Skip to content

[Rule Tuning] Linux DR Tuning - 4 #5484

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
Aegrah wants to merge 7 commits into
base: main
Choose a base branch
from
Open

[Rule Tuning] Linux DR Tuning - 4 #5484

Aegrah wants to merge 7 commits into from

Conversation

@Aegrah
Copy link
Contributor

@Aegrah Aegrah commented Dec 17, 2025 •
edited
Loading

Pull Request Summary

Why

This PR updates and strengthens Linux defense evasion detection rules, with a focus on improved detection accuracy, expanded data source coverage, increased risk prioritization, and more robust filtering of false positives.

What changed

  • General Enhancements

    • Many rules now have updated updated_date fields for traceability.
    • Several rules have increased risk scores and severity levels (e.g., from "low" to "medium"/"high", risk score from 21 to 47 or 73).
    • More event actions and process names included in detection logic for broader coverage.
    • Index patterns expanded to cover more log sources (e.g., logs-auditd_manager.auditd-*, logs-crowdstrike.fdr*, logs-sentinel_one_cloud_funnel.*, endgame-*, auditbeat-*).
    • Additional fields are now kept and aggregated in ESQL rules for richer alert context.

  • Rule-Specific Notes

    • command_and_control_frequent_egress_netcon_from_sus_executable.toml
      • ESQL query now includes metadata fields and aggregates more context (e.g., event dataset, data stream namespace).
      • No longer limits results to 100.
    • defense_evasion_acl_modification_via_setfacl.toml
      • Expanded parent process exclusions and improved filtering with optional fields.
      • Description now details attacker intent and persistence.
    • defense_evasion_attempt_to_disable_auditd_service.toml
      • Severity increased from "low" to "medium", risk score from 21 to 47.
      • Now detects more service management commands (e.g., update-rc.d, systemctl mask).
      • Improved parent process filtering.
    • defense_evasion_attempt_to_disable_iptables_or_firewall.toml
      • Severity increased from "low" to "medium", risk score from 21 to 47.
      • Now detects more service management commands and covers more firewall stop/disable scenarios.
    • defense_evasion_attempt_to_disable_syslog_service.toml
      • Improved description for clarity.
      • Now detects more service management commands (e.g., update-rc.d, systemctl mask).
      • Improved event type filtering.
    • defense_evasion_authorized_keys_file_deletion.toml
      • Now excludes more benign file paths (e.g., containing "backup", "ansible", "puppet").
    • defense_evasion_base16_or_base32_encoding_or_decoding_activity.toml
      • Severity increased from "low" to "medium", risk score from 21 to 47.
      • Improved description and false positive notes.
    • defense_evasion_base64_decoding_activity.toml
      • ESQL query now includes more metadata and aggregates more context.
    • defense_evasion_binary_copied_to_suspicious_directory.toml
      • Now detects both "rename" and "creation" actions, and only for cp or mv.
      • Excludes more benign process executables and paths.
    • defense_evasion_chattr_immutable_file.toml
      • Added auditd_manager and crowdstrike integrations and indexes.
      • Broader event action coverage and improved parent process filtering.
      • Excludes more benign parent executables and argument patterns.
    • defense_evasion_clear_kernel_ring_buffer.toml
      • Severity increased from "low" to "high", risk score from 21 to 73.
      • Improved description for attacker context.
    • defense_evasion_creation_of_hidden_files_directories.toml
      • Severity increased from "low" to "medium", risk score from 21 to 47.
      • Improved description for attacker context.
    • defense_evasion_directory_creation_in_bin.toml
      • Excludes more benign process arguments and parent executables.
    • defense_evasion_disable_apparmor_attempt.toml
      • Severity increased from "low" to "high", risk score from 21 to 73.
      • Now detects more service management commands (e.g., update-rc.d, systemctl mask).
      • Improved parent process filtering.
    • defense_evasion_disable_selinux_attempt.toml
      • Severity increased from "medium" to "high", risk score from 47 to 73.

Behavioral impact

  • Increased detection coverage for defense evasion techniques across more data sources and event types.
  • Higher severity and risk scores will prioritize these alerts in SOC workflows.
  • More robust filtering and exclusions should reduce false positives.
  • Alerts will now include richer context for investigation.

Risks/edge cases

  • Expanding index patterns and integrations could introduce noise if new data sources are not properly filtered or normalized.
  • Broader event action and process name coverage could increase false positives if not carefully tuned.
  • More aggressive filtering may inadvertently exclude some true positives if not validated in production.

Rollout notes

  • Ensure new data sources are ingested and mapped correctly before enabling updated rules.
  • Monitor for increased alert volume or false positives after deployment.
  • Communicate changes in detection logic, severity, and exclusions to SOC analysts.
  • Consider phased rollout or additional tuning if noise increases.
  • Review and update any playbooks or automations that reference these rules.

