nldcsc-elastic-rules 0.0.8__py3-none-any.whl → 0.0.16__py3-none-any.whl

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (123) hide show
  1. nldcsc_elastic_rules/__init__.py +1 -1
  2. nldcsc_elastic_rules/rules/{linux → cross-platform}/command_and_control_curl_wget_spawn_via_nodejs_parent.toml +32 -11
  3. nldcsc_elastic_rules/rules/cross-platform/command_and_control_genai_process_suspicious_tld_connection.toml +134 -0
  4. nldcsc_elastic_rules/rules/cross-platform/command_and_control_genai_process_unusual_domain.toml +128 -0
  5. nldcsc_elastic_rules/rules/cross-platform/credential_access_genai_process_sensitive_file_access.toml +154 -0
  6. nldcsc_elastic_rules/rules/cross-platform/credential_access_gitleaks_execution.toml +114 -0
  7. nldcsc_elastic_rules/rules/cross-platform/credential_access_multi_could_secrets_via_api.toml +198 -0
  8. nldcsc_elastic_rules/rules/cross-platform/credential_access_trufflehog_execution.toml +24 -5
  9. nldcsc_elastic_rules/rules/cross-platform/defense_evasion_genai_config_modification.toml +120 -0
  10. nldcsc_elastic_rules/rules/cross-platform/defense_evasion_genai_process_compiling_executables.toml +158 -0
  11. nldcsc_elastic_rules/rules/cross-platform/defense_evasion_genai_process_encoding_prior_to_network_activity.toml +172 -0
  12. nldcsc_elastic_rules/rules/cross-platform/defense_evasion_potential_http_downgrade_attack.toml +98 -0
  13. nldcsc_elastic_rules/rules/cross-platform/discovery_web_server_local_file_inclusion_activity.toml +172 -0
  14. nldcsc_elastic_rules/rules/cross-platform/discovery_web_server_remote_file_inclusion_activity.toml +133 -0
  15. nldcsc_elastic_rules/rules/cross-platform/execution_aws_ec2_lolbin_via_ssm.toml +250 -0
  16. nldcsc_elastic_rules/rules/{linux/persistence_nodejs_pre_or_post_install_script_execution.toml → cross-platform/execution_nodejs_pre_or_post_install_script_execution.toml} +40 -24
  17. nldcsc_elastic_rules/rules/cross-platform/execution_privileged_container_creation_with_host_reference.toml +146 -0
  18. nldcsc_elastic_rules/rules/cross-platform/execution_register_github_actions_runner.toml +126 -0
  19. nldcsc_elastic_rules/rules/cross-platform/execution_via_github_actions_runner.toml +130 -0
  20. nldcsc_elastic_rules/rules/cross-platform/execution_via_github_runner_with_runner_tracking_id_tampering_via_env_vars.toml +163 -0
  21. nldcsc_elastic_rules/rules/cross-platform/initial_access_execution_susp_react_serv_child.toml +130 -0
  22. nldcsc_elastic_rules/rules/cross-platform/initial_access_file_upload_followed_by_get_request.toml +145 -0
  23. nldcsc_elastic_rules/rules/cross-platform/multiple_alerts_elastic_defend_netsecurity_by_host.toml +4 -1
  24. nldcsc_elastic_rules/rules/cross-platform/persistence_credential_access_modify_auth_module_or_config.toml +3 -4
  25. nldcsc_elastic_rules/rules/cross-platform/persistence_web_server_potential_command_injection.toml +23 -25
  26. nldcsc_elastic_rules/rules/cross-platform/reconnaissance_web_server_discovery_or_fuzzing_activity.toml +13 -14
  27. nldcsc_elastic_rules/rules/cross-platform/reconnaissance_web_server_unusual_spike_in_error_logs.toml +8 -5
  28. nldcsc_elastic_rules/rules/cross-platform/reconnaissance_web_server_unusual_spike_in_error_response_codes.toml +12 -12
  29. nldcsc_elastic_rules/rules/cross-platform/reconnaissance_web_server_unusual_user_agents.toml +37 -43
  30. nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_rds_instance_restored.toml +137 -45
  31. nldcsc_elastic_rules/rules/integrations/aws/discovery_iam_principal_enumeration_via_update_assume_role_policy.toml +152 -0
  32. nldcsc_elastic_rules/rules/integrations/aws/discovery_multiple_discovery_api_calls_via_cli.toml +242 -0
  33. nldcsc_elastic_rules/rules/integrations/aws/exfiltration_rds_snapshot_export.toml +141 -33
  34. nldcsc_elastic_rules/rules/integrations/aws/exfiltration_rds_snapshot_shared_with_another_account.toml +108 -30
  35. nldcsc_elastic_rules/rules/integrations/aws/exfiltration_s3_bucket_policy_added_for_external_account_access.toml +2 -1
  36. nldcsc_elastic_rules/rules/integrations/aws/exfiltration_s3_bucket_replicated_to_external_account.toml +114 -27
  37. nldcsc_elastic_rules/rules/integrations/aws/impact_efs_filesystem_deleted.toml +174 -0
  38. nldcsc_elastic_rules/rules/integrations/aws/impact_kms_cmk_disabled_or_scheduled_for_deletion.toml +111 -33
  39. nldcsc_elastic_rules/rules/integrations/aws/impact_rds_instance_cluster_deletion.toml +129 -43
  40. nldcsc_elastic_rules/rules/integrations/aws/impact_rds_instance_cluster_deletion_protection_disabled.toml +89 -27
  41. nldcsc_elastic_rules/rules/integrations/aws/impact_rds_snapshot_deleted.toml +127 -37
  42. nldcsc_elastic_rules/rules/integrations/aws/impact_s3_object_encryption_with_external_key.toml +160 -43
  43. nldcsc_elastic_rules/rules/integrations/aws/initial_access_iam_session_token_used_from_multiple_addresses.toml +20 -10
  44. nldcsc_elastic_rules/rules/integrations/aws/ml_cloudtrail_error_message_spike.toml +35 -1
  45. nldcsc_elastic_rules/rules/integrations/aws/ml_cloudtrail_rare_error_code.toml +59 -1
  46. nldcsc_elastic_rules/rules/integrations/aws/ml_cloudtrail_rare_method_by_city.toml +19 -1
  47. nldcsc_elastic_rules/rules/integrations/aws/ml_cloudtrail_rare_method_by_country.toml +19 -1
  48. nldcsc_elastic_rules/rules/integrations/aws/ml_cloudtrail_rare_method_by_user.toml +58 -1
  49. nldcsc_elastic_rules/rules/integrations/aws/persistence_rds_db_instance_password_modified.toml +109 -35
  50. nldcsc_elastic_rules/rules/integrations/aws/persistence_rds_instance_made_public.toml +103 -22
  51. nldcsc_elastic_rules/rules/integrations/aws/persistence_redshift_instance_creation.toml +3 -3
  52. nldcsc_elastic_rules/rules/integrations/aws/privilege_escalation_sts_assume_root_from_rare_user_and_member_account.toml +126 -69
  53. nldcsc_elastic_rules/rules/integrations/azure/credential_access_azure_entra_susp_device_code_signin.toml +134 -0
  54. nldcsc_elastic_rules/rules/integrations/azure/credential_access_entra_id_excessive_account_lockouts.toml +2 -2
  55. nldcsc_elastic_rules/rules/integrations/azure/ml_azure_event_failures.toml +124 -0
  56. nldcsc_elastic_rules/rules/integrations/azure/ml_azure_rare_event_failures.toml +148 -0
  57. nldcsc_elastic_rules/rules/integrations/azure/ml_azure_rare_method_by_city.toml +109 -0
  58. nldcsc_elastic_rules/rules/integrations/azure/ml_azure_rare_method_by_country.toml +108 -0
