Elastic rules: 03

[metadata]
creation_date = "2024/04/12"
integration = ["aws"]
maturity = "production"
updated_date = "2026/04/10"

[rule]
author = ["Elastic"]
description = """
Identifies the deletion of an Amazon Route 53 Resolver Query Log Configuration. Resolver query logs provide critical
visibility into DNS activity across VPCs, including lookups made by EC2 instances, containers, Lambda functions, and
other AWS resources. Deleting a query log configuration immediately stops DNS query and response logging for the
associated VPC. Adversaries may delete these configurations to evade detection, suppress forensic evidence, or degrade
security monitoring capabilities.
"""
false_positives = [
    """
    Query log configuration deletions may occur during legitimate networking changes, logging pipeline updates, or
    infrastructure redesign. Confirm the activity aligns with expected operations before taking action.
    """,
]
from = "now-6m"
index = ["filebeat-*", "logs-aws.cloudtrail*"]
language = "kuery"
license = "Elastic License v2"
name = "AWS Route 53 Resolver Query Log Configuration Deleted"
note = """## Triage and analysis

### Investigating AWS Route 53 Resolver Query Log Configuration Deleted

Route 53 Resolver query logs provide essential telemetry for DNS visibility across AWS environments. Deleting a Resolver Query Log Configuration immediately halts DNS logging for one or more VPCs, creating a significant monitoring gap. Adversaries may intentionally delete these configurations to hide malicious activity. This rule detects successful invocations of `DeleteResolverQueryLogConfig`.

### Possible investigation steps

**Validate the actor and request origin**
- Review `aws.cloudtrail.user_identity.arn` and `aws.cloudtrail.user_identity.access_key_id` to determine who initiated the deletion. Confirm whether the identity normally manages Route53 Resolver resources or VPC-level DNS configuration.
- Examine `source.ip`, `source.address`, `source.geo` fields and `user_agent.original` to determine whether the request originated from an expected network path or automation role. Whether API calls were made via console, CLI, SDK, or custom tooling.

**Understand what was deleted and the impacted environment**
- Inspect `aws.cloudtrail.request_parameters` and `aws.cloudtrail.response_elements` to identify the Query Log Configuration ID, Associated VPCs and destinations (e.g., CloudWatch Log Group, S3 bucket, Kinesis stream).
- Determine whether these VPCs support production workloads, contain regulated or sensitive data, host internet-facing or privileged workloads (e.g., EKS clusters, directory services, bastion hosts).

**Correlate for intent and related activity**
- Use `@timestamp` to correlate the deletion with:
  - Prior `PutResolverQueryLogConfig` or `AssociateResolverQueryLogConfig` modifications.
  - IAM permission changes or STS session activities.
  - Recent DNS anomalies if logs were active prior to deletion.
- Pivot on the same `aws.cloudtrail.user_identity.arn` to identify:
  - Additional logging-related tampering (CloudTrail, VPC Flow Logs, S3 server access logs).
  - Resource isolation or privilege escalation attempts.
  - Suspicious EC2, Lambda, or container workload behavior.

**Validate operational context**
- Check whether a change request, maintenance window, or migration task was underway that could explain the deletion.
- Confirm with networking, SRE, or platform engineering teams whether a logging pipeline redesign was in progress, a deprecated log config was intentionally removed, infrastructure-as-code (IaC) automation recently applied updates that removed the configuration.

### False positive analysis

- **Legitimate network and logging redesign**  
  - Deletions performed during planned VPC migrations, resolver logging pipeline upgrades, or CloudWatch/S3 restructuring may be benign.
- **Expected IaC behavior**  
  - Terraform, CloudFormation, or CDK stacks may destroy and recreate logging configurations during updates.  
    Validate pipeline activity and automation roles to avoid noise.

### Response and remediation

**Contain and restore visibility**
- If unauthorized activity is suspected:
  - Immediately re-create the Resolver Query Log Configuration.
  - Re-associate the configuration with the affected VPCs to restore DNS visibility.
  - Verify that CloudWatch Log Groups or S3 destinations have not been deleted or altered.

**Investigate access and scope of impact**
- Review IAM permissions assigned to the actor:
  - Identify whether privilege escalation or role compromise occurred.
  - Validate that other high-impact logging or monitoring configurations (CloudTrail, VPC Flow Logs, GuardDuty) remain intact.
- Perform a DNS-focused threat hunt:
  - Analyze prior logged queries for indicators of malware, C2 infrastructure, or suspicious domains before the logging gap.

**Strengthen defensive controls**
- Restrict sensitive operations by:
  - Limiting `route53resolver:DeleteResolverQueryLogConfig` to a small number of privileged roles.
  - Adding IAM condition keys to constrain deletion operations by source IP, region, or principal ARN.
- Enable AWS Config or Security Hub controls that:
  - Detect missing or deleted query log configurations.
  - Enforce continuous logging for critical VPCs.

### Additional information
- **[AWS IR Playbooks](https://github.com/aws-samples/aws-incident-response-playbooks/blob/c151b0dc091755fffd4d662a8f29e2f6794da52c/playbooks/)** 
- **[AWS Customer Playbook Framework](https://github.com/aws-samples/aws-customer-playbook-framework/tree/a8c7b313636b406a375952ac00b2d68e89a991f2/docs)** 
- **[AWS Knowledge Center – Security Best Practices](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/)**
"""
references = [
    "https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_DeleteResolverQueryLogConfig.html",
]
risk_score = 47
rule_id = "453183fa-f903-11ee-8e88-f661ea17fbce"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Data Source: AWS",
    "Data Source: Amazon Web Services",
    "Data Source: AWS Route 53",
    "Use Case: Log Auditing",
    "Resources: Investigation Guide",
    "Tactic: Defense Evasion",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset: aws.cloudtrail 
    and event.provider: route53resolver.amazonaws.com
    and event.action: DeleteResolverQueryLogConfig 
    and event.outcome: success
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[rule.threat.technique.subtechnique]]
id = "T1562.008"
name = "Disable or Modify Cloud Logs"
reference = "https://attack.mitre.org/techniques/T1562/008/"



[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user_agent.original",
    "source.ip",
    "aws.cloudtrail.user_identity.arn",
    "aws.cloudtrail.user_identity.type",
    "aws.cloudtrail.user_identity.access_key_id",
    "event.action",
    "event.outcome",
    "cloud.account.id",
    "cloud.region",
    "aws.cloudtrail.request_parameters",
    "aws.cloudtrail.response_elements",
]

[rule]
description = """
Detects the creation of a bind shell via Netcat traditional. Attackers may spawn bind shells to establish persistence
onto a target system.
"""
id = "0fb019ab-98a0-487e-aa37-fabe5b69ec8a"
license = "Elastic License v2"
name = "Bind Shell via Netcat Traditional"
os_list = ["linux"]
reference = ["https://gtfobins.github.io/gtfobins/nc/"]
version = "1.0.5"

query = '''
process where event.type == "start" and event.action == "exec" and
process.name in ("nc", "ncat", "netcat", "netcat.openbsd", "netcat.traditional", "nc.openbsd", "nc.traditional") and
process.args == "-e" and process.args : "-*l*" and process.args : "-*p*" and
process.args : "*sh*" and process.args_count >= 5
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
tree = true

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "7.15.0"

[rule]
description = """
Detects the execution of curl via an automator application. Threat actors have been using automator applications in
order to bypass security controls and download second stage payloads as automator apps can be signed/trusted by the
system and are generally not subject to scanning.
"""
id = "3540b77a-80a6-42ea-b7f4-714291a28a62"
license = "Elastic License v2"
name = "Curl Execution via Automator Application"
os_list = ["macos"]
version = "1.0.5"

query = '''
process where event.type == "start" and process.parent.name in ("Application Stub", "Automator Application Stub") and 
 (
  (process.name like~ ("sh", "bash", "zsh", "tclsh*") and
    process.args == "-c" and
    process.args like~ ("curl*", "nscurl*")) or
  (process.name in ("curl", "nscurl"))
 )
'''

min_endpoint_version = "8.7.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1105"
name = "Ingress Tool Transfer"
reference = "https://attack.mitre.org/techniques/T1105/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "8.7.0"

