YARA-L rules: 2k

// Copyright 2023 Google LLC. Licensed under Apache-2.0.

rule aws_guardduty_tor_network_activity_detected {

  meta:
    author = "Google Cloud Security"
    description = "Amazon GuardDuty detects Tor Network activity in an AWS account."
    rule_id = "mr_abbc8f85-d4a3-4579-b444-19e6944f49d1"
    rule_name = "AWS GuardDuty Tor Network Activity Detected"
    mitre_attack_tactic = "Command and Control"
    mitre_attack_technique = "Proxy: Multi-hop Proxy"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1090/003/"
    mitre_attack_version = "v13.1"
    type = "Alert"
    data_source = "AWS GuardDuty"
    platform = "AWS"
    severity = "High"
    priority = "High"

  events:
    $guardduty.metadata.vendor_name = "AMAZON"
    $guardduty.metadata.product_name = "AWS GuardDuty"
    $guardduty.metadata.product_event_type = /TorIPCaller|TorRelay|TorClient/
    //Filter out sample findings
    $guardduty.security_result.about.labels["Sample"] != "true"

  outcome:
    $risk_score = max(35)
    $mitre_attack_tactic = "Command and Control"
    $mitre_attack_technique = "Proxy: Multi-hop Proxy"
    $mitre_attack_technique_id = "T1090.003"
    $event_count = count_distinct($guardduty.metadata.id)
    $principal_ip = array_distinct($guardduty.principal.ip)
    $principal_ip_country = array_distinct($guardduty.principal.ip_geo_artifact.location.country_or_region)
    $principal_ip_state = array_distinct($guardduty.principal.ip_geo_artifact.location.state)
    $principal_user_display_name = $guardduty.principal.user.user_display_name
    $aws_region = $guardduty.target.location.name
    $target_resource_name = $guardduty.target.resource.name
    $target_resource_product_object_id = $guardduty.target.resource.product_object_id
    $security_result_summary = array_distinct($guardduty.security_result.summary)
    $security_result_description = array_distinct($guardduty.security_result.description)
    $security_result_severity = array_distinct($guardduty.security_result.severity)
    $security_result_severity_details = array_distinct($guardduty.security_result.severity_details)
    $metadata_product_event_type = array_distinct($guardduty.metadata.product_event_type)

  condition:
    $guardduty
}

// Copyright 2025 Google LLC. Licensed under Apache-2.0.

 rule entra_id_add_user_to_admin_role {

  meta:
    author = "Google Cloud Security"
    description = "Adding users to administrative roles is needed but due to sensitivity of these roles, validation should occur when this occurs"
    rule_id = "mr_069a282b-a605-4572-921e-f466b93d0cf3"
    rule_name = "Entra ID Add User To Admin Role"
    tactic = "TA0003"
    technique = "T1098.003"
    assumption = "The list entra_id_watchlist_roles is populated with GUIDs, ie 62e90394-69f5-4237-9190-012177145e10"
    reference = "https://learn.microsoft.com/en-us/azure/active-directory/roles/permissions-reference"
    type = "alert"
    platform = "azure"
    data_source = "azure ad"
    severity = "Medium"
    priority = "Medium"

  events:
    $app.metadata.event_type = "USER_CHANGE_PERMISSIONS"
    $app.metadata.product_event_type = "Add member to role"
    $app.metadata.product_name = "Azure AD Directory Audit"
    $app.metadata.vendor_name = "Microsoft"
    $app.security_result.action = "ALLOW"
    //To use with a single named role, like Exchange Administrator, use the following
    //$app.target.user.title = "Exchange Administrator"
    //To use with single role in GUID form (Preferred), use the following
    $app.target.resource.attribute.labels["Role.TemplateId"] = "62e90394-69f5-4237-9190-012177145e10"
    //To use a list of GUIDs (Preferred), create a reference list and use the syntax below
    //$app.target.resource.attribute.labels["Role.TemplateId"] in %entra_id_watchlist_roles_guid
    $app.principal.user.userid = $userid

