detection.wiki

Detection rules › YARA-L

YARA-L rules: 2f

RuleSeverity
GCP Multiple HMAC Keys Deletedhigh
GCP Security Command Center Service Disabledhigh
GeoIP User Login From Multiple States Or Countrieslow
GitHub Repository Branch Protection Rules Disabledmedium

GCP Multiple HMAC Keys Deleted

#
Severity
high
Type
Alert
Time window
1h
Match by
user_id
Author
Google Cloud Security
Source
github.com/chronicle/detection-rules

Detect when multiple HMAC authentication keys are deleted from GCP Storage settings.

MITRE ATT&CK Coverage

TacticTechniques
Impact

Telemetry Coverage

PlatformRecord / event type
GCPstorage.hmacKeys.delete: Delete HMAC key

Rule Body

// Copyright 2024 Google LLC. Licensed under Apache-2.0.

rule gcp_multiple_hmac_keys_deleted {

  meta:
    author = "Google Cloud Security"
    description = "Detect when multiple HMAC authentication keys are deleted from GCP Storage settings."
    rule_id = "mr_75b441f1-edde-4a33-bc12-06a92ccb9ba8"
    rule_name = "GCP Multiple HMAC Keys Deleted"
    mitre_attack_tactic = "Impact"
    mitre_attack_technique = "Account Access Removal"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1531/"
    mitre_attack_version = "v14.1"
    type = "Alert"
    data_source = "GCP Cloud Audit"
    platform = "GCP"
    severity = "High"
    priority = "High"

  events:
    $gcp.metadata.event_type = "RESOURCE_DELETION"
    $gcp.metadata.log_type = "GCP_CLOUDAUDIT"
    $gcp.metadata.product_event_type = "storage.hmacKeys.delete"
    $gcp.target.application = "storage.googleapis.com"
    $gcp.target.user.userid = $user_id

  match:
    $user_id over 1h

  outcome:
    $risk_score = max(75)
    $mitre_attack_tactic = "Impact"
    $mitre_attack_technique = "Account Access Removal"
    $mitre_attack_technique_id = "T1531"
    $event_count = count_distinct($gcp.metadata.id)
    $network_http_user_agent = array_distinct($gcp.network.http.user_agent)
    $principal_ip = array_distinct($gcp.principal.ip)
    $principal_ip_country = array_distinct($gcp.principal.ip_geo_artifact.location.country_or_region)
    $principal_ip_state = array_distinct($gcp.principal.ip_geo_artifact.location.state)
    $principal_user_id = array_distinct($gcp.principal.user.userid)
    $principal_user_display_name = array_distinct($gcp.principal.user.user_display_name)
    $target_resource_name = array_distinct($gcp.target.resource.name)

  condition:
    #gcp >= 2
}

YARA-L Rule Structure

Condition

Fires when $gcp occurs at least 2 times in the 1h window.

Events

$gcp RESOURCE_DELETION

  • metadata.log_type = "GCP_CLOUDAUDIT"
  • metadata.product_event_type = "storage.hmacKeys.delete"
  • target.application = "storage.googleapis.com"

Match and Correlation

Match key
$user_id (target.user.userid)
Within
1h

Outcome

Outcome variables add context to a detection. When the rule generates an alert, $risk_score is displayed with it.

FieldExpression
risk_scoremax(75)
event_countcount_distinct($gcp.metadata.id)
network_http_user_agentarray_distinct($gcp.network.http.user_agent)
principal_iparray_distinct($gcp.principal.ip)
principal_ip_countryarray_distinct($gcp.principal.ip_geo_artifact.location.country_or_region)
principal_ip_statearray_distinct($gcp.principal.ip_geo_artifact.location.state)
principal_user_idarray_distinct($gcp.principal.user.userid)
principal_user_display_namearray_distinct($gcp.principal.user.user_display_name)
target_resource_namearray_distinct($gcp.target.resource.name)

GCP Security Command Center Service Disabled

#
Severity
high
Type
Alert
Author
Google Cloud Security
Source
github.com/chronicle/detection-rules

Detect when GCP Security Command Center services are disabled.

