Hi Mike,
I am using the index pattern logstash-* in my detection rule.
I am also posting the complete index mapping, in which i changed the mapping for organization, as well as the exported rule.
(P.S. The forums have a character limit so I am posting a pastebin link which contains my index mapping)
Index Mapping => https://pastebin.com/AM140nH4
Exported Rule =>
{"author":[],"actions":[],"created_at":"2020-11-05T10:24:43.640Z","updated_at":"2020-11-19T12:12:07.319Z","created_by":"elastic","description":"Adversaries may exploit software vulnerabilities in an attempt to collect elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.\n\nWhen initially gaining access to a system, an adversary may be operating within a lower privileged process which will prevent them from accessing certain resources on the system. Vulnerabilities may exist, usually in operating system components and software commonly running at higher permissions, that can be exploited to gain higher levels of access on the system. This could enable someone to move from unprivileged or user level permissions to SYSTEM or root permissions depending on the component that is vulnerable. This may be a necessary step for an adversary compromising a endpoint system that has been properly configured and limits other privilege escalation methods.","enabled":true,"false_positives":[],"filters":[],"from":"now-120s","id":"0a08f1a5-9857-41e1-ab84-5cd5b176ce56","immutable":false,"index":["logstash-*"],"interval":"1m","rule_id":"7e01639d-9158-4d41-af39-2cc6487de8fa","language":"kuery","license":"","output_index":".siem-signals-default","max_signals":100,"risk_score":50,"risk_score_mapping":[],"name":"Exploitation for Privilege Escalation (T1068)","query":"externalId : \"4672\"","references":[],"meta":{"from":"1m","kibana_siem_app_url":"https://cobalt.mycybercns.com/kibana/app/security"},"severity":"low","severity_mapping":[],"updated_by":"elastic","tags":[],"to":"now","type":"threshold","threat":[{"framework":"MITRE ATT&CK","technique":[{"reference":"https://attack.mitre.org/techniques/T1068","name":"Exploitation for Privilege Escalation","id":"T1068"}],"tactic":{"reference":"https://attack.mitre.org/tactics/TA0004","name":"Privilege Escalation","id":"TA0004"}}],"threshold":{"field":"deviceAddress","value":1},"throttle":"no_actions","timestamp_override":"@timestamp","version":44,"exceptions_list":[]}
{"exported_count":1,"missing_rules":[],"missing_rules_count":0}
Thanks