Elastic rules: 06

[metadata]
creation_date = "2021/07/14"
integration = ["endpoint"]
maturity = "production"
updated_date = "2026/03/24"

[rule]
author = ["Elastic"]
description = """
Detects when multiple hosts are using the same agent ID. This could occur in the event of an agent being taken over and
used to inject illegitimate documents into an instance as an attempt to spoof events in order to masquerade actual
activity to evade detection.
"""
false_positives = [
    """
    This is meant to run only on datasources using Elastic Agent 7.14+ since versions prior to that will be missing the
    necessary field, resulting in false positives.
    """,
]
from = "now-9m"
language = "esql"
license = "Elastic License v2"
name = "Agent Spoofing - Multiple Hosts Using Same Agent"
risk_score = 73
rule_id = "493834ca-f861-414c-8602-150d5505b777"
severity = "high"
tags = ["Use Case: Threat Detection", "Tactic: Defense Evasion", "Resources: Investigation Guide"]
timestamp_override = "event.ingested"
type = "esql"

query = '''
from logs-endpoint.*  metadata _id
| where event.agent_id_status is not null and agent.id is not null
| stats Esql.count_distinct_host_ids = count_distinct(host.id), Esql.host_id_values = values(host.id), Esql.user_id_values_user_id = values(user.id) by agent.id
| where Esql.count_distinct_host_ids >= 2
| keep Esql.count_distinct_host_ids, Esql.host_id_values, Esql.user_id_values_user_id, agent.id
'''
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Agent Spoofing - Multiple Hosts Using Same Agent

In network environments, agents are deployed on hosts to monitor and report activities. Adversaries may exploit these agents by hijacking their IDs to inject false data, masking malicious actions. The detection rule identifies anomalies where multiple hosts report using the same agent ID, signaling potential spoofing attempts. By focusing on unique agent ID usage, it helps uncover evasion tactics aimed at concealing unauthorized activities.

### Possible investigation steps

- Review the alert details to identify the specific agent ID that is being reported by multiple hosts.
- Cross-reference the agent ID with the list of known and authorized agents to determine if it has been compromised or misconfigured.
- Examine the network logs and host activity for each host reporting the same agent ID to identify any unusual or unauthorized activities.
- Check for any recent changes or updates to the agent software on the affected hosts that could explain the anomaly.
- Investigate the timeline of events to determine when the agent ID started being used by multiple hosts and correlate this with any known incidents or changes in the network environment.
- Assess the potential impact of the spoofing attempt on the network's security posture and consider isolating affected hosts if necessary to prevent further malicious activity.

### False positive analysis

- Legitimate load balancing or failover scenarios where multiple hosts are configured to use the same agent ID for redundancy can trigger false positives. Users should identify and document these configurations, then create exceptions in the detection rule to exclude these known non-threatening behaviors.
- Virtualized environments where snapshots or clones of a host are created might result in multiple instances reporting the same agent ID. Users should ensure that each virtual instance is assigned a unique agent ID or adjust the rule to account for these scenarios.
- Testing or development environments where agents are intentionally duplicated for testing purposes can also lead to false positives. Users should tag these environments appropriately and modify the rule to exclude events from these tags.
- In cases where agents are temporarily reassigned to different hosts for maintenance or troubleshooting, users should maintain a log of these activities and adjust the detection rule to ignore these temporary changes.

### Response and remediation

- Isolate affected hosts immediately to prevent further spread of potentially malicious activities across the network.
- Revoke and reissue new agent IDs for the affected hosts to ensure that compromised IDs are no longer in use.
- Conduct a thorough forensic analysis on the isolated hosts to identify any unauthorized changes or malicious software that may have been introduced.
- Review and update access controls and authentication mechanisms for agent deployment to prevent unauthorized access and hijacking of agent IDs.
- Monitor network traffic and logs closely for any signs of continued spoofing attempts or related suspicious activities.
- Escalate the incident to the security operations center (SOC) and relevant stakeholders to ensure awareness and coordinated response efforts.
- Implement enhanced logging and alerting for agent ID anomalies to improve detection of similar threats in the future."""


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1036"
name = "Masquerading"
reference = "https://attack.mitre.org/techniques/T1036/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1565"
name = "Data Manipulation"
reference = "https://attack.mitre.org/techniques/T1565/"

[[rule.threat.technique.subtechnique]]
id = "T1565.002"
name = "Transmitted Data Manipulation"
reference = "https://attack.mitre.org/techniques/T1565/002/"

[rule.threat.tactic]
id = "TA0040"
name = "Impact"
reference = "https://attack.mitre.org/tactics/TA0040/"

[metadata]
creation_date = "2026/07/13"
integration = ["aws"]
maturity = "production"
updated_date = "2026/07/13"

[rule]
author = ["Elastic"]
description = """
Detects the closure of an AWS account via the CloseAccount API. This can be called either by the account itself
(account.amazonaws.com, self-service closure) or by an AWS Organizations management account against one of its member
accounts (organizations.amazonaws.com). Account closure triggers a 90-day grace period during which the account is
suspended before permanent termination, and is one of the most destructive and disruptive actions available in AWS. It
removes access to all resources and data in the account for the duration of the suspension. An adversary with root-level
access in a member account, or management-level access to an organization, may close accounts to destroy evidence,
disrupt business operations, or eliminate compute and data resources. A malicious insider could use the same action for
sabotage.
"""
false_positives = [
    """
    AWS accounts may be legitimately closed as part of organizational restructuring, account consolidation, or
    decommissioning of workloads. Legitimate closures should always have a corresponding change-management record and
    documented approval; any closure without one should be treated as a critical incident.
    """,
]
from = "now-6m"
index = ["logs-aws.cloudtrail-*"]
language = "kuery"
license = "Elastic License v2"
name = "AWS Account Closed"
note = """## Triage and analysis

### Investigating AWS Account Closed

AWS account closure is one of the most destructive actions that can be performed against an AWS account. Even during
the 90-day suspension/grace period before permanent termination, the account and its resources are inaccessible. This
action requires either root credentials on the account itself, or organization-management-level permissions to close
a member account, making any unauthorized occurrence a critical security incident.

This rule covers both closure paths: self-service closure (`event.provider: account.amazonaws.com`) and closure of a
member account initiated from the organization's management account (`event.provider: organizations.amazonaws.com`).

#### Possible investigation steps

- **Identify the actor**: review `aws.cloudtrail.user_identity.arn` and `aws.cloudtrail.user_identity.type` to
  determine who initiated the closure, and from which account context (the closed account itself, or the
  organization's management account).
- **Determine which account was closed**: check `cloud.account.id` and `aws.cloudtrail.request_parameters` (the
  organization-initiated path includes the target `AccountId`).
- **Contact the account/organization owner immediately** to confirm intent — this should never be a surprise.
- **Act within the grace period**: AWS Organizations can cancel a pending closure during the up-to-90-day suspension
  window if the action was unauthorized.
- **Review the actor's other activity** immediately before and after the closure for signs of broader compromise
  (credential creation, privilege escalation, log tampering).

### False positive analysis

- Legitimate account decommissioning or consolidation will show the same event. Confirm against change-management
  records and organizational restructuring plans before escalating further.

### Response and remediation

- Contact AWS Support immediately to attempt cancellation/restoration within the grace period.
- Revoke or rotate credentials for the identity that initiated the closure, and escalate to incident response.
- Preserve all available CloudTrail logs and evidence from the affected account before access is lost.
- Review organization-level permissions to ensure `organizations:CloseAccount` and `account:CloseAccount` are
  restricted to a small, trusted set of administrative identities.

"""
references = [
    "https://docs.aws.amazon.com/accounts/latest/reference/API_CloseAccount.html",
    "https://docs.aws.amazon.com/organizations/latest/APIReference/API_CloseAccount.html",
    "https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_close.html",
]
risk_score = 47
rule_id = "c45844ce-5e16-497d-88a6-e4bbc66133ce"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Data Source: AWS",
    "Data Source: Amazon Web Services",
    "Data Source: AWS CloudTrail",
    "Use Case: Threat Detection",
    "Tactic: Impact",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset: "aws.cloudtrail"
    and event.action: "CloseAccount"
    and event.outcome: "success"
    and event.provider: ("account.amazonaws.com" or "organizations.amazonaws.com")
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1485"
name = "Data Destruction"
reference = "https://attack.mitre.org/techniques/T1485/"

[[rule.threat.technique]]
id = "T1531"
name = "Account Access Removal"
reference = "https://attack.mitre.org/techniques/T1531/"

[rule.threat.tactic]
id = "TA0040"
name = "Impact"
reference = "https://attack.mitre.org/tactics/TA0040/"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user_agent.original",
    "source.ip",
    "aws.cloudtrail.user_identity.arn",
    "aws.cloudtrail.user_identity.type",
    "event.provider",
    "event.action",
    "event.outcome",
    "aws.cloudtrail.request_parameters",
    "cloud.account.id",
    "cloud.region",
]

[metadata]
creation_date = "2026/07/13"
integration = ["aws"]
maturity = "production"
updated_date = "2026/07/13"

[rule]
author = ["Elastic"]
description = """
Detects any attempt, successful or denied, for a member account to leave an AWS Organization via the LeaveOrganization
API. Leaving an organization immediately strips the account of every Service Control Policy (SCP) guardrail the
organization enforces, removes it from centralized CloudTrail aggregation, and eliminates the management account's
ability to audit or control it going forward. An adversary who has gained root or organization-management-capable access
in a member account may use this technique to escape organizational security controls and operate unmonitored. Denied
attempts are included because a blocked call is just as strong a signal of intent as a successful one, and is often the
only trace left when the account's default permissions correctly prevent the action.
"""
false_positives = [
    """
    Accounts may legitimately leave an organization during company splits, divestitures, or other structural changes.
    This action requires the account's root credentials or an explicit policy granting
    `organizations:LeaveOrganization`. Any unexpected event, successful or denied, should be treated as a critical
    incident requiring immediate investigation and confirmation with account/organization owners.
    """,
]
from = "now-6m"
index = ["logs-aws.cloudtrail-*"]
language = "kuery"
license = "Elastic License v2"
name = "AWS Attempt to Leave Organization"
note = """## Triage and analysis

### Investigating AWS Attempt to Leave Organization

Leaving an AWS Organization removes every SCP-based guardrail from the account, cuts it off from centralized
monitoring (CloudTrail, GuardDuty, Security Hub aggregation at the organization level), and eliminates the management
account's ability to audit or control it. This is one of the most consequential defense-evasion actions available to
an adversary with sufficient access in a member account.

This rule fires on any `LeaveOrganization` call regardless of outcome — a denied attempt (for example, `AccessDenied`
because the calling principal lacks the permission) is still a critical indicator that someone attempted this action.

