YARA-L rules: 0l

// Copyright 2023 Google LLC. Licensed under Apache-2.0.

rule aws_guardduty_command_and_control_activity_detected {

  meta:
    author = "Google Cloud Security"
    description = "Amazon GuardDuty detects Command and control activity in Amazon EC2, AWS Lambda or Amazon EKS Runtimes."
    rule_id = "mr_dc0c33c7-35e3-44e2-b149-99212f3e54c6"
    rule_name = "AWS GuardDuty Command And Control Activity Detected"
    mitre_attack_tactic = "Command and Control"
    mitre_attack_technique = "Application Layer Protocol"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1071/"
    mitre_attack_version = "v13.1"
    type = "Alert"
    data_source = "AWS GuardDuty"
    platform = "AWS"
    severity = "High"
    priority = "High"

  events:
    $guardduty.metadata.vendor_name = "AMAZON"
    $guardduty.metadata.product_name = "AWS GuardDuty"
    $guardduty.metadata.product_event_type = /C&CActivity/
    //Filter out sample findings
    $guardduty.security_result.about.labels["Sample"] != "true"

  outcome:
    $risk_score = max(35)
    $mitre_attack_tactic = "Command and Control"
    $mitre_attack_technique = "Application Layer Protocol"
    $mitre_attack_technique_id = "T1071"
    $event_count = count_distinct($guardduty.metadata.id)
    $principal_ip = array_distinct($guardduty.principal.ip)
    $principal_ip_country = array_distinct($guardduty.principal.ip_geo_artifact.location.country_or_region)
    $principal_ip_state = array_distinct($guardduty.principal.ip_geo_artifact.location.state)
    $principal_user_display_name = $guardduty.principal.user.user_display_name
    $aws_region = $guardduty.target.location.name
    $target_resource_name = $guardduty.target.resource.name
    $target_resource_product_object_id = $guardduty.target.resource.product_object_id
    $security_result_summary = array_distinct($guardduty.security_result.summary)
    $security_result_description = array_distinct($guardduty.security_result.description)
    $security_result_severity = array_distinct($guardduty.security_result.severity)
    $security_result_severity_details = array_distinct($guardduty.security_result.severity_details)
    $metadata_product_event_type = array_distinct($guardduty.metadata.product_event_type)

  condition:
    $guardduty
}

// Copyright 2025 Google LLC. Licensed under Apache-2.0.

rule entra_id_admin_login_activity_to_uncommon_mscloud_apps {

  meta:
    author = "Google Cloud Security"
    description = "Detects Azure AD admin login activity to apps other than a defined list of first party MS Cloud Apps. Note that Azure Active Directory PowerShell and custom Azure apps are not in this list by default"
    rule_id = "mr_59c94dc1-b7af-412c-aa2d-4b5834474f19"
    rule_name = "Entra ID Admin Login Activity to Uncommon MS Cloud Apps"
    assumption = "The lists first_party_ms_cloud_apps and entra_id_admin_watchlist are populated as needed"
    tactic = "TA0001"
    technique = "T1078.004"
    reference = "https://learn.microsoft.com/en-us/troubleshoot/azure/active-directory/verify-first-party-apps-sign-in"
    type = "alert"
    platform = "azure"
    data_source = "azure ad"
    severity = "Medium"
    priority = "Medium"

  events:

    $login.metadata.event_type = "USER_LOGIN"
    $login.metadata.product_name = "Azure AD"
    $login.metadata.vendor_name = "Microsoft"
    $login.security_result.action = "ALLOW"
    not $login.target.resource.attribute.labels["App Id"] in %first_party_ms_cloud_apps

    //Use the list below to isolate activity to admins
    //@domain.com is stripped off to reduce the values in the list to just the username of the email address
    re.replace($login.target.user.userid, `@.*$`, "") in %entra_id_admin_watchlist
    $login.target.user.userid = $userid

  match:
    $userid over 5m

  outcome:
    $risk_score = 65
    $event_count = count_distinct($login.metadata.id)
    $target_application = array_distinct($login.target.application)
    $security_description = array_distinct($login.security_result.description)
    $security_summary = array_distinct($login.security_result.summary)
    $country_region_login_attempt = array_distinct(strings.concat($login.principal.location.city," ",$login.principal.location.state," ",$login.principal.location.country_or_region))
    $user_agent = array_distinct($login.network.http.user_agent)
    $principal_ip = array_distinct($login.principal.ip)

  condition:
    $login
}

// Copyright 2024 Google LLC. Licensed under Apache-2.0.

