admin/elastic-detection-rules
1
0
Fork 0
mirror of https://github.com/elastic/detection-rules synced 2026-06-08 14:00:08 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
65657ef697ea0081094f45fbf07f8831b366c91c
elastic-detection-rules/rules_building_block
T
History
Ruben Groenewoud d16c8153dc [Rule Tuning] Linux DR BBR Tuning (#5514) 
* [Rule Tuning] Linux DR BBR Tuning

* Update discovery_getconf_execution.toml

* Fix typo in process.args for dscl command

* Update persistence_web_server_sus_file_creation.toml

---------

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>

(cherry picked from commit 38e2e4766f)
2026-01-07 15:54:04 +00:00
..
.gitkeep
[FR] Add support for building block rules (BBR) (#2822)
2023-06-20 09:00:30 -04:00
collection_archive_data_zip_imageload.toml
Back-porting Version Trimming (#3704)
2024-05-23 00:45:10 +05:30
collection_common_compressed_archived_file.toml
[Rule Tuning] Windows Misc BBR Tuning (#4368)
2025-01-13 12:03:40 -03:00
collection_files_staged_in_recycle_bin_root.toml
Prep main for 9.1 (#4555)
2025-03-26 15:08:47 +00:00
collection_outlook_email_archive.toml
Prep main for 9.1 (#4555)
2025-03-26 15:08:47 +00:00
collection_posh_compression.toml
Prep main for 9.1 (#4555)
2025-03-26 15:08:47 +00:00
command_and_control_bitsadmin_activity.toml
Prep main for 9.1 (#4555)
2025-03-26 15:08:47 +00:00
command_and_control_certutil_network_connection.toml
Prep main for 9.1 (#4555)
2025-03-26 15:08:47 +00:00
command_and_control_non_standard_http_port.toml
[Rule Tuning] Linux DR BBR Tuning (#5514)
2026-01-07 15:54:04 +00:00
credential_access_iis_apppoolsa_pwd_appcmd.toml
Prep main for 9.1 (#4555)
2025-03-26 15:08:47 +00:00
credential_access_mdmp_file_creation.toml
[Rule Tuning] Windows Misc BBR Tuning (#4368)
2025-01-13 12:03:40 -03:00
credential_access_mdmp_file_unusual_extension.toml
Back-porting Version Trimming (#3704)
2024-05-23 00:45:10 +05:30
credential_access_win_private_key_access.toml
Prep main for 9.1 (#4555)
2025-03-26 15:08:47 +00:00
defense_evasion_aws_rds_snapshot_created.toml
[New BBR] AWS RDS DB Snapshot Created (#3828)
2024-06-27 23:59:33 -04:00
defense_evasion_cmd_copy_binary_contents.toml
Prep main for 9.1 (#4555)
2025-03-26 15:08:47 +00:00
defense_evasion_cmstp_execution.toml
Prep main for 9.1 (#4555)
2025-03-26 15:08:47 +00:00
defense_evasion_collection_masquerading_unusual_archive_file_extension.toml
Back-porting Version Trimming (#3704)
2024-05-23 00:45:10 +05:30
defense_evasion_dll_hijack.toml
Monthly Schema Updates (#5046)
2025-09-01 15:15:04 +00:00
defense_evasion_dotnet_clickonce_dfsvc_netcon.toml
Back-porting Version Trimming (#3704)
2024-05-23 00:45:10 +05:30
defense_evasion_download_susp_extension.toml
Back-porting Version Trimming (#3704)
2024-05-23 00:45:10 +05:30
defense_evasion_execution_via_visualstudio_prebuildevent.toml
Back-porting Version Trimming (#3704)
2024-05-23 00:45:10 +05:30
defense_evasion_file_permission_modification.toml
Back-porting Version Trimming (#3704)
2024-05-23 00:45:10 +05:30
defense_evasion_generic_deletion.toml
Back-porting Version Trimming (#3704)
2024-05-23 00:45:10 +05:30
defense_evasion_indirect_command_exec_pcalua_forfiles.toml
Prep main for 9.1 (#4555)
2025-03-26 15:08:47 +00:00
defense_evasion_injection_from_msoffice.toml
Back-porting Version Trimming (#3704)
2024-05-23 00:45:10 +05:30
defense_evasion_installutil_command_activity.toml
Prep main for 9.1 (#4555)
2025-03-26 15:08:47 +00:00
defense_evasion_invalid_codesign_imageload.toml
Back-porting Version Trimming (#3704)
