Elastic rules: 0d

[metadata]
creation_date = "2026/02/05"
integration = ["aws"]
maturity = "production"
updated_date = "2026/07/08"

[rule]
author = ["Elastic"]
description = """
Detects the creation of a new SAML Identity Provider (IdP) in AWS IAM. SAML providers enable federated authentication
between AWS and external identity providers, allowing users to access AWS resources using credentials from the external
IdP. Adversaries who have gained administrative access may create rogue SAML providers to establish persistent,
federated access to AWS accounts that survives credential rotation. This technique allows attackers to assume roles and
access resources by forging SAML assertions from an IdP they control. Creating a SAML provider is a rare administrative
action that should be closely monitored and validated against authorized infrastructure changes.
"""
false_positives = [
    """
    SAML providers may be created during legitimate identity federation setup, SSO integration projects, or
    infrastructure-as-code deployments. Verify whether the user identity and timing align with approved change
    management processes. If this is expected administrative activity, it can be exempted from the rule.
    """,
]
from = "now-6m"
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
language = "kuery"
license = "Elastic License v2"
name = "AWS IAM SAML Provider Created"
note = """## Triage and analysis

### Investigating AWS IAM SAML Provider Created

SAML (Security Assertion Markup Language) providers in AWS IAM enable federated authentication, allowing users from external identity providers to access AWS resources without separate AWS credentials. Creating a SAML provider establishes a trust relationship between AWS and the external IdP.

This rule detects successful `CreateSAMLProvider` API calls. In most environments, SAML provider creation is extremely rare—typically only occurring during initial SSO setup or major infrastructure changes. An unauthorized SAML provider creation could enable an attacker to maintain persistent access by forging SAML assertions from an IdP they control.

### Possible investigation steps

- **Identify the actor**
  - Review `aws.cloudtrail.user_identity.arn` to determine who created the SAML provider.
  - Verify whether this principal is authorized to manage identity federation.

- **Review the SAML provider details**
  - Examine `aws.cloudtrail.request_parameters` for the SAML provider name and metadata document.
  - Identify the external IdP URL and signing certificate in the metadata.

- **Validate business justification**
  - Confirm with identity management or platform teams whether this aligns with planned SSO integration.
  - Check for related change tickets or infrastructure-as-code deployments.

- **Check for follow-on activity**
  - Search for `CreateRole` or `UpdateAssumeRolePolicy` calls that reference the new SAML provider.
  - Look for `AssumeRoleWithSAML` calls using the newly created provider.

- **Correlate with other suspicious activity**
  - Check for preceding privilege escalation or credential access events.
  - Look for other persistence mechanisms being established concurrently.

### False positive analysis

- **Planned SSO integration**
  - SAML providers are created during initial setup of identity federation with Okta, Azure AD, or other IdPs.
  - Validate against documented SSO integration projects.

- **Infrastructure-as-code deployments**
  - Terraform, CloudFormation, or other IaC tools may create SAML providers as part of automated deployments.
  - Confirm via CI/CD logs.

### Response and remediation

- **Immediate containment**
  - If unauthorized, delete the SAML provider using `DeleteSAMLProvider`.
  - Review and remove any IAM roles that trust the rogue provider.

- **Investigation**
  - Audit CloudTrail for any `AssumeRoleWithSAML` calls using this provider.
  - Review all IAM roles with SAML trust relationships.

- **Hardening**
  - Restrict `iam:CreateSAMLProvider` permissions to a limited set of administrative roles.
  - Implement SCPs to control SAML provider creation in member accounts.
  - Enable AWS Config rules to monitor identity provider configurations.

### Additional information
- **[AWS IAM SAML Providers Documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_saml.html)**
- **[AWS IR Playbooks](https://github.com/aws-samples/aws-incident-response-playbooks/blob/c151b0dc091755fffd4d662a8f29e2f6794da52c/playbooks/)**
- **[AWS Customer Playbook Framework](https://github.com/aws-samples/aws-customer-playbook-framework/tree/a8c7b313636b406a375952ac00b2d68e89a991f2/docs)**
"""
references = [
    "https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateSAMLProvider.html",
    "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_saml.html",
    "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a",
]
risk_score = 73
rule_id = "a80ffc40-a256-475a-a86a-74361930cdb1"
severity = "high"
tags = [
    "Domain: Cloud",
    "Data Source: AWS",
    "Data Source: Amazon Web Services",
    "Data Source: AWS IAM",
    "Use Case: Identity and Access Audit",
    "Tactic: Persistence",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset: "aws.cloudtrail"
    and event.provider: "iam.amazonaws.com"
    and event.action: "CreateSAMLProvider"
    and event.outcome: "success"
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"

[[rule.threat.technique.subtechnique]]
id = "T1078.004"
name = "Cloud Accounts"
reference = "https://attack.mitre.org/techniques/T1078/004/"

[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"

[[rule.threat.technique.subtechnique]]
id = "T1098.001"
name = "Additional Cloud Credentials"
reference = "https://attack.mitre.org/techniques/T1098/001/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1484"
name = "Domain or Tenant Policy Modification"
reference = "https://attack.mitre.org/techniques/T1484/"

[[rule.threat.technique.subtechnique]]
id = "T1484.002"
name = "Trust Modification"
reference = "https://attack.mitre.org/techniques/T1484/002/"

[rule.threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"
[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user_agent.original",
    "source.ip",
    "aws.cloudtrail.user_identity.arn",
    "aws.cloudtrail.user_identity.type",
    "aws.cloudtrail.user_identity.access_key_id",
    "event.action",
    "event.outcome",
    "cloud.account.id",
    "cloud.region",
    "aws.cloudtrail.request_parameters",
    "aws.cloudtrail.response_elements",
]

[metadata]
creation_date = "2026/05/20"
integration = ["azure"]
maturity = "production"
updated_date = "2026/05/20"

[rule]
author = ["Elastic"]
description = """
Detects an unusually high ratio of 4xx HTTP responses from Azure AD Graph (graph.windows.net) per calling identity in a
short window. Post-identity compromise leading to recon often leaves a tail of 403s and 404s as tooling walks endpoints
it does not have permission for, asks for object IDs it does not have, or uses an OAuth client that has been pulled off
the AAD Graph allow-list. Surges or an unexpected ratio of 4xx responses concentrated on a single (user and ASN) pair are characteristic of
automated tooling rather than human or first-party traffic.
"""
false_positives = [
    """
    Legitimate first-party clients occasionally hit 4xx responses as part of conditional access flows, transient
    permission changes, or stale token retries. Tune the threshold for your tenant baseline.
    """,
    """
    Authorized red team activity. Document and add exceptions on the user, app ID, or source IP.
    """,
    """
    Legacy tooling may still be using AAD Graph. Validate and add exceptions on the calling app ID after review.
    """,
]
from = "now-8h"
interval = "1h"
language = "esql"
license = "Elastic License v2"
name = "Azure AD Graph High 4xx Error Ratio from User"
note = """## Triage and analysis

### Investigating Azure AD Graph High 4xx Error Ratio from User

A high 4xx rate on AAD Graph from a single calling identity is consistent with automated permission probing,
recon against endpoints the caller is not authorized for, or a token whose client has been blocked from AAD
Graph. The pattern is structurally distinct from sparse 4xx in first-party traffic.