  match:
    $userid over 5m

  outcome:
    $risk_score = 65
    $event_count = count_distinct($app.metadata.id)
    $assigned_role = array_distinct($app.target.user.title)
    $assigned_role_guid = array_distinct($app.target.resource.attribute.labels["Role.TemplateId"])
    $principal_county_region = array_distinct($app.principal.ip_geo_artifact.location.country_or_region)
    $user_agent = array_distinct($app.network.http.user_agent)
    $network_session = array_distinct($app.network.session_id)
    $principal_ip = array_distinct($app.principal.ip)
    $userid_making_modification = array_distinct($app.principal.user.userid)
    $principal_user_email_addresses = array_distinct($app.principal.user.email_addresses)
    $modified_userid = array_distinct($app.target.user.userid)

  condition:
    $app
}

// Copyright 2023 Google LLC. Licensed under Apache-2.0.

rule google_safebrowsing_file_process_creation {

  meta:
    author = "Google Cloud Security"
    description = "Detection of process/file events that match Safe Browsing hashes, which are files deemed to be malicious"
    rule_id = "mr_6aa149a9-cae3-4414-b50f-75cf53ac5e11"
    rule_name = "Google Safebrowsing File Process Creation"
    type = "alert"
    tags = "safe browsing"
    data_source = "microsoft sysmon"
    severity = "Critical"
    priority = "High"

  events:
    ($execution.metadata.event_type = "PROCESS_LAUNCH" or $execution.metadata.event_type = "FILE_CREATION")
    $execution.principal.hostname = $hostname
    $execution.target.process.file.sha256 != ""
    $execution.target.process.file.sha256 = $sha256

    // join execution event with Safe Browsing graph
    $safebrowse.graph.entity.file.sha256 = $sha256

    // Safe Browsing file hashes provided by GCTI Feed
    $safebrowse.graph.metadata.product_name = "Google Safe Browsing"
    $safebrowse.graph.metadata.entity_type = "FILE"
    $safebrowse.graph.metadata.source_type = "GLOBAL_CONTEXT"

    // Can comment the following two lines to adjust the safe browsing hashes available for correlation
    $safebrowse.graph.metadata.threat.category = "SOFTWARE_MALICIOUS"
    $safebrowse.graph.metadata.threat.severity = "CRITICAL"

  match:
    $hostname over 1h

  outcome:
    $risk_score = 95
    $event_count = count_distinct($execution.metadata.id)
    // added to populate alert graph with additional context
    // Commented out principal.hostname because it is already represented in graph as match variable. If match changes, can uncomment to add to results
    $principal_hostname = array_distinct($execution.principal.hostname)
    $principal_process_pid = array_distinct($execution.principal.process.pid)
    $principal_process_command_line = array_distinct($execution.principal.process.command_line)
    $principal_process_file_sha256 = array_distinct($execution.principal.process.file.sha256)
    $principal_process_file_full_path = array_distinct($execution.principal.process.file.full_path)
    $principal_process_product_specific_process_id = array_distinct($execution.principal.process.product_specific_process_id)
    $principal_process_parent_process_product_specific_process_id = array_distinct($execution.principal.process.parent_process.product_specific_process_id)
    $target_process_pid = array_distinct($execution.target.process.pid)
    $target_process_command_line = array_distinct($execution.target.process.command_line)
    $target_process_file_sha256 = array_distinct($execution.target.process.file.sha256)
    $target_process_file_full_path = array_distinct($execution.target.process.file.full_path)
    $target_process_product_specific_process_id = array_distinct($execution.target.process.product_specific_process_id)
    $principal_user_userid = array_distinct($execution.principal.user.userid)
    $target_file_sha256 = array_distinct($execution.target.file.sha256)
    $target_file_full_path = array_distinct($execution.target.file.full_path)

  condition:
    $execution and $safebrowse
}

// Copyright 2023 Google LLC. Licensed under Apache-2.0.

