[new hunts] add base64 decode examples #6

Samirbous · 2024-06-12T09:53:31Z

b64 encoded powershell cmd
b64 decode scheduled task actions via registry

elastic#3402) * Locked versions for releases: 8.3,8.4,8.5,8.6,8.7,8.8,8.9,8.10,8.11,8.12 * Update detection_rules/etc/version.lock.json --------- Co-authored-by: terrancedejesus <[email protected]> Co-authored-by: Terrance DeJesus <[email protected]>

* [New BBR] Reverse Connection through Port Knocking * Attempt to fix unit testing error * Mitre list fix? * Revert "Mitre list fix?" This reverts commit 83682b8. * Update command_and_control_linux_port_knocking_reverse_connection.toml * Update command_and_control_linux_port_knocking_reverse_connection.toml * Update rules_building_block/command_and_control_linux_port_knocking_reverse_connection.toml * Update command_and_control_linux_port_knocking_reverse_connection.toml * Update command_and_control_linux_port_knocking_reverse_connection.toml --------- Co-authored-by: Colson Wilhoit <[email protected]>

* [New Rule] Suspicious Passwd File Event Action * Description fix * Pot. UT fix * Pot. UT fix. --------- Co-authored-by: Colson Wilhoit <[email protected]>

* Update credential_access_dcsync_newterm_subjectuser.toml * Update credential_access_dcsync_replication_rights.toml

* Update command_and_control_google_drive_malicious_file_download.toml * Update command_and_control_google_drive_malicious_file_download.toml * Update command_and_control_google_drive_malicious_file_download.toml

…ic#3401) Co-authored-by: Ruben Groenewoud <[email protected]>

…#3416) * Create discovery_active_directory_webservice.toml * Update discovery_active_directory_webservice.toml * Update discovery_active_directory_webservice.toml * Update discovery_active_directory_webservice.toml * Update discovery_active_directory_webservice.toml

* [Rule Tuning] Windows BBR Tuning - 1 * . --------- Co-authored-by: Samirbous <[email protected]>

* [New Rule] Network Connection via systemd * Removed space from description * Added updated query

* [New Rule] apt Package Manager Persistence * [New Rules] APT Package Manager Persistence * [New Rules] APT Package Manager Persistence

* [New Rule] Executable Masquerading as Kernel Proc * Bumped dates * Added endgame support * Added auditd_manager support * Removed auditd_manager support for now

* [New Rules] DDExec Analysis * Increased rule scope * [New Rule] Dynamic Linker Discovery via od * Revert "[New Rule] Dynamic Linker Discovery via od" This reverts commit c58595b. * [New Rule] Dynamic Linker Discovery via od * [New Rule] Potential Memory Seeking Activity * [New BBR] Suspicious Memory grep Activity * Added endgame + auditd_manager support * Removed auditd_manager support for now * Removed auditd_manager support for now * Update discovery_suspicious_memory_grep_activity.toml --------- Co-authored-by: Samirbous <[email protected]>

* release fleet workflow updates; build package integration reference changes * updated commit hash extraction to output to env * adjusted bump-pkg-versions to only include release if necessary * fixed flake errors * add historical argument for build-release set to yes by default * Update detection_rules/devtools.py * fixed fleet workflow; updated registry data references * updated job names * removed extract commit hash job and consolidated into fleet pr job * added echo statement for current branch before checkout * removed id from extract commit hash

elastic#3431) * Locked versions for releases: 8.3,8.4,8.5,8.6,8.7,8.8,8.9,8.10,8.11,8.12 * Update detection_rules/etc/version.lock.json * updated downloadable updates file to reconcile changes * Removed spacing from downloadable updates file --------- Co-authored-by: terrancedejesus <[email protected]> Co-authored-by: Terrance DeJesus <[email protected]>

Co-authored-by: Ruben Groenewoud <[email protected]>

…ty docs (elastic#3434) * removed historical argument; added setup string; fixed links * fixing flake errors * added types for command arguments * adjusted get_release_diff to append strings for release tags * set fetch-depth to 0 for integrations checkout in workflow * changed the name of the workflow * removed TODOs * adjusted release docs workflow to remove prefix for release tags * adjusted URL replacement only if pointed to docs site * added elastic website to regex pattern * add docstrings; adjusted regex; add note for stopgap * added a note about the regex pattern for elastic URLs

