LoFP / if you have front-facing proxies that provide authentication and tls, this rule would need to be tuned to eliminate the source ip address of your reverse-proxy.

Techniques

• T1190
• T1595

Sample rules

Inbound Connection to an Unsecure Elasticsearch Node

• source: elastic
• technicques:
  • T1190
  • T1595

Description

Identifies Elasticsearch nodes that do not have Transport Layer Security (TLS), and/or lack authentication, and are accepting inbound network connections over the default Elasticsearch port.

Detection logic

(data_stream.dataset: network_traffic.http or (event.category: network_traffic and network.protocol: http)) and
http.response.status_code: 200 and destination.port: 9200 and network.direction: (inbound or ingress) and
not http.response.headers.content-type: "image/x-icon" and not http.request.headers.authorization: *