dev-v0.3.0

Changes

• Fix remaining Replace master doc URLs with current (#4441) @shashank-elastic
• [Tuning / New] Execution of a downloaded windows script (#4434) @Samirbous
• [New Rule] Process Backgrounded by Unusual Parent (#4431) @Aegrah
• [Rule Tuning] Linux DR Tuning - Part 6 (#4423) @Aegrah
• [Rule Tuning] Linux DR Tuning - Part 5 (#4422) @Aegrah
• [Rule Tuning] Linux DR Tuning - Part 4 (#4421) @Aegrah
• [Rule Tuning] Linux DR Tuning - Part 3 (#4420) @Aegrah
• [Rule Tuning] December-January AWS Rule Tuning (#4425) @terrancedejesus
• [Rule Tuning] Potential OpenSSH Backdoor Logging Activity (#4429) @Aegrah
• [New Rule] Suspicious Usage of bpf_probe_write_user Helper (#4426) @Aegrah
• [Rule Tuning] Linux DR Tuning - Part 2 (#4417) @Aegrah
• [Rule Tuning] Linux DR Tuning - Part 1 (#4416) @Aegrah
• [Tuning] Unusual Instance Metadata Service (IMDS) API Request (#4418) @Samirbous
• [Rule Tuning] Improve Detection Compatibility with Non-English Logs (#4410) @w0rk3r
• Fix S1 minstack version (#4415) @shashank-elastic
• [FR] Add Remaining Guides (#4412) @Mikaayenson
• [New Rule] File with Right-to-Left Override Character Created/Executed (#4396) @w0rk3r
• [New Rule] Unusual D-Bus Daemon Child Process (#4397) @Aegrah
• [New Rule] Adding Coverage for AWS S3 Unauthenticated Bucket Access by Rare Source (#4315) @terrancedejesus
• [Rule Tuning] Add Public Snapshot Coverage Regarding AWS EC2 EBS Snapshot Shared or Made Public (#4335) @terrancedejesus
• [New Rule] Polkit Version Discovery (#4378) @Aegrah
• [New Rule] Polkit Policy Creation (#4379) @Aegrah
• [New Rule] Unusual Pkexec Execution (#4380) @Aegrah
• [New Rule] NetworkManager Dispatcher Script Creation (#4381) @Aegrah
• [New Rule] D-Bus Service Created (#4382) @Aegrah
• [New Rule] Manual Dracut Execution (#4383) @Aegrah
• [New Rule] Dracut Module Creation (#4384) @Aegrah
• [New Rule] OpenSSL Password Hash Generation (#4385) @Aegrah
• [New Rule] Boot File Copy (#4386) @Aegrah
• [New Rule] Initramfs Unpacking via unmkinitramfs (#4387) @Aegrah
• [New Rule] Initramfs Extraction via CPIO (#4389) @Aegrah
• [Tuning] Powershell Rules (#4395) @Samirbous
• [Rule Tuning] Linux Persistence Rules (#4393) @Aegrah
• [New Rule] Systemd Shell Execution During Boot (#4392) @Aegrah
• [New Rule] GRUB Configuration Generation through Built-in Utilities (#4391) @Aegrah
• [New Rule] GRUB Configuration File Creation (#4390) @Aegrah
• [New Rule] Process Started with Executable Stack (#4340) @Aegrah
• [Deprecation] Deprecating Potential Password Spraying of Microsoft 365 User Accounts (#4394) @terrancedejesus
• [New Rules] Kernel Seeking/Unpacking Activity (#4341) @Aegrah
• [New Rule] System Binary Path File Permission Modification (#4339) @Aegrah
• [New Rule] Suspicious Path Invocation from Command Line (#4338) @Aegrah
• [New BBR] Linux System Information Discovery via Getconf (#4337) @Aegrah
• [New Rule] Adding Coverage for SNS Topic Message Publish by Rare User (#4350) @terrancedejesus
• [New Rule] Adding Coverage for AWS EC2 Deprecated AMI Discovery (#4328) @terrancedejesus
• [New Rule] Adding Coverage for AWS SQS Queue Purge (#4354) @terrancedejesus
• [Rule Tuning] Suspicious Communication App Child Process (#4369) @w0rk3r
• [Rule Tuning] Posh BBRs (#4372) @w0rk3r
• [New] Sensitive Audit Policy Sub-Category Disabled (#4373) @Samirbous
• [New Rule] Potential Process Name Stomping with Prctl (#4352) @Aegrah
