[Rule Tuning] Ensure host information is in endpoint rule queries

rules/linux/command_and_control_connection_attempt_by_non_ssh_root_session.toml

@@ -4,7 +4,7 @@ integration = ["endpoint"]
 maturity = "production"
 min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 min_stack_version = "8.3.0"
-updated_date = "2022/12/14"
+updated_date = "2023/02/22"
 
 [rule]
 author = ["Elastic"]
@@ -45,9 +45,9 @@ type = "eql"
 
 query = '''
 sequence by process.entity_id with maxspan=1m
-[network where event.type == "start" and event.action == "connection_attempted" and user.id == "0" and
+[network where host.os.type == "linux" and event.type == "start" and event.action == "connection_attempted" and user.id == "0" and
     not process.executable : ("/bin/ssh", "/sbin/ssh", "/usr/lib/systemd/systemd", "/usr/sbin/sshd")]
-[process where event.action == "session_id_change" and user.id == "0" and
+[process where host.os.type == "linux" and event.action == "session_id_change" and user.id == "0" and
     not process.executable : ("/bin/ssh", "/sbin/ssh", "/usr/lib/systemd/systemd", "/usr/sbin/sshd")]
 '''
 

rules/linux/command_and_control_linux_iodine_activity.toml

@@ -4,7 +4,7 @@ integration = ["endpoint"]
 maturity = "production"
 min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 min_stack_version = "8.3.0"
-updated_date = "2022/12/19"
+updated_date = "2023/02/22"
 
 [rule]
 author = ["Elastic"]
@@ -32,7 +32,7 @@ timestamp_override = "event.ingested"
 type = "query"
 
 query = '''
-event.category:process and event.type:(start or process_started) and process.name:(iodine or iodined)
+event.category:process and host.os.type:linux and event.type:(start or process_started) and process.name:(iodine or iodined)
 '''
 
 

rules/linux/command_and_control_tunneling_via_earthworm.toml

@@ -4,7 +4,7 @@ integration = ["endpoint"]
 maturity = "production"
 min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 min_stack_version = "8.3.0"
-updated_date = "2022/12/20"
+updated_date = "2023/02/22"
 
 [rule]
 author = ["Elastic"]
@@ -34,7 +34,7 @@ timestamp_override = "event.ingested"
 type = "eql"
 
 query = '''
-process where event.type == "start" and
+process where host.os.type == "linux" and event.type == "start" and
  process.args : "-s" and process.args : "-d" and process.args : "rssocks"
 '''
 

rules/linux/credential_access_bruteforce_password_guessing.toml

@@ -4,7 +4,7 @@ integration = ["system"]
 maturity = "production"
 min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 min_stack_version = "8.3.0"
-updated_date = "2023/02/01"
+updated_date = "2023/02/22"
 
 [rule]
 author = ["Elastic"]
@@ -54,10 +54,10 @@ tags = ["Elastic", "Host", "Linux", "Threat Detection", "Credential Access"]
 type = "eql"
 query = '''
 sequence by host.id, source.ip, user.name with maxspan=3s
-  [authentication where event.action  in ("ssh_login", "user_login") and
+  [authentication where host.os.type == "linux" and event.action  in ("ssh_login", "user_login") and
    event.outcome == "failure" and source.ip != null and source.ip != "0.0.0.0" and source.ip != "::" ] with runs=2
 
-  [authentication where event.action  in ("ssh_login", "user_login") and
+  [authentication where host.os.type == "linux" and event.action  in ("ssh_login", "user_login") and
    event.outcome == "success" and source.ip != null and source.ip != "0.0.0.0" and source.ip != "::" ]
 '''
 

rules/linux/credential_access_collection_sensitive_files.toml

@@ -4,7 +4,7 @@ integration = ["endpoint"]
 maturity = "production"
 min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 min_stack_version = "8.3.0"
-updated_date = "2022/12/20"
+updated_date = "2023/02/22"
 
