Elastic rules: 0h

[metadata]
creation_date = "2022/02/24"
integration = ["system", "windows"]
maturity = "production"
updated_date = "2026/05/03"

[rule]
author = ["Elastic"]
description = """
Identifies a modification on the dsHeuristics attribute on the bit that holds the configuration of groups excluded from
the SDProp process. The SDProp compares the permissions on protected objects with those defined on the AdminSDHolder
object. If the permissions on any of the protected accounts and groups do not match, the permissions on the protected
accounts and groups are reset to match those of the domain's AdminSDHolder object, meaning that groups excluded will
remain unchanged. Attackers can abuse this misconfiguration to maintain long-term access to privileged accounts in these
groups.
"""
from = "now-9m"
index = ["logs-system.security*", "logs-windows.forwarded*", "winlogbeat-*"]
language = "eql"
license = "Elastic License v2"
name = "AdminSDHolder SDProp Exclusion Added"
references = [
    "https://www.cert.ssi.gouv.fr/uploads/guide-ad.html#dsheuristics_bad",
    "https://petri.com/active-directory-security-understanding-adminsdholder-object",
]
risk_score = 73
rule_id = "61d29caf-6c15-4d1e-9ccb-7ad12ccc0bc7"
severity = "high"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Persistence",
    "Data Source: Active Directory",
    "Resources: Investigation Guide",
    "Use Case: Active Directory Monitoring",
    "Data Source: Windows Security Event Logs",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
any where host.os.type == "windows" and event.code == "5136" and
  winlog.event_data.AttributeLDAPDisplayName : "dSHeuristics" and
  winlog.event_data.OperationType : "%%14674" and
  length(winlog.event_data.AttributeValue) > 15 and
  winlog.event_data.AttributeValue regex~ "[0-9]{15}([1-9a-f]).*"
'''

note = """## Triage and analysis

### Investigating AdminSDHolder SDProp Exclusion Added

#### Possible investigation steps

- What did the 5136 record do to the SDProp exclusion mask?
  - Focus: `winlog.event_data.OperationType` and `winlog.event_data.AttributeValue`; decode position "1" = Account Operators, "2" = Server Operators, "4" = Print Operators, "8" = Backup Operators, with additive hex combinations.
  - Implication: escalate when an added or replaced value leaves any operator group excluded from SDProp, especially multiple groups; lower concern only when paired 5136 records prove removal and rollback to 0. If the active mask is unproven, treat as unresolved.

- Did the change land on the forest configuration object controlling SDProp behavior?
  - Focus: `winlog.event_data.ObjectDN`, `winlog.event_data.DSName`, and `host.name`.
  - Implication: forest-impacting when `winlog.event_data.ObjectDN` is the Directory Service object under "CN=Windows NT,CN=Services,CN=Configuration" and the naming context is in scope; narrow only when `winlog.event_data.DSName` and `host.name` identify a lab or recovery forest.

- Which identity changed "dSHeuristics", and does it fit directory configuration work?
  - Focus: `user.id`, `user.name`, `user.domain`, and `winlog.event_data.SubjectLogonId`.
  - Implication: suspicious when the writer is not a dedicated directory-configuration identity for the affected forest; reduce concern only when identity and object match confirmed hardening or recovery.

- What source session produced the directory change?
  - Why: the 5136 event names the writer, but session origin separates console or jump-host administration from remote or alternate-credential use.
  - Focus: on the domain controller, find 4624 events where `winlog.event_data.TargetLogonId` equals the 5136 `winlog.event_data.SubjectLogonId`; read `source.ip`, `winlog.logon.type`, and `winlog.event_data.AuthenticationPackageName`. $investigate_0
  - Hint: search 4648 by `winlog.event_data.SubjectLogonId` when explicit-credential use would change the answer. $investigate_1
  - Hint: Missing authentication telemetry is unresolved, not benign.
  - Implication: escalate for unexpected workstation, direct DC logon, remote-interactive path, NTLM where Kerberos is expected, or explicit-credential use; reduce concern when origin, logon type, and authentication package fit the confirmed directory-configuration case.

- Did the same operation or session change other privileged directory state?
  - Why: SDProp exclusion is most damaging with AdminSDHolder ACL, privileged membership, delegation, or security-descriptor changes that persist because SDProp no longer resets excluded groups.
  - Focus: 5136 events on the same `host.id` where `winlog.event_data.OpCorrelationID` matches, then the same `winlog.event_data.SubjectLogonId` if needed; read `winlog.event_data.ObjectDN`, `winlog.event_data.AttributeLDAPDisplayName`, and `winlog.event_data.AttributeValue`. $investigate_2
  - Range: inspect the alert burst first; if the mask stayed non-zero, extend through the weakened interval for follow-on membership, ACL, delegation, or security-descriptor changes on excluded groups.
  - Implication: escalate when the same burst touches AdminSDHolder, privileged groups, delegation attributes, or security descriptors; lower suspicion only when grouped changes stay limited to one intentional SDProp configuration action.

- If local evidence remains suspicious or unresolved, do related alerts change scope or urgency?
  - Focus: recent alerts for the same `user.id`. $investigate_3
  - Hint: also review domain controller `host.id` when controller compromise or change spread remains unresolved. $investigate_4
  - Implication: broaden response when the writer or controller has related AD tampering, unusual authentication, privilege abuse, persistence, credential-access, or lateral-movement alerts; keep scope local only when related alerts are quiet and local telemetry supports a bounded explanation.

- Escalate for an active non-zero in-scope mask, abnormal writer or source session, or grouped privileged changes; close only when mask, operation, scope, writer, session, and grouped 5136 prove rollback to 0 or confirmed hardening/testing without contradictions; preserve and escalate mixed or incomplete cases.

### False positive analysis

- Treat non-zero SDProp exclusions as suspicious. Directory hardening or delegated-admin redesign is benign only when excluded operator groups were intentionally stripped of privileged rights and a dedicated configuration workflow made the change. Confirm `winlog.event_data.AttributeValue` maps to the planned group set, `winlog.event_data.ObjectDN` and `winlog.event_data.DSName` identify the expected Directory Service object, `user.id` and recovered `source.ip` identify the authorized admin session, and `winlog.event_data.OpCorrelationID` activity stays bounded to maintenance. If evidence is unavailable, the alert remains unresolved; do not close from repetition.
- Lab-forest or recovery-forest testing may intentionally change "dSHeuristics". Confirm `winlog.event_data.DSName` and `host.name` place the event in that forest, `user.id` and `winlog.event_data.SubjectLogonId` identify the designated test administrator, and related alerts on `host.id` lack unrelated credential-access, persistence, or lateral-movement activity. If records are unavailable, treat as unresolved unless another reliable source confirms forest identity and administrator.
- Before creating an exception, validate recurrence for the same `user.id`, `host.id`, `winlog.event_data.ObjectDN`, `winlog.event_data.DSName`, `winlog.event_data.AttributeValue`, and bounded `winlog.event_data.OpCorrelationID` pattern. Avoid exceptions on "dSHeuristics", event 5136, or rule name alone.

### Response and remediation

- If confirmed benign, reverse temporary containment and document the mask, object scope, writer, session origin, controller, and confirmation source proving the authorized workflow. Keep exceptions tied to the recurring workflow pattern, not the attribute or event code.
- If suspicious but unconfirmed, preserve triggering and grouped 5136 records, linked 4624 or 4648 authentication records, and key identifiers: `winlog.event_data.ObjectGUID`, `winlog.event_data.OpCorrelationID`, `user.id`, `host.id`, and recovered `source.ip`. Apply reversible containment tied to those findings: restrict the implicated account from directory-configuration changes, increase DC monitoring, or contain the recovered source host if not a critical controller. Escalate to account disablement or host isolation only when related alerts or session evidence show broader abuse.
- If confirmed malicious, preserve directory-change and authentication evidence before changing configuration. Restore "dSHeuristics" to the expected value, verify rollback replication on other domain controllers, and review the same `winlog.event_data.OpCorrelationID` or `winlog.event_data.SubjectLogonId` for unauthorized directory changes. Contain the writer account or recovered source host with identity or endpoint response tooling; avoid isolating a domain controller unless broader compromise is confirmed and directory owners can tolerate the action.
- After containment, check whether excluded operator groups received unauthorized membership, ACL, delegation, or security-descriptor changes while SDProp protection was weakened, and roll back only malicious changes identified.
- Post-incident hardening: keep Windows Security 5136 directory-service auditing enabled on domain controllers, restrict "dSHeuristics" changes to dedicated directory-configuration workflows, reduce or remove privileged rights from built-in operator groups where possible, and record visibility gaps or adjacent variants for engineering review.
"""

setup = """## Setup

Audit Directory Service Changes must be enabled to generate the events used by this rule.
Setup instructions: https://ela.st/audit-directory-service-changes
"""

