Detection rules › YARA-L

YARA-L rules: 39

Rule	Severity
AWS Delete VPC Flow Logs	`low`
GCTI Tor Exit Nodes	`high`
O365 Add User To Admin Role	`medium`
Okta Multiple User's Logins With Invalid Credentials From The Same IP	`medium`

AWS Delete VPC Flow Logs

Severity: low
Type: Alert
Time window: 1h
Match by: user_id
Author: Google Cloud Security
Source: github.com/chronicle/detection-rules

Detects when AWS VPC FLow Logs are deleted.

MITRE ATT&CK Coverage

Tactic	Techniques
Defense Impairment	`T1685.002` Disable or Modify Tools: Disable or Modify Cloud Log

Telemetry Coverage

Platform	Record / event type
AWS	CloudTrail event `DeleteFlowLogs`: Deletes one or more VPC flow logs.

Rule Body

// Copyright 2023 Google LLC. Licensed under Apache-2.0.

rule aws_delete_vpc_flow_logs {

  meta:
    author = "Google Cloud Security"
    description = "Detects when AWS VPC FLow Logs are deleted."
    rule_id = "mr_b833ecbb-a3fb-4ea6-97dd-2c861c92620b"
    rule_name = "AWS Delete VPC Flow Logs"
    mitre_attack_tactic = "Defense Evasion"
    mitre_attack_technique = "Impair Defenses: Disable Cloud Logs"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1562/008/"
    mitre_attack_version = "v13.1"
    type = "Alert"
    data_source = "AWS CloudTrail"
    platform = "AWS"
    severity = "Low"
    priority = "Low"

  events:
    $cloudtrail.metadata.vendor_name = "AMAZON"
    $cloudtrail.metadata.product_name = "AWS CloudTrail"
    $cloudtrail.metadata.product_event_type = "DeleteFlowLogs"
    $cloudtrail.security_result.action = "ALLOW"
    $cloudtrail.principal.user.user_display_name = $user_id

  match:
    $user_id over 1h

  outcome:
    $risk_score = max(75)
    $mitre_attack_tactic = "Defense Evasion"
    $mitre_attack_technique = "Impair Defenses: Disable Cloud Logs"
    $mitre_attack_technique_id = "T1562.008"
    $event_count = count_distinct($cloudtrail.metadata.id)
    $network_http_user_agent = array_distinct($cloudtrail.network.http.user_agent)
    $principal_ip = array_distinct($cloudtrail.principal.ip)
    $principal_ip_country = array_distinct($cloudtrail.principal.ip_geo_artifact.location.country_or_region)
    $principal_ip_state = array_distinct($cloudtrail.principal.ip_geo_artifact.location.state)
    $principal_user_display_name = array_distinct($cloudtrail.principal.user.user_display_name)
    $recipient_aws_account_id = array_distinct($cloudtrail.additional.fields["recipientAccountId"])
    $aws_region = array_distinct($cloudtrail.principal.location.name)
    $target_resource_name = array_distinct($cloudtrail.target.resource.name)
    $target_resource_product_object_id = array_distinct($cloudtrail.target.resource.product_object_id)

  condition:
    $cloudtrail
}

YARA-L Rule Structure

Condition

Fires when at least one $cloudtrail event in the 1h window.

Events

`$cloudtrail`

metadata.product_event_type = "DeleteFlowLogs"
security_result.action = "ALLOW"

Match and Correlation

Match key: $user_id (principal.user.user_display_name)
Within: 1h

Outcome

Outcome variables add context to a detection. When the rule generates an alert, $risk_score is displayed with it.

Field	Expression
`risk_score`	`max(75)`
`event_count`	`count_distinct($cloudtrail.metadata.id)`
`network_http_user_agent`	`array_distinct($cloudtrail.network.http.user_agent)`
`principal_ip`	`array_distinct($cloudtrail.principal.ip)`
`principal_ip_country`	`array_distinct($cloudtrail.principal.ip_geo_artifact.location.country_or_region)`
`principal_ip_state`	`array_distinct($cloudtrail.principal.ip_geo_artifact.location.state)`
`principal_user_display_name`	`array_distinct($cloudtrail.principal.user.user_display_name)`
`recipient_aws_account_id`	`array_distinct($cloudtrail.additional.fields["recipientAccountId"])`
`aws_region`	`array_distinct($cloudtrail.principal.location.name)`
`target_resource_name`	`array_distinct($cloudtrail.target.resource.name)`
`target_resource_product_object_id`	`array_distinct($cloudtrail.target.resource.product_object_id)`

