Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Detection Rules] Adding Documents for v8.12.1 Pre-Built Detection Rules #4474

Merged
merged 14 commits into from
Jan 3, 2024
Merged

[Detection Rules] Adding Documents for v8.12.1 Pre-Built Detection Rules #4474

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
016b745
Update latest docs
protectionsmachine Dec 14, 2023
b2fa2bd
fixed broken links; added update description
terrancedejesus Dec 14, 2023
1409ba9
fixing dot notated docs
terrancedejesus Dec 14, 2023
264ca08
fixed underscores
terrancedejesus Dec 15, 2023
e532263
removed 'suspicious-execution-short-program-name'
terrancedejesus Dec 15, 2023
3617136
removed 'suspicious-network-connection-attempt-by-root'
terrancedejesus Dec 15, 2023
8788494
Merge branch '8.12' into update-security-docs-prebuilt-rules-8.12.1
terrancedejesus Jan 2, 2024
ba3fa24
adjusted 'linux-restricted-shell-breakout-via-linux-binarys'
terrancedejesus Jan 2, 2024
d7cb326
adjusted 'potential-shell-via-web-server'
terrancedejesus Jan 2, 2024
2c45007
adjusted 'potential-dll-sideloading-via-trusted-microsoft-programs'
terrancedejesus Jan 2, 2024
e4413b6
adjusted 'threat-detected-by-okta-threatinsight'
terrancedejesus Jan 2, 2024
45e1d8f
adjusted 'potential-dns-tunneling-via-iodine'
terrancedejesus Jan 2, 2024
ae9331d
adjusted 'prebuilt-rule-8-12-1-prebuilt-rules-8-12-5-summary'
terrancedejesus Jan 2, 2024
db5b731
adjusted 'prebuilt-rule-8-12-1-prebuilt-rules-8-12-5-summary'
terrancedejesus Jan 2, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
6 changes: 6 additions & 0 deletions ...uilt-rules/downloadable-packages/8-12-1/prebuilt-rules-8-12-1-appendix.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
["appendix",role="exclude",id="prebuilt-rule-8-12-1-prebuilt-rules-8-12-1-appendix"]
= Downloadable rule update v8.12.1

This section lists all updates associated with version 8.12.1 of the Fleet integration *Prebuilt Security Detection Rules*.


12 changes: 12 additions & 0 deletions ...built-rules/downloadable-packages/8-12-1/prebuilt-rules-8-12-1-summary.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
[[prebuilt-rule-8-12-1-prebuilt-rules-8-12-1-summary]]
[role="xpack"]
== Update v8.12.1

This section lists all updates associated with version 8.12.1 of the Fleet integration *Prebuilt Security Detection Rules*.


[width="100%",options="header"]
|==============================================
|Rule |Description |Status |Version

|==============================================
52 changes: 14 additions & 38 deletions docs/detections/prebuilt-rules/prebuilt-rules-changelog.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -151,7 +151,7 @@ information about a rule's changes, see the rule's description page.

<<encrypting-files-with-winrar-or-7z>>

<<enumerating-domain-trusts-via-nltest.exe>>
<<enumerating-domain-trusts-via-nltest-exe>>

<<enumeration-command-spawned-via-wmiprvse>>

Expand All @@ -167,7 +167,7 @@ information about a rule's changes, see the rule's description page.

<<execution-of-persistent-suspicious-program>>

<<execution-via-mssql-xp_cmdshell-stored-procedure>>
<<execution-via-mssql-xp-cmdshell-stored-procedure>>

<<execution-via-tsclient-mountpoint>>

Expand Down Expand Up @@ -305,7 +305,7 @@ information about a rule's changes, see the rule's description page.

<<startup-or-run-key-registry-modification>>

<<suspicious-.net-code-compilation>>
<<suspicious-net-code-compilation>>

<<suspicious-browser-child-process>>

Expand All @@ -317,8 +317,6 @@ information about a rule's changes, see the rule's description page.

<<suspicious-endpoint-security-parent-process>>

<<suspicious-execution-short-program-name>>

<<suspicious-execution-via-scheduled-task>>

<<suspicious-explorer-child-process>>
Expand All @@ -331,8 +329,6 @@ information about a rule's changes, see the rule's description page.

<<suspicious-microsoft-diagnostics-wizard-execution>>

<<suspicious-network-connection-attempt-by-root>>

<<suspicious-pdf-reader-child-process>>

<<suspicious-process-execution-via-renamed-psexec-executable>>
Expand Down Expand Up @@ -375,7 +371,7 @@ information about a rule's changes, see the rule's description page.

