mirror of
https://github.com/elastic/detection-rules
synced 2026-06-08 14:00:08 +00:00
Lock versions for releases: 8.14,8.15,8.16,8.17,8.18,9.0 (#4703)
(cherry picked from commit acab8b4c6e)
This commit is contained in:
github-actions[bot]
committed by
tradebot-elastic
tradebot-elastic
parent
1e419fc7ae
commit
07ef3aafc2
@@ -233,6 +233,12 @@
|
||||
"type": "eql",
|
||||
"version": 216
|
||||
},
|
||||
"064a2e08-25da-11f0-b1f1-f661ea17fbcd": {
|
||||
"rule_name": "Microsoft Entra ID Protection Anonymized IP Risk Detection",
|
||||
"sha256": "88d6085f4cb924d5a89fc80c05f57e7de76c00a86a1143008272edbe9adbb28c",
|
||||
"type": "query",
|
||||
"version": 1
|
||||
},
|
||||
"06568a02-af29-4f20-929c-f3af281e41aa": {
|
||||
"rule_name": "System Time Discovery",
|
||||
"sha256": "a6862748b17c59d814bdbc083c1cc7d27381aed9732b14f0f1b32474464fd2ef",
|
||||
@@ -312,6 +318,12 @@
|
||||
"type": "eql",
|
||||
"version": 111
|
||||
},
|
||||
"083383af-b9a4-42b7-a463-29c40efe7797": {
|
||||
"rule_name": "Potential PowerShell Obfuscation via Concatenated Dynamic Command Invocation",
|
||||
"sha256": "b3c65cf3fa6d91a0db24101a0c40ffdf65c059e9c55ce270d37ea711511f3ec6",
|
||||
"type": "esql",
|
||||
"version": 1
|
||||
},
|
||||
"083fa162-e790-4d85-9aeb-4fea04188adb": {
|
||||
"rule_name": "Suspicious Hidden Child Process of Launchd",
|
||||
"sha256": "92729a5db8411c86f55936222a8fdbd7c1634c859d8453339bf3d82144af86cf",
|
||||
@@ -442,9 +454,9 @@
|
||||
},
|
||||
"0b96dfd8-5b8c-4485-9a1c-69ff7839786a": {
|
||||
"rule_name": "Attempt to Establish VScode Remote Tunnel",
|
||||
"sha256": "e082d52aabc9e71bac630b02b5525e612118d3ea1de0be97cff74cd137292e72",
|
||||
"sha256": "7901e313780731e3cf06385e5d06a1b6d5d5eba1fc338c461e7d9d12752feb8b",
|
||||
"type": "eql",
|
||||
"version": 108
|
||||
"version": 109
|
||||
},
|
||||
"0c093569-dff9-42b6-87b1-0242d9f7d9b4": {
|
||||
"rule_name": "Processes with Trailing Spaces",
|
||||
@@ -453,10 +465,10 @@
|
||||
"version": 4
|
||||
},
|
||||
"0c1e8fda-4f09-451e-bc77-a192b6cbfc32": {
|
||||
"rule_name": "Potential Hex Payload Execution",
|
||||
"sha256": "3456061187c38a314b38c9a31cb4ea2fb3594e97fbd1609a97bf92e84844b66a",
|
||||
"rule_name": "Potential Hex Payload Execution via Common Utility",
|
||||
"sha256": "a136e060e489b1167082f3e16ebc4c713b7e08625e160cbd77e3d51aca074a75",
|
||||
"type": "eql",
|
||||
"version": 104
|
||||
"version": 105
|
||||
},
|
||||
"0c3c80de-08c2-11f0-bd11-f661ea17fbcc": {
|
||||
"rule_name": "Microsoft 365 Illicit Consent Grant via Registered Application",
|
||||
@@ -466,9 +478,9 @@
|
||||
},
|
||||
"0c41e478-5263-4c69-8f9e-7dfd2c22da64": {
|
||||
"rule_name": "Threat Intel IP Address Indicator Match",
|
||||
"sha256": "9507b5aae7440ff10ceb3f3e75dcc178e809320a084d56e616de90e14713d0d6",
|
||||
"sha256": "de0fce0fbcce6580a6a0af3a9cbd36da077ec0b32571149301aaaf7e6b50bc35",
|
||||
"type": "threat_match",
|
||||
"version": 8
|
||||
"version": 9
|
||||
},
|
||||
"0c74cd7e-ea35-11ee-a417-f661ea17fbce": {
|
||||
"min_stack_version": "8.16",
|
||||
@@ -818,10 +830,10 @@
|
||||
"version": 314
|
||||
},
|
||||
"14fa0285-fe78-4843-ac8e-f4b481f49da9": {
|
||||
"rule_name": "Suspicious Azure Sign-in via Visual Studio Code",
|
||||
"sha256": "1c9e0380426503d39ef2ca9cd471260e095452f22de6fc32357fa7d466efebe3",
|
||||
"rule_name": "Microsoft Entra ID OAuth Phishing via Visual Studio Code Client",
|
||||
"sha256": "355d09aa7f902af4b7d694675a700ffd0bbb2af0938dd7e9066cf812f38f59d9",
|
||||
"type": "query",
|
||||
"version": 2
|
||||
"version": 3
|
||||
},
|
||||
"1502a836-84b2-11ef-b026-f661ea17fbcc": {
|
||||
"min_stack_version": "8.15",
|
||||
@@ -905,6 +917,12 @@
|
||||
"type": "eql",
|
||||
"version": 116
|
||||
},
|
||||
"16acac42-b2f9-4802-9290-d6c30914db6e": {
|
||||
"rule_name": "AWS S3 Static Site JavaScript File Uploaded",
|
||||
"sha256": "20bd2d6a25a3247d29f055a381f839fa376d5e2d0456e0752f56973261d69518",
|
||||
"type": "esql",
|
||||
"version": 1
|
||||
},
|
||||
"16fac1a1-21ee-4ca6-b720-458e3855d046": {
|
||||
"rule_name": "Startup/Logon Script added to Group Policy Object",
|
||||
"sha256": "fe5e13f3787fcc982378ee56140edbaf40dae2433b59f7317df27287c7e6ced4",
|
||||
@@ -974,9 +992,9 @@
|
||||
},
|
||||
"17c7f6a5-5bc9-4e1f-92bf-13632d24384d": {
|
||||
"rule_name": "Renamed Utility Executed with Short Program Name",
|
||||
"sha256": "1453414b423b8754df625603ea2ce2069d74eca4075160463d70a276368a69bf",
|
||||
"sha256": "6c0b709419e710b9953271ff0aa4b3e8b65f2d986d5c626cd89a69f0d43d4fba",
|
||||
"type": "eql",
|
||||
"version": 213
|
||||
"version": 214
|
||||
},
|
||||
"17e68559-b274-4948-ad0b-f8415bb31126": {
|
||||
"rule_name": "Unusual Network Destination Domain Name",
|
||||
@@ -1162,6 +1180,12 @@
|
||||
"type": "query",
|
||||
"version": 209
|
||||
},
|
||||
"1d0027d4-6717-4a37-bad8-531d8e9fe53f": {
|
||||
"rule_name": "Potential Hex Payload Execution via Command-Line",
|
||||
"sha256": "6d381f28d6712557d51510f72fea18893a54a40f197b78c872099ec7b38ff31a",
|
||||
"type": "eql",
|
||||
"version": 1
|
||||
},
|
||||
"1d276579-3380-4095-ad38-e596a01bc64f": {
|
||||
"rule_name": "Remote File Download via Script Interpreter",
|
||||
"sha256": "e208abb63a46c842bbc761775a0e3ad1957b29ace3b55ba082ad3794d5179585",
|
||||
@@ -1278,9 +1302,9 @@
|
||||
},
|
||||
"1fe3b299-fbb5-4657-a937-1d746f2c711a": {
|
||||
"rule_name": "Unusual Network Activity from a Windows System Binary",
|
||||
"sha256": "bc2ec24a4af292ef9e6cd45b4093c5829cf768c36abde80b14cb1fe39d8f449f",
|
||||
"sha256": "38724353e2d175e82b9c7c4753a791e19c86f84761694f541d34bdee579710e2",
|
||||
"type": "eql",
|
||||
"version": 216
|
||||
"version": 217
|
||||
},
|
||||
"2003cdc8-8d83-4aa5-b132-1f9a8eb48514": {
|
||||
"rule_name": "Exploit - Detected - Elastic Endgame",