MITRE ATT&CK Coverage

TacticTechniques
Defense Impairment

Telemetry Coverage

PlatformRecord / event type
GCPany: securitycenter.googleapis.com (any method)

Rule Body

// Copyright 2024 Google LLC. Licensed under Apache-2.0.

 rule gcp_security_command_center_service_disabled {

  meta:
    author = "Google Cloud Security"
    description = "Detect when GCP Security Command Center services are disabled."
    rule_id = "mr_0d065dd8-4489-434a-bb6e-066537318484"
    rule_name = "GCP Security Command Center Service Disabled"
    mitre_attack_tactic = "Defense Evasion"
    mitre_attack_technique = "Impair Defenses"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1562/"
    mitre_attack_version = "v14.1"
    type = "Alert"
    data_source = "GCP Cloud Audit"
    platform = "GCP"
    severity = "High"
    priority = "High"

  events:
    $gcp.metadata.event_type = "RESOURCE_WRITTEN"
    $gcp.metadata.log_type = "GCP_CLOUDAUDIT"
    $gcp.metadata.product_event_type = /google.cloud.securitycenter.settings.*.Settings.Update/
    $gcp.security_result.action = "ALLOW"
    $gcp.target.application = "securitycenter.googleapis.com"
    $gcp.target.resource.attribute.labels["service_enablement_state"] = "DISABLED"

  outcome:
    $risk_score = max(75)
    $mitre_attack_tactic = "Defense Evasion"
    $mitre_attack_technique = "Impair Defenses"
    $mitre_attack_technique_id = "T1562"
    $event_count = count_distinct($gcp.metadata.id)
    $network_http_user_agent = $gcp.network.http.user_agent
    $principal_ip = array_distinct($gcp.principal.ip)
    $principal_ip_country = array_distinct($gcp.principal.ip_geo_artifact.location.country_or_region)
    $principal_ip_state = array_distinct($gcp.principal.ip_geo_artifact.location.state)
    $principal_user_id = $gcp.principal.user.userid
    $principal_user_display_name = $gcp.principal.user.user_display_name
    $target_resource_name = $gcp.target.resource.name

  condition:
    $gcp
}

YARA-L Rule Structure

Condition

Fires when at least one $gcp event.

Events

$gcp RESOURCE_WRITTEN

  • metadata.log_type = "GCP_CLOUDAUDIT"
  • metadata.product_event_type matches "google.cloud.securitycenter.settings.*.Settings.Update"
  • security_result.action = "ALLOW"
  • target.application = "securitycenter.googleapis.com"
  • target.resource.attribute.labels["service_enablement_state"] = "DISABLED"

Outcome

Outcome variables add context to a detection. When the rule generates an alert, $risk_score is displayed with it.

FieldExpression
risk_scoremax(75)
event_countcount_distinct($gcp.metadata.id)
network_http_user_agent$gcp.network.http.user_agent
principal_iparray_distinct($gcp.principal.ip)
principal_ip_countryarray_distinct($gcp.principal.ip_geo_artifact.location.country_or_region)
principal_ip_statearray_distinct($gcp.principal.ip_geo_artifact.location.state)
principal_user_id$gcp.principal.user.userid
principal_user_display_name$gcp.principal.user.user_display_name
target_resource_name$gcp.target.resource.name

GeoIP User Login From Multiple States Or Countries

#
Severity
low
Type
alert
Time window
1h
Match by
product, user
Author
Google Cloud Security
Source
github.com/chronicle/detection-rules

Detect multiple user logins from multiple states or countries using Chronicle GeoIP enrichment.

