YARA-L rules: 1g

// Copyright 2023 Google LLC. Licensed under Apache-2.0.

rule aws_multi_factor_authentication_disabled {

  meta:
    author = "Google Cloud Security"
    description = "Detects attempts to disable multi-factor authentication for an AWS IAM user."
    rule_id = "mr_0d6bd993-c80b-4367-a921-5a542ab826b3"
    rule_name = "AWS MultiFactor Authentication Disabled"
    mitre_attack_tactic = "Credential Access, Defense Evasion, Persistence"
    mitre_attack_technique = "Modify Authentication Process: Multi-Factor Authentication"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1556/006/"
    mitre_attack_version = "v13.1"
    type = "Alert"
    data_source = "AWS CloudTrail"
    platform = "AWS"
    severity = "Medium"
    priority = "Medium"

  events:
    $cloudtrail.metadata.vendor_name = "AMAZON"
    $cloudtrail.metadata.product_name = "AWS CloudTrail"
    (
      $cloudtrail.metadata.product_event_type = "DeleteVirtualMFADevice" or
      $cloudtrail.metadata.product_event_type = "DeactivateMFADevice"
    )
    $cloudtrail.security_result.action = "ALLOW"
    $cloudtrail.principal.user.user_display_name = $user_id

  match:
    $user_id over 1h

  outcome:
    $risk_score = max(
        //Baseline
        35 +
        // High Risk for AWS Root User
        if($cloudtrail.src.user.user_display_name = "AWS Root User", 50)
    )
    $mitre_attack_tactic = "Credential Access, Defense Evasion, Persistence"
    $mitre_attack_technique = "Modify Authentication Process: Multi-Factor Authentication"
    $mitre_attack_technique_id = "T1556.006"
    $event_count = count_distinct($cloudtrail.metadata.id)
    $network_http_user_agent = array_distinct($cloudtrail.network.http.user_agent)
    $principal_ip = array_distinct($cloudtrail.principal.ip)
    $principal_ip_country = array_distinct($cloudtrail.principal.ip_geo_artifact.location.country_or_region)
    $principal_ip_state = array_distinct($cloudtrail.principal.ip_geo_artifact.location.state)
    $principal_user_display_name = array_distinct($cloudtrail.principal.user.user_display_name)
    $recipient_aws_account_id = array_distinct($cloudtrail.additional.fields["recipientAccountId"])
    $aws_region = array_distinct($cloudtrail.principal.location.name)
    $target_resource_name = array_distinct($cloudtrail.target.resource.name)
    $target_resource_product_object_id = array_distinct($cloudtrail.target.resource.product_object_id)

  condition:
    $cloudtrail
}

// Copyright 2025 Google LLC. Licensed under Apache-2.0.

 rule entra_id_application_creation {

  meta:
    author = "Google Cloud Security"
    description = "Application creation can be legitimate but aren't frequently created. Validating application creation may be appropriate to ensure rogue apps aren't being created."
    rule_id = "mr_0c137994-a9d9-4cd2-8c2d-b8a9c0f223d0"
    rule_name = "Entra ID Application Creation"
    type = "alert"
    platform = "azure"
    data_source = "azure ad audit"
    severity = "Low"
    priority = "Medium"

  events:
    $app.metadata.event_type = "SERVICE_CREATION"
    $app.metadata.product_name = "Azure AD Directory Audit"
    $app.metadata.vendor_name = "Microsoft"
    $app.metadata.product_event_type = "Add application"
    $app.security_result.action = "ALLOW"
    $app.principal.user.userid = $user

  match:
    $user over 5m

  outcome:
    $risk_score = 35
    $event_count = count_distinct($app.metadata.id)
    $principal_ip = array_distinct($app.principal.ip)
    $principal_email = array_distinct($app.principal.user.email_addresses)
    $principal_county_region = array_distinct($app.principal.ip_geo_artifact.location.country_or_region)
    $user_agent = array_distinct($app.network.http.user_agent)
    $network_session = array_distinct($app.network.session_id)
    $target_application = array_distinct($app.target.resource.name)
    $target_application_id = array_distinct($app.target.resource.product_object_id)

  condition:
    $app
}

// Copyright 2024 Google LLC. Licensed under Apache-2.0.

rule github_secret_scanning_disabled_or_bypassed {

  meta:
    author = "Google Cloud Security"
    description = "Detects when components of GitHub secret scanning is disabled for an enterprise or organization."
    rule_id = "mr_982454f3-81ab-491a-b61c-bae718d6028e"
    rule_name = "GitHub Secret Scanning Disabled Or Bypassed"
    assumption = "Your GitHub enterprise audit log settings are configured to log the source IP address for events. Reference: https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization"
    type = "alert"
    severity = "High"
    priority = "High"
    platform = "GitHub"
    data_source = "github"
    mitre_attack_tactic = "Defense Evasion"
    mitre_attack_technique = "Impair Defenses: Disable or Modify Tools"
    mitre_attack_url = "https://attack.mitre.org/versions/v14/techniques/T1562/001/"
    mitre_attack_version = "v14"
    reference = "https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise"

