Skip to content

Commit 2bf004d

Browse files
FrankHassanabadrw-access
FrankHassanabad
and
rw-access
authored
[Detection Rules] Add 7.14 rules (#104772) (#105790)
Co-authored-by: Ross Wolf <31489089+rw-access@users.noreply.github.com>
1 parent f6018f7 commit 2bf004d

9 files changed

+396
-3
lines changed

‎x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_disabling_windows_defender_powershell.json‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
{
2+
"author": [
3+
"Elastic"
4+
],
5+
"description": "Identifies use of the Set-MpPreference PowerShell command to disable or weaken certain Windows Defender settings.",
6+
"false_positives": [
7+
"Planned Windows Defender configuration changes."
8+
],
9+
"from": "now-9m",
10+
"index": [
11+
"winlogbeat-*",
12+
"logs-endpoint.events.*",
13+
"logs-windows.*"
14+
],
15+
"language": "eql",
16+
"license": "Elastic License v2",
17+
"name": "Disabling Windows Defender Security Settings via PowerShell",
18+
"query": "process where event.type == \"start\" and\n (process.name : (\"powershell.exe\", \"pwsh.exe\") or process.pe.original_file_name == \"PowerShell.EXE\") and\n process.args : \"Set-MpPreference\" and process.args : (\"-Disable*\", \"Disabled\", \"NeverSend\", \"-Exclusion*\")\n",
19+
"references": [
20+
"https://docs.microsoft.com/en-us/powershell/module/defender/set-mppreference?view=windowsserver2019-ps"
21+
],
22+
"risk_score": 47,
23+
"rule_id": "c8cccb06-faf2-4cd5-886e-2c9636cfcb87",
24+
"severity": "medium",
25+
"tags": [
26+
"Elastic",
27+
"Host",
28+
"Windows",
29+
"Threat Detection",
30+
"Defense Evasion"
31+
],
32+
"threat": [
33+
{
34+
"framework": "MITRE ATT&CK",
35+
"tactic": {
36+
"id": "TA0005",
37+
"name": "Defense Evasion",
38+
"reference": "https://attack.mitre.org/tactics/TA0005/"
39+
},
40+
"technique": [
41+
{
42+
"id": "T1562",
43+
"name": "Impair Defenses",
44+
"reference": "https://attack.mitre.org/techniques/T1562/",
45+
"subtechnique": [
46+
{
47+
"id": "T1562.001",
48+
"name": "Disable or Modify Tools",
49+
"reference": "https://attack.mitre.org/techniques/T1562/001/"
50+
}
51+
]
52+
}
53+
]
54+
}
55+
],
56+
"timestamp_override": "event.ingested",
57+
"type": "eql",
58+
"version": 1
59+
}

‎x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_enable_network_discovery_with_netsh.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"author": [
3+
"Elastic"
4+
],
5+
"description": "Identifies use of the netsh.exe program to enable host discovery via the network. Attackers can use this command-line tool to weaken the host firewall settings.",
6+
"false_positives": [
7+
"Host Windows Firewall planned system administration changes."
8+
],
9+
"from": "now-9m",
10+
"index": [
11+
"winlogbeat-*",
12+
"logs-endpoint.events.*",
13+
"logs-windows.*"
14+
],
15+
"language": "eql",
16+
"license": "Elastic License v2",
17+
"name": "Enable Host Network Discovery via Netsh",
18+
"query": "process where event.type == \"start\" and\nprocess.name : \"netsh.exe\" and\nprocess.args : (\"firewall\", \"advfirewall\") and process.args : \"group=Network Discovery\" and process.args : \"enable=Yes\"\n",
19+
"risk_score": 47,
20+
"rule_id": "8b4f0816-6a65-4630-86a6-c21c179c0d09",
21+
"severity": "medium",
22+
"tags": [
23+
"Elastic",
24+
"Host",
25+
"Windows",
26+
"Threat Detection",
27+
"Defense Evasion"
28+
],
29+
"threat": [
30+
{
31+
"framework": "MITRE ATT&CK",
32+
"tactic": {
33+
"id": "TA0005",
34+
"name": "Defense Evasion",
35+
"reference": "https://attack.mitre.org/tactics/TA0005/"
36+
},
37+
"technique": [
38+
{
39+
"id": "T1562",
40+
"name": "Impair Defenses",
41+
"reference": "https://attack.mitre.org/techniques/T1562/",
42+
"subtechnique": [
43+
{
44+
"id": "T1562.001",
45+
"name": "Disable or Modify Tools",
46+
"reference": "https://attack.mitre.org/techniques/T1562/001/"
47+
}
48+
]
49+
}
50+
]
51+
}
52+
],
53+
"timestamp_override": "event.ingested",
54+
"type": "eql",
55+
"version": 1
56+
}

