YARA-L rules: 0u

// Copyright 2023 Google LLC. Licensed under Apache-2.0.

rule aws_user_creates_permanent_access_key {

  meta:
    author = "Google Cloud Security"
    description = "Detects when an AWS IAM user creates an AWS Access Key for programmatic calls."
    rule_id = "mr_ebe72ce0-1e54-4251-afca-ed3fc403cd1f"
    rule_name = "AWS User Creates Permanent Access Key"
    mitre_attack_tactic = "Defense Evasion, Persistence, Privilege Escalation, Initial Access"
    mitre_attack_technique = "Valid Accounts: Cloud Accounts"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1078/004/"
    mitre_attack_version = "v13.1"
    type = "Alert"
    data_source = "AWS CloudTrail"
    platform = "AWS"
    severity = "Medium"
    priority = "Medium"

  events:
    $cloudtrail.metadata.vendor_name = "AMAZON"
    $cloudtrail.metadata.product_name = "AWS CloudTrail"
    $cloudtrail.metadata.product_event_type = "CreateAccessKey"
    $cloudtrail.security_result.action = "ALLOW"

  outcome:
    $risk_score = max(50)
    $mitre_attack_tactic = "Defense Evasion, Persistence, Privilege Escalation, Initial Access"
    $mitre_attack_technique = "Valid Accounts: Cloud Accounts"
    $mitre_attack_technique_id = "T1078.004"
    $event_count = count_distinct($cloudtrail.metadata.id)
    $network_http_user_agent = $cloudtrail.network.http.user_agent
    $principal_ip = array_distinct($cloudtrail.principal.ip)
    $principal_ip_country = array_distinct($cloudtrail.principal.ip_geo_artifact.location.country_or_region)
    $principal_ip_state = array_distinct($cloudtrail.principal.ip_geo_artifact.location.state)
    $principal_user_display_name = $cloudtrail.principal.user.user_display_name
    $recipient_aws_account_id = $cloudtrail.additional.fields["recipientAccountId"]
    $aws_region = $cloudtrail.principal.location.name
    $target_resource_name = $cloudtrail.target.resource.name
    $target_resource_product_object_id = $cloudtrail.target.resource.product_object_id

  condition:
    $cloudtrail
}

// Copyright 2024 Google LLC. Licensed under Apache-2.0.

rule github_high_number_of_non_public_github_repositories_downloaded {

  meta:
    author = "Google Cloud Security"
    description = "Detects when a user downloads a high number of non-public GitHub repositories. An adversary may attempt to steal the contents of several GitHub repositories after compromising a user account."
    rule_id = "mr_549561b8-1088-4a08-b1f4-a1029a142919"
    rule_name = "GitHub High Number Of Non Public GitHub Repositories Downloaded"
    assumption = "Your GitHub enterprise audit log settings are configured to log the source IP address for events. Reference: https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization"
    type = "alert"
    severity = "High"
    priority = "High"
    platform = "GitHub"
    data_source = "github"
    mitre_attack_tactic = "Collection"
    mitre_attack_technique = "Data from Information Repositories: Code Repositories"
    mitre_attack_url = "https://attack.mitre.org/versions/v14/techniques/T1213/003/"
    mitre_attack_version = "v14"
    reference = "https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise"

  events:
    $github.metadata.vendor_name = "GITHUB" nocase
    $github.metadata.product_name = "GITHUB"
    $github.metadata.product_event_type = "repo.download_zip"
    $github.extracted.fields["public_repo"] = "false"
    $github.principal.user.userid = $user_id
    $github.target.resource.name = $github_repo_name

  match:
    $user_id over 30m

  outcome:
    $github_repo_name_distinct_count = count_distinct($github_repo_name)
    $risk_score = max(85)
    $mitre_attack_tactic = "Collection"
    $mitre_attack_technique = "Data from Information Repositories: Code Repositories"
    $mitre_attack_technique_id = "T1213.003"
    $event_count = count_distinct($github.metadata.id)
    $principal_ip = array_distinct($github.principal.ip)
    $principal_user_userid = array_distinct($github.principal.user.userid)
    $principal_ip_country = array_distinct($github.principal.ip_geo_artifact.location.country_or_region)
    $principal_ip_state = array_distinct($github.principal.ip_geo_artifact.location.state)
    $principal_ip_city = array_distinct($github.principal.location.city)
    $security_result_summary = array_distinct($github.security_result.summary)

  condition:
    // Customize GitHub repo count to fit your environment
    $github and $github_repo_name_distinct_count > 5
}

// Copyright 2025 Google LLC. Licensed under Apache-2.0.