### Possible investigation steps

- Confirm the surge volume and ratio.
    - Review `Esql.error_rate` (4xx as a fraction of total) and `Esql.total_calls` to assess the magnitude.
- Identify the caller and calling client.
    - `user.id` for the calling identity, `source.ip` for the egress, and `Esql.app_ids` (from `azure.aadgraphactivitylogs.properties.app_id`) for the OAuth client.
- Review which endpoints produced the errors.
    - `Esql.sample_paths` captures the distinct `url.path` values that 4xx'd.
- Correlate with successful calls from the same user / source to understand what reached AAD Graph.
- Pivot to sign-in logs (`logs-azure.signinlogs-*`) for the same user / source for token-mint context.
- Confirm the activity is not attributable to authorized testing (red team engagement, penetration test, internal tooling validation) before treating as malicious.

### Response and remediation

- Revoke refresh tokens and active sessions for the calling user if the surge indicates unauthorized recon.
    - `POST /v1.0/users/{id}/revokeSignInSessions`.
- Temporarily disable the user if the alert is high-confidence or you need to halt activity while investigation continues.
    - `PATCH /v1.0/users/{id}` with body `{"accountEnabled": false}`.
- If the calling application has no legitimate AAD Graph dependency, block further use by that app.
    - `PATCH /beta/applications/{id}` with body `{"authenticationBehaviors": {"blockAzureADGraphAccess": true}}`.
    - This property lives on the Graph beta endpoint, not v1.0.
- Apply Conditional Access targeting the AAD Graph audience for the affected user population.
"""
references = [
    "https://github.com/dirkjanm/ROADtools",
    "https://learn.microsoft.com/en-us/graph/migrate-azure-ad-graph-overview",
    "https://aadinternals.com/",
]
risk_score = 47
rule_id = "8cbc7793-9ce4-4b7d-9c20-a30afbde2a05"
setup = """#### Azure AD Graph Activity Logs
Requires Azure AD Graph Activity Logs ingested into `logs-azure.aadgraphactivitylogs-*` via the Elastic Azure
integration. Enable the `AzureADGraphActivityLogs` diagnostic-settings category on Entra ID.
"""
severity = "medium"
tags = [
    "Domain: Cloud",
    "Data Source: Azure",
    "Data Source: Azure AD Graph",
    "Data Source: Azure AD Graph Activity Logs",
    "Use Case: Threat Detection",
    "Tactic: Discovery",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "esql"

query = '''
from logs-azure.aadgraphactivitylogs-* metadata _id, _version, _index

| where data_stream.dataset == "azure.aadgraphactivitylogs"
| eval Esql.is_4xx = case(
    http.response.status_code >= 400 and
    http.response.status_code < 500, 1, 0
  )
| eval Esql.time_window = date_trunc(2 minutes, @timestamp)
| stats
    Esql.total_calls     = count(*),
    Esql.azure_tenants   = values(azure.tenant_id),
    Esql.errors          = sum(Esql.is_4xx),
    Esql.url_path_count  = count_distinct(url.path),
    Esql.api_versions    = values(azure.aadgraphactivitylogs.properties.api_version),
    Esql.app_ids         = values(azure.aadgraphactivitylogs.properties.app_id),
    Esql.source_ips      = values(source.ip),
    Esql.source_asn_name = values(source.as.organization.name),
    Esql.user_agents     = values(user_agent.original),
    Esql.first_seen      = min(@timestamp),
    Esql.last_seen       = max(@timestamp)
  by
    user.id,
    source.as.number,
    Esql.time_window
| eval Esql.error_rate = round(Esql.errors * 1.0 / Esql.total_calls, 2)
| where 
    Esql.total_calls > 20 and Esql.errors >= 10 and
    Esql.error_rate >= 0.4 and Esql.url_path_count >= 15
| keep
    user.id,
    source.as.number,
    Esql.*
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1087"
name = "Account Discovery"
reference = "https://attack.mitre.org/techniques/T1087/"
[[rule.threat.technique.subtechnique]]
id = "T1087.004"
name = "Cloud Account"
reference = "https://attack.mitre.org/techniques/T1087/004/"


[[rule.threat.technique]]
id = "T1526"
name = "Cloud Service Discovery"
reference = "https://attack.mitre.org/techniques/T1526/"


[rule.threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"

[rule.investigation_fields]
field_names = ["user.id", "user_agent.original"]

[rule]
description = """
Identifies scripting utilities and commonly abused binary proxy programs making a DNS request to a known public IP
address lookup web service. Malwares tend to perform this action to assess potential targets.
"""
id = "51894221-7657-4b56-9406-e080e19ad159"
license = "Elastic License v2"
name = "External IP Address Discovery via a Trusted Program"
os_list = ["windows"]
version = "1.0.39"

query = '''
sequence by process.entity_id with maxspan=5m
  [process where event.action == "start" and user.id like ("S-1-5-21*", "S-1-12-*") and
    (
     process.name : ("wscript.exe", "cscript.exe", "regsvr32.exe", "mshta.exe", "rundll32.exe", "vbc.exe",
                     "powershell.exe", "pwsh.exe", "msbuild.exe", "wmic.exe", "cmstp.exe", "RegAsm.exe",
                     "installutil.exe","RegSvcs.exe", "msxsl.exe", "xwizard.exe", "csc.exe", "curl.exe") or 
                     
     (process.name : "node.exe" and  process.Ext.relative_file_name_modify_time <= 300) or 
     
     process.executable : ("?:\\Program Files\\Java\\jre*\\bin\\javaw.exe",
                           "?:\\Program Files (x86)\\Java\\jre*\\bin\\javaw.exe",
                           "?:\\Program Files\\Java\\jre*\\bin\\java.exe",
                           "?:\\Program Files (x86)\\Java\\jre*\\bin\\java.exe",
                           "?:\\Windows\\Microsoft.NET\\*.exe")
     ) and
     not (process.name : "powershell.exe" and process.working_directory : "\\\\VMHOST\\Users\\*\\Downloads\\" and
          process.parent.executable : "\\Device\\Mup\\VMHOST\\*") and
     not process.command_line :  "\"C:\\Program Files\\PowerShell\\7\\pwsh.exe\"" and
     not (process.name : "curl.exe" and process.command_line : "curl  -s ipinfo.io/*" and 
          process.parent.name == "cmd.exe" and process.parent.command_line == "\"C:\\Windows\\system32\\cmd.exe\" ")
   ]
  [dns where
    dns.question.name :
         (
          "ip-api.com",
          "checkip.dyndns.org",
          "api.ipify.org",
          "api.ipify.com",
          "whatismyip.akamai.com",
          "bot.whatismyipaddress.com",
          "ifcfg.me",
          "ident.me",
          "ipof.in",
          "ip.tyk.nu",
          "icanhazip.com",
          "curlmyip.com",
          "wgetip.com",
          "eth0.me",
          "ipecho.net",
          "ip.appspot.com",
          "api.myip.com",
          "geoiptool.com",
          "api.2ip.ua",
          "api.ip.sb",
          "ipinfo.io",
          "checkip.amazonaws.com",
          "wtfismyip.com",
          "iplogger.*",
          "freegeoip.net",
          "freegeoip.app",
          "ipinfo.io",
          "geoplugin.net",
          "myip.dnsomatic.com",
          "www.geoplugin.net",
          "api64.ipify.org",
          "ip4.seeip.org",
          "*.geojs.io",
          "*portmap.io",
          "api.2ip.ua",
          "api.db-ip.com",
          "geolocation-db.com",
          "httpbin.org",
          "myip.opendns.com"
         )
  ]
'''

min_endpoint_version = "8.4.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1016"
name = "System Network Configuration Discovery"
reference = "https://attack.mitre.org/techniques/T1016/"


[threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"

[internal]
min_endpoint_version = "8.4.0"

[metadata]
creation_date = "2020/09/21"
integration = ["gcp"]
maturity = "production"
updated_date = "2026/04/10"

[rule]
author = ["Elastic"]
description = """
Identifies when a Google Cloud Platform (GCP) storage bucket is deleted. An adversary may delete a storage bucket in
order to disrupt their target's business operations.
"""
false_positives = [
    """
    Storage buckets may be deleted by a system or network administrator. Verify whether the user email, resource name,
    and/or hostname should be making changes in your environment. Bucket deletions by unfamiliar users or hosts should
    be investigated. If known behavior is causing false positives, it can be exempted from the rule.
    """,
]
index = ["filebeat-*", "logs-gcp*"]
language = "kuery"
license = "Elastic License v2"
name = "GCP Storage Bucket Deletion"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating GCP Storage Bucket Deletion

Google Cloud Platform (GCP) storage buckets are essential for storing and managing data in cloud environments. Adversaries may target these buckets to delete critical data, causing operational disruptions. The detection rule monitors audit logs for deletion actions, identifying potential malicious activity by flagging events where storage buckets are removed, thus enabling timely investigation and response.

### Possible investigation steps

- Review the audit logs for the specific event.action "storage.buckets.delete" to identify the user or service account responsible for the deletion.
- Check the timestamp of the deletion event to determine when the bucket was deleted and correlate it with any other suspicious activities around that time.
- Investigate the IP address and location from which the deletion request originated to assess if it aligns with expected access patterns.
- Examine the permissions and roles assigned to the user or service account involved in the deletion to determine if they had legitimate access.
- Look for any recent changes in IAM policies or permissions that might have allowed unauthorized access to the storage bucket.
- Contact the relevant stakeholders or data owners to confirm if the deletion was authorized or if it was unexpected.

### False positive analysis

- Routine maintenance or scheduled deletions by authorized personnel can trigger false positives. To manage this, create exceptions for known maintenance windows or specific user accounts responsible for these tasks.
- Automated scripts or applications that manage storage lifecycle policies might delete buckets as part of their normal operation. Identify these scripts and exclude their actions from triggering alerts by using service account identifiers.
- Development or testing environments often involve frequent creation and deletion of storage buckets. Exclude these environments from monitoring by filtering based on project IDs or environment tags.
- Organizational policy changes that involve restructuring storage resources can lead to legitimate bucket deletions. Coordinate with relevant teams to update detection rules temporarily during such changes.

### Response and remediation

- Immediately isolate the affected GCP project to prevent further unauthorized access or actions. This can be done by revoking access keys and permissions for any suspicious accounts identified in the audit logs.
- Restore the deleted storage bucket from the most recent backup to minimize data loss and operational disruption. Ensure that the backup is clean and free from any malicious alterations.
- Conduct a thorough review of IAM roles and permissions associated with the affected storage bucket to ensure that only authorized users have the necessary access. Implement the principle of least privilege.
- Enable versioning on critical storage buckets to protect against accidental or malicious deletions in the future, allowing for easier recovery of deleted objects.
- Set up alerts for any future deletion actions on storage buckets to ensure immediate awareness and response to similar threats.
- Escalate the incident to the security operations team for further investigation and to determine if additional systems or data were compromised.
- Document the incident, including actions taken and lessons learned, to improve response strategies and update incident response plans for future reference.

## Setup

The GCP Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
references = ["https://cloud.google.com/storage/docs/key-terms#buckets"]
risk_score = 47
rule_id = "bc0f2d83-32b8-4ae2-b0e6-6a45772e9331"
severity = "medium"
tags = ["Domain: Cloud", "Data Source: GCP", "Data Source: Google Cloud Platform", "Tactic: Impact", "Resources: Investigation Guide"]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset:gcp.audit and event.action:"storage.buckets.delete"
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1485"
name = "Data Destruction"
reference = "https://attack.mitre.org/techniques/T1485/"


[rule.threat.tactic]
id = "TA0040"
name = "Impact"
reference = "https://attack.mitre.org/tactics/TA0040/"

[metadata]
creation_date = "2026/06/30"
integration = ["gcp"]
maturity = "production"
updated_date = "2026/06/30"

[rule]
author = ["Elastic"]
description = """
Detects GKE service account or node identities invoking self-subject access or rules review APIs. Non-human identities
rarely enumerate their own permissions outside known controllers; this can indicate stolen tokens probing effective RBAC.
"""
false_positives = [
    """
    Some controllers and admin impersonation workflows legitimately submit self-subject reviews. Excluded identities
    include common Argo and Datadog service accounts.
    """,
]
index = ["logs-gcp.audit-*"]
language = "kuery"
license = "Elastic License v2"
name = "GKE Suspicious Self-Subject Review via Service Account"
note = """## Triage and analysis

### Investigating GKE Suspicious Self-Subject Review via Service Account

Review the calling service account or node identity and subsequent API activity.

### Investigation steps

- Confirm `user.email` and `event.action` (selfsubjectaccessreviews or selfsubjectrulesreviews).
- Correlate with denied requests, secret access, or RBAC changes from the same identity.

### False positives

- Known observability or workflow controllers; extend exclusions if needed.

## Setup

The GCP Fleet integration with GKE audit logs enabled is required to be compatible with this rule."""
references = [
    "https://kubernetes.io/docs/reference/access-authn-authz/authorization/#checking-api-access",
]
risk_score = 21
rule_id = "2302fb59-5201-46ec-b433-6044adb37b0b"
severity = "low"
tags = [
    "Domain: Cloud",
    "Domain: Kubernetes",
    "Data Source: GCP",
    "Data Source: Google Cloud Platform",
    "Use Case: Threat Detection",
    "Tactic: Discovery",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset:gcp.audit and service.name:k8s.io and event.action:(io.k8s.authorization.v1.selfsubjectaccessreviews.create or io.k8s.authorization.v1.selfsubjectrulesreviews.create) and user.email:((system\:node\:* or system\:serviceaccount\:*) and not ("system:serviceaccount:default:argo-argo-workflows-server" or "system:serviceaccount:default:argo-argo-workflows-workflow-controller" or system\:serviceaccount\:*\:datadog-kube-state-metrics))
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1069"
name = "Permission Groups Discovery"
reference = "https://attack.mitre.org/techniques/T1069/"

[[rule.threat.technique.subtechnique]]
id = "T1069.003"
name = "Cloud Groups"
reference = "https://attack.mitre.org/techniques/T1069/003/"

[[rule.threat.technique]]
id = "T1613"
name = "Container and Resource Discovery"
reference = "https://attack.mitre.org/techniques/T1613/"

[rule.threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"