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "host.name",
    "host.id",
    "user.id",
    "winlog.event_data.SubjectUserSid",
    "winlog.event_data.SubjectLogonId",
    "winlog.event_data.ObjectDN",
    "winlog.event_data.ObjectGUID",
    "winlog.event_data.ObjectClass",
    "winlog.event_data.AttributeLDAPDisplayName",
    "winlog.event_data.AttributeValue",
    "winlog.event_data.OperationType",
    "winlog.event_data.OpCorrelationID",
    "winlog.event_data.DSName",
]

[transform]

[[transform.investigate]]
label = "Linked logon for the modifying session"
description = ""
providers = [
  [
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "winlog.event_data.TargetLogonId", queryType = "phrase", value = "{{winlog.event_data.SubjectLogonId}}", valueType = "string" },
    { excluded = false, field = "event.code", queryType = "phrase", value = "4624", valueType = "string" }
  ]
]
relativeFrom = "now-24h/h"
relativeTo = "now"

[[transform.investigate]]
label = "Explicit credential events for the modifying session"
description = ""
providers = [
  [
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "winlog.event_data.SubjectLogonId", queryType = "phrase", value = "{{winlog.event_data.SubjectLogonId}}", valueType = "string" },
    { excluded = false, field = "event.code", queryType = "phrase", value = "4648", valueType = "string" }
  ]
]
relativeFrom = "now-24h/h"
relativeTo = "now"

[[transform.investigate]]
label = "All 5136 events in this SDProp exclusion change set"
description = ""
providers = [
  [
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "winlog.event_data.OpCorrelationID", queryType = "phrase", value = "{{winlog.event_data.OpCorrelationID}}", valueType = "string" },
    { excluded = false, field = "event.code", queryType = "phrase", value = "5136", valueType = "string" }
  ]
]
relativeFrom = "now-24h/h"
relativeTo = "now"

[[transform.investigate]]
label = "Alerts associated with the writer"
description = ""
providers = [
  [
    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
    { excluded = false, field = "user.id", queryType = "phrase", value = "{{user.id}}", valueType = "string" }
  ]
]
relativeFrom = "now-48h/h"
relativeTo = "now"

[[transform.investigate]]
label = "Alerts associated with the domain controller"
description = ""
providers = [
  [
    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" }
  ]
]
relativeFrom = "now-48h/h"
relativeTo = "now"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"

[[rule.threat.technique.subtechnique]]
id = "T1078.002"
name = "Domain Accounts"
reference = "https://attack.mitre.org/techniques/T1078/002/"

[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1484"
name = "Domain or Tenant Policy Modification"
reference = "https://attack.mitre.org/techniques/T1484/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[metadata]
creation_date = "2024/07/24"
integration = ["aws"]
maturity = "production"
updated_date = "2026/04/10"

[rule]
author = ["Elastic"]
description = """
Detects successful AWS Management Console or federation login activity performed using an EC2 instance’s assumed role
credentials. EC2 instances typically use temporary credentials to make API calls, not to authenticate interactively via
the console. A successful "ConsoleLogin" or "GetSigninToken" event using a session pattern that includes "i-" (the EC2
instance ID) is highly anomalous and may indicate that an adversary obtained the instance’s temporary credentials from
the instance metadata service (IMDS) and used them to access the console. Such activity can enable lateral movement,
privilege escalation, or persistence within the AWS account.
"""
event_category_override = "event.type"
false_positives = [
    """
    This is very uncommon behavior and should result in minimal false positives, ensure validity of the triggered event
    and include exceptions where necessary.
    """,
]
from = "now-6m"
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
language = "eql"
license = "Elastic License v2"
name = "AWS EC2 Instance Console Login via Assumed Role"
note = """## Triage and analysis

### Investigating AWS EC2 Instance Console Login via Assumed Role

This rule detects successful AWS console or federation logins using temporary credentials tied to EC2 instance profiles. Under normal conditions, EC2 instances use their temporary credentials for programmatic API access — **not** for interactive console sessions. When an attacker gains access to an instance’s IMDS (Instance Metadata Service) or its environment variables, they may retrieve temporary STS credentials and attempt console logins to gain full access to the AWS account. A successful login of this type is rare and high-risk, as it strongly suggests credential theft or unauthorized session hijacking.

#### Possible investigation steps

- **Identify the source and actor**
  - Review `aws.cloudtrail.user_identity.arn`, `user.id`, and `user_agent.original` fields to confirm the session originated from an EC2 instance (`:i-` pattern).
  - Correlate the instance ID (`i-xxxxxx`) with the specific EC2 instance in your environment to identify its owner, purpose, and running applications.
  - Check `source.ip` and `cloud.region` to determine if the login originated from within AWS infrastructure (expected) or an external location (suspicious).

- **Correlate surrounding activity**
  - Pivot in Timeline to view the sequence of events leading up to the login, including:
    - STS token retrievals (`GetSessionToken`, `AssumeRole`, `GetCallerIdentity`)
    - Calls to the IMDS endpoint or local credential exfiltration attempts from the instance.
  - Investigate whether the same role or credentials were used for API actions following the login (e.g., `CreateUser`, `AttachRolePolicy`, or `ListBuckets`).

- **Assess IAM role exposure**
  - Determine which IAM role was associated with the instance at the time of the event and review its attached permissions.
  - Evaluate whether the role grants console access or permissions beyond what that workload normally requires.
  - Check for any recent changes to that role’s trust policy or attached policies.

- **Validate authorization**
  - Contact the EC2 instance owner or service team to confirm if any legitimate process should be logging in to the console.
  - If no legitimate activity can explain the login, treat the credentials as compromised.

### False positive analysis

This is very uncommon behavior.  
Known legitimate causes include:
- AWS or internal security automation that programmatically initiates console sessions for validation or testing.
- Forensic or incident-response automation that logs in using temporary credentials from a compromised instance.
- Red-team or penetration-testing activity designed to validate IMDS exposure or lateral movement scenarios.

For any other occurrence, treat the alert as potentially malicious.  
Validate through:
- The originating instance’s purpose and owner.
- Known automation patterns in `user_agent.original`.
- The timestamp alignment with planned testing or security validation.

### Response and remediation

- **Immediate containment**
  - Revoke the temporary credentials for the affected role (`aws sts revoke-session-token` or rotate the role credentials).
  - Isolate the associated EC2 instance (e.g., detach it from the VPC or security groups) to prevent further credential misuse.
  - Invalidate active console sessions via AWS CLI or the AWS Console.

- **Investigation and scoping**
  - Review CloudTrail logs for all actions associated with the compromised role in the preceding 24 hours.
  - Determine if additional roles or instances show similar `ConsoleLogin` patterns.
  - Search for network indicators of IMDS exploitation (e.g., requests to `169.254.169.254` from unauthorized binaries or users).

- **Recovery and hardening**
  - Rotate all credentials for affected roles and users.
  - Apply IMDSv2 enforcement to prevent credential harvesting from EC2 metadata.
  - Implement restrictive IAM policies: deny console access (`iam:PassRole`, `sts:GetFederationToken`) for non-human roles.

### Additional information
- **[AWS IR Playbooks](https://github.com/aws-samples/aws-incident-response-playbooks/blob/c151b0dc091755fffd4d662a8f29e2f6794da52c/playbooks/)** 
- **[AWS Customer Playbook Framework](https://github.com/aws-samples/aws-customer-playbook-framework/tree/a8c7b313636b406a375952ac00b2d68e89a991f2/docs)** 
- **Security Best Practices:** [AWS Knowledge Center – Security Best Practices](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/).
"""
references = [
    "https://redcanary.com/blog/aws-sts/",
    "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_enable-console-custom-url.html/",
]
risk_score = 73
rule_id = "d1e5e410-3e34-412e-9b1f-dd500b3b55cd"
severity = "high"
tags = [
    "Domain: Cloud",
    "Data Source: AWS",
    "Data Source: Amazon Web Services",
    "Data Source: AWS EC2",
    "Data Source: AWS STS",
    "Data Source: AWS Sign-In",
    "Use Case: Identity and Access Audit",
    "Tactic: Lateral Movement",
    "Tactic: Credential Access",
    "Tactic: Persistence",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
info where data_stream.dataset == "aws.cloudtrail"
   and event.provider == "signin.amazonaws.com"
   and event.action in ("ConsoleLogin", "GetSigninToken")
   and event.outcome == "success"
   and aws.cloudtrail.user_identity.type == "AssumedRole"
   and stringContains (user.id, ":i-")
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1021"
name = "Remote Services"
reference = "https://attack.mitre.org/techniques/T1021/"

