Skip to content

Commit da9fabc

Browse files
alvarezmelissa87alvarezmelissa87
committed
format files
1 parent 1362be2 commit da9fabc

10 files changed

+1658
-1558
lines changed

‎packages/ml_problem_child/elasticsearch/ml_model/problemchild_20210526_1.0.json‎

Lines changed: 1017 additions & 1017 deletions
Large diffs are not rendered by default.

‎packages/ml_problem_child/kibana/ml_module/problem-child-ml.json‎

Lines changed: 423 additions & 381 deletions
Large diffs are not rendered by default.

‎packages/ml_problem_child/kibana/security_rule/34184d4e-ef61-477b-8d76-5c93448c29bf.json‎

Lines changed: 30 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,31 @@
11
{
2-
"attributes": {
3-
"author": [
4-
"Elastic"
5-
],
6-
"description": "A supervised machine learning model (ProblemChild) or its blocklist has identified\na suspicious Windows process event to be malicious activity.\n",
7-
"from": "now-9m",
8-
"index": ["endgame-*", "logs-endpoint.events.process.*", "winlogbeat-*"],
9-
"language": "kuery",
10-
"license": "Elastic License",
11-
"max_signals": 10000,
12-
"name": "Machine Learning Detected a Suspicious Windows Event Predicted to be Malicious Activity",
13-
"query": "problemchild.prediction:1 or blocklist_label:1",
14-
"risk_score": 21,
15-
"rule_id": "34184d4e-ef61-477b-8d76-5c93448c29bf",
16-
"severity": "low",
17-
"tags": ["Elastic", "ML-ProblemChild"],
18-
"timestamp_override": "event.ingested",
19-
"type": "query",
20-
"version": 2
21-
},
22-
"id": "34184d4e-ef61-477b-8d76-5c93448c29bf",
23-
"type": "security-rule"
24-
}
2+
"attributes": {
3+
"author": [
4+
"Elastic"
5+
],
6+
"description": "A supervised machine learning model (ProblemChild) or its blocklist has identified\na suspicious Windows process event to be malicious activity.\n",
7+
"from": "now-9m",
8+
"index": [
9+
"endgame-*",
10+
"logs-endpoint.events.process.*",
11+
"winlogbeat-*"
12+
],
13+
"language": "kuery",
14+
"license": "Elastic License",
15+
"max_signals": 10000,
16+
"name": "Machine Learning Detected a Suspicious Windows Event Predicted to be Malicious Activity",
17+
"query": "problemchild.prediction:1 or blocklist_label:1",
18+
"risk_score": 21,
19+
"rule_id": "34184d4e-ef61-477b-8d76-5c93448c29bf",
20+
"severity": "low",
21+
"tags": [
22+
"Elastic",
23+
"ML-ProblemChild"
24+
],
25+
"timestamp_override": "event.ingested",
26+
"type": "query",
27+
"version": 2
28+
},
29+
"id": "34184d4e-ef61-477b-8d76-5c93448c29bf",
30+
"type": "security-rule"
31+
}

‎packages/ml_problem_child/kibana/security_rule/415d6863-7676-401f-aa8d-62f59a28e849.json‎

Lines changed: 30 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1,25 +1,31 @@
11
{
2-
"attributes": {
3-
"anomaly_threshold": 75,
4-
"author": [
5-
"Elastic"
6-
],
7-
"description": "A machine learning job has detected a suspicious Windows process. This\nprocess has been classified as malicious in two ways. It was predicted to be malicious\nby the ProblemChild supervised ML model, and it was found to be an unusual process,\non a host that does not commonly manifest malicious activity. Such a process may be an\ninstance of suspicious or malicious activity, possibly involving LOLbins, that may be\nresistant to detection using conventional search rules.\n",
8-
"from": "now-45m",
9-
"interval": "15m",
10-
"license": "Elastic License",
11-
"machine_learning_job_id": "problem_child_rare_process_by_host",
12-
"name": "Unusual Process Spawned By a Host",
13-
"references": [
14-
"https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html"
15-
],
16-
"risk_score": 21,
17-
"rule_id": "415d6863-7676-401f-aa8d-62f59a28e849",
18-
"severity": "low",
19-
"tags": ["Elastic", "Windows", "Process", "Threat Detection", "ML"],
20-
"type": "machine_learning",
21-
"version": 1
22-
},
23-
"id": "415d6863-7676-401f-aa8d-62f59a28e849",
24-
"type": "security-rule"
25-
}
2+
"attributes": {
3+
"anomaly_threshold": 75,
4+
"author": [
5+
"Elastic"
6+
],
7+
"description": "A machine learning job has detected a suspicious Windows process. This\nprocess has been classified as malicious in two ways. It was predicted to be malicious\nby the ProblemChild supervised ML model, and it was found to be an unusual process,\non a host that does not commonly manifest malicious activity. Such a process may be an\ninstance of suspicious or malicious activity, possibly involving LOLbins, that may be\nresistant to detection using conventional search rules.\n",
8+
"from": "now-45m",
9+
"interval": "15m",
10+
"license": "Elastic License",
11+
"machine_learning_job_id": "problem_child_rare_process_by_host",
12+
"name": "Unusual Process Spawned By a Host",
13+
"references": [
14+
"https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html"
15+
],
16+
"risk_score": 21,
17+
"rule_id": "415d6863-7676-401f-aa8d-62f59a28e849",
18+
"severity": "low",
19+
"tags": [
20+
"Elastic",
21+
"Windows",
22+
"Process",
23+
"Threat Detection",
24+
"ML"
25+
],
26+
"type": "machine_learning",
27+
"version": 1
28+
},
29+
"id": "415d6863-7676-401f-aa8d-62f59a28e849",
30+
"type": "security-rule"
31+
}

