YARA-L rules: 0d

// Copyright 2023 Google LLC. Licensed under Apache-2.0.

rule aws_guardduty_crypto_currency_activity_detected {

  meta:
    author = "Google Cloud Security"
    description = "Amazon GuardDuty detects CryptoCurrency activity in Amazon EC2, AWS Lambda or Amazon EKS Runtimes."
    rule_id = "mr_be21d1ff-4d2b-4d0b-a928-0fa5d534cba5"
    rule_name = "AWS GuardDuty Cryptocurrency Activity Detected"
    mitre_attack_tactic = "Impact"
    mitre_attack_technique = "Resource Hijacking"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1496/"
    mitre_attack_version = "v13.1"
    type = "Alert"
    data_source = "AWS GuardDuty"
    platform = "AWS"
    severity = "High"
    priority = "High"

  events:
    $guardduty.metadata.vendor_name = "AMAZON"
    $guardduty.metadata.product_name = "AWS GuardDuty"
    $guardduty.metadata.product_event_type = /CryptoCurrency|CryptoMinerExecuted|BitcoinDomainRequest/
    //Filter out sample findings
    $guardduty.security_result.about.labels["Sample"] != "true"

  outcome:
    $risk_score = max(35)
    $mitre_attack_tactic = "Impact"
    $mitre_attack_technique = "Resource Hijacking"
    $mitre_attack_technique_id = "T1496"
    $event_count = count_distinct($guardduty.metadata.id)
    $principal_ip = array_distinct($guardduty.principal.ip)
    $principal_ip_country = array_distinct($guardduty.principal.ip_geo_artifact.location.country_or_region)
    $principal_ip_state = array_distinct($guardduty.principal.ip_geo_artifact.location.state)
    $principal_user_display_name = $guardduty.principal.user.user_display_name
    $aws_region = $guardduty.target.location.name
    $target_resource_name = $guardduty.target.resource.name
    $target_resource_product_object_id = $guardduty.target.resource.product_object_id
    $security_result_summary = array_distinct($guardduty.security_result.summary)
    $security_result_description = array_distinct($guardduty.security_result.description)
    $security_result_severity = array_distinct($guardduty.security_result.severity)
    $security_result_severity_details = array_distinct($guardduty.security_result.severity_details)
    $metadata_product_event_type = array_distinct($guardduty.metadata.product_event_type)

  condition:
    $guardduty
}

// Copyright 2025 Google LLC. Licensed under Apache-2.0.

rule entra_id_login_activity_to_uncommon_mscloud_apps {

  meta:
    author = "Google Cloud Security"
    description = "This rule detects Azure AD login activity to apps other than a defined list of first party MS Cloud Apps. Note that Azure Active Directory PowerShell and custom Azure apps are not in this list by default"
    assumption = "The lists first_party_ms_cloud_apps is populated and tuned as needed"
    rule_id = "mr_1a39c017-9045-48d4-928d-096511edf3cc"
    rule_name = "Entra ID Login Activity to Uncommon MS Cloud Apps"
    tactic = "TA0001"
    technique = "T1078.004"
    reference = "https://learn.microsoft.com/en-us/troubleshoot/azure/active-directory/verify-first-party-apps-sign-in"
    type = "alert"
    platform = "azure"
    data_source = "azure ad"
    severity = "Low"
    priority = "Low"

  events:
    $login.metadata.event_type = "USER_LOGIN"
    $login.metadata.product_name = "Azure AD"
    $login.metadata.vendor_name = "Microsoft"
    $login.security_result.action = "ALLOW"
    not $login.target.resource.attribute.labels["App Id"] in %first_party_ms_cloud_apps

    // Below is to filter ADFS Sync Account that runs every 30 minutes between AD and Azure; can use userid or email address
    //$login.target.user.userid = "insert your userid here"
    $login.target.user.user_display_name != "On-Premises Directory Synchronization Service Account"

    $login.target.user.userid = $userid

  match:
    $userid over 5m

  outcome:
    $risk_score = 35
    $event_count = count_distinct($login.metadata.id)
    $target_application = array_distinct($login.target.application)
    $traget_application_guid = array_distinct($login.target.resource.attribute.labels["App Id"])
    $security_description = array_distinct($login.security_result.description)
    $security_summary = array_distinct($login.security_result.summary)
    $country_region_login_attempt = array_distinct(strings.concat($login.principal.location.city," ",$login.principal.location.state," ",$login.principal.location.country_or_region))
    //Used for match condition, don't need as outcome variable as well
    //$target_user_userid = array_distinct($login.target.user.userid)

  condition:
    $login
}

// Copyright 2024 Google LLC. Licensed under Apache-2.0.

