From a9cb7ec0b4a44e6a6d8d30a4644768df83a3b469 Mon Sep 17 00:00:00 2001 From: Ricardo Valdes Date: Wed, 16 Sep 2026 20:34:33 -0400 Subject: [PATCH] fix: align Linux filter and rule contracts --- filters/audits/linux.md | 42 +++++++ filters/linux/linux.yml | 106 +++++++++++----- .../testdata/filter-contracts/linux.json | 113 ++++++++++++++++++ .../attempt_to_disable_syslog_service.yml | 4 +- rules/linux/chattr_immutable_file.yml | 4 +- .../debian_family/auditd_syslog_disabling.yml | 4 +- .../container_escape_techniques.yml | 4 +- .../debian_family/debian_kernel_exploits.yml | 4 +- .../debian_specific_rootkits.yml | 2 +- .../linux/debian_family/etc_shadow_access.yml | 4 +- .../kernel_exploit_indicators.yml | 4 +- .../suid_sgid_binary_creation.yml | 4 +- .../suspicious_binary_in_tmp.yml | 2 +- rules/linux/disable_selinux_attempt.yml | 4 +- rules/linux/insmod_kernel_module_load.yml | 4 +- rules/linux/linux_hping_activity.yml | 4 +- rules/linux/linux_nping_activity.yml | 4 +- rules/linux/log_files_deleted.yml | 4 +- .../openshift_security_violations.yml | 4 +- .../rhel_family/rhel_kernel_exploits.yml | 4 +- .../rhel_family/rhel_specific_malware.yml | 2 +- .../rhel_family/rpm_database_tampering.yml | 2 +- .../rhel_family/secure_boot_violations.yml | 4 +- .../rhel_family/selinux_policy_violations.yml | 2 +- .../yum_dnf_repository_attacks.yml | 2 +- rules/linux/tc_bpf_filter.yml | 4 +- 26 files changed, 270 insertions(+), 71 deletions(-) create mode 100644 filters/audits/linux.md create mode 100644 plugins/alerts/testdata/filter-contracts/linux.json diff --git a/filters/audits/linux.md b/filters/audits/linux.md new file mode 100644 index 000000000..9e1070266 --- /dev/null +++ b/filters/audits/linux.md @@ -0,0 +1,42 @@ +# Linux normalization and rule review + +Separate executable, working directory and signed exit status; correct outcomes and align path/grouping rule consumers. + +This draft targets UTMStack `v11`. It contains 1 filter changes +and 23 rule changes for this technology only. Review covered +1 filter configurations and 49 matching shipped rule files. +Unchanged rules are listed in the regression manifest; they are not duplicated in the diff. + +## Contract and validation + +- Compared exact standard names/types with go-sdk v1.1.31 and the supplied UTMStack dictionaries. +- Checked documented pipeline ordering, rename/move behavior, open vendor log fields, + event-side versus alert-side fields, and surviving fields used by affected rule predicates/history/grouping. +- Strict SDK configuration decoding and actual CEL compilation pass for this scope. +- 3 synthetic normalization cases pass, including SDK Event conversion and any + trigger predicate assertions recorded in the manifest. +- The scoped alerts module tests and `git diff --check` pass with the shared contract runner applied. + +The shared alert-contract PR supplies the reusable Go runner for the manifest in +`plugins/alerts/testdata/filter-contracts/linux.json`. Apply that support before running `go test ./...` in `plugins/alerts`. + +The changed rules also require the shared alert-grouping fix to resolve `lastEvent.