[Detection Rules] Add 7.9 rules (#71808)
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
This commit is contained in:
Ross Wolf
GitHub
parent
25d143fdf7
commit
a282af7ca3
|
|
@ -4,6 +4,13 @@
|
|||
],
|
||||
"description": "Generates a detection alert each time an Elastic Endpoint alert is received. Enabling this rule allows you to immediately begin investigating your Elastic Endpoint alerts.",
|
||||
"enabled": true,
|
||||
"exceptions_list": [
|
||||
{
|
||||
"id": "endpoint_list",
|
||||
"namespace_type": "agnostic",
|
||||
"type": "endpoint"
|
||||
}
|
||||
],
|
||||
"from": "now-10m",
|
||||
"index": [
|
||||
"logs-endpoint.alerts-*"
|
||||
|
|
|
|||
|
|
@ -205,6 +205,11 @@ import rule193 from './privilege_escalation_root_login_without_mfa.json';
|
|||
import rule194 from './privilege_escalation_updateassumerolepolicy.json';
|
||||
import rule195 from './elastic_endpoint.json';
|
||||
import rule196 from './external_alerts.json';
|
||||
import rule197 from './ml_cloudtrail_error_message_spike.json';
|
||||
import rule198 from './ml_cloudtrail_rare_error_code.json';
|
||||
import rule199 from './ml_cloudtrail_rare_method_by_city.json';
|
||||
import rule200 from './ml_cloudtrail_rare_method_by_country.json';
|
||||
import rule201 from './ml_cloudtrail_rare_method_by_user.json';
|
||||
|
||||
export const rawRules = [
|
||||
rule1,
|
||||
|
|
@ -403,4 +408,9 @@ export const rawRules = [
|
|||
rule194,
|
||||
rule195,
|
||||
rule196,
|
||||
rule197,
|
||||
rule198,
|
||||
rule199,
|
||||
rule200,
|
||||
rule201,
|
||||
];
|
||||
|
|
|
|||
|
|
@ -0,0 +1,29 @@
|
|||
{
|
||||
"anomaly_threshold": 50,
|
||||
"author": [
|
||||
"Elastic"
|
||||
],
|
||||
"description": "A machine learning job detected a significant spike in the rate of a particular error in the CloudTrail messages. Spikes in error messages may accompany attempts at privilege escalation, lateral movement, or discovery.",
|
||||
"false_positives": [
|
||||
"Spikes in error message activity can also be due to bugs in cloud automation scripts or workflows; changes to cloud automation scripts or workflows; adoption of new services; changes in the way services are used; or changes to IAM privileges."
|
||||
],
|
||||
"from": "now-60m",
|
||||
"interval": "15m",
|
||||
"license": "Elastic License",
|
||||
"machine_learning_job_id": "high_distinct_count_error_message",
|
||||
"name": "Spike in AWS Error Messages",
|
||||
"note": "### Investigating Spikes in CloudTrail Errors ###\nDetection alerts from this rule indicate a large spike in the number of CloudTrail log messages that contain a particular error message. The error message in question was associated with the response to an AWS API command or method call. Here are some possible avenues of investigation:\n- Examine the history of the error. Has it manifested before? If the error, which is visible in the `aws.cloudtrail.error_message` field, manifested only very recently, it might be related to recent changes in an automation module or script.\n- Examine the request parameters. These may provide indications as to the nature of the task being performed when the error occurred. Is the error related to unsuccessful attempts to enumerate or access objects, data or secrets? If so, this can sometimes be a byproduct of discovery, privilege escalation or lateral movement attempts.\n- Consider the user as identified by the user.name field. Is this activity part of an expected workflow for the user context? Examine the user identity in the `aws.cloudtrail.user_identity.arn` field and the access key id in the `aws.cloudtrail.user_identity.access_key_id` field which can help identify the precise user context. The user agent details in the `user_agent.original` field may also indicate what kind of a client made the request.\n- Consider the source IP address and geolocation for the calling user who issued the command. Do they look normal for the calling user? If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts or could it be sourcing from an EC2 instance not under your control? If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles? Are there any other alerts or signs of suspicious activity involving this instance?",
|
||||
"references": [
|
||||
"https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html"
|
||||
],
|
||||
"risk_score": 21,
|
||||
"rule_id": "78d3d8d9-b476-451d-a9e0-7a5addd70670",
|
||||
"severity": "low",
|
||||
"tags": [
|
||||
"AWS",
|
||||
"Elastic",
|
||||
"ML"
|
||||
],
|
||||
"type": "machine_learning",
|
||||
"version": 1
|
||||
}
|
||||
|
|
@ -0,0 +1,29 @@
|
|||
{
|
||||
"anomaly_threshold": 50,
|
||||
"author": [
|
||||
"Elastic"
|
||||
],
|
||||
"description": "A machine learning job detected an unusual error in a CloudTrail message. These can be byproducts of attempted or successful persistence, privilege escalation, defense evasion, discovery, lateral movement, or collection.",
|
||||
"false_positives": [
|
||||
"Rare and unusual errors may indicate an impending service failure state. Rare and unusual user error activity can also be due to manual troubleshooting or reconfiguration attempts by insufficiently privileged users, bugs in cloud automation scripts or workflows, or changes to IAM privileges."
