detection.wiki

Detection rules › YARA-L

YARA-L rules: 0n

RuleSeverity
AWS CloudTrail Logging Tamperedhigh
AWS Successful Console Authentication From Multiple IPsmedium
GCP Multiple Service APIs Disabledhigh
sap system or client configuration changehigh

AWS CloudTrail Logging Tampered

#
Severity
high
Type
Alert
Time window
1h
Match by
user_id
Author
Google Cloud Security
Source
github.com/chronicle/detection-rules

Detects when CloudTrail logging is updated, stopped or deleted.

MITRE ATT&CK Coverage

TacticTechniques
Defense Impairment

Telemetry Coverage

PlatformRecord / event type
AWSCloudTrail event DeleteTrail: Deletes a CloudTrail trail, permanently stopping the delivery of log files for that trail to its configured S3 bucket.
AWSCloudTrail event PutEventSelectors: Configures event selectors for a trail to specify which management and data events CloudTrail logs.
AWSCloudTrail event StopLogging: Suspends CloudTrail logging for a trail, halting the delivery of new log files while preserving the trail configuration.
AWSCloudTrail event UpdateTrail: Updates the settings of an existing CloudTrail trail, such as its S3 bucket, SNS topic, or log file validation configuration.

Rule Body

// Copyright 2023 Google LLC. Licensed under Apache-2.0.

rule aws_cloudtrail_logging_tampered {

  meta:
    author = "Google Cloud Security"
    description = "Detects when CloudTrail logging is updated, stopped or deleted."
    rule_id = "mr_86f08675-4130-4b47-8978-067c18c8cb55"
    rule_name = "AWS CloudTrail Logging Tampered"
    mitre_attack_tactic = "Defense Evasion"
    mitre_attack_technique = "Impair Defenses: Disable Cloud Logs"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1562/008/"
    mitre_attack_version = "v13.1"
    type = "Alert"
    data_source = "AWS CloudTrail"
    platform = "AWS"
    severity = "High"
    priority = "High"

  events:
    $cloudtrail.metadata.vendor_name = "AMAZON"
    $cloudtrail.metadata.product_name = "AWS CloudTrail"
    (
     $cloudtrail.metadata.product_event_type = "UpdateTrail" or
     $cloudtrail.metadata.product_event_type = "StopLogging" or
     $cloudtrail.metadata.product_event_type = "DeleteTrail" or
     $cloudtrail.metadata.product_event_type = "PutEventSelectors"
    )
    $cloudtrail.security_result.action = "ALLOW"
    $cloudtrail.principal.user.user_display_name = $user_id

  match:
    $user_id over 1h

  outcome:
    $risk_score = max(75)
    $mitre_attack_tactic = "Defense Evasion"
    $mitre_attack_technique = "Impair Defenses: Disable Cloud Logs"
    $mitre_attack_technique_id = "T1562.008"
    $event_count = count_distinct($cloudtrail.metadata.id)
    $network_http_user_agent = array_distinct($cloudtrail.network.http.user_agent)
    $principal_ip = array_distinct($cloudtrail.principal.ip)
    $principal_ip_country = array_distinct($cloudtrail.principal.ip_geo_artifact.location.country_or_region)
    $principal_ip_state = array_distinct($cloudtrail.principal.ip_geo_artifact.location.state)
    $principal_user_display_name = array_distinct($cloudtrail.principal.user.user_display_name)
    $recipient_aws_account_id = array_distinct($cloudtrail.additional.fields["recipientAccountId"])
    $aws_region = array_distinct($cloudtrail.principal.location.name)
    $target_resource_name = array_distinct($cloudtrail.target.resource.name)
    $target_resource_product_object_id = array_distinct($cloudtrail.target.resource.product_object_id)

  condition:
    $cloudtrail
}

YARA-L Rule Structure

Condition

Fires when at least one $cloudtrail event in the 1h window.