### Possible investigation steps

- **Identify the actor**: review `aws.cloudtrail.user_identity.arn` and `aws.cloudtrail.user_identity.type` —
  only root or a principal with an explicit `organizations:LeaveOrganization` grant can succeed at this.
- **Check the outcome**: if `event.outcome` is `success`, treat this as an active, ongoing incident — the account has
  already left the organization. If denied, determine why the attempt was made and whether the same actor has
  broader access that could be escalated to succeed.
- **Review source context**: check `source.ip`, `user_agent.original`, and `source.geo` for anomalies.
- **Correlate with other defense evasion or persistence activity**: look for recent IAM changes (new roles, policy
  attachments), root login events, or other attempts to shed organizational oversight around the same time.
- **Contact the account and organization owners immediately** to confirm whether this was an authorized, planned
  departure.

### False positive analysis

- Legitimate organizational restructuring (account divestiture, company split) can trigger this. Confirm with
  organization administrators and require documented change management before treating as benign.

### Response and remediation

- If successful and unauthorized, use `InviteAccountToOrganization` from the management account to re-invite the
  departed account as soon as possible, and treat the account as compromised in the interim.
- If denied, investigate how the calling principal obtained enough access to attempt this at all, and whether it can
  reach the required permission through another path (privilege escalation).
- Revoke or rotate credentials for the identity that made the call.
- Review the account's activity for the period immediately before and after the attempt for other compromise
  indicators.

"""
references = [
    "https://docs.aws.amazon.com/organizations/latest/APIReference/API_LeaveOrganization.html",
    "https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_remove.html",
    "https://stratus-red-team.cloud/attack-techniques/AWS/aws.defense-evasion.organizations-leave/",
]
risk_score = 47
rule_id = "4236393d-090e-4dfa-9e32-c9a7ec6189ee"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Data Source: AWS",
    "Data Source: Amazon Web Services",
    "Data Source: AWS CloudTrail",
    "Data Source: AWS Organizations",
    "Use Case: Threat Detection",
    "Tactic: Defense Evasion",
    "Tactic: Impact",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset: "aws.cloudtrail"
    and event.provider: "organizations.amazonaws.com"
    and event.action: "LeaveOrganization"
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[rule.threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"



[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1531"
name = "Account Access Removal"
reference = "https://attack.mitre.org/techniques/T1531/"


[rule.threat.tactic]
id = "TA0040"
name = "Impact"
reference = "https://attack.mitre.org/tactics/TA0040/"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user_agent.original",
    "source.ip",
    "aws.cloudtrail.user_identity.arn",
    "aws.cloudtrail.user_identity.type",
    "aws.cloudtrail.user_identity.access_key_id",
    "event.provider",
    "event.action",
    "event.outcome",
    "aws.cloudtrail.error_code",
    "aws.cloudtrail.error_message",
    "cloud.account.id",
    "cloud.region",
]

[metadata]
creation_date = "2025/02/25"
integration = ["azure_openai"]
maturity = "production"
updated_date = "2025/09/25"

[rule]
author = ["Elastic"]
description = """
Detects when Azure OpenAI requests result in zero response length, potentially indicating issues in output handling that
might lead to security exploits such as data leaks or code execution. This can occur in cases where the API fails to
handle outputs correctly under certain input conditions.
"""
false_positives = ["Queries that are designed to expect empty responses or benign system errors"]
from = "now-60m"
interval = "10m"
language = "esql"
license = "Elastic License v2"
name = "Azure OpenAI Insecure Output Handling"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Azure OpenAI Insecure Output Handling

Azure OpenAI integrates AI capabilities into applications, enabling natural language processing tasks. However, improper output handling can lead to vulnerabilities, such as data leaks or unauthorized code execution. Adversaries might exploit these by crafting inputs that cause the API to mishandle responses. The detection rule identifies anomalies by flagging instances where API responses are unexpectedly empty, suggesting potential misuse or misconfiguration, especially when such events occur frequently.

### Possible investigation steps

- Review the logs for the specific Azure resource name flagged in the alert to understand the context and frequency of zero-length responses.
- Examine the request lengths associated with the zero-length responses to identify any patterns or anomalies in the input data that might be causing the issue.
- Check the cloud account ID associated with the alert to determine if there are any known issues or recent changes in configuration that could affect output handling.
- Investigate the operation name "ChatCompletions_Create" to ensure that the API is being used as intended and that there are no unauthorized or unexpected uses.
- Assess the overall environment for any recent updates or changes in the Azure OpenAI configuration that might have impacted output handling.

### False positive analysis

- Frequent legitimate requests with zero response length can occur during testing or development phases. To manage this, exclude known test environments or accounts from the detection rule by adding exceptions for specific cloud.account.id or azure.resource.name values.
- Some applications may intentionally send requests that do not require a response, resulting in zero response length. Identify these applications and adjust the rule to exclude their specific azure.resource.name.
- Network issues or temporary service disruptions can lead to zero-length responses. Monitor for patterns of such occurrences and consider excluding specific time frames or network segments if they are known to cause false positives.
- Automated scripts or bots that interact with the API might generate zero-length responses as part of their normal operation. Identify these scripts and exclude their associated identifiers from the rule to prevent false alerts.

### Response and remediation

- Immediately isolate the affected Azure OpenAI resource to prevent further exploitation. This can be done by temporarily disabling the API or restricting access to it.
- Review and validate the input handling mechanisms of the affected API to ensure they are robust against malformed or malicious inputs that could lead to insecure output handling.
- Conduct a thorough audit of recent API requests and responses to identify any unauthorized access or data leaks. Pay special attention to requests with zero response length.
- Implement additional logging and monitoring for the affected API to capture detailed information about requests and responses, which can help in identifying patterns or repeated attempts of exploitation.
- Notify the security team and relevant stakeholders about the incident, providing them with detailed findings and any potential impact on data security.
- If unauthorized access or data leakage is confirmed, follow the organization's incident response plan to notify affected parties and comply with any regulatory requirements.
- Enhance detection capabilities by integrating anomaly detection tools that can identify unusual patterns in API usage, such as frequent zero-length responses, to prevent similar threats in the future.
"""
references = ["https://genai.owasp.org/llmrisk/llm02-insecure-output-handling"]
risk_score = 21
rule_id = "fb16f9ef-cb03-4234-adc2-44641f3b71ee"
setup = """## Setup

For more information on streaming events, see the Azure OpenAI documentation:

https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/stream-monitoring-data-event-hubs
"""
severity = "low"
tags = [
    "Domain: LLM",
    "Data Source: Azure OpenAI",
    "Data Source: Azure Event Hubs",
    "Use Case: Insecure Output Handling",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "esql"

query = '''
from logs-azure_openai.logs-*
| where
    azure.open_ai.properties.response_length == 0 and
    azure.open_ai.result_signature == "200" and
    azure.open_ai.operation_name == "ChatCompletions_Create"
| keep
    azure.open_ai.properties.request_length,
    azure.open_ai.result_signature,
    cloud.account.id,
    azure.resource.name
| stats
    Esql.event_count = count(*)
  by
    azure.resource.name
| where
    Esql.event_count >= 10
| sort
    Esql.event_count desc
'''

[metadata]
creation_date = "2020/08/31"
integration = ["azure"]
maturity = "production"
updated_date = "2026/04/10"

[rule]
author = ["Elastic"]
description = """
Identifies an invitation to an external user in Azure Active Directory (AD). Azure AD is extended to include
collaboration, allowing you to invite people from outside your organization to be guest users in your cloud account.
Unless there is a business need to provision guest access, it is best practice avoid creating guest users. Guest users
could potentially be overlooked indefinitely leading to a potential vulnerability.
"""
false_positives = [
    """
    Guest user invitations may be sent out by a system or network administrator. Verify whether the username, hostname,
    and/or resource name should be making changes in your environment. Guest user invitations from unfamiliar users or
    hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
    """,
]
from = "now-9m"
index = ["logs-azure.auditlogs-*", "filebeat-*"]
language = "kuery"
license = "Elastic License v2"
name = "Entra ID External Guest User Invited"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Entra ID External Guest User Invited

Azure Active Directory (AD) facilitates collaboration by allowing external users to be invited as guest users, enhancing flexibility in cloud environments. However, adversaries may exploit this feature to gain unauthorized access, posing security risks. The detection rule monitors audit logs for successful external user invitations, flagging potential misuse by identifying unusual or unnecessary guest account creations.

### Possible investigation steps

- Review the audit logs to confirm the details of the invitation event, focusing on the operation name "Invite external user" and ensuring the event outcome is marked as Success.
- Identify the inviter by examining the properties of the audit log entry, such as the initiator's user ID or email, to determine if the invitation was expected or authorized.
- Check the display name and other attributes of the invited guest user to assess if they align with known business needs or if they appear suspicious or unnecessary.
- Investigate the inviter's recent activity in Azure AD to identify any unusual patterns or deviations from their typical behavior that might indicate compromised credentials.
- Consult with relevant business units or stakeholders to verify if there was a legitimate business requirement for the guest user invitation and if it aligns with current projects or collaborations.
- Review the access permissions granted to the guest user to ensure they are limited to the minimum necessary for their role and do not expose sensitive resources.

### False positive analysis

- Invitations for legitimate business partners or vendors may trigger alerts. Regularly review and whitelist known partners to prevent unnecessary alerts.
- Internal users with dual roles or responsibilities that require external access might be flagged. Maintain a list of such users and update it periodically to exclude them from alerts.
- Automated systems or applications that require guest access for integration purposes can cause false positives. Identify these systems and configure exceptions in the monitoring rules.
- Temporary projects or collaborations often involve inviting external users. Document these projects and set expiration dates for guest access to minimize false positives.
- Frequent invitations from specific departments, such as HR or Marketing, for events or collaborations can be common. Establish a process to verify and approve these invitations to reduce false alerts.

### Response and remediation

- Immediately disable the guest user account identified in the alert to prevent any unauthorized access or activities.
- Review the audit logs to determine the source and context of the invitation, identifying the user or system that initiated the guest invitation.
- Notify the security team and relevant stakeholders about the unauthorized guest invitation for further investigation and potential escalation.
- Conduct a security assessment of the affected Azure AD environment to identify any other unauthorized guest accounts or suspicious activities.
- Implement conditional access policies to restrict guest user invitations to authorized personnel only, reducing the risk of future unauthorized invitations.
- Enhance monitoring and alerting for guest user invitations by integrating with a Security Information and Event Management (SIEM) system to ensure timely detection and response.
- Review and update the organization's Azure AD guest user policies to ensure they align with security best practices and business needs, minimizing unnecessary guest access.

