Conversation
* Temporaily Disable Changed FIles Workflow * bump version
…lastic#4516)" (elastic#4548) This reverts commit 2ff8d1b.
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
…ic#4545) Changed description and name of problemchild ML detection-rules
* Add new docs automation * Add path-pattern filters for documentation folders * Update .github/workflows/docs-build.yml Co-authored-by: Jan Calanog <nejcalanog@gmail.com> --------- Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com> Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> Co-authored-by: Jan Calanog <nejcalanog@gmail.com> Co-authored-by: Sergey Polzunov <traut@users.noreply.github.com>
* Bump changed-files Version to Patched Version * patch bump * reenable workflow * Use full length commit hash * Bump 44 to 46 --------- Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com>
…ic#4535) * new rules for AWS DynamoDB data exfiltration * bumping patch version * adjusting investigation guide * updating patch version * updating patch version * updating patch version --------- Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
* Simplify kibana session management * Drop removed options from `kibana_args` set * Style fix * Patch version bump * Bumping kibana lib version * Relax CLI requirement, making `api_key` optional, to allow `help` to run
… docs. (elastic#4508) * move docs folder to docs-dev * Add new docs folder * update docset.yml to reflect latest usage * Add rules_building_block folder * revert changes to docs-dev/experimental-machine-learning/url-spoof.md * bump patch versions * revert bump --------- Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com> Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
* Update to custom-rules markdown location * bump version * Update link reference
* Prep for Release 9.1 * Update Patch Version * Update Patch version * Update Patch version
* Added OWA (outlook for web) new AppID
**Title:** Add new Outlook for Web AppID to abnormal Microsoft 365 ClientAppID rule
**Description:**
This pull request updates the `initial_access_microsoft_365_abnormal_clientappid` rule to include the newly introduced Outlook for Web AppID:
- **New AppID**: `9199bf20-a13f-4107-85dc-02114787ef48`
### Context
Outlook for Web (OWA) is migrating to a new authentication platform using MSAL and a Single Page Application (SPA) auth model. As part of this backend change, Microsoft is replacing the existing OWA AppID with a new one. This change is being rolled out during the first half of calendar year 2024, with full deployment expected by Q4 2024.
- **Old OWA AppID**: `00000002-0000-0ff1-ce00-000000000000`
- **New OWA AppID**: `9199bf20-a13f-4107-85dc-02114787ef48`
Although no action is required for tenant administrators, this new AppID may show up in logs and should be accounted for in detections relying on known legitimate ClientAppIDs.
### Why this change?
The rule `initial_access_microsoft_365_abnormal_clientappid` flags potentially suspicious or unauthorized client applications accessing Microsoft 365 services. To prevent false positives caused by this official change from Microsoft, this PR adds the new OWA AppID to the allowlist.
### References
- Microsoft 365 Message Center notice (ref: MC715025)
- [MSAL documentation](https://learn.microsoft.com/en-us/azure/active-directory/develop/msal-overview)
* Update initial_access_microsoft_365_abnormal_clientappid.toml
Updated updated_date
…65 (elastic#4557) * tuning Azure rule for illicit grant activity; creating new rule for M365 * Update rules/integrations/o365/initial_access_microsoft_365_illicit_consent_grant_via_registered_application.toml * Update rules/integrations/azure/initial_access_entra_illicit_consent_grant_via_registered_application.toml * adjusted tags * Update rules/integrations/azure/initial_access_entra_illicit_consent_grant_via_registered_application.toml
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
Remove diagnostic hint
) * [New] Unusual Network Connection to Suspicious Web Service * Update rule threat order --------- Co-authored-by: Eric Forte <119343520+eric-forte-elastic@users.noreply.github.com> Co-authored-by: eric-forte-elastic <eric.forte@elastic.co> Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>
elastic#4529) * [FN Tuning] Shared Object Created or Changed by Previously Unknown Process * Update process exclusions in TOML file --------- Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com> Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com> Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> Co-authored-by: Eric Forte <119343520+eric-forte-elastic@users.noreply.github.com>
* [D4C Conversion] Converting Compatible D4C Rules to DR * added host.os.type * Rename * Update rules/linux/execution_container_management_binary_launched_inside_container.toml Co-authored-by: Isai <59296946+imays11@users.noreply.github.com> * Update rules/linux/privilege_escalation_debugfs_launched_inside_container.toml Co-authored-by: Isai <59296946+imays11@users.noreply.github.com> * Update rules/linux/privilege_escalation_debugfs_launched_inside_container.toml Co-authored-by: Isai <59296946+imays11@users.noreply.github.com> * Update rules/linux/privilege_escalation_mount_launched_inside_container.toml Co-authored-by: Isai <59296946+imays11@users.noreply.github.com> * Update rules/linux/privilege_escalation_mount_launched_inside_container.toml Co-authored-by: Isai <59296946+imays11@users.noreply.github.com> --------- Co-authored-by: Isai <59296946+imays11@users.noreply.github.com> Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com> Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>
* Update to pinned hash * version bump
…lastic#4583) * Add error catch for workaround * Switch to set for efficiency * Patch version bump --------- Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>
Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>
* [Rule Tuning] Suspicious Execution via Scheduled Task * [Rule Tuning] Suspicious WMI Event Subscription Created
…rement for Principal User` (elastic#4562) * tuning 'Microsoft Entra ID Rare Authentication Requirement for Principal User' * updated MITRE ATT&CK mappings * updated index target * updated patch version * updating patch version * bumping patch version * updating patch version
…stic#4570) * tuning 'Azure Service Principal Credentials Added' * updated patch version * added investigation guide * updating patch version * updating patch version
* Add support for local dates flag * Use two variables * Add support for import-rules-to-repo * Revert arg formatting * Update comment * Pass Rule Path as Path Object * Update to rule loader function * Streamline metadata function * Also support dictionaries * Bump patch version * Reduce complexity * Add if path exists check * Fix version bump
* Added new cli flag to exclude tactic name in rule file name * added a shortcut for the flag and adjusted CLI readme * Add no tactic flag also to import to prevent warnings * Added info about unit test * version bump * Added no_tactic_filename as config option + fixed linting * pyproject version bump --------- Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com> Co-authored-by: Eric Forte <119343520+eric-forte-elastic@users.noreply.github.com>
r0ot
added a commit
that referenced
this pull request
Apr 16, 2025
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
14 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.