|
||||
],
|
||||
"from": "now-60m",
|
||||
"interval": "15m",
|
||||
"license": "Elastic License",
|
||||
"machine_learning_job_id": "rare_error_code",
|
||||
"name": "Rare AWS Error Code",
|
||||
"note": "### Investigating Unusual CloudTrail Error Activity ###\nDetection alerts from this rule indicate a rare and unusual error code that was associated with the response to an AWS API command or method call. Here are some possible avenues of investigation:\n- Examine the history of the error. Has it manifested before? If the error, which is visible in the `aws.cloudtrail.error_code field`, manifested only very recently, it might be related to recent changes in an automation module or script.\n- Examine the request parameters. These may provide indications as to the nature of the task being performed when the error occurred. Is the error related to unsuccessful attempts to enumerate or access objects, data, or secrets? If so, this can sometimes be a byproduct of discovery, privilege escalation, or lateral movement attempts.\n- Consider the user as identified by the `user.name` field. Is this activity part of an expected workflow for the user context? Examine the user identity in the `aws.cloudtrail.user_identity.arn` field and the access key id in the `aws.cloudtrail.user_identity.access_key_id` field which can help identify the precise user context. The user agent details in the `user_agent.original` field may also indicate what kind of a client made the request.\n- Consider the source IP address and geolocation for the calling user who issued the command. Do they look normal for the calling user? If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts or could it be sourcing from an EC2 instance not under your control? If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles? Are there any other alerts or signs of suspicious activity involving this instance?",
|
||||
"references": [
|
||||
"https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html"
|
||||
],
|
||||
"risk_score": 21,
|
||||
"rule_id": "19de8096-e2b0-4bd8-80c9-34a820813fff",
|
||||
"severity": "low",
|
||||
"tags": [
|
||||
"AWS",
|
||||
"Elastic",
|
||||
"ML"
|
||||
],
|
||||
"type": "machine_learning",
|
||||
"version": 1
|
||||
}
|
||||
|
|
@ -0,0 +1,29 @@
|
|||
{
|
||||
"anomaly_threshold": 50,
|
||||
"author": [
|
||||
"Elastic"
|
||||
],
|
||||
"description": "A machine learning job detected AWS command activity that, while not inherently suspicious or abnormal, is sourcing from a geolocation (city) that is unusual for the command. This can be the result of compromised credentials or keys being used by a threat actor in a different geography then the authorized user(s).",
|
||||
"false_positives": [
|
||||
"New or unusual command and user geolocation activity can be due to manual troubleshooting or reconfiguration; changes in cloud automation scripts or workflows; adoption of new services; expansion into new regions; increased adoption of work from home policies; or users who travel frequently."
|
||||
],
|
||||
"from": "now-60m",
|
||||
"interval": "15m",
|
||||
"license": "Elastic License",
|
||||
"machine_learning_job_id": "rare_method_for_a_city",
|
||||
"name": "Unusual City For an AWS Command",
|
||||
"note": "### Investigating an Unusual CloudTrail Event ###\nDetection alerts from this rule indicate an AWS API command or method call that is rare and unusual for the geolocation of the source IP address. Here are some possible avenues of investigation:\n- Consider the source IP address and geolocation for the calling user who issued the command. Do they look normal for the calling user? If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts or could it be sourcing from an EC2 instance not under your control? If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles? Are there any other alerts or signs of suspicious activity involving this instance?\n- Consider the user as identified by the `user.name` field. Is this command part of an expected workflow for the user context? Examine the user identity in the `aws.cloudtrail.user_identity.arn` field and the access key id in the `aws.cloudtrail.user_identity.access_key_id` field which can help identify the precise user context. The user agent details in the `user_agent.original` field may also indicate what kind of a client made the request.\n- Consider the time of day. If the user is a human, not a program or script, did the activity take place during a normal time of day?\n- Examine the history of the command. If the command, which is visible in the `event.action field`, manifested only very recently, it might be part of a new automation module or script. If it has a consistent cadence - for example, if it appears in small numbers on a weekly or monthly cadence it might be part of a housekeeping or maintenance process.\n- Examine the request parameters. These may provide indications as to the source of the program or the nature of the tasks it is performing.",
|
||||
"references": [
|
||||
"https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html"
|
||||
],
|
||||
"risk_score": 21,
|
||||
"rule_id": "809b70d3-e2c3-455e-af1b-2626a5a1a276",
|
||||
"severity": "low",
|
||||
"tags": [
|
||||
"AWS",
|
||||
"Elastic",
|
||||
"ML"
|
||||
],
|
||||
"type": "machine_learning",
|
||||
"version": 1
|
||||
}
|
||||
|
|
@ -0,0 +1,29 @@
|
|||
{
|
||||
"anomaly_threshold": 50,
|
||||
"author": [
|
||||
"Elastic"
|
||||
],
|
||||
"description": "A machine learning job detected AWS command activity that, while not inherently suspicious or abnormal, is sourcing from a geolocation (country) that is unusual for the command. This can be the result of compromised credentials or keys being used by a threat actor in a different geography then the authorized user(s).",
|
||||
"false_positives": [
|
||||
"New or unusual command and user geolocation activity can be due to manual troubleshooting or reconfiguration; changes in cloud automation scripts or workflows; adoption of new services; expansion into new regions; increased adoption of work from home policies; or users who travel frequently."
