Elastic rules: 04

[rule]
description = """
Identifies access attempt to read the Windows Passwords Vault credentials by an unusual process. Adversaries may acquire
credentials from Vault files.
"""
id = "7ca8574b-b4f3-42c4-9314-521df1b4c942"
license = "Elastic License v2"
name = "Access to Windows Passwords Vault by Unusual Process"
os_list = ["windows"]
reference = [
    "https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5382",
    "https://www.elastic.co/security-labs/detect-credential-access",
]
version = "1.0.7"

query = '''
any where event.category == "iam" and event.action in ("vault_credentials_read", "vault-credentials-were-read") and
 process.parent.executable != null and user.id != "S-1-5-18" and process.executable != null and
 (process.code_signature.trusted == false or
  process.code_signature.exists == false or
  process.code_signature.subject_name in ("Microsoft Corporation", "Microsoft Windows")) and
 not (process.parent.executable : "C:\\Windows\\System32\\svchost.exe" and process.executable : "?:\\Windows\\*.exe") and
 not (process.executable : ("?:\\Windows\\System32\\svchost.exe", "?:\\Windows\\System32\\sppsvc.exe") and process.parent.executable : "?:\\Windows\\System32\\services.exe") and
 not (process.executable : "C:\\Windows\\System32\\msiexec.exe" and process.parent.executable : "C:\\Windows\\System32\\msiexec.exe") and
 not (process.name : "rundll32.exe" and process.command_line : "*inetcpl.cpl,ClearMyTracksByProcess*") and
 not (process.executable : "?:\\Windows\\System32\\rundll32.exe" and process.parent.executable : ("?:\\Program Files (x86)\\*.exe", "?:\\Program Files\\*.exe")) and
 not (process.executable : "?:\\Windows\\System32\\rundll32.exe" and process.parent.executable : ("?:\\Windows\\System32\\rundll32.exe", "?:\\Windows\\System32\\cmd.exe")) and
 not (process.executable : "?:\\Windows\\System32\\backgroundTaskHost.exe" and process.parent.executable : "?:\\Windows\\System32\\svchost.exe") and
 not (process.executable : "C:\\Windows\\explorer.exe" and process.parent.executable : "C:\\Windows\\System32\\userinit.exe") and
 not process.executable :
                ("?:\\Program Files\\*.exe",
                 "?:\\Program Files (x86)\\*.exe",
                 "?:\\Windows\\System32\\conhost.exe",
                 "?:\\ProgramData\\Motorola Solutions\\Flex\\application\\FlexClient\\FlexClient.exe") and
 not process.parent.executable :
                           ("C:\\Program Files\\Windows Defender Advanced Threat Protection\\SenseIR.exe",
                            "C:\\Program Files (x86)\\Microsoft Intune Management Extension\\AgentExecutor.exe",
                            "C:\\Program Files\\WindowsApps\\KeeperSecurityInc.KeeperPasswordManager_*\\app\\keeperpasswordmanager.exe",
                            "C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\officesvcmgr.exe") and
 not (process.executable : ("C:\\Users\\*\\AppData\\Local\\PowerToys\\WinUI3Apps\\PowerToys.*.exe",
                            "C:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\*\\OneDriveActionHelper.exe",
                            "C:\\Users\\*\\AppData\\Local\\Microsoft\\Edge SxS\\Application\\msedge.exe") and
      process.code_signature.subject_name == "Microsoft Corporation" and process.code_signature.trusted == true)
'''

min_endpoint_version = "8.18.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1555"
name = "Credentials from Password Stores"
reference = "https://attack.mitre.org/techniques/T1555/"
[[threat.technique.subtechnique]]
id = "T1555.004"
name = "Windows Credential Manager"
reference = "https://attack.mitre.org/techniques/T1555/004/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "8.18.0"

[metadata]
creation_date = "2020/05/21"
integration = ["aws"]
maturity = "production"
updated_date = "2026/08/05"

[rule]
author = ["Elastic"]
description = """
Identifies the deletion of an AWS Web Application Firewall (WAF) Web ACL. Web ACLs are the core enforcement objects in
AWS WAF, defining which traffic is inspected, allowed, or blocked for protected applications. Deleting a Web ACL removes
all associated rules, protections, and logging configurations. Adversaries who obtain sufficient privileges may delete a
Web ACL to disable critical security controls, evade detection, or prepare for downstream attacks such as
web-application compromise, data theft, or resource abuse. Because Web ACLs are rarely deleted outside of controlled
maintenance or infrastructure updates, unexpected deletions may indicate potential defense evasion.
"""
false_positives = [
    """
    Authorized administrators may delete Web ACLs as part of planned migrations, infrastructure refactoring, or
    automation-driven redeployments. Ensure the deletion aligns with approved change requests, maintenance windows, or
    known IaC workflows. Deletions performed by unfamiliar users, unusual identities, or unexpected automation should be
    investigated.
    """,
]
from = "now-6m"
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
language = "kuery"
license = "Elastic License v2"
name = "AWS WAF Access Control List Deletion"
note = """## Triage and analysis

### Investigating AWS WAF Access Control List Deletion

AWS Web Application Firewall (WAF) protects applications by inspecting HTTP/S traffic and applying rule groups,
managed rule sets, and custom logic to block or allow requests. A Web ACL is the primary enforcement object that binds
these protections to CloudFront distributions, Application Load Balancers, API Gateway stages, and AppSync APIs.

Deleting a Web ACL immediately removes all protections and logging associated with that application entry point.
Because this action can expose applications to direct exploitation, adversaries may delete Web ACLs to disable
defenses, evade detection, or prepare for lateral movement or data exfiltration.

This rule detects successful `DeleteWebACL` events across WAF Classic, WAF Regional, and WAFv2 APIs.

### Possible investigation steps

- **Identify the actor and access context**
  - Review `aws.cloudtrail.user_identity.arn` and `access_key_id` for the identity that initiated deletion.
  - Determine whether this principal normally manages WAF resources.
  - Check if the call originated via IAM role assumption, federated identity, or long-lived IAM key.

- **Assess the deleted ACL**
  - Check `aws.cloudtrail.request_parameters` for:
    - The Web ACL ID (`WebACLId`, `Id`, or ARN).
    - The scope (REGIONAL vs. CLOUDFRONT).
    - Associated resource ARNs that were protected.
  - Determine which applications or APIs depended on this Web ACL.
  - Evaluate the criticality and sensitivity of any exposed endpoints.

- **Correlate with related security-affecting activity**
  - Use CloudTrail to pivot on:
    - The same identity (`user_identity.arn` or access key).
    - The same application load balancer, CloudFront distribution, or API Gateway stage.
  - Look for:
    - Prior rule updates (`UpdateWebACL`, `DeleteRuleGroup`, etc.).
    - IAM privilege escalation events.
    - Changes to logging or monitoring (e.g., disabling WAF logging).

- **Investigate request origin and tooling**
  - Review `source.ip`, ASN, and geo-location for anomalies.
  - Analyze `user_agent.original` to identify automation, custom scripts, CLI usage, or console access.

- **Evaluate operational context**
  - Determine whether the deletion aligns with:
    - Scheduled maintenance.
    - IaC-driven redeployments (Terraform, CDK, CloudFormation).
    - Known migrations between WAF Classic and WAFv2.
  - If deletion occurred outside expected time windows or without a corresponding change ticket, treat it as suspicious.

