-
Notifications
You must be signed in to change notification settings - Fork 8.3k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[Detection Rules] Add 7.16 rules (#118657)
- Loading branch information
1 parent
d0070c9
commit 0c68ecf
Showing
40 changed files
with
1,562 additions
and
421 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
70 changes: 70 additions & 0 deletions
70
...on/server/lib/detection_engine/rules/prepackaged_rules/collection_posh_audio_capture.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,70 @@ | ||
| { | ||
| "author": [ | ||
| "Elastic" | ||
| ], | ||
| "description": "Detects PowerShell Scripts that can record audio, a common feature in popular post-exploitation tooling.", | ||
| "from": "now-9m", | ||
| "index": [ | ||
| "winlogbeat-*", | ||
| "logs-windows.*" | ||
| ], | ||
| "language": "kuery", | ||
| "license": "Elastic License v2", | ||
| "name": "PowerShell Suspicious Script with Audio Capture Capabilities", | ||
| "query": "event.code:\"4104\" and \n powershell.file.script_block_text : (\n Get-MicrophoneAudio or (waveInGetNumDevs and mciSendStringA)\n )\n", | ||
| "references": [ | ||
| "https://github.com/PowerShellMafia/PowerSploit/blob/master/Exfiltration/Get-MicrophoneAudio.ps1" | ||
| ], | ||
| "risk_score": 47, | ||
| "rule_id": "2f2f4939-0b34-40c2-a0a3-844eb7889f43", | ||
| "severity": "medium", | ||
| "tags": [ | ||
| "Elastic", | ||
| "Host", | ||
| "Windows", | ||
| "Threat Detection", | ||
| "Collection" | ||
| ], | ||
| "threat": [ | ||
| { | ||
| "framework": "MITRE ATT&CK", | ||
| "tactic": { | ||
| "id": "TA0009", | ||
| "name": "Collection", | ||
| "reference": "https://attack.mitre.org/tactics/TA0009/" | ||
| }, | ||
| "technique": [ | ||
| { | ||
| "id": "T1123", | ||
| "name": "Audio Capture", | ||
| "reference": "https://attack.mitre.org/techniques/T1123/" | ||
| } | ||
| ] | ||
| }, | ||
| { | ||
| "framework": "MITRE ATT&CK", | ||
| "tactic": { | ||
| "id": "TA0002", | ||
| "name": "Execution", | ||
| "reference": "https://attack.mitre.org/tactics/TA0002/" | ||
| }, | ||
| "technique": [ | ||
| { | ||
| "id": "T1059", | ||
| "name": "Command and Scripting Interpreter", | ||
| "reference": "https://attack.mitre.org/techniques/T1059/", | ||
| "subtechnique": [ | ||
| { | ||
| "id": "T1059.001", | ||
| "name": "PowerShell", | ||
| "reference": "https://attack.mitre.org/techniques/T1059/001/" | ||
| } | ||
| ] | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "timestamp_override": "event.ingested", | ||
| "type": "query", | ||
| "version": 1 | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
53 changes: 53 additions & 0 deletions
53
...rules/prepackaged_rules/credential_access_azure_full_network_packet_capture_detected.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,53 @@ | ||
| { | ||
| "author": [ | ||
| "Austin Songer" | ||
| ], | ||
| "description": "Identifies potential full network packet capture in Azure. Packet Capture is an Azure Network Watcher feature that can be used to inspect network traffic. This feature can potentially be abused to read sensitive data from unencrypted internal traffic.", | ||
| "false_positives": [ | ||
| "Full Network Packet Capture may be done by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Full Network Packet Capture from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule." | ||
| ], | ||
| "from": "now-25m", | ||
| "index": [ | ||
| "filebeat-*", | ||
| "logs-azure*" | ||
| ], | ||
| "language": "kuery", | ||
| "license": "Elastic License v2", | ||
| "name": "Azure Full Network Packet Capture Detected", | ||
| "note": "## Config\n\nThe Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.", | ||
| "query": "event.dataset:azure.activitylogs and azure.activitylogs.operation_name:\n (\n \"MICROSOFT.NETWORK/*/STARTPACKETCAPTURE/ACTION\" or\n \"MICROSOFT.NETWORK/*/VPNCONNECTIONS/STARTPACKETCAPTURE/ACTION\" or\n \"MICROSOFT.NETWORK/*/PACKETCAPTURES/WRITE\"\n ) and \nevent.outcome:(Success or success)\n", | ||
| "references": [ | ||
| "https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations" | ||
