Skip to content

Commit cf1e783

Browse files
terrancedejesusterrancedejesus
authored
[Security Rules] Update security rules package to v8.11.3-beta.1 (#8486)
* [Security Rules] Update security rules package to v8.11.3-beta.1 * Add changelog entry for 8.11.3-beta.1
1 parent e22c2e1 commit cf1e783

File tree

391 files changed

+41864
-2
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

391 files changed

+41864
-2
lines changed

‎packages/security_detection_engine/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,10 @@
11
# newer versions go on top
22
# NOTE: please use pre-release versions (e.g. -beta.0) until a package is ready for production
3+
- version: 8.11.3-beta.1
4+
changes:
5+
- description: Release security rules update
6+
type: enhancement
7+
link: https://github.com/elastic/integrations/pull/8486
38
- version: 8.11.2
49
changes:
510
- description: Release security rules update

‎packages/security_detection_engine/kibana/security_rule/00140285-b827-4aee-aa09-8113f58a08f3_110.json‎

Lines changed: 141 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,141 @@
1+
{
2+
"attributes": {
3+
"author": [
4+
"Elastic"
5+
],
6+
"description": "Identifies the execution of known Windows utilities often abused to dump LSASS memory or the Active Directory database (NTDS.dit) in preparation for credential access.",
7+
"from": "now-9m",
8+
"index": [
9+
"winlogbeat-*",
10+
"logs-endpoint.events.*",
11+
"logs-windows.*",
12+
"endgame-*",
13+
"logs-system.*"
14+
],
15+
"language": "eql",
16+
"license": "Elastic License v2",
17+
"name": "Potential Credential Access via Windows Utilities",
18+
"note": "## Triage and analysis\n\n### Investigating Potential Credential Access via Windows Utilities\n\nLocal Security Authority Server Service (LSASS) is a process in Microsoft Windows operating systems that is responsible for enforcing security policy on the system. It verifies users logging on to a Windows computer or server, handles password changes, and creates access tokens.\n\nThe `Ntds.dit` file is a database that stores Active Directory data, including information about user objects, groups, and group membership.\n\nThis rule looks for the execution of utilities that can extract credential data from the LSASS memory and Active Directory `Ntds.dit` file.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate abnormal behaviors observed by the subject process, such as network connections, registry or file modifications, and any spawned child processes.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Examine the command line to identify what information was targeted.\n- Identify the target computer and its role in the IT environment.\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently malicious must be monitored by the security team.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- If the host is a domain controller (DC):\n - Activate your incident response plan for total Active Directory compromise.\n - Review the privileges assigned to users that can access the DCs, to ensure that the least privilege principle is being followed and to reduce the attack surface.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n\n",
19+
"query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n(\n (\n (process.pe.original_file_name : \"procdump\" or process.name : \"procdump.exe\") and process.args : \"-ma\"\n ) or\n (\n process.name : \"ProcessDump.exe\" and not process.parent.executable regex~ \"\"\"C:\\\\Program Files( \\(x86\\))?\\\\Cisco Systems\\\\.*\"\"\"\n ) or\n (\n (process.pe.original_file_name : \"WriteMiniDump.exe\" or process.name : \"WriteMiniDump.exe\") and\n not process.parent.executable regex~ \"\"\"C:\\\\Program Files( \\(x86\\))?\\\\Steam\\\\.