[rule]
description = """
Adversaries may collect the keychain storage data from a system to acquire credentials. Keychains are the built-in way
for macOS to keep track of users' passwords and credentials for many services and features such as WiFi passwords,
websites, secure notes and certificates.
"""
id = "150f20b4-6b21-460b-8ae4-339695c1c86c"
license = "Elastic License v2"
name = "Keychain Credential Files Collected via Archive Utility"
os_list = ["macos"]
reference = [
    "https://objective-see.com/blog/blog_0x25.html",
    "https://securelist.com/calisto-trojan-for-macos/86543/",
]
version = "1.0.31"

query = '''
process where event.action == "exec" and process.name in ("zip", "tar") and
  process.command_line like~
    (
      "*/Users/*/Library/Keychains/*",
      "*/Library/Keychains/*",
      "*/Network/Library/Keychains/*",
      "*System.keychain*",
      "*login.keychain-db*",
      "*login.keychain*"
    ) and
    not process.args like~
               ("find-certificate",
                "add-trusted-cert",
                "set-keychain-settings",
                "delete-certificate",
                "/Users/*/Library/Keychains/openvpn.keychain-db",
                "show-keychain-info",
                "lock-keychain",
                "set-key-partition-list",
                "import",
                "find-identity") and
    not process.parent.executable like
      (
        "/Applications/OpenVPN Connect/OpenVPN Connect.app/Contents/MacOS/OpenVPN Connect",
        "/Applications/Microsoft Defender.app/Contents/MacOS/wdavdaemon_enterprise.app/Contents/MacOS/wdavdaemon_enterprise",
        "/opt/jc/bin/jumpcloud-agent"
      ) and
    not process.executable == "/opt/jc/bin/jumpcloud-agent"
'''

min_endpoint_version = "8.10.2"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1555"
name = "Credentials from Password Stores"
reference = "https://attack.mitre.org/techniques/T1555/"
[[threat.technique.subtechnique]]
id = "T1555.001"
name = "Keychain"
reference = "https://attack.mitre.org/techniques/T1555/001/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "8.10.2"

[rule]
description = """
This rule detects when the open command is used to launch the Launchpad application and the parent process is a
scripting language or the parent process is not signed or does not have a code signature. Threat actors have been seen
using the open command to launch the Launchpad application from a scripting language or from an unsigned or untrusted
process to evade detection when attempting to implement a malicious launchpad application.
"""
id = "b64bf1de-5e36-4051-89d6-8b4492bcfdbd"
license = "Elastic License v2"
name = "Launchpad Hijack"
os_list = ["macos"]
reference = ["https://x.com/MsftSecIntel/status/1891410993265123662"]
version = "1.0.3"

query = '''
process where event.type == "start" and event.action == "exec" and process.name == "open" and 
 process.args == "com.apple.launchpad.launcher" and (process.parent.name in ("osascript", "applet", "bash", "sh", "zsh") or 
 (process.parent.code_signature.trusted == false or process.parent.code_signature.exists == false))
'''

min_endpoint_version = "8.11.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1574"
name = "Hijack Execution Flow"
reference = "https://attack.mitre.org/techniques/T1574/"


[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1574"
name = "Hijack Execution Flow"
reference = "https://attack.mitre.org/techniques/T1574/"


[threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1574"
name = "Hijack Execution Flow"
reference = "https://attack.mitre.org/techniques/T1574/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.11.0"

[rule]
description = """
Detects the creation of a reverse shell through netcat. Attackers may spawn reverse shells to establish persistence onto
a target system.
"""
id = "c0ca8114-254d-46ba-88c6-db57de6efe2d"
license = "Elastic License v2"
name = "Linux Reverse Shell via netcat"
os_list = ["linux"]
reference = ["https://www.elastic.co/security-labs/primer-on-persistence-mechanisms"]
version = "1.0.8"

query = '''
sequence by process.entity_id with maxspan=5s
  [process where event.type == "start" and event.action == "exec" and 
   process.name in ("nc", "ncat", "netcat", "netcat.openbsd", "netcat.traditional", "nc.openbsd", "nc.traditional") and process.args_count >= 3 and 
   process.parent.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and process.args == "-e" and
   not process.args like~ ("-*z*", "-*l*")]
  [network where event.type == "start" and event.action in ("connection_attempted", "connection_accepted") and 
   process.name in ("nc", "ncat", "netcat", "netcat.openbsd", "netcat.traditional", "nc.openbsd", "nc.traditional") and 
   not (destination.ip == null or destination.ip == "0.0.0.0" or cidrmatch(
     destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.0.0/29",
     "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
     "192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10",
     "192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1", "FE80::/10",
     "FF00::/8"
     )
    )]
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "7.15.0"

[metadata]
creation_date = "2024/09/04"
integration = ["o365"]
maturity = "production"
updated_date = "2026/05/06"

[rule]
author = ["Elastic"]
description = """
Detects successful Microsoft 365 portal logins from impossible travel locations. Impossible travel locations are defined
as two different countries within a short time frame. This behavior may indicate an adversary attempting to access a
Microsoft 365 account from a compromised account or a malicious actor attempting to access a Microsoft 365 account from
a different location.
"""
false_positives = [
    """
    False positives may occur when users are using a VPN or when users are traveling to different locations for
    legitimate purposes.
    """,
]
from = "now-15m"
index = ["logs-o365.audit-*"]
language = "kuery"
license = "Elastic License v2"
name = "M365 Identity Login from Impossible Travel Location"
note = """## Triage and analysis

### Investigating M365 Identity Login from Impossible Travel Location

Microsoft 365's cloud-based services enable global access, but this can be exploited by adversaries logging in from disparate locations within short intervals, indicating potential account compromise. The detection rule identifies such anomalies by analyzing login events for rapid geographic shifts, flagging suspicious activity that may suggest unauthorized access attempts.

### Possible investigation steps

- Review the user associated with these sign-ins to determine if the login attempt was legitimate or if further investigation is needed.
- Analyze the geographic locations of the logins to identify any patterns or anomalies that may indicate malicious activity.
- Review the ISP information for the login attempts to identify any unusual or suspicious providers.
- Review the authorization request type to understand the context of the login attempts and whether they align with the user's typical behavior.
- Analyze the client application used for the login attempts to determine if it is consistent with the user's normal usage patterns (Teams, Office, etc.)
- Analyze the user-agent associated with the login attempts to identify any unusual or suspicious patterns. These could also indicate mobile and endpoint logins causing false-positives.

### False positive analysis

- Users traveling or using VPNs may trigger this alert. Verify with the user if they were traveling or using a VPN at the time of the login attempt.
- Mobile access may also result in false positives, as users may log in from various locations while on the go.

### Response and remediation

- Investigate the login attempt further by checking for any additional context or related events that may provide insight into the user's behavior.
- If the login attempt is deemed suspicious, consider implementing additional security measures, such as requiring multi-factor authentication (MFA) for logins from unusual locations.
- Educate users about the risks of accessing corporate resources from unfamiliar locations and the importance of using secure connections (e.g., VPNs) when doing so.
- Monitor for any subsequent login attempts from the same location or IP address to identify potential patterns of malicious activity.
- Consider adding exceptions to this rule for the user or source application ID if the login attempts are determined to be legitimate and not a security concern.
"""
references = ["https://www.huntress.com/blog/time-travelers-busted-how-to-detect-impossible-travel-"]
risk_score = 47
rule_id = "3896d4c0-6ad1-11ef-8c7b-f661ea17fbcc"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Domain: Identity",
    "Data Source: Microsoft 365",
    "Data Source: Microsoft 365 Audit Logs",
    "Use Case: Threat Detection",
    "Use Case: Identity and Access Audit",
    "Tactic: Initial Access",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "threshold"

query = '''
data_stream.dataset:o365.audit and
    event.provider:AzureActiveDirectory and
    event.action:UserLoggedIn and
    event.outcome:success and
    o365.audit.Target.Type:(0 or 10 or 2 or 3 or 5 or 6) and
    o365.audit.UserId:(* and not "Not Available") and
    source.geo.country_name:* and
    not o365.audit.ApplicationId:(
        29d9ed98-a469-4536-ade2-f981bc1d605e or
        38aa3b87-a06d-4817-b275-7a316988d93b or
        a809996b-059e-42e2-9866-db24b99a9782 or
        08e18876-6177-487e-b8b5-cf950c1e598c or
        3e62f81e-590b-425b-9531-cad6683656cf or
        d7b530a4-7680-4c23-a8bf-c52c121d2e87
    ) and not o365.audit.ExtendedProperties.RequestType:(
        "Cmsi:Cmsi" or
        "Consent:Set" or
        "Login:reprocess" or
        "Login:resume" or
        "MessagePrompt:MessagePrompt" or
        "SAS:EndAuth"
    )
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"

