Elastic rules: 07

[metadata]
creation_date = "2020/01/04"
integration = ["endpoint"]
maturity = "production"
updated_date = "2026/03/24"

[rule]
author = ["Elastic"]
description = """
Identifies attempts to enable the root account using the dsenableroot command. This command may be abused by adversaries
for persistence, as the root account is disabled by default.
"""
from = "now-9m"
index = ["logs-endpoint.events.*"]
language = "eql"
license = "Elastic License v2"
name = "Attempt to Enable the Root Account"
references = ["https://ss64.com/osx/dsenableroot.html"]
risk_score = 47
rule_id = "cc2fd2d0-ba3a-4939-b87f-2901764ed036"
setup = """## Setup

This rule requires data coming in from Elastic Defend.

### Elastic Defend Integration Setup
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.

#### Prerequisite Requirements:
- Fleet is required for Elastic Defend.
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).

#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
- Go to the Kibana home page and click "Add integrations".
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
- Click "Add Elastic Defend".
- Configure the integration name and optionally add a description.
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
- Click "Save and Continue".
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
"""
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: macOS",
    "Use Case: Threat Detection",
    "Tactic: Persistence",
    "Data Source: Elastic Defend",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
process where host.os.type == "macos" and event.type in ("start", "process_started") and
 process.name == "dsenableroot" and 
 not process.args == "-d"
'''
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Attempt to Enable the Root Account

In macOS environments, the root account is typically disabled to enhance security. However, adversaries may attempt to enable it using the `dsenableroot` command to gain persistent, elevated access. The detection rule identifies such attempts by monitoring process events for the execution of `dsenableroot` without the disable flag, indicating potential misuse for persistence.

### Possible investigation steps

- Review the process event logs to confirm the execution of the dsenableroot command without the disable flag, as indicated by the absence of process.args:"-d".
- Identify the user account associated with the process event to determine if the action was initiated by a legitimate user or a potential adversary.
- Check for any recent changes in user account permissions or configurations that might indicate unauthorized access or privilege escalation.
- Investigate any other suspicious activities or process executions around the same time as the dsenableroot command to identify potential lateral movement or further persistence mechanisms.
- Correlate the event with other security alerts or logs from the same host to assess if this is part of a broader attack campaign.

### False positive analysis

- System administrators may legitimately enable the root account for maintenance or troubleshooting. To handle this, create exceptions for known administrator accounts or specific maintenance windows.
- Automated scripts or management tools might use the dsenableroot command as part of their operations. Identify these tools and exclude their process signatures from triggering alerts.
- Educational or testing environments may require enabling the root account for instructional purposes. Implement exclusions for these environments by tagging relevant systems or user accounts.
- Ensure that any exclusion rules are regularly reviewed and updated to reflect changes in administrative practices or tool usage to maintain security integrity.

### Response and remediation

- Immediately isolate the affected macOS system from the network to prevent any potential lateral movement by the adversary.
- Terminate any unauthorized processes associated with the `dsenableroot` command to halt further misuse of elevated privileges.
- Review system logs and user activity to identify any unauthorized changes or access that occurred after the root account was enabled.
- Reset the root account password and disable the root account to prevent further unauthorized access.
- Conduct a thorough scan of the system for any additional signs of compromise or persistence mechanisms that may have been installed.
- Notify the security team and relevant stakeholders about the incident for awareness and further investigation.
- Implement additional monitoring and alerting for any future attempts to enable the root account, ensuring rapid detection and response."""


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"

[[rule.threat.technique.subtechnique]]
id = "T1078.003"
name = "Local Accounts"
reference = "https://attack.mitre.org/techniques/T1078/003/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"

[[rule.threat.technique.subtechnique]]
id = "T1078.003"
name = "Local Accounts"
reference = "https://attack.mitre.org/techniques/T1078/003/"

[rule.threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[metadata]
creation_date = "2024/08/26"
maturity = "production"
updated_date = "2026/04/10"

[rule]
author = ["Elastic"]
description = """
Identifies when a single AWS principal makes GetServiceQuota API calls for the EC2 service quota L-1216C47A, across more
than 10 AWS regions within a 30-second window. This quota represents the vCPU limit for on-demand EC2 instances.
Adversaries commonly enumerate this quota across regions to assess capacity for large-scale instance deployment,
including cryptocurrency mining, malware hosting, or command-and-control infrastructure. This behavior may indicate
cloud infrastructure discovery using compromised credentials or a compromised workload.
"""
false_positives = [
    """
    Organizations with mature multi-region operations may legitimately query EC2 service quotas across regions for
    capacity planning, automation, or compliance validation. Infrastructure-as-code tooling, quota monitoring solutions,
    or centralized cloud governance platforms may also generate similar activity. Validate the identity, purpose, and
    historical behavior of the calling principal before treating this activity as malicious.
    """,
]
from = "now-6m"
language = "esql"
license = "Elastic License v2"
name = "AWS Service Quotas Multi-Region GetServiceQuota Requests"
note = """## Triage and analysis

### Investigating AWS Service Quotas Multi-Region GetServiceQuota Requests

AWS Service Quotas define usage limits for AWS services and are commonly referenced during capacity planning or automation. However, adversaries frequently enumerate EC2 on-demand instance quotas across many regions to identify where they can rapidly deploy compute resources for malicious purposes such as cryptocurrency mining, botnet hosting, or malware staging. This rule detects unusually fast, multi-region enumeration of the EC2 on-demand vCPU quota (`L-1216C47A`), a pattern that is uncommon for normal administrative activity and strongly associated with cloud infrastructure discovery.

### Possible investigation steps

**Identify the actor**
- Review `aws.cloudtrail.user_identity.arn` and `aws.cloudtrail.user_identity.access_key_id` to determine whether the requests originated from an IAM user, role, or assumed role. Validate whether this principal is expected to perform quota discovery or capacity analysis across many regions.

**Evaluate the scope of discovery**
- Review the `cloud.region` values to determine which regions were queried and whether they align with regions normally used by your organization. Rapid enumeration of rarely used or disabled regions increases suspicion.

**Inspect request origin and tooling**
- Review `source.ip`, `source.as.organization.name`, and `user_agent.original` to determine whether the activity originated from a trusted corporate network, known cloud automation environment, or an unexpected hosting provider or VPN.
- Unexpected user agents or hosting providers may indicate compromised credentials or an attacker-controlled instance.

**Correlate with follow-on activity**
- Search for subsequent EC2-related actions such as `RunInstances`, `RequestSpotInstances`, `CreateLaunchTemplate`, or `ModifyInstanceAttribute` following the quota discovery.
- Review recent IAM activity for the same principal, including access key creation, role assumptions, or policy changes.

**Assess intent and risk**
- Determine whether this activity aligns with a known operational task (capacity planning, onboarding, automation testing), or whether it represents unexplained reconnaissance behavior.
- If the principal is newly created, rarely used, or exhibiting other anomalous behavior, treat this as high risk.

### False positive analysis
- Multi-region quota discovery may be legitimate in organizations with global deployments, centralized cloud governance, or automated capacity monitoring.
- Infrastructure-as-code pipelines, quota management tools, or internal cloud platforms may periodically enumerate quotas.

### Response and remediation
- If the activity is unauthorized or suspicious, immediately rotate or disable access keys associated with the principal and revoke active sessions.
- Review CloudTrail activity for evidence of follow-on abuse, particularly EC2 instance launches, network changes, or IAM modifications.
- Apply tighter IAM permissions to restrict access to Service Quotas APIs where not explicitly required.
- Enforce MFA on IAM users and consider conditional access controls (such as source IP or VPC restrictions) for sensitive roles.
- Notify security operations and cloud platform teams to assess potential impact and determine whether containment actions (such as SCP enforcement or account isolation) are required.
- Update detection coverage to monitor for EC2 provisioning attempts following quota discovery to catch resource abuse early.