### False positive analysis

- **Expected infrastructure lifecycle events**
  - IaC pipelines may destroy and recreate Web ACLs as part of environment rotation or blue/green deployments.
  - Confirm whether the deleting identity matches known automation roles.

- **Planned refactoring or migrations**
  - Organizations transitioning to WAFv2 or moving resources across regions may intentionally delete legacy ACLs.

- **Testing and sandbox environments**
  - Developers may frequently create and remove ACLs during experimentation.
  - Tune the rule to suppress events from non-production accounts or specific tags.

- **Automated cleanup**
  - Certain CI/CD processes or teardown scripts remove WAF resources during ephemeral environment shutdowns.

If any deletion is inconsistent with normal operational patterns or performed by an unexpected principal, treat it as a potential defense-evasion attempt.

### Response and remediation

- **Containment**
  - Immediately assess exposed applications. If feasible, apply temporary restrictive network controls (e.g., ALB security group tightening or CloudFront WAFv2 fallback rules).
  - Revoke session tokens or access keys associated with suspicious actors.

- **Restore protections**
  - Recreate the deleted Web ACL using IaC definitions, backups, or previous configurations.
  - Validate that logging and monitoring (WAF logs, CloudWatch alarms, SIEM ingestion) are correctly restored.

- **Scope and impact analysis**
  - Review CloudTrail for follow-on or preceding activity by the same actor:
    - Rule modifications.
    - IAM policy changes.
    - Application configuration updates.
    - API Gateway or ALB changes.
  - Review application access logs for unusual requests following ACL removal.

- **Hardening**
  - Limit IAM permissions for `waf:DeleteWebACL`, `wafv2:DeleteWebACL`, and related actions to a small set of trusted roles.
  - Enforce MFA for administrative access.
  - Use AWS Config or Security Hub controls to detect unauthorized modifications to WAF resources.

- **Post-incident improvements**
  - Update change-management workflows to include required approvals for WAF modifications.
  - Improve monitoring for other defense-evasion patterns such as disabling GuardDuty, CloudTrail, or logging.

### Additional information

- **DeleteWebACL API (WAF Classic & Regional):**  
  https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_DeleteWebACL.html  
- **DeleteWebACL API (WAFv2):**  
  https://docs.aws.amazon.com/waf/latest/APIReference/API_DeleteWebACL.html  
- **[AWS IR Playbooks](https://github.com/aws-samples/aws-incident-response-playbooks/blob/c151b0dc091755fffd4d662a8f29e2f6794da52c/playbooks/)** 
- **[AWS Customer Playbook Framework](https://github.com/aws-samples/aws-customer-playbook-framework/tree/a8c7b313636b406a375952ac00b2d68e89a991f2/docs)** 
- **[AWS Knowledge Center – Security Best Practices](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/)**
"""
references = [
    "https://docs.aws.amazon.com/waf/latest/APIReference/API_DeleteWebACL.html",
    "https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_DeleteWebACL.html",
]
risk_score = 47
rule_id = "91d04cd4-47a9-4334-ab14-084abe274d49"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Platform: AWS",
    "Data Source: AWS CloudTrail",
    "Service: AWS WAF",
    "Tactic: Defense Evasion",
    "Rule Type: Custom Query (KQL)",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset: aws.cloudtrail 
    and event.provider: (waf.amazonaws.com or waf-regional.amazonaws.com or wafv2.amazonaws.com)
    and event.action: DeleteWebACL 
    and event.outcome: success
    and not user_agent.original: (*Terraform* or *Pulumi*)
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[rule.threat.technique.subtechnique]]
id = "T1562.007"
name = "Disable or Modify Cloud Firewall"
reference = "https://attack.mitre.org/techniques/T1562/007/"



[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user_agent.original",
    "source.ip",
    "aws.cloudtrail.user_identity.arn",
    "aws.cloudtrail.user_identity.type",
    "aws.cloudtrail.user_identity.access_key_id",
    "event.action",
    "event.outcome",
    "cloud.account.id",
    "cloud.region",
    "aws.cloudtrail.request_parameters",
]

[metadata]
creation_date = "2021/11/22"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2026/05/04"

[rule]
author = ["Austin Songer"]
description = """
Identifies when a user attempts to clear console history. An adversary may clear the command history of a compromised
account to conceal the actions undertaken during an intrusion.
"""
from = "now-9m"
index = [
    "endgame-*",
    "logs-crowdstrike.fdr*",
    "logs-endpoint.events.process-*",
    "logs-m365_defender.event-*",
    "logs-sentinel_one_cloud_funnel.*",
    "logs-system.security*",
    "logs-windows.forwarded*",
    "logs-windows.sysmon_operational-*",
    "winlogbeat-*",
]
language = "eql"
license = "Elastic License v2"
name = "Clearing Windows Console History"
note = """## Triage and analysis

### Investigating Clearing Windows Console History

PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This makes it available for use in various environments, and creates an attractive way for attackers to execute code.

Attackers can try to cover their tracks by clearing PowerShell console history. PowerShell has two different ways of logging commands: the built-in history and the command history managed by the PSReadLine module. This rule looks for the execution of commands that can clear the built-in PowerShell logs or delete the `ConsoleHost_history.txt` file.

#### Possible investigation steps

- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
- Identify the user account that performed the action and whether it should perform this kind of action.
- Contact the account owner and confirm whether they are aware of this activity.
- Investigate other alerts associated with the user/host during the past 48 hours.
  - Verify if any other anti-forensics behaviors were observed.
- Investigate the PowerShell logs on the SIEM to determine if there was suspicious behavior that an attacker may be trying to cover up.

### False positive analysis

- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.

### Response and remediation

- Initiate the incident response process based on the outcome of the triage.
- Isolate the involved host to prevent further post-compromise behavior.
- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
  - Ensure that PowerShell auditing policies and log collection are in place to grant future visibility.
"""

setup = """## Setup

This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.

Setup instructions: https://ela.st/install-elastic-defend

### Additional data sources

This rule also supports the following third-party data sources. For setup instructions, refer to the links below:

- [CrowdStrike](https://ela.st/crowdstrike-integration)
- [Microsoft Defender XDR](https://ela.st/m365-defender)
- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
- [Sysmon Event ID 1 - Process Creation](https://ela.st/sysmon-event-1-setup)
- [Windows Process Creation Logs](https://ela.st/audit-process-creation)
"""

references = [
    "https://stefanos.cloud/kb/how-to-clear-the-powershell-command-history/",
    "https://www.shellhacks.com/clear-history-powershell/",
    "https://community.sophos.com/sophos-labs/b/blog/posts/powershell-command-history-forensics",
]
risk_score = 47
rule_id = "b5877334-677f-4fb9-86d5-a9721274223b"
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Defense Evasion",
    "Tactic: Execution",
    "Resources: Investigation Guide",
    "Data Source: Elastic Endgame",
    "Data Source: Elastic Defend",
    "Data Source: Windows Security Event Logs",
    "Data Source: Microsoft Defender XDR",
    "Data Source: Sysmon",
    "Data Source: SentinelOne",
    "Data Source: Crowdstrike",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
process where host.os.type == "windows" and event.type == "start" and
  (
    process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe") or
    ?process.pe.original_file_name in ("PowerShell.EXE", "pwsh.dll", "powershell_ise.EXE")
  ) and
  (
    process.command_line : "*Clear-History*" or
    (
      process.command_line : ("*Remove-Item*", "* rm *") and
      process.command_line : ("*ConsoleHost_history.txt*", "*(Get-PSReadlineOption).HistorySavePath*")
    ) or
    (process.command_line : "*Set-PSReadlineOption*" and process.command_line : "*SaveNothing*")
  )
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1070"
name = "Indicator Removal"
reference = "https://attack.mitre.org/techniques/T1070/"
[[rule.threat.technique.subtechnique]]
id = "T1070.003"
name = "Clear Command History"
reference = "https://attack.mitre.org/techniques/T1070/003/"



