feat(rules/bitdefender_gz): update detection rules and add phishing_access_blocked

rules/antivirus/bitdefender_gz/antivirus_service_stopped.yml

@@ -1,8 +1,8 @@
-# Rule version v1.0.0
+# Rule version v2.0.0
 
 dataTypes:
   - antivirus-bitdefender-gz
-name: Antivirus Service Stopped or Disabled
+name: Bitdefender GravityZone Antivirus Service Stopped or Tampered
 impact:
   confidentiality: 2
   integrity: 3
@@ -12,28 +12,30 @@ technique: "T1562.001 - Impair Defenses: Disable or Modify Tools"
 adversary: origin
 references:
   - https://www.bitdefender.com/business/support/en/77212-237089-event-types.html
+  - https://www.bitdefender.com/business/support/en/77212-237090-syslog-events.html
   - https://attack.mitre.org/techniques/T1562/001/
 description: |
-  Detects when the Bitdefender antivirus service or critical security modules are stopped, disabled, or experiencing failures. This is a critical security event that could indicate malicious tampering or system issues.
+  Detects when the Bitdefender security agent is disabled, stopped, or under an integrity attack. Three independent signals, all directly emitted by the vendor:
+
+  - Antitampering event with detection_technique "Callback Evasion". Bitdefender's own definition: a post-tampering incident where critical protection mechanisms have been disabled. This is the strongest possible signal that the agent is compromised.
+  - Antitampering event with detection_technique "Vulnerable Drivers". A driver exploitable against the security agent is present on the endpoint, which is the precursor to tampering.
+  - Product Modules Status event reporting that the Antimalware (malware_status) or Advanced Threat Control (avc_status) module has flipped to disabled (value 0).
 
   Next Steps:
-  - Verify if the service was intentionally stopped by authorized personnel
-  - Check system logs for any errors or crashes that may have caused the service to stop
-  - Look for signs of malware or unauthorized access attempts around the time of the event
-  - Review recent system changes or updates that might have affected the antivirus service
-  - If tampering is suspected, isolate the affected system and perform a forensic analysis
-  - Restart the Bitdefender service and ensure all modules are functioning properly
-  - Monitor for recurring issues that might indicate persistent threats
+  1. Isolate the endpoint from the network. The agent is either disabled or being actively targeted, and normal telemetry from this host is now untrusted.
+  2. Identify what changed:
+     - For antitampering events, log.BitdefenderGZDriverName / log.driverName names the driver and log.BitdefenderGZDetectionAction shows whether Bitdefender blocked it (deny/kill) or only observed it (reportOnly). reportOnly means the tampering succeeded.
+     - For modules events, log.BitdefenderGZMalwareStatus and log.BitdefenderGZAvcStatus show which protection was turned off.
+  3. Correlate with logon and admin activity on the same target.host in the surrounding minutes. Legitimate module changes are rare and normally come from a scheduled policy push; ad-hoc changes deserve attention.
+  4. Assume the endpoint is compromised until proven otherwise. Any threats that arrived while protection was down would not have been detected.
+  5. Re-enable protection through GravityZone Control Center, do not rely on the local agent. If the module refuses to come back up, treat as a reimage candidate.
 where: |
-  (equals("log.eventType", "modules") ||
-   equals("log.eventType", "Product ModulesStatus") ||
-   equals("log.eventType", "registration")) &&
-  (oneOf("log.severity", ["high", "5"]) ||
-   contains("log.product", "disabled") ||
-   contains("log.product", "stopped") ||
-   (contains("log.restData", "module") && contains("log.restData", "stopped")) ||
-   (contains("log.restData", "module") && contains("log.restData", "disabled")) ||
-   (contains("log.restData", "av") && contains("log.restData", "failure")))
+  equals("log.BitdefenderGZModule", "antitampering") ||
+  (equals("log.BitdefenderGZModule", "modules") &&
+   (equals("log.malware_status", "0") ||
+    equals("log.avc_status", "0") ||
+    equals("log.BitdefenderGZMalwareStatus", "0") ||
+    equals("log.BitdefenderGZAvcStatus", "0")))
 groupBy:
-  - lastEvent.log.eventType
-  - lastEvent.log.hostId
+  - target.host
+  - lastEvent.log.BitdefenderGZModule

