Elastic rules: 0b

[metadata]
creation_date = "2026/04/08"
integration = ["aws"]
maturity = "production"
updated_date = "2026/04/08"

[rule]
author = ["Elastic"]
description = """
Identifies when an IAM instance profile is associated with a running EC2 instance or replaces the existing association.
These APIs change which role credentials the instance obtains via the instance metadata service without terminating the
instance. Attackers who can call `AssociateIamInstanceProfile` or `ReplaceIamInstanceProfile` may attach a more
privileged role to a workload they control, enabling privilege escalation or lateral movement from the instance.
"""
false_positives = [
    """
    Blue/green deployments, instance remediation, and automation may rebind instance profiles intentionally. Confirm the
    instance id, new `iamInstanceProfile` or `IamInstanceProfile` ARN, and change records. Exclude known automation
    roles after validation.
    """,
]
from = "now-6m"
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
language = "kuery"
license = "Elastic License v2"
name = "AWS EC2 Instance Profile Associated with Running Instance"
note = """## Triage and analysis

### Investigating AWS EC2 Instance Profile Associated with Running Instance

`AssociateIamInstanceProfile` adds an instance profile to a running instance (where none was set at launch).
`ReplaceIamInstanceProfile` swaps the association. Both require `ec2:AssociateIamInstanceProfile` /
`ec2:ReplaceIamInstanceProfile` and typically `iam:PassRole` on the target instance profile’s role.

#### Possible investigation steps

- Parse `aws.cloudtrail.request_parameters` for `instanceId` and instance profile name or ARN.
- Identify the IAM role behind the profile and compare its policies to the prior role (if any).
- Map the instance to owner, application, and sensitivity; check for recent compromise indicators (SSRF to IMDS,
  unusual `AssumeRole` from the instance role).
- Review `aws.cloudtrail.user_identity.arn`, `source.ip`, and `user_agent.original`.

### False positive analysis

- Legitimate fixes for missing or wrong profiles at launch; verify with service owners.

### Response and remediation

- If unauthorized: disassociate or replace with the correct profile, revoke `PassRole`/`ec2` permissions from the
  actor, and rotate credentials that may have been issued from the over-privileged role.

### Additional information

- [AssociateIamInstanceProfile](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AssociateIamInstanceProfile.html)
- [ReplaceIamInstanceProfile](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ReplaceIamInstanceProfile.html)
"""
references = [
    "https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AssociateIamInstanceProfile.html",
    "https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ReplaceIamInstanceProfile.html",
]
risk_score = 73
rule_id = "e5f9a1b2-3c4d-4e6f-a7b8-9c0d1e2f3a4b"
severity = "high"
tags = [
    "Domain: Cloud",
    "Data Source: AWS",
    "Data Source: Amazon Web Services",
    "Data Source: AWS EC2",
    "Use Case: Threat Detection",
    "Tactic: Privilege Escalation",
    "Tactic: Lateral Movement",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
event.dataset: "aws.cloudtrail"
    and event.provider: "ec2.amazonaws.com"
    and event.action: ("AssociateIamInstanceProfile" or "ReplaceIamInstanceProfile")
    and event.outcome: "success"
    and not aws.cloudtrail.user_identity.type: "AWSService" 
    and not aws.cloudtrail.user_identity.invoked_by: "ssm.amazonaws.com" 
'''

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user_agent.original",
    "source.ip",
    "aws.cloudtrail.user_identity.arn",
    "aws.cloudtrail.user_identity.type",
    "aws.cloudtrail.user_identity.access_key_id",
    "aws.cloudtrail.resources.arn",
    "aws.cloudtrail.resources.type",
    "event.action",
    "event.outcome",
    "cloud.account.id",
    "cloud.region",
    "aws.cloudtrail.request_parameters",
    "aws.cloudtrail.response_elements",
]

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1548"
name = "Abuse Elevation Control Mechanism"
reference = "https://attack.mitre.org/techniques/T1548/"

[[rule.threat.technique.subtechnique]]
id = "T1548.005"
name = "Temporary Elevated Cloud Access"
reference = "https://attack.mitre.org/techniques/T1548/005/"

[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"

[[rule.threat.technique.subtechnique]]
id = "T1078.004"
name = "Cloud Accounts"
reference = "https://attack.mitre.org/techniques/T1078/004/"

[rule.threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[metadata]
creation_date = "2026/07/27"
integration = ["aws"]
maturity = "production"
updated_date = "2026/07/27"

[rule]
author = ["Elastic"]
description = """
Detects the first time an AWS identity successfully deletes an IAM managed policy whose ARN contains
guardrail-related keywords (for example Boundary, Deny, Restrict, Guard, SCP, Guardrail). Adversaries who have
obtained elevated IAM privileges may delete policies to remove restrictive permissions boundaries,
eliminate deny-based guardrails, or clean up after a privilege escalation operation. Infrastructure-as-code tools (Terraform, CloudFormation, Pulumi, and Ansible) are excluded because policy lifecycle management is a routine part of automated deployments. A policy deletion by an identity not seen performing this activity during the prior seven days may indicate newly compromised credentials being used to modify the account's permission structure.
"""
false_positives = [
    """
    New IAM administrator roles, recently provisioned automation accounts, or first-time
    IaC deployments may legitimately delete policies for the first time. Validate that the
    identity is an authorized IAM management role and that the deleted policy was obsolete
    or replaced as part of a known change.
    """,
]
from = "now-6m"
index = ["logs-aws.cloudtrail-*"]
interval = "5m"
language = "kuery"
license = "Elastic License v2"
name = "AWS IAM Permission Boundary or Guardrail Policy Deleted by Unusual Identity"
note = """## Triage and analysis

### Investigating AWS IAM Permission Boundary or Guardrail Policy Deleted by Unusual Identity

This rule fires the first time an identity deletes a customer-managed IAM policy in the prior 7 days. Policy deletion is a privilege-escalation or defense-evasion primitive: removing a deny-based policy or permissions boundary silently expands the effective access of every principal that policy applied to.

### Possible investigation steps

- Identify the deleting principal (`aws.cloudtrail.user_identity.arn`) and determine whether they have a history of IAM policy management in audit logs beyond the 7-day window.
- Review `aws.cloudtrail.request_parameters` to identify the policy ARN that was deleted. Policies with names containing "Boundary", "Deny", or "Restrict" in the ARN are highest priority.
- Check whether any principal previously had this policy attached as a permissions boundary — if so, those principals may now operate without that constraint.
- Review the same identity's CloudTrail activity for other IAM privilege escalation indicators in the same session: `CreatePolicyVersion`, `SetDefaultPolicyVersion`, `AttachRolePolicy`, `UpdateAssumeRolePolicy`.
- Determine whether this identity was recently assumed via `AssumeRole` from an unusual source IP.

### False positive analysis

- First-time IaC deployments (Terraform apply, CDK deploy) that manage IAM resources will appear as new identities performing policy deletions.
- New service accounts introduced to handle IAM lifecycle management.