GCTI Tor Exit Nodes

Severity: high
Type: alert
Time window: 1h
Match by: ip
Author: Google Cloud Security
Source: github.com/chronicle/detection-rules

Alert traffic destined for known Tor exit nodes

MITRE ATT&CK Coverage

Tactic	Techniques
Command & Control	`T1090.003` Proxy: Multi-hop Proxy

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 3: Network connection
Security-Auditing	Event ID 5156: The Windows Filtering Platform has permitted a connection.

Rule Body

// Copyright 2023 Google LLC. Licensed under Apache-2.0.

rule gcti_tor_exit_nodes {

  meta:
    author = "Google Cloud Security"
    description = "Alert traffic destined for known Tor exit nodes"
    rule_id = "mr_1d31f0e4-8cd9-4fc2-ae87-e91a435fe34f"
    rule_name = "GCTI Tor Exit Nodes"
    tactic = "TA0011"
    technique = "T1090.003"
    type = "alert"
    tags = "tor"
    data_source = "crowdstrike, microsoft sysmon, microsoft defender atp"
    severity = "High"
    priority = "High"

  events:
    $network.metadata.event_type = "NETWORK_CONNECTION"
    $network.security_result.action = "ALLOW"
    $network.target.ip = $ip

    // Tor IP listing provided by GCTI Feed
    $gcti_feed.graph.entity.artifact.ip = $ip
    $gcti_feed.graph.metadata.entity_type = "IP_ADDRESS"
    $gcti_feed.graph.metadata.threat.threat_feed_name = "Tor Exit Nodes"
    $gcti_feed.graph.metadata.product_name = "GCTI Feed"
    $gcti_feed.graph.metadata.source_type = "GLOBAL_CONTEXT"

  match:
    $ip over 1h

  outcome:
    $risk_score = 85
    $event_count = count_distinct($network.metadata.id)
    $tor_geoip_country = array_distinct($network.target.ip_geo_artifact.location.country_or_region)
    $tor_geoip_state = array_distinct($network.target.ip_geo_artifact.location.state)
    // added to populate alert graph with additional context
    $principal_ip = array_distinct($network.principal.ip)
    // Commented out target.ip because it is already represented in graph as match variable. If match changes, can uncomment to add to results
    //$target_ip = array_distinct($network.target.ip)
    $principal_process_pid = array_distinct($network.principal.process.pid)
    $principal_process_command_line = array_distinct($network.principal.process.command_line)
    $principal_process_file_sha256 = array_distinct($network.principal.process.file.sha256)
    $principal_process_file_full_path = array_distinct($network.principal.process.file.full_path)
    $principal_process_product_specific_process_id = array_distinct($network.principal.process.product_specific_process_id)
    $principal_process_parent_process_product_specific_process_id = array_distinct($network.principal.process.parent_process.product_specific_process_id)
    $target_process_pid = array_distinct($network.target.process.pid)
    $target_process_command_line = array_distinct($network.target.process.command_line)
    $target_process_file_sha256 = array_distinct($network.target.process.file.sha256)
    $target_process_file_full_path = array_distinct($network.target.process.file.full_path)
    //$target_process_product_specific_process_id = array_distinct($network.target.process.product_specific_process_id)
    //$target_process_parent_process_product_specific_process_id = array_distinct($network.target.process.parent_process.product_specific_process_id)
    $principal_user_userid = array_distinct($network.principal.user.userid)
    $target_user_userid = array_distinct($network.target.user.userid)

  condition:
    $network and $gcti_feed
}

YARA-L Rule Structure

Condition

Fires when at least one $network event in the 1h window and $gcti_feed matches entity context.

Events

`$gcti_feed` entity context (`IP_ADDRESS`)

graph.metadata.entity_type = "IP_ADDRESS"
graph.metadata.threat.threat_feed_name = "Tor Exit Nodes"
graph.metadata.product_name = "GCTI Feed"
graph.metadata.source_type = "GLOBAL_CONTEXT"

`$network` `NETWORK_CONNECTION` (`3`, `5156`)

security_result.action = "ALLOW"

Match and Correlation

Match key: $ip (target.ip)
Within: 1h

Outcome

Outcome variables add context to a detection. When the rule generates an alert, $risk_score is displayed with it.

