Nasreddine Bencherchali 9fc8942993 New Rules & Updates - Oct 25 (#3726) ...

* new rules and updates

* fix issues with ci

* rename for accurate macro

* update description and logic

* new wbadmin rule and fix pwsh dataset

* more updates for the weekend

* update network rules filters

* downgrade versions

* Update windows_file_transfer_protocol_in_non_common_process_path.yml

* add missing DS for some rules

* update nirsoft lookup and add new rules

* update more nirsoft stuff

* update snort message

* Update cisco_secure_firewall_filetype_lookup.yml

* new analytic and updates / incl. fix #3730

* Update detect_new_local_admin_account.yml

* add lnx dataset and fix wildcards

2025-10-24 14:19:48 -07:00

..

admon.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

amazon_security_lake.yml

new detection

2025-01-08 13:53:03 +01:00

appdynamics_security.yml

adding draft detections

2025-02-04 11:55:10 -08:00

applocker.yml

ESCU Release Branch - v4.30.0

2024-04-17 20:44:56 +00:00

aws_cloudwatchlogs_eks.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

aws_config.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

aws_description.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

aws_ecr_users_asl.yml

Release Branch - ESCU v4.32.0

2024-05-22 16:47:39 +00:00

aws_ecr_users.yml

container upload aws ecr

2021-08-19 15:51:17 +02:00

aws_s3_accesslogs.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

aws_securityhub_finding.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

aws_securityhub_firehose.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

azure_audit.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

azure_monitor_aad.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

azure_monitor_activity.yml

Uploading new detections

2025-01-06 16:19:32 +10:00

azuread.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

base64decode.yml

Release 4.19.0

2024-01-10 17:21:34 +00:00

bootloader_inventory.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

brand_abuse_dns.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

brand_abuse_email.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

brand_abuse_web.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

capi2_operational.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

certificateservices_lifecycle.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

circleci.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

cisco_ai_defense.yml

updaing for validate

2025-02-14 13:42:13 -08:00

cisco_asa.yml

move to public

2025-09-25 13:05:25 -07:00

cisco_duo_activity.yml

add macros

2025-07-10 15:45:40 +02:00

cisco_duo_administrator.yml

add macros

2025-07-10 15:45:40 +02:00

cisco_network_visibility_module_flowdata.yml

add new detections, story and other cool things

2025-07-01 23:04:48 +02:00

cisco_networks.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

cisco_secure_firewall_inside_to_outside.yml

Update cisco_secure_firewall_inside_to_outside.yml

2025-04-03 14:28:58 +02:00

cisco_secure_firewall.yml

update macro name

2025-04-03 14:26:51 +02:00

cloud_api_calls_from_previously_unseen_user_roles_activity_window.yml

single and double quote order issue

2020-09-23 17:32:52 -05:00

cloudtrail.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

cloudwatch_eks.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

cloudwatch_vpc.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

cloudwatchlogs_vpcflow.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

crowdstrike_identities.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

crowdstrike_stream.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

crushftp.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

driverinventory.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

dynamic_dns_providers.yml

Release Branch ESCU 4.23.0

2024-01-30 20:52:05 +00:00

dynamic_dns_web_traffic.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

ec2_modification_api_calls.yml

Removed a few API calls that are not really modifications

2020-08-18 13:47:04 -05:00

esxi_syslog.yml

Initial batch of ESXi content

2025-07-11 11:59:37 -04:00

evilginx_phishlets_0365.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

evilginx_phishlets_amazon.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

evilginx_phishlets_aws.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

evilginx_phishlets_facebook.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