[[rule.threat.technique.subtechnique]]
id = "T1021.007"
name = "Cloud Services"
reference = "https://attack.mitre.org/techniques/T1021/007/"

[[rule.threat.technique]]
id = "T1550"
name = "Use Alternate Authentication Material"
reference = "https://attack.mitre.org/techniques/T1550/"

[[rule.threat.technique.subtechnique]]
id = "T1550.001"
name = "Application Access Token"
reference = "https://attack.mitre.org/techniques/T1550/001/"

[rule.threat.tactic]
id = "TA0008"
name = "Lateral Movement"
reference = "https://attack.mitre.org/tactics/TA0008/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"

[[rule.threat.technique.subtechnique]]
id = "T1078.004"
name = "Cloud Accounts"
reference = "https://attack.mitre.org/techniques/T1078/004/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"

[[rule.threat.technique.subtechnique]]
id = "T1552.005"
name = "Cloud Instance Metadata API"
reference = "https://attack.mitre.org/techniques/T1552/005/"

[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"

[[rule.threat.technique.subtechnique]]
id = "T1078.004"
name = "Cloud Accounts"
reference = "https://attack.mitre.org/techniques/T1078/004/"

[[rule.threat.technique]]
id = "T1550"
name = "Use Alternate Authentication Material"
reference = "https://attack.mitre.org/techniques/T1550/"

[[rule.threat.technique.subtechnique]]
id = "T1550.001"
name = "Application Access Token"
reference = "https://attack.mitre.org/techniques/T1550/001/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"

[[rule.threat.technique.subtechnique]]
id = "T1078.004"
name = "Cloud Accounts"
reference = "https://attack.mitre.org/techniques/T1078/004/"

[rule.threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"
[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user_agent.original",
    "source.ip",
    "aws.cloudtrail.user_identity.arn",
    "aws.cloudtrail.user_identity.type",
    "aws.cloudtrail.user_identity.access_key_id",
    "event.action",
    "event.outcome",
    "cloud.account.id",
    "cloud.region",
    "aws.cloudtrail.response_elements",
]

[metadata]
creation_date = "2025/01/08"
integration = ["aws"]
maturity = "production"
updated_date = "2026/04/10"

[rule]
author = ["Elastic"]
description = """
Identifies when an AWS Simple Queue Service (SQS) queue is purged. Purging an SQS queue permanently deletes all messages
currently in the queue. Adversaries may use this action to disrupt application workflows, destroy operational data, or
impair monitoring and alerting by removing messages that contain evidence of malicious activity.
"""
false_positives = [
    """
    Authorized administrators or automated workflows may purge SQS queues for legitimate operational reasons, such as
    clearing stale messages, resetting test environments, or performing approved maintenance. Verify that the action
    aligns with documented procedures and expected operational behavior.
    """,
]
from = "now-6m"
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
language = "kuery"
license = "Elastic License v2"
name = "AWS SQS Queue Purge"
note = """## Triage and analysis

### Investigating AWS SQS Queue Purge

AWS SQS is a managed message queuing service commonly used to decouple services and buffer events across distributed and serverless architectures. Purging a queue removes all pending messages and cannot be undone. While this may be required for maintenance or testing, adversaries may abuse this action to disrupt operations, delete forensic evidence, or evade detection by removing queued security or audit events.

### Possible investigation steps

**Identify the actor**
- Review `aws.cloudtrail.user_identity.arn` and `access_key_id` to determine who initiated the purge. Confirm whether this identity typically manages SQS resources and whether the action aligns with their role.

**Review the affected queue**
- Identify the purged queue using `aws.cloudtrail.request_parameters` or `aws.cloudtrail.resources.arn`. Determine the purpose of the queue and whether it supports critical workflows, security tooling, or monitoring pipelines.

**Evaluate the context of the action**
- Review the `@timestamp` to determine when the purge occurred and whether it aligns with maintenance windows or
  deployment activity.
- Examine `source.ip` and `user_agent.original` for anomalies such as unexpected locations, automation tools, or
  unfamiliar clients.

**Correlate related activity**
- Search for other CloudTrail events from the same identity before and after the purge, including IAM changes, credential activity, or additional SQS operations.
- Look for signs of follow-on behavior such as queue deletion, policy updates, or attempts to suppress logging.

**Validate intent**
- Confirm with the queue owner or application team whether the purge was intentional, approved, and expected. If no clear business justification exists, treat the activity as potentially suspicious.

### False positive analysis

- Queue purges performed during routine maintenance, incident recovery, or test resets may be legitimate.
- Automated jobs or cleanup scripts may regularly purge queues as part of normal operation.

### Response and remediation

- If the purge was unauthorized, immediately restrict SQS permissions for the affected identity and investigate for credential compromise.
- Assess operational impact and determine whether downstream systems were disrupted or lost critical data.
- Review recent activity to identify any additional attempts to evade detection or disable monitoring.
- Reinforce least-privilege IAM policies to limit which identities can perform `PurgeQueue`.
- Enhance monitoring and alerting for destructive SQS actions, especially in production environments.
- Work with application teams to document approved purge workflows and ensure adequate guardrails are in place.

### Additional information
- **[AWS IR Playbooks](https://github.com/aws-samples/aws-incident-response-playbooks/blob/c151b0dc091755fffd4d662a8f29e2f6794da52c/playbooks/)** 
- **[AWS Customer Playbook Framework](https://github.com/aws-samples/aws-customer-playbook-framework/tree/a8c7b313636b406a375952ac00b2d68e89a991f2/docs)** 
- **[AWS Knowledge Center – Security Best Practices](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/)**
"""
references = [
    "https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_PurgeQueue.html",
    "https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/",
]
risk_score = 47
rule_id = "bab88bb8-cdd9-11ef-bd9a-f661ea17fbcd"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Data Source: AWS",
    "Data Source: Amazon Web Services",
    "Data Source: AWS SQS",
    "Use Case: Threat Detection",
    "Use Case: Log Auditing",
    "Tactic: Defense Evasion",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset: "aws.cloudtrail"
    and event.provider: "sqs.amazonaws.com"
    and event.action: "PurgeQueue"
    and event.outcome: "success"
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"

[[rule.threat.technique.subtechnique]]
id = "T1562.008"
name = "Disable or Modify Cloud Logs"
reference = "https://attack.mitre.org/techniques/T1562/008/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1485"
name = "Data Destruction"
reference = "https://attack.mitre.org/techniques/T1485/"

[rule.threat.tactic]
id = "TA0040"
name = "Impact"
reference = "https://attack.mitre.org/tactics/TA0040/"
[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user_agent.original",
    "source.ip",
    "aws.cloudtrail.user_identity.arn",
    "aws.cloudtrail.user_identity.type",
    "aws.cloudtrail.user_identity.access_key_id",
    "aws.cloudtrail.resources.arn",
    "aws.cloudtrail.resources.type",
    "event.action",
    "event.outcome",
    "cloud.account.id",
    "cloud.region",
    "aws.cloudtrail.request_parameters",
]

[rule]
description = """
This rule detects when a process establishes an outbound network connection followed by creating an in-memory file using
the memfd_create syscall. This activity indicates an active attempt to execute a fileless payload and should be
considered highly abnormal or suspicious. This activity can occur when the memfd syscall is utilized to create a memory
resident file, like a payload, and then uses it to execute a process via a command and control channel, resulting in an
exec event.
"""
id = "360f8271-2c39-4b7c-87b8-87ef328ddac7"
license = "Elastic License v2"
name = "Egress Network Connection Followed by Memory File Descriptor Creation"
os_list = ["linux"]
reference = ["https://man7.org/linux/man-pages/man2/memfd_create.2.html"]
version = "1.0.4"

