admin/elastic-detection-rules
1
0
Fork 0
mirror of https://github.com/elastic/detection-rules synced 2026-06-08 14:00:08 +00:00
Code Issues Packages Projects Releases Wiki Activity
2,780 Commits 407 Branches 706 Tags
1e419fc7aeac0f905bc5d9513e48e87e618d81ed
Commit Graph

473 Commits

Author SHA1 Message Date
Ruben Groenewoud 0605d754a3 [New Rule] Unusual Exim4 Child Process (#4684) 
(cherry picked from commit 3a601a10fb)
 2025-05-06 17:01:48 +00:00
Ruben Groenewoud 65791ff7c8 [New Rule] Unusual Execution from Kernel Thread (kthreadd) Parent (#4683) 
(cherry picked from commit c145e33f16)
 2025-05-06 16:43:13 +00:00
Ruben Groenewoud 8fe54e1785 [New Rule] Linux Telegram API Request (#4677) 
(cherry picked from commit 608e02e27e)
 2025-05-06 16:27:45 +00:00
Ruben Groenewoud d196211d68 [New Rule] Unusual LD_PRELOAD/LD_LIBRARY_PATH Command Line Arguments (#4685) 
(cherry picked from commit 944428d81e)
 2025-05-06 15:56:24 +00:00
Ruben Groenewoud 427c617f3b [New Rule] System Binary Symlink to Suspicious Location (#4682) 
(cherry picked from commit fdc6b09d54)
 2025-05-06 12:21:27 +00:00
Ruben Groenewoud 66c8faaa65 [New Rule] Suspicious Named Pipe Creation (#4681) 
(cherry picked from commit 25dc8498ae)
 2025-05-06 12:05:07 +00:00
Ruben Groenewoud e1506c7f6e [New Rule] Suspicious Kernel Feature Activity (#4676) 
(cherry picked from commit 8b08795e00)
 2025-05-06 11:48:07 +00:00
Ruben Groenewoud 453826355a [New Rule] Potential Data Exfiltration Through Curl (#4678) 
(cherry picked from commit 0193af2842)
 2025-05-06 11:32:34 +00:00
Ruben Groenewoud 0855f2b198 [New/Tuning] Potential Hex Payload Execution via Command-Line (#4675) 
(cherry picked from commit 4030de9295)
 2025-05-06 11:03:19 +00:00
Ruben Groenewoud 261b6a2a59 [New Rule] Potential Backdoor Execution Through PAM_EXEC (#4674) 
(cherry picked from commit eb3520a63b)
 2025-05-06 10:47:36 +00:00
Ruben Groenewoud 86cd02217d [New Rule] Git Repository or File Download to Suspicious Directory (#4663) 
(cherry picked from commit 403e20c2c6)
 2025-05-06 09:40:01 +00:00
Ruben Groenewoud 38734aba83 [New Rule] Manual Mount Discovery via /etc/exports (#4662) 
(cherry picked from commit 3f9e2edcb5)
 2025-05-06 09:23:28 +00:00
Ruben Groenewoud 552f0acfaf [New Rule] Docker Release File Creation (#4661) 
(cherry picked from commit a9e8a78c09)
 2025-05-06 09:06:09 +00:00
Ruben Groenewoud 8756bb5513 [New Rule] Manual Memory Dumping via Proc Filesystem (#4660) 
(cherry picked from commit 13cf424ef5)
 2025-05-06 08:50:39 +00:00
Ruben Groenewoud a7a7792c69 [FN Tuning] Suspicious /proc/maps Discovery (#4659) 
(cherry picked from commit c9c41747fc)
 2025-05-06 08:34:23 +00:00
Ruben Groenewoud 2d7ae8ca50 [New Rule] Suspicious Path Mounted (#4664) 
(cherry picked from commit 1150271372)
 2025-05-06 08:17:14 +00:00
shashank-elastic fd7e14bcd7 Refresh ecs, beats, integration manifests & schemas (#4699) 
(cherry picked from commit e4856d3c2c)
 2025-05-05 17:41:00 +00:00
Ruben Groenewoud e38f15bcf6 [New Rule] Potential Linux Tunneling and/or Port Forwarding via SSH Option (#4658) 
(cherry picked from commit 18e1103c51)
 2025-05-05 08:03:40 +00:00
Jonhnathan e0f689f18e [Rule Tuning] SSH Authorized Keys File Deletion (#4591) 
Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>

(cherry picked from commit 3eed0f5b6a)
 2025-04-15 15:20:58 +00:00
Ruben Groenewoud 50758935f6 [D4C Conversion] Converting Compatible D4C Rules to DR (#4532) 
* [D4C Conversion] Converting Compatible D4C Rules to DR

* added host.os.type

* Rename

* Update rules/linux/execution_container_management_binary_launched_inside_container.toml