<<unusual-network-connection-via-rundll32>>

<<unusual-parent-process-for-cmd.exe>>
<<unusual-parent-process-for-cmd-exe>>

<<unusual-parent-child-relationship>>

Expand Down Expand Up @@ -556,7 +552,7 @@ information about a rule's changes, see the rule's description page.

<<launchdaemon-creation-or-modification-and-immediate-loading>>

<<linux-restricted-shell-breakout-via-linux-binarys>>
<<linux-restricted-shell-breakout-via-linux-binary-s>>

<<ms-office-macro-security-registry-modifications>>

Expand Down Expand Up @@ -630,8 +626,6 @@ information about a rule's changes, see the rule's description page.

<<potential-reverse-shell-activity-via-terminal>>

<<potential-shell-via-web-server>>

<<powershell-kerberos-ticket-request>>

<<powershell-keylogging-script>>
Expand Down Expand Up @@ -678,7 +672,7 @@ information about a rule's changes, see the rule's description page.

<<sublime-plugin-or-application-script-modification>>

<<suspicious-.net-reflection-via-powershell>>
<<suspicious-net-reflection-via-powershell>>

<<suspicious-calendar-file-modification>>

Expand All @@ -690,14 +684,12 @@ information about a rule's changes, see the rule's description page.

<<suspicious-execution-via-scheduled-task>>

<<suspicious-image-load-taskschd.dll-from-ms-office>>
<<suspicious-image-load-taskschd-dll-from-ms-office>>

<<suspicious-ms-office-child-process>>

<<suspicious-microsoft-diagnostics-wizard-execution>>

<<suspicious-network-connection-attempt-by-root>>

<<suspicious-portable-executable-encoded-in-powershell-script>>

<<suspicious-powershell-engine-imageload>>
Expand Down Expand Up @@ -1204,7 +1196,7 @@ information about a rule's changes, see the rule's description page.

<<execution-from-unusual-directory-command-line>>

<<execution-via-mssql-xp_cmdshell-stored-procedure>>
<<execution-via-mssql-xp-cmdshell-stored-procedure>>

<<external-ip-lookup-from-non-browser-process>>

Expand Down Expand Up @@ -1258,8 +1250,6 @@ information about a rule's changes, see the rule's description page.

<<potential-credential-access-via-trusted-developer-utility>>

<<potential-dll-sideloading-via-trusted-microsoft-programs>>

<<potential-evasion-via-filter-manager>>

<<process-activity-via-compiled-html-file>>
Expand Down Expand Up @@ -1312,15 +1302,15 @@ information about a rule's changes, see the rule's description page.

<<unusual-child-process-from-a-system-virtual-process>>

<<unusual-child-process-of-dns.exe>>
<<unusual-child-process-of-dns-exe>>

<<unusual-executable-file-creation-by-a-system-critical-process>>

<<unusual-file-modification-by-dns.exe>>
<<unusual-file-modification-by-dns->>

<<unusual-network-connection-via-rundll32>>

<<unusual-parent-process-for-cmd.exe>>
<<unusual-parent-process-for-cmd->>

<<unusual-persistence-via-services-registry>>

Expand Down Expand Up @@ -1416,7 +1406,7 @@ information about a rule's changes, see the rule's description page.

<<suspicious-cmd-execution-via-wmi>>

<<suspicious-image-load-taskschd.dll-from-ms-office>>
<<suspicious-image-load-taskschd-dll-from-ms-office>>

<<suspicious-powershell-engine-imageload>>

Expand Down Expand Up @@ -1554,8 +1544,6 @@ information about a rule's changes, see the rule's description page.

<<potential-credential-access-via-trusted-developer-utility>>

<<potential-dll-sideloading-via-trusted-microsoft-programs>>

<<potential-modification-of-accessibility-binaries>>

<<potential-secure-file-deletion-via-sdelete-utility>>
Expand All @@ -1576,7 +1564,7 @@ information about a rule's changes, see the rule's description page.

<<smb-windows-file-sharing-activity-to-the-internet>>

<<suspicious-.net-code-compilation>>
<<suspicious-net-code-compilation>>

<<suspicious-endpoint-security-parent-process>>

Expand All @@ -1590,7 +1578,7 @@ information about a rule's changes, see the rule's description page.

<<unusual-child-processes-of-rundll32>>

<<unusual-file-modification-by-dns.exe>>
<<unusual-file-modification-by-dns-exe>>

<<unusual-network-connection-via-rundll32>>

Expand Down Expand Up @@ -1689,8 +1677,6 @@ information about a rule's changes, see the rule's description page.

