admin/elastic-detection-rules
1
0
Fork 0
mirror of https://github.com/elastic/detection-rules synced 2026-06-08 14:00:08 +00:00
Code Issues Packages Projects Releases Wiki Activity
3,574 Commits 407 Branches 706 Tags
04698d097640d2cefa7bc2a6c2c64b01191da968
Commit Graph

19 Commits

Author SHA1 Message Date
Mika Ayenson, PhD 44f69a586b [Rule Tuning] Add Supplemental Mitre Mappings (#5876) 
---------

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>
Co-authored-by: terrancedejesus <terrance.dejesus@elastic.co>
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
Co-authored-by: eric-forte-elastic <eric.forte@elastic.co>

Removed changes from:
- rules/cross-platform/command_and_control_kubectl_networking_modification.toml
- rules/cross-platform/defense_evasion_potential_kubectl_impersonation.toml
- rules/cross-platform/defense_evasion_potential_kubectl_masquerading.toml
- rules/cross-platform/discovery_kubectl_permission_discovery.toml
- rules/cross-platform/execution_d4c_k8s_mda_direct_interactive_kubernetes_api_request_by_usual_utilities.toml
- rules/cross-platform/execution_d4c_k8s_mda_forbidden_direct_interactive_kubernetes_api_request.toml
- rules/cross-platform/execution_d4c_k8s_mda_kubernetes_api_activity_by_unusual_utilities.toml
- rules/cross-platform/execution_d4c_k8s_mda_service_account_token_access_followed_by_kubernetes_api_request.toml
- rules/cross-platform/execution_kubernetes_direct_api_request_via_curl_or_wget.toml
- rules/integrations/azure/ml_azure_rare_method_by_city.toml
- rules/integrations/azure/ml_azure_rare_method_by_country.toml
- rules/integrations/azure/ml_azure_rare_method_by_user.toml
- rules/integrations/cloud_defend/command_and_control_curl_socks_proxy_detected_inside_container.toml
- rules/integrations/cloud_defend/command_and_control_interactive_file_download_from_internet.toml
- rules/integrations/cloud_defend/command_and_control_tunneling_and_port_forwarding.toml
- rules/integrations/cloud_defend/credential_access_cloud_creds_search_inside_a_container.toml
- rules/integrations/cloud_defend/credential_access_collection_sensitive_files_compression_inside_a_container.toml
- rules/integrations/cloud_defend/credential_access_sensitive_keys_or_passwords_search_inside_a_container.toml
- rules/integrations/cloud_defend/credential_access_service_account_token_or_cert_read.toml
- rules/integrations/cloud_defend/defense_evasion_decoded_payload_piped_to_interpreter.toml
- rules/integrations/cloud_defend/defense_evasion_file_creation_execution_deletion_cradle.toml
- rules/integrations/cloud_defend/defense_evasion_interactive_process_execution_from_suspicious_directory.toml
- rules/integrations/cloud_defend/defense_evasion_ld_preload_shared_object_modified_inside_a_container.toml
- rules/integrations/cloud_defend/defense_evasion_potential_evasion_via_encoded_payload.toml
- rules/integrations/cloud_defend/discovery_dns_enumeration.toml
- rules/integrations/cloud_defend/discovery_environment_enumeration.toml
- rules/integrations/cloud_defend/discovery_kubelet_certificate_file_access.toml
- rules/integrations/cloud_defend/discovery_kubelet_pod_discovery_via_builtin_utilities.toml
- rules/integrations/cloud_defend/discovery_privilege_boundary_enumeration_from_interactive_process.toml
- rules/integrations/cloud_defend/discovery_service_account_namespace_read.toml
- rules/integrations/cloud_defend/discovery_suspicious_network_tool_launched_inside_a_container.toml
- rules/integrations/cloud_defend/execution_container_management_binary_launched_inside_a_container.toml
- rules/integrations/cloud_defend/execution_direct_interactive_kubernetes_api_request.toml
- rules/integrations/cloud_defend/execution_interactive_file_creation_in_system_binary_locations.toml
- rules/integrations/cloud_defend/execution_kubeletctl_execution.toml
- rules/integrations/cloud_defend/execution_netcat_listener_established_inside_a_container.toml
- rules/integrations/cloud_defend/execution_payload_downloaded_and_piped_to_shell.toml
- rules/integrations/cloud_defend/execution_potential_direct_kubelet_access_via_process_args.toml
- rules/integrations/cloud_defend/execution_suspicious_file_made_executable_via_chmod_inside_a_container.toml
- rules/integrations/cloud_defend/execution_suspicious_interactive_interpreter_command_execution.toml
- rules/integrations/cloud_defend/execution_tool_installation.toml
- rules/integrations/cloud_defend/persistence_modification_of_persistence_relevant_files.toml
- rules/integrations/cloud_defend/persistence_ssh_authorized_keys_modification_inside_a_container.toml
- rules/integrations/cloud_defend/persistence_suspicious_echo_or_printf_execution.toml
- rules/integrations/cloud_defend/persistence_suspicious_webserver_child_process_execution.toml
- rules/integrations/cloud_defend/privilege_escalation_debugfs_launched_inside_a_privileged_container.toml
- rules/integrations/cloud_defend/privilege_escalation_potential_container_escape_via_modified_release_agent_file.toml
- rules/integrations/gcp/ml_gcp_rare_method_by_city.toml
- rules/integrations/gcp/ml_gcp_rare_method_by_country.toml
- rules/integrations/gcp/ml_gcp_rare_method_by_user.toml
- rules/linux/discovery_docker_socket_discovery.toml
- rules/linux/discovery_kubeconfig_file_discovery.toml
- rules/linux/execution_kubectl_apply_pod_from_url.toml
- rules/linux/lateral_movement_kubeconfig_file_activity.toml
- rules/linux/persistence_kubernetes_sensitive_file_activity.toml
- rules_building_block/discovery_kubectl_workload_and_cluster_discovery.toml

