detection.wiki

Detection rules › YARA-L

YARA-L rules: 0q

RuleSeverity
AWS CloudFront Insecure SSL Policylow
Google Safebrowsing File Contacts Tor Exit Nodecritical
Hunt for suspicious sign-in to Entra ID Using Extrnal Call Methodmedium

AWS CloudFront Insecure SSL Policy

#
Severity
low
Type
Alert
Author
Google Cloud Security
Source
github.com/chronicle/detection-rules

Detects when an insecure SSL policy is configured for an AWS CloudFront distribution.

MITRE ATT&CK Coverage

TacticTechniques
Defense Impairment

Rule Body

// Copyright 2024 Google LLC. Licensed under Apache-2.0.

rule aws_cloudfront_insecure_ssl_policy {

  meta:
    author = "Google Cloud Security"
    description = "Detects when an insecure SSL policy is configured for an AWS CloudFront distribution."
    rule_id = "mr_dc0d66a6-121c-4b01-9370-3bf7fd25de1e"
    rule_name = "AWS CloudFront Insecure SSL Policy"
    mitre_attack_tactic = "Defense Evasion"
    mitre_attack_technique = "Weaken Encryption: Reduce Key Space"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1600/001/"
    mitre_attack_version = "v15.1"
    type = "Alert"
    data_source = "AWS CloudTrail"
    platform = "AWS"
    severity = "Low"
    priority = "Low"

  events:
    $cloudtrail.metadata.vendor_name = "AMAZON"
    $cloudtrail.metadata.product_name = "AWS CloudTrail"
    ($cloudtrail.metadata.product_event_type = "CreateDistribution" or $cloudtrail.metadata.product_event_type = "UpdateDistribution")
    $cloudtrail.target.resource.attribute.labels["requestParameters.distributionConfig.viewerCertificate.minimumProtocolVersion"] = "TLSv1" or
    $cloudtrail.target.resource.attribute.labels["requestParameters.distributionConfig.viewerCertificate.minimumProtocolVersion"] = "SSLv3" or
    $cloudtrail.target.resource.attribute.labels["requestParameters.distributionConfig.viewerCertificate.minimumProtocolVersion"] = "TLSv1_2016" or
    $cloudtrail.target.resource.attribute.labels["requestParameters.distributionConfig.viewerCertificate.minimumProtocolVersion"] = "TLSv1.1_2016"

  outcome:
    $risk_score = max(35)
    $mitre_attack_tactic = "Defense Evasion"
    $mitre_attack_technique = "Weaken Encryption: Reduce Key Space"
    $mitre_attack_technique_id = "T1600.001"
    $event_count = count_distinct($cloudtrail.metadata.id)
    $network_http_user_agent = array_distinct($cloudtrail.network.http.user_agent)
    $principal_ip = array_distinct($cloudtrail.principal.ip)
    $principal_ip_country = array_distinct($cloudtrail.principal.ip_geo_artifact.location.country_or_region)
    $principal_ip_state = array_distinct($cloudtrail.principal.ip_geo_artifact.location.state)
    $principal_user_display_name = array_distinct($cloudtrail.principal.user.user_display_name)
    $recipient_aws_account_id = array_distinct($cloudtrail.additional.fields["recipientAccountId"])
    $aws_region = array_distinct($cloudtrail.principal.location.name)
    $accessed_via_console = array_distinct($cloudtrail.target.resource.attribute.labels["sessionCredentialFromConsole"])
    $cloudfront_distribution = array_distinct($cloudtrail.target.resource.attribute.labels["responseElements.distribution.aRN"])
    $ssl_security_policy = array_distinct($cloudtrail.target.resource.attribute.labels["requestParameters.distributionConfig.viewerCertificate.minimumProtocolVersion"])

  condition:
    $cloudtrail
}

YARA-L Rule Structure

Condition

Fires when at least one $cloudtrail event.

Events

$cloudtrail

  • metadata.product_event_type = "CreateDistribution" or "UpdateDistribution"
  • target.resource.attribute.labels["requestParameters.distributionConfig.viewerCertificate.minimumProtocolVersion"] is one of:
    • TLSv1
    • SSLv3
    • TLSv1_2016
    • TLSv1.1_2016

Outcome

Outcome variables add context to a detection. When the rule generates an alert, $risk_score is displayed with it.