‎packages/ml_problem_child/kibana/security_rule/86d57ec4-ace5-4456-8145-02e6f0cdd71a.json‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,10 +16,16 @@
1616
"risk_score": 21,
1717
"rule_id": "86d57ec4-ace5-4456-8145-02e6f0cdd71a",
1818
"severity": "low",
19-
"tags": ["Elastic", "Windows", "Process", "Threat Detection", "ML"],
19+
"tags": [
20+
"Elastic",
21+
"Windows",
22+
"Process",
23+
"Threat Detection",
24+
"ML"
25+
],
2026
"type": "machine_learning",
2127
"version": 1
2228
},
2329
"id": "86d57ec4-ace5-4456-8145-02e6f0cdd71a",
2430
"type": "security-rule"
25-
}
31+
}

‎packages/ml_problem_child/kibana/security_rule/9a2e372a-cbeb-4ad6-a288-017ef086324c.json‎

Lines changed: 30 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,31 @@
11
{
2-
"attributes": {
3-
"author": [
4-
"Elastic"
5-
],
6-
"description": "A supervised machine learning model (ProblemChild) has identified a suspicious Windows\nprocess event with high probability of it being malicious activity.\nAlternatively, the model's blocklist identified the event as being malicious.\n",
7-
"from": "now-9m",
8-
"index": ["endgame-*", "logs-endpoint.events.process.*", "winlogbeat-*"],
9-
"language": "kuery",
10-
"license": "Elastic License",
11-
"max_signals": 10000,
12-
"name": "Machine Learning Detected a Suspicious Windows Event with a High Malicious Probability Score",
13-
"query": "(problemchild.prediction:1 and problemchild.prediction_probability > 0.98) or blocklist_label:1",
14-
"risk_score": 21,
15-
"rule_id": "9a2e372a-cbeb-4ad6-a288-017ef086324c",
16-
"severity": "low",
17-
"tags": ["Elastic", "ML-ProblemChild"],
18-
"timestamp_override": "event.ingested",
19-
"type": "query",
20-
"version": 2
21-
},
22-
"id": "9a2e372a-cbeb-4ad6-a288-017ef086324c",
23-
"type": "security-rule"
24-
}
2+
"attributes": {
3+
"author": [
4+
"Elastic"
5+
],
6+
"description": "A supervised machine learning model (ProblemChild) has identified a suspicious Windows\nprocess event with high probability of it being malicious activity.\nAlternatively, the model's blocklist identified the event as being malicious.\n",
7+
"from": "now-9m",
8+
"index": [
9+
"endgame-*",
10+
"logs-endpoint.events.process.*",
11+
"winlogbeat-*"
12+
],
13+
"language": "kuery",
14+
"license": "Elastic License",
15+
"max_signals": 10000,
16+
"name": "Machine Learning Detected a Suspicious Windows Event with a High Malicious Probability Score",
17+
"query": "(problemchild.prediction:1 and problemchild.prediction_probability \u003e 0.98) or blocklist_label:1",
18+
"risk_score": 21,
19+
"rule_id": "9a2e372a-cbeb-4ad6-a288-017ef086324c",
20+
"severity": "low",
21+
"tags": [
22+
"Elastic",
23+
"ML-ProblemChild"
24+
],
25+
"timestamp_override": "event.ingested",
26+
"type": "query",
27+
"version": 2
28+
},
29+
"id": "9a2e372a-cbeb-4ad6-a288-017ef086324c",
30+
"type": "security-rule"
31+
}