(selectively cherry picked from commit 8993d1450b)
 2026-04-01 14:15:58 +00:00
yuriShafet 75f5ebfb94 [Rule Tuning] Machine Learning Detected a Suspicious Windows Event with a High Malicious Probability Score (#5523) (#5686) 
Add EQL exclusions for benign activity:
Opera GX renderer children,
Slack creating slack children,
Node using playwright to create chrome process
Python editors accessing reg.exe
Logitech manager activity
 and Zabbix script paths.

(cherry picked from commit 64cca9e1ba)
 2026-02-05 20:57:33 +00:00
Samirbous f2a9007368 [Tuning] Diverse Rules Tuning (#5482) 
* [Tuning] Diverse Rules Tuning

* Update persistence_shell_profile_modification.toml

* Update defense_evasion_ml_suspicious_windows_event_low_probability.toml

* Update defense_evasion_ml_suspicious_windows_event_high_probability.toml

* Update defense_evasion_ml_suspicious_windows_event_high_probability.toml

* ++

* Update persistence_suspicious_ssh_execution_xzbackdoor.toml

* Update persistence_suspicious_ssh_execution_xzbackdoor.toml

* Update credential_access_potential_linux_ssh_bruteforce_internal.toml

* Update persistence_shell_profile_modification.toml

* Revert "Update credential_access_potential_linux_ssh_bruteforce_internal.toml"

This reverts commit bad889a30d.

* Update persistence_web_server_sus_destination_port.toml

* Update defense_evasion_ml_suspicious_windows_event_high_probability.toml

* Update defense_evasion_ml_suspicious_windows_event_low_probability.toml

---------

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

(cherry picked from commit b996a29451)
 2025-12-18 15:33:53 +00:00
Mika Ayenson, PhD 392e0253c3 [Rule Tuning] Beats & Endgame Indices (#5072) 2025-09-09 13:19:13 -05:00
shashank-elastic e8c54169a4 Prep main for 9.1 (#4555) 
* Prep for Release 9.1