FieldExpression
risk_scoremax(35)
event_countcount_distinct($cloudtrail.metadata.id)
network_http_user_agentarray_distinct($cloudtrail.network.http.user_agent)
principal_iparray_distinct($cloudtrail.principal.ip)
principal_ip_countryarray_distinct($cloudtrail.principal.ip_geo_artifact.location.country_or_region)
principal_ip_statearray_distinct($cloudtrail.principal.ip_geo_artifact.location.state)
principal_user_display_namearray_distinct($cloudtrail.principal.user.user_display_name)
recipient_aws_account_idarray_distinct($cloudtrail.additional.fields["recipientAccountId"])
aws_regionarray_distinct($cloudtrail.principal.location.name)
accessed_via_consolearray_distinct($cloudtrail.target.resource.attribute.labels["sessionCredentialFromConsole"])
cloudfront_distributionarray_distinct($cloudtrail.target.resource.attribute.labels["responseElements.distribution.aRN"])
ssl_security_policyarray_distinct($cloudtrail.target.resource.attribute.labels["requestParameters.distributionConfig.viewerCertificate.minimumProtocolVersion"])

Google Safebrowsing File Contacts Tor Exit Node

#
Severity
critical
Type
alert
Time window
1h
Match by
hostname
Author
Google Cloud Security
Source
github.com/chronicle/detection-rules

A malicious file contacting a known Tor Exit Node.

MITRE ATT&CK Coverage

TacticTechniques
Command & Control

Telemetry Coverage

ProviderRecord / event type
SysmonEvent ID 3: Network connection
Security-AuditingEvent ID 5156: The Windows Filtering Platform has permitted a connection.

Rule Body

// Copyright 2023 Google LLC. Licensed under Apache-2.0.

rule google_safebrowsing_file_contacts_tor_exit_node {

  meta:
    author = "Google Cloud Security"
    description = "A malicious file contacting a known Tor Exit Node."
    rule_id = "mr_f6733319-50b3-477e-bad6-96bb4c14c632"
    rule_name = "Google Safebrowsing File Contacts Tor Exit Node"
    tactic = "TA0011"
    technique = "T1090.003"
    type = "alert"
    data_source = "microsoft defender atp, crowdstrike, microsoft sysmon"
    severity = "Critical"
    priority = "High"

  events:
    $network.metadata.event_type = "NETWORK_CONNECTION"
    $network.principal.process.file.sha256 != ""
    $network.principal.process.file.sha256 = $file_hash
    $network.principal.hostname = $hostname
    $network.target.ip = $ip

    // Safe Browsing file hashes provided by GCTI Feed
    $safebrowse.graph.metadata.product_name = "Google Safe Browsing"
    $safebrowse.graph.metadata.entity_type = "FILE"
    $safebrowse.graph.metadata.source_type = "GLOBAL_CONTEXT"
    $safebrowse.graph.metadata.threat.category = "SOFTWARE_MALICIOUS"
    $safebrowse.graph.entity.file.sha256 = $file_hash

    // Tor IP listing provided by GCTI Feed
    $gcti.graph.entity.artifact.ip = $ip
    $gcti.graph.metadata.entity_type = "IP_ADDRESS"
    $gcti.graph.metadata.source_type = "GLOBAL_CONTEXT"
    $gcti.graph.metadata.threat.threat_feed_name = "Tor Exit Nodes"
    $gcti.graph.metadata.vendor_name = "Google Cloud Threat Intelligence"
    $gcti.graph.metadata.product_name = "GCTI Feed"

