3 Commits

Author	SHA1	Message	Date
Mika Ayenson, PhD	44f69a586b	[Rule Tuning] Add Supplemental Mitre Mappings (#5876) ... --------- Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> Co-authored-by: Isai <59296946+imays11@users.noreply.github.com> Co-authored-by: terrancedejesus <terrance.dejesus@elastic.co> Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> Co-authored-by: eric-forte-elastic <eric.forte@elastic.co> Removed changes from: - rules/cross-platform/command_and_control_kubectl_networking_modification.toml - rules/cross-platform/defense_evasion_potential_kubectl_impersonation.toml - rules/cross-platform/defense_evasion_potential_kubectl_masquerading.toml - rules/cross-platform/discovery_kubectl_permission_discovery.toml - rules/cross-platform/execution_d4c_k8s_mda_direct_interactive_kubernetes_api_request_by_usual_utilities.toml - rules/cross-platform/execution_d4c_k8s_mda_forbidden_direct_interactive_kubernetes_api_request.toml - rules/cross-platform/execution_d4c_k8s_mda_kubernetes_api_activity_by_unusual_utilities.toml - rules/cross-platform/execution_d4c_k8s_mda_service_account_token_access_followed_by_kubernetes_api_request.toml - rules/cross-platform/execution_kubernetes_direct_api_request_via_curl_or_wget.toml - rules/integrations/azure/ml_azure_rare_method_by_city.toml - rules/integrations/azure/ml_azure_rare_method_by_country.toml - rules/integrations/azure/ml_azure_rare_method_by_user.toml - rules/integrations/cloud_defend/command_and_control_curl_socks_proxy_detected_inside_container.toml - rules/integrations/cloud_defend/command_and_control_interactive_file_download_from_internet.toml - rules/integrations/cloud_defend/command_and_control_tunneling_and_port_forwarding.toml - rules/integrations/cloud_defend/credential_access_cloud_creds_search_inside_a_container.toml - rules/integrations/cloud_defend/credential_access_collection_sensitive_files_compression_inside_a_container.toml - rules/integrations/cloud_defend/credential_access_sensitive_keys_or_passwords_search_inside_a_container.toml - rules/integrations/cloud_defend/credential_access_service_account_token_or_cert_read.toml - rules/integrations/cloud_defend/defense_evasion_decoded_payload_piped_to_interpreter.toml - rules/integrations/cloud_defend/defense_evasion_file_creation_execution_deletion_cradle.toml - rules/integrations/cloud_defend/defense_evasion_interactive_process_execution_from_suspicious_directory.toml - rules/integrations/cloud_defend/defense_evasion_ld_preload_shared_object_modified_inside_a_container.toml - rules/integrations/cloud_defend/defense_evasion_potential_evasion_via_encoded_payload.toml - rules/integrations/cloud_defend/discovery_dns_enumeration.toml - rules/integrations/cloud_defend/discovery_environment_enumeration.toml - rules/integrations/cloud_defend/discovery_kubelet_certificate_file_access.toml - rules/integrations/cloud_defend/discovery_kubelet_pod_discovery_via_builtin_utilities.toml - rules/integrations/cloud_defend/discovery_privilege_boundary_enumeration_from_interactive_process.toml - rules/integrations/cloud_defend/discovery_service_account_namespace_read.toml - rules/integrations/cloud_defend/discovery_suspicious_network_tool_launched_inside_a_container.toml - rules/integrations/cloud_defend/execution_container_management_binary_launched_inside_a_container.toml - rules/integrations/cloud_defend/execution_direct_interactive_kubernetes_api_request.toml - rules/integrations/cloud_defend/execution_interactive_file_creation_in_system_binary_locations.toml - rules/integrations/cloud_defend/execution_kubeletctl_execution.toml - rules/integrations/cloud_defend/execution_netcat_listener_established_inside_a_container.toml - rules/integrations/cloud_defend/execution_payload_downloaded_and_piped_to_shell.toml - rules/integrations/cloud_defend/execution_potential_direct_kubelet_access_via_process_args.toml - rules/integrations/cloud_defend/execution_suspicious_file_made_executable_via_chmod_inside_a_container.toml - rules/integrations/cloud_defend/execution_suspicious_interactive_interpreter_command_execution.toml - rules/integrations/cloud_defend/execution_tool_installation.toml - rules/integrations/cloud_defend/persistence_modification_of_persistence_relevant_files.toml - rules/integrations/cloud_defend/persistence_ssh_authorized_keys_modification_inside_a_container.toml - rules/integrations/cloud_defend/persistence_suspicious_echo_or_printf_execution.toml - rules/integrations/cloud_defend/persistence_suspicious_webserver_child_process_execution.toml - rules/integrations/cloud_defend/privilege_escalation_debugfs_launched_inside_a_privileged_container.toml - rules/integrations/cloud_defend/privilege_escalation_potential_container_escape_via_modified_release_agent_file.toml - rules/integrations/gcp/ml_gcp_rare_method_by_city.toml - rules/integrations/gcp/ml_gcp_rare_method_by_country.toml - rules/integrations/gcp/ml_gcp_rare_method_by_user.toml - rules/linux/discovery_docker_socket_discovery.toml - rules/linux/discovery_kubeconfig_file_discovery.toml - rules/linux/execution_kubectl_apply_pod_from_url.toml - rules/linux/lateral_movement_kubeconfig_file_activity.toml - rules/linux/persistence_kubernetes_sensitive_file_activity.toml - rules_building_block/discovery_kubectl_workload_and_cluster_discovery.toml (selectively cherry picked from commit 8993d1450b)	2026-04-01 14:15:58 +00:00
Samirbous	c6b312d2d5	[Tuning/New] Solarwinds Post Exploit (#5696) ... * [Tuning/New] Solawrwinds Post Exploit https://www.huntress.com/blog/active-exploitation-solarwinds-web-help-desk-cve-2025-26399 - new rule for tunneling using QEMU - added few websvc domains .cloud.es.io, files.catbox.moe and supabase.co - added javaw to the solarwinds rule - added ZOHO and Velociraptor to the new term RMM rule. * Update initial_access_potential_webhelpdesk_exploit.toml * Update rules/windows/command_and_control_common_webservices.toml Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> * ++ --------- Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> (cherry picked from commit 2b5472a9b3)	2026-02-09 14:45:16 +00:00
Samirbous	8f3a2bdcb9	[New] SolarWinds Web Help Desk Java Module Load or Child Process (#5665) ... * [New] Suspicious SolarWinds Web Help Desk Java Module Load or Child Process Identifies the SolarWinds Web Help Desk Java process loading an untrusted or remote native module (DLL). This behavior is uncommon for the Web Help Desk server and may indicate successful exploitation of deserialization vulnerabilities (CVE-2025-40536, CVE-2025-40551), which allow attackers to load malicious SQLite extensions and achieve remote code execution. https://horizon3.ai/attack-research/cve-2025-40551-another-solarwinds-web-help-desk-deserialization-issue/ https://github.com/rapid7/metasploit-framework/pull/20917 * Update rules/windows/initial_access_potential_webhelpdesk_exploit.toml Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com> * Update rules/windows/initial_access_potential_webhelpdesk_exploit.toml Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com> * Update rules/windows/initial_access_potential_webhelpdesk_exploit.toml Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com> --------- Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>	2026-02-09 09:31:53 -05:00