YARA-L rules: 0g

// Copyright 2024 Google LLC. Licensed under Apache-2.0.

rule github_enterprise_audit_log_stream_modified {

  meta:
    author = "Google Cloud Security"
    description = "Detects when a GitHub audit log stream is modified (e.g. paused, enabled, or disabled). An adversary may attempt to interrupt audit logging to erase their tracks."
    rule_id = "mr_6a64250e-df54-4037-80f7-1486775c6f37"
    rule_name = "GitHub Enterprise Audit Log Stream Modified"
    assumption = "Your GitHub enterprise audit log settings are configured to log the source IP address for events. Reference: https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization"
    type = "alert"
    severity = "High"
    priority = "High"
    platform = "GitHub"
    data_source = "github"
    mitre_attack_tactic = "Defense Evasion"
    mitre_attack_technique = "Impair Defenses: Disable or Modify Cloud Logs"
    mitre_attack_url = "https://attack.mitre.org/versions/v14/techniques/T1562/008/"
    mitre_attack_version = "v14"
    reference = "https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise"

  events:
    $github.metadata.vendor_name = "GITHUB" nocase
    $github.metadata.product_name = "GITHUB"
    $github.metadata.product_event_type = "audit_log_streaming.update"

  outcome:
    $risk_score = max(85)
    $mitre_attack_tactic = "Defense Evasion"
    $mitre_attack_technique = "Impair Defenses: Disable or Modify Cloud Logs"
    $mitre_attack_technique_id = "T1562.008"
    $principal_ip = array_distinct($github.principal.ip)
    $principal_user_userid = array_distinct($github.principal.user.userid)
    $principal_ip_country = array_distinct($github.principal.ip_geo_artifact.location.country_or_region)
    $principal_ip_state = array_distinct($github.principal.ip_geo_artifact.location.state)
    $principal_ip_city = array_distinct($github.principal.location.city)
    $security_result_summary = array_distinct($github.security_result.summary)

  condition:
    $github
}

// Copyright 2023 Google LLC. Licensed under Apache-2.0.

rule google_workspace_malicious_file_downloaded {

  meta:
    author = "Google Cloud Security"
    description = "Identifies when a user downloads a potentially malicious file from Google Drive."
    rule_id = "mr_72af4504-955b-4c61-9071-bb767c9bae88"
    rule_name = "Google Workspace Malicious File Downloaded"
    mitre_attack_tactic = "Execution"
    mitre_attack_technique = "User Execution: Malicious File"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1204/002/"
    mitre_attack_version = "v13.1"
    type = "Alert"
    data_source = "Workspace Activity"
    severity = "Medium"
    priority = "Medium"

  events:
    $ws.metadata.vendor_name = "Google Workspace"
    $ws.metadata.product_name = "drive"
    ($ws.metadata.product_event_type = "download" or
    $ws.metadata.product_event_type = "view" or
    $ws.metadata.product_event_type = "copy")

    ($ws.target.resource.attribute.labels["visibility"] = "people_with_link" or
    $ws.target.resource.attribute.labels["visibility"] = "public_on_the_web")
    $ws.target.resource.name = /.*\.dll|.*\.exe|.*\.scr|.*\.jar|.*\.pif|.*\.app|.*\.dmg|.*\.pkg|.*\.elf|.*\.so|.*\.bin|.*\.deb|.*\.rpm|.*\.sh|.*\.hta|.*\.lnk/

  outcome:
    $risk_score = max(35)
    $mitre_attack_tactic = "Execution"
    $mitre_attack_technique = "User Execution: Malicious File"
    $mitre_attack_technique_id = "T1204.002"
    $event_count = count_distinct($ws.metadata.id)
    $product_event_type = $ws.metadata.product_event_type
    $userid = $ws.principal.user.userid
    $doc_type = $ws.src.resource.attribute.labels["doc_type"]
    $owner = $ws.target.resource.attribute.labels["owner"]
    $doc_name = $ws.target.resource.name
    //$doc_id = $ws.target.resource.product_object_id

  condition:
    $ws
}

// Copyright 2025 Google LLC. Licensed under Apache-2.0.