[metadata]
creation_date = "2026/06/30"
integration = ["gcp"]
maturity = "production"
updated_date = "2026/06/30"

[rule]
author = ["Elastic"]
description = """
Detects GKE pod create, update, or patch events that mount sensitive hostPath volumes such as the root filesystem,
kubelet paths, or container runtime sockets. This can enable container escape and credential theft. System identities
and controller-owned workloads are excluded.
"""
false_positives = [
    """
    Node agents and observability DaemonSets commonly mount host paths like /proc or /var/log. Controller ownerReferences
    exclusions reduce noise; add image exceptions if needed.
    """,
]
index = ["logs-gcp.audit-*"]
language = "kuery"
license = "Elastic License v2"
name = "GKE Pod Created with a Sensitive hostPath Volume"
note = """## Triage and analysis

### Investigating GKE Pod Created with a Sensitive hostPath Volume

Review `gcp.audit.request.spec.volumes.hostPath.path` and whether the mount is required for the workload.

### Investigation steps

- Confirm the hostPath and container images in the audit request.
- Review `user.email`, namespace, and follow-on secret or exec activity.

### False positives

- Platform DaemonSets mounting /proc or kubelet paths; validate against known agents.

## Setup

The GCP Fleet integration with GKE audit logs enabled is required to be compatible with this rule."""
references = [
    "https://kubernetes.io/docs/concepts/storage/volumes/#hostpath",
    "https://blog.appsecco.com/kubernetes-namespace-breakout-using-insecure-host-path-volume-part-1-b382f2a6e216",
]
risk_score = 47
rule_id = "647ae821-a80d-4f07-bb12-d40dd433f6b4"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Domain: Kubernetes",
    "Data Source: GCP",
    "Data Source: Google Cloud Platform",
    "Use Case: Threat Detection",
    "Tactic: Privilege Escalation",
    "Tactic: Execution",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset:gcp.audit and event.outcome:success and
event.action:("io.k8s.core.v1.pods.create" or "io.k8s.core.v1.pods.update" or "io.k8s.core.v1.pods.patch") and
gcp.audit.request.spec.volumes.hostPath.path:(
  "/" or "/proc" or "/root" or "/var" or "/var/run" or "/var/run/docker.sock" or "/var/run/crio/crio.sock" or
  "/var/run/cri-dockerd.sock" or "/var/lib/kubelet" or "/var/lib/kubelet/pki" or "/var/lib/docker/overlay2" or "/etc" or
  "/etc/kubernetes" or "/etc/kubernetes/manifests" or "/etc/kubernetes/pki" or "/home/admin"
) and not user.email:system\:* and
not gcp.audit.request.metadata.ownerReferences.kind:("ReplicaSet" or "DaemonSet" or "StatefulSet")
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1611"
name = "Escape to Host"
reference = "https://attack.mitre.org/techniques/T1611/"

[rule.threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1610"
name = "Deploy Container"
reference = "https://attack.mitre.org/techniques/T1610/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[metadata]
creation_date = "2024/12/19"
integration = ["endpoint"]
maturity = "production"
updated_date = "2026/03/24"

[rule]
author = ["Elastic"]
description = """
This rule detects the creation of a Linux kernel object file (.ko) on a system. Threat actors may leverage Linux kernel
object files to load a rootkit or other type of malware on a system providing them with complete control and the ability
to hide from security products.
"""
from = "now-9m"
index = ["logs-endpoint.events.file-*"]
language = "kuery"
license = "Elastic License v2"
name = "Kernel Object File Creation"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Kernel Object File Creation

Kernel object files (.ko) are loadable modules that extend the functionality of the Linux kernel, often used for adding drivers or system features. Adversaries exploit this by loading malicious modules, such as rootkits, to gain control and evade detection. The detection rule identifies suspicious .ko file creation, excluding benign paths, to flag potential threats while minimizing false positives.

### Possible investigation steps

- Review the file path of the created .ko file to determine if it is located in a suspicious or unusual directory that is not excluded by the rule, such as /var/tmp or /usr/local.
- Examine the process that created the .ko file by checking the process.executable and process.name fields to identify if it is a known legitimate process or potentially malicious.
- Investigate the parent process of the process that created the .ko file to understand the context of how the file was created and if it was initiated by a legitimate user action or a script.
- Check for any recent system changes or anomalies around the time of the .ko file creation, such as new user accounts, changes in system configurations, or other suspicious file activities.
- Look for any associated network activity from the host around the time of the .ko file creation to identify potential command and control communications or data exfiltration attempts.
- Correlate the alert with other security events or logs from the same host to identify any patterns or additional indicators of compromise that may suggest a broader attack campaign.

### False positive analysis

- Kernel updates and system maintenance activities can generate .ko files in legitimate scenarios. Users should monitor for these activities and consider excluding paths related to official update processes.
- Custom kernel module development by developers or system administrators may trigger this rule. Establish a process to whitelist known development environments or specific user accounts involved in module creation.
- Automated system recovery tools, such as those using mkinitramfs, may create .ko files. Ensure these paths are excluded as indicated in the rule to prevent unnecessary alerts.
- Snap package installations might involve .ko file creation. Exclude the /snap/ directory to avoid false positives from legitimate package installations.
- Backup and restoration processes using tools like cpio can lead to .ko file creation. Verify these processes and exclude them if they are part of routine system operations.

### Response and remediation

- Isolate the affected system from the network to prevent further spread or communication with potential command and control servers.
- Terminate any suspicious processes associated with the creation of the .ko file, especially those not originating from known benign paths.
- Remove the suspicious .ko file from the system to prevent it from being loaded into the kernel.
- Conduct a thorough scan of the system using updated antivirus or endpoint detection and response (EDR) tools to identify and remove any additional malicious components.
- Review system logs and audit trails to identify any unauthorized access or changes made around the time of the .ko file creation.
- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if the threat is part of a larger attack campaign.
- Implement additional monitoring and alerting for similar activities, ensuring that any future attempts to create or load unauthorized .ko files are promptly detected and addressed."""
risk_score = 21
rule_id = "1965eab8-d17f-4b21-8c48-ad5ff133695d"
setup = """## Setup

This rule requires data coming in from Elastic Defend.

### Elastic Defend Integration Setup
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.

#### Prerequisite Requirements:
- Fleet is required for Elastic Defend.
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).

