Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Rule Tuning] Direct Outbound SMB Connection #3400

Merged
merged 2 commits into from
Jan 23, 2024
Merged

[Rule Tuning] Direct Outbound SMB Connection #3400

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
fe89e69
[Rule Tuning] Direct Outbound SMB Connection
w0rk3r Jan 23, 2024
5f2ae83
Update lateral_movement_direct_outbound_smb_connection.toml
w0rk3r Jan 23, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 4 additions & 10 deletions rules/windows/lateral_movement_direct_outbound_smb_connection.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/01/03"
updated_date = "2024/01/22"

[transform]
[[transform.osquery]]
Expand Down Expand Up @@ -41,7 +41,7 @@ connections are established by the kernel. Processes making 445/tcp connections
suspicious user-level processes moving laterally.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*"]
index = ["logs-endpoint.events.*"]
language = "eql"
license = "Elastic License v2"
name = "Direct Outbound SMB Connection"
Expand Down Expand Up @@ -104,14 +104,8 @@ query = '''
sequence by process.entity_id with maxspan=2m
[process where host.os.type == "windows" and event.type == "start" and process.pid != 4 and
not user.id : ("S-1-5-19", "S-1-5-20") and
not (process.code_signature.trusted == true and not process.code_signature.subject_name : ("Famatech Corp.", "Insecure.Com LLC")) and
not (process.name : "powershell.exe" and process.args : "?:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\Downloads\\PSScript_*.ps1") and
not (process.executable : "?:\\EnterpriseCare\\tools\\*\\bin\\java.exe" and process.args : "com.*.launcher.Invoker") and
not (process.executable : "?:\\Docusnap*\\Tools\\*\\nmap.exe" and process.args : "smb-os-discovery.nse") and
not process.executable :
("?:\\Program Files\\*.exe",
"?:\\Program Files (x86)\\*.exe",
"?:\\Windows\\ProPatches\\Installation\\InstallationSandbox*\\stdeploy.exe")]
not (process.code_signature.trusted == true and not process.code_signature.subject_name : "Microsoft *") and
not (process.name : "powershell.exe" and process.args : "?:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\Downloads\\PSScript_*.ps1")]
[network where host.os.type == "windows" and destination.port == 445 and process.pid != 4 and
not cidrmatch(destination.ip, "127.0.0.1", "::1")]
until [process where host.os.type == "windows" and event.type == "end"]
Expand Down
Loading