|
||||
@@ -1681,9 +1705,9 @@
|
||||
},
|
||||
"290aca65-e94d-403b-ba0f-62f320e63f51": {
|
||||
"rule_name": "UAC Bypass Attempt via Windows Directory Masquerading",
|
||||
"sha256": "3b4c39f2882d137e5d6fdc8191102f01353f46b329be10d552a428fb315ea3d4",
|
||||
"sha256": "4bd4408885e9a117457d761703a208973169337ceb574c33f517d95f9b2e4c11",
|
||||
"type": "eql",
|
||||
"version": 319
|
||||
"version": 320
|
||||
},
|
||||
"2917d495-59bd-4250-b395-c29409b76086": {
|
||||
"rule_name": "Web Shell Detection: Script Process Child of Common Web Processes",
|
||||
@@ -1725,6 +1749,12 @@
|
||||
"type": "eql",
|
||||
"version": 108
|
||||
},
|
||||
"2a3f38a8-204e-11f0-9c1f-f661ea17fbcd": {
|
||||
"rule_name": "Microsoft Graph First Occurrence of Client Request",
|
||||
"sha256": "6b466d820148d0cfc60bfd789a05cff1216e302972ec381bde5a8b6b44f6350c",
|
||||
"type": "new_terms",
|
||||
"version": 1
|
||||
},
|
||||
"2a692072-d78d-42f3-a48a-775677d79c4e": {
|
||||
"rule_name": "Potential Code Execution via Postgresql",
|
||||
"sha256": "28deb348694abf862e1107f51e2ab84f574cb8042b7d896e63059d608eae04db",
|
||||
@@ -1818,9 +1848,9 @@
|
||||
},
|
||||
"2e1e835d-01e5-48ca-b9fc-7a61f7f11902": {
|
||||
"rule_name": "Renamed AutoIt Scripts Interpreter",
|
||||
"sha256": "f7fd03f6bb642751c8c84323618c5b1a09634e759d073b4e660cb0e1888d3076",
|
||||
"sha256": "346cfb86eb74a1e77bd73e70d038d603a95b362a252c0cdbe98266cdeee937f9",
|
||||
"type": "eql",
|
||||
"version": 214
|
||||
"version": 215
|
||||
},
|
||||
"2e29e96a-b67c-455a-afe4-de6183431d0d": {
|
||||
"rule_name": "Potential Process Injection via PowerShell",
|
||||
@@ -1882,9 +1912,9 @@
|
||||
},
|
||||
"2f95540c-923e-4f57-9dae-de30169c68b9": {
|
||||
"rule_name": "Suspicious /proc/maps Discovery",
|
||||
"sha256": "8d3db01563b48467d6fd4b2aa637ef1c2b2410aa1c67802581ef4b79b235b26a",
|
||||
"sha256": "9bcfd15c8355e1483f675042cfb8851e541357ff83b2185fcd81ded9aee9acbf",
|
||||
"type": "eql",
|
||||
"version": 6
|
||||
"version": 7
|
||||
},
|
||||
"2fba96c0-ade5-4bce-b92f-a5df2509da3f": {
|
||||
"rule_name": "Startup Folder Persistence via Unsigned Process",
|
||||
@@ -1997,9 +2027,9 @@
|
||||
},
|
||||
"32c5cf9c-2ef8-4e87-819e-5ccb7cd18b14": {
|
||||
"rule_name": "Program Files Directory Masquerading",
|
||||
"sha256": "59001814aa3aee713cc6e7bd49678f75d75363103875f34b994312a15929baa9",
|
||||
"sha256": "7470d9183ce2433624a34e3d26ef66ef89f44a88977db1b7cc0d60171ae98b2a",
|
||||
"type": "eql",
|
||||
"version": 316
|
||||
"version": 317
|
||||
},
|
||||
"32d3ad0e-6add-11ef-8c7b-f661ea17fbcc": {
|
||||
"rule_name": "Microsoft 365 Portal Login from Rare Location",
|
||||
@@ -2081,9 +2111,9 @@
|
||||
},
|
||||
"35ab3cfa-6c67-11ef-ab4d-f661ea17fbcc": {
|
||||
"rule_name": "Azure Entra Sign-in Brute Force against Microsoft 365 Accounts",
|
||||
"sha256": "3f28423faced2b8aa0493681362683f095c9464aa5ecb67465ac44f2694aefc3",
|
||||
"sha256": "93996a82dfb600e7e40a0bc6c930c29592b522b81f785c3d11c67bd43e234bbe",
|
||||
"type": "esql",
|
||||
"version": 3
|
||||
"version": 4
|
||||
},
|
||||
"35c029c3-090e-4a25-b613-0b8099970fc1": {
|
||||
"rule_name": "File System Debugger Launched Inside a Container",
|
||||
@@ -2109,6 +2139,13 @@
|
||||
"type": "eql",
|
||||
"version": 100
|
||||
},
|
||||
"36188365-f88f-4f70-8c1d-0b9554186b9c": {
|
||||
"min_stack_version": "8.17",
|
||||
"rule_name": "Suspicious Microsoft 365 UserLoggedIn via OAuth Code",
|
||||
"sha256": "e65cd735fc5838b036a00de0f93ac57a0a0bd8463796719fe697884b902b45c2",
|
||||
"type": "esql",
|
||||
"version": 1
|
||||
},
|
||||
"3688577a-d196-11ec-90b0-f661ea17fbce": {
|
||||
"rule_name": "Process Started from Process ID (PID) File",
|
||||
"sha256": "6165a31cec72ee460cd8e53b67fe0da967b0f32bbe123f7ad1243b90483dcb9d",
|
||||
@@ -2133,6 +2170,13 @@
|
||||
"type": "eql",
|
||||
"version": 109
|
||||
},
|
||||
"375132c6-25d5-11f0-8745-f661ea17fbcd": {
|
||||
"min_stack_version": "8.17",
|
||||
"rule_name": "Suspicious Activity via Auth Broker On-Behalf-of Principal User",
|
||||
"sha256": "09ed97c79557bbb088d9225dead1bf3c06b746875cf3480922bf1dda5c00e832",
|
||||
"type": "esql",
|
||||
"version": 1
|
||||
},
|
||||
"378f9024-8a0c-46a5-aa08-ce147ac73a4e": {
|
||||
"rule_name": "AWS RDS Security Group Creation",
|
||||
"sha256": "214d63a52ae0355ff3cb42b688eefc344b7968960bacf35052c88b801ce22381",
|
||||
@@ -2260,9 +2304,9 @@
|
||||
},
|
||||
"3a657da0-1df2-11ef-a327-f661ea17fbcc": {
|
||||
"rule_name": "Rapid7 Threat Command CVEs Correlation",
|
||||
"sha256": "c80d00fd7a0f66bc3ada6dcb2ddde1ab42081096a9e817d0fac36426bf2cd5c0",
|
||||
"sha256": "578f758b47b1aead0b38e093c09d6cf0b68b2f4f3b8412cb9e7a7aec89f7c7c9",
|
||||
"type": "threat_match",
|
||||
"version": 106
|
||||
"version": 107
|
||||
},
|
||||
"3a86e085-094c-412d-97ff-2439731e59cb": {
|
||||
"rule_name": "Setgid Bit Set via chmod",
|
||||
@@ -2278,9 +2322,9 @@
|
||||
},
|
||||
"3ad49c61-7adc-42c1-b788-732eda2f5abf": {
|
||||
"rule_name": "VNC (Virtual Network Computing) to the Internet",
|
||||
"sha256": "b6a2ba7591ab0a1fc469eab313eccd9ca24affb4bd4ff94db89cdba0b97f6428",
|
||||
"sha256": "b2370cf022a97844dc68bdabfcf7602ace007aad1da28145f9832a3f8104bcc9",
|
||||
"type": "query",
|
||||
"version": 108
|
||||
"version": 109
|
||||
},
|
||||
"3ad77ed4-4dcf-4c51-8bfc-e3f7ce316b2f": {
|
||||
"rule_name": "Azure Full Network Packet Capture Detected",
|
||||
@@ -2294,6 +2338,12 @@
|
||||
"type": "new_terms",
|
||||
"version": 206
|
||||
},
|
||||
"3aff6ab1-18bd-427e-9d4c-c5732110c261": {
|
||||
"rule_name": "Suspicious Kernel Feature Activity",
|
||||
"sha256": "2aea6a63cd41bc04ea0527bbc86981121ebca4879eb2eb9d8f6ddaec2ce0707c",
|
||||
"type": "eql",
|
||||
"version": 1
|
||||
},
|
||||
"3b382770-efbb-44f4-beed-f5e0a051b895": {
