Skip to content

Commit

Permalink
[Rule Tuning] Event Aggregation - Fix event.action & event.type c…
Browse files Browse the repository at this point in the history
…onditions (#4445)

* [Rule Tuning] Event Aggregation - Fix `event.action` & `event.type` conditions

* .

---------

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>

(cherry picked from commit 5155f47)
  • Loading branch information
w0rk3r authored and tradebot-elastic committed Feb 7, 2025
1 parent 8c67391 commit aabb359
Show file tree
Hide file tree
Showing 5 changed files with 11 additions and 11 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
creation_date = "2023/04/26"
integration = ["cloud_defend"]
maturity = "production"
updated_date = "2025/01/15"
updated_date = "2025/02/04"

[rule]
author = ["Elastic"]
Expand Down Expand Up @@ -41,8 +41,8 @@ process where container.id: "*" and
event.type== "start" and
/*D4C consolidates closely spawned event.actions, this excludes end actions to only capture ongoing processes*/
event.action in ("fork", "exec") and event.action != "end"
and process.entry_leader.same_as_process== false and
event.action in ("fork", "exec") and
process.entry_leader.same_as_process== false and
(
(process.executable: "*/*sh" and process.args: ("-i", "-it")) or
process.args: "*/*sh"
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
creation_date = "2023/05/12"
integration = ["cloud_defend"]
maturity = "production"
updated_date = "2025/01/15"
updated_date = "2025/02/04"

[rule]
author = ["Elastic"]
Expand Down Expand Up @@ -45,7 +45,7 @@ type = "eql"

query = '''
process where container.id: "*" and event.type== "start" and
event.action in ("fork", "exec") and event.action != "end" and
event.action in ("fork", "exec") and
process.name: ("sshd", "ssh", "autossh")
'''
note = """## Triage and analysis
Expand Down
4 changes: 2 additions & 2 deletions rules/linux/execution_tc_bpf_filter.toml
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ integration = ["endpoint", "sentinel_one_cloud_funnel"]
maturity = "production"
min_stack_version = "8.13.0"
min_stack_comments = "Breaking change at 8.13.0 for SentinelOne Integration."
updated_date = "2025/02/04"
updated_date = "2025/02/07"

[rule]
author = ["Elastic"]
Expand Down Expand Up @@ -66,7 +66,7 @@ timestamp_override = "event.ingested"
type = "eql"

query = '''
process where host.os.type == "linux" and event.type != "end" and process.executable == "/usr/sbin/tc" and
process where host.os.type == "linux" and event.type == "start" and process.executable == "/usr/sbin/tc" and
process.args == "filter" and process.args == "add" and process.args == "bpf" and
not process.parent.executable == "/usr/sbin/libvirtd"
'''
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
creation_date = "2020/12/07"
integration = ["endpoint"]
maturity = "production"
updated_date = "2025/02/04"
updated_date = "2025/02/07"

[rule]
author = ["Elastic"]
Expand Down Expand Up @@ -61,7 +61,7 @@ type = "eql"
query = '''
sequence by host.id, process.entity_id with maxspan=30s
[process where host.os.type == "macos" and event.type == "start" and process.name == "osascript"]
[network where host.os.type == "macos" and event.type != "end" and process.name == "osascript" and destination.ip != "::1" and
[network where host.os.type == "macos" and event.type == "start" and process.name == "osascript" and destination.ip != "::1" and
not cidrmatch(destination.ip,
"10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32",
"192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24", "192.31.196.0/24",
Expand Down
4 changes: 2 additions & 2 deletions rules/windows/persistence_local_scheduled_task_creation.toml
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
creation_date = "2020/02/18"
integration = ["endpoint", "windows"]
maturity = "production"
updated_date = "2025/01/15"
updated_date = "2025/02/04"
min_stack_version = "8.14.0"
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."

Expand Down Expand Up @@ -40,7 +40,7 @@ type = "eql"

query = '''
sequence with maxspan=1m
[process where host.os.type == "windows" and event.type != "end" and
[process where host.os.type == "windows" and event.type == "start" and
((process.name : ("cmd.exe", "wscript.exe", "rundll32.exe", "regsvr32.exe", "wmic.exe", "mshta.exe",
"powershell.exe", "pwsh.exe", "powershell_ise.exe", "WmiPrvSe.exe", "wsmprovhost.exe", "winrshost.exe") or
process.pe.original_file_name : ("cmd.exe", "wscript.exe", "rundll32.exe", "regsvr32.exe", "wmic.exe", "mshta.exe",
Expand Down

0 comments on commit aabb359

Please sign in to comment.