[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[rule.threat.technique.subtechnique]]
id = "T1059.001"
name = "PowerShell"
reference = "https://attack.mitre.org/techniques/T1059/001/"



[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[metadata]
creation_date = "2025/12/04"
integration = ["endpoint"]
maturity = "production"
updated_date = "2026/07/16"

[rule]
author = ["Elastic"]
description = """
Detects GenAI tools connecting to unusual domains on macOS. Adversaries may compromise GenAI tools through prompt
injection, malicious MCP servers, or poisoned plugins to establish C2 channels or exfiltrate sensitive data to
attacker-controlled infrastructure. AI agents with network access can be manipulated to beacon to external servers,
download malicious payloads, or transmit harvested credentials and documents.
"""
from = "now-9m"
index = ["logs-endpoint.events.network*"]
language = "kuery"
license = "Elastic License v2"
name = "GenAI Process Connection to Unusual Domain"
note = """## Triage and analysis

### Investigating GenAI Process Connection to Unusual Domain

GenAI tools with network access can be weaponized to contact attacker infrastructure for C2, data exfiltration, or payload retrieval. Compromised MCP servers, malicious plugins, or prompt injection attacks can redirect AI agents to connect to arbitrary domains. While legitimate GenAI tools connect to vendor APIs and CDNs, connections to unusual domains may indicate exploitation.

### Possible investigation steps

- Review the destination domain to determine if it's a legitimate GenAI service, CDN, package registry, or potentially malicious infrastructure.
- Investigate the GenAI process command line and configuration to identify what triggered the connection (plugin, MCP server, user prompt).
- Check if the domain was recently registered, uses a suspicious TLD, or has a low reputation score in threat intelligence feeds.
- Review the timing and context of the connection to determine if it correlates with user activity or was automated.
- Examine network traffic to and from the domain to identify the nature of the communication (API calls, file downloads, data exfiltration).
- Check for other hosts in the environment connecting to the same domain to determine if this is an isolated incident.
- Investigate whether the GenAI tool's configuration files were recently modified to add new MCP servers or plugins.
- Correlate with file events to see if the GenAI tool downloaded or created files around the same time as the connection.

### False positive analysis

- GenAI tools may connect to new domains as vendors update their infrastructure, CDNs, or API endpoints.
- Package managers (npm, pip) used by MCP servers may connect to package registries for dependency resolution.
- Legitimate MCP servers and AI plugins connect to their respective backend services.
- Developer workflows testing new AI integrations or MCP servers will naturally trigger alerts for novel domain connections.

### Response and remediation

- If the domain is confirmed malicious, block it at the network level and investigate the source of the compromise.
- Review the GenAI tool's configuration for unauthorized MCP servers, plugins, or extensions that initiated the connection.
- Investigate any data that may have been sent to the suspicious domain and assess the potential for data exfiltration.
- Review and rotate any API keys, tokens, or credentials used by the GenAI tool.
- Update detection rules to monitor the identified domain across all hosts in the environment.
"""
references = [
    "https://atlas.mitre.org/techniques/AML.T0086",
    "https://glama.ai/blog/2025-11-11-the-lethal-trifecta-securing-model-context-protocol-against-data-flow-attacks",
    "https://www.elastic.co/security-labs/elastic-advances-llm-security",
    "https://specterops.io/blog/2025/11/21/an-evening-with-claude-code",
]
risk_score = 47
rule_id = "9050506c-df6d-4bdf-bc82-fcad0ef1e8c1"
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: macOS",
    "Use Case: Threat Detection",
    "Tactic: Command and Control",
    "Data Source: Elastic Defend",
    "Resources: Investigation Guide",
    "Domain: LLM",
    "Mitre Atlas: T0086",
]
timestamp_override = "event.ingested"
type = "new_terms"

query = '''
event.category:network and host.os.type:macos and event.action:connection_attempted and
(
  process.name:(
    Claude or "Claude Helper" or "Claude Helper (Plugin)" or Copilot or Cursor or
    "Cursor Helper" or "Cursor Helper (Plugin)" or GPT4All or Jan or "Jan Helper" or
    KoboldCpp or "LM Studio" or Ollama or Windsurf or "Windsurf Helper" or
    "Windsurf Helper (Plugin)" or bunx or claude or codex or copilot or cursor or deno or
    gemini-cli or genaiscript or gpt4all or grok or jan or koboldcpp or llama-cli or
    llama-server or lmstudio or npx or ollama or pnpm or qwen or textgen or windsurf or yarn
  )
) and destination.domain:(* and not (
    aka.ms or anthropic.com or atlassian.com or cursor.com or cursor.sh or github.com or
    gpt4all.io or hf.co or huggingface.co or lmstudio.ai or localhost or ollama.ai or
    ollama.com or openai.com or *.aka.ms or *.akamaized.net or *.amazonaws.com or
    *.amplitude.com or *.anthropic.com or *.atlassian.com or *.aws.amazon.com or
    *.azure.com or *.cdn.cloudflare.net or *.cloudflare-dns.com or *.cloudflare.com or
    *.cloudflarestorage.com or *.codeium.com or *.cursor.com or *.cursor.sh or
    *datadoghq.com or *.elastic-cloud.com or *.elastic.co or *.exp-tas.com or
    *.gemini.google.com or *.generativelanguage.googleapis.com or *.github.com or
    *.githubcopilot.com or *.githubusercontent.com or *.gitkraken.com or *.gitkraken.dev or
    *.google.com or *.googleapis.com or *.gpt4all.io or *.grok.x.ai or *.hf.co or
    *.honeycomb.io or *.huggingface.co or *.intercom.io or *.jan.ai or *.launchdarkly.com or
    *.lmstudio.ai or *.microsoft.com or *.mixpanel.com or *.msedge.net or *.npmjs.com or
    *.npmjs.org or *.oaiusercontent.com or *.ollama.ai or *.ollama.com or *.openai.com or
    *.pypi.org or *.r2.cloudflarestorage.com or *.schemastore.org or *.segment.io or
    *.sentry.io or *.visualstudio.com or *.vsassets.io or *.vscode-cdn.net or
    *.windsurf.ai or *.x.ai or *.yarnpkg.com or *.cartocdn.com or *.chatgpt.com or
    *.claude.ai or *.claude.com or *.claudeusercontent.com or *.ggpht.com or *.gstatic.com or
    *.googleusercontent.com or *.launchpadcontent.net or *.pythonhosted.org or
    *.recaptcha.net or *.shields.io or *.snapcraftcontent.com or *.snapcraft.io or
    *.stripe.com or *.travis-ci.com or *.travis-ci.org or *.ubuntu.com or *.ytimg.com or
    *.github.io or *.githubassets.com or *.jsdelivr.net or *.nodesource.com or
    *.asana.com or arxiv.org or chatgpt.com or claude.ai or claude.com or flagcdn.com or
    gitlab.com or mcp.linear.app or mcp.notion.com or mcp.slack.com or
    opencollective.com or pypi.org
))
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"
[[rule.threat.technique.subtechnique]]
id = "T1071.001"
name = "Web Protocols"
reference = "https://attack.mitre.org/techniques/T1071/001/"