 [rule]
 author = ["Elastic"]
@@ -28,7 +28,7 @@ timestamp_override = "event.ingested"
 type = "query"
 
 query = '''
-event.category:process and event.type:start and
+event.category:process and host.os.type:linux and event.type:start and
   process.name:(zip or tar or gzip or hdiutil or 7z) and
   process.args:
     (

rules/linux/credential_access_credential_dumping.toml

@@ -31,7 +31,7 @@ tags = ["Elastic", "Elastic Endgame", "Host", "Linux", "Threat Detection", "Cred
 timestamp_override = "event.ingested"
 type = "eql"
 query = '''
-process where process.name == "unshadow" and
+process where host.os.type == "linux" and process.name == "unshadow" and
   event.type == "start" and event.action == "exec" and process.args_count >= 2
 '''
 

rules/linux/credential_access_potential_linux_ssh_bruteforce.toml

@@ -4,7 +4,7 @@ integration = ["system"]
 maturity = "production"
 min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 min_stack_version = "8.3.0"
-updated_date = "2023/02/01"
+updated_date = "2023/02/22"
 
 [rule]
 author = ["Elastic"]
@@ -54,7 +54,7 @@ tags = ["Elastic", "Host", "Linux", "Threat Detection", "Credential Access"]
 type = "eql"
 query = '''
 sequence by host.id, source.ip, user.name with maxspan=10s
-  [authentication where event.action  in ("ssh_login", "user_login") and
+  [authentication where host.os.type == "linux" and event.action  in ("ssh_login", "user_login") and
    event.outcome == "failure" and source.ip != null and source.ip != "0.0.0.0" and source.ip != "::" ] with runs=10
 '''
 

rules/linux/credential_access_potential_linux_ssh_bruteforce_root.toml

@@ -4,7 +4,7 @@ integration = ["system"]
 maturity = "production"
 min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 min_stack_version = "8.3.0"
-updated_date = "2023/02/01"
+updated_date = "2023/02/22"
 
 [rule]
 author = ["Elastic"]
@@ -54,7 +54,7 @@ tags = ["Elastic", "Host", "Linux", "Threat Detection", "Lateral Movement", "Cre
 type = "eql"
 query = '''
 sequence by host.id, source.ip with maxspan=10s
-  [authentication where event.action  in ("ssh_login", "user_login") and
+  [authentication where host.os.type == "linux" and event.action  in ("ssh_login", "user_login") and
    event.outcome == "failure" and source.ip != null and source.ip != "0.0.0.0" and
    source.ip != "::" and  user.name in ("*root*" , "*admin*")] with runs=3
 '''

rules/linux/credential_access_ssh_backdoor_log.toml

@@ -4,7 +4,7 @@ integration = ["endpoint"]
 maturity = "production"
 min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 min_stack_version = "8.3.0"
-updated_date = "2022/12/20"
+updated_date = "2023/02/22"
 
 [rule]
 author = ["Elastic"]
@@ -35,7 +35,7 @@ timestamp_override = "event.ingested"
 type = "eql"
 
 query = '''
-file where event.type == "change" and process.executable : ("/usr/sbin/sshd", "/usr/bin/ssh") and
+file where host.os.type == "linux" and event.type == "change" and process.executable : ("/usr/sbin/sshd", "/usr/bin/ssh") and
   (
     (file.name : (".*", "~*", "*~") and not file.name : (".cache", ".viminfo", ".bash_history")) or
     file.extension : ("in", "out", "ini", "h", "gz", "so", "sock", "sync", "0", "1", "2", "3", "4", "5", "6", "7", "8", "9") or

rules/linux/defense_evasion_attempt_to_disable_iptables_or_firewall.toml

@@ -24,7 +24,7 @@ tags = ["Elastic", "Host", "Linux", "Threat Detection", "Defense Evasion"]
 timestamp_override = "event.ingested"
 type = "eql"
 query = '''
-process where event.type == "start" and event.action == "exec" and
+process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and
  (
    /* disable FW */
    (

rules/linux/defense_evasion_attempt_to_disable_syslog_service.toml

@@ -4,7 +4,7 @@ integration = ["endpoint"]
 maturity = "production"
 min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 min_stack_version = "8.3.0"
-updated_date = "2022/12/20"
+updated_date = "2023/02/22"
 
