/ -* Sub-technique: -** Name: Local Account -** ID: T1136.001 -** Reference URL: https://attack.mitre.org/techniques/T1136/001/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-creation-or-modification-of-a-new-gpo-scheduled-task-or-service.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-creation-or-modification-of-a-new-gpo-scheduled-task-or-service.asciidoc deleted file mode 100644 index be8a815a6d..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-creation-or-modification-of-a-new-gpo-scheduled-task-or-service.asciidoc +++ /dev/null @@ -1,68 +0,0 @@ -[[prebuilt-rule-0-14-2-creation-or-modification-of-a-new-gpo-scheduled-task-or-service]] -=== Creation or Modification of a new GPO Scheduled Task or Service - -Detects the creation or modification of a new Group Policy based scheduled task or service. These methods are used for legitimate system administration, but can also be abused by an attacker with domain admin permissions to execute a malicious payload remotely on all or a subset of the domain joined machines. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Persistence - -*Version*: 6 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -file where event.type != "deletion" and - file.path : ("?:\\Windows\\SYSVOL\\domain\\Policies\\*\\MACHINE\\Preferences\\ScheduledTasks\\ScheduledTasks.xml", - "?:\\Windows\\SYSVOL\\domain\\Policies\\*\\MACHINE\\Preferences\\Preferences\\Services\\Services.xml") and - not process.name : "dfsrs.exe" - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Persistence -** ID: TA0003 -** Reference URL: https://attack.mitre.org/tactics/TA0003/ -* Technique: -** Name: Scheduled Task/Job -** ID: T1053 -** Reference URL: https://attack.mitre.org/techniques/T1053/ -* Sub-technique: -** Name: Scheduled Task -** ID: T1053.005 -** Reference URL: https://attack.mitre.org/techniques/T1053/005/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-creation-or-modification-of-domain-backup-dpapi-private-key.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-creation-or-modification-of-domain-backup-dpapi-private-key.asciidoc deleted file mode 100644 index 87a3a0c46a..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-creation-or-modification-of-domain-backup-dpapi-private-key.asciidoc +++ /dev/null @@ -1,82 +0,0 @@ -[[prebuilt-rule-0-14-2-creation-or-modification-of-domain-backup-dpapi-private-key]] -=== Creation or Modification of Domain Backup DPAPI private key - -Identifies the creation or modification of Domain Backup private keys. Adversaries may extract the Data Protection API (DPAPI) domain backup key from a Domain Controller (DC) to be able to decrypt any domain user master key file. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: high - -*Risk score*: 73 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.dsinternals.com/en/retrieving-dpapi-backup-keys-from-active-directory/ -* https://www.harmj0y.net/blog/redteaming/operational-guidance-for-offensive-user-dpapi-abuse/ - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Credential Access - -*Version*: 6 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Triage and analysis - -Domain DPAPI Backup keys are stored on domain controllers and can be dumped remotely with tools such as Mimikatz. The resulting .pvk private key can be used to decrypt ANY domain user masterkeys, which then can be used to decrypt any secrets protected by those keys. ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -file where event.type != "deletion" and file.name : ("ntds_capi_*.pfx", "ntds_capi_*.pvk") - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Credential Access -** ID: TA0006 -** Reference URL: https://attack.mitre.org/tactics/TA0006/ -* Technique: -** Name: Unsecured Credentials -** ID: T1552 -** Reference URL: https://attack.mitre.org/techniques/T1552/ -* Sub-technique: -** Name: Private Keys -** ID: T1552.004 -** Reference URL: https://attack.mitre.org/techniques/T1552/004/ -* Technique: -** Name: Credentials from Password Stores -** ID: T1555 -** Reference URL: https://attack.mitre.org/techniques/T1555/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-credential-acquisition-via-registry-hive-dumping.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-credential-acquisition-via-registry-hive-dumping.asciidoc deleted file mode 100644 index 3a21f3c18d..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-credential-acquisition-via-registry-hive-dumping.asciidoc +++ /dev/null @@ -1,74 +0,0 @@ -[[prebuilt-rule-0-14-2-credential-acquisition-via-registry-hive-dumping]] -=== Credential Acquisition via Registry Hive Dumping - -Identifies attempts to export a registry hive which may contain credentials using the Windows reg.exe tool. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: high - -*Risk score*: 73 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://medium.com/threatpunter/detecting-attempts-to-steal-passwords-from-the-registry-7512674487f8 - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Credential Access - -*Version*: 4 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type in ("start", "process_started") and - process.pe.original_file_name == "reg.exe" and - process.args : ("save", "export") and - process.args : ("hklm\\sam", "hklm\\security") - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Credential Access -** ID: TA0006 -** Reference URL: https://attack.mitre.org/tactics/TA0006/ -* Technique: -** Name: OS Credential Dumping -** ID: T1003 -** Reference URL: https://attack.mitre.org/techniques/T1003/ -* Sub-technique: -** Name: Security Account Manager -** ID: T1003.002 -** Reference URL: https://attack.mitre.org/techniques/T1003/002/ -* Sub-technique: -** Name: LSA Secrets -** ID: T1003.004 -** Reference URL: https://attack.mitre.org/techniques/T1003/004/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-deleting-backup-catalogs-with-wbadmin.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-deleting-backup-catalogs-with-wbadmin.asciidoc deleted file mode 100644 index 34432436b5..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-deleting-backup-catalogs-with-wbadmin.asciidoc +++ /dev/null @@ -1,63 +0,0 @@ -[[prebuilt-rule-0-14-2-deleting-backup-catalogs-with-wbadmin]] -=== Deleting Backup Catalogs with Wbadmin - -Identifies use of the wbadmin.exe to delete the backup catalog. Ransomware and other malware may do this to prevent system recovery. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Impact - -*Version*: 10 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type in ("start", "process_started") and - (process.name : "wbadmin.exe" or process.pe.original_file_name == "WBADMIN.EXE") and - process.args : "catalog" and process.args : "delete" - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Impact -** ID: TA0040 -** Reference URL: https://attack.mitre.org/tactics/TA0040/ -* Technique: -** Name: Inhibit System Recovery -** ID: T1490 -** Reference URL: https://attack.mitre.org/techniques/T1490/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-direct-outbound-smb-connection.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-direct-outbound-smb-connection.asciidoc deleted file mode 100644 index a090c89422..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-direct-outbound-smb-connection.asciidoc +++ /dev/null @@ -1,68 +0,0 @@ -[[prebuilt-rule-0-14-2-direct-outbound-smb-connection]] -=== Direct Outbound SMB Connection - -Identifies unexpected processes making network connections over port 445. Windows File Sharing is typically implemented over Server Message Block (SMB), which communicates between hosts using port 445. When legitimate, these network connections are established by the kernel. Processes making 445/tcp connections may be port scanners, exploits, or suspicious user-level processes moving laterally. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Lateral Movement - -*Version*: 7 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -sequence by process.entity_id - [process where event.type == "start" and process.pid != 4] - [network where destination.port == 445 and process.pid != 4 and - not cidrmatch(destination.ip, "127.0.0.1", "::1")] - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Lateral Movement -** ID: TA0008 -** Reference URL: https://attack.mitre.org/tactics/TA0008/ -* Technique: -** Name: Remote Services -** ID: T1021 -** Reference URL: https://attack.mitre.org/techniques/T1021/ -* Sub-technique: -** Name: SMB/Windows Admin Shares -** ID: T1021.002 -** Reference URL: https://attack.mitre.org/techniques/T1021/002/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-disable-windows-event-and-security-logs-using-built-in-tools.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-disable-windows-event-and-security-logs-using-built-in-tools.asciidoc deleted file mode 100644 index 3194d67ce6..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-disable-windows-event-and-security-logs-using-built-in-tools.asciidoc +++ /dev/null @@ -1,78 +0,0 @@ -[[prebuilt-rule-0-14-2-disable-windows-event-and-security-logs-using-built-in-tools]] -=== Disable Windows Event and Security Logs Using Built-in Tools - -Identifies attempts to disable EventLog via the logman Windows utility, PowerShell, or auditpol. This is often done by attackers in an attempt to evade detection on a system. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/logman - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Defense Evasion - -*Version*: 2 - -*Rule authors*: - -* Elastic -* Ivan Ninichuck -* Austin Songer - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type in ("start", "process_started") and - - ((process.name:"logman.exe" or process.pe.original_file_name == "Logman.exe") and - process.args : "EventLog-*" and process.args : ("stop", "delete")) or - - ((process.name : ("pwsh.exe", "powershell.exe", "powershell_ise.exe") or process.pe.original_file_name in - ("pwsh.exe", "powershell.exe", "powershell_ise.exe")) and - process.args : "Set-Service" and process.args: "EventLog" and process.args : "Disabled") or - - ((process.name:"auditpol.exe" or process.pe.original_file_name == "AUDITPOL.EXE") and process.args : "/success:disable") - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Defense Evasion -** ID: TA0005 -** Reference URL: https://attack.mitre.org/tactics/TA0005/ -* Technique: -** Name: Indicator Removal on Host -** ID: T1070 -** Reference URL: https://attack.mitre.org/techniques/T1070/ -* Sub-technique: -** Name: Clear Windows Event Logs -** ID: T1070.001 -** Reference URL: https://attack.mitre.org/techniques/T1070/001/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-disable-windows-firewall-rules-via-netsh.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-disable-windows-firewall-rules-via-netsh.asciidoc deleted file mode 100644 index c1a0e44439..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-disable-windows-firewall-rules-via-netsh.asciidoc +++ /dev/null @@ -1,68 +0,0 @@ -[[prebuilt-rule-0-14-2-disable-windows-firewall-rules-via-netsh]] -=== Disable Windows Firewall Rules via Netsh - -Identifies use of the netsh.exe to disable or weaken the local firewall. Attackers will use this command line tool to disable the firewall during troubleshooting or to enable network mobility. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Defense Evasion - -*Version*: 10 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type in ("start", "process_started") and - process.name : "netsh.exe" and - (process.args : "disable" and process.args : "firewall" and process.args : "set") or - (process.args : "advfirewall" and process.args : "off" and process.args : "state") - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Defense Evasion -** ID: TA0005 -** Reference URL: https://attack.mitre.org/tactics/TA0005/ -* Technique: -** Name: Impair Defenses -** ID: T1562 -** Reference URL: https://attack.mitre.org/techniques/T1562/ -* Sub-technique: -** Name: Disable or Modify System Firewall -** ID: T1562.004 -** Reference URL: https://attack.mitre.org/techniques/T1562/004/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-dns-activity-to-the-internet.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-dns-activity-to-the-internet.asciidoc deleted file mode 100644 index 49a2058c92..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-dns-activity-to-the-internet.asciidoc +++ /dev/null @@ -1,95 +0,0 @@ -[[prebuilt-rule-0-14-2-dns-activity-to-the-internet]] -=== DNS Activity to the Internet - -This rule detects when an internal network client sends DNS traffic directly to the Internet. This is atypical behavior for a managed network and can be indicative of malware, exfiltration, command and control, or simply misconfiguration. This DNS activity also impacts your organization's ability to provide enterprise monitoring and logging of DNS, and it opens your network to a variety of abuses and malicious communications. - -*Rule type*: query - -*Rule indices*: - -* auditbeat-* -* filebeat-* -* packetbeat-* -* logs-endpoint.events.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.us-cert.gov/ncas/alerts/TA15-240A -* https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-81-2.pdf -* https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml - -*Tags*: - -* Elastic -* Network -* Threat Detection -* Command and Control -* Host - -*Version*: 12 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -event.category:(network or network_traffic) and (event.type:connection or type:dns) and (destination.port:53 or event.dataset:zeek.dns) - and source.ip:( - 10.0.0.0/8 or - 172.16.0.0/12 or - 192.168.0.0/16 - ) and - not destination.ip:( - 10.0.0.0/8 or - 127.0.0.0/8 or - 169.254.0.0/16 or - 172.16.0.0/12 or - 192.0.0.0/24 or - 192.0.0.0/29 or - 192.0.0.8/32 or - 192.0.0.9/32 or - 192.0.0.10/32 or - 192.0.0.170/32 or - 192.0.0.171/32 or - 192.0.2.0/24 or - 192.31.196.0/24 or - 192.52.193.0/24 or - 192.168.0.0/16 or - 192.88.99.0/24 or - 224.0.0.0/4 or - 100.64.0.0/10 or - 192.175.48.0/24 or - 198.18.0.0/15 or - 198.51.100.0/24 or - 203.0.113.0/24 or - 240.0.0.0/4 or - "::1" or - "FE80::/10" or - "FF00::/8" - ) - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Command and Control -** ID: TA0011 -** Reference URL: https://attack.mitre.org/tactics/TA0011/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-enable-host-network-discovery-via-netsh.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-enable-host-network-discovery-via-netsh.asciidoc deleted file mode 100644 index 7b42bef820..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-enable-host-network-discovery-via-netsh.asciidoc +++ /dev/null @@ -1,67 +0,0 @@ -[[prebuilt-rule-0-14-2-enable-host-network-discovery-via-netsh]] -=== Enable Host Network Discovery via Netsh - -Identifies use of the netsh.exe program to enable host discovery via the network. Attackers can use this command-line tool to weaken the host firewall settings. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Defense Evasion - -*Version*: 2 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type == "start" and -process.name : "netsh.exe" and -process.args : ("firewall", "advfirewall") and process.args : "group=Network Discovery" and process.args : "enable=Yes" - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Defense Evasion -** ID: TA0005 -** Reference URL: https://attack.mitre.org/tactics/TA0005/ -* Technique: -** Name: Impair Defenses -** ID: T1562 -** Reference URL: https://attack.mitre.org/techniques/T1562/ -* Sub-technique: -** Name: Disable or Modify System Firewall -** ID: T1562.004 -** Reference URL: https://attack.mitre.org/techniques/T1562/004/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-encoded-executable-stored-in-the-registry.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-encoded-executable-stored-in-the-registry.asciidoc deleted file mode 100644 index cae180fc09..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-encoded-executable-stored-in-the-registry.asciidoc +++ /dev/null @@ -1,67 +0,0 @@ -[[prebuilt-rule-0-14-2-encoded-executable-stored-in-the-registry]] -=== Encoded Executable Stored in the Registry - -Identifies registry write modifications to hide an encoded portable executable. This could be indicative of adversary defense evasion by avoiding the storing of malicious content directly on disk. - -*Rule type*: eql - -*Rule indices*: - -* logs-endpoint.events.* -* winlogbeat-* -* logs-windows.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Defense Evasion - -*Version*: 4 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -registry where -/* update here with encoding combinations */ - registry.data.strings : "TVqQAAMAAAAEAAAA*" - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Defense Evasion -** ID: TA0005 -** Reference URL: https://attack.mitre.org/tactics/TA0005/ -* Technique: -** Name: Deobfuscate/Decode Files or Information -** ID: T1140 -** Reference URL: https://attack.mitre.org/techniques/T1140/ -* Technique: -** Name: Modify Registry -** ID: T1112 -** Reference URL: https://attack.mitre.org/techniques/T1112/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-encrypting-files-with-winrar-or-7z.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-encrypting-files-with-winrar-or-7z.asciidoc deleted file mode 100644 index 6be4380754..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-encrypting-files-with-winrar-or-7z.asciidoc +++ /dev/null @@ -1,77 +0,0 @@ -[[prebuilt-rule-0-14-2-encrypting-files-with-winrar-or-7z]] -=== Encrypting Files with WinRar or 7z - -Identifies use of WinRar or 7z to create an encrypted files. Adversaries will often compress and encrypt data in preparation for exfiltration. - -*Rule type*: eql - -*Rule indices*: - -* logs-endpoint.events.* -* winlogbeat-* -* logs-windows.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.welivesecurity.com/2020/12/02/turla-crutch-keeping-back-door-open/ - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Collection - -*Version*: 4 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type in ("start", "process_started") and - ((process.name:"rar.exe" or process.code_signature.subject_name == "win.rar GmbH" or - process.pe.original_file_name == "Command line RAR") and - process.args == "a" and process.args : ("-hp*", "-p*", "-dw", "-tb", "-ta", "/hp*", "/p*", "/dw", "/tb", "/ta")) - - or - (process.pe.original_file_name in ("7z.exe", "7za.exe") and - process.args == "a" and process.args : ("-p*", "-sdel")) - - /* uncomment if noisy for backup software related FPs */ - /* not process.parent.executable : ("C:\\Program Files\\*.exe", "C:\\Program Files (x86)\\*.exe") */ - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Collection -** ID: TA0009 -** Reference URL: https://attack.mitre.org/tactics/TA0009/ -* Technique: -** Name: Archive Collected Data -** ID: T1560 -** Reference URL: https://attack.mitre.org/techniques/T1560/ -* Sub-technique: -** Name: Archive via Utility -** ID: T1560.001 -** Reference URL: https://attack.mitre.org/techniques/T1560/001/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-enumeration-command-spawned-via-wmiprvse.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-enumeration-command-spawned-via-wmiprvse.asciidoc deleted file mode 100644 index 07f3f20031..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-enumeration-command-spawned-via-wmiprvse.asciidoc +++ /dev/null @@ -1,103 +0,0 @@ -[[prebuilt-rule-0-14-2-enumeration-command-spawned-via-wmiprvse]] -=== Enumeration Command Spawned via WMIPrvSE - -Identifies native Windows host and network enumeration commands spawned by the Windows Management Instrumentation Provider Service (WMIPrvSE). - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Execution - -*Version*: 2 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type in ("start", "process_started") and - process.name: - ( - "arp.exe", - "dsquery.exe", - "dsget.exe", - "gpresult.exe", - "hostname.exe", - "ipconfig.exe", - "nbtstat.exe", - "net.exe", - "net1.exe", - "netsh.exe", - "netstat.exe", - "nltest.exe", - "ping.exe", - "qprocess.exe", - "quser.exe", - "qwinsta.exe", - "reg.exe", - "sc.exe", - "systeminfo.exe", - "tasklist.exe", - "tracert.exe", - "whoami.exe" - ) and - process.parent.name:"wmiprvse.exe" - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Execution -** ID: TA0002 -** Reference URL: https://attack.mitre.org/tactics/TA0002/ -* Technique: -** Name: Windows Management Instrumentation -** ID: T1047 -** Reference URL: https://attack.mitre.org/techniques/T1047/ -* Tactic: -** Name: Discovery -** ID: TA0007 -** Reference URL: https://attack.mitre.org/tactics/TA0007/ -* Technique: -** Name: Software Discovery -** ID: T1518 -** Reference URL: https://attack.mitre.org/techniques/T1518/ -* Technique: -** Name: Account Discovery -** ID: T1087 -** Reference URL: https://attack.mitre.org/techniques/T1087/ -* Technique: -** Name: Remote System Discovery -** ID: T1018 -** Reference URL: https://attack.mitre.org/techniques/T1018/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-enumeration-of-administrator-accounts.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-enumeration-of-administrator-accounts.asciidoc deleted file mode 100644 index 8d798cb5fd..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-enumeration-of-administrator-accounts.asciidoc +++ /dev/null @@ -1,80 +0,0 @@ -[[prebuilt-rule-0-14-2-enumeration-of-administrator-accounts]] -=== Enumeration of Administrator Accounts - -Identifies instances of lower privilege accounts enumerating Administrator accounts or groups using built-in Windows tools. - -*Rule type*: eql - -*Rule indices*: - -* logs-endpoint.events.* -* winlogbeat-* -* logs-windows.* - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Discovery - -*Version*: 4 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type in ("start", "process_started") and - (((process.name : "net.exe" or process.pe.original_file_name == "net.exe") or - ((process.name : "net1.exe" or process.pe.original_file_name == "net1.exe") and - not process.parent.name : "net.exe")) and - process.args : ("group", "user", "localgroup") and - process.args : ("admin", "Domain Admins", "Remote Desktop Users", "Enterprise Admins", "Organization Management") and - not process.args : "/add") - - or - - ((process.name : "wmic.exe" or process.pe.original_file_name == "wmic.exe") and - process.args : ("group", "useraccount")) - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Discovery -** ID: TA0007 -** Reference URL: https://attack.mitre.org/tactics/TA0007/ -* Technique: -** Name: Permission Groups Discovery -** ID: T1069 -** Reference URL: https://attack.mitre.org/techniques/T1069/ -* Sub-technique: -** Name: Domain Groups -** ID: T1069.002 -** Reference URL: https://attack.mitre.org/techniques/T1069/002/ -* Technique: -** Name: Account Discovery -** ID: T1087 -** Reference URL: https://attack.mitre.org/techniques/T1087/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-executable-file-creation-with-multiple-extensions.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-executable-file-creation-with-multiple-extensions.asciidoc deleted file mode 100644 index 828486db5e..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-executable-file-creation-with-multiple-extensions.asciidoc +++ /dev/null @@ -1,78 +0,0 @@ -[[prebuilt-rule-0-14-2-executable-file-creation-with-multiple-extensions]] -=== Executable File Creation with Multiple Extensions - -Masquerading can allow an adversary to evade defenses and better blend in with the environment. One way it occurs is when the name or location of a file is manipulated as a means of tricking a user into executing what they think is a benign file type but is actually executable code. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Defense Evasion - -*Version*: 3 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -file where event.type == "creation" and file.extension : "exe" and - file.name regex~ """.*\.(vbs|vbe|bat|js|cmd|wsh|ps1|pdf|docx?|xlsx?|pptx?|txt|rtf|gif|jpg|png|bmp|hta|txt|img|iso)\.exe""" - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Defense Evasion -** ID: TA0005 -** Reference URL: https://attack.mitre.org/tactics/TA0005/ -* Technique: -** Name: Masquerading -** ID: T1036 -** Reference URL: https://attack.mitre.org/techniques/T1036/ -* Sub-technique: -** Name: Masquerade Task or Service -** ID: T1036.004 -** Reference URL: https://attack.mitre.org/techniques/T1036/004/ -* Tactic: -** Name: Execution -** ID: TA0002 -** Reference URL: https://attack.mitre.org/tactics/TA0002/ -* Technique: -** Name: User Execution -** ID: T1204 -** Reference URL: https://attack.mitre.org/techniques/T1204/ -* Sub-technique: -** Name: Malicious File -** ID: T1204.002 -** Reference URL: https://attack.mitre.org/techniques/T1204/002/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-exporting-exchange-mailbox-via-powershell.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-exporting-exchange-mailbox-via-powershell.asciidoc deleted file mode 100644 index d5a24133d2..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-exporting-exchange-mailbox-via-powershell.asciidoc +++ /dev/null @@ -1,73 +0,0 @@ -[[prebuilt-rule-0-14-2-exporting-exchange-mailbox-via-powershell]] -=== Exporting Exchange Mailbox via PowerShell - -Identifies the use of the Exchange PowerShell cmdlet, New-MailBoxExportRequest, to export the contents of a primary mailbox or archive to a .pst file. Adversaries may target user email to collect sensitive information. - -*Rule type*: eql - -*Rule indices*: - -* logs-endpoint.events.* -* winlogbeat-* -* logs-windows.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/ -* https://docs.microsoft.com/en-us/powershell/module/exchange/new-mailboxexportrequest?view=exchange-ps - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Collection - -*Version*: 5 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type in ("start", "process_started") and - process.name: ("powershell.exe", "pwsh.exe") and process.args : "New-MailboxExportRequest*" - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Collection -** ID: TA0009 -** Reference URL: https://attack.mitre.org/tactics/TA0009/ -* Technique: -** Name: Email Collection -** ID: T1114 -** Reference URL: https://attack.mitre.org/techniques/T1114/ -* Sub-technique: -** Name: Remote Email Collection -** ID: T1114.002 -** Reference URL: https://attack.mitre.org/techniques/T1114/002/ -* Technique: -** Name: Data from Local System -** ID: T1005 -** Reference URL: https://attack.mitre.org/techniques/T1005/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-high-number-of-process-and-or-service-terminations.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-high-number-of-process-and-or-service-terminations.asciidoc deleted file mode 100644 index 499a9d00a8..