### Response and remediation

- If unauthorized, determine whether the deleted policy was a permissions boundary and re-apply it immediately to all affected principals.
- Revoke or disable the credentials used to perform the deletion pending investigation.
- Review all principals that had the policy attached and audit their current effective permissions.
"""
references = [
    "https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeletePolicy.html",
]
risk_score = 47
rule_id = "f4a82031-9c8e-4b23-a7d5-6e1094b2c539"
setup = "The AWS CloudTrail integration must be enabled and configured to collect IAM management events."
severity = "medium"
tags = [
    "Domain: Cloud",
    "Data Source: AWS",
    "Data Source: Amazon Web Services",
    "Data Source: AWS IAM",
    "Use Case: Identity and Access Audit",
    "Tactic: Defense Evasion",
    "Tactic: Persistence",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "new_terms"

query = '''
data_stream.dataset: "aws.cloudtrail"
    and event.provider: "iam.amazonaws.com"
    and event.action: "DeletePolicy"
    and event.outcome: "success"
    and not aws.cloudtrail.user_identity.type: "AWSService"
    and aws.cloudtrail.request_parameters: (*Boundary* or *boundary* or *Deny* or *deny* or *Restrict* or *restrict* or *Guard* or *guard* or *SCP* or *Guardrail* or *guardrail*)
    and not user_agent.original: (*Terraform* or *terraform* or "cloudformation.amazonaws.com" or *pulumi* or *Pulumi* or *ansible* or *Ansible*)
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[rule.new_terms]
field = "new_terms_fields"
value = ["aws.cloudtrail.user_identity.arn"]
[[rule.new_terms.history_window_start]]
field = "history_window_start"
value = "now-7d"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "aws.cloudtrail.user_identity.session_context.session_issuer.arn",
    "aws.cloudtrail.user_identity.type",
    "event.action",
    "event.outcome",
    "aws.cloudtrail.request_parameters",
    "source.ip",
    "cloud.region",
    "cloud.account.id",
]

[metadata]
creation_date = "2026/07/08"
integration = ["aws"]
maturity = "production"
updated_date = "2026/07/08"

[rule]
author = ["Elastic"]
description = """
Identifies a principal that, within a short window, both registers an Amazon ECS task definition using a public / non-ECR
container image at a high CPU allocation (8 or 16 vCPU) AND launches ECS workloads (RunTask, StartTask, or CreateService).
Registering a public miner image at maximum compute and then launching it is the ECS/Fargate cryptocurrency-mining
deployment pattern seen after credential compromise. Requiring both the mining-signature registration and a launch by the
same principal confirms an actual deployment rather than a standalone (possibly benign) task-definition registration,
which sharply reduces false positives from high-compute workloads that are merely registered.
"""
false_positives = [
    """
    A principal that legitimately both registers a high-compute public-image task definition and runs ECS workloads in the
    same window could match (for example, some data-science or batch pipelines). Confirm the image and CPU in
    "aws.cloudtrail.request_parameters" of the RegisterTaskDefinition event, the launched workload, and whether the
    principal in "aws.cloudtrail.user_identity.arn" is an expected ECS operator; exclude known principals after validation.
    The CPU threshold and registry list are tunable in the query.
    """,
]
from = "now-30m"
language = "esql"
license = "Elastic License v2"
name = "AWS Potential Cryptomining via ECS Task Definition Deployment"
note = """## Triage and analysis

### Investigating AWS Potential Cryptomining via ECS Task Definition Deployment

Amazon ECS runs containers from images referenced in a task definition. After credential compromise, a common impact action is to abuse ECS/Fargate for cryptomining: the adversary registers a task definition pointing at a public miner image (Docker Hub, GHCR, Quay, or the public ECR gallery) at maximum CPU to maximize hashrate, then launches it at scale via RunTask/CreateService, often across multiple regions.

This rule correlates by principal within the rule window and fires only when the same identity BOTH (a) registers a task definition whose container image comes from a public registry and whose CPU is high (8-16 vCPU), AND (b) launches ECS workloads (RunTask/StartTask/CreateService). Requiring the launch in addition to the mining-signature registration confirms active deployment and distinguishes it from a task definition that is merely registered.

### Possible investigation steps

- Review the RegisterTaskDefinition event's "aws.cloudtrail.request_parameters" for the container image, CPU/memory, and task family, and the launch event(s) for the cluster and desired count.
- Identify the principal in "aws.cloudtrail.user_identity.arn"/"aws.cloudtrail.user_identity.type" and whether it normally operates ECS; review "source.ip"/"source.as.number" and "user_agent.original".
- Correlate with related activity by the same principal: ECS "CreateCluster" (especially in unused regions), new IAM users with administrative policies, and prior reconnaissance.
- Inspect the referenced image and any running containers/tasks and their outbound network connections (mining-pool traffic).

### False positive analysis

- Legitimate batch/data-science workloads may both register a high-compute public-image task definition and run it. Validate the image, workload, and principal, and exclude known-good identities after confirmation.

### Response and remediation

- If unauthorized, stop and delete the launched services/tasks, deregister the task definition, and review other regions for the same activity.
- Investigate the principal for compromise, revoke or rotate its credentials, and review for persistence (new IAM users/policies).
- Restrict ECS task-definition registration and task execution roles, and require images from approved private ECR repositories.
"""
references = [
    "https://securitylabs.datadoghq.com/articles/tales-from-the-cloud-trenches-ecs-crypto-mining/",
    "https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_definitions.html",
]
risk_score = 73
rule_id = "3ca27e45-b0cd-417a-914c-d086869acd1b"
setup = "This rule requires AWS CloudTrail logs ingested via the Elastic AWS integration. See https://docs.elastic.co/integrations/aws/cloudtrail for setup details."
severity = "high"
tags = [
    "Domain: Cloud",
    "Data Source: AWS",
    "Data Source: AWS CloudTrail",
    "Data Source: Amazon Web Services",
    "Use Case: Threat Detection",
    "Tactic: Impact",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "esql"

query = '''
FROM logs-aws.cloudtrail-*
| WHERE event.provider == "ecs.amazonaws.com"
    AND event.action IN ("RegisterTaskDefinition", "RunTask", "StartTask", "CreateService")
| EVAL Esql.miner_register = CASE(
        event.action == "RegisterTaskDefinition"
            AND (aws.cloudtrail.request_parameters RLIKE """.*image=(docker.io|index.docker.io|ghcr.io|quay.io|public.ecr.aws)/.*"""
                OR aws.cloudtrail.request_parameters RLIKE """.*image=[-a-zA-Z0-9_]+(/|[,} :]).*""")
            AND aws.cloudtrail.request_parameters RLIKE """.*cpu=(8192|16384)[,} ].*""", 1, 0),
    Esql.task_run = CASE(event.action IN ("RunTask", "StartTask", "CreateService"), 1, 0)
| STATS Esql.miner_register_sum = SUM(Esql.miner_register), Esql.task_run_sum = SUM(Esql.task_run), Esql.event_count = COUNT(*),
        Esql.cloud_region_count_distinct = COUNT_DISTINCT(cloud.region), Esql.cloud_region_values = VALUES(cloud.region),
        Esql.event_action_values = VALUES(event.action), Esql.source_ip_values = VALUES(source.ip),
        Esql.source_as_number_values = VALUES(source.as.number), Esql.user_agent_original_values = VALUES(user_agent.original),
        Esql.cloud_account_id_values = VALUES(cloud.account.id), Esql.aws_cloudtrail_user_identity_type_values = VALUES(aws.cloudtrail.user_identity.type),
        Esql.timestamp_min = MIN(@timestamp), Esql.timestamp_max = MAX(@timestamp)
        BY aws.cloudtrail.user_identity.arn
| WHERE Esql.miner_register_sum >= 1 AND Esql.task_run_sum >= 1
| KEEP aws.*, Esql.aws_cloudtrail_user_identity_type_values, Esql.miner_register_sum, Esql.task_run_sum, Esql.event_count, Esql.cloud_region_count_distinct, Esql.cloud_region_values, Esql.event_action_values, Esql.source_ip_values, Esql.source_as_number_values, Esql.user_agent_original_values, Esql.cloud_account_id_values, Esql.timestamp_min, Esql.timestamp_max
'''

[rule.investigation_fields]
field_names = [
    "aws.cloudtrail.user_identity.arn",
    "Esql.aws_cloudtrail_user_identity_type_values",
    "Esql.miner_register_sum",
    "Esql.task_run_sum",
    "Esql.event_count",
    "Esql.cloud_region_count_distinct",
    "Esql.cloud_region_values",
    "Esql.event_action_values",
    "Esql.source_ip_values",
    "Esql.source_as_number_values",
    "Esql.user_agent_original_values",
    "Esql.cloud_account_id_values",
    "Esql.timestamp_min",
    "Esql.timestamp_max",
]