<<suspicious-activity-reported-by-okta-user>>

<<threat-detected-by-okta-threatinsight>>

<<unusual-network-connection-via-rundll32>>

<<unusual-parent-child-relationship>>
Expand Down Expand Up @@ -1780,12 +1766,8 @@ information about a rule's changes, see the rule's description page.

<<potential-credential-access-via-trusted-developer-utility>>

<<potential-dns-tunneling-via-iodine>>

<<potential-disabling-of-selinux>>

<<potential-shell-via-web-server>>

<<psexec-network-connection>>

<<rdp-remote-desktop-protocol-from-the-internet>>
Expand Down Expand Up @@ -1839,8 +1821,6 @@ information about a rule's changes, see the rule's description page.
[float]
=== 7.8.0

<<potential-shell-via-web-server>>

<<unusual-network-connection-via-rundll32>>

[float]
Expand Down Expand Up @@ -1907,8 +1887,6 @@ These prebuilt rules have been updated:

<<permission-theft-prevented-elastic-endgame>>

<<potential-dns-tunneling-via-iodine>>

<<potential-modification-of-accessibility-binaries>>

<<process-injection-detected-elastic-endgame>>
Expand Down Expand Up @@ -1969,8 +1947,6 @@ These prebuilt rules have been updated:

<<ipsec-nat-traversal-port-activity>>

<<potential-shell-via-web-server>>

<<rdp-remote-desktop-protocol-from-the-internet>>

<<rpc-remote-procedure-call-from-the-internet>>
Expand Down
129 changes: 8 additions & 121 deletions docs/detections/prebuilt-rules/prebuilt-rules-downloadable-updates.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,134 +6,21 @@ This section lists all updates to prebuilt detection rules, made available with

To update your installed rules to the latest versions, follow the instructions in <<update-prebuilt-rules>>.

For previous rule updates, please navigate to the https://www.elastic.co/guide/en/security/8.11/prebuilt-rules-downloadable-updates.html[last version].

[width="100%",options="header"]
|==============================================
|Update version |Date | New rules | Updated rules | Notes

|<<prebuilt-rule-8-7-1-prebuilt-rules-8-7-1-summary, 8.7.1>> | 15 Feb 2023 | 29 | 110 |
This release includes new rules for Windows and Linux endpoints.
Additionally, significant rule tuning for Windows and Linux rules has been added for better rule efficacy.
A Google Workspace promotional rule was added to promote security alerts from the Alert Center.
Machine learning rules related to failed logins have been adjusted for better scoring results.
Additional investigation guides have been added for Windows and Linux rules.
A https://www.elastic.co/guide/en/security/current/rules-ui-create.html[New Terms] rule has been created to identify loaded Windows drivers not seen in the last 30 days.
A guided onboarding rule has been created to assist new SIEM users with getting started.

|<<prebuilt-rule-8-6-1-prebuilt-rules-8-6-1-summary, 8.6.1>> | 15 Feb 2023 | 28 | 110 |
This release includes new rules for Windows and Linux endpoints.
Additionally, significant rule tuning for Windows and Linux rules has been added for better rule efficacy.
A Google Workspace promotional rule was added to promote security alerts from the Alert Center.
Machine learning rules related to failed logins have been adjusted for better scoring results.
Additional investigation guides have been added for Windows and Linux rules.
A https://www.elastic.co/guide/en/security/current/rules-ui-create.html[New Terms] rule has been created to identify loaded Windows drivers not seen in the last 30 days.
|<<prebuilt-rule-8-12-1-prebuilt-rules-8-12-1-summary, 8.12.1>> | 14 Dec 2023 | 7 | 35 |
This release includes new Windows, Linux and Okta rules.
New rules for Windows include detection for processes created with duplicated tokens and interactive logons.
Linux rules include detection for Out-of-Tree kernel module loading, persistence through Systemd-udevd and Kworker UID elevation.
New rules for Okta include detection for stolen credentials being used to reset MFA and suspicious authentication events.
Additionally, significant rule tuning for Windows, Linux and Okta rules has been added for better rule efficacy.

|<<prebuilt-rule-8-5-1-prebuilt-rules-8-5-1-summary, 8.5.1>> | 14 Feb 2023 | 27 | 110 |
This release includes new rules for Windows and Linux endpoints.
Additionally, significant rule tuning for Windows and Linux rules has been added for better rule efficacy.
A Google Workspace promotional rule was added to promote security alerts from the Alert Center.
Machine learning rules related to failed logins have been adjusted for better scoring results.
Additional investigation guides have been added for Windows and Linux rules.