#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
- Go to the Kibana home page and click "Add integrations".
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
- Click "Add Elastic Defend".
- Configure the integration name and optionally add a description.
- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
- Click "Save and Continue".
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
"""
severity = "low"
tags = [
    "Domain: Endpoint",
    "OS: Linux",
    "Use Case: Threat Detection",
    "Tactic: Persistence",
    "Tactic: Defense Evasion",
    "Data Source: Elastic Defend",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "new_terms"
query = '''
event.category:file and host.os.type:linux and event.type:creation and file.extension:ko and
not (
  file.path:(
    /tmp/mkinitramfs* or /var/cache/uptrack/* or /var/tmp/dracut.* or /build/* or /var/lib/dkms/* or
    /mnt/Samsung/* or /var/tmp/portage/* or /tmp/user/0/mkinitramfs* or /var/tmp/supermin* or
    /mnt/img/storage/squashfs-root/* or /var/opt/eset/* or /var/tmp/mkinitramfs_* 
  ) or
  process.executable:(
    "/usr/local/v3net/suarez/bin/suarez" or "/sbin/dracut" or "/opt/traps/bin/pmd" or "/usr/bin/pacman" or
    "/usr/bin/containerd" or "/usr/sbin/dockerd" or "/usr/bin/dockerd" or /snap/* or
    "/usr/lib/dracut/dracut-initramfs-restore" or "/sbin/unsquashfs"
  ) or
  process.name:"cpio"
)
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1547"
name = "Boot or Logon Autostart Execution"
reference = "https://attack.mitre.org/techniques/T1547/"

[[rule.threat.technique.subtechnique]]
id = "T1547.006"
name = "Kernel Modules and Extensions"
reference = "https://attack.mitre.org/techniques/T1547/006/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1014"
name = "Rootkit"
reference = "https://attack.mitre.org/techniques/T1014/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1547"
name = "Boot or Logon Autostart Execution"
reference = "https://attack.mitre.org/techniques/T1547/"

[[rule.threat.technique.subtechnique]]
id = "T1547.006"
name = "Kernel Modules and Extensions"
reference = "https://attack.mitre.org/techniques/T1547/006/"

[rule.threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"
[rule.new_terms]
field = "new_terms_fields"
value = ["process.name", "file.name"]

[[rule.new_terms.history_window_start]]
field = "history_window_start"
value = "now-5d"

[metadata]
creation_date = "2024/12/17"
integration = ["endpoint"]
maturity = "production"
updated_date = "2025/12/22"

[rule]
author = ["Elastic"]
description = """
This rule detects the creation of Loadable Kernel Module (LKM) configuration files. Attackers may create or modify these
files to allow their LKMs to be loaded upon reboot, ensuring persistence on a compromised system.
"""
from = "now-9m"
index = ["logs-endpoint.events.file*"]
language = "eql"
license = "Elastic License v2"
name = "Loadable Kernel Module Configuration File Creation"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Loadable Kernel Module Configuration File Creation

Loadable Kernel Modules (LKMs) are components that can be dynamically loaded into the Linux kernel to extend its functionality without rebooting. Adversaries exploit this by creating or altering LKM configuration files to ensure their malicious modules load at startup, achieving persistence. The detection rule identifies suspicious file creation or renaming activities in key directories, excluding benign processes, to flag potential threats.

### Possible investigation steps

- Review the file path and name to determine if it matches any known or expected LKM configuration files, focusing on paths like /etc/modules, /etc/modprobe.d/*, and others specified in the query.
- Examine the process executable responsible for the file creation or renaming to identify if it is a known or trusted application, especially if it is not in the list of excluded executables.
- Check the process name and executable path for any anomalies or signs of masquerading, particularly if they are not in the list of excluded names or paths.
- Investigate the user account associated with the process to determine if it has legitimate access or if it might be compromised.
- Correlate the event with other recent system activities to identify any patterns or additional suspicious behavior, such as other file modifications or network connections.
- Review system logs for any related entries that might provide additional context or evidence of malicious activity.
- Assess the risk and impact of the detected activity on the system's security posture and determine if further containment or remediation actions are necessary.

### False positive analysis

- System package managers like dpkg, rpm, and yum may trigger false positives when they update or install legitimate kernel modules. To handle this, exclude these processes by adding them to the exception list in the detection rule.
- Automated system management tools such as Puppet, Chef, and Ansible can create or modify LKM configuration files during routine operations. Exclude these processes by specifying their executables in the exception criteria.
- Temporary files created by text editors or system processes, such as those with extensions like swp or swx, can be mistaken for suspicious activity. Exclude these file extensions to reduce false positives.
- Processes running from specific directories like /nix/store or /snap may be part of legitimate software installations. Add these paths to the exclusion list to prevent unnecessary alerts.
- Scheduled tasks or cron jobs that involve file operations in the monitored directories might be flagged. Identify and exclude these processes by their names or paths to minimize false positives.

### Response and remediation

- Isolate the affected system from the network to prevent further propagation of the malicious loadable kernel module.
- Terminate any suspicious processes identified in the alert that are associated with the creation or modification of LKM configuration files.
- Remove or revert any unauthorized changes to LKM configuration files in the specified directories to prevent the malicious module from loading on reboot.
- Conduct a thorough scan of the system using updated antivirus or endpoint detection and response (EDR) tools to identify and remove any additional malicious components.
- Review system logs and the history of executed commands to identify the initial vector of compromise and any other affected systems.
- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if additional systems are compromised.
- Implement additional monitoring and alerting for similar suspicious activities to enhance detection and response capabilities for future incidents."""
risk_score = 47
rule_id = "6e2355cc-c60a-4d92-a80c-e54a45ad2400"
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: Linux",
    "Use Case: Threat Detection",
    "Tactic: Persistence",
    "Tactic: Defense Evasion",
    "Data Source: Elastic Defend",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"
query = '''
file where host.os.type == "linux" and event.action == "creation" and process.executable != null and
file.path like (
  "/etc/modules", "/etc/modprobe.d/*", "/run/modprobe.d/*", "/usr/local/lib/modprobe.d/*", "/usr/lib/modprobe.d/*",
  "/lib/modprobe.d/*", "/etc/modules-load.d/*", "/run/modules-load.d/*", "/usr/local/lib/modules-load.d/*",
  "/usr/lib/modules-load.d/*"
) and not (
  process.executable in (
    "/bin/dpkg", "/usr/bin/dpkg", "/bin/dockerd", "/usr/bin/dockerd", "/usr/sbin/dockerd", "/bin/microdnf",
    "/usr/bin/microdnf", "/bin/rpm", "/usr/bin/rpm", "/bin/snapd", "/usr/bin/snapd", "/bin/yum", "/usr/bin/yum",
    "/bin/dnf", "/usr/bin/dnf", "/bin/podman", "/usr/bin/podman", "/bin/dnf-automatic", "/usr/bin/dnf-automatic",
    "/bin/pacman", "/usr/bin/pacman", "/usr/bin/dpkg-divert", "/bin/dpkg-divert", "/sbin/apk", "/usr/sbin/apk",
    "/usr/local/sbin/apk", "/usr/bin/apt", "/usr/sbin/pacman", "/bin/podman", "/usr/bin/podman", "/usr/bin/puppet",
    "/bin/puppet", "/opt/puppetlabs/puppet/bin/puppet", "/usr/bin/chef-client", "/bin/chef-client",
    "/bin/autossl_check", "/usr/bin/autossl_check", "/proc/self/exe", "/dev/fd/*",  "/usr/bin/pamac-daemon",
    "/bin/pamac-daemon", "/usr/local/bin/dockerd", "/opt/elasticbeanstalk/bin/platform-engine",
    "/opt/puppetlabs/puppet/bin/ruby", "/usr/libexec/platform-python", "/opt/imunify360/venv/bin/python3",
    "/opt/eset/efs/lib/utild", "/usr/sbin/anacron", "/usr/bin/podman", "/kaniko/kaniko-executor", "/usr/bin/prime-select",
    "/usr/lib/dracut/dracut-install", "/usr/bin/dnf5", "./usr/bin/podman", "/usr/libexec/packagekitd", "/usr/bin/buildah",
    "./usr/lib/snapd/snap-update-ns", "/usr/lib/snapd/snapd", "/usr/local/bin/podman", "/usr/sbin/yum-cron",
    "./usr/bin/qemu-aarch64-static", "/.envbuilder/bin/envbuilder"
  ) or
  file.extension in ("swp", "swpx", "swx", "dpkg-remove") or
  file.Ext.original.extension == "dpkg-new" or
  process.executable like (
    "/nix/store/*", "/var/lib/dpkg/info/kmod.postinst", "/tmp/vmis.*", "/snap/*", "/dev/fd/*",
    "/usr/libexec/platform-python*", "./snap/snapd/*/snap-update-ns"
  ) or
  process.executable == null or
  process.name in (
    "crond", "executor", "puppet", "droplet-agent.postinst", "cf-agent", "schedd", "imunify-notifier", "perl",
    "jumpcloud-agent", "crio", "dnf_install", "utild", "dockerd"
  ) or
  process.name like "python*" or
  (process.name == "sed" and file.name : "sed*") or
  (process.name == "perl" and file.name : "e2scrub_all.tmp*")
)
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1547"
name = "Boot or Logon Autostart Execution"
reference = "https://attack.mitre.org/techniques/T1547/"