## Setup

The Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
references = ["https://docs.microsoft.com/en-us/azure/governance/policy/samples/cis-azure-1-1-0"]
risk_score = 21
rule_id = "141e9b3a-ff37-4756-989d-05d7cbf35b0e"
severity = "low"
tags = ["Domain: Cloud", "Data Source: Azure", "Use Case: Identity and Access Audit", "Tactic: Initial Access", "Resources: Investigation Guide"]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset:azure.auditlogs and azure.auditlogs.operation_name:"Invite external user" and azure.auditlogs.properties.target_resources.*.display_name:guest and event.outcome:(Success or success)
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"

[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"

[[rule.threat.technique]]
id = "T1136"
name = "Create Account"
reference = "https://attack.mitre.org/techniques/T1136/"

[[rule.threat.technique.subtechnique]]
id = "T1136.003"
name = "Cloud Account"
reference = "https://attack.mitre.org/techniques/T1136/003/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[rule]
description = "Identifies execution behavior from known malware or testing tools based on known call stack trailing bytes patterns."
id = "0a26ccb6-41b9-418d-9314-854aadcb1fba"
license = "Elastic License v2"
name = "Execution from Suspicious Stack Trailing Bytes"
os_list = ["windows"]
version = "1.0.34"

query = '''
any where event.category in ("library", "api") and
           _arraysearch(process.thread.Ext.call_stack, $entry,
                                                       $entry.callsite_trailing_bytes like
                                                             (/* CBR */
                                                              "4989c54885c00f841002000048c7442438000000004531c94c89*",
                                                              "*4889c24885c00f848b020000b9dedbfe0e4531e4*",
                                                              "837c244004752e4883642428004533c983642420004c8bc333d233c941ffd7488d48ff4883f9fd770c83caff488bc8ff152d1c0000488b8db00100004833cce8",
                                                              "4989c54885c00f849e02000048c7442438000000004531c94c89e2440fb783a4810000c7442430000000004889c1c74424280300000048c744242000000000ff",
                                                              "85c07507b800000000eb07488d05441c00004883c4305dc3554889e54883ec70488*",
                                                              "*4883c4305dc3554889e54883ec7048894d10488b4510c74424200000000041b9*",
                                                              "8b4c244c*4c897424204531c0ba0200000048894424604989c1b902000000ff15*",
                                                              "488b5550488b4d58e8d70700004533ff0fb74b0641ffc44883c728443be17288498bc6eb0233c0488b9c24a00000004883c460415f415e415d415c5f5e5dc3cc",
                                                              /* CNH */
                                                              "85c00f88f300000033c04883c720493bfe*",
                                                              "*85c0752a488d4424304889442420448b4c24304c8b442450488b542448*",
                                                              "4883c448c3000000*8954241048894c24084883ec48e8*",
                                                              "4883c448c3000000*4885c0744065488b0425300000004889442420488b442420*",
                                                              "89442434e9*488b8c2440010000e8*85c0752?488d4424304889442420*",
                                                              "85c07d0eb914000000e8515af9ff32c0eb15837c2450007502eb05e9c2fdffffe9fdfbffffb0014881c4e80000005f5ec3cccc48894c24084883ec38488b4424",
                                                              "85c07c0ac744242001000000eb08c7442420000000008b4424204881c4000500005fc3cccccc40574883ec70488d442458488bf833c0b910000000f3aa48c744",
                                                              "894424548b442454e9c9000000e9bf000000488b442438488944246048c744245804000000c744244400000000488d4424444889442428c7442420400000004c",
                                                              "4889442448eb21e886c9ffff83f8017517488b542430488b8c2440010000e88bfaffff488944244848837c2448007511b918000000e80047f9ff32c0e9fd0600",
                                                              "*741041ffc04883c008443b411872ef33c0*",
                                                              "*4885c07511ffc383fb1472d3eb08488bceffd5*",
                                                              "f7d0c1e81f488b5c2450488b7424584883c4305fc3cc*",
                                                              "f7d0c1e81f85c0????488b5424608b4c2440890a4883c4305bc3cccccc*",
                                                              "4889442448eb21e8*83f8017517488b542430488b8c2440010000e8*488944244848837c2448007511b918000000e8*",
                                                              "c3000000000000000031c065480b40304c8b98100100008b40684989ca41ffe300cccccccc488d0d*",
                                                              "85c0781a33c04503f7498bcff3aa443bf60f8267ffffff448d4001418bd88bc3488b9c24c80000004881c480000000415f415e415d415c5f5e5dc3cccc4885c9",
                                                              "*48895c241048896c2418565741564883ec30448b74247033db498bf9418bf0488bea*",
                                                              "*b0014881c4d80000005f5ec348894c24084883ec38488b442440488b40084863403c488b4c24404803*",
                                                              "*83f803752b488d442430488944242041b9400000004c8b442450488b542448488b8c24300100*",
                                                              "eb248b4424604c8d4c244889442428488d5424404533c0895c2420*",
                                                              "*418b45284c8d442458ba010000004c29e04801c8ffd0eb254189c141c1f91f4183e1704183c110*",
                                                              "e947ffffff418b45284c8d442458ba010000004c29e04801c8ffd0eb254189c141c1f91f4183e1704183c110eb834189c141c1f91f4183e1024183c102e963ff",
                                                              "4889442448eb21e842d1ffff83f8017517488b542430488b8c2400010000e8e7faffff488944244848837c2448007511b918000000e8f8d0ffff32c0e96c0500",
                                                              "f7d0c1e81f488b5c2450488b7424584883c4305fc3cc48895c240848896c241856574154415641574883ec40*",
                                                              /* CCS-1 */
                                                              "4889059a840300bb040000004c8d442468488bc88d5301448bcbff15591d0200488b0d7a8403004c8d4424688d5302448bcbff15411d0200488b058284030048", 
                                                              "*0300eb394533c033d2eb1a4533c0418bd6eb12b920000000e856*", 
                                                              "*0000ba030000004c8bc083642420004533c9488bcbff15*",
                                                              "4889842498000000488b4424388b00488b8c24880000004803c8488bc14889442430488b4424388b4010488b8c24880000004803c8488bc14889442428488b44", 
                                                              "880000004803c8488bc1488b7c2420488bf0b940000000f3a4448b8424a0000000ba40000000488b4c2420e846f3ffff488b4c2420488b842480000000ff5010",
                                                              "0f57c00f11458748c745970700000048c7459f0f000000488b0523e203008945870fb7051de203006689458b0fb60514e2030088458dc6458e00488d4d87e81e",
                                                              "45fc8b4dfc83790c000f842c0100008b55fc8b750c03720c8b7de0b940000000f3a48b4518506a40*",
                                                              "eb09ff7508ff15*5f5ec9c3558bec515133c9390d*",
                                                              "83c40c6a045ae8f297000050ff74241cff742430e8f715000083c40c3bc78944241c7e2eff742418e83e9200003bc7598944241c7e0f8b7c241850e831790000",
                                                              "5feb088b4508e8d819000033c040c9c20c00558bec83ec5457c745c400000000c745bc00000000c745d000000000c745d441414141c745d842424242c745dc00",
                                                              "41837c2404014c8bf8750deb06c6030048ffc3803b0075f58b1f8b77104803dd4803f5eb774885db743048833b007d2a4963473c0fb713428b8c388800000042",
                                                              "eb17448bcb4d8bc7498bd4498bce48897c2420ff15024d01004c8d5c2450498b5b38498b6b40498be3415f415e415c5f5ec3cc48895c240848896c2410488974",
                                                              /* CCS-2 */
                                                              "4831c94831d24d31c04d31c94150415041ba3a5679a7ffd5*",
                                                              "eb16448bcb4d8bc7498bd4498bce897c2420ff15*",
                                                              "*41ba57899fc6ffd5eb595b4889c14831d24989d84d31c95268*",
                                                              "*415141ba57899fc6ffd5eb795b4889c14831d24989d84d31c9526800*",
                                                              "*4d31c9415141516a03415141ba57899fc6ffd5eb*",
                                                              "458b7710458b274c03f34533db4c03e34c8be84d391e0f849c0000004c8b7c24284d85e47439*",
                                                              "489353534889e74889f14889da41b8002000004989f9*",
                                                              "85c0750956e853ffffff59eba38bc65e5bc9c35633f6*",
                                                              "489353534889e74889f14889da41b8002000004989f941ba12*",
                                                              "*904883c4405b5e5f5d415cc39090555756534883ec584531c041b9",
                                                              "*5f5ec9c3558bec515133c9390d*",
                                                              "c9c3ff7508ff15*c9c3558bec51515633f63935*",
                                                              "8b4da84c8d442420894c2428418bd4488b4da048894c24208b4dac894c242c498bceffd34d8bc7*",
                                                              "8b3b4c8bf08b73104803fd4803f5eb*",
                                                              "eb17448bcb4d8bc7498bd4498bce48897c2420ff15024d01004c8d5c2450498b5b38498b6b40498be3415f415e415c5f5ec3cc48895c240848896c2410488974",
                                                              "488bf04883f8ff750733c0e99e00000048895c244048895c2438488d8424580600004889442430488d4424504533c94533c0ba7f740440488bcec7442428f005",
                                                              "4889442430488b842480000000c7401800000200488b842480000000c7806401000001000000488b842480000000c70002000000488b842480000000488b4c24",
                                                              "8945148b55fc8b450c03028945f48b4dfc8b550c0351108955f08b45f08338000f84c8000000837df40074628b4df48b1181e20000008074558b45148b4d1403",
                                                              "8945f48b45f48be55dc3cccccccccc558bec51837d0c007422837d1000761c837d140475168d45fc506a208b4d10518b550c528b45088b4814ffd18be55dc355",
                                                              "488905360b0300bb040000004c8d442468488bc88d5301448bcbff1575ec0100488b0d160b03004c8d4424688d5302448bcbff155dec0100488b0dfe0a030048",
                                                              "488b0d93db02004c63c7488bd6e860930000448b442440488b0d7cdb02004c8d4c24408bd7ff150fb80100b918000000e8358a000048890566db0200e81d7700",
                                                              "41837c2404014c8bf8750deb06c6030048ffc3803b0075f58b1f8b77104803dd4803f5eb774885db743048833b007d2a4963473c0fb713428b8c388800000042",
                                                              "450fb6f6b90100000085c0440f49f1488b4df04885c9740b488b11ff5210488365f000488b4df84885c97406488b11ff5210488b5c2450488b742458488b7c24",
                                                              "b918000000e8358a000048890566db0200e81d770000488b0d5adb0200488901b92a000000e881770000488b0d46db020048894108e899a00000448bc0b80904",
                                                              "458b7710458b274c03f34533db4c03e34c8be84d391e0f849c0000004c8b7c24284d85e4743948b800000000000000804985042474294963453c410fb7142442",
                                                              "4889058fa90300bb040000004c8d442468488bc88d5301448bcbff152e3a0200488b0d6fa903004c8d4424688d5302448bcbff15163a0200488b05bf34030048",
                                                              "8b4d50488bf8488bd833c0f3aa4533db448a4510448b555041bd010000004983c2c044888424b80000004c03d34c895424384584c074088b4538482bd8eb218b",
                                                              "4889c1ebc448c705e90300000000000066418b4500894424544983c5024c896c244831f631c9ba0000100041b80010000041b940000000ff153c0300004889c7",
                                                              "4c8bc885f674204c8bc0482bf833d28bc3ffc3f7f5428a04324232040741880049ffc03bde72e6488b5c2430488b6c2438488b742440488b7c24484883c42041",
                                                              "488b6c24404c8b7c245083c502b8c5735176e93cfdffff3df15c5c3e0f8df80000003de0dfc83b0f8526fdffffe9500100003d3afaff1c0f8d010100003ddecf",
                                                              "4831c94831d24d31c04d31c94150415041ba3a5679a7ffd5eb735a4889c141b8280300004d31c9415141516a03415141ba57899fc6ffd5eb595b4889c14831d2",
                                                              "48894578e9e400000048837d40000f8493000000488b4540488b004885c00f8983000000488b45788b403c4863d0488b45784801d048894510488b4510480588",
                                                              "2fed0db2cd58f89eb8e16ee7f60fb2c04d26348c4e4626b9af354fa66d694a9f1f7fa92233db59a4b2c245267c3bd8352af9f1be8c73151d0a5cfa37d57af026",
                                                              "e69fa6540e4a73b1951a27ad7bc6c06babe52607616bddf0e5b886d4c68f898d945084d97a91d46dc069a3e56eb0f718d1b0bb334501befbc94e7118f881b96c",
                                                              "eb27b92b000000e85ad70000448b0587b7030033d20fb7c033c941b90030000089442420e8a1f4000048890562b703004885c0752dff15ef4502008b1559b703",
                                                              "488905b9b703004885c074d5448b05a5b7030033d2488bc8ff1552460200eb27b92b000000e85ad70000448b0587b7030033d20fb7c033c941b9003000008944",
                                                              "8b4da84c8d442420894c2428418bd4488b4da048894c24208b4dac894c242c498bceffd34d8bc7488d0d15feffffba04000000ffd3488bc3eb0233c04c8d9c24",
                                                              "89442440837c244000740733c0e92601000048c784240801000000000000488b8424100100008b40504889842450010000488b8424000100004889442430c744",
                                                              "8b3b4c8bf88b73104903fe4903f6eb7a4885ff742d48833f007d274963473c0fb717428b8c3888000000428b443910428b4c391c482bd04903cf8b04914903c7",
                                                              "85c00f8898000000488b4c245831d2ff158a1f000085c00f888300*",
                                                              "85c07507b801000000eb304d85f675144c8bcf448bc3498bd7498bccff15*",
                                                              "85c07502eb368b442430050010000089442430*",
                                                              "eb33488b8424e00000004889442420448b8c24d80000004c8b8424d0000000488b9424c8000000488b8c24c0000000ff*",
                                                              "eb16448bcb4d8bc7498bd4498bce897c2420*",
                                                              "89442420837c2420007518488b442458488b00488b00488b4c2458488b09ff5050eb1b4c8b442440*",
                                                              "33c985c00f84f0feffff48395c2438*", "33c985c00f8481feffff8b85340100004839442438*",
                                                              "0fb7450641ffc64883c628443bf0728b488b5c24784883c430415f415e415d415c*",
                                                              "488983100300004885c00f8433ffffff488*",
                                                              "488b5c2460488b6c2468488b7424704883c440415f415e5fc3cccc48895c24084889742410574883ec208b41144963f0488bf92b41103bf0*",
                                                              /* CCS-3 */
                                                              "*b800000000b9??0000004889d7f348ab*",
                                                              "*4153415141504883ec20*",
                                                              "*4151415241534883ec20*",
                                                              "*4152415041534883ec20*",
                                                              "*4883ec20b95bbc4a6aba*",
                                                              "*4883ec20b95d68fa3cba*",
                                                              "*4889d7f348ab*4883ec20*",
                                                              "*488b85e8030000488945c048c745c8*488b85e8030000488945d0*",
                                                              "*89c1488b4578488d9000100000488b85800000004189c84889c1*",
                                                              /* MYHANIB */
                                                              "85c0793ae98f0000004889c1ba5a4ce93be8*48894424684885c07478488b8c2420030000ba8828e950e8*000048894424784885c075a2eb5a488b",
                                                              "ba777791a7488983f00200004889c1e8*488b8bf0020000*48898338020000e8",
                                                               /* CHAV */
                                                              "85c07583488b0e488b01ff5050b8010000004883c4385b5e5f415cc3909090909057534883ec4848c74424300000000048c7442438000000004885c90f84ba00",
                                                              "85c0790d488b13488b92c208000089426831c0b908020000f3aab910000000488d7c2468f3aa488b4c24504885c9740ee8ea5c000048c744245000000000488b",
                                                              "eb094889d9ff90????00004883c4305bc3909090909090905331c04889cb4883ec3048894424204889442428*",
                                                              "e93dffffff8b43284c8d442458ba010000004c29e04801c8ffd04881c4880000005b5e5f5d415c415d415e415fc39090909090909090904989c9*",
                                                              /* dotnut shellcode */
                                                              "eb084c213beb034d213e85c07930498d461033d24c8d8e5406000048894424204c8d864406000033c9ff963801000085c0790b4d217e1033c0e923010000498b",
                                                              "488b5c2470488b7424784883c4605fc3488bc3ebebcccc*",
                                                              /* MP sc */
                                                              "53534889e1535a4d31c04d31c9535349ba041f9dbb00000000ffd54989c4e81a0000003100390032002e003100360038002e0031002e003500350000005a4889",
                                                              /* Qbot */
                                                              "85c0740d508bd78bcbe875ffffff598bf08d45fc50e86f080000595f8bc65e5bc9c353bb0001000053e82efcffff8bd08915041002105985d2750583c8ff5bc3",
                                                              /* sRDI */
                                                              "0fb745064783c6286a205a3bf872816a006a006affff9424c800000083bdc40000000074268b85c00000008b74180c8b0685c0741633ed456a005553ffd08d76",
                                                              /* GPulse */
                                                              "8bcb8bd585ed74182bf30f1f8400000000008a040e8d49018841ff83ea0175f28d44242450ff7424285553ffd7*",
                                                              "8b45e4508b4dac51*83c40c8b45ac998b4dc48981c00c00008991c40c0000c745cc000000008d55cc528b45fc8b4804518b55e8528b45e450ff55a8",
                                                              /* AdC2 */
                                                              "8b53544889c631c04839c2740b8a0c07880c0648ffc0ebf00fb7*",
                                                              "8345e801488b45d80fb740060fb7c03945e8*",
                                                              "488945e048837de000751741b800000000ba00000000b905010000e827*",
                                                              "4889038b45ec4898488d14c500000000488b45204801d0488b004885c07515*",
                                                              "488945d0488b4d10e84c9f000089c2488d85c0fbffff4989d0ba000000004889c1*",
                                                              "488945d0488b05??????00488b55d04889502848837dd0000f8470020000*",
                                                              "48898424100100004883bc241001000000751741b800000000ba00000000b905010000*",
                                                              "4889842430040000488b45104889c1e8????000089c2488d4424204989d0ba000000004889c1*",
                                                              "*488b55e84889501048837de8007422488b45e8*",
                                                              /* DANTE */
                                                              "8bf085c00f89b80000004983feff0f85ae000000488b5510*"
                                                              ))
'''

