nldcsc-elastic-rules 0.0.8__py3-none-any.whl → 0.0.16__py3-none-any.whl

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (123) hide show
  1. nldcsc_elastic_rules/__init__.py +1 -1
  2. nldcsc_elastic_rules/rules/{linux → cross-platform}/command_and_control_curl_wget_spawn_via_nodejs_parent.toml +32 -11
  3. nldcsc_elastic_rules/rules/cross-platform/command_and_control_genai_process_suspicious_tld_connection.toml +134 -0
  4. nldcsc_elastic_rules/rules/cross-platform/command_and_control_genai_process_unusual_domain.toml +128 -0
  5. nldcsc_elastic_rules/rules/cross-platform/credential_access_genai_process_sensitive_file_access.toml +154 -0
  6. nldcsc_elastic_rules/rules/cross-platform/credential_access_gitleaks_execution.toml +114 -0
  7. nldcsc_elastic_rules/rules/cross-platform/credential_access_multi_could_secrets_via_api.toml +198 -0
  8. nldcsc_elastic_rules/rules/cross-platform/credential_access_trufflehog_execution.toml +24 -5
  9. nldcsc_elastic_rules/rules/cross-platform/defense_evasion_genai_config_modification.toml +120 -0
  10. nldcsc_elastic_rules/rules/cross-platform/defense_evasion_genai_process_compiling_executables.toml +158 -0
  11. nldcsc_elastic_rules/rules/cross-platform/defense_evasion_genai_process_encoding_prior_to_network_activity.toml +172 -0
  12. nldcsc_elastic_rules/rules/cross-platform/defense_evasion_potential_http_downgrade_attack.toml +98 -0
  13. nldcsc_elastic_rules/rules/cross-platform/discovery_web_server_local_file_inclusion_activity.toml +172 -0
  14. nldcsc_elastic_rules/rules/cross-platform/discovery_web_server_remote_file_inclusion_activity.toml +133 -0
  15. nldcsc_elastic_rules/rules/cross-platform/execution_aws_ec2_lolbin_via_ssm.toml +250 -0
  16. nldcsc_elastic_rules/rules/{linux/persistence_nodejs_pre_or_post_install_script_execution.toml → cross-platform/execution_nodejs_pre_or_post_install_script_execution.toml} +40 -24
  17. nldcsc_elastic_rules/rules/cross-platform/execution_privileged_container_creation_with_host_reference.toml +146 -0
  18. nldcsc_elastic_rules/rules/cross-platform/execution_register_github_actions_runner.toml +126 -0
  19. nldcsc_elastic_rules/rules/cross-platform/execution_via_github_actions_runner.toml +130 -0
  20. nldcsc_elastic_rules/rules/cross-platform/execution_via_github_runner_with_runner_tracking_id_tampering_via_env_vars.toml +163 -0
  21. nldcsc_elastic_rules/rules/cross-platform/initial_access_execution_susp_react_serv_child.toml +130 -0
  22. nldcsc_elastic_rules/rules/cross-platform/initial_access_file_upload_followed_by_get_request.toml +145 -0
  23. nldcsc_elastic_rules/rules/cross-platform/multiple_alerts_elastic_defend_netsecurity_by_host.toml +4 -1
  24. nldcsc_elastic_rules/rules/cross-platform/persistence_credential_access_modify_auth_module_or_config.toml +3 -4
  25. nldcsc_elastic_rules/rules/cross-platform/persistence_web_server_potential_command_injection.toml +23 -25
  26. nldcsc_elastic_rules/rules/cross-platform/reconnaissance_web_server_discovery_or_fuzzing_activity.toml +13 -14
  27. nldcsc_elastic_rules/rules/cross-platform/reconnaissance_web_server_unusual_spike_in_error_logs.toml +8 -5
