Added Elastic SIEM Detections for Certificate Transparency and Phishi…

…ng Domains

_detections/ct_rule.json

@@ -0,0 +1 @@
+{"author":[],"actions":[],"created_at":"2020-09-10T11:44:35.060Z","updated_at":"2020-09-10T11:45:05.667Z","created_by":"elastic","description":"This detection rule flags when a domain is spotted in the certificate transparency fields, located in the Phishbeat index. Replace * with your domain in the query.","enabled":true,"false_positives":[],"filters":[{"$state":{"store":"appState"},"meta":{"negate":false,"alias":null,"disabled":false,"params":{"lt":"now","gte":"now-5m"},"type":"range","key":"@timestamp"},"range":{"@timestamp":{"lt":"now","gte":"now-5m"}}}],"from":"now-360s","id":"0f547385-664f-43d0-add9-a82f73927f51","immutable":false,"index":["phishbeat-*"],"interval":"5m","rule_id":"b8a7109f-3ef4-4bcb-a6f0-c4a6ab753fae","language":"kuery","license":"","output_index":".siem-signals-default","max_signals":100,"risk_score":0,"risk_score_mapping":[],"name":"Phishbeat - Certificate Transparency","query":"data.leaf_cert.all_domains: *","references":[],"meta":{"from":"1m","kibana_siem_app_url":"https://abc9f8363d8d4825a0805d15e24fec57.ap-southeast-2.aws.found.io:9243/app/security"},"severity":"low","severity_mapping":[],"updated_by":"elastic","tags":["Phishbeat","Certificate Transparency","Stric"],"to":"now","type":"query","threat":[],"throttle":"no_actions","version":2,"exceptions_list":[]}

_detections/phishing_rule.json

@@ -0,0 +1 @@
+{"author":[],"actions":[],"created_at":"2020-09-10T11:19:18.808Z","updated_at":"2020-09-10T11:37:57.372Z","created_by":"elastic","description":"This Detection alerts based on whether new detected domains are present in the phishbeat index. ","enabled":true,"false_positives":[],"filters":[{"$state":{"store":"appState"},"meta":{"negate":false,"alias":null,"disabled":false,"params":{"lt":"now","gte":"now-5m"},"type":"range","key":"@timestamp"},"range":{"@timestamp":{"lt":"now","gte":"now-5m"}}}],"from":"now-360s","id":"991f6db4-13a7-47ca-9541-53de6eaf02b9","immutable":false,"index":["phishbeat-*"],"interval":"5m","rule_id":"065f33a1-797e-4ad9-b104-13397706475a","language":"kuery","license":"","output_index":".siem-signals-default","max_signals":100,"risk_score":75,"risk_score_mapping":[],"name":"Phishbeat - Phishing Domain Detected","query":"domain: *","references":[],"meta":{"from":"1m","kibana_siem_app_url":"https://abc9f8363d8d4825a0805d15e24fec57.ap-southeast-2.aws.found.io:9243/app/security"},"severity":"high","severity_mapping":[],"updated_by":"elastic","tags":["Phishing","Stric","Phishbeat"],"to":"now","type":"query","threat":[{"framework":"MITRE ATT&CK","technique":[{"reference":"https://attack.mitre.org/techniques/T1192","name":"Spearphishing Link","id":"T1192"}],"tactic":{"reference":"https://attack.mitre.org/tactics/TA0001","name":"Initial Access","id":"TA0001"}}],"throttle":"no_actions","version":4,"exceptions_list":[]}