YARA-L rules: 04

// Copyright 2023 Google LLC. Licensed under Apache-2.0.

rule aws_guardduty_brute_force_activity_detected {

  meta:
    author = "Google Cloud Security"
    description = "Amazon GuardDuty detects a brute force activity in an Amazon EC2 or Amazon RDS instance."
    rule_id = "mr_33197748-cb9d-451f-8135-4b61cc5e4ca5"
    rule_name = "AWS GuardDuty Bruteforce Activity Detected"
    mitre_attack_tactic = "Credential Access"
    mitre_attack_technique = "Brute Force"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1110/"
    mitre_attack_version = "v13.1"
    type = "Alert"
    data_source = "AWS GuardDuty"
    platform = "AWS"
    severity = "High"
    priority = "High"

  events:
    $guardduty.metadata.vendor_name = "AMAZON"
    $guardduty.metadata.product_name = "AWS GuardDuty"
    $guardduty.metadata.product_event_type = /BruteForce/
    //Filter out sample findings
    $guardduty.security_result.about.labels["Sample"] != "true"

  outcome:
    $risk_score = max(35)
    $mitre_attack_tactic = "Credential Access"
    $mitre_attack_technique = "Brute Force"
    $mitre_attack_technique_id = "T1110"
    $event_count = count_distinct($guardduty.metadata.id)
    $principal_ip = array_distinct($guardduty.principal.ip)
    $principal_ip_country = array_distinct($guardduty.principal.ip_geo_artifact.location.country_or_region)
    $principal_ip_state = array_distinct($guardduty.principal.ip_geo_artifact.location.state)
    $principal_user_display_name = $guardduty.principal.user.user_display_name
    $aws_region = $guardduty.target.location.name
    $target_resource_name = $guardduty.target.resource.name
    $target_resource_product_object_id = $guardduty.target.resource.product_object_id
    $security_result_summary = array_distinct($guardduty.security_result.summary)
    $security_result_description = array_distinct($guardduty.security_result.description)
    $security_result_severity = array_distinct($guardduty.security_result.severity)
    $security_result_severity_details = array_distinct($guardduty.security_result.severity_details)
    $metadata_product_event_type = array_distinct($guardduty.metadata.product_event_type)

  condition:
    $guardduty
}

// Copyright 2023 Google LLC. Licensed under Apache-2.0.

rule google_workspace_user_ou_changed {

  meta:
    author = "Google Cloud Security"
    description = "Identifies when a Google Workspace user account is moved between Organizational Units."
    rule_id = "mr_e265b499-9a83-4e7d-acf8-ae7674e1c743"
    rule_name = "Google Workspace User Ou Changed"
    mitre_attack_tactic = "Persistence"
    mitre_attack_technique = "Account Manipulation: Additional Cloud Roles"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1098/003/"
    mitre_attack_version = "v13.1"
    type = "Alert"
    data_source = "Workspace Activity"
    severity = "High"
    priority = "High"

  events:
    $ws.metadata.vendor_name = "Google Workspace"
    $ws.metadata.product_name = "admin"
    $ws.metadata.product_event_type = "MOVE_USER_TO_ORG_UNIT"
    $ws.security_result.category_details = "USER_SETTINGS"

  outcome:
    $risk_score = max(70)
    $mitre_attack_tactic = "Persistence"
    $mitre_attack_technique = "Account Manipulation: Additional Cloud Roles"
    $mitre_attack_technique_id = "T1098.003"
    $event_count = count_distinct($ws.metadata.id)
    $principal_ip = array_distinct($ws.principal.ip)
    $principal_country = array_distinct($ws.principal.ip_geo_artifact.location.country_or_region)
    $principal_state = array_distinct($ws.principal.ip_geo_artifact.location.state)
    $principal_user_emails = array_distinct($ws.principal.user.email_addresses)
    $target_user_emails = array_distinct($ws.target.user.email_addresses)
    $principal_user_id = $ws.principal.user.userid
    $old_org_unit_name = $ws.about.labels["org_unit_name"]
    $new_org_unit_name = $ws.target.user.attribute.labels["new_value"]

  condition:
    $ws
}

// Copyright 2025 Google LLC. Licensed under Apache-2.0.

