From e5b734e90e983df7fc9cc33f2a9f33567eb02dda Mon Sep 17 00:00:00 2001 From: Justin Ibarra Date: Tue, 15 Feb 2022 12:01:53 -0900 Subject: [PATCH] Add rule docs for 8.0 rule changes (#1506) * Add rule docs for 8.0 rule changes * remove missing link for aws-ec2-vm-export-failure-history * update script to not add history without changelog * remove missing history links * remove extra version bump * remove debug line from script * update all occurrences of 8.0 to 8.0.0 Co-authored-by: Janeen Mikell-Straughn <57149392+jmikell821@users.noreply.github.com> (cherry picked from commit 9f79109bf1567ff1e781f068a5d201a8d459c43c) --- .../prebuilt-rules-changelog.asciidoc | 67 + .../prebuilt-rules-reference.asciidoc | 176 +- .../prebuilt-rules/rule-desc-index.asciidoc | 31 +- .../account-password-reset-remotely.asciidoc | 74 + ...behavior-detected-elastic-endgame.asciidoc | 9 +- ...-added-to-google-workspace-domain.asciidoc | 23 +- ...ntbridge-rule-disabled-or-deleted.asciidoc | 13 +- .../aws-rds-snapshot-restored.asciidoc | 13 +- ...-high-risk-user-sign-in-heuristic.asciidoc | 78 + ...pression-rule-created-or-modified.asciidoc | 81 + .../azure-kubernetes-events-deleted.asciidoc | 13 +- .../azure-kubernetes-pods-deleted.asciidoc | 13 +- ...e-kubernetes-rolebindings-created.asciidoc | 75 + .../clearing-windows-console-history.asciidoc | 71 + .../component-object-model-hijacking.asciidoc | 31 +- ...n-to-commonly-abused-web-services.asciidoc | 47 +- ...el-process-with-unusual-arguments.asciidoc | 13 +- ...-dumping-detected-elastic-endgame.asciidoc | 9 +- ...dumping-prevented-elastic-endgame.asciidoc | 9 +- ...pulation-detected-elastic-endgame.asciidoc | 9 +- ...ulation-prevented-elastic-endgame.asciidoc | 9 +- ...s-over-https-enabled-via-registry.asciidoc | 13 +- ...-google-workspace-trusted-domains.asciidoc | 23 +- ...rivileged-local-groups-membership.asciidoc | 91 + .../exploit-detected-elastic-endgame.asciidoc | 9 +- ...exploit-prevented-elastic-endgame.asciidoc | 9 +- ...tual-private-cloud-route-creation.asciidoc | 9 +- ...ace-admin-role-assigned-to-a-user.asciidoc | 23 +- ...gle-workspace-admin-role-deletion.asciidoc | 23 +- ...main-wide-delegation-of-authority.asciidoc | 23 +- ...rkspace-custom-admin-role-created.asciidoc | 23 +- ...orkspace-mfa-enforcement-disabled.asciidoc | 26 +- ...orkspace-password-policy-modified.asciidoc | 32 +- .../google-workspace-role-modified.asciidoc | 23 +- ...licy-abuse-for-privilege-addition.asciidoc | 119 + ...g-dcom-lateral-movement-via-mshta.asciidoc | 23 +- ...ng-dcom-lateral-movement-with-mmc.asciidoc | 22 +- ...hellbrowserwindow-or-shellwindows.asciidoc | 24 +- ...execution-via-powershell-remoting.asciidoc | 25 +- ...-execution-via-winrm-remote-shell.asciidoc | 19 +- .../lateral-tool-transfer.asciidoc | 27 +- ...odification-and-immediate-loading.asciidoc | 20 +- .../malware-detected-elastic-endgame.asciidoc | 9 +- ...malware-prevented-elastic-endgame.asciidoc | 9 +- ...for-google-workspace-organization.asciidoc | 27 +- ...365-potential-ransomware-activity.asciidoc | 13 +- ...rosoft-windows-defender-tampering.asciidoc | 113 + ...ssive-single-sign-on-logon-errors.asciidoc | 16 +- ...o365-mailbox-audit-logging-bypass.asciidoc | 80 + ...on-theft-detected-elastic-endgame.asciidoc | 9 +- ...n-theft-prevented-elastic-endgame.asciidoc | 9 +- ...sistence-via-folder-action-script.asciidoc | 19 +- ...cess-via-duplicatehandle-in-lsass.asciidoc | 13 +- ...tial-access-via-lsass-memory-dump.asciidoc | 68 + ...cess-via-renamed-com-services-dll.asciidoc | 80 + ...e-creation-via-psscapturesnapshot.asciidoc | 76 + ...emory-dump-via-psscapturesnapshot.asciidoc | 78 + ...alation-via-installerfiletakeover.asciidoc | 105 + ...-process-injection-via-powershell.asciidoc | 134 + .../potential-sharprdp-behavior.asciidoc | 29 +- .../powershell-keylogging-script.asciidoc | 135 + .../powershell-minidump-script.asciidoc | 77 +- .../powershell-psreflect-script.asciidoc | 131 + ...ery-related-windows-api-functions.asciidoc | 81 +- ...us-payload-encoded-and-compressed.asciidoc | 75 + ...t-with-audio-capture-capabilities.asciidoc | 77 +- ...ript-with-screenshot-capabilities.asciidoc | 73 + ...ia-rogue-named-pipe-impersonation.asciidoc | 79 + ...njection-detected-elastic-endgame.asciidoc | 9 +- ...jection-prevented-elastic-endgame.asciidoc | 9 +- ...nsomware-detected-elastic-endgame.asciidoc | 11 +- ...somware-prevented-elastic-endgame.asciidoc | 11 +- .../remote-scheduled-task-creation.asciidoc | 23 +- ...remotely-started-services-via-rpc.asciidoc | 26 +- ...file-downloaded-from-the-internet.asciidoc | 7 +- ...d-task-execution-at-scale-via-gpo.asciidoc | 135 + ...ript-added-to-group-policy-object.asciidoc | 139 + ...us-.net-reflection-via-powershell.asciidoc | 74 + .../suspicious-certutil-commands.asciidoc | 19 +- ...