min_endpoint_version = "8.8.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"

[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "8.8.0"

[metadata]
creation_date = "2026/07/10"
integration = ["gcp"]
maturity = "production"
updated_date = "2026/07/10"

[rule]
author = ["Elastic"]
description = """
Detects when the same non-system GKE identity creates a CertificateSigningRequest (CSR) and then approves that same CSR
within five minutes, consistent with self-approval abuse. Attackers who gain CSR create and approval RBAC
can submit a certificate request and approve it themselves to obtain a long-lived client certificate without involving
cluster operators, a pattern documented in Kubernetes persistence research and adversary emulation.
"""
false_positives = [
    """
    Automation that both submits and approves CSRs in one workflow may trigger this rule. Baseline cert-manager or
    internal PKI pipelines and tune exclusions for known service accounts.
    """,
]
from = "now-11m"
language = "esql"
license = "Elastic License v2"
name = "GKE Certificate Signing Request Self-Approved"
note = """## Triage and analysis

### Investigating GKE Certificate Signing Request Self-Approved

This rule groups CSR create and approval events by `client.user.email` and normalized CSR name (`Esql.csr_name`).
GKE logs approval on subresource paths (`.../csr-name/approval`), so the query strips `/approval` suffixes before
correlating. An alert means the same identity both submitted and approved the same CSR within five minutes, a strong
indicator of manual self-approval rather than normal `system:gcp-controller-manager` auto-approval of node
certificates.

### Possible investigation steps

- Review `Esql.event_action_values` for the sequence of create followed by `approval.update`.
- Inspect `gcp.audit.request.spec.signerName` and decode `gcp.audit.request.spec.request` on create events for the
  requested identity.
- Validate whether the actor should hold both CSR create and approval permissions.
- Hunt for subsequent API activity authenticated as the minted certificate identity.

### False positive analysis

- cert-manager or internal PKI automation that creates and approves CSRs under the same service account in one workflow.
- GitOps or bootstrap tooling that submits and signs CSRs programmatically. Baseline known automation and tune exclusions
  for those principals.
- Two unrelated CSR events from the same user within five minutes should not match because the query requires at least
  one create and one approval-class action on the same normalized CSR name.

### Related rules

- GKE Certificate Signing Request API Client Signer Requested - 1e344fba-a2f7-462b-aaec-d6c8f80d5a28
- GKE Certificate Signing Request Privileged Identity Requested - 4159bec9-76ad-4cdc-a797-4a8572073bbe
- GKE Client Certificate Signing Request Created or Approved - ec67ab57-945a-4edb-84f8-1d7a51f46544

### Response and remediation

- Revoke or deny the CSR, remove approval RBAC from untrusted principals, and rotate cluster signing credentials if
  abuse is confirmed.

