Elastic rules: 0i

[metadata]
creation_date = "2025/04/11"
integration = ["aws"]
maturity = "production"
min_stack_version = "9.3.0"
min_stack_comments = "Changing min stack to 9.3.0, the latest minimum supported version for 9.X releases."
updated_date = "2026/07/20"

[rule]
author = ["Elastic"]
description = """
This rule identifies potentially suspicious activity by detecting instances where a single IAM user's temporary session
token is accessed from multiple IP addresses within a short time frame. Such behavior may suggest that an adversary has
compromised temporary credentials and is utilizing them from various locations. To enhance detection accuracy and
minimize false positives, the rule incorporates criteria that evaluate unique IP addresses, user agents, cities, and
networks. These additional checks help distinguish between legitimate distributed access patterns and potential
credential misuse. Detected activities are classified into different types based on the combination of unique
indicators, with each classification assigned a fidelity score reflecting the likelihood of malicious behavior. High
fidelity scores are given to patterns most indicative of threats, such as multiple unique IPs, networks, cities, and
user agents. Medium and low fidelity scores correspond to less severe patterns, enabling security teams to effectively
prioritize alerts.
"""
false_positives = [
    """
    Highly distributed environments (e.g., globally deployed automation or edge nodes) may cause a single IAM user to
    appear from multiple IPs. Review the geolocation, network context, and user agent patterns to rule out benign use.
    This rule automatically excludes console login sessions, reducing false positives from legitimate console-based access across VPN or network changes.
    """,
]
from = "now-32m"
interval = "15m"
language = "esql"
license = "Elastic License v2"
name = "AWS Access Token Used from Multiple Addresses"
note = """## Triage and analysis

### Investigating AWS Access Token Used from Multiple Addresses

Access tokens are bound to a single user. Usage from multiple IP addresses may indicate the token was stolen and used elsewhere. By correlating this with additional detection criteria like multiple user agents, different cities, and different networks, we can improve the fidelity of the rule and help to eliminate false positives associated with expected behavior, like dual-stack IPV4/IPV6 usage.

### Possible investigation steps

- **Identify the IAM User**: Examine the `aws.cloudtrail.user_identity.arn` stored in `user_id` and correlate with the `source.ips` stored in `ip_list` and `unique_ips` count to determine how widely the token was used.
- **Correlate Additional Detection Context**: Examine `activity_type` and `fidelity_score` to determine additional cities, networks or user agents associated with the token usage.
- **Determine Access Key Type**: Examine the `access_key_id` to determine whether the token is short-term (beginning with ASIA) or long-term (beginning with AKIA).
- **Check Recent MFA Events**: Determine whether the user recently enabled MFA, registered devices, or assumed a role using this token.
- **Review Workload Context**: Confirm whether the user was expected to be active across multiple cities, networks or user agent environments.
- **Trace Adversary Movement**: Pivot to related actions (e.g., `s3:ListBuckets`, `iam:ListUsers`, `sts:GetCallerIdentity`) to track further enumeration.

### False positive analysis

- Automation frameworks that rotate through multiple IPs or cloud functions with dynamic egress IPs may cause this alert to fire.
- Confirm geolocation and workload context before escalating.

### Response and remediation

- **Revoke the Token**: Disable or rotate the IAM credentials and invalidate the temporary session token.
- **Audit the Environment**: Look for signs of lateral movement or data access during the token's validity.
- **Strengthen Controls**: Require MFA for high-privilege actions, restrict access via policy conditions (e.g., IP range or device).

### Additional information

- [IAM Long-Term Credentials](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html)
- [STS Temporary Credentials](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp.html)
- [Using MFA with Temporary Credentials](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_enable-regions.html)
- [AWS Threat Detection Use Cases](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-standards-fsbp-controls.html)
"""
references = ["https://www.sygnia.co/blog/sygnia-investigation-bybit-hack/"]
risk_score = 47
rule_id = "0d92d30a-5f3e-4b71-bc3d-4a0c4914b7e0"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Data Source: AWS",
    "Data Source: Amazon Web Services",
    "Data Source: AWS IAM",
    "Data Source: AWS CloudTrail",
    "Tactic: Initial Access",
    "Use Case: Identity and Access Audit",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "esql"