rule local_accounts_discovery {

  meta:
    author = "Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community"
    description = "Local accounts, System Owner/User discovery using operating systems utilities"
    reference = "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_local_system_owner_account_discovery.yml"
    license = "https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md"
    rule_name = "Local Accounts Discovery"
    sigma_uuid = "502b42de-4306-40b4-9596-6f590c81f073"
    sigma_status = "test"
    rule_id = "mr_3a6b5c72-8126-4f43-a4ac-9c8bbac7fa72"
    tactic = "TA0007"
    technique = "T1033"
    type = "Detection"
    data_source = "Sysmon"
    platform = "Windows"
    severity = "Low"
    priority = "Low"
    false_positives = "Legitimate administrator or user enumerates local users for legitimate reason"

  events:
    $process.metadata.event_type = "PROCESS_LAUNCH"
    (
      (
        re.regex($process.target.process.file.full_path, `\\cmd\.exe$`) nocase and
        strings.contains(strings.to_lower($process.target.process.command_line), " /c") and
        strings.contains(strings.to_lower($process.target.process.command_line), "dir ") and
        strings.contains(strings.to_lower($process.target.process.command_line), "\\users\\") and
        NOT strings.contains(strings.to_lower($process.target.process.command_line), " rmdir ")
      )
      or
      (
        re.regex($process.target.process.file.full_path, `\\net\.exe$`) nocase or
        re.regex($process.target.process.file.full_path, `\\net1\.exe$`) nocase and
        strings.contains(strings.to_lower($process.target.process.command_line), "user") and
        NOT strings.contains(strings.to_lower($process.target.process.command_line), "/domain") and
        NOT strings.contains(strings.to_lower($process.target.process.command_line), "/add") and
        NOT strings.contains(strings.to_lower($process.target.process.command_line), "/delete") and
        NOT strings.contains(strings.to_lower($process.target.process.command_line), "/active") and
        NOT strings.contains(strings.to_lower($process.target.process.command_line), "/expires") and
        NOT strings.contains(strings.to_lower($process.target.process.command_line), "/passwordreq") and
        NOT strings.contains(strings.to_lower($process.target.process.command_line), "/scriptpath") and
        NOT strings.contains(strings.to_lower($process.target.process.command_line), "/times") and
        NOT strings.contains(strings.to_lower($process.target.process.command_line), "/workstations")
      )
      or
      (
        re.regex($process.target.process.file.full_path, `\\whoami\.exe$`) nocase or
        re.regex($process.target.process.file.full_path, `\\quser\.exe$`) nocase or
        re.regex($process.target.process.file.full_path, `\\qwinsta\.exe$`) nocase or
        (
          re.regex($process.target.process.file.full_path, `\\wmic\.exe$`) nocase and
          strings.contains(strings.to_lower($process.target.process.command_line), "useraccount") and
          strings.contains(strings.to_lower($process.target.process.command_line), "get")
        ) or
        (
          re.regex($process.target.process.file.full_path, `\\cmdkey\.exe$`) nocase and
          strings.contains(strings.to_lower($process.target.process.command_line), " /l")
        )
      )
    )
    $process.principal.hostname = $hostname

