Skip to content

Commit 5446a87

Browse files
protectionsmachineprotectionsmachine
authored
Update latest docs (#5213)
1 parent 3490259 commit 5446a87

File tree

108 files changed

+7563
-249
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

108 files changed

+7563
-249
lines changed

‎docs/detections/prebuilt-rules/downloadable-packages/8-12-12/prebuilt-rule-8-12-12-access-to-keychain-credentials-directories.asciidoc‎

Lines changed: 136 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,136 @@
1+
[[prebuilt-rule-8-12-12-access-to-keychain-credentials-directories]]
2+
=== Access to Keychain Credentials Directories
3+
4+
Adversaries may collect the keychain storage data from a system to acquire credentials. Keychains are the built-in way for macOS to keep track of users' passwords and credentials for many services and features such as WiFi passwords, websites, secure notes and certificates.
5+
6+
*Rule type*: eql
7+
8+
*Rule indices*:
9+
10+
* logs-endpoint.events.*
11+
12+
*Severity*: high
13+
14+
*Risk score*: 73
15+
16+
*Runs every*: 5m
17+
18+
*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
19+
20+
*Maximum alerts per execution*: 100
21+
22+
*References*:
23+
24+
* https://objective-see.com/blog/blog_0x25.html
25+
* https://securelist.com/calisto-trojan-for-macos/86543/
26+
27+
*Tags*:
28+
29+
* Domain: Endpoint
30+
* OS: macOS
31+
* Use Case: Threat Detection
32+
* Tactic: Credential Access
33+
* Data Source: Elastic Defend
34+
35+
*Version*: 207
36+
37+
*Rule authors*:
38+
39+
* Elastic
40+
41+
*Rule license*: Elastic License v2
42+
43+
44+
==== Setup
45+
46+
47+
48+
*Setup*
49+
50+
51+
This rule requires data coming in from Elastic Defend.
52+
53+
54+
*Elastic Defend Integration Setup*
55+
56+
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
57+
58+
59+
*Prerequisite Requirements:*
60+
61+
- Fleet is required for Elastic Defend.
62+
- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
63+
64+
65+
*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
66+
67+
- Go to the Kibana home page and click "Add integrations".
68+
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
69+
- Click "Add Elastic Defend".
70+
- Configure the integration name and optionally add a description.
71+
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
72+
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
73+
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
74+
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
75+
For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
76+
- Click "Save and Continue".
77+
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
78+
For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
79+
80+
81+
==== Rule query
82+
83+
84+
[source, js]
85+
----------------------------------
86+
process where host.os.type == "macos" and event.type in ("start", "process_started") and
87+
process.args :
88+
(
89+
"/Users/*/Library/Keychains/*",
90+
"/Library/Keychains/*",
91+
"/Network/Library/Keychains/*",
92+
"System.keychain",
93+
"login.keychain-db",
94+
"login.keychain"
95+
) and
96+
not process.args : ("find-certificate",
97+
"add-trusted-cert",
98+
"set-keychain-settings",
99+
"delete-certificate",
100+
"/Users/*/Library/Keychains/openvpn.keychain-db",
101+
"show-keychain-info",
102+
"lock-keychain",
103+
"set-key-partition-list",
104+
"import",
105+
"find-identity") and
106+
not process.parent.executable :
107+
(
108+
"/Applications/OpenVPN Connect/OpenVPN Connect.app/Contents/MacOS/OpenVPN Connect",
109+
"/Applications/Microsoft Defender.app/Contents/MacOS/wdavdaemon_enterprise.app/Contents/MacOS/wdavdaemon_enterprise",
110+
"/opt/jc/bin/jumpcloud-agent"
111+
) and
112+
not process.executable : ("/opt/jc/bin/jumpcloud-agent", "/usr/bin/basename") and
113+
not process.Ext.effective_parent.executable : ("/opt/rapid7/ir_agent/ir_agent",
114+
"/Library/Elastic/Endpoint/elastic-endpoint.app/Contents/MacOS/elastic-endpoint",
115+
"/Applications/QualysCloudAgent.app/Contents/MacOS/qualys-cloud-agent",
116+
"/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfDaemon.app/Contents/MacOS/JamfDaemon",
117+
"/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfManagementService.app/Contents/MacOS/JamfManagementService",
118+
"/usr/local/jamf/bin/jamf",
119+
"/Applications/Microsoft Defender.app/Contents/MacOS/wdavdaemon")
120+
121+
----------------------------------
122+
123+
*Framework*: MITRE ATT&CK^TM^
124+
125+
* Tactic:
126+
** Name: Credential Access
127+
** ID: TA0006
128+
** Reference URL: https://attack.mitre.org/tactics/TA0006/
129+
* Technique:
130+
** Name: Credentials from Password Stores
131+
** ID: T1555
132+
** Reference URL: https://attack.mitre.org/techniques/T1555/
133+
* Sub-technique:
134+
** Name: Keychain
135+
** ID: T1555.001
136+
** Reference URL: https://attack.mitre.org/techniques/T1555/001/