### Additional information
- **[AWS IR Playbooks](https://github.com/aws-samples/aws-incident-response-playbooks/blob/c151b0dc091755fffd4d662a8f29e2f6794da52c/playbooks/)** 
- **[AWS Customer Playbook Framework](https://github.com/aws-samples/aws-customer-playbook-framework/tree/a8c7b313636b406a375952ac00b2d68e89a991f2/docs)** 
- **[AWS Knowledge Center – Security Best Practices](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/)**
"""
references = [
    "https://www.sentinelone.com/labs/exploring-fbot-python-based-malware-targeting-cloud-and-payment-services/",
    "https://docs.aws.amazon.com/servicequotas/2019-06-24/apireference/API_GetServiceQuota.html",
]
risk_score = 21
rule_id = "19be0164-63d2-11ef-8e38-f661ea17fbce"
severity = "low"
tags = [
    "Domain: Cloud",
    "Data Source: AWS",
    "Data Source: Amazon Web Services",
    "Data Source: AWS Service Quotas",
    "Use Case: Threat Detection",
    "Tactic: Discovery",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "esql"

query = '''
from logs-aws.cloudtrail-* METADATA _id, _version, _index

// filter for GetServiceQuota API calls
| where
  data_stream.dataset == "aws.cloudtrail"
  and event.provider == "servicequotas.amazonaws.com"
  and event.action == "GetServiceQuota"

// truncate the timestamp to a 30-second window
| eval Esql.time_window_date_trunc = date_trunc(30 seconds, @timestamp)

// dissect request parameters to extract service and quota code
| dissect aws.cloudtrail.request_parameters "{%{?Esql.aws_cloudtrail_request_parameters_service_code_key}=%{Esql.aws_cloudtrail_request_parameters_service_code}, %{?quota_code_key}=%{Esql.aws_cloudtrail_request_parameters_quota_code}}"

// filter for EC2 service quota L-1216C47A (vCPU on-demand instances)
| where Esql.aws_cloudtrail_request_parameters_service_code == "ec2" and Esql.aws_cloudtrail_request_parameters_quota_code == "L-1216C47A"

// keep only the relevant fields
| keep
    Esql.time_window_date_trunc,
    aws.cloudtrail.user_identity.arn,
    cloud.region,
    Esql.aws_cloudtrail_request_parameters_service_code,
    Esql.aws_cloudtrail_request_parameters_quota_code,
    aws.cloudtrail.request_parameters,
    @timestamp, 
    aws.cloudtrail.user_identity.type, 
    aws.cloudtrail.user_identity.access_key_id, 
    source.ip, 
    cloud.account.id, 
    user_agent.original, 
    source.as.organization.name, 
    data_stream.namespace
    
// count the number of unique regions and total API calls within the time window
| stats
    Esql.cloud_region_count_distinct = count_distinct(cloud.region),
    Esql.event_count = count(*),
    Esql.aws_cloudtrail_request_parameters_values = VALUES(aws.cloudtrail.request_parameters),
    Esql.event_timestamp_values = VALUES(@timestamp),
    Esql.aws_cloudtrail_user_identity_type_values = VALUES(aws.cloudtrail.user_identity.type),
    Esql.aws_cloudtrail_user_identity_access_key_id_values = VALUES(aws.cloudtrail.user_identity.access_key_id),
    Esql.source_ip_values = VALUES(source.ip),
    Esql.cloud_account_id_values = VALUES(cloud.account.id),
    Esql.user_agent_original_values = VALUES(user_agent.original),
    Esql.source_as_organization_name_values = VALUES(source.as.organization.name),
    Esql.cloud_region_values = VALUES(cloud.region),
    Esql.data_stream_namespace_values = VALUES(data_stream.namespace)
  by Esql.time_window_date_trunc, aws.cloudtrail.user_identity.arn

// filter for API calls in more than 10 regions within the 30-second window
| where
  Esql.cloud_region_count_distinct >= 10
  and Esql.event_count >= 10
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1526"
name = "Cloud Service Discovery"
reference = "https://attack.mitre.org/techniques/T1526/"

[[rule.threat.technique]]
id = "T1580"
name = "Cloud Infrastructure Discovery"
reference = "https://attack.mitre.org/techniques/T1580/"

[rule.threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"
[rule.investigation_fields]
field_names = [
    "Esql.cloud_region_count_distinct",
    "Esql.event_count",
    "Esql.time_window_date_trunc",
    "Esql.event_timestamp_values",
    "aws.cloudtrail.user_identity.arn",
    "Esql.aws_cloudtrail_user_identity_type_values",
    "Esql.aws_cloudtrail_user_identity_access_key_id_values",
    "Esql.source_ip_values",
    "Esql.source_as_organization_name_values",
    "Esql.user_agent_original_values",
    "Esql.cloud_account_id_values",
    "Esql.cloud_region_values",
    "Esql.data_stream_namespace_values",
]

[rule]
description = """
Identifies Bun scripting interpreter establishing a network connection to the link-local instance metadata service
address (169.254.169.254). Adversaries and cloud malware often query the instance metadata API to harvest IAM
credentials, tokens, and other secrets from cloud-hosted workloads.
"""
id = "04a04478-10b8-4b3f-a4e1-fe0c49c0f65b"
license = "Elastic License v2"
name = "Bun Script Attempted to Access IMDS Metadata"
os_list = ["linux", "windows"]
reference = [
    "https://attack.mitre.org/techniques/T1552/005/",
    "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html",
    "https://www.elastic.co/security-labs/shai-hulud-chaindrop-npm-supply-chain",
]
version = "1.0.0"

query = '''
sequence by process.entity_id with maxspan=1m
  [process where event.type == "start" and event.action in ("start", "exec") and process.name : ("bun", "bun.exe") and 
   not process.command_line like ("bun --watch src/app.ts", 
                                  "bun test src/integrations/__tests__/*", 
                                  "bun run scripts/ingest-resilience-retrospectives.ts --ingest", 
                                  "bun packages/product-config/codegen/api-codegen.ts", 
                                  "bun run apps/backend/probe-pagination.ts")]
  [network where event.action == "connection_attempted" and destination.address == "169.254.169.254" and destination.port == 80]
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"
[[threat.technique.subtechnique]]
id = "T1552.005"
name = "Cloud Instance Metadata API"
reference = "https://attack.mitre.org/techniques/T1552/005/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "7.15.0"

[metadata]
creation_date = "2023/06/06"
integration = ["cloud_defend"]
maturity = "production"
min_stack_comments = "Defend for Containers integration was re-introduced in 9.3.0"
min_stack_version = "9.3.0"
updated_date = "2026/07/29"

[rule]
author = ["Elastic"]
description = """
This rule detects the creation or modification of the dynamic linker preload shared object (ld.so.preload) inside a
container. The Linux dynamic linker is used to load libraries needed by a program at runtime. Adversaries may hijack the
dynamic linker by modifying the /etc/ld.so.preload file to point to malicious libraries. This behavior can be used to
grant unauthorized access to system resources and has been used to evade detection of malicious processes in container
environments.
"""
from = "now-6m"
index = ["logs-cloud_defend.file*"]
interval = "5m"
language = "eql"
license = "Elastic License v2"
name = "Dynamic Linker Modification Detected via Defend for Containers"
note = """## Setup

## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Dynamic Linker Modification Detected via Defend for Containers

The dynamic linker in Linux loads necessary libraries for programs at runtime, with the `ld.so.preload` file specifying libraries to load first. Adversaries exploit this by redirecting it to malicious libraries, gaining unauthorized access and evading detection. The detection rule identifies suspicious modifications to this file within containers, signaling potential hijacking attempts.

### Possible investigation steps

- Review the alert details to confirm the file path involved is "/etc/ld.so.preload", "/etc/ld.so.conf.d/*", or "/etc/ld.so.conf" and the event type is not "deletion", as specified in the query.
- Examine the container's metadata and context to identify the specific container where the modification occurred, including container ID, image, and host details.
- Investigate recent changes to the "/etc/ld.so.preload" file within the container by checking the file's modification history and identifying the user or process responsible for the change.
- Analyze the contents of the modified "/etc/ld.so.preload" file to determine if it references any suspicious or unauthorized libraries.
- Correlate the event with other security logs and alerts to identify any related suspicious activities or patterns, such as unauthorized access attempts or execution of unknown processes within the container.
- Assess the potential impact of the modification by evaluating the libraries listed in the preload file and their potential to grant unauthorized access or evade detection.
- Consider isolating the affected container to prevent further unauthorized access or malicious activity while the investigation is ongoing.