|
||||
"rule_name": "Malware - Prevented - Elastic Endgame",
|
||||
"sha256": "e1d1e24c41ffc15f2af27ca5bffcae7132edad1fef3f0ae1b8f21d8428eedda5",
|
||||
@@ -2606,9 +2656,9 @@
|
||||
},
|
||||
"4494c14f-5ff8-4ed2-8e99-bf816a1642fc": {
|
||||
"rule_name": "Potential Masquerading as VLC DLL",
|
||||
"sha256": "f15038ae4344dcb38d5ba6172cc940da97d498883df8610fd8faa971dc5b44b4",
|
||||
"sha256": "a3ea7556a748c2042b4ddc53356093c97193a916b4a367701ae9c45c75e2d656",
|
||||
"type": "eql",
|
||||
"version": 6
|
||||
"version": 7
|
||||
},
|
||||
"44fc462c-1159-4fa8-b1b7-9b6296ab4f96": {
|
||||
"rule_name": "Multiple Vault Web Credentials Read",
|
||||
@@ -2857,6 +2907,12 @@
|
||||
"type": "eql",
|
||||
"version": 111
|
||||
},
|
||||
"4d4cda2b-9aad-4702-a0a2-75952bd6a77c": {
|
||||
"rule_name": "Docker Release File Creation",
|
||||
"sha256": "e69728a04762799ea77a818bd6785703f743349e053f964fb09450026a8673e8",
|
||||
"type": "eql",
|
||||
"version": 1
|
||||
},
|
||||
"4d50a94f-2844-43fa-8395-6afbd5e1c5ef": {
|
||||
"rule_name": "AWS Management Console Brute Force of Root User Identity",
|
||||
"sha256": "46fed600c5e09c71e595ea8fba723e6da3eca531ac34ece084bb236a5755e711",
|
||||
@@ -3181,6 +3237,12 @@
|
||||
"type": "query",
|
||||
"version": 107
|
||||
},
|
||||
"56d9cf6c-46ea-4019-9c7f-b1fdb855fee3": {
|
||||
"rule_name": "Windows Sandbox with Sensitive Configuration",
|
||||
"sha256": "0c9f1706280b782810bf6ccd063b4deed9971dc5412cf44d75abe2c39ebe77a1",
|
||||
"type": "eql",
|
||||
"version": 1
|
||||
},
|
||||
"56f2e9b5-4803-4e44-a0a4-a52dc79d57fe": {
|
||||
"rule_name": "PowerShell PSReflect Script",
|
||||
"sha256": "09a841c5118a34b8d536f6f40cebadb5f41059cc12cbb7dc807ab4f32267e616",
|
||||
@@ -3195,9 +3257,9 @@
|
||||
},
|
||||
"5700cb81-df44-46aa-a5d7-337798f53eb8": {
|
||||
"rule_name": "VNC (Virtual Network Computing) from the Internet",
|
||||
"sha256": "0055101a29bb46804594e616a1fb0e62a567e48bf58e98bbe2a8990cb85d2062",
|
||||
"sha256": "a2ea199f37920a1f0bdc7b5a401338b7ac2ee4316586ee61f879f019c7fb7854",
|
||||
"type": "query",
|
||||
"version": 108
|
||||
"version": 109
|
||||
},
|
||||
"571afc56-5ed9-465d-a2a9-045f099f6e7e": {
|
||||
"rule_name": "Credential Dumping - Detected - Elastic Endgame",
|
||||
@@ -3363,9 +3425,9 @@
|
||||
},
|
||||
"5b9eb30f-87d6-45f4-9289-2bf2024f0376": {
|
||||
"rule_name": "Potential Masquerading as Browser Process",
|
||||
"sha256": "90722676fc3482cf3fcc632d3839a2322055842c94ad4453e5894f27f4f0d5be",
|
||||
"sha256": "4556a2b4d9ae5c0709537287d7c352c49fd07266ec3e249028df8c684d8e7bf2",
|
||||
"type": "eql",
|
||||
"version": 8
|
||||
"version": 9
|
||||
},
|
||||
"5bb4a95d-5a08-48eb-80db-4c3a63ec78a8": {
|
||||
"rule_name": "Suspicious PrintSpooler Service Executable File Creation",
|
||||
@@ -3549,10 +3611,10 @@
|
||||
"version": 105
|
||||
},
|
||||
"60b6b72f-0fbc-47e7-9895-9ba7627a8b50": {
|
||||
"rule_name": "Azure Service Principal Addition",
|
||||
"sha256": "7b36fcc6fddc87334292d6d23375b7707e2226c08877b6c0bb2e0e45b24a1d12",
|
||||
"rule_name": "Microsoft Entra ID Service Principal Created",
|
||||
"sha256": "040d3f31d90baa93524c9d627ffa97109ff4d5c31aefaaf89ce9fc0328943d37",
|
||||
"type": "query",
|
||||
"version": 107
|
||||
"version": 108
|
||||
},
|
||||
"60f3adec-1df9-4104-9c75-b97d9f078b25": {
|
||||
"rule_name": "Microsoft 365 Exchange DLP Policy Removed",
|
||||
@@ -3702,6 +3764,18 @@
|
||||
"type": "eql",
|
||||
"version": 10
|
||||
},
|
||||
"64f17c52-6c6e-479e-ba72-236f3df18f3d": {
|
||||
"rule_name": "Potential PowerShell Obfuscation via Invalid Escape Sequences",
|
||||
"sha256": "64241fbdce4cbe75d6d49945bec0a265cc28502d993e961ef207916659bbc716",
|
||||
"type": "esql",
|
||||
"version": 1
|
||||
},
|
||||
"6505e02e-28dd-41cd-b18f-64e649caa4e2": {
|
||||
"rule_name": "Manual Memory Dumping via Proc Filesystem",
|
||||
"sha256": "cadd4e933cec02287cd0565c61b5e29461fa812caca34ded53b59c7f76178960",
|
||||
"type": "eql",
|
||||
"version": 1
|
||||
},
|
||||
"6506c9fd-229e-4722-8f0f-69be759afd2a": {
|
||||
"rule_name": "Potential PrintNightmare Exploit Registry Modification",
|
||||
"sha256": "2835937a732bcb071b232eba9fe5f11b5f7ea8c7742eec0640d79cca3fcea621",
|
||||
@@ -3714,6 +3788,18 @@
|
||||
"type": "eql",
|
||||
"version": 204
|
||||
},
|
||||
"65613f5e-0d48-4b55-ad61-2fb9567cb1ad": {
|
||||
"rule_name": "Unusual LD_PRELOAD/LD_LIBRARY_PATH Command Line Arguments",
|
||||
"sha256": "495c77459d5c7193c167c816fe4cb017286a535b5705c66218d0fc37b42d346d",
|
||||
"type": "new_terms",
|
||||
"version": 1
|
||||
},
|
||||
"656739a8-2786-402b-8ee1-22e0762b63ba": {
|
||||
"rule_name": "Unusual Execution from Kernel Thread (kthreadd) Parent",
|
||||
"sha256": "91ae1485f517bfb8d8bf97a97a6efe29953b281d59a10bc34df0943467c1f8a7",
|
||||
"type": "new_terms",
|
||||
"version": 1
|
||||
},
|
||||
"65f9bccd-510b-40df-8263-334f03174fed": {
|
||||
"rule_name": "Kubernetes Exposed Service Created With Type NodePort",
|
||||
"sha256": "4b78114f6789b0bf0527251a185abee1d63381ecaabbd0157002c95d4a3b74a9",
|
||||
@@ -3762,9 +3848,9 @@
|
||||
},
|
||||
"66883649-f908-4a5b-a1e0-54090a1d3a32": {
|
||||
"rule_name": "Connection to Commonly Abused Web Services",
|
||||
"sha256": "5cdc19acb10ce775e182f1bfcd2a8c42e6f01433799682e833746111a950433b",
|
||||
"sha256": "6a43a05f6e5d1f479ce30211a8231a9e75a714f6cbcc39539e36e4ea0d69677b",
|
||||
"type": "eql",
|
||||
"version": 119
|
||||
"version": 120
|
||||
},
|
||||
"66c058f3-99f4-4d18-952b-43348f2577a0": {
|
||||
"rule_name": "Linux Process Hooking via GDB",
|
||||
@@ -3806,6 +3892,13 @@
|
||||
"type": "query",
|
||||
"version": 209
|
||||
},
|
||||
"6756ee27-9152-479b-9b73-54b5bbda301c": {
|
||||
"min_stack_version": "8.17",
|
||||
"rule_name": "Rare Connection to WebDAV Target",