‎packages/ml_problem_child/kibana/security_rule/9b98d945-2cce-45e5-aa84-4b021af0e153.json‎

Lines changed: 30 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,31 @@
11
{
2-
"attributes": {
3-
"anomaly_threshold": 75,
4-
"author": [
5-
"Elastic"
6-
],
7-
"description": "A machine learning job combination has detected a set of one or more suspicious Windows\nprocesses with unusually high scores for malicious probability. These process(es) have\nbeen classified as malicious in several ways. The process(es) were predicted to be malicious\nby the ProblemChild supervised ML model. If the anomaly contains a cluster of suspicious\nprocesses, each process has the same parent process name, and the aggregate score of the\nevent cluster was calculated to be unusually high by an unsupervised ML model. Such a cluster\noften contains suspicious or malicious activity, possibly involving LOLbins, that may be\nresistant to detection using conventional search rules.\n",
8-
"from": "now-45m",
9-
"interval": "15m",
10-
"license": "Elastic License",
11-
"machine_learning_job_id": "problem_child_high_sum_by_parent",
12-
"name": "Suspicious Windows Process Cluster Spawned by a Parent Process",
13-
"references": ["https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html"],
14-
"risk_score": 21,
15-
"rule_id": "9b98d945-2cce-45e5-aa84-4b021af0e153",
16-
"severity": "low",
17-
"tags": ["Elastic", "Windows", "Process", "Threat Detection", "ML"],
18-
"type": "machine_learning",
19-
"version": 1
20-
},
21-
"id": "9b98d945-2cce-45e5-aa84-4b021af0e153",
22-
"type": "security-rule"
23-
}
2+
"attributes": {
3+
"anomaly_threshold": 75,
4+
"author": [
5+
"Elastic"
6+
],
7+
"description": "A machine learning job combination has detected a set of one or more suspicious Windows\nprocesses with unusually high scores for malicious probability. These process(es) have\nbeen classified as malicious in several ways. The process(es) were predicted to be malicious\nby the ProblemChild supervised ML model. If the anomaly contains a cluster of suspicious\nprocesses, each process has the same parent process name, and the aggregate score of the\nevent cluster was calculated to be unusually high by an unsupervised ML model. Such a cluster\noften contains suspicious or malicious activity, possibly involving LOLbins, that may be\nresistant to detection using conventional search rules.\n",
8+
"from": "now-45m",
9+
"interval": "15m",
10+
"license": "Elastic License",
11+
"machine_learning_job_id": "problem_child_high_sum_by_parent",
12+
"name": "Suspicious Windows Process Cluster Spawned by a Parent Process",
13+
"references": [
14+
"https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html"
15+
],
16+
"risk_score": 21,
17+
"rule_id": "9b98d945-2cce-45e5-aa84-4b021af0e153",
18+
"severity": "low",
19+
"tags": [
20+
"Elastic",
21+
"Windows",
22+
"Process",
23+
"Threat Detection",
24+
"ML"
25+
],
26+
"type": "machine_learning",
27+
"version": 1
28+
},
29+
"id": "9b98d945-2cce-45e5-aa84-4b021af0e153",
30+
"type": "security-rule"
31+
}

‎packages/ml_problem_child/kibana/security_rule/a5cb4cd7-ba05-47e8-a815-f95c21719ded.json‎