‎x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_execution_windefend_unusual_path.json‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
{
2+
"author": [
3+
"Elastic"
4+
],
5+
"description": "Identifies a Windows trusted program that is known to be vulnerable to DLL Search Order Hijacking starting after being renamed or from a non-standard path. This is uncommon behavior and may indicate an attempt to evade defenses via side-loading a malicious DLL within the memory space of one of those processes.",
6+
"false_positives": [
7+
"Microsoft Antimalware Service Executable installed on non default installation path."
8+
],
9+
"from": "now-9m",
10+
"index": [
11+
"winlogbeat-*",
12+
"logs-endpoint.events.*",
13+
"logs-windows.*"
14+
],
15+
"language": "eql",
16+
"license": "Elastic License v2",
17+
"name": "Potential DLL Side-Loading via Microsoft Antimalware Service Executable",
18+
"query": "process where event.type == \"start\" and\n (process.pe.original_file_name == \"MsMpEng.exe\" and not process.name : \"MsMpEng.exe\") or\n (process.name : \"MsMpEng.exe\" and not\n process.executable : (\"?:\\\\ProgramData\\\\Microsoft\\\\Windows Defender\\\\*.exe\",\n \"?:\\\\Program Files\\\\Windows Defender\\\\*.exe\",\n \"?:\\\\Program Files (x86)\\\\Windows Defender\\\\*.exe\"))\n",
19+
"references": [
20+
"https://news.sophos.com/en-us/2021/07/04/independence-day-revil-uses-supply-chain-exploit-to-attack-hundreds-of-businesses/"
21+
],
22+
"risk_score": 73,
23+
"rule_id": "053a0387-f3b5-4ba5-8245-8002cca2bd08",
24+
"severity": "high",
25+
"tags": [
26+
"Elastic",
27+
"Host",
28+
"Windows",
29+
"Threat Detection",
30+
"Defense Evasion"
31+
],
32+
"threat": [
33+
{
34+
"framework": "MITRE ATT&CK",
35+
"tactic": {
36+
"id": "TA0005",
37+
"name": "Defense Evasion",
38+
"reference": "https://attack.mitre.org/tactics/TA0005/"
39+
},
40+
"technique": [
41+
{
42+
"id": "T1574",
43+
"name": "Hijack Execution Flow",
44+
"reference": "https://attack.mitre.org/techniques/T1574/",
45+
"subtechnique": [
46+
{
47+
"id": "T1574.002",
48+
"name": "DLL Side-Loading",
49+
"reference": "https://attack.mitre.org/techniques/T1574/002/"
50+
}
51+
]
52+
}
53+
]
54+
}
55+
],
56+
"timestamp_override": "event.ingested",
57+
"type": "eql",
58+
"version": 1
59+
}

‎x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/exfiltration_ec2_vm_export_failure.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@
1616
"language": "kuery",
1717
"license": "Elastic License v2",
1818
"name": "AWS EC2 VM Export Failure",
19-
"note": "## Config\nThe AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.",
19+
"note": "## Config\n\nThe AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.",
2020
"query": "event.dataset:aws.cloudtrail and event.provider:ec2.amazonaws.com and event.action:CreateInstanceExportTask and event.outcome:failure\n",
2121
"references": [
2222
"https://docs.aws.amazon.com/vm-import/latest/userguide/vmexport.html#export-instance"
@@ -66,5 +66,5 @@
6666
],
6767
"timestamp_override": "event.ingested",
6868
"type": "query",
69-
"version": 1
69+
"version": 2
7070
}