  match:
    $hostname over 1h

  outcome:
    $risk_score = 95
    $event_count = count_distinct($network.metadata.id)
    //added to populate alert graph with additional context
    $principal_ip = array_distinct($network.principal.ip)
    $target_ip = array_distinct($network.target.ip)
    $principal_process_pid = array_distinct($network.principal.process.pid)
    $principal_process_command_line = array_distinct($network.principal.process.command_line)
    $principal_process_file_sha256 = array_distinct($network.principal.process.file.sha256)
    $principal_process_file_full_path = array_distinct($network.principal.process.file.full_path)
    $principal_process_product_specific_process_id = array_distinct($network.principal.process.product_specific_process_id)
    $principal_process_parent_process_product_specific_process_id = array_distinct($network.principal.process.parent_process.product_specific_process_id)
    //$target_process_pid = array_distinct($network.target.process.pid)
    $target_process_command_line = array_distinct($network.target.process.command_line)
    $target_process_file_sha256 = array_distinct($network.target.process.file.sha256)
    $target_process_file_full_path = array_distinct($network.target.process.file.full_path)
    $target_process_product_specific_process_id = array_distinct($network.target.process.product_specific_process_id)
    $target_process_parent_process_product_specific_process_id = array_distinct($network.target.process.parent_process.product_specific_process_id)
    $principal_user_userid = array_distinct($network.principal.user.userid)
    $target_user_userid = array_distinct($network.target.user.userid)

  condition:
    $network and $gcti and $safebrowse
}

YARA-L Rule Structure

Condition

Fires when at least one $network event in the 1h window and $gcti matches entity context and $safebrowse matches entity context.

Events

$gcti entity context (IP_ADDRESS)

  • graph.metadata.entity_type = "IP_ADDRESS"
  • graph.metadata.source_type = "GLOBAL_CONTEXT"
  • graph.metadata.threat.threat_feed_name = "Tor Exit Nodes"
  • graph.metadata.vendor_name = "Google Cloud Threat Intelligence"
  • graph.metadata.product_name = "GCTI Feed"

$network NETWORK_CONNECTION (3, 5156)

  • principal.process.file.sha256 is not null

$safebrowse entity context (FILE)

  • graph.metadata.product_name = "Google Safe Browsing"
  • graph.metadata.entity_type = "FILE"
  • graph.metadata.source_type = "GLOBAL_CONTEXT"
  • graph.metadata.threat.category = "SOFTWARE_MALICIOUS"

Match and Correlation

Match key
$hostname (principal.hostname)
Within
1h

Outcome

Outcome variables add context to a detection. When the rule generates an alert, $risk_score is displayed with it.

FieldExpression
risk_score95
event_countcount_distinct($network.metadata.id)
principal_iparray_distinct($network.principal.ip)
target_iparray_distinct($network.target.ip)
principal_process_pidarray_distinct($network.principal.process.pid)
principal_process_command_linearray_distinct($network.principal.process.command_line)
principal_process_file_sha256array_distinct($network.principal.process.file.sha256)
principal_process_file_full_patharray_distinct($network.principal.process.file.full_path)
principal_process_product_specific_process_idarray_distinct($network.principal.process.product_specific_process_id)
principal_process_parent_process_product_specific_process_idarray_distinct($network.principal.process.parent_process.product_specific_process_id)
target_process_command_linearray_distinct($network.target.process.command_line)
target_process_file_sha256array_distinct($network.target.process.file.sha256)
target_process_file_full_patharray_distinct($network.target.process.file.full_path)
target_process_product_specific_process_idarray_distinct($network.target.process.product_specific_process_id)
target_process_parent_process_product_specific_process_idarray_distinct($network.target.process.parent_process.product_specific_process_id)
principal_user_useridarray_distinct($network.principal.user.userid)
target_user_useridarray_distinct($network.target.user.userid)

Hunt for suspicious sign-in to Entra ID Using Extrnal Call Method

#
Severity
medium
Type
hunt
Time window
5m
Match by
ip, user
Author
Google Cloud Security
Source
github.com/chronicle/detection-rules

Detects authentication to O365 followed by a non-interactive sign-ins that aligns to suspicious activity.

References

Telemetry Coverage

PlatformRecord / event type
Microsoft 365UserLoggedIn

Rules Detecting the Same Action

These rules filter on the same operation.

