[8.1] Add rule docs for 8.0 rule changes (backport #1506)

docs/detections/prebuilt-rules/prebuilt-rules-changelog.asciidoc

@@ -5,6 +5,73 @@ The following lists prebuilt rule updates per release. Only rules with
 significant modifications to their query or scope are listed. For detailed
 information about a rule's changes, see the rule's description page.
 
+[float]
+=== 8.0
+
+<<application-added-to-google-workspace-domain>>
+
+<<component-object-model-hijacking>>
+
+<<connection-to-commonly-abused-web-services>>
+
+<<domain-added-to-google-workspace-trusted-domains>>
+
+<<google-workspace-api-access-granted-via-domain-wide-delegation-of-authority>>
+
+<<google-workspace-admin-role-assigned-to-a-user>>
+
+<<google-workspace-admin-role-deletion>>
+
+<<google-workspace-custom-admin-role-created>>
+
+<<google-workspace-mfa-enforcement-disabled>>
+
+<<google-workspace-password-policy-modified>>
+
+<<google-workspace-role-modified>>
+
+<<incoming-dcom-lateral-movement-via-mshta>>
+
+<<incoming-dcom-lateral-movement-with-mmc>>
+
+<<incoming-dcom-lateral-movement-with-shellbrowserwindow-or-shellwindows>>
+
+<<incoming-execution-via-powershell-remoting>>
+
+<<incoming-execution-via-winrm-remote-shell>>
+
+<<lateral-tool-transfer>>
+
+<<launchdaemon-creation-or-modification-and-immediate-loading>>
+
+<<mfa-disabled-for-google-workspace-organization>>
+
+<<o365-excessive-single-sign-on-logon-errors>>
+
+<<persistence-via-folder-action-script>>
+
+<<potential-sharprdp-behavior>>
+
+<<powershell-minidump-script>>
+
+<<powershell-suspicious-discovery-related-windows-api-functions>>
+
+<<powershell-suspicious-script-with-audio-capture-capabilities>>
+
+<<remote-scheduled-task-creation>>
+
+<<remotely-started-services-via-rpc>>
+
+<<suspicious-certutil-commands>>
+
+<<suspicious-java-child-process>>
+
+<<suspicious-portable-executable-encoded-in-powershell-script>>
+
+<<wmi-incoming-lateral-movement>>
+
+<<windows-defender-exclusions-added-via-powershell>>
+
 [float]
 === 7.16.0
 