[[rule.threat.technique.subtechnique]]
id = "T1547.006"
name = "Kernel Modules and Extensions"
reference = "https://attack.mitre.org/techniques/T1547/006/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1014"
name = "Rootkit"
reference = "https://attack.mitre.org/techniques/T1014/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[metadata]
creation_date = "2026/03/23"
integration = ["microsoft_exchange_online_message_trace"]
maturity = "production"
updated_date = "2026/04/10"

[rule]
author = ["Elastic"]
description = """
Detects Azure Monitor alert notification emails with financial or billing themed subject lines delivered to organization
users. Adversaries abuse Azure Monitor alert rules to deliver callback phishing emails from Microsoft's legitimate
azure-noreply@microsoft.com address. Because the emails originate from Microsoft's own infrastructure, they pass SPF,
DKIM, and DMARC checks, bypassing email security filters and increasing victim trust. The attacker embeds a fraudulent
billing or security lure in the alert rule description, which is rendered in the notification email body. Observed
subject patterns include invoice numbers, payment references, and order confirmations.
"""
false_positives = [
    """
    Organizations that use Azure Monitor alert rules with financial or billing related naming conventions for legitimate
    infrastructure monitoring may trigger this rule. Review the email subject and recipient to determine if the alert
    originates from a known internal Azure subscription.
    """,
]
from = "now-9m"
language = "esql"
license = "Elastic License v2"
name = "M365 Azure Monitor Alert Email with Financial or Billing Theme"
note = """## Triage and analysis

### Investigating M365 Azure Monitor Alert Email with Financial or Billing Theme

Azure Monitor alert rules can be abused by adversaries to deliver callback phishing emails from Microsoft's legitimate `azure-noreply@microsoft.com` address. The attacker creates a metric or activity log alert in their own Azure tenant with a phishing lure embedded in the description field, then adds victim email addresses to an action group. When the alert fires, Microsoft sends the notification email — complete with the embedded lure — directly to the victims.

### Possible investigation steps

- Review the `email.subject` field to determine if the alert name matches known phishing patterns (e.g., `INV-`, `Payment Reference`, `order-`, `Funds Received`).
- Check the `email.to.address` field to identify which users received the email and whether they are high-value targets.
- Search for additional emails from `azure-noreply@microsoft.com` to the same recipient within a short time window. The attack typically sends both a "Fired" and "Resolved" notification, doubling phishing impressions.
- Look for an earlier "You're now in the X action group" notification email, which arrives before the phishing alert — this confirms the user was added to an external Azure Monitor action group.
- Check email message headers for the originating Azure subscription and resource group, which are embedded in the alert details.
- Contact the recipient to determine if they interacted with the email or called the phone number in the lure.
- If the victim called the number, initiate incident response for potential credential theft, payment fraud, or remote access tool installation.

### False positive analysis

- Legitimate Azure Monitor alerts with financial naming (e.g., a cost alert named "Invoice threshold exceeded") may match. Verify the alert originates from a known internal Azure subscription by examining the email body or message headers.
- Internal teams that name alert rules with billing-related terms for cost management should be documented as exceptions.

### Response and remediation

- If the email is confirmed as phishing, block the sender pattern and alert name in your email security gateway.
- Quarantine or delete the phishing emails from affected mailboxes.
- If the victim called the phone number, treat as a compromised account: reset credentials, revoke sessions, and audit for unauthorized access.
- Report the Azure subscription ID from the email headers to Microsoft abuse team for takedown.
- Consider implementing a mail flow rule to flag or quarantine Azure Monitor notification emails that contain phone numbers or financial language in the body.
"""
references = [
    "https://www.bleepingcomputer.com/news/security/microsoft-azure-monitor-alerts-abused-in-callback-phishing-campaigns/",
]
risk_score = 21
rule_id = "a6129187-c47b-48ab-a412-67a44836d918"
severity = "low"
tags = [
    "Domain: Cloud",
    "Domain: Email",
    "Data Source: Microsoft 365",
    "Data Source: Microsoft Exchange Online Message Trace",
    "Use Case: Threat Detection",
    "Tactic: Initial Access",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "esql"

query = '''
from logs-microsoft_exchange_online_message_trace.* metadata _id, _version, _index

// Filter for Azure Monitor notification emails with financial/billing themed subjects
| where data_stream.dataset == "microsoft_exchange_online_message_trace.log"
    and email.from.address == "azure-noreply@microsoft.com"
    and event.outcome in ("success", "unknown")
    and email.subject like "*Azure Monitor alert*"
    and (
        email.subject like "*INV-*"
        or email.subject like "*invoice*"
        or email.subject like "*payment*"
        or email.subject like "*order-*"
        or email.subject like "*purchase*"
        or email.subject like "*funds*"
        or email.subject like "*receipt*"
        or email.subject like "*billing*"
        or email.subject like "*transaction*"
        or email.subject like "*refund*"
        or email.subject like "*charge*"
        or email.subject like "*subscription*"
        or email.subject like "*renewal*"
        or email.subject like "*overdue*"
        or email.subject like "*past due*"
        or email.subject like "*amount due*"
        or email.subject like "*wire transfer*"
        or email.subject like "*bank account*"
        or email.subject like "*credit card*"
        or email.subject like "*financial*"
        or email.subject like "*remittance*"
    )

| keep *
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"
[[rule.threat.technique.subtechnique]]
id = "T1566.003"
name = "Spearphishing via Service"
reference = "https://attack.mitre.org/techniques/T1566/003/"



[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"

[metadata]
creation_date = "2024/03/24"
integration = ["endpoint"]
maturity = "production"
promotion = true
updated_date = "2025/07/02"

[rule]
author = ["Elastic"]
description = """
Generates a detection alert each time an Elastic Defend alert for memory signatures are received. Enabling this rule
allows you to immediately begin investigating your Endpoint memory signature alerts. This rule identifies Elastic Defend
memory signature detections only, and does not include prevention alerts.
"""
enabled = false
from = "now-2m"
index = ["logs-endpoint.alerts-*"]
interval = "1m"
language = "kuery"
license = "Elastic License v2"
max_signals = 1000
name = "Memory Threat - Detected - Elastic Defend"
note = """## Triage and analysis

### Investigating Memory Threat - Detected - Elastic Defend

Elastic Endpoint’s memory threat protection adds a layer of coverage for advanced attacks which avoid the traditional approach of writing payloads to disk. Instead, the malicious code runs only in-memory, an effective technique for evading legacy security products. There are currently two sub-categories of memory threat protection.

The first category is referred to as memory signatures and is available on all supported OS. It operates by periodically scanning process executable memory regions based on their activity to identify and terminate known bad malware.

The second category is referred to as shellcode thread and is unique to Windows endpoints today. A common technique of in-memory malware is to load the payload in a memory region not backed by a file on disk and create a thread to execute it.