  28. nldcsc_elastic_rules/rules/cross-platform/reconnaissance_web_server_unusual_spike_in_error_response_codes.toml +12 -12
  29. nldcsc_elastic_rules/rules/cross-platform/reconnaissance_web_server_unusual_user_agents.toml +37 -43
  30. nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_rds_instance_restored.toml +137 -45
  31. nldcsc_elastic_rules/rules/integrations/aws/discovery_iam_principal_enumeration_via_update_assume_role_policy.toml +152 -0
  32. nldcsc_elastic_rules/rules/integrations/aws/discovery_multiple_discovery_api_calls_via_cli.toml +242 -0
  33. nldcsc_elastic_rules/rules/integrations/aws/exfiltration_rds_snapshot_export.toml +141 -33
  34. nldcsc_elastic_rules/rules/integrations/aws/exfiltration_rds_snapshot_shared_with_another_account.toml +108 -30
  35. nldcsc_elastic_rules/rules/integrations/aws/exfiltration_s3_bucket_policy_added_for_external_account_access.toml +2 -1
  36. nldcsc_elastic_rules/rules/integrations/aws/exfiltration_s3_bucket_replicated_to_external_account.toml +114 -27
  37. nldcsc_elastic_rules/rules/integrations/aws/impact_efs_filesystem_deleted.toml +174 -0
  38. nldcsc_elastic_rules/rules/integrations/aws/impact_kms_cmk_disabled_or_scheduled_for_deletion.toml +111 -33
  39. nldcsc_elastic_rules/rules/integrations/aws/impact_rds_instance_cluster_deletion.toml +129 -43
  40. nldcsc_elastic_rules/rules/integrations/aws/impact_rds_instance_cluster_deletion_protection_disabled.toml +89 -27
  41. nldcsc_elastic_rules/rules/integrations/aws/impact_rds_snapshot_deleted.toml +127 -37
  42. nldcsc_elastic_rules/rules/integrations/aws/impact_s3_object_encryption_with_external_key.toml +160 -43
  43. nldcsc_elastic_rules/rules/integrations/aws/initial_access_iam_session_token_used_from_multiple_addresses.toml +20 -10
  44. nldcsc_elastic_rules/rules/integrations/aws/ml_cloudtrail_error_message_spike.toml +35 -1
  45. nldcsc_elastic_rules/rules/integrations/aws/ml_cloudtrail_rare_error_code.toml +59 -1
  46. nldcsc_elastic_rules/rules/integrations/aws/ml_cloudtrail_rare_method_by_city.toml +19 -1
  47. nldcsc_elastic_rules/rules/integrations/aws/ml_cloudtrail_rare_method_by_country.toml +19 -1
  48. nldcsc_elastic_rules/rules/integrations/aws/ml_cloudtrail_rare_method_by_user.toml +58 -1
  49. nldcsc_elastic_rules/rules/integrations/aws/persistence_rds_db_instance_password_modified.toml +109 -35
  50. nldcsc_elastic_rules/rules/integrations/aws/persistence_rds_instance_made_public.toml +103 -22
  51. nldcsc_elastic_rules/rules/integrations/aws/persistence_redshift_instance_creation.toml +3 -3
  52. nldcsc_elastic_rules/rules/integrations/aws/privilege_escalation_sts_assume_root_from_rare_user_and_member_account.toml +126 -69
  53. nldcsc_elastic_rules/rules/integrations/azure/credential_access_azure_entra_susp_device_code_signin.toml +134 -0
  54. nldcsc_elastic_rules/rules/integrations/azure/credential_access_entra_id_excessive_account_lockouts.toml +2 -2
  55. nldcsc_elastic_rules/rules/integrations/azure/ml_azure_event_failures.toml +124 -0
  56. nldcsc_elastic_rules/rules/integrations/azure/ml_azure_rare_event_failures.toml +148 -0
  57. nldcsc_elastic_rules/rules/integrations/azure/ml_azure_rare_method_by_city.toml +109 -0