query = '''
from logs-aws.cloudtrail* metadata _id, _version, _index
| where data_stream.dataset == "aws.cloudtrail"
  and aws.cloudtrail.user_identity.arn is not null
  and aws.cloudtrail.user_identity.type == "IAMUser"
  and source.ip is not null
  and aws.cloudtrail.user_identity.access_key_id is not null
  and not aws.cloudtrail.session_credential_from_console == "true"
  and not (
    user_agent.original like "*Terraform*" or
    user_agent.original like "*Ansible*" or
    user_agent.original like "*Pulumi*"
  )
  and `source.as.organization.name` != "AMAZON-AES"
  and not ((
    `source.as.organization.name` == "AMAZON-02" and aws.cloudtrail.event_category == "Data"))
  and event.provider not in (
    "health.amazonaws.com", "monitoring.amazonaws.com", "notifications.amazonaws.com",
    "ce.amazonaws.com", "cost-optimization-hub.amazonaws.com",
    "servicecatalog-appregistry.amazonaws.com", "securityhub.amazonaws.com", 
    "account.amazonaws.com", "budgets.amazonaws.com", "freetier.amazonaws.com", "support.amazonaws.com",
    "support-console.amazonaws.com"
  )

| eval
  Esql.time_window_date_trunc = date_trunc(30 minutes, @timestamp),
  Esql.aws_cloudtrail_user_identity_arn = aws.cloudtrail.user_identity.arn,
  Esql.aws_cloudtrail_user_identity_access_key_id = aws.cloudtrail.user_identity.access_key_id,
  Esql.source_ip = source.ip,
  Esql.user_agent_original = user_agent.original,
  Esql.source_ip_string = to_string(source.ip),
  Esql.source_ip_user_agent_pair = concat(Esql.source_ip_string, " - ", user_agent.original),
  Esql.source_ip_city_pair = concat(Esql.source_ip_string, " - ", source.geo.city_name),
  Esql.source_geo_city_name = source.geo.city_name,
  Esql.source_network_org_name = `source.as.organization.name`,
  Esql.source_ip_network_pair = concat(Esql.source_ip_string, "-", `source.as.organization.name`),
  Esql.event_timestamp = @timestamp,
  Esql.data_stream_namespace = data_stream.namespace

| stats
  Esql.event_action_values = values(event.action),
  Esql.event_provider_count_distinct = count_distinct(event.provider),
  Esql.event_provider_values = values(event.provider),
  Esql.aws_cloudtrail_user_identity_access_key_id_values = values(Esql.aws_cloudtrail_user_identity_access_key_id),
  Esql.aws_cloudtrail_user_identity_arn_values = values(Esql.aws_cloudtrail_user_identity_arn),
  Esql.source_ip_values = values(Esql.source_ip),
  Esql.user_agent_original_values = values(Esql.user_agent_original),
  Esql.source_ip_user_agent_pair_values = values(Esql.source_ip_user_agent_pair),
  Esql.source_geo_city_name_values = values(Esql.source_geo_city_name),
  Esql.source_ip_city_pair_values = values(Esql.source_ip_city_pair),
  Esql.source_network_org_name_values = values(Esql.source_network_org_name),
  Esql.source_ip_network_pair_values = values(Esql.source_ip_network_pair),
  Esql.source_ip_count_distinct = count_distinct(Esql.source_ip),
  Esql.user_agent_original_count_distinct = count_distinct(Esql.user_agent_original),
  Esql.source_geo_city_name_count_distinct = count_distinct(Esql.source_geo_city_name),
  Esql.source_network_org_name_count_distinct = count_distinct(Esql.source_network_org_name),
  Esql.data_stream_namespace_values = values(Esql.data_stream_namespace),
  Esql.timestamp_first_seen = min(Esql.event_timestamp),
  Esql.timestamp_last_seen = max(Esql.event_timestamp),
  Esql.event_count = count()
  by Esql.time_window_date_trunc, Esql.aws_cloudtrail_user_identity_access_key_id

| eval
  Esql.activity_type = case(
    Esql.source_ip_count_distinct >= 2 and Esql.source_network_org_name_count_distinct >= 2 and Esql.source_geo_city_name_count_distinct >= 2 and Esql.user_agent_original_count_distinct >= 2, "multiple_ip_network_city_user_agent",
    Esql.source_ip_count_distinct >= 2 and Esql.source_network_org_name_count_distinct >= 2 and Esql.source_geo_city_name_count_distinct >= 2, "multiple_ip_network_city",
    Esql.source_ip_count_distinct >= 2 and Esql.source_geo_city_name_count_distinct >= 2, "multiple_ip_and_city",
    Esql.source_ip_count_distinct >= 2 and Esql.source_network_org_name_count_distinct >= 2, "multiple_ip_and_network",
    Esql.source_ip_count_distinct >= 2 and Esql.user_agent_original_count_distinct >= 2, "multiple_ip_and_user_agent",
    "normal_activity"
  ),
  Esql.activity_fidelity_score = case(
    Esql.activity_type == "multiple_ip_network_city_user_agent", "high",
    Esql.activity_type == "multiple_ip_network_city", "high",
    Esql.activity_type == "multiple_ip_and_city", "medium",
    Esql.activity_type == "multiple_ip_and_network", "medium",
    Esql.activity_type == "multiple_ip_and_user_agent", "low"
  )