*\"\"\"\n ) or\n (\n (process.pe.original_file_name : \"RUNDLL32.EXE\" or process.name : \"RUNDLL32.exe\") and\n (process.args : \"MiniDump*\" or process.command_line : \"*comsvcs.dll*#24*\")\n ) or\n (\n (process.pe.original_file_name : \"RdrLeakDiag.exe\" or process.name : \"RdrLeakDiag.exe\") and\n process.args : \"/fullmemdmp\"\n ) or\n (\n (process.pe.original_file_name : \"SqlDumper.exe\" or process.name : \"SqlDumper.exe\") and\n process.args : \"0x01100*\") or\n (\n (process.pe.original_file_name : \"TTTracer.exe\" or process.name : \"TTTracer.exe\") and\n process.args : \"-dumpFull\" and process.args : \"-attach\") or\n (\n (process.pe.original_file_name : \"ntdsutil.exe\" or process.name : \"ntdsutil.exe\") and\n process.args : \"create*full*\") or\n (\n (process.pe.original_file_name : \"diskshadow.exe\" or process.name : \"diskshadow.exe\") and process.args : \"/s\")\n)\n",
20+
"references": [
21+
"https://lolbas-project.github.io/"
22+
],
23+
"related_integrations": [
24+
{
25+
"package": "endpoint",
26+
"version": "^8.2.0"
27+
},
28+
{
29+
"package": "windows",
30+
"version": "^1.5.0"
31+
}
32+
],
33+
"required_fields": [
34+
{
35+
"ecs": true,
36+
"name": "event.type",
37+
"type": "keyword"
38+
},
39+
{
40+
"ecs": true,
41+
"name": "host.os.type",
42+
"type": "keyword"
43+
},
44+
{
45+
"ecs": true,
46+
"name": "process.args",
47+
"type": "keyword"
48+
},
49+
{
50+
"ecs": true,
51+
"name": "process.command_line",
52+
"type": "wildcard"
53+
},
54+
{
55+
"ecs": true,
56+
"name": "process.name",
57+
"type": "keyword"
58+
},
59+
{
60+
"ecs": true,
61+
"name": "process.parent.executable",
62+
"type": "keyword"
63+
},
64+
{
65+
"ecs": true,
66+
"name": "process.pe.original_file_name",
67+
"type": "keyword"
68+
}
69+
],
70+
"risk_score": 73,
71+
"rule_id": "00140285-b827-4aee-aa09-8113f58a08f3",
72+
"setup": "\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2,\nevents will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.\nHence for this rule to work effectively, users will need to add a custom ingest pipeline to populate\n`event.ingested` to @timestamp.\nFor more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html\n",
73+
"severity": "high",
74+
"tags": [
75+
"Domain: Endpoint",
76+
"OS: Windows",
77+
"Use Case: Threat Detection",
78+
"Tactic: Credential Access",
79+
"Tactic: Defense Evasion",
80+
"Resources: Investigation Guide",
81+
"Data Source: Elastic Endgame",
82+
"Data Source: Elastic Defend"
83+
],
84+
"threat": [
85+
{
86+
"framework": "MITRE ATT\u0026CK",
87+
"tactic": {
88+
"id": "TA0006",
89+
"name": "Credential Access",
90+
"reference": "https://attack.mitre.org/tactics/TA0006/"
91+
},
92+
"technique": [
93+
{
94+
"id": "T1003",
95+
"name": "OS Credential Dumping",
96+
"reference": "https://attack.mitre.org/techniques/T1003/",
97+
"subtechnique": [
98+
{
99+
"id": "T1003.001",
100+
"name": "LSASS Memory",
101+
"reference": "https://attack.mitre.org/techniques/T1003/001/"
102+
},
103+
{
104+
"id": "T1003.003",
105+
"name": "NTDS",
106+
"reference": "https://attack.mitre.org/techniques/T1003/003/"
107+
}
108+
]
109+
}
110+
]
111+
},
112+
{
113+
"framework": "MITRE ATT\u0026CK",
114+
"tactic": {
115+
"id": "TA0005",
116+
"name": "Defense Evasion",
117+
"reference": "https://attack.mitre.org/tactics/TA0005/"
118+
},
119+
"technique": [
120+
{
121+
"id": "T1218",
122+
"name": "System Binary Proxy Execution",
123+
"reference": "https://attack.mitre.org/techniques/T1218/",
124+
"subtechnique": [
125+
{
126+
"id": "T1218.011",
127+
"name": "Rundll32",
128+
"reference": "https://attack.mitre.org/techniques/T1218/011/"
129+
}
130+
]
131+
}
132+
]
133+
}
134+
],
135+
"timestamp_override": "event.ingested",
136+
"type": "eql",
137+
"version": 110
138+
},
139+
"id": "00140285-b827-4aee-aa09-8113f58a08f3_110",
140+
"type": "security-rule"
141+
}