  58. nldcsc_elastic_rules/rules/integrations/azure/ml_azure_rare_method_by_country.toml +108 -0
  59. nldcsc_elastic_rules/rules/integrations/azure/ml_azure_rare_method_by_user.toml +147 -0
  60. nldcsc_elastic_rules/rules/integrations/fim/persistence_suspicious_file_modifications.toml +9 -1
  61. nldcsc_elastic_rules/rules/integrations/gcp/ml_gcp_error_message_spike.toml +95 -0
  62. nldcsc_elastic_rules/rules/integrations/gcp/ml_gcp_rare_error_code.toml +118 -0
  63. nldcsc_elastic_rules/rules/integrations/gcp/ml_gcp_rare_method_by_city.toml +79 -0
  64. nldcsc_elastic_rules/rules/integrations/gcp/ml_gcp_rare_method_by_country.toml +79 -0
  65. nldcsc_elastic_rules/rules/integrations/gcp/ml_gcp_rare_method_by_user.toml +117 -0
  66. nldcsc_elastic_rules/rules/integrations/github/initial_access_github_register_self_hosted_runner.toml +92 -0
  67. nldcsc_elastic_rules/rules/integrations/o365/collection_onedrive_excessive_file_downloads.toml +24 -14
  68. nldcsc_elastic_rules/rules/linux/defense_evasion_file_deletion_via_shred.toml +12 -5
  69. nldcsc_elastic_rules/rules/linux/execution_suspicious_pod_or_container_creation_command_execution.toml +150 -0
  70. nldcsc_elastic_rules/rules/linux/persistence_at_job_creation.toml +4 -4
  71. nldcsc_elastic_rules/rules/linux/persistence_pluggable_authentication_module_creation.toml +12 -7
  72. nldcsc_elastic_rules/rules/linux/persistence_pth_file_creation.toml +6 -1
  73. nldcsc_elastic_rules/rules/linux/persistence_site_and_user_customize_file_creation.toml +6 -1
  74. nldcsc_elastic_rules/rules/linux/persistence_web_server_unusual_command_execution.toml +155 -0
  75. nldcsc_elastic_rules/rules/ml/ml_high_count_events_for_a_host_name.toml +58 -1
  76. nldcsc_elastic_rules/rules/ml/ml_high_count_network_denies.toml +71 -1
  77. nldcsc_elastic_rules/rules/ml/ml_high_count_network_events.toml +53 -1
  78. nldcsc_elastic_rules/rules/ml/ml_linux_anomalous_network_activity.toml +56 -1
  79. nldcsc_elastic_rules/rules/ml/ml_linux_anomalous_network_port_activity.toml +40 -1
  80. nldcsc_elastic_rules/rules/ml/ml_low_count_events_for_a_host_name.toml +27 -1
  81. nldcsc_elastic_rules/rules/ml/ml_packetbeat_rare_server_domain.toml +63 -1
  82. nldcsc_elastic_rules/rules/ml/ml_rare_destination_country.toml +68 -1
  83. nldcsc_elastic_rules/rules/ml/ml_spike_in_traffic_to_a_country.toml +53 -1
  84. nldcsc_elastic_rules/rules/ml/ml_windows_anomalous_network_activity.toml +56 -1
  85. nldcsc_elastic_rules/rules/network/initial_access_react_server_components_rce_attempt.toml +123 -0
  86. nldcsc_elastic_rules/rules/promotions/external_alerts.toml +2 -2
  87. nldcsc_elastic_rules/rules/windows/command_and_control_common_webservices.toml +4 -3
  88. nldcsc_elastic_rules/rules/windows/credential_access_rare_webdav_destination.toml +3 -4
  89. nldcsc_elastic_rules/rules/windows/defense_evasion_masquerading_as_svchost.toml +11 -8
  90. nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation.toml +25 -2
  91. nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_backtick.toml +2 -3
  92. nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_backtick_var.toml +2 -3
  93. nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_char_arrays.toml +2 -3