rule gcp_identity_low_and_medium_severity_alert_escalation {

  meta:
    author = "Mo Mohajerani"
    description = "Detects when a Google Cloud identity experiences a low severity event followed by medium severity event within 24 hours."
    rule_name = "Google Cloud identity low and medium alert escalation"
    rule_id = "mr_fafc6c00-aedb-4664-ae1a-5a48f3a7534d"
    type = "Alert"
    platform = "GCP"
    data_source = "Security Command Center Threat"
    mitre_attack_tactic = "Defense Evasion, Persistence, Privilege Escalation, Initial Access"
    mitre_attack_technique = "Valid Accounts"
    severity = "High"
    priority = "High"

  events:
    // Low severity alert triggered in SCC
    $low_severity.metadata.product_name = "Security Command Center"
    $low_severity.security_result[0].severity = "LOW"
    $low_severity.principal.user.email_addresses = $user_email
    // Medium severity alert triggered in SCC
    $medium_severity.metadata.product_name = "Security Command Center"
    $medium_severity.security_result[0].severity = "MEDIUM"
    $medium_severity.principal.user.email_addresses = $user_email
    // Enforces the sequence of events, ensuring the low severity event(s) triggered prior to the medium severity event(s)
    $low_severity.metadata.event_timestamp.seconds < $medium_severity.metadata.event_timestamp.seconds

  match:
    $user_email over 24h

  outcome:
    // Risk score is increased when the suspicious identity has been accessed from unexpected locations
    // This logic can be customized based on your organization's environment and normal activity
    $risk_score = max(80 + if($low_severity.principal.location.country_or_region != "Germany", 10))
    $mitre_attack_tactic = "Defense Evasion, Persistence, Privilege Escalation, Initial Access"
    $mitre_attack_technique = "Valid Accounts"
    $mitre_attack_technique_id = "T1078"
    $security_category = array_distinct($medium_severity.security_result.category)
    $security_category_details = array_distinct($medium_severity.security_result.category_details)
    $security_summary = array_distinct($medium_severity.security_result.summary)
    $affected_identity = array_distinct($medium_severity.principal.user.userid)
    $principal_ip_country = array_distinct($medium_severity.principal.ip_geo_artifact.location.country_or_region)
    $principal_ip_state = array_distinct($medium_severity.principal.ip_geo_artifact.location.state)
    $event_count_low = count_distinct($low_severity.metadata.id)
    $principal_user_display_name = array_distinct($medium_severity.principal.user.user_display_name)

  condition:
    $low_severity and $medium_severity
}

// Copyright 2023 Google LLC. Licensed under Apache-2.0.

rule google_workspace_saml_idp_configuration_change {

  meta:
    author = "Google Cloud Security"
    description = "Identifies SAML provider configuration changes in Google Workspace. Security teams can monitor for changes to SAML provider configuration that may weaken the organization's security posture."
    rule_id = "mr_1a321683-9c52-4928-a654-e0677df97c09"
    rule_name = "Google Workspace SAML IDP Configuration Change"
    mitre_attack_tactic = "Defense Evasion, Persistence, Privilege Escalation, Initial Access"
    mitre_attack_technique = "Valid Accounts"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1078/"
    mitre_attack_version = "v13.1"
    type = "Alert"
    data_source = "Workspace Activity"
    severity = "High"
    priority = "High"

  events:
    $ws.metadata.vendor_name = "Google Workspace"
    $ws.metadata.product_name = "admin"
    $ws.security_result.category_details = "SAML2_SERVICE_PROVIDER_CONFIG_SETTINGS"
    $ws.metadata.product_event_type = /SAML2_SERVICE_PROVIDER_CONFIG/
    $ws.principal.user.userid = $userid

  match:
    $userid over 1h

  outcome:
    $risk_score = max(75)
    $mitre_attack_tactic = "Defense Evasion, Persistence, Privilege Escalation, Initial Access"
    $mitre_attack_technique = "Valid Accounts"
    $mitre_attack_technique_id = "T1078"
    $event_count = count_distinct($ws.metadata.id)
    $principal_ip = array_distinct($ws.principal.ip)
    $principal_country = array_distinct($ws.principal.ip_geo_artifact.location.country_or_region)
    $principal_state = array_distinct($ws.principal.ip_geo_artifact.location.state)
    $principal_user_emails = array_distinct($ws.principal.user.email_addresses)
    $principal_user_id = array_distinct($ws.principal.user.userid)
    $saml_entity_id = array_distinct($ws.about.labels["saml2_service_provider_entity_id"])
    $saml_name = array_distinct($ws.about.labels["saml2_service_provider_name"])
    $product_event_type = array_distinct($ws.metadata.product_event_type)

  condition:
    $ws
}

// Copyright 2025 Google LLC. Licensed under Apache-2.0.