query = '''
sequence with maxspan=10s
  [network where event.type == "start" and event.action == "connection_attempted" and (
    process.name in (
      "bash", "dash", "sh", "tcsh", "tclsh", "wish", "csh", "zsh", "ksh", "fish", "mksh",
      "busybox", "pwsh", "deno", "bun", "base64", "rscript", "escript", "java", "javaw",
      "r", "julia", "mono", "dotnet-ef", "groovy", "kotlin", "scala", "erlang",
      "ocaml", "ocamlopt", "ld.so", "ld-linux-x86-64.so.2", "awk", "gawk", "mawk", "nawk",
      "env", "timeout", "nice", "stdbuf", "setsid", "setarch", "unshare", "nsenter", "flock",
      "nohup", "runuser", "sudo", "snap", "snap-confine", "snap-exec", "erlexec", "beam.smp"
    ) or
    process.name like ("perl*", "php*", "lua*") or
    process.executable like (
      "memfd:*", "?memfd:*", "/tmp/*", "/var/tmp/*", "/dev/shm/*", "/run/user/*", "/var/run/user/*",
      "/boot/*", "/sys/*", "/lost+found/*", "/proc/*", "/var/mail/*"
    )
  ) and
  not (
    destination.ip == null or destination.ip == "0.0.0.0" or cidrmatch(
      destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.0.0/29",
      "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
      "192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10",
      "192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1", "FE80::/10",
      "FF00::/8"
    ) or
    process.executable like (
      "/usr/local/sbin/php-fpm", "/usr/local/cpanel/3rdparty/perl/*/bin/perl", "/snap/android-studio/*/jbr/bin/java",
      "/tmp/.mount_*", "/tmp/.tmp*/node", "/usr/sbin/php-fpm*", "/tmp/vscode-komo/*/server/node"
    )
  )] by process.entity_id
  [process where event.type == "start" and event.action == "memfd_create" and
  not (
    (
      process.executable like (
        "/home/runner/actions-runner-*/Runner.Listener", "/home/runner/actions-runner-*/Runner.Worker",
        "/home/runner/bin/Runner.Listener", "/home/runner/bin/Runner.Worker"
      ) and
      process.Ext.memfd.name == "memfd:doublemapper"
    ) or
    (
      process.name like "php*" and
      process.Ext.memfd.name in ("memfd:opcache_lock", "memfd:sd-executor-state")
    ) or
    (
      process.executable like "/home/*/.cache/camoufox/camoufox-bin" and
      process.Ext.memfd.name in ("memfd:mozilla-ipc", "memfd:mozilla-ipc-test")
    ) or
    (
      process.name == "praxis_node" and
      process.Ext.memfd.name in (
        "memfd:doublemapper", "memfd:sd-executor-state", "memfd:allocation fd", "memfd:spawn_stdio_stdin",
        "doublemapper", "memfd:/.glXXXXXX", "memfd:pulseaudio"
      )
    ) or
    (
      process.executable in ("./usr/bin/qemu-s390x", "./usr/bin/qemu-s390x-static") and
      process.Ext.memfd.name == "memfd:qemu-open"
    ) or
    (
      process.name like "php*" and
      process.working_directory like ("/var/www/*", "/builds/php/*")
    ) or
    (
      process.name like "php*" and
      process.args in ("/usr/bin/composer", "/bin/composer")
    ) or
    process.executable like (
      "/tmp/.mount_remp*/zen", "/usr/lib/systemd/systemd", "/usr/libexec/nordlayer/nordlayer-resolvconf",
      "/home/*/.vscode-server/*/bin/vsce-sign", "/sbin/apk", "/usr/bin/lxc-info", "/home/*/.local/share/claude/versions/*",
      "/tmp/*/.vscode-server/bin/*/node_modules/@vscode/vsce-sign/bin/vsce-sign"
    ) or
    (
      process.executable like "/usr/bin/php*" and
      process.Ext.memfd.name == "anon_hugepage"
    ) or
    (
     process.executable like "/opt/erlang/lib/erlang/erts-*/bin/beam.smp" and
     process.args like ("/opt/rabbitmq/escript/rabbitmq-diagnostics", "/opt/erlang/lib/erlang/erts-*/bin/beam.smp")
    )
  )] by process.parent.entity_id
'''

min_endpoint_version = "9.1.4"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1106"
name = "Native API"
reference = "https://attack.mitre.org/techniques/T1106/"


[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1620"
name = "Reflective Code Loading"
reference = "https://attack.mitre.org/techniques/T1620/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "9.1.4"

[metadata]
creation_date = "2020/12/15"
integration = ["endpoint", "windows", "system", "sentinel_one_cloud_funnel", "m365_defender", "crowdstrike"]
maturity = "production"
updated_date = "2026/05/04"

[rule]
author = ["Elastic"]
description = """
Identifies the use of the Exchange PowerShell cmdlet, New-MailBoxExportRequest, to export the contents of a primary
mailbox or archive to a .pst file. Adversaries may target user email to collect sensitive information.
"""
false_positives = ["Legitimate exchange system administration activity."]
from = "now-9m"
index = [
    "endgame-*",
    "logs-crowdstrike.fdr*",
    "logs-endpoint.events.process-*",
    "logs-m365_defender.event-*",
    "logs-sentinel_one_cloud_funnel.*",
    "logs-system.security*",
    "logs-windows.forwarded*",
    "logs-windows.sysmon_operational-*",
    "winlogbeat-*",
]
language = "eql"
license = "Elastic License v2"
name = "Exporting Exchange Mailbox via PowerShell"
note = """## Triage and analysis

### Investigating Exporting Exchange Mailbox via PowerShell

Email mailboxes and their information can be valuable assets for attackers. Company mailboxes often contain sensitive information such as login credentials, intellectual property, financial data, and personal information, making them high-value targets for malicious actors.

The `New-MailBoxExportRequest` cmdlet is used to begin the process of exporting contents of a primary mailbox or archive to a .pst file. Note that this is done on a per-mailbox basis and this cmdlet is available only in on-premises Exchange.

Attackers can abuse this functionality in preparation for exfiltrating contents, which is likely to contain sensitive and strategic data.

#### Possible investigation steps

- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
- Investigate other alerts associated with the user/host during the past 48 hours.
- Investigate the export operation:
  - Identify the user account that performed the action and whether it should perform this kind of action.
  - Contact the account owner and confirm whether they are aware of this activity.
  - Check if this operation was approved and performed according to the organization's change management policy.
  - Retrieve the operation status and use the `Get-MailboxExportRequest` cmdlet to review previous requests.
  - By default, no group in Exchange has the privilege to import or export mailboxes. Investigate administrators that assigned the "Mailbox Import Export" privilege for abnormal activity.
- Investigate if there is a significant quantity of export requests in the alert timeframe. This operation is done on a per-mailbox basis and can be part of a mass export.
- If the operation was completed successfully:
  - Check if the file is on the path specified in the command.
  - Investigate if the file was compressed, archived, or retrieved by the attacker for exfiltration.

### False positive analysis

- This mechanism can be used legitimately. Analysts can dismiss the alert if the administrator is aware of the activity and it is done with proper approval.

### Response and remediation

- Initiate the incident response process based on the outcome of the triage.
- If the involved host is not the Exchange server, isolate the host to prevent further post-compromise behavior.
- Use the `Remove-MailboxExportRequest` cmdlet to remove fully or partially completed export requests.
- Prioritize cases that involve personally identifiable information (PII) or other classified data.
- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
- Review the privileges of users with the "Mailbox Import Export" privilege to ensure that the least privilege principle is being followed.
- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
"""

setup = """## Setup

This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.

Setup instructions: https://ela.st/install-elastic-defend

### Additional data sources

This rule also supports the following third-party data sources. For setup instructions, refer to the links below:

- [CrowdStrike](https://ela.st/crowdstrike-integration)
- [Microsoft Defender XDR](https://ela.st/m365-defender)
- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
- [Sysmon Event ID 1 - Process Creation](https://ela.st/sysmon-event-1-setup)
- [Windows Process Creation Logs](https://ela.st/audit-process-creation)
"""

references = [
    "https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/",
    "https://docs.microsoft.com/en-us/powershell/module/exchange/new-mailboxexportrequest?view=exchange-ps",
    "https://www.elastic.co/security-labs/siestagraph-new-implant-uncovered-in-asean-member-foreign-ministry",
]
risk_score = 47
rule_id = "6aace640-e631-4870-ba8e-5fdda09325db"
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Collection",
    "Tactic: Execution",
    "Resources: Investigation Guide",
    "Data Source: Elastic Endgame",
    "Data Source: Elastic Defend",
    "Data Source: SentinelOne",
    "Data Source: Microsoft Defender XDR",
    "Data Source: Windows Security Event Logs",
    "Data Source: Crowdstrike",
    "Data Source: Sysmon",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
process where host.os.type == "windows" and event.type == "start" and
  process.name: ("powershell.exe", "pwsh.exe", "powershell_ise.exe") and
  process.command_line : ("*MailboxExportRequest*", "*-Mailbox*-ContentFilter*")
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1005"
name = "Data from Local System"
reference = "https://attack.mitre.org/techniques/T1005/"

[[rule.threat.technique]]
id = "T1114"
name = "Email Collection"
reference = "https://attack.mitre.org/techniques/T1114/"

[[rule.threat.technique.subtechnique]]
id = "T1114.001"
name = "Local Email Collection"
reference = "https://attack.mitre.org/techniques/T1114/001/"

