infosecn1nja
/
HELK
mirror of https://github.com/infosecn1nja/HELK.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #334 from Cyb3rWard0g/temp-sigma-fixes 

encoding fix and elastalert mapping
keyword-vs-text-changes
Nate Guagenti 2019-09-11 11:03:25 -05:00 committed by GitHub
parent 3ded2f6673 3113a243b9
commit 1b4b44a83e
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 20 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
docker/helk-elastalert/rules/helk_sysmon_services_rare_child.yml
View File

@ -4,10 +4,10 @@ description: Detects rare childs from services.exe (gold image based)
filter:
- query:
query_string:
query: (event_id:1 AND process_parent_name:"services.exe" AND NOT (process_path:"\windows\system32" OR process_path:"\program files\windows defender\mpcmdrun.exe" OR "\program files (x86)\google\update\googleupdate.exe" OR "c:\windows\servicing"))
query: (event_id:1 AND process_parent_name:"services.exe" AND NOT (process_path:"\\windows\\system32" OR process_path:"\\program\ files\\windows\ defender\\mpcmdrun.exe" OR "\\program\ files\ \(x86\)\\google\\update\\googleupdate.exe" OR "c:\\windows\\servicing"))
index: logs-endpoint-winevent-sysmon-*
name: Windows-services-rare-child_0
priority: 2
realert:
minutes: 0
type: any
type: any

18
docker/helk-logstash/output_templates/01-elastalert-status.json Normal file
View File

@ -0,0 +1,18 @@
{
"order": 999,
"index_patterns": [
"elastalert_status*"
],
"version": 2019082901,
"mappings": {
"properties": {
"match_body": {
"properties": {
"z_logstash_pipeline": {
"type": "keyword"
}
}
}
}
}
}