|
||||
],
|
||||
"from": "now-60m",
|
||||
"interval": "15m",
|
||||
"license": "Elastic License",
|
||||
"machine_learning_job_id": "rare_method_for_a_country",
|
||||
"name": "Unusual Country For an AWS Command",
|
||||
"note": "### Investigating an Unusual CloudTrail Event ###\nDetection alerts from this rule indicate an AWS API command or method call that is rare and unusual for the geolocation of the source IP address. Here are some possible avenues of investigation:\n- Consider the source IP address and geolocation for the calling user who issued the command. Do they look normal for the calling user? If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts or could it be sourcing from an EC2 instance not under your control? If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles? Are there any other alerts or signs of suspicious activity involving this instance?\n- Consider the user as identified by the `user.name` field. Is this command part of an expected workflow for the user context? Examine the user identity in the `aws.cloudtrail.user_identity.arn` field and the access key id in the `aws.cloudtrail.user_identity.access_key_id` field which can help identify the precise user context. The user agent details in the `user_agent.original` field may also indicate what kind of a client made the request.\n- Consider the time of day. If the user is a human, not a program or script, did the activity take place during a normal time of day?\n- Examine the history of the command. If the command, which is visible in the `event.action field`, manifested only very recently, it might be part of a new automation module or script. If it has a consistent cadence - for example, if it appears in small numbers on a weekly or monthly cadence it might be part of a housekeeping or maintenance process.\n- Examine the request parameters. These may provide indications as to the source of the program or the nature of the tasks it is performing.",
|
||||
"references": [
|
||||
"https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html"
|
||||
],
|
||||
"risk_score": 21,
|
||||
"rule_id": "dca28dee-c999-400f-b640-50a081cc0fd1",
|
||||
"severity": "low",
|
||||
"tags": [
|
||||
"AWS",
|
||||
"Elastic",
|
||||
"ML"
|
||||
],
|
||||
"type": "machine_learning",
|
||||
"version": 1
|
||||
}
|
||||
|
|
@ -0,0 +1,29 @@
|
|||
{
|
||||
"anomaly_threshold": 75,
|
||||
"author": [
|
||||
"Elastic"
|
||||
],
|
||||
"description": "A machine learning job detected an AWS API command that, while not inherently suspicious or abnormal, is being made by a user context that does not normally use the command. This can be the result of compromised credentials or keys as someone uses a valid account to persist, move laterally, or exfil data.",
|
||||
"false_positives": [
|
||||
"New or unusual user command activity can be due to manual troubleshooting or reconfiguration; changes in cloud automation scripts or workflows; adoption of new services; or changes in the way services are used."
|
||||
],
|
||||
"from": "now-60m",
|
||||
"interval": "15m",
|
||||
"license": "Elastic License",
|
||||
"machine_learning_job_id": "rare_method_for_a_username",
|
||||
"name": "Unusual AWS Command for a User",
|
||||
"note": "### Investigating an Unusual CloudTrail Event ###\nDetection alerts from this rule indicate an AWS API command or method call that is rare and unusual for the calling IAM user. Here are some possible avenues of investigation:\n- Consider the user as identified by the `user.name` field. Is this command part of an expected workflow for the user context? Examine the user identity in the `aws.cloudtrail.user_identity.arn` field and the access key id in the `aws.cloudtrail.user_identity.access_key_id` field which can help identify the precise user context. The user agent details in the `user_agent.original` field may also indicate what kind of a client made the request.\n- Consider the source IP address and geolocation for the calling user who issued the command. Do they look normal for the calling user? If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts or could it be sourcing from an EC2 instance not under your control? If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles? Are there any other alerts or signs of suspicious activity involving this instance?\n- Consider the time of day. If the user is a human, not a program or script, did the activity take place during a normal time of day?\n- Examine the history of the command. If the command, which is visible in the `event.action field`, manifested only very recently, it might be part of a new automation module or script. If it has a consistent cadence - for example, if it appears in small numbers on a weekly or monthly cadence it might be part of a housekeeping or maintenance process.\n- Examine the request parameters. These may provide indications as to the source of the program or the nature of the tasks it is performing.",
|
||||
"references": [
|
||||
"https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html"
|
||||
],
|
||||
"risk_score": 21,
|
||||
"rule_id": "ac706eae-d5ec-4b14-b4fd-e8ba8086f0e1",
|
||||
"severity": "low",
|
||||
"tags": [
|
||||
"AWS",
|
||||
"Elastic",
|
||||
"ML"
|
||||
],
|
||||
"type": "machine_learning",
|
||||
"version": 1
|
||||
}
|
||||
|
|
@ -4,15 +4,12 @@
|
|||
"Elastic"
|
||||
],
|
||||
"description": "Identifies Linux processes that do not usually use the network but have unexpected network activity, which can indicate command-and-control, lateral movement, persistence, or data exfiltration activity. A process with unusual network activity can denote process exploitation or injection, where the process is used to run persistence mechanisms that allow a malicious actor remote access or control of the host, data exfiltration, and execution of unauthorized network applications.",
|
||||
"false_positives": [
|
||||
"A newly installed program or one that rarely uses the network could trigger this signal."
|
||||
],
|
||||
"from": "now-45m",
|
||||
"interval": "15m",
|
||||
"license": "Elastic License",
|
||||
"machine_learning_job_id": "linux_anomalous_network_activity_ecs",
|
||||
"name": "Unusual Linux Network Activity",
|
||||
"note": "### Investigating Unusual Network Activity ###\nSignals from this rule indicate the presence of network activity from a Linux process for which network activity is rare and unusual. Here are some possible avenues of investigation:\n- Consider the IP addresses and ports. Are these used by normal but infrequent network workflows? Are they expected or unexpected? \n- If the destination IP address is remote or external, does it associate with an expected domain, organization or geography? Note: avoid interacting directly with suspected malicious IP addresses.\n- Consider the user as identified by the username field. Is this network activity part of an expected workflow for the user who ran the program?\n- Examine the history of execution. If this process manifested only very recently, it might be part of a new software package. If it has a consistent cadence - for example if it runs monthly or quarterly - it might be part of a monthly or quarterly business or maintenance process.\n- Examine the process arguments, title and working directory. These may provide indications as to the source of the program or the nature of the tasks it is performing.",
|
||||
"note": "### Investigating Unusual Network Activity ###\nDetection alerts from this rule indicate the presence of network activity from a Linux process for which network activity is rare and unusual. Here are some possible avenues of investigation:\n- Consider the IP addresses and ports. Are these used by normal but infrequent network workflows? Are they expected or unexpected? \n- If the destination IP address is remote or external, does it associate with an expected domain, organization or geography? Note: avoid interacting directly with suspected malicious IP addresses.\n- Consider the user as identified by the username field. Is this network activity part of an expected workflow for the user who ran the program?\n- Examine the history of execution. If this process manifested only very recently, it might be part of a new software package. If it has a consistent cadence - for example if it runs monthly or quarterly - it might be part of a monthly or quarterly business or maintenance process.\n- Examine the process arguments, title and working directory. These may provide indications as to the source of the program or the nature of the tasks it is performing.",
|
||||
"references": [
|
||||
"https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html"
|
||||
],
|
||||
|
|
|
|||
|
|
@ -5,7 +5,7 @@
|
|||
],
|
||||
"description": "Identifies unusual destination port activity that can indicate command-and-control, persistence mechanism, or data exfiltration activity. Rarely used destination port activity is generally unusual in Linux fleets, and can indicate unauthorized access or threat actor activity.",
|
||||
"false_positives": [
|
||||
"A newly installed program or one that rarely uses the network could trigger this signal."
