[Detection Rules] Add 7.10 rules (#81676)

elastic · Oct 27, 2020 · 20cfa16 · 20cfa16
1 parent 72ff6b8
commit 20cfa16
Show file tree

Hide file tree

Showing 325 changed files with 1,337 additions and 666 deletions.
diff --git a/...ution/server/lib/detection_engine/rules/prepackaged_rules/apm_403_response_to_a_post.json b/...ution/server/lib/detection_engine/rules/prepackaged_rules/apm_403_response_to_a_post.json
@@ -20,9 +20,9 @@
   "rule_id": "a87a4e42-1d82-44bd-b0bf-d9b7f91fb89e",
   "severity": "medium",
   "tags": [
-    "APM",
-    "Elastic"
+    "Elastic",
+    "APM"
   ],
   "type": "query",
-  "version": 3
+  "version": 4
 }
diff --git a/...ver/lib/detection_engine/rules/prepackaged_rules/apm_405_response_method_not_allowed.json b/...ver/lib/detection_engine/rules/prepackaged_rules/apm_405_response_method_not_allowed.json
@@ -20,9 +20,9 @@
   "rule_id": "75ee75d8-c180-481c-ba88-ee50129a6aef",
   "severity": "medium",
   "tags": [
-    "APM",
-    "Elastic"
+    "Elastic",
+    "APM"
   ],
   "type": "query",
-  "version": 3
+  "version": 4
 }
diff --git a/...ity_solution/server/lib/detection_engine/rules/prepackaged_rules/apm_null_user_agent.json b/...ity_solution/server/lib/detection_engine/rules/prepackaged_rules/apm_null_user_agent.json
@@ -38,9 +38,9 @@
   "rule_id": "43303fd4-4839-4e48-b2b2-803ab060758d",
   "severity": "medium",
   "tags": [
-    "APM",
-    "Elastic"
+    "Elastic",
+    "APM"
   ],
   "type": "query",
-  "version": 3
+  "version": 4
 }
diff --git a/...y_solution/server/lib/detection_engine/rules/prepackaged_rules/apm_sqlmap_user_agent.json b/...y_solution/server/lib/detection_engine/rules/prepackaged_rules/apm_sqlmap_user_agent.json
@@ -20,9 +20,9 @@
   "rule_id": "d49cc73f-7a16-4def-89ce-9fc7127d7820",
   "severity": "medium",
   "tags": [
-    "APM",
-    "Elastic"
+    "Elastic",
+    "APM"
   ],
   "type": "query",
-  "version": 3
+  "version": 4
 }
diff --git a/...b/detection_engine/rules/prepackaged_rules/c2_network_connection_from_windows_binary.json b/...b/detection_engine/rules/prepackaged_rules/c2_network_connection_from_windows_binary.json
diff --git a/...r/lib/detection_engine/rules/prepackaged_rules/collection_cloudtrail_logging_created.json b/...r/lib/detection_engine/rules/prepackaged_rules/collection_cloudtrail_logging_created.json
@@ -25,11 +25,12 @@
   "rule_id": "594e0cbf-86cc-45aa-9ff7-ff27db27d3ed",
   "severity": "low",
   "tags": [
-    "AWS",
     "Elastic",
+    "Cloud",
+    "AWS",
+    "Continuous Monitoring",
     "SecOps",
-    "Logging",
-    "Continuous Monitoring"
+    "Log Auditing"
   ],
   "threat": [
     {

diff --git a/...etection_engine/rules/prepackaged_rules/collection_gcp_pub_sub_subscription_creation.json b/...etection_engine/rules/prepackaged_rules/collection_gcp_pub_sub_subscription_creation.json
@@ -22,10 +22,11 @@
   "severity": "low",
   "tags": [
     "Elastic",
+    "Cloud",
     "GCP",
     "Continuous Monitoring",
     "SecOps",
-    "Logging"
+    "Log Auditing"
   ],
   "threat": [
     {

diff --git a/...r/lib/detection_engine/rules/prepackaged_rules/collection_gcp_pub_sub_topic_creation.json b/...r/lib/detection_engine/rules/prepackaged_rules/collection_gcp_pub_sub_topic_creation.json
@@ -22,10 +22,11 @@
   "severity": "low",
   "tags": [
     "Elastic",
+    "Cloud",
     "GCP",
     "Continuous Monitoring",
     "SecOps",
-    "Logging"
+    "Log Auditing"
   ],
   "threat": [
     {

