YARA-L rules: 27

// Copyright 2023 Google LLC. Licensed under Apache-2.0.

rule aws_successful_api_from_tor_exit_node {

  meta:
    author = "Google Cloud Security"
    description = "Detects successful API executions from a Tor exit node."
    rule_id = "mr_17232c2a-188e-4d6e-85b6-836cdc779655"
    rule_name = "AWS Successful API From Tor Exit Node"
    mitre_attack_tactic = "Execution"
    mitre_attack_technique = "User Execution"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1204/"
    mitre_attack_version = "v13.1"
    type = "Alert"
    data_source = "AWS CloudTrail"
    platform = "AWS"
    severity = "High"
    priority = "High"

  events:
    $api.metadata.vendor_name = "AMAZON"
    $api.metadata.product_name = "AWS CloudTrail"
    $api.security_result.action = "ALLOW"
    $api.principal.ip = $ip

    // Tor IP listing provided by GCTI Feed
    $gcti_feed.graph.entity.artifact.ip = $ip
    $gcti_feed.graph.metadata.entity_type = "IP_ADDRESS"
    $gcti_feed.graph.metadata.threat.threat_feed_name = "Tor Exit Nodes"
    $gcti_feed.graph.metadata.product_name = "GCTI Feed"
    $gcti_feed.graph.metadata.source_type = "GLOBAL_CONTEXT"

  match:
    $ip over 5m

  outcome:
    $risk_score = max(
        //Baseline
        35 +
        // Unauthorized geographies
        if($api.principal.ip_geo_artifact.location.country_or_region = "Cuba", 40) +
        if($api.principal.ip_geo_artifact.location.country_or_region = "Iran", 40) +
        if($api.principal.ip_geo_artifact.location.country_or_region = "North Korea" , 40) +
        if($api.principal.ip_geo_artifact.location.country_or_region = "Russia", 40) +
        if($api.principal.ip_geo_artifact.location.country_or_region = "Syria", 40)
    )
    $mitre_attack_tactic = "Execution"
    $mitre_attack_technique = "User Execution"
    $mitre_attack_technique_id = "T1204"
    $event_count = count_distinct($api.metadata.id)
    $network_http_user_agent = array_distinct($api.network.http.user_agent)
    $principal_ip = array_distinct($api.principal.ip)
    $principal_ip_country = array_distinct($api.principal.ip_geo_artifact.location.country_or_region)
    $principal_ip_state = array_distinct($api.principal.ip_geo_artifact.location.state)
    $principal_user_display_name = array_distinct($api.principal.user.user_display_name)
    $dc_principal_user_display_name = count_distinct($api.principal.user.user_display_name)
    $is_mfa_used = array_distinct($api.extensions.auth.auth_details)
    $target_resource_name = array_distinct($api.target.resource.name)
    $target_resource_product_object_id = array_distinct($api.target.resource.product_object_id)

  condition:
    $api and $gcti_feed
}

// Copyright 2023 Google LLC. Licensed under Apache-2.0.

rule chrome_browser_safe_browsing_user_bypass {

  meta:
    author = "Google Cloud Security"
    description = "Detects and alerts on users bypassing Chrome Safe Browsing warnings and accessing potentially dangerous content or downloads"
    rule_id = "mr_73e2a3d4-13ba-47ef-b250-a2bdcd98dc48"
    rule_name = "Chrome Browser Safe Browsing User Bypass"
    mitre_attack_tactic = "Initial Access"
    mitre_attack_technique = "Phishing: Spearphishing Link"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1566/002/"
    mitre_attack_version = "v14.1"
    type = "alert"
    tags = "chrome enterprise"
    data_source = "Chrome Management"
    severity = "Low"
    priority = "Low"

  events:
    $process.metadata.product_name = "Chrome Management"
    (
        $process.metadata.product_event_type = "badNavigationEvent" or
        $process.metadata.product_event_type = "dangerousDownloadEvent" or
        $process.metadata.product_event_type = "contentTransferEvent" or
        $process.metadata.product_event_type = "unscannedFileEvent"
    )
    $process.security_result.action_details = "EVENT_RESULT_BYPASSED"
    $process.security_result.category_details = $category
    strings.coalesce($process.principal.user.email_addresses, $process.principal.hostname ) = $user

  match:
    $user over 5m

  outcome:
    $risk_score = max(
      if ($category = "", 10) +
      if ($category = "THREAT_TYPE_UNSPECIFIED", 20) +
      if ($category = "SSL_ERROR", 30) +
      if ($category = "UNWANTED_SOFTWARE", 50) +
      if ($category = "DANGEROUS", 60) +
      if ($category = "SOCIAL_ENGINEERING", 70) +
      if ($category = "DANGEROUS_HOST", 80) +
      if ($category = "MALWARE", 90)
    )
    $instances = count_distinct($user)
    $suspicious_url = array_distinct($process.target.url)
    $suspicious_file_sha256 = array_distinct($process.target.file.sha256)
    $principal_user_userid = array_distinct($user)

condition:
  // To reduce the number of alerts to just higher risk events, uncomment the value in the line below
  $process // and $risk_score >= 50
}