* Update Patch Version

* Update Patch version

* Update Patch version
 2025-03-26 11:04:14 -04:00
Kirti Sodhi 955e973c00 Change description and name of problemchild ML detection-rules (#4545) 
Changed description and name of problemchild ML detection-rules
 2025-03-20 08:58:10 -04:00
Mika Ayenson fe8c81d762 [FR] Generate investigation guides (#4358) 2025-01-22 11:17:38 -06:00
shashank-elastic 123e090e7d Fix Minstack version for windows integration - Pahse 2 (#4216) 2024-10-28 20:25:02 +05:30
Kirti Sodhi dfbf86e853 Update ProblemChild detection rules with High and Low probability (#4000) 
* Updated ProblemChild detection rules
 2024-08-22 09:17:41 -04:00
Jonhnathan f5069763b6 [Rule Tuning] Add System tag to DRs (#3968) 
* [Rule Tuning] Add System tag to DRs

* bump
 2024-08-09 11:14:33 -03:00
shashank-elastic 418a95205e Remove unwanted backticks (#3724) 2024-05-31 21:46:24 +05:30
Gus Carlock 8b28a515c1 Update rule setup instructions for UEBA packages (#3652) 
* update detection-rules instructions for UEBA packages

---------

Co-authored-by: Susan <23287722+susan-shu-c@users.noreply.github.com>
 2024-05-28 14:21:46 -05:00
shashank-elastic 63e91c2f12 Back-porting Version Trimming (#3704) 2024-05-23 00:45:10 +05:30
Mika Ayenson 2c3dbfc039 Revert "Back-porting Version Trimming (#3681)" 
This reverts commit 71d2c59b5c.
 2024-05-22 13:51:46 -05:00
shashank-elastic 71d2c59b5c Back-porting Version Trimming (#3681) 2024-05-23 00:11:50 +05:30
Susan 400a84628e Update setup guide for ML integration packages (#3475) 
* Add more detail to ingest pipeline install

* Add more info to anomaly detection setup

* Update draft

* Fix typo

* Bulk add doc updates

* Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_host.toml

Co-authored-by: Kirti Sodhi <109447885+sodhikirti07@users.noreply.github.com>

* Address Kseniia feedback

* Update updated_date per review feedback

---------

Co-authored-by: Kirti Sodhi <109447885+sodhikirti07@users.noreply.github.com>
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>
 2024-04-01 15:02:32 -04:00
Jonhnathan 458e67918a [Security Content] Small tweaks on the setup guides (#3308) 
* [Security Content] Small tweaks on the setup guides

* Additional Fixes

* Avoid touching deprecated rules
 2024-03-11 09:09:40 -03:00
Apoorva Joshi 9a9f5437f2 Update Advanced Analytics config guides (#3302) 
* Updating config guides for Advanced Analytics rules

* More updates

* Update setup instructions for LMD

* Adding more guides

* update TestRuleTiming unit test to ignore advanced analytic rules

* fixed flake error

* Moving config guides under setup instead of note

* Removing leading and trailing whitespace

* Updates as requested by PM

* Updating related integrations, minor updates to setup guides

* fixing unit tests to ignore analytic packages with multiple integration tags

* Update tests/test_all_rules.py

* fixing linting errors

---------

Co-authored-by: Kirti Kirti <kirti.kirti@elastic.co>
Co-authored-by: terrancedejesus <terrance.dejesus@elastic.co>
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
 2023-12-13 07:53:41 -08:00
Terrance DeJesus 835be9b245 [New Rule] Add Living-off-the-Land (LotL) ProblemChild Rules (#3193) 
* adding new LotL rules

* added endpoint tags; updated technique mapping

* added missing data source tag

* Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_user.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_host.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_host.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_parent_process.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_host.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_user.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_parent_process.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_user.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_parent_process.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_host.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_host.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_host.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_parent_process.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_user.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_event.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_event_high_probability.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_host.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

* updated note, references and date

* changed ATT&CK technique to binary proxy execution

---------

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
 2023-10-23 12:23:56 -04:00