| keep
  Esql.time_window_date_trunc,
  Esql.activity_type,
  Esql.activity_fidelity_score,
  Esql.event_count,
  Esql.timestamp_first_seen,
  Esql.timestamp_last_seen,
  Esql.aws_cloudtrail_user_identity_arn_values,
  Esql.aws_cloudtrail_user_identity_access_key_id_values,
  Esql.event_provider_count_distinct,
  Esql.event_action_values,
  Esql.event_provider_values,
  Esql.source_ip_values,
  Esql.user_agent_original_values,
  Esql.source_ip_user_agent_pair_values,
  Esql.source_geo_city_name_values,
  Esql.source_ip_city_pair_values,
  Esql.source_network_org_name_values,
  Esql.source_ip_network_pair_values,
  Esql.source_ip_count_distinct,
  Esql.user_agent_original_count_distinct,
  Esql.source_geo_city_name_count_distinct,
  Esql.source_network_org_name_count_distinct,
  Esql.data_stream_namespace_values

| where Esql.activity_fidelity_score == "high" and Esql.event_provider_count_distinct > 1

// this rule only alerts for "high" fidelity cases, to broaden the rule scope to include all activity
// change the final condition to 
// | where Esql.activity_type != "normal_activity" and Esql.event_provider_count_distinct > 1

'''

[rule.investigation_fields]
field_names = [
      "Esql.timestamp_first_seen",
      "Esql.timestamp_last_seen",
      "Esql.activity_type",
      "Esql.activity_fidelity_score",
      "Esql.event_count",
      "Esql.aws_cloudtrail_user_identity_arn_values",
      "Esql.aws_cloudtrail_user_identity_access_key_id_values",
      "Esql.event_action_values",
      "Esql.event_provider_values",
      "Esql.source_ip_values",
      "Esql.user_agent_original_values",
      "Esql.source_ip_user_agent_pair_values",
      "Esql.source_geo_city_name_values",
      "Esql.source_ip_city_pair_values",
      "Esql.source_network_org_name_values",
      "Esql.source_ip_network_pair_values",
      "Esql.source_ip_count_distinct",
      "Esql.user_agent_original_count_distinct",
      "Esql.source_geo_city_name_count_distinct",
      "Esql.source_network_org_name_count_distinct",
      "Esql.data_stream_namespace_values"
]


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"

[[rule.threat.technique.subtechnique]]
id = "T1078.004"
name = "Cloud Accounts"
reference = "https://attack.mitre.org/techniques/T1078/004/"

[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"

[[rule.threat.technique.subtechnique]]
id = "T1078.004"
name = "Cloud Accounts"
reference = "https://attack.mitre.org/techniques/T1078/004/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[metadata]
creation_date = "2026/06/18"
integration = ["aws"]
maturity = "production"
updated_date = "2026/06/18"

[rule]
author = ["Elastic"]
description = """
Identifies the modification of an AWS Lambda layer permission policy to grant another AWS account, an AWS Organization, or
the public the ability to use a layer version. Lambda layers package code and dependencies that are loaded into the
execution environment of any function that references them. Sharing a layer with an external account or with everyone can
leak proprietary code or secrets bundled in the layer, and can serve as a supply-chain mechanism whereby downstream
functions load attacker-influenced code. Layer sharing should be infrequent and deliberate, so newly granted external or
public access warrants review.
"""
false_positives = [
    """
    Organizations sometimes publish shared utility layers across their own accounts or to partners intentionally. Verify
    the layer, the granted principal in `aws.cloudtrail.request_parameters`, and the principal in
    `aws.cloudtrail.user_identity.arn` against approved sharing practices. Known shared layers and distribution accounts
    can be excluded after validation.
    """,
]
from = "now-6m"
index = ["logs-aws.cloudtrail-*"]
interval = "5m"
language = "kuery"
license = "Elastic License v2"
name = "AWS Lambda Layer Shared Externally"
note = """## Triage and analysis

### Investigating AWS Lambda Layer Shared Externally

AWS Lambda layers bundle code and dependencies that are loaded into the runtime of any function referencing them. `AddLayerVersionPermission` modifies a layer version's permission policy to allow another AWS account, an organization, or the public (`principal=*`) to use it. This can expose code or secrets contained in the layer and can act as a supply-chain vector for any function that consumes the layer.