// Copyright 2025 Google LLC. Licensed under Apache-2.0.

rule entra_id_application_deletion {

  meta:
    author = "Google Cloud Security"
    description = "Delete Entra ID application. This is a soft delete, can still be recovered."
    rule_id = "mr_597d57bf-1bae-4179-a068-7985c2d28340"
    rule_name = "Entra ID Application Deletion"
    type = "alert"
    platform = "azure"
    data_source = "azure ad audit"
    severity = "Medium"
    priority = "Medium"

  events:
    $app.metadata.event_type = "SETTING_DELETION"
    $app.metadata.product_event_type = "Delete application"
    $app.metadata.product_name = "Azure AD Directory Audit"
    $app.metadata.vendor_name = "Microsoft"
    $app.security_result.action = "ALLOW"
    $app.principal.user.userid = $user

  match:
    $user over 5m

  outcome:
    $risk_score = 35
    $event_count = count_distinct($app.metadata.id)
    $principal_ip = array_distinct($app.principal.ip)
    $principal_email = array_distinct($app.principal.user.email_addresses)
    $principal_county_region = array_distinct($app.principal.ip_geo_artifact.location.country_or_region)
    $user_agent = array_distinct($app.network.http.user_agent)
    $network_session = array_distinct($app.network.session_id)
    $target_application = array_distinct($app.target.resource.name)
    $target_application_id = array_distinct($app.target.resource.product_object_id)

  condition:
    $app
}

// Copyright 2024 Google LLC. Licensed under Apache-2.0.

rule github_enterprise_or_organization_recovery_codes_activity {

  meta:
    author = "Google Cloud Security"
    description = "Detects when the Single Sign-On (SSO) recovery codes are accessed for a GitHub enterprise or organization. An adversary may attempt to access or steal SSO recovery codes in order to maintain access to their target's GitHub environment."
    rule_id = "mr_2bb0bc58-b799-4b8f-96c3-f1cfd7cea201"
    rule_name = "GitHub Enterprise Or Organization Recovery Codes Activity"
    assumption = "Your GitHub enterprise audit log settings are configured to log the source IP address for events. Reference: https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization"
    type = "alert"
    severity = "Medium"
    priority = "Medium"
    platform = "GitHub"
    data_source = "github"
    reference = "https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise"

  events:
    $github.metadata.vendor_name = "GITHUB" nocase
    $github.metadata.product_name = "GITHUB"
    (
        // GitHub enterprise events
        $github.metadata.product_event_type = "business.recovery_codes_downloaded" or
        $github.metadata.product_event_type = "business.recovery_codes_generated" or
        $github.metadata.product_event_type = "business.recovery_codes_printed" or
        $github.metadata.product_event_type = "business.recovery_codes_viewed" or
        // GitHub organization events
        $github.metadata.product_event_type = "org.recovery_codes_downloaded" or
        $github.metadata.product_event_type = "org.recovery_codes_generated" or
        $github.metadata.product_event_type = "org.recovery_codes_printed" or
        $github.metadata.product_event_type = "org.recovery_codes_viewed"
    )
    $github.principal.user.userid = $user_id

  match:
    $user_id over 30m

  outcome:
    $risk_score = max(65)
    $event_count = count_distinct($github.metadata.id)
    $principal_ip = array_distinct($github.principal.ip)
    $principal_user_userid = array_distinct($github.principal.user.userid)
    $principal_ip_country = array_distinct($github.principal.ip_geo_artifact.location.country_or_region)
    $principal_ip_state = array_distinct($github.principal.ip_geo_artifact.location.state)
    $principal_ip_city = array_distinct($github.principal.location.city)
    $security_result_summary = array_distinct($github.security_result.summary)

  condition:
    $github
}

// Copyright 2025 Google LLC. Licensed under Apache-2.0.