Field	Expression
`risk_score`	`85`
`event_count`	`count_distinct($network.metadata.id)`
`tor_geoip_country`	`array_distinct($network.target.ip_geo_artifact.location.country_or_region)`
`tor_geoip_state`	`array_distinct($network.target.ip_geo_artifact.location.state)`
`principal_ip`	`array_distinct($network.principal.ip)`
`principal_process_pid`	`array_distinct($network.principal.process.pid)`
`principal_process_command_line`	`array_distinct($network.principal.process.command_line)`
`principal_process_file_sha256`	`array_distinct($network.principal.process.file.sha256)`
`principal_process_file_full_path`	`array_distinct($network.principal.process.file.full_path)`
`principal_process_product_specific_process_id`	`array_distinct($network.principal.process.product_specific_process_id)`
`principal_process_parent_process_product_specific_process_id`	`array_distinct($network.principal.process.parent_process.product_specific_process_id)`
`target_process_pid`	`array_distinct($network.target.process.pid)`
`target_process_command_line`	`array_distinct($network.target.process.command_line)`
`target_process_file_sha256`	`array_distinct($network.target.process.file.sha256)`
`target_process_file_full_path`	`array_distinct($network.target.process.file.full_path)`
`principal_user_userid`	`array_distinct($network.principal.user.userid)`
`target_user_userid`	`array_distinct($network.target.user.userid)`

O365 Add User To Admin Role

Severity: medium
Type: alert
Time window: 5m
Match by: userid
Author: Google Cloud Security
Source: github.com/chronicle/detection-rules

Adding users to administrative roles is not malicious, but due to the sensitivity of certain roles, validation should occur when this occurs

MITRE ATT&CK Coverage

Tactic	Techniques
Persistence	`T1098.003` Account Manipulation: Additional Cloud Roles

Telemetry Coverage

Platform	Record / event type
Microsoft 365	Add member to role.

Rules Detecting the Same Action

These rules filter on the same operation.

M365 Identity Global Administrator Role Assigned (Elastic)
O365 Recently Created Entra ID User Assigned Roles (YARA-L)

Rule Body

// Copyright 2023 Google LLC. Licensed under Apache-2.0.

rule o365_add_user_to_admin_role {

  meta:
    author = "Google Cloud Security"
    description = "Adding users to administrative roles is not malicious, but due to the sensitivity of certain roles, validation should occur when this occurs"
    rule_id = "mr_ee28c257-d2c7-490c-addf-aef35d07f29d"
    rule_name = "O365 Add User To Admin Role"
    assumption = "The list msgraph_watchlist_roles is populated with role names, example: Application Administrator"
    mitre_attack_tactic = "TA0003"
    mitre_attack_technique = "T1098.003"
    type = "alert"
    platform = "azure"
    data_source = "o365"
    severity = "Medium"
    priority = "Medium"

  events:
    $app.metadata.event_type = "USER_UNCATEGORIZED"
    $app.metadata.product_event_type = "Add member to role."
    $app.metadata.product_name = "Office 365"
    $app.metadata.vendor_name = "Microsoft"
    $app.security_result.action = "ALLOW"
    $app.target.resource.attribute.roles.name in %msgraph_watchlist_roles
    $app.principal.user.userid = $userid

  match:
    $userid over 5m

  outcome:
    $risk_score = 65
    $event_count = count_distinct($app.metadata.id)
    $security_summary = array_distinct($app.security_result.summary)
    $user_agent = array_distinct($app.network.http.user_agent)
    $assigned_role = array_distinct($app.target.resource.attribute.roles.name)
    //added to populate alert graph with additional context
    //$principal_user_userid = array_distinct($app.principal.user.userid)
    $target_user_userid = array_distinct($app.target.user.userid)

  condition:
    $app
}

YARA-L Rule Structure

Condition

Fires when at least one $app event in the 5m window.

Events

`$app` `USER_UNCATEGORIZED`

metadata.product_event_type = "Add member to role."
security_result.action = "ALLOW"
target.resource.attribute.roles.name in "%msgraph_watchlist_roles"

Match and Correlation

Match key: $userid (principal.user.userid)
Within: 5m

Outcome

Outcome variables add context to a detection. When the rule generates an alert, $risk_score is displayed with it.

