YARA-L rules: 29

// Copyright 2023 Google LLC. Licensed under Apache-2.0.

rule aws_guardduty_denial_of_service_activity_detected {

  meta:
    author = "Google Cloud Security"
    description = "Amazon GuardDuty detects a Denial of Service (DoS) activity in an Amazon EC2 instance."
    rule_id = "mr_63e3f20f-95f5-4caa-b471-ec53d5de2d28"
    rule_name = "AWS GuardDuty Denial Of Service Activity Detected"
    mitre_attack_tactic = "Impact"
    mitre_attack_technique = "Network Denial of Service"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1498/"
    mitre_attack_version = "v13.1"
    type = "Alert"
    data_source = "AWS GuardDuty"
    platform = "AWS"
    severity = "High"
    priority = "High"

  events:
    $guardduty.metadata.vendor_name = "AMAZON"
    $guardduty.metadata.product_name = "AWS GuardDuty"
    $guardduty.metadata.product_event_type = /DenialOfService/
    //Filter out sample findings
    $guardduty.security_result.about.labels["Sample"] != "true"

  outcome:
    $risk_score = max(35)
    $mitre_attack_tactic = "Command and Control"
    $mitre_attack_technique = "Network Denial of Service"
    $mitre_attack_technique_id = "T1498"
    $event_count = count_distinct($guardduty.metadata.id)
    $principal_ip = array_distinct($guardduty.principal.ip)
    $principal_ip_country = array_distinct($guardduty.principal.ip_geo_artifact.location.country_or_region)
    $principal_ip_state = array_distinct($guardduty.principal.ip_geo_artifact.location.state)
    $principal_user_display_name = $guardduty.principal.user.user_display_name
    $aws_region = $guardduty.target.location.name
    $target_resource_name = $guardduty.target.resource.name
    $target_resource_product_object_id = $guardduty.target.resource.product_object_id
    $security_result_summary = array_distinct($guardduty.security_result.summary)
    $security_result_description = array_distinct($guardduty.security_result.description)
    $security_result_severity = array_distinct($guardduty.security_result.severity)
    $security_result_severity_details = array_distinct($guardduty.security_result.severity_details)
    $metadata_product_event_type = array_distinct($guardduty.metadata.product_event_type)

  condition:
    $guardduty
}

// Copyright 2024 Google LLC. Licensed under Apache-2.0.

rule github_oauth_application_access_restrictions_disabled {

  meta:
    author = "Google Cloud Security"
    description = "Detects when third-party application access restrictions are disabled for a GitHub organization."
    rule_id = "mr_9faa8dae-8e9f-4c10-9d11-e45eaebe1070"
    rule_name = "GitHub OAuth Application Access Restrictions Disabled"
    assumption = "Your GitHub enterprise audit log settings are configured to log the source IP address for events. Reference: https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization"
    type = "alert"
    severity = "Low"
    priority = "Low"
    platform = "GitHub"
    data_source = "github"
    reference = "https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise"

  events:
    $github.metadata.vendor_name = "GITHUB" nocase
    $github.metadata.product_name = "GITHUB"
    $github.metadata.product_event_type = "org.disable_oauth_app_restrictions"

  outcome:
    $risk_score = max(35)
    $principal_ip = array_distinct($github.principal.ip)
    $principal_user_userid = array_distinct($github.principal.user.userid)
    $principal_ip_country = array_distinct($github.principal.ip_geo_artifact.location.country_or_region)
    $principal_ip_state = array_distinct($github.principal.ip_geo_artifact.location.state)
    $principal_ip_city = array_distinct($github.principal.location.city)
    $security_result_summary = array_distinct($github.security_result.summary)

  condition:
    $github
}

// Copyright 2023 Google LLC. Licensed under Apache-2.0.

rule google_workspace_multiple_files_deleted_from_google_drive {

  meta:
    author = "Google Cloud Security"
    description = "Identifies when a user deletes multiple files from Google Drive, which may indicate data destruction."
    rule_id = "mr_efa7bd41-506c-49b9-85a0-d799f0345ecf"
    rule_name = "Google Workspace Multiple Files Deleted From Google Drive"
    mitre_attack_tactic = "Impact"
    mitre_attack_technique = "Data Destruction"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1485/"
    mitre_attack_version = "v13.1"
    type = "Alert"
    data_source = "Workspace Activity"
    severity = "High"
    priority = "High"

  events:
    $ws.metadata.vendor_name = "Google Workspace"
    $ws.metadata.product_name = "drive"
    (
        $ws.metadata.product_event_type = "trash" or
        $ws.metadata.product_event_type = "delete"
    )
    $ws.principal.user.userid = $user_id

  match:
    $user_id over 1h

  outcome:
    $risk_score = max(75)
    $mitre_attack_tactic = "Impact"
    $mitre_attack_technique = "Data Destruction"
    $mitre_attack_technique_id = "T1567"
    $event_count = count_distinct($ws.metadata.id)
    $product_event_type = array_distinct($ws.metadata.product_event_type)
    $userid = array_distinct($ws.principal.user.userid)
    $doc_type = array_distinct($ws.src.resource.attribute.labels["doc_type"])
    $owner = array_distinct($ws.target.resource.attribute.labels["owner"])
    $doc_name = array_distinct($ws.target.resource.name)
    $doc_id = array_distinct($ws.target.resource.product_object_id)
    $count_docs = count_distinct($ws.target.resource.product_object_id)

  condition:
    // Customize the value of $count_docs to set the alerting threshold for your environment
    $ws and $count_docs > 10
}

// Copyright 2025 Google LLC. Licensed under Apache-2.0.