[[rule.threat.technique.subtechnique]]
id = "T1078.004"
name = "Cloud Accounts"
reference = "https://attack.mitre.org/techniques/T1078/004/"

[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "organization.id",
    "o365.audit.UserId",
    "o365.audit.ActorIpAddress",
    "o365.audit.ApplicationId",
    "o365.audit.ExtendedProperties.RequestType",
    "o365.audit.Target.ID",
    "source.geo.country_name",
]

[rule.threshold]
field = ["o365.audit.UserId"]
value = 1
[[rule.threshold.cardinality]]
field = "source.geo.country_name"
value = 2

[metadata]
creation_date = "2022/09/22"
maturity = "production"
updated_date = "2025/01/15"

[rule]
author = ["Elastic"]
description = """
This rule helps you test and practice using alerts with Elastic Security as you get set up. It’s not a sign of threat
activity.
"""
enabled = false
false_positives = [
    "This rule is not looking for threat activity. Disable the rule if you're already familiar with alerts.",
]
from = "now-35m"
index = ["auditbeat-*", "filebeat-*", "logs-*", "winlogbeat-*"]
interval = "30m"
language = "kuery"
license = "Elastic License v2"
max_signals = 1
name = "My First Rule"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating My First Rule
Elastic Security leverages event data to monitor and alert on potential security incidents. The "My First Rule" is a foundational rule designed for onboarding, focusing on event data without indicating a specific threat. Adversaries might exploit event logging to obscure their tracks or trigger false alerts. This rule helps analysts familiarize themselves with event-based alerts, ensuring they can identify and respond to genuine threats effectively.

### Possible investigation steps

- Review the event data associated with the alert to understand the context and source of the event.kind:event.
- Check the timestamp of the event to determine when the activity occurred and correlate it with other events around the same time.
- Identify the host or user associated with the event to assess if there is any unusual or unauthorized activity.
- Examine related logs or events from the same source to identify any patterns or anomalies that could indicate suspicious behavior.
- Consult with team members or use internal resources to determine if the event is part of normal operations or if it requires further investigation.

### False positive analysis

- Routine system events can trigger alerts, as the rule monitors all event data without filtering for specific threats.
- Identify and document common non-threatening events that frequently trigger alerts, such as regular system updates or scheduled tasks.
- Use exceptions to exclude these documented non-threatening events from triggering alerts, reducing noise and focusing on genuine threats.
- Regularly review and update the list of exceptions to ensure it remains relevant and does not inadvertently exclude new potential threats.
- Collaborate with IT and operations teams to understand normal event patterns and adjust the rule's exceptions accordingly.

### Response and remediation

- Verify the legitimacy of the event by cross-referencing with known benign activities or scheduled tasks to rule out false positives.
- Contain any potential threat by isolating affected systems or accounts if suspicious activity is confirmed, preventing further unauthorized access or damage.
- Remediate by reviewing and adjusting logging configurations to ensure accurate event capture and reduce the risk of adversaries exploiting logging mechanisms.
- Escalate the incident to the appropriate security team or management if the event correlates with other suspicious activities or if it indicates a potential breach.
- Enhance detection capabilities by updating alerting rules to include additional context or indicators observed during the investigation, ensuring better identification of similar threats in the future.

This is a test alert.

This alert does not show threat activity. Elastic created this alert to help you understand how alerts work.

For normal rules, the Investigation Guide will help analysts investigate alerts.

This alert will show once every 24 hours for each host. It is safe to disable this rule.
"""
references = ["https://www.elastic.co/guide/en/security/current/prebuilt-rules.html"]
risk_score = 21
rule_id = "a198fbbd-9413-45ec-a269-47ae4ccf59ce"
severity = "low"
tags = ["Use Case: Guided Onboarding", "Resources: Investigation Guide"]
timestamp_override = "event.ingested"
type = "threshold"

query = '''
event.kind:event
'''



[rule.threshold]
field = ["host.name"]
value = 1

[rule]
description = """
This rule detects process masquerading through the use of the `exec` command. The `exec` command can be used in
conjunction with the `-a` flag to change the name of the process in the process table. This technique is used by malware
to hide the true identity of a process from security tools and analysts.
"""
id = "e6669bc3-cb75-4fb3-91e0-ddaa06dd59b2"
license = "Elastic License v2"
name = "Potential Process Masquerading via Exec"
os_list = ["linux"]
version = "1.0.21"

query = '''
process where event.type == "start" and event.action == "exec" and process.parent.executable != null and
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and
process.args == "-c" and process.command_line : "* exec -a *" and not (
  process.executable like ("/nix/store/*", "/tmp/newroot/*") or
  process.parent.executable in (
    "/opt/warpdotdev/warp-terminal/warp", "/opt/sp/serverpilot/stats/bin/sp-stats", "/bin/bcompare", "/bin/su",
    "/usr/NX/bin/nxnode.bin", "/usr/bin/gnome-shell", "/var/lib/dpkg/info/udev.postinst", "/usr/bin/bcompare", 
    "/usr/bin/su", "/usr/bin/claude-bin"
  ) or
  process.parent.executable like (
    "/home/*/.local/share/claude/*", "/home/*/.local/bin/klaude", "/usr/local/*/claude-bin",
    "/home/*/.claude/remote/ccd-cli/*", "/home/*/.claude/remote/ccd-cli", "/claude-cli/versions/*",
    "/usr/scratch/*/git/*/atl/src/aitools/claude/claude-bin", "/opt/forticlient/epctrl",
    "/root/.claude/remote/ccd-cli/*", "/root/.local/share/claude/versions/*", "/mnt/fast/*/.local/share/claude/versions/*",
    "/opt/warpdotdev/warp-terminal/warp (deleted)", "/opt/local/share/claude/versions/*",
    "/usr/share/cursor/cursor", "/home/*/.grok/downloads/grok*linux-x86_64", "/home/*/.codex/*/bin/codex"
  ) or
  process.parent.args == "claude" or
  process.parent.name == "claude" or
  process.command_line like (
    "*/tmp/fzf-args*", "/opt/sp/serverpilot/*", "*/opt/forticlientems/*", "*WarpTerminal*", "/bin/bash -c exec -a bash*",
    "/bin/bash -c exec -a sp-agent /opt/sp/serverpilot/agent/bin/sp-agent", """bash -c exec -a "$0" "$@" reboot /usr/sbin/reboot.no-molly-guard""",
    "bash -c exec -a auto_upgrade_fcems /opt/forticlientemstmp/upgradeworker_linux_amd64 -config ./goEMS.conf",
    "bash -c exec -a cubin_gpu_pool_worker sleep *", "bash -c exec -a chroma sleep 7200",
    "bash -c exec -a 'oes-mfa-agent' /usr/bin/node* --enable-source-maps /opt/novell/oes-mfa-agent/app/mfa-agent/main",
    "bash -c exec -a auto_upgrade_fcems /opt/forticlientemstmp/emsworkers_linux_amd64 -worker_name=upgrade -config ./goEMS.conf",
    "/bin/bash -c exec -a /usr/bin/heidisql /usr/share/heidisql/heidisql  > /dev/null 2>&1 /usr/bin/heidisql",
    "/usr/bin/bash -c exec -a ems:uninstall /opt/forticlient/epctrl uninstall",
    "bash -c exec -a \"apt-get update\" /var/cache/apt/cdroms.list",
    "/bin/bash -c exec -a nvsm_apis_mosquitto /usr/sbin/mosquitto -c /etc/nvsm/nvsm-mqtt.config",
    "*SNAPSHOT_FILE=/home/*/.claude/shell-snapshots/snapshot*"
  ) or
  process.working_directory in ("/opt/novell/umc/apps/umc-server", "/opt/novell/umc/apps/oes-rest", "/usr/share/epoptes-client") or 
  process.args in (
    "exec -a sp-monitor /opt/sp/serverpilot/monitor/bin/monitor",
    "exec -a sp-stats /opt/sp/serverpilot/stats/bin/sp-stats",
    "/usr/bin/bcompare", "/usr/lib64/beyondcompare/BCompare"
  ) or
  process.parent.command_line == "runc init" or
  process.command_line == """bash -c exec -a "$0" "$@" shutdown /usr/sbin/shutdown.no-molly-guard -r now""" or
  (process.command_line == "bash -c exec -a '[sleep router failover]' sleep 1" and process.parent.command_line == "/bin/bash /init.sh") or
  process.parent.command_line like "*/.claude/shell-snapshots/snapshot-*"
)
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1564"
name = "Hide Artifacts"
reference = "https://attack.mitre.org/techniques/T1564/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.15.0"