[rule.threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[rule.new_terms]
field = "new_terms_fields"
value = ["destination.domain"]
[[rule.new_terms.history_window_start]]
field = "history_window_start"
value = "now-7d"

[metadata]
creation_date = "2023/10/12"
integration = ["lmd", "endpoint"]
maturity = "production"
updated_date = "2026/07/27"
min_stack_version = "9.4.0"
min_stack_comments = "Use EA (Entity Analytics) fields"

[rule]
anomaly_threshold = 70
author = ["Elastic"]
description = """
A machine learning job has detected unusually high number of process arguments in an RDP session. Executing
sophisticated attacks such as lateral movement can involve the use of complex commands, obfuscation mechanisms,
redirection and piping, which in turn increases the number of arguments in a command.
"""
from = "now-12h"
interval = "15m"
license = "Elastic License v2"
machine_learning_job_id = "lmd_high_mean_rdp_process_args_ea"
name = "High Mean of Process Arguments in an RDP Session"
references = [
    "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html",
    "https://docs.elastic.co/en/integrations/lmd",
    "https://www.elastic.co/blog/detecting-lateral-movement-activity-a-new-kibana-integration",
    "https://www.elastic.co/blog/remote-desktop-protocol-connections-elastic-security",
]
risk_score = 21
rule_id = "36c48a0c-c63a-4cbc-aee1-8cac87db31a9"
setup = """## Setup

This rule requires the `host.ip` field to be populated.
For **Elastic Defend** events on versions **8.18 and above**, this field is **disabled by default**.

If you are using **Elastic Defend**, ensure host IP collection is enabled by following the configuration steps in the
[helper guide](https://www.elastic.co/docs/solutions/security/configure-elastic-defend/configure-data-volume-for-elastic-endpoint#host-fields).

The rule requires the Lateral Movement Detection integration assets to be installed, as well as file and Windows RDP process events collected by the Elastic Defend integration.

### Lateral Movement Detection Setup
The Lateral Movement Detection integration detects lateral movement activity by identifying abnormalities in file and Windows RDP events. Anomalies are detected using Elastic's Anomaly Detection feature.

#### Prerequisite Requirements:
- Fleet is required for Lateral Movement Detection.
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
- Windows RDP process events collected by the [Elastic Defend](https://docs.elastic.co/en/integrations/endpoint) integration.
- To install Elastic Defend, refer to the [documentation](https://www.elastic.co/guide/en/security/current/install-endpoint.html).

#### The following steps should be executed to install assets associated with the Lateral Movement Detection integration:
- Go to the Kibana homepage. Under Management, click Integrations.
- In the query bar, search for Lateral Movement Detection and select the integration to see more details about it.
- Follow the instructions under the **Installation** section.
- For this rule to work, complete the instructions through **Add preconfigured anomaly detection jobs**.
"""
severity = "low"
tags = [
    "Data Source: Elastic Defend",
    "Use Case: Lateral Movement Detection",
    "Rule Type: ML",
    "Rule Type: Machine Learning",
    "Tactic: Lateral Movement",
    "Resources: Investigation Guide",
]
type = "machine_learning"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating High Mean of Process Arguments in an RDP Session

Remote Desktop Protocol (RDP) facilitates remote access to systems, often targeted by adversaries for lateral movement. Attackers may exploit RDP by executing complex commands with numerous arguments to obfuscate their actions. The detection rule leverages machine learning to identify anomalies in process arguments, flagging potential misuse indicative of sophisticated attacks.

### Possible investigation steps

- Review the specific RDP session details, including the source and destination IP addresses, to identify any unusual or unauthorized access patterns.
- Analyze the process arguments flagged by the machine learning model to determine if they include known malicious commands or patterns indicative of obfuscation or redirection.
- Check the user account associated with the RDP session for any signs of compromise, such as recent password changes or login attempts from unusual locations.
- Correlate the alert with other security events or logs, such as firewall logs or intrusion detection system alerts, to identify any related suspicious activities or lateral movement attempts.
- Investigate the historical behavior of the involved systems and users to determine if the high number of process arguments is an anomaly or part of a regular pattern.

### False positive analysis

- Routine administrative tasks may generate a high number of process arguments, such as batch scripts or automated maintenance operations. Users can create exceptions for known scripts or processes that are regularly executed by trusted administrators.
- Software updates or installations often involve complex commands with multiple arguments. To mitigate false positives, users should whitelist update processes from trusted vendors.
- Monitoring and management tools that perform extensive logging or diagnostics can trigger this rule. Users should identify and exclude these tools if they are verified as non-threatening.
- Custom applications or scripts developed in-house may use numerous arguments for configuration purposes. Users should document and exclude these applications if they are part of normal business operations.
- Scheduled tasks that run during off-hours might appear suspicious due to their complexity. Users can adjust the rule to ignore these tasks if they are part of a regular, approved schedule.

### Response and remediation

- Isolate the affected system from the network to prevent further lateral movement and potential data exfiltration.
- Terminate any suspicious RDP sessions and associated processes that exhibit high numbers of arguments to halt ongoing malicious activities.
- Conduct a thorough review of the affected system's event logs and process execution history to identify any unauthorized access or changes made during the RDP session.
- Reset credentials for any accounts that were accessed during the suspicious RDP session to prevent unauthorized access using compromised credentials.
- Apply security patches and updates to the affected system and any other systems within the network to mitigate vulnerabilities that could be exploited for similar attacks.
- Enhance monitoring and logging for RDP sessions across the network to detect and respond to similar anomalies more quickly in the future.
- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if additional systems have been compromised."""
[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1021"
name = "Remote Services"
reference = "https://attack.mitre.org/techniques/T1021/"

[[rule.threat.technique.subtechnique]]
id = "T1021.001"
name = "Remote Desktop Protocol"
reference = "https://attack.mitre.org/techniques/T1021/001/"

[[rule.threat.technique]]
id = "T1210"
name = "Exploitation of Remote Services"
reference = "https://attack.mitre.org/techniques/T1210/"

[rule.threat.tactic]
id = "TA0008"
name = "Lateral Movement"
reference = "https://attack.mitre.org/tactics/TA0008/"