[[rule.threat.technique.subtechnique]]
id = "T1114.002"
name = "Remote Email Collection"
reference = "https://attack.mitre.org/techniques/T1114/002/"

[rule.threat.tactic]
id = "TA0009"
name = "Collection"
reference = "https://attack.mitre.org/tactics/TA0009/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"

[[rule.threat.technique.subtechnique]]
id = "T1059.001"
name = "PowerShell"
reference = "https://attack.mitre.org/techniques/T1059/001/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[metadata]
creation_date = "2026/08/24"
integration = ["netflow", "goflow2"]
maturity = "production"
updated_date = "2026/09/08"

[rule]
author = ["Elastic"]
description = """
Identifies a newly observed NetFlow, IPFIX, or sFlow exporter IP followed by another detection alert with
medium-or-higher severity or an elevated risk score, where that exporter IP is the source of the detected activity in
the same data stream namespace. This correlation adds behavioral evidence that can help distinguish routine exporter
onboarding from a potentially unauthorized or compromised exporter introduced as part of defense evasion.
"""
false_positives = [
    """
    Newly deployed network devices may legitimately generate other detection alerts during commissioning, testing,
    vulnerability scanning, or monitoring validation. Shared addresses, network address translation, and incomplete
    asset attribution can also cause unrelated activity to correlate to the exporter IP.
    """,
]
from = "now-45m"
interval = "15m"
language = "esql"
license = "Elastic License v2"
name = "First Seen Network Flow Exporter Followed by Suspicious Source Activity"
note = """## Triage and analysis

### Investigating First Seen Network Flow Exporter Followed by Suspicious Source Activity

This higher-order rule correlates the building-block alert "First Seen Network Flow Exporter" with a later detection
alert that has medium-or-higher severity or an elevated risk score within 30 minutes. The new exporter's `observer.ip`
must equal the later alert's `source.ip`, and both alerts must share the same `data_stream.namespace`.

This relationship provides stronger evidence than suspicious flows merely reported by the exporter. It indicates that
the exporter address itself was subsequently identified as the source of separately detected activity. It does not by
itself prove telemetry injection, exporter compromise, or the addition of a rogue collector. A rogue collector receives
flow exports and generally requires network-device configuration or audit telemetry to detect directly.

### Possible investigation steps

- Review the `observer.ip`, `source.ip`, correlation timestamps, and suspicious rule names and IDs surfaced in the
  alert. Pivot to the contributing alerts to review their risk score, destination, host, and user context.
- Confirm that `observer.ip` belongs to the newly observed exporter and that NAT, shared addressing, or stale asset
  records did not cause the correlation.
- Examine the second alert's rule name and determine what behavior associated the exporter address with `source.ip`.
- Verify the exporter's owner, device type, software version, management plane, recent configuration changes, and
  approved collector destinations.
- Review authentication, process, network-device audit, and configuration telemetry for the exporter around the
  correlation window.
- Compare observation domains, exporter version, uptime, sequence values, templates, sampling configuration, and flow
  volume with established exporters.
- Search for additional alerts involving the exporter address and for malformed, implausible, or conflicting flow
  records received from it.

### False positive analysis

- Validate recent device onboarding, migrations, disaster-recovery activation, penetration tests, vulnerability scans,
  and monitoring validation.
- Determine whether `source.ip` represents the exporter itself or a shared NAT, proxy, scanner, or management address.
- Confirm that the correlated source alert is a meaningful behavioral detection rather than an expected administrative
  or discovery event.

### Response and remediation

- If the exporter is unauthorized or compromised, restrict it at the collector boundary and isolate its management
  plane as appropriate.
- Preserve flow records, source alerts, configuration history, authentication events, and network evidence.
- Remove unauthorized export configuration, restore trusted device configuration, rotate affected credentials, and
  review collector ACLs and authentication.
"""
references = [
    "https://www.elastic.co/docs/solutions/security/detect-and-alert/about-building-block-rules",
    "https://www.elastic.co/docs/reference/integrations/netflow",
    "https://www.elastic.co/docs/reference/integrations/goflow2",
    "https://datatracker.ietf.org/doc/html/rfc7011",
    "https://sflow.org/sflow_version_5.txt",
]
risk_score = 73
rule_id = "882c8edc-1e39-4a60-80b2-485491b6c91c"
setup = """## Setup

Enable the building-block rule "First Seen Network Flow Exporter" and detection rules that can identify suspicious
activity with `source.ip` populated. The building-block rule requires decoded NetFlow, IPFIX, or sFlow records from the
Elastic NetFlow (`netflow.log`) or GoFlow2 (`goflow2.sflow`) integration.

The higher-order rule searches Elastic Security alert indices. The correlated source alert must preserve the exporter
address in `source.ip` and preserve `data_stream.namespace`; alerts without either field cannot contribute to this
correlation. Building-block, higher-order, machine-learning, new-terms, threat-match, and deprecated-rule alerts are
excluded as the second event.
"""
severity = "high"
tags = [
    "Domain: Network",
    "Use Case: Network Security Monitoring",
    "Use Case: Threat Detection",
    "Tactic: Defense Evasion",
    "Rule Type: Higher-Order Rule",
    "Data Source: Elastic Security",
    "Data Source: NetFlow",
    "Data Source: GoFlow2",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "esql"

query = '''
FROM .alerts-security.*
| WHERE event.kind == "signal"
    AND data_stream.namespace IS NOT NULL
    AND (
      (kibana.alert.rule.rule_id == "dfe3f626-4224-417e-aff1-8ef9a72c3191" AND observer.ip IS NOT NULL)
      OR
      (source.ip IS NOT NULL
        AND kibana.alert.rule.name IS NOT NULL
        AND kibana.alert.rule.rule_id IS NOT NULL
        AND kibana.alert.rule.rule_id != "dfe3f626-4224-417e-aff1-8ef9a72c3191"
        AND (kibana.alert.risk_score >= 47 OR kibana.alert.severity IN ("medium", "high", "critical"))
        AND KQL("""NOT kibana.alert.building_block_type : *""")
        AND NOT kibana.alert.rule.type IN ("machine_learning", "new_terms", "threat_match")
        AND NOT kibana.alert.rule.name LIKE "Deprecated - *"
        AND NOT KQL("""kibana.alert.rule.tags : "Rule Type: Higher-Order Rule" """))
    )
| EVAL
    Esql.is_exporter_alert = kibana.alert.rule.rule_id == "dfe3f626-4224-417e-aff1-8ef9a72c3191",
    Esql.is_suspicious_source_alert = kibana.alert.rule.rule_id != "dfe3f626-4224-417e-aff1-8ef9a72c3191",
    Esql.correlation_ip = CASE(Esql.is_exporter_alert, observer.ip, source.ip),
    Esql.exporter_alert_timestamp = CASE(Esql.is_exporter_alert, @timestamp, null),
    Esql.suspicious_source_alert_timestamp = CASE(Esql.is_suspicious_source_alert, @timestamp, null),
    Esql.suspicious_rule_name = CASE(Esql.is_suspicious_source_alert, kibana.alert.rule.name, null),
    Esql.suspicious_rule_id = CASE(Esql.is_suspicious_source_alert, kibana.alert.rule.rule_id, null)
| WHERE Esql.correlation_ip IS NOT NULL
| STATS
    Esql.exporter_alert_count = SUM(CASE(Esql.is_exporter_alert, 1, 0)),
    Esql.suspicious_source_alert_count = SUM(CASE(Esql.is_suspicious_source_alert, 1, 0)),
    observer.ip = MAX(CASE(Esql.is_exporter_alert, Esql.correlation_ip, null)),
    source.ip = MAX(CASE(Esql.is_suspicious_source_alert, Esql.correlation_ip, null)),
    Esql.exporter_alert_timestamp = MIN(Esql.exporter_alert_timestamp),
    Esql.suspicious_source_alert_timestamp = MAX(Esql.suspicious_source_alert_timestamp),
    Esql.suspicious_rule_name_values = VALUES(Esql.suspicious_rule_name),
    Esql.suspicious_rule_id_values = VALUES(Esql.suspicious_rule_id)
  BY data_stream.namespace, Esql.correlation_ip
| EVAL Esql.time_diff_seconds = DATE_DIFF(
    "second", Esql.exporter_alert_timestamp, Esql.suspicious_source_alert_timestamp
  )
| WHERE Esql.exporter_alert_count > 0
    AND Esql.suspicious_source_alert_count > 0
    AND Esql.time_diff_seconds >= 0
    AND Esql.time_diff_seconds <= 1800
| KEEP
    data_stream.namespace,
    observer.ip,
    source.ip,
    Esql.correlation_ip,
    Esql.exporter_alert_count,
    Esql.suspicious_source_alert_count,
    Esql.exporter_alert_timestamp,
    Esql.suspicious_source_alert_timestamp,
    Esql.suspicious_rule_name_values,
    Esql.suspicious_rule_id_values,
    Esql.time_diff_seconds
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"


