Detection rules › YARA-L

YARA-L rules: 20

Rule	Severity
API access to mailboxes for top N messages via the Microsoft Graph	`medium`
AWS API Gateway Keys Accessed	`low`
Okta User Rejected Multiple Push Notifications	`medium`

API access to mailboxes for top N messages via the Microsoft Graph

Severity: medium
Type: Alert
Time window: 5m
Match by: ip, session
Author: Google Cloud Security
Source: github.com/chronicle/detection-rules

Identify when mailboxes are being accessed with requests for N number of messages

Rule Body

// Copyright 2025 Google LLC. Licensed under Apache-2.0.

 rule ms_graph_mail_api_requests_top_n_messages {

  meta:
    author = "Google Cloud Security"
    description = "Identify when mailboxes are being accessed with requests for N number of messages"
    rule_id = "mr_4c2e1d84-5569-4bde-a9ad-d747b6fb84bf"
    rule_name = "API access to mailboxes for top N messages via the Microsoft Graph"
    type = "Alert"
    data_source = "MS Graph Activity Logs"
    platform = "Azure"
    severity = "Medium"
    priority = "Medium"

  events:
    $api.metadata.event_type = "NETWORK_HTTP"
    $api.metadata.product_event_type = "Microsoft Graph Activity"
    $api.network.http.method = "GET"
    $api.network.http.response_code = 200
    re.regex($api.target.url, `^https://graph.microsoft.com/v1.0/users/.*/mailFolders/.*\?\$top\=`) nocase
    //Can be tuned for specific User Agent strings being used
    //$api.network.http.user_agent = /PowerShell/ nocase

    $api.principal.ip = $ip
    $api.network.session_id = $session

  match:
    $ip, $session over 5m

  outcome:
    $risk_score = 65
    $event_count = count_distinct($api.metadata.id)
    $requesting_user_guid = array_distinct($api.principal.user.userid)
    $requesting_ip = array_distinct($api.principal.ip)
    $user_agent = array_distinct($api.network.http.user_agent)
    $location = array_distinct($api.principal.location.name)
    $target_application_id_guid = array_distinct($api.target.resource.product_object_id)
    $session_id = array_distinct($api.network.session_id)
    $target_url = array_distinct($api.target.url)
    $victim_user = array_distinct(re.capture($api.target.url, `^https://graph.microsoft.com/v1.0/users/(.*)/mailFolders/.*`))
    $victim_folder = array_distinct(re.capture($api.target.url, `^https://graph.microsoft.com/v1.0/users/.*/mailFolders/(.*)/messages`))
    $messages_requested = max(cast.as_int((re.capture($api.target.url, `^https://graph.microsoft.com/v1.0/users/.*/mailFolders/.*/messages\?\$top\=(\d+)`))))

  condition:
    //Optional threshold to set on the number of emails requested via API
    $api //and $messages_requested >= 100
}

YARA-L Rule Structure

Condition

Fires when at least one $api event in the 5m window.

Events

`$api` `NETWORK_HTTP`

metadata.product_event_type = "Microsoft Graph Activity"
network.http.method = "GET"
network.http.response_code = "200"
target.url matches "^https://graph.microsoft.com/v1.0/users/.*/mailFolders/.*\?\$top\="

Match and Correlation

Match key: $ip (principal.ip), $session (network.session_id)
Within: 5m

Outcome

Outcome variables add context to a detection. When the rule generates an alert, $risk_score is displayed with it.

Field	Expression
`risk_score`	`65`
`event_count`	`count_distinct($api.metadata.id)`
`requesting_user_guid`	`array_distinct($api.principal.user.userid)`
`requesting_ip`	`array_distinct($api.principal.ip)`
`user_agent`	`array_distinct($api.network.http.user_agent)`
`location`	`array_distinct($api.principal.location.name)`
`target_application_id_guid`	`array_distinct($api.target.resource.product_object_id)`
`session_id`	`array_distinct($api.network.session_id)`
`target_url`	`array_distinct($api.target.url)`
`victim_user`	array_distinct(re.capture($api.target.url, `^https:
`victim_folder`	array_distinct(re.capture($api.target.url, `^https:
`messages_requested`	max(cast.as_int((re.capture($api.target.url, `^https:

AWS API Gateway Keys Accessed

Severity: low
Type: Alert
Time window: 1h
Match by: ip
Author: Google Cloud Security
Source: github.com/chronicle/detection-rules

Detects when AWS API Gateway keys are accessed.

MITRE ATT&CK Coverage

Tactic	Techniques
Credential Access	`T1555` Credentials from Password Stores

Telemetry Coverage

Platform	Record / event type
AWS	CloudTrail event `GetApiKey`: Retrieves the details of a specific API key, including its value, associated usage plans, and enabled status.
AWS	CloudTrail event `GetApiKeys`: Lists all API keys in the account, optionally filtered by usage plan or name prefix, and optionally including key values.