‎x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/index.ts‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -562,7 +562,14 @@ import rule549 from './ml_auth_rare_user_logon.json';
562562
import rule550 from './ml_auth_spike_in_failed_logon_events.json';
563563
import rule551 from './ml_auth_spike_in_logon_events.json';
564564
import rule552 from './ml_auth_spike_in_logon_events_from_a_source_ip.json';
565-
import rule553 from './persistence_via_bits_job_notify_command.json';
565+
import rule553 from './privilege_escalation_printspooler_malicious_driver_file_changes.json';
566+
import rule554 from './privilege_escalation_printspooler_malicious_registry_modification.json';
567+
import rule555 from './privilege_escalation_printspooler_suspicious_file_deletion.json';
568+
import rule556 from './privilege_escalation_unusual_printspooler_childprocess.json';
569+
import rule557 from './defense_evasion_disabling_windows_defender_powershell.json';
570+
import rule558 from './defense_evasion_enable_network_discovery_with_netsh.json';
571+
import rule559 from './defense_evasion_execution_windefend_unusual_path.json';
572+
import rule560 from './persistence_via_bits_job_notify_command.json';
566573

567574
export const rawRules = [
568575
rule1,
@@ -1118,4 +1125,11 @@ export const rawRules = [
11181125
rule551,
11191126
rule552,
11201127
rule553,
1128+
rule554,
1129+
rule555,
1130+
rule556,
1131+
rule557,
1132+
rule558,
1133+
rule559,
1134+
rule560,
11211135
];

‎x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_printspooler_malicious_driver_file_changes.json‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
{
2+
"author": [
3+
"Elastic"
4+
],
5+
"description": "Detects the creation or modification of a print driver with an unusual file name. This may indicate attempts to exploit privilege escalation vulnerabilities related to the Print Spooler service. For more information refer to CVE-2021-34527 and verify that the impacted system is investigated.",
6+
"from": "now-9m",
7+
"index": [
8+
"winlogbeat-*",
9+
"logs-endpoint.events.*",
10+
"logs-windows.*"
11+
],
12+
"language": "eql",
13+
"license": "Elastic License v2",
14+
"name": "Potential PrintNightmare File Modification",
15+
"query": "/* This rule is compatible with both Sysmon and Elastic Endpoint */\n\nfile where process.name : \"spoolsv.exe\" and \n file.name : (\"kernelbase.dll\", \"ntdll.dll\", \"kernel32.dll\", \"winhttp.dll\", \"user32.dll\") and\n file.path : \"?:\\\\Windows\\\\System32\\\\spool\\\\drivers\\\\x64\\\\3\\\\*\"\n",
16+
"references": [
17+
"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527",
18+
"https://github.com/afwu/PrintNightmare"
19+
],
20+
"risk_score": 73,
21+
"rule_id": "5e87f165-45c2-4b80-bfa5-52822552c997",
22+
"severity": "high",
23+
"tags": [
24+
"Elastic",
25+
"Host",
26+
"Windows",
27+
"Threat Detection",
28+
"Privilege Escalation"
29+
],
30+
"threat": [
31+
{
32+
"framework": "MITRE ATT&CK",
33+
"tactic": {
34+
"id": "TA0004",
35+
"name": "Privilege Escalation",
36+
"reference": "https://attack.mitre.org/tactics/TA0004/"
37+
},
38+
"technique": [
39+
{
40+
"id": "T1068",
41+
"name": "Exploitation for Privilege Escalation",
42+
"reference": "https://attack.mitre.org/techniques/T1068/"
43+
}
44+
]
45+
}
46+
],
47+
"timestamp_override": "event.ingested",
48+
"type": "eql",
49+
"version": 1
50+
}