  59. nldcsc_elastic_rules/rules/integrations/azure/ml_azure_rare_method_by_user.toml +147 -0
  60. nldcsc_elastic_rules/rules/integrations/fim/persistence_suspicious_file_modifications.toml +9 -1
  61. nldcsc_elastic_rules/rules/integrations/gcp/ml_gcp_error_message_spike.toml +95 -0
  62. nldcsc_elastic_rules/rules/integrations/gcp/ml_gcp_rare_error_code.toml +118 -0
  63. nldcsc_elastic_rules/rules/integrations/gcp/ml_gcp_rare_method_by_city.toml +79 -0
  64. nldcsc_elastic_rules/rules/integrations/gcp/ml_gcp_rare_method_by_country.toml +79 -0
  65. nldcsc_elastic_rules/rules/integrations/gcp/ml_gcp_rare_method_by_user.toml +117 -0
  66. nldcsc_elastic_rules/rules/integrations/github/initial_access_github_register_self_hosted_runner.toml +92 -0
  67. nldcsc_elastic_rules/rules/integrations/o365/collection_onedrive_excessive_file_downloads.toml +24 -14
  68. nldcsc_elastic_rules/rules/linux/defense_evasion_file_deletion_via_shred.toml +12 -5
  69. nldcsc_elastic_rules/rules/linux/execution_suspicious_pod_or_container_creation_command_execution.toml +150 -0
  70. nldcsc_elastic_rules/rules/linux/persistence_at_job_creation.toml +4 -4
  71. nldcsc_elastic_rules/rules/linux/persistence_pluggable_authentication_module_creation.toml +12 -7
  72. nldcsc_elastic_rules/rules/linux/persistence_pth_file_creation.toml +6 -1
  73. nldcsc_elastic_rules/rules/linux/persistence_site_and_user_customize_file_creation.toml +6 -1
  74. nldcsc_elastic_rules/rules/linux/persistence_web_server_unusual_command_execution.toml +155 -0
  75. nldcsc_elastic_rules/rules/ml/ml_high_count_events_for_a_host_name.toml +58 -1
  76. nldcsc_elastic_rules/rules/ml/ml_high_count_network_denies.toml +71 -1
  77. nldcsc_elastic_rules/rules/ml/ml_high_count_network_events.toml +53 -1
  78. nldcsc_elastic_rules/rules/ml/ml_linux_anomalous_network_activity.toml +56 -1
  79. nldcsc_elastic_rules/rules/ml/ml_linux_anomalous_network_port_activity.toml +40 -1
  80. nldcsc_elastic_rules/rules/ml/ml_low_count_events_for_a_host_name.toml +27 -1
  81. nldcsc_elastic_rules/rules/ml/ml_packetbeat_rare_server_domain.toml +63 -1
  82. nldcsc_elastic_rules/rules/ml/ml_rare_destination_country.toml +68 -1
  83. nldcsc_elastic_rules/rules/ml/ml_spike_in_traffic_to_a_country.toml +53 -1
  84. nldcsc_elastic_rules/rules/ml/ml_windows_anomalous_network_activity.toml +56 -1
  85. nldcsc_elastic_rules/rules/network/initial_access_react_server_components_rce_attempt.toml +123 -0
  86. nldcsc_elastic_rules/rules/promotions/external_alerts.toml +2 -2
  87. nldcsc_elastic_rules/rules/windows/command_and_control_common_webservices.toml +4 -3
  88. nldcsc_elastic_rules/rules/windows/credential_access_rare_webdav_destination.toml +3 -4
  89. nldcsc_elastic_rules/rules/windows/defense_evasion_masquerading_as_svchost.toml +11 -8
  90. nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation.toml +25 -2
  91. nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_backtick.toml +2 -3
  92. nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_backtick_var.toml +2 -3
  93. nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_char_arrays.toml +2 -3
  94. nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_concat_dynamic.toml +2 -3
  95. nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_high_number_proportion.toml +2 -3
  96. nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_iex_env_vars_reconstruction.toml +2 -3
  97. nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_iex_string_reconstruction.toml +2 -3
  98. nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_index_reversal.toml +2 -3
  99. nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_reverse_keyword.toml +2 -3
  100. nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_string_concat.toml +2 -3
  101. nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_string_format.toml +2 -3
  102. nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_whitespace_special_proportion.toml +2 -3
  103. nldcsc_elastic_rules/rules/windows/defense_evasion_wsl_filesystem.toml +13 -10
  104. nldcsc_elastic_rules/rules/windows/execution_posh_hacktool_functions.toml +3 -2
  105. nldcsc_elastic_rules/rules/windows/execution_suspicious_powershell_imgload.toml +7 -2
  106. nldcsc_elastic_rules/rules/windows/execution_windows_powershell_susp_args.toml +9 -2
  107. nldcsc_elastic_rules/rules/windows/impact_mod_critical_os_files.toml +16 -6
  108. nldcsc_elastic_rules/rules/windows/lateral_movement_credential_access_kerberos_correlation.toml +7 -2
  109. nldcsc_elastic_rules/rules/windows/lateral_movement_scheduled_task_target.toml +2 -2
  110. nldcsc_elastic_rules/rules/windows/persistence_browser_extension_install.toml +19 -2
  111. nldcsc_elastic_rules/rules/windows/persistence_msi_installer_task_startup.toml +50 -13
  112. nldcsc_elastic_rules/rules/windows/persistence_via_application_shimming.toml +12 -2
  113. nldcsc_elastic_rules/rules/windows/privilege_escalation_tokenmanip_sedebugpriv_enabled.toml +24 -18
  114. nldcsc_elastic_rules/rules/windows/privilege_escalation_unusual_printspooler_childprocess.toml +14 -2
  115. nldcsc_elastic_rules/rules/windows/privilege_escalation_via_ppid_spoofing.toml +3 -2
  116. {nldcsc_elastic_rules-0.0.8.dist-info → nldcsc_elastic_rules-0.0.16.dist-info}/METADATA +1 -1
  117. {nldcsc_elastic_rules-0.0.8.dist-info → nldcsc_elastic_rules-0.0.16.dist-info}/RECORD +119 -87
  118. nldcsc_elastic_rules/rules/integrations/aws/credential_access_aws_iam_assume_role_brute_force.toml +0 -105
  119. nldcsc_elastic_rules/rules/integrations/aws/discovery_ec2_multi_region_describe_instances.toml +0 -135
  120. nldcsc_elastic_rules/rules/integrations/aws/discovery_ec2_multiple_discovery_api_calls_via_cli.toml +0 -155
  121. nldcsc_elastic_rules/rules/integrations/aws/impact_efs_filesystem_or_mount_deleted.toml +0 -95
  122. {nldcsc_elastic_rules-0.0.8.dist-info → nldcsc_elastic_rules-0.0.16.dist-info}/WHEEL +0 -0
  123. {nldcsc_elastic_rules-0.0.8.dist-info → nldcsc_elastic_rules-0.0.16.dist-info}/top_level.txt +0 -0
nldcsc_elastic_rules/rules/windows/credential_access_rare_webdav_destination.toml CHANGED
@@ -2,7 +2,7 @@
2
2
  creation_date = "2025/04/28"
3
3
  integration = ["endpoint", "system", "windows", "m365_defender", "crowdstrike"]
4
4
  maturity = "production"
5
- updated_date = "2025/07/16"
5
+ updated_date = "2025/12/05"
6
6
 