"""
setup = "The GCP Fleet integration with GKE audit logs enabled is required to be compatible with this rule."
references = [
    "https://kubernetes.io/docs/reference/access-authn-authz/certificate-signing-requests/",
    "https://kubernetes.io/docs/concepts/security/rbac-good-practices/",
    "https://stratus-red-team.cloud/attack-techniques/kubernetes/k8s.persistence.create-client-certificate/",
    "https://raesene.github.io/blog/2022/12/21/Kubernetes-persistence-with-Tocan-and-Teisteanas/",
    "https://www.aquasec.com/blog/kubernetes-rbac-privilige-escalation/",
]
risk_score = 73
rule_id = "e155e658-3dcd-4d27-a4e5-1d8da6704b0e"
severity = "high"
tags = [
    "Domain: Cloud",
    "Domain: Kubernetes",
    "Data Source: GCP",
    "Data Source: GCP Audit Logs",
    "Data Source: Google Cloud Platform",
    "Use Case: Threat Detection",
    "Tactic: Persistence",
    "Tactic: Privilege Escalation",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "esql"

query = '''
from logs-gcp.audit-* metadata _id, _index, _version
| where data_stream.dataset == "gcp.audit"
    and service.name == "k8s.io"
    and event.outcome == "success"
    and event.action in (
      "io.k8s.certificates.v1.certificatesigningrequests.create",
      "io.k8s.certificates.v1.certificatesigningrequests.approval.update"
    )
    and client.user.email is not null
    and gcp.audit.resource_name is not null
    and not client.user.email in (
      "system:gcp-controller-manager",
      "system:kube-controller-manager",
      "system:serviceaccount:kube-system:certificate-controller",
      "kubelet-bootstrap",
      "kubelet-nodepool-bootstrap"
    )
    and not client.user.email like "system:node:*"
| eval Esql.csr_name = replace(gcp.audit.resource_name, "/approval", "")
| stats
    Esql.create_count = count(*) where event.action == "io.k8s.certificates.v1.certificatesigningrequests.create",
    Esql.approval_count = count(*) where event.action == "io.k8s.certificates.v1.certificatesigningrequests.approval.update",
    Esql.event_action_values = values(event.action),
    Esql.timestamp_first_seen = min(@timestamp),
    Esql.timestamp_last_seen = max(@timestamp),
    Esql.source_ip_values = values(source.ip),
    Esql.user_agent_original_values = values(user_agent.original),
    Esql.data_stream_namespace_values = values(data_stream.namespace)
  by client.user.email, Esql.csr_name
| where Esql.create_count >= 1
    and Esql.approval_count >= 1
    and date_diff("seconds", Esql.timestamp_first_seen, Esql.timestamp_last_seen) <= 300
| keep client.user.email, Esql.*
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"

[[rule.threat.technique.subtechnique]]
id = "T1098.006"
name = "Additional Container Cluster Roles"
reference = "https://attack.mitre.org/techniques/T1098/006/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"

[[rule.threat.technique.subtechnique]]
id = "T1098.006"
name = "Additional Container Cluster Roles"
reference = "https://attack.mitre.org/techniques/T1098/006/"

[rule.threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[rule.investigation_fields]
field_names = [
    "client.user.email",
    "Esql.csr_name",
    "Esql.create_count",
    "Esql.approval_count",
    "Esql.event_action_values",
    "Esql.timestamp_first_seen",
    "Esql.timestamp_last_seen",
    "Esql.source_ip_values",
    "Esql.user_agent_original_values",
    "Esql.data_stream_namespace_values",
]

[metadata]
creation_date = "2022/01/27"
integration = ["system", "windows"]
maturity = "production"
updated_date = "2026/05/03"

[rule]
author = ["Elastic"]
description = """
Identifies the modification of the msDS-AllowedToDelegateTo attribute to KRBTGT. Attackers can use this technique to
maintain persistence to the domain by having the ability to request tickets for the KRBTGT service.
"""
from = "now-9m"
index = ["logs-system.security*", "logs-windows.forwarded*", "winlogbeat-*"]
language = "eql"
license = "Elastic License v2"
name = "KRBTGT Delegation Backdoor"
references = [
    "https://skyblue.team/posts/delegate-krbtgt",
    "https://github.com/atc-project/atomic-threat-coverage/blob/master/Atomic_Threat_Coverage/Logging_Policies/LP_0026_windows_audit_user_account_management.md",
]
risk_score = 73
rule_id = "e052c845-48d0-4f46-8a13-7d0aba05df82"
severity = "high"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Persistence",
    "Use Case: Active Directory Monitoring",
    "Data Source: Active Directory",
    "Data Source: Windows Security Event Logs",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
iam where host.os.type == "windows" and event.code == "4738" and winlog.event_data.AllowedToDelegateTo : "*krbtgt*"
'''

note = """## Triage and analysis

### Investigating KRBTGT Delegation Backdoor

#### Possible investigation steps

- What account was changed, and what krbtgt delegation value did the alert preserve?
  - Focus: alert 4738 evidence in `winlog.event_data.TargetSid`, `winlog.event_data.TargetUserName`, `winlog.event_data.TargetDomainName`, `winlog.event_data.AllowedToDelegateTo`, and `winlog.computer_name`.
  - Implication: Escalate when the target now lists a krbtgt service target such as "krbtgt/DOMAIN"; lower suspicion only when the target, value, and controller match a time-boxed security validation or emergency delegation repair explicitly naming krbtgt, which is not routine delegation.

- Who initiated the account change?
  - Focus: `winlog.event_data.SubjectUserSid`, `winlog.event_data.SubjectUserName`, `winlog.event_data.SubjectDomainName`, and `winlog.event_data.SubjectLogonId`.
  - Implication: Escalate when a human admin, newly introduced service identity, or unexpected controller-local context made the change; lower suspicion only when the same stable tier-0 identity owns this exact delegation-maintenance path.

- What source and authentication method created the modifying session?
  - Focus: authentication events on the same `host.id` where `winlog.event_data.TargetLogonId` equals alert `winlog.event_data.SubjectLogonId`; review `source.ip`, `winlog.logon.type`, and `winlog.event_data.AuthenticationPackageName`. $investigate_0
  - Hint: missing authentication telemetry, or absent `source.ip` on local/service sessions, is unresolved, not benign; review same-session 4648 records when credential-source context matters. $investigate_1
  - Implication: Escalate for an unusual source, remote-interactive access, unexpected NTLM, or explicit credentials; lower suspicion when the session maps to the expected tier-0 admin path for this controller.

- Did surrounding directory changes prepare, repeat, or roll back the krbtgt delegation?
  - Focus: surrounding 4738 records for the same `winlog.event_data.TargetSid`, plus 5136 records on the same `winlog.computer_name` and modifying subject/session; use `winlog.event_data.ObjectDN`, `winlog.event_data.AttributeLDAPDisplayName`, and `winlog.event_data.AttributeValue` to identify the affected object and value.
  - Hint: reconstruct the burst from same-target 4738 and same-controller directory-service changes; if 5136 grouping is thin, use `winlog.record_id` order on the same controller plus subject/session and object DN. Absent 5136 evidence leaves prerequisite and rollback context unresolved, not benign.
    - $investigate_2
    - $investigate_3
  - Implication: Escalate when `winlog.event_data.AttributeLDAPDisplayName` and `winlog.event_data.AttributeValue` show delegation-enabling changes, repeated msDS-AllowedToDelegateTo writes, or no rollback; prompt removal narrows the persistence window but does not clear actor or session intent.

- Does the same actor or target touch other delegation-relevant accounts in the case window?
  - Focus: run this only if earlier answers are suspicious or unresolved; search 4738 and 5136 records for the same modifying subject/session or `winlog.event_data.TargetSid`, then compare `winlog.event_data.TargetUserName`, `winlog.event_data.ObjectDN`, `winlog.event_data.AttributeLDAPDisplayName`, and `winlog.event_data.AttributeValue`.
  - Implication: Broaden scope when the same actor or target appears in additional delegation writes across objects or controllers; keep it narrow when changes stay confined to one exact target and resolved maintenance path. $investigate_4

- Escalate when a non-routine actor/session adds krbtgt delegation, supporting directory changes show setup, the value remains, or same-actor/target scope expands; close only when the modified account, krbtgt value, actor/session, source/authentication context, surrounding changes, rollback, and scope all align with one tightly controlled authorized workflow; preserve raw 4738, authentication, and directory-change evidence and escalate when findings stay mixed or incomplete.

### False positive analysis

- Authorized security validation or emergency delegation repair can trigger this rule only when krbtgt delegation is the explicit planned action. Confirm the target (`winlog.event_data.TargetSid` plus `winlog.event_data.AllowedToDelegateTo`), actor/session (`winlog.event_data.SubjectUserSid`, `winlog.event_data.SubjectLogonId`, and recovered authentication context), controller, and surrounding attribute evidence all align. If change records are unavailable, telemetry-only closure must still bind one exact workflow with no contradictions; prior benign recurrence strengthens confidence but is not required.
- Do not close generic service onboarding, migration, or constrained-delegation cutover as benign unless outside confirmation explicitly names krbtgt delegation and telemetry matches that exact target, actor, session, and controller path. A normal service-delegation explanation that does not account for the krbtgt value is incomplete.
- Before creating an exception, validate that the same `winlog.event_data.SubjectUserSid`, `winlog.event_data.TargetSid`, exact `winlog.event_data.AllowedToDelegateTo`, `winlog.computer_name`, and recovered session pattern identify the authorized workflow across prior benign cases or a tightly controlled test plan. Build the exception from that minimum confirmed pattern, and avoid exceptions on "krbtgt", event 4738, or "msDS-AllowedToDelegateTo" alone.

### Response and remediation

- If confirmed benign, document the actor, target account, krbtgt value, controller, recovered session context, and surrounding delegation-change pattern before reversing temporary containment. Create an exception only if that same pattern is stable across prior benign cases.
- If suspicious but unconfirmed, first export the alert, raw 4738 record, matching authentication events, and surrounding 4738 or 5136 records. Preserve the modified account, krbtgt value, actor/session, source/auth context, and rollback evidence before reversible containment such as heightened monitoring or temporary delegation-administration restrictions.
- If confirmed malicious, preserve the same identity, session, and directory-change evidence first, then restrict or disable the modifying account. Restrict the modified target only when it was intentionally backdoored or used for follow-on Kerberos abuse. Contain the recovered source host when session evidence identifies one, or hand off the preserved evidence set to Active Directory or incident response.
- After containment, review recent 4738 and 5136 records for the same actor, target, and controller before cleanup. Remove the unauthorized krbtgt value from the `msDS-AllowedToDelegateTo` attribute, roll back related delegation-prerequisite changes identified in the same change set, and verify clean replication across domain controllers.
- If ticket abuse or broader Active Directory compromise is confirmed, activate the domain-compromise plan, including the required double reset of krbtgt after scoping and coordination with directory owners.
- Post-incident hardening: restrict delegation administration and SeEnableDelegationPrivilege to dedicated tier-0 identities, keep Audit User Account Management plus supporting 5136, 4624, and 4648 visibility on domain controllers, and document any recurring benign validation pattern for future triage.
"""

setup = """## Setup

Audit User Account Management must be enabled to generate the events used by this rule.
Setup instructions: https://ela.st/audit-user-account-management
"""

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user.id",
    "winlog.event_data.SubjectUserName",
    "winlog.event_data.SubjectUserSid",
    "winlog.event_data.SubjectDomainName",
    "winlog.event_data.SubjectLogonId",
    "winlog.logon.id",
    "winlog.event_data.TargetUserName",
    "winlog.event_data.TargetSid",
    "winlog.event_data.TargetDomainName",
    "winlog.event_data.AllowedToDelegateTo",
    "host.name",
    "host.id",
    "winlog.computer_name",
]

[transform]

[[transform.investigate]]
label = "Authentication events for the modifying session"
description = ""
providers = [
  [
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "event.code", queryType = "phrase", value = "4624", valueType = "string" },
    { excluded = false, field = "winlog.event_data.TargetLogonId", queryType = "phrase", value = "{{winlog.event_data.SubjectLogonId}}", valueType = "string" }
  ]
]
relativeFrom = "now-48h/h"
relativeTo = "now"

[[transform.investigate]]
label = "Explicit-credential events from the modifying session"
description = ""
providers = [
  [
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "event.code", queryType = "phrase", value = "4648", valueType = "string" },
    { excluded = false, field = "winlog.event_data.SubjectLogonId", queryType = "phrase", value = "{{winlog.event_data.SubjectLogonId}}", valueType = "string" }
  ]
]
relativeFrom = "now-48h/h"
relativeTo = "now"