rule entra_id_expired_refresh_token_use {

  meta:
    author = "Google Cloud Security"
    description = "Identify Entra ID OAuth refresh tokens are attempted to be used but have expired. This could be because the token hasn't been used for 90 days or it has been revoked"
    rule_id = "mr_88826f0a-e964-4d11-8765-8732ae83b1f1"
    rule_name = "Hunt for Expired Tokens Attempting to sign-in to Entra ID"
    tactic = "TA0008"
    technique = "T1550.001"
    type = "Hunt"
    data_source = "Azure Activity"
    platform = "Azure"
    severity = "Low"
    priority = "Low"

  events:
    $login.metadata.event_type = "USER_LOGIN"
    $login.metadata.product_name = "Azure Activity"
    $login.metadata.product_event_type = "Sign-in activity"
    $login.metadata.vendor_name = "Microsoft"
    $login.security_result.action = "BLOCK"
    //$login.metadata.description = "Fresh auth token is needed. Have the user re-sign using fresh credentials."
    $login.security_result.action_details = "50173"
    $login.principal.user.userid = $userid

  match:
    $userid over 15m

  outcome:
    $risk_score = 15
    $event_count = count_distinct($login.metadata.id)
    $principal_ip = array_distinct($login.principal.ip)
    $user_agent = array_distinct($login.network.http.user_agent)
    $target_application = array_distinct($login.target.application)

  condition:
    $login
}

// Copyright 2025 Google LLC. Licensed under Apache-2.0.

rule rdp_sensitive_settings_changed {

  meta:
    author = "Samir Bousseaden, David ANDRE, Roberto Rodriguez @Cyb3rWard0g, Nasreddine Bencherchali"
    description = "Detects tampering of RDP Terminal Service/Server sensitive settings. Such as allowing unauthorized users access to a system via the 'fAllowUnsolicited' or enabling RDP via 'fDenyTSConnections'...etc"
    reference = "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_terminal_server_tampering.yml"
    license = "https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md"
    rule_name = "RDP Sensitive Settings Changed"
    rule_id = "mr_4c75375c-7ebf-4f9f-9b30-7aaab63dba8d"
    sigma_uuid = "3f6b7b62-61aa-45db-96bd-9c31b36b653c"
    sigma_status = "test"
    tactic = "TA0005"
    //tactic = "TA0003"
    technique = "T1112"
    type = "Detection"
    data_source = "Windows Registry"
    platform = "Windows"
    severity = "High"
    priority = "High"
    false_positives = "Some of the keys mentioned here could be modified by an administrator while setting group policy"

  events:
    $reg.metadata.event_type = "REGISTRY_MODIFICATION"
    (
        (
            (
                strings.contains(strings.to_lower($reg.target.registry.registry_key), "\\control\\terminal server\\") or
                strings.contains(strings.to_lower($reg.target.registry.registry_key), "\\windows nt\\terminal services\\")
            ) and
            re.regex($reg.target.registry.registry_key, `\\Shadow$`) nocase and
            (
                $reg.target.registry.registry_value_data = "DWORD (0x00000001)" nocase or
                $reg.target.registry.registry_value_data = "DWORD (0x00000002)" nocase or
                $reg.target.registry.registry_value_data = "DWORD (0x00000003)" nocase or
                $reg.target.registry.registry_value_data = "DWORD (0x00000004)" nocase
            )
        )
        or
        (
            (
                strings.contains(strings.to_lower($reg.target.registry.registry_key), "\\control\\terminal server\\") or
                strings.contains(strings.to_lower($reg.target.registry.registry_key), "\\windows nt\\terminal services\\")
            ) and
            (
                re.regex($reg.target.registry.registry_key, `\\DisableRemoteDesktopAntiAlias$`) nocase or
                re.regex($reg.target.registry.registry_key, `\\DisableSecuritySettings$`) nocase or
                re.regex($reg.target.registry.registry_key, `\\fAllowUnsolicited$`) nocase or
                re.regex($reg.target.registry.registry_key, `\\fAllowUnsolicitedFullControl$`) nocase
            ) and
            $reg.target.registry.registry_value_data = "DWORD (0x00000001)" nocase
        )
        or
        (
            strings.contains(strings.to_lower($reg.target.registry.registry_key), "\\control\\terminal server\\initialprogram") or
            strings.contains(strings.to_lower($reg.target.registry.registry_key), "\\control\\terminal server\\winstations\\rdp-tcp\\initialprogram") or
            strings.contains(strings.to_lower($reg.target.registry.registry_key), "\\services\\termservice\\parameters\\servicedll") or
            strings.contains(strings.to_lower($reg.target.registry.registry_key), "\\windows nt\\terminal services\\initialprogram")
        )
    )
    $reg.principal.hostname = $hostname

  match:
    $hostname over 5m

  outcome:
    //example usage of specifying test user and hostname to adjust risk score
    $risk_score = max(if($reg.principal.user.userid = "user" and $reg.principal.hostname = "hostname", 0, 15))
    $principal_hostname = array_distinct($reg.principal.hostname)
    $principal_process_pid = array_distinct($reg.principal.process.pid)
    $principal_process_file_full_path = array_distinct($reg.principal.process.file.full_path)
    $principal_process_product_specific_process_id = array_distinct($reg.principal.process.product_specific_process_id)
    $principal_user_userid = array_distinct($reg.principal.user.userid)
    $target_registry_key = array_distinct($reg.target.registry.registry_key)
    $target_registry_value_data = array_distinct($reg.target.registry.registry_value_data)
    $log_type = array_distinct(strings.concat($reg.metadata.log_type,"/",$reg.metadata.product_event_type))

  condition:
    $reg
}