Field	Expression
`risk_score`	`65`
`event_count`	`count_distinct($app.metadata.id)`
`security_summary`	`array_distinct($app.security_result.summary)`
`user_agent`	`array_distinct($app.network.http.user_agent)`
`assigned_role`	`array_distinct($app.target.resource.attribute.roles.name)`
`target_user_userid`	`array_distinct($app.target.user.userid)`

Okta Multiple User's Logins With Invalid Credentials From The Same IP

Severity: medium
Type: Alert
Time window: 1h
Match by: ip
Author: Google Cloud Security
Source: github.com/chronicle/detection-rules

Detects multiple user logins with invalid credentials from a single IP.

MITRE ATT&CK Coverage

Tactic	Techniques
Initial Access	`T1078` Valid Accounts
Persistence	`T1078` Valid Accounts
Privilege Escalation	`T1078` Valid Accounts
Stealth	`T1078` Valid Accounts

References

https://help.okta.com/en-us/Content/Topics/Security/threat-insight/configure-threatinsight-system-log.htm

Rule Body

// Copyright 2023 Google LLC. Licensed under Apache-2.0.

rule okta_multiple_users_logins_with_invalid_credentials_from_the_same_ip {

  meta:
    author = "Google Cloud Security"
    description = "Detects multiple user logins with invalid credentials from a single IP."
    rule_id = "mr_09e08430-0704-4411-b3a1-29d05bcd4e13"
    rule_name = "Okta Multiple User's Logins With Invalid Credentials From The Same IP"
    reference = "https://help.okta.com/en-us/Content/Topics/Security/threat-insight/configure-threatinsight-system-log.htm"
    mitre_attack_tactic = "Defense Evasion, Persistence, Privilege Escalation, Initial Access"
    mitre_attack_technique = "Valid Accounts"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1078/"
    mitre_attack_version = "v13.1"
    type = "Alert"
    data_source = "Okta"
    severity = "Medium"
    priority = "Medium"

  events:
    $login.metadata.product_name = "Okta"
    $login.metadata.vendor_name = "Okta"
    $login.metadata.event_type = "USER_LOGIN"
    $login.security_result.action = "BLOCK"
    $login.security_result.category_details = "INVALID_CREDENTIALS"
    $login.principal.ip = $ip

  match:
    $ip over 1h

  outcome:
    $risk_score = max(
      // If the IP Address is marked as suspicious IP address by Okta ThreatInsight
      if($login.security_result.detection_fields["threatSuspected"] = "true", 30) +
      // Based on Okta Behavior Detection pattern analysis
      if($login.security_result.description = /New Geo-Location=POSITIVE/, 10) +
      if($login.security_result.description = /New Device=POSITIVE/, 20) +
      if($login.security_result.description = /New IP=POSITIVE/, 5) +
      if($login.security_result.description = /New City=POSITIVE/, 5) +
      if($login.security_result.description = /New State=POSITIVE/, 10) +
      if($login.security_result.description = /New Country=POSITIVE/, 10) +
      if($login.security_result.description = /Velocity=POSITIVE/, 10) +
      // Unauthorized target geographies
      if($login.target.ip_geo_artifact.location.country_or_region = "Cuba", 20) +
      if($login.target.ip_geo_artifact.location.country_or_region = "Iran", 20) +
      if($login.target.ip_geo_artifact.location.country_or_region = "North Korea", 20) +
      if($login.target.ip_geo_artifact.location.country_or_region = "Russia", 20) +
      if($login.target.ip_geo_artifact.location.country_or_region = "Syria", 20)
    )
    $mitre_attack_tactic = "Defense Evasion, Persistence, Privilege Escalation, Initial Access"
    $mitre_attack_technique = "Valid Accounts"
    $target_user_agent = array_distinct($login.network.http.user_agent)
    $principal_ip = array_distinct($login.principal.ip)
    $principal_ip_country = array_distinct($login.principal.ip_geo_artifact.location.country_or_region)
    $principal_ip_state = array_distinct($login.principal.ip_geo_artifact.location.state)
    $principal_ip_city = array_distinct($login.principal.location.city)
    $security_result_summary = array_distinct($login.security_result.summary)
    $principal_user_managers_email_addresses = array_distinct($login.principal.user.managers.email_addresses)
    $principal_user_userid = array_distinct($login.principal.user.userid)
    $dc_principal_user_userid = count_distinct($login.principal.user.userid)
    $target_user_email_addresses = array_distinct($login.target.user.email_addresses)
    $target_user_userid = array_distinct($login.target.user.userid)
    $security_result_description = array_distinct($login.security_result.description)

