[New Rule] Threshold rule to detect multiple different Mitre Tactics on the same host in the last 24h

[aarju]

Description

A Threshold rule that looks for unique count of more than 2 different kibana.alert.rule.threat.tactic.name values for a single host.name in the last 24h and generates a critical alert when they are observed. This could be an indicator of an ongoing attack impacting multiple parts of the kill chain.

This is an example rule I created on my cluster

Required Info

Target indexes

.siem-signals-*

Additional requirements

Detection rules need to be configured with kibana.alert.rule.threat.tactic.name as much as possible.

[aarju]

A challenge I've run into with this is that several detection rules have 2 different Mitre ATT&CK tactics causing false positives

[aarju]

Within our environment this has worked pretty well. I increased the unique count of kibana.alert.rule.threat.tactic.name to >= 3 and I set the rule to run every hour with a 24h additional lookback. While not perfect, this has helped alert us to hosts that are at a higher risk due to multiple parts of the kill chain being seen.

[botelastic]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[aarju]

We've been running this detection rule on our production servers over the last few months and it has worked out really well.

[w0rk3r]

Thanks for letting us know @aarju, I'll work in a PR for this in the next few days

[SHolzhauer]

Came across this so created a PR for it; I left MITRE mapping out of this one as it triggers on others, which felt duplicate.
@aarju does this look like it matches with your logic/expectation?

[aarju]

Thanks for submitting the PR @SHolzhauer, the logic in that PR looks good to me.

[botelastic]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[botelastic]

This has been closed due to inactivity. If you feel this is an error, please re-open and include a justifying comment.