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-high-number-of-process-and-or-service-terminations.asciidoc +++ /dev/null @@ -1,62 +0,0 @@ -[[prebuilt-rule-0-14-2-high-number-of-process-and-or-service-terminations]] -=== High Number of Process and/or Service Terminations - -This rule identifies a high number (10) of process terminations (stop, delete, or suspend) from the same host within a short time period. - -*Rule type*: threshold - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Impact - -*Version*: 3 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -event.category:process and event.type:start and process.name:(net.exe or sc.exe or taskkill.exe) and - process.args:(stop or pause or delete or "/PID" or "/IM" or "/T" or "/F" or "/t" or "/f" or "/im" or "/pid") - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Impact -** ID: TA0040 -** Reference URL: https://attack.mitre.org/tactics/TA0040/ -* Technique: -** Name: Service Stop -** ID: T1489 -** Reference URL: https://attack.mitre.org/techniques/T1489/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-iis-http-logging-disabled.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-iis-http-logging-disabled.asciidoc deleted file mode 100644 index e09e748913..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-iis-http-logging-disabled.asciidoc +++ /dev/null @@ -1,68 +0,0 @@ -[[prebuilt-rule-0-14-2-iis-http-logging-disabled]] -=== IIS HTTP Logging Disabled - -Identifies when Internet Information Services (IIS) HTTP Logging is disabled on a server. An attacker with IIS server access via a webshell or other mechanism can disable HTTP Logging as an effective anti-forensics measure. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: high - -*Risk score*: 73 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 33 - -*References*: None - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Defense Evasion - -*Version*: 6 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type in ("start", "process_started") and - (process.name : "appcmd.exe" or process.pe.original_file_name == "appcmd.exe") and - process.args : "/dontLog*:*True" and - not process.parent.name : "iissetup.exe" - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Defense Evasion -** ID: TA0005 -** Reference URL: https://attack.mitre.org/tactics/TA0005/ -* Technique: -** Name: Impair Defenses -** ID: T1562 -** Reference URL: https://attack.mitre.org/techniques/T1562/ -* Sub-technique: -** Name: Disable Windows Event Logging -** ID: T1562.002 -** Reference URL: https://attack.mitre.org/techniques/T1562/002/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-incoming-dcom-lateral-movement-via-mshta.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-incoming-dcom-lateral-movement-via-mshta.asciidoc deleted file mode 100644 index 89e1ad3718..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-incoming-dcom-lateral-movement-via-mshta.asciidoc +++ /dev/null @@ -1,86 +0,0 @@ -[[prebuilt-rule-0-14-2-incoming-dcom-lateral-movement-via-mshta]] -=== Incoming DCOM Lateral Movement via MSHTA - -Identifies the use of Distributed Component Object Model (DCOM) to execute commands from a remote host, which are launched via the HTA Application COM Object. This behavior may indicate an attacker abusing a DCOM application to move laterally while attempting to evading detection. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: high - -*Risk score*: 73 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://codewhitesec.blogspot.com/2018/07/lethalhta.html - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Lateral Movement - -*Version*: 3 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -sequence with maxspan=1m - [process where event.type in ("start", "process_started") and - process.name : "mshta.exe" and process.args : "-Embedding" - ] by host.id, process.entity_id - [network where event.type == "start" and process.name : "mshta.exe" and - network.direction == "incoming" and network.transport == "tcp" and - source.port > 49151 and destination.port > 49151 and not source.address in ("127.0.0.1", "::1") - ] by host.id, process.entity_id - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Lateral Movement -** ID: TA0008 -** Reference URL: https://attack.mitre.org/tactics/TA0008/ -* Technique: -** Name: Remote Services -** ID: T1021 -** Reference URL: https://attack.mitre.org/techniques/T1021/ -* Sub-technique: -** Name: Distributed Component Object Model -** ID: T1021.003 -** Reference URL: https://attack.mitre.org/techniques/T1021/003/ -* Tactic: -** Name: Defense Evasion -** ID: TA0005 -** Reference URL: https://attack.mitre.org/tactics/TA0005/ -* Technique: -** Name: Signed Binary Proxy Execution -** ID: T1218 -** Reference URL: https://attack.mitre.org/techniques/T1218/ -* Sub-technique: -** Name: Mshta -** ID: T1218.005 -** Reference URL: https://attack.mitre.org/techniques/T1218/005/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-incoming-dcom-lateral-movement-with-mmc.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-incoming-dcom-lateral-movement-with-mmc.asciidoc deleted file mode 100644 index 8b15f618c4..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-incoming-dcom-lateral-movement-with-mmc.asciidoc +++ /dev/null @@ -1,73 +0,0 @@ -[[prebuilt-rule-0-14-2-incoming-dcom-lateral-movement-with-mmc]] -=== Incoming DCOM Lateral Movement with MMC - -Identifies the use of Distributed Component Object Model (DCOM) to run commands from a remote host, which are launched via the MMC20 Application COM Object. This behavior may indicate an attacker abusing a DCOM application to move laterally. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: high - -*Risk score*: 73 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://enigma0x3.net/2017/01/05/lateral-movement-using-the-mmc20-application-com-object/ - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Lateral Movement - -*Version*: 3 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -sequence by host.id with maxspan=1m - [network where event.type == "start" and process.name : "mmc.exe" and - source.port >= 49152 and destination.port >= 49152 and source.address not in ("127.0.0.1", "::1") and - network.direction == "incoming" and network.transport == "tcp" - ] by process.entity_id - [process where event.type in ("start", "process_started") and process.parent.name : "mmc.exe" - ] by process.parent.entity_id - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Lateral Movement -** ID: TA0008 -** Reference URL: https://attack.mitre.org/tactics/TA0008/ -* Technique: -** Name: Remote Services -** ID: T1021 -** Reference URL: https://attack.mitre.org/techniques/T1021/ -* Sub-technique: -** Name: Distributed Component Object Model -** ID: T1021.003 -** Reference URL: https://attack.mitre.org/techniques/T1021/003/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-incoming-dcom-lateral-movement-with-shellbrowserwindow-or-shellwindows.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-incoming-dcom-lateral-movement-with-shellbrowserwindow-or-shellwindows.asciidoc deleted file mode 100644 index 63fa063cab..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-incoming-dcom-lateral-movement-with-shellbrowserwindow-or-shellwindows.asciidoc +++ /dev/null @@ -1,74 +0,0 @@ -[[prebuilt-rule-0-14-2-incoming-dcom-lateral-movement-with-shellbrowserwindow-or-shellwindows]] -=== Incoming DCOM Lateral Movement with ShellBrowserWindow or ShellWindows - -Identifies use of Distributed Component Object Model (DCOM) to run commands from a remote host, which are launched via the ShellBrowserWindow or ShellWindows Application COM Object. This behavior may indicate an attacker abusing a DCOM application to stealthily move laterally. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://enigma0x3.net/2017/01/23/lateral-movement-via-dcom-round-2/ - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Lateral Movement - -*Version*: 3 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -sequence by host.id with maxspan=5s - [network where event.type == "start" and process.name : "explorer.exe" and - network.direction == "incoming" and network.transport == "tcp" and - source.port > 49151 and destination.port > 49151 and not source.address in ("127.0.0.1", "::1") - ] by process.entity_id - [process where event.type in ("start", "process_started") and - process.parent.name : "explorer.exe" - ] by process.parent.entity_id - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Lateral Movement -** ID: TA0008 -** Reference URL: https://attack.mitre.org/tactics/TA0008/ -* Technique: -** Name: Remote Services -** ID: T1021 -** Reference URL: https://attack.mitre.org/techniques/T1021/ -* Sub-technique: -** Name: Distributed Component Object Model -** ID: T1021.003 -** Reference URL: https://attack.mitre.org/techniques/T1021/003/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-kerberos-cached-credentials-dumping.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-kerberos-cached-credentials-dumping.asciidoc deleted file mode 100644 index 21f0273af7..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-kerberos-cached-credentials-dumping.asciidoc +++ /dev/null @@ -1,73 +0,0 @@ -[[prebuilt-rule-0-14-2-kerberos-cached-credentials-dumping]] -=== Kerberos Cached Credentials Dumping - -Identifies the use of the Kerberos credential cache (kcc) utility to dump locally cached Kerberos tickets. - -*Rule type*: query - -*Rule indices*: - -* auditbeat-* -* logs-endpoint.events.* - -*Severity*: high - -*Risk score*: 73 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://github.com/EmpireProject/EmPyre/blob/master/lib/modules/collection/osx/kerberosdump.py -* https://opensource.apple.com/source/Heimdal/Heimdal-323.12/kuser/kcc-commands.in.auto.html - -*Tags*: - -* Elastic -* Host -* macOS -* Threat Detection -* Credential Access - -*Version*: 4 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -event.category:process and event.type:(start or process_started) and - process.name:kcc and - process.args:copy_cred_cache - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Credential Access -** ID: TA0006 -** Reference URL: https://attack.mitre.org/tactics/TA0006/ -* Technique: -** Name: OS Credential Dumping -** ID: T1003 -** Reference URL: https://attack.mitre.org/techniques/T1003/ -* Technique: -** Name: Steal or Forge Kerberos Tickets -** ID: T1558 -** Reference URL: https://attack.mitre.org/techniques/T1558/ -* Sub-technique: -** Name: Kerberoasting -** ID: T1558.003 -** Reference URL: https://attack.mitre.org/techniques/T1558/003/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-lsass-memory-dump-creation.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-lsass-memory-dump-creation.asciidoc deleted file mode 100644 index 3d2364ef57..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-lsass-memory-dump-creation.asciidoc +++ /dev/null @@ -1,68 +0,0 @@ -[[prebuilt-rule-0-14-2-lsass-memory-dump-creation]] -=== LSASS Memory Dump Creation - -Identifies the creation of a Local Security Authority Subsystem Service (lsass.exe) default memory dump. This may indicate a credential access attempt via trusted system utilities such as Task Manager (taskmgr.exe) and SQL Dumper (sqldumper.exe) or known pentesting tools such as Dumpert and AndrewSpecial. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: high - -*Risk score*: 73 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://github.com/outflanknl/Dumpert -* https://github.com/hoangprod/AndrewSpecial - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Credential Access - -*Version*: 5 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -file where file.name : ("lsass*.dmp", "dumpert.dmp", "Andrew.dmp", "SQLDmpr*.mdmp", "Coredump.dmp") - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Credential Access -** ID: TA0006 -** Reference URL: https://attack.mitre.org/tactics/TA0006/ -* Technique: -** Name: OS Credential Dumping -** ID: T1003 -** Reference URL: https://attack.mitre.org/techniques/T1003/ -* Sub-technique: -** Name: LSASS Memory -** ID: T1003.001 -** Reference URL: https://attack.mitre.org/techniques/T1003/001/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-microsoft-365-potential-ransomware-activity.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-microsoft-365-potential-ransomware-activity.asciidoc deleted file mode 100644 index 730e738c15..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-microsoft-365-potential-ransomware-activity.asciidoc +++ /dev/null @@ -1,75 +0,0 @@ -[[prebuilt-rule-0-14-2-microsoft-365-potential-ransomware-activity]] -=== Microsoft 365 Potential ransomware activity - -Identifies when Microsoft Cloud App Security reported when a user uploads files to the cloud that might be infected with ransomware. - -*Rule type*: query - -*Rule indices*: - -* filebeat-* -* logs-o365* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://docs.microsoft.com/en-us/cloud-app-security/anomaly-detection-policy -* https://docs.microsoft.com/en-us/cloud-app-security/policy-template-reference - -*Tags*: - -* Elastic -* Cloud -* Microsoft 365 -* Continuous Monitoring -* SecOps -* Configuration Audit - -*Version*: 1 - -*Rule authors*: - -* Austin Songer - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Config - -The Microsoft 365 Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. - ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -event.dataset:o365.audit and event.provider:SecurityComplianceCenter and event.category:web and event.action:"Potential ransomware activity" and event.outcome:success - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Impact -** ID: TA0040 -** Reference URL: https://attack.mitre.org/tactics/TA0040/ -* Technique: -** Name: Data Encrypted for Impact -** ID: T1486 -** Reference URL: https://attack.mitre.org/techniques/T1486/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-microsoft-365-unusual-volume-of-file-deletion.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-microsoft-365-unusual-volume-of-file-deletion.asciidoc deleted file mode 100644 index 96658ce12b..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-microsoft-365-unusual-volume-of-file-deletion.asciidoc +++ /dev/null @@ -1,75 +0,0 @@ -[[prebuilt-rule-0-14-2-microsoft-365-unusual-volume-of-file-deletion]] -=== Microsoft 365 Unusual Volume of File Deletion - -Identifies that a user has deleted an unusually large volume of files as reported by Microsoft Cloud App Security. - -*Rule type*: query - -*Rule indices*: - -* filebeat-* -* logs-o365* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://docs.microsoft.com/en-us/cloud-app-security/anomaly-detection-policy -* https://docs.microsoft.com/en-us/cloud-app-security/policy-template-reference - -*Tags*: - -* Elastic -* Cloud -* Microsoft 365 -* Continuous Monitoring -* SecOps -* Configuration Audit - -*Version*: 1 - -*Rule authors*: - -* Austin Songer - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Config - -The Microsoft 365 Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. - ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -event.dataset:o365.audit and event.provider:SecurityComplianceCenter and event.category:web and event.action:"Unusual volume of file deletion" and event.outcome:success - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Impact -** ID: TA0040 -** Reference URL: https://attack.mitre.org/tactics/TA0040/ -* Technique: -** Name: Data Destruction -** ID: T1485 -** Reference URL: https://attack.mitre.org/techniques/T1485/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-microsoft-365-user-restricted-from-sending-email.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-microsoft-365-user-restricted-from-sending-email.asciidoc deleted file mode 100644 index e834edfe81..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-microsoft-365-user-restricted-from-sending-email.asciidoc +++ /dev/null @@ -1,75 +0,0 @@ -[[prebuilt-rule-0-14-2-microsoft-365-user-restricted-from-sending-email]] -=== Microsoft 365 User Restricted from Sending Email - -Identifies when a user has been restricted from sending email due to exceeding sending limits of the service policies per the Security Compliance Center. - -*Rule type*: query - -*Rule indices*: - -* filebeat-* -* logs-o365* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://docs.microsoft.com/en-us/cloud-app-security/anomaly-detection-policy -* https://docs.microsoft.com/en-us/cloud-app-security/policy-template-reference - -*Tags*: - -* Elastic -* Cloud -* Microsoft 365 -* Continuous Monitoring -* SecOps -* Configuration Audit - -*Version*: 1 - -*Rule authors*: - -* Austin Songer - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Config - -The Microsoft 365 Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. - ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -event.dataset:o365.audit and event.provider:SecurityComplianceCenter and event.category:web and event.action:"User restricted from sending email" and event.outcome:success - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Initial Access -** ID: TA0001 -** Reference URL: https://attack.mitre.org/tactics/TA0001/ -* Technique: -** Name: Valid Accounts -** ID: T1078 -** Reference URL: https://attack.mitre.org/techniques/T1078/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-microsoft-build-engine-started-by-a-script-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-microsoft-build-engine-started-by-a-script-process.asciidoc deleted file mode 100644 index a9118ed35a..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-microsoft-build-engine-started-by-a-script-process.asciidoc +++ /dev/null @@ -1,71 +0,0 @@ -[[prebuilt-rule-0-14-2-microsoft-build-engine-started-by-a-script-process]] -=== Microsoft Build Engine Started by a Script Process - -An instance of MSBuild, the Microsoft Build Engine, was started by a script or the Windows command interpreter. This behavior is unusual and is sometimes used by malicious payloads. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Defense Evasion - -*Version*: 9 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type == "start" and - (process.name : "MSBuild.exe" or process.pe.original_file_name == "MSBuild.exe") and - process.parent.name : ("cmd.exe", "powershell.exe", "cscript.exe", "wscript.exe", "mshta.exe") - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Defense Evasion -** ID: TA0005 -** Reference URL: https://attack.mitre.org/tactics/TA0005/ -* Technique: -** Name: Trusted Developer Utilities Proxy Execution -** ID: T1127 -** Reference URL: https://attack.mitre.org/techniques/T1127/ -* Sub-technique: -** Name: MSBuild -** ID: T1127.001 -** Reference URL: https://attack.mitre.org/techniques/T1127/001/ -* Tactic: -** Name: Execution -** ID: TA0002 -** Reference URL: https://attack.mitre.org/tactics/TA0002/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-microsoft-build-engine-started-by-a-system-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-microsoft-build-engine-started-by-a-system-process.asciidoc deleted file mode 100644 index 29f510d127..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-microsoft-build-engine-started-by-a-system-process.asciidoc +++ /dev/null @@ -1,71 +0,0 @@ -[[prebuilt-rule-0-14-2-microsoft-build-engine-started-by-a-system-process]] -=== Microsoft Build Engine Started by a System Process - -An instance of MSBuild, the Microsoft Build Engine, was started by Explorer or the WMI (Windows Management Instrumentation) subsystem. This behavior is unusual and is sometimes used by malicious payloads. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Defense Evasion - -*Version*: 9 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type in ("start", "process_started") and - process.name : "MSBuild.exe" and - process.parent.name : ("explorer.exe", "wmiprvse.exe") - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Defense Evasion -** ID: TA0005 -** Reference URL: https://attack.mitre.org/tactics/TA0005/ -* Technique: -** Name: Trusted Developer Utilities Proxy Execution -** ID: T1127 -** Reference URL: https://attack.mitre.org/techniques/T1127/ -* Sub-technique: -** Name: MSBuild -** ID: T1127.001 -** Reference URL: https://attack.mitre.org/techniques/T1127/001/ -* Tactic: -** Name: Execution -** ID: TA0002 -** Reference URL: https://attack.mitre.org/tactics/TA0002/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-microsoft-build-engine-started-by-an-office-application.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-microsoft-build-engine-started-by-an-office-application.asciidoc deleted file mode 100644 index 6cff3fc52c..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-microsoft-build-engine-started-by-an-office-application.asciidoc +++ /dev/null @@ -1,80 +0,0 @@ -[[prebuilt-rule-0-14-2-microsoft-build-engine-started-by-an-office-application]] -=== Microsoft Build Engine Started by an Office Application - -An instance of MSBuild, the Microsoft Build Engine, was started by Excel or Word. This is unusual behavior for the Build Engine and could have been caused by an Excel or Word document executing a malicious script payload. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: high - -*Risk score*: 73 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://blog.talosintelligence.com/2020/02/building-bypass-with-msbuild.html - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Defense Evasion - -*Version*: 9 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type in ("start", "process_started") and - process.name : "MSBuild.exe" and - process.parent.name : ("eqnedt32.exe", - "excel.exe", - "fltldr.exe", - "msaccess.exe", - "mspub.exe", - "outlook.exe", - "powerpnt.exe", - "winword.exe" ) - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Defense Evasion -** ID: TA0005 -** Reference URL: https://attack.mitre.org/tactics/TA0005/ -* Technique: -** Name: Trusted Developer Utilities Proxy Execution -** ID: T1127 -** Reference URL: https://attack.mitre.org/techniques/T1127/ -* Sub-technique: -** Name: MSBuild -** ID: T1127.001 -** Reference URL: https://attack.mitre.org/techniques/T1127/001/ -* Tactic: -** Name: Execution -** ID: TA0002 -** Reference URL: https://attack.mitre.org/tactics/TA0002/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-microsoft-build-engine-using-an-alternate-name.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-microsoft-build-engine-using-an-alternate-name.asciidoc deleted file mode 100644 index 544e377e86..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-microsoft-build-engine-using-an-alternate-name.asciidoc +++ /dev/null @@ -1,67 +0,0 @@ -[[prebuilt-rule-0-14-2-microsoft-build-engine-using-an-alternate-name]] -=== Microsoft Build Engine Using an Alternate Name - -An instance of MSBuild, the Microsoft Build Engine, was started after being renamed. This is uncommon behavior and may indicate an attempt to run unnoticed or undetected. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Defense Evasion - -*Version*: 9 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type in ("start", "process_started") and - process.pe.original_file_name == "MSBuild.exe" and - not process.name : "MSBuild.exe" - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Defense Evasion -** ID: TA0005 -** Reference URL: https://attack.mitre.org/tactics/TA0005/ -* Technique: -** Name: Masquerading -** ID: T1036 -** Reference URL: https://attack.mitre.org/techniques/T1036/ -* Sub-technique: -** Name: Rename System Utilities -** ID: T1036.003 -** Reference URL: https://attack.mitre.org/techniques/T1036/003/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-modification-of-boot-configuration.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-modification-of-boot-configuration.asciidoc deleted file mode 100644 index 4ffc052a22..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-modification-of-boot-configuration.asciidoc +++ /dev/null @@ -1,64 +0,0 @@ -[[prebuilt-rule-0-14-2-modification-of-boot-configuration]] -=== Modification of Boot Configuration - -Identifies use of bcdedit.exe to delete boot configuration data. This tactic is sometimes used as by malware or an attacker as a destructive technique. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Impact - -*Version*: 9 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type in ("start", "process_started") and - (process.name : "bcdedit.exe" or process.pe.original_file_name == "bcdedit.exe") and - (process.args : "/set" and process.args : "bootstatuspolicy" and process.args : "ignoreallfailures") or - (process.args : "no" and process.args : "recoveryenabled") - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Impact -** ID: TA0040 -** Reference URL: https://attack.mitre.org/tactics/TA0040/ -* Technique: -** Name: Inhibit System Recovery -** ID: T1490 -** Reference URL: https://attack.mitre.org/techniques/T1490/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-msbuild-making-network-connections.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-msbuild-making-network-connections.asciidoc deleted file mode 100644 index 9252902038..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-msbuild-making-network-connections.asciidoc +++ /dev/null @@ -1,68 +0,0 @@ -[[prebuilt-rule-0-14-2-msbuild-making-network-connections]] -=== MsBuild Making Network Connections - -Identifies MsBuild.exe making outbound network connections. This may indicate adversarial activity as MsBuild is often leveraged by adversaries to execute code and evade detection. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Defense Evasion - -*Version*: 8 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -sequence by process.entity_id - [process where process.name : "MSBuild.exe" and event.type == "start"] - [network where process.name : "MSBuild.exe" and - not cidrmatch(destination.ip, "127.0.0.1", "::1")] - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Defense Evasion -** ID: TA0005 -** Reference URL: https://attack.mitre.org/tactics/TA0005/ -* Technique: -** Name: Trusted Developer Utilities Proxy Execution -** ID: T1127 -** Reference URL: https://attack.mitre.org/techniques/T1127/ -* Sub-technique: -** Name: MSBuild -** ID: T1127.001 -** Reference URL: https://attack.mitre.org/techniques/T1127/001/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-net-command-via-system-account.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-net-command-via-system-account.asciidoc deleted file mode 100644 index be36822352..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-net-command-via-system-account.asciidoc +++ /dev/null @@ -1,64 +0,0 @@ -[[prebuilt-rule-0-14-2-net-command-via-system-account]] -=== Net command via SYSTEM account - -Identifies the SYSTEM account using an account discovery utility. This could be a sign of discovery activity after an adversary has achieved privilege escalation. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Discovery - -*Version*: 8 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type in ("start", "process_started") and - user.id in ("S-1-5-18", "S-1-5-19", "S-1-5-20") and - process.name : "whoami.exe" or - (process.name : "net1.exe" and not process.parent.name : "net.exe") - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Discovery -** ID: TA0007 -** Reference URL: https://attack.mitre.org/tactics/TA0007/ -* Technique: -** Name: System Owner/User Discovery -** ID: T1033 -** Reference URL: https://attack.mitre.org/techniques/T1033/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-network-connection-via-compiled-html-file.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-network-connection-via-compiled-html-file.asciidoc deleted file mode 100644 index 311ab9426e..