admin/elastic-detection-rules
1
0
Fork 0
mirror of https://github.com/elastic/detection-rules synced 2026-06-08 14:00:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

[Rule Tuning] Unusual Process Execution Path - Alternate Data Stream

Browse Source
This commit is contained in:
Samirbous
2021-03-09 12:11:06 +01:00
parent 2fe48e3225
commit 2bf2c33002
2 changed files with 92 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/.idea/workspace.xml
Generated
+89
View File
@@ -0,0 +1,89 @@
<?xml version="1.0" encoding="UTF-8"?>
<project version="4">
<component name="BranchesTreeState">
<expand>
<path>
<item name="ROOT" type="e8cecc67:BranchNodeDescriptor" />
<item name="LOCAL_ROOT" type="e8cecc67:BranchNodeDescriptor" />
</path>
<path>
<item name="ROOT" type="e8cecc67:BranchNodeDescriptor" />
<item name="LOCAL_ROOT" type="e8cecc67:BranchNodeDescriptor" />
<item name="GROUP_NODE:EggShell-RAT-for-MacOS" type="e8cecc67:BranchNodeDescriptor" />
</path>
<path>
<item name="ROOT" type="e8cecc67:BranchNodeDescriptor" />
<item name="REMOTE_ROOT" type="e8cecc67:BranchNodeDescriptor" />
</path>
<path>
<item name="ROOT" type="e8cecc67:BranchNodeDescriptor" />
<item name="REMOTE_ROOT" type="e8cecc67:BranchNodeDescriptor" />
<item name="GROUP_NODE:origin" type="e8cecc67:BranchNodeDescriptor" />
</path>
<path>
<item name="ROOT" type="e8cecc67:BranchNodeDescriptor" />
<item name="REMOTE_ROOT" type="e8cecc67:BranchNodeDescriptor" />
<item name="GROUP_NODE:origin" type="e8cecc67:BranchNodeDescriptor" />
<item name="GROUP_NODE:pr" type="e8cecc67:BranchNodeDescriptor" />
</path>
</expand>
<select />
</component>
<component name="ChangeListManager">
<list default="true" id="22f5d28a-8382-4d88-8ddf-8aa144e75a02" name="Default Changelist" comment="">
<change beforePath="$PROJECT_DIR$/windows/defense_evasion_unusual_dir_ads.toml" beforeDir="false" afterPath="$PROJECT_DIR$/windows/defense_evasion_unusual_dir_ads.toml" afterDir="false" />
</list>
<option name="SHOW_DIALOG" value="false" />
<option name="HIGHLIGHT_CONFLICTS" value="true" />
<option name="HIGHLIGHT_NON_ACTIVE_CHANGELIST" value="false" />
<option name="LAST_RESOLUTION" value="IGNORE" />
</component>
<component name="Git.Settings">
<option name="RECENT_GIT_ROOT_PATH" value="$PROJECT_DIR$/.." />
</component>
<component name="ProjectId" id="1pTGLFYecBdn7jMrkfV8oEDyNzU" />
<component name="ProjectLevelVcsManager" settingsEditedManually="true" />
<component name="ProjectViewState">
<option name="hideEmptyMiddlePackages" value="true" />
<option name="showLibraryContents" value="true" />
</component>
<component name="PropertiesComponent">
<property name="RunOnceActivity.OpenProjectViewOnStart" value="true" />
<property name="RunOnceActivity.ShowReadmeOnStart" value="true" />
</component>
<component name="RecentsManager">
<key name="MoveFile.RECENT_KEYS">
<recent name="C:\Users\bouss\Documents\GitHub\detection-rules\rules\cross-platform" />
</key>
</component>
<component name="SvnConfiguration">
<configuration />
</component>
<component name="TaskManager">
<task active="true" id="Default" summary="Default task">
<changelist id="22f5d28a-8382-4d88-8ddf-8aa144e75a02" name="Default Changelist" comment="" />
<created>1615199608901</created>
<option name="number" value="Default" />
<option name="presentableId" value="Default" />
<updated>1615199608901</updated>
</task>
<servers />
</component>
<component name="Vcs.Log.Tabs.Properties">
<option name="TAB_STATES">
<map>
<entry key="MAIN">
<value>
<State />
</value>
</entry>
</map>
</option>
</component>
<component name="WindowStateProjectService">
<state x="669" y="271" width="581" height="520" key="find.popup" timestamp="1615286918395">
<screen x="0" y="0" width="1920" height="1040" />
</state>
<state x="669" y="271" width="581" height="520" key="find.popup/0.0.1920.1040@0.0.1920.1040" timestamp="1615286918395" />
</component>
</project>
rules/windows/defense_evasion_unusual_dir_ads.toml
+3 -3
View File
@@ -1,7 +1,7 @@
[metadata]
creation_date = "2020/12/04"
maturity = "production"
updated_date = "2021/03/03"
updated_date = "2021/03/09"
[rule]
author = ["Elastic"]
@@ -22,8 +22,8 @@ timestamp_override = "event.ingested"
type = "eql"
query = '''
process where event.type in ("start", "process_started") and
process.args : "C:\\*:*"
process where event.type == "start" and
process.args : ("C:\\*:*", "D:\\*:*", "E:\\*:*") and process.args_count == 1
'''