Correlations Rules

Created by Juan Manuel Libera Frómeta, Modified on Fri, 17 Feb 2023 at 07:53 AM by Juan Manuel Libera Frómeta

Fields Reference

This is a comprehensive reference for fields used in correlating rules in UTMStack. These fields are utilized to trigger alerts based on the configured correlation rules, which aid in detecting attacks and security incidents. The guide covers the different fields such as name, severity, description, solution, category, tactic, and reference, among others. It also includes details on how to use the operators in the cache and search fields, with examples of how to apply them. By using these fields and operators, analysts can create specific and detailed correlation rules to detect attacks in their network

name This is the name that we will use for the alerts of the current rule.

severity The severity of the alerts for this rule. Use the majuscule initial. Possible values: Low, Medium, High.

description The description that will appear in the alerts.

solution If there is a known solution for this incident, specify here.

category If there is any category in which the alert can be grouped.

tactic If there is an incident detected by this rule fits into any of the attack tactics.

Reference A list of URLs where you can get more information about the attack.

Frequency How often in seconds the alert should be checked.

cache This field declares that the iterations will occur on the cache of the correlation engine and contains the definition of said iterations. When this field is used, the search field is not used and vice versa.

cache -> allOff All comparisons within this field must be met for the rule to generate an alert.

cache -> oneOff Any comparison within this field must be met for the rule to generate an alert.

cache -> [allOff | oneOff] -> field The field on which the comparison will be applied.

A field is a series of keys separated by dots. It can contain special wildcard characters '*' and '?'. To access a slice value, use the index as the key. To get the number of elements in a slice or to access a child path, use the '#' character. Dot and wildcard characters can be escaped with '\'.

You can also query a slice for the first match using # (...), or find all matches with # (...) #. You can use the comparison operators (==,!=, <, <=,>,>=) and the simple pattern matching operators (% and !%).

This description also applies to [cache | search] -> save -> field

cache -> [allOff | oneOff] -> operator Operator to use in the comparison. See information about the operators in https://github.com/AtlasInsideCorp/UTMStackCorrelationRules/blob/master/README-Spanish.md#operadores

cache -> [allOff | oneOff] -> value Value to compare the content of "cache -> [allOff | oneOff] -> field". In the second iteration case or onwards, you can use an alias to use the content of that alias as a value.

cache -> timeLapse How much time backward in seconds will be checked in the logs.

[cache | search] -> minCount How many minimum logs must be obtained as a result for this rule to be met.

[cache | search] -> save Required fields to save to use in the next cycle iteration or to complete the information of the alerts.

[cache | search] -> save -> field The original name of the field to store.

[cache | search] -> save -> alias The alias or name to access the field.

There cannot be two or more aliases with the same name within the same iteration.

In the last iteration, the system will use the following aliases to fill in the alert details:

Protocol
SourceUser
SourceHost
SourceIP
SourcePort
DestinationUser
DestinationHost
DestinationIP
DestinationPort

The geolocation will be filled automatically from the SourceIP and DestinationIP aliases.

If the SourceIP or DestinationIP aliases do not exist, the system will generate them using SourceHost and DestinationHost, and vice versa.

If any field is saved with the aliases AlertName and AlertCategory in the last iteration, the alert name or category will be overwritten with those aliases' content as appropriate.

Search This field declares that the iterations will occur on Elasticsearch and contains the said iterations definition. When this field is used, the cache field is not used, and vice versa.

Search -> query The elasticsearch or opensearch query in json format. Remember to enclose the query in simple quotation marks.