2024-05-23 00:45:10 +05:30
defense_evasion_masquerading_browsers.toml
Refresh ecs, beats, integration manifests & schemas (#4699)
2025-05-05 17:41:00 +00:00
defense_evasion_masquerading_unusual_exe_file_extension.toml
Back-porting Version Trimming (#3704)
2024-05-23 00:45:10 +05:30
defense_evasion_masquerading_vlc_dll.toml
Refresh ecs, beats, integration manifests & schemas (#4699)
2025-05-05 17:41:00 +00:00
defense_evasion_masquerading_windows_dll.toml
Monthly Schema Updates (#5046)
2025-09-01 15:15:04 +00:00
defense_evasion_masquerading_windows_system32_exe.toml
Refresh ecs, beats, integration manifests & schemas (#4699)
2025-05-05 17:41:00 +00:00
defense_evasion_msdt_suspicious_diagcab.toml
Prep main for 9.1 (#4555)
2025-03-26 15:08:47 +00:00
defense_evasion_msiexec_installsource_archive_file.toml
[Rule Tuning] Windows Registry Rules Tuning - 2 (#3958)
2024-08-06 17:15:08 +05:30
defense_evasion_outlook_suspicious_child.toml
Refresh ecs, beats, integration manifests & schemas (#4699)
2025-05-05 17:41:00 +00:00
defense_evasion_posh_obfuscation_proportion_special_chars.toml
[Rule Tuning] PowerShell Rules - Misc Tuning/Severity Bumps (#5486)
2025-12-18 11:31:50 +00:00
defense_evasion_powershell_clear_logs_script.toml
Prep main for 9.1 (#4555)
2025-03-26 15:08:47 +00:00
defense_evasion_service_disabled_registry.toml
Back-porting Version Trimming (#3704)
2024-05-23 00:45:10 +05:30
defense_evasion_service_path_registry.toml
Prep main for 9.1 (#4555)
2025-03-26 15:08:47 +00:00
defense_evasion_services_exe_path.toml
Prep main for 9.1 (#4555)
2025-03-26 15:08:47 +00:00
defense_evasion_suspicious_msiexec_execution.toml
Prep main for 9.1 (#4555)
2025-03-26 15:08:47 +00:00
defense_evasion_unsigned_bits_client.toml
Back-porting Version Trimming (#3704)
2024-05-23 00:45:10 +05:30
defense_evasion_unusual_process_extension.toml
Back-porting Version Trimming (#3704)
2024-05-23 00:45:10 +05:30
defense_evasion_unusual_process_path_wbem.toml
Prep main for 9.1 (#4555)
2025-03-26 15:08:47 +00:00
defense_evasion_write_dac_access.toml
Prep main for 9.1 (#4555)
2025-03-26 15:08:47 +00:00
discovery_capnetraw_capability.toml
[Rule Tuning] Linux DR BBR Tuning (#5514)
2026-01-07 15:54:04 +00:00
discovery_ec2_multi_region_describe_instances.toml
[Rule Tunings] AWS Multiple API Calls ESQL rules (#5238)
2025-12-08 15:32:49 +00:00
discovery_files_dir_systeminfo_via_cmd.toml
Prep main for 9.1 (#4555)
2025-03-26 15:08:47 +00:00
discovery_generic_account_groups.toml
Back-porting Version Trimming (#3704)
2024-05-23 00:45:10 +05:30
discovery_generic_process_discovery.toml
Prep main for 9.1 (#4555)
2025-03-26 15:08:47 +00:00
discovery_generic_registry_query.toml
[Rule Tuning] Lookback Times for Okta Multiple Session and AWS KMS Retrieval Rules (#4324)
2024-12-19 13:03:50 -05:00
discovery_getconf_execution.toml
[Rule Tuning] Linux DR BBR Tuning (#5514)
2026-01-07 15:54:04 +00:00
discovery_hosts_file_access.toml
[Rule Tuning] Linux DR BBR Tuning (#5514)
2026-01-07 15:54:04 +00:00
discovery_internet_capabilities.toml
Back-porting Version Trimming (#3704)
2024-05-23 00:45:10 +05:30
discovery_kernel_module_enumeration_via_proc.toml
[Rule Tuning] Linux DR BBR Tuning (#5514)
2026-01-07 15:54:04 +00:00
discovery_kubectl_configuration_discovery.toml
[Rule Tuning] Linux DR BBR Tuning (#5514)
2026-01-07 15:54:04 +00:00
discovery_kubectl_workload_and_cluster_discovery.toml
[Rule Tuning] Adds Crowdstrike Compatibility to Linux Process Rules (#5232)
2025-11-10 15:05:16 +00:00
discovery_linux_modprobe_enumeration.toml