Telemetry Coverage

ProviderRecord / event type
Security-AuditingEvent ID 4624: An account was successfully logged on.
Security-AuditingEvent ID 4625: An account failed to log on.
Security-AuditingEvent ID 4648: A logon was attempted using explicit credentials.
Entra-AADManagedIdentitySignInLogsany: Sign-in record (AADManagedIdentitySignInLogs, any result)
Entra-AADNonInteractiveUserSignInLogsany: Sign-in record (AADNonInteractiveUserSignInLogs, any result)
Entra-AADServicePrincipalSignInLogsany: Sign-in record (AADServicePrincipalSignInLogs, any result)
Entra IDSigninLogs sign-in event: Sign-in record (SigninLogs, any result)

Rule Body

// Copyright 2023 Google LLC. Licensed under Apache-2.0.

rule geoip_user_login_from_multiple_states_or_countries {

  meta:
    author = "Google Cloud Security"
    description = "Detect multiple user logins from multiple states or countries using Chronicle GeoIP enrichment."
    rule_id = "mr_3fa832e4-1ac0-42cd-9f0a-357d6b8fb12f"
    rule_name = "GeoIP User Login From Multiple States Or Countries"
    type = "alert"
    data_source = "microsoft ad, azure ad, okta, aws cloudtrail, google scc"
    tags = "geoip enrichment"
    severity = "Low"
    priority = "Low"

  events:
    $login.metadata.event_type = "USER_LOGIN"
    $login.security_result.action = "ALLOW"
    $login.principal.ip_geo_artifact.location.country_or_region != ""

    $login.principal.ip_geo_artifact.location.country_or_region = $country
    $login.principal.ip_geo_artifact.location.state  = $state
    $login.metadata.product_name = $product
    $login.target.user.userid = $user

  match:
    $user, $product over 1h

  outcome:
    $risk_score = 35
    $event_count = count_distinct($login.metadata.id)
    $state_login_threshold = 2
    $dc_state = count_distinct($login.principal.ip_geo_artifact.location.state)
    $array_state = array_distinct($login.principal.ip_geo_artifact.location.state)
    $dc_country_or_region = count_distinct($login.principal.ip_geo_artifact.location.country_or_region)
    $array_country_or_region = array_distinct($login.principal.ip_geo_artifact.location.country_or_region)
    $array_asn = array_distinct($login.principal.ip_geo_artifact.network.asn)
    $array_carrier_name = array_distinct($login.principal.ip_geo_artifact.network.carrier_name)
    //added to populate alert graph with additional context
    $principal_hostname = array_distinct($login.principal.hostname)
    $principal_ip = array_distinct($login.principal.ip)
    $target_hostname = array_distinct($login.target.hostname)
    $target_ip = array_distinct($login.target.ip)
    $principal_user_userid = array_distinct($login.principal.user.userid)
    $target_user_userid = array_distinct($login.target.user.userid)
    $principal_resource_name = array_distinct($login.principal.resource.name)
    $target_resource_name = array_distinct($login.target.resource.name)
    $target_url = array_distinct($login.target.url)

  condition:
    #country >= 1 and #state >= 2
}

YARA-L Rule Structure

Condition

Fires when $country occurs at least 1 times in the 1h window and $state occurs at least 2 times in the 1h window.

Events

$login USER_LOGIN (4624, 4625, 4648)

  • security_result.action = "ALLOW"
  • principal.ip_geo_artifact.location.country_or_region is not null

Match and Correlation

Match key
$product (metadata.product_name), $user (target.user.userid)
Within
1h

Outcome

Outcome variables add context to a detection. When the rule generates an alert, $risk_score is displayed with it.

FieldExpression
risk_score35
event_countcount_distinct($login.metadata.id)
state_login_threshold2
dc_statecount_distinct($login.principal.ip_geo_artifact.location.state)
array_statearray_distinct($login.principal.ip_geo_artifact.location.state)
dc_country_or_regioncount_distinct($login.principal.ip_geo_artifact.location.country_or_region)
array_country_or_regionarray_distinct($login.principal.ip_geo_artifact.location.country_or_region)
array_asnarray_distinct($login.principal.ip_geo_artifact.network.asn)
array_carrier_namearray_distinct($login.principal.ip_geo_artifact.network.carrier_name)
principal_hostnamearray_distinct($login.principal.hostname)
principal_iparray_distinct($login.principal.ip)
target_hostnamearray_distinct($login.target.hostname)
target_iparray_distinct($login.target.ip)
principal_user_useridarray_distinct($login.principal.user.userid)
target_user_useridarray_distinct($login.target.user.userid)
principal_resource_namearray_distinct($login.principal.resource.name)
target_resource_namearray_distinct($login.target.resource.name)
target_urlarray_distinct($login.target.url)