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-network-connection-via-compiled-html-file.asciidoc +++ /dev/null @@ -1,86 +0,0 @@ -[[prebuilt-rule-0-14-2-network-connection-via-compiled-html-file]] -=== Network Connection via Compiled HTML File - -Compiled HTML files (.chm) are commonly distributed as part of the Microsoft HTML Help system. Adversaries may conceal malicious code in a CHM file and deliver it to a victim for execution. CHM content is loaded by the HTML Help executable program (hh.exe). - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Execution - -*Version*: 9 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -sequence by process.entity_id - [process where process.name : "hh.exe" and event.type == "start"] - [network where process.name : "hh.exe" and - not cidrmatch(destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", - "192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", - "192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4", - "100.64.0.0/10", "192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1", - "FE80::/10", "FF00::/8")] - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Execution -** ID: TA0002 -** Reference URL: https://attack.mitre.org/tactics/TA0002/ -* Technique: -** Name: User Execution -** ID: T1204 -** Reference URL: https://attack.mitre.org/techniques/T1204/ -* Sub-technique: -** Name: Malicious File -** ID: T1204.002 -** Reference URL: https://attack.mitre.org/techniques/T1204/002/ -* Tactic: -** Name: Defense Evasion -** ID: TA0005 -** Reference URL: https://attack.mitre.org/tactics/TA0005/ -* Technique: -** Name: Signed Binary Proxy Execution -** ID: T1218 -** Reference URL: https://attack.mitre.org/techniques/T1218/ -* Sub-technique: -** Name: Compiled HTML File -** ID: T1218.001 -** Reference URL: https://attack.mitre.org/techniques/T1218/001/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-new-activesyncalloweddeviceid-added-via-powershell.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-new-activesyncalloweddeviceid-added-via-powershell.asciidoc deleted file mode 100644 index 7b1837c370..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-new-activesyncalloweddeviceid-added-via-powershell.asciidoc +++ /dev/null @@ -1,69 +0,0 @@ -[[prebuilt-rule-0-14-2-new-activesyncalloweddeviceid-added-via-powershell]] -=== New ActiveSyncAllowedDeviceID Added via PowerShell - -Identifies the use of the Exchange PowerShell cmdlet, Set-CASMailbox, to add a new ActiveSync allowed device. Adversaries may target user email to collect sensitive information. - -*Rule type*: eql - -*Rule indices*: - -* logs-endpoint.events.* -* winlogbeat-* -* logs-windows.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/ -* https://docs.microsoft.com/en-us/powershell/module/exchange/set-casmailbox?view=exchange-ps - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Persistence - -*Version*: 5 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type in ("start", "process_started") and - process.name: ("powershell.exe", "pwsh.exe") and process.args : "Set-CASMailbox*ActiveSyncAllowedDeviceIDs*" - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Persistence -** ID: TA0003 -** Reference URL: https://attack.mitre.org/tactics/TA0003/ -* Technique: -** Name: Account Manipulation -** ID: T1098 -** Reference URL: https://attack.mitre.org/techniques/T1098/ -* Sub-technique: -** Name: Exchange Email Delegate Permissions -** ID: T1098.002 -** Reference URL: https://attack.mitre.org/techniques/T1098/002/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-new-or-modified-federation-domain.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-new-or-modified-federation-domain.asciidoc deleted file mode 100644 index e16b995db6..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-new-or-modified-federation-domain.asciidoc +++ /dev/null @@ -1,84 +0,0 @@ -[[prebuilt-rule-0-14-2-new-or-modified-federation-domain]] -=== New or Modified Federation Domain - -Identifies a new or modified federation domain, which can be used to create a trust between O365 and an external identity provider. - -*Rule type*: query - -*Rule indices*: - -* filebeat-* -* logs-o365* - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 5m - -*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://docs.microsoft.com/en-us/powershell/module/exchange/remove-accepteddomain?view=exchange-ps -* https://docs.microsoft.com/en-us/powershell/module/exchange/remove-federateddomain?view=exchange-ps -* https://docs.microsoft.com/en-us/powershell/module/exchange/new-accepteddomain?view=exchange-ps -* https://docs.microsoft.com/en-us/powershell/module/exchange/add-federateddomain?view=exchange-ps -* https://docs.microsoft.com/en-us/powershell/module/exchange/set-accepteddomain?view=exchange-ps -* https://docs.microsoft.com/en-us/powershell/module/msonline/set-msoldomainfederationsettings?view=azureadps-1.0 - -*Tags*: - -* Elastic -* Cloud -* Microsoft 365 -* Continuous Monitoring -* SecOps -* Identity and Access - -*Version*: 1 - -*Rule authors*: - -* Austin Songer - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Config - -The Microsoft 365 Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -event.dataset:o365.audit and event.provider:Exchange and event.category:web and event.action:("Set-AcceptedDomain" or -"Set-MsolDomainFederationSettings" or "Add-FederatedDomain" or "New-AcceptedDomain" or "Remove-AcceptedDomain" or "Remove-FederatedDomain") and -event.outcome:success - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Privilege Escalation -** ID: TA0004 -** Reference URL: https://attack.mitre.org/tactics/TA0004/ -* Technique: -** Name: Domain Policy Modification -** ID: T1484 -** Reference URL: https://attack.mitre.org/techniques/T1484/ -* Sub-technique: -** Name: Domain Trust Modification -** ID: T1484.002 -** Reference URL: https://attack.mitre.org/techniques/T1484/002/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-ntds-or-sam-database-file-copied.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-ntds-or-sam-database-file-copied.asciidoc deleted file mode 100644 index ecaaacd282..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-ntds-or-sam-database-file-copied.asciidoc +++ /dev/null @@ -1,76 +0,0 @@ -[[prebuilt-rule-0-14-2-ntds-or-sam-database-file-copied]] -=== NTDS or SAM Database File Copied - -Identifies a copy operation of the Active Directory Domain Database (ntds.dit) or Security Account Manager (SAM) files. Those files contain sensitive information including hashed domain and/or local credentials. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: high - -*Risk score*: 73 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 33 - -*References*: - -* https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/ -* https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-3---esentutlexe-sam-copy - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Credential Access - -*Version*: 5 - -*Rule authors*: - -* Elastic -* Austin Songer - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type in ("start", "process_started") and - ( - (process.pe.original_file_name in ("Cmd.Exe", "PowerShell.EXE", "XCOPY.EXE") and - process.args : ("copy", "xcopy", "Copy-Item", "move", "cp", "mv") - ) or - (process.pe.original_file_name : "esentutl.exe" and process.args : ("*/y*", "*/vss*", "*/d*")) - ) and - process.args : ("*\\ntds.dit", "*\\config\\SAM", "\\*\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy*\\*", "*/system32/config/SAM*") - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Credential Access -** ID: TA0006 -** Reference URL: https://attack.mitre.org/tactics/TA0006/ -* Technique: -** Name: OS Credential Dumping -** ID: T1003 -** Reference URL: https://attack.mitre.org/techniques/T1003/ -* Sub-technique: -** Name: Security Account Manager -** ID: T1003.002 -** Reference URL: https://attack.mitre.org/techniques/T1003/002/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-o365-exchange-suspicious-mailbox-right-delegation.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-o365-exchange-suspicious-mailbox-right-delegation.asciidoc deleted file mode 100644 index 03c8d6235a..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-o365-exchange-suspicious-mailbox-right-delegation.asciidoc +++ /dev/null @@ -1,77 +0,0 @@ -[[prebuilt-rule-0-14-2-o365-exchange-suspicious-mailbox-right-delegation]] -=== O365 Exchange Suspicious Mailbox Right Delegation - -Identifies the assignment of rights to accesss content from another mailbox. An adversary may use the compromised account to send messages to other accounts in the network of the target business while creating inbox rules, so messages can evade spam/phishing detection mechanisms. - -*Rule type*: query - -*Rule indices*: - -* filebeat-* -* logs-o365* - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 5m - -*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Cloud -* Microsoft 365 -* Continuous Monitoring -* SecOps -* Configuration Audit - -*Version*: 1 - -*Rule authors*: - -* Elastic -* Austin Songer - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Config - -The Microsoft 365 Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -event.dataset:o365.audit and event.provider:Exchange and event.action:Add-MailboxPermission and -o365.audit.Parameters.AccessRights:(FullAccess or SendAs or SendOnBehalf) and event.outcome:success - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Persistence -** ID: TA0003 -** Reference URL: https://attack.mitre.org/tactics/TA0003/ -* Technique: -** Name: Account Manipulation -** ID: T1098 -** Reference URL: https://attack.mitre.org/techniques/T1098/ -* Sub-technique: -** Name: Exchange Email Delegate Permissions -** ID: T1098.002 -** Reference URL: https://attack.mitre.org/techniques/T1098/002/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-outbound-scheduled-task-activity-via-powershell.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-outbound-scheduled-task-activity-via-powershell.asciidoc deleted file mode 100644 index 00d9328fb4..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-outbound-scheduled-task-activity-via-powershell.asciidoc +++ /dev/null @@ -1,69 +0,0 @@ -[[prebuilt-rule-0-14-2-outbound-scheduled-task-activity-via-powershell]] -=== Outbound Scheduled Task Activity via PowerShell - -Identifies the PowerShell process loading the Task Scheduler COM DLL followed by an outbound RPC network connection within a short time period. This may indicate lateral movement or remote discovery via scheduled tasks. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/ - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Execution - -*Version*: 3 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -sequence by host.id, process.entity_id with maxspan = 5s - [library where dll.name : "taskschd.dll" and process.name : ("powershell.exe", "pwsh.exe")] - [network where process.name : ("powershell.exe", "pwsh.exe") and destination.port == 135 and not destination.address in ("127.0.0.1", "::1")] - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Execution -** ID: TA0002 -** Reference URL: https://attack.mitre.org/tactics/TA0002/ -* Technique: -** Name: Scheduled Task/Job -** ID: T1053 -** Reference URL: https://attack.mitre.org/techniques/T1053/ -* Sub-technique: -** Name: Scheduled Task -** ID: T1053.005 -** Reference URL: https://attack.mitre.org/techniques/T1053/005/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-persistence-via-scheduled-job-creation.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-persistence-via-scheduled-job-creation.asciidoc deleted file mode 100644 index 0210c2ddea..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-persistence-via-scheduled-job-creation.asciidoc +++ /dev/null @@ -1,66 +0,0 @@ -[[prebuilt-rule-0-14-2-persistence-via-scheduled-job-creation]] -=== Persistence via Scheduled Job Creation - -A job can be used to schedule programs or scripts to be executed at a specified date and time. Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Persistence - -*Version*: 2 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -file where event.type != "deletion" and - file.path : "?:\\Windows\\Tasks\\*" and file.extension : "job" - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Persistence -** ID: TA0003 -** Reference URL: https://attack.mitre.org/tactics/TA0003/ -* Technique: -** Name: Scheduled Task/Job -** ID: T1053 -** Reference URL: https://attack.mitre.org/techniques/T1053/ -* Sub-technique: -** Name: Scheduled Task -** ID: T1053.005 -** Reference URL: https://attack.mitre.org/techniques/T1053/005/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-persistence-via-telemetrycontroller-scheduled-task-hijack.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-persistence-via-telemetrycontroller-scheduled-task-hijack.asciidoc deleted file mode 100644 index b9279d4cf2..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-persistence-via-telemetrycontroller-scheduled-task-hijack.asciidoc +++ /dev/null @@ -1,74 +0,0 @@ -[[prebuilt-rule-0-14-2-persistence-via-telemetrycontroller-scheduled-task-hijack]] -=== Persistence via TelemetryController Scheduled Task Hijack - -Detects the successful hijack of Microsoft Compatibility Appraiser scheduled task to establish persistence with an integrity level of system. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: high - -*Risk score*: 73 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.trustedsec.com/blog/abusing-windows-telemetry-for-persistence/?utm_content=131234033&utm_medium=social&utm_source=twitter&hss_channel=tw-403811306 - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Persistence - -*Version*: 6 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type in ("start", "process_started") and - process.parent.name : "CompatTelRunner.exe" and process.args : "-cv*" and - not process.name : ("conhost.exe", - "DeviceCensus.exe", - "CompatTelRunner.exe", - "DismHost.exe", - "rundll32.exe", - "powershell.exe") - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Persistence -** ID: TA0003 -** Reference URL: https://attack.mitre.org/tactics/TA0003/ -* Technique: -** Name: Scheduled Task/Job -** ID: T1053 -** Reference URL: https://attack.mitre.org/techniques/T1053/ -* Sub-technique: -** Name: Scheduled Task -** ID: T1053.005 -** Reference URL: https://attack.mitre.org/techniques/T1053/005/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-persistence-via-wmi-event-subscription.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-persistence-via-wmi-event-subscription.asciidoc deleted file mode 100644 index 8edaefb269..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-persistence-via-wmi-event-subscription.asciidoc +++ /dev/null @@ -1,68 +0,0 @@ -[[prebuilt-rule-0-14-2-persistence-via-wmi-event-subscription]] -=== Persistence via WMI Event Subscription - -An adversary can use Windows Management Instrumentation (WMI) to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. Adversaries may use the capabilities of WMI to subscribe to an event and execute arbitrary code when that event occurs, providing persistence on a system. - -*Rule type*: eql - -*Rule indices*: - -* logs-endpoint.events.* -* winlogbeat-* -* logs-windows.* - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Persistence - -*Version*: 4 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type in ("start", "process_started") and - (process.name : "wmic.exe" or process.pe.original_file_name == "wmic.exe") and - process.args : "create" and - process.args : ("ActiveScriptEventConsumer", "CommandLineEventConsumer") - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Persistence -** ID: TA0003 -** Reference URL: https://attack.mitre.org/tactics/TA0003/ -* Technique: -** Name: Event Triggered Execution -** ID: T1546 -** Reference URL: https://attack.mitre.org/techniques/T1546/ -* Sub-technique: -** Name: Windows Management Instrumentation Event Subscription -** ID: T1546.003 -** Reference URL: https://attack.mitre.org/techniques/T1546/003/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-port-forwarding-rule-addition.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-port-forwarding-rule-addition.asciidoc deleted file mode 100644 index c54d8c7d79..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-port-forwarding-rule-addition.asciidoc +++ /dev/null @@ -1,63 +0,0 @@ -[[prebuilt-rule-0-14-2-port-forwarding-rule-addition]] -=== Port Forwarding Rule Addition - -Identifies the creation of a new port forwarding rule. An adversary may abuse this technique to bypass network segmentation restrictions. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.fireeye.com/blog/threat-research/2019/01/bypassing-network-restrictions-through-rdp-tunneling.html - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Command and Control - -*Version*: 4 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -registry where registry.path : "HKLM\\SYSTEM\\ControlSet*\\Services\\PortProxy\\v4tov4\\*" - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Command and Control -** ID: TA0011 -** Reference URL: https://attack.mitre.org/tactics/TA0011/ -* Technique: -** Name: Protocol Tunneling -** ID: T1572 -** Reference URL: https://attack.mitre.org/techniques/T1572/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-potential-command-and-control-via-internet-explorer.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-potential-command-and-control-via-internet-explorer.asciidoc deleted file mode 100644 index e5f9ec2bf8..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-potential-command-and-control-via-internet-explorer.asciidoc +++ /dev/null @@ -1,90 +0,0 @@ -[[prebuilt-rule-0-14-2-potential-command-and-control-via-internet-explorer]] -=== Potential Command and Control via Internet Explorer - -Identifies instances of Internet Explorer (iexplore.exe) being started via the Component Object Model (COM) making unusual network connections. Adversaries could abuse Internet Explorer via COM to avoid suspicious processes making network connections and bypass host-based firewall restrictions. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Command and Control - -*Version*: 4 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -sequence by host.id, user.id with maxspan = 5s - [library where dll.name : "IEProxy.dll" and process.name : ("rundll32.exe", "regsvr32.exe")] - [process where event.type == "start" and process.parent.name : "iexplore.exe" and process.parent.args : "-Embedding"] - /* IE started via COM in normal conditions makes few connections, mainly to Microsoft and OCSP related domains, add FPs here */ - [network where network.protocol == "dns" and process.name : "iexplore.exe" and - not dns.question.name : - ( - "*.microsoft.com", - "*.digicert.com", - "*.msocsp.com", - "*.windowsupdate.com", - "*.bing.com", - "*.identrust.com", - "*.sharepoint.com", - "*.office365.com", - "*.office.com" - ) - ] - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Command and Control -** ID: TA0011 -** Reference URL: https://attack.mitre.org/tactics/TA0011/ -* Technique: -** Name: Application Layer Protocol -** ID: T1071 -** Reference URL: https://attack.mitre.org/techniques/T1071/ -* Tactic: -** Name: Execution -** ID: TA0002 -** Reference URL: https://attack.mitre.org/tactics/TA0002/ -* Technique: -** Name: Inter-Process Communication -** ID: T1559 -** Reference URL: https://attack.mitre.org/techniques/T1559/ -* Sub-technique: -** Name: Component Object Model -** ID: T1559.001 -** Reference URL: https://attack.mitre.org/techniques/T1559/001/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-potential-credential-access-via-duplicatehandle-in-lsass.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-potential-credential-access-via-duplicatehandle-in-lsass.asciidoc deleted file mode 100644 index 662bfb591a..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-potential-credential-access-via-duplicatehandle-in-lsass.asciidoc +++ /dev/null @@ -1,72 +0,0 @@ -[[prebuilt-rule-0-14-2-potential-credential-access-via-duplicatehandle-in-lsass]] -=== Potential Credential Access via DuplicateHandle in LSASS - -Identifies suspicious access to an LSASS handle via DuplicateHandle from an unknown call trace module. This may indicate an attempt to bypass the NtOpenProcess API to evade detection and dump Lsass memory for credential access. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-windows.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://github.com/CCob/MirrorDump - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Credential Access - -*Version*: 1 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.code == "10" and - - /* LSASS requesting DuplicateHandle access right to another process */ - process.name : "lsass.exe" and winlog.event_data.GrantedAccess == "0x40" and - - /* call is coming from an unknown executable region */ - winlog.event_data.CallTrace : "*UNKNOWN*" - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Credential Access -** ID: TA0006 -** Reference URL: https://attack.mitre.org/tactics/TA0006/ -* Technique: -** Name: OS Credential Dumping -** ID: T1003 -** Reference URL: https://attack.mitre.org/techniques/T1003/ -* Sub-technique: -** Name: LSASS Memory -** ID: T1003.001 -** Reference URL: https://attack.mitre.org/techniques/T1003/001/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-potential-credential-access-via-windows-utilities.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-potential-credential-access-via-windows-utilities.asciidoc deleted file mode 100644 index cc0a4e4443..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-potential-credential-access-via-windows-utilities.asciidoc +++ /dev/null @@ -1,81 +0,0 @@ -[[prebuilt-rule-0-14-2-potential-credential-access-via-windows-utilities]] -=== Potential Credential Access via Windows Utilities - -Identifies the execution of known Windows utilities often abused to dump LSASS memory or the Active Directory database (NTDS.dit) in preparation for credential access. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: high - -*Risk score*: 73 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://lolbas-project.github.io/ - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Credential Access - -*Version*: 5 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type in ("start", "process_started") and -/* update here with any new lolbas with dump capability */ -(process.pe.original_file_name == "procdump" and process.args : "-ma") or -(process.name : "ProcessDump.exe" and not process.parent.executable regex~ """C:\\Program Files( \(x86\))?\\Cisco Systems\\.*""") or -(process.pe.original_file_name == "WriteMiniDump.exe" and not process.parent.executable regex~ """C:\\Program Files( \(x86\))?\\Steam\\.*""") or -(process.pe.original_file_name == "RUNDLL32.EXE" and (process.args : "MiniDump*" or process.command_line : "*comsvcs.dll*#24*")) or -(process.pe.original_file_name == "RdrLeakDiag.exe" and process.args : "/fullmemdmp") or -(process.pe.original_file_name == "SqlDumper.exe" and process.args : "0x01100*") or -(process.pe.original_file_name == "TTTracer.exe" and process.args : "-dumpFull" and process.args : "-attach") or -(process.pe.original_file_name == "ntdsutil.exe" and process.args : "create*full*") or -(process.pe.original_file_name == "diskshadow.exe" and process.args : "/s") - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Credential Access -** ID: TA0006 -** Reference URL: https://attack.mitre.org/tactics/TA0006/ -* Technique: -** Name: OS Credential Dumping -** ID: T1003 -** Reference URL: https://attack.mitre.org/techniques/T1003/ -* Sub-technique: -** Name: LSASS Memory -** ID: T1003.001 -** Reference URL: https://attack.mitre.org/techniques/T1003/001/ -* Sub-technique: -** Name: NTDS -** ID: T1003.003 -** Reference URL: https://attack.mitre.org/techniques/T1003/003/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-potential-dll-side-loading-via-microsoft-antimalware-service-executable.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-potential-dll-side-loading-via-microsoft-antimalware-service-executable.asciidoc deleted file mode 100644 index 12bdb78637..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-potential-dll-side-loading-via-microsoft-antimalware-service-executable.asciidoc +++ /dev/null @@ -1,75 +0,0 @@ -[[prebuilt-rule-0-14-2-potential-dll-side-loading-via-microsoft-antimalware-service-executable]] -=== Potential DLL Side-Loading via Microsoft Antimalware Service Executable - -Identifies a Windows trusted program that is known to be vulnerable to DLL Search Order Hijacking starting after being renamed or from a non-standard path. This is uncommon behavior and may indicate an attempt to evade defenses via side-loading a malicious DLL within the memory space of one of those processes. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: high - -*Risk score*: 73 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://news.sophos.com/en-us/2021/07/04/independence-day-revil-uses-supply-chain-exploit-to-attack-hundreds-of-businesses/ - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Defense Evasion - -*Version*: 2 - -*Rule authors*: - -* Elastic -* Dennis Perto - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type == "start" and - (process.pe.original_file_name == "MsMpEng.exe" and not process.name : "MsMpEng.exe") or - (process.name : "MsMpEng.exe" and not - process.executable : ("?:\\ProgramData\\Microsoft\\Windows Defender\\*.exe", - "?:\\Program Files\\Windows Defender\\*.exe", - "?:\\Program Files (x86)\\Windows Defender\\*.exe", - "?:\\Program Files\\Microsoft Security Client\\*.exe", - "?:\\Program Files (x86)\\Microsoft Security Client\\*.exe")) - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Defense Evasion -** ID: TA0005 -** Reference URL: https://attack.mitre.org/tactics/TA0005/ -* Technique: -** Name: Hijack Execution Flow -** ID: T1574 -** Reference URL: https://attack.mitre.org/techniques/T1574/ -* Sub-technique: -** Name: DLL Side-Loading -** ID: T1574.002 -** Reference URL: https://attack.mitre.org/techniques/T1574/002/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-potential-dns-tunneling-via-nslookup.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-potential-dns-tunneling-via-nslookup.asciidoc deleted file mode 100644 index f4a000d0d4..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-potential-dns-tunneling-via-nslookup.asciidoc +++ /dev/null @@ -1,67 +0,0 @@ -[[prebuilt-rule-0-14-2-potential-dns-tunneling-via-nslookup]] -=== Potential DNS Tunneling via NsLookup - -This rule identifies a large number (15) of nslookup.exe executions with an explicit query type from the same host. This may indicate command and control activity utilizing the DNS protocol. - -*Rule type*: threshold - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://unit42.paloaltonetworks.com/dns-tunneling-in-the-wild-overview-of-oilrigs-dns-tunneling/ - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Command and Control - -*Version*: 3 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -event.category:process and event.type:start and process.name:nslookup.exe and process.args:(-querytype=* or -qt=* or -q=* or -type=*) - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Command and Control -** ID: TA0011 -** Reference URL: https://attack.mitre.org/tactics/TA0011/ -* Technique: -** Name: Application Layer Protocol -** ID: T1071 -** Reference URL: https://attack.mitre.org/techniques/T1071/ -* Sub-technique: -** Name: DNS -** ID: T1071.004 -** Reference URL: https://attack.mitre.org/techniques/T1071/004/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-potential-evasion-via-filter-manager.