Adding Documents for v7.16.4 Pre-Built Detection Rules Integration Re…

…lease (elastic#2367) (elastic#2414) * adding documents for v7.16.4 pre-built detection rules * Update docs/detections/prebuilt-rules/prebuilt-rules-downloadable-updates.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Update docs/detections/prebuilt-rules/downloadable-packages/7-16-4/prebuilt-rule-7-16-4-potential-cookies-theft-via-browser-debugging.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Update docs/detections/prebuilt-rules/downloadable-packages/7-16-4/prebuilt-rules-7-16-4-summary.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Update docs/detections/prebuilt-rules/downloadable-packages/7-16-4/prebuilt-rules-7-16-4-summary.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Update docs/detections/prebuilt-rules/downloadable-packages/7-16-4/prebuilt-rule-7-16-4-elastic-agent-service-terminated.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Update docs/detections/prebuilt-rules/downloadable-packages/7-16-4/prebuilt-rule-7-16-4-gcp-logging-sink-deletion.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Update docs/detections/prebuilt-rules/downloadable-packages/7-16-4/prebuilt-rules-7-16-4-summary.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Update docs/detections/prebuilt-rules/downloadable-packages/7-16-4/prebuilt-rule-7-16-4-gcp-logging-sink-modification.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Update docs/detections/prebuilt-rules/downloadable-packages/7-16-4/prebuilt-rules-7-16-4-summary.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Update docs/detections/prebuilt-rules/downloadable-packages/7-16-4/prebuilt-rule-7-16-4-microsoft-365-global-administrator-role-assigned.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Update docs/detections/prebuilt-rules/downloadable-packages/7-16-4/prebuilt-rule-7-16-4-security-software-discovery-via-grep.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Update docs/detections/prebuilt-rules/downloadable-packages/7-16-4/prebuilt-rules-7-16-4-summary.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Update docs/detections/prebuilt-rules/downloadable-packages/7-16-4/prebuilt-rule-7-16-4-aws-access-secret-in-secrets-manager.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Update docs/detections/prebuilt-rules/downloadable-packages/7-16-4/prebuilt-rules-7-16-4-summary.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Update docs/detections/prebuilt-rules/downloadable-packages/7-16-4/prebuilt-rule-7-16-4-aws-config-resource-deletion.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Update docs/detections/prebuilt-rules/downloadable-packages/7-16-4/prebuilt-rule-7-16-4-aws-efs-file-system-or-mount-deleted.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Update docs/detections/prebuilt-rules/downloadable-packages/7-16-4/prebuilt-rules-7-16-4-summary.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Update docs/detections/prebuilt-rules/downloadable-packages/7-16-4/prebuilt-rules-7-16-4-summary.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Update docs/detections/prebuilt-rules/downloadable-packages/7-16-4/prebuilt-rule-7-16-4-aws-route53-private-hosted-zone-associated-with-a-vpc.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Update docs/detections/prebuilt-rules/downloadable-packages/7-16-4/prebuilt-rules-7-16-4-summary.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Update docs/detections/prebuilt-rules/downloadable-packages/7-16-4/prebuilt-rules-7-16-4-summary.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Update docs/detections/prebuilt-rules/downloadable-packages/7-16-4/prebuilt-rule-7-16-4-azure-command-execution-on-virtual-machine.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Update docs/detections/prebuilt-rules/downloadable-packages/7-16-4/prebuilt-rules-7-16-4-summary.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Update docs/detections/prebuilt-rules/downloadable-packages/7-16-4/prebuilt-rules-7-16-4-summary.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Update docs/detections/prebuilt-rules/downloadable-packages/7-16-4/prebuilt-rule-7-16-4-azure-active-directory-high-risk-sign-in.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Update docs/detections/prebuilt-rules/downloadable-packages/7-16-4/prebuilt-rules-7-16-4-summary.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Update docs/detections/prebuilt-rules/downloadable-packages/7-16-4/prebuilt-rules-7-16-4-summary.