* [Rule Tuning] Windows BBR Tuning - 2 * Update defense_evasion_masquerading_windows_system32_exe.toml --------- Co-authored-by: Ruben Groenewoud <[email protected]>

Co-authored-by: Samirbous <[email protected]>

* [Rule Tuning] Windows BBR Tuning - 4 * Update discovery_system_time_discovery.toml

* [Rule Tuning] Windows BBR Tuning - 3 * Update defense_evasion_service_disabled_registry.toml --------- Co-authored-by: Samirbous <[email protected]>

* Create initial_access_execution_from_inetcache.toml * Update initial_access_execution_from_inetcache.toml

…lastic#3430) * [FR] Add Auditd_Manager to NON_DATASET_PACKAGE * Changed alphabetical order --------- Co-authored-by: Mika Ayenson <[email protected]> Co-authored-by: Terrance DeJesus <[email protected]>

* [Tuning] Linux DR Tuning - Part 2 * Update defense_evasion_binary_copied_to_suspicious_directory.toml * Update defense_evasion_base16_or_base32_encoding_or_decoding_activity.toml

* [Tuning] Linux DR Tuning - Part 1 * Update command_and_control_linux_tunneling_and_port_forwarding.toml * Update command_and_control_cat_network_activity.toml

* [New Rule] User Added to Privileged Group * add more groups * Update rules/windows/persistence_user_account_added_to_privileged_group_ad.toml Co-authored-by: Terrance DeJesus <[email protected]> * Update persistence_user_account_added_to_privileged_group_ad.toml --------- Co-authored-by: Terrance DeJesus <[email protected]>

…oup, Role(es|ql) (elastic#3735) * [New Rule] AWS IAM AdministratorAccess Policy Attached to User issue... * add source.address and source.geo.location * fix threat tactic ids * AdministratorAccess Policy Attached to Group * AdminstratoAccess Policy Attached to Role * reduce severity to medium Co-authored-by: Ruben Groenewoud <[email protected]> --------- Co-authored-by: Ruben Groenewoud <[email protected]>

* [New Rule] Executable Bit Set for rc.local/rc.common * Endgame compatibility * Update rules/linux/persistence_rc_local_common_executable_bit_set.toml

* [New Rule] Netcon through XDG Autostart Entry * Update rules/linux/persistence_xdg_autostart_netcon.toml Co-authored-by: Terrance DeJesus <[email protected]> * Update persistence_xdg_autostart_netcon.toml * Update persistence_xdg_autostart_netcon.toml --------- Co-authored-by: Terrance DeJesus <[email protected]>

…c#3759) * [New Rule] Network Connection Initiated by SSH Parent Process * Update persistence_ssh_netcon.toml * Update rules/linux/persistence_ssh_netcon.toml Co-authored-by: Samirbous <[email protected]> * Update rules/linux/persistence_ssh_netcon.toml Co-authored-by: Samirbous <[email protected]> * Update persistence_ssh_netcon.toml * Update persistence_ssh_netcon.toml --------- Co-authored-by: Samirbous <[email protected]>

* new rule 'AWS S3 Bucket Object Retrieval, Deletion, and Potential Ransom Note Replacement' * fixed technique mapping * added investigation guide; added more ransom note extensions * adjusted lookback and maxspan * added API call to second sequence * updating date * Update rules/integrations/aws/impact_s3_bucket_object_deletion_and_ransomware_note_added.toml Co-authored-by: Ruben Groenewoud <[email protected]> * Update rules/integrations/aws/impact_s3_bucket_object_deletion_and_ransomware_note_added.toml Co-authored-by: Ruben Groenewoud <[email protected]> * changed rule to ESQL; updated investigation guide * changed file name * removed txt, ecc, and note --------- Co-authored-by: Ruben Groenewoud <[email protected]>

…ddress.md

…nce_frequency_by_top_source_ip.toml

…t_address.toml

…_frequency_by_top_source_ip.md

…nce_frequency.toml

…_frequency.md

) * [New Rule] APT Package Manager Configuration File Creation * Update rules/linux/persistence_apt_package_manager_file_creation.toml * Update persistence_apt_package_manager_file_creation.toml