|
||||
"sha256": "92b9fe3e356e788ab08e04b80551d2c955982681d6c01d7bd8b098d0720ece71",
|
||||
"type": "esql",
|
||||
"version": 1
|
||||
},
|
||||
"676cff2b-450b-4cf1-8ed2-c0c58a4a2dd7": {
|
||||
"min_stack_version": "8.15",
|
||||
"previous": {
|
||||
@@ -3910,6 +4003,12 @@
|
||||
"type": "eql",
|
||||
"version": 213
|
||||
},
|
||||
"68e90a9b-0eab-425e-be3b-902b0cd1fe9c": {
|
||||
"rule_name": "Suspicious Path Mounted",
|
||||
"sha256": "664ec378782177a9812b671daa037398f82d9dfa26df837de9a3d88cd95f0e6b",
|
||||
"type": "eql",
|
||||
"version": 1
|
||||
},
|
||||
"6951f15e-533c-4a60-8014-a3c3ab851a1b": {
|
||||
"rule_name": "AWS KMS Customer Managed Key Disabled or Scheduled for Deletion",
|
||||
"sha256": "dd12550a3cff20c4f63fc6067d74d35429245b167537619b73a3d2a44d4250db",
|
||||
@@ -4014,9 +4113,9 @@
|
||||
},
|
||||
"6cf17149-a8e3-44ec-9ec9-fdc8535547a1": {
|
||||
"rule_name": "Suspicious Outlook Child Process",
|
||||
"sha256": "5a47a69e0e2c603dc63ba05bd15d6dc1eff858bd9c72ad7fd9cb5ae65aafe9ed",
|
||||
"sha256": "ead3bdb03abbff29fb244e73d16f7594a5225127c4cf750abe0bb59b4f881ff9",
|
||||
"type": "eql",
|
||||
"version": 3
|
||||
"version": 4
|
||||
},
|
||||
"6d448b96-c922-4adb-b51c-b767f1ea5b76": {
|
||||
"rule_name": "Unusual Process For a Windows Host",
|
||||
@@ -4030,6 +4129,12 @@
|
||||
"type": "eql",
|
||||
"version": 8
|
||||
},
|
||||
"6ddb6c33-00ce-4acd-832a-24b251512023": {
|
||||
"rule_name": "Potential PowerShell Obfuscation via Special Character Overuse",
|
||||
"sha256": "d76b1ae821692910302705f22322c89936e5db62bfe2fa3a8f3b3b2f747eb1ed",
|
||||
"type": "esql",
|
||||
"version": 1
|
||||
},
|
||||
"6ded0996-7d4b-40f2-bf4a-6913e7591795": {
|
||||
"rule_name": "Root Certificate Installation",
|
||||
"sha256": "00c16c5651bd3bfbc8171580c45de1fe5d519dfd069eeb0a487d3209b1041f9d",
|
||||
@@ -4038,9 +4143,9 @@
|
||||
},
|
||||
"6e1a2cc4-d260-11ed-8829-f661ea17fbcc": {
|
||||
"rule_name": "First Time Seen Commonly Abused Remote Access Tool Execution",
|
||||
"sha256": "826cfd4fe378e2c7e5056644acf29a6839bf1584ce6c27d48dd9cd8035d0b84d",
|
||||
"sha256": "1014d1cd366887b7e055bf5e1f2c3ca6c34aa7b148deb9e055bb027e08f614f3",
|
||||
"type": "new_terms",
|
||||
"version": 111
|
||||
"version": 112
|
||||
},
|
||||
"6e2355cc-c60a-4d92-a80c-e54a45ad2400": {
|
||||
"rule_name": "Loadable Kernel Module Configuration File Creation",
|
||||
@@ -4068,9 +4173,9 @@
|
||||
},
|
||||
"6ea41894-66c3-4df7-ad6b-2c5074eb3df8": {
|
||||
"rule_name": "Potential Windows Error Manager Masquerading",
|
||||
"sha256": "80b979e17fd99eacffbc0ba5f09ee05cc50d70ce7114ea41704833ba42e4decb",
|
||||
"sha256": "eec393cdeeee96acead27b0a15500be1195c020ebfdcc3d880d99c8583ce3e8b",
|
||||
"type": "eql",
|
||||
"version": 212
|
||||
"version": 213
|
||||
},
|
||||
"6ea55c81-e2ba-42f2-a134-bccf857ba922": {
|
||||
"rule_name": "Security Software Discovery using WMIC",
|
||||
@@ -4084,6 +4189,12 @@
|
||||
"type": "query",
|
||||
"version": 100
|
||||
},
|
||||
"6eb862bb-013d-4d4f-a14b-341433ca1a1f": {
|
||||
"rule_name": "Unusual Exim4 Child Process",
|
||||
"sha256": "c32d2132e275f837c86612882a7015d3614d567d7d3e2dc56b0e4d8b78c00dd1",
|
||||
"type": "new_terms",
|
||||
"version": 1
|
||||
},
|
||||
"6ee947e9-de7e-4281-a55d-09289bdf947e": {
|
||||
"rule_name": "Potential Linux Tunneling and/or Port Forwarding",
|
||||
"sha256": "249f8c3e30b2ff141fc384b2cc2eb539fb5abacd8eb8f3414dc1199c2ee1997a",
|
||||
@@ -4137,6 +4248,12 @@
|
||||
"type": "machine_learning",
|
||||
"version": 3
|
||||
},
|
||||
"70089609-c41a-438e-b132-5b3b43c5fc07": {
|
||||
"rule_name": "Git Repository or File Download to Suspicious Directory",
|
||||
"sha256": "04bdca22dc0c1ade781d83503d7b064d3bcc8eabe7882afcd821c1340b6d2a54",
|
||||
"type": "eql",
|
||||
"version": 1
|
||||
},
|
||||
"7020ff25-76d7-4a7d-b95b-266cf27d70e8": {
|
||||
"rule_name": "Unusual Interactive Process Launched in a Container",
|
||||
"sha256": "7e4aba06e06e21dbd41febca8830202c92f2a6b4efc7a54d9065b8c0d2ff9615",
|
||||
@@ -4432,9 +4549,9 @@
|
||||
},
|
||||
"78de1aeb-5225-4067-b8cc-f4a1de8a8546": {
|
||||
"rule_name": "Suspicious ScreenConnect Client Child Process",
|
||||
"sha256": "b2af2eb4c4507e179708ae45739bd4e802073b963692fb938563be7c3b9ed827",
|
||||
"sha256": "030f794bc9fe8acd0c6e7d24f93ccf1656808b54cd87b4027d431fabc125dce0",
|
||||
"type": "eql",
|
||||
"version": 311
|
||||
"version": 312
|
||||
},
|
||||
"78e9b5d5-7c07-40a7-a591-3dbbf464c386": {
|
||||
"rule_name": "Suspicious File Renamed via SMB",
|
||||
@@ -4484,9 +4601,9 @@
|
||||
},
|
||||
"79ce2c96-72f7-44f9-88ef-60fa1ac2ce47": {
|
||||
"rule_name": "Potential Masquerading as System32 Executable",
|
||||
"sha256": "31586bc64891535b1dbfb6342c1f325514d202bb159cc197b78c5d1cfb7bbfc6",
|
||||
"sha256": "8b980b38e01743202bf213e8e3a1684119d087b4ece47c02ca74498829afa271",
|
||||
"type": "eql",
|
||||
"version": 7
|
||||
"version": 8
|
||||
},
|
||||
"79e7291f-9e3b-4a4b-9823-800daa89c8f9": {
|
||||
"rule_name": "Linux User Account Credential Modification",
|
||||
@@ -4720,6 +4837,12 @@
|
||||
"type": "machine_learning",
|
||||
"version": 7
|
||||
},
|
||||
"8167c5ae-3310-439a-8a58-be60f55023d2": {
|
||||
"rule_name": "Suspicious Named Pipe Creation",
|
||||
"sha256": "07b9e8be3e6bf5bcaacd776d6b7b2c423ceb3f58790d0aab5402bd3fa2bd80dd",
|
||||
"type": "new_terms",
|
||||
"version": 1
|
||||
},
|
||||
"818e23e6-2094-4f0e-8c01-22d30f3506c6": {
|
||||
"rule_name": "PowerShell Script Block Logging Disabled",
|
||||
"sha256": "a74e2f1d576685aa6609e515d8f65b5beafaa71340e79e88d1d6c46e50c4ae67",
|
||||
@@ -4834,6 +4957,13 @@
|
||||
"type": "new_terms",
|
||||
"version": 213
|
||||
},
|
||||
"85e2d45e-a3df-4acf-83d3-21805f564ff4": {
|
||||
"min_stack_version": "8.17",
