detection.wiki

Corelight

Search Corelight rules.

Telemetry Evidence

These values show how indexed rules identify Corelight telemetry.

Elastic

  • Index logs-corelight.* (7 rules)
  • Integration corelight (7 rules)

Kusto

  • Queried source table corelight_conn (2 rules)
  • Queried source table corelight_conn_red (2 rules)
  • Queried source table corelight_dns (1 rule)
  • Queried source table corelight_dns_red (1 rule)
  • Queried source table corelight_http (6 rules)
  • Queried source table corelight_smtp (1 rule)

YARA-L

  • Data source crowdstrike, gcp firewall, microsoft sysmon, gcp scc, microsoft defender atp, corelight zeek, microsoft windows events (1 rule)

Detection Rules

Elastic #

  • Abnormally Large DNS Response source medium: Specially crafted DNS requests can manipulate a known overflow vulnerability in some Windows DNS servers, resulting in Remote Code Execution (RCE) or a Denial of Service (DoS) from crashing the service.T1210, T1499, T1499.004
  • RDP (Remote Desktop Protocol) from the Internet source medium: This rule detects network events that may indicate the use of RDP traffic from the Internet. RDP is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector.T1021, T1021.001, T1133, T1190
  • RPC (Remote Procedure Call) from the Internet source high: This rule detects network events that may indicate the use of RPC traffic from the Internet. RPC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector.T1133, T1190
  • RPC (Remote Procedure Call) to the Internet source high: This rule detects network events that may indicate the use of RPC traffic to the Internet. RPC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector.T1021, T1021.003, T1190
  • SMB (Windows File Sharing) Activity from the Internet source high: This rule detects network events that may indicate inbound Windows file sharing (SMB or CIFS) traffic originating from the Internet. SMB should never be directly reachable from the Internet, as it is a primary target for exploitation by threat actors seeking initial access. Inbound SMB from a public IP is a direct precondition for attacks such as EternalBlue (MS17-010) and related SMB remote code execution vulnerabilities.T1133, T1190
  • SMB (Windows File Sharing) Activity to the Internet source medium: This rule detects network events that may indicate the use of Windows file sharing (also called SMB or CIFS) traffic to the Internet. SMB is commonly used within networks to share files, printers, and other system resources amongst trusted systems. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector or for data exfiltration.T1048, T1190
  • SMTP to the Internet on Port 26/TCP source low: This rule detects events that may indicate use of SMTP on TCP port 26 from an internal host to an external destination. This port is commonly used by several popular mail transfer agents to deconflict with the default SMTP port 25. This port has also been used by a malware family called BadPatch for command and control of Windows systems. The rule is scoped to outbound traffic (internal source to external destination) to focus on the command and control and exfiltration use cases, rather than benign internal mail relays or unrelated transit traffic observed by the sensor.T1048, T1071, T1071.003, T1571

Kusto #

YARA-L #

Compatible Rules

These rules declare Corelight connector or schema compatibility without a product-specific query filter.

Kusto #