[rule]
description = """
Identifies the use of Windows commands to tamper with system recovery settings via Microsoft Office processes.
Ransomware and other malware may do this to prevent system recovery.
"""
id = "58a08390-e69d-4b32-9487-1d1ddb16ba09"
license = "Elastic License v2"
name = "Inhibit System Recovery via Microsoft Office Process"
os_list = ["windows"]
version = "1.0.31"

query = '''
process where event.action == "start" and
  descendant of [process where event.action == "start" and
    process.name : (
      "WINWORD.EXE",
      "EXCEL.EXE",
      "POWERPNT.EXE",
      "MSACCESS.EXE",
      "MSPUB.EXE",
      "fltldr.exe"
    )] and
  not descendant of [process where event.action == "start" and
    process.name : (
      "iexplore.exe",
      "msedge.exe",
      "microsoftedge.exe",
      "chrome.exe",
      "firefox.exe",
      "opera.exe",
      "safari.exe"
    )] and
    (
    (process.pe.original_file_name : "wmic.exe" and process.command_line : "*shadowcopy*" and process.command_line : "*delete*") or
    (process.pe.original_file_name : "vssadmin.exe" and process.command_line : "*shadows*" and process.command_line : ("*delete*", "*resize*")) or
    (process.pe.original_file_name : "bcdedit.exe" and process.command_line : ("*bootstatuspolicy*", "*recoveryenabled*")) or
    (process.pe.original_file_name : "wbadmin.exe" and process.command_line : ("*catalog*", "*systemstatebackup*") and process.command_line : "*delete*")
    )
'''

min_endpoint_version = "7.15.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"
[[threat.technique.subtechnique]]
id = "T1566.001"
name = "Spearphishing Attachment"
reference = "https://attack.mitre.org/techniques/T1566/001/"



[threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1047"
name = "Windows Management Instrumentation"
reference = "https://attack.mitre.org/techniques/T1047/"


[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1490"
name = "Inhibit System Recovery"
reference = "https://attack.mitre.org/techniques/T1490/"


[threat.tactic]
id = "TA0040"
name = "Impact"
reference = "https://attack.mitre.org/tactics/TA0040/"

[internal]
min_endpoint_version = "7.15.0"

[rule]
description = """
Detects when a binary located in a suspicious location gets executed by a shell interpreter and put in the background
via the & operator. Malware may execute their payloads in the background in an effort to remain hidden.
"""
id = "21692d53-d4a5-462c-9ee6-2d8788411996"
license = "Elastic License v2"
name = "Linux Background Process Execution via Shell"
os_list = ["linux"]
version = "1.0.9"

query = '''
process where event.type == "start" and event.action == "exec" and
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and process.args == "-c" and
process.args like ("/* &", "/*&") and process.args_count == 3 and
process.parent.executable like ("/dev/shm/*", "/var/tmp/*", "/tmp/*", "/var/www/*") and
not (
  process.executable like "/tmp/newroot/*" or
  process.command_line == "/bin/bash -c /opt/forticlient/fortitray &" or
  process.parent.executable like ("/var/www/splynx/*", "/tmp/.mount_cursor*", "/tmp/newroot/*") or
  process.parent.args == "cursor"
)
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
tree = true

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "7.15.0"

[metadata]
bypass_bbr_timing = true
creation_date = "2023/10/11"
integration = ["github"]
maturity = "production"
updated_date = "2026/03/24"

[rule]
author = ["Elastic"]
building_block_type = "default"
description = "A new user was added to a GitHub organization.\n"
from = "now-9m"
index = ["logs-github.audit-*"]
language = "eql"
license = "Elastic License v2"
name = "New User Added To GitHub Organization"
risk_score = 21
rule_id = "61336fe6-c043-4743-ab6e-41292f439603"
severity = "low"
tags = [
    "Domain: Cloud",
    "Use Case: Threat Detection",
    "Use Case: UEBA",
    "Tactic: Persistence",
    "Rule Type: BBR",
    "Data Source: Github",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
configuration where event.dataset == "github.audit" and event.action == "org.add_member"
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"

[[rule.threat.technique.subtechnique]]
id = "T1098.001"
name = "Additional Cloud Credentials"
reference = "https://attack.mitre.org/techniques/T1098/001/"

[[rule.threat.technique.subtechnique]]
id = "T1098.003"
name = "Additional Cloud Roles"
reference = "https://attack.mitre.org/techniques/T1098/003/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[metadata]
creation_date = "2025/01/16"
integration = ["endpoint", "auditd_manager", "crowdstrike", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2026/03/24"

[rule]
author = ["Elastic"]
description = """
This rule detects the usage of the "openssl" binary to generate password hashes on Linux systems. The "openssl" command
is a cryptographic utility that can be used to generate password hashes. Attackers may use "openssl" to generate
password hashes for new user accounts or to change the password of existing accounts, which can be leveraged to maintain
persistence on a Linux system.
"""
from = "now-9m"
index = [
    "logs-endpoint.events.process*",
    "endgame-*",
    "auditbeat-*",
    "logs-auditd_manager.auditd-*",
    "logs-crowdstrike.fdr*",
    "logs-sentinel_one_cloud_funnel.*",
]
language = "eql"
license = "Elastic License v2"
name = "OpenSSL Password Hash Generation"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating OpenSSL Password Hash Generation

OpenSSL is a robust cryptographic toolkit used for secure communications and data protection, including generating password hashes. Adversaries may exploit OpenSSL to create hashes for unauthorized user accounts or modify existing ones, aiding in persistent access to Linux systems. The detection rule identifies suspicious OpenSSL executions by monitoring specific process actions and arguments, flagging potential misuse for further investigation.

### Possible investigation steps

- Review the process execution details to confirm the presence of the "openssl" command with the "passwd" argument, as this indicates an attempt to generate a password hash.
- Identify the user account associated with the process execution to determine if the action was performed by a legitimate user or a potential adversary.
- Check the system logs and user activity around the time of the alert to identify any suspicious behavior or unauthorized access attempts.
- Investigate any recent changes to user accounts on the system, focusing on new account creations or password modifications that coincide with the alert.
- Correlate the alert with other security events or alerts from the same host to identify patterns or additional indicators of compromise.
- Assess the risk and impact of the detected activity by considering the context of the system and its role within the organization, as well as any potential data exposure or system access implications.

### False positive analysis

- Routine administrative tasks may trigger the rule when system administrators use OpenSSL to generate password hashes for legitimate user account management. To handle this, create exceptions for specific administrator accounts or processes that are known to perform these tasks regularly.
- Automated scripts for user account provisioning or maintenance that utilize OpenSSL for password hashing can also cause false positives. Identify these scripts and exclude their execution paths or associated user accounts from the rule.
- Security tools or compliance checks that periodically verify password strength or integrity using OpenSSL might be flagged. Review these tools and whitelist their operations to prevent unnecessary alerts.
- Development environments where OpenSSL is used for testing password hashing functions can generate alerts. Exclude these environments or specific test accounts from monitoring to reduce noise.
- Scheduled tasks or cron jobs that involve OpenSSL for password management purposes should be identified and excluded if they are part of regular system operations.