[[transform.investigate]]
label = "4738 changes for this delegation target"
description = ""
providers = [
  [
    { excluded = false, field = "event.code", queryType = "phrase", value = "4738", valueType = "string" },
    { excluded = false, field = "winlog.event_data.TargetSid", queryType = "phrase", value = "{{winlog.event_data.TargetSid}}", valueType = "string" }
  ],
  [
    { excluded = false, field = "event.code", queryType = "phrase", value = "4738", valueType = "string" },
    { excluded = false, field = "winlog.event_data.SubjectLogonId", queryType = "phrase", value = "{{winlog.event_data.SubjectLogonId}}", valueType = "string" }
  ]
]
relativeFrom = "now-24h/h"
relativeTo = "now"

[[transform.investigate]]
label = "5136 directory changes by this modifying session"
description = ""
providers = [
  [
    { excluded = false, field = "event.code", queryType = "phrase", value = "5136", valueType = "string" },
    { excluded = false, field = "winlog.computer_name", queryType = "phrase", value = "{{winlog.computer_name}}", valueType = "string" },
    { excluded = false, field = "winlog.event_data.SubjectLogonId", queryType = "phrase", value = "{{winlog.event_data.SubjectLogonId}}", valueType = "string" }
  ],
  [
    { excluded = false, field = "event.code", queryType = "phrase", value = "5136", valueType = "string" },
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "winlog.event_data.SubjectUserSid", queryType = "phrase", value = "{{winlog.event_data.SubjectUserSid}}", valueType = "string" }
  ]
]
relativeFrom = "now-24h/h"
relativeTo = "now"

[[transform.investigate]]
label = "Delegation-sensitive changes by this actor"
description = ""
providers = [
  [
    { excluded = false, field = "event.code", queryType = "phrase", value = "4738", valueType = "string" },
    { excluded = false, field = "winlog.event_data.SubjectUserSid", queryType = "phrase", value = "{{winlog.event_data.SubjectUserSid}}", valueType = "string" }
  ],
  [
    { excluded = false, field = "event.code", queryType = "phrase", value = "5136", valueType = "string" },
    { excluded = false, field = "winlog.event_data.SubjectUserSid", queryType = "phrase", value = "{{winlog.event_data.SubjectUserSid}}", valueType = "string" }
  ]
]
relativeFrom = "now-48h/h"
relativeTo = "now"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1558"
name = "Steal or Forge Kerberos Tickets"
reference = "https://attack.mitre.org/techniques/T1558/"

[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[metadata]
creation_date = "2026/05/05"
integration = ["kubernetes"]
maturity = "production"
updated_date = "2026/05/05"

[rule]
author = ["Elastic"]
description = """
Detects creation or approval of a Kubernetes CertificateSigningRequest (CSR) by a non-system identity. Attackers who
have gained cluster access can submit a CSR with a privileged Common Name such as system:kube-controller-manager or
system:masters, then approve it themselves to obtain a long-lived client certificate. Unlike service account tokens
which expire in hours, client certificates persist until they expire or the cluster CA is rotated, providing durable
access that survives pod termination, token revocation, and RBAC changes. On non-EKS clusters, the signed certificate
allows the attacker to authenticate as the privileged identity from anywhere without needing cluster network access,
making it one of the most persistent backdoor mechanisms available in Kubernetes.
"""
false_positives = [
    """
    Approved certificate workflows (for example cert-manager, internal PKI rotation, or node bootstrap) may create or
    update CSRs from identities not in the exclusion list if they run under a custom service account. Baseline
    automation that legitimately approves CSRs and tune exclusions for those principals.
    """,
]
from = "now-9m"
index = ["logs-kubernetes.audit_logs-*"]
language = "kuery"
license = "Elastic License v2"
name = "Kubernetes Client Certificate Signing Request Created or Approved"
note = """## Triage and analysis

### Investigating Kubernetes Client Certificate Signing Request Created or Approved

Identify the actor (`user.name`, groups), client (`user_agent.original`), and `source.ip`. Confirm whether the
principal is expected to create or approve CSRs. Review `kubernetes.audit.requestURI` and, when audit level captures
request bodies, the CSR `spec` (requested signer, usages, and requested identity / Common Name).

### Extracting the Certificate Common Name

For create events, "kubernetes.audit.requestObject.spec.request" holds the base64-encoded PEM certificate signing request.
Decode that value to PEM, then inspect the CSR subject (for example with OpenSSL’s CSR subject view) to read the
requested Common Name (CN). 

Known base64 substrings that often appear inside the encoded request for high-risk identities:

- `c3lzdGVtOm1hc3Rlcn` — `system:masters`
- `c3lzdGVtOmt1YmUtY29udHJvbGxlci1tYW5hZ2Vy` — `system:kube-controller-manager`
- `c3lzdGVtOmFkbWlu` — `system:admin`

Priority CNs that usually indicate privilege escalation intent:

- `system:masters` (cluster-admin group)
- `system:kube-controller-manager` (broad control-plane–style access, including secrets and token minting)
- `system:kube-scheduler` (scheduling across the cluster)
- `system:kube-proxy` (node/network–adjacent access)
- Any CN that matches an existing ClusterRoleBinding subject name

### Possible investigation steps

- Compare the CSR name and extracted CN against approved PKI or bootstrap processes.
- Determine whether the same identity both created and approved or patched the CSR in a short window, which matches
  self-approval abuse.
- Review `kubernetes.audit.objectRef` and subsequent authentication or API activity from unusual networks.
- Correlate with RBAC changes, secret access, or TokenRequest activity that preceded CSR activity.

### Response and remediation

- If malicious, deny further approval, delete or deny the CSR per incident policy, revoke or rotate cluster signing
  trust if the CA or signer was abused, and invalidate issued credentials.
- Remove excessive RBAC that allows `certificatesigningrequests` create/update/patch or approval for untrusted
  identities; enforce signer restrictions and approved issuers where supported.
"""
references = [
    "https://kubernetes.io/docs/reference/access-authn-authz/certificate-signing-requests/",
    "https://attack.mitre.org/techniques/T1098/",
]
risk_score = 73
rule_id = "0f5941c6-3db9-4d2f-91df-06c7c292ba45"
severity = "high"
tags = [
    "Data Source: Kubernetes",
    "Domain: Kubernetes",
    "Use Case: Threat Detection",
    "Tactic: Persistence",
    "Tactic: Privilege Escalation",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"
query = '''
data_stream.dataset:"kubernetes.audit_logs" and 
kubernetes.audit.objectRef.resource:"certificatesigningrequests" and
kubernetes.audit.verb:("create" or "update" or "patch") and
kubernetes.audit.annotations.authorization_k8s_io/decision:"allow" and
not user.name:(
  system\:kube-controller-manager or
  system\:kube-scheduler or
  system\:node\:* or
  system\:serviceaccount\:kube-system\:* or
  eks\:* or aksService
)
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"

[[rule.threat.technique.subtechnique]]
id = "T1098.006"
name = "Additional Container Cluster Roles"
reference = "https://attack.mitre.org/techniques/T1098/006/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"

[[rule.threat.technique.subtechnique]]
id = "T1098.006"
name = "Additional Container Cluster Roles"
reference = "https://attack.mitre.org/techniques/T1098/006/"

[rule.threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[metadata]
creation_date = "2021/05/17"
integration = ["o365"]
maturity = "production"
updated_date = "2026/04/10"

[rule]
author = ["Austin Songer"]
description = """
Identifies a new or modified federation domain, which can be used to create a trust between O365 and an external
identity provider.
"""
index = ["logs-o365.audit-*", "filebeat-*"]
language = "kuery"
license = "Elastic License v2"
name = "M365 Exchange Federated Domain Created or Modified"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating M365 Exchange Federated Domain Created or Modified

Federation domains enable trust between Office 365 and external identity providers, facilitating seamless authentication. Adversaries may exploit this by altering federation settings to redirect authentication flows, potentially gaining unauthorized access. The detection rule monitors specific actions like domain modifications, signaling potential privilege escalation attempts, and alerts analysts to investigate these changes.

### Possible investigation steps

- Review the event logs for the specific actions listed in the query, such as "Set-AcceptedDomain" or "Add-FederatedDomain", to identify the exact changes made to the federation domain settings.
- Identify the user account associated with the event by examining the event logs, and verify if the account has the necessary permissions to perform such actions.
- Check the event.outcome field to confirm the success of the action and cross-reference with any recent administrative changes or requests to validate legitimacy.
- Investigate the event.provider and event.category fields to ensure the actions were performed through legitimate channels and not via unauthorized or suspicious methods.
- Analyze the timing and frequency of the federation domain changes to detect any unusual patterns or repeated attempts that could indicate malicious activity.
- Correlate the detected changes with any recent alerts or incidents involving privilege escalation or unauthorized access attempts to assess potential links or broader security implications.

### False positive analysis

- Routine administrative changes to federation domains by IT staff can trigger alerts. To manage this, create exceptions for known and scheduled maintenance activities by trusted administrators.
- Automated scripts or tools used for domain management may cause false positives. Identify these scripts and exclude their actions from triggering alerts by whitelisting their associated accounts or IP addresses.
- Integration of new services or applications that require federation domain modifications can be mistaken for suspicious activity. Document these integrations and adjust the rule to recognize these legitimate changes.
- Changes made during organizational restructuring, such as mergers or acquisitions, might appear as unauthorized modifications. Coordinate with relevant departments to anticipate these changes and temporarily adjust monitoring thresholds or exclusions.
- Regular audits or compliance checks that involve domain settings adjustments can lead to false positives. Schedule these audits and inform the security team to prevent unnecessary alerts.

### Response and remediation

- Immediately disable any newly added or modified federation domains to prevent unauthorized access. This can be done using the appropriate administrative tools in Office 365.
- Review and revoke any suspicious or unauthorized access tokens or sessions that may have been issued through the compromised federation domain.
- Conduct a thorough audit of recent administrative actions and access logs to identify any unauthorized changes or access patterns related to the federation domain modifications.
- Escalate the incident to the security operations team for further investigation and to determine if additional containment measures are necessary.
- Implement additional monitoring on federation domain settings to detect any further unauthorized changes promptly.
- Communicate with affected stakeholders and provide guidance on any immediate actions they need to take, such as password resets or additional authentication steps.
- Review and update federation domain policies and configurations to ensure they align with best practices and reduce the risk of similar incidents in the future.