‎x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_printspooler_malicious_registry_modification.json‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
{
2+
"author": [
3+
"Elastic"
4+
],
5+
"description": "Detects attempts to exploit privilege escalation vulnerabilities related to the Print Spooler service. For more information refer to CVE-2021-34527 and verify that the impacted system is investigated.",
6+
"from": "now-9m",
7+
"index": [
8+
"logs-endpoint.events.*",
9+
"logs-windows.*"
10+
],
11+
"language": "eql",
12+
"license": "Elastic License v2",
13+
"name": "Potential PrintNightmare Exploit Registry Modification",
14+
"query": "/* This rule is not compatible with Sysmon due to schema issues */\n\nregistry where process.name : \"spoolsv.exe\" and\n (registry.path : \"HKLM\\\\SYSTEM\\\\ControlSet*\\\\Control\\\\Print\\\\Environments\\\\Windows*\\\\Drivers\\\\Version-3\\\\mimikatz*\\\\Data File\" or\n (registry.path : \"HKLM\\\\SYSTEM\\\\ControlSet*\\\\Control\\\\Print\\\\Environments\\\\Windows*\\\\Drivers\\\\Version-3\\\\*\\\\Configuration File\" and\n registry.data.strings : (\"kernelbase.dll\", \"ntdll.dll\", \"kernel32.dll\", \"winhttp.dll\", \"user32.dll\")))\n",
15+
"references": [
16+
"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527",
17+
"https://github.com/afwu/PrintNightmare"
18+
],
19+
"risk_score": 73,
20+
"rule_id": "6506c9fd-229e-4722-8f0f-69be759afd2a",
21+
"severity": "high",
22+
"tags": [
23+
"Elastic",
24+
"Host",
25+
"Windows",
26+
"Threat Detection",
27+
"Privilege Escalation"
28+
],
29+
"threat": [
30+
{
31+
"framework": "MITRE ATT&CK",
32+
"tactic": {
33+
"id": "TA0004",
34+
"name": "Privilege Escalation",
35+
"reference": "https://attack.mitre.org/tactics/TA0004/"
36+
},
37+
"technique": [
38+
{
39+
"id": "T1068",
40+
"name": "Exploitation for Privilege Escalation",
41+
"reference": "https://attack.mitre.org/techniques/T1068/"
42+
}
43+
]
44+
}
45+
],
46+
"timestamp_override": "event.ingested",
47+
"type": "eql",
48+
"version": 1
49+
}

‎x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_printspooler_suspicious_file_deletion.json‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
{
2+
"author": [
3+
"Elastic"
4+
],
5+
"description": "Detects deletion of print driver files by an unusual process. This may indicate a clean up attempt post successful privilege escalation via Print Spooler service related vulnerabilities.",
6+
"false_positives": [
7+
"Uninstall or manual deletion of a legitimate printing driver files. Verify the printer file metadata such as manufacturer and signature information."
8+
],
9+
"from": "now-9m",
10+
"index": [
11+
"winlogbeat-*",
12+
"logs-endpoint.events.*",
13+
"logs-windows.*"
14+
],
15+
"language": "eql",
16+
"license": "Elastic License v2",
17+
"name": "Suspicious Print Spooler File Deletion",
18+
"query": "file where event.type : \"deletion\" and\n not process.name : (\"spoolsv.exe\", \"dllhost.exe\", \"explorer.exe\") and\n file.path : \"?:\\\\Windows\\\\System32\\\\spool\\\\drivers\\\\x64\\\\3\\\\*.dll\"\n",
19+
"references": [
20+
"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527",
21+
"https://github.com/afwu/PrintNightmare"
22+
],
23+
"risk_score": 47,
24+
"rule_id": "c4818812-d44f-47be-aaef-4cfb2f9cc799",
25+
"severity": "medium",
26+
"tags": [
27+
"Elastic",
28+
"Host",
29+
"Windows",
30+
"Threat Detection",
31+
"Privilege Escalation"
32+
],
33+
"threat": [
34+
{
35+
"framework": "MITRE ATT&CK",
36+
"tactic": {
37+
"id": "TA0004",
38+
"name": "Privilege Escalation",
39+
"reference": "https://attack.mitre.org/tactics/TA0004/"
40+
},
41+
"technique": [
42+
{
43+
"id": "T1068",
44+
"name": "Exploitation for Privilege Escalation",
45+
"reference": "https://attack.mitre.org/techniques/T1068/"
46+
}
47+
]
48+
}
49+
],
50+
"timestamp_override": "event.ingested",
51+
"type": "eql",
52+
"version": 1
53+
}

0 commit comments

Comments
 (0)