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1496"
name = "Resource Hijacking"
reference = "https://attack.mitre.org/techniques/T1496/"

[rule.threat.tactic]
id = "TA0040"
name = "Impact"
reference = "https://attack.mitre.org/tactics/TA0040/"

[rule]
description = "Detects attempts to execute encoded powershell commands via Windows Installers."
id = "5a7148dc-338a-4998-8adb-5b64d7557dfc"
license = "Elastic License v2"
name = "Encoded Powershell Execution via MsiExec"
os_list = ["windows"]
version = "1.0.3"

query = '''
process where event.action == "start" and
 (process.name : "powershell.exe" or process.pe.original_file_name == "PowerShell.EXE") and
 process.args : ("-e", "-enc", "-ec", "-encod", "-encode", "iex (gc *") and
 (
  descendant of [process where event.action == "start" and process.name : "msiexec.exe"] or
  process.parent.name : "msiexec.exe"
  )
'''

min_endpoint_version = "7.16.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.001"
name = "PowerShell"
reference = "https://attack.mitre.org/techniques/T1059/001/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[[threat.technique.subtechnique]]
id = "T1218.007"
name = "Msiexec"
reference = "https://attack.mitre.org/techniques/T1218/007/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.16.0"

[metadata]
creation_date = "2025/04/30"
integration = ["azure"]
maturity = "production"
updated_date = "2026/04/10"

[rule]
author = ["Elastic"]
description = """
Identifies more than two Microsoft Entra ID Protection alerts associated to the user principal in a short time period.
Microsoft Entra ID Protection alerts are triggered by suspicious sign-in activity, such as anomalous IP addresses, risky
sign-ins, or other risk detections. Multiple alerts in a short time frame may indicate an ongoing attack or compromised
account.
"""
from = "now-9m"
index = ["logs-azure.identity_protection-*"]
language = "eql"
license = "Elastic License v2"
name = "Entra ID Protection Alerts for User Detected"
note = """## Triage and analysis

### Investigating Entra ID Protection Alerts for User Detected

#### Possible investigation steps
- Identify the Risk Detection that triggered the event. A list with descriptions can be found [here](https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks#risk-types-and-detection).
- Identify the user account involved and validate whether the suspicious activity is normal for that user.
  - Consider the source IP address and geolocation for the involved user account. Do they look normal?
  - Consider the device used to sign in. Is it registered and compliant?
- Investigate other alerts associated with the user account during the past 48 hours.
- Contact the account owner and confirm whether they are aware of this activity.
- Check if this operation was approved and performed according to the organization's change management policy.
- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.

### False positive analysis
- If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination of user and device conditions.
- Consider the context of the user account and whether the activity is expected. For example, if the user is a developer or administrator, they may have legitimate reasons for accessing resources from various locations or devices.

### Response and remediation
- Initiate the incident response process based on the outcome of the triage.
- Disable or limit the account during the investigation and response.
- Identify the possible impact of the incident and prioritize accordingly; the following actions can help you gain context:
    - Identify the account role in the cloud environment.
    - Assess the criticality of affected services and servers.
    - Work with your IT team to identify and minimize the impact on users.
    - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
    - Identify any regulatory or legal ramifications related to this activity.
- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
- Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.
- Consider enabling multi-factor authentication for users.
- Follow security best practices [outlined](https://docs.microsoft.com/en-us/azure/security/fundamentals/identity-management-best-practices) by Microsoft.
- Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
"""
references = [
    "https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/reference-azure-monitor-sign-ins-log-schema",
    "https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection",
    "https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-investigate-risk",
    "https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-investigate-risk#investigation-framework",
]
risk_score = 73
rule_id = "bcf0e362-0a2f-4f5e-9dd8-0d34f901781f"
severity = "high"
tags = [
    "Domain: Cloud",
    "Data Source: Azure",
    "Data Source: Microsoft Entra ID",
    "Data Source: Microsoft Entra ID Protection Logs",
    "Use Case: Identity and Access Audit",
    "Resources: Investigation Guide",
    "Tactic: Initial Access",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
sequence by azure.identityprotection.properties.user_principal_name with maxspan=10m
[any where event.module == "azure" and data_stream.dataset == "azure.identity_protection"] with runs=2
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"

[[rule.threat.technique.subtechnique]]
id = "T1078.004"
name = "Cloud Accounts"
reference = "https://attack.mitre.org/techniques/T1078/004/"

[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"

[[rule.threat.technique.subtechnique]]
id = "T1078.004"
name = "Cloud Accounts"
reference = "https://attack.mitre.org/techniques/T1078/004/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"

[[rule.threat.technique.subtechnique]]
id = "T1078.004"
name = "Cloud Accounts"
reference = "https://attack.mitre.org/techniques/T1078/004/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[metadata]
creation_date = "2022/07/05"
integration = ["kubernetes"]
maturity = "production"
updated_date = "2026/04/10"

[rule]
author = ["Elastic"]
description = """
This rule detects an attempt to create or modify a pod using the host IPC namespace. This gives access to data used by
any pod that also use the hosts IPC namespace. If any process on the host or any processes in a pod uses the hosts
inter-process communication mechanisms (shared memory, semaphore arrays, message queues, etc.), an attacker can
read/write to those same mechanisms. They may look for files in /dev/shm or use ipcs to check for any IPC facilities
being used.
"""
false_positives = [
    """
    An administrator or developer may want to use a pod that runs as root and shares the host's IPC, Network, and PID
    namespaces for debugging purposes. If something is going wrong in the cluster and there is no easy way to SSH onto
    the host nodes directly, a privileged pod of this nature can be useful for viewing things like iptable rules and
    network namespaces from the host's perspective. Add exceptions for trusted container images using the query field
    "kubernetes.audit.requestObject.spec.container.image"
    """,
]
index = ["logs-kubernetes.audit_logs-*"]
language = "kuery"
license = "Elastic License v2"
name = "Kubernetes Pod Created With HostIPC"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Kubernetes Pod Created With HostIPC

Kubernetes allows pods to share the host's IPC namespace, enabling inter-process communication. While useful for legitimate applications, adversaries can exploit this to access shared memory and IPC mechanisms, potentially leading to data exposure or privilege escalation. The detection rule identifies suspicious pod creation or modification events that enable host IPC, excluding known benign images, to flag potential security threats.

### Possible investigation steps

- Review the Kubernetes audit logs to identify the specific pod creation or modification event that triggered the alert, focusing on the event.dataset field with the value "kubernetes.audit_logs".
- Examine the kubernetes.audit.annotations.authorization_k8s_io/decision field to confirm that the action was allowed, and verify the identity of the user or service account that initiated the request.
- Investigate the kubernetes.audit.objectRef.resource field to ensure the resource involved is indeed a pod, and check the kubernetes.audit.verb field to determine if the action was a create, update, or patch operation.
- Analyze the kubernetes.audit.requestObject.spec.hostIPC field to confirm that host IPC was enabled, and cross-reference with the kubernetes.audit.requestObject.spec.containers.image field to ensure the image is not part of the known benign list.
- Check for any other pods or processes on the host that might be using the host's IPC namespace, and assess if there is any unauthorized access or data exposure risk.
- Look for any suspicious activity or anomalies in the /dev/shm directory or use the ipcs command to identify any IPC facilities that might be exploited.