  94. nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_concat_dynamic.toml +2 -3
  95. nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_high_number_proportion.toml +2 -3
  96. nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_iex_env_vars_reconstruction.toml +2 -3
  97. nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_iex_string_reconstruction.toml +2 -3
  98. nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_index_reversal.toml +2 -3
  99. nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_reverse_keyword.toml +2 -3
  100. nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_string_concat.toml +2 -3
  101. nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_string_format.toml +2 -3
  102. nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_whitespace_special_proportion.toml +2 -3
  103. nldcsc_elastic_rules/rules/windows/defense_evasion_wsl_filesystem.toml +13 -10
  104. nldcsc_elastic_rules/rules/windows/execution_posh_hacktool_functions.toml +3 -2
  105. nldcsc_elastic_rules/rules/windows/execution_suspicious_powershell_imgload.toml +7 -2
  106. nldcsc_elastic_rules/rules/windows/execution_windows_powershell_susp_args.toml +9 -2
  107. nldcsc_elastic_rules/rules/windows/impact_mod_critical_os_files.toml +16 -6
  108. nldcsc_elastic_rules/rules/windows/lateral_movement_credential_access_kerberos_correlation.toml +7 -2
  109. nldcsc_elastic_rules/rules/windows/lateral_movement_scheduled_task_target.toml +2 -2
  110. nldcsc_elastic_rules/rules/windows/persistence_browser_extension_install.toml +19 -2
  111. nldcsc_elastic_rules/rules/windows/persistence_msi_installer_task_startup.toml +50 -13
  112. nldcsc_elastic_rules/rules/windows/persistence_via_application_shimming.toml +12 -2
  113. nldcsc_elastic_rules/rules/windows/privilege_escalation_tokenmanip_sedebugpriv_enabled.toml +24 -18
  114. nldcsc_elastic_rules/rules/windows/privilege_escalation_unusual_printspooler_childprocess.toml +14 -2
  115. nldcsc_elastic_rules/rules/windows/privilege_escalation_via_ppid_spoofing.toml +3 -2
  116. {nldcsc_elastic_rules-0.0.8.dist-info → nldcsc_elastic_rules-0.0.16.dist-info}/METADATA +1 -1
  117. {nldcsc_elastic_rules-0.0.8.dist-info → nldcsc_elastic_rules-0.0.16.dist-info}/RECORD +119 -87
  118. nldcsc_elastic_rules/rules/integrations/aws/credential_access_aws_iam_assume_role_brute_force.toml +0 -105
  119. nldcsc_elastic_rules/rules/integrations/aws/discovery_ec2_multi_region_describe_instances.toml +0 -135
  120. nldcsc_elastic_rules/rules/integrations/aws/discovery_ec2_multiple_discovery_api_calls_via_cli.toml +0 -155
  121. nldcsc_elastic_rules/rules/integrations/aws/impact_efs_filesystem_or_mount_deleted.toml +0 -95
  122. {nldcsc_elastic_rules-0.0.8.dist-info → nldcsc_elastic_rules-0.0.16.dist-info}/WHEEL +0 -0
  123. {nldcsc_elastic_rules-0.0.8.dist-info → nldcsc_elastic_rules-0.0.16.dist-info}/top_level.txt +0 -0
nldcsc_elastic_rules/rules/windows/persistence_msi_installer_task_startup.toml CHANGED
@@ -2,7 +2,7 @@
2
2
  creation_date = "2024/09/05"
3
3
  integration = ["endpoint"]
4
4
  maturity = "production"
5
- updated_date = "2025/01/15"
5
+ updated_date = "2025/12/01"
6
6
 