Rule Body

// Copyright 2024 Google LLC. Licensed under Apache-2.0.

rule aws_api_gateway_get_keys {

  meta:
    author = "Google Cloud Security"
    description = "Detects when AWS API Gateway keys are accessed."
    rule_id = "mr_1d8ffb2e-ca26-4f8f-8ca1-3dd4694776f5"
    rule_name = "AWS API Gateway Keys Accessed"
    mitre_attack_tactic = "Credential Access"
    mitre_attack_technique = "Credentials from Password Stores"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1555/"
    mitre_attack_version = "v15.1"
    type = "Alert"
    data_source = "AWS CloudTrail"
    platform = "AWS"
    severity = "Low"
    priority = "Low"

  events:
    $cloudtrail.metadata.vendor_name = "AMAZON"
    $cloudtrail.metadata.product_name = "AWS CloudTrail"
    (
        ($cloudtrail.metadata.product_event_type = "GetApiKey" and $cloudtrail.target.resource.attribute.labels["requestParameters.includeValue"] = "true") or
        ($cloudtrail.metadata.product_event_type = "GetApiKeys" and $cloudtrail.target.resource.attribute.labels["requestParameters.includeValues"] = "true")
    )
    $cloudtrail.security_result.action = "ALLOW"
    $cloudtrail.principal.ip = $ip

  match:
    $ip over 1h

  outcome:
    $risk_score = max(35)
    $mitre_attack_tactic = "Credential Access"
    $mitre_attack_technique = "Credentials from Password Stores"
    $mitre_attack_technique_id = "T1555"
    $event_count = count_distinct($cloudtrail.metadata.id)
    $network_http_user_agent = array_distinct($cloudtrail.network.http.user_agent)
    $principal_ip = array_distinct($cloudtrail.principal.ip)
    $principal_ip_country = array_distinct($cloudtrail.principal.ip_geo_artifact.location.country_or_region)
    $principal_ip_state = array_distinct($cloudtrail.principal.ip_geo_artifact.location.state)
    $principal_user_display_name = array_distinct($cloudtrail.principal.user.user_display_name)
    $recipient_aws_account_id = array_distinct($cloudtrail.additional.fields["recipientAccountId"])
    $aws_region = array_distinct($cloudtrail.principal.location.name)
    $target_api_key = array_distinct($cloudtrail.target.resource.attribute.labels["requestParameters.apiKey"])
    $accessed_via_console = array_distinct($cloudtrail.target.resource.attribute.labels["sessionCredentialFromConsole"])

  condition:
    $cloudtrail
}

YARA-L Rule Structure

Condition

Fires when at least one $cloudtrail event in the 1h window.

Events

`$cloudtrail`

metadata.product_event_type = "GetApiKey"
target.resource.attribute.labels["requestParameters.includeValue"] = "true"
metadata.product_event_type = "GetApiKeys"
target.resource.attribute.labels["requestParameters.includeValues"] = "true"
security_result.action = "ALLOW"

Match and Correlation

Match key: $ip (principal.ip)
Within: 1h

Outcome

Outcome variables add context to a detection. When the rule generates an alert, $risk_score is displayed with it.

Field	Expression
`risk_score`	`max(35)`
`event_count`	`count_distinct($cloudtrail.metadata.id)`
`network_http_user_agent`	`array_distinct($cloudtrail.network.http.user_agent)`
`principal_ip`	`array_distinct($cloudtrail.principal.ip)`
`principal_ip_country`	`array_distinct($cloudtrail.principal.ip_geo_artifact.location.country_or_region)`
`principal_ip_state`	`array_distinct($cloudtrail.principal.ip_geo_artifact.location.state)`
`principal_user_display_name`	`array_distinct($cloudtrail.principal.user.user_display_name)`
`recipient_aws_account_id`	`array_distinct($cloudtrail.additional.fields["recipientAccountId"])`
`aws_region`	`array_distinct($cloudtrail.principal.location.name)`
`target_api_key`	`array_distinct($cloudtrail.target.resource.attribute.labels["requestParameters.apiKey"])`
`accessed_via_console`	`array_distinct($cloudtrail.target.resource.attribute.labels["sessionCredentialFromConsole"])`

Okta User Rejected Multiple Push Notifications

Severity: medium
Type: Alert
Time window: 10m
Match by: userid
Author: Google Cloud Security
Source: github.com/chronicle/detection-rules

Detects when an Okta user rejects more than 2 Push notifications in a 10 minute window.

MITRE ATT&CK Coverage

Tactic	Techniques
Credential Access	`T1110` Brute Force

References

https://sec.okta.com/pushfatigueworkflows

Telemetry Coverage

Platform	Record / event type
Okta	System Log event type `user.authentication.auth_via_mfa`: User authenticated via MFA
Okta	System Log event type `user.mfa.okta_verify.deny_push`: Okta Verify push rejected by user

Rules Detecting the Same Action

These rules filter on the same operation.

