[Detection Rules] Add 7.11 rules

[brokensound77]

Summary

Pull updates to detection rules from https://github.com/elastic/detection-rules/tree/7.11

Checklist

• Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support

[kibanamachine]

💚 Build Succeeded

• continuous-integration/kibana-ci/pull-request
• Commit: c749667

Metrics [docs]

Distributable file count

id	before	after	diff
default	46991	47886	+895

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

[spong]

No comments here, this one should work right?

[brokensound77]

Broke it out to make precedence more readable

process where event.type in ("start", "process_started") and
  (
      (
          (process.name : "net.exe" or process.pe.original_file_name == "net.exe") or
            (
              (process.name : "net1.exe" or process.pe.original_file_name == "net1.exe") and
                 not process.parent.name : "net.exe"
            )
      ) and
      process.args : ("group", "user", "localgroup") and
      process.args : ("admin", "Domain Admins", "Remote Desktop Users", "Enterprise Admins", "Organization Management") and
      not process.args : "/add"
  )

   or

  (
      (process.name : "wmic.exe" or process.pe.original_file_name == "wmic.exe") and
      process.args : ("group", "useraccount")
  )

Query looks good to me. Based on the location of the error, looks like it could also be an issue with case insensitive compare of multiple args, though I got the same error as above in siem-dev via EQL API search. Thoughts @rw-access

[brokensound77]

elastic/detection-rules#709

[spong]

Checked out, tested upgrade locally and all rules installed without issue! 🎉 Had to fetch the latest to avoid an SO migration error since #82969 got merged in-between the last build, but no other issues observed on upgrade.

There were some rule run failures which I commented on (and I'm sure you're tracking :), but just wanted to note as everything else looks 👍 for approval and we can tweak those in follow-ups like last time.

Great stuff here -- thanks for all your hard work @elastic/protections!!! To 451 and beyond!! 🚀 😀

[spong]

Look at those sub-techniques! 🙌 @dplumlee 🙌

[brokensound77]

Thanks for testing these @spong! I created a few issues to track your findings and as @rw-access mentioned, we will need to see why the ES is having issues with the EQL searches.

I am going to merge this before too much changes in Kibana. We will be making a few more PRs for rule changes over the next few weeks, and we can include revisions from this as needed 👍