|
||||
"A newly installed program or one that rarely uses the network could trigger this alert."
|
||||
],
|
||||
"from": "now-45m",
|
||||
"interval": "15m",
|
||||
|
|
|
|||
|
|
@ -5,7 +5,7 @@
|
|||
],
|
||||
"description": "Identifies unusual listening ports on Linux instances that can indicate execution of unauthorized services, backdoors, or persistence mechanisms.",
|
||||
"false_positives": [
|
||||
"A newly installed program or one that rarely uses the network could trigger this signal."
|
||||
"A newly installed program or one that rarely uses the network could trigger this alert."
|
||||
],
|
||||
"from": "now-45m",
|
||||
"interval": "15m",
|
||||
|
|
|
|||
|
|
@ -5,7 +5,7 @@
|
|||
],
|
||||
"description": "A machine learning job detected an unusual web URL request from a Linux host, which can indicate malware delivery and execution. Wget and cURL are commonly used by Linux programs to download code and data. Most of the time, their usage is entirely normal. Generally, because they use a list of URLs, they repeatedly download from the same locations. However, Wget and cURL are sometimes used to deliver Linux exploit payloads, and threat actors use these tools to download additional software and code. For these reasons, unusual URLs can indicate unauthorized downloads or threat activity.",
|
||||
"false_positives": [
|
||||
"A new and unusual program or artifact download in the course of software upgrades, debugging, or troubleshooting could trigger this signal."
|
||||
"A new and unusual program or artifact download in the course of software upgrades, debugging, or troubleshooting could trigger this alert."
|
||||
],
|
||||
"from": "now-45m",
|
||||
"interval": "15m",
|
||||
|
|
|
|||
|
|
@ -5,14 +5,14 @@
|
|||
],
|
||||
"description": "Searches for rare processes running on multiple Linux hosts in an entire fleet or network. This reduces the detection of false positives since automated maintenance processes usually only run occasionally on a single machine but are common to all or many hosts in a fleet.",
|
||||
"false_positives": [
|
||||
"A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this signal."
|
||||
"A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this alert."
|
||||
],
|
||||
"from": "now-45m",
|
||||
"interval": "15m",
|
||||
"license": "Elastic License",
|
||||
"machine_learning_job_id": "linux_anomalous_process_all_hosts_ecs",
|
||||
"name": "Anomalous Process For a Linux Population",
|
||||
"note": "### Investigating an Unusual Linux Process ###\nSignals from this rule indicate the presence of a Linux process that is rare and unusual for all of the monitored Linux hosts for which Auditbeat data is available. Here are some possible avenues of investigation:\n- Consider the user as identified by the username field. Is this program part of an expected workflow for the user who ran this program on this host?\n- Examine the history of execution. If this process manifested only very recently, it might be part of a new software package. If it has a consistent cadence - for example if it runs monthly or quarterly - it might be part of a monthly or quarterly business process.\n- Examine the process arguments, title and working directory. These may provide indications as to the source of the program or the nature of the tasks it is performing.",
|
||||
"note": "### Investigating an Unusual Linux Process ###\nDetection alerts from this rule indicate the presence of a Linux process that is rare and unusual for all of the monitored Linux hosts for which Auditbeat data is available. Here are some possible avenues of investigation:\n- Consider the user as identified by the username field. Is this program part of an expected workflow for the user who ran this program on this host?\n- Examine the history of execution. If this process manifested only very recently, it might be part of a new software package. If it has a consistent cadence - for example if it runs monthly or quarterly - it might be part of a monthly or quarterly business process.\n- Examine the process arguments, title and working directory. These may provide indications as to the source of the program or the nature of the tasks it is performing.",
|
||||
"references": [
|
||||
"https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html"
|
||||
],
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@
|
|||
"license": "Elastic License",
|
||||
"machine_learning_job_id": "linux_anomalous_user_name_ecs",
|
||||
"name": "Unusual Linux Username",
|
||||
"note": "### Investigating an Unusual Linux User ###\nSignals from this rule indicate activity for a Linux user name that is rare and unusual. Here are some possible avenues of investigation:\n- Consider the user as identified by the username field. Is this program part of an expected workflow for the user who ran this program on this host? Could this be related to troubleshooting or debugging activity by a developer or site reliability engineer?\n- Examine the history of user activity. If this user manifested only very recently, it might be a service account for a new software package. If it has a consistent cadence - for example if it runs monthly or quarterly - it might be part of a monthly or quarterly business process.\n- Examine the process arguments, title and working directory. These may provide indications as to the source of the program or the nature of the tasks that the user is performing.",
|
||||
"note": "### Investigating an Unusual Linux User ###\nDetection alerts from this rule indicate activity for a Linux user name that is rare and unusual. Here are some possible avenues of investigation:\n- Consider the user as identified by the username field. Is this program part of an expected workflow for the user who ran this program on this host? Could this be related to troubleshooting or debugging activity by a developer or site reliability engineer?\n- Examine the history of user activity. If this user manifested only very recently, it might be a service account for a new software package. If it has a consistent cadence - for example if it runs monthly or quarterly - it might be part of a monthly or quarterly business process.\n- Examine the process arguments, title and working directory. These may provide indications as to the source of the program or the nature of the tasks that the user is performing.",
|
||||
"references": [
|
||||
"https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html"
|
||||
],
|
||||
|
|
|
|||
|
|
@ -5,7 +5,7 @@
|
|||
],
|
||||
"description": "A machine learning job detected unusually large numbers of DNS queries for a single top-level DNS domain, which is often used for DNS tunneling. DNS tunneling can be used for command-and-control, persistence, or data exfiltration activity. For example, dnscat tends to generate many DNS questions for a top-level domain as it uses the DNS protocol to tunnel data.",
|
||||
"false_positives": [
|
||||
"DNS domains that use large numbers of child domains, such as software or content distribution networks, can trigger this signal and such parent domains can be excluded."
