Deprecation Notice to Cloud Defend Rules #4520

shashank-elastic · 2025-03-06T08:44:26Z

Pull Request

Issue link(s): https://github.com/elastic/security-team/issues/11393

Summary - What I changed

Issue Deprecation notice via rule name.

How To Test

Unit test should pass.

Checklist

Added a label for the type of pr: bug, enhancement, schema, maintenance, Rule: New, Rule: Deprecation, Rule: Tuning, Hunt: New, or Hunt: Tuning so guidelines can be generated
Added the meta:rapid-merge label if planning to merge within 24 hours
Secret and sensitive material has been managed correctly
Automated testing was updated or added to match the most common scenarios
Documentation and comments were added for features that require explanation

Contributor checklist

Have you signed the contributor license agreement?
Have you followed the contributor guidelines?

github-actions · 2025-03-06T08:44:42Z

Rule: Deprecation - Guidelines

These guidelines serve as a reminder set of considerations when recommending the deprecation of a rule.

Documentation and Context

Description of the reason for deprecation.
Include any context or historical data supporting the deprecation decision.

Rule Metadata Checks

deprecated = true added to the rule metadata.
updated_date should be the date of the PR.

Testing and Validation

A prior rule tuning occurred for the rule where Deprecated - is prepended to the rule name, and the rule has already been released.
Rule has be moved to the _deprecated directory.
Double check gaps potentially or inadvertently introduced.
Provide evidence that the rule is no longer needed or has been replaced (e.g., alternative rules, updated detection methods).

Aegrah

Are we still looking to migrate these over to Elastic Defend prior to deprecation? For the vast majority of these, we can write similar rules using the process.entry_leader.entry_meta.type == "container" to determine whether the process' init stems from a container.

I am fine doing this before I leave for PTO. WDYT? @imays11

w0rk3r · 2025-03-06T10:39:15Z

rules/integrations/cloud_defend/container_workload_protection.toml

@@ -42,7 +42,7 @@ note = """## Triage and analysis
 > **Disclaimer**:
 > This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

-### Investigating Container Workload Protection
+### Investigating Deprecated - Container Workload Protection


Suggested change

### Investigating Deprecated - Container Workload Protection

### Investigating Container Workload Protection

All of the rule name changes in Investigation Guide is because of the Unit test failure reported here - https://github.com/elastic/detection-rules/actions/runs/13694627124/job/38294173310

w0rk3r · 2025-03-06T10:40:15Z

rules/integrations/cloud_defend/credential_access_aws_creds_search_inside_a_container.toml

@@ -45,7 +45,7 @@ note = """## Triage and analysis
 > **Disclaimer**:
 > This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

-### Investigating AWS Credentials Searched For Inside A Container
+### Investigating Deprecated - AWS Credentials Searched For Inside A Container


Suggested change

### Investigating Deprecated - AWS Credentials Searched For Inside A Container

### Investigating AWS Credentials Searched For Inside A Container

w0rk3r · 2025-03-06T10:40:29Z

...loud_defend/credential_access_collection_sensitive_files_compression_inside_a_container.toml

@@ -70,7 +70,7 @@ note = """## Triage and analysis
 > **Disclaimer**:
 > This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

-### Investigating Sensitive Files Compression Inside A Container
+### Investigating Deprecated - Sensitive Files Compression Inside A Container


Suggested change

### Investigating Deprecated - Sensitive Files Compression Inside A Container

### Investigating Sensitive Files Compression Inside A Container

w0rk3r · 2025-03-06T10:40:48Z

...ns/cloud_defend/credential_access_sensitive_keys_or_passwords_search_inside_a_container.toml

@@ -52,7 +52,7 @@ note = """## Triage and analysis
 > **Disclaimer**:
 > This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

-### Investigating Sensitive Keys Or Passwords Searched For Inside A Container
+### Investigating Deprecated - Sensitive Keys Or Passwords Searched For Inside A Container


