Skip to content

Commit 3ce10b9

Browse files
mergify[bot]brokensound77
mergify[bot]
and
brokensound77
authored
Add rules for integration-v0.14.3 (#1331) (#1344)
* Add rules for integration-v0.14.3 * add summary note * fix link * fix file name * remove duplicated links caused by a deprecation/rename * update date and summary description (cherry picked from commit d07ae02) Co-authored-by: Justin Ibarra <[email protected]>
1 parent 03c1d3f commit 3ce10b9

File tree

85 files changed

+6448
-1
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

85 files changed

+6448
-1
lines changed

‎docs/detections/prebuilt-rules/downloadable-packages/0-14-3/prebuilt-rule-0-14-3-account-password-reset-remotely.asciidoc

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
[[prebuilt-rule-0-14-3-account-password-reset-remotely]]
2+
=== Account Password Reset Remotely
3+
4+
Identifies an attempt to reset an account password remotely. Adversaries may manipulate account passwords to maintain access or evade password duration policies and preserve compromised credentials.
5+
6+
*Rule type*: eql
7+
8+
*Rule indices*:
9+
10+
* winlogbeat-*
11+
* logs-windows.*
12+
13+
*Severity*: medium
14+
15+
*Risk score*: 47
16+
17+
*Runs every*: 5m
18+
19+
*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
20+
21+
*Maximum alerts per execution*: 100
22+
23+
*References*:
24+
25+
* https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4724
26+
* https://stealthbits.com/blog/manipulating-user-passwords-with-mimikatz/
27+
* https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES/blob/master/Credential%20Access/remote_pwd_reset_rpc_mimikatz_postzerologon_target_DC.evtx
28+
29+
*Tags*:
30+
31+
* Elastic
32+
* Host
33+
* Windows
34+
* Threat Detection
35+
* Persistence
36+
37+
*Version*: 1
38+
39+
*Rule authors*:
40+
41+
* Elastic
42+
43+
*Rule license*: Elastic License v2
44+
45+
46+
==== Rule query
47+
48+
49+
[source, js]
50+
----------------------------------
51+
sequence by host.id with maxspan=5m
52+
[authentication where event.action == "logged-in" and
53+
/* event 4624 need to be logged */
54+
winlog.logon.type : "Network" and event.outcome == "success" and source.ip != null and
55+
not source.ip in ("127.0.0.1", "::1")] by winlog.event_data.TargetLogonId
56+
/* event 4724 need to be logged */
57+
[iam where event.action == "reset-password"] by winlog.event_data.SubjectLogonId
58+
59+
----------------------------------
60+
61+
*Framework*: MITRE ATT&CK^TM^
62+
63+
* Tactic:
64+
** Name: Persistence
65+
** ID: TA0003
66+
** Reference URL: https://attack.mitre.org/tactics/TA0003/
67+
* Technique:
68+
** Name: Account Manipulation
69+
** ID: T1098
70+
** Reference URL: https://attack.mitre.org/techniques/T1098/

‎docs/detections/prebuilt-rules/downloadable-packages/0-14-3/prebuilt-rule-0-14-3-aws-efs-file-system-or-mount-deleted.asciidoc

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
[[prebuilt-rule-0-14-3-aws-efs-file-system-or-mount-deleted]]
2+
=== AWS EFS File System or Mount Deleted
3+
4+
Detects when a EFS File System or Mount is deleted. An adversary could break any file system using the mount target that is being deleted, which might disrupt instances or applications using those mounts. The mount must be deleted prior to deleting the File System, or the adversary will be unable to delete the File System.
5+
6+
*Rule type*: query
7+
8+
*Rule indices*:
9+
10+
* filebeat-*
11+
* logs-aws*
12+
13+
*Severity*: medium
14+
15+
*Risk score*: 47
16+
17+
*Runs every*: 10m
18+
19+
*Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
20+
21+
*Maximum alerts per execution*: 100
22+
23+
*References*:
24+
25+
* https://docs.aws.amazon.com/efs/latest/ug/API_DeleteFileSystem.html
26+
* https://docs.aws.amazon.com/efs/latest/ug/API_DeleteMountTarget.html
27+
28+
*Tags*:
29+
30+
* Elastic
31+
* Cloud
32+
* AWS
33+
* Continuous Monitoring
34+
* SecOps
35+
* Data Protection
36+
37+
*Version*: 1
38+
39+
*Rule authors*:
40+
41+
* Austin Songer
42+
43+
*Rule license*: Elastic License v2
44+
45+
46+
==== Investigation guide
47+
48+
49+
[source, markdown]
50+
----------------------------------
51+
## Config
52+
53+
The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
54+
----------------------------------
55+
56+
==== Rule query
57+
58+
59+
[source, js]
60+
----------------------------------
61+
event.dataset:aws.cloudtrail and event.provider:elasticfilesystem.amazonaws.com and
62+
event.action:(DeleteMountTarget or DeleteFileSystem) and event.outcome:success
63+
64+
----------------------------------
65+
66+
*Framework*: MITRE ATT&CK^TM^
67+
68+
* Tactic:
69+
** Name: Impact
70+
** ID: TA0040
71+
** Reference URL: https://attack.mitre.org/tactics/TA0040/
72+
* Technique:
73+
** Name: Data Destruction
74+
** ID: T1485
75+
** Reference URL: https://attack.mitre.org/techniques/T1485/

‎docs/detections/prebuilt-rules/downloadable-packages/0-14-3/prebuilt-rule-0-14-3-aws-eventbridge-rule-disabled-or-deleted.asciidoc