*` values correctly at runtime. + +The model starts from synthetic extraction results. It does not run complex grok, +JSON/KV/XML/CSV extraction, time conversion, dynamic plugins, historical OpenSearch +queries, or the closed EventProcessor. Raw vendor logs and resulting alerts must +still be checked in staging before rollout. No customer false-positive reduction +has been measured and no production rollout is included. + + + +## References + +- [SDK schema](https://github.com/threatwinds/go-sdk/blob/v1.1.31/plugins/plugins.proto) +- [Filter steps](https://github.com/threatwinds/go-sdk/wiki/Filter-Steps-Reference) +- [Standard event schema](https://github.com/threatwinds/go-sdk/wiki/Standard-Event-Schema) +- [Rule implementation](https://github.com/threatwinds/go-sdk/wiki/Implementing-Rules) + +`afterEvents`, empty noncapturing grok names, supported numeric strings, and custom +`log.*` fields are accepted. Existing textual protocol casing and vendor action names +are preserved unless a concrete consumer mismatch requires correction. diff --git a/filters/linux/linux.yml b/filters/linux/linux.yml index 78110c46f..202f3ac0a 100644 --- a/filters/linux/linux.yml +++ b/filters/linux/linux.yml @@ -273,9 +273,27 @@ pipeline: - rename: from: - - log.JOBRESULT - to: actionResult - where: exists("log.JOBRESULT") && !regexMatch("log.JOBRESULT", "(?i)\b(?:denied|blocked|failed)\b") + - log.JOBRESULT + to: log.vendorActionResult + where: exists("log.JOBRESULT") + - add: + function: string + params: + key: actionResult + value: success + where: regexMatch("log.vendorActionResult", "(?i)^(success|succeeded|successful|ok|done|accepted|accept|allowed|allow|permitted|permit|passed|pass|true)$") + - add: + function: string + params: + key: actionResult + value: failure + where: regexMatch("log.vendorActionResult", "(?i)^(failure|failed|fail|error|invalid|timeout|false)$") + - add: + function: string + params: + key: actionResult + value: denied + where: regexMatch("log.vendorActionResult", "(?i)^(denied|deny|blocked|block|dropped|drop|rejected|reject|forbidden|unauthorized|quarantined)$") - rename: from: @@ -341,15 +359,15 @@ pipeline: function: string params: key: severity - value: "emergency" - where: 'equals("log.priority", "0")' + value: critical + where: equals("log.priority", "0") - add: function: string params: key: severity - value: "alert" - where: 'equals("log.priority", "1")' + value: critical + where: equals("log.priority", "1") - add: function: string @@ -376,8 +394,8 @@ pipeline: function: string params: key: severity - value: "notice" - where: 'equals("log.priority", "5")' + value: info + where: equals("log.priority", "5") - add: function: string @@ -416,39 +434,57 @@ pipeline: # Map result to actionResult (success/failure) - rename: from: - - log.result - to: actionResult - where: 'equals("log.type", "auditd") && exists("log.result") && !regexMatch("log.result", "(?i)\b(?:denied|blocked|failed)\b")' + - log.result + to: log.vendorActionResult + where: exists("log.result") + - add: + function: string + params: + key: actionResult + value: success + where: regexMatch("log.vendorActionResult", "(?i)^(success|succeeded|successful|ok|done|accepted|accept|allowed|allow|permitted|permit|passed|pass|true)$") + - add: + function: string + params: + key: actionResult + value: failure + where: regexMatch("log.vendorActionResult", "(?i)^(failure|failed|fail|error|invalid|timeout|false)$") + - add: + function: string + params: + key: actionResult + value: denied + where: regexMatch("log.vendorActionResult", "(?i)^(denied|deny|blocked|block|dropped|drop|rejected|reject|forbidden|unauthorized|quarantined)$") # Adding action result - add: - function: 'string' + function: string params: key: actionResult - value: 'denied' - where: regexMatch("log.result", "(?i)\bdenied\b") + value: denied + where: regexMatch("log.result", "(?i)\\bdenied\\b") - add: - function: 'string' + function: string params: key: actionResult - value: 'blocked' - where: regexMatch("log.result", "(?i)\bblocked\b") + value: denied + where: regexMatch("log.result", "(?i)\\bblocked\\b") - add: - function: 'string' + function: string params: key: actionResult - value: 'failed' - where: regexMatch("log.result", "(?i)\bfailed\b") + value: failure + where: regexMatch("log.result", "(?i)\\bfailed\\b") # Map exe to origin.process (full path to executable) # Only if journald's COMM didn't already set origin.process - rename: from: - - log.exe - to: origin.process - where: 'equals("log.type", "auditd") && exists("log.exe") && !exists("origin.process")' + - log.exe + to: origin.path + where: equals("log.type", "auditd") && exists("log.exe") # Fallback: map auditd comm to origin.process if exe not mapped - rename: @@ -474,19 +510,27 @@ pipeline: # Map cwd to origin.path (current working directory) - rename: from: - - log.cwd - to: origin.path - where: 'equals("log.type", "auditd") && exists("log.cwd")' + - log.cwd + to: log.workingDirectory + where: equals("log.type", "auditd") && exists("log.cwd") # Map exit code to statusCode (for correlation and alerting) - rename: from: - - log.exit - to: statusCode - where: 'equals("log.type", "auditd") && exists("log.exit")' + - log.exit + to: log.exitCode + where: equals("log.type", "auditd") && exists("log.exit") # Cast statusCode to integer (proto schema expects uint32) - cast: fields: [statusCode] to: int - where: 'equals("log.type", "auditd") && exists("statusCode")' \ No newline at end of file + where: 'equals("log.type", "auditd") && exists("statusCode")' + + # Normalize explicit outcomes; an unknown outcome remains unset. + - add: + function: string + params: + key: actionResult + value: failure + where: '!exists("actionResult") && lessThan("log.exitCode",0)' diff --git a/plugins/alerts/testdata/filter-contracts/linux.json b/plugins/alerts/testdata/filter-contracts/linux.json new file mode 100644 index 000000000..7ffaf062d --- /dev/null +++ b/plugins/alerts/testdata/filter-contracts/linux.json @@ -0,0 +1,113 @@ +{ + "technology": "Linux", + "filters": [ + "filters/linux/linux.yml" + ], + "rules": [ + "rules/linux/attempt_to_disable_syslog_service.yml", + "rules/linux/bruteforce_attack.yml", + "rules/linux/chattr_immutable_file.yml", + "rules/linux/debian_family/auditd_syslog_disabling.yml", + "rules/linux/debian_family/container_escape_techniques.yml", + "rules/linux/debian_family/crontab_persistence.yml", + "rules/linux/debian_family/debian_kernel_exploits.yml", + "rules/linux/debian_family/debian_specific_rootkits.yml", + "rules/linux/debian_family/ebpf_rootkit_detection.yml", + "rules/linux/debian_family/etc_shadow_access.yml", + "rules/linux/debian_family/kernel_exploit_indicators.yml", + "rules/linux/debian_family/ld_preload_hijacking.yml", + "rules/linux/debian_family/process_masquerading.yml", + "rules/linux/debian_family/reverse_shell_detection.yml", + "rules/linux/debian_family/shell_rc_file_modification.yml", + "rules/linux/debian_family/ssh_authorized_keys_modification.yml", + "rules/linux/debian_family/ssh_tunneling_port_forwarding.yml", + "rules/linux/debian_family/suid_sgid_binary_creation.yml", + "rules/linux/debian_family/suspicious_binary_in_tmp.yml", + "rules/linux/debian_family/systemd_timer_persistence.yml", + "rules/linux/disable_selinux_attempt.yml", + "rules/linux/file_deletion_via_shred.yml", + "rules/linux/file_transfer_or_listener_established_via_netcat.yml", + "rules/linux/insmod_kernel_module_load.yml", + "rules/linux/kde_autostart_modification.yml", + "rules/linux/kernel_module_removal.yml", + "rules/linux/linux_hping_activity.yml", + "rules/linux/linux_iodine_activity.yml", + "rules/linux/linux_nping_activity.yml", + "rules/linux/log_files_deleted.yml", + "rules/linux/modify_ssh_binaries.yml", + "rules/linux/perl_tty_shell.yml", + "rules/linux/pkexec_envar_hijack.yml", + "rules/linux/python_tty_shell.yml", + "rules/linux/reverse_shell_via_named_pipe.yml", + "rules/linux/rhel_family/boot_loader_attacks.yml", + "rules/linux/rhel_family/container_platform_attacks.yml", + "rules/linux/rhel_family/openshift_security_violations.yml", + "rules/linux/rhel_family/rhel_kernel_exploits.yml", + "rules/linux/rhel_family/rhel_specific_malware.yml", + "rules/linux/rhel_family/rpm_database_tampering.yml", + "rules/linux/rhel_family/secure_boot_violations.yml", + "rules/linux/rhel_family/selinux_policy_violations.yml", + "rules/linux/rhel_family/systemd_unit_file_attacks.yml", + "rules/linux/rhel_family/yum_dnf_repository_attacks.yml", + "rules/linux/tc_bpf_filter.yml", + "rules/linux/tunneling_via_earthworm.yml", + "rules/linux/unshare_namesapce_manipulation.yml", + "rules/linux/user_added_to_admin_group.yml" + ], + "fixtures": [ + { + "name": "Linux negative syscall return preserved", + "filter": "linux/linux.yml", + "input": { + "log": { + "type": "auditd", + "exit": -13, + "exe": "/usr/bin/cat", + "comm": "cat", + "cwd": "/home/user" + } + }, + "expected": { + "log.exitCode": -13, + "actionResult": "failure", + "origin.path": "/usr/bin/cat", + "origin.process": "cat", + "log.workingDirectory": "/home/user" + }, + "absent": [ + "statusCode" + ], + "rules": {} + }, + { + "name": "Linux textual job failure", + "filter": "linux/linux.yml", + "input": { + "log": { + "JOBRESULT": "failed" + } + }, + "expected": { + "actionResult": "failure" + }, + "absent": [], + "rules": {} + }, + { + "name": "Linux unknown job result", + "filter": "linux/linux.yml", + "input": { + "log": { + "JOBRESULT": "dependency" + } + }, + "expected": { + "log.vendorActionResult": "dependency" + }, + "absent": [ + "actionResult" + ], + "rules": {} + } + ] +} diff --git a/rules/linux/attempt_to_disable_syslog_service.yml b/rules/linux/attempt_to_disable_syslog_service.yml index 1d0f00dd2..bda8d50b9 100644 --- a/rules/linux/attempt_to_disable_syslog_service.yml +++ b/rules/linux/attempt_to_disable_syslog_service.yml @@ -17,5 +17,5 @@ references: - "https://attack.mitre.org/techniques/T1562/001/" where: regexMatch("log.message", "((service|chkconfig) (syslog|rsyslog|syslog-ng) (stop|disable|off|kill))|((systemctl) (stop|disable|off|kill) (syslog|rsyslog|syslog-ng))") groupBy: - - origin.ip - - origin.user + - adversary.ip + - adversary.user diff --git a/rules/linux/chattr_immutable_file.yml b/rules/linux/chattr_immutable_file.yml index 3761c72c5..9263bfe4b 100644 --- a/rules/linux/chattr_immutable_file.yml +++ b/rules/linux/chattr_immutable_file.yml @@ -20,5 +20,5 @@ references: - "https://attack.mitre.org/techniques/T1222/" where: regexMatch("log.message", "(chattr (\\+|-)i )") groupBy: - - origin.ip - - origin.user + - adversary.ip + - adversary.user diff --git a/rules/linux/debian_family/auditd_syslog_disabling.yml b/rules/linux/debian_family/auditd_syslog_disabling.yml index b1dc69f1d..c10186901 100644 --- a/rules/linux/debian_family/auditd_syslog_disabling.yml +++ b/rules/linux/debian_family/auditd_syslog_disabling.yml @@ -31,5 +31,5 @@ where: | contains("log.message", "syslog")) && !