2 Commits

Author	SHA1	Message	Date
Mika Ayenson, PhD	44f69a586b	[Rule Tuning] Add Supplemental Mitre Mappings (#5876) ... --------- Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> Co-authored-by: Isai <59296946+imays11@users.noreply.github.com> Co-authored-by: terrancedejesus <terrance.dejesus@elastic.co> Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> Co-authored-by: eric-forte-elastic <eric.forte@elastic.co> Removed changes from: - rules/cross-platform/command_and_control_kubectl_networking_modification.toml - rules/cross-platform/defense_evasion_potential_kubectl_impersonation.toml - rules/cross-platform/defense_evasion_potential_kubectl_masquerading.toml - rules/cross-platform/discovery_kubectl_permission_discovery.toml - rules/cross-platform/execution_d4c_k8s_mda_direct_interactive_kubernetes_api_request_by_usual_utilities.toml - rules/cross-platform/execution_d4c_k8s_mda_forbidden_direct_interactive_kubernetes_api_request.toml - rules/cross-platform/execution_d4c_k8s_mda_kubernetes_api_activity_by_unusual_utilities.toml - rules/cross-platform/execution_d4c_k8s_mda_service_account_token_access_followed_by_kubernetes_api_request.toml - rules/cross-platform/execution_kubernetes_direct_api_request_via_curl_or_wget.toml - rules/integrations/azure/ml_azure_rare_method_by_city.toml - rules/integrations/azure/ml_azure_rare_method_by_country.toml - rules/integrations/azure/ml_azure_rare_method_by_user.toml - rules/integrations/cloud_defend/command_and_control_curl_socks_proxy_detected_inside_container.toml - rules/integrations/cloud_defend/command_and_control_interactive_file_download_from_internet.toml - rules/integrations/cloud_defend/command_and_control_tunneling_and_port_forwarding.toml - rules/integrations/cloud_defend/credential_access_cloud_creds_search_inside_a_container.toml - rules/integrations/cloud_defend/credential_access_collection_sensitive_files_compression_inside_a_container.toml - rules/integrations/cloud_defend/credential_access_sensitive_keys_or_passwords_search_inside_a_container.toml - rules/integrations/cloud_defend/credential_access_service_account_token_or_cert_read.toml - rules/integrations/cloud_defend/defense_evasion_decoded_payload_piped_to_interpreter.toml - rules/integrations/cloud_defend/defense_evasion_file_creation_execution_deletion_cradle.toml - rules/integrations/cloud_defend/defense_evasion_interactive_process_execution_from_suspicious_directory.toml - rules/integrations/cloud_defend/defense_evasion_ld_preload_shared_object_modified_inside_a_container.toml - rules/integrations/cloud_defend/defense_evasion_potential_evasion_via_encoded_payload.toml - rules/integrations/cloud_defend/discovery_dns_enumeration.toml - rules/integrations/cloud_defend/discovery_environment_enumeration.toml - rules/integrations/cloud_defend/discovery_kubelet_certificate_file_access.toml - rules/integrations/cloud_defend/discovery_kubelet_pod_discovery_via_builtin_utilities.toml - rules/integrations/cloud_defend/discovery_privilege_boundary_enumeration_from_interactive_process.toml - rules/integrations/cloud_defend/discovery_service_account_namespace_read.toml - rules/integrations/cloud_defend/discovery_suspicious_network_tool_launched_inside_a_container.toml - rules/integrations/cloud_defend/execution_container_management_binary_launched_inside_a_container.toml - rules/integrations/cloud_defend/execution_direct_interactive_kubernetes_api_request.toml - rules/integrations/cloud_defend/execution_interactive_file_creation_in_system_binary_locations.toml - rules/integrations/cloud_defend/execution_kubeletctl_execution.toml - rules/integrations/cloud_defend/execution_netcat_listener_established_inside_a_container.toml - rules/integrations/cloud_defend/execution_payload_downloaded_and_piped_to_shell.toml - rules/integrations/cloud_defend/execution_potential_direct_kubelet_access_via_process_args.toml - rules/integrations/cloud_defend/execution_suspicious_file_made_executable_via_chmod_inside_a_container.toml - rules/integrations/cloud_defend/execution_suspicious_interactive_interpreter_command_execution.toml - rules/integrations/cloud_defend/execution_tool_installation.toml - rules/integrations/cloud_defend/persistence_modification_of_persistence_relevant_files.toml - rules/integrations/cloud_defend/persistence_ssh_authorized_keys_modification_inside_a_container.toml - rules/integrations/cloud_defend/persistence_suspicious_echo_or_printf_execution.toml - rules/integrations/cloud_defend/persistence_suspicious_webserver_child_process_execution.toml - rules/integrations/cloud_defend/privilege_escalation_debugfs_launched_inside_a_privileged_container.toml - rules/integrations/cloud_defend/privilege_escalation_potential_container_escape_via_modified_release_agent_file.toml - rules/integrations/gcp/ml_gcp_rare_method_by_city.toml - rules/integrations/gcp/ml_gcp_rare_method_by_country.toml - rules/integrations/gcp/ml_gcp_rare_method_by_user.toml - rules/linux/discovery_docker_socket_discovery.toml - rules/linux/discovery_kubeconfig_file_discovery.toml - rules/linux/execution_kubectl_apply_pod_from_url.toml - rules/linux/lateral_movement_kubeconfig_file_activity.toml - rules/linux/persistence_kubernetes_sensitive_file_activity.toml - rules_building_block/discovery_kubectl_workload_and_cluster_discovery.toml (selectively cherry picked from commit 8993d1450b)	2026-04-01 14:15:58 +00:00