[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[rule.investigation_fields]
field_names = [
    "observer.ip",
    "source.ip",
    "data_stream.namespace",
    "Esql.exporter_alert_timestamp",
    "Esql.suspicious_source_alert_timestamp",
    "Esql.suspicious_rule_name_values",
    "Esql.suspicious_rule_id_values",
    "Esql.time_diff_seconds",
]

[metadata]
creation_date = "2026/06/30"
integration = ["gcp"]
maturity = "production"
updated_date = "2026/07/10"

[rule]
author = ["Elastic"]
description = """
Detects creation or modification of a GKE ClusterRoleBinding that grants the cluster-admin ClusterRole, providing
unrestricted cluster access and enabling rapid privilege escalation or persistence.
"""
index = ["logs-gcp.audit-*"]
language = "kuery"
license = "Elastic License v2"
name = "GKE Cluster-Admin Role Binding Created or Modified"
note = """## Triage and analysis

### Investigating GKE Cluster-Admin Role Binding Created or Modified

Identify who created or changed the binding and which subject received cluster-admin.

### Investigation steps

- Review `client.user.email`, `source.ip`, and `gcp.audit.request` for the bound subject.
- Hunt for secret reads, privileged pod creation, or webhook changes from the same actor or new subject.

### False positives

- Bootstrap and recovery may recreate cluster-admin bindings via `system:apiserver` during control plane reconciliation (excluded).

"""
setup = "The GCP Fleet integration with GKE audit logs enabled is required to be compatible with this rule."
references = [
    "https://cloud.google.com/kubernetes-engine/docs/how-to/role-based-access-control",
    "https://heilancoos.github.io/research/2025/12/16/kubernetes.html#overly-permissive-role-based-access-control",
]
risk_score = 47
rule_id = "16708afb-4904-4d3c-af78-63640a075cb0"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Domain: Kubernetes",
    "Data Source: GCP",
    "Data Source: Google Cloud Platform",
    "Use Case: Threat Detection",
    "Tactic: Persistence",
    "Tactic: Privilege Escalation",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset:gcp.audit and service.name:"k8s.io" and event.outcome:success and
event.action:(
  "io.k8s.authorization.rbac.v1.clusterrolebindings.create" or
  "io.k8s.authorization.rbac.v1.clusterrolebindings.patch" or
  "io.k8s.authorization.rbac.v1.clusterrolebindings.update"
) and gcp.audit.request.kind:"ClusterRoleBinding" and
gcp.audit.resource_name:"rbac.authorization.k8s.io/v1/clusterrolebindings/cluster-admin" and
not client.user.email:"system:apiserver"
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"

[[rule.threat.technique.subtechnique]]
id = "T1098.006"
name = "Additional Container Cluster Roles"
reference = "https://attack.mitre.org/techniques/T1098/006/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"

[[rule.threat.technique.subtechnique]]
id = "T1098.006"
name = "Additional Container Cluster Roles"
reference = "https://attack.mitre.org/techniques/T1098/006/"

[rule.threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "client.user.email",
    "source.ip",
    "user_agent.original",
    "event.action",
    "event.outcome",
    "gcp.audit.resource_name",
    "gcp.audit.request.kind",
    "gcp.audit.request.roleRef.name",
    "gcp.audit.request.subjects.name",
    "data_stream.namespace",
]

[rule]
description = """
Identifies attempts to register for input from the keyboard using RegisterRawInputDevices API. Adversaries may log user
keystrokes to intercept credentials or other information from the user as the user types them.
"""
id = "4dbb9dfb-b3e2-49d7-8919-d6f221526df4"
license = "Elastic License v2"
name = "Keystroke Input Capture via RegisterRawInputDevices"
os_list = ["windows"]
reference = [
    "https://attack.mitre.org/techniques/T1056/001/",
    "https://learn.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-registerrawinputdevices",
    "https://www.cyberbit.com/endpoint-security/hawkeye-malware-keylogging-technique/",
    "https://www.elastic.co/security-labs/protecting-your-devices-from-information-theft-keylogger-protection",
]
version = "1.0.15"

query = '''
api where
 process.Ext.api.name == "RegisterRawInputDevices" and not process.code_signature.status : "trusted" and
 process.Ext.api.parameters.usage == "KEYBOARD" and
 process.Ext.api.parameters.flags like "*INPUTSINK*" and process.thread.Ext.call_stack_summary : "?*" and
 process.thread.Ext.call_stack_final_user_module.hash.sha256 != null and process.executable != null and
 not process.thread.Ext.call_stack_final_user_module.path :
                         ("*\\program files*", "*\\windows\\system32\\*", "*\\windows\\syswow64\\*",
                          "*\\windows\\systemapps\\*",
                          "*\\users\\*\\appdata\\local\\*\\kumospace.exe",
                          "*\\users\\*\\appdata\\local\\microsoft\\teams\\current\\teams.exe") and 
 not process.executable : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe") and 
 process.thread.Ext.call_stack_final_user_module.hash.sha256 in
                                       ("2e2dc7f8da5e1cc8510e0b3724dc4448a693f3fb76891cea7be5973aa9d94034",
                                        "9e039448344e4f70122a9cb2416cf282d26033ec8a81b3084c8e7076e3242d8b")
'''

min_endpoint_version = "8.12.0"
optional_actions = []
reputation = true
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1056"
name = "Input Capture"
reference = "https://attack.mitre.org/techniques/T1056/"
[[threat.technique.subtechnique]]
id = "T1056.001"
name = "Keylogging"
reference = "https://attack.mitre.org/techniques/T1056/001/"



[threat.tactic]
id = "TA0009"
name = "Collection"
reference = "https://attack.mitre.org/tactics/TA0009/"

[internal]
min_endpoint_version = "8.12.0"

[rule]
description = """
Identifies attempts to change memory protection of NTDLL from an unsigned final user module, this module is often
targeted by malware for functions unhooking.
"""
id = "29688edf-a003-42e4-8d79-c958cffce9fc"
license = "Elastic License v2"
name = "NTDLL Memory Protection Change via Unsigned DLL"
os_list = ["windows"]
version = "1.0.5"