Events

$cloudtrail

  • metadata.product_event_type is one of:
    • UpdateTrail
    • StopLogging
    • DeleteTrail
    • PutEventSelectors
  • security_result.action = "ALLOW"

Match and Correlation

Match key
$user_id (principal.user.user_display_name)
Within
1h

Outcome

Outcome variables add context to a detection. When the rule generates an alert, $risk_score is displayed with it.

FieldExpression
risk_scoremax(75)
event_countcount_distinct($cloudtrail.metadata.id)
network_http_user_agentarray_distinct($cloudtrail.network.http.user_agent)
principal_iparray_distinct($cloudtrail.principal.ip)
principal_ip_countryarray_distinct($cloudtrail.principal.ip_geo_artifact.location.country_or_region)
principal_ip_statearray_distinct($cloudtrail.principal.ip_geo_artifact.location.state)
principal_user_display_namearray_distinct($cloudtrail.principal.user.user_display_name)
recipient_aws_account_idarray_distinct($cloudtrail.additional.fields["recipientAccountId"])
aws_regionarray_distinct($cloudtrail.principal.location.name)
target_resource_namearray_distinct($cloudtrail.target.resource.name)
target_resource_product_object_idarray_distinct($cloudtrail.target.resource.product_object_id)

AWS Successful Console Authentication From Multiple IPs

#
Severity
medium
Type
Alert
Time window
5m
Match by
user_id
Author
Google Cloud Security
Source
github.com/chronicle/detection-rules

Detects when an AWS user successfully authenticating from more than one unique IP address within 5 minutes.

MITRE ATT&CK Coverage

TacticTechniques
Resource Development

Telemetry Coverage

PlatformRecord / event type
AWSCloudTrail event ConsoleLogin: Records an authentication attempt to the AWS Management Console, including whether it succeeded or failed.

Rule Body

// Copyright 2023 Google LLC. Licensed under Apache-2.0.

rule aws_successful_console_authentication_from_multiple_ips {

  meta:
    author = "Google Cloud Security"
    description = "Detects when an AWS user successfully authenticating from more than one unique IP address within 5 minutes."
    rule_id = "mr_4a221c43-1059-4247-a7a6-69d8ce4dca2c"
    rule_name = "AWS Successful Console Authentication From Multiple IPs"
    mitre_attack_tactic = "Resource Development"
    mitre_attack_technique = "Compromise Accounts"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1586/"
    mitre_attack_version = "v13.1"
    type = "Alert"
    data_source = "AWS CloudTrail"
    platform = "AWS"
    severity = "Medium"
    priority = "Medium"

  events:
    $login.metadata.vendor_name = "AMAZON"
    $login.metadata.product_name = "AWS CloudTrail"
    $login.metadata.event_type = "USER_LOGIN"
    $login.metadata.product_event_type = "ConsoleLogin"
    $login.security_result.action = "ALLOW"
    $login.principal.ip = $ip
    $login.target.user.userid = $user_id

  match:
    $user_id over 5m

  outcome:
    $risk_score = max(
        // Unauthorized geographies
        if($login.principal.ip_geo_artifact.location.country_or_region = "Cuba", 40) +
        if($login.principal.ip_geo_artifact.location.country_or_region = "Iran", 40) +
        if($login.principal.ip_geo_artifact.location.country_or_region = "North Korea" , 40) +
        if($login.principal.ip_geo_artifact.location.country_or_region = "Russia", 40) +
        if($login.principal.ip_geo_artifact.location.country_or_region = "Syria", 40)
    )
    $mitre_attack_tactic = "Resource Development"
    $mitre_attack_technique = "Compromise Accounts"
    $mitre_attack_technique_id = "T1586"
    $event_count = count_distinct($login.metadata.id)
    $network_http_user_agent = array_distinct($login.network.http.user_agent)
    $principal_ip = array_distinct($login.principal.ip)
    $principal_ip_country = array_distinct($login.principal.ip_geo_artifact.location.country_or_region)
    $principal_ip_state = array_distinct($login.principal.ip_geo_artifact.location.state)
    $target_user_userid = array_distinct($login.target.user.userid)
    $is_mfa_used = array_distinct($login.extensions.auth.auth_details)
    $target_resource_name = array_distinct($login.target.resource.name)
    $target_resource_product_object_id = array_distinct($login.target.resource.product_object_id)

  condition:
    $login and #ip > 1
}

YARA-L Rule Structure

Condition

Fires when at least one $login event in the 5m window and $ip occurs more than 1 times in the 5m window.