evilginx_phishlets_github.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

evilginx_phishlets_google.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

evilginx_phishlets_outlook.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

f5_bigip_rogue.yml

remove index

2024-12-18 13:32:03 -08:00

fillnull_config.yml

Release Branch - ESCU v4.34.0

2024-06-26 14:41:53 +00:00

filter_rare_process_allow_list.yml

Changed the language in some of the descriptions

2021-01-21 23:53:47 -06:00

github_enterprise.yml

improvements

2025-01-15 16:03:42 +01:00

github_known_users.yml

github detection

2021-09-01 13:56:23 +02:00

github_organizations.yml

new github detections

2025-01-16 10:36:09 +01:00

github.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

google_gcp_pubnet_message.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

google_gcp_pubsub_message.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

gsuite_calendar.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

gsuite_drive.yml

change to supported sourcetype

2025-06-17 09:08:10 -05:00

gsuite_gmail.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

gws_login_mfa_methods.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

gws_reports_admin.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

gws_reports_login.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

iis_get_webglobalmodule.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

iis_operational_logs.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

important_audit_policy_subcategory_guids.yml

feat: add new analytic story and analytic

2025-02-19 11:22:18 +01:00

is_net_windows_file_macro.yml

ESCU Release v4.31.0

2024-05-08 16:05:40 +00:00

is_nirsoft_software_macro.yml

ESCU Release v4.31.0

2024-05-08 16:05:40 +00:00

is_windows_system_file_macro.yml

ESCU Release v4.31.0

2024-05-08 16:05:40 +00:00

ivanti_vtm_audit.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

kube_allowed_images.yml

Release v4.18.0

2023-12-20 16:18:23 +00:00

kube_allowed_locations.yml

ESCU Release v4.31.0

2024-05-08 16:05:40 +00:00

kube_allowed_user_agents.yml

Release v4.18.0

2023-12-20 16:18:23 +00:00

kube_allowed_user_groups.yml

Release v4.18.0

2023-12-20 16:18:23 +00:00

kube_allowed_user_names.yml

Release v4.18.0

2023-12-20 16:18:23 +00:00

kube_audit.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

kube_container_falco.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

kube_objects_events.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

kubernetes_azure.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

kubernetes_container_controller.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

kubernetes_metrics.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

linux_auditd_normalized_execve_process.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

linux_auditd_normalized_proctitle_process.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

linux_auditd.yml

auditd_detection_updates

2025-02-20 13:36:03 +01:00

linux_hosts.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

linux_shells.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

m365_copilot_graph_api.yml

Copilot based Detections (#3693)

2025-10-13 12:14:09 -07:00

m365_exported_ediscovery_prompt_logs.yml

Copilot based Detections (#3693)

2025-10-13 12:14:09 -07:00

moveit_sftp_logs.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

ms365_defender_incident_alerts.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

ms_defender_atp_alerts.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

ms_defender.yml

update: windows event log macros

2025-01-30 20:32:27 +01:00

msexchange_management.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

netbackup.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

network_acl_events.yml

naming updates, jinja macros updates

2019-12-16 13:05:17 -08:00

nginx_access_logs.yml

ESCU v4.26.0 Release branch

2024-03-06 19:30:20 +00:00

normalized_service_binary_field.yml

analytics_enhancement

2025-02-03 18:34:10 +01:00

ntlm_audit.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

o365_graph.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

o365_management_activity.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

o365_messagetrace.yml

Update o365_messagetrace.yml

2025-01-23 14:14:45 -05:00

o365_suspect_search_terms_regex.yml

Update macro

2025-03-17 16:44:09 -07:00

okta.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

oldsummaries_config.yml

Release Branch - ESCU v4.34.0

2024-06-26 14:41:53 +00:00

ollama_server.yml

Ollama TA detections (#3710)

2025-10-13 21:54:37 +02:00

osquery_macro.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

osquery_process.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

papercutng.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

pingid.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

potential_password_in_username_false_positive_reduction.yml

map filter

2022-06-21 12:24:04 -07:00

potentially_malicious_code_on_cmdline_tokenize_score.yml

Editing the macro to put the apply statement into the search query so that it's clear that MLTK is being used

2022-01-26 22:38:13 -05:00

powershell.yml

update: windows event log macros

2025-01-30 20:32:27 +01:00

previously_seen_cloud_api_calls_per_user_role_forget_window.yml

macro fixes

2020-09-23 17:16:35 -05:00

previously_seen_cloud_compute_creations_by_user_search_window_begin_offset.yml

Macro fixes

2020-09-23 17:22:02 -05:00

previously_seen_cloud_compute_image_search_window_begin_offset.yml

Macro fixes

2020-09-23 17:22:02 -05:00

previously_seen_cloud_compute_images_forget_window.yml

macro fixes

2020-09-23 17:16:35 -05:00

previously_seen_cloud_compute_instance_type_forget_window.yml

macro fixes

2020-09-23 17:16:35 -05:00

previously_seen_cloud_compute_instance_types_search_window_begin_offset.yml

Macro fixes

2020-09-23 17:22:02 -05:00

previously_seen_cloud_instance_modifications_by_user_search_window_begin_offset.yml