### False positive analysis

- Routine system updates or maintenance activities may modify the ld.so.preload file. Users should verify if the changes coincide with scheduled updates and consider excluding these events if they are confirmed to be benign.
- Some containerized applications might legitimately modify the ld.so.preload file to optimize performance or load specific libraries. Users should identify these applications and create exceptions for their known behaviors to prevent false alerts.
- Automated configuration management tools might alter the ld.so.preload file as part of their normal operations. Users should review the tool's activity logs and whitelist these actions if they are consistent with expected behavior.
- Development or testing environments often involve frequent changes to system files, including ld.so.preload. Users should differentiate between production and non-production environments and apply more lenient rules to the latter to reduce false positives.

### Response and remediation

- Immediately isolate the affected container to prevent further unauthorized access or execution of malicious code. This can be done by stopping the container or disconnecting it from the network.
- Conduct a thorough review of the `/etc/ld.so.preload`, `/etc/ld.so.conf.d/*`, or `/etc/ld.so.conf` files within the container to identify any unauthorized or malicious entries. Remove any entries that are not recognized or are confirmed to be malicious.
- Verify the integrity of the container's base image and all installed libraries to ensure no other components have been tampered with. Rebuild the container from a trusted image if necessary.
- Implement monitoring and alerting for any future modifications to the `/etc/ld.so.preload`, `/etc/ld.so.conf.d/*`, or `/etc/ld.so.conf` file across all containers to detect similar threats promptly.
- Review and tighten access controls and permissions for container environments to minimize the risk of unauthorized modifications to critical system files.
- Escalate the incident to the security operations team for further investigation and to determine if the threat has spread to other parts of the infrastructure.
- Document the incident, including the steps taken for containment and remediation, to improve response strategies and update incident response plans for future reference."""
references = [
    "https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/",
    "https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang/",
    "https://sysdig.com/blog/threat-detection-aws-cloud-containers/",
]
risk_score = 73
rule_id = "342f834b-21a6-41bf-878c-87d116eba3ee"
severity = "high"
tags = [
    "Data Source: Elastic Defend for Containers",
    "Domain: Container",
    "OS: Linux",
    "Use Case: Threat Detection",
    "Tactic: Defense Evasion",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"
query = '''
file where host.os.type == "linux" and event.type != "deletion" and
file.path like ("/etc/ld.so.preload", "/etc/ld.so.conf.d/*", "/etc/ld.so.conf") and
container.id like "*" 
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1574"
name = "Hijack Execution Flow"
reference = "https://attack.mitre.org/techniques/T1574/"

[[rule.threat.technique.subtechnique]]
id = "T1574.006"
name = "Dynamic Linker Hijacking"
reference = "https://attack.mitre.org/techniques/T1574/006/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1574"
name = "Hijack Execution Flow"
reference = "https://attack.mitre.org/techniques/T1574/"

[[rule.threat.technique.subtechnique]]
id = "T1574.006"
name = "Dynamic Linker Hijacking"
reference = "https://attack.mitre.org/techniques/T1574/006/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1574"
name = "Hijack Execution Flow"
reference = "https://attack.mitre.org/techniques/T1574/"

[[rule.threat.technique.subtechnique]]
id = "T1574.006"
name = "Dynamic Linker Hijacking"
reference = "https://attack.mitre.org/techniques/T1574/006/"

[rule.threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[metadata]
creation_date = "2026/07/28"
integration = ["endpoint"]
maturity = "production"
updated_date = "2026/07/28"

[rule]
author = ["Elastic"]
description = """
Identifies a newly observed RMM-related code-signature subject across the Windows Elastic Defend hosts. Attackers often
use RMM tools to gain remote access to victim machines and deploy malware.
"""
from = "now-9m"
index = ["logs-endpoint.events.process-*"]
language = "kuery"
license = "Elastic License v2"
name = "First Time Seen RMM Signer Across the Environment"
references = [
    "https://thedfirreport.com/2023/04/03/malicious-iso-file-leads-to-domain-wide-ransomware/",
    "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-025a",
    "https://www.cisa.gov/sites/default/files/2025-06/aa25-163a-ransomware-simplehelp-rmm-compromise.pdf",
    "https://lolrmm.io/",
]
risk_score = 47
rule_id = "bb8dac47-0271-4000-b4e3-1bfc75eec5c4"
setup = """## Setup

This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.

Setup instructions: https://ela.st/install-elastic-defend
"""
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Command and Control",
    "Resources: Investigation Guide",
    "Data Source: Elastic Defend",
]
timestamp_override = "event.ingested"
type = "new_terms"

query = '''
host.os.type: "windows" and
event.category: "process" and event.type: "start" and
process.code_signature.subject_name: (
    "Action1 Corporation" or
    "Aeroadmin LLC" or
    "AeroAdmin LLC" or
    "AmidaWare LLC" or
    "Ammyy LLC" or
    "AnyDesk Software GmbH" or
    "AOMEI International Network Limited" or
    "Atera Networks Ltd" or
    "AWERAY PTE. LTD." or
    "BeamYourScreen GmbH" or
    "Bomgar Corporation" or
    "BreakingSecurity.net" or
    "ConnectWise, Inc." or
    "ConnectWise, LLC" or
    "Connectwise, LLC" or
    "Devolutions Inc" or
    "Devolutions inc." or
    "DOMOTZ INC." or
    "DUC FABULOUS CO.,LTD" or
    "DWSNET OÜ" or
    "DWSNET srl" or
    "Electronic Team, Inc." or
    "Famatech Corp." or
    "FleetDeck Inc" or
    "GlavSoft LLC" or
    "GlavSoft LLC." or
    "GoTo Technologies USA, LLC" or
    "Hefei Pingbo Network Technology Co. Ltd" or
    "IDrive, Inc." or
    "Impero Solutions Limited" or
    "IMPERO SOLUTIONS LIMITED" or
    "Instant Housecall" or
    "ISL Online Ltd." or
    "JumpCloud Inc" or
    "Level Software, Inc." or
    "LogMeIn, Inc." or
    "LUNIXAR SAS DE CV" or
    "MMSOFT Design Ltd." or
    "Monitoring Client" or
    "MSPBytes Corp" or
    "MSPBytes, Corp." or
    "N-ABLE TECHNOLOGIES LTD" or
    "Nanosystems S.r.l." or
    "NetSupport Ltd" or
    "NetSupport Ltd." or
    "NETSUPPORT LTD." or
    "NinjaOne LLC" or
    "NinjaRMM, LLC" or
    "Open Source Developer, Huabing Zhou" or
    "Parallels International GmbH" or
    "philandro Software GmbH" or
    "Pro Softnet Corporation" or
    "PURSLANE" or
    "RealVNC" or
    "RealVNC Limited" or
    "REMOTE UTILITIES PTE. LTD." or
    "Remote Utilities LLC" or
    "Rocket Software, Inc." or
    "Rsupport Co., Ltd." or
    "SAFIB" or
    "ScreenConnect Client" or
    "Servably, Inc." or
    "Servably Inc." or
    "ShowMyPC INC" or
    "SimpleHelp Ltd" or
    "Splashtop Inc." or
    "Superops Inc." or
    "Tailscale Inc." or
    "TeamViewer" or
    "TeamViewer GmbH" or
    "TeamViewer Germany GmbH" or
    "Techinline Limited" or
    "uvnc bvba" or
    "Yakhnovets Denis Aleksandrovich IP" or
    "Zhou Huabing" or
    "ZOHO Corporation Private Limited"
)
'''


note = """## Triage and analysis

### Investigating First Time Seen RMM Signer Across the Environment

Attackers abuse legitimate RMM and remote-access software to open interactive sessions, persist, and stage follow-on tooling while blending into IT support activity. This rule alerts on a Windows Elastic Defend process start whose `process.code_signature.subject_name` matches a curated vendor list, when that subject is first seen across the visible fleet in the 10-day new_terms history window. Novelty is keyed only on the signer subject, so each certificate string alerts once environment-wide and renamed binaries that still carry a listed signer still match. Signature trust is not a query condition; review `process.code_signature.trusted` as context only.

