cd02674402
[New Rule] Suspicious Email Access by First-Party Application via Microsoft Graph ( #4704 )
...
* new rule 'Suspicious Email Access by First-Party Application via Microsoft Graph'
* updated patch version
---------
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com >
(cherry picked from commit 8f27c24528
2025-05-10 00:53:46 +00:00
c68b580e44
[New Rule] Microsoft Entra Session Reuse with Suspicious Graph Access ( #4711 )
...
* new rule 'Microsoft Entra Session Reuse with Suspicious Graph Access'
* fixed tags; linted
* fixed mitre mappings
* updated name and investigation guide
(cherry picked from commit d83e1c711a
2025-05-10 00:36:55 +00:00
10294e6762
[Rule Tuning] Unusual File Creation - Alternate Data Stream ( #4712 )
...
(cherry picked from commit d30e65e5a2
2025-05-09 17:01:21 +00:00
6914c0fe4e
[Rule Tuning] Tuning Suspicious Mailbox Permission Delegation in Exchange Online ( #4705 )
...
* rule tuning 'Suspicious Mailbox Permission Delegation in Exchange Online'
* Update rules/integrations/o365/persistence_exchange_suspicious_mailbox_permission_delegation.toml
* updated date
(cherry picked from commit 762857f15f
2025-05-08 15:05:14 +00:00
6f5d450c53
Fix new term doc broken link ( #4706 )
...
(cherry picked from commit 0f3bfcd98a
2025-05-07 11:38:32 +00:00
07ef3aafc2
Lock versions for releases: 8.14,8.15,8.16,8.17,8.18,9.0 ( #4703 )
...
(cherry picked from commit acab8b4c6e
2025-05-07 02:08:55 +00:00
1e419fc7ae
Update ATT&CK coverage URL(s) in docs-dev/ATT&CK-coverage.md ( #4702 )
...
(cherry picked from commit 69498a97ac
2025-05-06 17:47:44 +00:00
6268062729
[FR] Add check-version-lock dev command ( #4650 )
...
* Add check-version-lock dev command
* Bump the version
* Add Check Double Bumps to lock-versions workflow
* Replace return with ctx aware exit
* Bump Version
* Update Double Bump Modulo calculation
* Update if formatting
* Undo formatting typo
* Add logic to process the local file
* Update for descriptiveness
* Allow double bump branch for testing
* Pass github token
* Re-restrict to main
* Patch version bump
* Add comment if no double bumps found
* Bump Version
(cherry picked from commit 639d748ec2
2025-05-06 17:31:03 +00:00
c25110e975
[Rule Tuning] Add exceptions for non-interactive signin failures for Entra M365 Bruteforce ( #4405 )
...
* Add exceptions for non-interactive signin failures.
Include exceptions for error codes, restricted to `NonInteractiveUserSignInLogs` and token refreshes:
- 70043 : Refresh token expired or no longer valid due to conditional access frequency checks
- 70044 : Session expired or no longer valid due to conditional access frequency checks
- 50057 : User account is disabled
* Update rules/integrations/azure/credential_access_entra_signin_brute_force_microsoft_365.toml
* Update metadata for `updated_date`
---------
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com >
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com >
Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com >
Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com >
(cherry picked from commit 36d595ae2f
2025-05-06 17:17:43 +00:00
0605d754a3
[New Rule] Unusual Exim4 Child Process ( #4684 )
...
(cherry picked from commit 3a601a10fb
2025-05-06 17:01:48 +00:00
65791ff7c8
[New Rule] Unusual Execution from Kernel Thread (kthreadd) Parent ( #4683 )
...
(cherry picked from commit c145e33f16
2025-05-06 16:43:13 +00:00
8fe54e1785
[New Rule] Linux Telegram API Request ( #4677 )
...
(cherry picked from commit 608e02e27e
2025-05-06 16:27:45 +00:00
69aae56d99
[Rule Tuning] Reduce Severity from Critical to High ( #4637 )
...
(cherry picked from commit d3aa4b2f38
2025-05-06 16:12:09 +00:00
d196211d68
[New Rule] Unusual LD_PRELOAD/LD_LIBRARY_PATH Command Line Arguments ( #4685 )
...