docs/detections/prebuilt-rules/rule-desc-index.asciidoc

@@ -54,6 +54,7 @@ include::rule-details/aws-waf-rule-or-rule-group-deletion.asciidoc[]
 include::rule-details/abnormally-large-dns-response.asciidoc[]
 include::rule-details/access-of-stored-browser-credentials.asciidoc[]
 include::rule-details/access-to-keychain-credentials-directories.asciidoc[]
+include::rule-details/account-password-reset-remotely.asciidoc[]
 include::rule-details/adfind-command-activity.asciidoc[]
 include::rule-details/adding-hidden-file-attribute-via-attrib.asciidoc[]
 include::rule-details/administrator-privileges-assigned-to-an-okta-group.asciidoc[]
@@ -103,7 +104,9 @@ include::rule-details/auditd-max-failed-login-attempts.asciidoc[]
 include::rule-details/auditd-max-login-sessions.asciidoc[]
 include::rule-details/authorization-plugin-modification.asciidoc[]
 include::rule-details/azure-active-directory-high-risk-sign-in.asciidoc[]
+include::rule-details/azure-active-directory-high-risk-user-sign-in-heuristic.asciidoc[]
 include::rule-details/azure-active-directory-powershell-sign-in.asciidoc[]
+include::rule-details/azure-alert-suppression-rule-created-or-modified.asciidoc[]
 include::rule-details/azure-application-credential-modification.asciidoc[]
 include::rule-details/azure-automation-account-created.asciidoc[]
 include::rule-details/azure-automation-runbook-created-or-modified.asciidoc[]
@@ -124,6 +127,7 @@ include::rule-details/azure-global-administrator-role-addition-to-pim-user.ascii
 include::rule-details/azure-key-vault-modified.asciidoc[]
 include::rule-details/azure-kubernetes-events-deleted.asciidoc[]
 include::rule-details/azure-kubernetes-pods-deleted.asciidoc[]
+include::rule-details/azure-kubernetes-rolebindings-created.asciidoc[]
 include::rule-details/azure-network-watcher-deletion.asciidoc[]
 include::rule-details/azure-privilege-identity-management-role-modified.asciidoc[]
 include::rule-details/azure-resource-group-deletion.asciidoc[]
@@ -134,6 +138,7 @@ include::rule-details/azure-virtual-network-device-modified-or-deleted.asciidoc[
 include::rule-details/base16-or-base32-encoding-decoding-activity.asciidoc[]
 include::rule-details/bash-shell-profile-modification.asciidoc[]
 include::rule-details/bypass-uac-via-event-viewer.asciidoc[]
+include::rule-details/clearing-windows-console-history.asciidoc[]
 include::rule-details/clearing-windows-event-logs.asciidoc[]
 include::rule-details/cobalt-strike-command-and-control-beacon.asciidoc[]
 include::rule-details/command-execution-via-solarwinds-process.asciidoc[]
@@ -183,6 +188,7 @@ include::rule-details/endpoint-security.asciidoc[]
 include::rule-details/enumeration-command-spawned-via-wmiprvse.asciidoc[]
 include::rule-details/enumeration-of-administrator-accounts.asciidoc[]
 include::rule-details/enumeration-of-kernel-modules.asciidoc[]
+include::rule-details/enumeration-of-privileged-local-groups-membership.asciidoc[]
 include::rule-details/enumeration-of-users-or-groups-via-built-in-commands.asciidoc[]
 include::rule-details/executable-file-creation-with-multiple-extensions.asciidoc[]
 include::rule-details/execution-from-unusual-directory-command-line.asciidoc[]
@@ -235,6 +241,7 @@ include::rule-details/google-workspace-custom-admin-role-created.asciidoc[]
 include::rule-details/google-workspace-mfa-enforcement-disabled.asciidoc[]
 include::rule-details/google-workspace-password-policy-modified.asciidoc[]
 include::rule-details/google-workspace-role-modified.asciidoc[]
+include::rule-details/group-policy-abuse-for-privilege-addition.asciidoc[]
 include::rule-details/halfbaked-command-and-control-beacon.asciidoc[]
 include::rule-details/high-number-of-okta-user-password-reset-or-unlock-attempts.asciidoc[]
 include::rule-details/high-number-of-process-and-or-service-terminations.asciidoc[]
@@ -297,6 +304,7 @@ include::rule-details/microsoft-exchange-server-um-writing-suspicious-files.asci
 include::rule-details/microsoft-exchange-worker-spawning-suspicious-processes.asciidoc[]
 include::rule-details/microsoft-iis-connection-strings-decryption.asciidoc[]
 include::rule-details/microsoft-iis-service-account-password-dumped.asciidoc[]
+include::rule-details/microsoft-windows-defender-tampering.asciidoc[]
 include::rule-details/mimikatz-memssp-log-file-detected.asciidoc[]
 include::rule-details/modification-of-amsienable-registry-key.asciidoc[]
 include::rule-details/modification-of-boot-configuration.asciidoc[]
@@ -327,6 +335,7 @@ include::rule-details/nping-process-activity.asciidoc[]
 include::rule-details/nullsessionpipe-registry-modification.asciidoc[]