### Response and remediation

- Immediately isolate the affected system from the network to prevent further unauthorized access or lateral movement by the adversary.
- Terminate any suspicious OpenSSL processes identified by the detection rule to halt ongoing unauthorized password hash generation.
- Conduct a thorough review of user accounts on the affected system to identify any unauthorized accounts or changes to existing accounts, and revert any unauthorized modifications.
- Change passwords for all user accounts on the affected system, especially those with elevated privileges, to ensure that any compromised credentials are no longer valid.
- Implement additional monitoring on the affected system to detect any further unauthorized use of OpenSSL or similar tools, focusing on process execution and command-line arguments.
- Escalate the incident to the security operations team for a comprehensive investigation to determine the root cause and scope of the breach, and to assess potential impacts on other systems.
- Review and update access controls and authentication mechanisms to enhance security and prevent similar incidents in the future, ensuring that only authorized users can perform sensitive operations."""
risk_score = 47
rule_id = "f4b857b3-faef-430d-b420-90be48647f00"
setup = """## Setup

This rule requires data coming in from Elastic Defend.

### Elastic Defend Integration Setup
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.

#### Prerequisite Requirements:
- Fleet is required for Elastic Defend.
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).

#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
- Go to the Kibana home page and click "Add integrations".
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
- Click "Add Elastic Defend".
- Configure the integration name and optionally add a description.
- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
- Click "Save and Continue".
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
"""
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: Linux",
    "Use Case: Threat Detection",
    "Tactic: Persistence",
    "Data Source: Elastic Endgame",
    "Data Source: Elastic Defend",
    "Data Source: Auditd Manager",
    "Data Source: Crowdstrike",
    "Data Source: SentinelOne",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"
query = '''
process where host.os.type == "linux" and event.type == "start" and
event.action in ("exec", "exec_event", "start", "ProcessRollup2", "executed") and process.name == "openssl"
and process.args == "passwd" and ?process.args_count >= 4 and
not process.args in ("-help", "--help", "-h")
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"

[[rule.threat.technique]]
id = "T1136"
name = "Create Account"
reference = "https://attack.mitre.org/techniques/T1136/"

[[rule.threat.technique.subtechnique]]
id = "T1136.001"
name = "Local Account"
reference = "https://attack.mitre.org/techniques/T1136/001/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[rule]
description = """
Identifies a list of common LDAP search queries used to gather candidate accounts before launching password spraying
attacks.
"""
id = "375b5571-4cc4-427e-a39e-77b7f18f3d7e"
license = "Elastic License v2"
name = "Password Spraying Enumeration via LDAP"
os_list = ["windows"]
reference = ["https://attack.mitre.org/techniques/T1201/"]
version = "1.0.3"

query = '''
api where process.Ext.api.name == "ldap_search" and user.id != "S-1-5-18" and
 not process.executable :
             ("?:\\Program Files\\Azure Advanced Threat Protection Sensor\\*\\Microsoft.Tri.Sensor.exe",
              "?:\\Windows\\ADFS\\Microsoft.IdentityServer.ServiceHost.exe",
              "?:\\Windows\\ADWS\\Microsoft.ActiveDirectory.WebServices.exe",
              "?:\\Program Files (x86)\\Trend Micro\\Security Agent\\PccNTMon.exe",
              "?:\\Program Files\\Microsoft SQL Server\\MSSQL??.MSSQLSERVER\\MSSQL\\Binn\\sqlservr.exe") and
 process.Ext.api.parameters.search_filter : (
  // Enabled accounts
  "(&(objectCategory=person)(objectClass=user)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))",
  "(&(objectCategory=Computer)(!userAccountControl:1.2.840.113556.1.4.803:=2))",

  // Password never set / reset conditions
  "(&(objectCategory=person)(objectClass=user)*(pwdLastSet=0))",
  "(&(objectCategory=person)(objectClass=user)*(pwdLastSet>=129473172000000000))",

  // Weak password policy accounts
  "(&(objectCategory=person)(objectClass=user)*(userAccountControl:1.2.840.113556.1.4.803:=65536))", // PASSWD_NEVER_EXPIRES
  "(&(objectCategory=person)(objectClass=user)*(userAccountControl:1.2.840.113556.1.4.803:=32))",    // PASSWD_NOTREQD

  // Spray candidate filters
  "(&(samAccountType=805306368)(|(homeDirectory=?)(scriptPath=*)(profilePath=?)))",
  "(&(objectCategory=person)(objectClass=user)(directReports=?)(!(manager=?)))"
 )
'''

min_endpoint_version = "9.1.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1087"
name = "Account Discovery"
reference = "https://attack.mitre.org/techniques/T1087/"
[[threat.technique.subtechnique]]
id = "T1087.002"
name = "Domain Account"
reference = "https://attack.mitre.org/techniques/T1087/002/"


[[threat.technique]]
id = "T1201"
name = "Password Policy Discovery"
reference = "https://attack.mitre.org/techniques/T1201/"


[threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"

[internal]
min_endpoint_version = "9.1.0"

[metadata]
creation_date = "2026/05/21"
integration = ["endpoint", "crowdstrike", "sentinel_one_cloud_funnel", "auditd_manager"]
maturity = "production"
updated_date = "2026/06/01"

[rule]
author = ["Elastic"]
description = """
This rule detects passwordless sudo probing activity on Linux systems. Passwordless sudo probing
can be an indication of an attacker attempting to enumerate it's allowed commands and potential
privilege escalation.
"""
from = "now-9m"
index = [
    "auditbeat-*",
    "endgame-*",
    "logs-auditd_manager.auditd-*",
    "logs-crowdstrike.fdr*",
    "logs-endpoint.events.process*",
    "logs-sentinel_one_cloud_funnel.*",
]
language = "eql"
license = "Elastic License v2"
name = "Passwordless Sudo Probing"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Passwordless Sudo Probing

This rule catches a Linux user running `sudo -n true`, a quiet check for passwordless sudo that reveals whether the account can elevate without user interaction. Attackers often issue this immediately after gaining a shell to test privilege-escalation paths, then pivot to `sudo -l` or directly launch an allowed root command if the probe succeeds.

### Possible investigation steps

- Identify the originating user, session type, parent shell or service, and authentication source to determine whether the probe came from normal administration, automation, or a potentially compromised interactive login.
- Review activity immediately before and after the alert for follow-on actions such as privilege enumeration, attempts to launch root-level utilities, service manipulation, credential access, or edits to sudo and persistence-related files.
- Confirm the account’s effective sudo privileges by inspecting sudoers policy, included drop-in rules, and centralized identity policy to verify whether passwordless elevation is expected and which commands are allowed.
- Correlate the same user, host, and source address across authentication, process, and network telemetry to spot unusual login patterns, lateral movement, or repeated probing on additional Linux systems.
- If the behavior is not attributable to approved tooling or maintenance, isolate the affected session or host, preserve volatile evidence and shell history, and rotate any credentials or keys that may have been exposed.

### False positive analysis

- Administrative scripts, cron jobs, or service-account maintenance tasks may run `sudo -n true` to confirm non-interactive privilege is available before continuing privileged work; verify the parent process, executing user, script location, and timing against approved operational activity.
- Sudoers validation during account provisioning, system configuration, or post-change testing can legitimately execute `sudo -n true` after privilege updates; verify recent changes to sudo policy or user permissions and confirm the account is expected to have passwordless sudo access.