[rule]
description = """
This rule detects the execution of a shell process with suspicious arguments which may be indicative of reverse shell
activity. Attackers may use the "/dev/tcp" or "/dev/udp" file descriptors to establish a reverse shell connection.
"""
id = "73c3fc93-ff0b-4ef1-a1b3-2b016b92b7ae"
license = "Elastic License v2"
name = "Potential Reverse Shell Activity via TCP/UDP Socket"
os_list = ["linux"]
reference = [
    "https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md",
    "https://github.com/WangYihang/Reverse-Shell-Manager",
    "https://www.netsparker.com/blog/web-security/understanding-reverse-shells/",
]
version = "1.0.9"

query = '''
process where event.type == "start" and event.action == "exec" and process.parent.executable != null and (
  process.name in (
    "bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "zmodload", "setsid", "nohup", "busybox",
    "timeout", "chroot", "logger", "printf"
  ) or
  process.name like ".*" or
  process.executable like (
    "/tmp/*", "/var/tmp/*", "/dev/shm/*", "/run/*", "/var/run/*", "/boot/*", "/home/*", "/root/*",
    "/opt/*", "/var/www/*", "/app/*", "/srv/*"
  )
) and
process.command_line like ("*/dev/tcp/*", "*/dev/udp/*", "*zsh/net/tcp*", "*zsh/net/udp*") and
process.command_line like ("*&>*", "*<>*", "*>&*", "*<&*") and
not (
  process.command_line like ("*/dev/tcp/127.0.0.1/*", "*/dev/tcp/localhost/*", "*/home/*/.claude/shell-snapshots/snapshot*", "*teleport-installer*") or
  process.parent.command_line like ("/usr/bin/runc init", "*/home/*/.claude/shell-snapshots/snapshot*", "runc init") or
  process.parent.args in ("/usr/bin/testssl.sh", "/usr/local/bin/testssl.sh", "/usr/bin/crun") or
  process.working_directory like ("/home/*/workspace/graphwise.ai/*") or
  (
    process.parent.executable in ("/usr/bin/timeout", "/bin/timeout") and
    process.command_line like ("bash -c exec *<>/dev/tcp/*", "sh -c exec *<>/dev/tcp/*", "bash -lc exec *<>/dev/tcp/*")
  ) or
  (
    process.executable in ("/usr/bin/timeout", "/bin/timeout") and
    process.command_line like "timeout * exec *<>/dev/tcp/*"
  ) or
  process.parent.executable like (
    "/usr/share/windsurf/resources/app/extensions/windsurf/bin/language_server_linux_x64", "/home/*/.cursor-server/bin/*/node", "/root/.cursor-server/cli/servers/*/server/node",
    "/usr/local/lib/node_modules/@openai/codex/node_modules/@openai/codex-linux-x64/vendor/x86_64-unknown-linux-musl/codex/codex", "/opt/teleport/system/bin/teleport",
    "/home/*/.local/bin/claude", "/usr/bin/claude-bin", "/home/*/.config/Claude/claude-code-vm/*/claude", "/usr/share/cursor/cursor", "/usr/local/bin/teleport",
    "/home/*/.local/share/claude/versions/*", "/home/*/.local/bin/kiro-cli-chat", "./runc", "/home/linuxbrew/.linuxbrew/Caskroom/codex/*/codex-x86_64-unknown-linux-musl",
    "/home/*/.opencode/bin/opencode", "/home/*/.aimee-code/bin/*", "/usr/bin/make", "/home/*/.local/share/cursor-agent/*", "/home/*/.grok/downloads/*",
    "*/site-packages/claude_agent_sdk/_bundled/claude", "/home/*/.codex/packages/standalone/*/bin/codex", "/scratch/*/.cursor-server/*/node", "*/.local/share/claude/versions/*",
    "*/hermes-agent/.hermes-runtime/python/*/bin/python*", "*/.hermes/hermes-agent/venv/bin/*", "*/extensions/openai.chatgpt-*/bin/*/codex", "/home/linuxbrew/.linuxbrew/Caskroom/codex/*",
    "*/.opencode/bin/opencode*"
  )
)
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "7.15.0"

[metadata]
creation_date = "2026/03/18"
integration = ["endpoint"]
maturity = "production"
updated_date = "2026/04/02"

[rule]
author = ["Elastic"]
description = """
This rule detects non-root file creation within "/tmp/.snap" or its host backing path
"/tmp/snap-private-tmp/*/tmp/.snap", which may indicate exploitation attempts related to CVE-2026-3888.
In vulnerable Ubuntu systems, the snap-confine utility normally creates the "/tmp/.snap" directory as
root when initializing a snap sandbox. The vulnerability arises when systemd-tmpfiles deletes this
directory after it becomes stale, allowing an unprivileged user to recreate it and populate
attacker-controlled files. During subsequent snap sandbox initialization, snap-confine may bind-mount
or trust these attacker-controlled paths, enabling manipulation of libraries or configuration files
that can lead to local privilege escalation to root. Because legitimate creation of ".snap" directories
should only be performed by root, non-root file activity in these locations is highly suspicious. This
detection helps identify early stages of the exploit before privilege escalation is completed.
"""
from = "now-9m"
index = ["logs-endpoint.events.file*"]
language = "eql"
license = "Elastic License v2"
name = "Potential snap-confine Privilege Escalation via CVE-2026-3888"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Potential snap-confine Privilege Escalation via CVE-2026-3888

This rule flags non-root creation of files under temporary snap sandbox directories that snap-confine should prepare as root, which can expose an attempt to abuse CVE-2026-3888 for local root access. A common pattern is an unprivileged user waiting for stale `/tmp/.snap` content to be removed, recreating that path, and dropping crafted libraries or configuration so the next snap launch pulls attacker-controlled files into the sandbox setup and elevates privileges.