## Setup

The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
references = [
    "https://docs.microsoft.com/en-us/powershell/module/exchange/remove-accepteddomain?view=exchange-ps",
    "https://docs.microsoft.com/en-us/powershell/module/exchange/remove-federateddomain?view=exchange-ps",
    "https://docs.microsoft.com/en-us/powershell/module/exchange/new-accepteddomain?view=exchange-ps",
    "https://docs.microsoft.com/en-us/powershell/module/exchange/add-federateddomain?view=exchange-ps",
    "https://docs.microsoft.com/en-us/powershell/module/exchange/set-accepteddomain?view=exchange-ps",
    "https://docs.microsoft.com/en-us/powershell/module/msonline/set-msoldomainfederationsettings?view=azureadps-1.0",
]
risk_score = 21
rule_id = "684554fc-0777-47ce-8c9b-3d01f198d7f8"
severity = "low"
tags = [
    "Domain: Cloud",
    "Data Source: Microsoft 365",
    "Use Case: Identity and Access Audit",
    "Tactic: Privilege Escalation",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset:o365.audit and event.provider:Exchange and event.category:web and event.action:("Set-AcceptedDomain" or
"Set-MsolDomainFederationSettings" or "Add-FederatedDomain" or "New-AcceptedDomain" or "Remove-AcceptedDomain" or "Remove-FederatedDomain") and
event.outcome:success
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1484"
name = "Domain or Tenant Policy Modification"
reference = "https://attack.mitre.org/techniques/T1484/"

[[rule.threat.technique.subtechnique]]
id = "T1484.002"
name = "Trust Modification"
reference = "https://attack.mitre.org/techniques/T1484/002/"

[rule.threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1484"
name = "Domain or Tenant Policy Modification"
reference = "https://attack.mitre.org/techniques/T1484/"

[[rule.threat.technique.subtechnique]]
id = "T1484.002"
name = "Trust Modification"
reference = "https://attack.mitre.org/techniques/T1484/002/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[metadata]
creation_date = "2026/09/08"
integration = ["endpoint"]
maturity = "production"
updated_date = "2026/09/08"

[rule]
author = ["Elastic"]
description = """
Detects when curl or nscurl is spawned by a shell or osascript to make a JSON-RPC request to a blockchain
endpoint for command and control purposes. Adversaries may leverage blockchain smart contracts as a covert
C2 channel to retrieve commands or payload staging information, as observed in ClickFix campaigns.
"""
from = "now-9m"
index = ["logs-endpoint.events.process-*"]
language = "eql"
license = "Elastic License v2"
name = "Potential EtherHiding C2 via Curl JSON-RPC Request"
references = [
    "https://notes.netbytesec.com/2026/08/anatomy-of-macos-clickfix-crimekit-that.html",
    "https://cloud.google.com/blog/topics/threat-intelligence/dprk-adopts-etherhiding",
    "https://cloud.google.com/blog/topics/threat-intelligence/unc5142-etherhiding-distribute-malware",

]
risk_score = 73
rule_id = "54285d96-2b7c-4345-890e-3c40e173f099"
severity = "high"
tags = [
    "Domain: Endpoint",
    "OS: macOS",
    "Use Case: Threat Detection",
    "Tactic: Command and Control",
    "Tactic: Execution",
    "Data Source: Elastic Defend",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
process where host.os.type == "macos" and event.type == "start" and event.action == "exec" and
  process.name in ("curl", "nscurl") and
  process.parent.name in ("osascript", "bash", "sh", "zsh") and
  process.command_line like~ ("*eth_call*", "*\"jsonrpc\"*")
'''

note = """## Triage and analysis

### Investigating Potential EtherHiding C2 via Curl JSON-RPC Request

EtherHiding is a command and control technique in which threat actors store malicious configuration, commands,
or payload URLs inside smart contract data on public blockchains. Because the blockchain is immutable and the
RPC endpoints are legitimate public infrastructure, this provides a takedown-resistant C2 channel. On macOS,
ClickFix-delivered loaders have been observed reading contract data by spawning curl from a shell or osascript
with a raw JSON-RPC eth_call request body.

### Possible investigation steps

- Review process.command_line to identify the destination RPC endpoint, the contract address in the eth_call
  parameters, and the method selector.
- Examine the parent process chain (process.parent.command_line, effective parent) to determine how the shell
  or osascript was launched — interactive terminal, LaunchAgent, or another persistence mechanism.
- Search the same host for follow-on network connections shortly after this event; EtherHiding reads are
  typically followed by a connection to the decoded C2 host.
- Check for recent LaunchAgent or LaunchDaemon plist creation on the host, which commonly accompanies this
  activity as persistence.
- Search the contract address against threat intelligence sources to identify the associated campaign.
- Pivot fleet-wide on the destination RPC domain and any decoded C2 domains to identify additional hosts.

### False positive analysis

- Web3 developers may test contract calls with curl against RPC endpoints. Verify whether the user has a
  legitimate blockchain development role and whether the parent context (terminal session vs. persistence
  item) matches interactive development work.
- CI or build scripts that query chain state via curl could match. Confirm with the owning team and consider
  excluding specific parent scripts or hosts.

### Response and remediation

- Isolate the affected host to interrupt the C2 channel.
- Terminate the parent shell or osascript process tree.
- Identify and remove any associated persistence (LaunchAgents/LaunchDaemons) and decoded payloads.
- Block decoded C2 domains identified from the contract data; note that blocking public RPC aggregators may
  impact legitimate use and should be a risk-based decision.
- Rotate credentials accessible from the host and review for evidence of data theft.
- Escalate for full incident response if the activity chains from a ClickFix or social engineering delivery.
"""

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1102"
name = "Web Service"
reference = "https://attack.mitre.org/techniques/T1102/"

[[rule.threat.technique.subtechnique]]
id = "T1102.001"
name = "Dead Drop Resolver"
reference = "https://attack.mitre.org/techniques/T1102/001/"

[[rule.threat.technique.subtechnique]]
id = "T1102.002"
name = "Bidirectional Communication"
reference = "https://attack.mitre.org/techniques/T1102/002/"

[rule.threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"

[[rule.threat.technique.subtechnique]]
id = "T1059.002"
name = "AppleScript"
reference = "https://attack.mitre.org/techniques/T1059/002/"

[[rule.threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[rule]
description = """
Identifies attempts to coerce the victim to enter their google credentials via spawning a browser child process from an
unusual parent process pointing to Google signin prompt URL.
"""
id = "ff2c7c15-92ee-4cb5-83be-6c1b0f7dc28f"
license = "Elastic License v2"
name = "Potential Google Credentials Phishing"
os_list = ["windows"]
version = "1.0.2"

query = '''
process where event.type == "start" and
 process.name : ("chrome.exe", "msedge.exe") and process.args : "https://youtube.com/account?=https://accounts.google.com/v?/signin/challenge/pwd" and
 process.parent.executable != null and
 not process.parent.executable in~
                     ("c:\\windows\\explorer.exe",
                      "c:\\program files\\google\\chrome\\application\\chrome_proxy.exe",
                      "C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome_proxy.exe",
                      "c:\\program files\\google\\chrome\\application\\chrome.exe",
                      "c:\\Program Files (x86)\\google\\chrome\\application\\chrome.exe") and
 not (process.parent.code_signature.subject_name == "Google LLC" and process.parent.code_signature.trusted == true)
'''

min_endpoint_version = "8.10.0"
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
tree = true

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"


[threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1555"
name = "Credentials from Password Stores"
reference = "https://attack.mitre.org/techniques/T1555/"
[[threat.technique.subtechnique]]
id = "T1555.003"
name = "Credentials from Web Browsers"
reference = "https://attack.mitre.org/techniques/T1555/003/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "8.10.0"

[metadata]
creation_date = "2025/04/29"
integration = ["auditd_manager", "crowdstrike", "endpoint", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2026/03/24"

[rule]
author = ["Elastic"]
description = """
This rule detects when a process executes a command line containing hexadecimal characters. Malware authors may use
hexadecimal encoding to obfuscate their payload and evade detection.
"""
from = "now-9m"
index = [
    "auditbeat-*",
    "endgame-*",
    "logs-crowdstrike.fdr*",
    "logs-endpoint.events.process*",
    "logs-sentinel_one_cloud_funnel.*",
    "logs-auditd_manager.auditd-*",
]
language = "eql"
license = "Elastic License v2"
name = "Potential Hex Payload Execution via Command-Line"
note = """ ## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Potential Hex Payload Execution via Command-Line

In Linux environments, command-line interfaces are pivotal for executing processes and scripts. Adversaries exploit this by embedding payloads in hexadecimal format to obfuscate their actions, evading detection. The detection rule identifies processes with lengthy command lines containing multiple hex patterns, signaling potential obfuscation. This approach targets defense evasion tactics, leveraging Elastic Defend to flag suspicious executions.

### Possible investigation steps

- Review the process.command_line field to identify the specific hexadecimal patterns and assess if they correspond to known malicious payloads or commands.
- Examine the process.parent.executable to determine the parent process that initiated the execution, which may provide context on whether the execution is expected or suspicious.
- Check the user account associated with the process execution to verify if the activity aligns with typical user behavior or if it indicates potential compromise.
- Investigate the host where the alert was triggered to identify any other related suspicious activities or anomalies that might indicate a broader compromise.
- Correlate the event with other logs or alerts from the same host or user to identify patterns or repeated attempts at obfuscation and execution.

### False positive analysis

- Legitimate software installations or updates may use hexadecimal encoding in command lines for legitimate purposes. Users can create exceptions for known software update processes by identifying their parent executable paths and excluding them from the rule.
- System administration scripts or tools that utilize hexadecimal encoding for configuration or data processing might trigger the rule. Review and whitelist these scripts by verifying their source and purpose, then exclude them based on their command line patterns or parent processes.
- Security tools or monitoring software that perform regular scans or data collection using hexadecimal encoding could be flagged. Confirm these tools' legitimacy and add them to an exception list by specifying their executable paths or command line characteristics.
- Custom applications developed in-house that use hexadecimal encoding for data handling or communication may be mistakenly identified. Document these applications and exclude them by their unique command line signatures or parent process identifiers.

### Response and remediation

- Isolate the affected system from the network to prevent further spread of the potential threat and to contain any malicious activity.
- Terminate the suspicious process identified by the detection rule to halt any ongoing malicious execution.
- Conduct a forensic analysis of the affected system to identify any additional indicators of compromise, such as modified files or unauthorized user accounts.
- Remove any identified malicious files or scripts from the system to ensure the threat is eradicated.
- Restore the system from a known good backup if any critical system files or configurations have been altered.
- Update and patch the system to close any vulnerabilities that may have been exploited by the adversary.
- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if additional systems are affected.
"""
risk_score = 21
rule_id = "1d0027d4-6717-4a37-bad8-531d8e9fe53f"
setup = """## Setup

This rule requires data coming in from Elastic Defend.

### Elastic Defend Integration Setup
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.

#### Prerequisite Requirements:
- Fleet is required for Elastic Defend.
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).