@Aegrah Aegrah self-assigned this Dec 17, 2025
@Aegrah Aegrah added OS: Linux Rule: Tuning tweaking or tuning an existing rule Team: TRADE labels Dec 17, 2025
@github-actions
Copy link
Contributor

github-actions bot commented Dec 17, 2025

Rule: Tuning - Guidelines

These guidelines serve as a reminder set of considerations when tuning an existing rule.

Documentation and Context

  • Detailed description of the suggested changes.
  • Provide example JSON data or screenshots.
  • Provide evidence of reducing benign events mistakenly identified as threats (False Positives).
  • Provide evidence of enhancing detection of true threats that were previously missed (False Negatives).
  • Provide evidence of optimizing resource consumption and execution time of detection rules (Performance).
  • Provide evidence of specific environment factors influencing customized rule tuning (Contextual Tuning).
  • Provide evidence of improvements made by modifying sensitivity by changing alert triggering thresholds (Threshold Adjustments).
  • Provide evidence of refining rules to better detect deviations from typical behavior (Behavioral Tuning).
  • Provide evidence of improvements of adjusting rules based on time-based patterns (Temporal Tuning).
  • Provide reasoning of adjusting priority or severity levels of alerts (Severity Tuning).
  • Provide evidence of improving quality integrity of our data used by detection rules (Data Quality).
  • Ensure the tuning includes necessary updates to the release documentation and versioning.

Rule Metadata Checks

  • updated_date matches the date of tuning PR merged.
  • min_stack_version should support the widest stack versions.
  • name and description should be descriptive and not include typos.
  • query should be inclusive, not overly exclusive. Review to ensure the original intent of the rule is maintained.

Testing and Validation

  • Validate that the tuned rule's performance is satisfactory and does not negatively impact the stack.
  • Ensure that the tuned rule has a low false positive rate.

@tradebot-elastic
Copy link

tradebot-elastic commented Dec 17, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Potential Hex Payload Execution via Common Utility (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Hex Payload Execution via Command-Line (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ High Number of Egress Network Connections from Unusual Executable (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Defense Evasion via Doas (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Attempt to Clear Kernel Ring Buffer (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Attempt to Disable Syslog Service (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Directory Creation in /bin directory (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ SSH Authorized Keys File Deletion (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Hidden Files and Directories via Hidden Flag (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dynamic Linker Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Attempt to Disable Auditd Service (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Attempt to Disable IPTables or Firewall (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ File made Immutable by Chattr (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Access Control List Modification via setfacl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ File Permission Modification in Writable Directory (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ File Deletion via Shred (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Base64 Encoding/Decoding Activity (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Base16 or Base32 Encoding/Decoding Activity (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Disabling of SELinux (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Disabling of AppArmor (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System Binary Moved or Copied (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Dec 17, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Potential Hex Payload Execution via Common Utility (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Hex Payload Execution via Command-Line (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ High Number of Egress Network Connections from Unusual Executable (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Defense Evasion via Doas (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Attempt to Clear Kernel Ring Buffer (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Attempt to Disable Syslog Service (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Directory Creation in /bin directory (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ SSH Authorized Keys File Deletion (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Hidden Files and Directories via Hidden Flag (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dynamic Linker Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Attempt to Disable Auditd Service (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Attempt to Disable IPTables or Firewall (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ File made Immutable by Chattr (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Access Control List Modification via setfacl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ File Permission Modification in Writable Directory (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ File Deletion via Shred (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Base64 Encoding/Decoding Activity (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Base16 or Base32 Encoding/Decoding Activity (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Disabling of SELinux (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Disabling of AppArmor (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System Binary Moved or Copied (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

eric-forte-elastic
eric-forte-elastic reviewed Dec 18, 2025
View reviewed changes
rules/linux/command_and_control_frequent_egress_netcon_from_sus_executable.toml
process.executable like "/tmp/.mount*" or
process.executable like "/tmp/go-build*"
)
| keep
Copy link
Contributor

@eric-forte-elastic eric-forte-elastic Dec 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For this keep I think you will need to keep the meta data too _id, _index, _version

Ref: #5441

eric-forte-elastic
eric-forte-elastic reviewed Dec 18, 2025
View reviewed changes
rules/linux/defense_evasion_base64_decoding_activity.toml
process.command_line like "*Base64.decode64*"
)
)
| keep
Copy link
Contributor

@eric-forte-elastic eric-forte-elastic Dec 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same for this keep I think.