### False positive analysis

- Pods using hostIPC for legitimate inter-process communication may trigger alerts. Review the pod's purpose and verify if hostIPC is necessary for its function.
- Known benign images, such as monitoring or logging agents, might use hostIPC. Update the exclusion list to include these images if they are verified as non-threatening.
- Development or testing environments often use hostIPC for debugging purposes. Consider excluding these environments from the rule or creating a separate rule with a higher threshold for alerts.
- Automated deployment tools might temporarily use hostIPC during setup. Ensure these tools are recognized and excluded if they are part of a controlled and secure process.
- Regularly review and update the exclusion list to reflect changes in your environment, ensuring that only verified and necessary uses of hostIPC are excluded.

### Response and remediation

- Immediately isolate the affected pod to prevent further access to the host's IPC namespace. This can be done by cordoning the node or deleting the pod if necessary.
- Review and revoke any unnecessary permissions or roles that allowed the pod to be created or modified with hostIPC enabled. Ensure that only trusted entities have the capability to modify pod specifications.
- Conduct a thorough audit of other pods and configurations in the cluster to identify any additional instances where hostIPC is enabled without a valid justification.
- Implement network policies to restrict communication between pods and the host, limiting the potential impact of any unauthorized access to the host's IPC mechanisms.
- Escalate the incident to the security operations team for further investigation and to determine if any data exposure or privilege escalation occurred.
- Update security policies and configurations to prevent the use of hostIPC in future pod deployments unless explicitly required and approved.
- Enhance monitoring and alerting to detect similar attempts in the future, ensuring that any unauthorized use of hostIPC is promptly flagged and addressed.

## Setup

The Kubernetes Fleet integration with Audit Logs enabled or similarly structured data is required to be compatible with this rule."""
references = [
    "https://research.nccgroup.com/2021/11/10/detection-engineering-for-kubernetes-clusters/#part3-kubernetes-detections",
    "https://kubernetes.io/docs/concepts/security/pod-security-policy/#host-namespaces",
    "https://bishopfox.com/blog/kubernetes-pod-privilege-escalation",
]
risk_score = 47
rule_id = "764c8437-a581-4537-8060-1fdb0e92c92d"
severity = "medium"
tags = [
  "Data Source: Kubernetes",
  "Domain: Kubernetes",
  "Use Case: Threat Detection",
  "Tactic: Execution",
  "Tactic: Privilege Escalation",
  "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"
query = '''
data_stream.dataset : "kubernetes.audit_logs" and kubernetes.audit.annotations.authorization_k8s_io/decision:"allow" and
kubernetes.audit.objectRef.resource:"pods" and kubernetes.audit.verb:("create" or "update" or "patch") and
kubernetes.audit.requestObject.spec.hostIPC:true and
not kubernetes.audit.requestObject.spec.containers.image: (
  docker.elastic.co/beats/elastic-agent* or rancher/system-agent* or registry.crowdstrike.com/falcon-sensor*
)
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1611"
name = "Escape to Host"
reference = "https://attack.mitre.org/techniques/T1611/"

[rule.threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1610"
name = "Deploy Container"
reference = "https://attack.mitre.org/techniques/T1610/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[rule]
description = """
Identifies when a Microsoft Office process creates an executable file (DLL) and the file is subsequently loaded. An
adversary may deliver a weaponized Office document to their target that writes and loads malicious modules.
"""
id = "a0a82ad6-98ed-4426-abd8-52e7b052e297"
license = "Elastic License v2"
name = "Microsoft Office Loaded a Dropped Executable File"
os_list = ["windows"]
reference = [
    "https://www.elastic.co/security-labs/Hunting-for-Suspicious-Windows-Libraries-for-Execution-and-Evasion",
]
version = "1.0.33"

query = '''
sequence by process.entity_id with maxspan=1m
  [ file where event.action != "deletion" and
      process.name :
          ("WINWORD.EXE",
           "EXCEL.EXE",
           "POWERPNT.EXE",
           "MSACCESS.EXE") and
      (
        file.extension : ("dll", "cpl", "ocx") or
        // Match Windows PE files by header data (MZ)
        file.Ext.header_bytes : "4d5a*"
      )] by file.path
  [ library where
    process.name : ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "MSACCESS.EXE") and
    dll.hash.sha256 != null and
    not (dll.code_signature.trusted == true and dll.path : "?:\\Users\\*\\appdata\\local\\assembly\\*.dll") and
    not (dll.code_signature.subject_name == "Bloomberg L.P." and dll.code_signature.trusted == true) and
    not dll.hash.sha256 : ("8f66789803adb34bdce7dd6686c6d53a0d1089ebf998ec3ab2b455da2828fd3c",
                           "464266dd5656b82acaac189406983e1c9427be6578f6617360c613e5911c2b06",
                           "2ce237db9ba8d32db3e1fb7301b407e66cf101cc8f37efa32e5e97d40032f75a",
                           "aa6fd3c1caf2a53d1fba496564dff15d89779bbdf8f132917eec30049adc9678",
                           "077e534918a6d0ce90ad91b26168d6b838a854f3899ddf0720a38ca31d15102b",
                           "26815ae316c6fdeb699b722ba9663089590a5aeaee1ec10375d21d814c5f3aec",
                           "e464f82e4a44064dc00e997b18fb55c22e0f39182dc22e150ef081cd13af01fe",
                           "b0680c48dd70da998844bb34fb4bb70d95cc7698ebb7443c36be0d393adc14d5",
                           "3ab00c79bc361e4b10d79f7c9e1b9d4ab9935b5e5a622027700bc278b5eb622d",
                           "e0a51c0bf8b8563a91aba2b3a473e93c8e2febf6d2db1f0a3aeebd8dd3d8d054",
                           "2153b80f5d1cb4bce4b01ec7801abb0b0858b644f21ad5f8cb4d7d83c7db151d",
                           "e8db34b27fbedd8d4022b9ee9071ca2651730fe1741569bad746dbdf129e562a",
                           "0ac3251c8451349337c6b2b9763a95a47dfc5b883ba6f91eccd22b07c930c984",
                           "57ec9182ffb5e1baf5c105eb531111d11de1c8bb5c46740ae3dae557e40dffe7") and
    not dll.path : "?:\\Windows\\assembly\\NativeImages_*.dll" and
    not dll.code_signature.status : ("trusted", "errorExpired", "errorCode_endpoint*") and
    not dll.pe.imphash : "dae02f32a21e03ce65412f6e56942daa"] by dll.path
'''

min_endpoint_version = "8.10.0"
optional_actions = []
reputation = true
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"
[[threat.technique.subtechnique]]
id = "T1566.001"
name = "Spearphishing Attachment"
reference = "https://attack.mitre.org/techniques/T1566/001/"



[threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"

[internal]
min_endpoint_version = "8.10.0"

[metadata]
creation_date = "2024/06/06"
integration = ["endpoint"]
maturity = "production"
updated_date = "2026/03/24"

[rule]
author = ["Elastic"]
description = """
This rule identifies an egress internet connection initiated by an SSH Daemon child process. This behavior is
indicative of the alteration of a shell configuration file or other mechanism that launches a process when a
new SSH login occurs. Attackers can also backdoor the SSH daemon to allow for persistence, call out to a C2
or to steal credentials.
"""
from = "now-9m"
index = ["logs-endpoint.events.network*", "logs-endpoint.events.process*"]
language = "eql"
license = "Elastic License v2"
name = "Network Connection Initiated by Suspicious SSHD Child Process"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Network Connection Initiated by Suspicious SSHD Child Process

The SSH Daemon (SSHD) facilitates secure remote logins and command execution on Linux systems. Adversaries may exploit SSHD by modifying shell configurations or backdooring the daemon to establish unauthorized connections, often for persistence or data exfiltration. The detection rule identifies suspicious outbound connections initiated by SSHD child processes, excluding benign processes and internal IP ranges, to flag potential malicious activity.