### Response and remediation

- Isolate the affected Linux host from the network and terminate the malicious user session or shell while preserving shell history, sudo logs, and any temporary scripts under `/tmp`, `/var/tmp`, or the user’s home directory for incident handling.
- Remove attacker access by disabling the involved account, revoking exposed SSH keys, rotating passwords and tokens, and deleting unauthorized entries in `authorized_keys`, `sudoers` drop-ins, cron jobs, systemd services, and startup scripts.
- Inspect and reverse any privileged changes made after the sudo probe, including new local users, modified `/etc/sudoers` or `/etc/sudoers.d` files, altered PAM or SSH configuration, unexpected package installs, and binaries replaced outside approved change windows.
- If the probe was followed by successful `sudo` use, new root persistence, credential theft activity, or similar behavior on additional Linux hosts, escalate immediately to incident response as a suspected privileged-compromise case and expand containment to related systems and accounts.
- Restore the host to a known-good state by rebuilding from a trusted image or verified backup when root-level execution occurred, then validate system integrity, reapply approved `sudo` policy, and restrict passwordless `sudo` to only documented commands.
"""
references = [
    "https://github.com/nrwl/nx-console/issues/3139",
]
risk_score = 21
rule_id = "92b11a06-57ab-4f6d-a18b-fb7fdf3cc63f"
severity = "low"
setup = """## Setup

This rule requires data coming in from Elastic Defend.

### Elastic Defend Integration Setup
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.

#### Prerequisite Requirements:
- Fleet is required for Elastic Defend.
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).

#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
- Go to the Kibana home page and click "Add integrations".
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
- Click "Add Elastic Defend".
- Configure the integration name and optionally add a description.
- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
- Click "Save and Continue".
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
"""
tags = [
    "Domain: Endpoint",
    "OS: Linux",
    "Use Case: Threat Detection",
    "Tactic: Discovery",
    "Data Source: Elastic Endgame",
    "Data Source: Elastic Defend",
    "Data Source: Auditd Manager",
    "Data Source: Crowdstrike",
    "Data Source: SentinelOne",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"
query = '''
process where host.os.type == "linux" and event.type == "start" and
event.action in ("exec", "exec_event", "start", "ProcessRollup2", "executed", "process_started") and
process.name == "sudo" and process.args in ("-n", "--non-interactive") and process.args == "true"
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1033"
name = "System Owner/User Discovery"
reference = "https://attack.mitre.org/techniques/T1033/"

[[rule.threat.technique]]
id = "T1082"
name = "System Information Discovery"
reference = "https://attack.mitre.org/techniques/T1082/"

[rule.threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"

[metadata]
creation_date = "2025/11/27"
integration = ["nginx", "apache", "apache_tomcat", "traefik"]
maturity = "production"
updated_date = "2026/03/16"

[rule]
author = ["Elastic"]
description = """
Through the new_terms rule type, this rule detects potential HTTP downgrade attacks by identifying
HTTP traffic that uses a different HTTP version than the one typically used in the environment. An
HTTP downgrade attack occurs when an attacker forces a connection via an older HTTP version, 
resulting in potentially less secure communication. For example, an attacker might downgrade a
connection from HTTP/2 to HTTP/1.1 or HTTP/1.0 to exploit known vulnerabilities or weaknesses in
the older protocol versions.
"""
from = "now-9m"
index = [
        "logs-nginx.access-*",
        "logs-apache.access-*",
        "logs-apache_tomcat.access-*",
        "logs-traefik.access-*",
]
language = "kuery"
license = "Elastic License v2"
name = "Potential HTTP Downgrade Attack"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Potential HTTP Downgrade Attack

This detection surfaces HTTP traffic negotiating a protocol version that deviates from your baseline, a sign of downgrade attempts that strip protections and enable evasion or exploit paths in older behaviors. An attacker deliberately breaks HTTP/2 negotiation so the server falls back to HTTP/1.1, then probes with crafted headers and chunked bodies to attempt request smuggling or cache bypass against web services.

### Possible investigation steps

- Correlate with TLS termination or load balancer logs to verify ALPN or Upgrade negotiation (server advertising h2) and whether the same client/IP previously used h2 with the same SNI/Host, distinguishing forced downgrade from capability mismatch.
- Review the downgraded requests for exploitation indicators such as simultaneous Content-Length and Transfer-Encoding headers, duplicated or mixed-case headers, unusual methods (TRACE or PRI), or inconsistent chunked encoding suggesting smuggling attempts.
- Examine surrounding response patterns for increased 400/421/426/431/505, backend 5xx, connection resets, or latency spikes that coincide with these requests and indicate error-driven fallback or probing.
- Check for recent config changes or incidents on CDNs/WAFs/load balancers and web servers (e.g., http2 enablement, ALPN lists, h2/h2c settings) that could have disabled HTTP/2 and caused benign fallbacks.
- Cluster events by source IP/User-Agent/ASN and targeted host to identify campaign activity across services and pivot the sources through threat intelligence or reputation feeds.

### False positive analysis

- Recent Nginx/Apache/Tomcat configuration changes that disable HTTP/2/h2c or alter TLS/ALPN on specific virtual hosts can legitimately force clients to fall back to HTTP/1.1, surfacing as a downgrade event in access logs.
- Newly onboarded internal services or scripts that only support HTTP/1.0/1.1 and begin hitting an endpoint for the first time can introduce a first-seen older http.version relative to an HTTP/2 baseline without malicious intent.

### Response and remediation

- Immediately block or challenge source IPs/ASNs repeatedly forcing HTTP/1.1 to hosts that previously negotiated HTTP/2 via ALPN, and enable WAF rules to drop “Upgrade: h2c” attempts, requests with both Content-Length and Transfer-Encoding, or duplicated/mixed-case headers.
- Remove downgrade paths by requiring TLS+ALPN “h2” on 443 (e.g., Nginx listen 443 ssl http2; Apache Protocols h2 http/1.1), disabling cleartext h2c and HTTP/1.0 on public endpoints, and ensuring intermediaries do not strip ALPN or rewrite headers.
- Redeploy corrected configs and validate end-to-end HTTP/2 with curl --http2 and browser devtools, then confirm normal 2xx/3xx rates and elimination of 421/426/431/505 responses and backend 5xx spikes around previously downgraded traffic.
- Escalate to Incident Response if downgraded requests show smuggling patterns (simultaneous Content-Length and Transfer-Encoding, mixed-case duplicates, TRACE/PRI methods), hit sensitive paths (/admin, /login, /actuator), or trigger cache anomalies like cross-user content.
- Harden parsing and caching by normalizing headers at the edge, enforcing a single Content-Length, disabling TRACE, setting strict client_header_buffer_size and large_client_header_buffers, and configuring proxies/backends to reject conflicting CL/TE or ambiguous chunked bodies.
"""
risk_score = 21
rule_id = "9797d2c8-8ec9-48e6-a022-350cdfbf2d5e"
severity = "low"
tags = [
    "Domain: Web",
    "Use Case: Threat Detection",
    "Tactic: Defense Evasion",
    "Data Source: Nginx",
    "Data Source: Apache",
    "Data Source: Apache Tomcat",
    "Data Source: Traefik",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "new_terms"
query = '''
http.version:*
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"

[[rule.threat.technique.subtechnique]]
id = "T1562.010"
name = "Downgrade Attack"
reference = "https://attack.mitre.org/techniques/T1562/010/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[rule.new_terms]
field = "new_terms_fields"
value = ["http.version", "agent.id"]

[[rule.new_terms.history_window_start]]
field = "history_window_start"
value = "now-7d"

