Deprecation Notice to Cloud Defend Rules #4520

shashank-elastic · 2025-03-06T08:44:26Z

Pull Request

Issue link(s): https://github.com/elastic/security-team/issues/11393

Summary - What I changed

Issue Deprecation notice via rule name.

How To Test

Unit test should pass.

Checklist

Added a label for the type of pr: bug, enhancement, schema, maintenance, Rule: New, Rule: Deprecation, Rule: Tuning, Hunt: New, or Hunt: Tuning so guidelines can be generated
Added the meta:rapid-merge label if planning to merge within 24 hours
Secret and sensitive material has been managed correctly
Automated testing was updated or added to match the most common scenarios
Documentation and comments were added for features that require explanation

Contributor checklist

Have you signed the contributor license agreement?
Have you followed the contributor guidelines?

github-actions · 2025-03-06T08:44:42Z

Rule: Deprecation - Guidelines

These guidelines serve as a reminder set of considerations when recommending the deprecation of a rule.

Documentation and Context

Description of the reason for deprecation.
Include any context or historical data supporting the deprecation decision.

Rule Metadata Checks

deprecated = true added to the rule metadata.
updated_date should be the date of the PR.

Testing and Validation

A prior rule tuning occurred for the rule where Deprecated - is prepended to the rule name, and the rule has already been released.
Rule has be moved to the _deprecated directory.
Double check gaps potentially or inadvertently introduced.
Provide evidence that the rule is no longer needed or has been replaced (e.g., alternative rules, updated detection methods).

Aegrah

Are we still looking to migrate these over to Elastic Defend prior to deprecation? For the vast majority of these, we can write similar rules using the process.entry_leader.entry_meta.type == "container" to determine whether the process' init stems from a container.

I am fine doing this before I leave for PTO. WDYT? @imays11

w0rk3r · 2025-03-06T10:39:15Z

rules/integrations/cloud_defend/container_workload_protection.toml

 > This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

-### Investigating Container Workload Protection
+### Investigating Deprecated - Container Workload Protection


Suggested change

### Investigating Deprecated - Container Workload Protection

### Investigating Container Workload Protection

All of the rule name changes in Investigation Guide is because of the Unit test failure reported here - https://github.com/elastic/detection-rules/actions/runs/13694627124/job/38294173310

Strange one

w0rk3r · 2025-03-06T10:40:15Z

rules/integrations/cloud_defend/credential_access_aws_creds_search_inside_a_container.toml

 > This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

-### Investigating AWS Credentials Searched For Inside A Container
+### Investigating Deprecated - AWS Credentials Searched For Inside A Container


Suggested change

### Investigating Deprecated - AWS Credentials Searched For Inside A Container

### Investigating AWS Credentials Searched For Inside A Container

w0rk3r · 2025-03-06T10:40:29Z

...loud_defend/credential_access_collection_sensitive_files_compression_inside_a_container.toml

 > This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

-### Investigating Sensitive Files Compression Inside A Container
+### Investigating Deprecated - Sensitive Files Compression Inside A Container


Suggested change

### Investigating Deprecated - Sensitive Files Compression Inside A Container

### Investigating Sensitive Files Compression Inside A Container

w0rk3r · 2025-03-06T10:40:48Z

...ns/cloud_defend/credential_access_sensitive_keys_or_passwords_search_inside_a_container.toml

 > This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

-### Investigating Sensitive Keys Or Passwords Searched For Inside A Container
+### Investigating Deprecated - Sensitive Keys Or Passwords Searched For Inside A Container


Suggested change

### Investigating Deprecated - Sensitive Keys Or Passwords Searched For Inside A Container

### Investigating Sensitive Keys Or Passwords Searched For Inside A Container

w0rk3r · 2025-03-06T10:41:01Z

...tions/cloud_defend/defense_evasion_ld_preload_shared_object_modified_inside_a_container.toml

 > This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

-### Investigating Modification of Dynamic Linker Preload Shared Object Inside A Container
+### Investigating Deprecated - Modification of Dynamic Linker Preload Shared Object Inside A Container


Suggested change

### Investigating Deprecated - Modification of Dynamic Linker Preload Shared Object Inside A Container

### Investigating Modification of Dynamic Linker Preload Shared Object Inside A Container

w0rk3r · 2025-03-06T10:42:56Z

...tegrations/cloud_defend/persistence_ssh_authorized_keys_modification_inside_a_container.toml

 > This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

-### Investigating SSH Authorized Keys File Modified Inside a Container
+### Investigating Deprecated - SSH Authorized Keys File Modified Inside a Container


Suggested change

### Investigating Deprecated - SSH Authorized Keys File Modified Inside a Container

### Investigating SSH Authorized Keys File Modified Inside a Container

w0rk3r · 2025-03-06T10:43:09Z

...ations/cloud_defend/privilege_escalation_debugfs_launched_inside_a_privileged_container.toml

 > This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

-### Investigating File System Debugger Launched Inside a Privileged Container
+### Investigating Deprecated - File System Debugger Launched Inside a Privileged Container


Suggested change

### Investigating Deprecated - File System Debugger Launched Inside a Privileged Container

### Investigating File System Debugger Launched Inside a Privileged Container

w0rk3r · 2025-03-06T10:43:21Z

...grations/cloud_defend/privilege_escalation_mount_launched_inside_a_privileged_container.toml

 > This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

-### Investigating Mount Launched Inside a Privileged Container
+### Investigating Deprecated - Mount Launched Inside a Privileged Container


Suggested change

### Investigating Deprecated - Mount Launched Inside a Privileged Container

### Investigating Mount Launched Inside a Privileged Container

w0rk3r · 2025-03-06T10:43:36Z

...end/privilege_escalation_potential_container_escape_via_modified_notify_on_release_file.toml