• [Rule Tuning] Windows Misc BBR Tuning (#4368) @w0rk3r
• [Rule: Tuning] - Azure blob permission modification tagging - Correct tags (#4371) @jvalente-salemstate
• [Tuning] Potential SYN-Based Network Scan Detected (#4366) @Samirbous
• [Rule Tuning] Linux 3rd Party EDR Support - Crowdstrike and S1 - 10 (#4357) @w0rk3r
• [Rule Tuning] Linux 3rd Party EDR Support - Crowdstrike and S1 - 8 (#4355) @w0rk3r
• [Rule Tuning] Linux 3rd Party EDR Support - Crowdstrike and S1 - 7 (#4349) @w0rk3r
• [Rule Tuning] Linux 3rd Party EDR Support - Crowdstrike and S1 - 4 (#4345) @w0rk3r
• [Rule Tuning] Linux 3rd Party EDR Support - Crowdstrike and S1 - 3 (#4343) @w0rk3r
• [Rule Tuning] Linux 3rd Party EDR Support - Crowdstrike and S1 - 6 (#4348) @w0rk3r
• [Rule Tuning] Linux 3rd Party EDR Support - Crowdstrike and S1 - 5 (#4346) @w0rk3r
• [Rule Tuning] Linux 3rd Party EDR Support - Crowdstrike and S1 - 9 (#4356) @w0rk3r
• [Rule Tuning] Linux 3rd Party EDR Support - Crowdstrike and S1 - 2 (#4333) @w0rk3r
• [Rule Tuning] Linux 3rd Party EDR Support - Crowdstrike and S1 - 1 (#4330) @w0rk3r
• [New Rule] SSH via Backdoored System User (#4336) @Aegrah
• [New Rule] Pluggable Authentication Module Source Download (#4301) @Aegrah
• [Tuning] Suspicious WMI Event Subscription Created (#4327) @Samirbous
• [New Rule] Dynamic Linker (ld.so) Creation (#4306) @Aegrah
• [New Rule] Kernel Object File Creation (#4325) @Aegrah
• [Rule Tuning] Potential Persistence via File Modification (#4310) @Aegrah
• [New Rule] Simple HTTP Web Server Connection (#4309) @Aegrah
• [New Rule] Simple HTTP Web Server Creation (#4308) @Aegrah
• [New Rule] Loadable Kernel Module Configuration File Creation (#4307) @Aegrah
• [New Rule] Unusual Preload Environment Variable Process Execution (#4305) @Aegrah
• [Rule Tuning] Creation or Modification of Pluggable Authentication Mo… (#4304) @Aegrah
• [New Rule] Unusual SSHD Child Process (#4303) @Aegrah
• [New Rule] Pluggable Authentication Module Creation in Unusual Directory (#4302) @Aegrah
• [New Rule] PAM Version Discovery (#4300) @Aegrah
• [Rule Tuning] Windows misc Rule Tuning (#4298) @w0rk3r
• [Tuning] Uncommon Registry Persistence Change (#4286) @rad9800
• [New Rule] Endpoint Security Promotion Rules for Specific Events (#3533) @terrancedejesus
• [Rule Tuning] Lookback Times for Okta Multiple Session and AWS KMS Retrieval Rules (#4324) @terrancedejesus
• [New Rule] Adding Coverage for Azure Entra MFA TOTP Brute Force Attempts (#4297) @terrancedejesus
• Minstack endpoint rules with process.group.id fields (#4294) @shashank-elastic
• [Rule Tuning] Remove Trailing Comma in AWS IAM User Created Access Keys For Another User (#4292) @terrancedejesus
• [Rule Tuning] Update Okta and Github Min-Stack Versions for Release (#4290) @terrancedejesus
• [New Rule] Adding Coverage for Self-Created Login Profile for Root Accounts in AWS (#4277) @terrancedejesus
• [Tuning] SDH - Possible Consent Grant Attack via Azure-Registered Application (#4283) @imays11
• Protections for AWS Bedrock (#4270) @shashank-elastic
• Add event dataset for missing rule in Github integration (#4278) @shashank-elastic
• Minstack versions for Okta and Github Integration (#4273) @shashank-elastic
• [Rule Tuning] Kernel Module Removal (#4269) @Aegrah
• [New Rule] Adding Coverage for AWS STS AssumeRoot by Rare User and Member Account (#4271) @terrancedejesus