7
7
  [rule]
8
8
  author = ["Elastic"]
@@ -54,7 +54,7 @@ timestamp_override = "event.ingested"
54
54
  type = "esql"
55
55
 
56
56
  query = '''
57
- from logs-*
57
+ from logs-endpoint.events.process-*, logs-windows.sysmon_operational-*, logs-system.security-*, logs-windows.*, winlogbeat-*, logs-crowdstrike.fdr*, logs-m365_defender.event-* METADATA _id, _version, _index
58
58
  | where
59
59
  @timestamp > now() - 8 hours and
60
60
  event.category == "process" and
@@ -62,8 +62,7 @@ from logs-*
62
62
  process.name == "rundll32.exe" and
63
63
  process.command_line like "*DavSetCookie*"
64
64
  | keep host.id, process.command_line, user.name
65
- | grok
66
- process.command_line """(?<Esql.server_webdav_cookie>DavSetCookie .* http)"""
65
+ | grok process.command_line """(?<Esql.server_webdav_cookie>DavSetCookie .* http)"""
67
66
  | eval
68
67
  Esql.server_webdav_cookie_replace = replace(Esql.server_webdav_cookie, "(DavSetCookie | http)", "")
69
68
  | where
nldcsc_elastic_rules/rules/windows/defense_evasion_masquerading_as_svchost.toml CHANGED
@@ -1,8 +1,8 @@
1
1
  [metadata]
2
2
  creation_date = "2025/11/12"
3
- integration = ["windows"]
3
+ integration = ["endpoint", "windows", "system"]
4
4
  maturity = "production"
5
- updated_date = "2025/11/12"
5
+ updated_date = "2025/12/09"
6
6
  min_stack_version = "9.1.0"
7
7
  min_stack_comments = "The esql match operator was introduced in version 9.1.0"
8
8
 