Rule Body

// Copyright 2025 Google LLC. Licensed under Apache-2.0.

rule suspicious_entra_id_sign_in_external_call {

  meta:
    author = "Google Cloud Security"
    description = "Detects authentication to O365 followed by a non-interactive sign-ins that aligns to suspicious activity."
    rule_id = "mr_2245edf0-3a75-4bf6-901b-c47ffda1703e"
    rule_name = "Hunt for suspicious sign-in to Entra ID Using Extrnal Call Method"
    assumption = "Microsoft Office is the application the stolen token is associated with, however this can be modified in GraphRunner. This detection could create FPs if not focusing on the default application, however filtering on suspicious IP addresses or user agents may help make this useful as a hunting rule."
    reference = "https://github.com/dafthack/GraphRunner/blob/main/GraphRunner.ps1"
    type = "hunt"
    platform = "azure"
    data_source = "o365, azure activity"
    severity = "Medium"
    priority = "Medium"

  events:
    $init_login.metadata.event_type = "USER_LOGIN"
    $init_login.metadata.product_event_type = "UserLoggedIn"
    $init_login.metadata.product_name = "Office 365"
    $init_login.metadata.vendor_name = "Microsoft"
    $init_login.security_result.action = "ALLOW"
    $init_login.network.session_id != ""
    strings.to_lower($init_login.target.user.userid) = $user
    $init_login.principal.ip = $ip
    //Can add specific IPs of interest here or filter admin consoles out
    //$init_login.principal.ip != "10.10.10.10"

    $init_login.network.session_id != $sub_login.network.session_id
    $init_login.target.application != $sub_login.target.application
    $init_login.network.http.user_agent != $sub_login.network.http.user_agent
    $init_login.metadata.event_timestamp.seconds < $sub_login.metadata.event_timestamp.seconds

    $sub_login.metadata.event_type = "USER_LOGIN"
    $sub_login.metadata.product_event_type = "Sign-in activity"
    $sub_login.metadata.product_name = "Azure Activity"
    $sub_login.metadata.vendor_name = "Microsoft"
    $sub_login.security_result.action = "ALLOW"
    $sub_login.security_result.category_details = "NonInteractiveUserSignInLogs"
    //Microsoft Office GUID is the default application used with Get-GraphTokens function. This can be customized but is a good place to start
    //$sub_login.target.application = "Microsoft Office"
    //UA listing displayed here as strings separated by or statement
    //Each line is commented with device or browser or combination as specified in GraphRunner
    //Could also convert to regex to refine if desired or used with a list
    (
        $sub_login.network.http.user_agent = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36" nocase or // Mac/Chrome | Chrome
        $sub_login.network.http.user_agent = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:70.0) Gecko/20100101 Firefox/70.0" nocase or // Mac/Firefox
        $sub_login.network.http.user_agent = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/604.1 Edg/91.0.100.0" nocase or // Mac/Edge
        $sub_login.network.http.user_agent = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Safari/605.1.15" nocase or // Mac/Safari | Mac | Safari
        $sub_login.network.http.user_agent = "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko" nocase or // Windows/IE | IE
        $sub_login.network.http.user_agent = "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36" nocase or // Windows/Chrome
        $sub_login.network.http.user_agent = "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:70.0) Gecko/20100101 Firefox/70.0" nocase or // Windows/Firefox | Firefox
        $sub_login.network.http.user_agent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19042" nocase or // Windows/Edge | Windows
        $sub_login.network.http.user_agent = "Mozilla/5.0 (Linux; U; Android 4.0.2; en-us; Galaxy Nexus Build/ICL53F) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30" nocase or // AndroidMobile/Android | AndroidMobile | Android
        $sub_login.network.http.user_agent = "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Mobile Safari/537.36" nocase or // AndroidMobile/Chrome
        $sub_login.network.http.user_agent = "Mozilla/5.0 (Android 4.4; Mobile; rv:70.0) Gecko/70.0 Firefox/70.0" nocase or // AndroidMobile/Firefox
        $sub_login.network.http.user_agent = "Mozilla/5.0 (Linux; Android 8.1.0; Pixel Build/OPM4.171019.021.D1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.109 Mobile Safari/537.36 EdgA/42.0.0.2057" nocase or // AndroidMobile/Edge
        $sub_login.network.http.user_agent = "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/91.0.4472.114 Mobile/15E148 Safari/604.1" nocase or // iPhone/Chrome
        $sub_login.network.http.user_agent = "Mozilla/5.0 (iPhone; CPU iPhone OS 8_3 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) FxiOS/1.0 Mobile/12F69 Safari/600.1.4" nocase or // iPhone/Firefox
        $sub_login.network.http.user_agent = "Mozilla/5.0 (iPhone; CPU iPhone OS 12_3_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.1 EdgiOS/44.5.0.10 Mobile/15E148 Safari/604.1" nocase or // iPhone/Edge
        $sub_login.network.http.user_agent = "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1" nocase or // iPhone/Safari | iPhone
        $sub_login.network.http.user_agent = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36" nocase // Edge
    )
    strings.to_lower($sub_login.principal.user.email_addresses[0]) = $user
    $sub_login.principal.ip = $ip