### Possible investigation steps

- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts :
   - For shellcode alerts, the key for bucketing alerts is stored in the `Memory_protection.unique_key_v1` field.
   - For Memory signature alerts, bucket based on the signatures which match `rule.name`.
- Examine the following fields if there are any matches on known Yara signatures:
  - `process.Ext.memory_region.malware_signature.all_names`
  - `Target.process.Ext.memory_region.malware_signature.all_names`
  - `process.Ext.memory_region.malware_signature.primary.signature.name`
- Review the memory region strings for any suspicious or unique keywords captured in `process.Ext.memory_region.strings` and `Target.process.Ext.memory_region.strings`.
- For signature matches review the `process.Ext.memory_region.malware_signature.primary.matches` and `process.Ext.memory_region.malware_signature.secondary.matches` to understand which keywords or byte sequences matched on the memory Yara signature.
- For shellcode alerts, check the field `Memory_protection.self_injection` value, if it's false it means it's a remote shellcode injection and you need to review the Target process details like `Target.process.executable` fields.
- Even if the acting process is signed, review any unsigned or suspicious loaded libraries (adversaries may use `DLL Side-Loading`) captured in:
  - `process.thread.Ext.call_stack.module_path`
  - `process.Ext.dll.path and process.Ext.dll.hash.sha256`
  - `Target.process.Ext.dll.hash.sha256`
  - `Target.process.Ext.dll.path`
- If you have access to VirusTotal of similar services, you can also perform vGrep searches to look for files with bytes matching on `process.thread.Ext.start_address_bytes` or `Target.process.thread.Ext.start_address_bytes`.
- Investigate any abnormal behavior by the subject process, such as network connections, registry or file modifications, and any spawned child processes.

### False positive analysis

- False positives may include Yara signature matches on generic keywords or some third party softwares performing code injection (often all involved files are signed and by the same vendor).

### Response and Remediation

- Initiate the incident response process based on the outcome of the triage.
  - If malicious activity is confirmed, perform a broader investigation to identify the scope of the compromise and determine the appropriate remediation steps.
- Implement Elastic Endpoint Security to detect and prevent further post exploitation activities in the environment.
   - Contain the affected system by isolating it from the network to prevent further spread of the attack.
- If the triage identified malware, search the environment for additional compromised hosts.
  - Implement temporary network rules, procedures, and segmentation to contain the malware.
  - Stop suspicious processes.
  - Immediately block the identified indicators of compromise (IoCs).
  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
- Remove and block malicious artifacts identified during triage.
- Restore the affected system to its operational state by applying any necessary patches, updates, or configuration changes.
- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
"""
references = [
    "https://github.com/elastic/protections-artifacts/tree/main/yara",
    "https://docs.elastic.co/en/integrations/endpoint",
]
risk_score = 73
rule_id = "017de1e4-ea35-11ee-a417-f661ea17fbce"
rule_name_override = "message"
setup = """## Setup

### Elastic Defend Alerts
This rule is designed to capture specific alerts generated by Elastic Defend.

To capture all the Elastic Defend alerts, it is recommended to use all of the Elastic Defend feature-specific protection rules:

Behavior - Detected - Elastic Defend (UUID: 0f615fe4-eaa2-11ee-ae33-f661ea17fbce)
Behavior - Prevented - Elastic Defend (UUID: eb804972-ea34-11ee-a417-f661ea17fbce)
Malicious File - Detected - Elastic Defend (UUID: f2c3caa6-ea34-11ee-a417-f661ea17fbce)
Malicious File - Prevented - Elastic Defend (UUID: f87e6122-ea34-11ee-a417-f661ea17fbce)
Memory Threat - Detected - Elastic Defend (UUID: 017de1e4-ea35-11ee-a417-f661ea17fbce)
Memory Threat - Prevented - Elastic Defend (UUID: 06f3a26c-ea35-11ee-a417-f661ea17fbce)
Ransomware - Detected - Elastic Defend (UUID: 0c74cd7e-ea35-11ee-a417-f661ea17fbce)
Ransomware - Prevented - Elastic Defend (UUID: 10f3d520-ea35-11ee-a417-f661ea17fbce)

To avoid generating duplicate alerts, you should enable either all feature-specific protection rules or the Endpoint Security (Elastic Defend) rule (UUID: 9a1a2dae-0b5f-4c3d-8305-a268d404c306).

### Additional notes

For information on troubleshooting the maximum alerts warning please refer to this [guide](https://www.elastic.co/guide/en/security/current/alerts-ui-monitor.html#troubleshoot-max-alerts).
"""
severity = "high"
tags = ["Data Source: Elastic Defend", "Tactic: Defense Evasion", "Resources: Investigation Guide"]
timestamp_override = "event.ingested"
type = "query"

query = '''
event.kind : alert and event.code : (memory_signature or shellcode_thread) and (event.type : allowed or (event.type: denied and event.outcome: failure))
'''


[[rule.exceptions_list]]
id = "endpoint_list"
list_id = "endpoint_list"
namespace_type = "agnostic"
type = "endpoint"

[[rule.risk_score_mapping]]
field = "event.risk_score"
operator = "equals"
value = ""

[[rule.severity_mapping]]
field = "event.severity"
operator = "equals"
severity = "low"
value = "21"

[[rule.severity_mapping]]
field = "event.severity"
operator = "equals"
severity = "medium"
value = "47"

[[rule.severity_mapping]]
field = "event.severity"
operator = "equals"
severity = "high"
value = "73"

[[rule.severity_mapping]]
field = "event.severity"
operator = "equals"
severity = "critical"
value = "99"

[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"

[[rule.threat.technique]]
id = "T1620"
name = "Reflective Code Loading"
reference = "https://attack.mitre.org/techniques/T1620/"


[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[metadata]
creation_date = "2026/01/09"
integration = ["endpoint"]
maturity = "production"
updated_date = "2026/03/24"

[rule]
author = ["Elastic"]
building_block_type = "default"
description = """
Detects Ollama DNS queries to domains outside official infrastructure. Adversaries can redirect Ollama to pull models
from attacker-controlled servers via OLLAMA_HOST or custom manifests. Malicious models may contain backdoors, exploit
parsing vulnerabilities like CVE-2025-1975, or poison inference outputs.
"""
from = "now-119m"
index = ["logs-endpoint.events.network-*"]
interval = "60m"
language = "eql"
license = "Elastic License v2"
name = "Ollama DNS Query to Untrusted Domain"
references = [
    "https://www.greynoise.io/blog/threat-actors-actively-targeting-llms",
    "https://atlas.mitre.org/techniques/AML.T0010.003",
    "https://nvd.nist.gov/vuln/detail/CVE-2025-1975",
]
risk_score = 21
rule_id = "e9a3b2c1-d4f5-6789-0abc-def123456789"
severity = "low"
tags = [
    "Domain: Endpoint",
    "OS: Linux",
    "OS: macOS",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Command and Control",
    "Data Source: Elastic Defend",
    "Domain: LLM",
    "Mitre Atlas: T0010.003",
    "Rule Type: BBR",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
network where event.action == "lookup_requested" and
  process.name in ("ollama", "ollama.exe") and
  dns.question.name != null and
  not dns.question.name : (
    "ollama.ai", "*.ollama.ai", "ollama.com", "*.ollama.com",
    "github.com", "*.github.com", "*.githubusercontent.com",
    "*.r2.cloudflarestorage.com", "*.cloudflare.com", "*.cloudflarestorage.com",
    "localhost", "*.local", "*.internal", "*.localdomain"
  )
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1105"
name = "Ingress Tool Transfer"
reference = "https://attack.mitre.org/techniques/T1105/"

[rule.threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1195"
name = "Supply Chain Compromise"
reference = "https://attack.mitre.org/techniques/T1195/"

[[rule.threat.technique.subtechnique]]
id = "T1195.001"
name = "Compromise Software Dependencies and Development Tools"
reference = "https://attack.mitre.org/techniques/T1195/001/"

[[rule.threat.technique.subtechnique]]
id = "T1195.002"
name = "Compromise Software Supply Chain"
reference = "https://attack.mitre.org/techniques/T1195/002/"

[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"

[metadata]
creation_date = "2020/12/18"
integration = ["endpoint"]
maturity = "production"
updated_date = "2026/03/24"

[rule]
author = ["Elastic"]
description = """
An adversary can establish persistence by modifying an existing macOS dock property list in order to execute a malicious
application instead of the intended one when invoked.
"""
from = "now-9m"
index = ["logs-endpoint.events.*"]
language = "eql"
license = "Elastic License v2"
name = "Persistence via Docker Shortcut Modification"
references = [
    "https://github.com/specterops/presentations/raw/master/Leo%20Pitt/Hey_Im_Still_in_Here_Modern_macOS_Persistence_SO-CON2020.pdf",
]
risk_score = 47
rule_id = "c81cefcb-82b9-4408-a533-3c3df549e62d"
setup = """## Setup

This rule requires data coming in from Elastic Defend.