* [Rule Tuning] Systemd-udevd Rule File Creation * Incompatible endgame field * Update rules/linux/persistence_udev_rule_creation.toml * Update rules/linux/persistence_udev_rule_creation.toml Co-authored-by: Samirbous <[email protected]> * Update rules/linux/persistence_udev_rule_creation.toml Co-authored-by: Samirbous <[email protected]> * Update persistence_udev_rule_creation.toml --------- Co-authored-by: Samirbous <[email protected]>

* [New Rules] PAM Module Creation & Unusual PAM Grantor * Update persistence_unusual_pam_grantor.toml * Update persistence_pluggable_authentication_module_creation.toml * Update rules/linux/persistence_pluggable_authentication_module_creation.toml * Update persistence_pluggable_authentication_module_creation.toml * Update persistence_unusual_pam_grantor.toml * Update rules/linux/persistence_pluggable_authentication_module_creation.toml

* [New Rule] Suspicious File Modification * Update persistence_suspicious_file_modifications.toml * Update rules/linux/persistence_suspicious_file_modifications.toml Co-authored-by: Jonhnathan <[email protected]> * Update rules/linux/persistence_suspicious_file_modifications.toml Co-authored-by: Jonhnathan <[email protected]> * Updates * Update rules/integrations/fim/persistence_suspicious_file_modifications.toml --------- Co-authored-by: Jonhnathan <[email protected]> Co-authored-by: Justin Ibarra <[email protected]>

…nts-mass-dump

- Scheduled tasks creation by action via registry - Suspicious Base64 Encoded Powershell Command

github-actions bot and others added 30 commits January 23, 2024 16:36

[New Rule] Suspicious Passwd File Event Action (elastic#3396)

381ccf4

* [New Rule] Suspicious Passwd File Event Action * Description fix * Pot. UT fix * Pot. UT fix. --------- Co-authored-by: Colson Wilhoit <[email protected]>

[Tuning] DCSync Rules - 4662 event.action (elastic#3410)

d7f4d79

* Update credential_access_dcsync_newterm_subjectuser.toml * Update credential_access_dcsync_replication_rights.toml

[Tuning] Suspicious File Downloaded from Google Drive (elastic#3411)

4c74588

* Update command_and_control_google_drive_malicious_file_download.toml * Update command_and_control_google_drive_malicious_file_download.toml * Update command_and_control_google_drive_malicious_file_download.toml

[Rule Tuning] Potential Modification of Accessibility Binaries (elast…

50df6f3

…ic#3401) Co-authored-by: Ruben Groenewoud <[email protected]>

[Rule Tuning] Startup or Run Key Registry Modification (elastic#3367)

edd3556

[Rule Tuning] Windows BBR Tuning - 1 (elastic#3380)

8274f9a

* [Rule Tuning] Windows BBR Tuning - 1 * . --------- Co-authored-by: Samirbous <[email protected]>

Update lateral_movement_remote_task_creation_winlog.toml (elastic#3419)

6906a27

[New Rule] Suspicious Network Connection via systemd (elastic#3420)

4f303ab

* [New Rule] Network Connection via systemd * Removed space from description * Added updated query

[New Rules] APT Package Manager Persistence (elastic#3418)

208b2e9

* [New Rule] apt Package Manager Persistence * [New Rules] APT Package Manager Persistence * [New Rules] APT Package Manager Persistence

[New Rule] Executable Masquerading as Kernel Process (elastic#3421)

90d64f0

* [New Rule] Executable Masquerading as Kernel Proc * Bumped dates * Added endgame support * Added auditd_manager support * Removed auditd_manager support for now

[Rule Tuning] Suspicious Antimalware Scan Interface DLL (elastic#3432)

21b559c

Co-authored-by: Ruben Groenewoud <[email protected]>

Add the Zen of Security Rules to philosophy (elastic#3437)

298d1bc

[FR] Add support for Threshold Alert Suppression (elastic#3433)

c3ca01e

[FR] Add New Kibana Schema Issue Template (elastic#3441)

df6dd09

[Rule Tuning] Windows BBR Tuning - 2 (elastic#3381)

ae00f30

* [Rule Tuning] Windows BBR Tuning - 2 * Update defense_evasion_masquerading_windows_system32_exe.toml --------- Co-authored-by: Ruben Groenewoud <[email protected]>

[Rule Tuning] Windows BBR Tuning - 5 (elastic#3385)