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>

* Update rules/linux/privilege_escalation_debugfs_launched_inside_container.toml

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>

* Update rules/linux/privilege_escalation_debugfs_launched_inside_container.toml

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>

* Update rules/linux/privilege_escalation_mount_launched_inside_container.toml

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>

* Update rules/linux/privilege_escalation_mount_launched_inside_container.toml

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>

---------

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>
Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com>
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>

(cherry picked from commit 3b1f780435)
 2025-04-10 12:31:24 +00:00
Ruben Groenewoud 2a07268bdb [FN Tuning] Shared Object Created or Changed by Previously Unknown Pr… (#4529) 
* [FN Tuning] Shared Object Created or Changed by Previously Unknown Process

* Update process exclusions in TOML file

---------

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com>
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: Eric Forte <119343520+eric-forte-elastic@users.noreply.github.com>

(cherry picked from commit 05c9f6bbdb)
 2025-04-08 16:23:58 +00:00
shashank-elastic a0538f2ce9 Add investigation guides (#4600) 
(cherry picked from commit 3966981dae)
 2025-04-07 15:55:32 +00:00
Jonhnathan 182d9e6c47 [Rule Tuning] Add Host Metadata to ES|QL Aggregation Rules (#4592) 
Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>

(cherry picked from commit 9577d53284)
 2025-04-07 15:04:31 +00:00
shashank-elastic a1dd22efbe Prep for Release 9.0 (#4550) 
Removed changes from:
- detection_rules/etc/packages.yaml

(selectively cherry picked from commit 059d7efa25)
 2025-03-20 15:07:35 +00:00
Ruben Groenewoud d7d8c414ec [New Rule] File Creation in /var/log via Suspicious Process (#4528) 
* [New Rule] File Creation in /var/log via Suspicious Process

* ++

* ++
 2025-03-12 12:50:48 +01:00
Ruben Groenewoud 561ab703de [New Rule] Uncommon Destination Port Connection by Web Server (#4515) 2025-03-06 22:01:33 +05:30
Ruben Groenewoud fe0a9f4935 [New/Tuning] Docker Socket Enumeration (#4510) 
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
 2025-03-06 17:07:10 +01:00
Ruben Groenewoud 8dfa5da3bf [New Rules] Potential Port/Subnet Scanning Activity from Compromised Host (#4509) 
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
 2025-03-06 16:57:33 +01:00
Ruben Groenewoud fe06843636 [New Rule] Unusual Process Spawned from Web Server Parent (#4513) 2025-03-06 16:46:12 +01:00
Ruben Groenewoud 7ce6aaf566 [New Rule] Unusual Command Execution from Web Server Parent (#4512) 
* [New Rule] Unusual Command Execution from Web Server Parent

* ++
 2025-03-06 16:25:38 +01:00
Ruben Groenewoud b9e8115c2f [New Rule] Python Site or User Customize File Creation (#4500) 
* [New Rule] Python Site or User Customize File Creation

* Update persistence_site_and_user_customize_file_creation.toml

* Update persistence_site_and_user_customize_file_creation.toml

---------

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
 2025-03-03 15:30:33 +01:00
Ruben Groenewoud d948279af6 [New Rule] Python Path File (pth) Creation (#4499) 
* [New Rule] Python Path File (pth) Creation

* ++

* Update persistence_pth_file_creation.toml

* Update persistence_pth_file_creation.toml

* Update persistence_pth_file_creation.toml

---------

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
 2025-03-03 15:20:00 +01:00
Ruben Groenewoud f70eafb8e7 [New Rule] Successful SSH Authentication from Unusual User (#4481) 
* [New Rule] Succesful SSH Authentication from Unusual User

* Rename initial_access_first_time_public_key_authentication.toml to initial_access_successful_ssh_authentication_by_unusual_user.toml

* Update rules/linux/initial_access_successful_ssh_authentication_by_unusual_user.toml

* Update initial_access_successful_ssh_authentication_by_unusual_user.toml

* Update rules/linux/initial_access_successful_ssh_authentication_by_unusual_user.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

---------

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
 2025-03-03 11:55:27 +01:00
Ruben Groenewoud 06002cd9ac [New Rule] Kill Command Execution (#4485) 
* [New Rule] Kill Command Execution

* Update defense_evasion_kill_command_executed.toml

---------

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
 2025-02-28 11:26:50 +01:00
Ruben Groenewoud 9bb3b9f204 [New Rule] Unusual File Transfer Utility Launched (#4487) 
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
 2025-02-28 11:15:21 +01:00
Ruben Groenewoud 029fd45bb1 [New Rule] Base64 Decoded Payload Piped to Interpreter (#4488) 
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
 2025-02-28 11:01:52 +01:00
Ruben Groenewoud a2a120858f [New Rule] Unusual Base64 Encoding/Decoding Activity (#4486) 
* [New Rule] Unusual Base64 Encoding/Decoding Activity