rule github_two_factor_authentication_requirement_disabled {

  meta:
    author = "Google Cloud Security"
    description = "Detects when two-factor authentication requirements are disabled for a GitHub enterprise or organization."
    rule_id = "mr_43f096a4-42dc-4da7-a6aa-c81379f529c6"
    rule_name = "GitHub Two-Factor Authentication Requirement Disabled"
    assumption = "Your GitHub enterprise audit log settings are configured to log the source IP address for events. Reference: https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization"
    type = "alert"
    severity = "High"
    priority = "High"
    platform = "GitHub"
    data_source = "github"
    mitre_attack_tactic = "Defense Evasion"
    mitre_attack_technique = "Impair Defenses: Disable or Modify Tools"
    mitre_attack_url = "https://attack.mitre.org/versions/v14/techniques/T1562/001/"
    mitre_attack_version = "v14"
    reference = "https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise"

  events:
    $github.metadata.vendor_name = "GITHUB" nocase
    $github.metadata.product_name = "GITHUB"
    (
        $github.metadata.product_event_type = "business.disable_two_factor_requirement" or
        $github.metadata.product_event_type = "org.disable_two_factor_requirement"
    )

  outcome:
    $risk_score = max(85)
    $mitre_attack_tactic = "Defense Evasion"
    $mitre_attack_technique = "Impair Defenses: Disable or Modify Tools"
    $mitre_attack_technique_id = "T1562.001"
    $principal_ip = array_distinct($github.principal.ip)
    $principal_user_userid = array_distinct($github.principal.user.userid)
    $principal_ip_country = array_distinct($github.principal.ip_geo_artifact.location.country_or_region)
    $principal_ip_state = array_distinct($github.principal.ip_geo_artifact.location.state)
    $principal_ip_city = array_distinct($github.principal.location.city)
    $security_result_summary = array_distinct($github.security_result.summary)

  condition:
    $github
}

// Copyright 2025 Google LLC. Licensed under Apache-2.0.

rule hacktool_sharp_successor_execution {

  meta:
    author = "Georg Lauenstein - suresecure GmbH, Mohamed Abdelfattah - suresecure GmbH"
    description = "SharpSuccessor is a .NET-based post-exploitation tool designed to weaponize the BadSuccessor attack discovered by Yuval Gordon (@YuG0rd) from Akamai. It allows a low-privileged user with 'CreateChild' permissions over any Organizational Unit (OU) in an Active Directory domain to escalate privileges to Domain Administrator. This detection rule identifies execution patterns or behavioral indicators linked to SharpSuccessor activity, which may signal privilege escalation attempts in Active Directory environments."
    rule_id = "mr_be51aa7d-b4b8-4d8c-9998-0aa3194e98c3"
    rule_name = "Hacktool - SharpSuccessor Execution"
    tactic = "TA0004"
    technique = "T1068"
    references = "https://academy.bluraven.io/blog/detecting-badsuccessor, https://github.com/logangoins/SharpSuccessor"
    type = "alert"
    platform = "Windows, EDR"
    data_source = "Microsoft Sysmon, Windows Security Event Log, Microsoft Defender XDR"
    severity = "High"
    priority = "High"

  events:

    (
      $sharp_successor_execution.metadata.event_type = "PROCESS_LAUNCH"
      and (
            $sharp_successor_execution.src.process.file.full_path = "SharpSuccessor.exe" nocase or
            $sharp_successor_execution.target.asset.software.description = "SharpSuccessor" nocase or
            $sharp_successor_execution.target.process.file.full_path = /\\SharpSuccessor\.exe/ nocase or
            $sharp_successor_execution.principal.process.file.full_path = /\\SharpSuccessor\.exe/ nocase or
            $sharp_successor_execution.target.process.command_line = /SharpSuccessor/ nocase
          )
    )
    or
    ( // Microsoft-Windows-Security-Auditing -- EventCode: 4673
      $sharp_successor_execution.metadata.event_type = "SERVICE_UNSPECIFIED"
      and (
            $sharp_successor_execution.metadata.description = "A privileged service was called" and
            $sharp_successor_execution.target.process.command_line = /SharpSuccessor/ nocase
          )
    )