 rule ms_graph_group_members_enumeration {

  meta:
    author = "Google Cloud Security"
    description = "Identify the enumeration of members within groups in Entra ID. This is based on GraphRunner Get-SecurityGroups function behavior so modifications may be needed for other scenarios"
    rule_id = "mr_a7af3e4e-19b0-4102-a794-ed2ca151df8c"
    rule_name = "Hunt for group members enumeration in the Microsoft Graph API"
    reference = "https://github.com/dafthack/GraphRunner/blob/main/GraphRunner.ps1"
    type = "Hunt"
    data_source = "MS Graph Activity Logs"
    platform = "Azure"
    severity = "Low"
    priority = "Low"

  events:
    $api.metadata.event_type = "NETWORK_HTTP"
    $api.metadata.product_event_type = "Microsoft Graph Activity"
    re.regex($api.target.url, `^https://graph.microsoft.com/v1.0/groups/.*/members$`) nocase
    //Can be tuned for specific User Agent strings being used
    //$api.network.http.user_agent = /PowerShell/ nocase
    $api.network.http.method = "GET"
    $api.network.http.response_code = 200
    $api.principal.ip[0] = $ip
    $api.network.session_id = $session
    re.capture($api.target.url, `^https://graph.microsoft.com/v1.0/groups/(.*)/members$`) = $group_guid

  match:
    $ip, $session over 5m

  outcome:
    $risk_score = 35
    $event_count = count_distinct($api.metadata.id)
    $requesting_user_guid = array_distinct($api.principal.user.userid)
    //Using $ip placeholder variable since we specify first value in repeated field only, if repeated field is used, it can cause duplicate counts in sums below
    $requesting_ip = array_distinct($ip)
    $user_agent = array_distinct($api.network.http.user_agent)
    $location = array_distinct($api.principal.location.name)
    $target_application_id_guid = array_distinct($api.target.resource.product_object_id)
    $session_id = array_distinct($api.network.session_id)
    $group_count = count_distinct($group_guid)
    $group_list = array_distinct($group_guid) //limited to 25 groups outputted to screen

  condition:
    //option to add additional threshold here for number of groups enumerated if desired
    $api //and $group_count > 10
}

// Copyright 2023 Google LLC. Licensed under Apache-2.0.

rule impacket_wmiexec_cisa_report {

  meta:
    author = "Google Cloud Security"
    description = "Detects the artifacts generally associated with the use of wmiexec.py"
    rule_id = "mr_ca682bc6-411b-46e5-88ef-1668032b14d1"
    rule_name = "Impacket WMIExec CISA Report"
    type = "alert"
    data_source = "microsoft sysmon, microsoft windows events"
    tactic = "TA0002"
    technique = "T1047"
    reference = "https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF"
    severity = "Medium"
    priority = "Medium"

  events:
    (
        $process.metadata.event_type = "PROCESS_LAUNCH" and
        re.regex($process.target.process.command_line, `1>.*\\ADMIN\$\\__.*2>&1`) nocase
    )
    or
    (
        $process.metadata.event_type = "FILE_CREATION" and
        re.regex($process.target.file.full_path, `\\windows\\__`) nocase
    )
    $process.principal.hostname = $hostname

  match:
    $hostname over 5m

  outcome:
    $risk_score = 65
    // added to populate alert graph with additional context
    $principal_hostname = array_distinct($process.principal.hostname)
    $principal_process_pid = array_distinct($process.principal.process.pid)
    $principal_process_command_line = array_distinct($process.principal.process.command_line)
    $principal_process_file_sha256 = array_distinct($process.principal.process.file.sha256)
    $principal_process_file_full_path = array_distinct($process.principal.process.file.full_path)
    $principal_process_product_specific_process_id = array_distinct($process.principal.process.product_specific_process_id)
    $principal_process_parent_process_product_specific_process_id = array_distinct($process.principal.process.parent_process.product_specific_process_id)
    $target_process_pid = array_distinct($process.target.process.pid)
    $target_process_command_line = array_distinct($process.target.process.command_line)
    $target_process_file_sha256 = array_distinct($process.target.process.file.sha256)
    $target_process_file_full_path = array_distinct($process.target.process.file.full_path)
    $target_process_product_specific_process_id = array_distinct($process.target.process.product_specific_process_id)
    $principal_user_userid = array_distinct($process.principal.user.userid)
    $target_user_userid = array_distinct($process.target.user.userid)
    $target_file_full_path = array_distinct($process.target.file.full_path)

  condition:
    $process
}

// Copyright 2023 Google LLC. Licensed under Apache-2.0.