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-potential-evasion-via-filter-manager.asciidoc deleted file mode 100644 index 585ddc7082..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-potential-evasion-via-filter-manager.asciidoc +++ /dev/null @@ -1,66 +0,0 @@ -[[prebuilt-rule-0-14-2-potential-evasion-via-filter-manager]] -=== Potential Evasion via Filter Manager - -The Filter Manager Control Program (fltMC.exe) binary may be abused by adversaries to unload a filter driver and evade defenses. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Defense Evasion - -*Version*: 8 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type in ("start", "process_started") and - process.name : "fltMC.exe" and process.args : "unload" - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Defense Evasion -** ID: TA0005 -** Reference URL: https://attack.mitre.org/tactics/TA0005/ -* Technique: -** Name: Impair Defenses -** ID: T1562 -** Reference URL: https://attack.mitre.org/techniques/T1562/ -* Sub-technique: -** Name: Disable or Modify Tools -** ID: T1562.001 -** Reference URL: https://attack.mitre.org/techniques/T1562/001/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-potential-kerberos-attack-via-bifrost.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-potential-kerberos-attack-via-bifrost.asciidoc deleted file mode 100644 index 3d64bd242f..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-potential-kerberos-attack-via-bifrost.asciidoc +++ /dev/null @@ -1,80 +0,0 @@ -[[prebuilt-rule-0-14-2-potential-kerberos-attack-via-bifrost]] -=== Potential Kerberos Attack via Bifrost - -Identifies use of Bifrost, a known macOS Kerberos pentesting tool, which can be used to dump cached Kerberos tickets or attempt unauthorized authentication techniques such as pass-the-ticket/hash and kerberoasting. - -*Rule type*: query - -*Rule indices*: - -* auditbeat-* -* logs-endpoint.events.* - -*Severity*: high - -*Risk score*: 73 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://github.com/its-a-feature/bifrost - -*Tags*: - -* Elastic -* Host -* macOS -* Threat Detection -* Credential Access -* Lateral Movement - -*Version*: 2 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -event.category:process and event.type:start and - process.args:("-action" and ("-kerberoast" or askhash or asktgs or asktgt or s4u or ("-ticket" and ptt) or (dump and (tickets or keytab)))) - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Lateral Movement -** ID: TA0008 -** Reference URL: https://attack.mitre.org/tactics/TA0008/ -* Technique: -** Name: Use Alternate Authentication Material -** ID: T1550 -** Reference URL: https://attack.mitre.org/techniques/T1550/ -* Sub-technique: -** Name: Pass the Ticket -** ID: T1550.003 -** Reference URL: https://attack.mitre.org/techniques/T1550/003/ -* Tactic: -** Name: Credential Access -** ID: TA0006 -** Reference URL: https://attack.mitre.org/tactics/TA0006/ -* Technique: -** Name: Steal or Forge Kerberos Tickets -** ID: T1558 -** Reference URL: https://attack.mitre.org/techniques/T1558/ -* Sub-technique: -** Name: Kerberoasting -** ID: T1558.003 -** Reference URL: https://attack.mitre.org/techniques/T1558/003/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-potential-remote-desktop-tunneling-detected.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-potential-remote-desktop-tunneling-detected.asciidoc deleted file mode 100644 index c5555c66f9..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-potential-remote-desktop-tunneling-detected.asciidoc +++ /dev/null @@ -1,66 +0,0 @@ -[[prebuilt-rule-0-14-2-potential-remote-desktop-tunneling-detected]] -=== Potential Remote Desktop Tunneling Detected - -Identifies potential use of an SSH utility to establish RDP over a reverse SSH Tunnel. This can be used by attackers to enable routing of network packets that would otherwise not reach their intended destination. - -*Rule type*: eql - -*Rule indices*: - -* logs-endpoint.events.* -* winlogbeat-* -* logs-windows.* - -*Severity*: high - -*Risk score*: 73 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://blog.netspi.com/how-to-access-rdp-over-a-reverse-ssh-tunnel/ - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Command and Control - -*Version*: 4 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type in ("start", "process_started") and - /* RDP port and usual SSH tunneling related switches in command line */ - process.args : "*:3389" and - process.args : ("-L", "-P", "-R", "-pw", "-ssh") - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Command and Control -** ID: TA0011 -** Reference URL: https://attack.mitre.org/tactics/TA0011/ -* Technique: -** Name: Protocol Tunneling -** ID: T1572 -** Reference URL: https://attack.mitre.org/techniques/T1572/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-potential-sharprdp-behavior.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-potential-sharprdp-behavior.asciidoc deleted file mode 100644 index 4fd9b3dc89..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-potential-sharprdp-behavior.asciidoc +++ /dev/null @@ -1,84 +0,0 @@ -[[prebuilt-rule-0-14-2-potential-sharprdp-behavior]] -=== Potential SharpRDP Behavior - -Identifies potential behavior of SharpRDP, which is a tool that can be used to perform authenticated command execution against a remote target via Remote Desktop Protocol (RDP) for the purposes of lateral movement. - -*Rule type*: eql - -*Rule indices*: - -* logs-endpoint.events.* -* winlogbeat-* -* logs-windows.* - -*Severity*: high - -*Risk score*: 73 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://posts.specterops.io/revisiting-remote-desktop-lateral-movement-8fb905cb46c3 -* https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES/blob/master/Lateral%20Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Lateral Movement - -*Version*: 3 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -/* Incoming RDP followed by a new RunMRU string value set to cmd, powershell, taskmgr or tsclient, followed by process execution within 1m */ - -sequence by host.id with maxspan=1m - [network where event.type == "start" and process.name : "svchost.exe" and destination.port == 3389 and - network.direction == "incoming" and network.transport == "tcp" and - source.address != "127.0.0.1" and source.address != "::1" - ] - - [registry where process.name : "explorer.exe" and - registry.path : ("HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU\\*") and - registry.data.strings : ("cmd.exe*", "powershell.exe*", "taskmgr*", "\\\\tsclient\\*.exe\\*") - ] - - [process where event.type in ("start", "process_started") and - (process.parent.name : ("cmd.exe", "powershell.exe", "taskmgr.exe") or process.args : ("\\\\tsclient\\*.exe")) and - not process.name : "conhost.exe" - ] - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Lateral Movement -** ID: TA0008 -** Reference URL: https://attack.mitre.org/tactics/TA0008/ -* Technique: -** Name: Remote Services -** ID: T1021 -** Reference URL: https://attack.mitre.org/techniques/T1021/ -* Sub-technique: -** Name: Remote Desktop Protocol -** ID: T1021.001 -** Reference URL: https://attack.mitre.org/techniques/T1021/001/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-process-activity-via-compiled-html-file.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-process-activity-via-compiled-html-file.asciidoc deleted file mode 100644 index b22bf024cc..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-process-activity-via-compiled-html-file.asciidoc +++ /dev/null @@ -1,79 +0,0 @@ -[[prebuilt-rule-0-14-2-process-activity-via-compiled-html-file]] -=== Process Activity via Compiled HTML File - -Compiled HTML files (.chm) are commonly distributed as part of the Microsoft HTML Help system. Adversaries may conceal malicious code in a CHM file and deliver it to a victim for execution. CHM content is loaded by the HTML Help executable program (hh.exe). - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Execution - -*Version*: 9 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type in ("start", "process_started") and - process.parent.name : "hh.exe" and - process.name : ("mshta.exe", "cmd.exe", "powershell.exe", "pwsh.exe", "cscript.exe", "wscript.exe") - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Execution -** ID: TA0002 -** Reference URL: https://attack.mitre.org/tactics/TA0002/ -* Technique: -** Name: User Execution -** ID: T1204 -** Reference URL: https://attack.mitre.org/techniques/T1204/ -* Sub-technique: -** Name: Malicious File -** ID: T1204.002 -** Reference URL: https://attack.mitre.org/techniques/T1204/002/ -* Tactic: -** Name: Defense Evasion -** ID: TA0005 -** Reference URL: https://attack.mitre.org/tactics/TA0005/ -* Technique: -** Name: Signed Binary Proxy Execution -** ID: T1218 -** Reference URL: https://attack.mitre.org/techniques/T1218/ -* Sub-technique: -** Name: Compiled HTML File -** ID: T1218.001 -** Reference URL: https://attack.mitre.org/techniques/T1218/001/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-process-termination-followed-by-deletion.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-process-termination-followed-by-deletion.asciidoc deleted file mode 100644 index 93bf5e8d3e..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-process-termination-followed-by-deletion.asciidoc +++ /dev/null @@ -1,68 +0,0 @@ -[[prebuilt-rule-0-14-2-process-termination-followed-by-deletion]] -=== Process Termination followed by Deletion - -Identifies a process termination event quickly followed by the deletion of its executable file. Malware tools and other non-native files dropped or created on a system by an adversary may leave traces to indicate to what occurred. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint. - -*Rule type*: eql - -*Rule indices*: - -* logs-endpoint.events.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Defense Evasion - -*Version*: 3 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -sequence by host.id with maxspan=5s - [process where event.type == "end" and - process.code_signature.trusted == false and - not process.executable : ("C:\\Windows\\SoftwareDistribution\\*.exe", "C:\\Windows\\WinSxS\\*.exe") - ] by process.executable - [file where event.type == "deletion" and file.extension : ("exe", "scr", "com")] by file.path - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Defense Evasion -** ID: TA0005 -** Reference URL: https://attack.mitre.org/tactics/TA0005/ -* Technique: -** Name: Indicator Removal on Host -** ID: T1070 -** Reference URL: https://attack.mitre.org/techniques/T1070/ -* Sub-technique: -** Name: File Deletion -** ID: T1070.004 -** Reference URL: https://attack.mitre.org/techniques/T1070/004/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-program-files-directory-masquerading.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-program-files-directory-masquerading.asciidoc deleted file mode 100644 index da3395460f..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-program-files-directory-masquerading.asciidoc +++ /dev/null @@ -1,67 +0,0 @@ -[[prebuilt-rule-0-14-2-program-files-directory-masquerading]] -=== Program Files Directory Masquerading - -Identifies execution from a directory masquerading as the Windows Program Files directories. These paths are trusted and usually host trusted third party programs. An adversary may leverage masquerading, along with low privileges to bypass detections whitelisting those folders. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Defense Evasion - -*Version*: 5 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type == "start" and - process.executable : "C:\\*Program*Files*\\*.exe" and - not process.executable : ("C:\\Program Files\\*.exe", "C:\\Program Files (x86)\\*.exe", "C:\\Users\\*.exe", "C:\\ProgramData\\*.exe") - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Defense Evasion -** ID: TA0005 -** Reference URL: https://attack.mitre.org/tactics/TA0005/ -* Technique: -** Name: Masquerading -** ID: T1036 -** Reference URL: https://attack.mitre.org/techniques/T1036/ -* Sub-technique: -** Name: Match Legitimate Name or Location -** ID: T1036.005 -** Reference URL: https://attack.mitre.org/techniques/T1036/005/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-rare-aws-error-code.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-rare-aws-error-code.asciidoc deleted file mode 100644 index ea9f409c77..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-rare-aws-error-code.asciidoc +++ /dev/null @@ -1,57 +0,0 @@ -[[prebuilt-rule-0-14-2-rare-aws-error-code]] -=== Rare AWS Error Code - -A machine learning job detected an unusual error in a CloudTrail message. These can be byproducts of attempted or successful persistence, privilege escalation, defense evasion, discovery, lateral movement, or collection. - -*Rule type*: machine_learning - -*Rule indices*: None - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 15m - -*Searches indices from*: now-2h ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html - -*Tags*: - -* Elastic -* Cloud -* AWS -* ML - -*Version*: 7 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Config - -The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. - -## Triage and analysis - -Investigating Unusual CloudTrail Error Activity ### -Detection alerts from this rule indicate a rare and unusual error code that was associated with the response to an AWS API command or method call. Here are some possible avenues of investigation: -- Examine the history of the error. Has it manifested before? If the error, which is visible in the `aws.cloudtrail.error_code field`, only manifested recently, it might be related to recent changes in an automation module or script. -- Examine the request parameters. These may provide indications as to the nature of the task being performed when the error occurred. Is the error related to unsuccessful attempts to enumerate or access objects, data, or secrets? If so, this can sometimes be a byproduct of discovery, privilege escalation, or lateral movement attempts. -- Consider the user as identified by the `user.name` field. Is this activity part of an expected workflow for the user context? Examine the user identity in the `aws.cloudtrail.user_identity.arn` field and the access key ID in the `aws.cloudtrail.user_identity.access_key_id` field, which can help identify the precise user context. The user agent details in the `user_agent.original` field may also indicate what kind of a client made the request. -- Consider the source IP address and geolocation for the calling user who issued the command. Do they look normal for the calling user? If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts, or could it be sourcing from an EC2 instance that's not under your control? If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles? Are there any other alerts or signs of suspicious activity involving this instance? ----------------------------------- diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-rare-user-logon.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-rare-user-logon.asciidoc deleted file mode 100644 index 71f5fe3eb1..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-rare-user-logon.asciidoc +++ /dev/null @@ -1,38 +0,0 @@ -[[prebuilt-rule-0-14-2-rare-user-logon]] -=== Rare User Logon - -A machine learning job found an unusual user name in the authentication logs. An unusual user name is one way of detecting credentialed access by means of a new or dormant user account. An inactive user account (because the user has left the organization) that becomes active may be due to credentialed access using a compromised account password. Threat actors will sometimes also create new users as a means of persisting in a compromised web application. - -*Rule type*: machine_learning - -*Rule indices*: None - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 15m - -*Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html - -*Tags*: - -* Elastic -* Authentication -* Threat Detection -* ML - -*Version*: 3 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-rdp-enabled-via-registry.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-rdp-enabled-via-registry.asciidoc deleted file mode 100644 index a2fcea100a..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-rdp-enabled-via-registry.asciidoc +++ /dev/null @@ -1,68 +0,0 @@ -[[prebuilt-rule-0-14-2-rdp-enabled-via-registry]] -=== RDP Enabled via Registry - -Identifies registry write modifications to enable Remote Desktop Protocol (RDP) access. This could be indicative of adversary lateral movement preparation. - -*Rule type*: eql - -*Rule indices*: - -* logs-endpoint.events.* -* winlogbeat-* -* logs-windows.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Lateral Movement - -*Version*: 4 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -registry where -registry.path : "HKLM\\SYSTEM\\ControlSet*\\Control\\Terminal Server\\fDenyTSConnections" and -registry.data.strings == "0" and not (process.name : "svchost.exe" and user.domain == "NT AUTHORITY") and -not process.executable : "C:\\Windows\\System32\\SystemPropertiesRemote.exe" - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Lateral Movement -** ID: TA0008 -** Reference URL: https://attack.mitre.org/tactics/TA0008/ -* Technique: -** Name: Remote Services -** ID: T1021 -** Reference URL: https://attack.mitre.org/techniques/T1021/ -* Sub-technique: -** Name: Remote Desktop Protocol -** ID: T1021.001 -** Reference URL: https://attack.mitre.org/techniques/T1021/001/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-remote-desktop-enabled-in-windows-firewall.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-remote-desktop-enabled-in-windows-firewall.asciidoc deleted file mode 100644 index 26f107637e..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-remote-desktop-enabled-in-windows-firewall.asciidoc +++ /dev/null @@ -1,68 +0,0 @@ -[[prebuilt-rule-0-14-2-remote-desktop-enabled-in-windows-firewall]] -=== Remote Desktop Enabled in Windows Firewall - -Identifies use of the network shell utility (netsh.exe) to enable inbound Remote Desktop Protocol (RDP) connections in the Windows Firewall. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Defense Evasion - -*Version*: 4 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type in ("start", "process_started") and - (process.name : "netsh.exe" or process.pe.original_file_name == "netsh.exe") and - process.args : ("localport=3389", "RemoteDesktop", "group=\"remote desktop\"") and - process.args : ("action=allow", "enable=Yes", "enable") - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Defense Evasion -** ID: TA0005 -** Reference URL: https://attack.mitre.org/tactics/TA0005/ -* Technique: -** Name: Impair Defenses -** ID: T1562 -** Reference URL: https://attack.mitre.org/techniques/T1562/ -* Sub-technique: -** Name: Disable or Modify System Firewall -** ID: T1562.004 -** Reference URL: https://attack.mitre.org/techniques/T1562/004/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-remote-file-copy-via-teamviewer.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-remote-file-copy-via-teamviewer.asciidoc deleted file mode 100644 index 2d5ce573d1..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-remote-file-copy-via-teamviewer.asciidoc +++ /dev/null @@ -1,68 +0,0 @@ -[[prebuilt-rule-0-14-2-remote-file-copy-via-teamviewer]] -=== Remote File Copy via TeamViewer - -Identifies an executable or script file remotely downloaded via a TeamViewer transfer session. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://blog.menasec.net/2019/11/hunting-for-suspicious-use-of.html - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Command and Control - -*Version*: 5 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -file where event.type == "creation" and process.name : "TeamViewer.exe" and - file.extension : ("exe", "dll", "scr", "com", "bat", "ps1", "vbs", "vbe", "js", "wsh", "hta") - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Command and Control -** ID: TA0011 -** Reference URL: https://attack.mitre.org/tactics/TA0011/ -* Technique: -** Name: Ingress Tool Transfer -** ID: T1105 -** Reference URL: https://attack.mitre.org/techniques/T1105/ -* Technique: -** Name: Remote Access Software -** ID: T1219 -** Reference URL: https://attack.mitre.org/techniques/T1219/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-remote-scheduled-task-creation.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-remote-scheduled-task-creation.asciidoc deleted file mode 100644 index a2e563f20b..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-remote-scheduled-task-creation.asciidoc +++ /dev/null @@ -1,122 +0,0 @@ -[[prebuilt-rule-0-14-2-remote-scheduled-task-creation]] -=== Remote Scheduled Task Creation - -Identifies remote scheduled task creations on a target host. This could be indicative of adversary lateral movement. - -*Rule type*: eql - -*Rule indices*: - -* logs-endpoint.events.* -* winlogbeat-* -* logs-windows.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Lateral Movement - -*Version*: 4 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Triage and analysis - -### Investigating Creation of Remote Scheduled Tasks - -[Scheduled tasks](https://docs.microsoft.com/en-us/windows/win32/taskschd/about-the-task-scheduler) are a great mechanism used for persistence and executing programs. These features can -be used remotely for a variety of legitimate reasons, but at the same time used by malware and adversaries. -When investigating scheduled tasks that have been set-up remotely, one of the first methods should be determining the -original intent behind the configuration and verify if the activity is tied to benign behavior such as software installations or any kind -of network administrator work. One objective for these alerts is to understand the configured action within the scheduled -task, this is captured within the registry event data for this rule and can be base64 decoded to view the value. - -#### Possible investigation steps: -- Review the base64 encoded tasks actions registry value to investigate the task configured action. -- Determine if task is related to legitimate or benign behavior based on the corresponding process or program tied to the -scheduled task. -- Further examination should include both the source and target machines where host-based artifacts and network logs -should be reviewed further around the time window of the creation of the scheduled task. - -### False Positive Analysis -- There is a high possibility of benign activity tied to the creation of remote scheduled tasks as it is a general feature -within Windows and used for legitimate purposes for a wide range of activity. Any kind of context should be found to -further understand the source of the activity and determine the intent based on the scheduled task contents. - -### Related Rules -- Service Command Lateral Movement -- Remotely Started Services via RPC - -### Response and Remediation -- This behavior represents post-exploitation actions such as persistence or lateral movement, immediate response should -be taken to review and investigate the activity and potentially isolate involved machines to prevent further post-compromise -behavior. -- Remove scheduled task and any other related artifacts to the activity. -- Review privileged account management and user account management settings such as implementing GPO policies to further -restrict activity or configure settings that only allow Administrators to create remote scheduled tasks. - ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -/* Task Scheduler service incoming connection followed by TaskCache registry modification */ - -sequence by host.id, process.entity_id with maxspan = 1m - [network where process.name : "svchost.exe" and - network.direction == "incoming" and source.port >= 49152 and destination.port >= 49152 and - source.address != "127.0.0.1" and source.address != "::1" - ] - [registry where registry.path : "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\*\\Actions"] - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Lateral Movement -** ID: TA0008 -** Reference URL: https://attack.mitre.org/tactics/TA0008/ -* Technique: -** Name: Remote Services -** ID: T1021 -** Reference URL: https://attack.mitre.org/techniques/T1021/ -* Tactic: -** Name: Execution -** ID: TA0002 -** Reference URL: https://attack.mitre.org/tactics/TA0002/ -* Technique: -** Name: Scheduled Task/Job -** ID: T1053 -** Reference URL: https://attack.mitre.org/techniques/T1053/ -* Sub-technique: -** Name: Scheduled Task -** ID: T1053.005 -** Reference URL: https://attack.mitre.org/techniques/T1053/005/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-renamed-autoit-scripts-interpreter.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-renamed-autoit-scripts-interpreter.asciidoc deleted file mode 100644 index 5b28390775..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-renamed-autoit-scripts-interpreter.asciidoc +++ /dev/null @@ -1,66 +0,0 @@ -[[prebuilt-rule-0-14-2-renamed-autoit-scripts-interpreter]] -=== Renamed AutoIt Scripts Interpreter - -Identifies a suspicious AutoIt process execution. Malware written as an AutoIt script tends to rename the AutoIt executable to avoid detection. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Defense Evasion - -*Version*: 5 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type in ("start", "process_started", "info") and - process.pe.original_file_name : "AutoIt*.exe" and not process.name : "AutoIt*.exe" - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Defense Evasion -** ID: TA0005 -** Reference URL: https://attack.mitre.org/tactics/TA0005/ -* Technique: -** Name: Masquerading -** ID: T1036 -** Reference URL: https://attack.mitre.org/techniques/T1036/ -* Sub-technique: -** Name: Rename System Utilities -** ID: T1036.003 -** Reference URL: https://attack.mitre.org/techniques/T1036/003/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-roshal-archive-rar-or-powershell-file-downloaded-from-the-internet.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-roshal-archive-rar-or-powershell-file-downloaded-from-the-internet.asciidoc deleted file mode 100644 index 358a96ae95..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-roshal-archive-rar-or-powershell-file-downloaded-from-the-internet.asciidoc +++ /dev/null @@ -1,110 +0,0 @@ -[[prebuilt-rule-0-14-2-roshal-archive-rar-or-powershell-file-downloaded-from-the-internet]] -=== Roshal Archive (RAR) or PowerShell File Downloaded from the Internet - -Detects a Roshal Archive (RAR) file or PowerShell script downloaded from the internet by an internal host. Gaining initial access to a system and then downloading encoded or encrypted tools to move laterally is a common practice for adversaries as a way to protect their more valuable tools and tactics, techniques, and procedures (TTPs). This may be atypical behavior for a managed network and can be indicative of malware, exfiltration, or command and control. - -*Rule type*: query - -*Rule indices*: - -* auditbeat-* -* filebeat-* -* packetbeat-* -* logs-endpoint.events.