gap analysis

rules/command_and_control/aws_cli_endpoint_url_used.yaml

@@ -0,0 +1,14 @@
+# Title: AWS CLI command with custom endpoint URL
+
+# Creation Date: 2025/05/11
+
+# MITRE ATT&CK Tactic: TA0011 - Command and Control - https://attack.mitre.org/tactics/TA0011/
+
+# MITRE ATT&CK Technique: T1572 - Protocol Tunneling - https://attack.mitre.org/techniques/T1572/
+
+- name: AWS CLI Endpoint URL Used
+  type: Exec
+  category: command_and_control
+  severity: medium
+  description: Detects the use of AWS CLI with a specified endpoint URL, which may indicate attempts to communicate with unauthorized AWS endpoints.
+  condition: payload.filename ENDS_WITH "/aws" AND payload.argv CONTAINS "--endpoint-url"

rules/command_and_control/connection_to_C2_addr.yaml

@@ -0,0 +1,16 @@
+# Title: Connection to Known C2 IP Addresses
+
+# Creation date: 2022/10/21
+
+# MITRE ATT&CK Tactic: TA0011 - Command and Control - https://attack.mitre.org/tactics/TA0011/
+
+# MITRE ATT&CK Technique: T1071 - Application Layer Protocol - https://attack.mitre.org/techniques/T1071/
+
+# Add C2 IPs
+# https://feodotracker.abuse.ch/downloads/ipblocklist_recommended.txt
+- name: Connection to C2 IPs
+  type: Connect
+  category: execution
+  severity: high
+  description: Detects connections to known C2 IPs. Adversaries may use these IPs to communicate with their command and control servers.
+  condition: payload.destination.ip IN ["1.234.21.73", "103.109.247.10", "103.124.107.109", "103.173.121.17", "103.224.241.74", "103.253.145.28"]

rules/command_and_control/linux_suspicious_proxychains_activity.yaml

@@ -10,11 +10,10 @@
   type: Exec
   category: command_and_control
   severity: low
-  description: This rule monitors for the execution of suspicious Linux tools through ProxyChains. ProxyChains is a command-line tool
-    that enables the routing of network connections through intermediary proxies, enhancing anonymity and enabling access to
-    restricted resources. Attackers can exploit the ProxyChains utility to hide their true source IP address, evade detection,
+  description: This rule monitors for the execution of suspicious Linux tools through ProxyChains.
+    Attackers can exploit the ProxyChains utility to hide their true source IP address, evade detection,
     and perform malicious activities through a chain of proxy servers, potentially masking their identity and intentions.
-  condition: header.image ENDS_WITH "proxychains"
+  condition: (header.image ENDS_WITH "proxychains" OR header.image ENDS_WITH "proxychains4" OR header.image ENDS_WITH "tsocks")
     AND (payload.argv CONTAINS "ssh" OR payload.argv CONTAINS "sshd" OR payload.argv CONTAINS "sshuttle" OR payload.argv CONTAINS "socat" 
     OR payload.argv CONTAINS "iodine" OR payload.argv CONTAINS "iodined" OR payload.argv CONTAINS "dnscat" OR payload.argv CONTAINS "hans" 
     OR payload.argv CONTAINS "hans-ubuntu" OR payload.argv CONTAINS "ptunnel-ng" OR payload.argv CONTAINS "ssf" OR payload.argv CONTAINS "3proxy" 
@@ -23,4 +22,3 @@
     OR payload.argv CONTAINS "nc" OR payload.argv CONTAINS "netcat" OR payload.argv CONTAINS "ncat" OR payload.argv CONTAINS "telnet" 
     OR payload.argv CONTAINS "awk" OR payload.argv CONTAINS "java" OR payload.argv CONTAINS "telnet" OR payload.argv CONTAINS "ftp" 
     OR payload.argv CONTAINS "curl" OR payload.argv CONTAINS "wget")
-