‎packages/security_detection_engine/kibana/security_rule/027ff9ea-85e7-42e3-99d2-bbb7069e02eb_104.json‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
{
2+
"attributes": {
3+
"author": [
4+
"Elastic"
5+
],
6+
"description": "Identifies the execution of a Chromium based browser with the debugging process argument, which may indicate an attempt to steal authentication cookies. An adversary may steal web application or service session cookies and use them to gain access web applications or Internet services as an authenticated user without needing credentials.",
7+
"false_positives": [
8+
"Developers performing browsers plugin or extension debugging."
9+
],
10+
"from": "now-9m",
11+
"index": [
12+
"auditbeat-*",
13+
"winlogbeat-*",
14+
"logs-endpoint.events.*",
15+
"logs-windows.*"
16+
],
17+
"language": "eql",
18+
"license": "Elastic License v2",
19+
"max_signals": 33,
20+
"name": "Potential Cookies Theft via Browser Debugging",
21+
"query": "process where event.type in (\"start\", \"process_started\", \"info\") and\n process.name in (\n \"Microsoft Edge\",\n \"chrome.exe\",\n \"Google Chrome\",\n \"google-chrome-stable\",\n \"google-chrome-beta\",\n \"google-chrome\",\n \"msedge.exe\") and\n process.args : (\"--remote-debugging-port=*\",\n \"--remote-debugging-targets=*\",\n \"--remote-debugging-pipe=*\") and\n process.args : \"--user-data-dir=*\" and not process.args:\"--remote-debugging-port=0\"\n",
22+
"references": [
23+
"https://github.com/defaultnamehere/cookie_crimes",
24+
"https://embracethered.com/blog/posts/2020/cookie-crimes-on-mirosoft-edge/",
25+
"https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/post/multi/gather/chrome_cookies.md",
26+
"https://posts.specterops.io/hands-in-the-cookie-jar-dumping-cookies-with-chromiums-remote-debugger-port-34c4f468844e"
27+
],
28+
"related_integrations": [
29+
{
30+
"package": "endpoint",
31+
"version": "^8.2.0"
32+
},
33+
{
34+
"package": "windows",
35+
"version": "^1.5.0"
36+
}
37+
],
38+
"required_fields": [
39+
{
40+
"ecs": true,
41+
"name": "event.type",
42+
"type": "keyword"
43+
},
44+
{
45+
"ecs": true,
46+
"name": "process.args",
47+
"type": "keyword"
48+
},
49+
{
50+
"ecs": true,
51+
"name": "process.name",
52+
"type": "keyword"
53+
}
54+
],
55+
"risk_score": 47,
56+
"rule_id": "027ff9ea-85e7-42e3-99d2-bbb7069e02eb",
57+
"setup": "\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2,\nevents will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.\nHence for this rule to work effectively, users will need to add a custom ingest pipeline to populate\n`event.ingested` to @timestamp.\nFor more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html\n",
58+
"severity": "medium",
59+
"tags": [
60+
"Domain: Endpoint",
61+
"OS: Linux",
62+
"OS: Windows",
63+
"OS: macOS",
64+
"Use Case: Threat Detection",
65+
"Tactic: Credential Access",
66+
"Data Source: Elastic Defend"
67+
],
68+
"threat": [
69+
{
70+
"framework": "MITRE ATT\u0026CK",
71+
"tactic": {
72+
"id": "TA0006",
73+
"name": "Credential Access",
74+
"reference": "https://attack.mitre.org/tactics/TA0006/"
75+
},
76+
"technique": [
77+
{
78+
"id": "T1539",
79+
"name": "Steal Web Session Cookie",
80+
"reference": "https://attack.mitre.org/techniques/T1539/"
81+
}
82+
]
83+
}
84+
],
85+
"timestamp_override": "event.ingested",
86+
"type": "eql",
87+
"version": 104
88+
},
89+
"id": "027ff9ea-85e7-42e3-99d2-bbb7069e02eb_104",
90+
"type": "security-rule"
91+
}

