fix(rules/linux): correct detection fields, dedup, and adversary on 27 Linux rules (#2269)

Validated by firing real telemetry on a live Linux agent (auditd + journald
normalization). Three classes of issues were fixed; only detection logic /
grouping / adversary changed — impact, category, technique, description and
references are preserved.

- Wrong field for command execution: command lines are in `origin.command`
  (auditd execve), not `log.message` (only `sudo` echoes a command into
  journald). Rules matching `log.message` missed unprivileged execution →
  switched to `origin.command` / `origin.process` / `log.execve.a0`.
- Non-existent `log.process` (it is `origin.process`) on several rules.
- Duplicate-alert spam: `groupBy` used `origin.ip`/`origin.user`/`origin.host`,
  all empty on the agent's execve telemetry → grouping disabled → one alert per
  event. Switched to `deduplicateBy: [dataSource]` (the only always-populated
  host key). Measured: a burst that produced 79/158 alerts now produces ~1-2.
- Empty adversary: netcat (427) and earthworm (441) used `adversary: target`,
  but `target.*` is empty on local Linux events → set `adversary: origin`.
- Brute-force (423): rewrote `where` to detect failed auth and re-pointed the
  `afterEvents` threshold to correlate by the populated `dataSource`.

Each fixed rule was deployed to a live SIEM and confirmed firing on a real
payload generated on the agent.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Yorjander Hernandez Vergara <99102374+Kbayero@users.noreply.github.com>

Author: 3 people

rules/linux/bruteforce_attack.yml

@@ -1,4 +1,4 @@
-# Rule version v1.0.1
+# Rule version v1.0.2
 
 dataTypes:
   - "linux"
@@ -15,35 +15,18 @@ description: "Identifies multiple SSH login failures followed by a successful on
 references:
   - "https://attack.mitre.org/tactics/TA0006/"
   - "https://attack.mitre.org/techniques/T1110/"
-where: equals("action", "system.auth") && regexMatch("log.message", "([Ss]ession opened)") && exists("origin.user") && exists("log.hostId")
+where: |
+  contains("log.message", "Failed password") || (equals("action", "USER_AUTH") && contains("log.userauth.result", "fail"))
 afterEvents:
   - indexPattern: v11-log-linux-*
     with:
-      - field: origin.user
+      - field: dataSource.keyword
         operator: filter_term
-        value: '{{.origin.user}}'
-      - field: log.hostId
-        operator: filter_term
-        value: '{{.log.hostId}}'
+        value: '{{.dataSource}}'
       - field: log.message
         operator: filter_match
         value: 'Failed password'
     within: 15m
     count: 10
-    or:
-      - indexPattern: v11-log-linux-*
-        with:
-          - field: origin.user
-            operator: filter_term
-            value: '{{.origin.user}}'
-          - field: log.hostId
-            operator: filter_term
-            value: '{{.log.hostId}}'
-          - field: log.message
-            operator: filter_match
-            value: 'authentication failure'
-        within: 15m
-        count: 10
-groupBy:
-  - origin.ip
-  - origin.user
+deduplicateBy:
+  - dataSource

rules/linux/debian_family/crontab_persistence.yml

@@ -1,4 +1,4 @@
-# Rule version v1.0.0
+# Rule version v1.0.1
 
 dataTypes:
   - linux
@@ -24,14 +24,6 @@ description: |
   5. Review other persistence mechanisms on the host
   6. If unauthorized, remove the cron entry and investigate the source of compromise
 where: |
-  (contains("log.process", "crontab") || contains("log.process", "cron") || contains("log.process", "atd")) &&
-  (contains("log.message", "REPLACE") ||
-   contains("log.message", "INSTALL") ||
-   contains("log.message", "cron.d") ||
-   contains("log.message", "crontab") ||
-   contains("log.message", "at job") ||
-   (contains("log.message", "EDIT") && contains("log.message", "crontab")) ||
-   (contains("log.message", "BEGIN EDIT") || contains("log.message", "END EDIT")))
-groupBy:
-  - origin.host
-  - origin.user
+  contains("origin.process", "crontab") && (contains("log.message", "REPLACE") || contains("log.message", "INSTALL") || contains("log.message", "LIST") || contains("log.message", "EDIT"))
+deduplicateBy:
+  - dataSource