@@ -60,19 +60,22 @@ tags = [
60
60
  "OS: Windows",
61
61
  "Use Case: Threat Detection",
62
62
  "Tactic: Defense Evasion",
63
- "Resources: Investigation Guide"
63
+ "Resources: Investigation Guide",
64
+ "Data Source: Elastic Defend",
65
+ "Data Source: Windows Security Event Logs",
66
+ "Data Source: Sysmon"
64
67
  ]
65
68
  timestamp_override = "event.ingested"
66
69
  type = "esql"
67
70
 
68
71
  query = '''
69
- FROM logs-* metadata _id, _version, _index
72
+ FROM logs-endpoint.events.process-*, logs-windows.sysmon_operational-*, logs-system.security-*, logs-windows.*, winlogbeat-* metadata _id, _version, _index
70
73
  | where event.category == "process" and event.type == "start" and
71
74
  match(process.name, "svchost.exe", { "fuzziness": 1, "max_expansions": 10 }) and
72
- not process.executable in ("C:\\Windows\\SysWOW64\\svchost.exe", "C:\\Windows\\System32\\svchost.exe") and
73
- not process.executable like """\\Device\\HarddiskVolume*\\Windows\\System32\\svchost.exe""" and
74
- not process.executable like """\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\svchost.exe"""
75
- | keep event.dataset, host.name, host.id, user.id, user.name, process.executable, process.parent.executable, process.command_line
75
+ not to_lower(process.executable) in ("c:\\windows\\syswow64\\svchost.exe", "c:\\windows\\system32\\svchost.exe") and
76
+ not to_lower(process.executable) like """\\device\\harddiskvolume*\\windows\\system32\\svchost.exe""" and
77
+ not to_lower(process.executable) like """\\device\\harddiskvolume*\\windows\\syswow64\\svchost.exe"""
78
+ | keep event.dataset, host.name, host.id, user.id, user.name, process.executable, process.parent.executable, process.command_line, _id, _version, _index
76
79
  '''
77
80
 
78
81
 
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation.toml CHANGED
@@ -2,7 +2,7 @@
2
2
  creation_date = "2024/07/03"
3
3
  integration = ["windows"]
4
4
  maturity = "production"
5
- updated_date = "2025/03/20"
5
+ updated_date = "2025/12/01"
6
6
 
7
7
  [rule]
8
8
  author = ["Elastic"]
@@ -91,7 +91,6 @@ event.category:process and host.os.type:windows and
91
91
  "[convert]::toint16" or
92
92
  "[char][int]$_" or
93
93
  ("ConvertTo-SecureString" and "PtrToStringAuto") or
94
- ".GetNetworkCredential().password" or
95
94
  "-BXor" or
96
95
  ("replace" and "char") or
97
96
  "[array]::reverse" or
@@ -106,9 +105,33 @@ event.category:process and host.os.type:windows and
106
105
  ("$VerbosePreference" and "[1,3]+'X'-Join''") or
107
106
  ("rahc" or "ekovin" or "gnirts" or "ecnereferpesobrev" or "ecalper" or "cepsmoc" or "dillehs") or
108
107
  ("System.Management.Automation.$([cHAr]" or "System.$([cHAr]" or ")+[cHAR]([byte]")
108
+ ) and
109
+ not powershell.file.script_block_text : (
110
+ ("Copyright (c) 2018 Ansible Project" or "Export-ModuleMember -Function Add-CSharpType") and
111
+ ("[Object]$AnsibleModule" or "$AnsibleModule.Tmpdir")
109
112
  )
110
113
  '''
111
114
 
115
+ [[rule.filters]]
116
+ [rule.filters.meta]
117
+ negate = true
118
+ [rule.filters.query.wildcard."file.directory"]
119
+ case_insensitive = true
120
+ value = "?:\\\\Program Files\\\\WindowsPowerShell\\\\Modules\\\\*"
121
+
122
+ [[rule.filters]]
123
+ [rule.filters.meta]
124
+ negate = true
125
+ [rule.filters.query.wildcard."file.directory"]
126
+ case_insensitive = true
127
+ value = "?:\\\\Program Files (x86)\\\\WindowsPowerShell\\\\Modules\\\\*"
128
+
129
+ [[rule.filters]]
130
+ [rule.filters.meta]
131
+ negate = true
132
+ [rule.filters.query.wildcard."file.path"]
133
+ case_insensitive = true
134
+ value = "?:\\\\ProgramData\\\\Microsoft\\\\Windows Defender Advanced Threat Protection\\\\Downloads\\\\*"
112
135
 
113
136
  [[rule.threat]]
114
137
  framework = "MITRE ATT&CK"
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_backtick.toml CHANGED
@@ -2,7 +2,7 @@
2
2
  creation_date = "2025/04/15"
3
3
  integration = ["windows"]
4
4
  maturity = "production"
5
- updated_date = "2025/08/14"
5
+ updated_date = "2025/12/01"
6
6
 
7
7
  [rule]
8
8
  author = ["Elastic"]
@@ -104,8 +104,7 @@ from logs-windows.powershell_operational* metadata _id, _version, _index
104
104
  | keep
105
105
  Esql.script_block_pattern_count,
106
106
  Esql.script_block_tmp,
107
- powershell.file.script_block_text,
108
- powershell.file.script_block_id,
107
+ powershell.file.*,
109
108
  file.name,
110
109
  file.directory,
111
110
  file.path,
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_backtick_var.toml CHANGED
@@ -2,7 +2,7 @@
2
2
  creation_date = "2025/04/16"
3
3
  integration = ["windows"]
4
4
  maturity = "production"
5
- updated_date = "2025/07/16"
5
+ updated_date = "2025/12/01"
6
6
 