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Update docs/detections/prebuilt-rules/downloadable-packages/7-16-4/prebuilt-rule-7-16-4-azure-ad-global-administrator-role-assigned.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Update docs/detections/prebuilt-rules/downloadable-packages/7-16-4/prebuilt-rule-7-16-4-azure-global-administrator-role-addition-to-pim-user.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Update docs/detections/prebuilt-rules/downloadable-packages/7-16-4/prebuilt-rule-7-16-4-gcp-logging-bucket-deletion.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Update docs/detections/prebuilt-rules/downloadable-packages/7-16-4/prebuilt-rules-7-16-4-summary.asciidoc Co-authored-by: Janeen Mikell-Straughn <57149392+jmikell821@users.noreply.github.com> * Update docs/detections/prebuilt-rules/downloadable-packages/7-16-4/prebuilt-rules-7-16-4-summary.asciidoc Co-authored-by: Janeen Mikell-Straughn <57149392+jmikell821@users.noreply.github.com> Co-authored-by: Joe Peeples <joe.peeples@elastic.co> Co-authored-by: Janeen Mikell-Straughn <57149392+jmikell821@users.noreply.github.com> Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> Co-authored-by: Joe Peeples <joe.peeples@elastic.co>
lcawl · Sep 1, 2022 · ae3de1f · ae3de1f
1 parent bd087a5
commit ae3de1f
Show file tree

Hide file tree

Showing 518 changed files with 49,843 additions and 2 deletions.
diff --git a/...kages/7-16-4/prebuilt-rule-7-16-4-access-of-stored-browser-credentials.asciidoc b/...kages/7-16-4/prebuilt-rule-7-16-4-access-of-stored-browser-credentials.asciidoc
@@ -0,0 +1,97 @@
+[[prebuilt-rule-7-16-4-access-of-stored-browser-credentials]]
+=== Access of Stored Browser Credentials
+
+Identifies the execution of a process with arguments pointing to known browser files that store passwords and cookies. Adversaries may acquire credentials from web browsers by reading files specific to the target browser.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* auditbeat-*
+* logs-endpoint.events.*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://securelist.com/calisto-trojan-for-macos/86543/
+
+*Tags*: 
+
+* Elastic
+* Host
+* macOS
+* Threat Detection
+* Credential Access
+
+*Version*: 5
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Setup
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where event.type in ("start", "process_started") and
+  process.args :
+    (
+      "/Users/*/Library/Application Support/Google/Chrome/Default/Login Data",
+      "/Users/*/Library/Application Support/Google/Chrome/Default/Cookies",
+      "/Users/*/Library/Application Support/Google/Chrome/Profile*/Cookies",
+      "/Users/*/Library/Cookies*",
+      "/Users/*/Library/Application Support/Firefox/Profiles/*.default/cookies.sqlite",
+      "/Users/*/Library/Application Support/Firefox/Profiles/*.default/key*.db",
+      "/Users/*/Library/Application Support/Firefox/Profiles/*.default/logins.json",
+      "Login Data",
+      "Cookies.binarycookies",
+      "key4.db",
+      "key3.db",
+      "logins.json",
+      "cookies.sqlite"
+    )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Steal Web Session Cookie
+** ID: T1539
+** Reference URL: https://attack.mitre.org/techniques/T1539/
+* Technique:
+** Name: Credentials from Password Stores
+** ID: T1555
+** Reference URL: https://attack.mitre.org/techniques/T1555/
+* Sub-technique:
+** Name: Credentials from Web Browsers
+** ID: T1555.003
+** Reference URL: https://attack.mitre.org/techniques/T1555/003/
diff --git a/...7-16-4/prebuilt-rule-7-16-4-access-to-keychain-credentials-directories.asciidoc b/...7-16-4/prebuilt-rule-7-16-4-access-to-keychain-credentials-directories.asciidoc
@@ -0,0 +1,104 @@
+[[prebuilt-rule-7-16-4-access-to-keychain-credentials-directories]]
+=== Access to Keychain Credentials Directories
+
+Adversaries may collect the keychain storage data from a system to acquire credentials. Keychains are the built-in way for macOS to keep track of users' passwords and credentials for many services and features such as WiFi passwords, websites, secure notes and certificates.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* auditbeat-*
+* logs-endpoint.events.*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://objective-see.com/blog/blog_0x25.html
+* https://securelist.com/calisto-trojan-for-macos/86543/
+
+*Tags*: 
+
+* Elastic
+* Host
+* macOS
+* Threat Detection
+* Credential Access
+
+*Version*: 9
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Setup