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html -* https://www.justice.gov/opa/press-release/file/1084361/download -* https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml - -*Tags*: - -* Elastic -* Network -* Threat Detection -* Command and Control -* Host - -*Version*: 8 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Threat intel - -This activity has been observed in FIN7 campaigns. ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -event.category:(network or network_traffic) and network.protocol:http and - (url.extension:(ps1 or rar) or url.path:(*.ps1 or *.rar)) and - not destination.ip:( - 10.0.0.0/8 or - 127.0.0.0/8 or - 169.254.0.0/16 or - 172.16.0.0/12 or - 192.0.0.0/24 or - 192.0.0.0/29 or - 192.0.0.8/32 or - 192.0.0.9/32 or - 192.0.0.10/32 or - 192.0.0.170/32 or - 192.0.0.171/32 or - 192.0.2.0/24 or - 192.31.196.0/24 or - 192.52.193.0/24 or - 192.168.0.0/16 or - 192.88.99.0/24 or - 224.0.0.0/4 or - 100.64.0.0/10 or - 192.175.48.0/24 or - 198.18.0.0/15 or - 198.51.100.0/24 or - 203.0.113.0/24 or - 240.0.0.0/4 or - "::1" or - "FE80::/10" or - "FF00::/8" - ) and - source.ip:( - 10.0.0.0/8 or - 172.16.0.0/12 or - 192.168.0.0/16 - ) - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Command and Control -** ID: TA0011 -** Reference URL: https://attack.mitre.org/tactics/TA0011/ -* Technique: -** Name: Ingress Tool Transfer -** ID: T1105 -** Reference URL: https://attack.mitre.org/techniques/T1105/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-scheduled-task-created-by-a-windows-script.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-scheduled-task-created-by-a-windows-script.asciidoc deleted file mode 100644 index 2b2e1f7da7..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-scheduled-task-created-by-a-windows-script.asciidoc +++ /dev/null @@ -1,77 +0,0 @@ -[[prebuilt-rule-0-14-2-scheduled-task-created-by-a-windows-script]] -=== Scheduled Task Created by a Windows Script - -A scheduled task was created by a Windows script via cscript.exe, wscript.exe or powershell.exe. This can be abused by an adversary to establish persistence. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Persistence - -*Version*: 4 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Triage and analysis - -Decode the base64 encoded Tasks Actions registry value to investigate the task's configured action. ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -sequence by host.id with maxspan = 30s - [library where dll.name : "taskschd.dll" and process.name : ("cscript.exe", "wscript.exe", "powershell.exe")] - [registry where registry.path : "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\*\\Actions"] - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Persistence -** ID: TA0003 -** Reference URL: https://attack.mitre.org/tactics/TA0003/ -* Technique: -** Name: Scheduled Task/Job -** ID: T1053 -** Reference URL: https://attack.mitre.org/techniques/T1053/ -* Sub-technique: -** Name: Scheduled Task -** ID: T1053.005 -** Reference URL: https://attack.mitre.org/techniques/T1053/005/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-screensaver-plist-file-modified-by-unexpected-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-screensaver-plist-file-modified-by-unexpected-process.asciidoc deleted file mode 100644 index f439ed5a3c..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-screensaver-plist-file-modified-by-unexpected-process.asciidoc +++ /dev/null @@ -1,88 +0,0 @@ -[[prebuilt-rule-0-14-2-screensaver-plist-file-modified-by-unexpected-process]] -=== Screensaver Plist File Modified by Unexpected Process - -Identifies when a screensaver plist file is modified by an unexpected process. An adversary can maintain persistence on a macOS endpoint by creating a malicious screensaver (.saver) file and configuring the screensaver plist file to execute code each time the screensaver is activated. - -*Rule type*: eql - -*Rule indices*: - -* auditbeat-* -* logs-endpoint.events.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://posts.specterops.io/saving-your-access-d562bf5bf90b -* https://github.com/D00MFist/PersistentJXA - -*Tags*: - -* Elastic -* Host -* macOS -* Threat Detection -* Persistence - -*Version*: 1 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Triage and analysis - -- Analyze the plist file modification event to identify whether the change was expected or not -- Investigate the process that modified the plist file for malicious code or other suspicious behavior -- Identify if any suspicious or known malicious screensaver (.saver) files were recently written to or modified on the host ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -file where event.type != "deletion" and - file.name: "com.apple.screensaver.*.plist" and - file.path : ( - "/Users/*/Library/Preferences/ByHost/*", - "/Library/Managed Preferences/*", - "/System/Library/Preferences/*" - ) and - /* Filter OS processes modifying screensaver plist files */ - not process.executable : ( - "/usr/sbin/cfprefsd", - "/usr/libexec/xpcproxy", - "/System/Library/CoreServices/ManagedClient.app/Contents/Resources/MCXCompositor", - "/System/Library/CoreServices/ManagedClient.app/Contents/MacOS/ManagedClient" - ) - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Persistence -** ID: TA0003 -** Reference URL: https://attack.mitre.org/tactics/TA0003/ -* Technique: -** Name: Event Triggered Execution -** ID: T1546 -** Reference URL: https://attack.mitre.org/techniques/T1546/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-searching-for-saved-credentials-via-vaultcmd.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-searching-for-saved-credentials-via-vaultcmd.asciidoc deleted file mode 100644 index 5efc6a8ace..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-searching-for-saved-credentials-via-vaultcmd.asciidoc +++ /dev/null @@ -1,74 +0,0 @@ -[[prebuilt-rule-0-14-2-searching-for-saved-credentials-via-vaultcmd]] -=== Searching for Saved Credentials via VaultCmd - -Windows Credential Manager allows you to create, view, or delete saved credentials for signing into websites, connected applications, and networks. An adversary may abuse this to list or dump credentials stored in the Credential Manager for saved usernames and passwords. This may also be performed in preparation of lateral movement. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16 -* https://rastamouse.me/blog/rdp-jump-boxes/ - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Credential Access - -*Version*: 2 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type in ("start", "process_started") and - (process.pe.original_file_name:"vaultcmd.exe" or process.name:"vaultcmd.exe") and - process.args:"/list*" - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Credential Access -** ID: TA0006 -** Reference URL: https://attack.mitre.org/tactics/TA0006/ -* Technique: -** Name: OS Credential Dumping -** ID: T1003 -** Reference URL: https://attack.mitre.org/techniques/T1003/ -* Technique: -** Name: Credentials from Password Stores -** ID: T1555 -** Reference URL: https://attack.mitre.org/techniques/T1555/ -* Sub-technique: -** Name: Windows Credential Manager -** ID: T1555.004 -** Reference URL: https://attack.mitre.org/techniques/T1555/004/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-security-software-discovery-using-wmic.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-security-software-discovery-using-wmic.asciidoc deleted file mode 100644 index e6bc087f97..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-security-software-discovery-using-wmic.asciidoc +++ /dev/null @@ -1,67 +0,0 @@ -[[prebuilt-rule-0-14-2-security-software-discovery-using-wmic]] -=== Security Software Discovery using WMIC - -Identifies the use of Windows Management Instrumentation Command (WMIC) to discover certain System Security Settings such as AntiVirus or Host Firewall details. - -*Rule type*: eql - -*Rule indices*: - -* logs-endpoint.events.* -* winlogbeat-* -* logs-windows.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Discovery - -*Version*: 4 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type in ("start", "process_started") and - (process.name:"wmic.exe" or process.pe.original_file_name:"wmic.exe") and - process.args:"/namespace:\\\\root\\SecurityCenter2" and process.args:"Get" - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Discovery -** ID: TA0007 -** Reference URL: https://attack.mitre.org/tactics/TA0007/ -* Technique: -** Name: Software Discovery -** ID: T1518 -** Reference URL: https://attack.mitre.org/techniques/T1518/ -* Sub-technique: -** Name: Security Software Discovery -** ID: T1518.001 -** Reference URL: https://attack.mitre.org/techniques/T1518/001/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-spike-in-aws-error-messages.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-spike-in-aws-error-messages.asciidoc deleted file mode 100644 index 4af65b6a12..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-spike-in-aws-error-messages.asciidoc +++ /dev/null @@ -1,80 +0,0 @@ -[[prebuilt-rule-0-14-2-spike-in-aws-error-messages]] -=== Spike in AWS Error Messages - -A machine learning job detected a significant spike in the rate of a particular error in the CloudTrail messages. Spikes in error messages may accompany attempts at privilege escalation, lateral movement, or discovery. - -*Rule type*: machine_learning - -*Rule indices*: None - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 15m - -*Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html - -*Tags*: - -* Elastic -* Cloud -* AWS -* ML - -*Version*: 7 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Config - -The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. - -## Triage and analysis - -### Investigating Spikes in CloudTrail Errors - -CloudTrail logging provides visibility on actions taken within an AWS environment. By monitoring these events and understanding -what is considered normal behavior within an organization, suspicious or malicious activity can be spotted when deviations -are observed. This example rule triggers from a large spike in the number of CloudTrail log messages that contain a -particular error message. The error message in question was associated with the response to an AWS API command or method call, -this has the potential to uncover unknown threats or activity. - -#### Possible investigation steps: -- Examine the history of the error. Has it manifested before? If the error, which is visible in the `aws.cloudtrail.error_message` field, only manifested recently, it might be related to recent changes in an automation module or script. -- Examine the request parameters. These may provide indications as to the nature of the task being performed when the error occurred. Is the error related to unsuccessful attempts to enumerate or access objects, data, or secrets? If so, this can sometimes be a byproduct of discovery, privilege escalation or lateral movement attempts. -- Consider the user as identified by the `user.name field`. Is this activity part of an expected workflow for the user context? Examine the user identity in the `aws.cloudtrail.user_identity.arn` field and the access key ID in the `aws.cloudtrail.user_identity.access_key_id` field, which can help identify the precise user context. The user agent details in the `user_agent.original` field may also indicate what kind of a client made the request. -- Consider the source IP address and geolocation for the calling user who issued the command. Do they look normal for the calling user? If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts, or could it be sourcing from an EC2 instance that's not under your control? If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles? Are there any other alerts or signs of suspicious activity involving this instance? - -### False Positive Analysis -- This rule has the possibility to produce false positives based on unexpected activity occurring such as bugs or recent -changes to automation modules or scripting. -- Adoption of new services or implementing new functionality to scripts may generate false positives - -### Related Rules -- Unusual AWS Command for a User -- Rare AWS Error Code - -### Response and Remediation -- If activity is observed as suspicious or malicious, immediate response should be looked into rotating and deleting AWS IAM access keys -- Validate if any unauthorized new users were created, remove these accounts and request password resets for other IAM users -- Look into enabling multi-factor authentication for users -- Follow security best practices [outlined](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/) by AWS - ----------------------------------- diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-spike-in-logon-events-from-a-source-ip.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-spike-in-logon-events-from-a-source-ip.asciidoc deleted file mode 100644 index 63fd6d9984..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-spike-in-logon-events-from-a-source-ip.asciidoc +++ /dev/null @@ -1,38 +0,0 @@ -[[prebuilt-rule-0-14-2-spike-in-logon-events-from-a-source-ip]] -=== Spike in Logon Events from a Source IP - -A machine learning job found an unusually large spike in successful authentication events from a particular source IP address. This can be due to password spraying, user enumeration or brute force activity. - -*Rule type*: machine_learning - -*Rule indices*: None - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 15m - -*Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html - -*Tags*: - -* Elastic -* Authentication -* Threat Detection -* ML - -*Version*: 2 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-suspicious-execution-via-scheduled-task.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-suspicious-execution-via-scheduled-task.asciidoc deleted file mode 100644 index 28213fbb91..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-suspicious-execution-via-scheduled-task.asciidoc +++ /dev/null @@ -1,97 +0,0 @@ -[[prebuilt-rule-0-14-2-suspicious-execution-via-scheduled-task]] -=== Suspicious Execution via Scheduled Task - -Identifies execution of a suspicious program via scheduled tasks by looking at process lineage and command line usage. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Persistence - -*Version*: 4 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type == "start" and - /* Schedule service cmdline on Win10+ */ - process.parent.name : "svchost.exe" and process.parent.args : "Schedule" and - /* add suspicious programs here */ - process.pe.original_file_name in - ( - "cscript.exe", - "wscript.exe", - "PowerShell.EXE", - "Cmd.Exe", - "MSHTA.EXE", - "RUNDLL32.EXE", - "REGSVR32.EXE", - "MSBuild.exe", - "InstallUtil.exe", - "RegAsm.exe", - "RegSvcs.exe", - "msxsl.exe", - "CONTROL.EXE", - "EXPLORER.EXE", - "Microsoft.Workflow.Compiler.exe", - "msiexec.exe" - ) and - /* add suspicious paths here */ - process.args : ( - "C:\\Users\\*", - "C:\\ProgramData\\*", - "C:\\Windows\\Temp\\*", - "C:\\Windows\\Tasks\\*", - "C:\\PerfLogs\\*", - "C:\\Intel\\*", - "C:\\Windows\\Debug\\*", - "C:\\HP\\*") - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Persistence -** ID: TA0003 -** Reference URL: https://attack.mitre.org/tactics/TA0003/ -* Technique: -** Name: Scheduled Task/Job -** ID: T1053 -** Reference URL: https://attack.mitre.org/techniques/T1053/ -* Sub-technique: -** Name: Scheduled Task -** ID: T1053.005 -** Reference URL: https://attack.mitre.org/techniques/T1053/005/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-suspicious-ms-office-child-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-suspicious-ms-office-child-process.asciidoc deleted file mode 100644 index 16db871d7f..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-suspicious-ms-office-child-process.asciidoc +++ /dev/null @@ -1,73 +0,0 @@ -[[prebuilt-rule-0-14-2-suspicious-ms-office-child-process]] -=== Suspicious MS Office Child Process - -Identifies suspicious child processes of frequently targeted Microsoft Office applications (Word, PowerPoint, Excel). These child processes are often launched during exploitation of Office applications or from documents with malicious macros. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Initial Access - -*Version*: 9 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type in ("start", "process_started") and - process.parent.name : ("eqnedt32.exe", "excel.exe", "fltldr.exe", "msaccess.exe", "mspub.exe", "powerpnt.exe", "winword.exe") and - process.name : ("Microsoft.Workflow.Compiler.exe", "arp.exe", "atbroker.exe", "bginfo.exe", "bitsadmin.exe", "cdb.exe", "certutil.exe", - "cmd.exe", "cmstp.exe", "control.exe", "cscript.exe", "csi.exe", "dnx.exe", "dsget.exe", "dsquery.exe", "forfiles.exe", - "fsi.exe", "ftp.exe", "gpresult.exe", "hostname.exe", "ieexec.exe", "iexpress.exe", "installutil.exe", "ipconfig.exe", - "mshta.exe", "msxsl.exe", "nbtstat.exe", "net.exe", "net1.exe", "netsh.exe", "netstat.exe", "nltest.exe", "odbcconf.exe", - "ping.exe", "powershell.exe", "pwsh.exe", "qprocess.exe", "quser.exe", "qwinsta.exe", "rcsi.exe", "reg.exe", "regasm.exe", - "regsvcs.exe", "regsvr32.exe", "sc.exe", "schtasks.exe", "systeminfo.exe", "tasklist.exe", "tracert.exe", "whoami.exe", - "wmic.exe", "wscript.exe", "xwizard.exe", "explorer.exe", "rundll32.exe", "hh.exe") - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Initial Access -** ID: TA0001 -** Reference URL: https://attack.mitre.org/tactics/TA0001/ -* Technique: -** Name: Phishing -** ID: T1566 -** Reference URL: https://attack.mitre.org/techniques/T1566/ -* Sub-technique: -** Name: Spearphishing Attachment -** ID: T1566.001 -** Reference URL: https://attack.mitre.org/techniques/T1566/001/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-suspicious-net-code-compilation.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-suspicious-net-code-compilation.asciidoc deleted file mode 100644 index a58d117408..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-suspicious-net-code-compilation.asciidoc +++ /dev/null @@ -1,67 +0,0 @@ -[[prebuilt-rule-0-14-2-suspicious-net-code-compilation]] -=== Suspicious .NET Code Compilation - -Identifies suspicious .NET code execution. connections. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Defense Evasion - -*Version*: 5 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type in ("start", "process_started") and - process.name : ("csc.exe", "vbc.exe") and - process.parent.name : ("wscript.exe", "mshta.exe", "cscript.exe", "wmic.exe", "svchost.exe", "rundll32.exe", "cmstp.exe", "regsvr32.exe") - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Defense Evasion -** ID: TA0005 -** Reference URL: https://attack.mitre.org/tactics/TA0005/ -* Technique: -** Name: Obfuscated Files or Information -** ID: T1027 -** Reference URL: https://attack.mitre.org/techniques/T1027/ -* Sub-technique: -** Name: Compile After Delivery -** ID: T1027.004 -** Reference URL: https://attack.mitre.org/techniques/T1027/004/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-suspicious-startup-shell-folder-modification.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-suspicious-startup-shell-folder-modification.asciidoc deleted file mode 100644 index 7fc85ac8d6..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-suspicious-startup-shell-folder-modification.asciidoc +++ /dev/null @@ -1,119 +0,0 @@ -[[prebuilt-rule-0-14-2-suspicious-startup-shell-folder-modification]] -=== Suspicious Startup Shell Folder Modification - -Identifies suspicious startup shell folder modifications to change the default Startup directory in order to bypass detections monitoring file creation in the Windows Startup folder. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: high - -*Risk score*: 73 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Persistence - -*Version*: 2 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Triage and analysis - -### Investigating Suspicious Startup Shell Activity - -Techniques used within malware and by adversaries often leverage the Windows registry to store malicious programs for -persistence. Startup shell folders are often targeted as they are not as prevalent as normal Startup folder paths so this -behavior may evade existing AV/EDR solutions. Another preference is that these programs might run with higher privileges -which can be ideal for an attacker. - -#### Possible investigation steps: -- Review the source process and related file tied to the Windows Registry entry -- Validate the activity is not related to planned patches, updates, network administrator activity or legitimate software -installations -- Determine if activity is unique by validating if other machines in same organization have similar entry - -### False Positive Analysis -- There is a high possibility of benign legitimate programs being added to Shell folders. This activity could be based -on new software installations, patches, or any kind of network administrator related activity. Before entering further -investigation, this activity should be validated that is it not related to benign activity - -### Related Rules -- Startup or Run Key Registry Modification -- Persistent Scripts in the Startup Directory - -### Response and Remediation -- Activity should first be validated as a true positive event if so then immediate response should be taken to review, -investigate and potentially isolate activity to prevent further post-compromise behavior -- The respective binary or program tied to this persistence method should be further analyzed and reviewed to understand -it's behavior and capabilities -- Since this activity is considered post-exploitation behavior, it's important to understand how the behavior was first -initialized such as through a macro-enabled document that was attached in a phishing email. By understanding the source -of the attack, this information can then be used to search for similar indicators on other machines in the same environment. - ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -registry where - registry.path : ( - "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Common Startup", - "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\Common Startup", - "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Startup", - "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\Startup" - ) and - registry.data.strings != null and - /* Normal Startup Folder Paths */ - not registry.data.strings : ( - "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", - "%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", - "%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", - "C:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup" - ) - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Persistence -** ID: TA0003 -** Reference URL: https://attack.mitre.org/tactics/TA0003/ -* Technique: -** Name: Boot or Logon Autostart Execution -** ID: T1547 -** Reference URL: https://attack.mitre.org/techniques/T1547/ -* Sub-technique: -** Name: Registry Run Keys / Startup Folder -** ID: T1547.001 -** Reference URL: https://attack.mitre.org/techniques/T1547/001/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-third-party-backup-files-deleted-via-unexpected-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-third-party-backup-files-deleted-via-unexpected-process.asciidoc deleted file mode 100644 index aba5c2fcb3..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-third-party-backup-files-deleted-via-unexpected-process.asciidoc +++ /dev/null @@ -1,75 +0,0 @@ -[[prebuilt-rule-0-14-2-third-party-backup-files-deleted-via-unexpected-process]] -=== Third-party Backup Files Deleted via Unexpected Process - -Identifies the deletion of backup files, saved using third-party software, by a process outside of the backup suite. Adversaries may delete Backup files to ensure that recovery from a Ransomware attack is less likely. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.advintel.io/post/backup-removal-solutions-from-conti-ransomware-with-love - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Impact - -*Version*: 1 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -file where event.type == "deletion" and - ( - /* Veeam Related Backup Files */ - (file.extension : ("VBK", "VIB", "VBM") and - not process.executable : ("?:\\Windows\\Veeam\\Backup\\*", - "?:\\Program Files\\Veeam\\Backup and Replication\\*", - "?:\\Program Files (x86)\\Veeam\\Backup and Replication\\*")) or - - /* Veritas Backup Exec Related Backup File */ - (file.extension : "BKF" and - not process.executable : ("?:\\Program Files\\Veritas\\Backup Exec\\*", - "?:\\Program Files (x86)\\Veritas\\Backup Exec\\*")) - ) - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Impact -** ID: TA0040 -** Reference URL: https://attack.mitre.org/tactics/TA0040/ -* Technique: -** Name: Inhibit System Recovery -** ID: T1490 -** Reference URL: https://attack.mitre.org/techniques/T1490/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-threat-intel-filebeat-module-indicator-match.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-threat-intel-filebeat-module-indicator-match.asciidoc deleted file mode 100644 index 4c2447b42e..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-threat-intel-filebeat-module-indicator-match.asciidoc +++ /dev/null @@ -1,106 +0,0 @@ -[[prebuilt-rule-0-14-2-threat-intel-filebeat-module-indicator-match]] -=== Threat Intel Filebeat Module Indicator Match - -This rule is triggered when indicators from the Threat Intel Filebeat module has a match against local file or network observations. - -*Rule type*: threat_match - -*Rule indices*: - -* auditbeat-* -* endgame-* -* filebeat-* -* logs-* -* packetbeat-* -* winlogbeat-* - -*Severity*: critical - -*Risk score*: 99 - -*Runs every*: 9m - -*Searches indices from*: now-10m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-threatintel.html - -*Tags*: - -* Elastic -* Windows -* Elastic Endgame -* Network -* Continuous Monitoring -* SecOps -* Monitoring - -*Version*: 2 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Triage and Analysis - -### Investigating Threat Intel Indicator Matches - -Threat Intel indicator match rules allow matching from a local observation such as an endpoint event that records a file -hash with an entry of a file hash stored within the Threat Intel Filebeat module. Other examples of matches can occur on -an IP address, registry path, URL and imphash. - -The matches will be based on the incoming feed data so it's important to validate the data and review the results by -investigating the associated activity to determine if it requires further investigation. - -If an indicator matches a local observation, the following enriched fields will be generated to identify the indicator, field, and type matched. - -- `threatintel.indicator.matched.atomic` - this identifies the atomic indicator that matched the local observation -- `threatintel.indicator.matched.field` - this identifies the indicator field that matched the local observation -- `threatintel.indicator.matched.type` - this identifies the indicator type that matched the local observation - -#### Possible investigation steps: -- Investigation should be validated and reviewed based on the data (file hash, registry path, URL, imphash) that was matched -and viewing the source of that activity. -- Consider the history of the indicator that was matched. Has it happened before? Is it happening on multiple machines? -These kinds of questions can help understand if the activity is related to legitimate behavior. -- Consider the user and their role within the company, is this something related to their job or work function? - -### False Positive Analysis -- For any matches found, it's important to consider the initial release date of that indicator. Threat intelligence can -be a great tool for augmenting existing security processes, while at the same time it should be understood that threat -intelligence can represent a specific set of activity observed at a point in time. For example, an IP address -may have hosted malware observed in a Dridex campaign six months ago, but it's possible that IP has been remediated and -no longer represents any threat. -- Adversaries often use legitimate tools as network administrators such as `PsExec` or `AdFind`, these tools often find their -way into indicator lists creating the potential for false positives. -- It's possible after large and publicly written campaigns, curious employees might end up going directly to attacker infrastructure and generating these rules - -### Response and Remediation -- If suspicious or malicious behavior is observed, immediate response should be taken to isolate activity to prevent further -post-compromise behavior. -- One example of a response if a machine matched a command and control IP address would be to add an entry to a network -device such as a firewall or proxy appliance to prevent any outbound activity from leaving that machine. -- Another example of a response with a malicious file hash match would involve validating if the file was properly quarantined, -review current running processes looking for any abnormal activity, and investigating for any other follow-up actions such as persistence or lateral movement - ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -file.hash.