rule hacktool_dumpert_process_dumper_exec {
  meta:
    author = "Florian Roth (Nextron Systems)"
    description = "Detects the use of Dumpert process dumper, which dumps the lsass.exe process memory"
    reference = "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_dumpert.yml"
    rule_name = "HackTool - Dumpert Process Dumper Execution"
    sigma_uuid = "2704ab9e-afe2-4854-a3b1-0c0706d03578"
    sigma_status = "test"
    rule_id = "mr_39c682b6-b50e-4d22-95de-c9d579c8fc44"
    tactic = "TA0006"
    technique = "T1003.001"
    type = "Detection"
    data_source = "Sysmon"
    platform = "Windows"
    severity = "Critical"
    priority = "Critical"
    false_positives = "Very unlikely"

  events:
    $process.metadata.event_type = "PROCESS_LAUNCH"
    (
        $process.target.process.file.file_metadata.pe.import_hash = "09D278F9DE118EF09163C6140255C690" nocase or
        $process.target.process.file.pe_file.imphash = "09D278F9DE118EF09163C6140255C690" nocase or
        strings.contains(strings.to_lower($process.target.process.command_line), "dumpert.dll")
    )
    $process.principal.hostname = $hostname

  match:
    $hostname over 5m

  outcome:
    //example usage of specifying test user and hostname to adjust risk score
    $risk_score = max(if($process.principal.user.userid = "user" and $process.principal.hostname = "hostname", 0, 15))
    $principal_process_pid = array_distinct($process.principal.process.pid)
    $principal_process_command_line = array_distinct($process.principal.process.command_line)
    $principal_process_file_sha256 = array_distinct($process.principal.process.file.sha256)
    $principal_process_file_full_path = array_distinct($process.principal.process.file.full_path)
    $principal_process_product_specfic_process_id = array_distinct($process.principal.process.product_specific_process_id)
    $principal_process_parent_process_product_specfic_process_id = array_distinct($process.principal.process.parent_process.product_specific_process_id)
    $target_process_pid = array_distinct($process.target.process.pid)
    $target_process_command_line = array_distinct($process.target.process.command_line)
    $target_process_file_sha256 = array_distinct($process.target.process.file.sha256)
    $target_process_file_full_path = array_distinct($process.target.process.file.full_path)
    $target_process_product_specfic_process_id = array_distinct($process.target.process.product_specific_process_id)
    $principal_user_userid = array_distinct($process.principal.user.userid)
    $log_type = array_distinct(strings.concat($process.metadata.log_type,"/",$process.metadata.product_event_type))

  condition:
    $process
}

// Copyright 2023 Google LLC. Licensed under Apache-2.0.

rule ioc_sha256_hash_vt {

  meta:
    author = "Google Cloud Security"
    description = "Detect file/process events with watchlisted hashes from MISP that VT flagged as MS Office docx file types"
    rule_id = "mr_d36dec67-3af0-4d52-be78-1fe14c865006"
    rule_name = "IOC SHA256 Hash VT"
    type = "alert"
    tags = "threat indicators, vt enrichment"
    assumption = "Assumes MISP data has been ingested into entity graph; this rule can be modified to utilize other TI indicators"
    data_source = "microsoft sysmon"
    severity = "Medium"
    priority = "Medium"

  events:
    $process.metadata.event_type = "PROCESS_LAUNCH" or $process.metadata.event_type ="FILE_CREATION"
    $process.principal.hostname = $hostname
    $process.target.file.sha256 != ""
    $process.target.file.sha256 = $sha256
    // Enriched field from VirusTotal integration, can be commented out or modified if not using
    $process.target.file.file_type = "FILE_TYPE_DOCX"

    // Correlates with MISP data; can be modified based on your MISP parser or other TI
    $ioc.graph.metadata.product_name = "MISP"
    $ioc.graph.metadata.entity_type = "FILE"
    $ioc.graph.metadata.source_type = "ENTITY_CONTEXT"
    $ioc.graph.entity.file.sha256 = $sha256