  events:
    $github.metadata.vendor_name = "GITHUB" nocase
    $github.metadata.product_name = "GITHUB"
    (
        $github.metadata.product_event_type = "secret_scanning.disable" or
        $github.metadata.product_event_type = "secret_scanning_new_repos.disable" or
        $github.metadata.product_event_type = "secret_scanning_push_protection.bypass" or
        $github.metadata.product_event_type = "business_secret_scanning_custom_pattern_push_protection.disabled" or
        $github.metadata.product_event_type = "business_secret_scanning.disable" or
        $github.metadata.product_event_type = "business_secret_scanning.disabled_for_new_repos" or
        $github.metadata.product_event_type = "business_secret_scanning_push_protection_custom_message.disable" or
        $github.metadata.product_event_type = "business_secret_scanning_push_protection.disable" or
        $github.metadata.product_event_type = "business_secret_scanning_push_protection.disabled_for_new_repos" or
        $github.metadata.product_event_type = "org_secret_scanning_generic_secrets.disabled" or
        $github.metadata.product_event_type = "repository_secret_scanning.disable" or
        $github.metadata.product_event_type = "repository_secret_scanning_generic_secrets.disabled" or
        $github.metadata.product_event_type = "repository_secret_scanning_push_protection.disable"
    )

  outcome:
    $risk_score = max(85)
    $mitre_attack_tactic = "Defense Evasion"
    $mitre_attack_technique = "Impair Defenses: Disable or Modify Tools"
    $mitre_attack_technique_id = "T1562.001"
    $principal_ip = array_distinct($github.principal.ip)
    $principal_user_userid = array_distinct($github.principal.user.userid)
    $principal_ip_country = array_distinct($github.principal.ip_geo_artifact.location.country_or_region)
    $principal_ip_state = array_distinct($github.principal.ip_geo_artifact.location.state)
    $principal_ip_city = array_distinct($github.principal.location.city)
    $security_result_summary = array_distinct($github.security_result.summary)

  condition:
    $github
}

// Copyright 2023 Google LLC. Licensed under Apache-2.0.

rule okta_threatinsight_suspected_brute_force_attack {

  meta:
    author = "Google Cloud Security"
    description = "Okta ThreatInsight detects multiple login failures from the same IP across one or more Okta orgs."
    rule_id = "mr_9537e888-7af7-491f-a5e2-3623e1798aba"
    rule_name = "Okta ThreatInsight Suspected Bruteforce Attack"
    reference = "https://help.okta.com/en-us/Content/Topics/Security/threat-insight/configure-threatinsight-system-log.htm"
    mitre_attack_tactic = "Credential Access"
    mitre_attack_technique = "Brute Force: Password Guessing"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1110/001/"
    mitre_attack_version = "v13.1"
    type = "Alert"
    data_source = "Okta"
    severity = "Medium"
    priority = "Medium"

  events:
    $bruteforce.metadata.product_name = "Okta"
    $bruteforce.metadata.vendor_name = "Okta"
    $bruteforce.metadata.event_type = "USER_UNCATEGORIZED"
    $bruteforce.metadata.product_event_type = "security.threat.detected"
    $bruteforce.security_result.category_details = "Login Failures"
    $bruteforce.principal.user.userid = $userid

  match:
    $userid over 1h

  outcome:
    $risk_score = max(
        35 +
        // If the IP Address is marked as suspicious IP address by Okta ThreatInsight
        if($bruteforce.security_result.detection_fields["threatSuspected"] = "true", 30) +
        // Unauthorized target geographies
        if($bruteforce.principal.ip_geo_artifact.location.country_or_region = "Cuba", 20) +
        if($bruteforce.principal.ip_geo_artifact.location.country_or_region = "Iran", 20) +
        if($bruteforce.principal.ip_geo_artifact.location.country_or_region = "North Korea", 20) +
        if($bruteforce.principal.ip_geo_artifact.location.country_or_region = "Russia", 20) +
        if($bruteforce.principal.ip_geo_artifact.location.country_or_region = "Syria", 20)
    )
    $mitre_attack_tactic = "Credential Access"
    $mitre_attack_technique = "Brute Force: Password Guessing"
    $target_user_agent = array_distinct($bruteforce.network.http.user_agent)
    $principal_ip = array_distinct($bruteforce.principal.ip)
    $principal_ip_country = array_distinct($bruteforce.principal.ip_geo_artifact.location.country_or_region)
    $principal_ip_state = array_distinct($bruteforce.principal.ip_geo_artifact.location.state)
    $principal_ip_city = array_distinct($bruteforce.principal.location.city)
    $security_result_summary = array_distinct($bruteforce.security_result.summary)

  condition:
    $bruteforce
}

// Copyright 2026 Google LLC. Licensed under Apache-2.0.

rule sap_sensitive_role_authorization_modification {

  meta:
    author = "Google Cloud Security"
    description = "Detects changes to authorization objects within defined sensitive roles. Correlates with login audit logs for session context."
    severity = "High"
    tactic = "TA0004"
    technique = "T1098"

  events:
    $change.metadata.log_type = "SAP_CHANGE_DOCUMENT"
    $change.target.resource.name = "PFCG"
    $change.target.resource.attribute.labels["TABNAME"] = /1251/
    $change.target.resource.attribute.labels["CHANGE_IND"] = "U"

    $role_id = $change.target.resource.product_object_id
    $role_id in %sap_sensitive_roles.role

    //join
    $user = $change.principal.user.userid
    $user = $audit.principal.user.userid

    $audit.metadata.log_type = "SAP_SECURITY_AUDIT"
    $audit.additional.fields["msg_1"] = /^AU1$|^AU5$/

    not $user in %sap_admin_users.user

  match:
    $user over 12h

  outcome:
    $risk_score = 85
    $changed_role = array_distinct($role_id)
    $auth_objects = array_distinct($change.target.resource.attribute.labels["TABKEY"])
    $terminal_ip = array_distinct($audit.principal.ip)
    $terminal_host = array_distinct($audit.principal.hostname)
    $transaction = array_distinct($change.target.application)

    $time_diff_minutes = max(timestamp.get_minute($change.metadata.event_timestamp.seconds) - timestamp.get_minute($audit.metadata.event_timestamp.seconds))

  condition:
    $change and $audit
}