7
7
  [rule]
8
8
  author = ["Elastic"]
@@ -35,18 +35,55 @@ type = "eql"
35
35
 
36
36
  query = '''
37
37
  any where host.os.type == "windows" and
38
- (process.name : "msiexec.exe" or Effective_process.name : "msiexec.exe") and
39
- (
40
- (event.category == "file" and event.action == "creation" and
41
- file.path : ("?:\\Windows\\System32\\Tasks\\*",
42
- "?:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\*",
43
- "?:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*")) or
44
-
45
- (event.category == "registry" and event.action == "modification" and
46
- registry.path : ("H*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
47
- "H*\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
48
- "H*\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*",
49
- "H*\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*"))
38
+ (process.name : "msiexec.exe" or Effective_process.name : "msiexec.exe") and
39
+ (
40
+ (
41
+ event.category == "file" and event.action == "creation" and
42
+ file.path : (
43
+ "?:\\Windows\\System32\\Tasks\\*",
44
+ "?:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\*",
45
+ "?:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*"
46
+ ) and
47
+ not file.path : (
48
+ "?:\\Windows\\System32\\Tasks\\Adobe Acrobat Update Task",
49
+ "?:\\Windows\\System32\\Tasks\\HP\\Sure Click\\Sure Click ?.?.??.????",
50
+ "?:\\Windows\\System32\\Tasks\\HP\\Sure Click\\Sure Click UI ?.?.??.????",
51
+ "?:\\Windows\\System32\\Tasks\\HP\\Sure Click\\Upgrade Repair ?.?.??.????",
52
+ "?:\\Windows\\System32\\Tasks\\IntelSURQC-Upgrade-86621605-2a0b-4128-8ffc-15514c247132",
53
+ "?:\\Windows\\System32\\Tasks\\IntelSURQC-Upgrade-86621605-2a0b-4128-8ffc-15514c247132-Logon"
54
+ )
55
+ ) or
56
+ (
57
+ event.category == "registry" and event.action == "modification" and registry.data.strings != null and
58
+ registry.path : (
59
+ "H*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
60
+ "H*\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
61
+ "H*\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*",
62
+ "H*\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*"
63
+ ) and
64
+ not registry.data.strings : (
65
+ "C:\\Program Files (x86)\\Common Files\\Acronis\\TibMounter\\tib_mounter_monitor.exe",
66
+ "C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jusched.exe",
67
+ "C:\\Program Files\\Citrix\\Secure Access Client\\CtxsDPS.exe --clean-user-installs",
68
+ "C:\\Program Files\\OpenVPN\\bin\\openvpn-gui.exe",
69
+ "C:\\Program Files\\Veeam\\Endpoint Backup\\Veeam.EndPoint.Tray.exe -NoControlPanel -CheckNumberOfRunningAgents",
70
+ "\"C:\\Program Files (x86)\\Cisco\\Cisco Secure Client\\UI\\csc_ui.exe\" -minimized",
71
+ "\"C:\\Program Files (x86)\\Citrix\\ICA Client\\concentr.exe\" /startup",
72
+ "\"C:\\Program Files (x86)\\Citrix\\ICA Client\\Receiver\\AnalyticsSrv.exe\" /Startup",
73
+ "\"C:\\Program Files (x86)\\Citrix\\ICA Client\\redirector.exe\" /startup",
74
+ "\"C:\\Program Files (x86)\\EPSON Software\\Download Navigator\\EPSDNMON.EXE\"",
75
+ "\"C:\\Program Files (x86)\\Jabra\\Direct6\\jabra-direct.exe\" /minimized",
76
+ "\"C:\\Program Files (x86)\\VMware\\VMware Workstation\\vmware-tray.exe\"",
77
+ "\"C:\\Program Files\\ESET\\ESET Security\\ecmds.exe\" /run /hide /proxy",
78
+ "\"C:\\Program Files\\iTunes\\iTunesHelper.exe\"",
79
+ "\"C:\\Program Files\\KeePassXC\\KeePassXC.exe\"",
80
+ "\"C:\\Program Files\\Palo Alto Networks\\GlobalProtect\\PanGPA.exe\"",
81
+ "\"C:\\Program Files\\PDF24\\pdf24.exe\"",
82
+ "\"C:\\Program Files\\VMware\\VMware Tools\\vmtoolsd.exe\" -n vmusr",
83
+ "\"C:\\PROGRA~2\\Citrix\\DEVICE~1\\Bin64\\DTCLIE~1.EXE\"",
84
+ "\"%ProgramFiles%\\Teams Installer\\Teams.exe\" --checkInstall --source=default"
85
+ )
86
+ )
50
87
  )
51
88
  '''
52
89
  note = """## Triage and analysis
nldcsc_elastic_rules/rules/windows/persistence_via_application_shimming.toml CHANGED
@@ -2,7 +2,7 @@
2
2
  creation_date = "2020/02/18"
3
3
  integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
4
4
  maturity = "production"
5
- updated_date = "2025/03/20"
5
+ updated_date = "2025/12/01"
6
6
 
7
7
  [rule]
8
8
  author = ["Elastic"]
@@ -85,7 +85,17 @@ query = '''
85
85
  process where host.os.type == "windows" and event.type == "start" and process.name : "sdbinst.exe" and
86
86
  process.args : "?*" and
87
87
  not (process.args : "-m" and process.args : "-bg") and
88
- not process.args : "-mm"
88
+ not process.args : (
89
+ "-mm",
90
+ "?:\\Program Files\\WindowsApps\\Microsoft.ApplicationCompatibilityEnhancements_*\\sdb\\sysMergeInboxStoreApp.sdb",
91
+ "\"?:\\Program Files\\WindowsApps\\Microsoft.ApplicationCompatibilityEnhancements_*\\sdb\\sysMergeInboxStoreApp.sdb\"",
92
+ "?:\\Program Files\\WindowsApps\\Microsoft.ApplicationCompatibilityEnhancements_*\\sdb\\msiMergeInboxStoreApp.sdb",
93
+ "\"?:\\Program Files\\WindowsApps\\Microsoft.ApplicationCompatibilityEnhancements_*\\sdb\\msiMergeInboxStoreApp.sdb\"",
94
+ "?:\\Program Files (x86)\\Citrix\\ICA Client\\CitrixWorkspaceLegacySWDA.sdb",
95
+ "Citrix Workspace",
96
+ "C:\\Program Files\\IIS Express\\iisexpressshim.sdb",
97
+ "C:\\Program Files (x86)\\IIS Express\\iisexpressshim.sdb"
98
+ )
89
99
  '''
90
100
 