  match:
    $hostname over 15m

  outcome:
    $risk_score = 65
    $event_count = count_distinct($process.metadata.id)
    // added to populate alert graph with additional context
    // Commented out principal.hostname because it is already represented in graph as match variable. If match changes, can uncomment to add to results
    //$principal_hostname = array_distinct($process.principal.hostname)
    $principal_process_pid = array_distinct($process.principal.process.pid)
    $principal_process_command_line = array_distinct($process.principal.process.command_line)
    $principal_process_file_sha256 = array_distinct($process.principal.process.file.sha256)
    $principal_process_file_full_path = array_distinct($process.principal.process.file.full_path)
    $principal_process_product_specific_process_id = array_distinct($process.principal.process.product_specific_process_id)
    $principal_process_parent_process_product_specific_process_id = array_distinct($process.principal.process.parent_process.product_specific_process_id)
    $target_process_pid = array_distinct($process.target.process.pid)
    $target_process_command_line = array_distinct($process.target.process.command_line)
    $target_process_file_sha256 = array_distinct($process.target.process.file.sha256)
    $target_process_file_full_path = array_distinct($process.target.process.file.full_path)
    $target_process_product_specific_process_id = array_distinct($process.target.process.product_specific_process_id)
    $principal_user_userid = array_distinct($process.principal.user.userid)
    $target_file_sha256 = array_distinct($process.target.file.sha256)
    $target_file_full_path = array_distinct($process.target.file.full_path)

  condition:
    $process and $ioc
}

// Copyright 2023 Google LLC. Licensed under Apache-2.0.

rule okta_suspicious_use_of_a_session_cookie {

  meta:
    author = "Google Cloud Security"
    description = "Detects when an adversary attempts to reuse a stolen web session cookie in a different device that has a different OS, IP, Browser or User Agent."
    rule_id = "mr_913cbc7a-86c9-46a4-b822-023b4aa17106"
    rule_name = "Okta Suspicious Use Of A Session Cookie"
    reference = "https://sec.okta.com/sessioncookietheft"
    mitre_attack_tactic = "Credential Access"
    mitre_attack_technique = "Steal Web Session Cookie"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1539/"
    mitre_attack_version = "v13.1"
    type = "Alert"
    data_source = "Okta"
    severity = "Medium"
    priority = "Medium"

  events:
    $login.metadata.product_name = "Okta"
    $login.metadata.vendor_name = "Okta"
    $login.metadata.event_type = "USER_UNCATEGORIZED"
    $login.metadata.product_event_type = "policy.evaluate_sign_on"
    (
        $login.security_result.action = "ALLOW" or
        $login.security_result.action = "ALLOW_WITH_MODIFICATION" or
        $login.security_result.action = "CHALLENGE"
    )
    $login.principal.user.userid = $userid
    $login.security_result.detection_fields["dtHash"] = $dtHash

  match:
    $userid, $dtHash over 1h

  outcome:
    $risk_score = max(35)
    $mitre_attack_tactic = "Credential Access"
    $mitre_attack_technique = "Steal Web Session Cookie"
    $target_os = array_distinct($login.network.http.parsed_user_agent.os)
    $dc_target_os = count_distinct($login.network.http.parsed_user_agent.os)
    $target_browser = array_distinct($login.network.http.parsed_user_agent.browser)
    $dc_target_browser = count_distinct($login.network.http.parsed_user_agent.browser)
    $target_user_agent = array_distinct($login.network.http.user_agent)
    $principal_ip = array_distinct($login.principal.ip)
    $dc_principal_ip = count_distinct($login.principal.ip)
    $principal_ip_country = array_distinct($login.principal.ip_geo_artifact.location.country_or_region)
    $principal_ip_state = array_distinct($login.principal.ip_geo_artifact.location.state)
    $principal_ip_city = array_distinct($login.principal.location.city)
    $dc_principal_ip_city = count_distinct($login.principal.location.city)
    $security_result_summary = array_distinct($login.security_result.summary)
    $principal_user_managers_email_addresses = array_distinct($login.principal.user.managers.email_addresses)
    $principal_user_userid = array_distinct($login.principal.user.userid)

  condition:
    $login and $dc_principal_ip > 1 and ($dc_target_browser > 1 or $dc_target_os > 1)
}

// Copyright 2025 Google LLC. Licensed under Apache-2.0.