 include::rule-details/o365-excessive-single-sign-on-logon-errors.asciidoc[]
 include::rule-details/o365-exchange-suspicious-mailbox-right-delegation.asciidoc[]
+include::rule-details/o365-mailbox-audit-logging-bypass.asciidoc[]
 include::rule-details/okta-brute-force-or-password-spraying-attack.asciidoc[]
 include::rule-details/outbound-scheduled-task-activity-via-powershell.asciidoc[]
 include::rule-details/parent-process-pid-spoofing.asciidoc[]
@@ -357,6 +366,8 @@ include::rule-details/potential-application-shimming-via-sdbinst.asciidoc[]
 include::rule-details/potential-command-and-control-via-internet-explorer.asciidoc[]
 include::rule-details/potential-cookies-theft-via-browser-debugging.asciidoc[]
 include::rule-details/potential-credential-access-via-duplicatehandle-in-lsass.asciidoc[]
+include::rule-details/potential-credential-access-via-lsass-memory-dump.asciidoc[]
+include::rule-details/potential-credential-access-via-renamed-com-services-dll.asciidoc[]
 include::rule-details/potential-credential-access-via-windows-utilities.asciidoc[]
 include::rule-details/potential-dll-side-loading-via-microsoft-antimalware-service-executable.asciidoc[]
 include::rule-details/potential-dll-sideloading-via-trusted-microsoft-programs.asciidoc[]
@@ -367,6 +378,8 @@ include::rule-details/potential-evasion-via-filter-manager.asciidoc[]
 include::rule-details/potential-hidden-local-user-account-creation.asciidoc[]
 include::rule-details/potential-kerberos-attack-via-bifrost.asciidoc[]
 include::rule-details/potential-lsa-authentication-package-abuse.asciidoc[]
+include::rule-details/potential-lsass-clone-creation-via-psscapturesnapshot.asciidoc[]
+include::rule-details/potential-lsass-memory-dump-via-psscapturesnapshot.asciidoc[]
 include::rule-details/potential-microsoft-office-sandbox-evasion.asciidoc[]
 include::rule-details/potential-modification-of-accessibility-binaries.asciidoc[]
 include::rule-details/potential-openssh-backdoor-logging-activity.asciidoc[]
@@ -380,8 +393,10 @@ include::rule-details/potential-printnightmare-exploit-registry-modification.asc
 include::rule-details/potential-printnightmare-file-modification.asciidoc[]
 include::rule-details/potential-privacy-control-bypass-via-localhost-secure-copy.asciidoc[]
 include::rule-details/potential-privacy-control-bypass-via-tccdb-modification.asciidoc[]
+include::rule-details/potential-privilege-escalation-via-installerfiletakeover.asciidoc[]
 include::rule-details/potential-privilege-escalation-via-sudoers-file-modification.asciidoc[]
 include::rule-details/potential-process-herpaderping-attempt.asciidoc[]
+include::rule-details/potential-process-injection-via-powershell.asciidoc[]
 include::rule-details/potential-protocol-tunneling-via-earthworm.asciidoc[]
 include::rule-details/potential-remote-desktop-shadowing-activity.asciidoc[]
 include::rule-details/potential-remote-desktop-tunneling-detected.asciidoc[]
@@ -391,10 +406,15 @@ include::rule-details/potential-secure-file-deletion-via-sdelete-utility.asciido
 include::rule-details/potential-sharprdp-behavior.asciidoc[]
 include::rule-details/potential-shell-via-web-server.asciidoc[]
 include::rule-details/potential-windows-error-manager-masquerading.asciidoc[]
+include::rule-details/powershell-keylogging-script.asciidoc[]
 include::rule-details/powershell-minidump-script.asciidoc[]
+include::rule-details/powershell-psreflect-script.asciidoc[]
 include::rule-details/powershell-suspicious-discovery-related-windows-api-functions.asciidoc[]
+include::rule-details/powershell-suspicious-payload-encoded-and-compressed.asciidoc[]
 include::rule-details/powershell-suspicious-script-with-audio-capture-capabilities.asciidoc[]
+include::rule-details/powershell-suspicious-script-with-screenshot-capabilities.asciidoc[]
 include::rule-details/privilege-escalation-via-named-pipe-impersonation.asciidoc[]
+include::rule-details/privilege-escalation-via-rogue-named-pipe-impersonation.asciidoc[]
 include::rule-details/privilege-escalation-via-root-crontab-file-modification.asciidoc[]
 include::rule-details/privilege-escalation-via-windir-environment-variable.asciidoc[]
 include::rule-details/process-activity-via-compiled-html-file.asciidoc[]
@@ -436,6 +456,7 @@ include::rule-details/smtp-on-port-26-tcp.asciidoc[]
 include::rule-details/ssh-authorized-keys-file-modification.asciidoc[]
 include::rule-details/sunburst-command-and-control-activity.asciidoc[]
 include::rule-details/scheduled-task-created-by-a-windows-script.asciidoc[]
+include::rule-details/scheduled-task-execution-at-scale-via-gpo.asciidoc[]