### Elastic Defend Integration Setup
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.

#### Prerequisite Requirements:
- Fleet is required for Elastic Defend.
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).

#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
- Go to the Kibana home page and click "Add integrations".
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
- Click "Add Elastic Defend".
- Configure the integration name and optionally add a description.
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
- Click "Save and Continue".
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
"""
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: macOS",
    "Use Case: Threat Detection",
    "Tactic: Persistence",
    "Data Source: Elastic Defend",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
file where host.os.type == "macos" and event.action == "modification" and
 file.path like "/Users/*/Library/Preferences/com.apple.dock.plist" and
 ((process.name like~ ("osascript", "python*", "sh", "bash", "zsh", "node") or Effective_process.name like~ ("osascript", "python*", "sh", "bash", "zsh", "node")) or
  (process.code_signature.exists == false or process.code_signature.trusted == false))
'''
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Persistence via Docker Shortcut Modification

Docker shortcuts on macOS are managed through dock property lists, which define application launch behaviors. Adversaries may exploit this by altering these lists to redirect shortcuts to malicious applications, thus achieving persistence. The detection rule identifies unauthorized modifications to these property lists, excluding legitimate processes, to flag potential threats. This approach helps in pinpointing suspicious activities that could indicate persistence mechanisms being established by attackers.

### Possible investigation steps

- Review the alert details to identify the specific file path and process name involved in the modification of the com.apple.dock.plist file.
- Examine the process that triggered the alert by checking its parent process, command line arguments, and execution history to determine if it is associated with known malicious activity.
- Investigate the user account associated with the file modification to determine if there are any signs of compromise or unauthorized access.
- Check for any recent changes or anomalies in the user's environment, such as new applications installed or unexpected network connections, that could indicate further malicious activity.
- Correlate the event with other security alerts or logs from the same host to identify any patterns or additional indicators of compromise.
- If possible, restore the original com.apple.dock.plist file from a backup to ensure the system's integrity and prevent the execution of any malicious applications.

### False positive analysis

- Legitimate software updates or installations may modify the dock property list. Users can create exceptions for known update processes like software management tools to prevent false alerts.
- System maintenance tasks performed by macOS utilities might trigger the rule. Exclude processes such as cfprefsd and plutil, which are involved in regular system operations, to reduce noise.
- Custom scripts or automation tools that modify user preferences could be flagged. Identify and whitelist these scripts if they are part of routine administrative tasks.
- Security or IT management tools like Jamf or Kandji may interact with dock property lists. Ensure these tools are included in the exclusion list to avoid unnecessary alerts.
- User-initiated changes to dock settings can also be mistaken for malicious activity. Educate users on the implications of modifying dock settings and monitor for patterns that deviate from normal behavior.

### Response and remediation

- Immediately isolate the affected macOS system from the network to prevent further malicious activity or lateral movement.
- Terminate any suspicious processes identified as modifying the dock property list, especially those not matching legitimate process names or executables.
- Restore the original com.apple.dock.plist file from a known good backup to ensure the dock shortcuts are not redirecting to malicious applications.
- Conduct a thorough scan of the system using updated antivirus or endpoint detection tools to identify and remove any additional malicious software.
- Review and audit user accounts and permissions on the affected system to ensure no unauthorized access or privilege escalation has occurred.
- Implement monitoring for any future unauthorized modifications to dock property lists, ensuring alerts are configured for quick response.
- Escalate the incident to the security operations team for further investigation and to determine if additional systems may be affected."""


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1543"
name = "Create or Modify System Process"
reference = "https://attack.mitre.org/techniques/T1543/"

[[rule.threat.technique]]
id = "T1547"
name = "Boot or Logon Autostart Execution"
reference = "https://attack.mitre.org/techniques/T1547/"

[[rule.threat.technique.subtechnique]]
id = "T1547.009"
name = "Shortcut Modification"
reference = "https://attack.mitre.org/techniques/T1547/009/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[rule]
description = """
Identifies an unusual process accessing Users Windows Credential History File. The CREDHIST file contains previous
password related master key hashes used by Microsoft's DPAPI. Adversaries may acquire credentials from the Windows
Credential Manager.
"""
id = "ce8a6302-7248-457a-8427-3d6bad14e2f0"
license = "Elastic License v2"
name = "Potential Credential Access via Windows Credential History"
os_list = ["windows"]
reference = ["http://www.harmj0y.net/blog/redteaming/operational-guidance-for-offensive-user-dpapi-abuse/"]
version = "1.0.30"

query = '''
file where event.action == "open" and
   /* Credentials History */
  file.path : "?:\\Users\\*\\AppData\\*\\Microsoft\\Protect\\CREDHIST" and
  user.id : ("S-1-5-21*", "S-1-12-*") and process.executable : "?:\\*" and
  /* third party programs and noisy native system processes */
  not process.executable :
          ("?:\\Program Files\\*",
           "?:\\Program Files (x86)\\*",
           "?:\\Windows\\System32\\lsass.exe",
           "?:\\Windows\\System32\\svchost.exe",
           "?:\\Windows\\System32\\Robocopy.exe",
           "?:\\Windows\\ccmcache\\*.exe",
           "?:\\Windows\\CCM\\*.exe",
           "?:\\Windows\\explorer.exe",
           "?:\\ProgramData\\Microsoft\\Windows Defender\\*.exe",
           "?:\\Windows\\explorer.exe",
           "?:\\Windows\\System32\\WerFault.exe",
           "?:\\Windows\\SysWOW64\\WerFault.exe",
           "?:\\Windows\\System32\\dllhost.exe",
           "?:\\Windows\\System32\\sdclt.exe",
           "?:\\Windows\\System32\\PickerHost.exe",
           "?:\\Windows\\System32\\MRT.exe",
           "?:\\Windows\\System32\\xcopy.exe",
           "?:\\Users\\*\\AppData\\Local\\Programs\\Git\\usr\\bin\\find.exe",
           "?:\\Users\\*\\git\\usr\\bin\\grep.exe",
           "?:\\Users\\*\\AppData\\Local\\Programs\\Microsoft VS Code\\*\\resources\\app\\node_modules\\@vscode\\ripgrep\\bin\\rg.exe",
           "?:\\Windows\\System32\\Dism.exe") and
  not (process.code_signature.subject_name in ("ForensiT Limited", "Anysphere, Inc.", "Anthropic, PBC", "Open Source Developer, Bryan Berns", "JetBrains s.r.o.", "QUICK HEAL TECHNOLOGIES LIMITED") and process.code_signature.trusted == true)
'''

min_endpoint_version = "8.0.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1555"
name = "Credentials from Password Stores"
reference = "https://attack.mitre.org/techniques/T1555/"
[[threat.technique.subtechnique]]
id = "T1555.004"
name = "Windows Credential Manager"
reference = "https://attack.mitre.org/techniques/T1555/004/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "8.0.0"