Colson Wilhoit	d6fdee6b2d	[New] Endpoint Rule Conversion PR (#5658) ... * update * [New] Endpoint Rule Conversion PR * fix: replace invalid rule_ids with valid UUIDs * fix: remove malformed TOML in docker_outbound_connection rule * fix: rename Security Software Discovery rule to avoid name collision * fix: remove rule using unsupported 'as event' alias syntax * fix: add timestamp_override, investigation guides, and fix MITRE mapping - Added timestamp_override = 'event.ingested' to 15 non-sequence EQL rules - Added '## Triage and analysis' investigation guides to 19 high-severity rules - Fixed T1176 technique name from 'Browser Extensions' to 'Software Extensions' * Enhance investigation guides for 19 high-severity macOS SIEM rules Enhanced investigation guides to align with existing SIEM rule format: - Added detailed context paragraphs explaining the threat and detection logic - Expanded investigation steps to 6-7 items with specific field references - Enhanced false positive analysis with 4-5 items and exclusion guidance - Added comprehensive response and remediation steps (6-7 items) Rules enhanced: - Defense Evasion: dylib_injection, gatekeeper_override, tcc_access - Persistence: shell_profile, hidden_plist, chromium_extension, startup_item, pkg_install_script, launch_agent_daemon - Execution: unusual_library_python - Lateral Movement: jamf_endpoint - Command and Control: google_calendar_c2, oast_domain, etherhiding, curl_from_app, curl_google_script, unsigned_binary - Collection: pbpaste, sensitive_file_compression * Fix investigation guide tests: add Resources tag and fix OAST title - Added 'Resources: Investigation Guide' tag to all 19 rules with investigation guides - Fixed OAST rule investigation guide title to match rule name exactly: 'Network Connection to OAST Domain via Script Interpreter' * Remove duplicate detection_rules 2 folder from PR * Address Samir's PR feedback: consolidate rules, convert to ES|QL, fix Gatekeeper rule Changes: - Convert AWS S3 connection rule to ES|QL with aggregation - Consolidate Python + Node non-standard port rules into single script interpreter rule - Fix Gatekeeper rule to use correct gatekeeper_override event - Simplify Gatekeeper rule to single event per Samir's suggestion - Convert TCC access rule to ES|QL with COUNT_DISTINCT - Tune cross-platform security software grep rule (add egrep, pgrep, more tools) - Add node to system/network config check rule Deleted duplicates (covered by existing cross-platform rules): - Docker suspicious TLD rule (covered by unusual_connection_to_suspicious_top_level_domain) - Security software via grep (tuned cross-platform version instead) - VM fingerprinting via grep (duplicate of cross-platform version) * fix: ESQL formatting and wildcard versioning patterns - Add Esql. prefix to computed fields in ESQL rules - Add KEEP statements to ESQL rules for proper field visibility - Add perl* wildcard to OAST domain rule for version consistency - Add ruby* wildcard to Etherhiding C2 rule for version consistency - Fix regex pattern in TCC rule (perl.*/ruby.* for versioning) * fix: remove duplicate Script Interpreter rule Delete command_and_control_suspicious_outbound_python_network.toml which is an exact duplicate of command_and_control_script_interpreter_connection_to_non_standard_port.toml (same rule_id: aa1e007a-2997-4247-b048-dd9344742560) * fix: add timestamp_override to Pbpaste and Gatekeeper rules - collection_pbpaste_execution_via_unusual_parent.toml - defense_evasion_gatekeeper_override_and_execution.toml EQL/KQL rules require timestamp_override: event.ingested * fix: remove perl from Script Interpreter rule Perl is covered by the broader perl_outbound_network_connection rule which catches perl → any external IP (not just non-standard ports). Perl network connections on macOS are rare and inherently suspicious regardless of port. * Update rules/macos/command_and_control_aws_s3_connection_via_script.toml Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com> * Update rules/macos/command_and_control_aws_s3_connection_via_script.toml Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com> * Update rules/macos/command_and_control_aws_s3_connection_via_script.toml Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com> * Update rules/macos/defense_evasion_suspicious_tcc_access_granted.toml Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com> * Update rules/macos/persistence_manual_chromium_extension_loading.toml Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com> * Update rules/macos/persistence_startup_item_plist_creation.toml Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com> * Update rules/macos/persistence_suspicious_launch_agent_or_launch_daemon.toml Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com> * Update rules/macos/persistence_suspicious_launch_agent_or_launch_daemon.toml Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com> * Fix ESQL syntax error in AWS S3 connection rule Remove trailing comma before BY clause in STATS command that caused a parsing_exception. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> (cherry picked from commit 43d3f3b467)	2026-02-06 16:56:57 +00:00