(cherry picked from commit 944428d81e
2025-05-06 15:56:24 +00:00
db75bd006f
[New Rule] Potential Dynamic IEX Reconstruction via Environment Variables ( #4633 )
...
(cherry picked from commit e028bf7954
2025-05-06 15:40:49 +00:00
585df071ad
[Rule Tuning] Excluding Microsoft Entra ID Service Principal Addition Invoked by MSFT Identity ( #4700 )
...
* tuning rule to exclude service principals added by MSFT
* added additional exclusions
* updated rule name and file name
* updated investigation guide and mitre
(cherry picked from commit a34a26ddec
2025-05-06 15:24:22 +00:00
2bb32cdef4
[New Rule] Potential PowerShell Obfuscation via Special Character Overuse ( #4632 )
...
(cherry picked from commit 0cd7de6862
2025-05-06 15:03:50 +00:00
a838563ceb
[New Rule] Potential PowerShell Obfuscation via High Numeric Character Proportion ( #4631 )
...
(cherry picked from commit b7016253ae
2025-05-06 14:48:03 +00:00
216bb984f5
[New Rule] Potential PowerShell Obfuscation via Backtick-Escaped Variable Expansion ( #4630 )
...
(cherry picked from commit 5d8f0c2ffe
2025-05-06 14:32:20 +00:00
e2907b36c0
[New Rule][BBR] Potential PowerShell Obfuscation via High Special Character Proportion ( #4629 )
...
(cherry picked from commit b6a755c84f
2025-05-06 14:16:15 +00:00
fa469f3263
[New Rule] Potential PowerShell Obfuscation via Concatenated Dynamic Command Invocation ( #4615 )
...
(cherry picked from commit dc6cb3e811
2025-05-06 14:00:33 +00:00
bd7f469a81
[New Rule] Potential PowerShell Obfuscation via Invalid Escape Sequences ( #4614 )
...
(cherry picked from commit 5ab73943a1
2025-05-06 13:44:25 +00:00
720e69b105
[New Rule] PowerShell Obfuscation via Negative Index String Reversal ( #4610 )
...
(cherry picked from commit b5ac9707ba
2025-05-06 13:28:55 +00:00
4fc2aa35a2
[New Rule] Potential PowerShell Obfuscation via Reverse Keywords ( #4609 )
...
(cherry picked from commit c291638521
2025-05-06 13:11:06 +00:00
6f88f0dd8a
[New Rule] Potential PowerShell Obfuscation via Character Array Reconstruction ( #4608 )
...
(cherry picked from commit 7b9cd77bc2
2025-05-06 12:52:54 +00:00
e9930ebfcf
[New Rule] Potential PowerShell Obfuscation via String Concatenation ( #4607 )
...
(cherry picked from commit ebe77f2d86
2025-05-06 12:37:13 +00:00
427c617f3b
[New Rule] System Binary Symlink to Suspicious Location ( #4682 )
...
(cherry picked from commit fdc6b09d54
2025-05-06 12:21:27 +00:00
66c8faaa65
[New Rule] Suspicious Named Pipe Creation ( #4681 )
...
(cherry picked from commit 25dc8498ae
2025-05-06 12:05:07 +00:00
e1506c7f6e
[New Rule] Suspicious Kernel Feature Activity ( #4676 )
...
(cherry picked from commit 8b08795e00
2025-05-06 11:48:07 +00:00
453826355a
[New Rule] Potential Data Exfiltration Through Curl ( #4678 )
...
(cherry picked from commit 0193af2842
2025-05-06 11:32:34 +00:00
0855f2b198
[New/Tuning] Potential Hex Payload Execution via Command-Line ( #4675 )
...
(cherry picked from commit 4030de9295
2025-05-06 11:03:19 +00:00
261b6a2a59
[New Rule] Potential Backdoor Execution Through PAM_EXEC ( #4674 )
...
(cherry picked from commit eb3520a63b
2025-05-06 10:47:36 +00:00
1006dee489
[New] Windows Sandbox with Sensitive Configuration ( #4606 )
...
https://blog-en.itochuci.co.jp/entry/2025/03/12/140000
(cherry picked from commit 91acb4e9ce
2025-05-06 10:32:59 +00:00
dbddc99917
[New] Rare Connection to WebDAV Target ( #4667 )
...