‎docs/detections/prebuilt-rules/downloadable-packages/8-12-12/prebuilt-rule-8-12-12-adversary-behavior-detected-elastic-endgame.asciidoc‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
[[prebuilt-rule-8-12-12-adversary-behavior-detected-elastic-endgame]]
2+
=== Adversary Behavior - Detected - Elastic Endgame
3+
4+
Elastic Endgame detected an Adversary Behavior. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information.
5+
6+
*Rule type*: query
7+
8+
*Rule indices*:
9+
10+
* endgame-*
11+
12+
*Severity*: medium
13+
14+
*Risk score*: 47
15+
16+
*Runs every*: 10m
17+
18+
*Searches indices from*: now-15m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
19+
20+
*Maximum alerts per execution*: 10000
21+
22+
*References*: None
23+
24+
*Tags*:
25+
26+
* Data Source: Elastic Endgame
27+
28+
*Version*: 104
29+
30+
*Rule authors*:
31+
32+
* Elastic
33+
34+
*Rule license*: Elastic License v2
35+
36+
37+
==== Setup
38+
39+
40+
41+
*Setup*
42+
43+
44+
This rule is configured to generate more **Max alerts per run** than the default 1000 alerts per run set for all rules. This is to ensure that it captures as many alerts as possible.
45+
46+
**IMPORTANT:** The rule's **Max alerts per run** setting can be superseded by the `xpack.alerting.rules.run.alerts.max` Kibana config setting, which determines the maximum alerts generated by _any_ rule in the Kibana alerting framework. For example, if `xpack.alerting.rules.run.alerts.max` is set to 1000, this rule will still generate no more than 1000 alerts even if its own **Max alerts per run** is set higher.
47+
48+
To make sure this rule can generate as many alerts as it's configured in its own **Max alerts per run** setting, increase the `xpack.alerting.rules.run.alerts.max` system setting accordingly.
49+
50+
**NOTE:** Changing `xpack.alerting.rules.run.alerts.max` is not possible in Serverless projects.
51+
52+
==== Rule query
53+
54+
55+
[source, js]
56+
----------------------------------
57+
event.kind:alert and event.module:endgame and (event.action:behavior_protection_event or endgame.event_subtype_full:behavior_protection_event)
58+
59+
----------------------------------

‎docs/detections/prebuilt-rules/downloadable-packages/8-12-12/prebuilt-rule-8-12-12-alternate-data-stream-creation-execution-at-volume-root-directory.asciidoc‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
[[prebuilt-rule-8-12-12-alternate-data-stream-creation-execution-at-volume-root-directory]]
2+
=== Alternate Data Stream Creation/Execution at Volume Root Directory
3+
4+
Identifies the creation of an Alternate Data Stream (ADS) at a volume root directory, which can indicate the attempt to hide tools and malware, as ADSs created in this directory are not displayed by system utilities.
5+
6+
*Rule type*: eql
7+
8+
*Rule indices*:
9+
10+
* winlogbeat-*
11+
* logs-endpoint.events.process-*
12+
* logs-endpoint.events.file-*
13+
* logs-windows.sysmon_operational-*
14+
15+
*Severity*: medium
16+
17+
*Risk score*: 47
18+
19+
*Runs every*: 5m
20+
21+
*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
22+
23+
*Maximum alerts per execution*: 100
24+
25+
*References*:
26+
27+
* https://www.crowdstrike.com/blog/anatomy-of-alpha-spider-ransomware/
28+
29+
*Tags*:
30+
31+
* Domain: Endpoint
32+
* OS: Windows
33+
* Use Case: Threat Detection
34+
* Tactic: Defense Evasion
35+
* Data Source: Elastic Defend
36+
* Data Source: Sysmon
37+
38+
*Version*: 1
39+
40+
*Rule authors*:
41+
42+
* Elastic
43+
44+
*Rule license*: Elastic License v2
45+
46+
47+
==== Rule query
48+
49+
50+
[source, js]
51+
----------------------------------
52+
any where host.os.type == "windows" and event.category in ("file", "process") and
53+
(
54+
(event.type == "creation" and file.path regex~ """[A-Z]:\\:.+""") or
55+
(event.type == "start" and process.executable regex~ """[A-Z]:\\:.+""")
56+
)
57+
58+
----------------------------------
59+
60+
*Framework*: MITRE ATT&CK^TM^
61+
62+
* Tactic:
63+
** Name: Defense Evasion
64+
** ID: TA0005
65+
** Reference URL: https://attack.mitre.org/tactics/TA0005/
66+
* Technique:
67+
** Name: Hide Artifacts
68+
** ID: T1564
69+
** Reference URL: https://attack.mitre.org/techniques/T1564/
70+
* Sub-technique:
71+
** Name: NTFS File Attributes
72+
** ID: T1564.004
73+
** Reference URL: https://attack.mitre.org/techniques/T1564/004/