diff --git a/...r/lib/detection_engine/rules/prepackaged_rules/collection_update_event_hub_auth_rule.json b/...r/lib/detection_engine/rules/prepackaged_rules/collection_update_event_hub_auth_rule.json
@@ -22,11 +22,12 @@
   "rule_id": "b6dce542-2b75-4ffb-b7d6-38787298ba9d",
   "severity": "medium",
   "tags": [
-    "Azure",
     "Elastic",
-    "SecOps",
+    "Cloud",
+    "Azure",
     "Continuous Monitoring",
-    "Logging"
+    "SecOps",
+    "Log Auditing"
   ],
   "threat": [
     {

diff --git a/...ction_engine/rules/prepackaged_rules/command_and_control_certutil_network_connection.json b/...ction_engine/rules/prepackaged_rules/command_and_control_certutil_network_connection.json
@@ -17,7 +17,10 @@
   "severity": "low",
   "tags": [
     "Elastic",
-    "Windows"
+    "Host",
+    "Windows",
+    "Threat Detection",
+    "Command and Control"
   ],
   "threat": [
     {

diff --git a/...ib/detection_engine/rules/prepackaged_rules/command_and_control_cobalt_strike_beacon.json b/...ib/detection_engine/rules/prepackaged_rules/command_and_control_cobalt_strike_beacon.json
@@ -23,7 +23,9 @@
   "severity": "high",
   "tags": [
     "Elastic",
-    "Network"
+    "Network",
+    "Threat Detection",
+    "Command and Control"
   ],
   "threat": [
     {

diff --git a/...tion_engine/rules/prepackaged_rules/command_and_control_dns_directly_to_the_internet.json b/...tion_engine/rules/prepackaged_rules/command_and_control_dns_directly_to_the_internet.json
@@ -23,7 +23,9 @@
   "severity": "medium",
   "tags": [
     "Elastic",
-    "Network"
+    "Network",
+    "Threat Detection",
+    "Command and Control"
   ],
   "threat": [
     {
@@ -43,5 +45,5 @@
     }
   ],
   "type": "query",
-  "version": 4
+  "version": 5
 }
diff --git a/...ne/rules/prepackaged_rules/command_and_control_download_rar_powershell_from_internet.json b/...ne/rules/prepackaged_rules/command_and_control_download_rar_powershell_from_internet.json
@@ -23,7 +23,9 @@
   "severity": "medium",
   "tags": [
     "Elastic",
-    "Network"
+    "Network",
+    "Threat Detection",
+    "Command and Control"
   ],
   "threat": [
     {

diff --git a/...er/lib/detection_engine/rules/prepackaged_rules/command_and_control_fin7_c2_behavior.json b/...er/lib/detection_engine/rules/prepackaged_rules/command_and_control_fin7_c2_behavior.json
@@ -22,7 +22,9 @@
   "severity": "high",
   "tags": [
     "Elastic",
-    "Network"
+    "Network",
+    "Threat Detection",
+    "Command and Control"
   ],
   "threat": [
     {

diff --git a/...ckaged_rules/command_and_control_ftp_file_transfer_protocol_activity_to_the_internet.json b/...ckaged_rules/command_and_control_ftp_file_transfer_protocol_activity_to_the_internet.json
@@ -8,7 +8,8 @@
   ],
   "index": [
     "filebeat-*",
-    "packetbeat-*"
+    "packetbeat-*",
+    "logs-endpoint.events.*"
   ],
   "language": "kuery",
   "license": "Elastic License",
@@ -19,7 +20,10 @@
   "severity": "low",
   "tags": [
     "Elastic",
-    "Network"
+    "Host",
+    "Network",
+    "Threat Detection",
+    "Command and Control"
   ],
   "threat": [
     {
@@ -54,5 +58,5 @@
     }
   ],
   "type": "query",
-  "version": 4
+  "version": 5
 }
diff --git a/...er/lib/detection_engine/rules/prepackaged_rules/command_and_control_halfbaked_beacon.json b/...er/lib/detection_engine/rules/prepackaged_rules/command_and_control_halfbaked_beacon.json
@@ -23,7 +23,9 @@
   "severity": "high",
   "tags": [
     "Elastic",
-    "Network"
+    "Network",
+    "Threat Detection",
+    "Command and Control"
   ],
   "threat": [
     {