rule vt_relationships_file_contacts_tor_ip {

  meta:
    author = "Google Cloud Security"
    description = "Alert on known Hash contacting Tor IP with VT Relationships."
    rule_id = "mr_a6f8b114-8fdb-4f39-8820-8961dcbb1079"
    rule_name = "VT Relationships File Contacts Tor IP"
    tactic = "TA0011"
    technique = "T1090.003"
    type = "alert"
    tags = "vt, tor"
    data_source = "microsoft defender atp"
    severity = "Critical"
    priority = "High"

  events:
    $network.metadata.event_type = "NETWORK_CONNECTION"
    $network.principal.process.file.sha256 = $file_hash
    $network.target.ip = $ip
    $network.principal.hostname = $hostname

    // Uses VirusTotal integration via entity graph, this section maps to principal process file hash
    $vt.graph.metadata.entity_type = "FILE"
    $vt.graph.metadata.source_type = "GLOBAL_CONTEXT"
    $vt.graph.metadata.vendor_name = "VirusTotal"
    $vt.graph.metadata.product_name = "VirusTotal Relationships"
    $vt.graph.entity.file.sha256 = $file_hash

    // Uses VirusTotal integration via entity graph, this section maps the hash to the ip address it contacts
    $vt.graph.relations.entity_type = "IP_ADDRESS"
    $vt.graph.relations.relationship = "CONTACTS"
    $vt.graph.relations.entity.ip = $ip

    // Tor IP listing provided by GCTI Feed
    $gcti.graph.entity.artifact.ip = $ip
    $gcti.graph.metadata.entity_type = "IP_ADDRESS"
    $gcti.graph.metadata.source_type = "GLOBAL_CONTEXT"
    $gcti.graph.metadata.threat.threat_feed_name = "Tor Exit Nodes"
    $gcti.graph.metadata.vendor_name = "Google Cloud Threat Intelligence"
    $gcti.graph.metadata.product_name = "GCTI Feed"

  match:
    $hostname over 5m

  outcome:
    $risk_score = max(
        if($gcti.graph.metadata.threat.confidence = "HIGH_CONFIDENCE", 70) +
        // Unauthorized target geographies
        if($network.target.ip_geo_artifact.location.country_or_region = "Cuba", 20) +
        if($network.target.ip_geo_artifact.location.country_or_region = "Iran", 20) +
        if($network.target.ip_geo_artifact.location.country_or_region = "North Korea", 20) +
        if($network.target.ip_geo_artifact.location.country_or_region = "Russia", 20) +
        if($network.target.ip_geo_artifact.location.country_or_region = "Syria", 20)
    )
    $event_count = count_distinct($network.metadata.id)
    $count_file_hash = count_distinct($file_hash)
    $count_tor_ips = count_distinct($ip)
    $tor_geoip_country = array_distinct($network.target.ip_geo_artifact.location.country_or_region)
    $tor_geoip_state = array_distinct($network.target.ip_geo_artifact.location.state)
    // added to populate alert graph with additional context
    $principal_ip = array_distinct($network.principal.ip)
    $target_ip = array_distinct($network.target.ip)
    $principal_process_pid = array_distinct($network.principal.process.pid)
    $principal_process_command_line = array_distinct($network.principal.process.command_line)
    $principal_process_file_sha256 = array_distinct($network.principal.process.file.sha256)
    $principal_process_file_full_path = array_distinct($network.principal.process.file.full_path)
    $principal_process_product_specific_process_id = array_distinct($network.principal.process.product_specific_process_id)
    $principal_process_parent_process_product_specific_process_id = array_distinct($network.principal.process.parent_process.product_specific_process_id)
    //$target_process_pid = array_distinct($network.target.process.pid)
    //$target_process_command_line = array_distinct($network.target.process.command_line)
    //$target_process_file_sha256 = array_distinct($network.target.process.file.sha256)
    $target_process_file_full_path = array_distinct($network.target.process.file.full_path)
    //$target_process_product_specific_process_id = array_distinct($network.target.process.product_specific_process_id)
    //$target_process_parent_process_product_specific_process_id = array_distinct($network.target.process.parent_process.product_specific_process_id)
    $principal_user_userid = array_distinct($network.principal.user.userid)
    //$target_user_userid = array_distinct($network.target.user.userid)
    $target_url = array_distinct($network.target.url)