#### Possible investigation steps

- Is the matched binary a remote-access component, or an unrelated product that shares this signer?
  - Focus: `process.executable`, `process.name`, `process.pe.original_file_name`, `process.command_line`.
  - Review the other binaries this signer started on the alerted host with $investigate_0
  - Implication: Several vendors on this list also ship backup, virtualization, terminal-emulation, and management software under the same certificate, so a signer's first appearance is often not its remote-access product. A path, original file name, and command line matching the vendor's remote-access agent keeps that hypothesis active. An unrelated product from the same vendor makes this a low-value observation that still consumes the signer's novelty term, so confirm the vendor's remote-access footprint now rather than waiting for a later alert this rule will not produce.
- Does the parent and session context explain why this process launched on this host?
  - Focus: `process.parent.executable`, `process.parent.command_line`, `process.Ext.session_info.logon_type`, `process.Ext.token.elevation_level`, `user.name`.
  - Retrieve the parent process event while the parent entity is still retained with $investigate_1
  - Implication: A parent consistent with a software-deployment service or a scheduled management task keeps this inside a rollout hypothesis. A launch from a browser, archive, mail client, script interpreter, or an unexpected interactive session points instead to social engineering or staged access.
- What did the matched process start after launch?
  - Focus: child `process.name`, `process.command_line`, `process.parent.entity_id`.
  - Review child process starts on the same host with $investigate_2
  - Implication: No child process evidence is unresolved, not benign. Children limited to the vendor's own service and updater binaries stay consistent with normal tool operation without proving the deployment was authorized, while child shells, script interpreters, discovery commands, or credential tooling are suspicious.
- Did the same process perform remote-access network activity that changes the host scope?
  - Focus: `destination.ip`, `destination.port`, `network.direction`.
  - Review endpoint network events for the same process entity with $investigate_3
  - Implication: Missing network telemetry is unresolved, not benign. Sessions to the vendor's own service endpoints show the tool operating normally but do not establish who initiated the session, while connections to unrelated external infrastructure keep the case open for escalation and wider scoping.
- If local evidence is suspicious or unresolved, is the same signer or executable hash appearing beyond the alerted host?
  - Focus: `process.code_signature.subject_name`, `process.hash.sha256`, `process.executable`, `host.name`, `user.name`.
  - Review recent process starts sharing the matched signer or executable hash with $investigate_4; the pivot is bounded to the last 24 hours for performance, so widen the Timeline range when the deployment window or suspected activity is older.
  - Implication: Additional hosts or users shift the hypothesis from a single host deployment to an environment-wide remote-access introduction and should expand response scope. This rule reports a signer once for the whole fleet, so it will not alert again for this vendor and will not alert at all on a renamed binary reusing an already-observed signer; a clean 24-hour pivot therefore bounds recent spread only and is not evidence that spread has stopped.

After these checks, escalate when source process, parent, network, or cross-host evidence is suspicious; close only when alert-local and recovered evidence prove the exact expected host/user/signer/hash scope with verified owner confirmation; preserve and escalate mixed or incomplete cases for more context.

### False positive analysis

- This rule can alert on a real but expected first appearance of a listed signer when a software rollout, support session, or vendor agent introduction reaches the Elastic Defend fleet for the first time in the 10-day history window.
- Treat benign disposition as evidence-bounded: the alert's `process.code_signature.subject_name`, `process.executable`, `process.hash.sha256`, `host.id`, `host.name`, `user.id`, and `user.domain` should match a validated change record or verified owner confirmation for the exact system and activity.
- Treat `process.code_signature.trusted` as contextual evidence, not clearance: a trusted signature does not establish authorization or benign intent, and an untrusted, invalid, or missing trust value does not by itself prove malicious use.
- Certificate subjects that differ only in case or punctuation are separate novelty terms, so a single vendor can produce more than one alert as its certificate strings drift across products and releases. Correlate those and treat them as one introduction rather than as repeat findings.
- When justified, scope an exception conjunctively to the exact `process.code_signature.subject_name` plus `process.executable`, further bounded by supported host/user anchors such as `host.id`, `host.name`, `user.id`, or `user.domain`; never exclude on signer alone. `process.hash.sha256` is precise for scoping one investigation but is not a durable exception anchor, because the vendor's next release changes it and the exception silently stops matching.
- Expect an exception to have limited effect here, because the first alert already consumes that signer's novelty term for the history window; an exception only applies if the signer disappears from the visible fleet for more than 10 days and returns. `user.name` appears in the Focus lines for readability during analysis, while exception criteria prefer `user.id` and `user.domain` as stable identifiers rather than display names.

### Response and remediation

- Preserve or export case evidence plus volatile process, memory, executable, and file-system artifacts that could be lost before isolation, process termination, cleanup, or other disruptive action.
- Scope the activity by signer, executable hash, process entity, host, and user before containment; include child processes, same-process network events when available, and any later hosts that show the same signer or hash.
- If malicious use is confirmed, contain affected hosts through the endpoint response integration when available and contain affected accounts using reversible controls first; if direct endpoint response is unavailable, document the collected evidence and artifacts and hand them off to the responsible endpoint or incident-response team able to act. After evidence collection and scoping, terminate malicious processes, remove persistence, and clean up remote-access tooling.
- Review collected evidence for credential exposure, lateral movement, and follow-on tooling before final remediation decisions.
- Document confirmed indicators and any logging or detection gaps for the responsible detection or logging owners after scoping and containment.
"""

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "host.id",
    "host.name",
    "user.id",
    "user.name",
    "user.domain",
    "process.entity_id",
    "process.parent.entity_id",
    "process.code_signature.subject_name",
    "process.code_signature.trusted",
    "process.name",
    "process.executable",
    "process.pe.original_file_name",
    "process.command_line",
    "process.hash.sha256",
    "process.Ext.session_info.logon_type",
    "process.Ext.token.elevation_level",
]


[[transform.investigate]]
label = "Signer footprint on the alerted host"
description = "Show which binaries sharing the matched code-signature subject started on the alerted host during the investigation window."
providers = [[
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "process.code_signature.subject_name", queryType = "phrase", value = "{{process.code_signature.subject_name}}", valueType = "string" },
    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" },
    { excluded = false, field = "event.type", queryType = "phrase", value = "start", valueType = "string" },
]]
relativeFrom = "now-24h/h"
relativeTo = "now"

[[transform.investigate]]
label = "Parent process context"
description = "Find the parent process event for the matched launch when the parent entity is retained."
providers = [[
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.parent.entity_id}}", valueType = "string" },
    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" },
]]
relativeFrom = "now-24h/h"
relativeTo = "now"

[[transform.investigate]]
label = "Child process starts"
description = "Find child process starts spawned by the matched process on the same host."
providers = [[
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "process.parent.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" },
    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" },
    { excluded = false, field = "event.type", queryType = "phrase", value = "start", valueType = "string" },
]]
relativeFrom = "now-24h/h"
relativeTo = "now"

[[transform.investigate]]
label = "Same-process network events"
description = "Search for endpoint network events tied to the matched process entity on the same host."
providers = [[
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" },
    { excluded = false, field = "event.category", queryType = "phrase", value = "network", valueType = "string" },
]]
relativeFrom = "now-24h/h"
relativeTo = "now"