91
101
 
nldcsc_elastic_rules/rules/windows/privilege_escalation_tokenmanip_sedebugpriv_enabled.toml CHANGED
@@ -2,13 +2,14 @@
2
2
  creation_date = "2022/10/20"
3
3
  integration = ["windows", "system"]
4
4
  maturity = "production"
5
- updated_date = "2025/03/20"
5
+ updated_date = "2025/12/01"
6
6
 
7
7
  [rule]
8
8
  author = ["Elastic"]
9
9
  description = """
10
- Identifies the creation of a process running as SYSTEM and impersonating a Windows core binary privileges. Adversaries
11
- may create a new process with a different token to escalate privileges and bypass access controls.
10
+ Identifies a process running with a non-SYSTEM account that enables the SeDebugPrivilege privilege. Adversaries may
11
+ enable this privilege to debug and modify other processes, typically reserved for system-level tasks, to escalate
12
+ privileges and bypass access controls.
12
13
  """
13
14
  from = "now-9m"
14
15
  index = ["logs-system.security*", "logs-windows.forwarded*", "winlogbeat-*"]
@@ -94,21 +95,26 @@ any where host.os.type == "windows" and event.provider: "Microsoft-Windows-Secur
94
95
  /* exclude processes with System Integrity */
95
96
  not winlog.event_data.SubjectUserSid : ("S-1-5-18", "S-1-5-19", "S-1-5-20") and
96
97
 
97
- not winlog.event_data.ProcessName :
98
- ("?:\\Windows\\System32\\msiexec.exe",
99
- "?:\\Windows\\SysWOW64\\msiexec.exe",
100
- "?:\\Windows\\System32\\lsass.exe",
101
- "?:\\Windows\\WinSxS\\*",
102
- "?:\\Program Files\\*",
103
- "?:\\Program Files (x86)\\*",
104
- "?:\\Windows\\System32\\MRT.exe",
105
- "?:\\Windows\\System32\\cleanmgr.exe",
106
- "?:\\Windows\\System32\\taskhostw.exe",
107
- "?:\\Windows\\System32\\mmc.exe",
108
- "?:\\Users\\*\\AppData\\Local\\Temp\\*-*\\DismHost.exe",
109
- "?:\\Windows\\System32\\auditpol.exe",
110
- "?:\\Windows\\System32\\wbem\\WmiPrvSe.exe",
111
- "?:\\Windows\\SysWOW64\\wbem\\WmiPrvSe.exe")
98
+ not winlog.event_data.ProcessName : (
99
+ "?:\\Program Files (x86)\\*",
100
+ "?:\\Program Files\\*",
101
+ "?:\\Users\\*\\AppData\\Local\\Temp\\*-*\\DismHost.exe",
102
+ "?:\\Windows\\System32\\auditpol.exe",
103
+ "?:\\Windows\\System32\\cleanmgr.exe",
104
+ "?:\\Windows\\System32\\lsass.exe",
105
+ "?:\\Windows\\System32\\mmc.exe",
106
+ "?:\\Windows\\System32\\MRT.exe",
107
+ "?:\\Windows\\System32\\msiexec.exe",
108
+ "?:\\Windows\\System32\\sdiagnhost.exe",
109
+ "?:\\Windows\\System32\\ServerManager.exe",
110
+ "?:\\Windows\\System32\\taskhostw.exe",
111
+ "?:\\Windows\\System32\\wbem\\WmiPrvSe.exe",
112
+ "?:\\Windows\\System32\\WerFault.exe",
113
+ "?:\\Windows\\SysWOW64\\msiexec.exe",
114
+ "?:\\Windows\\SysWOW64\\wbem\\WmiPrvSe.exe",
115
+ "?:\\Windows\\SysWOW64\\WerFault.exe",
116
+ "?:\\Windows\\WinSxS\\*"
117
+ )
112
118
  '''
113
119
 
