YARA-L rules: 0y

// Copyright 2023 Google LLC. Licensed under Apache-2.0.

rule aws_ec2_get_windows_admin_password {

  meta:
    author = "Google Cloud Security"
    description = "Detects a successful attempt to retrieve the encrypted Administrator password for a Windows EC2 instance."
    rule_id = "mr_92364192-b3c7-4e5d-a1a1-eb7b3adbd0e4"
    rule_name = "AWS EC2 Get Windows Admin Password"
    mitre_attack_tactic = "Credential Access"
    mitre_attack_technique = "Credentials from Password Stores"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1555/"
    mitre_attack_version = "v13.1"
    type = "Alert"
    data_source = "AWS CloudTrail"
    platform = "AWS"
    severity = "High"
    priority = "High"

  events:
    $cloudtrail.metadata.vendor_name = "AMAZON"
    $cloudtrail.metadata.product_name = "AWS CloudTrail"
    $cloudtrail.metadata.product_event_type = "GetPasswordData"
    $cloudtrail.security_result.action = "ALLOW"
    $cloudtrail.principal.ip = $ip

  match:
    $ip over 1h

  outcome:
    $risk_score = max(75)
    $mitre_attack_tactic = "Credential Access"
    $mitre_attack_technique = "Credentials from Password Stores"
    $mitre_attack_technique_id = "T1555"
    $event_count = count_distinct($cloudtrail.metadata.id)
    $network_http_user_agent = array_distinct($cloudtrail.network.http.user_agent)
    $principal_ip = array_distinct($cloudtrail.principal.ip)
    $principal_ip_country = array_distinct($cloudtrail.principal.ip_geo_artifact.location.country_or_region)
    $principal_ip_state = array_distinct($cloudtrail.principal.ip_geo_artifact.location.state)
    $principal_user_display_name = array_distinct($cloudtrail.principal.user.user_display_name)
    $recipient_aws_account_id = array_distinct($cloudtrail.additional.fields["recipientAccountId"])
    $aws_region = array_distinct($cloudtrail.principal.location.name)
    $target_resource_ancestors_product_object_id = array_distinct($cloudtrail.target.resource_ancestors.product_object_id)

  condition:
    $cloudtrail
}

// Copyright 2023 Google LLC. Licensed under Apache-2.0.

rule aws_guardduty_malicious_or_suspicious_file_executed {

  meta:
    author = "Google Cloud Security"
    description = "Amazon GuardDuty detects a malicious or suspicious file on an Amazon EC2 instance or a container workload."
    rule_id = "mr_a5d8f51c-d0de-4169-99e2-d3eaa02b266c"
    rule_name = "AWS GuardDuty Malicious Or Suspicious File Executed"
    mitre_attack_tactic = "Execution"
    mitre_attack_technique = "User Execution: Malicious File"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1204/002/"
    mitre_attack_version = "v13.1"
    type = "Alert"
    data_source = "AWS GuardDuty"
    platform = "AWS"
    severity = "High"
    priority = "High"

  events:
    $guardduty.metadata.vendor_name = "AMAZON"
    $guardduty.metadata.product_name = "AWS GuardDuty"
    $guardduty.metadata.product_event_type = /MaliciousFile|SuspiciousFile/
    //Filter out sample findings
    $guardduty.security_result.about.labels["Sample"] != "true"

  outcome:
    $risk_score = max(35)
    $mitre_attack_tactic = "Execution"
    $mitre_attack_technique = "User Execution: Malicious File"
    $mitre_attack_technique_id = "T1204.002"
    $event_count = count_distinct($guardduty.metadata.id)
    $principal_ip = array_distinct($guardduty.principal.ip)
    $principal_ip_country = array_distinct($guardduty.principal.ip_geo_artifact.location.country_or_region)
    $principal_ip_state = array_distinct($guardduty.principal.ip_geo_artifact.location.state)
    $principal_user_display_name = $guardduty.principal.user.user_display_name
    $aws_region = $guardduty.target.location.name
    $target_resource_name = $guardduty.target.resource.name
    $target_resource_product_object_id = $guardduty.target.resource.product_object_id
    $security_result_summary = array_distinct($guardduty.security_result.summary)
    $security_result_description = array_distinct($guardduty.security_result.description)
    $security_result_severity = array_distinct($guardduty.security_result.severity)
    $security_result_severity_details = array_distinct($guardduty.security_result.severity_details)
    $metadata_product_event_type = array_distinct($guardduty.metadata.product_event_type)

  condition:
    $guardduty
}

// Copyright 2025 Google LLC. Licensed under Apache-2.0.

rule gmail_spike_in_undeliverables {

  meta:
    author = "Bastradamus"
    description = "Detects a spike in undeliverable emails, this can be an early indication of a targeted phishing campaign or a compromised user account."
    severity = "Medium"
    priority = "Medium"
    type = "alert"
    platform = "Google workspace"
    data_source = "Workspace Activity, gmail"
    mitre_attack_tactic = "Initial Access"
    mitre_attack_technique = "Phishing"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1566/"

  events:
    $email.metadata.vendor_name = "Google Workspace"
    $email.metadata.product_name = "gmail"
    $email.metadata.event_type = "EMAIL_TRANSACTION"
    $email.network.email.subject = /Undeliverable\:/ nocase
    $email.target.user.email_addresses = $user
    $email.network.email.subject = $subject

  match:
    $user over 10m

  outcome:
    $mitre_attack_tactic = array_distinct("Initial Access")
    $mitre_attack_technique = array_distinct("Phishing")
    $mitre_attack_technique_id = array_distinct("T1566")
    $event_count = count_distinct($email.metadata.description)
    $target_user_distinct_count = count_distinct($user)
    $target_user_count = count($user)
    $principal_ip = array_distinct($email.principal.ip)
    $count_subject_bounce = count_distinct($subject)
    $count_bounce_distinct_mail_id = count_distinct($email.network.email.mail_id)
    $sender_from = array_distinct($email.principal.network.email.from)

  condition:
    $email and $count_bounce_distinct_mail_id > 10 and $count_subject_bounce = 1
}