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where event.type in ("start", "process_started") and
+  process.args :
+    (
+      "/Users/*/Library/Keychains/*",
+      "/Library/Keychains/*",
+      "/Network/Library/Keychains/*",
+      "System.keychain",
+      "login.keychain-db",
+      "login.keychain"
+    ) and
+    not process.args : ("find-certificate",
+                      "add-trusted-cert",
+                      "set-keychain-settings",
+                      "delete-certificate",
+                      "/Users/*/Library/Keychains/openvpn.keychain-db",
+                      "show-keychain-info",
+                      "lock-keychain",
+                      "set-key-partition-list",
+                      "import",
+                      "find-identity") and
+    not process.parent.executable :
+      (
+        "/Applications/OpenVPN Connect/OpenVPN Connect.app/Contents/MacOS/OpenVPN Connect",
+        "/Applications/Microsoft Defender.app/Contents/MacOS/wdavdaemon_enterprise.app/Contents/MacOS/wdavdaemon_enterprise",
+        "/opt/jc/bin/jumpcloud-agent"
+      ) and
+    not process.executable : "/opt/jc/bin/jumpcloud-agent"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Credentials from Password Stores
+** ID: T1555
+** Reference URL: https://attack.mitre.org/techniques/T1555/
+* Sub-technique:
+** Name: Keychain
+** ID: T1555.001
+** Reference URL: https://attack.mitre.org/techniques/T1555/001/
diff --git a/...16-4/prebuilt-rule-7-16-4-account-discovery-command-via-system-account.asciidoc b/...16-4/prebuilt-rule-7-16-4-account-discovery-command-via-system-account.asciidoc
@@ -0,0 +1,117 @@
+[[prebuilt-rule-7-16-4-account-discovery-command-via-system-account]]
+=== Account Discovery Command via SYSTEM Account
+
+Identifies when the SYSTEM account uses an account discovery utility. This could be a sign of discovery activity after an adversary has achieved privilege escalation.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.*
+* logs-windows.*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Elastic
+* Host
+* Windows
+* Threat Detection
+* Discovery
+
+*Version*: 15
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating Account Discovery Command via SYSTEM Account
+
+After successfully compromising an environment, attackers may try to gain situational awareness to plan their next steps.
+This can happen by running commands to enumerate network resources, users, connections, files, and installed security
+software.
+
+This rule looks for the execution of account discovery utilities using the SYSTEM account, which is commonly observed
+after attackers successfully perform privilege escalation or exploit web applications.
+
+#### Possible investigation steps
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files
+for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+  - If the process tree includes a web-application server process such as w3wp, httpd.exe, nginx.exe and alike,
+  investigate any suspicious file creation or modification in the last 48 hours to assess the presence of any potential
+  webshell backdoor.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Determine how the SYSTEM account is being used. For example, users with administrator privileges can spawn a system
+shell using Windows services, scheduled tasks or other third party utilities.
+
+### False positive analysis
+
+- Discovery activities are not inherently malicious if they occur in isolation. As long as the analyst did not identify
+suspicious activity related to the user or host, such alerts can be dismissed.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
+identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
+systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
+malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
+mean time to respond (MTTR).
+- Use the data collected through the analysis to investigate other machines affected in the environment.
+
+## Setup
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where event.type in ("start", "process_started") and
+  (?process.Ext.token.integrity_level_name : "System" or
+  ?winlog.event_data.IntegrityLevel : "System") and
+  (process.name : "whoami.exe" or
+  (process.name : "net1.exe" and not process.parent.name : "net.exe"))
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: System Owner/User Discovery
+** ID: T1033
+** Reference URL: https://attack.mitre.org/techniques/T1033/