7
7
  [rule]
8
8
  author = ["Elastic"]
@@ -103,8 +103,7 @@ from logs-windows.powershell_operational* metadata _id, _version, _index
103
103
  Esql.script_block_pattern_count,
104
104
  Esql.script_block_length,
105
105
  Esql.script_block_tmp,
106
- powershell.file.script_block_text,
107
- powershell.file.script_block_id,
106
+ powershell.file.*,
108
107
  file.path,
109
108
  file.name,
110
109
  powershell.sequence,
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_char_arrays.toml CHANGED
@@ -2,7 +2,7 @@
2
2
  creation_date = "2025/04/14"
3
3
  integration = ["windows"]
4
4
  maturity = "production"
5
- updated_date = "2025/07/16"
5
+ updated_date = "2025/12/01"
6
6
 
7
7
  [rule]
8
8
  author = ["Elastic"]
@@ -105,8 +105,7 @@ from logs-windows.powershell_operational* metadata _id, _version, _index
105
105
  | keep
106
106
  Esql.script_block_pattern_count,
107
107
  Esql.script_block_tmp,
108
- powershell.file.script_block_text,
109
- powershell.file.script_block_id,
108
+ powershell.file.*,
110
109
  file.path,
111
110
  powershell.sequence,
112
111
  powershell.total,
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_concat_dynamic.toml CHANGED
@@ -2,7 +2,7 @@
2
2
  creation_date = "2025/04/15"
3
3
  integration = ["windows"]
4
4
  maturity = "production"
5
- updated_date = "2025/07/16"
5
+ updated_date = "2025/12/01"
6
6
 
7
7
  [rule]
8
8
  author = ["Elastic"]
@@ -101,8 +101,7 @@ from logs-windows.powershell_operational* metadata _id, _version, _index
101
101
  | keep
102
102
  Esql.script_block_pattern_count,
103
103
  Esql.script_block_tmp,
104
- powershell.file.script_block_text,
105
- powershell.file.script_block_id,
104
+ powershell.file.*,
106
105
  file.path,
107
106
  powershell.sequence,
108
107
  powershell.total,
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_high_number_proportion.toml CHANGED
@@ -2,7 +2,7 @@
2
2
  creation_date = "2025/04/16"
3
3
  integration = ["windows"]
4
4
  maturity = "production"
5
- updated_date = "2025/08/14"
5
+ updated_date = "2025/12/01"
6
6
 
7
7
  [rule]
8
8
  author = ["Elastic"]
@@ -106,8 +106,7 @@ from logs-windows.powershell_operational* metadata _id, _version, _index
106
106
  Esql.script_block_ratio,
107
107
  Esql.script_block_length,
108
108
  Esql.script_block_tmp,
109
- powershell.file.script_block_text,
110
- powershell.file.script_block_id,
109
+ powershell.file.*,
111
110
  file.directory,
112
111
  file.path,
113
112
  powershell.sequence,
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_iex_env_vars_reconstruction.toml CHANGED
@@ -2,7 +2,7 @@
2
2
  creation_date = "2025/04/16"
3
3
  integration = ["windows"]
4
4
  maturity = "production"
5
- updated_date = "2025/08/14"
5
+ updated_date = "2025/12/01"
6
6
 
7
7
  [rule]
8
8
  author = ["Elastic"]
@@ -106,8 +106,7 @@ from logs-windows.powershell_operational* metadata _id, _version, _index
106
106
  Esql.script_block_pattern_count,
107
107
  Esql.script_block_length,
108
108
  Esql.script_block_tmp,
109
- powershell.file.script_block_text,
110
- powershell.file.script_block_id,
109
+ powershell.file.*,
111
110
  file.path,
112
111
  powershell.sequence,
113
112
  powershell.total,
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_iex_string_reconstruction.toml CHANGED
@@ -2,7 +2,7 @@
2
2
  creation_date = "2025/04/16"
3
3
  integration = ["windows"]
4
4
  maturity = "production"
5
- updated_date = "2025/08/14"
5
+ updated_date = "2025/12/01"
6
6
 
7
7
  [rule]
8
8
  author = ["Elastic"]
@@ -107,8 +107,7 @@ from logs-windows.powershell_operational* metadata _id, _version, _index
107
107
  Esql.script_block_pattern_count,
108
108
  Esql.script_block_length,
109
109
  Esql.script_block_tmp,
110
- powershell.file.script_block_text,
111
- powershell.file.script_block_id,
110
+ powershell.file.*,
112
111
  file.path,
113
112
  file.directory,
114
113
  powershell.sequence,
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_index_reversal.toml CHANGED
@@ -2,7 +2,7 @@
2
2
  creation_date = "2025/04/14"
3
3
  integration = ["windows"]
4
4
  maturity = "production"
5
- updated_date = "2025/07/16"
5
+ updated_date = "2025/12/01"
6
6
 
7
7
  [rule]
8
8
  author = ["Elastic"]
@@ -108,8 +108,7 @@ from logs-windows.powershell_operational* metadata _id, _version, _index
108
108
  Esql.script_block_pattern_count,
109
109
  Esql.script_block_length,
110
110
  Esql.script_block_tmp,
111
- powershell.file.script_block_text,
112
- powershell.file.script_block_id,
111
+ powershell.file.*,
113
112
  file.path,
114
113
  powershell.sequence,
115
114
  powershell.total,
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_reverse_keyword.toml CHANGED
@@ -2,7 +2,7 @@
2
2
  creation_date = "2025/04/14"
3
3
  integration = ["windows"]
4
4
  maturity = "production"
5
- updated_date = "2025/08/14"
5
+ updated_date = "2025/12/01"
6
6
 