  condition:
    $network and $vt and $gcti
}

// Copyright 2023 Google LLC. Licensed under Apache-2.0.

rule whois_dns_query_to_typosquatting_domain {

  meta:
    author = "Google Cloud Security"
    description = "Provides example usage of WHOIS data, detecting a DNS query for a domain that contains a specific string and is not registered with the defined domain registrar."
    rule_id = "mr_32cd8835-d328-4a89-8265-f19cffe89346"
    rule_name = "WHOIS DNS Query To Typesquatting Domain"
    // This rule must be customized to alert on DNS queries for possible typosquatting domains that contain your organization's domain name(s) that are not registered with your approved domain registrar.
    type = "hunt"
    tags = "whois"
    data_source = "microsoft sysmon"
    severity = "low"
    priority = "low"

  events:
    // Match on DNS queries for domains that contain a specific string or company name(s).
    $dns.metadata.event_type = "NETWORK_DNS"
    // Customize the value for $dns.network.dns.questions.name to fit your environment.
    $dns.network.dns.questions.name = /threatpunter/ nocase
    $dns.network.dns.questions.name = $dns_query_name

    // Join DNS query events with WHOIS data.
    $whois.graph.entity.hostname = $dns_query_name
    $whois.graph.metadata.entity_type = "DOMAIN_NAME"
    $whois.graph.metadata.vendor_name = "WHOIS"
    $whois.graph.metadata.product_name = "WHOISXMLAPI Simple Whois"
    $whois.graph.metadata.source_type = "GLOBAL_CONTEXT"

    // Check if the domain is registered with a registrar other than Mark Monitor.
    // Customize the values for $whois.graph.entity.domain.registrar based on the approved/expected registrar(s) used by your organization.
    $whois.graph.entity.domain.registrar != "MarkMonitor Inc."

    // Check if the domain was first seen in our environment within the last 30 days (2592000 seconds).
    $seen.graph.entity.domain.name = $dns_query_name
    $seen.graph.entity.domain.first_seen_time.seconds > 0
    2592000 > timestamp.current_seconds() - $seen.graph.entity.domain.first_seen_time.seconds

  match:
    // Return the DNS query name when the rule finds a match within a 1 hour time window.
    $dns_query_name over 1h

  outcome:
    $event_count = count_distinct($dns.metadata.id)
    $principal_hostname = array_distinct($dns.principal.hostname)
    $network_dns_questions_name = array_distinct($dns.network.dns.questions.name)
    $network_dns_answers_data = array_distinct($dns.network.dns.answers.data)
    $principal_ip = array_distinct($dns.principal.ip)
    $target_ip = array_distinct($dns.target.ip)
    $principal_process_pid = array_distinct($dns.principal.process.pid)
    $principal_process_file_full_path = array_distinct($dns.principal.process.file.full_path)
    $principal_process_product_specific_process_id = array_distinct($dns.principal.process.product_specific_process_id)
    $principal_process_command_line = array_distinct($dns.principal.process.command_line)
    $principal_process_file_sha256 = array_distinct($dns.principal.process.file.sha256)
    $principal_process_parent_process_product_specific_process_id = array_distinct($dns.principal.process.parent_process.product_specific_process_id)
    $principal_user_userid = array_distinct($dns.principal.user.userid)

  condition:
    // Trigger rule if a match is found for the following events.
    $dns and $whois and $seen
}