 > This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

-### Investigating Potential Container Escape via Modified notify_on_release File
+### Investigating Deprecated - Potential Container Escape via Modified notify_on_release File


Suggested change

### Investigating Deprecated - Potential Container Escape via Modified notify_on_release File

### Investigating Potential Container Escape via Modified notify_on_release File

w0rk3r · 2025-03-06T10:43:48Z

..._defend/privilege_escalation_potential_container_escape_via_modified_release_agent_file.toml

 > This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

-### Investigating Potential Container Escape via Modified release_agent File
+### Investigating Deprecated - Potential Container Escape via Modified release_agent File


Suggested change

### Investigating Deprecated - Potential Container Escape via Modified release_agent File

### Investigating Potential Container Escape via Modified release_agent File

w0rk3r · 2025-03-06T10:46:39Z

We should also provide a reason for the deprecation, either in the setup guide or in the rule description, so it is clear to customers why this is being deprecated. Here is an example we did for the threat match rules.

Mikaayenson · 2025-03-06T10:52:26Z

If you search for cloud_defend in our repo, it shows up in a couple places. We may need to make other minor changes.

shashank-elastic · 2025-03-06T13:49:26Z

Updates

We would continue to announce deprecation in this release, and then tune as per @Aegrah as a separate effort after the complete deprecation is announced.
For adding additional information on deprecation, I would wait till we have @imays11 look on this and we can add those additional information.

imays11 · 2025-03-06T22:04:29Z

@shashank-elastic I've added a setup guide with the additional deprecation context as suggested @w0rk3r

@Aegrah for any duplicated rules you create can you be sure to add the tag "Domain: Container" as this is what I'm directing users to look for within the Linux ruleset as a replacement for these rules.

Mikaayenson · 2025-03-07T12:31:56Z

@shashank-elastic I've added a setup guide with the additional deprecation context as suggested @w0rk3r

Thanks for doing this @imays11. Just missed this, but we may have wanted to include in the note that they are already deprecated on severless.

Deprecation Notice to Cloud Defend Rules

c588b9f

shashank-elastic added Rule: Deprecation removal of a rule meta:rapid-merge labels Mar 6, 2025

shashank-elastic requested review from Aegrah, Mikaayenson, Samirbous, imays11 and terrancedejesus March 6, 2025 08:44

shashank-elastic self-assigned this Mar 6, 2025

github-actions bot added the backport: auto label Mar 6, 2025

Samirbous approved these changes Mar 6, 2025

View reviewed changes

Udpate names in investigation guide

15d64d4

Aegrah reviewed Mar 6, 2025

View reviewed changes

w0rk3r reviewed Mar 6, 2025

View reviewed changes

terrancedejesus approved these changes Mar 6, 2025

View reviewed changes

Merge branch 'main' into deprecate_notice_cloud_defend

55f9ea9

shashank-elastic requested review from Aegrah and w0rk3r March 6, 2025 14:53

shashank-elastic and others added 2 commits March 6, 2025 22:04

Merge branch 'main' into deprecate_notice_cloud_defend

a39cef7

Adding deprecation note under Setup field

efc14d9

reverting back to setup field name

64d9c66

imays11 merged commit e28512a into main Mar 7, 2025
9 checks passed

imays11 deleted the deprecate_notice_cloud_defend branch March 7, 2025 05:20

shashank-elastic mentioned this pull request Mar 14, 2025

Deprecate Cloud Defend Rules #4537

Merged

5 tasks

	### Investigating Deprecated - Container Workload Protection
	### Investigating Container Workload Protection

	### Investigating Deprecated - AWS Credentials Searched For Inside A Container
	### Investigating AWS Credentials Searched For Inside A Container

	### Investigating Deprecated - Sensitive Files Compression Inside A Container
	### Investigating Sensitive Files Compression Inside A Container

	### Investigating Deprecated - Sensitive Keys Or Passwords Searched For Inside A Container
	### Investigating Sensitive Keys Or Passwords Searched For Inside A Container

	### Investigating Deprecated - Modification of Dynamic Linker Preload Shared Object Inside A Container
	### Investigating Modification of Dynamic Linker Preload Shared Object Inside A Container

	### Investigating Deprecated - SSH Authorized Keys File Modified Inside a Container
	### Investigating SSH Authorized Keys File Modified Inside a Container

	### Investigating Deprecated - File System Debugger Launched Inside a Privileged Container
	### Investigating File System Debugger Launched Inside a Privileged Container

	### Investigating Deprecated - Mount Launched Inside a Privileged Container
	### Investigating Mount Launched Inside a Privileged Container

	### Investigating Deprecated - Potential Container Escape via Modified notify_on_release File
	### Investigating Potential Container Escape via Modified notify_on_release File

Deprecation Notice to Cloud Defend Rules #4520

Deprecation Notice to Cloud Defend Rules #4520

Uh oh!

Conversation

shashank-elastic commented Mar 6, 2025

Pull Request

Summary - What I changed

How To Test

Checklist

Contributor checklist

Uh oh!

github-actions bot commented Mar 6, 2025

Rule: Deprecation - Guidelines

Documentation and Context

Rule Metadata Checks

Testing and Validation

Uh oh!

Aegrah left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

w0rk3r commented Mar 6, 2025

Uh oh!

Mikaayenson commented Mar 6, 2025

Uh oh!

shashank-elastic commented Mar 6, 2025

Updates

Uh oh!

imays11 commented Mar 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Mikaayenson commented Mar 7, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

imays11 commented Mar 6, 2025 •

edited

Loading