-
Notifications
You must be signed in to change notification settings - Fork 8.3k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Browse files
Browse the repository at this point in the history
# Backport This will backport the following commits from `main` to `8.6`: - [[Detection Engine] Adds 8.6 rules (#146402)](#146402) <!--- Backport version: 8.9.7 --> ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sqren/backport) <!--BACKPORT [{"author":{"name":"Terrance DeJesus","email":"[email protected]"},"sourceCommit":{"committedDate":"2022-11-29T14:33:20Z","message":"[Detection Engine] Adds 8.6 rules (#146402)\n\n## Summary\r\n\r\nPull updates to detection rules from\r\nhttps://github.com/elastic/detection-rules/tree/0600b575650f3bec81720da72b1cea7481978576.\r\n\r\n### Checklist\r\n\r\nDelete any items that are not applicable to this PR.\r\n\r\n- [x] Any text added follows [EUI's writing\r\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),\r\nuses sentence case text and includes [i18n\r\nsupport](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)\r\n\r\nCo-authored-by: Dmitrii <[email protected]>","sha":"d4aff1626f0bb98739224a7652e17258e5594f78","branchLabelMapping":{"^v8.7.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","backport:skip","auto-backport","trade-artifacts","v8.6.0"],"number":146402,"url":"https://github.com/elastic/kibana/pull/146402","mergeCommit":{"message":"[Detection Engine] Adds 8.6 rules (#146402)\n\n## Summary\r\n\r\nPull updates to detection rules from\r\nhttps://github.com/elastic/detection-rules/tree/0600b575650f3bec81720da72b1cea7481978576.\r\n\r\n### Checklist\r\n\r\nDelete any items that are not applicable to this PR.\r\n\r\n- [x] Any text added follows [EUI's writing\r\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),\r\nuses sentence case text and includes [i18n\r\nsupport](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)\r\n\r\nCo-authored-by: Dmitrii <[email protected]>","sha":"d4aff1626f0bb98739224a7652e17258e5594f78"}},"sourceBranch":"main","suggestedTargetBranches":["8.6"],"targetPullRequestStates":[{"branch":"8.6","label":"v8.6.0","labelRegex":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}] BACKPORT--> Co-authored-by: Terrance DeJesus <[email protected]>
- Loading branch information
1 parent
82db446
commit f27fa89
Showing
345 changed files
with
3,954 additions
and
1,546 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
101 changes: 101 additions & 0 deletions
101
...ontent/prepackaged_rules/command_and_control_accepted_default_telnet_port_connection.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,101 @@ | ||
| { | ||
| "author": [ | ||
| "Elastic" | ||
| ], | ||
| "description": "This rule detects network events that may indicate the use of Telnet traffic. Telnet is commonly used by system administrators to remotely control older or embedded systems using the command line shell. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector. As a plain-text protocol, it may also expose usernames and passwords to anyone capable of observing the traffic.", | ||
| "false_positives": [ | ||
| "IoT (Internet of Things) devices and networks may use telnet and can be excluded if desired. Some business work-flows may use Telnet for administration of older devices. These often have a predictable behavior. Telnet activity involving an unusual source or destination may be more suspicious. Telnet activity involving a production server that has no known associated Telnet work-flow or business requirement is often suspicious." | ||
| ], | ||
| "from": "now-9m", | ||
| "index": [ | ||
| "auditbeat-*", | ||
| "filebeat-*", | ||
| "packetbeat-*", | ||
| "logs-endpoint.events.*" | ||
| ], | ||
| "language": "kuery", | ||
| "license": "Elastic License v2", | ||
| "name": "Accepted Default Telnet Port Connection", | ||
| "query": "event.category:(network or network_traffic) and destination.port:23\n and network.direction:(inbound or ingress or outbound or egress)\n and not event.action:(\n flow_dropped or denied or deny or\n flow_terminated or timeout or Reject or network_flow)\n", | ||
| "required_fields": [ | ||
| { | ||
| "ecs": true, | ||
| "name": "destination.port", | ||
| "type": "long" | ||
| }, | ||
| { | ||
| "ecs": true, | ||
| "name": "event.action", | ||
| "type": "keyword" | ||
| }, | ||
| { | ||
| "ecs": true, | ||
| "name": "event.category", | ||
| "type": "keyword" | ||
| }, | ||
| { | ||
| "ecs": true, | ||
| "name": "network.direction", | ||
| "type": "keyword" | ||
| } | ||
| ], | ||
| "risk_score": 47, | ||
| "rule_id": "34fde489-94b0-4500-a76f-b8a157cf9269", | ||
| "severity": "medium", | ||
| "tags": [ | ||
| "Elastic", | ||
| "Host", | ||
| "Network", | ||
| "Threat Detection", | ||
| "Command and Control", | ||
| "Host", | ||
| "Lateral Movement", | ||
| "Initial Access" | ||
| ], | ||
| "threat": [ | ||
| { | ||
| "framework": "MITRE ATT&CK", | ||
| "tactic": { | ||
| "id": "TA0011", | ||
| "name": "Command and Control", | ||
| "reference": "https://attack.mitre.org/tactics/TA0011/" | ||
| }, | ||
| "technique": [] | ||
| }, | ||
| { | ||
| "framework": "MITRE ATT&CK", | ||
| "tactic": { | ||
| "id": "TA0008", | ||
| "name": "Lateral Movement", | ||
| "reference": "https://attack.mitre.org/tactics/TA0008/" | ||
| }, | ||
| "technique": [ | ||
| { | ||
| "id": "T1021", | ||
| "name": "Remote Services", | ||
| "reference": "https://attack.mitre.org/techniques/T1021/" | ||
| } | ||
| ] | ||
| }, | ||
| { | ||
| "framework": "MITRE ATT&CK", | ||
| "tactic": { | ||
| "id": "TA0001", | ||
| "name": "Initial Access", | ||
| "reference": "https://attack.mitre.org/tactics/TA0001/" | ||
| }, | ||
| "technique": [ | ||
| { | ||
| "id": "T1190", | ||
| "name": "Exploit Public-Facing Application", | ||
| "reference": "https://attack.mitre.org/techniques/T1190/" | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "timeline_id": "300afc76-072d-4261-864d-4149714bf3f1", | ||
| "timeline_title": "Comprehensive Network Timeline", | ||
| "timestamp_override": "event.ingested", | ||
| "type": "query", | ||
| "version": 101 | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.