rules/linux/debian_family/debian_specific_rootkits.yml

@@ -1,4 +1,4 @@
-# Rule version v1.0.0
+# Rule version v1.0.1
 
 dataTypes:
   - linux
@@ -27,32 +27,6 @@ description: |
   7. Analyze network connections for command and control communications
   8. Update security tools and perform full system scan
 where: |
-  (contains("log.file_path", "/usr/bin/passwd") && 
-   equals("log.event_type", "file_modify") && 
-   !equals("log.process_name", "dpkg")) ||
-  (contains("log.file_path", "/etc/ld.so.preload") && 
-   oneOf("log.event_type", ["file_create", "file_modify"])) ||
-  (oneOf("log.process_name", ["reptile", "bdvl", "azazel", "jynx", "xorddos"]) || 
-   contains("log.file_path", "reptile") || 
-   contains("log.file_path", "bdvl")) ||
-  (contains("log.command_line", "insmod") && 
-   (contains("log.command_line", "rootkit") || 
-    contains("log.command_line", "hide") || 
-    contains("log.command_line", "backdoor"))) ||
-  (contains("log.file_path", "/proc/") && 
-   contains("log.file_path", "/maps") && 
-   contains("log.message", "deleted")) ||
-  (oneOf("log.network_port", [31337, 12345, 6666]) && 
-   equals("log.event_type", "network_listen")) ||
-  (contains("log.file_path", "/dev/ptmx") && 
-   equals("log.event_type", "file_create") && 
-   !equals("log.user", "root")) ||
-  (contains("log.message", "LKM") && 
-   (contains("log.message", "rootkit") || 
-    contains("log.message", "hiding"))) ||
-  (regexMatch("log.file_path", "/lib/modules/.*/.*\\.ko") &&
-   equals("log.event_type", "file_create") &&
-   !equals("log.process_name", "dpkg"))
-groupBy:
-  - lastEvent.log.process_name
-  - origin.host
+  regexMatch("origin.process", "/(reptile|bdvl|azazel|jynx|xorddos)") || (contains("origin.command", "insmod") && regexMatch("origin.command", "(rootkit|hide|backdoor)")) || (contains("origin.command", "ld.so.preload") && regexMatch("origin.command", "(>>|tee|echo)"))
+deduplicateBy:
+  - dataSource

rules/linux/debian_family/ebpf_rootkit_detection.yml

@@ -1,4 +1,4 @@
-# Rule version v1.0.0
+# Rule version v1.0.1
 
 dataTypes:
   - linux
@@ -24,15 +24,6 @@ description: |
   5. Investigate for signs of process hiding or network traffic manipulation
   6. If malicious, reboot the system and perform forensic analysis
 where: |
-  (contains("log.message", "bpf(") || contains("log.message", "BPF") ||
-   contains("log.message", "ebpf") || contains("log.message", "bpftool")) &&
-  (contains("log.message", "PROG_LOAD") || contains("log.message", "prog_load") ||
-   contains("log.message", "BPF_PROG_TYPE_TRACING") ||
-   contains("log.message", "BPF_PROG_TYPE_KPROBE") ||
-   contains("log.message", "BPF_PROG_TYPE_XDP") ||
-   contains("log.message", "attached") || contains("log.message", "loaded")) &&
-  !(contains("log.process", "systemd") || contains("log.process", "cilium") ||
-    contains("log.process", "falco") || contains("log.process", "bpftrace"))
-groupBy:
-  - origin.host
-  - origin.user
+  regexMatch("origin.command", "bpftool .*(prog|map).*(load|loadall|attach)") && !regexMatch("origin.command", "(cilium|falco|bpftrace)")
+deduplicateBy:
+  - dataSource

rules/linux/debian_family/ld_preload_hijacking.yml

@@ -1,4 +1,4 @@
-# Rule version v1.0.0
+# Rule version v1.0.1
 
 dataTypes:
   - linux
@@ -25,12 +25,6 @@ description: |
   6. Remove the malicious preload entry and the shared library
   7. Audit all running processes for injected libraries
 where: |
-  (contains("log.message", "ld.so.preload") ||
-   contains("log.message", "LD_PRELOAD") ||
-   contains("log.message", "ld.so.conf")) &&
-  (contains("log.message", "modified") || contains("log.message", "write") ||
-   contains("log.message", "opened") || contains("log.message", "export") ||
-   contains("log.message", "changed"))
-groupBy:
-  - origin.host
-  - origin.user
+  (contains("origin.command", "ld.so.preload") || contains("origin.command", "LD_PRELOAD") || contains("origin.command", "ld.so.conf")) && regexMatch("origin.command", "(>>|tee|echo|sed |cp |mv )")
+deduplicateBy:
+  - dataSource

rules/linux/debian_family/process_masquerading.yml

@@ -1,4 +1,4 @@
-# Rule version v1.0.0
+# Rule version v1.0.1
 
 dataTypes:
   - linux
@@ -23,11 +23,6 @@ description: |
   5. If confirmed malicious, terminate the process and remove the binary
   6. Check for other masquerading processes on the system
 where: |
-  (contains("log.message", "/proc/self/comm") ||
-   contains("log.message", "/proc/self/exe") ||
-   contains("log.message", "prctl") && contains("log.message", "PR_SET_NAME")) &&
-  (contains("log.message", "write") || contains("log.message", "modified") ||
-   contains("log.message", "open"))
-groupBy:
-  - origin.host
-  - origin.user
+  regexMatch("log.execve.a0", "^\\[(kworker|kthreadd|ksoftirqd|migration|rcu_|kswapd|watchdog|kdevtmpfs|kauditd|kcompactd|kintegrityd|khugepaged|kblockd|kthrotld)")
+deduplicateBy:
+  - dataSource