### Possible investigation steps

- Review the process details of the SSHD child process that initiated the network connection, focusing on the process.entity_id and process.parent.entity_id to understand the process hierarchy and parent-child relationship.
- Examine the destination IP address of the network connection attempt to determine if it is associated with known malicious activity or suspicious external entities, especially since it is not within the excluded internal IP ranges.
- Investigate the executable path of the process that initiated the connection to ensure it is not a known benign process like "/bin/yum" or "/usr/bin/yum", and verify if the process name is not among the excluded ones such as "login_duo", "ssh", "sshd", or "sshd-session".
- Check the timing and frequency of the SSHD child process executions and network connection attempts to identify any patterns or anomalies that could indicate unauthorized or persistent access attempts.
- Correlate the alert with other security events or logs from the same host.id to gather additional context and determine if there are other indicators of compromise or related suspicious activities.

### False positive analysis

- Internal administrative scripts or tools that initiate network connections upon SSH login can trigger false positives. To manage this, identify and whitelist these specific scripts or tools by their process names or executable paths.
- Automated software updates or package management processes like yum may occasionally initiate network connections. Exclude these processes by adding them to the exception list using their executable paths.
- Security tools such as login_duo or other authentication mechanisms that establish network connections during SSH sessions can be mistaken for malicious activity. Exclude these tools by specifying their process names in the exception list.
- Custom monitoring or logging solutions that connect to external servers for data aggregation might be flagged. Identify these processes and exclude them by their executable paths or process names to prevent false alerts.

### Response and remediation

- Immediately isolate the affected host from the network to prevent further unauthorized access or data exfiltration.
- Terminate any suspicious processes identified as child processes of SSHD that are attempting unauthorized network connections.
- Conduct a thorough review of SSHD configuration files and shell configuration files for unauthorized modifications or backdoors, and restore them from a known good backup if necessary.
- Change all credentials associated with the affected system, especially those that may have been exposed or used during the unauthorized SSH sessions.
- Apply security patches and updates to the SSH daemon and related software to mitigate known vulnerabilities that could be exploited for persistence or unauthorized access.
- Monitor network traffic for any further suspicious outbound connections from other systems, indicating potential lateral movement or additional compromised hosts.
- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine the scope of the compromise."""
references = ["https://hadess.io/the-art-of-linux-persistence/"]
risk_score = 47
rule_id = "63431796-f813-43af-820b-492ee2efec8e"
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: Linux",
    "Use Case: Threat Detection",
    "Tactic: Persistence",
    "Data Source: Elastic Defend",
    "Resources: Investigation Guide"
]
type = "eql"
query = '''
sequence by host.id with maxspan=1s
  [process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and
   process.parent.executable == "/usr/sbin/sshd" and not process.command_line like ("*ansible*", "*BECOME-SUCCESS*")] by process.entity_id
  [network where host.os.type == "linux" and event.type == "start" and event.action == "connection_attempted" and (
     process.executable like (
       "/tmp/*", "/var/tmp/*", "/dev/shm/*", "./*", "/run/*", "/var/run/*", "/boot/*", "/sys/*", "/lost+found/*",
       "/proc/*", "/var/mail/*", "/var/www/*", "/home/*", "/root/*" 
     ) or
     process.name like~ (
       // Hidden processes
       ".*",
       // Suspicious file formats
       "*.elf", "*.sh", "*.py", "*.rb", "*.pl", "*.lua*", "*.php*", ".js",
       // Scheduled tasks
       "systemd", "cron", "crond",
       // Network utilities often used for reverse shells
       "nc", "netcat", "ncat", "telnet", "socat", "openssl", "nc.openbsd", "ngrok", "nc.traditional"
     )
   ) and  
   not (
     destination.ip == null or destination.ip == "0.0.0.0" or cidrmatch(
       destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.0.0/29",
       "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
       "192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10",
       "192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1", "FE80::/10",
       "FF00::/8", "172.31.0.0/16"
     ) or
     process.executable in ("/bin/yum", "/usr/bin/yum") or
     process.name in ("login_duo", "ssh", "sshd", "sshd-session", "sqlplus")
   )
  ] by process.parent.entity_id
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1546"
name = "Event Triggered Execution"
reference = "https://attack.mitre.org/techniques/T1546/"

[[rule.threat.technique.subtechnique]]
id = "T1546.004"
name = "Unix Shell Configuration Modification"
reference = "https://attack.mitre.org/techniques/T1546/004/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1021"
name = "Remote Services"
reference = "https://attack.mitre.org/techniques/T1021/"

[[rule.threat.technique.subtechnique]]
id = "T1021.004"
name = "SSH"
reference = "https://attack.mitre.org/techniques/T1021/004/"

[[rule.threat.technique]]
id = "T1563"
name = "Remote Service Session Hijacking"
reference = "https://attack.mitre.org/techniques/T1563/"

[[rule.threat.technique.subtechnique]]
id = "T1563.001"
name = "SSH Hijacking"
reference = "https://attack.mitre.org/techniques/T1563/001/"

[rule.threat.tactic]
id = "TA0008"
name = "Lateral Movement"
reference = "https://attack.mitre.org/tactics/TA0008/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1095"
name = "Non-Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1095/"

[rule.threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[rule]
description = """
Identifies attempts to access browser history and bookmarks files. Adversaries may enumerate information about browsers
to learn more about compromised environments.
"""
id = "b66bbe30-dd0a-4c79-ade4-2700930f8c09"
license = "Elastic License v2"
name = "Potential Browser Information Discovery"
os_list = ["windows"]
reference = ["https://attack.mitre.org/techniques/T1217/"]
version = "1.0.13"

query = '''
file where event.action == "open" and 
process.executable != null and not user.id in ("S-1-5-18", "S-1-5-19", "S-1-5-20") and process.pid != 4 and
 file.path :
     ("?:\\users\\*\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History",
      "?:\\users\\*\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Bookmarks",
      "?:\\users\\*\\appdata\\local\\microsoft\\edge\\user data\\default\\History",
      "?:\\users\\*\\appdata\\local\\microsoft\\edge\\user data\\default\\Bookmarks",
      "?:\\Users\\*\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*.default*\\places.sqlite",
      "?:\\Users\\*\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*.default*\\formhistory.sqlite") and
 process.thread.Ext.call_stack_summary : "?*" and
 (
  (process.code_signature.trusted == false and not process.code_signature.status : ("errorExpired", "errorCode_endpoint*")) or
  process.code_signature.exists == false or
  (process.code_signature.subject_name : "Microsoft*" and process.thread.Ext.call_stack_contains_unbacked == true and not process.name : "powershell.exe") or
  process.executable :
                ("?:\\Users\\Public\\*",
                 "?:\\Users\\*\\Downloads\\*",
                 "?:\\Windows\\Temp\\*",
                 "?:\\Windows\\Tasks\\*",
                 "?:\\ProgramData\\*",
                 "?:\\Windows\\Microsoft.NET\\*")
 ) and
 not (process.code_signature.subject_name : ("Google LLC", "Mozilla Corporation", "BrowserWorks Ltd", "SAP SE", "Time Doctor LLC", "Emsisoft Ltd", "PIRIFORM SOFTWARE LIMITED") and
      process.code_signature.trusted == true) and
 not (process.code_signature.subject_name : "Shift Technologies Inc." and process.code_signature.status : "errorUntrustedRoot") and 
 not process.executable :
                  ("?:\\Program Files (x86)\\*.exe",
                   "?:\\Program Files\\*.exe",
                   "?:\\Windows\\System32\\svchost.exe",
                   "?:\\Windows\\BitLockerDiscoveryVolumeContents\\BitLockerToGo.exe",
                   "?:\\Users\\*\\User Data\\Default\\mozilla_downloads.exe",
                   "?:\\Users\\*\\User Data\\Default\\chrome_downloads.exe",
                   "?:\\Users\\*\\User Data\\Default\\msedge_downloads.exe",
                   "?:\\Users\\*\\AppData\\Local\\Chromium\\Application\\chrome.exe",
                   "?:\\Users\\*\\AppData\\Local\\Thorium\\Application\\thorium.exe") and
 not (process.executable : "C:\\Windows\\Temp\\RarSFX*\\scanstate.exe" and
      process.thread.Ext.call_stack_summary == "ntdll.dll|sophosed.dll|apphelp.dll|kernelbase.dll|migcore.dll|migstore.dll|migcore.dll|scanstate.exe|kernel32.dll|ntdll.dll") and
 not (process.executable : "C:\\Windows\\explorer.exe" and
      process.thread.Ext.call_stack_summary : "ntdll.dll|kernelbase.dll|hostshellextension.dll|Unbacked") and
 not _arraysearch(process.thread.Ext.call_stack, $entry,
                     $entry.symbol_info : ("*\\chrome.dll!GetHandleVerifier*",
                                           "*\\chrome.dll!ChromeMain*",
                                           "*\\nw.dll!sqlite3_dbdata_init*",
                                           "*\\nw.dll!GetHandleVerifier*",
                                           "*\\BrowserSettings.dll!SetEdgeAsDefaultBrowserOnWin8Beyond*",
                                           "*\\chrome.dll!IsSandboxedProcess*",
                                           "*BrowserSettings.dll!SetEdgeAsDefaultBrowserOnWin*"))
'''