[rule]
description = """
Identifies when a process running as protected process loads an unsigned DLL. This may indicate an attempt to bypass
Process Protection and inject malicious code.
"""
id = "e8ed06c7-3a70-40a7-85a5-4fc6a2203fce"
license = "Elastic License v2"
name = "Potential Protected Process DLL Injection via RPC"
os_list = ["windows"]
reference = [
    "https://www.elastic.co/blog/protecting-windows-protected-processes",
    "https://github.com/Slowerzs/PPLSystem/tree/main",
]
version = "1.0.3"

query = '''
library where dll.Ext.defense_evasions : "Process Tampering: Code integrity violation" and
  process.thread.Ext.call_stack_summary : "ntdll.dll|rpcrt4.dll|combase.dll|*"
'''

min_endpoint_version = "8.7.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1211"
name = "Exploitation for Defense Evasion"
reference = "https://attack.mitre.org/techniques/T1211/"

[[threat.technique]]
id = "T1574"
name = "Hijack Execution Flow"
reference = "https://attack.mitre.org/techniques/T1574/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.7.0"

[metadata]
creation_date = "2020/09/01"
integration = ["endpoint", "windows", "m365_defender", "crowdstrike"]
maturity = "production"
updated_date = "2026/04/29"

[rule]
author = ["Elastic"]
description = """
Identifies renamed automation script interpreter processes, including AutoIt, AutoHotkey, and KIX32. Malware operators
may rename these executables to avoid detection.
"""
from = "now-9m"
index = [
    "winlogbeat-*",
    "logs-endpoint.events.process-*",
    "logs-windows.sysmon_operational-*",
    "endgame-*",
    "logs-m365_defender.event-*",
    "logs-crowdstrike.fdr*",
]
language = "eql"
license = "Elastic License v2"
name = "Renamed Automation Script Interpreter"
risk_score = 73
rule_id = "2e1e835d-01e5-48ca-b9fc-7a61f7f11902"
severity = "high"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Defense Evasion",
    "Data Source: Elastic Endgame",
    "Resources: Investigation Guide",
    "Data Source: Elastic Defend",
    "Data Source: Sysmon",
    "Data Source: Microsoft Defender XDR",
    "Data Source: Crowdstrike"
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
process where host.os.type == "windows" and event.type == "start" and
  (
   (process.pe.original_file_name : "AutoIt*.exe" and not process.name : "AutoIt*.exe") or
   (process.pe.original_file_name == "AutoHotkey.exe" and not process.name : ("AutoHotkey*.exe", "InternalAHK.exe")) or
   (process.pe.original_file_name == "KIX32.EXE" and not process.name : "KIX*.exe" and process.executable : ("?:\\Users\\*.exe", "?:\\ProgramData\\*.exe", "\\Device\\HarddiskVolume*\\Users\\*.exe", "\\Device\\HarddiskVolume*\\ProgramData\\*.exe"))
   )
'''

note = """## Triage and analysis

### Investigating Renamed Automation Script Interpreter
#### Possible investigation steps

- Which interpreter family and masquerade path did the alert capture?
  - Why: the PE original-name/runtime-name mismatch is decisive, and AutoIt, AutoHotkey, and KIX32 have different normal baselines.
  - Focus: `process.pe.original_file_name`, `process.name`, `process.executable`, and `process.command_line`.
  - Implication: escalate when AutoIt, AutoHotkey, or KIX32 identity is hidden by a misleading name, recent rename, or user-writable path, especially KIX32 under Users or ProgramData; lower suspicion when family, path, and command line fit one stable packaged automation or logon-script bundle.
  - Hint: variants may strip PE original-name metadata or run under the expected interpreter name; if path or command line still points to AutoIt, AutoHotkey, or KIX content, keep reviewing lineage and artifacts.

- Is the binary identity consistent with a recognized interpreter package or a repackaged copy?
  - Focus: `process.hash.sha256`, `process.code_signature.subject_name`, `process.code_signature.trusted`, and `process.executable`.
  - Implication: escalate when signer, hash, or path is unknown, untrusted, or inconsistent with AutoIt, AutoHotkey, or KIX32 packaging; lower suspicion only when identity, path, parent, and command line fit one recognized package. Trusted identity does not clear suspicious use.

- Does the launch context explain why the interpreter ran under this name?
  - Focus: `process.parent.executable`, `process.parent.command_line`, `process.command_line`, `user.id`, and `host.id`.
  - Implication: escalate when Office, browsers, archive tools, LOLBins, or unusual admin or service contexts launch it, or when arguments point to hidden A3X, AHK, KIX, or payload execution; lower suspicion when parent, user, host, and arguments match recurring deployment, logon-script, or packaging workflow.

- Did the same process stage or touch script or payload artifacts?
  - Focus: file events from `host.id` plus `process.entity_id`, and script or payload paths in `process.command_line`. $investigate_0
  - Implication: escalate when the process writes, extracts, renames, or runs scriptable or executable content from temp, downloads, user-profile, or share-backed paths, or with internet provenance; lower suspicion when artifacts stay inside one recognized package tree. Missing file telemetry is unresolved, not benign.
  - Hint: if `process.entity_id` is absent, recover with `host.id`, `process.pid`, and the tight alert window.

- Did the renamed interpreter produce follow-on execution, persistence, or egress?
  - Focus: child process events from `process.entity_id`; same-process registry or network activity. $investigate_1 $investigate_2
  - Implication: escalate when it spawns shells or script engines, writes autorun or service state, or contacts rare external destinations; lower suspicion when follow-on activity stays inside the same bounded automation task. Missing registry or network telemetry is unresolved, not benign.
  - Hint: if `process.entity_id` is absent, recover with `host.id`, `process.pid`, and the tight alert window.

- If local findings remain suspicious or unresolved, do related alerts show broader compromise?
  - Focus: related alerts for `user.id`, especially masquerading, script-interpreter, persistence, or credential-access activity. $investigate_3
  - Hint: compare `host.id` alerts for the same interpreter path, renamed binaries, or adjacent defense-evasion activity. $investigate_4
  - Implication: broaden scope when either view shows related masquerading, staging, persistence, or post-compromise behavior; keep local when related alerts are absent and all local evidence fits one stable automation workflow.

- Escalate on PE/name mismatch plus suspicious lineage, staging, persistence, egress, or related alerts; close only when path, parent, user, host, artifacts, and activity bind to one stable benign workflow with no contradictions; preserve artifacts and escalate when evidence is mixed or visibility is incomplete.

### False positive analysis

- Software packaging, endpoint automation, KIX logon-script deployment, or authorized testing can rename AutoIt, AutoHotkey, or KIX32 interpreters inside a stable bundle. Confirm `process.pe.original_file_name`, `process.hash.sha256` or `process.code_signature.subject_name`, `process.executable`, `process.parent.executable`, `process.command_line`, `user.id`, and `host.id` align with one workflow; recovered artifacts or destinations should stay bounded to it, and missing telemetry is not benign evidence.
- Before creating an exception, validate the workflow locally and check recurrence for stable anchors: `process.executable`, `process.hash.sha256` or `process.code_signature.subject_name`, `process.parent.executable`, `user.id`, and `host.id`. Build the minimum pattern and avoid exceptions on `process.pe.original_file_name`, `process.name`, or `host.id` alone.

### Response and remediation

- If confirmed benign, reverse temporary containment and document the exact workflow evidence: interpreter family, executable path, hash or signer, parent executable, user, host, and artifact scope. Create an exception only after that same pattern recurs across prior alerts from this rule.
- If suspicious but unconfirmed, preserve the process event, executable copy or hash, parent and child lineage, referenced scripts or payloads, and any recovered registry or destination indicators before containment or cleanup. Apply reversible containment tied to the finding, such as temporary destination restrictions, heightened monitoring, or host isolation only when payload delivery, persistence, or egress risk is meaningful.
- If confirmed malicious, preserve the renamed interpreter `process.entity_id`, command line, executable hash or signer, child processes, and recovered artifacts first. Then isolate the affected host when identity, lineage, artifact, persistence, or egress evidence shows active compromise, weighing host criticality before isolation.
- Before eradication, scope related users and hosts for the same executable path, parent, script or payload paths, persistence keys, and destinations so cleanup does not destroy evidence needed to understand spread.
- Quarantine the renamed interpreter, associated scripts, and extracted support files identified during triage; remove only persistence or launcher artifacts confirmed in this case; block confirmed malicious hashes or destinations tied to the same activity.
- After containment, retain the confirmed workflow or malicious artifact set for future triage and avoid suppressing the broader AutoIt, AutoHotkey, or KIX32 interpreter families.
"""

setup = """## Setup

This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.