*:* or file.pe.imphash:* or source.ip:* or destination.ip:* or url.full:* or registry.path:* - ----------------------------------- diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-unauthorized-access-to-an-okta-application.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-unauthorized-access-to-an-okta-application.asciidoc deleted file mode 100644 index 80011d394d..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-unauthorized-access-to-an-okta-application.asciidoc +++ /dev/null @@ -1,84 +0,0 @@ -[[prebuilt-rule-0-14-2-unauthorized-access-to-an-okta-application]] -=== Unauthorized Access to an Okta Application - -Identifies when an unauthorized access attempt is made by a user for an Okta application. - -*Rule type*: query - -*Rule indices*: - -* filebeat-* -* logs-okta* - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 5m - -*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Identity -* Okta -* Continuous Monitoring -* SecOps -* Identity and Access - -*Version*: 1 - -*Rule authors*: - -* Elastic -* Austin Songer - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Config - -The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -event.dataset:okta.system and event.action:app.generic.unauth_app_access_attempt - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Initial Access -** ID: TA0001 -** Reference URL: https://attack.mitre.org/tactics/TA0001/ -* Technique: -** Name: Valid Accounts -** ID: T1078 -** Reference URL: https://attack.mitre.org/techniques/T1078/ -* Tactic: -** Name: Defense Evasion -** ID: TA0005 -** Reference URL: https://attack.mitre.org/tactics/TA0005/ -* Tactic: -** Name: Persistence -** ID: TA0003 -** Reference URL: https://attack.mitre.org/tactics/TA0003/ -* Tactic: -** Name: Privilege Escalation -** ID: TA0004 -** Reference URL: https://attack.mitre.org/tactics/TA0004/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-uncommon-registry-persistence-change.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-uncommon-registry-persistence-change.asciidoc deleted file mode 100644 index 5bd05c6a6b..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-uncommon-registry-persistence-change.asciidoc +++ /dev/null @@ -1,133 +0,0 @@ -[[prebuilt-rule-0-14-2-uncommon-registry-persistence-change]] -=== Uncommon Registry Persistence Change - -Detects changes to registry persistence keys that are uncommonly used or modified by legitimate programs. This could be an indication of an adversary's attempt to persist in a stealthy manner. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.microsoftpressstore.com/articles/article.aspx?p=2762082&seqNum=2 - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Persistence - -*Version*: 4 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -registry where - /* uncomment once stable length(registry.data.strings) > 0 and */ - registry.path : ( - "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\Install\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\*", - "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\Install\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Runonce\\*", - "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\Load", - "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\Run", - "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\IconServiceLib", - "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell", - "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell", - "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\AppSetup", - "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Taskman", - "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Userinit", - "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\VmApplet", - "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*", - "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Shell", - "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Logoff\\Script", - "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Logon\\Script", - "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Shutdown\\Script", - "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Startup\\Script", - "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*", - "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Shell", - "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Logoff\\Script", - "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Logon\\Script", - "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Shutdown\\Script", - "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Startup\\Script", - "HKLM\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components\\*\\ShellComponent", - "HKLM\\SOFTWARE\\Microsoft\\Windows CE Services\\AutoStartOnConnect\\MicrosoftActiveSync", - "HKLM\\SOFTWARE\\Microsoft\\Windows CE Services\\AutoStartOnDisconnect\\MicrosoftActiveSync", - "HKLM\\SOFTWARE\\Microsoft\\Ctf\\LangBarAddin\\*\\FilePath", - "HKLM\\SOFTWARE\\Microsoft\\Internet Explorer\\Extensions\\*\\Exec", - "HKLM\\SOFTWARE\\Microsoft\\Internet Explorer\\Extensions\\*\\Script", - "HKLM\\SOFTWARE\\Microsoft\\Command Processor\\Autorun", - "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Ctf\\LangBarAddin\\*\\FilePath", - "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Internet Explorer\\Extensions\\*\\Exec", - "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Internet Explorer\\Extensions\\*\\Script", - "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Command Processor\\Autorun", - "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\*\\VerifierDlls", - "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\GpExtensions\\*\\DllName", - "HKLM\\SYSTEM\\ControlSet*\\Control\\SafeBoot\\AlternateShell", - "HKLM\\SYSTEM\\ControlSet*\\Control\\Terminal Server\\Wds\\rdpwd\\StartupPrograms", - "HKLM\\SYSTEM\\ControlSet*\\Control\\Terminal Server\\WinStations\\RDP-Tcp\\InitialProgram", - "HKLM\\SYSTEM\\ControlSet*\\Control\\Session Manager\\BootExecute", - "HKLM\\SYSTEM\\ControlSet*\\Control\\Session Manager\\SetupExecute", - "HKLM\\SYSTEM\\ControlSet*\\Control\\Session Manager\\Execute", - "HKLM\\SYSTEM\\ControlSet*\\Control\\Session Manager\\S0InitialCommand", - "HKLM\\SYSTEM\\ControlSet*\\Control\\ServiceControlManagerExtension", - "HKLM\\SYSTEM\\ControlSet*\\Control\\BootVerificationProgram\\ImagePath", - "HKLM\\SYSTEM\\Setup\\CmdLine", - "HKEY_USERS\\*\\Environment\\UserInitMprLogonScript") and - - not registry.data.strings : ("C:\\Windows\\system32\\userinit.exe", "cmd.exe", "C:\\Program Files (x86)\\*.exe", - "C:\\Program Files\\*.exe") and - not (process.name : "rundll32.exe" and registry.path : "*\\Software\\Microsoft\\Internet Explorer\\Extensions\\*\\Script") and - not process.executable : ("C:\\Windows\\System32\\msiexec.exe", - "C:\\Windows\\SysWOW64\\msiexec.exe", - "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe", - "C:\\Program Files\\*.exe", - "C:\\Program Files (x86)\\*.exe") - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Persistence -** ID: TA0003 -** Reference URL: https://attack.mitre.org/tactics/TA0003/ -* Technique: -** Name: Boot or Logon Autostart Execution -** ID: T1547 -** Reference URL: https://attack.mitre.org/techniques/T1547/ -* Sub-technique: -** Name: Registry Run Keys / Startup Folder -** ID: T1547.001 -** Reference URL: https://attack.mitre.org/techniques/T1547/001/ -* Tactic: -** Name: Defense Evasion -** ID: TA0005 -** Reference URL: https://attack.mitre.org/tactics/TA0005/ -* Technique: -** Name: Modify Registry -** ID: T1112 -** Reference URL: https://attack.mitre.org/techniques/T1112/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-unexpected-child-process-of-macos-screensaver-engine.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-unexpected-child-process-of-macos-screensaver-engine.asciidoc deleted file mode 100644 index 5e34f874d5..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-unexpected-child-process-of-macos-screensaver-engine.asciidoc +++ /dev/null @@ -1,77 +0,0 @@ -[[prebuilt-rule-0-14-2-unexpected-child-process-of-macos-screensaver-engine]] -=== Unexpected Child Process of macOS Screensaver Engine - -Identifies when a child process is spawned by the screensaver engine process, which is consistent with an attacker's malicious payload being executed after the screensaver activated on the endpoint. An adversary can maintain persistence on a macOS endpoint by creating a malicious screensaver (.saver) file and configuring the screensaver plist file to execute code each time the screensaver is activated. - -*Rule type*: eql - -*Rule indices*: - -* auditbeat-* -* logs-endpoint.events.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://posts.specterops.io/saving-your-access-d562bf5bf90b -* https://github.com/D00MFist/PersistentJXA - -*Tags*: - -* Elastic -* Host -* macOS -* Threat Detection -* Persistence - -*Version*: 1 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Triage and analysis - -- Analyze the descendant processes of the ScreenSaverEngine process for malicious code and suspicious behavior such -as downloading a payload from a server -- Review the installed and activated screensaver on the host. Triage the screensaver (.saver) file that was triggered to -identify whether the file is malicious or not. - ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type == "start" and process.parent.name == "ScreenSaverEngine" - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Persistence -** ID: TA0003 -** Reference URL: https://attack.mitre.org/tactics/TA0003/ -* Technique: -** Name: Event Triggered Execution -** ID: T1546 -** Reference URL: https://attack.mitre.org/techniques/T1546/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-unusual-aws-command-for-a-user.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-unusual-aws-command-for-a-user.asciidoc deleted file mode 100644 index a996360c7b..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-unusual-aws-command-for-a-user.asciidoc +++ /dev/null @@ -1,59 +0,0 @@ -[[prebuilt-rule-0-14-2-unusual-aws-command-for-a-user]] -=== Unusual AWS Command for a User - -A machine learning job detected an AWS API command that, while not inherently suspicious or abnormal, is being made by a user context that does not normally use the command. This can be the result of compromised credentials or keys as someone uses a valid account to persist, move laterally, or exfiltrate data. - -*Rule type*: machine_learning - -*Rule indices*: None - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 15m - -*Searches indices from*: now-2h ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html - -*Tags*: - -* Elastic -* Cloud -* AWS -* ML - -*Version*: 7 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Config - -The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. - -## Triage and analysis - -### Investigating an Unusual CloudTrail Event - -Detection alerts from this rule indicate an AWS API command or method call that is rare and unusual for the calling IAM user. Here are some possible avenues of investigation: -- Consider the user as identified by the `user.name` field. Is this command part of an expected workflow for the user context? Examine the user identity in the `aws.cloudtrail.user_identity.arn` field and the access key ID in the `aws.cloudtrail.user_identity.access_key_id` field, which can help identify the precise user context. The user agent details in the `user_agent.original` field may also indicate what kind of a client made the request. -- Consider the source IP address and geolocation for the calling user who issued the command. Do they look normal for the calling user? If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts, or could it be sourcing from an EC2 instance that's not under your control? If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles? Are there any other alerts or signs of suspicious activity involving this instance? -- Consider the time of day. If the user is a human, not a program or script, did the activity take place during a normal time of day? -- Examine the history of the command. If the command, which is visible in the `event.action field`, only manifested recently, it might be part of a new automation module or script. If it has a consistent cadence (for example, if it appears in small numbers on a weekly or monthly cadence), it might be part of a housekeeping or maintenance process. -- Examine the request parameters. These may provide indications as to the source of the program or the nature of the tasks it is performing. ----------------------------------- diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-unusual-city-for-an-aws-command.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-unusual-city-for-an-aws-command.asciidoc deleted file mode 100644 index d586ec0903..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-unusual-city-for-an-aws-command.asciidoc +++ /dev/null @@ -1,58 +0,0 @@ -[[prebuilt-rule-0-14-2-unusual-city-for-an-aws-command]] -=== Unusual City For an AWS Command - -A machine learning job detected AWS command activity that, while not inherently suspicious or abnormal, is sourcing from a geolocation (city) that is unusual for the command. This can be the result of compromised credentials or keys being used by a threat actor in a different geography than the authorized user(s). - -*Rule type*: machine_learning - -*Rule indices*: None - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 15m - -*Searches indices from*: now-2h ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html - -*Tags*: - -* Elastic -* Cloud -* AWS -* ML - -*Version*: 7 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Config - -The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. - -## Triage and analysis - -### Investigating an Unusual CloudTrail Event -Detection alerts from this rule indicate an AWS API command or method call that is rare and unusual for the geolocation of the source IP address. Here are some possible avenues of investigation: -- Consider the source IP address and geolocation for the calling user who issued the command. Do they look normal for the calling user? If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts, or could it be sourcing from an EC2 instance that's not under your control? If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles? Are there any other alerts or signs of suspicious activity involving this instance? -- Consider the user as identified by the `user.name` field. Is this command part of an expected workflow for the user context? Examine the user identity in the `aws.cloudtrail.user_identity.arn` field and the access key ID in the `aws.cloudtrail.user_identity.access_key_id` field, which can help identify the precise user context. The user agent details in the `user_agent.original` field may also indicate what kind of a client made the request. -- Consider the time of day. If the user is a human, not a program or script, did the activity take place during a normal time of day? -- Examine the history of the command. If the command, which is visible in the `event.action field`, only manifested recently, it might be part of a new automation module or script. If it has a consistent cadence (for example, if it appears in small numbers on a weekly or monthly cadence), it might be part of a housekeeping or maintenance process. -- Examine the request parameters. These may provide indications as to the source of the program or the nature of the tasks it is performing. ----------------------------------- diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-unusual-country-for-an-aws-command.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-unusual-country-for-an-aws-command.asciidoc deleted file mode 100644 index aa5beeae63..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-unusual-country-for-an-aws-command.asciidoc +++ /dev/null @@ -1,80 +0,0 @@ -[[prebuilt-rule-0-14-2-unusual-country-for-an-aws-command]] -=== Unusual Country For an AWS Command - -A machine learning job detected AWS command activity that, while not inherently suspicious or abnormal, is sourcing from a geolocation (country) that is unusual for the command. This can be the result of compromised credentials or keys being used by a threat actor in a different geography than the authorized user(s). - -*Rule type*: machine_learning - -*Rule indices*: None - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 15m - -*Searches indices from*: now-2h ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html - -*Tags*: - -* Elastic -* Cloud -* AWS -* ML - -*Version*: 7 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Config - -The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. - -## Triage and analysis - -### Investigating an Unusual Country For an AWS Command - -CloudTrail logging provides visibility on actions taken within an AWS environment. By monitoring these events and understanding -what is considered normal behavior within an organization, suspicious or malicious activity can be spotted when deviations -are observed. This example rule focuses on AWS command activity where the country from the source of the activity has been -considered unusual based on previous history. - -#### Possible investigation steps: -- Consider the source IP address and geolocation for the calling user who issued the command. Do they look normal for the calling user? If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts, or could it be sourcing from an EC2 instance that's not under your control? If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles? Are there any other alerts or signs of suspicious activity involving this instance? -- Consider the user as identified by the `user.name` field. Is this command part of an expected workflow for the user context? Examine the user identity in the `aws.cloudtrail.user_identity.arn` field and the access key ID in the `aws.cloudtrail.user_identity.access_key_id` field, which can help identify the precise user context. The user agent details in the `user_agent.original` field may also indicate what kind of a client made the request. -- Consider the time of day. If the user is a human, not a program or script, did the activity take place during a normal time of day? -- Examine the history of the command. If the command, which is visible in the `event.action field`, only manifested recently, it might be part of a new automation module or script. If it has a consistent cadence (for example, if it appears in small numbers on a weekly or monthly cadence), it might be part of a housekeeping or maintenance process. -- Examine the request parameters. These may provide indications as to the source of the program or the nature of the tasks it is performing. - -### False Positive Analysis -- False positives can occur if activity is coming from new employees based in a country with no previous history in AWS, -therefore it's important to validate the activity listed in the investigation steps above. - -### Related Rules -- Unusual City For an AWS Command -- Unusual AWS Command for a User -- Rare AWS Error Code - -### Response and Remediation -- If activity is observed as suspicious or malicious, immediate response should be looked into rotating and deleting AWS IAM access keys -- Validate if any unauthorized new users were created, remove these accounts and request password resets for other IAM users -- Look into enabling multi-factor authentication for users -- Follow security best practices [outlined](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/) by AWS - ----------------------------------- diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-unusual-parent-child-relationship.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-unusual-parent-child-relationship.asciidoc deleted file mode 100644 index 0279f41c70..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-unusual-parent-child-relationship.asciidoc +++ /dev/null @@ -1,97 +0,0 @@ -[[prebuilt-rule-0-14-2-unusual-parent-child-relationship]] -=== Unusual Parent-Child Relationship - -Identifies Windows programs run from unexpected parent processes. This could indicate masquerading or other strange activity on a system. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://github.com/sbousseaden/Slides/blob/master/Hunting%20MindMaps/PNG/Windows%20Processes%20TH.map.png -* https://www.andreafortuna.org/2017/06/15/standard-windows-processes-a-brief-reference/ - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Privilege Escalation - -*Version*: 10 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type in ("start", "process_started") and -process.parent.name != null and - ( - /* suspicious parent processes */ - (process.name:"autochk.exe" and not process.parent.name:"smss.exe") or - (process.name:("fontdrvhost.exe", "dwm.exe") and not process.parent.name:("wininit.exe", "winlogon.exe")) or - (process.name:("consent.exe", "RuntimeBroker.exe", "TiWorker.exe") and not process.parent.name:"svchost.exe") or - (process.name:"SearchIndexer.exe" and not process.parent.name:"services.exe") or - (process.name:"SearchProtocolHost.exe" and not process.parent.name:("SearchIndexer.exe", "dllhost.exe")) or - (process.name:"dllhost.exe" and not process.parent.name:("services.exe", "svchost.exe")) or - (process.name:"smss.exe" and not process.parent.name:("System", "smss.exe")) or - (process.name:"csrss.exe" and not process.parent.name:("smss.exe", "svchost.exe")) or - (process.name:"wininit.exe" and not process.parent.name:"smss.exe") or - (process.name:"winlogon.exe" and not process.parent.name:"smss.exe") or - (process.name:("lsass.exe", "LsaIso.exe") and not process.parent.name:"wininit.exe") or - (process.name:"LogonUI.exe" and not process.parent.name:("wininit.exe", "winlogon.exe")) or - (process.name:"services.exe" and not process.parent.name:"wininit.exe") or - (process.name:"svchost.exe" and not process.parent.name:("MsMpEng.exe", "services.exe")) or - (process.name:"spoolsv.exe" and not process.parent.name:"services.exe") or - (process.name:"taskhost.exe" and not process.parent.name:("services.exe", "svchost.exe")) or - (process.name:"taskhostw.exe" and not process.parent.name:("services.exe", "svchost.exe")) or - (process.name:"userinit.exe" and not process.parent.name:("dwm.exe", "winlogon.exe")) or - (process.name:("wmiprvse.exe", "wsmprovhost.exe", "winrshost.exe") and not process.parent.name:"svchost.exe") or - /* suspicious child processes */ - (process.parent.name:("SearchProtocolHost.exe", "taskhost.exe", "csrss.exe") and not process.name:("werfault.exe", "wermgr.exe", "WerFaultSecure.exe")) or - (process.parent.name:"autochk.exe" and not process.name:("chkdsk.exe", "doskey.exe", "WerFault.exe")) or - (process.parent.name:"smss.exe" and not process.name:("autochk.exe", "smss.exe", "csrss.exe", "wininit.exe", "winlogon.exe", "setupcl.exe", "WerFault.exe")) or - (process.parent.name:"wermgr.exe" and not process.name:("WerFaultSecure.exe", "wermgr.exe", "WerFault.exe")) or - (process.parent.name:"conhost.exe" and not process.name:("mscorsvw.exe", "wermgr.exe", "WerFault.exe", "WerFaultSecure.exe")) - ) - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Privilege Escalation -** ID: TA0004 -** Reference URL: https://attack.mitre.org/tactics/TA0004/ -* Technique: -** Name: Process Injection -** ID: T1055 -** Reference URL: https://attack.mitre.org/techniques/T1055/ -* Sub-technique: -** Name: Process Hollowing -** ID: T1055.012 -** Reference URL: https://attack.mitre.org/techniques/T1055/012/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-unusual-process-execution-path-alternate-data-stream.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-unusual-process-execution-path-alternate-data-stream.asciidoc deleted file mode 100644 index a4ebbe8930..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-unusual-process-execution-path-alternate-data-stream.asciidoc +++ /dev/null @@ -1,66 +0,0 @@ -[[prebuilt-rule-0-14-2-unusual-process-execution-path-alternate-data-stream]] -=== Unusual Process Execution Path - Alternate Data Stream - -Identifies processes running from an Alternate Data Stream. This is uncommon for legitimate processes and sometimes done by adversaries to hide malware. - -*Rule type*: eql - -*Rule indices*: - -* logs-endpoint.events.* -* winlogbeat-* -* logs-windows.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Defense Evasion - -*Version*: 5 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type == "start" and - process.args : "?:\\*:*" and process.args_count == 1 - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Defense Evasion -** ID: TA0005 -** Reference URL: https://attack.mitre.org/tactics/TA0005/ -* Technique: -** Name: Hide Artifacts -** ID: T1564 -** Reference URL: https://attack.mitre.org/techniques/T1564/ -* Sub-technique: -** Name: NTFS File Attributes -** ID: T1564.004 -** Reference URL: https://attack.mitre.org/techniques/T1564/004/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-unusual-process-for-a-windows-host.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-unusual-process-for-a-windows-host.asciidoc deleted file mode 100644 index 7d13833cad..