🚀 Features

• Lock versions for releases: 8.12,8.13,8.14,8.15,8.16,8.17 (#4442) @github-actions[bot]
• Add prerelease version for sentinel_one_cloud_funnel (#4438) @shashank-elastic
• Refresh ECS & Beats schemas, Integration manifests & schemas (#4436) @shashank-elastic
• [FR] Generate investigation guides (#4358) @Mikaayenson
• Lock versions for releases: 8.12,8.13,8.14,8.15,8.16,8.17 (#4400) @github-actions[bot]
• Update ATT&CK coverage URL(s) in docs/ATT&CK-coverage.md (#4398) @github-actions[bot]
• Provide Deprecate Warnings for Experimental ML commands (#4365) @shashank-elastic
• [Maintenance] Remove hunting TOML files from repo version checks (#4374) @terrancedejesus
• [Maintenance] repository config update pt 5 (#4367) @terrancedejesus
• [Maintenance] repository config update pt 4 (#4364) @terrancedejesus
• [Maintenance] Repository Config Update pt 3 (#4363) @terrancedejesus
• [Maintenance] Updated Navigator Gist Token pt 2 (#4361) @terrancedejesus
• [Maintenance] Repository Config Update (#4359) @terrancedejesus
• Lock versions for releases: 8.12,8.13,8.14,8.15,8.16,8.17 (#4347) @github-actions[bot]
• Update ATT&CK coverage URL(s) in docs/ATT&CK-coverage.md (#4344) @github-actions[bot]
• [Python] Ignore Hunting Doc Changes for Version Code Checks (#4331) @terrancedejesus
• Monthly Refresh ECS & Beats schemas, Integration manifests & schemas. (#4332) @shashank-elastic
• Update versioning support for 8.17 (#4296) @shashank-elastic
• Lock versions for releases: 8.12,8.13,8.14,8.15,8.16,8.17 (#4295) @github-actions[bot]
• Lock versions for releases: 8.12,8.13,8.14,8.15,8.16,8.17 (#4291) @github-actions[bot]
• Prep for Release 8.18 (#4288) @shashank-elastic
• Add all historical versions for v8.17.0 and above packages (#4279) @shashank-elastic
• Lock versions for releases: 8.11,8.12,8.13,8.14,8.15,8.16 (#4274) @github-actions[bot]

🐛 Bug Fixes

• [Bug] [DaC] Metadata maturity field default mismatch and poor enforcement of rule naming conventions (#4285) @eric-forte-elastic
• [Bug] [DaC] Actions Connector Defaults to None (#4376) @eric-forte-elastic
• Enhance Readability of KQL validation check failures (#4329) @shashank-elastic
• Enhance Readability of validation check failures (#4299) @shashank-elastic

🛠 Internal Changes

• Replace master doc URLs with current (#4439) @shashank-elastic
• Refresh ECS & Beats schemas, Integration manifests & schemas (#4436) @shashank-elastic
• [FR] Generate investigation guides (#4358) @Mikaayenson
• [Bug] [DaC] Metadata maturity field default mismatch and poor enforcement of rule naming conventions (#4285) @eric-forte-elastic
• [New Rule] Adding Coverage for Unusual AWS S3 Object Encryption with SSE-C (#4377) @terrancedejesus
• Provide Deprecate Warnings for Experimental ML commands (#4365) @shashank-elastic
• [Rule Tuning] Adjusting Verbiage for AWS EC2 Instance Connect SSH Public Key Uploaded (#4334) @terrancedejesus
• [Bug] [DaC] Actions Connector Defaults to None (#4376) @eric-forte-elastic
• [Maintenance] Remove hunting TOML files from repo version checks (#4374) @terrancedejesus
• [Maintenance] repository config update pt 5 (#4367) @terrancedejesus
• [Maintenance] repository config update pt 4 (#4364) @terrancedejesus
• [Maintenance] Repository Config Update pt 3 (#4363) @terrancedejesus
• [Maintenance] Updated Navigator Gist Token pt 2 (#4361) @terrancedejesus
• [Maintenance] Repository Config Update (#4359) @terrancedejesus
• [Python] Ignore Hunting Doc Changes for Version Code Checks (#4331) @terrancedejesus
• Enhance Readability of KQL validation check failures (#4329) @shashank-elastic
• Monthly Refresh ECS & Beats schemas, Integration manifests & schemas. (#4332) @shashank-elastic
• Enhance Readability of validation check failures (#4299) @shashank-elastic
• Prep for Release 8.18 (#4288) @shashank-elastic
• Add all historical versions for v8.17.0 and above packages (#4279) @shashank-elastic

🔍 Hunting Updates

• [Hunt Tuning] Logon Activity by Source IP (#4428) @Aegrah
• [New Hunt] Adding Hunting Query for IAM Unusual Default Aviatrix Role Activity (#4409) @terrancedejesus
• [New Hunt] Persistence via Initramfs (#4402) @Aegrah
• [New & Tuning] Persistence via GRUB Bootloader (#4401) @Aegrah
• [Hunt Tuning] Persistence via SSH Configurations and/or Keys (#4351) @Aegrah
• [New Hunts] Adding Several Hunting PRs into this Main PR (#4342) @Aegrah
• [New Hunt] Adding Hunting Query for AWS IAM Unusual AWS Access Key Usage for User (#4280) @terrancedejesus