[Rule Tuning] Linux DR BBR Tuning (#5514)
2026-01-07 15:54:04 +00:00
discovery_linux_sysctl_enumeration.toml
[Rule Tuning] Linux DR BBR Tuning (#5514)
2026-01-07 15:54:04 +00:00
discovery_linux_system_information_discovery.toml
[Rule Tuning] Linux DR BBR Tuning (#5514)
2026-01-07 15:54:04 +00:00
discovery_linux_system_owner_user_discovery.toml
[Rule Tuning] Linux DR BBR Tuning (#5514)
2026-01-07 15:54:04 +00:00
discovery_net_share_discovery_winlog.toml
Prep main for 9.1 (#4555)
2025-03-26 15:08:47 +00:00
discovery_net_view.toml
Prep main for 9.1 (#4555)
2025-03-26 15:08:47 +00:00
discovery_of_accounts_or_groups_via_builtin_tools.toml
[Rule Tuning] Linux DR BBR Tuning (#5514)
2026-01-07 15:54:04 +00:00
discovery_of_domain_groups.toml
[Rule Tuning] Adds Crowdstrike Compatibility to Linux Process Rules (#5232)
2025-11-10 15:05:16 +00:00
discovery_posh_generic.toml
[Rule Tuning] PowerShell Windows Defender ATP DataCollection Scripts (#4867)
2025-07-07 14:00:32 +00:00
discovery_posh_password_policy.toml
[Rule Tuning] PowerShell Rules (#5056)
2025-09-11 23:56:28 +00:00
discovery_post_exploitation_external_ip_lookup.toml
Back-porting Version Trimming (#3704)
2024-05-23 00:45:10 +05:30
discovery_potential_memory_seeking_activity.toml
[Rule Tuning] Linux DR BBR Tuning (#5514)
2026-01-07 15:54:04 +00:00
discovery_process_discovery_via_builtin_tools.toml
[Rule Tuning] Linux DR BBR Tuning (#5514)
2026-01-07 15:54:04 +00:00
discovery_remote_system_discovery_commands_windows.toml
Prep main for 9.1 (#4555)
2025-03-26 15:08:47 +00:00
discovery_security_software_wmic.toml
Prep main for 9.1 (#4555)
2025-03-26 15:08:47 +00:00
discovery_signal_unusual_user_host.toml
Testcase to check if Rule Type: BBR tag is present for all BBR rules (#4048)
2024-09-02 21:29:31 +05:30
discovery_suspicious_proc_enumeration.toml
Back-porting Version Trimming (#3704)
2024-05-23 00:45:10 +05:30
discovery_system_network_connections.toml
[Rule Tuning] Linux DR BBR Tuning (#5514)
2026-01-07 15:54:04 +00:00
discovery_system_service_discovery.toml
Prep main for 9.1 (#4555)
2025-03-26 15:08:47 +00:00
discovery_system_time_discovery.toml
Prep main for 9.1 (#4555)
2025-03-26 15:08:47 +00:00
discovery_win_network_connections.toml
Back-porting Version Trimming (#3704)
2024-05-23 00:45:10 +05:30
discovery_windows_system_information_discovery.toml
Prep main for 9.1 (#4555)
2025-03-26 15:08:47 +00:00
entra_id_identity_protection_risk_detections.toml
[Rule Tuning] Update Azure / M365 Rule Names and File Paths (#5172)
2025-12-10 18:01:25 +00:00
execution_aws_lambda_function_updated.toml
Testcase to check if Rule Type: BBR tag is present for all BBR rules (#4048)
2024-09-02 21:29:31 +05:30
execution_github_new_event_action_for_pat.toml
[Rule Tuning] Linux DR BBR Tuning (#5514)
2026-01-07 15:54:04 +00:00
execution_github_new_repo_interaction_for_pat.toml
[Rule Tuning] Linux DR BBR Tuning (#5514)
2026-01-07 15:54:04 +00:00
execution_github_new_repo_interaction_for_user.toml
[Rule Tuning] Linux DR BBR Tuning (#5514)
2026-01-07 15:54:04 +00:00
execution_github_repo_created.toml
Prep for Release 9.0 (#4550)
2025-03-20 15:07:35 +00:00
execution_github_repo_interaction_from_new_ip.toml
[Rule Tuning] Linux DR BBR Tuning (#5514)
2026-01-07 15:54:04 +00:00
execution_linux_segfault.toml
Back-porting Version Trimming (#3704)
2024-05-23 00:45:10 +05:30
execution_mcp_server_child_process.toml
[New Rules] Add MITRE ATLAS framework support and GenAI threat detection rules (#5352)
2025-12-05 18:28:29 +00:00
execution_settingcontent_ms_file_creation.toml