query = '''
api where process.Ext.api.name == "VirtualProtect" and process.Ext.token.integrity_level_name != "low" and
 process.Ext.api.metadata.target_address_name == "ntdll.dll" and
 process.thread.Ext.call_stack_final_user_module.hash.sha256 != null and process.Ext.api.parameters.size > 4096 and
 _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.trusted == false or $entry.exists == false) and
 not _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info: ("*ntdll.dll!LdrLoadDll*", "*ntdll.dll!LdrUnloadDll*", "*ntdll.dll!LdrShutdownProcess*")) and
 not process.thread.Ext.call_stack_final_user_module.path like
                                          ("?:\\program files\\*",
                                           "?:\\program files (x86)\\*",
                                           "?:\\windows\\assembly\\nativeimages_*",
                                           "?:\\windows\\syswow64\\cyinjct.dll",
                                           "?:\\windows\\system32\\tmumh\\*\\tmmon64.dll",
                                           "?:\\windows\\winsxs\\*\\mfc??.dll") and
 not process.thread.Ext.call_stack_final_hook_module.path like ("c:\\program files\\*", "c:\\program files (x86)\\*") and
 not (process.Ext.api.parameters.size == 4096 and
     _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info: ("*chrome_elf.dll!GetInstallDetailsPayload*", "*chrome_elf.dll!DumpHungProcessWithPtype_ExportThunk*", "*mozglue.dll!??MAwakeTimeStamp*", "*firefox.exe!TargetNtUnmapViewOfSection*", "*firefox.exe!IsSandboxedProcess*"))) and
 not process.thread.Ext.call_stack_final_user_module.protection_provenance_path like ("c:\\program files\\*", "c:\\program files (x86)\\*", "c:\\windows\\assembly\\nativeimages_*") and
 not _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry,
                  $entry.trusted == true and $entry.subject_name in ("Carbon Black, Inc.", "MUSARUBRA US LLC", "Microsoft Windows Hardware Compatibility Publisher", "Kaspersky Lab JSC", "AO Kaspersky Lab", "Palo Alto Networks (Netherlands) B.V.", "G DATA CyberDefense AG")) and
 not process.thread.Ext.call_stack_final_user_module.hash.sha256 in ("b27b7d2ac43c6c734aa9e370afc987704f4bd8ba11bc5199a8c3bc5b07b2600c",
                                                                    "85f238fb7ace3cbdf7c29c72b01307c440f13491b07a509cbc5b9f257a637164",
                                                                    "55f3206cf9bb092aef6a61508683144afe21ddf930686433bb233e2e233be38c",
                                                                    "b152de9afc373bba831dc9c1b137668462ae6d46ccd46815f2ffcc7f1bfc7056",
                                                                    "991042b4a0eb46fdfddb6f9118d046dc1ff500743ff01a8584ad5e73c092b188",
                                                                    "7f6f5855d4968235163d75c62ab82e8fdc7cf3c83de34e3c5a0666e2d08a0001",
                                                                    "b27b7d2ac43c6c734aa9e370afc987704f4bd8ba11bc5199a8c3bc5b07b2600c",
                                                                    "ddcbecf2cd2cd4904cf21e3db40c6a918df0ed3b258473fc5d6e2688dee72696",
                                                                    "18d1bae077da62bb5cf5bfa6a6c5c38ac9ade57f098ea2b357fab477e85f1c25",
                                                                    "a0c662a21ba02f2b997907ad113097856916fc3683331e24d065e864213ff379",
                                                                    "16f1b19c60f80ae33c5b4fef4acd38454f11bbc965dcdd622db0d1c5bb65b931",
                                                                    "023983f43bb97fd6c909df5012c142140650eff6921a9b0db33c0f558402988d",
                                                                    "01f46f2401df22465bf2b3f3d59343d14dcf6aada6747e386f1adb965af7b3c3",
                                                                    "680dc9c393faad3851147bcbb3c5a1fd29b8ed61ddf1bf416f4415132d85f784",
                                                                    "d59c12264054c84d5e988d4c340fe9d83d2f646f240b5fd52b9bf8564b0dd164",
                                                                    "9becd39f90077a5ab064681c0a1be139d15be9ce434bacd48cd1dc894d3911cb",
                                                                    "bb7b4184ea19f248c34f6fb670d37e3062f1648aacc98e009cec1a58c78e8871",
                                                                    "8df8b4e86a9e96baa92bcd9cf1fca189565a90d815630df899d72ac6eefcf852",
                                                                    "1902241e12adbdf40ed4dafc410ccbcf8e07fce117d540dabbc2f75ff371f5be",
                                                                    "7117da40b5cd080575863842e2281576f9b6d1d41cb250690a13aef9cc6436c5",
                                                                    "e06439cebb8280c46d0aa538ec89b4af4659e7f2915c5787b239871c9dfd65a5",
                                                                    "f5f02a15419cbad6b0ea2eb9e986d25f13d23abf8e6b8b32ccf18e427f6c48aa",
                                                                    "2496a1ad22ed1917037e5d6747e5401c50612cb0e3c9cf32a3a1233ebb53207c",
                                                                    "4b0b5c6e06f7df6dd89dcb027200f6f86b7b4d7dc274a095a82bb609d8cdbe38",
                                                                    "05b70f473543119cd831f9fc1cd2fbcdc7a3e1938c8a5cb208a2dda017433a7d",
                                                                    "967189adfbc889fde89aafc867f7a1f02731f8592cf6fd5a4ace1929213e2e13",
                                                                    "f216ea8efb5b3bb9ad3d938fb9ac07e3b8f78c2c92faab03d2c468d0b6798a5a",
                                                                    "dea0369456f49fcb4fc5afa42fffb69ae1e19ea238d18e32d9c498d69ab12c69",
                                                                    "4d40d7064907cf932abae04ef8864ca7288af6993e1ff9e958bd9ac756f62808",
                                                                    "bfe6fd180245ec727fbc538b11ed59d714b3d794d4fadb2dc76d8a019422066a",
                                                                    "90c2f3d2bceafb50fb4468bda7a68025f12a23673f151839cae56e2b1ce0a74d",
                                                                    "3c3c4dcec5b68807e874455021a133b5f5945af86cb9149efed146065201039a",
                                                                    "cb7ab3788d10940df874acd97b1821bbb5ee4a91f3eec11982bb5bf7a3c96443")
'''

min_endpoint_version = "8.16.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1620"
name = "Reflective Code Loading"
reference = "https://attack.mitre.org/techniques/T1620/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.16.0"

[metadata]
creation_date = "2026/02/25"
integration = ["system", "windows"]
maturity = "production"
updated_date = "2026/05/04"

[rule]
author = ["Elastic"]
description = """
Identifies a user account that normally logs in with high volume from one source IP suddenly logging in from a different
source IP. This pattern (one IP with many successful logons, another IP with very few) may indicate account takeover
or use of stolen credentials from a new location.
"""
from = "now-15m"
interval = "14m"
language = "esql"
license = "Elastic License v2"
name = "Potential Account Takeover - Logon from New Source IP"
note = """## Triage and analysis

### Investigating Potential Account Takeover - Logon from New Source IP

An account that historically logs in many times from a single source IP (e.g. usual workstation or VPN) and then shows successful logons from exactly one other IP with a low count may indicate credential compromise and use from a new location (account takeover).

### Possible investigation steps

- Confirm with the account owner whether they recently logged in from the new source IP or from a new device/location.
- Check the new source IP for reputation, geography, and whether it is expected (e.g. corporate VPN range vs unknown).
- Correlate with other alerts for the same user or source IP (e.g. logon failures, password changes, MFA changes).
- Review timeline: if the "new" IP logon is very recent compared to the high-count IP, treat as higher priority.

### False positive analysis

- Legitimate use from a second device (e.g. new laptop, second office, VPN from travel) can produce exactly two IPs with one IP having few logons. Tune threshold (e.g. max_logon >= 100) or add exclusions for known VPN/remote ranges if needed.
- Service or shared accounts that are used from multiple jump hosts or scripts may show two IPs; consider excluding known service accounts.

### Response and remediation

- If takeover is confirmed: force password reset, revoke sessions, and enable or enforce MFA. Disable or lock the account until the user verifies identity.
- Investigate how credentials may have been compromised (phishing, breach, endpoint) and address the vector.
"""

setup = """## Setup

Audit Logon must be enabled to generate the events used by this rule.
Setup instructions: https://ela.st/audit-logon
"""

references = ["https://attack.mitre.org/techniques/T1078/"]
risk_score = 47
rule_id = "a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d"
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Privilege Escalation",
    "Data Source: Windows Security Event Logs",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "esql"

query = '''
from logs-system.security*, logs-windows.forwarded*, winlogbeat-* metadata _id, _version, _index
| where event.category == "authentication" and event.action == "logged-in" and winlog.event_id == "4624" and 
        event.outcome == "success" and winlog.logon.type in ("Network", "RemoteInteractive") and 
		source.ip is not null and source.ip != "127.0.0.1" and not to_string(source.ip) like "*::*" and not user.name like "*$"
| stats logon_count = COUNT(*), host_names = VALUES(host.name) by user.name, user.id, source.ip
| stats 
    Esql.max_logon = MAX(logon_count),
    Esql.min_logon = MIN(logon_count),
    Esql.unique_host_count = COUNT_DISTINCT(host_names),
    Esql.host_name_values = VALUES(host_names),
    Esql.source_ip_values = VALUES(source.ip),
    Esql.count_distinct_source_ip = COUNT_DISTINCT(source.ip) by user.name, user.id

// high count of logons is often associated with service account tied to a specific source.ip, if observed in use from a new source.ip it's suspicious
| where Esql.max_logon >= 1000 and (Esql.min_logon >= 1 and Esql.min_logon <= 5) and Esql.count_distinct_source_ip == 2 and Esql.unique_host_count >= 2
| eval source.ip = MV_FIRST(Esql.source_ip_values), host.name = MV_FIRST(Esql.host_name_values)
| KEEP user.name, user.id, host.name, source.ip, Esql.*
'''

[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"


[rule.threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[metadata]
creation_date = "2026/01/07"
integration = ["endpoint"]
maturity = "production"
updated_date = "2026/05/04"

[rule]
author = ["Elastic"]
description = """
Detects the creation or modification of a mandatory user profile hive (NTUSER.MAN) by an unusual process.
Adversaries may abuse Windows mandatory profiles by dropping a malicious NTUSER.MAN file containing
pre-populated persistence-related registry keys. On the next user logon, Windows loads the registry hive
from NTUSER.MAN, causing embedded persistence mechanisms to activate without directly modifying the live
registry. This technique can evade traditional registry-based monitoring and indicate a stealthy
persistence attempt.
"""
from = "now-9m"
index = ["logs-endpoint.events.file-*"]
language = "eql"
license = "Elastic License v2"
name = "Potential Persistence via Mandatory User Profile"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Potential Persistence via Mandatory User Profile

Windows supports *mandatory user profiles*, which rely on the `NTUSER.MAN` registry hive instead of the standard `NTUSER.DAT`. When a user logs in, Windows loads registry settings directly from this file. Adversaries can exploit this behavior by crafting or modifying an `NTUSER.MAN` file with embedded persistence mechanisms (for example, `Run` keys, logon scripts, or policy-based execution). Because the registry hive is loaded at logon, this technique may bypass traditional registry modification telemetry and provide stealthy persistence.