|
||||
"DNS domains that use large numbers of child domains, such as software or content distribution networks, can trigger this alert and such parent domains can be excluded."
|
||||
],
|
||||
"from": "now-45m",
|
||||
"interval": "15m",
|
||||
|
|
|
|||
|
|
@ -5,7 +5,7 @@
|
|||
],
|
||||
"description": "A machine learning job detected a rare and unusual DNS query that indicate network activity with unusual DNS domains. This can be due to initial access, persistence, command-and-control, or exfiltration activity. For example, when a user clicks on a link in a phishing email or opens a malicious document, a request may be sent to download and run a payload from an uncommon domain. When malware is already running, it may send requests to an uncommon DNS domain the malware uses for command-and-control communication.",
|
||||
"false_positives": [
|
||||
"A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this signal. Network activity that occurs rarely, in small quantities, can trigger this signal. Possible examples are browsing technical support or vendor networks sparsely. A user who visits a new or unique web destination may trigger this signal."
|
||||
"A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this alert. Network activity that occurs rarely, in small quantities, can trigger this alert. Possible examples are browsing technical support or vendor networks sparsely. A user who visits a new or unique web destination may trigger this alert."
|
||||
],
|
||||
"from": "now-45m",
|
||||
"interval": "15m",
|
||||
|
|
|
|||
|
|
@ -5,7 +5,7 @@
|
|||
],
|
||||
"description": "A machine learning job detected an unusual network destination domain name. This can be due to initial access, persistence, command-and-control, or exfiltration activity. For example, when a user clicks on a link in a phishing email or opens a malicious document, a request may be sent to download and run a payload from an uncommon web server name. When malware is already running, it may send requests to an uncommon DNS domain the malware uses for command-and-control communication.",
|
||||
"false_positives": [
|
||||
"Web activity that occurs rarely in small quantities can trigger this signal. Possible examples are browsing technical support or vendor URLs that are used very sparsely. A user who visits a new and unique web destination may trigger this signal when the activity is sparse. Web applications that generate URLs unique to a transaction may trigger this when they are used sparsely. Web domains can be excluded in cases such as these."
|
||||
"Web activity that occurs rarely in small quantities can trigger this alert. Possible examples are browsing technical support or vendor URLs that are used very sparsely. A user who visits a new and unique web destination may trigger this alert when the activity is sparse. Web applications that generate URLs unique to a transaction may trigger this when they are used sparsely. Web domains can be excluded in cases such as these."
|
||||
],
|
||||
"from": "now-45m",
|
||||
"interval": "15m",
|
||||
|
|
|
|||
|
|
@ -5,7 +5,7 @@
|
|||
],
|
||||
"description": "A machine learning job detected a rare and unusual URL that indicates unusual web browsing activity. This can be due to initial access, persistence, command-and-control, or exfiltration activity. For example, in a strategic web compromise or watering hole attack, when a trusted website is compromised to target a particular sector or organization, targeted users may receive emails with uncommon URLs for trusted websites. These URLs can be used to download and run a payload. When malware is already running, it may send requests to uncommon URLs on trusted websites the malware uses for command-and-control communication. When rare URLs are observed being requested for a local web server by a remote source, these can be due to web scanning, enumeration or attack traffic, or they can be due to bots and web scrapers which are part of common Internet background traffic.",
|
||||
"false_positives": [
|
||||
"Web activity that occurs rarely in small quantities can trigger this signal. Possible examples are browsing technical support or vendor URLs that are used very sparsely. A user who visits a new and unique web destination may trigger this signal when the activity is sparse. Web applications that generate URLs unique to a transaction may trigger this when they are used sparsely. Web domains can be excluded in cases such as these."
|
||||
"Web activity that occurs rarely in small quantities can trigger this alert. Possible examples are browsing technical support or vendor URLs that are used very sparsely. A user who visits a new and unique web destination may trigger this alert when the activity is sparse. Web applications that generate URLs unique to a transaction may trigger this when they are used sparsely. Web domains can be excluded in cases such as these."
|
||||
],
|
||||
"from": "now-45m",
|
||||
"interval": "15m",
|
||||
|
|
|
|||
|
|
@ -5,7 +5,7 @@
|
|||
],
|
||||
"description": "A machine learning job detected a rare and unusual user agent indicating web browsing activity by an unusual process other than a web browser. This can be due to persistence, command-and-control, or exfiltration activity. Uncommon user agents coming from remote sources to local destinations are often the result of scanners, bots, and web scrapers, which are part of common Internet background traffic. Much of this is noise, but more targeted attacks on websites using tools like Burp or SQLmap can sometimes be discovered by spotting uncommon user agents. Uncommon user agents in traffic from local sources to remote destinations can be any number of things, including harmless programs like weather monitoring or stock-trading programs. However, uncommon user agents from local sources can also be due to malware or scanning activity.",
|
||||
"false_positives": [
|
||||
"Web activity that is uncommon, like security scans, may trigger this signal and may need to be excluded. A new or rarely used program that calls web services may trigger this signal."
|
||||
"Web activity that is uncommon, like security scans, may trigger this alert and may need to be excluded. A new or rarely used program that calls web services may trigger this alert."
|
||||
],
|
||||
"from": "now-45m",
|
||||
"interval": "15m",
|
||||
|
|
|
|||
|
|
@ -5,14 +5,14 @@
|
|||
],
|
||||
"description": "Identifies rare processes that do not usually run on individual hosts, which can indicate execution of unauthorized services, malware, or persistence mechanisms. Processes are considered rare when they only run occasionally as compared with other processes running on the host.",
|
||||
"false_positives": [
|
||||
"A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this signal."