Prep main for 9.1 (#4555)
2025-03-26 15:08:47 +00:00
execution_unsigned_service_executable.toml
Back-porting Version Trimming (#3704)
2024-05-23 00:45:10 +05:30
execution_wmi_wbemtest.toml
Prep main for 9.1 (#4555)
2025-03-26 15:08:47 +00:00
impact_azure_recovery_services_deletion.toml
[New Rule] Azure Recovery Services Deletion (#5214)
2025-10-17 14:13:45 +00:00
impact_github_member_removed_from_organization.toml
Prep for Release 9.0 (#4550)
2025-03-20 15:07:35 +00:00
impact_github_pat_access_revoked.toml
Prep for Release 9.0 (#4550)
2025-03-20 15:07:35 +00:00
impact_github_user_blocked_from_organization.toml
Prep for Release 9.0 (#4550)
2025-03-20 15:07:35 +00:00
initial_access_anomalous_rsc_flight_data_patterns.toml
[New Rule] React2Shell Detection (#5408)
2025-12-05 23:39:17 +00:00
initial_access_aws_signin_token_created.toml
[Rule Tuning][New BBR Rule] AWS Sign-In Token Creation and Console Login (#5197)
2025-10-16 16:49:46 +00:00
initial_access_github_new_ip_address_for_pat.toml
[Rule Tuning] Linux DR BBR Tuning (#5514)
2026-01-07 15:54:04 +00:00
initial_access_github_new_ip_address_for_user.toml
[Rule Tuning] Linux DR BBR Tuning (#5514)
2026-01-07 15:54:04 +00:00
initial_access_github_new_user_agent_for_pat.toml
[Rule Tuning] Linux DR BBR Tuning (#5514)
2026-01-07 15:54:04 +00:00
initial_access_github_new_user_agent_for_user.toml
[Rule Tuning] Linux DR BBR Tuning (#5514)
2026-01-07 15:54:04 +00:00
initial_access_potential_rce_via_toolshell.toml
[New Rule] Toolshell Exploit Chain Detections (#4928)
2025-08-29 19:19:55 +00:00
initial_access_potential_toolshell_exploit_attempt.toml
[New Rule] Toolshell Exploit Chain Detections (#4928)
2025-08-29 19:19:55 +00:00
lateral_movement_at.toml
Prep main for 9.1 (#4555)
2025-03-26 15:08:47 +00:00
lateral_movement_posh_winrm_activity.toml
Prep main for 9.1 (#4555)
2025-03-26 15:08:47 +00:00
lateral_movement_rdp_conn_unusual_process.toml
Testcase to check if Rule Type: BBR tag is present for all BBR rules (#4048)
2024-09-02 21:29:31 +05:30
lateral_movement_unusual_process_sql_accounts.toml
Back-porting Version Trimming (#3704)
2024-05-23 00:45:10 +05:30
lateral_movement_wmic_remote.toml
Prep main for 9.1 (#4555)
2025-03-26 15:08:47 +00:00
persistence_aws_iam_login_profile_added_to_user.toml
Back-porting Version Trimming (#3704)
2024-05-23 00:45:10 +05:30
persistence_cap_sys_admin_added_to_new_binary.toml
[Rule Tuning] Linux DR BBR Tuning (#5514)
2026-01-07 15:54:04 +00:00
persistence_creation_of_kernel_module.toml
[Rule Tuning] Linux DR BBR Tuning (#5514)
2026-01-07 15:54:04 +00:00
persistence_github_new_pat_for_user.toml
[Rule Tuning] Linux DR BBR Tuning (#5514)
2026-01-07 15:54:04 +00:00
persistence_github_new_user_added_to_organization.toml
Prep for Release 9.0 (#4550)
2025-03-20 15:07:35 +00:00
persistence_iam_instance_request_to_iam_service.toml
[Rule Tuning] Add Investigation Fields to Specific AWS Rules (#4261)
2024-11-08 23:11:18 -05:00
persistence_startup_folder_lnk.toml
Back-porting Version Trimming (#3704)
2024-05-23 00:45:10 +05:30
persistence_transport_agent_exchange.toml
Prep main for 9.1 (#4555)
2025-03-26 15:08:47 +00:00
persistence_web_server_potential_sql_injection.toml
[New Rule] Web Server Potential SQL Injection Request (#5342)
2025-12-02 09:48:27 +00:00
persistence_web_server_sus_file_creation.toml
[Rule Tuning] Linux DR BBR Tuning (#5514)
2026-01-07 15:54:04 +00:00
privilege_escalation_sts_getsessiontoken_abuse.toml
[Rule Tuning] AWS GetSessionToken Abuse (#5274)
2025-11-14 09:15:51 +00:00