[[transform.investigate]]
label = "Recent signer and hash spread"
description = "Search the 24-hour investigation window for process starts that share the matched signer or executable hash. Widen the Timeline range to look further back."
providers = [[
    { excluded = false, field = "process.code_signature.subject_name", queryType = "phrase", value = "{{process.code_signature.subject_name}}", valueType = "string" },
    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" },
    { excluded = false, field = "event.type", queryType = "phrase", value = "start", valueType = "string" },
], [
    { excluded = false, field = "process.hash.sha256", queryType = "phrase", value = "{{process.hash.sha256}}", valueType = "string" },
    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" },
    { excluded = false, field = "event.type", queryType = "phrase", value = "start", valueType = "string" },
]]
relativeFrom = "now-24h/h"
relativeTo = "now"

[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1219"
name = "Remote Access Tools"
reference = "https://attack.mitre.org/techniques/T1219/"
[[rule.threat.technique.subtechnique]]
id = "T1219.002"
name = "Remote Desktop Software"
reference = "https://attack.mitre.org/techniques/T1219/002/"



[rule.threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[rule.new_terms]
field = "new_terms_fields"
value = ["process.code_signature.subject_name"]
[[rule.new_terms.history_window_start]]
field = "history_window_start"
value = "now-10d"

[rule]
description = """
This rule detects hidden executables being executed through cron and systemd. Cron and Systemd can be used to schedule
jobs (commands or scripts) to run periodically at fixed times, dates, or intervals. Threat actors may abuse these
built-in services to execute malicious commands or scripts at specific times or intervals to establish persistence or
escalate privileges.
"""
id = "e8b2afe5-37a9-468c-a6fb-f178d46cb698"
license = "Elastic License v2"
name = "Hidden Payload Executed via Scheduled Job"
os_list = ["linux"]
reference = [
    "https://intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/",
    "https://www.elastic.co/security-labs/primer-on-persistence-mechanisms",
]
version = "1.0.27"

query = '''
process where event.type == "start" and event.action == "exec" and (
  (process.parent.name in ("cron", "crond") and process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and
   process.args == "-c" and process.args like "*/.*" and not process.args like ("*/.*/*", "*/.*;*")) or
  (process.parent.name == "systemd" and process.args like "*/.*" and process.args_count == 1)
) and not (
  process.command_line in (
    "/bin/sh -c /bin/bash /root/rotate.sh rotate /root/.vault-token",
    "/bin/sh -c crontab -l > $HOME/.crontab",
    "/bin/sh -c autorestic -c /root/.autorestic.yml --ci cron",
    "/bin/sh -c /root/.dbbackup.sh",
    "/bin/sh -c bash /root/.stafftimerDatabase.sh",
    "/bin/sh -c bash /root/.db-backup.sh",
    "/bin/bash -c chown root /tmp/.flexlm*",
    "/bin/sh -c crontab -l > $HOME/.crontab.bak",
    "/bin/sh -c /bin/...",
    "/bin/sh -c crontab -l > ~keystone/.crontab.$MAILTAG.keystone",
    "/bin/sh -c /usr/local/bin/autorestic -c /root/.autorestic.yml --ci cron",
    "/bin/sh -c /root/bin/getssl -a -q -w /root/.getssl-acme.sectigo.com",
    "/bin/sh -c /webmail/tools/alluser.pl > /webmail/modules/ad_sync/etc/.always_keep.list",
    "/bin/sh -c bash /root/.pf-new-vpn-ssl-check.sh",
    "/bin/sh -c /bin/bash $HOME/.backup.sh",
    "/bin/sh -c /bin/mysql_tzinfo_to_sql /usr/share/zoneinfo/| /bin/mysql --defaults-file=/root/.my.cnf mysql",
    "/bin/sh -c /bin/echo -n >/data/EXPORT/.approved",
    "/bin/sh -c source ~/.bashrc",
    "/bin/sh -c /usr/local/bin/getssl -a -q -w /home/acme/.getssl", "/bin/sh -c mysqlcheck --defaults-file=/root/.my.cnf -o misp",
    "/bin/sh -c /usr/local/bin/getssl -a -q -w /home/acme/.getssl-lets-encrypt"
  ) or
  process.command_line like (
    "*/home/*/.*.*", "*/opt/invgate/insight-agent/*", "*ansible*", "/bin/sh -c /backup/store_Weight_LABEL/.create_site.sh*",
    "/bin/sh -c /backup/mktphotos/.main*.sh", "/bin/bash -c unset*/var/.cagefs'", "/bin/sh -c *autorestic*", "*/opt/export-ecs-ip/ecs-ip.py*", 
    "/bin/sh -c /usr/local/bin/mettle cache -d /var/cache/mettle *", 
    "/bin/sh -c /opt/tm/mettle/root/mettle cache -d /opt/tm/mettle/root/var/cache/mettle*",
    "/bin/sh -c gssh-agent scp -r *:/mnt/*/common/shared/*/skills_repo/skills ~/.agents"
  ) or
  process.args like (
    "/usr/sbin/tmpwatch*", "/usr/sap/*", "sed*", "*/../*", "cd ~/.unison*", "/usr/sbin/logrotate*",
    "/home/raulsiim/.local/share/JetBrains/Toolbox/apps/intellij-idea-community-edition/bin/idea",
    "/usr/bin/flock*", "export VAULT_ADDR=* VAULT_SKIP_VERIFY=true && /usr/local/bin/vault token renew >> ~/.vault-renewal.log 2>&1"
  ) or
  process.executable like (
    "/opt/eset/eei/bin/*", "/tmp/newroot/tmp/.mount_*", "/tmp/.mount_*", "/opt/gotify/gotify-linux-amd64",
    "/home/*/.local/share/JetBrains/Toolbox/apps/goland/bin/goland", "/home/*/.linuxbrew/opt/etcd/bin/etcd",
    "/tmp/newroot/home/*/.local/share/JetBrains/*", "/home/*/.local/share/caa/caa",
    "/home/*/.local/bin/gitsign-credential-cache",
    "/home/*/.local/share/JetBrains/Toolbox/apps/intellij-idea-ultimate/bin/idea",
    "/home/*/.local/share/JetBrains/*", "/home/*/.local/opt/activitywatch/*",
    "/home/*/.local/bin/claude-oauth-proxy", "/root/.local/openaev-agent-session/openaev-agent",
    "/nix/store/*/bin/.blueman-tray-wrapped", "/var/lib/containers/storage/overlay/nix/store/*/bin/.blueman-tray-wrapped",
    "/home/*/.config/discord/*/Discord"
  ) or
  process.name in ("riptide-agent", "zellij", "gitsign-credential-cache", "jetbrains-toolbox", "goland") or
  process.working_directory == "/var/lib/rabbitmq" or
  (process.working_directory == "/home/oracle" and process.command_line like "/bin/sh -c sh /u01/oradata/*")
)
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1053"
name = "Scheduled Task/Job"
reference = "https://attack.mitre.org/techniques/T1053/"
[[threat.technique.subtechnique]]
id = "T1053.003"
name = "Cron"
reference = "https://attack.mitre.org/techniques/T1053/003/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1053"
name = "Scheduled Task/Job"
reference = "https://attack.mitre.org/techniques/T1053/"
[[threat.technique.subtechnique]]
id = "T1053.003"
name = "Cron"
reference = "https://attack.mitre.org/techniques/T1053/003/"


[[threat.technique]]
id = "T1543"
name = "Create or Modify System Process"
reference = "https://attack.mitre.org/techniques/T1543/"
[[threat.technique.subtechnique]]
id = "T1543.002"
name = "Systemd Service"
reference = "https://attack.mitre.org/techniques/T1543/002/"



[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1053"
name = "Scheduled Task/Job"
reference = "https://attack.mitre.org/techniques/T1053/"
[[threat.technique.subtechnique]]
id = "T1053.003"
name = "Cron"
reference = "https://attack.mitre.org/techniques/T1053/003/"


[[threat.technique]]
id = "T1543"
name = "Create or Modify System Process"
reference = "https://attack.mitre.org/techniques/T1543/"
[[threat.technique.subtechnique]]
id = "T1543.002"
name = "Systemd Service"
reference = "https://attack.mitre.org/techniques/T1543/002/"



[threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[internal]
min_endpoint_version = "7.15.0"

[metadata]
creation_date = "2025/02/20"
integration = ["endpoint"]
maturity = "production"
updated_date = "2026/04/10"

[rule]
author = ["Elastic"]
description = """
This rule detects a high number of egress network connections from an unusual executable on a Linux system. This could
indicate a command and control (C2) communication attempt, a brute force attack via a malware infection, or other
malicious activity. ESQL rules have limited fields available in its alert documents. Make sure to review the original
documents to aid in the investigation of this alert.
"""
from = "now-61m"
interval = "1h"
language = "esql"
license = "Elastic License v2"
name = "High Number of Egress Network Connections from Unusual Executable"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating High Number of Egress Network Connections from Unusual Executable

In Linux environments, executables can initiate network connections for legitimate purposes. However, adversaries exploit this by deploying malware in temporary directories to establish command and control (C2) channels. The detection rule identifies unusual executables making numerous outbound connections, excluding trusted IP ranges and known benign paths, to flag potential threats.