Suggested change

### Investigating Deprecated - Sensitive Keys Or Passwords Searched For Inside A Container

### Investigating Sensitive Keys Or Passwords Searched For Inside A Container

w0rk3r · 2025-03-06T10:41:01Z

...tions/cloud_defend/defense_evasion_ld_preload_shared_object_modified_inside_a_container.toml

@@ -39,7 +39,7 @@ note = """## Triage and analysis
 > **Disclaimer**:
 > This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

-### Investigating Modification of Dynamic Linker Preload Shared Object Inside A Container
+### Investigating Deprecated - Modification of Dynamic Linker Preload Shared Object Inside A Container


Suggested change

### Investigating Deprecated - Modification of Dynamic Linker Preload Shared Object Inside A Container

### Investigating Modification of Dynamic Linker Preload Shared Object Inside A Container

w0rk3r · 2025-03-06T10:42:56Z

...tegrations/cloud_defend/persistence_ssh_authorized_keys_modification_inside_a_container.toml

@@ -42,7 +42,7 @@ note = """## Triage and analysis
 > **Disclaimer**:
 > This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

-### Investigating SSH Authorized Keys File Modified Inside a Container
+### Investigating Deprecated - SSH Authorized Keys File Modified Inside a Container


Suggested change

### Investigating Deprecated - SSH Authorized Keys File Modified Inside a Container

### Investigating SSH Authorized Keys File Modified Inside a Container

w0rk3r · 2025-03-06T10:43:09Z

...ations/cloud_defend/privilege_escalation_debugfs_launched_inside_a_privileged_container.toml

@@ -48,7 +48,7 @@ note = """## Triage and analysis
 > **Disclaimer**:
 > This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

-### Investigating File System Debugger Launched Inside a Privileged Container
+### Investigating Deprecated - File System Debugger Launched Inside a Privileged Container


Suggested change

### Investigating Deprecated - File System Debugger Launched Inside a Privileged Container

### Investigating File System Debugger Launched Inside a Privileged Container

w0rk3r · 2025-03-06T10:43:21Z

...grations/cloud_defend/privilege_escalation_mount_launched_inside_a_privileged_container.toml

@@ -46,7 +46,7 @@ note = """## Triage and analysis
 > **Disclaimer**:
 > This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

-### Investigating Mount Launched Inside a Privileged Container
+### Investigating Deprecated - Mount Launched Inside a Privileged Container


Suggested change

### Investigating Deprecated - Mount Launched Inside a Privileged Container

### Investigating Mount Launched Inside a Privileged Container

w0rk3r · 2025-03-06T10:43:36Z

...end/privilege_escalation_potential_container_escape_via_modified_notify_on_release_file.toml

@@ -47,7 +47,7 @@ note = """## Triage and analysis
 > **Disclaimer**:
 > This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

-### Investigating Potential Container Escape via Modified notify_on_release File
+### Investigating Deprecated - Potential Container Escape via Modified notify_on_release File


Suggested change

### Investigating Deprecated - Potential Container Escape via Modified notify_on_release File

### Investigating Potential Container Escape via Modified notify_on_release File

w0rk3r · 2025-03-06T10:43:48Z

..._defend/privilege_escalation_potential_container_escape_via_modified_release_agent_file.toml

@@ -46,7 +46,7 @@ note = """## Triage and analysis
 > **Disclaimer**:
 > This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

-### Investigating Potential Container Escape via Modified release_agent File
+### Investigating Deprecated - Potential Container Escape via Modified release_agent File


Suggested change

### Investigating Deprecated - Potential Container Escape via Modified release_agent File

### Investigating Potential Container Escape via Modified release_agent File

w0rk3r · 2025-03-06T10:46:39Z

We should also provide a reason for the deprecation, either in the setup guide or in the rule description, so it is clear to customers why this is being deprecated. Here is an example we did for the threat match rules.