|<<prebuilt-rule-8-4-3-prebuilt-rules-8-4-3-summary, 8.4.3>> | 14 Feb 2023 | 27 | 110 |
This release includes new rules for Windows and Linux endpoints.
Additionally, significant rule tuning for Windows and Linux rules has been added for better rule efficacy.
A Google Workspace promotional rule was added to promote security alerts from the Alert Center.
Machine learning rules related to failed logins have been adjusted for better scoring results.
Additional investigation guides have been added for Windows and Linux rules.

|<<prebuilt-rule-8-4-2-prebuilt-rules-8-4-2-summary, 8.4.2>> | 24 Jan 2023 | 5 | 494 |
This release includes new rules for Windows regarding Microsoft Exchange interaction via Powershell.
Additionally, significant rule tuning for Windows rules has been added for better rule efficacy.
A new rule for multiple alerts with different ATT&CK tactics on a single host has also been included.
A new rule for multiple alerts involving a single user has been added.
Related integration tags and recommended versions have been added to endpoint rules.
Bug fixes for OSQuery execution in rule investigation guides has been added.

|<<prebuilt-rule-8-3-4-prebuilt-rules-8-3-4-summary, 8.3.4>> | 24 Jan 2023 | 1 | 4 |
This release includes new rules for Windows regarding Microsoft Exchange interaction via PowerShell.
A new rule for multiple alerts with different ATT&CK tactics on a single host has also been included.
Additionally, a new rule for multiple alerts involving a single user has been added.
This release also includes rule tuning for suspicious Windows Error Reporting child processes.

|<<prebuilt-rule-8-3-3-prebuilt-rules-8-3-3-summary, 8.3.3>> | 19 Jan 2023 | 17 | 500 |
This release includes new rules for Windows regarding Microsoft Exchange interaction via PowerShell.
Additionally, significant rule tuning for Windows rules has been added for better rule efficacy.
Related integration tags and recommended versions have been added to endpoint rules.
Bug fixes for OSQuery execution in rule investigation guides has been added.

|<<prebuilt-rule-8-4-1-prebuilt-rules-8-4-1-summary, 8.4.1>> | 05 Dec 2022 | 20 | 298 |
This release includes new rules for Linux regarding reverse shells.
Additionally, new windows rules have been added to supply coverage for credential access and access token manipulation.
Specific Windows and Linux rules have been tuned to reduce false-positive signals.

|<<prebuilt-rule-8-3-2-prebuilt-rules-8-3-2-summary, 8.3.2>> | 06 Oct 2022 | 25 | 232 |
This release includes new rules for Linux, Windows, Google Workspace and Kubernetes.
Also included are expanded investigation guides for Linux, Windows and macOS rules.

|<<prebuilt-rule-8-3-1-prebuilt-rules-8-3-1-summary, 8.3.1>> | 26 Aug 2022 | 0 | 113 |
This release includes new rules for Linux, Windows, Google Workspace and Kubernetes.
Also included are expanded investigation and setup guides for Linux, Windows and macOS rules.
Rule compatability for required event fields and related Fleet integrations has also been included.

|<<prebuilt-rule-8-2-1-prebuilt-rules-8-2-1-summary, 8.2.1>> | 24 Aug 2022 | 442 | 96 |
This release includes new rules for Windows, MacOS, Linux, Kubernetes, and considerable tuning efforts.
Also included are expanded investion guides for Windows, Azure and AWS rules.

|<<prebuilt-rule-8-1-1-prebuilt-rules-8-1-1-summary, 8.1.1>> | 24 Jun 2022 | 14 | 159 |
This release includes new rules for Windows, MacOS, Linux and Kubernetes.
Also included are expanded investigation guides for Windows rules.
Additionally, this update includes new rules to help detect emerging threat https://www.elastic.co/blog/a-peek-behind-the-bpfdoor[BPFDoor].
Updates to existing Windows rules were made to help detect exploitation attempts against https://www.elastic.co/blog/vulnerability-summary-follina[CVE-2022-30190].

