detection-rules

detection-rules copied to clipboard

[New Rule] Potential PowerShell Obfuscation via String Reordering

9

## Issues Part of https://github.com/elastic/ia-trade-team/issues/533 ## Summary Identifies PowerShell scripts that use string reordering and runtime reconstruction techniques as a form of obfuscation. These methods are designed to evade static...

w0rk3r

[New Rule] Potential PowerShell Obfuscation via String Concatenation

5

## Issues Part of https://github.com/elastic/ia-trade-team/issues/533 ## Summary Identifies PowerShell scripts that use string concatenation as a form of obfuscation. These methods are designed to evade static analysis and bypass security...

w0rk3r

[New Rule] Potential PowerShell Obfuscation via Character Array Reconstruction

3

## Issues Part of https://github.com/elastic/ia-trade-team/issues/533 ## Summary Identifies PowerShell scripts that use character arrays and runtime string reconstruction as a form of obfuscation. This technique breaks strings into individual characters,...

w0rk3r

[Bug] Update Schema Prompt to include new_terms_fields

1

# Pull Request *Issue link(s)*: Resolves https://github.com/elastic/detection-rules/issues/4566 ## Summary - What I changed This PR fixes a bug where there was a missing default value if there where no new_terms...

eric-forte-elastic

[New Rule][BBR] Potential PowerShell Obfuscation via High Special Character Proportion

1

## Issues Part of https://github.com/elastic/ia-trade-team/issues/533 ## Summary Identifies PowerShell scripts with an abnormally high proportion of non-alphanumeric characters, often resulting from encoding, string mangling, or dynamic code generation. High volume...

w0rk3r

[New Rule] Potential PowerShell Obfuscation via Backtick-Escaped Variable Expansion

2

## Issues Part of https://github.com/elastic/ia-trade-team/issues/533 ## Summary Identifies PowerShell scripts that use backtick-escaped characters inside ${} variable expansion as a form of obfuscation. These methods are designed to evade static...

w0rk3r

[New Rule] Potential PowerShell Obfuscation via High Numeric Character Proportion

2

## Issues Part of https://github.com/elastic/ia-trade-team/issues/533 ## Summary Identifies PowerShell scripts with a disproportionately high number of numeric characters, often indicating the presence of obfuscated or encoded payloads. This behavior is...

w0rk3r

[New Rule] Potential PowerShell Obfuscation via Special Character Overuse

2

## Issues Part of https://github.com/elastic/ia-trade-team/issues/533 ## Summary Identifies PowerShell scripts with an unusually high proportion of whitespace and special characters, often indicative of obfuscation. This behavior is commonly associated with...

w0rk3r

[New Rule] Adding Coverage for AWS Temporary User Session Token Used from Multiple Addresses

1

# Pull Request *Issue link(s)*: * https://github.com/elastic/ia-trade-team/issues/585 ## Summary - What I changed Adds detection coverage for `AWS STS Temporary IAM Session Token Used from Multiple Addresses`. Identified via ByBit/SafeWallet...

terrancedejesus

[New Rule] Potential Dynamic IEX Reconstruction via Environment Variables

2

## Issues Part of https://github.com/elastic/ia-trade-team/issues/533 ## Summary Identifies PowerShell scripts that reconstruct the IEX (Invoke-Expression) command at runtime using indexed slices of environment variables. This technique leverages character access and...

w0rk3r