Skip to content

[Tuning] Expand compatibility to extra OS#5883

Merged
Samirbous merged 11 commits intomainfrom
Samirbous-patch-1
Mar 26, 2026
Merged

[Tuning] Expand compatibility to extra OS#5883
Samirbous merged 11 commits intomainfrom
Samirbous-patch-1

Conversation

@Samirbous
Copy link
Copy Markdown
Contributor

@Samirbous Samirbous commented Mar 25, 2026 •
edited
Loading

Expanded compatibility to Windows and macOS as well as integrations:

  • Potential Data Exfiltration Through Curl (adds macOS and Windows)
  • Kubernetes Direct API Request via Curl or Wget (adds macOS and Windows)
  • Kubectl Network Configuration Modification (adds macOS)
  • Potential Impersonation Attempt via Kubectl (adds macOS)
  • Potential Kubectl Masquerading via Unexpected Process (adds macOS)
  • Kubectl Permission Discovery (adds macOS)
  • Kubectl Secrets Enumeration Across All Namespaces (New rule - macOS and Linux)

@Samirbous
Update and rename exfiltration_potential_curl_data_exfiltration.toml …
b10b050 
…to exfiltration_potential_curl_data_exfiltration.toml
@Samirbous Samirbous self-assigned this Mar 25, 2026
@Samirbous Samirbous added Rule: Tuning tweaking or tuning an existing rule Domain: Endpoint labels Mar 25, 2026
@Samirbous Samirbous changed the title [Tuning] Potential Data Exfiltration Through Curl" [Tuning] Potential Data Exfiltration Through Curl Mar 25, 2026
@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Mar 25, 2026

Rule: Tuning - Guidelines

These guidelines serve as a reminder set of considerations when tuning an existing rule.

Documentation and Context

  • Detailed description of the suggested changes.
  • Provide example JSON data or screenshots.
  • Provide evidence of reducing benign events mistakenly identified as threats (False Positives).
  • Provide evidence of enhancing detection of true threats that were previously missed (False Negatives).
  • Provide evidence of optimizing resource consumption and execution time of detection rules (Performance).
  • Provide evidence of specific environment factors influencing customized rule tuning (Contextual Tuning).
  • Provide evidence of improvements made by modifying sensitivity by changing alert triggering thresholds (Threshold Adjustments).
  • Provide evidence of refining rules to better detect deviations from typical behavior (Behavioral Tuning).
  • Provide evidence of improvements of adjusting rules based on time-based patterns (Temporal Tuning).
  • Provide reasoning of adjusting priority or severity levels of alerts (Severity Tuning).
  • Provide evidence of improving quality integrity of our data used by detection rules (Data Quality).
  • Ensure the tuning includes necessary updates to the release documentation and versioning.

Rule Metadata Checks

  • updated_date matches the date of tuning PR merged.
  • min_stack_version should support the widest stack versions.
  • name and description should be descriptive and not include typos.
  • query should be inclusive, not overly exclusive. Review to ensure the original intent of the rule is maintained.

Testing and Validation

  • Validate that the tuned rule's performance is satisfactory and does not negatively impact the stack.
  • Ensure that the tuned rule has a low false positive rate.

@tradebot-elastic
Copy link
Copy Markdown

tradebot-elastic commented Mar 25, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Potential Data Exfiltration Through Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