rule win_pua_detection_of_uncommon_rmm {

  meta:
    author = "Georg Lauenstein - suresecure GmbH"
    description = "This detection rule identifies uncommon or suspicious Remote Monitoring and Management (RMM) tools, leveraging intelligence from the LOL-RMM (Living Off the Land RMM) project. While RMM tools are widely used for IT administration, remote support, and network management, they are also frequently abused by attackers, initial access brokers (IABs), and ransomware operators to establish persistent remote access, execute malicious commands, or deploy additional payloads. This rule detects RMM software that is not commonly observed in the environment, indicating potential unauthorized access or lateral movement."
    rule_id = "mr_f5681a0f-215f-4055-80c7-864ee39bcfb8"
    rule_name = "Uncommon or Suspicious RMM Tool Execution Detected"
    tactic = "TA0011"
    technique = "T1219"
    reference = "https://lolrmm.io/"
    type = "alert"
    platform = "Windows, EDR"
    data_source = "Microsoft Sysmon, Windows Event Logs"
    severity = "Medium"  // Adjust based on your risk assessment
    priority = "Medium"  // Adjust based on your incident response process

  events:
    $rmm_tool.metadata.event_type = "PROCESS_LAUNCH"

    (
      // 247ithelp.com (ConnectWise) RMM
      $rmm_tool.target.process.file.full_path = /\\Remote Workforce Client\.exe$/ nocase
    ) or

    (
      // Potential Acronic Cyber Protect (Remotix) RMM Tool Process Activity
      $rmm_tool.target.process.file.full_path = /\\AcronisCyberProtectConnectAgent\.exe$/ nocase
    ) or

    (
      // Potential AeroAdmin RMM Tool Process Activity
      $rmm_tool.target.process.file.full_path = /\\aeroadmin\.exe|\\AeroAdmin\.exe/ nocase
    ) or

    (
      // Potential Air Live Drive RMM Tool Process Activity
      $rmm_tool.target.process.file.full_path = /\\AirLiveDrive\.exe$/ nocase
    ) or

    (
      // Potential AliWangWang-remote-control RMM Tool Process Activity
      $rmm_tool.target.process.file.full_path = /\\alitask\.exe$/ nocase
    ) or

    (
      // Potential Alpemix RMM Tool Process Activity
      $rmm_tool.target.process.file.full_path = /\\AlpemixService\.exe$/ nocase
    ) or

    (
      // Potential Any Support RMM Tool Process Activity
      $rmm_tool.target.process.file.full_path = /\\ManualLauncher\.exe$/ nocase
    ) or

    (
      // Potential Anyplace Control RMM Tool Process Activity
      $rmm_tool.target.process.file.full_path = /\\apc_host\.exe$/ nocase
    ) or

    (
      // Potential aria2 RMM Tool Process Activity
      $rmm_tool.target.process.file.full_path = /\\aria2c\.exe$/ nocase
    ) or

    (
      // Potential Atera RMM Tool Process Activity
      $rmm_tool.target.process.file.full_path = /\\AgentPackageNetworkDiscovery\.exe|\\AgentPackageTaskScheduler\.exe|\\AteraAgent\.exe|\\atera_agent\.exe|\\ateraagent\.exe/ nocase
    ) or

    (
      // Potential Auvik RMM Tool Process Activity
      $rmm_tool.target.process.file.full_path = /\\auvik\.engine\.exe|\\auvik\.agent\.exe/ nocase
    ) or

    (
      // Potential Absolute (Computrace) RMM Tool Process Activity
      $rmm_tool.target.process.file.full_path = /\\rpcnet\.exe|\\ctes\.exe|\\ctespersitence\.exe|\\cteshostsvc\.exe|\\rpcld\.exe/ nocase
    ) or

    (
      // Potential Bluetrait MSP Agent Tool Process Activity
      $rmm_tool.target.process.file.full_path = /\\Bluetrait MSP Agent\.exe|\\BluetraitUserAgent\.exe|\\Bluetrait Agent\\libraries\\paexec\.exe/ nocase
    ) or

    (
      // Potential BeamYourScreen RMM Tool Process Activity
      $rmm_tool.target.process.file.full_path = /\\beamyourscreen\.exe|\\beamyourscreen-host\.exe/ nocase
    ) or

    (
      // Potential Connectwise Automate (LabTech) RMM Tool Process Activity
      $rmm_tool.target.process.file.full_path = /\\ltsvc\.exe|\\ltsvcmon\.exe|\\lttray\.exe/ nocase
    ) or

    (
      // Potential Duplicati RMM Tool Process Activity
      $rmm_tool.target.process.file.full_path = /\\Duplicati\.Server\.exe$/ nocase
    ) or