|
||||
"A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this alert."
|
||||
],
|
||||
"from": "now-45m",
|
||||
"interval": "15m",
|
||||
"license": "Elastic License",
|
||||
"machine_learning_job_id": "rare_process_by_host_linux_ecs",
|
||||
"name": "Unusual Process For a Linux Host",
|
||||
"note": "### Investigating an Unusual Linux Process ###\nSignals from this rule indicate the presence of a Linux process that is rare and unusual for the host it ran on. Here are some possible avenues of investigation:\n- Consider the user as identified by the username field. Is this program part of an expected workflow for the user who ran this program on this host?\n- Examine the history of execution. If this process manifested only very recently, it might be part of a new software package. If it has a consistent cadence - for example if it runs monthly or quarterly - it might be part of a monthly or quarterly business process.\n- Examine the process arguments, title and working directory. These may provide indications as to the source of the program or the nature of the tasks it is performing.",
|
||||
"note": "### Investigating an Unusual Linux Process ###\nDetection alerts from this rule indicate the presence of a Linux process that is rare and unusual for the host it ran on. Here are some possible avenues of investigation:\n- Consider the user as identified by the username field. Is this program part of an expected workflow for the user who ran this program on this host?\n- Examine the history of execution. If this process manifested only very recently, it might be part of a new software package. If it has a consistent cadence - for example if it runs monthly or quarterly - it might be part of a monthly or quarterly business process.\n- Examine the process arguments, title and working directory. These may provide indications as to the source of the program or the nature of the tasks it is performing.",
|
||||
"references": [
|
||||
"https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html"
|
||||
],
|
||||
|
|
|
|||
|
|
@ -5,14 +5,14 @@
|
|||
],
|
||||
"description": "Identifies rare processes that do not usually run on individual hosts, which can indicate execution of unauthorized services, malware, or persistence mechanisms. Processes are considered rare when they only run occasionally as compared with other processes running on the host.",
|
||||
"false_positives": [
|
||||
"A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this signal."
|
||||
"A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this alert."
|
||||
],
|
||||
"from": "now-45m",
|
||||
"interval": "15m",
|
||||
"license": "Elastic License",
|
||||
"machine_learning_job_id": "rare_process_by_host_windows_ecs",
|
||||
"name": "Unusual Process For a Windows Host",
|
||||
"note": "### Investigating an Unusual Windows Process ###\nSignals from this rule indicate the presence of a Windows process that is rare and unusual for the host it ran on. Here are some possible avenues of investigation:\n- Consider the user as identified by the username field. Is this program part of an expected workflow for the user who ran this program on this host?\n- Examine the history of execution. If this process manifested only very recently, it might be part of a new software package. If it has a consistent cadence - for example if it runs monthly or quarterly - it might be part of a monthly or quarterly business process.\n- Examine the process metadata like the values of the Company, Description and Product fields which may indicate whether the program is associated with an expected software vendor or package. \n- Examine arguments and working directory. These may provide indications as to the source of the program or the nature of the tasks it is performing.\n- Consider the same for the parent process. If the parent process is a legitimate system utility or service, this could be related to software updates or system management. If the parent process is something user-facing like an Office application, this process could be more suspicious.\n- If you have file hash values in the event data, and you suspect malware, you can optionally run a search for the file hash to see if the file is identified as malware by anti-malware tools. ",
|
||||
"note": "### Investigating an Unusual Windows Process ###\nDetection alerts from this rule indicate the presence of a Windows process that is rare and unusual for the host it ran on. Here are some possible avenues of investigation:\n- Consider the user as identified by the username field. Is this program part of an expected workflow for the user who ran this program on this host?\n- Examine the history of execution. If this process manifested only very recently, it might be part of a new software package. If it has a consistent cadence - for example if it runs monthly or quarterly - it might be part of a monthly or quarterly business process.\n- Examine the process metadata like the values of the Company, Description and Product fields which may indicate whether the program is associated with an expected software vendor or package. \n- Examine arguments and working directory. These may provide indications as to the source of the program or the nature of the tasks it is performing.\n- Consider the same for the parent process. If the parent process is a legitimate system utility or service, this could be related to software updates or system management. If the parent process is something user-facing like an Office application, this process could be more suspicious.\n- If you have file hash values in the event data, and you suspect malware, you can optionally run a search for the file hash to see if the file is identified as malware by anti-malware tools. ",
|
||||
"references": [
|
||||
"https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html"
|
||||
],
|
||||
|
|
|
|||
|
|
@ -5,7 +5,7 @@
|
|||
],
|
||||
"description": "Identifies an unusually high number of authentication attempts.",
|
||||
"false_positives": [
|
||||
"Security audits may trigger this signal. Conditions that generate bursts of failed logins, such as misconfigured applications or account lockouts could trigger this signal."
|
||||
"Security audits may trigger this alert. Conditions that generate bursts of failed logins, such as misconfigured applications or account lockouts could trigger this alert."
|
||||
],
|
||||
"from": "now-45m",
|
||||
"interval": "15m",
|
||||
|
|
|
|||
|
|
@ -5,14 +5,14 @@
|
|||
],
|
||||
"description": "Identifies Windows processes that do not usually use the network but have unexpected network activity, which can indicate command-and-control, lateral movement, persistence, or data exfiltration activity. A process with unusual network activity can denote process exploitation or injection, where the process is used to run persistence mechanisms that allow a malicious actor remote access or control of the host, data exfiltration, and execution of unauthorized network applications.",
|
||||
"false_positives": [
|
||||
"A newly installed program or one that rarely uses the network could trigger this signal."
|
||||
"A newly installed program or one that rarely uses the network could trigger this alert."