 [rule]
 author = ["Elastic"]
@@ -25,7 +25,7 @@ timestamp_override = "event.ingested"
 type = "query"
 
 query = '''
-event.category:process and event.type:(start or process_started) and
+event.category:process and host.os.type:linux and event.type:(start or process_started) and
   ((process.name:service and process.args:stop) or
      (process.name:chkconfig and process.args:off) or
      (process.name:systemctl and process.args:(disable or stop or kill)))

rules/linux/defense_evasion_base16_or_base32_encoding_or_decoding_activity.toml

@@ -4,7 +4,7 @@ integration = ["endpoint"]
 maturity = "production"
 min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 min_stack_version = "8.3.0"
-updated_date = "2022/12/20"
+updated_date = "2023/02/22"
 
 [rule]
 author = ["Elastic"]
@@ -28,7 +28,7 @@ timestamp_override = "event.ingested"
 type = "query"
 
 query = '''
-event.category:process and event.type:(start or process_started) and
+event.category:process and host.os.type:linux and event.type:(start or process_started) and
   process.name:(base16 or base32 or base32plain or base32hex)
 '''
 

rules/linux/defense_evasion_chattr_immutable_file.toml

@@ -4,7 +4,7 @@ integration = ["endpoint"]
 maturity = "production"
 min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 min_stack_version = "8.3.0"
-updated_date = "2022/12/20"
+updated_date = "2023/02/22"
 
 [rule]
 author = ["Elastic"]
@@ -32,7 +32,9 @@ timestamp_override = "event.ingested"
 type = "eql"
 
 query = '''
-process where event.type == "start" and user.name == "root" and process.executable : "/usr/bin/chattr" and process.args : ("-*i*", "+*i*") and not process.parent.executable: "/lib/systemd/systemd"
+process where host.os.type == "linux" and event.type == "start" and user.name == "root" and
+  process.executable : "/usr/bin/chattr" and process.args : ("-*i*", "+*i*") and
+  not process.parent.executable: "/lib/systemd/systemd"
 '''
 
 

rules/linux/defense_evasion_disable_selinux_attempt.toml

@@ -4,7 +4,7 @@ integration = ["endpoint"]
 maturity = "production"
 min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 min_stack_version = "8.3.0"
-updated_date = "2022/12/20"
+updated_date = "2023/02/22"
 
 [rule]
 author = ["Elastic"]
@@ -26,7 +26,7 @@ timestamp_override = "event.ingested"
 type = "query"
 
 query = '''
-event.category:process and event.type:(start or process_started) and process.name:setenforce and process.args:0
+event.category:process and host.os.type:linux and event.type:(start or process_started) and process.name:setenforce and process.args:0
 '''
 
 

rules/linux/defense_evasion_file_deletion_via_shred.toml

@@ -4,7 +4,7 @@ integration = ["endpoint"]
 maturity = "production"
 min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 min_stack_version = "8.3.0"
-updated_date = "2022/12/20"
+updated_date = "2023/02/22"
 
 [rule]
 author = ["Elastic"]
@@ -26,7 +26,7 @@ timestamp_override = "event.ingested"
 type = "query"
 
 query = '''
-event.category:process and event.type:(start or process_started) and process.name:shred and
+event.category:process and host.os.type:linux and event.type:(start or process_started) and process.name:shred and
   process.args:("-u" or "--remove" or "-z" or "--zero")
 '''
 

rules/linux/defense_evasion_file_mod_writable_dir.toml

@@ -4,7 +4,7 @@ integration = ["endpoint"]
 maturity = "production"
 min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 min_stack_version = "8.3.0"
-updated_date = "2022/12/14"
+updated_date = "2023/02/22"
 
 [rule]
 author = ["Elastic"]
@@ -31,7 +31,7 @@ timestamp_override = "event.ingested"
 type = "query"
 
 query = '''
-event.category:process and event.type:(start or process_started) and
+event.category:process and host.os.type:linux and event.type:(start or process_started) and
   process.name:(chmod or chown or chattr or chgrp) and
   process.working_directory:(/tmp or /var/tmp or /dev/shm) and
   not user.name:root

rules/linux/defense_evasion_hidden_file_dir_tmp.toml

@@ -4,7 +4,7 @@ integration = ["endpoint"]
 maturity = "production"
 min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 min_stack_version = "8.3.0"
-updated_date = "2022/12/14"
+updated_date = "2023/02/22"
 