97e4979

Co-authored-by: Samirbous <[email protected]>

[Rule Tuning] Windows BBR Tuning - 6 (elastic#3386)

f233909

Co-authored-by: Samirbous <[email protected]>

[Rule Tuning] Windows BBR Tuning - 4 (elastic#3384)

1a8271d

* [Rule Tuning] Windows BBR Tuning - 4 * Update discovery_system_time_discovery.toml

[Rule Tuning] Windows BBR Tuning - 3 (elastic#3382)

5334601

* [Rule Tuning] Windows BBR Tuning - 3 * Update defense_evasion_service_disabled_registry.toml --------- Co-authored-by: Samirbous <[email protected]>

[New] Suspicious Execution from INET Cache (elastic#3445)

4809de6

* Create initial_access_execution_from_inetcache.toml * Update initial_access_execution_from_inetcache.toml

[FR] NON_DATASET_PACKAGE list & Data Source tag for Auditd_manager (e…

a637bce

…lastic#3430) * [FR] Add Auditd_Manager to NON_DATASET_PACKAGE * Changed alphabetical order --------- Co-authored-by: Mika Ayenson <[email protected]> Co-authored-by: Terrance DeJesus <[email protected]>

[Tuning] Linux DR Tuning - Part 2 (elastic#3453)

0e48747

* [Tuning] Linux DR Tuning - Part 2 * Update defense_evasion_binary_copied_to_suspicious_directory.toml * Update defense_evasion_base16_or_base32_encoding_or_decoding_activity.toml

[Tuning] Linux DR Tuning - Part 1 (elastic#3452)

1dc7fd6

* [Tuning] Linux DR Tuning - Part 1 * Update command_and_control_linux_tunneling_and_port_forwarding.toml * Update command_and_control_cat_network_activity.toml

eric-forte-elastic and others added 26 commits June 7, 2024 00:12

react_sync_rta_updates_3575 (elastic#3762)

57095a2

Test deprecated rule modification (elastic#3727)

f9b3534

[New Rule] Executable Bit Set for rc.local/rc.common (elastic#3736)

70496f8

* [New Rule] Executable Bit Set for rc.local/rc.common * Endgame compatibility * Update rules/linux/persistence_rc_local_common_executable_bit_set.toml

fixed index (elastic#3770)

13140d5

Update hunting/windows/docs/execution_via_remote_services_by_client_a…

892b47d

…ddress.md

Update hunting/windows/queries/execution_via_network_logon_by_occurre…

3d83c2b

…nce_frequency_by_top_source_ip.toml

Update hunting/windows/queries/execution_via_remote_services_by_clien…

83d7d1e

…t_address.toml

Update hunting/windows/docs/execution_via_network_logon_by_occurrence…

a81f909

…_frequency_by_top_source_ip.md

Update hunting/windows/queries/execution_via_network_logon_by_occurre…

9c22b1d

…nce_frequency.toml

Update hunting/windows/docs/execution_via_network_logon_by_occurrence…

80c8607

…_frequency.md

Merge branch 'main' into new-hunts-mass-dump

96303f2

[New Rule] APT Package Manager Configuration File Creation (elastic#3739

4003219

) * [New Rule] APT Package Manager Configuration File Creation * Update rules/linux/persistence_apt_package_manager_file_creation.toml * Update persistence_apt_package_manager_file_creation.toml

Add exceptions to C2 Beaconing Activity (elastic#3771)

8baf5dc

Update Minstack versions for SentinelOne rules (elastic#3777)

0a69c19

update docs with naming information

8661fb0

Merge remote-tracking branch 'origin/new-hunts-mass-dump' into new-hu…

d6a098b

…nts-mass-dump

Merge branch 'main' into new-hunts-mass-dump

9721443

[new hunts] base64 decode hunts

1e3d053

- Scheduled tasks creation by action via registry - Suspicious Base64 Encoded Powershell Command

Samirbous requested a review from brokensound77 as a code owner June 12, 2024 09:53

github-actions bot added community backport: auto labels Jun 12, 2024

Samirbous closed this Jun 12, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[new hunts] add base64 decode examples #6

[new hunts] add base64 decode examples #6

Samirbous commented Jun 12, 2024

[new hunts] add base64 decode examples #6

[new hunts] add base64 decode examples #6

Conversation

Samirbous commented Jun 12, 2024