@tradebot-elastic
Copy link

tradebot-elastic commented Dec 18, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Potential Hex Payload Execution via Common Utility (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Hex Payload Execution via Command-Line (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ High Number of Egress Network Connections from Unusual Executable (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Defense Evasion via Doas (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Attempt to Clear Kernel Ring Buffer (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Attempt to Disable Syslog Service (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Directory Creation in /bin directory (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ SSH Authorized Keys File Deletion (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Hidden Files and Directories via Hidden Flag (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dynamic Linker Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Attempt to Disable Auditd Service (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Attempt to Disable IPTables or Firewall (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ File made Immutable by Chattr (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Access Control List Modification via setfacl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ File Permission Modification in Writable Directory (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ File Deletion via Shred (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Base64 Encoding/Decoding Activity (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Base16 or Base32 Encoding/Decoding Activity (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Disabling of SELinux (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Disabling of AppArmor (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System Binary Moved or Copied (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Dec 18, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Potential Hex Payload Execution via Common Utility (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Hex Payload Execution via Command-Line (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ High Number of Egress Network Connections from Unusual Executable (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Defense Evasion via Doas (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Attempt to Clear Kernel Ring Buffer (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Attempt to Disable Syslog Service (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Directory Creation in /bin directory (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ SSH Authorized Keys File Deletion (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Hidden Files and Directories via Hidden Flag (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dynamic Linker Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Attempt to Disable Auditd Service (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Attempt to Disable IPTables or Firewall (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ File made Immutable by Chattr (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Access Control List Modification via setfacl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ File Permission Modification in Writable Directory (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ File Deletion via Shred (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Base64 Encoding/Decoding Activity (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Base16 or Base32 Encoding/Decoding Activity (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Disabling of SELinux (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Disabling of AppArmor (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System Binary Moved or Copied (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Dec 19, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Potential Hex Payload Execution via Common Utility (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Hex Payload Execution via Command-Line (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ High Number of Egress Network Connections from Unusual Executable (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Defense Evasion via Doas (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Attempt to Clear Kernel Ring Buffer (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Attempt to Disable Syslog Service (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Directory Creation in /bin directory (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ SSH Authorized Keys File Deletion (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Hidden Files and Directories via Hidden Flag (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dynamic Linker Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Attempt to Disable Auditd Service (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Attempt to Disable IPTables or Firewall (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ File made Immutable by Chattr (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Access Control List Modification via setfacl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ File Permission Modification in Writable Directory (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ File Deletion via Shred (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Base64 Encoding/Decoding Activity (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Base16 or Base32 Encoding/Decoding Activity (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Disabling of SELinux (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Disabling of AppArmor (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System Binary Moved or Copied (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Dec 23, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Potential Hex Payload Execution via Common Utility (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Hex Payload Execution via Command-Line (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ High Number of Egress Network Connections from Unusual Executable (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Defense Evasion via Doas (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Attempt to Clear Kernel Ring Buffer (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Attempt to Disable Syslog Service (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Directory Creation in /bin directory (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ SSH Authorized Keys File Deletion (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Hidden Files and Directories via Hidden Flag (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dynamic Linker Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Attempt to Disable Auditd Service (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Attempt to Disable IPTables or Firewall (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ File made Immutable by Chattr (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Access Control List Modification via setfacl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ File Permission Modification in Writable Directory (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ File Deletion via Shred (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Base64 Encoding/Decoding Activity (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Base16 or Base32 Encoding/Decoding Activity (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Disabling of SELinux (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Disabling of AppArmor (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System Binary Moved or Copied (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Dec 23, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Potential Hex Payload Execution via Common Utility (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Hex Payload Execution via Command-Line (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ High Number of Egress Network Connections from Unusual Executable (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Defense Evasion via Doas (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Attempt to Clear Kernel Ring Buffer (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Attempt to Disable Syslog Service (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Directory Creation in /bin directory (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ SSH Authorized Keys File Deletion (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Hidden Files and Directories via Hidden Flag (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dynamic Linker Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Attempt to Disable Auditd Service (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Attempt to Disable IPTables or Firewall (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ File made Immutable by Chattr (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Access Control List Modification via setfacl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ File Permission Modification in Writable Directory (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ File Deletion via Shred (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Base64 Encoding/Decoding Activity (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Base16 or Base32 Encoding/Decoding Activity (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Disabling of SELinux (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Disabling of AppArmor (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System Binary Moved or Copied (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@terrancedejesus terrancedejesus terrancedejesus approved these changes

@eric-forte-elastic eric-forte-elastic Awaiting requested review from eric-forte-elastic

@Samirbous Samirbous Awaiting requested review from Samirbous

@shashank-elastic shashank-elastic Awaiting requested review from shashank-elastic

At least 2 approving reviews are required to merge this pull request.

Assignees

@Aegrah Aegrah

Labels

backport: auto Domain: Endpoint OS: Linux Rule: Tuning tweaking or tuning an existing rule Team: TRADE

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

@Aegrah @tradebot-elastic @Samirbous @terrancedejesus @eric-forte-elastic