### Possible investigation steps

- Review the process.executable field to identify the specific executable making the connections and determine if it is known or expected in the environment.
- Examine the destination.ip field to identify the external IP addresses the executable is attempting to connect to and check if they are known malicious or suspicious.
- Check the host.os.type and agent.id fields to identify the specific host and agent involved, and gather additional context about the system's role and recent activity.
- Analyze the @timestamp field to correlate the timing of the connections with other events or activities on the network or host.
- Cross-reference the identified executable and IP addresses with threat intelligence sources to determine if they are associated with known threats or campaigns.
- If the executable is determined to be malicious or suspicious, isolate the affected host and perform a deeper forensic analysis to identify any additional indicators of compromise or lateral movement.

### False positive analysis

- Executables in temporary directories used by legitimate applications or scripts can trigger alerts. Review the process name and executable path to determine if they are associated with known applications or scripts.
- Automated scripts or cron jobs that perform network operations might be flagged. Identify these scripts and consider excluding their paths from the rule if they are verified as non-malicious.
- Development or testing environments often use temporary directories for network operations. If these environments are known and trusted, add their specific paths to the exclusion list.
- Backup or synchronization tools that use temporary directories for data transfer can generate numerous connections. Verify these tools and exclude their paths if they are confirmed to be safe.
- Security tools or monitoring agents that operate in temporary directories might be mistakenly flagged. Confirm their legitimacy and exclude their paths to prevent false positives.

### Response and remediation

- Isolate the affected host immediately from the network to prevent further potential malicious communication and lateral movement.
- Terminate the suspicious process identified by the alert to stop any ongoing malicious activity.
- Conduct a forensic analysis of the affected system to identify any additional indicators of compromise (IOCs) and assess the extent of the infection.
- Remove any malicious executables or files found in temporary directories such as /tmp, /var/tmp, or /dev/shm to eliminate the threat.
- Patch and update the affected system to the latest security standards to close any vulnerabilities that may have been exploited.
- Monitor network traffic for any unusual outbound connections from other systems to detect potential spread or similar threats.
- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to ensure comprehensive remediation.
"""
risk_score = 47
rule_id = "1fa350e0-0aa2-4055-bf8f-ab8b59233e59"
setup = """## Setup

This rule requires data coming in from Elastic Defend.

### Elastic Defend Integration Setup
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.

#### Prerequisite Requirements:
- Fleet is required for Elastic Defend.
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).

#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
- Go to the Kibana home page and click "Add integrations".
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
- Click "Add Elastic Defend".
- Configure the integration name and optionally add a description.
- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
- Click "Save and Continue".
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
"""
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: Linux",
    "Use Case: Threat Detection",
    "Tactic: Command and Control",
    "Data Source: Elastic Defend",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "esql"
query = '''
from logs-endpoint.events.network-* metadata _id, _index, _version
| mv_expand event.action 
| where
    host.os.type == "linux" and
    event.type == "start" and
    event.action == "connection_attempted" and
    (
        process.executable like "/tmp/*" or
        process.executable like "/var/tmp/*" or
        process.executable like "/dev/shm/*" or
        process.executable like "/var/log/*" or
        process.executable like "/sys/*" or
        process.executable like "/media/*" or
        process.executable like "/proc/*" or
        process.executable like "/var/backups/*" or
        process.executable like "/var/mail/*" or
        process.executable like "/var/spool/*" or
        process.executable like "./*" or
        process.name like ".*"
    ) and
    not (
        cidr_match(destination.ip,
            "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12",
            "192.0.0.0/24", "192.0.0.29/32", "192.0.0.8/32", "192.0.0.9/32",
            "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
            "192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24",
            "224.0.0.0/4", "100.64.0.0/10", "192.175.48.0/24", "198.18.0.0/15",
            "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1", "FE80::/10", "FF00::/8"
        ) or
        process.executable like "/tmp/newroot/*" or
        process.executable like "/tmp/.mount*" or
        process.executable like "/tmp/go-build*"
    )
| keep
    @timestamp,
    _id,
    _index,
    _version,
    host.os.type,
    event.type,
    event.action,
    process.name,
    process.executable,
    destination.ip,
    agent.id,
    host.name,
    data_stream.dataset,
    data_stream.namespace

| stats
    Esql.event_count = count(),
    Esql.agent_id_count_distinct = count_distinct(agent.id),
    Esql.host_name_values = values(host.name),
    Esql.agent_id_values = values(agent.id),
    Esql.data_stream_dataset_values = values(data_stream.dataset),
    Esql.data_stream_namespace_values = values(data_stream.namespace)
    by process.executable
| where
    Esql.agent_id_count_distinct == 1 and
    Esql.event_count > 15

// Extract unique values to ECS fields for alerts exclusion
| eval agent.id = mv_min(Esql.agent_id_values),
       host.name = mv_min(Esql.host_name_values)

| sort Esql.event_count asc

| keep agent.id, host.name, process.executable, Esql.*
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"

[rule.threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1564"
name = "Hide Artifacts"
reference = "https://attack.mitre.org/techniques/T1564/"

[[rule.threat.technique.subtechnique]]
id = "T1564.001"
name = "Hidden Files and Directories"
reference = "https://attack.mitre.org/techniques/T1564/001/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[rule]
description = """
Detects when an installer package creates a new directory structure and immediately moves an executable file into that
directory. Threat actors will often include system preparation steps in their initial access installer packages
implemented via pre or post install scripts with the purpose of preparing a location to drop and execute their payload
from that won't raise suspicion.
"""
id = "6e53dbb1-55c6-419c-ab8e-75a5d53aac49"
license = "Elastic License v2"
name = "Initial Access Staging via Installer Package"
os_list = ["macos"]
version = "1.0.12"

query = '''
sequence by process.entity_id with maxspan=15s
[process where event.type == "start" and process.Ext.effective_parent.name == "installer" and
  process.parent.name : ("bash", "sh", "zsh", "dash", "csh", "tcsh", "ksh", "tclsh*", "fish") and process.name in ("cp", "mv")]
[file where event.action != "deletion" and file.Ext.header_bytes like~ ("cffaedfe*", "cafebabe*") and
  (file.name like~ ".*" or file.path like
                                  ("/Users/Shared/*",
                                   "/tmp/*", 
                                   "/private/tmp/*", 
                                   "/var/tmp/*", 
                                   "/Library/WebServer/*", 
                                   "/Library/Graphics/*", 
                                   "/Library/Fonts/*")) and
  not file.path like
                  ("/private/tmp/org.gpgtools/gpgmailloader_install/GPGMailLoader.signed.mailbundle/Contents/MacOS/GPGMailLoader",
                   "/private/tmp/PKInstallSandbox*")]
'''

min_endpoint_version = "8.8.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1546"
name = "Event Triggered Execution"
reference = "https://attack.mitre.org/techniques/T1546/"
[[threat.technique.subtechnique]]
id = "T1546.016"
name = "Installer Packages"
reference = "https://attack.mitre.org/techniques/T1546/016/"