GitHub Repository Branch Protection Rules Disabled

#
Severity
medium
Type
alert
Time window
30m
Match by
github_repo_name, user_id
Author
Google Cloud Security
Source
github.com/chronicle/detection-rules

Detects when branch protection rules are disabled for a GitHub repository.

MITRE ATT&CK Coverage

TacticTechniques
Defense Impairment

References

Telemetry Coverage

PlatformRecord / event type
GitHubAudit log action repository_branch_protection_evaluation.disable: Branch protection disabled for repository

Rule Body

// Copyright 2024 Google LLC. Licensed under Apache-2.0.

rule github_repository_branch_protection_rules_disabled {

  meta:
    author = "Google Cloud Security"
    description = "Detects when branch protection rules are disabled for a GitHub repository."
    rule_id = "mr_6cf2c5d1-3e94-428f-b29c-84d09c209424"
    rule_name = "GitHub Repository Branch Protection Rules Disabled"
    assumption = "Your GitHub enterprise audit log settings are configured to log the source IP address for events. Reference: https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization"
    type = "alert"
    severity = "Medium"
    priority = "Medium"
    platform = "GitHub"
    data_source = "github"
    mitre_attack_tactic = "Defense Evasion"
    mitre_attack_technique = "Impair Defenses: Disable or Modify Tools"
    mitre_attack_url = "https://attack.mitre.org/versions/v14/techniques/T1562/001/"
    mitre_attack_version = "v14"
    reference = "https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise"

  events:
    $github.metadata.vendor_name = "GITHUB" nocase
    $github.metadata.product_name = "GITHUB"
    $github.metadata.product_event_type = "repository_branch_protection_evaluation.disable"
    $github.principal.user.userid = $user_id
    $github.target.resource.name = $github_repo_name

  match:
    $user_id, $github_repo_name over 30m

  outcome:
    $risk_score = max(65)
    $mitre_attack_tactic = "Defense Evasion"
    $mitre_attack_technique = "Impair Defenses: Disable or Modify Tools"
    $mitre_attack_technique_id = "T1562.001"
    $event_count = count_distinct($github.metadata.id)
    $principal_ip = array_distinct($github.principal.ip)
    $principal_user_userid = array_distinct($github.principal.user.userid)
    $principal_ip_country = array_distinct($github.principal.ip_geo_artifact.location.country_or_region)
    $principal_ip_state = array_distinct($github.principal.ip_geo_artifact.location.state)
    $principal_ip_city = array_distinct($github.principal.location.city)
    $security_result_summary = array_distinct($github.security_result.summary)

  condition:
    $github
}

YARA-L Rule Structure

Condition

Fires when at least one $github event in the 30m window.

Events

$github

  • metadata.product_event_type = "repository_branch_protection_evaluation.disable"

Match and Correlation

Match key
$github_repo_name (target.resource.name), $user_id (principal.user.userid)
Within
30m

Outcome

Outcome variables add context to a detection. When the rule generates an alert, $risk_score is displayed with it.

FieldExpression
risk_scoremax(65)
event_countcount_distinct($github.metadata.id)
principal_iparray_distinct($github.principal.ip)
principal_user_useridarray_distinct($github.principal.user.userid)
principal_ip_countryarray_distinct($github.principal.ip_geo_artifact.location.country_or_region)
principal_ip_statearray_distinct($github.principal.ip_geo_artifact.location.state)
principal_ip_cityarray_distinct($github.principal.location.city)
security_result_summaryarray_distinct($github.security_result.summary)

Back to all YARA-L rules