This rule detects successful `AddLayerVersionPermission` calls. Public grants (`principal=*`) are the highest concern; specific cross-account grants should be validated against approved sharing.

### Possible investigation steps

- Inspect `aws.cloudtrail.request_parameters` for the `layerName`, version number, `action`, and the granted `principal` (a specific account id, an organization id, or `*` for public).
- Identify the actor in `aws.cloudtrail.user_identity.arn` and `aws.cloudtrail.user_identity.type`, and review `source.ip` and `user_agent.original` to understand how the grant was made.
- Determine whether the layer contains sensitive code or secrets and whether external sharing was intended and approved.
- Identify which functions reference the layer and whether the grant could influence their runtime.
- Correlate with other activity by the same principal, such as layer publication (`PublishLayerVersion`) or function changes.

### False positive analysis

- Shared utility layers distributed across an organization's accounts or to partners are a legitimate pattern. Confirm the grant is approved and exclude known distribution accounts or layers on `aws.cloudtrail.user_identity.arn` or the layer name after validation.

### Response and remediation

- If the sharing is unauthorized, remove the layer permission (`RemoveLayerVersionPermission`) and rotate any secrets that may have been exposed in the layer.
- Review which accounts accessed or copied the layer while the grant was in place and assess potential exposure.
- Rotate or restrict credentials for the principal if compromise is suspected, and constrain `lambda:AddLayerVersionPermission` to a small set of trusted roles.

### Additional information

- [AWS Lambda layers](https://docs.aws.amazon.com/lambda/latest/dg/chapter-layers.html)
- [AddLayerVersionPermission API](https://docs.aws.amazon.com/lambda/latest/api/API_AddLayerVersionPermission.html)
"""
references = [
    "https://docs.aws.amazon.com/lambda/latest/dg/chapter-layers.html",
    "https://docs.aws.amazon.com/lambda/latest/api/API_AddLayerVersionPermission.html",
]
risk_score = 47
rule_id = "e00c7862-43f1-48fd-aa30-950db838eded"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Data Source: AWS",
    "Data Source: Amazon Web Services",
    "Data Source: AWS Lambda",
    "Use Case: Threat Detection",
    "Tactic: Execution",
    "Tactic: Defense Evasion",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset: "aws.cloudtrail"
    and event.provider: "lambda.amazonaws.com"
    and event.action: AddLayerVersionPermission*
    and event.outcome: "success"
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1648"
name = "Serverless Execution"
reference = "https://attack.mitre.org/techniques/T1648/"


[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1578"
name = "Modify Cloud Compute Infrastructure"
reference = "https://attack.mitre.org/techniques/T1578/"
[[rule.threat.technique.subtechnique]]
id = "T1578.005"
name = "Modify Cloud Compute Configurations"
reference = "https://attack.mitre.org/techniques/T1578/005/"



[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user_agent.original",
    "source.ip",
    "aws.cloudtrail.user_identity.arn",
    "aws.cloudtrail.user_identity.type",
    "aws.cloudtrail.user_identity.access_key_id",
    "aws.cloudtrail.user_identity.session_context.session_issuer.arn",
    "aws.cloudtrail.request_parameters",
    "aws.cloudtrail.response_elements",
    "event.action",
    "event.outcome",
    "cloud.account.id",
    "cloud.region",
]

[metadata]
creation_date = "2026/05/15"
integration = ["azure"]
maturity = "production"
updated_date = "2026/05/15"

[rule]
author = ["Elastic"]
description = """
Detects successful Microsoft Entra ID audit events for Register device where additional details indicate an Azure AD join
and the recorded user agent is not one of the common native registration clients (Dsreg, DeviceRegistrationClient, or
Dalvik-based Android enrollment). Legitimate Windows and standard mobile enrollment flows often present predictable
user-agent strings; unexpected clients may reflect scripted registration, third-party tooling, or adversary-driven device
registration used for persistence or token abuse. Baseline approved provisioning tools and MDM integrations before tuning.
"""
false_positives = [
    """
    Custom device management agents, OEM enrollment clients, or updated Microsoft clients that use new user-agent strings
    may match. Add exclusions for known `azure.auditlogs.properties.userAgent` values or enrollment programs after review.
    """,
]
from = "now-9m"
index = ["logs-azure.auditlogs-*"]
language = "kuery"
license = "Elastic License v2"
name = "Entra ID Register Device with Unusual User Agent (Azure AD Join)"
note = """## Triage and analysis