 [rule]
 author = ["Elastic"]
@@ -37,7 +37,7 @@ timestamp_override = "event.ingested"
 type = "eql"
 
 query = '''
-process where event.type in ("start", "process_started") and
+process where host.os.type == "linux" and event.type in ("start", "process_started") and
   process.working_directory in ("/tmp", "/var/tmp", "/dev/shm") and
   process.args regex~ """\.[a-z0-9_\-][a-z0-9_\-\.]{1,254}""" and
   not process.name in ("ls", "find", "grep")

rules/linux/defense_evasion_hidden_shared_object.toml

@@ -4,7 +4,7 @@ integration = ["endpoint"]
 maturity = "production"
 min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 min_stack_version = "8.3.0"
-updated_date = "2022/12/20"
+updated_date = "2023/02/22"
 
 [rule]
 author = ["Elastic"]
@@ -31,7 +31,7 @@ timestamp_override = "event.ingested"
 type = "eql"
 
 query = '''
-file where event.type : "creation" and file.extension == "so" and file.name : ".*.so"
+file where host.os.type == "linux" and event.type == "creation" and file.extension == "so" and file.name : ".*.so"
 '''
 
 

rules/linux/defense_evasion_kernel_module_removal.toml

@@ -4,7 +4,7 @@ integration = ["endpoint"]
 maturity = "production"
 min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 min_stack_version = "8.3.0"
-updated_date = "2022/12/20"
+updated_date = "2023/02/22"
 
 [rule]
 author = ["Elastic"]
@@ -33,7 +33,7 @@ timestamp_override = "event.ingested"
 type = "query"
 
 query = '''
-event.category:process and event.type:(start or process_started) and
+event.category:process and host.os.type:linux and event.type:(start or process_started) and
   process.args:((rmmod and sudo) or (modprobe and sudo and ("--remove" or "-r")))
 '''
 

rules/linux/defense_evasion_log_files_deleted.toml

@@ -4,7 +4,7 @@ integration = ["endpoint"]
 maturity = "production"
 min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 min_stack_version = "8.3.0"
-updated_date = "2022/12/20"
+updated_date = "2023/02/22"
 
 [rule]
 author = ["Elastic"]
@@ -32,7 +32,7 @@ timestamp_override = "event.ingested"
 type = "eql"
 
 query = '''
-file where event.type == "deletion" and
+file where host.os.type == "linux" and event.type == "deletion" and
   file.path :
     (
     "/var/run/utmp",

rules/linux/discovery_kernel_module_enumeration.toml

@@ -4,7 +4,7 @@ integration = ["endpoint"]
 maturity = "production"
 min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 min_stack_version = "8.3.0"
-updated_date = "2022/12/20"
+updated_date = "2023/02/22"
 
 [rule]
 author = ["Elastic"]
@@ -32,7 +32,7 @@ timestamp_override = "event.ingested"
 type = "query"
 
 query = '''
-event.category:process and event.type:(start or process_started) and
+event.category:process and host.os.type:linux and event.type:(start or process_started) and
   process.args:(kmod and list and sudo or sudo and (depmod or lsmod or modinfo))
 '''
 

rules/linux/discovery_linux_hping_activity.toml

@@ -4,7 +4,7 @@ integration = ["endpoint"]
 maturity = "production"
 min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 min_stack_version = "8.3.0"
-updated_date = "2022/12/20"
+updated_date = "2023/02/22"
 
 [rule]
 author = ["Elastic"]
@@ -32,7 +32,7 @@ timestamp_override = "event.ingested"
 type = "query"
 
 query = '''
-event.category:process and event.type:(start or process_started) and process.name:(hping or hping2 or hping3)
+event.category:process and host.os.type:linux and event.type:(start or process_started) and process.name:(hping or hping2 or hping3)
 '''