|
||||
"rule_name": "Potential PowerShell Obfuscation via Character Array Reconstruction",
|
||||
"sha256": "acaa59b7068789551c4bea35c19e1d53a5768954e4d110604a5b2a1b6271db39",
|
||||
"type": "esql",
|
||||
"version": 1
|
||||
},
|
||||
"860f2a03-a1cf-48d6-a674-c6d62ae608a1": {
|
||||
"rule_name": "Potential Subnet Scanning Activity from Compromised Host",
|
||||
"sha256": "f19ae4741867c9e307e5b163c103be3d72c01d955948a27d31a083ae0429b059",
|
||||
@@ -5269,6 +5399,12 @@
|
||||
"type": "query",
|
||||
"version": 212
|
||||
},
|
||||
"929d0766-204b-11f0-9c1f-f661ea17fbcd": {
|
||||
"rule_name": "Microsoft 365 OAuth Phishing via Visual Studio Code Client",
|
||||
"sha256": "69ec4930f25e7ceca53b47c161c1c163a656a0077256cf62957b709a3059adaa",
|
||||
"type": "query",
|
||||
"version": 1
|
||||
},
|
||||
"92a6faf5-78ec-4e25-bea1-73bacc9b59d9": {
|
||||
"rule_name": "A scheduled task was created",
|
||||
"sha256": "7934e4ed22a27c1b5d20983cf6b8666433a3535dff45e1cefc66f45152fedb52",
|
||||
@@ -5455,6 +5591,12 @@
|
||||
"type": "eql",
|
||||
"version": 212
|
||||
},
|
||||
"96f29282-ffcc-4ce7-834b-b17aee905568": {
|
||||
"rule_name": "Potential Backdoor Execution Through PAM_EXEC",
|
||||
"sha256": "e0628fafd4d2de9e48bffda8abdf7a7bdfd937583ca7bbe0bb57e64259c96807",
|
||||
"type": "eql",
|
||||
"version": 1
|
||||
},
|
||||
"97020e61-e591-4191-8a3b-2861a2b887cd": {
|
||||
"rule_name": "SeDebugPrivilege Enabled by a Suspicious Process",
|
||||
"sha256": "721369ff74415e524db18c08b07e924d7fc2afb77dd0de54c0094712ccad6b66",
|
||||
@@ -5527,9 +5669,9 @@
|
||||
},
|
||||
"97db8b42-69d8-4bf3-9fd4-c69a1d895d68": {
|
||||
"rule_name": "Suspicious Renaming of ESXI Files",
|
||||
"sha256": "7db18f569abc0cbcbb84d08ac015a927b5bed00d412d4e7b78c79820c8bb2fc8",
|
||||
"sha256": "44f27c7249bafcc36b63740acc5ee15d6ece8db5bbc0d0a3feb7507e1c6ba859",
|
||||
"type": "eql",
|
||||
"version": 10
|
||||
"version": 11
|
||||
},
|
||||
"97f22dab-84e8-409d-955e-dacd1d31670b": {
|
||||
"rule_name": "Base64 Encoding/Decoding Activity",
|
||||
@@ -5737,9 +5879,9 @@
|
||||
},
|
||||
"9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae4": {
|
||||
"rule_name": "Microsoft Build Engine Using an Alternate Name",
|
||||
"sha256": "747b24053c4fc97f684dbcccf202bc97241610d6eb5f8a4c1bb90a5b4bdbb012",
|
||||
"sha256": "10b96f4738dafa6bded0fab598bd190860ba5bad82262b599f9db0e32d0effec",
|
||||
"type": "eql",
|
||||
"version": 216
|
||||
"version": 217
|
||||
},
|
||||
"9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae5": {
|
||||
"rule_name": "Potential Credential Access via Trusted Developer Utility",
|
||||
@@ -5777,6 +5919,12 @@
|
||||
"type": "new_terms",
|
||||
"version": 4
|
||||
},
|
||||
"9edd1804-83c7-4e48-b97d-c776b4c97564": {
|
||||
"rule_name": "PowerShell Obfuscation via Negative Index String Reversal",
|
||||
"sha256": "6a515fb5dd38fdc765201c0cd3ed8ab1bfbfbea0dbe8f0f6aa079de7770fcc26",
|
||||
"type": "esql",
|
||||
"version": 1
|
||||
},
|
||||
"9efb3f79-b77b-466a-9fa0-3645d22d1e7f": {
|
||||
"rule_name": "AWS RDS DB Instance Made Public",
|
||||
"sha256": "6ab37a0c54d41e81d56ba27c0ad3dcac227dc7a8f82cd0f4324da20cc757080b",
|
||||
@@ -5916,6 +6064,12 @@
|
||||
"type": "machine_learning",
|
||||
"version": 3
|
||||
},
|
||||
"a3cc60d8-2701-11f0-accf-f661ea17fbcd": {
|
||||
"rule_name": "Microsoft Entra ID SharePoint Access for User Principal via Auth Broker",
|
||||
"sha256": "411113088ba431184790b1d524a1f56f33cb24eee23e03dedb7ce9738bc5accf",
|
||||
"type": "new_terms",
|
||||
"version": 1
|
||||
},
|
||||
"a3ea12f3-0d4e-4667-8b44-4230c63f3c75": {
|
||||
"rule_name": "Execution via local SxS Shared Module",
|
||||
"sha256": "be27eb9ce31990ab750298238c182e7525e554dcd7e2cc6e8f4df99b787e93e0",
|
||||
@@ -5978,9 +6132,9 @@
|
||||
},
|
||||
"a61809f3-fb5b-465c-8bff-23a8a068ac60": {
|
||||
"rule_name": "Threat Intel Windows Registry Indicator Match",
|
||||
"sha256": "c061bcef15efcf1c65649493512805d27d383b262ef29f1ee14d2c941e88724e",
|
||||
"sha256": "13b8297ead30f89bf1e834ac869dc0d250d9ed0b8604dea85acc5c85584ada84",
|
||||
"type": "threat_match",
|
||||
"version": 8
|
||||
"version": 9
|
||||
},
|
||||
"a624863f-a70d-417f-a7d2-7a404638d47f": {
|
||||
"rule_name": "Suspicious MS Office Child Process",
|
||||
@@ -6124,9 +6278,9 @@
|
||||
},
|
||||
"aab184d3-72b3-4639-b242-6597c99d8bca": {
|
||||
"rule_name": "Threat Intel Hash Indicator Match",
|
||||
"sha256": "dc906d8e338b0fba7e19f677e0f95691c4e1c94fab8b366f0f0fa007db2226e3",
|
||||
"sha256": "e2a2498e73e3f61c27758713a85c042b5c136d49093f9f6e33faaf38267ece36",
|
||||
"type": "threat_match",
|
||||
"version": 9
|
||||
"version": 10
|
||||
},
|
||||
"aabdad51-51fb-4a66-9d82-3873e42accb8": {
|
||||
"rule_name": "GRUB Configuration Generation through Built-in Utilities",
|
||||
@@ -6280,9 +6434,9 @@
|
||||
},
|
||||
"adbfa3ee-777e-4747-b6b0-7bd645f30880": {
|
||||
"rule_name": "Suspicious Communication App Child Process",
|
||||
"sha256": "9a7e55186da7bb8bb06595190c224e34c6a2398d73114e8a0be6f1e650841c65",
|
||||
"sha256": "4dd926efe49fd806e22c5d0294e28655370604c5b7d73e7499fba2a4d567406a",
|
||||
"type": "eql",
|
||||
"version": 9
|
||||
"version": 10
|
||||
},
|
||||
"ae343298-97bc-47bc-9ea2-5f2ad831c16e": {
|
||||
"rule_name": "Suspicious File Creation via Kworker",
|
||||
@@ -6302,6 +6456,12 @@
|
||||
"type": "new_terms",
|
||||
"version": 13
|
||||
},
|
||||
"af1e36fe-0abd-4463-b5ec-4e276dec0b26": {
|
||||
"rule_name": "Linux Telegram API Request",
|
||||
"sha256": "52c40932bf4b8be27d66e7e3ad83e11afae602be847fa068608f0afc3202c8fa",
|
||||
"type": "eql",
|
||||
"version": 1
|
||||
},
|
||||
"af22d970-7106-45b4-b5e3-460d15333727": {
|
||||
"rule_name": "First Occurrence of Entra ID Auth via DeviceCode Protocol",
|
