DOCSEARCHbyAlgolia
Submit Docs

Elastic Security Detection Rules

repository·main·Indexed 25 days ago

https://github.com/elastic/detection-rules

Central repository for the development, maintenance, testing, and release of Elastic Security detection rules. It features a 'Detections as Code' (DaC) framework with Python modules for rule validation, Kibana API integration, and KQL parsing. The repository includes tools for threat hunting queries (including LLM-specific protections), experimental machine learning features like DGA and risk scoring, and guides for implementing required Windows audit policies and Sysmon configurations.

Tokens
184.6K
Snippets
314
Records
694
Agent score
83%

What's inside elastic-detection-rules

  1. Overview of LLM Threat Hunting Queries

    main

    The LLM subfolder within the hunting directory contains specialized threat hunting queries designed to protect Large Language Model (LLM) applications. These queries target unique security challenges by focusing on vulnerabilities identified in the OWASP Top 10 for LLMs and the MITRE ATLAS matrix.

    Key threat areas covered include:

    • Sensitive Content Refusal: Monitoring interactions to ensure compliance with ethical standards and refusal of sensitive topics.
    • Denial of Service (DoS) and Resource Exhaustion: Detecting patterns indicative of attacks intended to disrupt LLM operations.
    • Latency Anomalies: Tracking processing delays that may signal performance issues or security threats like DDoS.

  2. Overview of Experimental Machine Learning features

    main
    The detection-rules repository provides experimental machine learning features, including model bundles (models, scripts, and pipelines), rules, and jobs. These components are currently in development and may not have undergone the same testing or scrutiny as production detections. They may utilize non-GA features and are not covered by the standard support SLA.

  3. Overview of Detection as Code (DaC) Components

    main

    The detection-rules repository provides a reference implementation of Detection as Code (DaC) components. These components include CLI tools and workflows designed to help apply software development best practices (such as version control, schema validation, and automated testing) to the management of security rules.

    These tools act as wrappers around underlying Kibana APIs and are intended to facilitate experimentation and community contributions to custom DaC implementations. Users are responsible for testing these tools in their specific environments before production use.

  4. Overview of the Detection Rules repository structure

    main

    The repository contains the following key directories:

    folderdescription
    detection_rules/Python module for rule parsing, validating and packaging
    etc/Miscellaneous files, such as ECS and Beats schemas and configuration files
    hunting/Root directory where threat hunting package and queries are stored
    kibana/Python library for handling the API calls to Kibana and the Detection Engine
    kql/Python library for parsing and validating Kibana Query Language
    rules/Root directory where rules are stored
    rules_building_block/Root directory where building block rules are stored
    tests/Python code for unit testing rules

  5. Browse available hunting queries by category

    main

    The hunting queries are organized into several categories based on the target environment or technology. You can find specific ES|QL queries for the following categories:

    • aws: AWS IAM, EC2, Lambda, S3, SNS, SSM, STS, and Secrets Manager.
    • azure: Microsoft Entra ID (formerly Azure AD) authentication and service principal activity.
    • cross-platform: General authentication domain spoofing detection.
    • linux: Persistence, defense evasion, privilege escalation, and network activity on Linux systems.
    • llm: Anomalies and attacks targeting AWS Bedrock LLM services.
    • macos: Python-based threats, Docker-related execution, and suspicious Mach-O/Launch Agent activity.
    • network: Command and Control (C2) detection in network protocols (e.g., Cisco SD-WAN).

  6. Available Experimental Machine Learning features

    main

    The following experimental machine learning features are available in this repository:

    • DGA: Domain Generation Algorithm detection.
    • ProblemChild: Detection logic for specific problematic child processes.
    • HostRiskScore: Scoring mechanism for host risk.
    • URLSpoof: Detection of URL spoofing attempts.
    • UserRiskScore: Scoring mechanism for user risk.
    • experimental detections: A collection of other experimental detection rules.

  7. Hunt for Linux persistence via Cron

    main

    This hunt identifies potential persistence mechanisms on Linux systems by monitoring for file creation or modification events in cron configuration directories and processes spawned by scheduling services like cron, fcron, or atd.

    Metadata:

    • UUID: e1cffb7c-4acf-4e7a-8d72-b8b7657cf7b8
    • Integration: endpoint
    • Supported Languages: ES|QL, SQL (OSQuery)
    • MITRE ATT&CK Techniques: T1053.003, T1053.005

  8. Understand the detection rules directory structure

    main

    Detection rules are stored in the rules/ directory and are organized by solution, platform, or integration. The hierarchy is intentionally flattened to improve navigability. Rules are stored as .toml files. When applicable, the primary MITRE ATT&CK tactic is included in the filename (e.g., windows/execution_via_compiled_html_file.toml).

    Platform and Data Source Folders

    FolderDescription
    .Root directory where rules are stored
    apm/Rules using Application Performance Monitoring (APM) data sources
    cross-platform/Rules applying to multiple platforms (e.g., Windows and Linux)
    linux/Rules for Linux or Unix-based operating systems
    macos/Rules for macOS
    ml/Rules using machine learning (ML) jobs
    network/Rules using network data sources
    promotions/Rules promoting external alerts into detection engine alerts
    windows/Rules for Microsoft Windows
    integrations/Rules organized by Fleet integration

  9. Understand the versioning strategy for detection-rules code and libraries

    main

    The detection-rules repository uses Semantic Versioning (MAJOR.MINOR.PATCH) for its core code and libraries. Note that this versioning excludes the detection rules themselves, which are released separately.

    Components covered by this versioning:

    • Core Detection-Rules Code: Logic for rule management, CLI, etc.
    • kql Library: Kibana Query Language parsing and operations.
    • kibana Library: Integrations and API interactions with Kibana.
    • Configuration Files: Files under etc/ impacting schema and Detections as Code (DaC).
    • Hunting Logic: The hunting/ folder managing hunting rules.

  10. Detect Python Script Drop and Execute on macOS

    main

    Use this detection rule to identify when a Python script is written to a user's home directory and immediately executed by the same process lineage. This pattern is typical of initial access payloads or malware staging.

    Detection Logic:

    • Monitors for file modification events where the process name matches python* and the file extension is .py within /Users/*.
    • Correlates this with a subsequent process start event (exec) where the process arguments point to a file in /Users/* within a 15-second window.

    Investigation Tips:

    • Pivot on process.entity_id and file.path to analyze the subsequent behavior of the executed script.
    sequence with maxspan=15s
  [file where event.action == "modification" and process.name like~ "python*" and
   file.extension == "py" and file.path like "/Users/*"] by process.entity_id
  [process where event.type == "start" and event.action == "exec" and
   process.args_count == 2 and process.args like "/Users/*"] by process.parent.entity_id

  11. Generate ATT&CK navigator layer files

    main
    ATT&CK navigator layer files are automatically generated during the build process. You can generate these files by running either the make release command or by using the Python module command python -m detection-rules. These files can then be used to populate custom sessions in the ATT&CK Navigator.

  12. Set up Sysmon Registry Event collection

    main

    To enable detection rules that monitor for malicious registry activity (such as persistence via Registry Run keys or tampering with system configurations), you must collect Sysmon Event IDs 12, 13, and 14.

    Warning: Collecting all Sysmon registry events without specific filtering will result in extremely high data volume. These instructions provide a minimal baseline that requires significant tuning for production environments.

    To collect these logs:

    1. Use the Windows Integration.
    2. Select the Sysmon Operational channel during the integration setup.