Events

$login USER_LOGIN

  • metadata.product_event_type = "ConsoleLogin"
  • security_result.action = "ALLOW"

Match and Correlation

Match key
$user_id (target.user.userid)
Within
5m

Outcome

Outcome variables add context to a detection. When the rule generates an alert, $risk_score is displayed with it.

FieldExpression
risk_scoremax( if($login.principal.ip_geo_artifact.location.country_or_region = "Cuba", 40) + if($login.principal.ip_geo_artifact.location.country_or_region = "Iran", 40) + if($login.principal.ip_geo_artifact.location.country_or_region = "North Korea" , 40) + if($login.principal.ip_geo_artifact.location.country_or_region = "Russia", 40) + if($login.principal.ip_geo_artifact.location.country_or_region = "Syria", 40) )
event_countcount_distinct($login.metadata.id)
network_http_user_agentarray_distinct($login.network.http.user_agent)
principal_iparray_distinct($login.principal.ip)
principal_ip_countryarray_distinct($login.principal.ip_geo_artifact.location.country_or_region)
principal_ip_statearray_distinct($login.principal.ip_geo_artifact.location.state)
target_user_useridarray_distinct($login.target.user.userid)
is_mfa_usedarray_distinct($login.extensions.auth.auth_details)
target_resource_namearray_distinct($login.target.resource.name)
target_resource_product_object_idarray_distinct($login.target.resource.product_object_id)

GCP Multiple Service APIs Disabled

#
Severity
high
Type
Alert
Time window
1h
Match by
userid
Author
Google Cloud Security
Source
github.com/chronicle/detection-rules

Detect when multiple GCP Service APIs are disabled in a short period of time.

MITRE ATT&CK Coverage

TacticTechniques
Impact

Telemetry Coverage

PlatformRecord / event type
GCPgoogle.api.serviceusage.ServiceUsage.DisableService: Disable service

Rule Body

// Copyright 2024 Google LLC. Licensed under Apache-2.0.

 rule gcp_multiple_service_apis_disabled {

  meta:
    author = "Google Cloud Security"
    description = "Detect when multiple GCP Service APIs are disabled in a short period of time."
    rule_id = "mr_5a4ce357-e4da-4a4b-8cc2-ed5515f1043d"
    rule_name = "GCP Multiple Service APIs Disabled"
    mitre_attack_tactic = "Impact"
    mitre_attack_technique = "Service Stop"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1489/"
    mitre_attack_version = "v14.1"
    type = "Alert"
    data_source = "GCP Cloud Audit"
    platform = "GCP"
    severity = "High"
    priority = "High"

  events:
    $gcp.metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT"
    $gcp.metadata.log_type = "GCP_CLOUDAUDIT"
    $gcp.metadata.product_event_type = "google.api.serviceusage.v1.ServiceUsage.DisableService"
    $gcp.security_result.action = "ALLOW"
    $gcp.target.application = "serviceusage.googleapis.com"
    $gcp.principal.user.userid = $userid

  match:
    $userid over 1h

  outcome:
    $risk_score = max(75)
    $mitre_attack_tactic = "Impact"
    $mitre_attack_technique = "Service Stop"
    $mitre_attack_technique_id = "T1489"
    $event_count = count_distinct($gcp.metadata.id)
    $network_http_user_agent = array_distinct($gcp.network.http.user_agent)
    $principal_ip = array_distinct($gcp.principal.ip)
    $principal_ip_country = array_distinct($gcp.principal.ip_geo_artifact.location.country_or_region)
    $principal_ip_state = array_distinct($gcp.principal.ip_geo_artifact.location.state)
    $principal_user_id = array_distinct($gcp.principal.user.userid)
    $principal_user_display_name = array_distinct($gcp.principal.user.user_display_name)
    $target_resource_name = array_distinct($gcp.target.resource.name)
    $dc_target_resource_name = count_distinct($gcp.target.resource.name)

  condition:
    $gcp and $dc_target_resource_name > 5
}

YARA-L Rule Structure

Condition

Fires when at least one $gcp event in the 1h window and $dc_target_resource_name > 5.