min_endpoint_version = "8.7.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1217"
name = "Browser Information Discovery"
reference = "https://attack.mitre.org/techniques/T1217/"


[threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"

[internal]
min_endpoint_version = "8.7.0"

[rule]
description = """
Detects when the native system binary 'open' is used to open a .doc or .pdf file in a temporary directory or via an
unsigned or untrusted process. Decoy documents are often used to trick users into believing a file or executable is
harmless and distract them from what the malware is doing behind the scenes.
"""
id = "3f2c51ce-5da8-4c9b-8a39-17677ed08eb9"
license = "Elastic License v2"
name = "Potential Decoy Document via Open"
os_list = ["macos"]
reference = [
    "https://github.com/center-for-threat-informed-defense/adversary_emulation_library/tree/4a57b3dd5d28ad1bd79e927e04b20fd4d66934a0/ocean_lotus",
]
version = "1.0.9"

query = '''
process where event.type == "start" and event.action == "exec" and process.name == "open" and
 process.args_count < 3 and 
 process.args like~ ("/tmp/*.doc*", "/tmp/*.pdf*", "/private/tmp/*.doc*", "/private/tmp/*.pdf*", "/Users/Shared/*.doc*", "/Users/Shared/*.pdf*", "/Users/*/Library/*.pdf") and
 not process.args like~ "/tmp/PKInstallSandbox*" and
 not process.args == "-R" and
 not process.Ext.effective_parent.executable in ("/usr/bin/open", "/Applications/Cursor.app/Contents/MacOS/Cursor")
'''

min_endpoint_version = "8.11.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1204"
name = "User Execution"
reference = "https://attack.mitre.org/techniques/T1204/"
[[threat.technique.subtechnique]]
id = "T1204.002"
name = "Malicious File"
reference = "https://attack.mitre.org/techniques/T1204/002/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "8.11.0"

[rule]
description = """
The Installer tool is a command-line utility that allows you to install and uninstall server resources by executing the
installer components in specified assemblies. Adversaries may abuse this utility to run malicious code.
"""
id = "7558b740-a23a-4c73-a060-12ed4e1ddc14"
license = "Elastic License v2"
name = "Potential Evasion via dotNET Framework Installation Utility"
os_list = ["windows"]
reference = ["https://lolbas-project.github.io/lolbas/Binaries/Installutil/"]
version = "1.0.22"

query = '''
process where event.action == "start" and
 (
   ((process.name : "installutil.exe" or process.pe.original_file_name == "InstallUtil.exe") and process.command_line :  ("*/LogFile*", "*http*")) or

   descendant of [process where event.action == "start" and
                  (process.name : "installutil.exe" or process.pe.original_file_name == "InstallUtil.exe") and process.command_line :  "*/LogFile*"]
 ) and
 not (process.executable : "?:\\Windows\\System32\\conhost.exe" and process.args : "0xffffffff" and process.args : "-ForceV1") and
 not (process.name : "installutil.exe" and
      process.args : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*", "PFU.PaperStream.Capture.FiScannerEventService.exe", "PFU.PaperStream.Capture.ReleaseService.exe")) and
 not (process.parent.name : "installutil.exe" and process.parent.args : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*")) and
 not process.executable :
              ("?:\\Program Files\\*exe",
               "?:\\Program Files (x86)\\*.exe",
               "?:\\Windows\\System32\\wbem\\mofcomp.exe",
               "?:\\Windows\\SysWOW64\\wbem\\mofcomp.exe",
               "?:\\Windows\\system32\\conhost.exe",
               "?:\\Windows\\SysWOW64\\conhost.exe",
               "?:\\Windows\\Sys*\\net.exe",
               "?:\\Windows\\Sys*\\net1.exe",
               "?:\\Windows\\System32\\wbem\\mofcomp.exe") and
 not process.parent.executable :
              ("?:\\Program Files*\\SolarWinds\\Orion\\ConfigurationWizard.exe",
               "?:\\Program Files*\\Rescue and Smart Assistant\\InstallUtil64.exe",
               "?:\\Program Files*\\Rescue and Smart Assistant\\*.exe",
               "?:\\Windows\\System32\\msiexec.exe") and
 not (process.executable : "?:\\Windows\\System32\\sc.exe" and process.args : "delete") and
 not (process.args : "/LogFile=C:\\ProgramData\\Veeam\\Setup\\Temp\\Veeam.Backup.PowerShell.InstallLog" and process.parent.name : "msiexec.exe") and
 not (process.name : "InstallUtil.exe" and process.args : ("C:\\Estensa\\Bin64Client\\SL.Server.Cache.WindowsService.exe", "\\SolarWinds TFTP Server.exe"))
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[[threat.technique.subtechnique]]
id = "T1218.004"
name = "InstallUtil"
reference = "https://attack.mitre.org/techniques/T1218/004/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1105"
name = "Ingress Tool Transfer"
reference = "https://attack.mitre.org/techniques/T1105/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "7.15.0"

[metadata]
creation_date = "2025/06/14"
integration = ["system", "windows"]
maturity = "production"
updated_date = "2026/04/24"

[rule]
author = ["Elastic"]
description = """
Identifies directory-service access or creation events involving a MicrosoftDNS record that contains a base64-encoded
blob matching the pattern "UWhRCA...BAAAA". This blob pattern corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION
structure associated with DNS-based SPN spoofing used in Kerberos coercion tradecraft. Adversaries may abuse such
records to coerce victim systems into authenticating to attacker-controlled hosts while requesting Kerberos tickets for
legitimate services.
"""
from = "now-9m"
index = ["logs-system.security*", "logs-windows.forwarded*", "winlogbeat-*"]
language = "kuery"
license = "Elastic License v2"
name = "Potential Kerberos Coercion via DNS-Based SPN Spoofing"
references = [
    "https://www.synacktiv.com/en/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025.html",
    "https://blog.redteam-pentesting.de/2025/reflective-kerberos-relay-attack/",
    "https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html",
    "https://github.com/CICADA8-Research/RemoteKrbRelay/blob/main/README.md",
    "https://github.com/Orange-Cyberdefense/ocd-mindmaps/blob/main/excalimap/mindmap/ad/authenticated.md",
]
risk_score = 73
rule_id = "f701be14-0a36-4e9a-a851-b3e20ae55f09"
severity = "high"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Credential Access",
    "Data Source: Active Directory",
    "Use Case: Active Directory Monitoring",
    "Data Source: Windows Security Event Logs",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
host.os.type:"windows" and
(
  (event.code:4662 and winlog.event_data.AdditionalInfo: *UWhRC*BAAAA*MicrosoftDNS*) or 
  (event.code:5137 and winlog.event_data.ObjectDN: *UWhRC*BAAAA*MicrosoftDNS*)
)
'''

note = """## Triage and analysis

### Investigating Potential Kerberos Coercion via DNS-Based SPN Spoofing

#### Possible investigation steps

- Which ADIDNS record or access event matched the coercion blob?
  - Focus: `event.code`, `winlog.event_data.AdditionalInfo`, `winlog.event_data.ObjectDN`, `winlog.event_data.DSName`, and `winlog.computer_name` to place the marshaled CREDENTIAL_TARGET_INFORMATION blob in its MicrosoftDNS partition.
  - Implication: a namespace used by real clients makes the alert high priority; a lab-only namespace reduces urgency only when later telemetry stays bounded.