### Possible investigation steps

- Review the originating user's recent terminal, SSH, sudo, and scheduled-task activity to determine whether the file creation was part of legitimate administration or an unexpected local execution chain.
- Inspect the affected `.snap` directory contents for crafted symlinks, shared libraries, configuration files, or path redirection artifacts that could be consumed during snap sandbox initialization.
- Correlate the activity with nearby launches of `snap`, `snap-confine`, `snapd`, or installed snap applications and determine whether any such execution was followed by a new root-level process tree.
- Look for evidence that `systemd-tmpfiles` or another cleanup mechanism removed the stale directory shortly before it was recreated by the unprivileged account, as this timing strongly supports CVE-2026-3888 exploitation behavior.
- Examine post-alert host activity for signs of successful escalation such as unexpected root-owned file changes, new setuid binaries, persistence creation, credential access, or security control tampering.

### False positive analysis

- A user troubleshooting a failing snap application may manually create or modify files under `/tmp/.snap` or `/tmp/snap-private-tmp/*/tmp/.snap`; verify by reviewing the parent shell/process lineage and nearby `snap` or `snap-confine` executions to confirm it was interactive testing with no follow-on root activity.
- Telemetry can occasionally attribute file creation to the invoking non-root user during normal snap sandbox initialization even though the privileged helper completes the action; verify by checking whether related `snap` or `snap-confine` events occurred at the same time and whether the final directory and files are owned by root.

### Response and remediation

- Isolate the affected Linux host from the network, stop any active `snap`, `snap-confine`, or suspicious root shell processes tied to the originating user, and preserve the contents of `/tmp/.snap` or `/tmp/snap-private-tmp/*/tmp/.snap` for evidence.
- Remove attacker-controlled files, symlinks, shared libraries, and configuration placed in the recreated `.snap` paths, then delete any persistence added after the event such as unauthorized `systemd` units, `/etc/cron*` entries, `~/.ssh/authorized_keys` changes, sudoers modifications, new local accounts, or unexpected setuid-root binaries.
- Escalate immediately to incident response and treat the host as fully compromised if you confirm a root-owned process tree descending from the unprivileged user, root-level file changes outside the temporary snap path, or tampering with `/etc/ld.so.preload`, PAM modules, or endpoint security agents.
- Restore the host to a known-good state by rebuilding or reimaging it when privilege escalation cannot be conclusively ruled out, or otherwise replace modified system files from trusted packages, rotate credentials exposed on the system, and verify correct root ownership and permissions on snap temporary directories before reconnecting it.
- Harden the environment by applying the vendor fix for CVE-2026-3888, updating `snapd` and related Ubuntu packages, restricting unnecessary local shell access, and increasing monitoring for non-root creation of files under `/tmp/.snap` and `/tmp/snap-private-tmp/*/tmp/.snap`.
"""
references = [
    "https://blog.qualys.com/vulnerabilities-threat-research/2026/03/17/cve-2026-3888-important-snap-flaw-enables-local-privilege-escalation-to-root",
    "https://cdn2.qualys.com/advisory/2026/03/17/snap-confine-systemd-tmpfiles.txt"
]
risk_score = 73
rule_id = "44cb1d8a-1922-4fc0-a00f-36c1caf57393"
setup = """## Setup

This rule requires data coming in from Elastic Defend.

### Elastic Defend Integration Setup
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.

#### Prerequisite Requirements:
- Fleet is required for Elastic Defend.
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).

#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
- Go to the Kibana home page and click "Add integrations".
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
- Click "Add Elastic Defend".
- Configure the integration name and optionally add a description.
- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
- Click "Save and Continue".
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
"""
severity = "high"
tags = [
    "Domain: Endpoint",
    "OS: Linux",
    "Use Case: Threat Detection",
    "Use Case: Vulnerability",
    "Tactic: Privilege Escalation",
    "Data Source: Elastic Defend",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"
query = '''
file where host.os.type == "linux" and event.action == "creation" and
file.path like ("/tmp/.snap*", "/tmp/snap-private-tmp/*/tmp/.snap*") and
user.id != "0"
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1068"
name = "Exploitation for Privilege Escalation"
reference = "https://attack.mitre.org/techniques/T1068/"

[[rule.threat.technique]]
id = "T1574"
name = "Hijack Execution Flow"
reference = "https://attack.mitre.org/techniques/T1574/"

[rule.threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[rule]
description = "Identifies attempt to allocate or execute Shellcode from a module with low or unknown reputation."
id = "9fda6a38-3822-45b6-b621-02f750e8cf0d"
license = "Elastic License v2"
name = "Shellcode Execution from Low Reputation Module"
os_list = ["windows"]
reference = [
    "https://www.elastic.co/security-labs/pikabot-i-choose-you",
    "https://www.elastic.co/security-labs/spring-cleaning-with-latrodectus",
]
version = "1.0.21"