| ], | ||
| "risk_score": 47, | ||
| "rule_id": "3ad77ed4-4dcf-4c51-8bfc-e3f7ce316b2f", | ||
| "severity": "medium", | ||
| "tags": [ | ||
| "Elastic", | ||
| "Cloud", | ||
| "Azure", | ||
| "Continuous Monitoring", | ||
| "SecOps", | ||
| "Monitoring" | ||
| ], | ||
| "threat": [ | ||
| { | ||
| "framework": "MITRE ATT&CK", | ||
| "tactic": { | ||
| "id": "TA0006", | ||
| "name": "Credential Access", | ||
| "reference": "https://attack.mitre.org/tactics/TA0006/" | ||
| }, | ||
| "technique": [ | ||
| { | ||
| "id": "T1040", | ||
| "name": "Network Sniffing", | ||
| "reference": "https://attack.mitre.org/techniques/T1040/" | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "timestamp_override": "event.ingested", | ||
| "type": "query", | ||
| "version": 1 | ||
| } |
81 changes: 81 additions & 0 deletions
81
.../server/lib/detection_engine/rules/prepackaged_rules/credential_access_posh_minidump.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,81 @@ | ||
| { | ||
| "author": [ | ||
| "Elastic" | ||
| ], | ||
| "description": "This rule detects PowerShell scripts that have capabilities to dump process memory using WindowsErrorReporting or Dbghelp.dll MiniDumpWriteDump. Attackers can use this tooling to dump LSASS and get access to credentials.", | ||
| "false_positives": [ | ||
| "Powershell Scripts that use this capability for troubleshooting." | ||
| ], | ||
| "from": "now-9m", | ||
| "index": [ | ||
| "winlogbeat-*", | ||
| "logs-windows.*" | ||
| ], | ||
| "language": "kuery", | ||
| "license": "Elastic License v2", | ||
| "name": "PowerShell MiniDump Script", | ||
| "query": "event.code:\"4104\" and powershell.file.script_block_text:(MiniDumpWriteDump or MiniDumpWithFullMemory or pmuDetirWpmuDiniM)\n", | ||
| "references": [ | ||
| "https://github.com/PowerShellMafia/PowerSploit/blob/master/Exfiltration/Out-Minidump.ps1", | ||
| "https://github.com/FuzzySecurity/PowerShell-Suite/blob/master/Get-ProcessMiniDump.ps1" | ||
| ], | ||
| "risk_score": 73, | ||
| "rule_id": "577ec21e-56fe-4065-91d8-45eb8224fe77", | ||
| "severity": "high", | ||
| "tags": [ | ||
| "Elastic", | ||
| "Host", | ||
| "Windows", | ||
| "Threat Detection", | ||
| "Credential Access" | ||
| ], | ||
| "threat": [ | ||
| { | ||
| "framework": "MITRE ATT&CK", | ||
| "tactic": { | ||
| "id": "TA0006", | ||
| "name": "Credential Access", | ||
| "reference": "https://attack.mitre.org/tactics/TA0006/" | ||
| }, | ||
| "technique": [ | ||
| { | ||
| "id": "T1003", | ||
| "name": "OS Credential Dumping", | ||
| "reference": "https://attack.mitre.org/techniques/T1003/", | ||
| "subtechnique": [ | ||
| { | ||
| "id": "T1003.001", | ||
| "name": "LSASS Memory", | ||
| "reference": "https://attack.mitre.org/techniques/T1003/001/" | ||
| } | ||
| ] | ||
| } | ||
| ] | ||
| }, | ||
| { | ||
| "framework": "MITRE ATT&CK", | ||
| "tactic": { | ||
| "id": "TA0002", | ||
| "name": "Execution", | ||
| "reference": "https://attack.mitre.org/tactics/TA0002/" | ||
| }, | ||
| "technique": [ | ||
| { | ||
| "id": "T1059", | ||
| "name": "Command and Scripting Interpreter", | ||
| "reference": "https://attack.mitre.org/techniques/T1059/", | ||
| "subtechnique": [ | ||
| { | ||
| "id": "T1059.001", | ||
| "name": "PowerShell", | ||
| "reference": "https://attack.mitre.org/techniques/T1059/001/" | ||
| } | ||
| ] | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "timestamp_override": "event.ingested", | ||
| "type": "query", | ||
| "version": 1 | ||
| } |
52 changes: 52 additions & 0 deletions
52
...ction_engine/rules/prepackaged_rules/defense_evasion_azure_blob_permissions_modified.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,52 @@ | ||
| { | ||
| "author": [ | ||
| "Austin Songer" | ||
| ], | ||
| "description": "Identifies when the Azure role-based access control (Azure RBAC) permissions are modified for an Azure Blob. An adversary may modify the permissions on a blob to weaken their target's security controls or an administrator may inadvertently modify the permissions, which could lead to data exposure or loss.", | ||