(contains("log.message", "restart") || contains("log.message", "reload")) groupBy: - - origin.host - - origin.user + - adversary.host + - adversary.user diff --git a/rules/linux/debian_family/container_escape_techniques.yml b/rules/linux/debian_family/container_escape_techniques.yml index 9f775b66d..86c6649c7 100644 --- a/rules/linux/debian_family/container_escape_techniques.yml +++ b/rules/linux/debian_family/container_escape_techniques.yml @@ -34,5 +34,5 @@ where: | (contains("log.message", "mount") && contains("log.message", "/dev/") && (contains("log.message", "container") || contains("log.message", "docker"))) groupBy: - - origin.host - - origin.user + - adversary.host + - adversary.user diff --git a/rules/linux/debian_family/debian_kernel_exploits.yml b/rules/linux/debian_family/debian_kernel_exploits.yml index 4d79af1ea..19522d6f8 100644 --- a/rules/linux/debian_family/debian_kernel_exploits.yml +++ b/rules/linux/debian_family/debian_kernel_exploits.yml @@ -45,5 +45,5 @@ where: | contains("log.message", "Return-oriented programming") || contains("log.message", "ROP chain")) groupBy: - - origin.host - - origin.user + - adversary.host + - adversary.user diff --git a/rules/linux/debian_family/debian_specific_rootkits.yml b/rules/linux/debian_family/debian_specific_rootkits.yml index bf79c5d41..a58a77291 100644 --- a/rules/linux/debian_family/debian_specific_rootkits.yml +++ b/rules/linux/debian_family/debian_specific_rootkits.yml @@ -27,6 +27,6 @@ description: | 7. Analyze network connections for command and control communications 8. Update security tools and perform full system scan where: | - regexMatch("origin.process", "/(reptile|bdvl|azazel|jynx|xorddos)") || (contains("origin.command", "insmod") && regexMatch("origin.command", "(rootkit|hide|backdoor)")) || (contains("origin.command", "ld.so.preload") && regexMatch("origin.command", "(>>|tee|echo)")) + (regexMatch("origin.path", "/(reptile|bdvl|azazel|jynx|xorddos)") || regexMatch("origin.process", "/(reptile|bdvl|azazel|jynx|xorddos)")) || (contains("origin.command", "insmod") && regexMatch("origin.command", "(rootkit|hide|backdoor)")) || (contains("origin.command", "ld.so.preload") && regexMatch("origin.command", "(>>|tee|echo)")) deduplicateBy: - dataSource diff --git a/rules/linux/debian_family/etc_shadow_access.yml b/rules/linux/debian_family/etc_shadow_access.yml index 8edfd744c..841e7fdc5 100644 --- a/rules/linux/debian_family/etc_shadow_access.yml +++ b/rules/linux/debian_family/etc_shadow_access.yml @@ -32,5 +32,5 @@ where: | contains("log.process", "usermod") || contains("log.process", "groupadd") || contains("log.process", "chpasswd") || contains("log.process", "login")) groupBy: - - origin.host - - origin.user + - adversary.host + - adversary.user diff --git a/rules/linux/debian_family/kernel_exploit_indicators.yml b/rules/linux/debian_family/kernel_exploit_indicators.yml index d56aec149..2501952c2 100644 --- a/rules/linux/debian_family/kernel_exploit_indicators.yml +++ b/rules/linux/debian_family/kernel_exploit_indicators.yml @@ -32,5 +32,5 @@ where: | contains("log.message", "copy_from_user"))) || (contains("log.message", "SPLICE_F_MOVE") && contains("log.message", "pipe_buf_operations")) groupBy: - - origin.host - - origin.user + - adversary.host + - adversary.user diff --git a/rules/linux/debian_family/suid_sgid_binary_creation.yml b/rules/linux/debian_family/suid_sgid_binary_creation.yml index 89058a645..c5fd1921d 100644 --- a/rules/linux/debian_family/suid_sgid_binary_creation.yml +++ b/rules/linux/debian_family/suid_sgid_binary_creation.yml @@ -29,5 +29,5 @@ where: | contains("log.message", "2755") || contains("log.message", "6755") || contains("log.message", "u+s") || contains("log.message", "g+s"))) groupBy: - - origin.host - - origin.user + - adversary.host + - adversary.user diff --git a/rules/linux/debian_family/suspicious_binary_in_tmp.yml b/rules/linux/debian_family/suspicious_binary_in_tmp.yml index f7a2cf478..50f2e6468 100644 --- a/rules/linux/debian_family/suspicious_binary_in_tmp.yml +++ b/rules/linux/debian_family/suspicious_binary_in_tmp.yml @@ -24,6 +24,6 @@ description: | 6. Remove the binary and investigate the initial access vector 7. Scan the system for additional indicators of compromise where: | - regexMatch("origin.process", "^/(tmp|dev/shm|var/tmp)/") && !regexMatch("origin.process", "(apt|dpkg|yum|dnf|pip)") + (regexMatch("origin.path", "^/(tmp|dev/shm|var/tmp)/") || regexMatch("origin.process", "^/(tmp|dev/shm|var/tmp)/")) && !regexMatch("origin.process", "(apt|dpkg|yum|dnf|pip)") deduplicateBy: - dataSource diff --git a/rules/linux/disable_selinux_attempt.yml b/rules/linux/disable_selinux_attempt.yml index bd78dd7fb..8f199e4e6 100644 --- a/rules/linux/disable_selinux_attempt.yml +++ b/rules/linux/disable_selinux_attempt.yml @@ -17,5 +17,5 @@ references: - "https://attack.mitre.org/techniques/T1562/001/" where: contains("log.message", "setenforce 0") groupBy: - - origin.ip - - origin.user + - adversary.ip + - adversary.user diff --git a/rules/linux/insmod_kernel_module_load.yml b/rules/linux/insmod_kernel_module_load.yml index d44bfd05c..0fc7a9a17 100644 --- a/rules/linux/insmod_kernel_module_load.yml +++ b/rules/linux/insmod_kernel_module_load.yml @@ -18,5 +18,5 @@ references: - "https://attack.mitre.org/techniques/T1547/006/" where: regexMatch("log.message", "(insmod (.+).ko)") groupBy: - - origin.ip - - origin.user + - adversary.ip + - adversary.user diff --git a/rules/linux/linux_hping_activity.yml b/rules/linux/linux_hping_activity.yml index 7f41b429b..c38a8e7a9 100644 --- a/rules/linux/linux_hping_activity.yml +++ b/rules/linux/linux_hping_activity.yml @@ -17,5 +17,5 @@ references: - "https://attack.mitre.org/techniques/T1082/" where: contains("log.message", "hping") deduplicateBy: - - origin.ip - - origin.user + - adversary.ip + - adversary.user diff --git a/rules/linux/linux_nping_activity.yml b/rules/linux/linux_nping_activity.yml index bb34dfe31..5c61bceb1 100644 --- a/rules/linux/linux_nping_activity.yml +++ b/rules/linux/linux_nping_activity.yml @@ -17,5 +17,5 @@ references: - "https://attack.mitre.org/techniques/T1046/" where: contains("log.message", "nping") deduplicateBy: - - origin.ip - - origin.user + - adversary.ip + - adversary.user diff --git a/rules/linux/log_files_deleted.yml b/rules/linux/log_files_deleted.yml index 180f64546..1df0c1333 100644 --- a/rules/linux/log_files_deleted.yml +++ b/rules/linux/log_files_deleted.yml @@ -17,5 +17,5 @@ references: - "https://attack.mitre.org/techniques/T1070/002/" where: regexMatch("log.message", "(/var/run/utmp|/var/log/wtmp|/var/log/btmp|/var/log/lastlog|/var/log/faillog|/var/log/syslog|/var/log/messages|/var/log/secure|/var/log/auth.log|/var/log/boot.log|/var/log/kern.log)") && !contains("log.message", "gzip") && regexMatch("log.message", "(rm |shred -u)") groupBy: - - origin.ip - - origin.user + - adversary.ip + - adversary.user diff --git a/rules/linux/rhel_family/openshift_security_violations.yml b/rules/linux/rhel_family/openshift_security_violations.yml index b07f9493c..091cdc789 100644 --- a/rules/linux/rhel_family/openshift_security_violations.yml +++ b/rules/linux/rhel_family/openshift_security_violations.yml @@ -41,5 +41,5 @@ where: | (oneOf("log.resource", ["secrets", "configmaps", "serviceaccounts"]) && equals("log.verb", "get") && equals("log.response_code", 403)) ) groupBy: - - origin.host - - origin.user + - adversary.host + - adversary.user diff --git a/rules/linux/rhel_family/rhel_kernel_exploits.yml b/rules/linux/rhel_family/rhel_kernel_exploits.yml index fbf2b23b5..8f2dc4767 100644 --- a/rules/linux/rhel_family/rhel_kernel_exploits.yml +++ b/rules/linux/rhel_family/rhel_kernel_exploits.yml @@ -36,5 +36,5 @@ afterEvents: within: 5m count: 3 groupBy: - - origin.host - - origin.ip + - adversary.host + - adversary.ip diff --git a/rules/linux/rhel_family/rhel_specific_malware.yml b/rules/linux/rhel_family/rhel_specific_malware.yml index df43abc87..61d8a2b63 100644 --- a/rules/linux/rhel_family/rhel_specific_malware.yml +++ b/rules/linux/rhel_family/rhel_specific_malware.yml @@ -28,6 +28,6 @@ description: | 9. Review access logs to determine initial compromise method 10. Implement additional monitoring for similar attack patterns where: | - regexMatch("origin.process", "/(reptile|bdvl|kovid|suterusu|rooty|vlany|azazel|jynx|xorddos)") + (regexMatch("origin.path", "/(reptile|bdvl|kovid|suterusu|rooty|vlany|azazel|jynx|xorddos)") || regexMatch("origin.process", "/(reptile|bdvl|kovid|suterusu|rooty|vlany|azazel|jynx|xorddos)")) deduplicateBy: - dataSource diff --git a/rules/linux/rhel_family/rpm_database_tampering.yml b/rules/linux/rhel_family/rpm_database_tampering.yml index ad164a4d9..820f796fe 100644 --- a/rules/linux/rhel_family/rpm_database_tampering.yml +++ b/rules/linux/rhel_family/rpm_database_tampering.yml @@ -53,5 +53,5 @@ where: | ) ) groupBy: - - origin.host + - adversary.host - target.file diff --git a/rules/linux/rhel_family/secure_boot_violations.yml b/rules/linux/rhel_family/secure_boot_violations.yml index cd2cdab5a..914be6ab2 100644 --- a/rules/linux/rhel_family/secure_boot_violations.yml +++ b/rules/linux/rhel_family/secure_boot_violations.yml @@ -35,5 +35,5 @@ where: | (oneOf("log.efi_variable", ["SecureBoot", "SetupMode", "PK", "KEK", "db", "dbx"]) && oneOf("log.action", ["modify", "delete"])) || (contains("log.shim_message", "verification failed") || contains("log.shim_message", "signature invalid")) groupBy: - - origin.host - - origin.user + - adversary.host + - adversary.user diff --git a/rules/linux/rhel_family/selinux_policy_violations.yml b/rules/linux/rhel_family/selinux_policy_violations.yml index c1a566385..7d4e5e3a8 100644 --- a/rules/linux/rhel_family/selinux_policy_violations.yml +++ b/rules/linux/rhel_family/selinux_policy_violations.yml @@ -55,4 +55,4 @@ where: | groupBy: - lastEvent.log.scontext - lastEvent.log.tcontext - - origin.host + - adversary.host diff --git a/rules/linux/rhel_family/yum_dnf_repository_attacks.yml b/rules/linux/rhel_family/yum_dnf_repository_attacks.yml index 1608ce966..5bb65f5de 100644 --- a/rules/linux/rhel_family/yum_dnf_repository_attacks.yml +++ b/rules/linux/rhel_family/yum_dnf_repository_attacks.yml @@ -49,4 +49,4 @@ where: | ) groupBy: - lastEvent.log.comm - - origin.host + - adversary.host diff --git a/rules/linux/tc_bpf_filter.yml b/rules/linux/tc_bpf_filter.yml index f10b8b5a7..30e734243 100644 --- a/rules/linux/tc_bpf_filter.yml +++ b/rules/linux/tc_bpf_filter.yml @@ -19,5 +19,5 @@ references: - "https://attack.mitre.org/techniques/T1059/004/" where: containsAll("log.message", ["tc", "filter", "bpf"]) groupBy: - - origin.ip - - origin.user + - adversary.ip + - adversary.user