YARA-L rules: 1y

// Copyright 2025 Google LLC. Licensed under Apache-2.0.

rule blackbyte_ransomware_registry {

  meta:
    author = "frack113"
    description = "BlackByte set three different registry values to escalate privileges and begin setting the stage for lateral movement and encryption"
    reference = "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_blackbyte_ransomware.yml"
    license = "https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md"
    rule_name = "Blackbyte Ransomware Registry"
    rule_id = "mr_83d31958-2537-4ac7-bee2-1d6e193c892f"
    sigma_uuid = "83314318-052a-4c90-a1ad-660ece38d276"
    sigma_status = "test"
    tactic = "TA0005"
    technique = "T1112"
    type = "Detection"
    data_source = "Windows Registry"
    platform = "Windows"
    severity = "High"
    priority = "High"
    false_positives = "Unknown"

  events:
    $reg.metadata.event_type = "REGISTRY_MODIFICATION"
    (
        $reg.target.registry.registry_key = "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\LocalAccountTokenFilterPolicy" nocase or
        $reg.target.registry.registry_key = "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLinkedConnections" nocase or
        $reg.target.registry.registry_key = "HKLM\\SYSTEM\\CurrentControlSet\\Control\\FileSystem\\LongPathsEnabled" nocase
    ) and $reg.target.registry.registry_value_data = "DWORD (0x00000001)" nocase

    $reg.principal.hostname = $hostname

  match:
    $hostname over 5m

  outcome:
    //example usage of specifying test user and hostname to adjust risk score
    $risk_score = max(if($reg.principal.user.userid = "user" and $reg.principal.hostname = "hostname", 0, 15))
    $principal_hostname = array_distinct($reg.principal.hostname)
    $principal_process_pid = array_distinct($reg.principal.process.pid)
    $principal_process_file_full_path = array_distinct($reg.principal.process.file.full_path)
    $principal_process_product_specific_process_id = array_distinct($reg.principal.process.product_specific_process_id)
    $principal_user_userid = array_distinct($reg.principal.user.userid)
    $target_registry_key = array_distinct($reg.target.registry.registry_key)
    $target_registry_value_data = array_distinct($reg.target.registry.registry_value_data)
    $log_type = array_distinct(strings.concat($reg.metadata.log_type,"/",$reg.metadata.product_event_type))

  condition:
    $reg
}

// Copyright 2024 Google LLC. Licensed under Apache-2.0.

rule github_repository_deploy_key_created_or_modified {

  meta:
    author = "Google Cloud Security"
    description = "Detects when an SSH deploy key is added or modified in a GitHub repository. A compromised or unauthorized deploy key could allow malicious actors to push unauthorized changes into production environments, potentially bypassing code reviews and testing procedures. This could lead to the introduction of backdoors, malware, or the exfiltration of sensitive data."
    rule_id = "mr_e10b0f8b-6a90-48af-aecb-95ef2ca10de8"
    rule_name = "GitHub Repository Deploy Key Created Or Modified"
    assumption = "Your GitHub enterprise audit log settings are configured to log the source IP address for events. Reference: https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization"
    type = "alert"
    severity = "High"
    priority = "High"
    platform = "GitHub"
    data_source = "github"
    mitre_attack_tactic = "Persistence"
    mitre_attack_technique = "Account Manipulation: Additional Cloud Credentials"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1098/001/"
    mitre_attack_version = "v14"
    reference = "https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise"

  events:
    $github.metadata.vendor_name = "GITHUB" nocase
    $github.metadata.product_name = "GITHUB"
    (
        $github.metadata.product_event_type = "public_key.create" or
        $github.metadata.product_event_type = "public_key.update"
    )
    $github.principal.user.userid = $user_id
    $github.target.resource.name = $github_repo_name

  match:
    $user_id, $github_repo_name over 30m

  outcome:
    $risk_score = max(65)
    $mitre_attack_tactic = "Persistence"
    $mitre_attack_technique = "Account Manipulation: Additional Cloud Credentials"
    $mitre_attack_technique_id = "T1098.001"
    $event_count = count_distinct($github.metadata.id)
    $principal_ip = array_distinct($github.principal.ip)
    $principal_user_userid = array_distinct($github.principal.user.userid)
    $principal_ip_country = array_distinct($github.principal.ip_geo_artifact.location.country_or_region)
    $principal_ip_state = array_distinct($github.principal.ip_geo_artifact.location.state)
    $principal_ip_city = array_distinct($github.principal.location.city)
    $security_result_summary = array_distinct($github.security_result.summary)

  condition:
    $github
}

// Copyright 2025 Google LLC. Licensed under Apache-2.0.

rule o365_admin_login_activity_to_uncommon_mscloud_apps {

  meta:
    author = "Google Cloud Security"
    description = "This rule detects O365 login activity to apps other than a defined list of first party MS Cloud Apps. Note that Azure Active Directory PowerShell and custom Azure apps are not in this list by default"
    rule_id = "mr_4fa166c8-922a-4dc1-b72d-9bcb2ec7609f"
    rule_name = "O365 Admin Login Activity To Uncommon Microsoft Cloud Apps"
    assumption = "The lists first_party_ms_cloud_apps and msazure_admin_watchlist are populated as needed"
    tactic = "TA0001"
    technique = "T1078.004"
    reference = "https://learn.microsoft.com/en-us/troubleshoot/azure/active-directory/verify-first-party-apps-sign-in"
    type = "alert"
    platform = "azure"
    data_source = "o365"
    severity = "High"
    priority = "High"

  events:
    $login.metadata.event_type = "USER_LOGIN"
    $login.metadata.product_event_type = "UserLoggedIn"
    $login.metadata.product_name = "Office 365"
    NOT $login.target.resource.product_object_id in %first_party_ms_cloud_apps
    $login.metadata.vendor_name = "Microsoft"
    $login.security_result.action = "ALLOW"
    $login.target.user.userid = $userid

    //Use the criteria below if you want to isolate activity to a specific watchlist of users
    //@domain.com is stripped off to reduce the values in the list to just the username of the email address, can apply to userid or email address fields
    re.replace($login.target.user.userid, `@.*$`, "")  in %msazure_admin_watchlist

  match:
    $userid over 5m

  outcome:
    $risk_score = 65
    $event_count = count_distinct($login.metadata.id)
    $target_application = array_distinct($login.target.resource.product_object_id)
    $security_summary = array_distinct($login.security_result.summary)
    $user_agent = array_distinct($login.network.http.user_agent)
    $country_region_login_attempt = array_distinct($login.principal.ip_geo_artifact.location.country_or_region)
    //added to populate alert graph with additional context
    $principal_ip = array_distinct($login.principal.ip)
    $target_user_userid = array_distinct($login.target.user.userid)

  condition:
    $login
}