First Occurrence of Okta User Session Started via Proxy (Elastic)
MFA Fatigue (OKTA) (Kusto)
Okta AiTM Phishing Attempt Blocked by FastPass (Panther)
Okta Authentication Failed During MFA Challenge (Splunk)
Okta Fast Pass phishing Detection (Kusto)
Okta FastPass Phishing Detection (Sigma)
Okta FastPass Phishing Detection (Elastic)
Okta MFA Bruteforce Attack (YARA-L)

Rule Body

// Copyright 2023 Google LLC. Licensed under Apache-2.0.

rule okta_user_rejected_multiple_push_notifications {

  meta:
    author = "Google Cloud Security"
    description = "Detects when an Okta user rejects more than 2 Push notifications in a 10 minute window."
    rule_id = "mr_4d8ac05a-0d73-4d81-a5a1-470d2bd7d725"
    rule_name = "Okta User Rejected Multiple Push Notifications"
    reference = "https://sec.okta.com/pushfatigueworkflows"
    mitre_attack_tactic = "Credential Access"
    mitre_attack_technique = "Brute Force"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1110/"
    mitre_attack_version = "v13.1"
    type = "Alert"
    data_source = "Okta"
    severity = "Medium"
    priority = "Medium"

  events:
    $login.metadata.product_name = "Okta"
    $login.metadata.vendor_name = "Okta"
    $login.metadata.event_type = "USER_UNCATEGORIZED"
    ($login.metadata.product_event_type = "user.mfa.okta_verify.deny_push" and $login.security_result.summary = "User rejected Okta push verify") or
    ($login.metadata.product_event_type = "user.authentication.auth_via_mfa" and $login.security_result.detection_fields["factor"] = "OKTA_VERIFY_PUSH")
    $login.security_result.action = "BLOCK"
    $login.principal.user.userid = $userid

  match:
    $userid over 10m

  outcome:
    $risk_score = max(35)
    $mitre_attack_tactic = "Credential Access"
    $mitre_attack_technique = "Brute Force"
    $target_user_agent = array_distinct($login.network.http.user_agent)
    $principal_ip = array_distinct($login.principal.ip)
    $principal_ip_country = array_distinct($login.principal.ip_geo_artifact.location.country_or_region)
    $principal_ip_state = array_distinct($login.principal.ip_geo_artifact.location.state)
    $principal_ip_city = array_distinct($login.principal.location.city)
    $principal_user_email_addresses = array_distinct ($login.principal.user.email_addresses)
    $security_result_summary = array_distinct($login.security_result.summary)

  condition:
    #login >= 2
}

YARA-L Rule Structure

Condition

Fires when $login occurs at least 2 times in the 10m window.

Events

`$login` `USER_UNCATEGORIZED`

metadata.product_event_type = "user.mfa.okta_verify.deny_push"
security_result.summary = "User rejected Okta push verify"
metadata.product_event_type = "user.authentication.auth_via_mfa"
security_result.detection_fields["factor"] = "OKTA_VERIFY_PUSH"
security_result.action = "BLOCK"

Match and Correlation

Match key: $userid (principal.user.userid)
Within: 10m

Outcome

Outcome variables add context to a detection. When the rule generates an alert, $risk_score is displayed with it.

Field	Expression
`risk_score`	`max(35)`
`target_user_agent`	`array_distinct($login.network.http.user_agent)`
`principal_ip`	`array_distinct($login.principal.ip)`
`principal_ip_country`	`array_distinct($login.principal.ip_geo_artifact.location.country_or_region)`
`principal_ip_state`	`array_distinct($login.principal.ip_geo_artifact.location.state)`
`principal_ip_city`	`array_distinct($login.principal.location.city)`
`principal_user_email_addresses`	`array_distinct ($login.principal.user.email_addresses)`
`security_result_summary`	`array_distinct($login.security_result.summary)`

Back to all YARA-L rules

YARA-L rules: 20

API access to mailboxes for top N messages via the Microsoft Graph

Rule Body

YARA-L Rule Structure

Condition

Events

$api NETWORK_HTTP

Match and Correlation

Outcome

AWS API Gateway Keys Accessed

MITRE ATT&CK Coverage

Telemetry Coverage

Rule Body

YARA-L Rule Structure

Condition

Events

$cloudtrail

Match and Correlation

Outcome

Okta User Rejected Multiple Push Notifications

MITRE ATT&CK Coverage

References

Telemetry Coverage

Rules Detecting the Same Action

Rule Body

YARA-L Rule Structure

Condition

Events

$login USER_UNCATEGORIZED

Match and Correlation

Outcome

`$api` `NETWORK_HTTP`

`$cloudtrail`

`$login` `USER_UNCATEGORIZED`