Setup instructions: https://ela.st/install-elastic-defend

### Additional data sources

This rule also supports the following third-party data sources. For setup instructions, refer to the links below:

- [CrowdStrike](https://ela.st/crowdstrike-integration)
- [Microsoft Defender XDR](https://ela.st/m365-defender)
- [Sysmon Event ID 1 - Process Creation](https://ela.st/sysmon-event-1-setup)
"""

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "host.id",
    "user.id",
    "process.entity_id",
    "process.pid",
    "process.name",
    "process.executable",
    "process.command_line",
    "process.pe.original_file_name",
    "process.hash.sha256",
    "process.code_signature.trusted",
    "process.code_signature.subject_name",
    "process.parent.entity_id",
    "process.parent.executable",
    "process.parent.command_line",
]

[transform]

[[transform.investigate]]
label = "File activity by the renamed interpreter"
description = ""
providers = [
  [
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" },
    { excluded = false, field = "event.category", queryType = "phrase", value = "file", valueType = "string" }
  ]
]
relativeFrom = "now-1h"
relativeTo = "now"

[[transform.investigate]]
label = "Child process activity from the renamed interpreter"
description = ""
providers = [
  [
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "process.parent.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" },
    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" },
    { excluded = false, field = "event.type", queryType = "phrase", value = "start", valueType = "string" }
  ]
]
relativeFrom = "now-1h"
relativeTo = "now"

[[transform.investigate]]
label = "Registry or network activity by the renamed interpreter"
description = ""
providers = [
  [
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" },
    { excluded = false, field = "event.category", queryType = "phrase", value = "registry", valueType = "string" }
  ],
  [
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" },
    { excluded = false, field = "event.category", queryType = "phrase", value = "network", valueType = "string" }
  ]
]
relativeFrom = "now-1h"
relativeTo = "now"

[[transform.investigate]]
label = "Alerts associated with the user"
description = ""
providers = [
  [
    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
    { excluded = false, field = "user.id", queryType = "phrase", value = "{{user.id}}", valueType = "string" }
  ]
]
relativeFrom = "now-48h/h"
relativeTo = "now"

[[transform.investigate]]
label = "Alerts associated with the host"
description = ""
providers = [
  [
    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" }
  ]
]
relativeFrom = "now-48h/h"
relativeTo = "now"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1036"
name = "Masquerading"
reference = "https://attack.mitre.org/techniques/T1036/"

[[rule.threat.technique.subtechnique]]
id = "T1036.003"
name = "Rename Legitimate Utilities"
reference = "https://attack.mitre.org/techniques/T1036/003/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"

[[rule.threat.technique.subtechnique]]
id = "T1059.010"
name = "AutoHotKey & AutoIT"
reference = "https://attack.mitre.org/techniques/T1059/010/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[rule]
description = "Identifies attempts to disable Windows Defender via registering a rogue anti-virus."
id = "38deccde-475d-4d1d-a4a2-50168fdc6c18"
license = "Elastic License v2"
name = "Suspicious Antivirus Registration"
os_list = ["windows"]
reference = ["https://blog.es3n1n.eu/posts/how-i-ruined-my-vacation/"]
version = "1.0.3"

query = '''
registry where event.action == "modification" and process.executable : "C:\\Windows\\System32\\svchost.exe" and
 registry.value : "REPORTINGEXE" and registry.path : "HKLM\\SOFTWARE\\Microsoft\\Security Center\\Provider\\Av\\{*}\\REPORTINGEXE" and
 registry.data.strings : "C:\\Windows\\System32\\*.exe"
'''

min_endpoint_version = "8.10.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1112"
name = "Modify Registry"
reference = "https://attack.mitre.org/techniques/T1112/"

[[threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"

[rule]
description = """
Detects the use of specific commandline arguments that can be used with certain Electron based applications to covertly
execute code for a variety of purposes.
"""
id = "1f1b8910-e6b3-4d9d-9bf0-7a7728f5bce6"
license = "Elastic License v2"
name = "Suspicious Electron Command Execution"
os_list = ["macos"]
reference = ["https://medium.com/@MalFuzzer/one-electron-to-rule-them-all-dc2e9b263daf"]
version = "1.0.11"

query = '''
sequence with maxspan=15s
[process where event.type == "start" and event.action == "exec"  and 
  process.command_line like~ ("*--gpu-launcher=?*", 
                             "*--utility-cmd-prefix=?*", 
                             "*--browser-subprocess-path=?*", 
                             "*--renderer-cmd-prefix=?*") and
  not process.command_line like~ "*--browser-subprocess-path=/Users/*Chromium Helper*"] by process.entity_id
[process where event.type == "start" and event.action == "exec"] by process.parent.entity_id
'''

min_endpoint_version = "8.10.2"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "8.10.2"

[rule]
description = """
Detects when the ScreenCapture binary executes and creates an image in a suspicious location like tmp or the shared
directory. Malware has used the ScreenCapture binary to collect images of victim systems and exfiltrate them via C2.
"""
id = "0701ab8c-9abc-41e1-8af7-2d937778e73f"
license = "Elastic License v2"
name = "Suspicious Image Creation via ScreenCapture"
os_list = ["macos"]
version = "1.0.10"

query = '''
sequence by process.entity_id with maxspan=10s
[process where event.type == "start" and event.action == "exec" and process.name == "screencapture" and
  not process.command_line == "screencapture --help" and
  not process.parent.executable like ("/System/Library/CoreServices/SystemUIServer.app/Contents/MacOS/SystemUIServer",
                                      "/System/Library/CoreServices/loginwindow.app/Contents/MacOS/loginwindow") and
  not process.Ext.effective_parent.executable like ("/System/Library/CoreServices/SystemUIServer.app/Contents/MacOS/SystemUIServer",
                                                    "/System/Library/CoreServices/loginwindow.app/Contents/MacOS/loginwindow",
                                                    "/Applications/Visual Studio Code.app/*",
                                                    "/Applications/Cursor.app/*",
                                                    "/Applications/Claude.app/*",
                                                    "/Applications/Ghostty.app/*",
                                                    "/Applications/IntelliJ IDEA.app/*",
                                                    "/Users/*/Applications/Codex.app/*",
                                                    "/Users/*/Library/Application Support/Claude/claude-code/*/claude.app/*",
                                                    "/Applications/Codex.app/*",
                                                    "/private/var/folders/*/AppTranslocation/*/Visual Studio Code.app/*",
                                                    "/Users/*/.local/bin/uv",
                                                    "/Applications/Warp.app/*",
                                                    "/Applications/Obsidian.app/*",
                                                    "/Applications/Tabby.app/*",
                                                    "/Applications/Android Studio.app/Contents/MacOS/studio",
                                                    "/Applications/Zed.app/Contents/MacOS/zed",
                                                    "/Applications/WebStorm.app/*")]
[file where event.action == "modification" and file.path like ("/Users/Shared/*", "/tmp/*", "/private/tmp/*")]
'''

min_endpoint_version = "8.11.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1113"
name = "Screen Capture"
reference = "https://attack.mitre.org/techniques/T1113/"


[threat.tactic]
id = "TA0009"
name = "Collection"
reference = "https://attack.mitre.org/tactics/TA0009/"

[internal]
min_endpoint_version = "8.11.0"