7
7
  [rule]
8
8
  author = ["Elastic"]
@@ -104,8 +104,7 @@ from logs-windows.powershell_operational* metadata _id, _version, _index
104
104
  | keep
105
105
  Esql.script_block_pattern_count,
106
106
  Esql.script_block_tmp,
107
- powershell.file.script_block_text,
108
- powershell.file.script_block_id,
107
+ powershell.file.*,
109
108
  file.path,
110
109
  powershell.sequence,
111
110
  powershell.total,
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_string_concat.toml CHANGED
@@ -2,7 +2,7 @@
2
2
  creation_date = "2025/04/14"
3
3
  integration = ["windows"]
4
4
  maturity = "production"
5
- updated_date = "2025/07/16"
5
+ updated_date = "2025/12/01"
6
6
 
7
7
  [rule]
8
8
  author = ["Elastic"]
@@ -106,8 +106,7 @@ from logs-windows.powershell_operational* metadata _id, _version, _index
106
106
  Esql.script_block_pattern_count,
107
107
  Esql.script_block_length,
108
108
  Esql.script_block_tmp,
109
- powershell.file.script_block_text,
110
- powershell.file.script_block_id,
109
+ powershell.file.*,
111
110
  file.path,
112
111
  powershell.sequence,
113
112
  powershell.total,
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_string_format.toml CHANGED
@@ -2,7 +2,7 @@
2
2
  creation_date = "2025/04/03"
3
3
  integration = ["windows"]
4
4
  maturity = "production"
5
- updated_date = "2025/08/14"
5
+ updated_date = "2025/12/01"
6
6
 
7
7
  [rule]
8
8
  author = ["Elastic"]
@@ -105,8 +105,7 @@ from logs-windows.powershell_operational* metadata _id, _version, _index
105
105
  Esql.script_block_pattern_count,
106
106
  Esql.script_block_length,
107
107
  Esql.script_block_tmp,
108
- powershell.file.script_block_text,
109
- powershell.file.script_block_id,
108
+ powershell.file.*,
110
109
  file.path,
111
110
  file.directory,
112
111
  powershell.sequence,
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_whitespace_special_proportion.toml CHANGED
@@ -2,7 +2,7 @@
2
2
  creation_date = "2025/04/16"
3
3
  integration = ["windows"]
4
4
  maturity = "production"
5
- updated_date = "2025/07/16"
5
+ updated_date = "2025/12/01"
6
6
 
7
7
  [rule]
8
8
  author = ["Elastic"]
@@ -113,8 +113,7 @@ from logs-windows.powershell_operational* metadata _id, _version, _index
113
113
  Esql.script_block_length,
114
114
  Esql.script_block_ratio,
115
115
  Esql.script_block_tmp,
116
- powershell.file.script_block_text,
117
- powershell.file.script_block_id,
116
+ powershell.file.*,
118
117
  file.path,
119
118
  powershell.sequence,
120
119
  powershell.total,
nldcsc_elastic_rules/rules/windows/defense_evasion_wsl_filesystem.toml CHANGED
@@ -2,13 +2,13 @@
2
2
  creation_date = "2023/01/12"
3
3
  integration = ["endpoint", "windows", "sentinel_one_cloud_funnel"]
4
4
  maturity = "production"
5
- updated_date = "2025/08/26"
5
+ updated_date = "2025/12/01"
6
6
 
7
7
  [rule]
8
8
  author = ["Elastic"]
9
9
  description = """
10
- Detects files creation and modification on the host system from the the Windows Subsystem for Linux. Adversaries may
11
- enable and use WSL for Linux to avoid detection.
10
+ Detects file creation and modification on the host system from the Windows Subsystem for Linux. Adversaries may enable
11
+ and use WSL to avoid detection.
12
12
  """
13
13
  from = "now-9m"
14
14
  index = [
@@ -20,13 +20,13 @@ index = [
20
20
  ]
21
21
  language = "eql"
22
22
  license = "Elastic License v2"
23
- name = "Host Files System Changes via Windows Subsystem for Linux"
23
+ name = "Host File System Changes via Windows Subsystem for Linux"
24
24
  note = """## Triage and analysis
25
25
 
26
26
  > **Disclaimer**:
27
27
  > This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
28
28
 
29
- ### Investigating Host Files System Changes via Windows Subsystem for Linux
29
+ ### Investigating Host File System Changes via Windows Subsystem for Linux
30
30
 
31
31
  Windows Subsystem for Linux (WSL) allows users to run a Linux environment directly on Windows, facilitating seamless file access between systems. Adversaries may exploit WSL to modify host files stealthily, bypassing traditional security measures. The detection rule identifies suspicious file operations initiated by WSL processes, particularly those involving the Plan9FileSystem, to flag potential defense evasion attempts.
32
32
 
@@ -75,11 +75,14 @@ type = "eql"
75
75
 
76
76
  query = '''
77
77
  sequence by process.entity_id with maxspan=5m
78
- [process where host.os.type == "windows" and event.type == "start" and
79
- process.name : "dllhost.exe" and
80
- /* Plan9FileSystem CLSID - WSL Host File System Worker */
81
- process.command_line : "*{DFB65C4C-B34F-435D-AFE9-A86218684AA8}*"]
82
- [file where host.os.type == "windows" and process.name : "dllhost.exe" and not file.path : "?:\\Users\\*\\Downloads\\*"]
78
+ [process where host.os.type == "windows" and event.type == "start" and
79
+ process.name : "dllhost.exe" and
80
+ /* Plan9FileSystem CLSID - WSL Host File System Worker */
81
+ process.command_line : "*{DFB65C4C-B34F-435D-AFE9-A86218684AA8}*"]
82
+ [file where host.os.type == "windows" and process.name : "dllhost.exe" and
83
+ not file.path : (
84
+ "?:\\Users\\*\\Downloads\\*",
85
+ "?:\\Windows\\Prefetch\\DLLHOST.exe-????????.pf")]
83
86
  '''
84
87
 