[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[internal]
min_endpoint_version = "8.8.0"

[rule]
description = """
Identifies the execution of a file written or modified by Microsoft Office processes followed by a child process spawned
via Windows Management Instrumentation (WMI). This behavior may indicate adversarial activity to avoid spawning a
suspicious MS Office child process.
"""
id = "792411bd-59ef-4ac0-89be-786d52d1a5c8"
license = "Elastic License v2"
name = "Microsoft Office File Execution via WMI"
os_list = ["windows"]
reference = [
    "https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16",
]
version = "1.0.31"

query = '''
sequence with maxspan=1m
  [file where event.action != "deletion" and
   (file.extension : ("exe", "com") or file.Ext.header_bytes : "4d5a*") and
   process.name : ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "MSACCESS.EXE", "MSPUB.EXE", "fltldr.exe")] by file.path
  [process where event.action == "start" and process.parent.name : "wmiprvse.exe" and
   not process.Ext.token.integrity_level_name == "system"] by process.executable
'''

min_endpoint_version = "7.15.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"
[[threat.technique.subtechnique]]
id = "T1566.001"
name = "Spearphishing Attachment"
reference = "https://attack.mitre.org/techniques/T1566/001/"



[threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1047"
name = "Windows Management Instrumentation"
reference = "https://attack.mitre.org/techniques/T1047/"


[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "7.15.0"

[metadata]
creation_date = "2026/02/20"
integration = ["okta"]
maturity = "production"
updated_date = "2026/04/27"

[rule]
author = ["Elastic"]
description = """
Correlates the first occurrence of an Okta user session started via a proxy with subsequent Okta security alerts for the
same user. Attackers frequently use proxy infrastructure (VPNs, Tor, residential proxies) to mask their origin when
using stolen credentials, and their post-authentication activity often triggers additional detection rules.
"""
false_positives = [
    """
    Legitimate users who routinely use VPN or proxy services for privacy may trigger this if they also trigger unrelated
    security alerts.
    """,
    "Security testing or red team exercises using proxy infrastructure.",
]
from = "now-60m"
index = [".alerts-security.*"]
interval = "30m"
language = "eql"
license = "Elastic License v2"
name = "Okta Alerts Following Unusual Proxy Authentication"
note = """## Triage and analysis

### Investigating Okta Alerts Following Unusual Proxy Authentication

This rule correlates the first occurrences of authentication behind a proxy followed by an alert with subsequent Okta security alerts for the same user. Attackers frequently use proxy infrastructure (VPNs, Tor, residential proxies) to mask their origin when using stolen credentials, and their post-authentication activity often triggers additional detection rules.

By correlating the proxy alert with other Okta alerts using an EQL sequence, this rule identifies users whose proxy-based authentication was followed by suspicious activity within a 1-hour window.

#### Possible investigation steps
- Identify the affected user and review the correlated security alerts to understand what suspicious activity was detected after the proxy authentication.
- Examine the proxy source IP addresses and cross-reference with threat intelligence feeds for known malicious infrastructure.
- Review the time gap between the proxy authentication and subsequent alert generation.
- Review the user's recent Okta activity for signs of account takeover (MFA changes, new devices, unusual app access).
- Verify with the user whether they intentionally used a proxy or VPN during this session.

### False positive analysis
- Users who legitimately use VPN services for privacy or remote work may trigger this rule if they also trigger unrelated alerts.
- Security testing or red team exercises using proxy infrastructure combined with testing that triggers alerts.
- Corporate VPN egress points that Okta classifies as proxy infrastructure.

### Response and remediation
- If account compromise is suspected, immediately revoke all active sessions for the user.
- Reset the user's password and MFA factors.
- Review and revoke any OAuth tokens or API keys associated with the account.
- Block the source proxy IP at the network perimeter if confirmed malicious.
- Review the user's access to sensitive applications and data during the suspicious session.
"""
references = [
    "https://developer.okta.com/docs/reference/api/system-log/",
    "https://developer.okta.com/docs/reference/api/event-types/",
    "https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy",
    "https://www.elastic.co/security-labs/monitoring-okta-threats-with-elastic-security",
    "https://www.elastic.co/security-labs/starter-guide-to-understanding-okta",
    "https://cloud.google.com/blog/topics/threat-intelligence/expansion-shinyhunters-saas-data-theft",
]
risk_score = 73
rule_id = "af2d8e4c-3b7c-4e91-8f5a-6c9d0e1f2a3b"
severity = "high"
tags = [
    "Domain: Identity",
    "Domain: Cloud",
    "Use Case: Identity and Access Audit",
    "Use Case: Threat Detection",
    "Data Source: Okta",
    "Data Source: Okta System Logs",
    "Tactic: Initial Access",
    "Rule Type: Higher-Order Rule",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
sequence by user.name with maxspan=30m
    [any where event.dataset == "okta.system" and
        kibana.alert.rule.rule_id == "6f1bb4b2-7dc8-11ee-92b2-f661ea17fbcd"]
    [any where event.dataset == "okta.system" and
        kibana.alert.rule.rule_id != null and
        kibana.alert.severity != "low" and
        kibana.alert.rule.rule_id not in  (
            "6f1bb4b2-7dc8-11ee-92b2-f661ea17fbcd",
            "af2d8e4c-3b7c-4e91-8f5a-6c9d0e1f2a3b"
        )
    ]
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"
[[rule.threat.technique.subtechnique]]
id = "T1078.004"
name = "Cloud Accounts"
reference = "https://attack.mitre.org/techniques/T1078/004/"



[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"

[metadata]
creation_date = "2026/01/09"
integration = ["endpoint"]
maturity = "production"
updated_date = "2026/03/24"

[rule]
author = ["Elastic"]
description = """
Detects when the Ollama LLM server accepts connections from external IP addresses. Ollama lacks built-in authentication,
so exposed instances allow unauthenticated model theft, prompt injection, and resource hijacking.
"""
from = "now-9m"
index = ["logs-endpoint.events.network-*"]
language = "eql"
license = "Elastic License v2"
name = "Ollama API Accessed from External Network"
note = """## Triage and analysis

### Investigating Ollama API Accessed from External Network

This rule detects when Ollama accepts connections from external IP addresses. Ollama binds to localhost:11434 by default but can be exposed via OLLAMA_HOST. Since Ollama lacks authentication, exposed instances allow unauthenticated model theft, prompt injection, and resource hijacking.

### Possible investigation steps

- Check the OLLAMA_HOST environment variable to determine if external exposure was intentional.
- Review the source IP address to identify if it's a known attacker, scanner, or miscategorized internal system.
- Examine Ollama logs for suspicious API calls to /api/pull, /api/push, or /api/generate.
- Check ~/.ollama/models/ for unexpected model downloads that may indicate model poisoning.
- Review network traffic for data exfiltration following the connection.
- Look for child processes spawned by Ollama that may indicate exploitation.

### False positive analysis

- Internal networks not properly classified in CIDR ranges may trigger false positives.
- Load balancers or reverse proxies accessing Ollama from external-facing IPs within trusted infrastructure.
- Legitimate remote access through VPN or authenticated proxy (add proxy IPs to exclusions).