Mikaayenson · 2025-03-06T10:52:26Z

If you search for cloud_defend in our repo, it shows up in a couple places. We may need to make other minor changes.

shashank-elastic · 2025-03-06T13:49:26Z

Updates

We would continue to announce deprecation in this release, and then tune as per @Aegrah as a separate effort after the complete deprecation is announced.
For adding additional information on deprecation, I would wait till we have @imays11 look on this and we can add those additional information.

Deprecation Notice to Cloud Defend Rules

c588b9f

shashank-elastic added Rule: Deprecation removal of a rule meta:rapid-merge labels Mar 6, 2025

shashank-elastic requested review from Mikaayenson, imays11, Samirbous, Aegrah and terrancedejesus March 6, 2025 08:44

shashank-elastic self-assigned this Mar 6, 2025

github-actions bot added the backport: auto label Mar 6, 2025

Samirbous approved these changes Mar 6, 2025

View reviewed changes

Udpate names in investigation guide

15d64d4

Aegrah reviewed Mar 6, 2025

View reviewed changes

w0rk3r reviewed Mar 6, 2025

View reviewed changes

terrancedejesus approved these changes Mar 6, 2025

View reviewed changes

Merge branch 'main' into deprecate_notice_cloud_defend

55f9ea9

shashank-elastic requested review from w0rk3r and Aegrah March 6, 2025 14:53

Merge branch 'main' into deprecate_notice_cloud_defend

a39cef7

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Deprecation Notice to Cloud Defend Rules #4520

Deprecation Notice to Cloud Defend Rules #4520

shashank-elastic commented Mar 6, 2025

github-actions bot commented Mar 6, 2025

Aegrah left a comment

w0rk3r Mar 6, 2025

shashank-elastic Mar 6, 2025

w0rk3r Mar 6, 2025

w0rk3r Mar 6, 2025

w0rk3r Mar 6, 2025

w0rk3r Mar 6, 2025

w0rk3r Mar 6, 2025

w0rk3r Mar 6, 2025

w0rk3r Mar 6, 2025

w0rk3r Mar 6, 2025

w0rk3r Mar 6, 2025

w0rk3r commented Mar 6, 2025

Mikaayenson commented Mar 6, 2025

shashank-elastic commented Mar 6, 2025

	### Investigating Deprecated - Container Workload Protection
	### Investigating Container Workload Protection

	### Investigating Deprecated - AWS Credentials Searched For Inside A Container
	### Investigating AWS Credentials Searched For Inside A Container

	### Investigating Deprecated - Sensitive Files Compression Inside A Container
	### Investigating Sensitive Files Compression Inside A Container

	### Investigating Deprecated - Sensitive Keys Or Passwords Searched For Inside A Container
	### Investigating Sensitive Keys Or Passwords Searched For Inside A Container

	### Investigating Deprecated - Modification of Dynamic Linker Preload Shared Object Inside A Container
	### Investigating Modification of Dynamic Linker Preload Shared Object Inside A Container

	### Investigating Deprecated - SSH Authorized Keys File Modified Inside a Container
	### Investigating SSH Authorized Keys File Modified Inside a Container

	### Investigating Deprecated - File System Debugger Launched Inside a Privileged Container
	### Investigating File System Debugger Launched Inside a Privileged Container

	### Investigating Deprecated - Mount Launched Inside a Privileged Container
	### Investigating Mount Launched Inside a Privileged Container

	### Investigating Deprecated - Potential Container Escape via Modified notify_on_release File
	### Investigating Potential Container Escape via Modified notify_on_release File

Deprecation Notice to Cloud Defend Rules #4520

Are you sure you want to change the base?

Deprecation Notice to Cloud Defend Rules #4520

Conversation

shashank-elastic commented Mar 6, 2025

Pull Request

Summary - What I changed

How To Test

Checklist

Contributor checklist

github-actions bot commented Mar 6, 2025

Rule: Deprecation - Guidelines

Documentation and Context

Rule Metadata Checks

Testing and Validation

Aegrah left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

w0rk3r commented Mar 6, 2025

Mikaayenson commented Mar 6, 2025

shashank-elastic commented Mar 6, 2025

Updates