‎docs/detections/prebuilt-rules/downloadable-packages/8-12-12/prebuilt-rule-8-12-12-apple-scripting-execution-with-administrator-privileges.asciidoc‎

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
[[prebuilt-rule-8-12-12-apple-scripting-execution-with-administrator-privileges]]
2+
=== Apple Scripting Execution with Administrator Privileges
3+
4+
Identifies execution of the Apple script interpreter (osascript) without a password prompt and with administrator privileges.
5+
6+
*Rule type*: eql
7+
8+
*Rule indices*:
9+
10+
* logs-endpoint.events.*
11+
12+
*Severity*: medium
13+
14+
*Risk score*: 47
15+
16+
*Runs every*: 5m
17+
18+
*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
19+
20+
*Maximum alerts per execution*: 100
21+
22+
*References*:
23+
24+
* https://discussions.apple.com/thread/2266150
25+
26+
*Tags*:
27+
28+
* Domain: Endpoint
29+
* OS: macOS
30+
* Use Case: Threat Detection
31+
* Tactic: Execution
32+
* Tactic: Privilege Escalation
33+
* Data Source: Elastic Defend
34+
35+
*Version*: 207
36+
37+
*Rule authors*:
38+
39+
* Elastic
40+
41+
*Rule license*: Elastic License v2
42+
43+
44+
==== Setup
45+
46+
47+
48+
*Setup*
49+
50+
51+
This rule requires data coming in from Elastic Defend.
52+
53+
54+
*Elastic Defend Integration Setup*
55+
56+
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
57+
58+
59+
*Prerequisite Requirements:*
60+
61+
- Fleet is required for Elastic Defend.
62+
- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
63+
64+
65+
*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
66+
67+
- Go to the Kibana home page and click "Add integrations".
68+
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
69+
- Click "Add Elastic Defend".
70+
- Configure the integration name and optionally add a description.
71+
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
72+
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
73+
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
74+
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
75+
For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
76+
- Click "Save and Continue".
77+
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
78+
For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
79+
80+
81+
==== Rule query
82+
83+
84+
[source, js]
85+
----------------------------------
86+
process where host.os.type == "macos" and event.type in ("start", "process_started") and process.name : "osascript" and
87+
process.command_line : "osascript*with administrator privileges" and
88+
not process.parent.name : "Electron" and
89+
not process.Ext.effective_parent.executable : ("/Applications/Visual Studio Code.app/Contents/MacOS/Electron",
90+
"/Applications/OpenVPN Connect/Uninstall OpenVPN Connect.app/Contents/MacOS/uninstaller")
91+
92+
----------------------------------
93+
94+
*Framework*: MITRE ATT&CK^TM^
95+
96+
* Tactic:
97+
** Name: Privilege Escalation
98+
** ID: TA0004
99+
** Reference URL: https://attack.mitre.org/tactics/TA0004/
100+
* Technique:
101+
** Name: Valid Accounts
102+
** ID: T1078
103+
** Reference URL: https://attack.mitre.org/techniques/T1078/
104+
* Tactic:
105+
** Name: Execution
106+
** ID: TA0002
107+
** Reference URL: https://attack.mitre.org/tactics/TA0002/
108+
* Technique:
109+
** Name: Command and Scripting Interpreter
110+
** ID: T1059
111+
** Reference URL: https://attack.mitre.org/techniques/T1059/

0 commit comments

Comments
 (0)