||||
"sha256": "c2f5295802a072f58704ecc1fefd7e82f1c0e495c6d850576988c946ac0b99f3",
|
||||
@@ -6362,6 +6522,12 @@
|
||||
"type": "new_terms",
|
||||
"version": 3
|
||||
},
|
||||
"b0c98cfb-0745-4513-b6f9-08dddb033490": {
|
||||
"rule_name": "Potential Dynamic IEX Reconstruction via Environment Variables",
|
||||
"sha256": "dee59afe352e3dde84cb787a5b882671fedd5be95a52c8a0d13c42f200733edb",
|
||||
"type": "esql",
|
||||
"version": 1
|
||||
},
|
||||
"b15a15f2-becf-475d-aa69-45c9e0ff1c49": {
|
||||
"rule_name": "Hidden Directory Creation via Unusual Parent",
|
||||
"sha256": "0cf427bce0665a9f2c65ff8c2a3e0e55c2def5a3360f8fe744de9f85b85354ac",
|
||||
@@ -6394,9 +6560,9 @@
|
||||
},
|
||||
"b25a7df2-120a-4db2-bd3f-3e4b86b24bee": {
|
||||
"rule_name": "Remote File Copy via TeamViewer",
|
||||
"sha256": "651ff483f64fb63f8cc4ab6e13211ffe8b3635b379b15115d384e186e15162c9",
|
||||
"sha256": "52aa8a7867e9c06d8ac41bc7e4a521146e2bbbe4c7596ce8c45461962588f3ba",
|
||||
"type": "eql",
|
||||
"version": 215
|
||||
"version": 216
|
||||
},
|
||||
"b2951150-658f-4a60-832f-a00d1e6c6745": {
|
||||
"rule_name": "Microsoft 365 Unusual Volume of File Deletion",
|
||||
@@ -6424,9 +6590,9 @@
|
||||
},
|
||||
"b41a13c6-ba45-4bab-a534-df53d0cfed6a": {
|
||||
"rule_name": "Suspicious Endpoint Security Parent Process",
|
||||
"sha256": "f8eb703e42ab5bac9d27f6e2dce20d18881968fe501b74750fd815bc8cb2023b",
|
||||
"sha256": "ec68f9c712548786f765ae4aae5de06e94390dd91e30f700e8fc56e1c50a61b0",
|
||||
"type": "eql",
|
||||
"version": 317
|
||||
"version": 318
|
||||
},
|
||||
"b43570de-a908-4f7f-8bdb-b2df6ffd8c80": {
|
||||
"rule_name": "Code Signing Policy Modification Through Built-in tools",
|
||||
@@ -6748,9 +6914,21 @@
|
||||
},
|
||||
"bcaa15ce-2d41-44d7-a322-918f9db77766": {
|
||||
"rule_name": "Machine Learning Detected DGA activity using a known SUNBURST DNS domain",
|
||||
"sha256": "d62276e466778109c924b6ef09f4a7e1766e791a1dd1704a25dd18adf48318c1",
|
||||
"sha256": "738bdc893bf3d562e861dbdf7a75427c263f7aaca05a2bb682d878ee38c60a5f",
|
||||
"type": "query",
|
||||
"version": 8
|
||||
"version": 9
|
||||
},
|
||||
"bcf0e362-0a2f-4f5e-9dd8-0d34f901781f": {
|
||||
"rule_name": "Multiple Microsoft Entra ID Protection Alerts by User Principal",
|
||||
"sha256": "0fbdb8e00dba1a4aceb7eb5c70df0824c3d964c15dbf1b26067578febc1ff849",
|
||||
"type": "eql",
|
||||
"version": 1
|
||||
},
|
||||
"bd18f4a3-c4c6-43b9-a1e4-b05e09998110": {
|
||||
"rule_name": "Manual Mount Discovery via /etc/exports or /etc/fstab",
|
||||
"sha256": "b69c93e3dd8a6d6dee653fb069ec54a694c50711b4276a052ff1ef441e216073",
|
||||
"type": "eql",
|
||||
"version": 1
|
||||
},
|
||||
"bd1eadf6-3ac6-4e66-91aa-4a1e6711915f": {
|
||||
"min_stack_version": "8.18",
|
||||
@@ -6807,6 +6985,12 @@
|
||||
"type": "machine_learning",
|
||||
"version": 7
|
||||
},
|
||||
"be70614d-4295-473c-a953-582aef41c865": {
|
||||
"rule_name": "Potential Data Exfiltration Through Curl",
|
||||
"sha256": "e34c903966e6d24219ecd22ca2c41f41adca94ab015eefd057c518fdcbb4a72a",
|
||||
"type": "eql",
|
||||
"version": 1
|
||||
},
|
||||
"be8afaed-4bcd-4e0a-b5f9-5562003dde81": {
|
||||
"rule_name": "Searching for Saved Credentials via VaultCmd",
|
||||
"sha256": "9528420d04a587758e5eaa1726f14ac0ca1f92c1f939f9ed2d5d86484aa588f7",
|
||||
@@ -6833,9 +7017,9 @@
|
||||
},
|
||||
"bfeaf89b-a2a7-48a3-817f-e41829dc61ee": {
|
||||
"rule_name": "Suspicious DLL Loaded for Persistence or Privilege Escalation",
|
||||
"sha256": "3e0b27ff048d8261ff92439e122c0a79ebc9bb9b16e3c3a6f721f2961194140f",
|
||||
"sha256": "daa3134d44070e9b2e92a5b1b3b54adc512807adddf724617180b23c4c8ad666",
|
||||
"type": "eql",
|
||||
"version": 216
|
||||
"version": 217
|
||||
},
|
||||
"c02c8b9f-5e1d-463c-a1b0-04edcdfe1a3d": {
|
||||
"rule_name": "Potential Privacy Control Bypass via Localhost Secure Copy",
|
||||
@@ -6875,9 +7059,9 @@
|
||||
},
|
||||
"c125e48f-6783-41f0-b100-c3bf1b114d16": {
|
||||
"rule_name": "Suspicious Renaming of ESXI index.html File",
|
||||
"sha256": "8e4ac293043d2357ec77100813b1a0ecf9a7cebc7733ae28f859db883ace0b40",
|
||||
"sha256": "7d9cc9a951cd23d851d94e65b88177c5dbecc7e760a584e7e9901538e4d48ba5",
|
||||
"type": "eql",
|
||||
"version": 10
|
||||
"version": 11
|
||||
},
|
||||
"c1812764-0788-470f-8e74-eb4a14d47573": {
|
||||
"rule_name": "AWS EC2 Full Network Packet Capture Detected",
|
||||
@@ -6906,9 +7090,9 @@
|
||||
},
|
||||
"c20cd758-07b1-46a1-b03f-fa66158258b8": {
|
||||
"rule_name": "Unsigned DLL Loaded by a Trusted Process",
|
||||
"sha256": "2ead0220f5d2ad2b9775c3feeba083d18e30adb8250bd892779f52425eac4af7",
|
||||
"sha256": "ed69a0aa73e3375f24b9ec86bacc6ff5e538e05119616cf5514057696690e747",
|
||||
"type": "eql",
|
||||
"version": 104
|
||||
"version": 105
|
||||
},
|
||||
"c24e9a43-f67e-431d-991b-09cdb83b3c0c": {
|
||||
"rule_name": "Active Directory Forced Authentication from Linux Host - SMB Named Pipes",
|
||||
@@ -7208,9 +7392,9 @@
|
||||
},
|
||||
"c9482bfa-a553-4226-8ea2-4959bd4f7923": {
|
||||
"rule_name": "Potential Masquerading as Communication Apps",
|
||||
"sha256": "1da4fa9bbf335388123ea4a8dcd806e9d479156c3e60adbe4194799c816b5412",
|
||||
"sha256": "23228fc4c56544cbca69f1ef27c24aa3f0f936b8efc3ef9cda8e2a21e324185e",
|
||||
"type": "eql",
|
||||
"version": 9
|
||||
"version": 10
|
||||
},
|
||||
"c9e38e64-3f4c-4bf3-ad48-0e61a60ea1fa": {
|
||||
"rule_name": "Credential Manipulation - Prevented - Elastic Endgame",
|
||||
@@ -7462,9 +7646,9 @@
|
||||
},
|
||||
"cff92c41-2225-4763-b4ce-6f71e5bda5e6": {
|
||||
"rule_name": "Execution from Unusual Directory - Command Line",
|
||||
"sha256": "8156042053c728a81a5b64422ea6ca0d60a0ceed08bf531cd99fea69dc23b090",
|
||||
"sha256": "630b88a3364fbe8639133004b3bbe4f833208f2804012fa6a85120ad434c6d85",