rules/linux/debian_family/reverse_shell_detection.yml

@@ -1,4 +1,4 @@
-# Rule version v1.0.0
+# Rule version v1.0.1
 
 dataTypes:
   - linux
@@ -25,16 +25,6 @@ description: |
   6. Perform full incident response on the compromised host
   7. Block the C2 IP address at the network perimeter
 where: |
-  regexMatch("log.message", "(?i)bash\\s+-i\\s+>&\\s+/dev/tcp/") ||
-  regexMatch("log.message", "(?i)python[23]?\\s+-c\\s+.*socket.*connect") ||
-  regexMatch("log.message", "(?i)nc\\s+(-e|--exec|-c)\\s+") ||
-  regexMatch("log.message", "(?i)ncat\\s+(-e|--exec)\\s+") ||
-  regexMatch("log.message", "(?i)socat\\s+.*exec.*tcp") ||
-  regexMatch("log.message", "(?i)perl\\s+-e\\s+.*socket.*INET") ||
-  regexMatch("log.message", "(?i)php\\s+-r\\s+.*fsockopen") ||
-  regexMatch("log.message", "(?i)ruby\\s+-rsocket\\s+-e") ||
-  regexMatch("log.message", "(?i)mkfifo\\s+.*nc\\s+") ||
-  regexMatch("log.message", "(?i)\\b0<&\\d+-;exec\\s+\\d+<>/dev/tcp/")
-groupBy:
-  - origin.host
-  - origin.ip
+  regexMatch("origin.command", "(bash -i.*/dev/tcp|python.* -c .*socket.*connect|nc .*-e|ncat .*-e|socat.*exec.*tcp|perl.*-e.*socket|php.*-r.*fsockopen|ruby.*-rsocket)")
+deduplicateBy:
+  - dataSource

rules/linux/debian_family/shell_rc_file_modification.yml

@@ -1,4 +1,4 @@
-# Rule version v1.0.0
+# Rule version v1.0.1
 
 dataTypes:
   - linux
@@ -23,12 +23,6 @@ description: |
   5. Review all shell RC files for the affected user and system-wide profiles
   6. Remove malicious entries and investigate the compromise vector
 where: |
-  (contains("log.message", ".bashrc") || contains("log.message", ".bash_profile") ||
-   contains("log.message", ".profile") || contains("log.message", "/etc/profile.d/") ||
-   contains("log.message", ".zshrc") || contains("log.message", ".zprofile") ||
-   contains("log.message", "/etc/bash.bashrc") || contains("log.message", "/etc/profile")) &&
-  (contains("log.message", "modified") || contains("log.message", "opened for writing") ||
-   contains("log.message", "write") || contains("log.message", "changed"))
-groupBy:
-  - origin.host
-  - origin.user
+  regexMatch("origin.command", "(tee|>>|cp |sed |vi |vim |nano |echo).*(.bashrc|.bash_profile|.zshrc|.profile|/etc/profile)")
+deduplicateBy:
+  - dataSource

rules/linux/debian_family/ssh_authorized_keys_modification.yml

@@ -1,4 +1,4 @@
-# Rule version v1.0.0
+# Rule version v1.0.1
 
 dataTypes:
   - linux
@@ -25,10 +25,6 @@ description: |
   6. Remove unauthorized keys and rotate affected credentials
   7. Monitor for subsequent SSH connections from unknown sources
 where: |
-  (contains("log.message", "authorized_keys") || contains("log.message", "authorized_keys2")) &&
-  (contains("log.message", "modified") || contains("log.message", "opened for writing") ||
-   contains("log.message", "changed") || contains("log.process", "sshd") ||
-   contains("log.message", ".ssh") && contains("log.message", "write"))
-groupBy:
-  - origin.host
-  - origin.user
+  contains("origin.command", "authorized_keys")
+deduplicateBy:
+  - dataSource

rules/linux/debian_family/ssh_tunneling_port_forwarding.yml

@@ -1,4 +1,4 @@
-# Rule version v1.0.0
+# Rule version v1.0.1
 
 dataTypes:
   - linux
@@ -24,14 +24,6 @@ description: |
   5. If unauthorized, terminate the SSH session and block the connection
   6. Review SSH configuration to restrict port forwarding if not needed
 where: |
-  contains("log.process", "sshd") &&
-  (regexMatch("log.message", "(?i)ssh\\s+.*-[LRD]\\s+") ||
-   contains("log.message", "port forwarding") ||
-   contains("log.message", "Local forwarding") ||
-   contains("log.message", "Remote forwarding") ||
-   contains("log.message", "Dynamic forwarding") ||
-   contains("log.message", "tunnel") ||
-   regexMatch("log.message", "(?i)open forward.*port"))
-groupBy:
-  - origin.host
-  - origin.ip
+  regexMatch("origin.command", "ssh .*-[LRD] ")
+deduplicateBy:
+  - dataSource