### Response and remediation

- Restrict access immediately by setting OLLAMA_HOST=127.0.0.1:11434 or applying firewall rules.
- If exploitation is suspected, stop Ollama and audit ~/.ollama/models/ for unauthorized models.
- Review Ollama and system logs for signs of compromise.
- Consider running Ollama in a container with network isolation.
"""
references = [
    "https://www.greynoise.io/blog/threat-actors-actively-targeting-llms",
    "https://atlas.mitre.org/techniques/AML.T0040",
    "https://atlas.mitre.org/techniques/AML.T0044",
]
risk_score = 47
rule_id = "d8f2a1b3-c4e5-6789-abcd-ef0123456789"
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: Linux",
    "OS: macOS",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Initial Access",
    "Data Source: Elastic Defend",
    "Resources: Investigation Guide",
    "Domain: LLM",
    "Mitre Atlas: T0040",
    "Mitre Atlas: T0044",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
network where event.action == "connection_accepted" and
  process.name in ("ollama", "ollama.exe") and
  destination.port == 11434 and
  source.ip != null and source.ip != "0.0.0.0" and
  not cidrmatch(source.ip, 
    "10.0.0.0/8", 
    "127.0.0.0/8", 
    "169.254.0.0/16", 
    "172.16.0.0/12", 
    "192.168.0.0/16",
    "100.64.0.0/10",
    "::1",
    "fe80::/10",
    "fc00::/7",
    "ff00::/8"
  )
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1133"
name = "External Remote Services"
reference = "https://attack.mitre.org/techniques/T1133/"

[[rule.threat.technique]]
id = "T1190"
name = "Exploit Public-Facing Application"
reference = "https://attack.mitre.org/techniques/T1190/"

[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"

[rule]
description = """
Detects when an interpreter process creates a memory file descriptor and executes a command in the proc file system.
This activity indicates an active attempt to execute a fileless payload and should be considered highly abnormal or
suspicious. This activity can occur when the memfd syscall is utilized to create a memory resident file, like a payload,
and then uses it to execute a process via a command and control channel.
"""
id = "87d16b52-e0be-4dd2-b6a8-056f188be018"
license = "Elastic License v2"
name = "Potential Fileless Execution via Memory File Descriptor from Interpreter"
os_list = ["linux"]
version = "1.0.7"

query = '''
process where event.type == "start" and event.action == "memfd_create" and (
  (process.name like "python*" and process.args == "-c") or
  (process.name like ("perl*", "ruby*", "lua*", "node", "nodejs") and process.args like "-e*") or
  (process.name like "php*" and process.args like "-r*") or
  process.name like ("*.py", "*.pyc", "*.lua", "*.pl", "*.rb", "*.bin", "*.php", "*.js", "*.mjs") or
  (
    process.name like ("python*", "perl*", "php*", "ruby*", "lua*", "node", "java", "javaw") and
    (
      process.args like (
        "/tmp/*", "/var/tmp/*", "/dev/shm/*", "/run/user/*", "/var/run/user/*", "/root/*",
        "/boot/*", "/sys/*", "/lost+found/*", "/proc/*", "/var/mail/*", "/var/www/*"
      ) and process.args_count <= 2
    ) 
  )
) and not (
  process.executable like (
    "/usr/lib/libreoffice/program/soffice.bin", "/app/bin/evolution.bin", "/opt/cpanel/ea-php83/root/usr/bin/php-cgi",
    "/snap/libreoffice/*/lib/libreoffice/program/soffice.bin", "/usr/NX/bin/nxrunner.bin",
    "/usr/lib64/libreoffice/program/soffice.bin", "/opt/libreoffice*/program/soffice.bin", "/opt/hrt/hrtpylon-*/bin/python3*",
    "/usr/NX/bin/nxplayer.bin", "/usr/bin/qgis.bin", "/opt/gitlab/embedded/bin/ruby", "/app/libreoffice/program/soffice.bin",
    "/ztank/sw/eb/sw/Python/*/bin/python*", "/sw/eb/sw/Python/*/bin/python*", "/home/*/.local/share/uv/python/cpython*/bin/python*",
    "/opt/micromamba/bin/python*", "/opt/balenaEtcher/balena-etcher.bin"
  ) or
  process.parent.command_line == "/bin/sh -e /usr/lib/php/sessionclean" or
  (
    process.name like "php*" and (
      process.Ext.memfd.name in (
        "memfd:opcache_lock", "anon_hugepage", "opcache_lock", "memfd:anon-handle",
        "memfd:anon-shm-handle", "memfd:trampoline_dependencies.so", "memfd:spawn_worker_trampoline"
      ) or
      process.command_line == "php public/index.php"
    )
  ) or
  (
    process.name like "python*" and
    process.Ext.memfd.name like (
      "wayland-shm", "memfd:pulseaudio", "memfd:dd_inject_info", "memfd:dd_language_detected", "wayland-cursor",
      "memfd:wayland-cursor", "pulseaudio", "datadog-tracer-info*", "memfd:datadog-tracer-info-*", "memfd:libffi",
      "libffi", "memfd:xshmfence", "xshmfence", "JITCode*", "unknown-usage*", "JSVMStack*", "JSGCHeap*",
      "OTEL_CTX", "memfd:OTEL_CTX"
    )
  ) or
  (
    process.name like ("ruby*", "node", "nodejs") and
    process.Ext.memfd.name like ("OTEL_CTX", "memfd:OTEL_CTX")
  ) or
  (
    process.name like "ruby*" and
    process.Ext.memfd.name like ("memfd:libffi", "libffi")
  ) or
  (
    process.name like ("node", "nodejs") and
    process.Ext.memfd.name like ("datadog-tracer-info*", "memfd:datadog-tracer-info-*")
  ) or
  process.parent.executable like (
    "/opt/saltstack/salt/bin/python3*", "/usr/lib/systemd/systemd", "/usr/bin/gnome-shell", "/usr/NX/bin/nxexec",
    "/usr/bin/sddm", "/usr/bin/bwrap", "/usr/bin/rofi", "/usr/bin/dbus-daemon", "/tmp/.mount_*/lm-studio",
    "/usr/libexec/gnome-session-binary", "/usr/local/aegis/AliSecCheckTmp/AliSecCheck", "./runc", "/usr/bin/runc",
    "/snap/claude-ai-desktop/*/app/claude-desktop.bin", "/home/*/Programy/WBEST-MNT/WBEST-MNTv1_0_Linux",
    "/opt/LM-Studio/lm-studio", "/var/lib/rancher/rke2/data/*/bin/runc", "/var/lib/rancher/rke2/data/*/bin/containerd-shim-runc-v2"
  ) or
  process.parent.command_line in ("/bin/sh /usr/local/bin/docker-php-ext-enable xdebug", "/usr/bin/python3 /usr/bin/nobara-updater --all") or
  process.parent.command_line like "*/home/*/.claude/shell-snapshots/snapshot-*" or
  (
    process.command_line == "buildah-chroot-runtime" and
    process.Ext.memfd.name == "memfd:buildah-chroot-runtime"
  ) or
  (
    process.name like "ruby*" and
    process.args == "-e" and
    process.args == "sandbox"
  ) or
  (
    process.name like "ruby*" and
    process.Ext.memfd.name like "memfd:datadog-tracer-info-*"
  ) or
  (
    process.executable == "/usr/bin/perl" and
    process.Ext.memfd.name in ("memfd:dd_inject_info", "memfd:dd_language_detected")
  ) or
  (process.name like "python3*" and process.args == "/usr/bin/supervisord") or
  (process.name == "node" and process.args == "appCron.js") or
  process.parent.executable like "*/node_modules/@openai/codex/node_modules/@openai/codex-linux-x64/vendor/x86_64-unknown-linux-musl/bin/codex"
)
'''

min_endpoint_version = "9.1.4"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.006"
name = "Python"
reference = "https://attack.mitre.org/techniques/T1059/006/"

[[threat.technique.subtechnique]]
id = "T1059.007"
name = "JavaScript"
reference = "https://attack.mitre.org/techniques/T1059/007/"

[[threat.technique.subtechnique]]
id = "T1059.011"
name = "Lua"
reference = "https://attack.mitre.org/techniques/T1059/011/"


[[threat.technique]]
id = "T1106"
name = "Native API"
reference = "https://attack.mitre.org/techniques/T1106/"


[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"
[[threat.technique.subtechnique]]
id = "T1055.009"
name = "Proc Memory"
reference = "https://attack.mitre.org/techniques/T1055/009/"


[[threat.technique]]
id = "T1620"
name = "Reflective Code Loading"
reference = "https://attack.mitre.org/techniques/T1620/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1105"
name = "Ingress Tool Transfer"
reference = "https://attack.mitre.org/techniques/T1105/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "9.1.4"