diff --git a/rules/integrations/pad/privileged_access_ml_linux_high_count_privileged_process_events_by_user.toml b/rules/integrations/pad/privileged_access_ml_linux_high_count_privileged_process_events_by_user.toml new file mode 100644 index 00000000000..552abb705b2 --- /dev/null +++ b/rules/integrations/pad/privileged_access_ml_linux_high_count_privileged_process_events_by_user.toml @@ -0,0 +1,62 @@ +[metadata] +creation_date = "2025/02/18" +integration = ["pad", "endpoint", "sysmon_linux"] +maturity = "production" + +[rule] +anomaly_threshold = 75 +author = ["Elastic"] +description = """ +A machine learning job has detected an increase in the execution of privileged commands by a user, suggesting potential privileged access activity. +This may indicate an attempt by the user to gain unauthorized access to sensitive or restricted parts of the system. +""" +from = "now-3h" +interval = "15m" +license = "Elastic License v2" +machine_learning_job_id = "pad_linux_high_count_privileged_process_events_by_user" +name = "Spike in Privileged Command Execution by a User" +references = [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html", + "https://docs.elastic.co/en/integrations/pad" +] +risk_score = 21 +rule_id = "bd1eadf6-3ac6-4e66-91aa-4a1e6711915f" +setup = """## Setup + +The rule requires the Privileged Access Detection integration assets to be installed, as well as Linux logs collected by integrations such as Elastic Defend and Sysmon Linux. + +### Privileged Access Detection Setup +The Privileged Access Detection integration detects privileged access activity by identifying abnormalities in Windows, Linux and Okta events. Anomalies are detected using Elastic's Anomaly Detection feature. + +#### Prerequisite Requirements: +- Fleet is required for Privileged Access Detection. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). +- Linux events collected by [Elastic Defend](https://docs.elastic.co/en/integrations/endpoint) or [Sysmon Linux](https://docs.elastic.co/en/integrations/sysmon_linux) integration. +- To install Elastic Defend, refer to the [documentation](https://www.elastic.co/guide/en/security/current/install-endpoint.html). +- To add Sysmon Linux integration to an Elastic Agent policy, refer to [this](https://www.elastic.co/guide/en/fleet/current/add-integration-to-policy.html) guide. + +#### The following steps should be executed to install assets associated with the Privileged Access Detection integration: +- Go to the Kibana homepage. Under Management, click Integrations. +- In the query bar, search for Privileged Access Detection and select the integration to see more details about it. +- Follow the instructions under the **Installation** section. +- For this rule to work, complete the instructions through **Add preconfigured anomaly detection jobs**. +""" +severity = "low" +tags = [ + "Use Case: Privileged Access Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Privilege Escalation" +] +type = "machine_learning" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1078" +name = "Valid Accounts" +reference = "https://attack.mitre.org/techniques/T1078/" + +[rule.threat.tactic] +id = "TA0004" +name = "Privilege Escalation" +reference = "https://attack.mitre.org/tactics/TA0004/" \ No newline at end of file diff --git a/rules/integrations/pad/privileged_access_ml_linux_high_median_process_command_line_entropy_by_user.toml b/rules/integrations/pad/privileged_access_ml_linux_high_median_process_command_line_entropy_by_user.toml new file mode 100644 index 00000000000..b8c1bcb445e --- /dev/null +++ b/rules/integrations/pad/privileged_access_ml_linux_high_median_process_command_line_entropy_by_user.toml @@ -0,0 +1,62 @@ +[metadata] +creation_date = "2025/02/18" +integration = ["pad", "endpoint", "sysmon_linux"] +maturity = "production" + +[rule] +anomaly_threshold = 75 +author = ["Elastic"] +description = """ +A machine learning job has identified an unusually high median command line entropy for privileged commands executed by a user, suggesting possible privileged access activity through command lines. +High entropy often indicates that the commands may be obfuscated or deliberately complex, which can be a sign of suspicious or unauthorized use of privileged access. +""" +from = "now-3h" +interval = "15m" +license = "Elastic License v2" +machine_learning_job_id = "pad_linux_high_median_process_command_line_entropy_by_user" +name = "High Command Line Entropy Detected for Privileged Commands" +references = [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html", + "https://docs.elastic.co/en/integrations/pad" +] +risk_score = 21 +rule_id = "0cbbb5e0-f93a-47fe-ab72-8213366c38f1" +setup = """## Setup + +The rule requires the Privileged Access Detection integration assets to be installed, as well as Linux logs collected by integrations such as Elastic Defend and Sysmon Linux. + +### Privileged Access Detection Setup +The Privileged Access Detection integration detects privileged access activity by identifying abnormalities in Windows, Linux and Okta events. Anomalies are detected using Elastic's Anomaly Detection feature. + +#### Prerequisite Requirements: +- Fleet is required for Privileged Access Detection. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). +- Linux events collected by [Elastic Defend](https://docs.elastic.co/en/integrations/endpoint) or [Sysmon Linux](https://docs.elastic.co/en/integrations/sysmon_linux) integration. +- To install Elastic Defend, refer to the [documentation](https://www.elastic.co/guide/en/security/current/install-endpoint.html). +- To add Sysmon Linux integration to an Elastic Agent policy, refer to [this](https://www.elastic.co/guide/en/fleet/current/add-integration-to-policy.html) guide. + +#### The following steps should be executed to install assets associated with the Privileged Access Detection integration: +- Go to the Kibana homepage. Under Management, click Integrations. +- In the query bar, search for Privileged Access Detection and select the integration to see more details about it. +- Follow the instructions under the **Installation** section. +- For this rule to work, complete the instructions through **Add preconfigured anomaly detection jobs**. +""" +severity = "low" +tags = [ + "Use Case: Privileged Access Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Privilege Escalation" +] +type = "machine_learning" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1078" +name = "Valid Accounts" +reference = "https://attack.mitre.org/techniques/T1078/" + +[rule.threat.tactic] +id = "TA0004" +name = "Privilege Escalation" +reference = "https://attack.mitre.org/tactics/TA0004/" \ No newline at end of file diff --git a/rules/integrations/pad/privileged_access_ml_linux_rare_process_executed_by_user.toml b/rules/integrations/pad/privileged_access_ml_linux_rare_process_executed_by_user.toml new file mode 100644 index 00000000000..40103622370 --- /dev/null +++ b/rules/integrations/pad/privileged_access_ml_linux_rare_process_executed_by_user.toml @@ -0,0 +1,61 @@ +[metadata] +creation_date = "2025/02/18" +integration = ["pad", "endpoint", "sysmon_linux"] +maturity = "production" + +[rule] +anomaly_threshold = 75 +author = ["Elastic"] +description = """ +A machine learning job has detected an unusual process run for privileged commands by a user, indicating potential privileged access activity. +""" +from = "now-1h" +interval = "15m" +license = "Elastic License v2" +machine_learning_job_id = "pad_linux_rare_process_executed_by_user" +name = "Unusual Process Detected for Privileged Commands by a User" +references = [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html", + "https://docs.elastic.co/en/integrations/pad" +] +risk_score = 21 +rule_id = "5eac16ab-6d4f-427b-9715-f33e1b745fc7" +setup = """## Setup + +The rule requires the Privileged Access Detection integration assets to be installed, as well as Linux logs collected by integrations such as Elastic Defend and Sysmon Linux. + +### Privileged Access Detection Setup +The Privileged Access Detection integration detects privileged access activity by identifying abnormalities in Windows, Linux and Okta events. Anomalies are detected using Elastic's Anomaly Detection feature. + +#### Prerequisite Requirements: +- Fleet is required for Privileged Access Detection. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). +- Linux events collected by [Elastic Defend](https://docs.elastic.co/en/integrations/endpoint) or [Sysmon Linux](https://docs.elastic.co/en/integrations/sysmon_linux) integration. +- To install Elastic Defend, refer to the [documentation](https://www.elastic.co/guide/en/security/current/install-endpoint.html). +- To add Sysmon Linux integration to an Elastic Agent policy, refer to [this](https://www.elastic.co/guide/en/fleet/current/add-integration-to-policy.html) guide. + +#### The following steps should be executed to install assets associated with the Privileged Access Detection integration: +- Go to the Kibana homepage. Under Management, click Integrations. +- In the query bar, search for Privileged Access Detection and select the integration to see more details about it. +- Follow the instructions under the **Installation** section. +- For this rule to work, complete the instructions through **Add preconfigured anomaly detection jobs**. +""" +severity = "low" +tags = [ + "Use Case: Privileged Access Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Privilege Escalation" +] +type = "machine_learning" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1078" +name = "Valid Accounts" +reference = "https://attack.mitre.org/techniques/T1078/" + +[rule.threat.tactic] +id = "TA0004" +name = "Privilege Escalation" +reference = "https://attack.mitre.org/tactics/TA0004/" \ No newline at end of file diff --git a/rules/integrations/pad/privileged_access_ml_okta_high_sum_concurrent_sessions_by_user.toml b/rules/integrations/pad/privileged_access_ml_okta_high_sum_concurrent_sessions_by_user.toml new file mode 100644 index 00000000000..8c5c356bc94 --- /dev/null +++ b/rules/integrations/pad/privileged_access_ml_okta_high_sum_concurrent_sessions_by_user.toml @@ -0,0 +1,67 @@ +[metadata] +creation_date = "2025/02/18" +integration = ["pad","okta"] +maturity = "production" + +[rule] +anomaly_threshold = 75 +author = ["Elastic"] +description = """ +A machine learning job has detected an unusually high number of active concurrent sessions initiated by a user, indicating potential privileged access activity. +A sudden surge in concurrent active sessions by a user may indicate an attempt to abuse valid credentials for privilege escalation or maintain persistence. +Adversaries might be leveraging multiple sessions to execute privileged operations, evade detection, or perform unauthorized actions across different systems. +""" +from = "now-3h" +interval = "15m" +license = "Elastic License v2" +machine_learning_job_id = "pad_okta_high_sum_concurrent_sessions_by_user" +name = "Unusual Spike in Concurrent Active Sessions by a User" +references = [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html", + "https://docs.elastic.co/en/integrations/pad" +] +risk_score = 21 +rule_id = "a300dea6-e228-40e1-9123-a339e207378b" +setup = """## Setup + +The rule requires the Privileged Access Detection integration assets to be installed, as well as Okta logs collected by integrations such as Okta. + +### Privileged Access Detection Setup +The Privileged Access Detection integration detects privileged access activity by identifying abnormalities in Windows, Linux and Okta events. Anomalies are detected using Elastic's Anomaly Detection feature. + +#### Prerequisite Requirements: +- Fleet is required for Privileged Access Detection. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). +- Okta events collected by [Okta](https://docs.elastic.co/en/integrations/okta) integration. +- To add the Okta integration to an Elastic Agent policy, refer to [this](https://www.elastic.co/guide/en/fleet/current/add-integration-to-policy.html) guide. + +#### The following steps should be executed to install assets associated with the Privileged Access Detection integration: +- Go to the Kibana homepage. Under Management, click Integrations. +- In the query bar, search for Privileged Access Detection and select the integration to see more details about it. +- Follow the instructions under the **Installation** section. +- For this rule to work, complete the instructions through **Add preconfigured anomaly detection jobs**. +""" +severity = "low" +tags = [ + "Use Case: Privileged Access Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Privilege Escalation" +] +type = "machine_learning" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1068" +name = "Exploitation for Privilege Escalation" +reference = "https://attack.mitre.org/techniques/T1068/" + +[[rule.threat.technique]] +id = "T1078" +name = "Valid Accounts" +reference = "https://attack.mitre.org/techniques/T1078/" + +[rule.threat.tactic] +id = "TA0004" +name = "Privilege Escalation" +reference = "https://attack.mitre.org/tactics/TA0004/" \ No newline at end of file diff --git a/rules/integrations/pad/privileged_access_ml_okta_rare_host_name_by_user.toml b/rules/integrations/pad/privileged_access_ml_okta_rare_host_name_by_user.toml new file mode 100644 index 00000000000..8bd10440e7f --- /dev/null +++ b/rules/integrations/pad/privileged_access_ml_okta_rare_host_name_by_user.toml @@ -0,0 +1,61 @@ +[metadata] +creation_date = "2025/02/18" +integration = ["pad","okta"] +maturity = "production" + +[rule] +anomaly_threshold = 75 +author = ["Elastic"] +description = """ +A machine learning job has identified a user performing privileged operations in Okta from an uncommon device, indicating potential privileged access activity. +This could signal a compromised account, an attacker using stolen credentials, or an insider threat leveraging an unauthorized device to escalate privileges. +""" +from = "now-1h" +interval = "15m" +license = "Elastic License v2" +machine_learning_job_id = "pad_okta_rare_host_name_by_user" +name = "Unusual Host Name for Okta Privileged Operations Detected" +references = [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html", + "https://docs.elastic.co/en/integrations/pad" +] +risk_score = 21 +rule_id = "8c9ae3e2-f0b1-4b2c-9eba-bd87c2db914f" +setup = """## Setup + +The rule requires the Privileged Access Detection integration assets to be installed, as well as Okta logs collected by integrations such as Okta. + +### Privileged Access Detection Setup +The Privileged Access Detection integration detects privileged access activity by identifying abnormalities in Windows, Linux and Okta events. Anomalies are detected using Elastic's Anomaly Detection feature. + +#### Prerequisite Requirements: +- Fleet is required for Privileged Access Detection. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). +- Okta events collected by [Okta](https://docs.elastic.co/en/integrations/okta) integration. +- To add the Okta integration to an Elastic Agent policy, refer to [this](https://www.elastic.co/guide/en/fleet/current/add-integration-to-policy.html) guide. + +#### The following steps should be executed to install assets associated with the Privileged Access Detection integration: +- Go to the Kibana homepage. Under Management, click Integrations. +- In the query bar, search for Privileged Access Detection and select the integration to see more details about it. +- Follow the instructions under the **Installation** section. +- For this rule to work, complete the instructions through **Add preconfigured anomaly detection jobs**. +""" +severity = "low" +tags = [ + "Use Case: Privileged Access Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Privilege Escalation" +] +type = "machine_learning" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1078" +name = "Valid Accounts" +reference = "https://attack.mitre.org/techniques/T1078/" + +[rule.threat.tactic] +id = "TA0004" +name = "Privilege Escalation" +reference = "https://attack.mitre.org/tactics/TA0004/" \ No newline at end of file diff --git a/rules/integrations/pad/privileged_access_ml_okta_rare_region_name_by_user.toml b/rules/integrations/pad/privileged_access_ml_okta_rare_region_name_by_user.toml new file mode 100644 index 00000000000..2ccad4ed284 --- /dev/null +++ b/rules/integrations/pad/privileged_access_ml_okta_rare_region_name_by_user.toml @@ -0,0 +1,61 @@ +[metadata] +creation_date = "2025/02/18" +integration = ["pad","okta"] +maturity = "production" + +[rule] +anomaly_threshold = 75 +author = ["Elastic"] +description = """ +A machine learning job has identified a user performing privileged operations in Okta from an uncommon geographical location, indicating potential privileged access activity. +This could suggest a compromised account, unauthorized access, or an attacker using stolen credentials to escalate privileges. +""" +from = "now-1h" +interval = "15m" +license = "Elastic License v2" +machine_learning_job_id = "pad_okta_rare_region_name_by_user" +name = "Unusual Region Name for Okta Privileged Operations Detected" +references = [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html", + "https://docs.elastic.co/en/integrations/pad" +] +risk_score = 21 +rule_id = "a8f7187f-76d6-4c1d-a1d5-1ff301ccc120" +setup = """## Setup + +The rule requires the Privileged Access Detection integration assets to be installed, as well as Okta logs collected by integrations such as Okta. + +### Privileged Access Detection Setup +The Privileged Access Detection integration detects privileged access activity by identifying abnormalities in Windows, Linux and Okta events. Anomalies are detected using Elastic's Anomaly Detection feature. + +#### Prerequisite Requirements: +- Fleet is required for Privileged Access Detection. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). +- Okta events collected by [Okta](https://docs.elastic.co/en/integrations/okta) integration. +- To add the Okta integration to an Elastic Agent policy, refer to [this](https://www.elastic.co/guide/en/fleet/current/add-integration-to-policy.html) guide. + +#### The following steps should be executed to install assets associated with the Privileged Access Detection integration: +- Go to the Kibana homepage. Under Management, click Integrations. +- In the query bar, search for Privileged Access Detection and select the integration to see more details about it. +- Follow the instructions under the **Installation** section. +- For this rule to work, complete the instructions through **Add preconfigured anomaly detection jobs**. +""" +severity = "low" +tags = [ + "Use Case: Privileged Access Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Privilege Escalation" +] +type = "machine_learning" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1078" +name = "Valid Accounts" +reference = "https://attack.mitre.org/techniques/T1078/" + +[rule.threat.tactic] +id = "TA0004" +name = "Privilege Escalation" +reference = "https://attack.mitre.org/tactics/TA0004/" \ No newline at end of file diff --git a/rules/integrations/pad/privileged_access_ml_okta_rare_source_ip_by_user.toml b/rules/integrations/pad/privileged_access_ml_okta_rare_source_ip_by_user.toml new file mode 100644 index 00000000000..e44eeddfdc6 --- /dev/null +++ b/rules/integrations/pad/privileged_access_ml_okta_rare_source_ip_by_user.toml @@ -0,0 +1,61 @@ +[metadata] +creation_date = "2025/02/18" +integration = ["pad","okta"] +maturity = "production" + +[rule] +anomaly_threshold = 75 +author = ["Elastic"] +description = """ +A machine learning job has identified a user performing privileged operations in Okta from an uncommon source IP, indicating potential privileged access activity. +This could suggest an account compromise, misuse of administrative privileges, or an attacker leveraging a new network location to escalate privileges. +""" +from = "now-1h" +interval = "15m" +license = "Elastic License v2" +machine_learning_job_id = "pad_okta_rare_source_ip_by_user" +name = "Unusual Source IP for Okta Privileged Operations Detected" +references = [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html", + "https://docs.elastic.co/en/integrations/pad" +] +risk_score = 21 +rule_id = "fbb10f1e-77cb-42f9-994e-5da17fc3fc15" +setup = """## Setup + +The rule requires the Privileged Access Detection integration assets to be installed, as well as Okta logs collected by integrations such as Okta. + +### Privileged Access Detection Setup +The Privileged Access Detection integration detects privileged access activity by identifying abnormalities in Windows, Linux and Okta events. Anomalies are detected using Elastic's Anomaly Detection feature. + +#### Prerequisite Requirements: +- Fleet is required for Privileged Access Detection. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). +- Okta events collected by [Okta](https://docs.elastic.co/en/integrations/okta) integration. +- To add the Okta integration to an Elastic Agent policy, refer to [this](https://www.elastic.co/guide/en/fleet/current/add-integration-to-policy.html) guide. + +#### The following steps should be executed to install assets associated with the Privileged Access Detection integration: +- Go to the Kibana homepage. Under Management, click Integrations. +- In the query bar, search for Privileged Access Detection and select the integration to see more details about it. +- Follow the instructions under the **Installation** section. +- For this rule to work, complete the instructions through **Add preconfigured anomaly detection jobs**. +""" +severity = "low" +tags = [ + "Use Case: Privileged Access Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Privilege Escalation" +] +type = "machine_learning" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1078" +name = "Valid Accounts" +reference = "https://attack.mitre.org/techniques/T1078/" + +[rule.threat.tactic] +id = "TA0004" +name = "Privilege Escalation" +reference = "https://attack.mitre.org/tactics/TA0004/" \ No newline at end of file diff --git a/rules/integrations/pad/privileged_access_ml_okta_spike_in_group_application_assignment_changes.toml b/rules/integrations/pad/privileged_access_ml_okta_spike_in_group_application_assignment_changes.toml new file mode 100644 index 00000000000..e5bc2a1121b --- /dev/null +++ b/rules/integrations/pad/privileged_access_ml_okta_spike_in_group_application_assignment_changes.toml @@ -0,0 +1,71 @@ +[metadata] +creation_date = "2025/02/18" +integration = ["pad","okta"] +maturity = "production" + +[rule] +anomaly_threshold = 75 +author = ["Elastic"] +description = """ +A machine learning job has identified an unusual spike in Okta group application assignment change events, indicating potential privileged access activity. +Threat actors might be assigning applications to groups to escalate access, maintain persistence, or facilitate lateral movement within an organization’s environment. +""" +from = "now-3h" +interval = "15m" +license = "Elastic License v2" +machine_learning_job_id = "pad_okta_spike_in_group_application_assignment_changes" +name = "Spike in Group Application Assignment Change Events" +references = [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html", + "https://docs.elastic.co/en/integrations/pad" +] +risk_score = 21 +rule_id = "3278313c-d6cd-4d49-aa24-644e1da6623c" +setup = """## Setup + +The rule requires the Privileged Access Detection integration assets to be installed, as well as Okta logs collected by integrations such as Okta. + +### Privileged Access Detection Setup +The Privileged Access Detection integration detects privileged access activity by identifying abnormalities in Windows, Linux and Okta events. Anomalies are detected using Elastic's Anomaly Detection feature. + +#### Prerequisite Requirements: +- Fleet is required for Privileged Access Detection. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). +- Okta events collected by [Okta](https://docs.elastic.co/en/integrations/okta) integration. +- To add the Okta integration to an Elastic Agent policy, refer to [this](https://www.elastic.co/guide/en/fleet/current/add-integration-to-policy.html) guide. + +#### The following steps should be executed to install assets associated with the Privileged Access Detection integration: +- Go to the Kibana homepage. Under Management, click Integrations. +- In the query bar, search for Privileged Access Detection and select the integration to see more details about it. +- Follow the instructions under the **Installation** section. +- For this rule to work, complete the instructions through **Add preconfigured anomaly detection jobs**. +""" +severity = "low" +tags = [ + "Use Case: Privileged Access Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Privilege Escalation" +] +type = "machine_learning" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1098" +name = "Account Manipulation" +reference = "https://attack.mitre.org/techniques/T1098/" + +[[rule.threat.technique]] +id = "T1068" +name = "Exploitation for Privilege Escalation" +reference = "https://attack.mitre.org/techniques/T1068/" + +[[rule.threat.technique]] +id = "T1078" +name = "Valid Accounts" +reference = "https://attack.mitre.org/techniques/T1078/" + +[rule.threat.tactic] +id = "TA0004" +name = "Privilege Escalation" +reference = "https://attack.mitre.org/tactics/TA0004/" \ No newline at end of file diff --git a/rules/integrations/pad/privileged_access_ml_okta_spike_in_group_lifecycle_changes.toml b/rules/integrations/pad/privileged_access_ml_okta_spike_in_group_lifecycle_changes.toml new file mode 100644 index 00000000000..97668573cf3 --- /dev/null +++ b/rules/integrations/pad/privileged_access_ml_okta_spike_in_group_lifecycle_changes.toml @@ -0,0 +1,66 @@ +[metadata] +creation_date = "2025/02/18" +integration = ["pad","okta"] +maturity = "production" + +[rule] +anomaly_threshold = 75 +author = ["Elastic"] +description = """ +A machine learning job has identified an unusual spike in Okta group lifecycle change events, indicating potential privileged access activity. +Adversaries may be altering group structures to escalate privileges, maintain persistence, or facilitate lateral movement within an organization’s identity management system. +""" +from = "now-3h" +interval = "15m" +license = "Elastic License v2" +machine_learning_job_id = "pad_okta_spike_in_group_lifecycle_changes" +name = "Spike in Group Lifecycle Change Events" +references = [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html", + "https://docs.elastic.co/en/integrations/pad" +] +risk_score = 21 +rule_id = "aa28f01d-bc93-4c8f-bc01-6f67f2a0a833" +setup = """## Setup + +The rule requires the Privileged Access Detection integration assets to be installed, as well as Okta logs collected by integrations such as Okta. + +### Privileged Access Detection Setup +The Privileged Access Detection integration detects privileged access activity by identifying abnormalities in Windows, Linux and Okta events. Anomalies are detected using Elastic's Anomaly Detection feature. + +#### Prerequisite Requirements: +- Fleet is required for Privileged Access Detection. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). +- Okta events collected by [Okta](https://docs.elastic.co/en/integrations/okta) integration. +- To add the Okta integration to an Elastic Agent policy, refer to [this](https://www.elastic.co/guide/en/fleet/current/add-integration-to-policy.html) guide. + +#### The following steps should be executed to install assets associated with the Privileged Access Detection integration: +- Go to the Kibana homepage. Under Management, click Integrations. +- In the query bar, search for Privileged Access Detection and select the integration to see more details about it. +- Follow the instructions under the **Installation** section. +- For this rule to work, complete the instructions through **Add preconfigured anomaly detection jobs**. +""" +severity = "low" +tags = [ + "Use Case: Privileged Access Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Privilege Escalation" +] +type = "machine_learning" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1068" +name = "Exploitation for Privilege Escalation" +reference = "https://attack.mitre.org/techniques/T1068/" + +[[rule.threat.technique]] +id = "T1078" +name = "Valid Accounts" +reference = "https://attack.mitre.org/techniques/T1078/" + +[rule.threat.tactic] +id = "TA0004" +name = "Privilege Escalation" +reference = "https://attack.mitre.org/tactics/TA0004/" \ No newline at end of file diff --git a/rules/integrations/pad/privileged_access_ml_okta_spike_in_group_membership_changes.toml b/rules/integrations/pad/privileged_access_ml_okta_spike_in_group_membership_changes.toml new file mode 100644 index 00000000000..415a7333a26 --- /dev/null +++ b/rules/integrations/pad/privileged_access_ml_okta_spike_in_group_membership_changes.toml @@ -0,0 +1,66 @@ +[metadata] +creation_date = "2025/02/18" +integration = ["pad","okta"] +maturity = "production" + +[rule] +anomaly_threshold = 75 +author = ["Elastic"] +description = """ +A machine learning job has identified an unusual spike in Okta group membership events, indicating potential privileged access activity. +Attackers or malicious insiders might be adding accounts to privileged groups to escalate their access, potentially leading to unauthorized actions or data breaches. +""" +from = "now-3h" +interval = "15m" +license = "Elastic License v2" +machine_learning_job_id = "pad_okta_spike_in_group_membership_changes" +name = "Spike in Group Membership Events" +references = [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html", + "https://docs.elastic.co/en/integrations/pad" +] +risk_score = 21 +rule_id = "138520d2-11ff-4288-a80e-a45b36dca4b1" +setup = """## Setup + +The rule requires the Privileged Access Detection integration assets to be installed, as well as Okta logs collected by integrations such as Okta. + +### Privileged Access Detection Setup +The Privileged Access Detection integration detects privileged access activity by identifying abnormalities in Windows, Linux and Okta events. Anomalies are detected using Elastic's Anomaly Detection feature. + +#### Prerequisite Requirements: +- Fleet is required for Privileged Access Detection. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). +- Okta events collected by [Okta](https://docs.elastic.co/en/integrations/okta) integration. +- To add the Okta integration to an Elastic Agent policy, refer to [this](https://www.elastic.co/guide/en/fleet/current/add-integration-to-policy.html) guide. + +#### The following steps should be executed to install assets associated with the Privileged Access Detection integration: +- Go to the Kibana homepage. Under Management, click Integrations. +- In the query bar, search for Privileged Access Detection and select the integration to see more details about it. +- Follow the instructions under the **Installation** section. +- For this rule to work, complete the instructions through **Add preconfigured anomaly detection jobs**. +""" +severity = "low" +tags = [ + "Use Case: Privileged Access Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Privilege Escalation" +] +type = "machine_learning" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1068" +name = "Exploitation for Privilege Escalation" +reference = "https://attack.mitre.org/techniques/T1068/" + +[[rule.threat.technique]] +id = "T1078" +name = "Valid Accounts" +reference = "https://attack.mitre.org/techniques/T1078/" + +[rule.threat.tactic] +id = "TA0004" +name = "Privilege Escalation" +reference = "https://attack.mitre.org/tactics/TA0004/" \ No newline at end of file diff --git a/rules/integrations/pad/privileged_access_ml_okta_spike_in_group_privilege_changes.toml b/rules/integrations/pad/privileged_access_ml_okta_spike_in_group_privilege_changes.toml new file mode 100644 index 00000000000..7af2d7686a7 --- /dev/null +++ b/rules/integrations/pad/privileged_access_ml_okta_spike_in_group_privilege_changes.toml @@ -0,0 +1,71 @@ +[metadata] +creation_date = "2025/02/18" +integration = ["pad","okta"] +maturity = "production" + +[rule] +anomaly_threshold = 75 +author = ["Elastic"] +description = """ +A machine learning job has identified an unusual spike in Okta group privilege change events, indicating potential privileged access activity. +Attackers might be elevating privileges by adding themselves or compromised accounts to high-privilege groups, enabling further access or persistence. +""" +from = "now-3h" +interval = "15m" +license = "Elastic License v2" +machine_learning_job_id = "pad_okta_spike_in_group_privilege_changes" +name = "Spike in Group Privilege Change Events" +references = [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html", + "https://docs.elastic.co/en/integrations/pad" +] +risk_score = 21 +rule_id = "02b4420d-eda2-4529-9e46-4a60eccb7e2d" +setup = """## Setup + +The rule requires the Privileged Access Detection integration assets to be installed, as well as Okta logs collected by integrations such as Okta. + +### Privileged Access Detection Setup +The Privileged Access Detection integration detects privileged access activity by identifying abnormalities in Windows, Linux and Okta events. Anomalies are detected using Elastic's Anomaly Detection feature. + +#### Prerequisite Requirements: +- Fleet is required for Privileged Access Detection. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). +- Okta events collected by [Okta](https://docs.elastic.co/en/integrations/okta) integration. +- To add the Okta integration to an Elastic Agent policy, refer to [this](https://www.elastic.co/guide/en/fleet/current/add-integration-to-policy.html) guide. + +#### The following steps should be executed to install assets associated with the Privileged Access Detection integration: +- Go to the Kibana homepage. Under Management, click Integrations. +- In the query bar, search for Privileged Access Detection and select the integration to see more details about it. +- Follow the instructions under the **Installation** section. +- For this rule to work, complete the instructions through **Add preconfigured anomaly detection jobs**. +""" +severity = "low" +tags = [ + "Use Case: Privileged Access Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Privilege Escalation" +] +type = "machine_learning" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1098" +name = "Account Manipulation" +reference = "https://attack.mitre.org/techniques/T1098/" + +[[rule.threat.technique]] +id = "T1068" +name = "Exploitation for Privilege Escalation" +reference = "https://attack.mitre.org/techniques/T1068/" + +[[rule.threat.technique]] +id = "T1078" +name = "Valid Accounts" +reference = "https://attack.mitre.org/techniques/T1078/" + +[rule.threat.tactic] +id = "TA0004" +name = "Privilege Escalation" +reference = "https://attack.mitre.org/tactics/TA0004/" \ No newline at end of file diff --git a/rules/integrations/pad/privileged_access_ml_okta_spike_in_user_lifecycle_management_changes.toml b/rules/integrations/pad/privileged_access_ml_okta_spike_in_user_lifecycle_management_changes.toml new file mode 100644 index 00000000000..a96c189dfab --- /dev/null +++ b/rules/integrations/pad/privileged_access_ml_okta_spike_in_user_lifecycle_management_changes.toml @@ -0,0 +1,66 @@ +[metadata] +creation_date = "2025/02/18" +integration = ["pad","okta"] +maturity = "production" + +[rule] +anomaly_threshold = 75 +author = ["Elastic"] +description = """ +A machine learning job has identified an unusual spike in Okta user lifecycle management change events, indicating potential privileged access activity. +Threat actors may manipulate user accounts to gain higher access rights or persist within the environment. +""" +from = "now-3h" +interval = "15m" +license = "Elastic License v2" +machine_learning_job_id = "pad_okta_spike_in_user_lifecycle_management_changes" +name = "Spike in User Lifecycle Management Change Events" +references = [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html", + "https://docs.elastic.co/en/integrations/pad" +] +risk_score = 21 +rule_id = "178770e0-5c20-4246-b430-e216a2888b23" +setup = """## Setup + +The rule requires the Privileged Access Detection integration assets to be installed, as well as Okta logs collected by integrations such as Okta. + +### Privileged Access Detection Setup +The Privileged Access Detection integration detects privileged access activity by identifying abnormalities in Windows, Linux and Okta events. Anomalies are detected using Elastic's Anomaly Detection feature. + +#### Prerequisite Requirements: +- Fleet is required for Privileged Access Detection. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). +- Okta events collected by [Okta](https://docs.elastic.co/en/integrations/okta) integration. +- To add the Okta integration to an Elastic Agent policy, refer to [this](https://www.elastic.co/guide/en/fleet/current/add-integration-to-policy.html) guide. + +#### The following steps should be executed to install assets associated with the Privileged Access Detection integration: +- Go to the Kibana homepage. Under Management, click Integrations. +- In the query bar, search for Privileged Access Detection and select the integration to see more details about it. +- Follow the instructions under the **Installation** section. +- For this rule to work, complete the instructions through **Add preconfigured anomaly detection jobs**. +""" +severity = "low" +tags = [ + "Use Case: Privileged Access Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Privilege Escalation" +] +type = "machine_learning" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1098" +name = "Account Manipulation" +reference = "https://attack.mitre.org/techniques/T1098/" + +[[rule.threat.technique]] +id = "T1078" +name = "Valid Accounts" +reference = "https://attack.mitre.org/techniques/T1078/" + +[rule.threat.tactic] +id = "TA0004" +name = "Privilege Escalation" +reference = "https://attack.mitre.org/tactics/TA0004/" \ No newline at end of file diff --git a/rules/integrations/pad/privileged_access_ml_windows_high_count_group_management_events.toml b/rules/integrations/pad/privileged_access_ml_windows_high_count_group_management_events.toml new file mode 100644 index 00000000000..2d7763fdd21 --- /dev/null +++ b/rules/integrations/pad/privileged_access_ml_windows_high_count_group_management_events.toml @@ -0,0 +1,68 @@ +[metadata] +creation_date = "2025/02/18" +integration = ["pad", "endpoint", "windows"] +maturity = "production" + +[rule] +anomaly_threshold = 75 +author = ["Elastic"] +description = """ +A machine learning job has identified a spike in group management events for a user, indicating potential privileged access activity. +The machine learning has flagged an abnormal rise in group management actions (such as adding or removing users from privileged groups), +which could point to an attempt to escalate privileges or unauthorized modifications to group memberships. +""" +from = "now-3h" +interval = "15m" +license = "Elastic License v2" +machine_learning_job_id = "pad_windows_high_count_group_management_events" +name = "Spike in Group Management Events" +references = [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html", + "https://docs.elastic.co/en/integrations/pad" +] +risk_score = 21 +rule_id = "751b0329-7295-4682-b9c7-4473b99add69" +setup = """## Setup + +The rule requires the Privileged Access Detection integration assets to be installed, as well as Windows logs collected by integrations such as Elastic Defend and Windows. + +### Privileged Access Detection Setup +The Privileged Access Detection integration detects privileged access activity by identifying abnormalities in Windows, Linux and Okta events. Anomalies are detected using Elastic's Anomaly Detection feature. + +#### Prerequisite Requirements: +- Fleet is required for Privileged Access Detection. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). +- Windows events collected by the [Elastic Defend](https://docs.elastic.co/en/integrations/endpoint) and [Windows](https://docs.elastic.co/en/integrations/windows) integration. +- To install Elastic Defend, refer to the [documentation](https://www.elastic.co/guide/en/security/current/install-endpoint.html). +- To add the Windows integration to an Elastic Agent policy, refer to [this](https://www.elastic.co/guide/en/fleet/current/add-integration-to-policy.html) guide. + +#### The following steps should be executed to install assets associated with the Privileged Access Detection integration: +- Go to the Kibana homepage. Under Management, click Integrations. +- In the query bar, search for Privileged Access Detection and select the integration to see more details about it. +- Follow the instructions under the **Installation** section. +- For this rule to work, complete the instructions through **Add preconfigured anomaly detection jobs**. +""" +severity = "low" +tags = [ + "Use Case: Privileged Access Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Privilege Escalation" +] +type = "machine_learning" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1098" +name = "Account Manipulation" +reference = "https://attack.mitre.org/techniques/T1098/" + +[[rule.threat.technique]] +id = "T1078" +name = "Valid Accounts" +reference = "https://attack.mitre.org/techniques/T1078/" + +[rule.threat.tactic] +id = "TA0004" +name = "Privilege Escalation" +reference = "https://attack.mitre.org/tactics/TA0004/" \ No newline at end of file diff --git a/rules/integrations/pad/privileged_access_ml_windows_high_count_special_logon_events.toml b/rules/integrations/pad/privileged_access_ml_windows_high_count_special_logon_events.toml new file mode 100644 index 00000000000..b6ce4973b68 --- /dev/null +++ b/rules/integrations/pad/privileged_access_ml_windows_high_count_special_logon_events.toml @@ -0,0 +1,67 @@ +[metadata] +creation_date = "2025/02/18" +integration = ["pad", "endpoint", "windows"] +maturity = "production" + +[rule] +anomaly_threshold = 75 +author = ["Elastic"] +description = """ +A machine learning job has detected a surge in special logon events for a user, indicating potential privileged access activity. +A sudden spike in these events could suggest an attacker or malicious insider gaining elevated access, possibly for lateral movement or privilege escalation. +""" +from = "now-3h" +interval = "15m" +license = "Elastic License v2" +machine_learning_job_id = "pad_windows_high_count_special_logon_events" +name = "Spike in Special Logon Events" +references = [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html", + "https://docs.elastic.co/en/integrations/pad" +] +risk_score = 21 +rule_id = "097ef0b8-fb21-4e45-ad89-d81666349c6a" +setup = """## Setup + +The rule requires the Privileged Access Detection integration assets to be installed, as well as Windows logs collected by integrations such as Elastic Defend and Windows. + +### Privileged Access Detection Setup +The Privileged Access Detection integration detects privileged access activity by identifying abnormalities in Windows, Linux and Okta events. Anomalies are detected using Elastic's Anomaly Detection feature. + +#### Prerequisite Requirements: +- Fleet is required for Privileged Access Detection. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). +- Windows events collected by the [Elastic Defend](https://docs.elastic.co/en/integrations/endpoint) and [Windows](https://docs.elastic.co/en/integrations/windows) integration. +- To install Elastic Defend, refer to the [documentation](https://www.elastic.co/guide/en/security/current/install-endpoint.html). +- To add the Windows integration to an Elastic Agent policy, refer to [this](https://www.elastic.co/guide/en/fleet/current/add-integration-to-policy.html) guide. + +#### The following steps should be executed to install assets associated with the Privileged Access Detection integration: +- Go to the Kibana homepage. Under Management, click Integrations. +- In the query bar, search for Privileged Access Detection and select the integration to see more details about it. +- Follow the instructions under the **Installation** section. +- For this rule to work, complete the instructions through **Add preconfigured anomaly detection jobs**. +""" +severity = "low" +tags = [ + "Use Case: Privileged Access Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Privilege Escalation" +] +type = "machine_learning" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1068" +name = "Exploitation for Privilege Escalation" +reference = "https://attack.mitre.org/techniques/T1068/" + +[[rule.threat.technique]] +id = "T1078" +name = "Valid Accounts" +reference = "https://attack.mitre.org/techniques/T1078/" + +[rule.threat.tactic] +id = "TA0004" +name = "Privilege Escalation" +reference = "https://attack.mitre.org/tactics/TA0004/" \ No newline at end of file diff --git a/rules/integrations/pad/privileged_access_ml_windows_high_count_special_privilege_use_events.toml b/rules/integrations/pad/privileged_access_ml_windows_high_count_special_privilege_use_events.toml new file mode 100644 index 00000000000..abc7ff98c69 --- /dev/null +++ b/rules/integrations/pad/privileged_access_ml_windows_high_count_special_privilege_use_events.toml @@ -0,0 +1,67 @@ +[metadata] +creation_date = "2025/02/18" +integration = ["pad", "endpoint", "windows"] +maturity = "production" + +[rule] +anomaly_threshold = 75 +author = ["Elastic"] +description = """ +A machine learning job has detected an unusual increase in special privilege usage events, such as privileged operations and service calls, for a user, suggesting potential unauthorized privileged access. +A sudden spike in these events may indicate an attempt to escalate privileges, execute unauthorized tasks, or maintain persistence within a system. +""" +from = "now-3h" +interval = "15m" +license = "Elastic License v2" +machine_learning_job_id = "pad_windows_high_count_special_privilege_use_events" +name = "Spike in Special Privilege Use Events" +references = [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html", + "https://docs.elastic.co/en/integrations/pad" +] +risk_score = 21 +rule_id = "6fb2280a-d91a-4e64-a97e-1332284d9391" +setup = """## Setup + +The rule requires the Privileged Access Detection integration assets to be installed, as well as Windows logs collected by integrations such as Elastic Defend and Windows. + +### Privileged Access Detection Setup +The Privileged Access Detection integration detects privileged access activity by identifying abnormalities in Windows, Linux and Okta events. Anomalies are detected using Elastic's Anomaly Detection feature. + +#### Prerequisite Requirements: +- Fleet is required for Privileged Access Detection. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). +- Windows events collected by the [Elastic Defend](https://docs.elastic.co/en/integrations/endpoint) and [Windows](https://docs.elastic.co/en/integrations/windows) integration. +- To install Elastic Defend, refer to the [documentation](https://www.elastic.co/guide/en/security/current/install-endpoint.html). +- To add the Windows integration to an Elastic Agent policy, refer to [this](https://www.elastic.co/guide/en/fleet/current/add-integration-to-policy.html) guide. + +#### The following steps should be executed to install assets associated with the Privileged Access Detection integration: +- Go to the Kibana homepage. Under Management, click Integrations. +- In the query bar, search for Privileged Access Detection and select the integration to see more details about it. +- Follow the instructions under the **Installation** section. +- For this rule to work, complete the instructions through **Add preconfigured anomaly detection jobs**. +""" +severity = "low" +tags = [ + "Use Case: Privileged Access Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Privilege Escalation" +] +type = "machine_learning" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1068" +name = "Exploitation for Privilege Escalation" +reference = "https://attack.mitre.org/techniques/T1068/" + +[[rule.threat.technique]] +id = "T1078" +name = "Valid Accounts" +reference = "https://attack.mitre.org/techniques/T1078/" + +[rule.threat.tactic] +id = "TA0004" +name = "Privilege Escalation" +reference = "https://attack.mitre.org/tactics/TA0004/" \ No newline at end of file diff --git a/rules/integrations/pad/privileged_access_ml_windows_high_count_user_account_management_events.toml b/rules/integrations/pad/privileged_access_ml_windows_high_count_user_account_management_events.toml new file mode 100644 index 00000000000..fcbc922626b --- /dev/null +++ b/rules/integrations/pad/privileged_access_ml_windows_high_count_user_account_management_events.toml @@ -0,0 +1,68 @@ +[metadata] +creation_date = "2025/02/18" +integration = ["pad", "endpoint", "windows"] +maturity = "production" + +[rule] +anomaly_threshold = 75 +author = ["Elastic"] +description = """ +A machine learning job has identified a spike in user account management events for a user, indicating potential privileged access activity. +This indicates an unusual increase in actions related to managing user accounts (such as creating, modifying, or deleting accounts), +which could be a sign of an attempt to escalate privileges or unauthorized activity involving account management. +""" +from = "now-3h" +interval = "15m" +license = "Elastic License v2" +machine_learning_job_id = "pad_windows_high_count_user_account_management_events" +name = "Spike in User Account Management Events" +references = [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html", + "https://docs.elastic.co/en/integrations/pad" +] +risk_score = 21 +rule_id = "37cca4d4-92ab-4a33-a4f8-44a7a380ccda" +setup = """## Setup + +The rule requires the Privileged Access Detection integration assets to be installed, as well as Windows logs collected by integrations such as Elastic Defend and Windows. + +### Privileged Access Detection Setup +The Privileged Access Detection integration detects privileged access activity by identifying abnormalities in Windows, Linux and Okta events. Anomalies are detected using Elastic's Anomaly Detection feature. + +#### Prerequisite Requirements: +- Fleet is required for Privileged Access Detection. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). +- Windows events collected by the [Elastic Defend](https://docs.elastic.co/en/integrations/endpoint) and [Windows](https://docs.elastic.co/en/integrations/windows) integration. +- To install Elastic Defend, refer to the [documentation](https://www.elastic.co/guide/en/security/current/install-endpoint.html). +- To add the Windows integration to an Elastic Agent policy, refer to [this](https://www.elastic.co/guide/en/fleet/current/add-integration-to-policy.html) guide. + +#### The following steps should be executed to install assets associated with the Privileged Access Detection integration: +- Go to the Kibana homepage. Under Management, click Integrations. +- In the query bar, search for Privileged Access Detection and select the integration to see more details about it. +- Follow the instructions under the **Installation** section. +- For this rule to work, complete the instructions through **Add preconfigured anomaly detection jobs**. +""" +severity = "low" +tags = [ + "Use Case: Privileged Access Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Privilege Escalation" +] +type = "machine_learning" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1068" +name = "Exploitation for Privilege Escalation" +reference = "https://attack.mitre.org/techniques/T1068/" + +[[rule.threat.technique]] +id = "T1078" +name = "Valid Accounts" +reference = "https://attack.mitre.org/techniques/T1078/" + +[rule.threat.tactic] +id = "TA0004" +name = "Privilege Escalation" +reference = "https://attack.mitre.org/tactics/TA0004/" \ No newline at end of file diff --git a/rules/integrations/pad/privileged_access_ml_windows_rare_device_by_user.toml b/rules/integrations/pad/privileged_access_ml_windows_rare_device_by_user.toml new file mode 100644 index 00000000000..b7014a84b6f --- /dev/null +++ b/rules/integrations/pad/privileged_access_ml_windows_rare_device_by_user.toml @@ -0,0 +1,62 @@ +[metadata] +creation_date = "2025/02/18" +integration = ["pad", "endpoint", "windows"] +maturity = "production" + +[rule] +anomaly_threshold = 75 +author = ["Elastic"] +description = """ +A machine learning job has identified a user performing privileged operations in Windows from an uncommon device, indicating potential privileged access activity. +This could signal a compromised account, an attacker using stolen credentials, or an insider threat leveraging an unauthorized device to escalate privileges. +""" +from = "now-1h" +interval = "15m" +license = "Elastic License v2" +machine_learning_job_id = "pad_windows_rare_host_name_by_user" +name = "Unusual Host Name for Windows Privileged Operations Detected" +references = [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html", + "https://docs.elastic.co/en/integrations/pad" +] +risk_score = 21 +rule_id = "2bca4fcd-5228-4472-9071-148903a31057" +setup = """## Setup + +The rule requires the Privileged Access Detection integration assets to be installed, as well as Windows logs collected by integrations such as Elastic Defend and Windows. + +### Privileged Access Detection Setup +The Privileged Access Detection integration detects privileged access activity by identifying abnormalities in Windows, Linux and Okta events. Anomalies are detected using Elastic's Anomaly Detection feature. + +#### Prerequisite Requirements: +- Fleet is required for Privileged Access Detection. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). +- Windows events collected by the [Elastic Defend](https://docs.elastic.co/en/integrations/endpoint) and [Windows](https://docs.elastic.co/en/integrations/windows) integration. +- To install Elastic Defend, refer to the [documentation](https://www.elastic.co/guide/en/security/current/install-endpoint.html). +- To add the Windows integration to an Elastic Agent policy, refer to [this](https://www.elastic.co/guide/en/fleet/current/add-integration-to-policy.html) guide. + +#### The following steps should be executed to install assets associated with the Privileged Access Detection integration: +- Go to the Kibana homepage. Under Management, click Integrations. +- In the query bar, search for Privileged Access Detection and select the integration to see more details about it. +- Follow the instructions under the **Installation** section. +- For this rule to work, complete the instructions through **Add preconfigured anomaly detection jobs**. +""" +severity = "low" +tags = [ + "Use Case: Privileged Access Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Privilege Escalation" +] +type = "machine_learning" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1078" +name = "Valid Accounts" +reference = "https://attack.mitre.org/techniques/T1078/" + +[rule.threat.tactic] +id = "TA0004" +name = "Privilege Escalation" +reference = "https://attack.mitre.org/tactics/TA0004/" \ No newline at end of file diff --git a/rules/integrations/pad/privileged_access_ml_windows_rare_group_name_by_user.toml b/rules/integrations/pad/privileged_access_ml_windows_rare_group_name_by_user.toml new file mode 100644 index 00000000000..6592c2f521d --- /dev/null +++ b/rules/integrations/pad/privileged_access_ml_windows_rare_group_name_by_user.toml @@ -0,0 +1,79 @@ +[metadata] +creation_date = "2025/02/18" +integration = ["pad", "endpoint", "windows"] +maturity = "production" + +[rule] +anomaly_threshold = 75 +author = ["Elastic"] +description = """ +A machine learning job has detected a user accessing an uncommon group name for privileged operations, indicating potential privileged access activity. +This indicates that a user has accessed a group name that is unusual for their typical operations, particularly for actions requiring elevated privileges. +This could point to an attempt to manipulate group memberships or escalate privileges on a system. +""" +from = "now-1h" +interval = "15m" +license = "Elastic License v2" +machine_learning_job_id = "pad_windows_rare_group_name_by_user" +name = "Unusual Group Name Accessed by a User" +references = [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html", + "https://docs.elastic.co/en/integrations/pad" +] +risk_score = 21 +rule_id = "fb5d91d0-3b94-4f91-bf20-b6fbc4b2480a" +setup = """## Setup + +The rule requires the Privileged Access Detection integration assets to be installed, as well as Windows logs collected by integrations such as Elastic Defend and Windows. + +### Privileged Access Detection Setup +The Privileged Access Detection integration detects privileged access activity by identifying abnormalities in Windows, Linux and Okta events. Anomalies are detected using Elastic's Anomaly Detection feature. + +#### Prerequisite Requirements: +- Fleet is required for Privileged Access Detection. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). +- Windows events collected by the [Elastic Defend](https://docs.elastic.co/en/integrations/endpoint) and [Windows](https://docs.elastic.co/en/integrations/windows) integration. +- To install Elastic Defend, refer to the [documentation](https://www.elastic.co/guide/en/security/current/install-endpoint.html). +- To add the Windows integration to an Elastic Agent policy, refer to [this](https://www.elastic.co/guide/en/fleet/current/add-integration-to-policy.html) guide. + +#### The following steps should be executed to install assets associated with the Privileged Access Detection integration: +- Go to the Kibana homepage. Under Management, click Integrations. +- In the query bar, search for Privileged Access Detection and select the integration to see more details about it. +- Follow the instructions under the **Installation** section. +- For this rule to work, complete the instructions through **Add preconfigured anomaly detection jobs**. +""" +severity = "low" +tags = [ + "Use Case: Privileged Access Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Privilege Escalation" +] +type = "machine_learning" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1068" +name = "Exploitation for Privilege Escalation" +reference = "https://attack.mitre.org/techniques/T1068/" + +[[rule.threat.technique]] +id = "T1078" +name = "Valid Accounts" +reference = "https://attack.mitre.org/techniques/T1078/" + +[[rule.threat.technique]] +id = "T1069" +name = "Permission Groups Discovery" +reference = "https://attack.mitre.org/techniques/T1069/" + +[rule.threat.tactic] +id = "TA0004" +name = "Privilege Escalation" +reference = "https://attack.mitre.org/tactics/TA0004/" + +[rule.threat.tactic] +id = "TA0007" +name = "Discovery" +reference = "https://attack.mitre.org/tactics/TA0007/" + diff --git a/rules/integrations/pad/privileged_access_ml_windows_rare_privilege_assigned_to_user.toml b/rules/integrations/pad/privileged_access_ml_windows_rare_privilege_assigned_to_user.toml new file mode 100644 index 00000000000..a5e52b0732f --- /dev/null +++ b/rules/integrations/pad/privileged_access_ml_windows_rare_privilege_assigned_to_user.toml @@ -0,0 +1,67 @@ +[metadata] +creation_date = "2025/02/18" +integration = ["pad", "endpoint", "windows"] +maturity = "production" + +[rule] +anomaly_threshold = 75 +author = ["Elastic"] +description = """ +A machine learning job has identified a user leveraging an uncommon privilege type for privileged operations, indicating potential privileged access activity. +This indicates that a user is performing operations requiring elevated privileges but is using a privilege type that is not typically seen in their baseline logs. +""" +from = "now-1h" +interval = "15m" +license = "Elastic License v2" +machine_learning_job_id = "pad_windows_rare_privilege_assigned_to_user" +name = "Unusual Privilege Type assigned to a User" +references = [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html", + "https://docs.elastic.co/en/integrations/pad" +] +risk_score = 21 +rule_id = "27569131-560e-441e-b556-0b9180af3332" +setup = """## Setup + +The rule requires the Privileged Access Detection integration assets to be installed, as well as Windows logs collected by integrations such as Elastic Defend and Windows. + +### Privileged Access Detection Setup +The Privileged Access Detection integration detects privileged access activity by identifying abnormalities in Windows, Linux and Okta events. Anomalies are detected using Elastic's Anomaly Detection feature. + +#### Prerequisite Requirements: +- Fleet is required for Privileged Access Detection. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). +- Windows events collected by the [Elastic Defend](https://docs.elastic.co/en/integrations/endpoint) and [Windows](https://docs.elastic.co/en/integrations/windows) integration. +- To install Elastic Defend, refer to the [documentation](https://www.elastic.co/guide/en/security/current/install-endpoint.html). +- To add the Windows integration to an Elastic Agent policy, refer to [this](https://www.elastic.co/guide/en/fleet/current/add-integration-to-policy.html) guide. + +#### The following steps should be executed to install assets associated with the Privileged Access Detection integration: +- Go to the Kibana homepage. Under Management, click Integrations. +- In the query bar, search for Privileged Access Detection and select the integration to see more details about it. +- Follow the instructions under the **Installation** section. +- For this rule to work, complete the instructions through **Add preconfigured anomaly detection jobs**. +""" +severity = "low" +tags = [ + "Use Case: Privileged Access Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Privilege Escalation" +] +type = "machine_learning" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1068" +name = "Exploitation for Privilege Escalation" +reference = "https://attack.mitre.org/techniques/T1068/" + +[[rule.threat.technique]] +id = "T1078" +name = "Valid Accounts" +reference = "https://attack.mitre.org/techniques/T1078/" + +[rule.threat.tactic] +id = "TA0004" +name = "Privilege Escalation" +reference = "https://attack.mitre.org/tactics/TA0004/" \ No newline at end of file diff --git a/rules/integrations/pad/privileged_access_ml_windows_rare_region_name_by_user.toml b/rules/integrations/pad/privileged_access_ml_windows_rare_region_name_by_user.toml new file mode 100644 index 00000000000..ab2d7639c1a --- /dev/null +++ b/rules/integrations/pad/privileged_access_ml_windows_rare_region_name_by_user.toml @@ -0,0 +1,62 @@ +[metadata] +creation_date = "2025/02/18" +integration = ["pad", "endpoint", "windows"] +maturity = "production" + +[rule] +anomaly_threshold = 75 +author = ["Elastic"] +description = """ +A machine learning job has identified a user performing privileged operations in Windows from an uncommon geographical location, indicating potential privileged access activity. +This could suggest a compromised account, unauthorized access, or an attacker using stolen credentials to escalate privileges. +""" +from = "now-1h" +interval = "15m" +license = "Elastic License v2" +machine_learning_job_id = "pad_windows_rare_region_name_by_user" +name = "Unusual Region Name for Windows Privileged Operations Detected" +references = [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html", + "https://docs.elastic.co/en/integrations/pad" +] +risk_score = 21 +rule_id = "d2703b82-f92c-4489-a4a7-62aa29a62542" +setup = """## Setup + +The rule requires the Privileged Access Detection integration assets to be installed, as well as Windows logs collected by integrations such as Elastic Defend and Windows. + +### Privileged Access Detection Setup +The Privileged Access Detection integration detects privileged access activity by identifying abnormalities in Windows, Linux and Okta events. Anomalies are detected using Elastic's Anomaly Detection feature. + +#### Prerequisite Requirements: +- Fleet is required for Privileged Access Detection. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). +- Windows events collected by the [Elastic Defend](https://docs.elastic.co/en/integrations/endpoint) and [Windows](https://docs.elastic.co/en/integrations/windows) integration. +- To install Elastic Defend, refer to the [documentation](https://www.elastic.co/guide/en/security/current/install-endpoint.html). +- To add the Windows integration to an Elastic Agent policy, refer to [this](https://www.elastic.co/guide/en/fleet/current/add-integration-to-policy.html) guide. + +#### The following steps should be executed to install assets associated with the Privileged Access Detection integration: +- Go to the Kibana homepage. Under Management, click Integrations. +- In the query bar, search for Privileged Access Detection and select the integration to see more details about it. +- Follow the instructions under the **Installation** section. +- For this rule to work, complete the instructions through **Add preconfigured anomaly detection jobs**. +""" +severity = "low" +tags = [ + "Use Case: Privileged Access Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Privilege Escalation" +] +type = "machine_learning" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1078" +name = "Valid Accounts" +reference = "https://attack.mitre.org/techniques/T1078/" + +[rule.threat.tactic] +id = "TA0004" +name = "Privilege Escalation" +reference = "https://attack.mitre.org/tactics/TA0004/" \ No newline at end of file diff --git a/rules/integrations/pad/privileged_access_ml_windows_rare_source_ip_by_user.toml b/rules/integrations/pad/privileged_access_ml_windows_rare_source_ip_by_user.toml new file mode 100644 index 00000000000..ed9d6dd2993 --- /dev/null +++ b/rules/integrations/pad/privileged_access_ml_windows_rare_source_ip_by_user.toml @@ -0,0 +1,62 @@ +[metadata] +creation_date = "2025/02/18" +integration = ["pad", "endpoint", "windows"] +maturity = "production" + +[rule] +anomaly_threshold = 75 +author = ["Elastic"] +description = """ +A machine learning job has identified a user performing privileged operations in Windows from an uncommon source IP, indicating potential privileged access activity. +This could suggest an account compromise, misuse of administrative privileges, or an attacker leveraging a new network location to escalate privileges. +""" +from = "now-1h" +interval = "15m" +license = "Elastic License v2" +machine_learning_job_id = "pad_windows_rare_source_ip_by_user" +name = "Unusual Source IP for Windows Privileged Operations Detected" +references = [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html", + "https://docs.elastic.co/en/integrations/pad" +] +risk_score = 21 +rule_id = "08be5599-3719-4bbd-8cbc-7e9cff556881" +setup = """## Setup + +The rule requires the Privileged Access Detection integration assets to be installed, as well as Windows logs collected by integrations such as Elastic Defend and Windows. + +### Privileged Access Detection Setup +The Privileged Access Detection integration detects privileged access activity by identifying abnormalities in Windows, Linux and Okta events. Anomalies are detected using Elastic's Anomaly Detection feature. + +#### Prerequisite Requirements: +- Fleet is required for Privileged Access Detection. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). +- Windows events collected by the [Elastic Defend](https://docs.elastic.co/en/integrations/endpoint) and [Windows](https://docs.elastic.co/en/integrations/windows) integration. +- To install Elastic Defend, refer to the [documentation](https://www.elastic.co/guide/en/security/current/install-endpoint.html). +- To add the Windows integration to an Elastic Agent policy, refer to [this](https://www.elastic.co/guide/en/fleet/current/add-integration-to-policy.html) guide. + +#### The following steps should be executed to install assets associated with the Privileged Access Detection integration: +- Go to the Kibana homepage. Under Management, click Integrations. +- In the query bar, search for Privileged Access Detection and select the integration to see more details about it. +- Follow the instructions under the **Installation** section. +- For this rule to work, complete the instructions through **Add preconfigured anomaly detection jobs**. +""" +severity = "low" +tags = [ + "Use Case: Privileged Access Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Privilege Escalation" +] +type = "machine_learning" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1078" +name = "Valid Accounts" +reference = "https://attack.mitre.org/techniques/T1078/" + +[rule.threat.tactic] +id = "TA0004" +name = "Privilege Escalation" +reference = "https://attack.mitre.org/tactics/TA0004/" \ No newline at end of file