Mikaayenson
Mikaayenson approved these changes Mar 25, 2026
View reviewed changes
@tradebot-elastic
Copy link
Copy Markdown

tradebot-elastic commented Mar 25, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Potential Data Exfiltration Through Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@Samirbous Samirbous requested a review from Aegrah March 25, 2026 21:28
@tradebot-elastic
Copy link
Copy Markdown

tradebot-elastic commented Mar 25, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Potential Data Exfiltration Through Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link
Copy Markdown

tradebot-elastic commented Mar 25, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Potential Data Exfiltration Through Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link
Copy Markdown

tradebot-elastic commented Mar 26, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Kubernetes Direct API Request via Curl or Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Data Exfiltration Through Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@Samirbous Samirbous changed the title [Tuning] Potential Data Exfiltration Through Curl [Tuning] Expand compatibility to extra OS Mar 26, 2026
@tradebot-elastic
Copy link
Copy Markdown

tradebot-elastic commented Mar 26, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Kubectl Permission Discovery (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Kubectl Masquerading via Unexpected Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Impersonation Attempt via Kubectl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kubectl Network Configuration Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kubernetes Direct API Request via Curl or Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Data Exfiltration Through Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link
Copy Markdown

tradebot-elastic commented Mar 26, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Kubectl Permission Discovery (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Kubectl Masquerading via Unexpected Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Impersonation Attempt via Kubectl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kubectl Network Configuration Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kubectl Secrets Enumeration Across All Namespaces (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kubernetes Direct API Request via Curl or Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Data Exfiltration Through Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

Aegrah
Aegrah approved these changes Mar 26, 2026
View reviewed changes
Samirbous and others added 2 commits March 26, 2026 11:57
@Samirbous @Aegrah
Update rules/cross-platform/execution_kubernetes_direct_api_request_v…
5363b94 
…ia_curl_or_wget.toml

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
@Samirbous @Aegrah
Update rules/cross-platform/discovery_kubectl_secrets_all_namespaces.…
d1dca97 
…toml

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
@tradebot-elastic
Copy link
Copy Markdown

tradebot-elastic commented Mar 26, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Kubectl Permission Discovery (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Kubectl Masquerading via Unexpected Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Impersonation Attempt via Kubectl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kubectl Network Configuration Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kubectl Secrets Enumeration Across All Namespaces (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kubernetes Direct API Request via Curl or Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Data Exfiltration Through Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

Samirbous and others added 2 commits March 26, 2026 11:57
@Samirbous @Aegrah
Update rules/cross-platform/exfiltration_potential_curl_data_exfiltra…
699506c 
…tion.toml

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
@Samirbous
Merge branch 'main' into Samirbous-patch-1
d5a3d36
@tradebot-elastic
Copy link
Copy Markdown

tradebot-elastic commented Mar 26, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Kubectl Permission Discovery (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Kubectl Masquerading via Unexpected Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Impersonation Attempt via Kubectl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kubectl Network Configuration Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kubectl Secrets Enumeration Across All Namespaces (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kubernetes Direct API Request via Curl or Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Data Exfiltration Through Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link
Copy Markdown

tradebot-elastic commented Mar 26, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Kubectl Permission Discovery (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Kubectl Masquerading via Unexpected Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Impersonation Attempt via Kubectl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kubectl Network Configuration Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kubectl Secrets Enumeration Across All Namespaces (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kubernetes Direct API Request via Curl or Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Data Exfiltration Through Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link
Copy Markdown

tradebot-elastic commented Mar 26, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Kubectl Permission Discovery (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Kubectl Masquerading via Unexpected Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Impersonation Attempt via Kubectl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kubectl Network Configuration Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kubectl Secrets Enumeration Across All Namespaces (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Kubernetes Direct API Request via Curl or Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Data Exfiltration Through Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@Samirbous Samirbous merged commit 5d5e1d9 into main Mar 26, 2026
14 checks passed
@Samirbous Samirbous deleted the Samirbous-patch-1 branch March 26, 2026 12:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Mikaayenson Mikaayenson Mikaayenson approved these changes

@Aegrah Aegrah Aegrah approved these changes

@terrancedejesus terrancedejesus Awaiting requested review from terrancedejesus

Assignees

@Samirbous Samirbous

Labels

backport: auto Domain: Endpoint Rule: Tuning tweaking or tuning an existing rule

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@Samirbous @tradebot-elastic @Mikaayenson @Aegrah