  condition:
    $login and $dc_principal_user_userid > 5
}

YARA-L Rule Structure

Condition

Fires when at least one $login event in the 1h window and $dc_principal_user_userid > 5.

Events

`$login` `USER_LOGIN`

security_result.action = "BLOCK"
security_result.category_details = "INVALID_CREDENTIALS"

Match and Correlation

Match key: $ip (principal.ip)
Within: 1h

Outcome

Outcome variables add context to a detection. When the rule generates an alert, $risk_score is displayed with it.

Field	Expression
`risk_score`	max( if($login.security_result.detection_fields["threatSuspected"] = "true", 30) + if($login.security_result.description = /New Geo-Location=POSITIVE/, 10) + if($login.security_result.description = /New Device=POSITIVE/, 20) + if($login.security_result.description = /New IP=POSITIVE/, 5) + if($login.security_result.description = /New City=POSITIVE/, 5) + if($login.security_result.description = /New State=POSITIVE/, 10) + if($login.security_result.description = /New Country=POSITIVE/, 10) + if($login.security_result.description = /Velocity=POSITIVE/, 10) + if($login.target.ip_geo_artifact.location.country_or_region = "Cuba", 20) + if($login.target.ip_geo_artifact.location.country_or_region = "Iran", 20) + if($login.target.ip_geo_artifact.location.country_or_region = "North Korea", 20) + if($login.target.ip_geo_artifact.location.country_or_region = "Russia", 20) + if($login.target.ip_geo_artifact.location.country_or_region = "Syria", 20) )
`target_user_agent`	`array_distinct($login.network.http.user_agent)`
`principal_ip`	`array_distinct($login.principal.ip)`
`principal_ip_country`	`array_distinct($login.principal.ip_geo_artifact.location.country_or_region)`
`principal_ip_state`	`array_distinct($login.principal.ip_geo_artifact.location.state)`
`principal_ip_city`	`array_distinct($login.principal.location.city)`
`security_result_summary`	`array_distinct($login.security_result.summary)`
`principal_user_managers_email_addresses`	`array_distinct($login.principal.user.managers.email_addresses)`
`principal_user_userid`	`array_distinct($login.principal.user.userid)`
`dc_principal_user_userid`	`count_distinct($login.principal.user.userid)`
`target_user_email_addresses`	`array_distinct($login.target.user.email_addresses)`
`target_user_userid`	`array_distinct($login.target.user.userid)`
`security_result_description`	`array_distinct($login.security_result.description)`

Back to all YARA-L rules

YARA-L rules: 39

AWS Delete VPC Flow Logs

MITRE ATT&CK Coverage

Telemetry Coverage

Rule Body

YARA-L Rule Structure

Condition

Events

$cloudtrail

Match and Correlation

Outcome

GCTI Tor Exit Nodes

MITRE ATT&CK Coverage

Telemetry Coverage

Rule Body

YARA-L Rule Structure

Condition

Events

$gcti_feed entity context (IP_ADDRESS)

$network NETWORK_CONNECTION (3, 5156)

Match and Correlation

Outcome

O365 Add User To Admin Role

MITRE ATT&CK Coverage

Telemetry Coverage

Rules Detecting the Same Action

Rule Body

YARA-L Rule Structure

Condition

Events

$app USER_UNCATEGORIZED

Match and Correlation

Outcome

Okta Multiple User's Logins With Invalid Credentials From The Same IP

MITRE ATT&CK Coverage

References

Rule Body

YARA-L Rule Structure

Condition

Events

$login USER_LOGIN

Match and Correlation

Outcome

`$cloudtrail`

`$gcti_feed` entity context (`IP_ADDRESS`)

`$network` `NETWORK_CONNECTION` (`3`, `5156`)

`$app` `USER_UNCATEGORIZED`

`$login` `USER_LOGIN`