=> suspicious-java-child-process.asciidoc} | 40 +- ...able-encoded-in-powershell-script.asciidoc | 82 +- ...ess-access-via-direct-system-call.asciidoc | 13 +- ...icious-process-creation-calltrace.asciidoc | 68 + ...bolic-link-to-shadow-copy-created.asciidoc | 71 + ...es-deleted-via-unexpected-process.asciidoc | 13 +- ...beat-module-v8.x-indicator-match.asciidoc} | 31 +- .../threat-intel-indicator-match.asciidoc | 107 + ...e-padding-in-process-command-line.asciidoc | 7 +- ...r-exclusions-added-via-powershell.asciidoc | 20 +- ...-firewall-disabled-via-powershell.asciidoc | 75 + .../wmi-incoming-lateral-movement.asciidoc | 33 +- prebuilt-rules-scripts/changelog-entries.yml | 1 + .../final-files/final-rule-file-8.0.0.json | 50607 ++++++++++++++++ .../gen-files/json-from-docs-8.0.0.json | 33946 +++++++++++ prebuilt-rules-scripts/generate.py | 7 +- .../7.16.0-prebuilt-rule.json | 32154 ++++++++++ .../8.0.0-prebuilt-rule.json | 33946 +++++++++++ 97 files changed, 154440 insertions(+), 329 deletions(-) create mode 100644 docs/detections/prebuilt-rules/rule-details/account-password-reset-remotely.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/azure-active-directory-high-risk-user-sign-in-heuristic.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/azure-alert-suppression-rule-created-or-modified.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/azure-kubernetes-rolebindings-created.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/clearing-windows-console-history.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/enumeration-of-privileged-local-groups-membership.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/group-policy-abuse-for-privilege-addition.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/microsoft-windows-defender-tampering.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/o365-mailbox-audit-logging-bypass.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-lsass-memory-dump.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-renamed-com-services-dll.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-lsass-clone-creation-via-psscapturesnapshot.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-lsass-memory-dump-via-psscapturesnapshot.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-installerfiletakeover.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-process-injection-via-powershell.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/powershell-keylogging-script.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/powershell-psreflect-script.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/powershell-suspicious-payload-encoded-and-compressed.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/powershell-suspicious-script-with-screenshot-capabilities.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-rogue-named-pipe-impersonation.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/scheduled-task-execution-at-scale-via-gpo.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/startup-logon-script-added-to-group-policy-object.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/suspicious-.net-reflection-via-powershell.asciidoc rename docs/detections/prebuilt-rules/rule-details/{suspicious-jar-child-process.asciidoc => suspicious-java-child-process.asciidoc} (57%) create mode 100644 docs/detections/prebuilt-rules/rule-details/suspicious-process-creation-calltrace.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/symbolic-link-to-shadow-copy-created.asciidoc rename docs/detections/prebuilt-rules/rule-details/{threat-intel-filebeat-module-indicator-match.asciidoc => threat-intel-filebeat-module-v8.x-indicator-match.asciidoc} (76%) create mode 100644 docs/detections/prebuilt-rules/rule-details/threat-intel-indicator-match.