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
[[prebuilt-rule-0-14-3-aws-eventbridge-rule-disabled-or-deleted]]
2+
=== AWS EventBridge Rule Disabled or Deleted
3+
4+
Identifies when a user has disabled or deleted an EventBridge rule. This activity can result in an unintended loss of visibility in applications or a break in the flow with other AWS services.
5+
6+
*Rule type*: query
7+
8+
*Rule indices*:
9+
10+
* filebeat-*
11+
* logs-aws*
12+
13+
*Severity*: low
14+
15+
*Risk score*: 21
16+
17+
*Runs every*: 5m
18+
19+
*Searches indices from*: now-20m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
20+
21+
*Maximum alerts per execution*: 100
22+
23+
*References*:
24+
25+
* https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_DeleteRule.html
26+
* https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_DisableRule.html
27+
28+
*Tags*:
29+
30+
* Elastic
31+
* Cloud
32+
* AWS
33+
* Continuous Monitoring
34+
* SecOps
35+
* Monitoring
36+
37+
*Version*: 2
38+
39+
*Rule authors*:
40+
41+
* Austin Songer
42+
43+
*Rule license*: Elastic License v2
44+
45+
46+
==== Investigation guide
47+
48+
49+
[source, markdown]
50+
----------------------------------
51+
## Config
52+
53+
The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
54+
----------------------------------
55+
56+
==== Rule query
57+
58+
59+
[source, js]
60+
----------------------------------
61+
event.dataset:aws.cloudtrail and event.provider:eventbridge.amazonaws.com and event.action:(DeleteRule or DisableRule) and
62+
event.outcome:success
63+
64+
----------------------------------
65+
66+
*Framework*: MITRE ATT&CK^TM^
67+
68+
* Tactic:
69+
** Name: Impact
70+
** ID: TA0040
71+
** Reference URL: https://attack.mitre.org/tactics/TA0040/

‎docs/detections/prebuilt-rules/downloadable-packages/0-14-3/prebuilt-rule-0-14-3-aws-rds-snapshot-export.asciidoc

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
[[prebuilt-rule-0-14-3-aws-rds-snapshot-export]]
2+
=== AWS RDS Snapshot Export
3+
4+
Identifies the export of an Amazon Relational Database Service (RDS) Aurora database snapshot.
5+
6+
*Rule type*: query
7+
8+
*Rule indices*:
9+
10+
* filebeat-*
11+
* logs-aws*
12+
13+
*Severity*: low
14+
15+
*Risk score*: 21
16+
17+
*Runs every*: 10m
18+
19+
*Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
20+
21+
*Maximum alerts per execution*: 100
22+
23+
*References*:
24+
25+
* https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_StartExportTask.html
26+
27+
*Tags*:
28+
29+
* Elastic
30+
* Cloud
31+
* AWS
32+
* Continuous Monitoring
33+
* SecOps
34+
* Asset Visibility
35+
36+
*Version*: 3
37+
38+
*Rule authors*:
39+
40+
* Elastic
41+
42+
*Rule license*: Elastic License v2
43+
44+
45+
==== Investigation guide
46+
47+
48+
[source, markdown]
49+
----------------------------------
50+
## Config
51+
52+
The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
53+
----------------------------------
54+
55+
==== Rule query
56+
57+
58+
[source, js]
59+
----------------------------------
60+
event.dataset:aws.cloudtrail and event.provider:rds.amazonaws.com and event.action:StartExportTask and event.outcome:success
61+
62+
----------------------------------
63+
64+
*Framework*: MITRE ATT&CK^TM^
65+
66+
* Tactic:
67+
** Name: Exfiltration
68+
** ID: TA0010
69+
** Reference URL: https://attack.mitre.org/tactics/TA0010/

‎docs/detections/prebuilt-rules/downloadable-packages/0-14-3/prebuilt-rule-0-14-3-aws-rds-snapshot-restored.asciidoc

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
[[prebuilt-rule-0-14-3-aws-rds-snapshot-restored]]
2+
=== AWS RDS Snapshot Restored
3+
4+
Identifies when an attempt was made to restore an RDS Snapshot. Snapshots are sometimes shared by threat actors in order to exfiltrate bulk data. If the permissions were modified, verify if the snapshot was shared with an unauthorized or unexpected AWS account.
5+
6+
*Rule type*: query
7+
8+
*Rule indices*:
9+
10+
* filebeat-*
11+
* logs-aws*
12+
13+
*Severity*: medium
14+
15+
*Risk score*: 47
16+
17+
*Runs every*: 5m
18+
19+
*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
20+
21+
*Maximum alerts per execution*: 100
22+
23+
*References*:
24+
25+
* https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_RestoreDBInstanceFromDBSnapshot.html
26+
* https://github.com/RhinoSecurityLabs/pacu/blob/master/pacu/modules/rds__explore_snapshots/main.py
27+
28+
*Tags*:
29+
30+
* Elastic
31+
* Cloud
32+
* AWS
33+
* Continuous Monitoring
34+
* SecOps
35+
* Asset Visibility
36+
37+
*Version*: 2
38+
39+
*Rule authors*:
40+
41+
* Austin Songer
42+
43+
*Rule license*: Elastic License v2
44+
45+
46+
==== Investigation guide
47+
48+
49+
[source, markdown]
50+
----------------------------------
51+
## Config
52+
53+
The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
54+
----------------------------------
55+
56+
==== Rule query
57+
58+
59+
[source, js]
60+
----------------------------------
61+
event.dataset:aws.cloudtrail and event.provider:rds.amazonaws.com and event.action:RestoreDBInstanceFromDBSnapshot and
62+
event.outcome:success
63+
64+
----------------------------------
65+
66+
*Framework*: MITRE ATT&CK^TM^
67+
68+
* Tactic:
69+
** Name: Exfiltration
70+
** ID: TA0010
71+
** Reference URL: https://attack.mitre.org/tactics/TA0010/

0 commit comments

Comments
 (0)