rules/antivirus/bitdefender_gz/apt_detection.yml

@@ -1,4 +1,4 @@
-# Rule version v1.0.0
+# Rule version v2.0.0
 
 dataTypes:
   - antivirus-bitdefender-gz
@@ -7,35 +7,46 @@ impact:
   confidentiality: 3
   integrity: 3
   availability: 2
-category: Command and Control
-technique: "TA0011 - Application Layer Protocol"
+category: Execution
+technique: "T1204.002 - User Execution: Malicious File"
 adversary: origin
 references:
   - https://www.bitdefender.com/business/support/en/77212-237089-event-types.html
-  - https://attack.mitre.org/tactics/TA0011/
+  - https://www.bitdefender.com/business/support/en/77212-237090-syslog-events.html
+  - https://attack.mitre.org/techniques/T1204/002/
+  - https://attack.mitre.org/techniques/T1110/
 description: |
-  Detects indicators of Advanced Persistent Threats including targeted attacks, sophisticated malware, and persistent threats detected by Bitdefender GravityZone's HyperDetect module.
-
+  Detects high-severity threats that Bitdefender itself classifies as targeted or sophisticated, rather than commodity malware. Three independent signals, all requiring CEF severity 8 or above:
+
+  - HyperDetect reporting attack_type "targeted attack". HyperDetect is Bitdefender's machine-learning layer tuned specifically for targeted attacks and advanced threats, and it labels the detection itself.
+  - Sandbox Analyzer detection. A verdict here means an unknown payload was detonated and found malicious after evading signature-based detection, which is characteristic of tooling built for a specific target.
+  - Network Attack Defense reporting attack technique credentialAccess. Credential access is a core phase of a persistent intrusion, and covers Kerberos brute force and password-stealer traffic.
+
+  Per-incident MITRE technique identifiers are carried by the vendor in log.BitdefenderGZAttCkId as an array, and are more precise than this rule's single technique tag.
+
   Next Steps:
-  - Investigate the affected endpoint to determine the scope of compromise
-  - Review process execution history and network connections from the affected system
-  - Check for lateral movement by examining authentication logs from the same source IP
-  - Isolate the affected system if active threat is confirmed
-  - Collect forensic artifacts including memory dumps and event logs
-  - Search for similar malware indicators across the environment
-  - Review user account activities for signs of credential compromise
-  - Contact security operations center if threat actors match known APT groups
+  1. Determine the affected endpoint from target.host and the attacker from log.BitdefenderGZDetectionAttackerIp when the source is Network Attack Defense
+  2. Read the vendor's own classification before assuming scope:
+     - log.BitdefenderGZAttCkId lists the MITRE techniques Bitdefender attributed to the incident
+     - log.BitdefenderGZDetectionName names the detection, for example Attack.Bruteforce.KERBEROS or PrivacyThreat.PasswordStealer
+  3. For credentialAccess detections, treat the credentials as compromised:
+     - Identify the targeted accounts and force a password reset
+     - Review authentication logs from the attacker IP for any successful logon
+     - Check for Kerberos ticket anomalies if the detection names KERBEROS
+  4. Establish persistence and lateral movement:
+     - Review process ancestry via log.BitdefenderGZDetectionName and target.path
+     - Correlate other events from the same target.host in the surrounding hours
+     - Search the environment for the same detection name on other hosts
+  5. Collect forensic artifacts before remediating - memory image and endpoint logs - since a targeted intrusion warrants attribution work
+  6. Isolate the endpoint if the detection action shows the threat was not blocked, then hunt for what ran while it was active
 where: |
-  equals("log.product", "Bitdefender GravityZone") &&
-  greaterOrEqual("log.severity", 8) &&
+  greaterOrEqual("severity", 8) &&
   (
-    contains("log.eventType", ["apt", "targeted", "advanced", "persistent", "hyperdetect"]) ||
-    contains("log.restData", ["apt", "targeted attack", "advanced persistent",
-      "lazarus", "equation", "sofacy", "cozy bear", "fancy bear",
-      "panda", "kitten", "carbanak", "fin7", "fileless"]) ||
-    equals("log.signatureID", "hyperdetect")
-  ) &&
-  exists("log.hostId")
+    (equals("log.BitdefenderGZModule", "hd") &&
+     regexMatch("log.BitdefenderGZAttackTypes", "(?i)targeted attack")) ||
+    equals("log.BitdefenderGZModule", "network-sandboxing") ||
+    equals("log.BitdefenderGZDetectionAttackTechnique", "credentialAccess")
+  )
 groupBy:
-  - lastEvent.log.eventType
-  - lastEvent.log.hostId
+  - target.host
+  - lastEvent.log.BitdefenderGZDetectionName