|
||||
"type": "eql",
|
||||
"version": 318
|
||||
"version": 319
|
||||
},
|
||||
"cffbaf47-9391-4e09-a83c-1f27d7474826": {
|
||||
"rule_name": "Archive File with Unusual Extension",
|
||||
@@ -7508,6 +7692,12 @@
|
||||
"type": "eql",
|
||||
"version": 5
|
||||
},
|
||||
"d19a2399-f8e2-4b10-80d8-a561ce9d24d1": {
|
||||
"rule_name": "System Binary Symlink to Suspicious Location",
|
||||
"sha256": "043ab30dd06dca1d177e5bdb8c37333afaf55b137ce4582952abe4d6b83e7f9d",
|
||||
"type": "new_terms",
|
||||
"version": 1
|
||||
},
|
||||
"d1e5e410-3e34-412e-9b1f-dd500b3b55cd": {
|
||||
"rule_name": "AWS EC2 Instance Console Login via Assumed Role",
|
||||
"sha256": "1840ab7f88854100732ae36fafc2ed1b21edec5c873a90b4cbf7774e9bc86cc8",
|
||||
@@ -7557,6 +7747,12 @@
|
||||
"type": "eql",
|
||||
"version": 107
|
||||
},
|
||||
"d43f2b43-02a1-4219-8ce9-10929a32a618": {
|
||||
"rule_name": "Potential PowerShell Obfuscation via Backtick-Escaped Variable Expansion",
|
||||
"sha256": "1e64953f57fbf188a817a2d3e5a02e5fabc9f9802b29ac015a8cff430ebfcc8c",
|
||||
"type": "esql",
|
||||
"version": 1
|
||||
},
|
||||
"d461fac0-43e8-49e2-85ea-3a58fe120b4f": {
|
||||
"rule_name": "Shell Execution via Apple Scripting",
|
||||
"sha256": "2527c4142d94796d2b6a29956710c8e839a75d3f11fd53b71390789e00214068",
|
||||
@@ -8124,9 +8320,9 @@
|
||||
},
|
||||
"e2f9fdf5-8076-45ad-9427-41e0e03dc9c2": {
|
||||
"rule_name": "Suspicious Process Execution via Renamed PsExec Executable",
|
||||
"sha256": "8dbc1e2d156ccf0adf6506cf3d0b00cf3990cfcaf775fa36171b762d4c182f8f",
|
||||
"sha256": "6c61c69e5a43bcb87d6fc65f9582b72bb95f5ee8f4dd63f417ee7989e276ebe8",
|
||||
"type": "eql",
|
||||
"version": 214
|
||||
"version": 215
|
||||
},
|
||||
"e2fb5b18-e33c-4270-851e-c3d675c9afcd": {
|
||||
"rule_name": "GCP IAM Role Deletion",
|
||||
@@ -8146,6 +8342,12 @@
|
||||
"type": "eql",
|
||||
"version": 316
|
||||
},
|
||||
"e3bd85e9-7aff-46eb-b60e-20dfc9020d98": {
|
||||
"rule_name": "Microsoft Entra ID Concurrent Sign-Ins with Suspicious Properties",
|
||||
"sha256": "6fecdb0d35593629ba03cc2c1a447db499bd93ec89e820dd5b497a5184c312e7",
|
||||
"type": "esql",
|
||||
"version": 1
|
||||
},
|
||||
"e3c27562-709a-42bd-82f2-3ed926cced19": {
|
||||
"rule_name": "AWS Route53 private hosted zone associated with a VPC",
|
||||
"sha256": "62b824699c2098388d66fdbbe0b8767b5bc602e55a375c10a712423a64f53a8c",
|
||||
@@ -8258,9 +8460,9 @@
|
||||
},
|
||||
"e7075e8d-a966-458e-a183-85cd331af255": {
|
||||
"rule_name": "Default Cobalt Strike Team Server Certificate",
|
||||
"sha256": "1f3ef6b36f94b173b4ee1a03599fb8617465cce585fabb7e8c99523878023049",
|
||||
"sha256": "04bf3e29bdae001d0d6e5252b2e7ffe48bf3768f072adbeb9f4a138613d1a911",
|
||||
"type": "query",
|
||||
"version": 107
|
||||
"version": 108
|
||||
},
|
||||
"e707a7be-cc52-41ac-8ab3-d34b38c20005": {
|
||||
"rule_name": "Potential Credential Access via Memory Dump File Creation",
|
||||
@@ -8507,9 +8709,9 @@
|
||||
},
|
||||
"ebfe1448-7fac-4d59-acea-181bd89b1f7f": {
|
||||
"rule_name": "Process Execution from an Unusual Directory",
|
||||
"sha256": "254c4076dbcd8aee6c2114d39634fd0cadb43e44f7035ca3a9b7c16ba24ee50f",
|
||||
"sha256": "a142efdb2037310db7836d7d03a99bebf545ffb3f5260aeb9930d874603d6d63",
|
||||
"type": "eql",
|
||||
"version": 317
|
||||
"version": 318
|
||||
},
|
||||
"ec604672-bed9-43e1-8871-cf591c052550": {
|
||||
"rule_name": "Deprecated - File Made Executable via Chmod Inside A Container",
|
||||
@@ -8639,6 +8841,12 @@
|
||||
"type": "eql",
|
||||
"version": 111
|
||||
},
|
||||
"ef395dff-be12-4a6e-8919-d87d627c2174": {
|
||||
"rule_name": "Potential Linux Tunneling and/or Port Forwarding via SSH Option",
|
||||
"sha256": "8460a162e279f5fda15d1ca2b73d37efb1578dbea8efc02b713682242c29cf3a",
|
||||
"type": "eql",
|
||||
"version": 1
|
||||
},
|
||||
"ef65e82c-d8b4-4895-9824-5f6bc6166804": {
|
||||
"rule_name": "Deprecated - Potential Container Escape via Modified notify_on_release File",
|
||||
"sha256": "e4750e67d85a5bceb46ee02825a18989d55a065f353791467ac9bdcc98f4cb7a",
|
||||
@@ -8697,6 +8905,13 @@
|
||||
"type": "query",
|
||||
"version": 105
|
||||
},
|
||||
"f0cc239b-67fa-46fc-89d4-f861753a40f5": {
|
||||
"min_stack_version": "8.17",
|
||||
"rule_name": "Microsoft Azure or Mail Sign-in from a Suspicious Source",
|
||||
"sha256": "3596cbeaa0407a5f2e35ddd85a3ee3d81a599369c2fe3cd3fe28a8251fee3da8",
|
||||
"type": "esql",
|
||||
"version": 1
|
||||
},
|
||||
"f0eb70e9-71e9-40cd-813f-bf8e8c812cb1": {
|
||||
"rule_name": "Execution with Explicit Credentials via Scripting",
|
||||
"sha256": "c238de5d2b0c57efaa4780d8e7f5f95a05cf99a2ec8a5840a05e31456acd97c4",
|
||||
@@ -8806,6 +9021,13 @@
|
||||
"type": "eql",
|
||||
"version": 7
|
||||
},
|
||||
"f38633f4-3b31-4c80-b13d-e77c70ce8254": {
|
||||
"min_stack_version": "8.17",
|
||||
"rule_name": "Potential PowerShell Obfuscation via Reverse Keywords",
|
||||
"sha256": "f1e316afb64f4a9a133e5e3d818c57ed93ff99c9d5594d2251e7fa353ff01d9e",
|
||||
"type": "esql",
|
||||
"version": 1
|
||||
},
|
||||
"f391d3fd-219b-42a3-9ba9-2f66eb0155aa": {
|
||||
"rule_name": "Kill Command Execution",
|
||||
"sha256": "f80398ec972742b94bcdaeaa5f360b15ed60a3178453f75e099fa359c543c7de",
|
||||
@@ -8814,9 +9036,9 @@
|
||||
},
|
||||
"f3e22c8b-ea47-45d1-b502-b57b6de950b3": {
|
||||
"rule_name": "Threat Intel URL Indicator Match",
|
||||
"sha256": "d523f9e7b0b0a672bde61148eda10896934ae0f610892a879adf5a29cd789057",
|
||||
"sha256": "155ff4eef509d2fc7fd1c2d2123e8343f5ccec6b90178d7647703aec30eacf8b",
|
||||
"type": "threat_match",
|
||||
"version": 8
|
||||
"version": 9
|
||||
},
|
||||
"f401a0e3-5eeb-4591-969a-f435488e7d12": {
|
||||
"rule_name": "Remote Desktop File Opened from Suspicious Path",
|
||||