Lines changed: 30 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,31 @@
11
{
2-
"attributes": {
3-
"anomaly_threshold": 75,
4-
"author": [
5-
"Elastic"
6-
],
7-
"description": "A machine learning job has detected a suspicious Windows process. This process has\nbeen classified as malicious in two ways. It was predicted to be malicious by the\nProblemChild supervised ML model, and it was found to be suspicious given that its\nuser context is unusual and does not commonly manifest malicious activity,by an\nunsupervised ML model. Such a process may be an instance of suspicious or malicious\nactivity, possibly involving LOLbins, that may be resistant to detection using\nconventional search rules.\n",
8-
"from": "now-45m",
9-
"interval": "15m",
10-
"license": "Elastic License",
11-
"machine_learning_job_id": "problem_child_rare_process_by_user",
12-
"name": "Unusual Process Spawned By a User",
13-
"references": ["https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html"],
14-
"risk_score": 21,
15-
"rule_id": "a5cb4cd7-ba05-47e8-a815-f95c21719ded",
16-
"severity": "low",
17-
"tags": ["Elastic", "Windows", "Process", "Threat Detection", "ML"],
18-
"type": "machine_learning",
19-
"version": 1
20-
},
21-
"id": "a5cb4cd7-ba05-47e8-a815-f95c21719ded",
22-
"type": "security-rule"
23-
}
2+
"attributes": {
3+
"anomaly_threshold": 75,
4+
"author": [
5+
"Elastic"
6+
],
7+
"description": "A machine learning job has detected a suspicious Windows process. This process has\nbeen classified as malicious in two ways. It was predicted to be malicious by the\nProblemChild supervised ML model, and it was found to be suspicious given that its\nuser context is unusual and does not commonly manifest malicious activity,by an\nunsupervised ML model. Such a process may be an instance of suspicious or malicious\nactivity, possibly involving LOLbins, that may be resistant to detection using\nconventional search rules.\n",
8+
"from": "now-45m",
9+
"interval": "15m",
10+
"license": "Elastic License",
11+
"machine_learning_job_id": "problem_child_rare_process_by_user",
12+
"name": "Unusual Process Spawned By a User",
13+
"references": [
14+
"https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html"
15+
],
16+
"risk_score": 21,
17+
"rule_id": "a5cb4cd7-ba05-47e8-a815-f95c21719ded",
18+
"severity": "low",
19+
"tags": [
20+
"Elastic",
21+
"Windows",
22+
"Process",
23+
"Threat Detection",
24+
"ML"
25+
],
26+
"type": "machine_learning",
27+
"version": 1
28+
},
29+
"id": "a5cb4cd7-ba05-47e8-a815-f95c21719ded",
30+
"type": "security-rule"
31+
}

‎packages/ml_problem_child/kibana/security_rule/ae7c2f69-0c51-4b02-ad54-d3d75023da8b.json‎

Lines changed: 30 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,31 @@
11
{
2-
"attributes": {
3-
"anomaly_threshold": 75,
4-
"author": [
5-
"Elastic"
6-
],
7-
"description": "A machine learning job has detected a suspicious Windows process. This\nprocess has been classified as malicious in two ways. It was predicted to be malicious\nby the ProblemChild supervised ML model, and it was found to be an unusual child process name,\nfor the parent process, by an unsupervised ML model. Such a process may be an instance of\nsuspicious or malicious activity, possibly involving LOLbins, that may be resistant to\ndetection using conventional search rules.\n",
8-
"from": "now-45m",
9-
"interval": "15m",
10-
"license": "Elastic License",
11-
"machine_learning_job_id": "problem_child_rare_process_by_parent",
12-
"name": "Unusual Process Spawned By a Parent Process",
13-
"references": ["https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html"],
14-
"risk_score": 21,
15-
"rule_id": "ae7c2f69-0c51-4b02-ad54-d3d75023da8b",
16-
"severity": "low",
17-
"tags": ["Elastic", "Windows", "Process", "Threat Detection", "ML"],
18-
"type": "machine_learning",
19-
"version": 1
20-
},
21-
"id": "ae7c2f69-0c51-4b02-ad54-d3d75023da8b",
22-
"type": "security-rule"
23-
}
2+
"attributes": {
3+
"anomaly_threshold": 75,
4+
"author": [
5+
"Elastic"
6+
],
7+
"description": "A machine learning job has detected a suspicious Windows process. This\nprocess has been classified as malicious in two ways. It was predicted to be malicious\nby the ProblemChild supervised ML model, and it was found to be an unusual child process name,\nfor the parent process, by an unsupervised ML model. Such a process may be an instance of\nsuspicious or malicious activity, possibly involving LOLbins, that may be resistant to\ndetection using conventional search rules.\n",
8+
"from": "now-45m",
9+
"interval": "15m",
10+
"license": "Elastic License",
11+
"machine_learning_job_id": "problem_child_rare_process_by_parent",
12+
"name": "Unusual Process Spawned By a Parent Process",
13+
"references": [
14+
"https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html"
15+
],
16+
"risk_score": 21,
17+
"rule_id": "ae7c2f69-0c51-4b02-ad54-d3d75023da8b",
18+
"severity": "low",
19+
"tags": [
20+
"Elastic",
21+
"Windows",
22+
"Process",
23+
"Threat Detection",
24+
"ML"
25+
],
26+
"type": "machine_learning",
27+
"version": 1
28+
},
29+
"id": "ae7c2f69-0c51-4b02-ad54-d3d75023da8b",
30+
"type": "security-rule"
31+
}

0 commit comments

Comments
 (0)