| "false_positives": [ | ||
| "Blob permissions may be modified by system administrators. Verify that the configuration change was expected. Exceptions can be added to this rule to filter expected behavior." | ||
| ], | ||
| "index": [ | ||
| "filebeat-*", | ||
| "logs-azure*" | ||
| ], | ||
| "language": "kuery", | ||
| "license": "Elastic License v2", | ||
| "name": "Azure Blob Permissions Modification", | ||
| "note": "## Config\n\nThe Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.", | ||
| "query": "event.dataset:azure.activitylogs and azure.activitylogs.operation_name:(\n \"MICROSOFT.STORAGE/STORAGEACCOUNTS/BLOBSERVICES/CONTAINERS/BLOBS/MANAGEOWNERSHIP/ACTION\" or\n \"MICROSOFT.STORAGE/STORAGEACCOUNTS/BLOBSERVICES/CONTAINERS/BLOBS/MODIFYPERMISSIONS/ACTION\") and \n event.outcome:(Success or success)\n", | ||
| "references": [ | ||
| "https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles" | ||
| ], | ||
| "risk_score": 47, | ||
| "rule_id": "d79c4b2a-6134-4edd-86e6-564a92a933f9", | ||
| "severity": "medium", | ||
| "tags": [ | ||
| "Elastic", | ||
| "Cloud", | ||
| "Azure", | ||
| "Continuous Monitoring", | ||
| "SecOps", | ||
| "Identity and Access" | ||
| ], | ||
| "threat": [ | ||
| { | ||
| "framework": "MITRE ATT&CK", | ||
| "tactic": { | ||
| "id": "TA0005", | ||
| "name": "Defense Evasion", | ||
| "reference": "https://attack.mitre.org/tactics/TA0005/" | ||
| }, | ||
| "technique": [ | ||
| { | ||
| "id": "T1222", | ||
| "name": "File and Directory Permissions Modification", | ||
| "reference": "https://attack.mitre.org/techniques/T1222/" | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "timestamp_override": "event.ingested", | ||
| "type": "query", | ||
| "version": 1 | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
50 changes: 50 additions & 0 deletions
50
.../lib/detection_engine/rules/prepackaged_rules/defense_evasion_dns_over_https_enabled.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,50 @@ | ||
| { | ||
| "author": [ | ||
| "Austin Songer" | ||
| ], | ||
| "description": "Identifies when a user enables DNS-over-HTTPS. This can be used to hide internet activity or be used to hide the process of exfiltrating data. With this enabled organization will lose visibility into data such as query type, response and originating IP that are used to determine bad actors.", | ||
| "from": "now-9m", | ||
| "index": [ | ||
| "winlogbeat-*", | ||
| "logs-endpoint.events.*", | ||
| "logs-windows.*" | ||
| ], | ||
| "language": "eql", | ||
| "license": "Elastic License v2", | ||
| "name": "DNS-over-HTTPS Enabled via Registry", | ||
| "query": "registry where event.type in (\"creation\", \"change\") and\n (registry.path : \"*\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Edge\\\\BuiltInDnsClientEnabled\" and\n registry.data.strings : \"1\") or\n (registry.path : \"*\\\\SOFTWARE\\\\Google\\\\Chrome\\\\DnsOverHttpsMode\" and\n registry.data.strings : \"secure\") or\n (registry.path : \"*\\\\SOFTWARE\\\\Policies\\\\Mozilla\\\\Firefox\\\\DNSOverHTTPS\" and\n registry.data.strings : \"1\")\n", | ||
| "references": [ | ||
| "https://www.tenforums.com/tutorials/151318-how-enable-disable-dns-over-https-doh-microsoft-edge.html", | ||
| "https://chromeenterprise.google/policies/?policy=DnsOverHttpsMode" | ||
| ], | ||
| "risk_score": 21, | ||
| "rule_id": "a22a09c2-2162-4df0-a356-9aacbeb56a04", | ||
| "severity": "low", | ||
| "tags": [ | ||
| "Elastic", | ||
| "Host", | ||
| "Windows", | ||
| "Threat Detection", | ||
| "Defense Evasion" | ||
| ], | ||
| "threat": [ | ||
| { | ||
| "framework": "MITRE ATT&CK", | ||
| "tactic": { | ||
| "id": "TA0005", | ||
| "name": "Defense Evasion", | ||
| "reference": "https://attack.mitre.org/tactics/TA0005/" | ||
| }, | ||
| "technique": [ | ||
| { | ||
| "id": "T1562", | ||
| "name": "Impair Defenses", | ||
| "reference": "https://attack.mitre.org/techniques/T1562/" | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "timestamp_override": "event.ingested", | ||
| "type": "eql", | ||
| "version": 1 | ||
| } |
Oops, something went wrong.