- Which account and logon session touched the record?
  - Focus: `user.id`, `winlog.event_data.SubjectUserSid`, `winlog.event_data.SubjectUserName`, `winlog.event_data.SubjectDomainName`, and `winlog.event_data.SubjectLogonId`.
  - Hint: match `winlog.event_data.SubjectLogonId` on the same domain controller to authentication events where `winlog.event_data.TargetLogonId` matches, then read `source.ip` and `winlog.logon.type`. $investigate_2 Missing authentication telemetry is unresolved, not benign.
  - Implication: an actor, source, or logon type outside the DNS or directory-administration tier raises concern; a lab-scoped account, source, and session lowers suspicion only when the change set and authentication evidence also stay bounded.

- Did the same session make adjacent MicrosoftDNS changes that show setup or cleanup?
  - Why: Kerberos coercion setups can create, alter, and remove DNS objects around the single blob-bearing event.
  - Focus: start with surrounding directory-service events for the same `winlog.event_data.SubjectLogonId`, then narrow manually with `winlog.event_data.ObjectDN`, `winlog.event_data.ObjectGUID`, `winlog.event_data.OpCorrelationID`, and `winlog.event_data.AttributeLDAPDisplayName`.
  - Hint: use `winlog.event_data.AttributeValue` to identify added record data or cleanup values when the source logged them, and expect to filter unrelated same-session directory activity manually. $investigate_3
  - Implication: coordinated creation, modification, or deletion supports coercion preparation; one bounded change is less concerning only when it matches the same validation scope.

- Could the spoofed name coerce Kerberos from valuable systems or services?
  - Focus: `winlog.event_data.ObjectDN`, `winlog.event_data.AdditionalInfo`, and `winlog.event_data.DSName` for the spoofed hostname and ADIDNS zone.
  - Implication: names resembling real servers, management systems, service SPN targets, or broad discovery labels increase relay risk; names isolated from real consumers carry lower practical risk.

- Do Windows Security authentication events show the coercion progressed?
  - Focus: after the directory-service event, review Windows Security logon or explicit-credential events with `event.code`, `winlog.event_data.TargetServerName`, `winlog.event_data.TargetInfo`, and `winlog.event_data.AuthenticationPackageName` tied to the spoofed hostname or expected target service.
  - Hint: use `source.ip`, `winlog.event_data.TargetUserName`, and `winlog.computer_name` to identify victim systems and relay targets. Missing authentication telemetry is unresolved, not benign.
  - Implication: escalate as progressed coercion when Kerberos or service access follows the record creation, especially from machine accounts or management systems; treat it as attempted-only when authentication evidence remains absent and the local record evidence is otherwise bounded.

- Is the suspicious pattern isolated to this actor and domain controller?
  - Focus: related relay, directory-service, credential-access, or privilege-escalation alerts for `user.id`. $investigate_0
  - Hint: compare alerts on the logging domain controller's `host.id` for the same behavior families. $investigate_1
  - Implication: expand case scope when the same actor or controller has related suspicious alerts; keep scope local when no related alerts contradict the locally validated test scope.

- What disposition is supported?
  - Focus: record scope, actor/session, MicrosoftDNS change set, authentication progression, and related-alert scope.
  - Implication: escalate when a meaningful blob-bearing record, abnormal actor/session, adjacent MicrosoftDNS changes, or follow-on Kerberos/service activity supports coercion; close only when telemetry binds those categories to a lab or security-test workflow, with external validation required for any legitimacy claim telemetry cannot prove; preserve and escalate when evidence is mixed or incomplete.

### False positive analysis

- Authorized security testing or lab validation can create CredMarshalTargetInfo-style ADIDNS records. Confirm by verifying that `winlog.event_data.ObjectDN` is in the test namespace named by the validation record, `user.id` or `winlog.event_data.SubjectUserSid` matches the named operator, the MicrosoftDNS change set stays bounded, and Windows Security authentication events stay inside the stated victim and target scope. If validation records are unavailable and telemetry cannot prove that exact workflow, keep the alert unresolved instead of closing on recurrence alone.
- Build exceptions from the minimum confirmed pattern: stable `user.id` or `winlog.event_data.SubjectUserSid`, the specific zone path in `winlog.event_data.ObjectDN`, and the logging `host.id`. Avoid exceptions on event codes 4662 or 5137, all MicrosoftDNS changes, or the blob pattern alone.

### Response and remediation

- If confirmed benign, reverse any temporary containment and document the recognized operator, ADIDNS zone or record pattern, and lab-only authentication scope that confirmed the security-test workflow. Create an exception only after the same actor, zone pattern, and domain-controller scope recur.
- If suspicious but unconfirmed, preserve a case export of the raw Windows Security event, `winlog.event_data.ObjectDN`, `winlog.event_data.ObjectGUID`, `winlog.event_data.AdditionalInfo`, the actor/session evidence, the logging domain controller, and any follow-on authentication events before containment. Export the record and surrounding zone state, then use reversible containment such as tightening the affected zone's write access or temporarily removing the actor's ability to modify MicrosoftDNS objects while scope is clarified.
- If confirmed malicious, preserve the coercion record, surrounding MicrosoftDNS changes, and Windows Security authentication evidence tied to the spoofed name; contain the implicated account before destructive cleanup. Review the affected zone, replicating domain controllers, victim systems, and relay targets before removing the spoofing record and adjacent unauthorized DNS objects created by the same session.
- If Kerberos, LDAP, SMB, ADCS, or other service access followed the record, reset exposed account or machine secrets as appropriate and review for RBCD, certificate enrollment, Shadow Credentials, LAPS retrieval, password changes, group changes, service creation, or interactive SMB follow-on behavior.
- Harden by removing unnecessary ADIDNS write permissions, restricting authenticated-user access to MicrosoftDNS objects, and enforcing relay-resistant controls such as SMB signing, LDAP signing/channel binding, and EPA where applicable.
- Retain directory-service and authentication telemetry that supported the decision, and document the confirmed workflow or malicious artifact set for future analysts.
"""

setup = """## Setup

The following Windows audit policies must be enabled to generate the events used by this rule:
- [Audit Directory Service Access](https://ela.st/audit-directory-service-access)
- [Audit Directory Service Changes](https://ela.st/audit-directory-service-changes)
"""

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "event.code",
    "host.id",
    "winlog.computer_name",
    "winlog.event_data.SubjectUserName",
    "winlog.event_data.SubjectUserSid",
    "winlog.event_data.SubjectDomainName",
    "winlog.event_data.SubjectLogonId",
    "winlog.event_data.ObjectDN",
    "winlog.event_data.ObjectGUID",
    "winlog.event_data.AdditionalInfo",
    "winlog.event_data.DSName",
    "winlog.event_data.OpCorrelationID",
    "winlog.event_data.AttributeLDAPDisplayName",
    "winlog.event_data.AttributeValue",
]