rules/antivirus/bitdefender_gz/av_console_lateral_movement.yml

@@ -1,8 +1,8 @@
-# Rule version v1.0.0
+# Rule version v2.0.0
 
 dataTypes:
   - antivirus-bitdefender-gz
-name: Bitdefender Console Used for Lateral Movement
+name: Bitdefender GravityZone Task Burst Across Endpoints
 impact:
   confidentiality: 3
   integrity: 3
@@ -11,32 +11,34 @@ category: Lateral Movement
 technique: "T1072 - Software Deployment Tools"
 adversary: origin
 references:
-  - https://attack.mitre.org/techniques/T1072/
   - https://www.bitdefender.com/business/support/en/77212-237089-event-types.html
+  - https://www.bitdefender.com/business/support/en/77212-237090-syslog-events.html
+  - https://attack.mitre.org/techniques/T1072/
 description: |
-  Detects when the Bitdefender GravityZone management console is potentially being used to push malicious policies, scripts, or tasks to managed endpoints, indicating a compromised admin account being leveraged for lateral movement.
+  Detects a burst of Bitdefender GravityZone task deployments across many endpoints in a short window, which is the observable trace of a compromised admin console being used to push activity to managed machines. Bitdefender's own management console is a first-class software deployment tool by MITRE's definition, so its abuse is T1072.
+
+  A single task event is normal operational activity. Three or more distinct endpoints receiving tasks from the same admin identity within an hour is the shape of console-driven lateral movement.
 
   Next Steps:
-  1. Review all recent task and policy deployments from the console
-  2. Identify the admin account used and verify its legitimacy
-  3. Check for unusual login patterns to the GravityZone console
-  4. Review the content of pushed policies for malicious configurations
-  5. Suspend the admin account if compromise is suspected
-  6. Audit all managed endpoints for signs of compromise
+  1. Identify the admin identity via log.BitdefenderGZUserName or the user object in the task. Correlate with authentication-audit events from the same identity for logon location and browser.
+  2. Read log.BitdefenderGZTaskName and log.BitdefenderGZTaskType. Scan and update tasks are routine; script execution, arbitrary install, and uninstall tasks deserve scrutiny.
+  3. List every target.host that received a task in this window and treat the set as the potentially-affected estate, not each host individually.
+  4. Cross-check against the change control system. A legitimate task burst normally has a ticket; an ad-hoc burst outside a change window is the strongest indicator.
+  5. Suspend the admin account and rotate its credentials before deciding whether it was compromised or misused. Then audit every endpoint that received a task for signs of the tasks having succeeded.
+  6. Review Control Center authentication logs for the source IP behind the admin session. External or unusual geographies for the admin login argue for an account compromise rather than an insider.
 where: |
-  (contains("log.message", ["remote task", "deploy", "push policy", "execute script"]) ||
-   (contains("log.message", "task") && contains("log.message", "created") &&
-    (contains("log.message", "scan") || contains("log.message", "install") ||
-     contains("log.message", "uninstall") || contains("log.message", "execute")))) &&
-  exists("log.severity")
-afterEvents:
+  equals("log.BitdefenderGZModule", "task-status")
+correlation:
   - indexPattern: v11-log-antivirus-bitdefender-gz-*
+    within: 1h
+    count: 3
     with:
-      - field: log.hostId
+      - field: log.BitdefenderGZModule
         operator: filter_term
-        value: '{{.log.hostId}}'
-    within: 30m
-    count: 10
+        value: "task-status"
+      - field: target.host
+        operator: must_not_term
+        value: "{{.target.host}}"
 groupBy:
-  - lastEvent.log.eventType
-  - lastEvent.log.hostId
+  - target.host
+  - lastEvent.log.BitdefenderGZTaskName