|
||||
],
|
||||
"from": "now-45m",
|
||||
"interval": "15m",
|
||||
"license": "Elastic License",
|
||||
"machine_learning_job_id": "windows_anomalous_network_activity_ecs",
|
||||
"name": "Unusual Windows Network Activity",
|
||||
"note": "### Investigating Unusual Network Activity ###\nSignals from this rule indicate the presence of network activity from a Windows process for which network activity is very unusual. Here are some possible avenues of investigation:\n- Consider the IP addresses, protocol and ports. Are these used by normal but infrequent network workflows? Are they expected or unexpected? \n- If the destination IP address is remote or external, does it associate with an expected domain, organization or geography? Note: avoid interacting directly with suspected malicious IP addresses.\n- Consider the user as identified by the username field. Is this network activity part of an expected workflow for the user who ran the program?\n- Examine the history of execution. If this process manifested only very recently, it might be part of a new software package. If it has a consistent cadence - for example if it runs monthly or quarterly - it might be part of a monthly or quarterly business process.\n- Examine the process arguments, title and working directory. These may provide indications as to the source of the program or the nature of the tasks it is performing.\n- Consider the same for the parent process. If the parent process is a legitimate system utility or service, this could be related to software updates or system management. If the parent process is something user-facing like an Office application, this process could be more suspicious.\n- If you have file hash values in the event data, and you suspect malware, you can optionally run a search for the file hash to see if the file is identified as malware by anti-malware tools.",
|
||||
"note": "### Investigating Unusual Network Activity ###\nDetection alerts from this rule indicate the presence of network activity from a Windows process for which network activity is very unusual. Here are some possible avenues of investigation:\n- Consider the IP addresses, protocol and ports. Are these used by normal but infrequent network workflows? Are they expected or unexpected? \n- If the destination IP address is remote or external, does it associate with an expected domain, organization or geography? Note: avoid interacting directly with suspected malicious IP addresses.\n- Consider the user as identified by the username field. Is this network activity part of an expected workflow for the user who ran the program?\n- Examine the history of execution. If this process manifested only very recently, it might be part of a new software package. If it has a consistent cadence - for example if it runs monthly or quarterly - it might be part of a monthly or quarterly business process.\n- Examine the process arguments, title and working directory. These may provide indications as to the source of the program or the nature of the tasks it is performing.\n- Consider the same for the parent process. If the parent process is a legitimate system utility or service, this could be related to software updates or system management. If the parent process is something user-facing like an Office application, this process could be more suspicious.\n- If you have file hash values in the event data, and you suspect malware, you can optionally run a search for the file hash to see if the file is identified as malware by anti-malware tools.",
|
||||
"references": [
|
||||
"https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html"
|
||||
],
|
||||
|
|
|
|||
|
|
@ -5,7 +5,7 @@
|
|||
],
|
||||
"description": "Identifies processes started from atypical folders in the file system, which might indicate malware execution or persistence mechanisms. In corporate Windows environments, software installation is centrally managed and it is unusual for programs to be executed from user or temporary directories. Processes executed from these locations can denote that a user downloaded software directly from the Internet or a malicious script or macro executed malware.",
|
||||
"false_positives": [
|
||||
"A new and unusual program or artifact download in the course of software upgrades, debugging, or troubleshooting could trigger this signal. Users downloading and running programs from unusual locations, such as temporary directories, browser caches, or profile paths could trigger this signal."
|
||||
"A new and unusual program or artifact download in the course of software upgrades, debugging, or troubleshooting could trigger this alert. Users downloading and running programs from unusual locations, such as temporary directories, browser caches, or profile paths could trigger this alert."
|
||||
],
|
||||
"from": "now-45m",
|
||||
"interval": "15m",
|
||||
|
|
|
|||
|
|
@ -5,14 +5,14 @@
|
|||
],
|
||||
"description": "Searches for rare processes running on multiple hosts in an entire fleet or network. This reduces the detection of false positives since automated maintenance processes usually only run occasionally on a single machine but are common to all or many hosts in a fleet.",
|
||||
"false_positives": [
|
||||
"A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this signal."
|
||||
"A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this alert."
|
||||
],
|
||||
"from": "now-45m",
|
||||
"interval": "15m",
|
||||
"license": "Elastic License",
|
||||
"machine_learning_job_id": "windows_anomalous_process_all_hosts_ecs",
|
||||
"name": "Anomalous Process For a Windows Population",
|
||||
"note": "### Investigating an Unusual Windows Process ###\nSignals from this rule indicate the presence of a Windows process that is rare and unusual for all of the Windows hosts for which Winlogbeat data is available. Here are some possible avenues of investigation:\n- Consider the user as identified by the username field. Is this program part of an expected workflow for the user who ran this program on this host?\n- Examine the history of execution. If this process manifested only very recently, it might be part of a new software package. If it has a consistent cadence - for example if it runs monthly or quarterly - it might be part of a monthly or quarterly business process.\n- Examine the process metadata like the values of the Company, Description and Product fields which may indicate whether the program is associated with an expected software vendor or package. \n- Examine arguments and working directory. These may provide indications as to the source of the program or the nature of the tasks it is performing.\n- Consider the same for the parent process. If the parent process is a legitimate system utility or service, this could be related to software updates or system management. If the parent process is something user-facing like an Office application, this process could be more suspicious.\n- If you have file hash values in the event data, and you suspect malware, you can optionally run a search for the file hash to see if the file is identified as malware by anti-malware tools. ",
|
||||
"note": "### Investigating an Unusual Windows Process ###\nDetection alerts from this rule indicate the presence of a Windows process that is rare and unusual for all of the Windows hosts for which Winlogbeat data is available. Here are some possible avenues of investigation:\n- Consider the user as identified by the username field. Is this program part of an expected workflow for the user who ran this program on this host?\n- Examine the history of execution. If this process manifested only very recently, it might be part of a new software package. If it has a consistent cadence - for example if it runs monthly or quarterly - it might be part of a monthly or quarterly business process.\n- Examine the process metadata like the values of the Company, Description and Product fields which may indicate whether the program is associated with an expected software vendor or package.\n- Examine arguments and working directory. These may provide indications as to the source of the program or the nature of the tasks it is performing.\n- Consider the same for the parent process. If the parent process is a legitimate system utility or service, this could be related to software updates or system management. If the parent process is something user-facing like an Office application, this process could be more suspicious.\n- If you have file hash values in the event data, and you suspect malware, you can optionally run a search for the file hash to see if the file is identified as malware by anti-malware tools. ",
|
||||
"references": [
|
||||
"https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html"
|
||||
],
|
||||
|
|
|
|||
|
|
@ -5,7 +5,7 @@
|
|||
],
|
||||
"description": "Identifies unusual parent-child process relationships that can indicate malware execution or persistence mechanisms. Malicious scripts often call on other applications and processes as part of their exploit payload. For example, when a malicious Office document runs scripts as part of an exploit payload, Excel or Word may start a script interpreter process, which, in turn, runs a script that downloads and executes malware. Another common scenario is Outlook running an unusual process when malware is downloaded in an email. Monitoring and identifying anomalous process relationships is a method of detecting new and emerging malware that is not yet recognized by anti-virus scanners.",
|
||||
"false_positives": [
|
||||
"Users running scripts in the course of technical support operations of software upgrades could trigger this signal. A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this signal."