[rule]
description = """
Identifies the creation of a process from unusual modules or NTDLL offsets. This may indicate an attempt to bypass API
monitoring using Return Oriented Programming (ROP) assembly gadgets to execute a syscall instruction.
"""
id = "4cd250a2-82a0-463b-adda-5256cee422ce"
license = "Elastic License v2"
name = "Process Creation via ROP Gadgets"
os_list = ["windows"]
version = "1.0.24"

query = '''
process where event.action == "start" and
 not process.Ext.token.integrity_level_name == "low" and
 process.parent.thread.Ext.call_stack_summary : ("ntdll.dll|*", "win32u.dll|*") and
 not _arraysearch(process.parent.thread.Ext.call_stack, $entry, $entry.symbol_info:
                                                                 ("*ntdll.dll!*CreateUserProcess*",
                                                                  "*ntdll.dll!*DeviceIoControlFile*",
                                                                  "*ntdll.dll!*CreateThreadEx*",
                                                                  "*ntdll.dll!*AssignProcessToJobObject*",
                                                                  "*ntdll.dll!*DeleteAtom*",
                                                                  "*ntdll.dll!NtSetEvent*",
                                                                  "*ntdll.dll!NtCallbackReturn*",
                                                                  "*KernelBase.dll*!CreateProcess*",
                                                                  "*ntdll.dll+*",
                                                                  "*ntdll.dll!*ReadFile*",
                                                                  "*ntdll.dll!NtReplyWaitReceivePort*",
                                                                  "*KernelBase.dll!WriteConsoleW*", 
                                                                  "*ntdll.dll!NtDebugContinue*", 
                                                                  "*kernel32.dll!CreateProcess*", 
                                                                  "*ntdll.dll!ZwCreateMailslotFile*", 
                                                                  "*ntdll.dll!*EnableLastKnownGood*", 
                                                                  "*ntdll.dll!*CreateEnclave*", 
                                                                  "*ntdll.dll!ZwCreateTimer*",
                                                                  "*ntdll.dll!ZwCreateKeyedEvent*",
                                                                  "*ntdll.dll!NtSinglePhaseReject*",
                                                                  "*ntdll.dll!RtlCompleteProcessCloning*",
                                                                  "*ntdll.dll!NtCreateWaitCompletionPacket*",
                                                                  "C:\\Windows\\System32\\ntdll.dll!NtAlpcDeleteSecurityContext+*", 
                                                                  "C:\\Windows\\System32\\ntdll.dll!NtCreateRegistryTransaction*", 
                                                                  "C:\\Windows\\System32\\ntdll.dll!NtCreatePrivateNamespace*", 
                                                                  "C:\\Windows\\System32\\ntdll.dll!NtDeletePrivateNamespace*", 
                                                                  "C:\\Windows\\System32\\ntdll.dll!NtSetInformationDebugObject*", 
                                                                  "C:\\Windows\\System32\\ntdll.dll!NtQueryAttributesFile*",
                                                                  "C:\\Windows\\System32\\ntdll.dll!NtOpenPrivateNamespace*",
                                                                  "C:\\Windows\\System32\\kernel32.dll!LoadLibrary*",
                                                                  "C:\\Windows\\System32\\KernelBase.dll!LoadLibrary*", 
                                                                  "C:\\Windows\\System32\\advapi32.dll!CreateProcessAsUser*", 
                                                                  "C:\\Windows\\System32\\wersvc.dll!SvchostPushServiceGlobals*", 
                                                                  "C:\\Windows\\System32\\ntdll.dll!NtSetInformationSymbolicLink*")) and
 not _arraysearch(process.parent.thread.Ext.call_stack, $entry, $entry.symbol_info : "*ntdll.dll*" and $entry.allocation_private_bytes > 0) and
 not _arraysearch(process.parent.thread.Ext.call_stack, $entry, $entry.symbol_info : "*ntdll.dll+0x*") and
 not process.executable : ("?:\\Windows\\System32\\conhost.exe", "?:\\Windows\\SysWOW64\\WerFault.exe") and
 not (process.executable : "?:\\Windows\\System32\\sppsvc.exe" and process.Ext.protection == "PsProtectedSignerWindows" and 
      process.parent.thread.Ext.call_stack_summary == "ntdll.dll|kernelbase.dll|kernel32.dll|services.exe|rpcrt4.dll|ntdll.dll|kernel32.dll|ntdll.dll")
'''

min_endpoint_version = "8.8.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.8.0"

[rule]
description = """
Identifies the native Windows tool, regsvr32.exe, executing a scriptlet file. This can allow an attacker to bypass
whitelisting and run arbitrary scripts.
"""
id = "0524c24c-e45e-4220-b21a-abdba0c46c4d"
license = "Elastic License v2"
name = "Regsvr32 Scriptlet Execution"
os_list = ["windows"]
version = "1.0.32"

query = '''
process where event.action == "start" and
 (process.pe.original_file_name : "regsvr32.exe" or process.name : "regsvr32.exe") and
  (
    (process.command_line : "*scrobj*" and process.command_line : ("* /i:*", "* -i:*", "*.sct*")) or
      /* attackers may rename scrobj.dll */
      (
        process.command_line : "* /u*" and
        process.command_line :
          (
            "* /i:C:\\*",
            "* /i:\"C:\\*",
            "* -i:C:\\*",
            "* -i:\"C:\\*",
            "* /i:*http*",
            "* -i:*http*"
          )
      )
  ) and
  /* Issue #326 */
  not (process.Ext.token.integrity_level_name == "system" and not process.command_line : "*scrobj.dll*") and
  not process.command_line : ("*:\\Program Files\\*", "*:\\Program Files (x86)\\*") and
  not (process.parent.executable : ("?:\\Windows\\SysWOW64\\msiexec.exe", "?:\\Windows\\system32\\msiexec.exe") and
      not process.command_line : "*scrobj.dll*")
'''

min_endpoint_version = "7.15.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[[threat.technique.subtechnique]]
id = "T1218.010"
name = "Regsvr32"
reference = "https://attack.mitre.org/techniques/T1218/010/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.15.0"

[rule]
description = """
Identifies INETCookies file deletion by unsigned process, consistent with the Remcos Remote Access Trojan (RAT)
behavior. Remcos RAT is used by attackers to perform actions on infected machines remotely.
"""
id = "cf7592cc-6954-4973-92ee-213c5eea0fa5"
license = "Elastic License v2"
name = "Remcos RAT INETCookies File Deletion"
os_list = ["windows"]
reference = [
    "https://any.run/malware-trends/remcos",
    "https://attack.mitre.org/software/S0332/",
    "https://www.elastic.co/security-labs/dissecting-remcos-rat-part-four",
]
version = "1.0.4"

query = '''
file where event.action == "deletion" and file.name : "container.dat" and user.id != "S-1-5-18" and
 (process.code_signature.trusted == false or process.code_signature.exists == false) and
 file.path : "?:\\Users\\*\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\container.dat" and
 not process.executable : "C:\\Program Files (x86)\\WinDirStat\\windirstat.exe"
'''

min_endpoint_version = "8.1.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1112"
name = "Modify Registry"
reference = "https://attack.mitre.org/techniques/T1112/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[[threat]]
framework = "MITRE ATT&CK"

[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "8.1.0"