    (
      // Potential FixMe.it RMM Tool Process Activity
      $rmm_tool.target.process.file.full_path = /\\FixMeit Unattended Access Setup\.exe|\\TiExpertStandalone\.exe|\\FixMeit Client\.exe|\\FixMeit Expert Setup\.exe|\\TiExpertCore\.exe|\\TiClientCore\.exe/ nocase
    ) or

    (
      // Potential FleetDeck.io RMM Tool Process Activity
      $rmm_tool.target.process.file.full_path = /\\fleetdeck_agent_svc\.exe|\\fleetdeck_commander_svc\.exe|\\fleetdeck_installer\.exe|\\fleetdeck_commander_launcher\.exe|\\fleetdeck_agent\.exe/ nocase
    ) or

    (
      // Potential Level.io RMM Tool Process Activity
      $rmm_tool.target.process.file.full_path = /\\level-windows-amd64\.exe|\\level\.exe|\\level-remote-control-ffmpeg\.exe/ nocase
    ) or

    (
      // Potential NetSupport Manager RMM Tool Process Activity
      $rmm_tool.target.process.file.full_path = /\\pcictlui\.exe|\\client32\.exe|\\pcicfgui\.exe/ nocase
    ) or

    (
      // Potential NinjaRMM RMM Tool Process Activity
      $rmm_tool.target.process.file.full_path = /\\ninjarmmagent\.exe|\\NinjaRMMAgent\.exe|\\NinjaRMMAgenPatcher\.exe|\\ninjarmm-cli\.exe/ nocase
    ) or

    (
      // Potential REMCOS RMM Tool Process Activity
      $rmm_tool.target.process.file.full_path = /\\remcos/ nocase
    ) or

    (
      // Potential Rocket Remote Desktop RMM Tool Process Activity
      $rmm_tool.target.process.file.full_path = /\\RocketRemoteDesktop_Setup\.exe$/ nocase
    ) or

    (
      // Potential Tactical RMM Tool Process Activity
      $rmm_tool.target.process.file.full_path = /\\tacticalrmm\.exe$/ nocase
    ) or

    (
      // Potential TightVNC RMM Tool Process Activity
      $rmm_tool.target.process.file.full_path = /\\tvnviewer\.exe|\\tvnserver\.exe/ nocase
    ) or

    (
      // Potential Zoho Assist RMM Tool Process Activity
      $rmm_tool.target.process.file.full_path = /\\zaservice\.exe|\\ZA_Access\.exe|\\ZohoMeeting\.exe|\\Zohours\.exe|\\zohotray\.exe|\\ZohoURSService\.exe|\\Zaservice\.exe|\\za_connect\.exe|\\ZMAgent\.exe/ nocase
    )

    $rmm_tool.principal.hostname = $hostname
    $rmm_tool.target.process.file.full_path = $image
    $rmm_tool.extracted.fields["Company"] = $rmm_company_info

    // Filter for known RMM Tools based on Customer Information
    // not $rmm_tool.target.process.file.full_path in %known_rmm_tools nocase

  match:
    $hostname, $image, $rmm_company_info over 10m

  outcome:
    $risk_score = max(65)
    $event_count = count_distinct($rmm_tool.metadata.id)
    $principal_process_pid = array_distinct($rmm_tool.principal.process.pid)
    $principal_process_command_line = array_distinct($rmm_tool.principal.process.command_line)
    $principal_process_file_sha256 = array_distinct($rmm_tool.principal.process.file.sha256)
    $principal_process_file_full_path = array_distinct($rmm_tool.principal.process.file.full_path)
    $principal_process_product_specific_process_id = array_distinct($rmm_tool.principal.process.product_specific_process_id)
    $principal_process_parent_process_product_specific_process_id = array_distinct($rmm_tool.principal.process.parent_process.product_specific_process_id)
    $target_process_pid = array_distinct($rmm_tool.target.process.pid)
    $target_process_command_line = array_distinct($rmm_tool.target.process.command_line)
    $target_process_file_sha256 = array_distinct($rmm_tool.target.process.file.sha256)
    $target_process_file_full_path = array_distinct($rmm_tool.target.process.file.full_path)
    $target_process_product_specific_process_id = array_distinct($rmm_tool.target.process.product_specific_process_id)
    $principal_user_userid = array_distinct($rmm_tool.principal.user.userid)

  condition:
    $rmm_tool
}