Macro fixes

2020-09-23 17:22:02 -05:00

previously_seen_cloud_provisioning_activity_forget_window.yml

macro fixes

2020-09-23 17:16:35 -05:00

previously_seen_cloud_region_forget_window.yml

macro fixes

2020-09-23 17:16:35 -05:00

previously_seen_cloud_regions_search_window_begin_offset.yml

Macro fixes

2020-09-23 17:22:02 -05:00

previously_seen_windows_services_forget_window.yml

macro fixes

2020-09-23 17:16:35 -05:00

previously_seen_windows_services_window.yml

bug fix

2021-02-03 15:44:56 +01:00

previously_seen_zoom_child_processes_forget_window.yml

macro fixes

2020-09-23 17:16:35 -05:00

previously_seen_zoom_child_processes_window.yml

Macro fixes

2020-09-23 17:22:02 -05:00

previously_unseen_cloud_provisioning_activity_window.yml

Macro fixes

2020-09-23 17:22:02 -05:00

printservice.yml

update: windows event log macros

2025-01-30 20:32:27 +01:00

process_auditpol.yml

feat: add auditpol macro

2025-02-19 11:22:18 +01:00

process_bitsadmin.yml

macro'd bitsadmin

2021-08-17 15:20:40 -06:00

process_certutil.yml

macro'd certutil

2021-08-17 15:00:51 -06:00

process_cmd.yml

macro'd wmic

2021-08-17 11:44:30 -06:00

process_copy.yml

privilege_escalation_persistence

2021-10-05 11:56:48 +02:00

process_csc.yml

ioc_detections

2021-11-17 16:09:42 +01:00

process_cscript.yml

update powershell analytics

2025-01-14 19:34:31 +01:00

process_curl.yml

fixes

2021-10-20 07:08:14 -06:00

process_diskshadow.yml

DiskShadow + Story Scaffolding

2022-02-17 10:12:50 -06:00

process_dllhost.yml

macros

2021-08-18 09:50:08 -06:00

process_dsquery.yml

macros

2021-08-18 09:50:08 -06:00

process_dxdiag.yml

more_ioc_detections

2021-11-19 12:01:45 +01:00

process_esentutl.yml

Update process_esentutl.yml

2021-08-18 11:14:13 -06:00

process_fodhelper.yml

macros

2021-08-18 09:50:08 -06:00

process_gpupdate.yml

macros

2021-08-18 09:50:08 -06:00

process_hh.yml

macro'd hh

2021-08-17 14:29:16 -06:00

process_installutil.yml

InstallUTIL 🍺

2021-11-12 13:05:19 -07:00

process_microsoftworkflowcompiler.yml

macros

2021-08-18 09:50:08 -06:00

process_msbuild.yml

msbuild and microsoftworkflowcompiler

2021-08-19 06:57:11 -06:00

process_mshta.yml

macro'd mshta

2021-08-17 13:38:11 -06:00

process_msiexec.yml

T1218.007 - MSIExec

2022-06-17 09:36:34 -06:00

process_net.yml

update to analytics using net

2025-01-13 22:20:46 +01:00

process_netsh.yml

macro'd netsh

2021-08-17 15:14:35 -06:00

process_nltest.yml

macros

2021-08-18 09:50:08 -06:00

process_ntdsutil.yml

macros

2021-08-18 09:50:08 -06:00

process_office_products_parent.yml

update office macro

2025-01-14 20:02:52 +01:00

process_office_products.yml

rba changes

2025-01-22 20:18:12 +01:00

process_ping.yml

WhisperGateIsOpen

2022-01-20 15:11:12 +01:00

process_powershell.yml

update powershell analytics

2025-01-14 19:34:31 +01:00

process_procdump.yml

no longer need sysmon procdump - updated superior procdump

2021-09-16 12:06:20 -06:00

process_psexec.yml

hh, mshta, and psexec

2021-09-16 11:13:15 -06:00

process_rclone.yml

rookie mistake

2021-11-30 05:34:29 -07:00

process_reg.yml

macro'd reg cmd

2021-08-17 12:09:31 -06:00

process_regasm.yml

macros

2021-08-18 09:50:08 -06:00

process_regedit.yml

update reg analytics

2025-01-15 15:55:16 +01:00

process_regsvcs.yml

macros

2021-08-18 09:50:08 -06:00

process_regsvr32.yml

macro'd regsvr32

2021-08-17 13:27:48 -06:00

process_route.yml

ioc_detections

2021-11-17 16:09:42 +01:00

process_runas.yml

ioc_detections

2021-11-17 16:09:42 +01:00

process_rundll32.yml

macrod rundll32

2021-08-17 13:21:24 -06:00

process_sc.yml

update to analytics using net

2025-01-13 22:20:46 +01:00

process_schtasks.yml

macros

2021-08-18 09:50:08 -06:00

process_sdelete.yml

privilege_escalation_persistence

2021-10-06 11:15:47 +02:00

process_setspn.yml