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-unusual-process-for-a-windows-host.asciidoc +++ /dev/null @@ -1,81 +0,0 @@ -[[prebuilt-rule-0-14-2-unusual-process-for-a-windows-host]] -=== Unusual Process For a Windows Host - -Identifies rare processes that do not usually run on individual hosts, which can indicate execution of unauthorized services, malware, or persistence mechanisms. Processes are considered rare when they only run occasionally as compared with other processes running on the host. - -*Rule type*: machine_learning - -*Rule indices*: None - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 15m - -*Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* ML - -*Version*: 8 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Triage and analysis - -### Investigating an Unusual Windows Process - -Searching for abnormal Windows processes is a good methodology to find potentially malicious activity within a network. -By understanding what is commonly run within an environment and developing baselines for legitimate activity can help -uncover potential malware and suspicious behaviors. - -#### Possible investigation steps: -- Consider the user as identified by the `user.name` field. Is this program part of an expected workflow for the user who ran this program on this host? -- Examine the history of execution. If this process only manifested recently, it might be part of a new software package. If it has a consistent cadence (for example if it runs monthly or quarterly), it might be part of a monthly or quarterly business process. -- Examine the process metadata like the values of the Company, Description and Product fields which may indicate whether the program is associated with an expected software vendor or package. -- Examine arguments and working directory. These may provide indications as to the source of the program or the nature of the tasks it is performing. -- Consider the same for the parent process. If the parent process is a legitimate system utility or service, this could be related to software updates or system management. If the parent process is something user-facing like an Office application, this process could be more suspicious. -- If you have file hash values in the event data, and you suspect malware, you can optionally run a search for the file hash to see if the file is identified as malware by anti-malware tools. - -### False Positive Analysis -- Validate the unusual Windows process is not related to new benign software installation activity. If related to -legitimate software, this can be done by leveraging the exception workflow in the Kibana Security App or Elasticsearch -API to tune this rule to your environment -- Try to understand the context of the execution by thinking about the user, machine, or business purpose. It's possible that a small number of endpoints -such as servers that have very unique software that might appear to be unusual, but satisfy a specific business need. - -### Related Rules -- Anomalous Windows Process Creation -- Unusual Windows Path Activity -- Unusual Windows Process Calling the Metadata Service - -### Response and Remediation -- This rule is related to process execution events and should be immediately reviewed and investigated to determine if malicious -- Based on validation and if malicious, the impacted machine should be isolated and analyzed to determine other post-compromise -behavior such as setting up persistence or performing lateral movement. -- Look into preventive measures such as Windows Defender Application Control and AppLocker to gain better control on -what is allowed to run on Windows infrastructure. - ----------------------------------- diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-user-account-creation.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-user-account-creation.asciidoc deleted file mode 100644 index a1017827a2..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-user-account-creation.asciidoc +++ /dev/null @@ -1,68 +0,0 @@ -[[prebuilt-rule-0-14-2-user-account-creation]] -=== User Account Creation - -Identifies attempts to create new local users. This is sometimes done by attackers to increase access to a system or domain. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Persistence - -*Version*: 9 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type in ("start", "process_started") and - process.name : ("net.exe", "net1.exe") and - not process.parent.name : "net.exe" and - (process.args : "user" and process.args : ("/ad", "/add")) - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Persistence -** ID: TA0003 -** Reference URL: https://attack.mitre.org/tactics/TA0003/ -* Technique: -** Name: Create Account -** ID: T1136 -** Reference URL: https://attack.mitre.org/techniques/T1136/ -* Sub-technique: -** Name: Local Account -** ID: T1136.001 -** Reference URL: https://attack.mitre.org/techniques/T1136/001/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-user-added-to-privileged-group-in-active-directory.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-user-added-to-privileged-group-in-active-directory.asciidoc deleted file mode 100644 index 7bebcf56e6..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-user-added-to-privileged-group-in-active-directory.asciidoc +++ /dev/null @@ -1,71 +0,0 @@ -[[prebuilt-rule-0-14-2-user-added-to-privileged-group-in-active-directory]] -=== User Added to Privileged Group in Active Directory - -Identifies a user being added to a privileged group in Active Directory. Privileged accounts and groups in Active Directory are those to which powerful rights, privileges, and permissions are granted that allow them to perform nearly any action in Active Directory and on domain-joined systems. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-windows.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-b--privileged-accounts-and-groups-in-active-directory - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Persistence - -*Version*: 3 - -*Rule authors*: - -* Elastic -* Skoetting - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -iam where event.action == "added-member-to-group" and - group.name : ("Admin*", - "Local Administrators", - "Domain Admins", - "Enterprise Admins", - "Backup Admins", - "Schema Admins", - "DnsAdmins", - "Exchange Organization Administrators") - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Persistence -** ID: TA0003 -** Reference URL: https://attack.mitre.org/tactics/TA0003/ -* Technique: -** Name: Account Manipulation -** ID: T1098 -** Reference URL: https://attack.mitre.org/techniques/T1098/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-virtual-machine-fingerprinting-via-grep.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-virtual-machine-fingerprinting-via-grep.asciidoc deleted file mode 100644 index 9b28fd8d0f..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-virtual-machine-fingerprinting-via-grep.asciidoc +++ /dev/null @@ -1,66 +0,0 @@ -[[prebuilt-rule-0-14-2-virtual-machine-fingerprinting-via-grep]] -=== Virtual Machine Fingerprinting via Grep - -An adversary may attempt to get detailed information about the operating system and hardware. This rule identifies common locations used to discover virtual machine hardware by a non-root user. This technique has been used by the Pupy RAT and other malware. - -*Rule type*: eql - -*Rule indices*: - -* auditbeat-* -* logs-endpoint.events.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://objective-see.com/blog/blog_0x4F.html - -*Tags*: - -* Elastic -* Host -* macOS -* Linux -* Threat Detection -* Discovery - -*Version*: 1 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type == "start" and - process.name in ("grep", "egrep") and user.id != "0" and - process.args : ("parallels*", "vmware*", "virtualbox*") and process.args : "Manufacturer*" and - not process.parent.executable in ("/Applications/Docker.app/Contents/MacOS/Docker", "/usr/libexec/kcare/virt-what") - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Discovery -** ID: TA0007 -** Reference URL: https://attack.mitre.org/tactics/TA0007/ -* Technique: -** Name: System Information Discovery -** ID: T1082 -** Reference URL: https://attack.mitre.org/techniques/T1082/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-volume-shadow-copy-deleted-or-resized-via-vssadmin.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-volume-shadow-copy-deleted-or-resized-via-vssadmin.asciidoc deleted file mode 100644 index f91b921089..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-volume-shadow-copy-deleted-or-resized-via-vssadmin.asciidoc +++ /dev/null @@ -1,63 +0,0 @@ -[[prebuilt-rule-0-14-2-volume-shadow-copy-deleted-or-resized-via-vssadmin]] -=== Volume Shadow Copy Deleted or Resized via VssAdmin - -Identifies use of vssadmin.exe for shadow copy deletion or resizing on endpoints. This commonly occurs in tandem with ransomware or other destructive attacks. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: high - -*Risk score*: 73 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Impact - -*Version*: 10 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type in ("start", "process_started") and event.action == "start" - and (process.name : "vssadmin.exe" or process.pe.original_file_name == "VSSADMIN.EXE") and - process.args in ("delete", "resize") and process.args : "shadows*" - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Impact -** ID: TA0040 -** Reference URL: https://attack.mitre.org/tactics/TA0040/ -* Technique: -** Name: Inhibit System Recovery -** ID: T1490 -** Reference URL: https://attack.mitre.org/techniques/T1490/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-volume-shadow-copy-deletion-via-powershell.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-volume-shadow-copy-deletion-via-powershell.asciidoc deleted file mode 100644 index 60ad3eaa30..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-volume-shadow-copy-deletion-via-powershell.asciidoc +++ /dev/null @@ -1,70 +0,0 @@ -[[prebuilt-rule-0-14-2-volume-shadow-copy-deletion-via-powershell]] -=== Volume Shadow Copy Deletion via PowerShell - -Identifies the use of the Win32_ShadowCopy class and related cmdlets to achieve shadow copy deletion. This commonly occurs in tandem with ransomware or other destructive attacks. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: high - -*Risk score*: 73 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://docs.microsoft.com/en-us/previous-versions/windows/desktop/vsswmi/win32-shadowcopy -* https://powershell.one/wmi/root/cimv2/win32_shadowcopy -* https://www.fortinet.com/blog/threat-research/stomping-shadow-copies-a-second-look-into-deletion-methods - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Impact - -*Version*: 1 - -*Rule authors*: - -* Elastic -* Austin Songer - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type in ("start", "process_started") and - process.name : ("powershell.exe", "pwsh.exe") and - process.args : ("*Get-WmiObject*", "*gwmi*", "*Get-CimInstance*", "*gcim*") and - process.args : ("*Win32_ShadowCopy*") and - process.args : ("*.Delete()*", "*Remove-WmiObject*", "*rwmi*", "*Remove-CimInstance*", "*rcim*") - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Impact -** ID: TA0040 -** Reference URL: https://attack.mitre.org/tactics/TA0040/ -* Technique: -** Name: Inhibit System Recovery -** ID: T1490 -** Reference URL: https://attack.mitre.org/techniques/T1490/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-volume-shadow-copy-deletion-via-wmic.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-volume-shadow-copy-deletion-via-wmic.asciidoc deleted file mode 100644 index baed56896f..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-volume-shadow-copy-deletion-via-wmic.asciidoc +++ /dev/null @@ -1,63 +0,0 @@ -[[prebuilt-rule-0-14-2-volume-shadow-copy-deletion-via-wmic]] -=== Volume Shadow Copy Deletion via WMIC - -Identifies use of wmic.exe for shadow copy deletion on endpoints. This commonly occurs in tandem with ransomware or other destructive attacks. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: high - -*Risk score*: 73 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Impact - -*Version*: 10 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type in ("start", "process_started") and - (process.name : "WMIC.exe" or process.pe.original_file_name == "wmic.exe") and - process.args : "delete" and process.args : "shadowcopy" - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Impact -** ID: TA0040 -** Reference URL: https://attack.mitre.org/tactics/TA0040/ -* Technique: -** Name: Inhibit System Recovery -** ID: T1490 -** Reference URL: https://attack.mitre.org/techniques/T1490/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-webshell-detection-script-process-child-of-common-web-processes.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-webshell-detection-script-process-child-of-common-web-processes.asciidoc deleted file mode 100644 index 63a6848c91..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-webshell-detection-script-process-child-of-common-web-processes.asciidoc +++ /dev/null @@ -1,87 +0,0 @@ -[[prebuilt-rule-0-14-2-webshell-detection-script-process-child-of-common-web-processes]] -=== Webshell Detection: Script Process Child of Common Web Processes - -Identifies suspicious commands executed via a web server, which may suggest a vulnerability and remote shell access. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: high - -*Risk score*: 73 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.microsoft.com/security/blog/2020/02/04/ghost-in-the-shell-investigating-web-shell-attacks/ - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Persistence - -*Version*: 2 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Triage and analysis - -Detections should be investigated to identify if the activity corresponds to legitimate activity. As this rule detects post-exploitation process activity, investigations into this should be prioritized. ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type == "start" and - process.parent.name : ("w3wp.exe", "httpd.exe", "nginx.exe", "php.exe", "php-cgi.exe", "tomcat.exe") and - process.name : ("cmd.exe", "cscript.exe", "powershell.exe", "pwsh.exe", "wmic.exe", "wscript.exe") - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Persistence -** ID: TA0003 -** Reference URL: https://attack.mitre.org/tactics/TA0003/ -* Technique: -** Name: Server Software Component -** ID: T1505 -** Reference URL: https://attack.mitre.org/techniques/T1505/ -* Sub-technique: -** Name: Web Shell -** ID: T1505.003 -** Reference URL: https://attack.mitre.org/techniques/T1505/003/ -* Tactic: -** Name: Initial Access -** ID: TA0001 -** Reference URL: https://attack.mitre.org/tactics/TA0001/ -* Technique: -** Name: Exploit Public-Facing Application -** ID: T1190 -** Reference URL: https://attack.mitre.org/techniques/T1190/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-whitespace-padding-in-process-command-line.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-whitespace-padding-in-process-command-line.asciidoc deleted file mode 100644 index 2ad7cdabc5..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-whitespace-padding-in-process-command-line.asciidoc +++ /dev/null @@ -1,74 +0,0 @@ -[[prebuilt-rule-0-14-2-whitespace-padding-in-process-command-line]] -=== Whitespace Padding in Process Command Line - -Identifies process execution events where the command line value contains a long sequence of whitespace characters or multiple occurrences of contiguous whitespace. Attackers may attempt to evade signature-based detections by padding their malicious command with unnecessary whitespace characters. These observations should be investigated for malicious behavior. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://twitter.com/JohnLaTwC/status/1419251082736201737 - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Defense Evasion - -*Version*: 2 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Triage and analysis - -- Analyze the command line of the process in question for evidence of malicious code execution. -- Review the ancestor and child processes spawned by the process in question for indicators of further malicious code execution. ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type in ("start", "process_started") and - process.command_line regex ".*[ ]{20,}.*" or - - /* this will match on 3 or more separate occurrences of 5+ contiguous whitespace characters */ - process.command_line regex ".*(.*[ ]{5,}[^ ]*){3,}.*" - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Defense Evasion -** ID: TA0005 -** Reference URL: https://attack.mitre.org/tactics/TA0005/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-windows-defender-exclusions-added-via-powershell.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-windows-defender-exclusions-added-via-powershell.asciidoc deleted file mode 100644 index 3cae16af1e..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-windows-defender-exclusions-added-via-powershell.asciidoc +++ /dev/null @@ -1,126 +0,0 @@ -[[prebuilt-rule-0-14-2-windows-defender-exclusions-added-via-powershell]] -=== Windows Defender Exclusions Added via PowerShell - -Identifies modifications to the Windows Defender configuration settings using PowerShell to add exclusions at the folder directory or process level. - -*Rule type*: eql - -*Rule indices*: - -* winlogbeat-* -* logs-endpoint.events.* -* logs-windows.* - -*Severity*: medium - -*Risk score*: 47 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: - -* https://www.bitdefender.com/files/News/CaseStudies/study/400/Bitdefender-PR-Whitepaper-MosaicLoader-creat5540-en-EN.pdf - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Defense Evasion - -*Version*: 3 - -*Rule authors*: - -* Elastic - -*Rule license*: Elastic License v2 - - -==== Investigation guide - - -[source, markdown] ----------------------------------- -## Triage and analysis - -### Investigating Windows Defender Exclusions - -Microsoft Windows Defender is an anti-virus product built-in within Microsoft Windows. Since this software product is -used to prevent and stop malware, it's important to monitor what specific exclusions are made to the product's configuration -settings. These can often be signs of an adversary or malware trying to bypass Windows Defender's capabilities. One of the more -notable [examples](https://www.cyberbit.com/blog/endpoint-security/latest-trickbot-variant-has-new-tricks-up-its-sleeve/) was observed in 2018 where Trickbot incorporated mechanisms to disable Windows Defense to avoid detection. - -#### Possible investigation steps: -- With this specific rule, it's completely possible to trigger detections on network administrative activity or benign users -using scripting and PowerShell to configure the different exclusions for Windows Defender. Therefore, it's important to -identify the source of the activity first and determine if there is any mal-intent behind the events. -- The actual exclusion such as the process, the file or directory should be reviewed in order to determine the original -intent behind the exclusion. Is the excluded file or process malicious in nature or is it related to software that needs -to be legitimately whitelisted from Windows Defender? - -### False Positive Analysis -- This rule has a higher chance to produce false positives based on the nature around configuring exclusions by possibly -a network administrator. In order to validate the activity further, review the specific exclusion made and determine based -on the exclusion of the original intent behind the exclusion. There are often many legitimate reasons why exclusions are made -with Windows Defender so it's important to gain context around the exclusion. - -### Related Rules -- Windows Defender Disabled via Registry Modification -- Disabling Windows Defender Security Settings via PowerShell - -### Response and Remediation -- Since this is related to post-exploitation activity, immediate response should be taken to review, investigate and -potentially isolate further activity -- If further analysis showed malicious intent was behind the Defender exclusions, administrators should remove -the exclusion and ensure antimalware capability has not been disabled or deleted -- Exclusion lists for antimalware capabilities should always be routinely monitored for review - ----------------------------------- - -==== Rule query - - -[source, js] ----------------------------------- -process where event.type == "start" and - (process.name : ("powershell.exe", "pwsh.exe") or process.pe.original_file_name : ("powershell.exe", "pwsh.exe")) and - process.args : ("*Add-MpPreference*-Exclusion*", "*Set-MpPreference*-Exclusion*") - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Defense Evasion -** ID: TA0005 -** Reference URL: https://attack.mitre.org/tactics/TA0005/ -* Technique: -** Name: Impair Defenses -** ID: T1562 -** Reference URL: https://attack.mitre.org/techniques/T1562/ -* Sub-technique: -** Name: Indicator Blocking -** ID: T1562.006 -** Reference URL: https://attack.mitre.org/techniques/T1562/006/ -* Sub-technique: -** Name: Disable or Modify Tools -** ID: T1562.001 -** Reference URL: https://attack.mitre.org/techniques/T1562/001/ -* Tactic: -** Name: Execution -** ID: TA0002 -** Reference URL: https://attack.mitre.org/tactics/TA0002/ -* Technique: -** Name: Command and Scripting Interpreter -** ID: T1059 -** Reference URL: https://attack.mitre.org/techniques/T1059/ -* Sub-technique: -** Name: PowerShell -** ID: T1059.001 -** Reference URL: https://attack.mitre.org/techniques/T1059/001/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-windows-event-logs-cleared.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-windows-event-logs-cleared.asciidoc deleted file mode 100644 index df7ba0cfdd..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-windows-event-logs-cleared.asciidoc +++ /dev/null @@ -1,66 +0,0 @@ -[[prebuilt-rule-0-14-2-windows-event-logs-cleared]] -=== Windows Event Logs Cleared - -Identifies attempts to clear Windows event log stores. This is often done by attackers in an attempt to evade detection or destroy forensic evidence on a system. - -*Rule type*: query - -*Rule indices*: - -* winlogbeat-* -* logs-windows.* -* logs-system.* - -*Severity*: low - -*Risk score*: 21 - -*Runs every*: 5m - -*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) - -*Maximum alerts per execution*: 100 - -*References*: None - -*Tags*: - -* Elastic -* Host -* Windows -* Threat Detection -* Defense Evasion - -*Version*: 2 - -*Rule authors*: - -* Elastic -* Anabella Cristaldi - -*Rule license*: Elastic License v2 - - -==== Rule query - - -[source, js] ----------------------------------- -event.action:("audit-log-cleared" or "Log clear") - ----------------------------------- - -*Framework*: MITRE ATT&CK^TM^ - -* Tactic: -** Name: Defense Evasion -** ID: TA0005 -** Reference URL: https://attack.mitre.org/tactics/TA0005/ -* Technique: -** Name: Indicator Removal on Host -** ID: T1070 -** Reference URL: https://attack.mitre.org/techniques/T1070/ -* Sub-technique: -** Name: Clear Windows Event Logs -** ID: T1070.001 -** Reference URL: https://attack.mitre.org/techniques/T1070/001/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rules-0-14-2-appendix.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rules-0-14-2-appendix.asciidoc deleted file mode 100644 index ee226870ba..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rules-0-14-2-appendix.asciidoc +++ /dev/null @@ -1,113 +0,0 @@ -["appendix",role="exclude",id="prebuilt-rule-0-14-2-prebuilt-rules-0-14-2-appendix"] -= Downloadable rule update v0.14.2 - -This section lists all updates associated with version 0.14.2 of the Fleet integration *Prebuilt Security Detection