|
||||
"Users running scripts in the course of technical support operations of software upgrades could trigger this alert. A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this alert."
|
||||
],
|
||||
"from": "now-45m",
|
||||
"interval": "15m",
|
||||
|
|
|
|||
|
|
@ -5,7 +5,7 @@
|
|||
],
|
||||
"description": "A machine learning job detected a PowerShell script with unusual data characteristics, such as obfuscation, that may be a characteristic of malicious PowerShell script text blocks.",
|
||||
"false_positives": [
|
||||
"Certain kinds of security testing may trigger this signal. PowerShell scripts that use high levels of obfuscation or have unusual script block payloads may trigger this signal."
|
||||
"Certain kinds of security testing may trigger this alert. PowerShell scripts that use high levels of obfuscation or have unusual script block payloads may trigger this alert."
|
||||
],
|
||||
"from": "now-45m",
|
||||
"interval": "15m",
|
||||
|
|
|
|||
|
|
@ -5,7 +5,7 @@
|
|||
],
|
||||
"description": "A machine learning job detected an unusual Windows service, This can indicate execution of unauthorized services, malware, or persistence mechanisms. In corporate Windows environments, hosts do not generally run many rare or unique services. This job helps detect malware and persistence mechanisms that have been installed and run as a service.",
|
||||
"false_positives": [
|
||||
"A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this signal."
|
||||
"A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this alert."
|
||||
],
|
||||
"from": "now-45m",
|
||||
"interval": "15m",
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@
|
|||
"license": "Elastic License",
|
||||
"machine_learning_job_id": "windows_anomalous_user_name_ecs",
|
||||
"name": "Unusual Windows Username",
|
||||
"note": "### Investigating an Unusual Windows User ###\nSignals from this rule indicate activity for a Windows user name that is rare and unusual. Here are some possible avenues of investigation:\n- Consider the user as identified by the username field. Is this program part of an expected workflow for the user who ran this program on this host? Could this be related to occasional troubleshooting or support activity?\n- Examine the history of user activity. If this user manifested only very recently, it might be a service account for a new software package. If it has a consistent cadence - for example if it runs monthly or quarterly - it might be part of a monthly or quarterly business process.\n- Examine the process arguments, title and working directory. These may provide indications as to the source of the program or the nature of the tasks that the user is performing.\n- Consider the same for the parent process. If the parent process is a legitimate system utility or service, this could be related to software updates or system management. If the parent process is something user-facing like an Office application, this process could be more suspicious.",
|
||||
"note": "### Investigating an Unusual Windows User ###\nDetection alerts from this rule indicate activity for a Windows user name that is rare and unusual. Here are some possible avenues of investigation:\n- Consider the user as identified by the username field. Is this program part of an expected workflow for the user who ran this program on this host? Could this be related to occasional troubleshooting or support activity?\n- Examine the history of user activity. If this user manifested only very recently, it might be a service account for a new software package. If it has a consistent cadence - for example if it runs monthly or quarterly - it might be part of a monthly or quarterly business process.\n- Examine the process arguments, title and working directory. These may provide indications as to the source of the program or the nature of the tasks that the user is performing.\n- Consider the same for the parent process. If the parent process is a legitimate system utility or service, this could be related to software updates or system management. If the parent process is something user-facing like an Office application, this process could be more suspicious.",
|
||||
"references": [
|
||||
"https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html"
|
||||
],
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@
|
|||
"license": "Elastic License",
|
||||
"machine_learning_job_id": "windows_rare_user_type10_remote_login",
|
||||
"name": "Unusual Windows Remote User",
|
||||
"note": "### Investigating an Unusual Windows User ###\nSignals from this rule indicate activity for a rare and unusual Windows RDP (remote desktop) user. Here are some possible avenues of investigation:\n- Consider the user as identified by the username field. Is the user part of a group who normally logs into Windows hosts using RDP (remote desktop protocol)? Is this logon activity part of an expected workflow for the user? \n- Consider the source of the login. If the source is remote, could this be related to occasional troubleshooting or support activity by a vendor or an employee working remotely?",
|
||||
"note": "### Investigating an Unusual Windows User ###\nDetection alerts from this rule indicate activity for a rare and unusual Windows RDP (remote desktop) user. Here are some possible avenues of investigation:\n- Consider the user as identified by the username field. Is the user part of a group who normally logs into Windows hosts using RDP (remote desktop protocol)? Is this logon activity part of an expected workflow for the user? \n- Consider the source of the login. If the source is remote, could this be related to occasional troubleshooting or support activity by a vendor or an employee working remotely?",
|
||||
"references": [
|
||||
"https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html"
|
||||
],
|
||||
|
|
|
|||
Loading…
Reference in a new issue