|<<prebuilt-rule-1-0-2-prebuilt-rules-1-0-2-summary, 1.0.2>> | 03 May 2022 | 42 | 341 |
This release includes new rules for MacOS regarding initial access and persistence coverage.
New rules to detect shell evasion in Linux have also been added.
Also included are expanded investigation guides for Windows rules as well as new rules for credential theft and Active Directory (AD).
Additionally, this update includes new rules to help detect the emerging threat https://www.elastic.co/blog/detecting-and-responding-to-dirty-pipe-with-elastic[CVE-2022-0847 (Dirty Pipe)]

|<<prebuilt-rule-0-14-3-prebuilt-rules-0-14-3-summary, 0.14.3>> | 13 Dec 2021 | 35 | 45 |
This release includes an update to an existing rule and adds a new rule to help detect https://www.elastic.co/blog/detecting-log4j2-with-elastic-security[CVE-2021-44228 (log4j2)].
Also included are updates and new rules for cloud integrations, windows, PowerShell, and others.

|<<prebuilt-rule-0-14-2-prebuilt-rules-0-14-2-summary, 0.14.2>> | 15 Oct 2021 | 18 | 89 |
This release includes rules covering Windows endpoints, as well as several third-party integrations — including rules contributed by the community.

|<<prebuilt-rule-0-14-1-prebuilt-rules-0-14-1-summary, 0.14.1>> | 08 Sep 2021 | 3 | 71 |
Included in this release is a rule to detect web shells, including
https://discuss.elastic.co/t/detection-and-response-for-proxyshell-activity/282407[ProxyShell] activity.

|<<prebuilt-rule-0-13-3-prebuilt-rules-0-13-3-summary, 0.13.3>> | 22 Jul 2021 | 4 | 36 |
Included in this release is a rule for Windows Defender Exclusions, which has been used in recent campaigns, as well as
a rule to resiliently detect parent PID spoofing.

|<<prebuilt-rule-0-13-2-prebuilt-rules-0-13-2-summary, 0.13.2>> | 07 Jul 2021 | 15 | 6 |
Included in this release are 3 new rules for the recently observed
https://www.elastic.co/blog/elastic-security-prevents-100-percent-of-revil-ransomware-samples[REvil]
activity as well as 4 new rules covering the recent
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527[PrintNightmare] vulnerability.

|<<prebuilt-rule-0-13-1-prebuilt-rules-0-13-1-summary, 0.13.1>> | 21 Jun 2021 | 4 | 41 |

|==============================================


include::downloadable-packages/0-13-1/prebuilt-rules-0-13-1-summary.asciidoc[leveloffset=+1]
include::downloadable-packages/0-13-2/prebuilt-rules-0-13-2-summary.asciidoc[leveloffset=+1]
include::downloadable-packages/0-13-3/prebuilt-rules-0-13-3-summary.asciidoc[leveloffset=+1]
include::downloadable-packages/0-14-1/prebuilt-rules-0-14-1-summary.asciidoc[leveloffset=+1]
include::downloadable-packages/0-14-2/prebuilt-rules-0-14-2-summary.asciidoc[leveloffset=+1]
include::downloadable-packages/0-14-3/prebuilt-rules-0-14-3-summary.asciidoc[leveloffset=+1]
include::downloadable-packages/1-0-2/prebuilt-rules-1-0-2-summary.asciidoc[leveloffset=+1]
include::downloadable-packages/8-1-1/prebuilt-rules-8-1-1-summary.asciidoc[leveloffset=+1]
include::downloadable-packages/8-2-1/prebuilt-rules-8-2-1-summary.asciidoc[leveloffset=+1]
include::downloadable-packages/8-3-1/prebuilt-rules-8-3-1-summary.asciidoc[leveloffset=+1]
include::downloadable-packages/8-3-2/prebuilt-rules-8-3-2-summary.asciidoc[leveloffset=+1]
include::downloadable-packages/8-3-3/prebuilt-rules-8-3-3-summary.asciidoc[leveloffset=+1]
include::downloadable-packages/8-3-4/prebuilt-rules-8-3-4-summary.asciidoc[leveloffset=+1]
include::downloadable-packages/8-4-1/prebuilt-rules-8-4-1-summary.asciidoc[leveloffset=+1]
include::downloadable-packages/8-4-2/prebuilt-rules-8-4-2-summary.asciidoc[leveloffset=+1]
include::downloadable-packages/8-4-3/prebuilt-rules-8-4-3-summary.asciidoc[leveloffset=+1]
include::downloadable-packages/8-5-1/prebuilt-rules-8-5-1-summary.asciidoc[leveloffset=+1]
include::downloadable-packages/8-6-1/prebuilt-rules-8-6-1-summary.asciidoc[leveloffset=+1]
include::downloadable-packages/8-7-1/prebuilt-rules-8-7-1-summary.asciidoc[leveloffset=+1]
include::downloadable-packages/8-12-1/prebuilt-rules-8-12-1-summary.asciidoc[leveloffset=+1]
Loading