#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
- Go to the Kibana home page and click "Add integrations".
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
- Click "Add Elastic Defend".
- Configure the integration name and optionally add a description.
- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
- Click "Save and Continue".
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
"""
severity = "low"
tags = [
  "Domain: Endpoint",
  "OS: Linux",
  "Use Case: Threat Detection",
  "Tactic: Defense Evasion",
  "Tactic: Execution",
  "Data Source: Auditd Manager",
  "Data Source: Elastic Defend",
  "Data Source: Elastic Endgame",
  "Data Source: Crowdstrike",
  "Data Source: SentinelOne",
  "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"
query = '''
process where host.os.type == "linux" and event.type == "start" and
event.action in ("exec", "exec_event", "start", "ProcessRollup2", "executed", "process_started") and
?process.parent.executable != null and
process.command_line : "*\\x*\\x*\\x*\\x*\\x*\\x*\\x*\\x*\\x*\\x*\\x*\\x*\\x*\\x*" and
length(process.command_line) > 50 and
not process.name in ("snap", "printf", "sed")
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1027"
name = "Obfuscated Files or Information"
reference = "https://attack.mitre.org/techniques/T1027/"

[[rule.threat.technique.subtechnique]]
id = "T1027.010"
name = "Command Obfuscation"
reference = "https://attack.mitre.org/techniques/T1027/010/"

[[rule.threat.technique]]
id = "T1140"
name = "Deobfuscate/Decode Files or Information"
reference = "https://attack.mitre.org/techniques/T1140/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"

[[rule.threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"

[[rule.threat.technique]]
id = "T1204"
name = "User Execution"
reference = "https://attack.mitre.org/techniques/T1204/"

[[rule.threat.technique.subtechnique]]
id = "T1204.002"
name = "Malicious File"
reference = "https://attack.mitre.org/techniques/T1204/002/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[metadata]
creation_date = "2023/09/01"
integration = ["endpoint"]
maturity = "production"
updated_date = "2026/05/04"

[rule]
author = ["Elastic"]
description = """
Identifies executables with names resembling legitimate business applications but lacking signatures from the original
developer. Attackers may trick users into downloading malicious executables that masquerade as legitimate applications
via malicious ads, forum posts, and tutorials, effectively gaining initial access.
"""
from = "now-9m"
index = ["logs-endpoint.events.process-*", "endgame-*"]
language = "eql"
license = "Elastic License v2"
name = "Potential Masquerading as Business App Installer"
references = [
    "https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers",
]
risk_score = 21
rule_id = "feafdc51-c575-4ed2-89dd-8e20badc2d6c"
severity = "low"
tags = [
    "Domain: Endpoint",
    "Data Source: Elastic Defend",
    "Data Source: Elastic Endgame",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Defense Evasion",
    "Tactic: Initial Access",
    "Tactic: Execution",
    "Resources: Investigation Guide"
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
process where host.os.type == "windows" and 
  event.type == "start" and process.executable : "?:\\Users\\*\\Downloads\\*" and
  not process.code_signature.status like ("errorCode_endpoint*", "errorUntrustedRoot", "errorChaining") and process.hash.sha256 != null and 
  (
    /* Slack */
    (process.name : "*slack*.exe" and not
      (process.code_signature.subject_name in (
        "Slack Technologies, Inc.",
        "Slack Technologies, LLC"
       ) and process.code_signature.trusted == true)
    ) or

    /* WebEx */
    (process.name : "*webex*.exe" and not
      (process.code_signature.subject_name in ("Cisco WebEx LLC", "Cisco Systems, Inc.") and process.code_signature.trusted == true)
    ) or

    /* Teams */
    (process.name : "teams*.exe" and not
      (process.code_signature.subject_name == "Microsoft Corporation" and process.code_signature.trusted == true)
    ) or

    /* Discord */
    (process.name : "*discord*.exe" and not
      (process.code_signature.subject_name == "Discord Inc." and process.code_signature.trusted == true)
    ) or

    /* WhatsApp */
    (process.name : "*whatsapp*.exe" and not
      (process.code_signature.subject_name in (
        "WhatsApp LLC",
        "WhatsApp, Inc",
        "24803D75-212C-471A-BC57-9EF86AB91435",
        /* WhatsApp Installer - MS Store */
        "Microsoft Corporation"
       ) and process.code_signature.trusted == true)
    ) or

    /* Zoom */
    (process.name : ("*zoom*installer*.exe", "*zoom*setup*.exe", "zoom.exe")  and not
      (process.code_signature.subject_name in (
        "Zoom Video Communications, Inc.", "Zoom Communications, Inc."
       ) and process.code_signature.trusted == true)
    ) or

    /* Outlook */
    (process.name : "*outlook*.exe" and not
      (
        (process.code_signature.subject_name == "Microsoft Corporation" and process.code_signature.trusted == true) or
        (
          process.name: "MSOutlookHelp-PST-Viewer.exe" and process.code_signature.subject_name == "Aryson Technologies Pvt. Ltd" and
          process.code_signature.trusted == true
        )
      )
    ) or

    /* Thunderbird */
    (process.name : "*thunderbird*.exe" and not
      (process.code_signature.subject_name == "Mozilla Corporation" and process.code_signature.trusted == true)
    ) or

    /* Grammarly */
    (process.name : "*grammarly*.exe" and not
      (process.code_signature.subject_name == "Grammarly, Inc." and process.code_signature.trusted == true)
    ) or

    /* Dropbox */
    (process.name : "*dropbox*.exe" and not
      (process.code_signature.subject_name == "Dropbox, Inc" and process.code_signature.trusted == true)
    ) or

    /* Tableau */
    (process.name : "*tableau*.exe" and not
      (process.code_signature.subject_name == "Tableau Software LLC" and process.code_signature.trusted == true)
    ) or

    /* Google Drive */
    (process.name : "*googledrive*.exe" and not
      (process.code_signature.subject_name == "Google LLC" and process.code_signature.trusted == true)
    ) or

    /* MSOffice */
    (process.name : "*office*setup*.exe" and not
      (process.code_signature.subject_name == "Microsoft Corporation" and process.code_signature.trusted == true)
    ) or

    /* Okta */
    (process.name : "*okta*.exe" and not
      (process.code_signature.subject_name == "Okta, Inc." and process.code_signature.trusted == true)
    ) or

    /* OneDrive */
    (process.name : "*onedrive*.exe" and not
      (process.code_signature.subject_name == "Microsoft Corporation" and process.code_signature.trusted == true)
    ) or

    /* Chrome */
    (process.name : "*chrome*.exe" and not
      (process.code_signature.subject_name in ("Google LLC", "Google Inc") and process.code_signature.trusted == true)
    ) or

    /* Firefox */
    (process.name : "*firefox*.exe" and not
      (process.code_signature.subject_name == "Mozilla Corporation" and process.code_signature.trusted == true)
    ) or

    /* Edge */
    (process.name : ("*microsoftedge*.exe", "*msedge*.exe") and not
      (process.code_signature.subject_name == "Microsoft Corporation" and process.code_signature.trusted == true)
    ) or

    /* Brave */
    (process.name : "*brave*.exe" and not
      (process.code_signature.subject_name == "Brave Software, Inc." and process.code_signature.trusted == true)
    ) or

    /* GoogleCloud Related Tools */
    (process.name : "*GoogleCloud*.exe" and not
      (process.code_signature.subject_name == "Google LLC" and process.code_signature.trusted == true)
    ) or

    /* Github Related Tools */
    (process.name : "*github*.exe" and not
      (process.code_signature.subject_name == "GitHub, Inc." and process.code_signature.trusted == true)
    ) or

    /* Notion */
    (process.name : "*notion*.exe" and not
      (process.code_signature.subject_name == "Notion Labs, Inc." and process.code_signature.trusted == true)
    )
  )
'''

setup = """## Setup

This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.

Setup instructions: https://ela.st/install-elastic-defend
"""

note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Potential Masquerading as Business App Installer

Business applications are integral to productivity, often downloaded and installed by users. Adversaries exploit this by creating malicious executables with names mimicking legitimate apps, tricking users into installing them. The detection rule identifies such threats by checking for unsigned executables in download directories, ensuring they don't masquerade as trusted applications.

### Possible investigation steps

- Review the process name and executable path to confirm if it matches any known legitimate business application names listed in the rule, such as Slack, WebEx, or Teams, and verify if it was executed from a typical download directory.
- Check the process code signature status and subject name to determine if the executable is unsigned or signed by an untrusted entity, which could indicate a masquerading attempt.
- Investigate the source of the download by examining browser history, email attachments, or any recent file transfers to identify potential phishing attempts or malicious download sources.
- Analyze the process execution context, including parent processes and command-line arguments, to understand how the executable was launched and if it aligns with typical user behavior.
- Look for any network connections initiated by the process to identify suspicious outbound traffic or connections to known malicious IP addresses or domains.
- Cross-reference the executable's hash with threat intelligence databases to check for known malware signatures or previous reports of malicious activity.
- If the executable is determined to be suspicious, isolate the affected system and perform a full malware scan to prevent further compromise.

### False positive analysis

- Unsigned executables from legitimate developers may trigger alerts if they are not properly signed or if the signature is not recognized. Users can create exceptions for specific executables by verifying the developer's authenticity and adding them to a trusted list.
- Custom or in-house developed applications that mimic business app names but are unsigned can cause false positives. Organizations should ensure these applications are signed with a trusted certificate or add them to an exclusion list after verifying their safety.
- Software updates or beta versions of legitimate applications might not have updated signatures, leading to false positives. Users should verify the source of the update and, if legitimate, temporarily exclude these versions from the rule.
- Applications installed in non-standard directories that match the naming patterns but are legitimate can be excluded by specifying trusted paths or directories in the rule configuration.
- Third-party tools or utilities that integrate with business applications and use similar naming conventions might be flagged. Users should verify these tools and, if safe, add them to an exception list to prevent future alerts.

### Response and remediation

- Isolate the affected system from the network to prevent further spread of the potential threat and to contain any malicious activity.
- Terminate the suspicious process identified by the alert to stop any ongoing malicious actions.
- Quarantine the executable file flagged by the detection rule to prevent execution and further analysis.
- Conduct a thorough scan of the affected system using updated antivirus or endpoint detection and response (EDR) tools to identify and remove any additional malicious files or remnants.
- Review and analyze the process execution logs and any related network activity to understand the scope of the intrusion and identify any other potentially compromised systems.
- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if additional systems are affected.
- Implement application whitelisting to prevent unauthorized executables from running, ensuring only trusted and signed applications are allowed to execute."""


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1036"
name = "Masquerading"
reference = "https://attack.mitre.org/techniques/T1036/"
[[rule.threat.technique.subtechnique]]
id = "T1036.001"
name = "Invalid Code Signature"
reference = "https://attack.mitre.org/techniques/T1036/001/"

[[rule.threat.technique.subtechnique]]
id = "T1036.005"
name = "Match Legitimate Resource Name or Location"
reference = "https://attack.mitre.org/techniques/T1036/005/"



[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1189"
name = "Drive-by Compromise"
reference = "https://attack.mitre.org/techniques/T1189/"


[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1204"
name = "User Execution"
reference = "https://attack.mitre.org/techniques/T1204/"
[[rule.threat.technique.subtechnique]]
id = "T1204.002"
name = "Malicious File"
reference = "https://attack.mitre.org/techniques/T1204/002/"



[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"