  match:
    $user, $ip over 5m

  outcome:
    $risk_score = 65
    $event_count = count_distinct($init_login.metadata.id)
    $init_user_agent = array_distinct($init_login.network.http.user_agent)
    $sub_user_agent = array_distinct($sub_login.network.http.user_agent)
    $security_summary = array_distinct($init_login.security_result.summary)
    $init_target_application = array_distinct($init_login.target.application)
    $sub_target_application = array_distinct($sub_login.target.application)
    //$principal_user_userid = array_distinct($group.principal.user.userid)
    $principal_user =array_distinct($user)
    $principal_ip = array_distinct($init_login.principal.ip)
    $session_id = array_distinct($init_login.network.session_id)

  condition:
    $init_login and $sub_login
}

YARA-L Rule Structure

Condition

Fires when at least one $init_login event in the 5m window and at least one $sub_login event in the 5m window.

Events

$init_login USER_LOGIN

  • metadata.product_event_type = "UserLoggedIn"
  • security_result.action = "ALLOW"
  • network.session_id is not null
  • network.session_id cross_field_compare "sub_login.network.session_id"
  • target.application cross_field_compare "sub_login.target.application"
  • network.http.user_agent cross_field_compare "sub_login.network.http.user_agent"

$sub_login USER_LOGIN

  • metadata.product_event_type = "Sign-in activity"
  • security_result.action = "ALLOW"
  • security_result.category_details = "NonInteractiveUserSignInLogs"
  • network.http.user_agent is one of:
    • Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36
    • Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:70.0) Gecko/20100101 Firefox/70.0
    • Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/604.1 Edg/91.0.100.0
    • Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Safari/605.1.15
    • Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
    • Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36
    • Mozilla/5.0 (Windows NT 10.0; WOW64; rv:70.0) Gecko/20100101 Firefox/70.0
    • Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19042
    • Mozilla/5.0 (Linux; U; Android 4.0.2; en-us; Galaxy Nexus Build/ICL53F) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
    • Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Mobile Safari/537.36
    • Mozilla/5.0 (Android 4.4; Mobile; rv:70.0) Gecko/70.0 Firefox/70.0
    • Mozilla/5.0 (Linux; Android 8.1.0; Pixel Build/OPM4.171019.021.D1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.109 Mobile Safari/537.36 EdgA/42.0.0.2057
    • Mozilla/5.0 (iPhone; CPU iPhone OS 13_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/91.0.4472.114 Mobile/15E148 Safari/604.1
    • Mozilla/5.0 (iPhone; CPU iPhone OS 8_3 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) FxiOS/1.0 Mobile/12F69 Safari/600.1.4
    • Mozilla/5.0 (iPhone; CPU iPhone OS 12_3_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.1 EdgiOS/44.5.0.10 Mobile/15E148 Safari/604.1
    • Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1
    • Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36

Match and Correlation

Order
$init_login before $sub_login
Match key
$ip (principal.ip), $user
Within
5m

Outcome

Outcome variables add context to a detection. When the rule generates an alert, $risk_score is displayed with it.

FieldExpression
risk_score65
event_countcount_distinct($init_login.metadata.id)
init_user_agentarray_distinct($init_login.network.http.user_agent)
sub_user_agentarray_distinct($sub_login.network.http.user_agent)
security_summaryarray_distinct($init_login.security_result.summary)
init_target_applicationarray_distinct($init_login.target.application)
sub_target_applicationarray_distinct($sub_login.target.application)
principal_userarray_distinct($user)
principal_iparray_distinct($init_login.principal.ip)
session_idarray_distinct($init_login.network.session_id)

Back to all YARA-L rules