query = '''
sequence by process.entity_id with maxspan=1m
[library where
  not dll.code_signature.status == "trusted" and
  not dll.code_signature.status == "errorCode_endpoint: Failure in an external software component" and
  (dll.Ext.relative_file_creation_time <= 3600 or dll.Ext.relative_file_name_modify_time <= 3600) and 
  not dll.path : ("?:\\windows\\assembly\\nativeimages_*", "c:\\windows\\ccmcache\\*") and
  not (dll.path : "?:\\Windows\\Installer\\*.tmp" and process.name : "msiexec.exe") and
  not dll.hash.sha256 in
              ("29ae6f149e581f8dbdc01eed2d5d20b82b597c4b4c7e102cab6d012b168df4d8",
               "e2705efc246b6cd16ec560122d595394bb01de90db963d409c33f5330a871a93",
               "c4fe4ea78a4134349dfa71f4059b6233a8d1bb4b7592b66da89619726131bd2d",
               "2d81ba21fe9a567dd0fc283afaee95320579c2db163499593bfdc9032b29b925",
               "6ee97fdac52b4a673e9289124be4ce86a6d33e460aa71577848880f6f2ea8b99",
               "3b9aef3265246eac39e4bbacba2b057d5fcd1705c32679254e9ab94d267cb0ac",
               "43af7fe8fc892c3c013f2b980b5295d2e13b0c2e1d1123841ede8a62b94f08a4",
               "5acb0c408b3309a313623d05868ca7359dc17cf113461ffa0522f5df10963644",
               "9c973a0aca4147970c3e714a8750fbceda27f6d96fdfb04c8f5f24f66abde6aa",
               "c16f23e42ecdfe6561d2d9c9ce746630252f1ad15fa670d60ef268c1a7819c10",
               "10f5e4152ad9072116c6925defb54ccd56993b33bfad0c80b43cc3ea6daca812",
               "e5c81555bcc87dc59574f546f19af7d9a0ca564b254178148112d79201d2bf9c",
               "0d5d73d3bea132f98be91f918d13043791decb419a81d9e755979315a7cf0502",
               "beea6a901336753d2a9b8802a8cfa88da2619bebf9fafbef6bbab07b0d4eddcb",
               "dfde40ca8128e6cc3b046ede410be4734bc1ba552ce546e62bac40ad7d69dec0",
               "ba877ea99e9ebd794266529dc0228d279219516349fbbefc0bdd5dfd514eb52f",
               "beea6a901336753d2a9b8802a8cfa88da2619bebf9fafbef6bbab07b0d4eddcb",
               "3f2fb2aa90ca14fe598bd2ec32e2fc6818f5784fa0cd69160939b7394a4f8bdd",
               "15efeb9a8ab4d7553ce58e825c7a7ac5852a5a217722d92bdec17a890c2e006d",
               "efd601882adb9cba4adbce6770be1ff62302f3f10321657c527a9c647faccd15",
               "c233341d1b6bee8a61c8748e956d8f9ec6c4c1bb93de0322639da46c8d9bbf92",
               "de7585c96725bbe66e11c3c80aebb66cd61b901d6acf983b63c29e64e0cfbc9c",
               "4c28bcbbbd54e0c7e43cb1cb9980918668ca6cab379ad114e9d1d4640b5ef154",
               "19f75446ac56ee7bf3efe1cc25383fcab91a557f9b6257b39e496ec4a6ff8b2e",
               "e2b761094a6f6300da32e861e8f42c359b22a0cf1d62ff3a2721882aa4d1c2c6",
               "f0997f96bc59a9ff7d7fb8905b79996a179bfaad39a6113c9edf00135a96c561",
               "ef14a3b57cd57f97fea9fcbf81b3350d0f11785ecc27e37085110f380ddcb17d",
               "db3477572af5b5f353e723db1e7e8de9b743a120a145c3c26851e969ac34044d",
               "5655e005145c8a0bd1648bae17d456f14321d054240486dff349253c2c8da087",
               "d57cdf9fe51debc65441be155eddb663cebfaec1c0c91161234dd3398ca71b76",
               "22ee08ed8c02358f994b5deba0940735b161f9a73ad60e4e57d10b9e1988ec83",
               "88f0452c2ac66146139b87e60e9bb8a8b6a6566cbb9040e5e8ee1774e12f35ba",
               "4379d68dde8fb1f022a870947d0524c0ed8a7b37bcfc49772a4d0a4e04158b7b",
               "f7d7680d544e9e8da9b95c8905e5d2ca5adc2a3e700c2e1aa1f99287da0d184c",
               "6f49e3558970540edfb187c59d32f3a27eecc6a48d87b49ad72c19495355f1db",
               "bce30810240512dde3f6513b3734ae0f6b98c35ac5465e5e12262db8a086e37e",
               "32394db9c0677d31efd0d684e969c6fab55fa1c47114c980a9e3f39ff85f2e58",
               "fb6ec0f7104fec7d0963c53754e84dcb13d6d94c0d19762a2f161503ea5e3580",
               "6a1081e60b6c3e22cf58bb21267230c1dd61bb741c32627f7cfd6ad67f7c86db",
               "81d695146542b67483b432ce2778c62944d711a4ad740be37dd930f9a97b80ca",
               "81d695146542b67483b432ce2778c62944d711a4ad740be37dd930f9a97b80ca",
               "635d1185b1507ca5e08a6771f08595801d8d98145ba78665366e492ee1875317",
               "6e2bb79dcafb019d6bbc34b7a4550cd603852493b5427252ae44301f4ea96db4",
               "13ff0fa4901b81b663311faf1396dbc804f53fd56b6067f73776acc48a54f9f9",
               "b4a68330d3a235ef755fa3229e4492e2b7b824fc576dfe73309f09bce6c7adc7",
               "a6457ca8f7a14ba363e6f8467c020e62425eeec755ee1c7a57068e8952c16672",
               "e667c70c74112ae249dff32805c5767700d25fde443ca513222ec3203ce76872",
               "7586725f6bad44993a942453694e3b8d0ca19c5f480f3a741042b6c5132c55ef",
               "5aa02b23b3c30a8f78317b2942a36206520c513d2bbfa3e1341f4caff749b692",
               "ce12e654c48a7145f456ded3337354227c845c4012a6302fa63e6901c580b610",
               "ed9b5c4a768f2744cc564a8d470af9b2cf259f53a7538adf59cb8f1eaee0217b",
               "7c9f73755aa4e7b0480ca6a1b23b25e3103c17afa1635a3abf8c03bb3a686a78",
               "3885dbec9db4d8a3a1f6ad12ff0055e64de63d351424b954369e7828950f7fa7",
               "ce12e654c48a7145f456ded3337354227c845c4012a6302fa63e6901c580b610",
               "05b5616932031283eea3751dfcad273db805a71b4e35afdbc03bd3c30bc6b6b0",
               "f5924d522b7d8b4a551c2d4045069c9a711b62b97e2b799e7b42a9931e58fba3",
               "0cd9e13dbce7595879d9e972dc04e81da63d1cbf34c99fd3603e2aba68ccf2a5",
               "f6b9cefd13932daad90ac587fec1e5ec542bca1936fcbd3245d0919e48460a9c",
               "c14d07ccccaaab6c4adbfba16b3f977f64408499dce5aa8df424b2c59a313d48") and
 not (process.executable : "?:\\Windows\\Sys*\\msiexec.exe" and dll.path : "C:\\Windows\\Installer\\MSI????.tmp")] by dll.hash.sha256
[api where
 process.Ext.api.behaviors in ("shellcode", "allocate_shellcode", "execute_shellcode") and
 process.thread.Ext.call_stack_final_user_module.hash.sha256 like "?*" and
 not process.thread.Ext.call_stack_final_user_module.protection_provenance like ("Unknown", "issetup.dll", "isrt.dll", "isslideshow.dll", "is_*.tmp") and
 not (process.executable : ("C:\\Windows\\SysWOW64\\msiexec.exe", "C:\\Windows\\System32\\msiexec.exe") and
      (process.thread.Ext.call_stack_final_user_module.name like "msi*.tmp" or process.thread.Ext.call_stack_final_user_module.protection_provenance like "msi*.tmp")) and
 not (process.Ext.api.name == "VirtualAlloc" and process.Ext.api.parameters.size <= 5000) and
 not (process.Ext.api.name == "NtQueueApcThread" and process.executable : "C:\\Windows\\SysWOW64\\msiexec.exe" and
      process.thread.Ext.call_stack_final_user_module.name like "_is*.tmp") and
 not (process.thread.Ext.call_stack_final_user_module.protection_provenance == "bass.dll" and
      process.thread.Ext.call_stack_final_user_module.protection_provenance_path like "c:\\users\\*\\appdata\\local\\temp\\is-*.tmp\\*.tmp") and
 not (process.parent.executable : ("C:\\Program Files\\*", "C:\\Program Files (x86)\\*") and
      process.thread.Ext.call_stack_final_user_module.protection_provenance_path: ("C:\\Program Files\\*", "C:\\Program Files (x86)\\*")) and
 not (process.Ext.api.name == "VirtualProtect" and
       _arraysearch(process.thread.Ext.call_stack, $entry,
                    $entry.symbol_info like ("c:\\windows\\sys?????\\ntdll.dll!LdrLoadDll*",
                                             "c:\\windows\\sys?????\\kernelbase.dll!LoadLibrary*"))) and
 not (process.name : ("msiexec.exe", "setup.exe") and
      _arraysearch(process.thread.Ext.call_stack, $entry, $entry.callsite_trailing_bytes == "8985271f001056e8f60300008d8dbd1d001085c00f859400000056e84003000056e85502000056e85301000090909090909090908b4e3485c90f848900000003"))
 ] by process.thread.Ext.call_stack_final_user_module.hash.sha256
'''

min_endpoint_version = "8.14.2"
reputation = true
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"

[[threat.technique]]
id = "T1574"
name = "Hijack Execution Flow"
reference = "https://attack.mitre.org/techniques/T1574/"
[[threat.technique.subtechnique]]
id = "T1574.001"
name = "DLL"
reference = "https://attack.mitre.org/techniques/T1574/001/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.14.2"