* Update defense_evasion_base64_decoding_activity.toml

---------

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
 2025-02-28 10:09:48 +01:00
Ruben Groenewoud 8c250db3c3 [New Rule] Successful SSH Authentication from Unusual IP-Address (#4482) 
* [New Rule] Successful SSH Authentication from Unusual IP-Address

* Apply suggestions from code review

* Update rules/linux/initial_access_successful_ssh_authentication_by_unusual_ip.toml

---------

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
 2025-02-28 09:55:35 +01:00
Ruben Groenewoud 89f79c6e4f [New Rule] Successful SSH Authentication from Unusual SSH Public Key (#4478) 
* [New Rule] First Time Public Key Authentication

* Update initial_access_first_time_public_key_authentication.toml

* Update initial_access_first_time_public_key_authentication.toml

---------

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
 2025-02-28 09:44:51 +01:00
Ruben Groenewoud fe48309daf [New Rule] Linux User Account Credential Modification (#4484) 
* [New Rule] Linux User Account Credential Modification

* Update rules/linux/persistence_user_credential_modification_via_echo.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

---------

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
 2025-02-27 16:42:11 +01:00
Ruben Groenewoud 342e18075b [New Rule] SSH Authorized Keys File Deletion (#4483) 
* [New Rule] Authorized Keys File Deletion

* Apply suggestions from code review

---------

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
 2025-02-27 16:29:51 +01:00
Ruben Groenewoud a614da5900 [New Rule] Remote File Creation in World Writeable Directory (#4475) 
* [New Rule] Remote File Creation in World Writeable Directory

* Update rules/linux/lateral_movement_remote_file_creation_world_writeable_dir.toml

* Update lateral_movement_remote_file_creation_world_writeable_dir.toml

* Update rules/linux/lateral_movement_remote_file_creation_world_writeable_dir.toml
 2025-02-26 10:11:55 +01:00
Ruben Groenewoud 59473f09ac [New Rule] Potential Malware-Driven SSH Brute Force Attempt (#4474) 
* [New Rule] Potential Malware-Driven SSH Brute Force Attempt

* Update impact_potential_bruteforce_malware_infection.toml

* Update rules/linux/impact_potential_bruteforce_malware_infection.toml

* Update impact_potential_bruteforce_malware_infection.toml
 2025-02-26 10:00:31 +01:00
Ruben Groenewoud 758e155231 [New Rule] High Number of Egress Network Connections from Unusual Executable (#4473) 
* [New Rule] High Number of Egress Network Connections from Unusual Executable

* Update command_and_control_frequent_egress_netcon_from_sus_executable.toml

* Update rules/linux/command_and_control_frequent_egress_netcon_from_sus_executable.toml

* Update command_and_control_frequent_egress_netcon_from_sus_executable.toml

* Update command_and_control_frequent_egress_netcon_from_sus_executable.toml

---------

Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com>
 2025-02-26 09:43:54 +01:00
Ruben Groenewoud 8a221325e9 [New Rule] Unusual Remote File Creation (#4476) 
* [New Rule] Unusual Remote File Creation

* Description update

* ++

* ++

* Update rules/linux/lateral_movement_unusual_remote_file_creation.toml

---------

Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com>
 2025-02-26 09:30:47 +01:00
Jonhnathan 5155f47b86 [Rule Tuning] Event Aggregation - Fix event.action & event.type conditions (#4445) 
* [Rule Tuning] Event Aggregation - Fix `event.action` & `event.type` conditions

* .

---------

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
 2025-02-07 18:42:28 -03:00
Jonhnathan 0268daa17d [Rule Tuning] Tighten Up Elastic Defend Indexes - Linux (#4446) 2025-02-05 15:25:45 -03:00
shashank-elastic 818467f132 Replace master doc URLs with current (#4439) 2025-02-03 21:27:50 +05:30
Ruben Groenewoud 8d29a1f7d5 [New Rule] Process Backgrounded by Unusual Parent (#4431) 
* [New Rule] Process Backgrounded by Unusual Parent

* Update execution_process_backgrounded_by_unusual_parent.toml

* Update execution_process_backgrounded_by_unusual_parent.toml
 2025-02-03 14:17:15 +01:00
Ruben Groenewoud 14c648598e [Rule Tuning] Linux DR Tuning - Part 6 (#4423) 
* [Rule Tuning] Linux DR Tuning - Part 6

* Update privilege_escalation_ld_preload_shared_object_modif.toml

* Update privilege_escalation_ld_preload_shared_object_modif.toml
 2025-02-03 14:05:26 +01:00