(cherry picked from commit 04f15aa08c
2025-05-06 10:15:48 +00:00
aaa29b1995
[New] Microsoft Azure or Mail Sign-in from a Suspicious Source ( #4673 )
...
(cherry picked from commit 70f758d9ad
2025-05-06 09:55:45 +00:00
86cd02217d
[New Rule] Git Repository or File Download to Suspicious Directory ( #4663 )
...
(cherry picked from commit 403e20c2c6
2025-05-06 09:40:01 +00:00
38734aba83
[New Rule] Manual Mount Discovery via /etc/exports ( #4662 )
...
(cherry picked from commit 3f9e2edcb5
2025-05-06 09:23:28 +00:00
552f0acfaf
[New Rule] Docker Release File Creation ( #4661 )
...
(cherry picked from commit a9e8a78c09
2025-05-06 09:06:09 +00:00
8756bb5513
[New Rule] Manual Memory Dumping via Proc Filesystem ( #4660 )
...
(cherry picked from commit 13cf424ef5
2025-05-06 08:50:39 +00:00
a7a7792c69
[FN Tuning] Suspicious /proc/maps Discovery ( #4659 )
...
(cherry picked from commit c9c41747fc
2025-05-06 08:34:23 +00:00
2d7ae8ca50
[New Rule] Suspicious Path Mounted ( #4664 )
...
(cherry picked from commit 1150271372
2025-05-06 08:17:14 +00:00
6dcd7d0564
Update command_and_control_common_webservices.toml ( #4686 )
...
(cherry picked from commit bcff3f95d5
2025-05-06 08:01:32 +00:00
53f92f41c7
[New] Concurrent Azure SignIns with Suspicious Properties ( #4670 )
...
(cherry picked from commit f480e98f16
2025-05-06 07:44:24 +00:00
7d4d068122
[New] Suspicious Microsoft 365 UserLoggedIn via OAuth Code ( #4691 )
...
(cherry picked from commit 6e3b38c645
2025-05-06 07:27:43 +00:00
2db70a18c6
[New Rule] Adding Coverage for Suspicious Activity via Auth Broker On-Behalf-of Principal User ( #4687 )
...
(cherry picked from commit 57be590d73
2025-05-06 07:16:14 +00:00
557c6bbef9
[New Rule] Adding Coverage for Microsoft Entra ID SharePoint Access for User Principal via Auth Broker ( #4695 )
...
* new rule 'Microsoft Entra ID SharePoint Access for User Principal via Auth Broker'
* updated severity
* added new terms note
(cherry picked from commit 58d03d4043
2025-05-05 20:49:59 +00:00
fd7e14bcd7
Refresh ecs, beats, integration manifests & schemas ( #4699 )
...
(cherry picked from commit e4856d3c2c
2025-05-05 17:41:00 +00:00
e38f15bcf6
[New Rule] Potential Linux Tunneling and/or Port Forwarding via SSH Option ( #4658 )
...
(cherry picked from commit 18e1103c51
2025-05-05 08:03:40 +00:00
8f880c00a8
Deprecate Experimental ML command ( #4669 )
...
(cherry picked from commit b3adc6d3ea
2025-05-02 15:36:09 +00:00
6be77cdf9d
[New] Microsoft 365 OAuth Redirect to Device Registration for User ( #4694 )
...
* [New] Microsoft 365 OAuth Redirect to Device Registration for User Principal
https://github.com/elastic/ia-trade-team/issues/590
* Update non-ecs-schema.json
* Update pyproject.toml
* Update credential_access_antra_id_device_reg_via_oauth_redirection.toml
* Update credential_access_antra_id_device_reg_via_oauth_redirection.toml
* Update credential_access_antra_id_device_reg_via_oauth_redirection.toml
* fixed investigation guide formatting; fixed unit test failure
* updated patch version
---------
Co-authored-by: terrancedejesus <terrance.dejesus@elastic.co >
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com >
(cherry picked from commit dddc2a7bb9
2025-05-02 07:40:22 +00:00
Terrance DeJesus