 include::rule-details/scheduled-tasks-at-command-enabled.asciidoc[]
 include::rule-details/screensaver-plist-file-modified-by-unexpected-process.asciidoc[]
 include::rule-details/searching-for-saved-credentials-via-vaultcmd.asciidoc[]
@@ -458,11 +479,13 @@ include::rule-details/spike-in-network-traffic.asciidoc[]
 include::rule-details/spike-in-network-traffic-to-a-country.asciidoc[]
 include::rule-details/startup-folder-persistence-via-unsigned-process.asciidoc[]
 include::rule-details/startup-or-run-key-registry-modification.asciidoc[]
+include::rule-details/startup-logon-script-added-to-group-policy-object.asciidoc[]
 include::rule-details/strace-process-activity.asciidoc[]
 include::rule-details/sublime-plugin-or-application-script-modification.asciidoc[]
 include::rule-details/sudo-heap-based-buffer-overflow-attempt.asciidoc[]
 include::rule-details/sudoers-file-modification.asciidoc[]
 include::rule-details/suspicious-.net-code-compilation.asciidoc[]
+include::rule-details/suspicious-.net-reflection-via-powershell.asciidoc[]
 include::rule-details/suspicious-activity-reported-by-okta-user.asciidoc[]
 include::rule-details/suspicious-automator-workflows-execution.asciidoc[]
 include::rule-details/suspicious-browser-child-process.asciidoc[]
@@ -480,7 +503,7 @@ include::rule-details/suspicious-explorer-child-process.asciidoc[]
 include::rule-details/suspicious-hidden-child-process-of-launchd.asciidoc[]
 include::rule-details/suspicious-image-load-taskschd.dll-from-ms-office.asciidoc[]
 include::rule-details/suspicious-imagepath-service-creation.asciidoc[]
-include::rule-details/suspicious-jar-child-process.asciidoc[]
+include::rule-details/suspicious-java-child-process.asciidoc[]
 include::rule-details/suspicious-ms-office-child-process.asciidoc[]
 include::rule-details/suspicious-ms-outlook-child-process.asciidoc[]
 include::rule-details/suspicious-managed-code-hosting-process.asciidoc[]
@@ -493,6 +516,7 @@ include::rule-details/suspicious-print-spooler-point-and-print-dll.asciidoc[]
 include::rule-details/suspicious-printspooler-spl-file-created.asciidoc[]
 include::rule-details/suspicious-printspooler-service-executable-file-creation.asciidoc[]
 include::rule-details/suspicious-process-access-via-direct-system-call.asciidoc[]
+include::rule-details/suspicious-process-creation-calltrace.asciidoc[]
 include::rule-details/suspicious-process-execution-via-renamed-psexec-executable.asciidoc[]
 include::rule-details/suspicious-process-from-conhost.asciidoc[]
 include::rule-details/suspicious-rdp-activex-client-loaded.asciidoc[]
@@ -505,6 +529,7 @@ include::rule-details/suspicious-werfault-child-process.asciidoc[]
 include::rule-details/suspicious-zoom-child-process.asciidoc[]
 include::rule-details/suspicious-macos-ms-office-child-process.asciidoc[]
 include::rule-details/svchost-spawning-cmd.asciidoc[]
+include::rule-details/symbolic-link-to-shadow-copy-created.asciidoc[]
 include::rule-details/system-log-file-deletion.asciidoc[]
 include::rule-details/system-shells-via-services.asciidoc[]
 include::rule-details/systemkey-access-via-command-line.asciidoc[]
@@ -513,7 +538,8 @@ include::rule-details/tampering-of-bash-command-line-history.asciidoc[]
 include::rule-details/telnet-port-activity.asciidoc[]
 include::rule-details/third-party-backup-files-deleted-via-unexpected-process.asciidoc[]
 include::rule-details/threat-detected-by-okta-threatinsight.asciidoc[]
-include::rule-details/threat-intel-filebeat-module-indicator-match.asciidoc[]
+include::rule-details/threat-intel-filebeat-module-v8.x-indicator-match.asciidoc[]
+include::rule-details/threat-intel-indicator-match.asciidoc[]
 include::rule-details/timestomping-using-touch-command.asciidoc[]
 include::rule-details/uac-bypass-attempt-via-elevated-com-internet-explorer-add-on-installer.asciidoc[]
 include::rule-details/uac-bypass-attempt-via-privileged-ifileoperation-com-interface.asciidoc[]
@@ -601,6 +627,7 @@ include::rule-details/windows-cryptoapi-spoofing-vulnerability-cve-2020-0601-cur
 include::rule-details/windows-defender-disabled-via-registry-modification.asciidoc[]
 include::rule-details/windows-defender-exclusions-added-via-powershell.asciidoc[]
 include::rule-details/windows-event-logs-cleared.asciidoc[]
+include::rule-details/windows-firewall-disabled-via-powershell.asciidoc[]
 include::rule-details/windows-network-enumeration.asciidoc[]
 include::rule-details/windows-script-executing-powershell.asciidoc[]
 include::rule-details/windows-script-interpreter-executing-process-via-wmi.asciidoc[]

