[Rule Tuning] 8.8 Linux Rule Tuning Reviews

[shashank-elastic]

Description

A detailed Analysis of Linux Rule Tunings over the releases has been documented here

Review Rules Guide Lines.

1. Check for False Positive(s) of Rule Firing.
2. Look if Rule Index is pointing to the right log structures.
3. Check Rule Semantics like Tags Naming and MITRE Mapping --> Mostly Caught in Unit Tests, but good to have checks
4. On High False Positives Tune the Rule Logic to excluded and tighten the detection criteria.

Following Rules have to be reviewed for Tuning in 8.8

• 1. credential_access_bruteforce_password_guessing (good)
• 2. credential_access_potential_linux_ssh_bruteforce (tuned in [Rule Tuning & Addition] Potential Linux SSH Brute Force #2583)
• 3. credential_access_potential_linux_ssh_bruteforce_root (fixed in [Rule Tuning] Privileged SSH Brute Force Detected #2595)
• 4. defense_evasion_chattr_immutable_file Linux Rule Tuning #2753
• 5. defense_evasion_hidden_shared_object (tuned in [Rule Tuning] Creation of Hidden Shared Object #2596)
• 6. execution_process_started_from_process_id_file (good)
• 7. execution_reverse_shell_via_named_pipe (good)
• 8. execution_tc_bpf_filter (good)
• 9. impact_process_kill_threshold (waiting for feedback on type change bypass)
• 10. persistence_chkconfig_service_add (good)
• 11. persistence_dynamic_linker_backup (good)
• 12. persistence_insmod_kernel_module_load (good)
• 13. privilege_escalation_shadow_file_read (tuned in [Rule Tuning] Potential Shadow File Read via CLI #2594)
• 14. privilege_escalation_unshare_namesapce_manipulation (changed filename [Rule Tuning] Namespace Manipulation Using Unshare #2599)

Following Rules need round 2 Iteration Of Tuning

• 1. execution_abnormal_process_id_file_created (tuned in [Rule Tuning] Abnormal PID or Lock File Created #2600)
• 2. execution_shell_evasion_linux_binary (tuned in [Rule Tuning] Evaluate GTFOArgs for shell evasion #2686) Awk family was tuned and new process detections added.
• 3. persistence_shell_activity_by_web_server (tuned in [Rule Tuning] Potential Shell via Web Server #2585)

The below Rules have been fixed in previous release, they need to re-checked for tuning and updated accordingly.

• 1. persistence_etc_file_creation Linux Rule Tuning #2753

Similar Issues reported Community

• [Rule Tuning] Potential Credential Access via Windows Utilities #2539
• [Rule Tuning] Abnormal Process ID or Lock File Created #2543

Note : Update the excel sheet according with the tuning details that can help us track for future releases

Example Data