@@ -8962,6 +9184,12 @@
|
||||
"type": "new_terms",
|
||||
"version": 4
|
||||
},
|
||||
"f6d8c743-0916-4483-8333-3c6f107e0caa": {
|
||||
"rule_name": "Potential PowerShell Obfuscation via String Concatenation",
|
||||
"sha256": "6169ac41dcca7234b32135552fcb0db95bab95cce4966d55a5e70618ef4c178e",
|
||||
"type": "esql",
|
||||
"version": 1
|
||||
},
|
||||
"f75f65cf-ed04-48df-a7ff-b02a8bfe636e": {
|
||||
"rule_name": "System Hosts File Access",
|
||||
"sha256": "95d21e6f12f573fcfe1c7b40679200ac326659d5bec0e2e78d7729d1967afa05",
|
||||
@@ -9079,9 +9307,15 @@
|
||||
},
|
||||
"f97504ac-1053-498f-aeaa-c6d01e76b379": {
|
||||
"rule_name": "Browser Extension Install",
|
||||
"sha256": "f50efb55c9cb93b9c68c26e6b6f7784021c105ff2797ea09b860350378201692",
|
||||
"sha256": "576be150607dc9afd8fedcd60b859916ff133c1200bc665c1b3be75c7b71afd8",
|
||||
"type": "eql",
|
||||
"version": 205
|
||||
"version": 206
|
||||
},
|
||||
"f9753455-8d55-4ad8-b70a-e07b6f18deea": {
|
||||
"rule_name": "Potential PowerShell Obfuscation via High Special Character Proportion",
|
||||
"sha256": "c4923f00e82b142b5a4bcf2fe72541045e8f469ea7e9a23be38aab17b341cdb5",
|
||||
"type": "esql",
|
||||
"version": 1
|
||||
},
|
||||
"f9790abf-bd0c-45f9-8b5f-d0b74015e029": {
|
||||
"rule_name": "Privileged Account Brute Force",
|
||||
@@ -9105,6 +9339,12 @@
|
||||
"type": "query",
|
||||
"version": 412
|
||||
},
|
||||
"f9abcddc-a05d-4345-a81d-000b79aa5525": {
|
||||
"rule_name": "Potential PowerShell Obfuscation via High Numeric Character Proportion",
|
||||
"sha256": "5049ed89606ac8c5067143066404d7ebf1a25a9bbdebd6935a521f1a126e6ff5",
|
||||
"type": "esql",
|
||||
"version": 1
|
||||
},
|
||||
"fa01341d-6662-426b-9d0c-6d81e33c8a9d": {
|
||||
"rule_name": "Remote File Copy to a Hidden Share",
|
||||
"sha256": "949ebfdb52e937926b2ae1392d29f7242d04e41581e73229ca952e910f0ab35e",
|
||||
@@ -9125,9 +9365,9 @@
|
||||
},
|
||||
"fa488440-04cc-41d7-9279-539387bf2a17": {
|
||||
"rule_name": "Suspicious Antimalware Scan Interface DLL",
|
||||
"sha256": "c6cab592080a85478b1a7365d01fe975532aebc5814a000a5846d5f0b2c1d089",
|
||||
"sha256": "81e3b29bed0ef07c810cc38dc585d1364d27e82d36f56beb75829bab7bdfd7ed",
|
||||
"type": "eql",
|
||||
"version": 317
|
||||
"version": 318
|
||||
},
|
||||
"fac52c69-2646-4e79-89c0-fd7653461010": {
|
||||
"rule_name": "Potential Disabling of AppArmor",
|
||||
@@ -9137,9 +9377,9 @@
|
||||
},
|
||||
"fb01d790-9f74-4e76-97dd-b4b0f7bf6435": {
|
||||
"rule_name": "Potential Masquerading as System32 DLL",
|
||||
"sha256": "d6b409a3770dcc2a77e0a325c528d7efc50c47d9765e9c870b1e56dc20b30e6d",
|
||||
"sha256": "627186aa4c8cd46c699f0dfa1e7aac501e8b503fa2fb1224a6c09fcfe8769fc9",
|
||||
"type": "eql",
|
||||
"version": 107
|
||||
"version": 108
|
||||
},
|
||||
"fb02b8d3-71ee-4af1-bacd-215d23f17efa": {
|
||||
"rule_name": "Network Connection via Registration Utility",
|
||||
@@ -9203,11 +9443,17 @@
|
||||
"type": "new_terms",
|
||||
"version": 206
|
||||
},
|
||||
"fcd2e4be-6ec4-482f-9222-6245367cd738": {
|
||||
"rule_name": "Microsoft 365 OAuth Redirect to Device Registration for User Principal",
|
||||
"sha256": "1d02af55b664c31f3cc24f4d2d7dd45c93c876b21c5782043ca1b237fbd4ff9e",
|
||||
"type": "eql",
|
||||
"version": 1
|
||||
},
|
||||
"fcf18de8-ad7d-4d01-b3f7-a11d5b3883af": {
|
||||
"rule_name": "Threat Intel Email Indicator Match",
|
||||
"sha256": "b00162604ddc689f7fecde4e19732c62f634d9c94986ca576438479fa1f3fe4c",
|
||||
"sha256": "cfa8a4fcc12561cec5bb571ef7f143d87543fe860577aa1f11b2b284b2e7ecb2",
|
||||
"type": "threat_match",
|
||||
"version": 1
|
||||
"version": 2
|
||||
},
|
||||
"fcf733d5-7801-4eb0-92ac-8ffacf3658f2": {
|
||||
"rule_name": "User or Group Creation/Modification",
|
||||
@@ -9259,9 +9505,9 @@
|
||||
},
|
||||
"fda1d332-5e08-4f27-8a9b-8c802e3292a6": {
|
||||
"rule_name": "System Binary Moved or Copied",
|
||||
"sha256": "bbed26c1b50c04f06d493c382342255eb4ff9ae8408fbf490c5cf9376a953aff",
|
||||
"sha256": "4cafdc105f02e8f5f46077255b00cd343f0782c5810d170830958f5ccdd4fac1",
|
||||
"type": "eql",
|
||||
"version": 16
|
||||
"version": 17
|
||||
},
|
||||
"fddff193-48a3-484d-8d35-90bb3d323a56": {
|
||||
"rule_name": "PowerShell Kerberos Ticket Dump",
|
||||
@@ -9289,9 +9535,9 @@
|
||||
},
|
||||
"feafdc51-c575-4ed2-89dd-8e20badc2d6c": {
|
||||
"rule_name": "Potential Masquerading as Business App Installer",
|
||||
"sha256": "7bb35804d9de7cd16208fec65d9122de758e7c08124862ee6e3be68d0d791bcc",
|
||||
"sha256": "41ec550b3078839de7f19bf83a042b3438322accc41dc05b6cb5c9d2f2e18d8e",
|
||||
"type": "eql",
|
||||
"version": 7
|
||||
"version": 8
|
||||
},
|
||||
"fec7ccb7-6ed9-4f98-93ab-d6b366b063a0": {
|
||||
"rule_name": "Execution via MS VisualStudio Pre/Post Build Events",
|
||||
@@ -9307,9 +9553,9 @@
|
||||
},
|
||||
"fef62ecf-0260-4b71-848b-a8624b304828": {
|
||||
"rule_name": "Potential Process Name Stomping with Prctl",
|
||||
"sha256": "bd0a28efece0a229b9c43ccba89972c4f09381f12a7b212e3da5f812aedac6ac",
|
||||
"sha256": "899d1fba09b4b54578b7d0b3b9924dd9cdc57c0da03c5b7f666b712d50b598ae",
|
||||
"type": "eql",
|
||||
"version": 4
|
||||
"version": 5
|
||||
},
|
||||
"ff013cb4-274d-434a-96bb-fe15ddd3ae92": {
|
||||
"rule_name": "Roshal Archive (RAR) or PowerShell File Downloaded from the Internet",
|
||||
|
||||
+1
-1
@@ -1,6 +1,6 @@
|
||||
[project]
|
||||
name = "detection_rules"
|
||||
version = "1.2.3"
|
||||
version = "1.2.4"
|
||||
description = "Detection Rules is the home for rules used by Elastic Security. This repository is used for the development, maintenance, testing, validation, and release of rules for Elastic Security’s Detection Engine."
|
||||
readme = "README.md"
|
||||
requires-python = ">=3.12"
|
||||
|
||||
Reference in New Issue
Block a user