  match:
    $hostname over 5m

  outcome:
    //example usage of specifying test user and hostname to adjust risk score
    $risk_score = max(if($process.principal.user.userid = "user" and $process.principal.hostname = "hostname", 0, 15))
    $principal_process_pid = array_distinct($process.principal.process.pid)
    $principal_process_command_line = array_distinct($process.principal.process.command_line)
    $principal_process_file_sha256 = array_distinct($process.principal.process.file.sha256)
    $principal_process_file_full_path = array_distinct($process.principal.process.file.full_path)
    $principal_process_product_specfic_process_id = array_distinct($process.principal.process.product_specific_process_id)
    $principal_process_parent_process_product_specfic_process_id = array_distinct($process.principal.process.parent_process.product_specific_process_id)
    $target_process_pid = array_distinct($process.target.process.pid)
    $target_process_command_line = array_distinct($process.target.process.command_line)
    $target_process_file_sha256 = array_distinct($process.target.process.file.sha256)
    $target_process_file_full_path = array_distinct($process.target.process.file.full_path)
    $target_process_product_specfic_process_id = array_distinct($process.target.process.product_specific_process_id)
    $principal_user_userid = array_distinct($process.principal.user.userid)
    $log_type = array_distinct(strings.concat($process.metadata.log_type,"/",$process.metadata.product_event_type))

  condition:
    $process
}

// Copyright 2024 Google LLC. Licensed under Apache-2.0.

rule onelogin_super_user_privileges_assigned {

  meta:
    author = "Google Cloud Security"
    description = "Detects when a user is assigned super user privileges."
    rule_id = "mr_5a2dc2cc-a66a-413c-83de-99e0ed698849"
    rule_name = "OneLogin Super User Privileges Assigned"
    reference = "https://onelogin.service-now.com/kb_view_customer.do?sysparm_article=KB0010391"
    mitre_attack_tactic = "Privilege Escalation"
    mitre_attack_technique = "Valid Accounts: Cloud Accounts"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1078/004/"
    mitre_attack_version = "v15.1"
    type = "Alert"
    data_source = "OneLogin"
    severity = "High"
    priority = "High"

  events:
     $user.metadata.event_type = "USER_CHANGE_PERMISSIONS"
     $user.metadata.product_name = "ONELOGIN_SSO"
     $user.metadata.vendor_name = "ONELOGIN"
     $user.metadata.product_event_type = "72" //user granted permission to a specific privilege
     $user.target.resource.name = "Super user"

  outcome:
    $risk_score = max(35)
    $mitre_attack_tactic = "Privilege Escalation"
    $mitre_attack_technique = "Valid Accounts: Cloud Accounts"
    $principal_user_userid = array_distinct($user.principal.user.userid)
    $principal_user_user_display_name = array_distinct($user.principal.user.user_display_name)
    $principal_ip = array_distinct($user.principal.ip)
    $principal_ip_country = array_distinct($user.principal.ip_geo_artifact.location.country_or_region)
    $principal_ip_state = array_distinct($user.principal.ip_geo_artifact.location.state)
    $target_user_userid = array_distinct($user.target.user.userid)

  condition:
    $user
}

// Copyright 2026 Google LLC. Licensed under Apache-2.0.

rule sap_sensitive_role_assignment_correlation {

  meta:
    author = "Google Cloud Security"
    description = "Correlates SAP Change Documents with Security Audit logs to detect sensitive role assignments and self-assignments."
    severity = "Medium"
    tactic = "TA0004"
    technique = "T1098"

  events:
    $change.metadata.log_type = "SAP_CHANGE_DOCUMENT"
    $change.target.resource.name = "PFCG"
    $change.target.resource.attribute.labels["TABNAME"] = "AGR_USERS"
    $change.target.resource.attribute.labels["CHANGE_IND"] = "I"

    $client = $change.target.resource.attribute.labels["MANDANT"]
    $target_user = $change.target.resource.attribute.labels["TABKEY"]

    //joining on user value
    $user = $change.principal.user.userid
    $user = $audit.principal.user.userid

    $audit.metadata.log_type = "SAP_SECURITY_AUDIT"
    $client = $audit.target.resource.attribute.labels["slgmand"]

    not $user in %sap_admin_users.user

  match:
    $user, $client over 30m

  outcome:
    $assigned_role = array_distinct($change.target.resource.product_object_id)
    $principal_ip = array_distinct($audit.principal.ip)
    $audit_description = array_distinct($audit.metadata.description)

  condition:
    $change and $audit
}