Events

$gcp USER_RESOURCE_UPDATE_CONTENT

  • metadata.log_type = "GCP_CLOUDAUDIT"
  • metadata.product_event_type = "google.api.serviceusage.v1.ServiceUsage.DisableService"
  • security_result.action = "ALLOW"
  • target.application = "serviceusage.googleapis.com"

Match and Correlation

Match key
$userid (principal.user.userid)
Within
1h

Outcome

Outcome variables add context to a detection. When the rule generates an alert, $risk_score is displayed with it.

FieldExpression
risk_scoremax(75)
event_countcount_distinct($gcp.metadata.id)
network_http_user_agentarray_distinct($gcp.network.http.user_agent)
principal_iparray_distinct($gcp.principal.ip)
principal_ip_countryarray_distinct($gcp.principal.ip_geo_artifact.location.country_or_region)
principal_ip_statearray_distinct($gcp.principal.ip_geo_artifact.location.state)
principal_user_idarray_distinct($gcp.principal.user.userid)
principal_user_display_namearray_distinct($gcp.principal.user.user_display_name)
target_resource_namearray_distinct($gcp.target.resource.name)
dc_target_resource_namecount_distinct($gcp.target.resource.name)

sap system or client configuration change

#
Severity
high
Time window
1h
Match by
user
Author
Google Cloud Security
Source
github.com/chronicle/detection-rules

Detects changes to either Global System Changeability (EU1) or Client-Specific Configuration (EU2/SCC4).

MITRE ATT&CK Coverage

TacticTechniques
Defense Impairment

Rule Body

// Copyright 2026 Google LLC. Licensed under Apache-2.0.

rule sap_system_or_client_configuration_change {
  meta:
    author = "Google Cloud Security"
    description = "Detects changes to either Global System Changeability (EU1) or Client-Specific Configuration (EU2/SCC4)."
    severity = "High"
    tactic = "TA0005"
    technique = "T1562.001"

  events:
    $e.metadata.log_type = "SAP_SECURITY_AUDIT"

        (
            $e.additional.fields["msg_1"] = "EU1" or
            $e.additional.fields["msg_1"] = "EU2"
        )


    $user = $e.principal.user.userid

  match:
    $user over 1h

  outcome:
    $risk_score = max(if($e.additional.fields["msg_1"] = "EU1", 95, 60))

    $client = array_distinct($e.target.resource.attribute.labels["slgmand"])
    $principal_user = array_distinct($user)
    $msg_id = array_distinct($e.additional.fields["msg_1"])
    $terminal_ip = array_distinct($e.principal.ip)
    $details = array_distinct($e.metadata.description)

  condition:
    $e
}

YARA-L Rule Structure

Condition

Fires when at least one $e event in the 1h window.

Events

$e

  • metadata.log_type = "SAP_SECURITY_AUDIT"
  • additional.fields["msg_1"] = "EU1" or "EU2"

Match and Correlation

Match key
$user
Within
1h

Outcome

Outcome variables add context to a detection. When the rule generates an alert, $risk_score is displayed with it.

FieldExpression
risk_scoremax(if($e.additional.fields["msg_1"] = "EU1", 95, 60))
clientarray_distinct($e.target.resource.attribute.labels["slgmand"])
principal_userarray_distinct($user)
msg_idarray_distinct($e.additional.fields["msg_1"])
terminal_iparray_distinct($e.principal.ip)
detailsarray_distinct($e.metadata.description)

Back to all YARA-L rules