rule o365_group_modification_remove_member_success {

  meta:
    author = "Google Cloud Security"
    description = "Detects when a user is removed from a group in Office 365."
    rule_id = "mr_fb6fe12b-737b-4d6c-a53f-3832343bc548"
    rule_name = "Hunt for Office 365 group modification remove member success"
    type = "hunt"
    platform = "azure"
    data_source = "o365"
    severity = "Low"
    priority = "Low"

  events:
    $group.metadata.event_type = "GROUP_MODIFICATION"
    $group.metadata.product_event_type = "Remove member from group."
    $group.metadata.product_name = "Office 365"
    $group.metadata.vendor_name = "Microsoft"
    $group.security_result.action = "ALLOW"
    $group.principal.user.userid = $user

  match:
    $user over 5m

  outcome:
    $risk_score = 35
    $event_count = count_distinct($group.metadata.id)
    $user_agent = array_distinct($group.network.http.user_agent)
    $security_summary = array_distinct($group.security_result.summary)
    $target_application = array_distinct($group.target.application)
    //Used in match section so excluding here
    //$principal_user_userid = array_distinct($app.principal.user.userid)
    $group_name = array_distinct($group.target.group.group_display_name)
    $group_guid = array_distinct($group.target.group.product_object_id)
    $user_removed = array_distinct($group.target.user.userid)
    $user_count = count_distinct($group.target.user.userid)

  condition:
    $group
}

// Copyright 2026 Google LLC. Licensed under Apache-2.0.

rule sap_security_audit_log_configuration_change {

  meta:
    author = "Google Cloud Security"
    description = "Detects changes to the SAP Security Audit Log configuration. Monitoring message codes AUE, AUF, AUI, AUJ, FU0, and E05."
    severity = "High"
    tactic = "TA0005"
    technique = "T1562"

  events:
    $e.metadata.log_type = "SAP_SECURITY_AUDIT"

    $e.additional.fields["msg_1"] = /^AUE$|^AUF$|^AUI$|^AUJ$|^FU0$|^E05$/

    $user = $e.principal.user.userid
    $sid = $e.target.application

    not $user in %sap_admin_users.user

  match:
    $user, $sid over 1h

  outcome:
    $risk_score = 75
    $target_sid = array_distinct($sid)
    $description = array_distinct($e.metadata.description)
    $terminal = array_distinct($e.principal.hostname)
    $message_ids = array_distinct($e.additional.fields["msg_1"])
    $t_code = array_distinct($e.security_result.detection_fields["slgtc_1"])
    $TXSUBCLSID = array_distinct($e.security_result.summary)
    $system = array_distinct($e.target.application)
    $instance = array_distinct($e.target.resource.name)


  condition:
    $e
}

// Copyright 2023 Google LLC. Licensed under Apache-2.0.

rule windows_event_log_cleared {

  meta:
    author = "Google Cloud Security"
    description = "Detects the clearing of event logs within the Windows Event Viewer. "
    rule_id = "mr_067f3ee9-9bc6-400d-9ba5-bebe7253482f"
    rule_name = "Windows Event Log Cleared"
    type = "alert"
    data_source = "microsoft sysmon, microsoft windows events"
    platform = "Windows"
    tactic = "TA0005"
    technique = "T1070.001"
    severity = "Medium"
    priority = "Medium"

  events:
    (
        $process.metadata.event_type = "PROCESS_LAUNCH" and
        // currently the command line is focused on the three primary log sets, could expand this further if desired
        re.regex($process.target.process.command_line, `wevtutil.*cl.*(system|application|security)`) nocase
    )
    or
    (
        $process.metadata.event_type = "SYSTEM_AUDIT_LOG_WIPE" and
        $process.metadata.vendor_name = "Microsoft"
    )
    or
    (
        $process.metadata.event_type = "STATUS_UPDATE" and
        $process.metadata.product_name = "PowerShell" and
        $process.metadata.vendor_name = "Microsoft" and
        (
            re.regex($process.security_result.description, `Remove-EventLog`) nocase or
            re.regex($process.security_result.description, `Clear-EventLog`) nocase
        )
    )
    $process.principal.hostname = $hostname

  match:
    $hostname over 5m

  outcome:
    $risk_score = 65
    $event_count = count_distinct($process.metadata.id)
    $process_description = array_distinct($process.metadata.description)
    // added to populate alert graph with additional context
    // Commented out principal.hostname because it is already represented in graph as match variable. If match changes, can uncomment to add to results
    //$principal_hostname = array_distinct($process.principal.hostname)
    $principal_process_pid = array_distinct($process.principal.process.pid)
    $principal_process_command_line = array_distinct($process.principal.process.command_line)
    $principal_process_file_sha256 = array_distinct($process.principal.process.file.sha256)
    $principal_process_file_full_path = array_distinct($process.principal.process.file.full_path)
    $principal_process_product_specific_process_id = array_distinct($process.principal.process.product_specific_process_id)
    $principal_process_parent_process_product_specific_process_id = array_distinct($process.principal.process.parent_process.product_specific_process_id)
    $target_process_pid = array_distinct($process.target.process.pid)
    $target_process_command_line = array_distinct($process.target.process.command_line)
    $target_process_file_sha256 = array_distinct($process.target.process.file.sha256)
    $target_process_file_full_path = array_distinct($process.target.process.file.full_path)
    $target_process_product_specific_process_id = array_distinct($process.target.process.product_specific_process_id)
    $principal_user_userid = array_distinct($process.principal.user.userid)

  condition:
    $process
}