85
88
 
nldcsc_elastic_rules/rules/windows/execution_posh_hacktool_functions.toml CHANGED
@@ -2,7 +2,7 @@
2
2
  creation_date = "2023/01/17"
3
3
  integration = ["windows"]
4
4
  maturity = "production"
5
- updated_date = "2025/09/03"
5
+ updated_date = "2025/12/01"
6
6
 
7
7
  [transform]
8
8
  [[transform.osquery]]
@@ -321,7 +321,8 @@ event.category:process and host.os.type:windows and
321
321
  "Invoke-FileTransferOverWMI" or "Invoke-WMImplant" or
322
322
  "Invoke-WMIObfuscatedPSCommand" or "Invoke-WMIDuplicateClass" or
323
323
  "Invoke-WMIUpload" or "Invoke-WMIRemoteExtract" or "Invoke-winPEAS" or
324
- "Invoke-AzureHound" or "Invoke-SharpHound"
324
+ "Invoke-AzureHound" or "Invoke-SharpHound" or "Invoke-DownloadCradle" or
325
+ "Invoke-AppPathBypass"
325
326
  ) and
326
327
  not powershell.file.script_block_text : (
327
328
  "sentinelbreakpoints" and "Set-PSBreakpoint"
nldcsc_elastic_rules/rules/windows/execution_suspicious_powershell_imgload.toml CHANGED
@@ -2,7 +2,7 @@
2
2
  creation_date = "2020/11/17"
3
3
  integration = ["endpoint"]
4
4
  maturity = "production"
5
- updated_date = "2025/09/18"
5
+ updated_date = "2025/12/01"
6
6
 
7
7
  [rule]
8
8
  author = ["Elastic"]
@@ -97,7 +97,7 @@ host.os.type:windows and event.category:library and
97
97
  process.code_signature.trusted:true
98
98
  ) and
99
99
  not (
100
- process.executable: C\:\\Windows\\Temp\\\{*\}\\_is*.exe and
100
+ process.name: (_is*.exe or "DellInstaller_x64.exe") and
101
101
  process.code_signature.subject_name:("Dell Technologies Inc." or "Dell Inc" or "Dell Inc.") and
102
102
  process.code_signature.trusted:true
103
103
  ) and
@@ -106,6 +106,11 @@ host.os.type:windows and event.category:library and
106
106
  process.code_signature.subject_name:("Chocolatey Software, Inc." or "Chocolatey Software, Inc") and
107
107
  process.code_signature.trusted:true
108
108
  ) and
109
+ not (
110
+ process.name: "Docker Desktop Installer.exe" and
111
+ process.code_signature.subject_name:"Docker Inc" and
112
+ process.code_signature.trusted:true
113
+ ) and
109
114
  not process.executable : (
110
115
  "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" or
111
116
  "C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe"
nldcsc_elastic_rules/rules/windows/execution_windows_powershell_susp_args.toml CHANGED
@@ -2,7 +2,7 @@
2
2
  creation_date = "2024/09/06"
3
3
  integration = ["endpoint", "windows", "system", "sentinel_one_cloud_funnel", "m365_defender", "crowdstrike"]
4
4
  maturity = "production"
5
- updated_date = "2025/09/18"
5
+ updated_date = "2025/12/01"
6
6
 
7
7
  [rule]
8
8
  author = ["Elastic"]
@@ -150,7 +150,9 @@ process where host.os.type == "windows" and event.type == "start" and
150
150
  "*$env:computername*http*",
151
151
  "*;InVoKe-ExpRESsIoN $COntent.CONTENt;*",
152
152
  "*WebClient*example.com*",
153
- "*=iwr $*;iex $*"
153
+ "*=iwr $*;iex $*",
154
+ "*ServerXmlHttp*IEX*",
155
+ "*XmlDocument*IEX*"
154
156
  ) or
155
157
 
156
158
  (process.args : "-c" and process.args : "&{'*") or
@@ -161,6 +163,11 @@ process where host.os.type == "windows" and event.type == "start" and
161
163
 
162
164
  process.args : "$*$*;set-alias" or
163
165
 
166
+ process.args == "-e" or
167
+
168
+ // ATHPowerShellCommandLineParameter
169
+ process.args : ("-EncodedCommandParamVariation", "-UseEncodedArguments", "-CommandParamVariation") or
170
+
164
171
  (
165
172
  process.parent.name : ("explorer.exe", "cmd.exe") and
166
173
  process.command_line : ("*-encodedCommand*", "*Invoke-webrequest*", "*WebClient*", "*Reflection.Assembly*"))
nldcsc_elastic_rules/rules/windows/impact_mod_critical_os_files.toml CHANGED
@@ -1,8 +1,8 @@
1
1
  [metadata]
2
2
  creation_date = "2025/09/01"
3
- integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
3
+ integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel"]
4
4
  maturity = "production"
5
- updated_date = "2025/09/11"
5
+ updated_date = "2025/12/01"
6
6
 
7
7
  [rule]
8
8
  author = ["Elastic"]
@@ -18,7 +18,6 @@ index = [
18
18
  "endgame-*",
19
19
  "logs-m365_defender.event-*",
20
20
  "logs-sentinel_one_cloud_funnel.*",
21
- "logs-crowdstrike.fdr*",
22
21
  ]
23
22
  language = "eql"
24
23
  license = "Elastic License v2"
@@ -75,9 +74,20 @@ type = "eql"
75
74
 