rules/antivirus/bitdefender_gz/av_policy_override.yml

@@ -1,8 +1,8 @@
-# Rule version v1.0.0
+# Rule version v2.0.0
 
 dataTypes:
   - antivirus-bitdefender-gz
-name: Bitdefender AV Policy Weakened
+name: Bitdefender GravityZone Protection Module Disabled
 impact:
   confidentiality: 3
   integrity: 3
@@ -12,32 +12,36 @@ technique: "T1562.001 - Impair Defenses: Disable or Modify Tools"
 adversary: origin
 references:
   - https://www.bitdefender.com/business/support/en/77212-237089-event-types.html
+  - https://www.bitdefender.com/business/support/en/77212-237090-syslog-events.html
   - https://attack.mitre.org/techniques/T1562/001/
 description: |
-  Detects when Bitdefender GravityZone antivirus policies are weakened by administrators, such as disabling real-time protection, reducing scan aggressiveness, or adding broad exclusions. This could indicate a compromised admin account or insider threat.
+  Detects a Bitdefender GravityZone protection module transitioning to disabled on an endpoint. The vendor reports this in two ways, both of which fire this rule:
+
+  - Product Modules Status (module=modules) with any of the protection flags set to 0. The doc-defined status keys are malware_status (Antimalware on-access), avc_status (Advanced Threat Control), pu_status (Anti-Phishing), dlp_status (Data Protection), app_control_status (Application Control), patch_management, and the exchange_* variants. A 0 means the module is currently off.
+  - Antitampering (Callback Evasion) fires when critical protection mechanisms have been disabled by a post-tampering incident.
+
+  This does not catch every policy edit - adding scan exclusions or narrowing content filtering categories only reaches the Control Center audit log. It catches the highest-impact edits: turning a whole protection module off.
 
   Next Steps:
-  1. Identify the administrator who modified the policy
-  2. Verify the policy change was authorized through change management
-  3. Review the specific settings that were weakened
-  4. Check for concurrent suspicious activity on managed endpoints
-  5. Restore the previous policy configuration if unauthorized
-  6. Review admin account access logs for compromise indicators
+  1. Identify who was authorised to change the policy. Cross-check the modules-status timestamp against the Control Center audit log for policy pushes to this endpoint's group.
+  2. Read which module was disabled: log.BitdefenderGZModule tells you the event, and the specific status key (log.malware_status, log.avc_status, etc.) tells you what turned off. Antimalware and ATC being off is a live-fire situation; the others are lower-severity but still deserve verification.
+  3. If antitampering fired, treat the endpoint as actively targeted rather than mis-configured. detection_technique will be Callback Evasion or Vulnerable Drivers.
+  4. Restore the previous policy configuration from the Control Center if the change was unauthorised. Do not rely on the local agent to accept a re-enable; verify with the next modules-status event.
+  5. Review activity on the endpoint during the disabled window - anything that arrived while protection was off would not have been detected.
+  6. Rotate the credentials of any admin account that could have pushed the change.
 where: |
-  (contains("log.message", ["policy", "configuration", "setting"]) &&
-   (contains("log.message", ["disabled", "weakened", "reduced", "lowered", "excluded"]) ||
-    (contains("log.message", "real-time") && contains("log.message", "off")) ||
-    (contains("log.message", "exclusion") && contains("log.message", "added")) ||
-    (contains("log.message", "protection") && contains("log.message", "disabled")))) &&
-  exists("log.severity")
-afterEvents:
-  - indexPattern: v11-log-antivirus-bitdefender-gz-*
-    with:
-      - field: log.hostId
-        operator: filter_term
-        value: '{{.log.hostId}}'
-    within: 1h
-    count: 3
+  equals("log.BitdefenderGZModule", "antitampering") ||
+  (equals("log.BitdefenderGZModule", "modules") &&
+   (equals("log.malware_status", "0") ||
+    equals("log.avc_status", "0") ||
+    equals("log.pu_status", "0") ||
+    equals("log.dlp_status", "0") ||
+    equals("log.app_control_status", "0") ||
+    equals("log.BitdefenderGZMalwareStatus", "0") ||
+    equals("log.BitdefenderGZAvcStatus", "0") ||
+    equals("log.BitdefenderGZPuStatus", "0") ||
+    equals("log.BitdefenderGZDlpStatus", "0") ||
+    equals("log.BitdefenderGZAppControlStatus", "0")))
 groupBy:
-  - lastEvent.log.eventType
-  - lastEvent.log.hostId
+  - target.host
+  - lastEvent.log.BitdefenderGZModule