Operators	Description
==	It’s true if the field's content is exactly equal to “value” content. It is sensitive to capital letters. hello == Hello //False hello == hello //True
::	It's true if the field's content is equal to "value" content. It is not sensitive to capital letters. hello :: Hello //True hello :: hello //True
!= y <>	It's true if the field's content is unequal to "value" content. It is sensitive to capital letters. hello != Hello //True hello != hello //False
!!	It's true if the field's content is unequal to "value" content. It is not sensitive to capital letters. hello !! Hello //False hello !! hello //False
contains	It's true if the "value" content is part of the field content. "hello world" contains "world" //True "hello world" contains "worlds" //False
not contain	It's true if the "value" content is not part of the field content. " hello world " not contain " world " //False " hello world " not contain " worlds" //True
in	It's true if the field content is part of the "value" content. " world " in "hello, world, this, is, a, test" //True " worlds" in "hello, world, this, is, a, test" //False
not in	It's true if the field content is not part of the "value" content. " world" not in "hello, world, this, is, a, test " //False " worlds" not in "hello, world, this, is, a, test " //True
start with	It's true if the "value" content is a prefix of the field content. " hello world " start with " world " //False " hello world " start with "hello" //True
not start with	It's true if the "value" content is not a prefix of the field content. " hello world " not start with " world " //True " hello world " not start with " hello " //False
end with	It's true if the "value" content is a suffix of the field content. " hello world " end with " world " //True " hello world " end with "hello" //False
not end with	It's true if the "value" content is not a suffix of the field content. " hello world " not end with " world " //False " hello world " not end with " hello " //True
regexp	It's true if the field content matches the regular expression of "value". "adam[23]" regexp "^[a-z]+\[[0-9]+\]$" //True " hello world " regexp "^[a-z]+\[[0-9]+\]$" //False
not regexp	It's true if the field content does not match the regular expression of "value". "adam[23]" not regexp "^[a-z]+\[[0-9]+\]$" //False " hello world " not regexp "^[a-z]+\[[0-9]+\]$" //True
exist	It's true if the field exists. The value must leave empty, as it must exist, but it will not be used.
not exist	It's true if the field does not exist. The value must leave empty, as it must exist, but it will not be used.
in cidr	It's true if the IP in the field is within the value range.
not in cidr	It's true if the IP in the field is not within the value range.

Classic mathematical operators that only apply to numbers. Use only when the field content and the "value" are numeric.

When to use cache or search

We recommend using the cache for the rules that will analyze logs in a maximum of 1h.

We recommend using search when the analysis period exceeds 1h or the rule's complexity is very high, and there is no way to do it using the cache.

- name: Windows authentication failure

severity: Low

description: A Windows user was unable to authenticate with the server or workstation more than 5 times.

solution: Refer to NIST guidelines when creating password policies and set account lockout policies after a certain number of failed login attempts to prevent passwords from being guessed. Too strict a policy may create a denial of service condition and render environments un-usable, with all accounts used in the brute force being locked-out.

category: User Account Authentication

tactic: "Brute Force: Password Guessing"

reference:

- "https://attack.mitre.org/techniques/T1110/001/"

frequency: 10

cache:

- allOf:

- field: logx.wineventlog.event_id

operator: "=="

value: 4625

minCount: 1

timeLapse: 15

save:

- field: logx.wineventlog.event_data.TargetUserName

alias: DestinationUser

- field: logx.wineventlog.host.name

alias: DestinationHost

- allOf:

- field: logx.wineventlog.event_id

operator: "=="

value: 4625

- field: logx.wineventlog.event_data.TargetUserName

operator: "=="

value: "{{.DestinationUser}}"

- field: logx.wineventlog.host.name

operator: "=="

value: "{{.DestinationHost}}"

minCount: 5

timeLapse: 60

save:

- field: logx.wineventlog.event_data.TargetUserName

alias: DestinationUser

- field: logx.wineventlog.host.name

alias: DestinationHost

- field: logx.wineventlog.event_data.WorkstationName

alias: SourceHost

- field: logx.wineventlog.event_data.IpAddress

alias: SourceIP

Example II

- name: Windows authentication failure

severity: Low

description: A Windows user was unable to authenticate with the server or workstation more than 5 times.

category: User Account Authentication

tactic: "Brute Force: Password Guessing"

reference:

- "https://attack.mitre.org/techniques/T1110/001/"

frequency: 10

search:

- query: '{"size": 500, "query": {"bool": {"must": [{"match_phrase": {"logx.wineventlog.event_id": 4625}}], "filter": [{"range": {"@timestamp": {"gte": "now-15s", "lte": "now"}}}], "should": [], "must_not": []}}}'

minCount: 1

save:

- field: logx.wineventlog.event_data.TargetUserName

alias: DestinationUser

- field: logx.wineventlog.host.name

alias: DestinationHost

- query: '{"size": 500, "query": {"bool": {"must": [{"match_phrase": {"logx.wineventlog.event_id": 4625}}, {"match_phrase": {"logx.wineventlog.event_data.TargetUserName": "{{.DestinationUser}}"}}], "filter": [{"range": {"@timestamp": {"gte": "now-60s", "lte": "now"}}}], "should": [], "must_not": [{"match_phrase": {"logx.wineventlog.event_data.TargetUserName": "{{.DestinationHost}}$"}}]}}}'

minCount: 5

save:

- field: logx.wineventlog.event_data.TargetUserName

alias: DestinationUser

- field: logx.wineventlog.host.name

alias: DestinationHost

- field: logx.wineventlog.event_data.WorkstationName

alias: SourceHost

- field: logx.wineventlog.event_data.IpAddress

alias: SourceIP