‎packages/security_detection_engine/kibana/security_rule/02a4576a-7480-4284-9327-548a806b5e48_207.json‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
{
2+
"attributes": {
3+
"author": [
4+
"Elastic"
5+
],
6+
"description": "Identifies suspicious access to an LSASS handle via DuplicateHandle from an unknown call trace module. This may indicate an attempt to bypass the NtOpenProcess API to evade detection and dump LSASS memory for credential access.",
7+
"from": "now-9m",
8+
"index": [
9+
"winlogbeat-*",
10+
"logs-windows.*"
11+
],
12+
"language": "eql",
13+
"license": "Elastic License v2",
14+
"name": "Potential Credential Access via DuplicateHandle in LSASS",
15+
"query": "process where host.os.type == \"windows\" and event.code == \"10\" and\n\n /* LSASS requesting DuplicateHandle access right to another process */\n process.name : \"lsass.exe\" and winlog.event_data.GrantedAccess == \"0x40\" and\n\n /* call is coming from an unknown executable region */\n winlog.event_data.CallTrace : \"*UNKNOWN*\"\n",
16+
"references": [
17+
"https://github.com/CCob/MirrorDump"
18+
],
19+
"related_integrations": [
20+
{
21+
"package": "windows",
22+
"version": "^1.5.0"
23+
}
24+
],
25+
"required_fields": [
26+
{
27+
"ecs": true,
28+
"name": "event.code",
29+
"type": "keyword"
30+
},
31+
{
32+
"ecs": true,
33+
"name": "host.os.type",
34+
"type": "keyword"
35+
},
36+
{
37+
"ecs": true,
38+
"name": "process.name",
39+
"type": "keyword"
40+
},
41+
{
42+
"ecs": false,
43+
"name": "winlog.event_data.CallTrace",
44+
"type": "keyword"
45+
},
46+
{
47+
"ecs": false,
48+
"name": "winlog.event_data.GrantedAccess",
49+
"type": "keyword"
50+
}
51+
],
52+
"risk_score": 47,
53+
"rule_id": "02a4576a-7480-4284-9327-548a806b5e48",
54+
"setup": "\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2,\nevents will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.\nHence for this rule to work effectively, users will need to add a custom ingest pipeline to populate\n`event.ingested` to @timestamp.\nFor more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html\n",
55+
"severity": "medium",
56+
"tags": [
57+
"Domain: Endpoint",
58+
"OS: Windows",
59+
"Use Case: Threat Detection",
60+
"Tactic: Credential Access",
61+
"Data Source: Sysmon Only"
62+
],
63+
"threat": [
64+
{
65+
"framework": "MITRE ATT\u0026CK",
66+
"tactic": {
67+
"id": "TA0006",
68+
"name": "Credential Access",
69+
"reference": "https://attack.mitre.org/tactics/TA0006/"
70+
},
71+
"technique": [
72+
{
73+
"id": "T1003",
74+
"name": "OS Credential Dumping",
75+
"reference": "https://attack.mitre.org/techniques/T1003/",
76+
"subtechnique": [
77+
{
78+
"id": "T1003.001",
79+
"name": "LSASS Memory",
80+
"reference": "https://attack.mitre.org/techniques/T1003/001/"
81+
}
82+
]
83+
}
84+
]
85+
}
86+
],
87+
"timestamp_override": "event.ingested",
88+
"type": "eql",
89+
"version": 207
90+
},
91+
"id": "02a4576a-7480-4284-9327-548a806b5e48_207",
92+
"type": "security-rule"
93+
}

0 commit comments

Comments
 (0)