[[transform.investigate]]
label = "Alerts associated with the creator"
description = ""
providers = [
  [
    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
    { excluded = false, field = "user.id", queryType = "phrase", value = "{{user.id}}", valueType = "string" }
  ]
]
relativeFrom = "now-48h/h"
relativeTo = "now"

[[transform.investigate]]
label = "Alerts associated with the domain controller"
description = ""
providers = [
  [
    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" }
  ]
]
relativeFrom = "now-48h/h"
relativeTo = "now"

[[transform.investigate]]
label = "Authentication events for the subject logon session"
description = ""
providers = [
  [
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "event.code", queryType = "phrase", value = "4624", valueType = "string" },
    { excluded = false, field = "winlog.event_data.TargetLogonId", queryType = "phrase", value = "{{winlog.event_data.SubjectLogonId}}", valueType = "string" }
  ],
  [
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "event.code", queryType = "phrase", value = "4648", valueType = "string" },
    { excluded = false, field = "winlog.event_data.SubjectLogonId", queryType = "phrase", value = "{{winlog.event_data.SubjectLogonId}}", valueType = "string" }
  ]
]
relativeFrom = "now-24h"
relativeTo = "now"

[[transform.investigate]]
label = "MicrosoftDNS directory-service events for the same session"
description = ""
providers = [
  [
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "event.code", queryType = "phrase", value = "4662", valueType = "string" },
    { excluded = false, field = "winlog.event_data.SubjectLogonId", queryType = "phrase", value = "{{winlog.event_data.SubjectLogonId}}", valueType = "string" }
  ],
  [
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "event.code", queryType = "phrase", value = "5136", valueType = "string" },
    { excluded = false, field = "winlog.event_data.SubjectLogonId", queryType = "phrase", value = "{{winlog.event_data.SubjectLogonId}}", valueType = "string" }
  ],
  [
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "event.code", queryType = "phrase", value = "5137", valueType = "string" },
    { excluded = false, field = "winlog.event_data.SubjectLogonId", queryType = "phrase", value = "{{winlog.event_data.SubjectLogonId}}", valueType = "string" }
  ]
]
relativeFrom = "now-24h"
relativeTo = "now"

[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1557"
name = "Adversary-in-the-Middle"
reference = "https://attack.mitre.org/techniques/T1557/"
[[rule.threat.technique.subtechnique]]
id = "T1557.001"
name = "LLMNR/NBT-NS Poisoning and SMB Relay"
reference = "https://attack.mitre.org/techniques/T1557/001/"

[[rule.threat.technique]]
id = "T1187"
name = "Forced Authentication"
reference = "https://attack.mitre.org/techniques/T1187/"

[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[rule]
description = """
This rule detects the execution of a command or binary through the crash binary. Attackers may use this technique to
execute commands while attempting to evade detection.
"""
id = "995c8bdb-5ebb-4c5b-9a03-4d39b52c0ff3"
license = "Elastic License v2"
name = "Potential Proxy Execution via Crash"
os_list = ["linux"]
reference = ["https://gtfobins.github.io/gtfobins/crash/"]
version = "1.0.3"

query = '''
process where event.type == "start" and event.action == "exec" and process.parent.name == "crash" and
process.parent.args == "-h" and process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and
process.args == "-c"
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.15.0"

[metadata]
creation_date = "2023/09/20"
integration = ["endpoint", "crowdstrike", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2025/12/18"

[rule]
author = ["Elastic"]
description = """
Identifies when a non-interactive terminal (tty) is being upgraded to a fully interactive shell. Attackers may upgrade a
simple reverse shell to a fully interactive tty after obtaining initial access to a host, in order to obtain a more
stable connection.
"""
from = "now-9m"
index = [
    "endgame-*",
    "logs-crowdstrike.fdr*",
    "logs-endpoint.events.process*",
    "logs-sentinel_one_cloud_funnel.*",
]
language = "eql"
license = "Elastic License v2"
name = "Potential Upgrade of Non-interactive Shell"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Potential Upgrade of Non-interactive Shell

In Linux environments, attackers often seek to enhance a basic reverse shell to a fully interactive shell to gain a more robust foothold. This involves using tools like `stty` or `script` to manipulate terminal settings, enabling features like command history and job control. The detection rule identifies such activities by monitoring specific process executions and arguments, flagging potential misuse indicative of an upgrade attempt.

### Possible investigation steps

- Review the process execution details to confirm the presence of `stty` or `script` commands with the specific arguments outlined in the detection rule, such as `stty raw -echo` or `script -qc /dev/null`.
- Examine the parent process of the flagged `stty` or `script` command to determine how the shell was initially spawned and identify any potentially malicious scripts or binaries.
- Check the user account associated with the process execution to assess if it aligns with expected user behavior or if it indicates potential compromise.
- Investigate the network connections associated with the host at the time of the alert to identify any suspicious remote connections that could be indicative of a reverse shell.
- Review historical process execution and login records for the user and host to identify any patterns of suspicious activity or previous attempts to establish a reverse shell.

### False positive analysis

- System administrators or legitimate users may use stty or script commands for routine maintenance or troubleshooting, which can trigger the rule. To manage this, create exceptions for known user accounts or specific maintenance windows.
- Automated scripts or cron jobs that utilize stty or script for legitimate purposes might be flagged. Review these scripts and whitelist them by process hash or command line pattern to prevent false positives.
- Development environments where developers frequently use stty or script for testing purposes can generate alerts. Consider excluding specific development machines or user groups from the rule to reduce noise.
- Monitoring tools or security solutions that simulate shell upgrades for testing or auditing purposes may inadvertently trigger the rule. Identify these tools and add them to an exception list based on their process name or execution path.

### Response and remediation

- Immediately isolate the affected host from the network to prevent further unauthorized access or lateral movement by the attacker.
- Terminate any suspicious processes identified by the detection rule, specifically those involving `stty` or `script` with the flagged arguments, to disrupt the attacker's attempt to upgrade the shell.
- Conduct a thorough review of the affected system's logs and process history to identify any additional malicious activities or compromised accounts.
- Reset credentials for any user accounts that were active during the time of the alert to prevent unauthorized access using potentially compromised credentials.
- Apply security patches and updates to the affected system to address any vulnerabilities that may have been exploited by the attacker.
- Enhance monitoring and logging on the affected host and similar systems to detect any future attempts to upgrade non-interactive shells or other suspicious activities.
- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if additional systems may be affected."""
risk_score = 47
rule_id = "84d1f8db-207f-45ab-a578-921d91c23eb2"
setup = """## Setup

This rule requires data coming in from Elastic Defend.

### Elastic Defend Integration Setup
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.

#### Prerequisite Requirements:
- Fleet is required for Elastic Defend.
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).

#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
- Go to the Kibana home page and click "Add integrations".
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
- Click "Add Elastic Defend".
- Configure the integration name and optionally add a description.
- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
- Click "Save and Continue".
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
"""
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: Linux",
    "Use Case: Threat Detection",
    "Tactic: Execution",
    "Data Source: Elastic Endgame",
    "Data Source: Elastic Defend",
    "Data Source: Crowdstrike",
    "Data Source: SentinelOne",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"
query = '''
process where host.os.type == "linux" and event.type == "start" and
event.action in ("exec", "exec_event", "start", "ProcessRollup2") and
(
  (process.name == "stty" and process.args == "raw" and process.args == "-echo" and process.args_count >= 3) or
  (
    process.name == "script" and process.args in ("-qc", "-c") and process.args == "/dev/null" and process.args_count == 4
  )
) and
not process.parent.command_line like ("linode-longview", "*bootstrap*", "*homebrew*")
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"

[[rule.threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"