    // Capture the hostname where the event occurred
    $sharp_successor_execution.principal.hostname = $hostname

  match:
    $hostname over 10m

  outcome:
    $risk_score = 65
    $event_count = count_distinct($sharp_successor_execution.metadata.id)
    $principal_process_pid = array_distinct($sharp_successor_execution.principal.process.pid)
    $principal_process_command_line = array_distinct($sharp_successor_execution.principal.process.command_line)
    $principal_process_file_sha256 = array_distinct($sharp_successor_execution.principal.process.file.sha256)
    $principal_process_file_full_path = array_distinct($sharp_successor_execution.principal.process.file.full_path)
    $principal_process_product_specific_process_id = array_distinct($sharp_successor_execution.principal.process.product_specific_process_id)
    $principal_process_parent_process_product_specific_process_id = array_distinct($sharp_successor_execution.principal.process.parent_process.product_specific_process_id)
    $target_process_pid = array_distinct($sharp_successor_execution.target.process.pid)
    $target_process_command_line = array_distinct($sharp_successor_execution.target.process.command_line)
    $target_process_file_sha256 = array_distinct($sharp_successor_execution.target.process.file.sha256)
    $target_process_file_full_path = array_distinct($sharp_successor_execution.target.process.file.full_path)
    $target_process_product_specific_process_id = array_distinct($sharp_successor_execution.target.process.product_specific_process_id)
    $principal_user_userid = array_distinct($sharp_successor_execution.principal.user.userid)

  condition:
      $sharp_successor_execution
}

// Copyright 2023 Google LLC. Licensed under Apache-2.0.

rule ioc_sha256_hash {

  meta:
    author = "Google Cloud Security"
    description = "Detect file/process events that match watchlisted hashes in MISP"
    rule_id = "mr_82df7e96-1bc3-489d-9e17-ff86e8f6e89b"
    rule_name = "IOC SHA256 Hash"
    type = "alert"
    tags = "threat indicators"
    assumption = "Assumes MISP data has been ingested into entity graph; this rule can be modified to utilize other TI indicators"
    data_source = "microsoft sysmon"
    severity = "Medium"
    priority = "Medium"

  events:
    $process.metadata.event_type = "PROCESS_LAUNCH" or $process.metadata.event_type ="FILE_CREATION"
    $process.target.process.file.sha256 = $sha256

    // Correlates with MISP data; can be modified based on your MISP parser or other TI
    $ioc.graph.metadata.product_name = "MISP"
    $ioc.graph.metadata.entity_type = "FILE"
    $ioc.graph.metadata.source_type = "ENTITY_CONTEXT"
    $ioc.graph.entity.file.sha256 = $sha256

  match:
    $sha256 over 5m

  outcome:
    $risk_score = 65
    $event_count = count_distinct($process.metadata.id)
    // added to populate alert graph with additional context
    $principal_hostname = array_distinct($process.principal.hostname)
    $principal_process_pid = array_distinct($process.principal.process.pid)
    $principal_process_command_line = array_distinct($process.principal.process.command_line)
    $principal_process_file_sha256 = array_distinct($process.principal.process.file.sha256)
    $principal_process_file_full_path = array_distinct($process.principal.process.file.full_path)
    $principal_process_product_specific_process_id = array_distinct($process.principal.process.product_specific_process_id)
    $principal_process_parent_process_product_specific_process_id = array_distinct($process.principal.process.parent_process.product_specific_process_id)
    $target_process_pid = array_distinct($process.target.process.pid)
    $target_process_command_line = array_distinct($process.target.process.command_line)
    // Commented out target.process.file.sha256 because it is already represented in graph as match variable. If match changes, can uncomment to add to results
    //$target_process_file_sha256 = array_distinct($process.target.process.file.sha256)
    $target_process_file_full_path = array_distinct($process.target.process.file.full_path)
    $target_process_product_specific_process_id = array_distinct($process.target.process.product_specific_process_id)
    $principal_user_userid = array_distinct($process.principal.user.userid)
    $target_file_sha256 = array_distinct($process.target.file.sha256)
    $target_file_full_path = array_distinct($process.target.file.full_path)

  condition:
    $process and $ioc
}