Rules*. - - -include::prebuilt-rule-0-14-2-virtual-machine-fingerprinting-via-grep.asciidoc[] -include::prebuilt-rule-0-14-2-aws-elasticache-security-group-created.asciidoc[] -include::prebuilt-rule-0-14-2-aws-elasticache-security-group-modified-or-deleted.asciidoc[] -include::prebuilt-rule-0-14-2-aws-route-table-modified-or-deleted.asciidoc[] -include::prebuilt-rule-0-14-2-aws-sts-getsessiontoken-abuse.asciidoc[] -include::prebuilt-rule-0-14-2-azure-frontdoor-web-application-firewall-waf-policy-deleted.asciidoc[] -include::prebuilt-rule-0-14-2-microsoft-365-potential-ransomware-activity.asciidoc[] -include::prebuilt-rule-0-14-2-microsoft-365-user-restricted-from-sending-email.asciidoc[] -include::prebuilt-rule-0-14-2-o365-exchange-suspicious-mailbox-right-delegation.asciidoc[] -include::prebuilt-rule-0-14-2-new-or-modified-federation-domain.asciidoc[] -include::prebuilt-rule-0-14-2-unauthorized-access-to-an-okta-application.asciidoc[] -include::prebuilt-rule-0-14-2-unexpected-child-process-of-macos-screensaver-engine.asciidoc[] -include::prebuilt-rule-0-14-2-screensaver-plist-file-modified-by-unexpected-process.asciidoc[] -include::prebuilt-rule-0-14-2-microsoft-365-unusual-volume-of-file-deletion.asciidoc[] -include::prebuilt-rule-0-14-2-potential-credential-access-via-duplicatehandle-in-lsass.asciidoc[] -include::prebuilt-rule-0-14-2-control-panel-process-with-unusual-arguments.asciidoc[] -include::prebuilt-rule-0-14-2-third-party-backup-files-deleted-via-unexpected-process.asciidoc[] -include::prebuilt-rule-0-14-2-volume-shadow-copy-deletion-via-powershell.asciidoc[] -include::prebuilt-rule-0-14-2-threat-intel-filebeat-module-indicator-match.asciidoc[] -include::prebuilt-rule-0-14-2-aws-rds-snapshot-export.asciidoc[] -include::prebuilt-rule-0-14-2-spike-in-aws-error-messages.asciidoc[] -include::prebuilt-rule-0-14-2-rare-aws-error-code.asciidoc[] -include::prebuilt-rule-0-14-2-unusual-city-for-an-aws-command.asciidoc[] -include::prebuilt-rule-0-14-2-unusual-country-for-an-aws-command.asciidoc[] -include::prebuilt-rule-0-14-2-unusual-aws-command-for-a-user.asciidoc[] -include::prebuilt-rule-0-14-2-aws-security-group-configuration-change-detection.asciidoc[] -include::prebuilt-rule-0-14-2-aws-rds-instance-creation.asciidoc[] -include::prebuilt-rule-0-14-2-kerberos-cached-credentials-dumping.asciidoc[] -include::prebuilt-rule-0-14-2-potential-kerberos-attack-via-bifrost.asciidoc[] -include::prebuilt-rule-0-14-2-rare-user-logon.asciidoc[] -include::prebuilt-rule-0-14-2-spike-in-logon-events-from-a-source-ip.asciidoc[] -include::prebuilt-rule-0-14-2-unusual-process-for-a-windows-host.asciidoc[] -include::prebuilt-rule-0-14-2-dns-activity-to-the-internet.asciidoc[] -include::prebuilt-rule-0-14-2-roshal-archive-rar-or-powershell-file-downloaded-from-the-internet.asciidoc[] -include::prebuilt-rule-0-14-2-exporting-exchange-mailbox-via-powershell.asciidoc[] -include::prebuilt-rule-0-14-2-encrypting-files-with-winrar-or-7z.asciidoc[] -include::prebuilt-rule-0-14-2-connection-to-commonly-abused-web-services.asciidoc[] -include::prebuilt-rule-0-14-2-potential-dns-tunneling-via-nslookup.asciidoc[] -include::prebuilt-rule-0-14-2-potential-command-and-control-via-internet-explorer.asciidoc[] -include::prebuilt-rule-0-14-2-port-forwarding-rule-addition.asciidoc[] -include::prebuilt-rule-0-14-2-potential-remote-desktop-tunneling-detected.asciidoc[] -include::prebuilt-rule-0-14-2-remote-file-copy-via-teamviewer.asciidoc[] -include::prebuilt-rule-0-14-2-potential-credential-access-via-windows-utilities.asciidoc[] -include::prebuilt-rule-0-14-2-ntds-or-sam-database-file-copied.asciidoc[] -include::prebuilt-rule-0-14-2-creation-or-modification-of-domain-backup-dpapi-private-key.asciidoc[] -include::prebuilt-rule-0-14-2-credential-acquisition-via-registry-hive-dumping.asciidoc[] -include::prebuilt-rule-0-14-2-lsass-memory-dump-creation.asciidoc[] -include::prebuilt-rule-0-14-2-searching-for-saved-credentials-via-vaultcmd.asciidoc[] -include::prebuilt-rule-0-14-2-clearing-windows-event-logs.asciidoc[] -include::prebuilt-rule-0-14-2-windows-event-logs-cleared.asciidoc[] -include::prebuilt-rule-0-14-2-windows-defender-exclusions-added-via-powershell.asciidoc[] -include::prebuilt-rule-0-14-2-disable-windows-firewall-rules-via-netsh.asciidoc[] -include::prebuilt-rule-0-14-2-disable-windows-event-and-security-logs-using-built-in-tools.asciidoc[] -include::prebuilt-rule-0-14-2-suspicious-net-code-compilation.asciidoc[] -include::prebuilt-rule-0-14-2-remote-desktop-enabled-in-windows-firewall.asciidoc[] -include::prebuilt-rule-0-14-2-enable-host-network-discovery-via-netsh.asciidoc[] -include::prebuilt-rule-0-14-2-microsoft-build-engine-started-by-an-office-application.asciidoc[] -include::prebuilt-rule-0-14-2-microsoft-build-engine-started-by-a-script-process.asciidoc[] -include::prebuilt-rule-0-14-2-microsoft-build-engine-started-by-a-system-process.asciidoc[] -include::prebuilt-rule-0-14-2-microsoft-build-engine-using-an-alternate-name.asciidoc[] -include::prebuilt-rule-0-14-2-potential-dll-side-loading-via-microsoft-antimalware-service-executable.asciidoc[] -include::prebuilt-rule-0-14-2-executable-file-creation-with-multiple-extensions.asciidoc[] -include::prebuilt-rule-0-14-2-encoded-executable-stored-in-the-registry.asciidoc[] -include::prebuilt-rule-0-14-2-iis-http-logging-disabled.asciidoc[] -include::prebuilt-rule-0-14-2-renamed-autoit-scripts-interpreter.asciidoc[] -include::prebuilt-rule-0-14-2-program-files-directory-masquerading.asciidoc[] -include::prebuilt-rule-0-14-2-msbuild-making-network-connections.asciidoc[] -include::prebuilt-rule-0-14-2-process-termination-followed-by-deletion.asciidoc[] -include::prebuilt-rule-0-14-2-unusual-process-execution-path-alternate-data-stream.asciidoc[] -include::prebuilt-rule-0-14-2-potential-evasion-via-filter-manager.asciidoc[] -include::prebuilt-rule-0-14-2-whitespace-padding-in-process-command-line.asciidoc[] -include::prebuilt-rule-0-14-2-adfind-command-activity.asciidoc[] -include::prebuilt-rule-0-14-2-enumeration-of-administrator-accounts.asciidoc[] -include::prebuilt-rule-0-14-2-net-command-via-system-account.asciidoc[] -include::prebuilt-rule-0-14-2-security-software-discovery-using-wmic.asciidoc[] -include::prebuilt-rule-0-14-2-enumeration-command-spawned-via-wmiprvse.asciidoc[] -include::prebuilt-rule-0-14-2-network-connection-via-compiled-html-file.asciidoc[] -include::prebuilt-rule-0-14-2-outbound-scheduled-task-activity-via-powershell.asciidoc[] -include::prebuilt-rule-0-14-2-process-activity-via-compiled-html-file.asciidoc[] -include::prebuilt-rule-0-14-2-deleting-backup-catalogs-with-wbadmin.asciidoc[] -include::prebuilt-rule-0-14-2-modification-of-boot-configuration.asciidoc[] -include::prebuilt-rule-0-14-2-high-number-of-process-and-or-service-terminations.asciidoc[] -include::prebuilt-rule-0-14-2-volume-shadow-copy-deleted-or-resized-via-vssadmin.asciidoc[] -include::prebuilt-rule-0-14-2-volume-shadow-copy-deletion-via-wmic.asciidoc[] -include::prebuilt-rule-0-14-2-suspicious-ms-office-child-process.asciidoc[] -include::prebuilt-rule-0-14-2-incoming-dcom-lateral-movement-via-mshta.asciidoc[] -include::prebuilt-rule-0-14-2-incoming-dcom-lateral-movement-with-mmc.asciidoc[] -include::prebuilt-rule-0-14-2-incoming-dcom-lateral-movement-with-shellbrowserwindow-or-shellwindows.asciidoc[] -include::prebuilt-rule-0-14-2-direct-outbound-smb-connection.asciidoc[] -include::prebuilt-rule-0-14-2-abnormally-large-dns-response.asciidoc[] -include::prebuilt-rule-0-14-2-rdp-enabled-via-registry.asciidoc[] -include::prebuilt-rule-0-14-2-potential-sharprdp-behavior.asciidoc[] -include::prebuilt-rule-0-14-2-remote-scheduled-task-creation.asciidoc[] -include::prebuilt-rule-0-14-2-creation-of-a-hidden-local-user-account.asciidoc[] -include::prebuilt-rule-0-14-2-suspicious-startup-shell-folder-modification.asciidoc[] -include::prebuilt-rule-0-14-2-creation-or-modification-of-a-new-gpo-scheduled-task-or-service.asciidoc[] -include::prebuilt-rule-0-14-2-persistence-via-scheduled-job-creation.asciidoc[] -include::prebuilt-rule-0-14-2-scheduled-task-created-by-a-windows-script.asciidoc[] -include::prebuilt-rule-0-14-2-new-activesyncalloweddeviceid-added-via-powershell.asciidoc[] -include::prebuilt-rule-0-14-2-uncommon-registry-persistence-change.asciidoc[] -include::prebuilt-rule-0-14-2-suspicious-execution-via-scheduled-task.asciidoc[] -include::prebuilt-rule-0-14-2-user-added-to-privileged-group-in-active-directory.asciidoc[] -include::prebuilt-rule-0-14-2-user-account-creation.asciidoc[] -include::prebuilt-rule-0-14-2-persistence-via-telemetrycontroller-scheduled-task-hijack.asciidoc[] -include::prebuilt-rule-0-14-2-persistence-via-wmi-event-subscription.asciidoc[] -include::prebuilt-rule-0-14-2-webshell-detection-script-process-child-of-common-web-processes.asciidoc[] -include::prebuilt-rule-0-14-2-unusual-parent-child-relationship.asciidoc[] diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rules-0-14-2-summary.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rules-0-14-2-summary.asciidoc deleted file mode 100644 index 83e68ab874..0000000000 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rules-0-14-2-summary.asciidoc +++ /dev/null @@ -1,226 +0,0 @@ -[[prebuilt-rule-0-14-2-prebuilt-rules-0-14-2-summary]] -[role="xpack"] -== Update v0.14.2 - -This section lists all updates associated with version 0.14.2 of the Fleet integration *Prebuilt Security Detection Rules*. - - -[width="100%",options="header"] -|============================================== -|Rule |Description |Status |Version - -|<> | An adversary may attempt to get detailed information about the operating system and hardware. This rule identifies common locations used to discover virtual machine hardware by a non-root user. This technique has been used by the Pupy RAT and other malware. | new | 1 - -|<> | Identifies when an ElastiCache security group has been created. | new | 1 - -|<> | Identifies when an ElastiCache security group has been modified or deleted. | new | 1 - -|<> | Identifies when an AWS Route Table has been modified or deleted. | new | 1 - -|<> | Identifies the suspicious use of GetSessionToken. Tokens could be created and used by attackers to move laterally and escalate privileges. | new | 1 - -|<> | Identifies the deletion of a Frontdoor Web Application Firewall (WAF) Policy in Azure. An adversary may delete a Frontdoor Web Application Firewall (WAF) Policy in an attempt to evade defenses and/or to eliminate barriers in carrying out their initiative. | new | 1 - -|<> | Identifies when Microsoft Cloud App Security reported when a user uploads files to the cloud that might be infected with ransomware. | new | 1 - -|<> | Identifies when a user has been restricted from sending email due to exceeding sending limits of the service policies per the Security Compliance Center. | new | 1 - -|<> | Identifies the assignment of rights to accesss content from another mailbox. An adversary may use the compromised account to send messages to other accounts in the network of the target business while creating inbox rules, so messages can evade spam/phishing detection mechanisms. | new | 1 - -|<> | Identifies a new or modified federation domain, which can be used to create a trust between O365 and an external identity provider. | new | 1 - -|<> | Identifies when an unauthorized access attempt is made by a user for an Okta application. | new | 1 - -|<> | Identifies when a child process is spawned by the screensaver engine process, which is consistent with an attacker's malicious payload being executed after the screensaver activated on the endpoint. An adversary can maintain persistence on a macOS endpoint by creating a malicious screensaver (.saver) file and configuring the screensaver plist file to execute code each time the screensaver is activated. | new | 1 - -|<> | Identifies when a screensaver plist file is modified by an unexpected process. An adversary can maintain persistence on a macOS endpoint by creating a malicious screensaver (.saver) file and configuring the screensaver plist file to execute code each time the screensaver is activated. | new | 1 - -|<> | Identifies that a user has deleted an unusually large volume of files as reported by Microsoft Cloud App Security. | new | 1 - -|<> | Identifies suspicious access to an LSASS handle via DuplicateHandle from an unknown call trace module. This may indicate an attempt to bypass the NtOpenProcess API to evade detection and dump Lsass memory for credential access. | new | 1 - -|<> | Identifies unusual instances of Control Panel with suspicious keywords or paths in the process command line value. Adversaries may abuse Control.exe to proxy execution of malicious code. | new | 1 - -|<> | Identifies the deletion of backup files, saved using third-party software, by a process outside of the backup suite. Adversaries may delete Backup files to ensure that recovery from a Ransomware attack is less likely. | new | 1 - -|<> | Identifies the use of the Win32_ShadowCopy class and related cmdlets to achieve shadow copy deletion. This commonly occurs in tandem with ransomware or other destructive attacks. | new | 1 - -|<> | This rule is triggered when indicators from the Threat Intel Filebeat module has a match against local file or network observations. | update | 2 - -|<> | Identifies the export of an Amazon Relational Database Service (RDS) Aurora database snapshot. | update | 2 - -|<> | A machine learning job detected a significant spike in the rate of a particular error in the CloudTrail messages. Spikes in error messages may accompany attempts at privilege escalation, lateral movement, or discovery. | update | 7 - -|<> | A machine learning job detected an unusual error in a CloudTrail message. These can be byproducts of attempted or successful persistence, privilege escalation, defense evasion, discovery, lateral movement, or collection. | update | 7 - -|<> | A machine learning job detected AWS command activity that, while not inherently suspicious or abnormal, is sourcing from a geolocation (city) that is unusual for the command. This can be the result of compromised credentials or keys being used by a threat actor in a different geography than the authorized user(s). | update | 7 - -|<> | A machine learning job detected AWS command activity that, while not inherently suspicious or abnormal, is sourcing from a geolocation (country) that is unusual for the command. This can be the result of compromised credentials or keys being used by a threat actor in a different geography than the authorized user(s). | update | 7 - -|<> | A machine learning job detected an AWS API command that, while not inherently suspicious or abnormal, is being made by a user context that does not normally use the command. This can be the result of compromised credentials or keys as someone uses a valid account to persist, move laterally, or exfiltrate data. | update | 7 - -|<> | Identifies a change to an AWS Security Group Configuration. A security group is like a virtual firewall, and modifying configurations may allow unauthorized access. Threat actors may abuse this to establish persistence, exfiltrate data, or pivot in an AWS environment. | update | 2 - -|<> | Identifies the creation of an Amazon Relational Database Service (RDS) Aurora database instance. | update | 2 - -|<> | Identifies the use of the Kerberos credential cache (kcc) utility to dump locally cached Kerberos tickets. | update | 4 - -|<> | Identifies use of Bifrost, a known macOS Kerberos pentesting tool, which can be used to dump cached Kerberos tickets or attempt unauthorized authentication techniques such as pass-the-ticket/hash and kerberoasting. | update | 2 - -|<> | A machine learning job found an unusual user name in the authentication logs. An unusual user name is one way of detecting credentialed access by means of a new or dormant user account. An inactive user account (because the user has left the organization) that becomes active may be due to credentialed access using a compromised account password. Threat actors will sometimes also create new users as a means of persisting in a compromised web application. | update | 3 - -|<> | A machine learning job found an unusually large spike in successful authentication events from a particular source IP address. This can be due to password spraying, user enumeration or brute force activity. | update | 2 - -|<> | Identifies rare processes that do not usually run on individual hosts, which can indicate execution of unauthorized services, malware, or persistence mechanisms. Processes are considered rare when they only run occasionally as compared with other processes running on the host. | update | 8 - -|<> | This rule detects when an internal network client sends DNS traffic directly to the Internet. This is atypical behavior for a managed network and can be indicative of malware, exfiltration, command and control, or simply misconfiguration. This DNS activity also impacts your organization's ability to provide enterprise monitoring and logging of DNS, and it opens your network to a variety of abuses and malicious communications. | update | 12 - -|<> | Detects a Roshal Archive (RAR) file or PowerShell script downloaded from the internet by an internal host. Gaining initial access to a system and then downloading encoded or encrypted tools to move laterally is a common practice for adversaries as a way to protect their more valuable tools and tactics, techniques, and procedures (TTPs). This may be atypical behavior for a managed network and can be indicative of malware, exfiltration, or command and control. | update | 8 - -|<> | Identifies the use of the Exchange PowerShell cmdlet, New-MailBoxExportRequest, to export the contents of a primary mailbox or archive to a .pst file. Adversaries may target user email to collect sensitive information. | update | 5 - -|<> | Identifies use of WinRar or 7z to create an encrypted files. Adversaries will often compress and encrypt data in preparation for exfiltration. | update | 4 - -|<> | Adversaries may implement command and control communications that use common web services in order to hide their activity. This attack technique is typically targeted to an organization and uses web services common to the victim network which allows the adversary to blend into legitimate traffic. activity. These popular services are typically targeted since they have most likely been used before a compromise and allow adversaries to blend in the network. | update | 5 - -|<> | This rule identifies a large number (15) of nslookup.exe executions with an explicit query type from the same host. This may indicate command and control activity utilizing the DNS protocol. | update | 3 - -|<> | Identifies instances of Internet Explorer (iexplore.exe) being started via the Component Object Model (COM) making unusual network connections. Adversaries could abuse Internet Explorer via COM to avoid suspicious processes making network connections and bypass host-based firewall restrictions. | update | 4 - -|<> | Identifies the creation of a new port forwarding rule. An adversary may abuse this technique to bypass network segmentation restrictions. | update | 4 - -|<> | Identifies potential use of an SSH utility to establish RDP over a reverse SSH Tunnel. This can be used by attackers to enable routing of network packets that would otherwise not reach their intended destination. | update | 4 - -|<> | Identifies an executable or script file remotely downloaded via a TeamViewer transfer session. | update | 5 - -|<> | Identifies the execution of known Windows utilities often abused to dump LSASS memory or the Active Directory database (NTDS.dit) in preparation for credential access. | update | 5 - -|<> | Identifies a copy operation of the Active Directory Domain Database (ntds.dit) or Security Account Manager (SAM) files. Those files contain sensitive information including hashed domain and/or local credentials. | update | 5 - -|<> | Identifies the creation or modification of Domain Backup private keys. Adversaries may extract the Data Protection API (DPAPI) domain backup key from a Domain Controller (DC) to be able to decrypt any domain user master key file. | update | 6 - -|<> | Identifies attempts to export a registry hive which may contain credentials using the Windows reg.exe tool. | update | 4 - -|<> | Identifies the creation of a Local Security Authority Subsystem Service (lsass.exe) default memory dump. This may indicate a credential access attempt via trusted system utilities such as Task Manager (taskmgr.exe) and SQL Dumper (sqldumper.exe) or known pentesting tools such as Dumpert and AndrewSpecial. | update | 5 - -|<> | Windows Credential Manager allows you to create, view, or delete saved credentials for signing into websites, connected applications, and networks. An adversary may abuse this to list or dump credentials stored in the Credential Manager for saved usernames and passwords. This may also be performed in preparation of lateral movement. | update | 2 - -|<> | Identifies attempts to clear or disable Windows event log stores using Windows wevetutil command. This is often done by attackers in an attempt to evade detection or destroy forensic evidence on a system. | update | 10 - -|<> | Identifies attempts to clear Windows event log stores. This is often done by attackers in an attempt to evade detection or destroy forensic evidence on a system. | update | 2 - -|<> | Identifies modifications to the Windows Defender configuration settings using PowerShell to add exclusions at the folder directory or process level. | update | 3 - -|<> | Identifies use of the netsh.exe to disable or weaken the local firewall. Attackers will use this command line tool to disable the firewall during troubleshooting or to enable network mobility. | update | 10 - -|<> | Identifies attempts to disable EventLog via the logman Windows utility, PowerShell, or auditpol. This is often done by attackers in an attempt to evade detection on a system. | update | 2 - -|<> | Identifies suspicious .NET code execution. connections. | update | 5 - -|<> | Identifies use of the network shell utility (netsh.exe) to enable inbound Remote Desktop Protocol (RDP) connections in the Windows Firewall. | update | 4 - -|<> | Identifies use of the netsh.exe program to enable host discovery via the network. Attackers can use this command-line tool to weaken the host firewall settings. | update | 2 - -|<> | An instance of MSBuild, the Microsoft Build Engine, was started by Excel or Word. This is unusual behavior for the Build Engine and could have been caused by an Excel or Word document executing a malicious script payload. | update | 9 - -|<> | An instance of MSBuild, the Microsoft Build Engine, was started by a script or the Windows command interpreter. This behavior is unusual and is sometimes used by malicious payloads. | update | 9 - -|<> | An instance of MSBuild, the Microsoft Build Engine, was started by Explorer or the WMI (Windows Management Instrumentation) subsystem. This behavior is unusual and is sometimes used by malicious payloads. | update | 9 - -|<> | An instance of MSBuild, the Microsoft Build Engine, was started after being renamed. This is uncommon behavior and may indicate an attempt to run unnoticed or undetected. | update | 9 - -|<> | Identifies a Windows trusted program that is known to be vulnerable to DLL Search Order Hijacking starting after being renamed or from a non-standard path. This is uncommon behavior and may indicate an attempt to evade defenses via side-loading a malicious DLL within the memory space of one of those processes. | update | 2 - -|<> | Masquerading can allow an adversary to evade defenses and better blend in with the environment. One way it occurs is when the name or location of a file is manipulated as a means of tricking a user into executing what they think is a benign file type but is actually executable code. | update | 3 - -|<> | Identifies registry write modifications to hide an encoded portable executable. This could be indicative of adversary defense evasion by avoiding the storing of malicious content directly on disk. | update | 4 - -|<> | Identifies when Internet Information Services (IIS) HTTP Logging is disabled on a server. An attacker with IIS server access via a webshell or other mechanism can disable HTTP Logging as an effective anti-forensics measure. | update | 6 - -|<> | Identifies a suspicious AutoIt process execution. Malware written as an AutoIt script tends to rename the AutoIt executable to avoid detection. | update | 5 - -|<> | Identifies execution from a directory masquerading as the Windows Program Files directories. These paths are trusted and usually host trusted third party programs. An adversary may leverage masquerading, along with low privileges to bypass detections whitelisting those folders. | update | 5 - -|<> | Identifies MsBuild.exe making outbound network connections. This may indicate adversarial activity as MsBuild is often leveraged by adversaries to execute code and evade detection. | update | 8 - -|<> | Identifies a process termination event quickly followed by the deletion of its executable file. Malware tools and other non-native files dropped or created on a system by an adversary may leave traces to indicate to what occurred. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint. | update | 3 - -|<> | Identifies processes running from an Alternate Data Stream. This is uncommon for legitimate processes and sometimes done by adversaries to hide malware. | update | 5 - -|<> | The Filter Manager Control Program (fltMC.exe) binary may be abused by adversaries to unload a filter driver and evade defenses. | update | 8 - -|<> | Identifies process execution events where the command line value contains a long sequence of whitespace characters or multiple occurrences of contiguous whitespace. Attackers may attempt to evade signature-based detections by padding their malicious command with unnecessary whitespace characters. These observations should be investigated for malicious behavior. | update | 2 - -|<> | This rule detects the Active Directory query tool, AdFind.exe. AdFind has legitimate purposes, but it is frequently leveraged by threat actors to perform post-exploitation Active Directory reconnaissance. The AdFind tool has been observed in Trickbot, Ryuk, Maze, and FIN6 campaigns. For Winlogbeat, this rule requires Sysmon. | update | 5 - -|<> | Identifies instances of lower privilege accounts enumerating Administrator accounts or groups using built-in Windows tools. | update | 4 - -|<> | Identifies the SYSTEM account using an account discovery utility. This could be a sign of discovery activity after an adversary has achieved privilege escalation. | update | 8 - -|<> | Identifies the use of Windows Management Instrumentation Command (WMIC) to discover certain System Security Settings such as AntiVirus or Host Firewall details. | update | 4 - -|<> | Identifies native Windows host and network enumeration commands spawned by the Windows Management Instrumentation Provider Service (WMIPrvSE). | update | 2 - -|<> | Compiled HTML files (.chm) are commonly distributed as part of the Microsoft HTML Help system. Adversaries may conceal malicious code in a CHM file and deliver it to a victim for execution. CHM content is loaded by the HTML Help executable program (hh.exe). | update | 9 - -|<> | Identifies the PowerShell process loading the Task Scheduler COM DLL followed by an outbound RPC network connection within a short time period. This may indicate lateral movement or remote discovery via scheduled tasks. | update | 3 - -|<> | Compiled HTML files (.chm) are commonly distributed as part of the Microsoft HTML Help system. Adversaries may conceal malicious code in a CHM file and deliver it to a victim for execution. CHM content is loaded by the HTML Help executable program (hh.exe). | update | 9 - -|<> | Identifies use of the wbadmin.exe to delete the backup catalog. Ransomware and other malware may do this to prevent system recovery. | update | 10 - -|<> | Identifies use of bcdedit.exe to delete boot configuration data. This tactic is sometimes used as by malware or an attacker as a destructive technique. | update | 9 - -|<> | This rule identifies a high number (10) of process terminations (stop, delete, or suspend) from the same host within a short time period. | update | 3 - -|<> | Identifies use of vssadmin.exe for shadow copy deletion or resizing on endpoints. This commonly occurs in tandem with ransomware or other destructive attacks. | update | 10 - -|<> | Identifies use of wmic.exe for shadow copy deletion on endpoints. This commonly occurs in tandem with ransomware or other destructive attacks. | update | 10 - -|<> | Identifies suspicious child processes of frequently targeted Microsoft Office applications (Word, PowerPoint, Excel). These child processes are often launched during exploitation of Office applications or from documents with malicious macros. | update | 9 - -|<> | Identifies the use of Distributed Component Object Model (DCOM) to execute commands from a remote host, which are launched via the HTA Application COM Object. This behavior may indicate an attacker abusing a DCOM application to move laterally while attempting to evading detection. | update | 3 - -|<> | Identifies the use of Distributed Component Object Model (DCOM) to run commands from a remote host, which are launched via the MMC20 Application COM Object. This behavior may indicate an attacker abusing a DCOM application to move laterally. | update | 3 - -|<> | Identifies use of Distributed Component Object Model (DCOM) to run commands from a remote host, which are launched via the ShellBrowserWindow or ShellWindows Application COM Object. This behavior may indicate an attacker abusing a DCOM application to stealthily move laterally. | update | 3 - -|<> | Identifies unexpected processes making network connections over port 445. Windows File Sharing is typically implemented over Server Message Block (SMB), which communicates between hosts using port 445. When legitimate, these network connections are established by the kernel. Processes making 445/tcp connections may be port scanners, exploits, or suspicious user-level processes moving laterally. | update | 7 - -|<> | Specially crafted DNS requests can manipulate a known overflow vulnerability in some Windows DNS servers which result in Remote Code Execution (RCE) or a Denial of Service (DoS) from crashing the service. | update | 5 - -|<> | Identifies registry write modifications to enable Remote Desktop Protocol (RDP) access. This could be indicative of adversary lateral movement preparation. | update | 4 - -|<> | Identifies potential behavior of SharpRDP, which is a tool that can be used to perform authenticated command execution against a remote target via Remote Desktop Protocol (RDP) for the purposes of lateral movement. | update | 3 - -|<> | Identifies remote scheduled task creations on a target host. This could be indicative of adversary lateral movement. | update | 4 - -|<