rule rw_mimikatz_T1003 {

  meta:
    author = "Google Cloud Security"
    description = "Detects the process mimikatz being issued from the command line."
    rule_id = "mr_fa96ead4-7f1f-4dbb-bacb-a526f985c12f"
    rule_name = "MITRE ATT&CK T1003 RW Mimikatz"
    tactic = "TA0006"
    technique = "T1003"
    type = "alert"
    platform = "Windows"
    data_source = "microsoft sysmon, microsoft windows events"
    severity = "Critical"
    priority = "High"

  events:
    $process.metadata.event_type = "PROCESS_LAUNCH"
    $process.metadata.event_type = $event_type
    $process.target.process.command_line = /mimikatz/ nocase

  match:
    $event_type over 5m

  outcome:
    $risk_score = 95
    $event_count = count_distinct($process.metadata.id)
    // added to populate alert graph with additional context
    $principal_hostname = array_distinct($process.principal.hostname)
    $principal_process_pid = array_distinct($process.principal.process.pid)
    $principal_process_command_line = array_distinct($process.principal.process.command_line)
    $principal_process_file_sha256 = array_distinct($process.principal.process.file.sha256)
    $principal_process_file_full_path = array_distinct($process.principal.process.file.full_path)
    $principal_process_product_specific_process_id = array_distinct($process.principal.process.product_specific_process_id)
    $principal_process_parent_process_product_specific_process_id = array_distinct($process.principal.process.parent_process.product_specific_process_id)
    $target_process_pid = array_distinct($process.target.process.pid)
    $target_process_command_line = array_distinct($process.target.process.command_line)
    $target_process_file_sha256 = array_distinct($process.target.process.file.sha256)
    $target_process_file_full_path = array_distinct($process.target.process.file.full_path)
    $target_process_product_specific_process_id = array_distinct($process.target.process.product_specific_process_id)
    $principal_user_userid = array_distinct($process.principal.user.userid)

  condition:
    $process
}

// Copyright 2025 Google LLC. Licensed under Apache-2.0.

rule renamed_createdump_utility_execution {

  meta:
    author = "Florian Roth (Nextron Systems)"
    description = "Detects uses of a renamed legitimate createdump.exe LOLOBIN utility to dump process memory"
    reference = "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_renamed_createdump.yml"
    license = "https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md"
    rule_name = "Renamed CreateDump Utility Execution"
    sigma_uuid = "1a1ed54a-2ba4-4221-94d5-01dee560d71e"
    sigma_status = "test"
    rule_id = "mr_d680d855-18b0-4a96-9844-1a1e41a239c9"
    tactic = "TA0006"
    technique = "T1003.001"
    type = "Detection"
    data_source = "Sysmon"
    platform = "Windows"
    severity = "High"
    priority = "High"
    false_positives = "Command lines that use the same flags"

  events:
    $process.metadata.event_type = "PROCESS_LAUNCH"
    (
        (
            $process.src.process.file.full_path = "FX_VER_INTERNALNAME_STR" nocase
        )
        or
        (
            strings.contains($process.target.process.command_line, " -u ") and
            strings.contains($process.target.process.command_line, " -f ") and
            strings.contains($process.target.process.command_line, ".dmp")
        )
        or
        (
            strings.contains($process.target.process.command_line, " --full ") and
            strings.contains($process.target.process.command_line, " --name ") and
            strings.contains($process.target.process.command_line, ".dmp")
        )
    )
    NOT re.regex($process.target.process.file.full_path, `\\createdump\.exe$`) nocase

    $process.principal.hostname = $hostname

  match:
    $hostname over 5m

  outcome:
    //example usage of specifying test user and hostname to adjust risk score
    $risk_score = max(if($process.principal.user.userid = "user" and $process.principal.hostname = "hostname", 0, 15))
    $principal_process_pid = array_distinct($process.principal.process.pid)
    $principal_process_command_line = array_distinct($process.principal.process.command_line)
    $principal_process_file_sha256 = array_distinct($process.principal.process.file.sha256)
    $principal_process_file_full_path = array_distinct($process.principal.process.file.full_path)
    $principal_process_product_specfic_process_id = array_distinct($process.principal.process.product_specific_process_id)
    $principal_process_parent_process_product_specfic_process_id = array_distinct($process.principal.process.parent_process.product_specific_process_id)
    $target_process_pid = array_distinct($process.target.process.pid)
    $target_process_command_line = array_distinct($process.target.process.command_line)
    $target_process_file_sha256 = array_distinct($process.target.process.file.sha256)
    $target_process_file_full_path = array_distinct($process.target.process.file.full_path)
    $target_process_product_specfic_process_id = array_distinct($process.target.process.product_specific_process_id)
    $principal_user_userid = array_distinct($process.principal.user.userid)
    $log_type = array_distinct(strings.concat($process.metadata.log_type,"/",$process.metadata.product_event_type))

  condition:
    $process
}