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/windows-firewall-disabled-via-powershell.asciidoc create mode 100644 prebuilt-rules-scripts/diff-files/final-files/final-rule-file-8.0.0.json create mode 100644 prebuilt-rules-scripts/diff-files/gen-files/json-from-docs-8.0.0.json create mode 100644 prebuilt-rules-scripts/orig-rules-json-files/7.16.0-prebuilt-rule.json create mode 100644 prebuilt-rules-scripts/orig-rules-json-files/8.0.0-prebuilt-rule.json diff --git a/docs/detections/prebuilt-rules/prebuilt-rules-changelog.asciidoc b/docs/detections/prebuilt-rules/prebuilt-rules-changelog.asciidoc index 109a3edf17..d377efb7ea 100644 --- a/docs/detections/prebuilt-rules/prebuilt-rules-changelog.asciidoc +++ b/docs/detections/prebuilt-rules/prebuilt-rules-changelog.asciidoc @@ -5,6 +5,73 @@ The following lists prebuilt rule updates per release. Only rules with significant modifications to their query or scope are listed. For detailed information about a rule's changes, see the rule's description page. +[float] +=== 8.0 + +<> + +<> + +<> + +<> + +<> + +<> + +<> + +<> + +<> + +<> + +<> + +<> + +<> + +<> + +<> + +<> + +<> + +<> + +<> + +<> + +<> + +<> + +<> + +<> + +<> + +<> + +<> + +<> + +<> + +<> + +<> + +<> + [float] === 7.16.0 diff --git a/docs/detections/prebuilt-rules/prebuilt-rules-reference.asciidoc b/docs/detections/prebuilt-rules/prebuilt-rules-reference.asciidoc index 4c58a464f6..e458de3bbd 100644 --- a/docs/detections/prebuilt-rules/prebuilt-rules-reference.asciidoc +++ b/docs/detections/prebuilt-rules/prebuilt-rules-reference.asciidoc @@ -54,7 +54,7 @@ and their rule type is `machine_learning`. |<> |Identifies when an ElastiCache security group has been modified or deleted. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Monitoring] |7.16.0 |1 -|<> |Identifies when a user disabled or deleted an EventBridge rule. This activity can result in an unintended loss of visibility in applications or breaking the flow with other AWS services. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Monitoring] |7.16.0 |1 +|<> |Identifies when a user has disabled or deleted an EventBridge rule. This activity can result in an unintended loss of visibility in applications or a break in the flow with other AWS services. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Monitoring] |7.16.0 |2 <> |<> |Identifies the execution of commands and scripts via System Manager. Execution methods such as RunShellScript, RunPowerShellScript, and alike can be abused by an authenticated attacker to install a backdoor or to interact with a compromised instance via reverse-shell using system only commands. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Log Auditing] |7.9.0 |6 <> @@ -92,7 +92,7 @@ and their rule type is `machine_learning`. |<> |Identifies the export of an Amazon Relational Database Service (RDS) Aurora database snapshot. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Asset Visibility] |7.16.0 |1 -|<> |Identifies when an attempt was made to restored RDS Snapshot. Snapshots are sometimes shared by threat actors in order to exfiltrate bulk data. If the permissions were modified, verify if the snapshot was shared with an unauthorized or unexpected AWS account. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Asset Visibility] |7.16.0 |1 +|<> |Identifies when an attempt was made to restore an RDS Snapshot. Snapshots are sometimes shared by threat actors in order to exfiltrate bulk data. If the permissions were modified, verify if the snapshot was shared with an unauthorized or unexpected AWS account. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Asset Visibility] |7.16.0 |2 <> |<> |Identifies attempts to login to AWS as the root user without using multi-factor authentication (MFA). Amazon AWS best practices indicate that the root user should be protected by MFA. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Identity and Access] |7.9.0 |5 <> @@ -126,6 +126,8 @@ and their rule type is `machine_learning`. |<> |Adversaries may collect the keychain storage data from a system to acquire credentials. Keychains are the built-in way for macOS to keep track of users' passwords and credentials for many services and features such as WiFi passwords, websites, secure notes and certificates. |[Elastic] [Host] [macOS] [Threat Detection] [Credential Access] |7.10.0 |5 <> +|<> |Identifies an attempt to reset an account password remotely. Adversaries may manipulate account passwords to maintain access or evade password duration policies and preserve compromised credentials. |[Elastic] [Host] [Windows] [Threat Detection] [Persistence] |8.0.0 |1 + |<> |This rule detects the Active Directory query tool, AdFind.exe. AdFind has legitimate purposes, but it is frequently leveraged by threat actors to perform post-exploitation Active Directory reconnaissance. The AdFind tool has been observed in Trickbot, Ryuk, Maze, and FIN6 campaigns. For Winlogbeat, this rule requires Sysmon. |[Elastic] [Host] [Windows] [Threat Detection] [Discovery] |7.11.0 |5 <> |<