 rule gcp_admin_privileged_roles_added_to_service_accounts {

  meta:
    author = "Google Cloud Security"
    description = "Detect when admin privileged roles such as Owner or Editor are added to a Service Account."
    rule_id = "mr_9ffebc73-6d73-40bd-8973-2d53a810272f"
    rule_name = "GCP Admin Privileged Roles Added To Service Accounts"
    mitre_attack_tactic = "Persistence, Privilege Escalation"
    mitre_attack_technique = "Account Manipulation: Additional Cloud Roles"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1098/003/"
    mitre_attack_version = "v14.1"
    type = "Alert"
    data_source = "GCP Cloud Audit"
    platform = "GCP"
    severity = "Low"
    priority = "Low"

  events:
    $gcp.metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
    $gcp.metadata.log_type = "GCP_CLOUDAUDIT"
    $gcp.metadata.product_event_type = "SetIamPolicy"
    $gcp.security_result.action = "ALLOW"
    $gcp.target.resource.attribute.labels["ser_binding_deltas_action"] = "ADD"
    $gcp.target.resource.attribute.labels["ser_binding_deltas_role"] = /roles\/owner.*|roles\/editor.*/ nocase
    $gcp.target.resource.attribute.labels["ser_binding_deltas_member"] = /^serviceAccount/ nocase

  outcome:
    $risk_score = max(35)
    $mitre_attack_tactic = "Persistence, Privilege Escalation"
    $mitre_attack_technique = "Account Manipulation: Additional Cloud Roles"
    $mitre_attack_technique_id = "T1098.003"
    $event_count = count_distinct($gcp.metadata.id)
    $network_http_user_agent = array_distinct($gcp.network.http.user_agent)
    $principal_ip = array_distinct($gcp.principal.ip)
    $principal_ip_country = array_distinct($gcp.principal.ip_geo_artifact.location.country_or_region)
    $principal_ip_state = array_distinct($gcp.principal.ip_geo_artifact.location.state)
    $principal_user_id = $gcp.principal.user.userid
    $principal_user_display_name = $gcp.principal.user.user_display_name
    $target_resource_name = $gcp.target.resource.name
    $event_name = $gcp.metadata.product_event_type
    $target_email_addresses = array_distinct($gcp.target.user.email_addresses)

  condition:
    $gcp
}

// Copyright 2025 Google LLC. Licensed under Apache-2.0.

rule potential_cred_dumping_via_lsass_silentprocessexit_technique {

  meta:
    author = "Florian Roth (Nextron Systems)"
    description = "Detects changes to the Registry in which a monitor program gets registered to dump the memory of the lsass.exe process"
    reference = "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_event/registry_event_silentprocessexit_lsass.yml"
    license = "https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md"
    rule_name = "Potential Credential Dumping Via LSASS SilentProcessExit Technique"
    sigma_uuid = "55e29995-75e7-451a-bef0-6225e2f13597"
    sigma_status = "test"
    rule_id = "mr_bc2279f0-9b27-485d-b392-ff6f13ae68df"
    tactic = "TA0006"
    technique = "T1003.001"
    type = "Detection"
    data_source = "Sysmon"
    platform = "Windows"
    severity = "Critical"
    priority = "Critical"
    false_positives = "Unlikely"

  events:
    $registry.metadata.event_type = "REGISTRY_MODIFICATION"
    //$registry.metadata.product_event_type = "13"
    strings.contains(strings.to_lower($registry.target.registry.registry_key), "microsoft\\windows nt\\currentversion\\silentprocessexit\\lsass.exe")

    $registry.principal.hostname = $hostname

  match:
    $hostname over 5m

  outcome:
    //example usage of specifying test user and hostname to adjust risk score
    $risk_score = max(if($registry.principal.user.userid = "user" and $registry.principal.hostname = "hostname", 0, 15))
    $principal_hostname = array_distinct($registry.principal.hostname)
    $principal_process_pid = array_distinct($registry.principal.process.pid)
    $principal_process_file_full_path = array_distinct($registry.principal.process.file.full_path)
    $principal_process_product_specific_process_id = array_distinct($registry.principal.process.product_specific_process_id)
    $principal_user_userid = array_distinct($registry.principal.user.userid)
    $target_registry_key = array_distinct($registry.target.registry.registry_key)
    $target_registry_value = array_distinct($registry.target.registry.registry_value_data)

  condition:
    $registry
}