docs/detections/prebuilt-rules/rule-details/account-password-reset-remotely.asciidoc

@@ -0,0 +1,74 @@
+[[account-password-reset-remotely]]
+=== Account Password Reset Remotely
+
+Identifies an attempt to reset an account password remotely. Adversaries may manipulate account passwords to maintain access or evade password duration policies and preserve compromised credentials.
+
+*Rule type*: eql
+
+*Rule indices*:
+
+* winlogbeat-*
+* logs-windows.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5 minutes
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*:
+
+* https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4724
+* https://stealthbits.com/blog/manipulating-user-passwords-with-mimikatz/
+* https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES/blob/master/Credential%20Access/remote_pwd_reset_rpc_mimikatz_postzerologon_target_DC.evtx
+
+*Tags*:
+
+* Elastic
+* Host
+* Windows
+* Threat Detection
+* Persistence
+
+*Version*: 1
+
+*Added ({stack} release)*: 8.0.0
+
+*Rule authors*: Elastic
+
+*Rule license*: Elastic License v2
+
+==== Potential false positives
+
+Legitimate remote account administration.
+
+==== Rule query
+
+
+[source,js]
+----------------------------------
+sequence by host.id with maxspan=5m [authentication where
+event.action == "logged-in" and /* event 4624 need to be logged */
+winlog.logon.type : "Network" and event.outcome == "success" and
+source.ip != null and not source.ip in ("127.0.0.1", "::1")] by
+winlog.event_data.TargetLogonId /* event 4724 need to be logged */
+[iam where event.action == "reset-password"] by
+winlog.event_data.SubjectLogonId
+----------------------------------
+
+==== Threat mapping
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Account Manipulation
+** ID: T1098
+** Reference URL: https://attack.mitre.org/techniques/T1098/

docs/detections/prebuilt-rules/rule-details/adversary-behavior-detected-elastic-endgame.asciidoc

@@ -17,18 +17,18 @@ Elastic Endgame detected an Adversary Behavior. Click the Elastic Endgame icon i
 
 *Searches indices from*: now-15m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
-*Maximum alerts per execution*: 100
+*Maximum alerts per execution*: 10000
 
 *Tags*:
 
 * Elastic
 * Elastic Endgame
 
-*Version*: 6 (<<adversary-behavior-detected-elastic-endgame-history, version history>>)
+*Version*: 7 (<<adversary-behavior-detected-elastic-endgame-history, version history>>)
 
 *Added ({stack} release)*: 7.6.0
 
-*Last modified ({stack} release)*: 7.12.1
+*Last modified ({stack} release)*: 8.0.0
 
 *Rule authors*: Elastic
 
@@ -48,6 +48,9 @@ endgame.event_subtype_full:rules_engine_event)
 [[adversary-behavior-detected-elastic-endgame-history]]
 ==== Rule version history
 
+Version 7 (8.0.0 release)::
+* Formatting only
+
 Version 6 (7.12.1 release)::
 * Formatting only