diff --git a/..._rules/command_and_control_irc_internet_relay_chat_protocol_activity_to_the_internet.json b/..._rules/command_and_control_irc_internet_relay_chat_protocol_activity_to_the_internet.json
@@ -8,7 +8,8 @@
   ],
   "index": [
     "filebeat-*",
-    "packetbeat-*"
+    "packetbeat-*",
+    "logs-endpoint.events.*"
   ],
   "language": "kuery",
   "license": "Elastic License",
@@ -19,7 +20,10 @@
   "severity": "medium",
   "tags": [
     "Elastic",
-    "Network"
+    "Host",
+    "Network",
+    "Threat Detection",
+    "Command and Control"
   ],
   "threat": [
     {

diff --git a/...ction_engine/rules/prepackaged_rules/command_and_control_nat_traversal_port_activity.json b/...ction_engine/rules/prepackaged_rules/command_and_control_nat_traversal_port_activity.json
@@ -8,7 +8,8 @@
   ],
   "index": [
     "filebeat-*",
-    "packetbeat-*"
+    "packetbeat-*",
+    "logs-endpoint.events.*"
   ],
   "language": "kuery",
   "license": "Elastic License",
@@ -19,7 +20,10 @@
   "severity": "low",
   "tags": [
     "Elastic",
-    "Network"
+    "Host",
+    "Network",
+    "Threat Detection",
+    "Command and Control"
   ],
   "threat": [
     {
@@ -39,5 +43,5 @@
     }
   ],
   "type": "query",
-  "version": 3
+  "version": 4
 }
diff --git a/...er/lib/detection_engine/rules/prepackaged_rules/command_and_control_port_26_activity.json b/...er/lib/detection_engine/rules/prepackaged_rules/command_and_control_port_26_activity.json
@@ -8,7 +8,8 @@
   ],
   "index": [
     "filebeat-*",
-    "packetbeat-*"
+    "packetbeat-*",
+    "logs-endpoint.events.*"
   ],
   "language": "kuery",
   "license": "Elastic License",
@@ -23,7 +24,10 @@
   "severity": "low",
   "tags": [
     "Elastic",
-    "Network"
+    "Host",
+    "Network",
+    "Threat Detection",
+    "Command and Control"
   ],
   "threat": [
     {

diff --git a/...ngine/rules/prepackaged_rules/command_and_control_port_8000_activity_to_the_internet.json b/...ngine/rules/prepackaged_rules/command_and_control_port_8000_activity_to_the_internet.json
@@ -8,7 +8,8 @@
   ],
   "index": [
     "filebeat-*",
-    "packetbeat-*"
+    "packetbeat-*",
+    "logs-endpoint.events.*"
   ],
   "language": "kuery",
   "license": "Elastic License",
@@ -19,7 +20,10 @@
   "severity": "low",
   "tags": [
     "Elastic",
-    "Network"
+    "Host",
+    "Network",
+    "Threat Detection",
+    "Command and Control"
   ],
   "threat": [
     {
@@ -39,5 +43,5 @@
     }
   ],
   "type": "query",
-  "version": 4
+  "version": 5
 }
diff --git a/...repackaged_rules/command_and_control_pptp_point_to_point_tunneling_protocol_activity.json b/...repackaged_rules/command_and_control_pptp_point_to_point_tunneling_protocol_activity.json
@@ -8,7 +8,8 @@
   ],
   "index": [
     "filebeat-*",
-    "packetbeat-*"
+    "packetbeat-*",
+    "logs-endpoint.events.*"
   ],
   "language": "kuery",
   "license": "Elastic License",
@@ -19,7 +20,10 @@
   "severity": "low",
   "tags": [
     "Elastic",
-    "Network"
+    "Host",
+    "Network",
+    "Threat Detection",
+    "Command and Control"
   ],
   "threat": [
     {
@@ -39,5 +43,5 @@
     }
   ],
   "type": "query",
-  "version": 3
+  "version": 4
 }