114
120
 
nldcsc_elastic_rules/rules/windows/privilege_escalation_unusual_printspooler_childprocess.toml CHANGED
@@ -2,7 +2,7 @@
2
2
  creation_date = "2021/07/06"
3
3
  integration = ["endpoint", "windows", "system", "crowdstrike", "sentinel_one_cloud_funnel", "m365_defender"]
4
4
  maturity = "production"
5
- updated_date = "2025/08/28"
5
+ updated_date = "2025/12/01"
6
6
 
7
7
  [rule]
8
8
  author = ["Elastic"]
@@ -105,10 +105,22 @@ process where host.os.type == "windows" and event.type == "start" and
105
105
  not process.executable : (
106
106
  "?:\\Program Files (x86)\\CutePDF Writer\\CPWriter2.exe",
107
107
  "?:\\Program Files (x86)\\GPLGS\\gswin32c.exe",
108
+ "?:\\Program Files (x86)\\Acro Software\\CutePDF Writer\\CPWSave.exe",
109
+ "?:\\Program Files (x86)\\Acro Software\\CutePDF Writer\\CPWriter2.exe",
110
+ "?:\\Program Files (x86)\\CutePDF Writer\\CPWSave.exe",
111
+ "?:\\Program Files (x86)\\TSplus\\UniversalPrinter\\CPWriter2.exe",
112
+ "?:\\Program Files\\Seagull\\Printer Drivers\\Packages\\*\\DriverEnvironmentSetup.exe",
113
+ "?:\\Windows\\system32\\CNAB4RPD.EXE",
108
114
 
109
115
  /* Crowdstrike specific condition as it uses NT Object paths */
110
116
  "\\Device\\HarddiskVolume*\\Program Files (x86)\\CutePDF Writer\\CPWriter2.exe",
111
- "\\Device\\HarddiskVolume*\\Program Files (x86)\\GPLGS\\gswin32c.exe"
117
+ "\\Device\\HarddiskVolume*\\Program Files (x86)\\GPLGS\\gswin32c.exe",
118
+ "\\Device\\HarddiskVolume*\\Program Files (x86)\\Acro Software\\CutePDF Writer\\CPWSave.exe",
119
+ "\\Device\\HarddiskVolume*\\Program Files (x86)\\Acro Software\\CutePDF Writer\\CPWriter2.exe",
120
+ "\\Device\\HarddiskVolume*\\Program Files (x86)\\CutePDF Writer\\CPWSave.exe",
121
+ "\\Device\\HarddiskVolume*\\Program Files (x86)\\TSplus\\UniversalPrinter\\CPWriter2.exe",
122
+ "\\Device\\HarddiskVolume*\\Program Files\\Seagull\\Printer Drivers\\Packages\\*\\DriverEnvironmentSetup.exe",
123
+ "\\Device\\HarddiskVolume*\\Windows\\system32\\CNAB4RPD.EXE"
112
124
  )
113
125
  '''
114
126
 
nldcsc_elastic_rules/rules/windows/privilege_escalation_via_ppid_spoofing.toml CHANGED
@@ -2,7 +2,7 @@
2
2
  creation_date = "2022/10/20"
3
3
  integration = ["endpoint"]
4
4
  maturity = "production"
5
- updated_date = "2025/01/15"
5
+ updated_date = "2025/12/01"
6
6
 
7
7
  [rule]
8
8
  author = ["Elastic"]
@@ -58,7 +58,8 @@ process where host.os.type == "windows" and event.action == "start" and
58
58
  not (process.parent.executable : "?:\\Windows\\System32\\Utilman.exe" and
59
59
  process.executable : ("?:\\Windows\\System32\\osk.exe",
60
60
  "?:\\Windows\\System32\\Narrator.exe",
61
- "?:\\Windows\\System32\\Magnify.exe")) and
61
+ "?:\\Windows\\System32\\Magnify.exe",
62
+ "?:\\Windows\\System32\\VoiceAccess.exe")) and
62
63
 
63
64
  not process.parent.executable : "?:\\Windows\\System32\\AtBroker.exe" and
64
65
 
{nldcsc_elastic_rules-0.0.8.dist-info → nldcsc_elastic_rules-0.0.16.dist-info}/METADATA RENAMED
@@ -1,3 +1,3 @@
1
1
  Metadata-Version: 2.4
2
2
  Name: nldcsc-elastic-rules
3
- Version: 0.0.8
3
+ Version: 0.0.16