This rule detects the creation or modification of `NTUSER.MAN` files in user profile directories by non-system processes, which is uncommon in legitimate environments.

### Possible investigation steps

- Review the process responsible for creating or modifying NTUSER.MAN, focusing on process.name, process.executable, and parent process relationships. Creation or modification by scripting engines, LOLBins, or unsigned binaries is highly suspicious.
- Examine the file path to confirm whether the .MAN profile corresponds to a legitimate mandatory profile or an unexpected user directory.
- Extract and analyze the contents of the NTUSER.MAN file by loading it offline into a registry viewer. Look for persistence-related keys such as:
  - Run / RunOnce
  - UserInitMprLogonScript
  - Policy-based execution keys
- Determine which user account(s) are configured to use the mandatory profile and whether this aligns with expected administrative behavior.
- Correlate the event with preceding file writes, downloads, or process executions** that may have staged the malicious hive.
- Review recent logon activity for users tied to the mandatory profile to identify whether persistence may have already been triggered.
- Check threat intelligence sources for known malware or tooling that abuses mandatory profiles or offline registry hive manipulation.

### False positive analysis

- Legitimate enterprise environments may use mandatory profiles in controlled scenarios such as kiosks, training systems, or shared workstations.
- Administrative tools or scripts used during system imaging or profile provisioning may legitimately create NTUSER.MAN files.
- Profile migrations or backup/restore operations could trigger benign modifications.

Validate whether the modifying process, user, and timing align with known administrative activity before dismissing the alert.

### Response and remediation

- Isolate the affected host if malicious persistence is suspected to prevent further execution.
- Prevent further logons for users associated with the suspicious mandatory profile until analysis is complete.
- Remove or replace the malicious NTUSER.MAN file with a known-good version.
- Inspect the loaded registry hive for additional persistence mechanisms and remove any unauthorized entries.
- Conduct a full endpoint scan to identify additional payloads or lateral movement.
- Review endpoint detection coverage to ensure offline registry hive and profile-based persistence** techniques are monitored.
- Escalate confirmed malicious activity to incident response and document findings to improve future detections."""
references = ["https://deceptiq.com/blog/ntuser-man-registry-persistence"]
risk_score = 47
rule_id = "0e42f920-047d-4568-b961-2a50db6c4713"
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Persistence",
    "Data Source: Elastic Defend",
    "Resources: Investigation Guide",
]
timeline_id = "4d4c0b59-ea83-483f-b8c1-8c360ee53c5c"
timeline_title = "Comprehensive File Timeline"
timestamp_override = "event.ingested"
type = "eql"

query = '''
file where host.os.type == "windows" and
 event.type in ("creation", "change") and user.id != "S-1-5-18" and
 file.name : "NTUSER.MAN" and file.path : "?:\\Users\\*.MAN"
'''

setup = """## Setup

This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.

Setup instructions: https://ela.st/install-elastic-defend
"""


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1547"
name = "Boot or Logon Autostart Execution"
reference = "https://attack.mitre.org/techniques/T1547/"

[[rule.threat.technique.subtechnique]]
id = "T1547.001"
name = "Registry Run Keys / Startup Folder"
reference = "https://attack.mitre.org/techniques/T1547/001/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1112"
name = "Modify Registry"
reference = "https://attack.mitre.org/techniques/T1112/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[metadata]
creation_date = "2026/01/24"
integration = ["endpoint", "crowdstrike", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2026/03/24"

[rule]
author = ["Elastic"]
description = """
Identifies potential exploitation of a Telnet remote authentication bypass vulnerability (CVE-2026-24061) in GNU Inetutils
telnetd. The vulnerability allows unauthenticated access by supplying a crafted `-f <username>` value via the `USER` environment
variable, resulting in a login process spawned with elevated privileges.
"""
from = "now-9m"
index = [
    "endgame-*",
    "logs-endpoint.events.process*",
    "logs-crowdstrike.fdr*",
    "logs-sentinel_one_cloud_funnel.*",
]
language = "eql"
license = "Elastic License v2"
name = "Potential Telnet Authentication Bypass (CVE-2026-24061)"
note = """## Triage and analysis

### Investigating Potential Telnet Authentication Bypass (CVE-2026-24061)

CVE-2026-24061 is a critical authentication bypass vulnerability affecting `telnetd` in GNU Inetutils. By supplying a
crafted `-f root` value through the USER environment variable, a remote attacker can bypass authentication and gain
unauthorized root-level access. This exploit results in the `login` process being executed with attacker-controlled
arguments, typically spawned by `telnetd` or via `xinetd`.

This rule detects suspicious `login` executions associated with Telnet services that include the `-f` flag, which
forces authentication as a specified user and is indicative of exploitation attempts.

#### Possible investigation steps

- Investigate the process execution chain (parent process tree) for the suspicious `login` process.
  - Confirm whether `login` was spawned by `telnetd` or indirectly via `xinetd`.
  - Review the command-line arguments passed to `login`, paying special attention to the presence of `-f` and any
    attempts to authenticate as `root` or other privileged users.
- Validate whether the Telnet service is expected to be running on the affected host.
  - Telnet is deprecated and should rarely be exposed or enabled in modern environments.
- Investigate post-authentication activity originating from the compromised session.
  - Look for command execution, file modifications, privilege escalation attempts, or persistence mechanisms.
  - Review network connections initiated after the suspicious login event.
- Check for additional alerts or suspicious activity on the same host within the past 48 hours.
- Determine whether the system is running a vulnerable version of GNU Inetutils telnetd.

### False positive analysis

- Legitimate use of the `-f` flag with `login` is extremely rare and typically restricted to trusted, local workflows.
- False positives may occur in highly customized or legacy environments where Telnet is still in use.
- Any benign occurrences should be carefully validated and documented before adding exceptions.

### Related Rules

- Telnet Authentication Bypass via User Environment Variable - "eb3150eb-e9fb-4a64-a0fc-aa66cdd35632"

### Response and remediation

- Immediately isolate the affected host to prevent further unauthorized access or lateral movement.
- Terminate suspicious Telnet sessions and collect volatile forensic data where possible.
- Investigate for signs of credential access, persistence, or follow-on exploitation.
- Patch or upgrade GNU Inetutils to a version that addresses CVE-2026-24061.
- Disable the Telnet service entirely if it is not explicitly required.
- Enforce the use of secure alternatives such as SSH for remote administration.
- Rotate credentials for any accounts that may have been exposed or accessed.
- Perform a full system integrity review and antimalware scan.
- Update hardening, monitoring, and logging policies to improve detection of legacy remote access abuse.
"""
references = [
    "https://www.safebreach.com/blog/safebreach-labs-root-cause-analysis-and-poc-exploit-for-cve-2026-24061/",
    "https://security-tracker.debian.org/tracker/CVE-2026-24061"
]
risk_score = 99
rule_id = "ab7795cc-0e0b-4f9d-a934-1f17a58f869a"
severity = "critical"
tags = [
    "Domain: Endpoint",
    "OS: Linux",
    "Use Case: Threat Detection",
    "Tactic: Initial Access",
    "Tactic: Lateral Movement",
    "Resources: Investigation Guide",
    "Use Case: Vulnerability",
    "Data Source: Elastic Defend",
    "Data Source: Elastic Endgame",
    "Data Source: Crowdstrike",
    "Data Source: SentinelOne"
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
process where host.os.type == "linux" and event.type == "start" and
  event.action in ("exec", "exec_event", "start", "ProcessRollup2", "executed") and
  process.name == "login" and process.parent.name in ("telnetd", "xinetd") and process.args : "-*f*"
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1190"
name = "Exploit Public-Facing Application"
reference = "https://attack.mitre.org/techniques/T1190/"

[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1210"
name = "Exploitation of Remote Services"
reference = "https://attack.mitre.org/techniques/T1210/"

[rule.threat.tactic]
id = "TA0008"
name = "Lateral Movement"
reference = "https://attack.mitre.org/tactics/TA0008/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1068"
name = "Exploitation for Privilege Escalation"
reference = "https://attack.mitre.org/techniques/T1068/"

[rule.threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"