HaagRoast

2021-10-15 12:31:33 -06:00

process_sqlcmd.yml

Haag's SQL Server Story Time: Tales of SQLCMD and Suspicious Queries 📚

2025-02-13 17:14:27 -07:00

process_verclsid.yml

privilege_escalation_persistence

2021-09-29 10:42:05 +02:00

process_vssadmin.yml

macros

2021-08-18 09:50:08 -06:00

process_wbadmin.yml

macros

2021-08-18 09:50:08 -06:00

process_wermgr.yml

qakbot_2

2022-10-27 16:07:23 +02:00

process_wmic.yml

Macro'd powershell

2021-08-17 11:15:36 -06:00

process_wscript.yml

update powershell analytics

2025-01-14 19:34:31 +01:00

prohibited_apps_launching_cmd_macro.yml

ESCU Release v4.31.0

2024-05-08 16:05:40 +00:00

prohibited_softwares.yml

Release Branch - ESCU v4.34.0

2024-06-26 14:41:53 +00:00

ransomware_extensions.yml

output normalisation

2025-03-05 14:25:32 +01:00

ransomware_notes.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

remote_access_software_usage_exceptions.yml

Modified macro name for clarity, updated how to implements with details

2024-07-26 14:11:24 -05:00

remoteconnectionmanager.yml

update: windows event log macros

2025-01-30 20:32:27 +01:00

remove_valid_domains.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

risk_index.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

s3_accesslogs.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

secureapp_es_field_mappings.yml

updating spl

2025-08-04 14:48:58 -05:00

security_content_ctime.yml

Present times in ISO8601 instead of US style

2020-08-12 23:45:53 +02:00

security_content_summariesonly.yml

Release Branch - ESCU v4.34.0

2024-06-26 14:41:53 +00:00

security_group_api_calls.yml

naming updates, jinja macros updates

2019-12-16 13:05:17 -08:00

stream_dns.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

stream_http.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

stream_tcp.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

subjectinterfacepackage.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

summariesonly_config.yml

Release Branch - ESCU v4.34.0

2024-06-26 14:41:53 +00:00

suricata.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

suspicious_email_attachments.yml

naming updates, jinja macros updates

2019-12-16 13:05:17 -08:00

suspicious_writes.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

sysmon.yml

update: windows event log macros

2025-01-30 20:32:27 +01:00

system_network_configuration_discovery_tools.yml

additional updates and fixes

2025-01-20 16:42:07 +01:00

uacbypass_process_name.yml

Release 4.19.0

2024-01-10 17:21:34 +00:00

uncommon_processes.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

windows_exchange_iis.yml

update exchange macro

2025-02-19 21:11:52 +01:00

windows_shells.yml

New Rules & Updates - Oct 25 (#3726)

2025-10-24 14:19:48 -07:00

wineventlog_application.yml

update: windows event log macros

2025-01-30 20:32:27 +01:00

wineventlog_appxdeploymentserver.yml

The Lost Payload: MSIX Resurrection

2025-08-18 11:46:34 -06:00

wineventlog_appxpackaging.yml

The Lost Payload: MSIX Resurrection

2025-08-18 11:46:34 -06:00

wineventlog_rdp.yml

update: windows event log macros

2025-01-30 20:32:27 +01:00

wineventlog_security.yml

update: windows event log macros

2025-01-30 20:32:27 +01:00

wineventlog_system.yml

update: windows event log macros

2025-01-30 20:32:27 +01:00

wineventlog_task_scheduler.yml

update: windows event log macros

2025-01-30 20:32:27 +01:00

wmi.yml

update: windows event log macros

2025-01-30 20:32:27 +01:00

zeek_rpc.yml

remove index

2024-12-18 13:32:03 -08:00

zeek_ssl.yml

remove index

2024-12-18 13:32:03 -08:00

zeek_x509.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00

zoom_index.yml

Initial remote employment fraud detections.

2025-06-12 14:43:59 -04:00

zscaler_proxy.yml

fix env typo in macros

2024-11-26 23:43:48 +01:00