76
75
  query = '''
77
76
  file where host.os.type == "windows" and event.type in ("change", "deletion") and
78
- file.name : ("winload.exe", "winlod.efi", "ntoskrnl.exe", "bootmgr") and
79
- file.path : ("?:\\Windows\\*", "\\Device\\HarddiskVolume*\\Windows\\*") and
80
- not process.executable : ("?:\\Windows\\System32\\poqexec.exe", "\\Device\\HarddiskVolume*\\Windows\\System32\\poqexec.exe")
77
+ file.name : ("winload.exe", "winlod.efi", "ntoskrnl.exe", "bootmgr") and
78
+ file.path : ("?:\\Windows\\*", "\\Device\\HarddiskVolume*\\Windows\\*") and
79
+ not process.executable : (
80
+ "?:\\Windows\\System32\\poqexec.exe",
81
+ "?:\\Windows\\WinSxS\\amd64_microsoft-windows-servicingstack_*\\tiworker.exe"
82
+ ) and
83
+ not file.path : (
84
+ "?:\\Windows\\WinSxS\\Temp\\InFlight\\*",
85
+ "?:\\Windows\\SoftwareDistribution\\Download*",
86
+ "?:\\Windows\\WinSxS\\amd64_microsoft-windows*",
87
+ "?:\\Windows\\SystemTemp\\*",
88
+ "?:\\Windows\\Temp\\????????.???\\*",
89
+ "?:\\Windows\\Temp\\*\\amd64_microsoft-windows-*"
90
+ )
81
91
  '''
82
92
 
83
93
 
nldcsc_elastic_rules/rules/windows/lateral_movement_credential_access_kerberos_correlation.toml CHANGED
@@ -2,7 +2,7 @@
2
2
  creation_date = "2025/10/28"
3
3
  integration = ["endpoint", "windows", "system"]
4
4
  maturity = "production"
5
- updated_date = "2025/10/28"
5
+ updated_date = "2025/11/25"
6
6
 
7
7
  [rule]
8
8
  author = ["Elastic"]
@@ -85,7 +85,12 @@ query = '''
85
85
  sequence by source.port, source.ip with maxspan=3s
86
86
  [network where host.os.type == "windows" and destination.port == 88 and
87
87
  process.executable != null and
88
- not process.executable : ("?:\\Windows\\system32\\lsass.exe", "\\device\\harddiskvolume*\\windows\\system32\\lsass.exe") and
88
+ not process.executable :
89
+ ("?:\\Windows\\system32\\lsass.exe",
90
+ "\\device\\harddiskvolume*\\windows\\system32\\lsass.exe") and
91
+ not (process.executable : ("C:\\Windows\\System32\\svchost.exe",
92
+ "C:\\Program Files\\VMware\\VMware View\\Server\\bin\\ws_TomcatService.exe",
93
+ "F:\\IGEL\\RemoteManager\\*\\bin\\tomcat10.exe") and user.id in ("S-1-5-20", "S-1-5-18")) and
89
94
  source.ip != "127.0.0.1" and destination.ip != "::1" and destination.ip != "127.0.0.1"]
90
95
  [authentication where host.os.type == "windows" and event.code in ("4768", "4769")]
91
96
  '''
nldcsc_elastic_rules/rules/windows/lateral_movement_scheduled_task_target.toml CHANGED
@@ -2,7 +2,7 @@
2
2
  creation_date = "2020/11/20"
3
3
  integration = ["endpoint", "windows", "sentinel_one_cloud_funnel"]
4
4
  maturity = "production"
5
- updated_date = "2025/08/28"
5
+ updated_date = "2025/12/08"
6
6
 
7
7
  [rule]
8
8
  author = ["Elastic"]
@@ -68,7 +68,7 @@ query = '''
68
68
  sequence by host.id, process.entity_id with maxspan = 1m
69
69
  [network where host.os.type == "windows" and process.name : "svchost.exe" and
70
70
  network.direction : ("incoming", "ingress") and source.port >= 49152 and destination.port >= 49152 and
71
- source.ip != "127.0.0.1" and source.ip != "::1"
71
+ source.ip != "127.0.0.1" and source.ip != "::1" and source.ip != null
72
72
  ]
73
73
  [registry where host.os.type == "windows" and event.type == "change" and registry.value : "Actions" and
74
74
  registry.path : "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\*\\Actions"]
nldcsc_elastic_rules/rules/windows/persistence_browser_extension_install.toml CHANGED
@@ -2,7 +2,7 @@
2
2
  creation_date = "2023/08/22"
3
3
  integration = ["endpoint", "m365_defender", "sentinel_one_cloud_funnel", "windows"]
4
4
  maturity = "production"
5
- updated_date = "2025/05/05"
5
+ updated_date = "2025/12/01"
6
6
 
7
7
  [rule]
8
8
  author = ["Elastic"]
@@ -84,7 +84,24 @@ file where host.os.type == "windows" and event.type : "creation" and
84
84
  not
85
85
  (
86
86
  process.name : "firefox.exe" and
87
- file.name : ("langpack-*@firefox.mozilla.org.xpi", "*@dictionaries.addons.mozilla.org.xpi")
87
+ file.name : (
88
+ "langpack-*@firefox.mozilla.org.xpi",
89
+ "*@dictionaries.addons.mozilla.org.xpi",
90
+ "newtab@mozilla.org.xpi",
91
+ "uBlock0@raymondhill.net.xpi",
92
+ /* AdBlockPlus */
93
+ "{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi",
94
+ /* Bitwarden */
95
+ "{446900e4-71c2-419f-a6a7-df9c091e268b}.xpi",
96
+ "addon@darkreader.org.xpi",
97
+ /* 1Password */
98
+ "{d634138d-c276-4fc8-924b-40a0ea21d284}.xpi",
99
+ "support@lastpass.com.xpi",
100
+ /* Grammarly */
101
+ "87677a2c52b84ad3a151a4a72f5bd3c4@jetpack.xpi",
102
+ "sentinelone_visibility@sentinelone.com.xpi",
103
+ "keepassxc-browser@keepassxc.org.xpi"
104
+ )
88
105
  )
89
106
  ) or
90
107
  /* Chromium-Based Browsers */