### Investigating Entra ID Register Device with Unusual User Agent (Azure AD Join)

Review `azure.auditlogs.properties.initiated_by.user.userPrincipalName`, source IP fields on the audit event,
`azure.auditlogs.properties.target_resources.0.display_name` for the device name, and
`azure.correlation_id` for related audit entries.

Compare `azure.auditlogs.properties.userAgent` to your organization's standard Autopilot, Intune, and Windows enrollment
clients.

### Possible investigation steps

- Confirm whether the user intentionally joined a device and whether the user agent matches a known provisioning package.
- Pivot to `azure.signinlogs` for the same principal and timeframe for risky sign-ins or token broker activity.
- Search for other `Register device` events from the same IP or user agent across the tenant.

### Response and remediation

- If malicious, remove the device in Entra ID, revoke refresh and primary refresh tokens for the user, and reset credentials per policy.
- Tighten device registration and join controls via Conditional Access and device compliance policies.
"""
references = [
    "https://learn.microsoft.com/en-us/entra/identity/devices/concept-directory-join",
    "https://github.com/dirkjanm/ROADtools",
]
risk_score = 47
rule_id = "d4695889-0410-4e7b-a4aa-59be525a11a6"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Domain: Identity",
    "Data Source: Azure",
    "Data Source: Microsoft Entra ID",
    "Data Source: Microsoft Entra ID Audit Logs",
    "Use Case: Threat Detection",
    "Tactic: Persistence",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"
query = '''
data_stream.dataset:"azure.auditlogs" and event.action:"Register device" and
event.outcome:(success or Success) and
azure.auditlogs.properties.userAgent:(* and not (Dsreg* or DeviceRegistrationClient or Dalvik*)) and
azure.auditlogs.properties.additional_details.value:"Azure AD join"
'''

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "event.action",
    "event.outcome",
    "azure.auditlogs.properties.userAgent",
    "azure.auditlogs.properties.additional_details.value",
    "azure.auditlogs.properties.initiated_by.user.userPrincipalName",
    "azure.auditlogs.properties.initiated_by.user.ipAddress",
    "azure.auditlogs.properties.target_resources.0.display_name",
    "azure.auditlogs.properties.target_resources.0.id",
    "azure.correlation_id",
]

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"

[[rule.threat.technique.subtechnique]]
id = "T1098.005"
name = "Device Registration"
reference = "https://attack.mitre.org/techniques/T1098/005/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[rule]
description = """
Identifies the execution of a script with an unusual file extension by Windows Script Host processes (cscript or
wscript).
"""
id = "b76c0a04-b504-4a2f-a0cf-b4175a2f3eea"
license = "Elastic License v2"
name = "Execution of a Windows Script with Unusual File Extension"
os_list = ["windows"]
version = "1.0.36"

query = '''
process where event.action == "start" and
 (process.pe.original_file_name :"wscript.exe" or process.name : "wscript.exe") and process.parent.name != null and
 process.args : ("-e:*", "/e:*", "//e:*") and
 not process.command_line : ("*.js*", "*.vb*", "*.wsf*", "*.wsh*", "*.wsc*", "*.tmp*") and
 /* Issue #286 */
 not process.parent.executable : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe") and 
 not process.command_line : ("*:\\Program Files\\*", "*:\\Program Files (x86)\\*", "*\\Windows\\system32\\spool\\DRIVERS\\*") and
 not (process.name : "cscript.exe" and process.args : "C:\\PGM_TC~1\\DHL_FR~1\\xls2csv.bat") and
 not (process.args : "\\\\*" and process.args_count >= 3) and
 not (process.args : "/mts/wav/adf" and process.args : "/emf") and
 not (process.parent.args : "D:\\*.cmd" and process.args : "https://app.*:444/api/Banner") and
 not (process.parent.name : "cmd.exe" and process.parent.command_line : ("\"C:\\windows\\system32\\cmd.exe\" ", "cmd ")) and
 not (process.parent.name : "cmd.exe" and
       process.parent.args :
            ("C:\\ProgramData\\NinjaRMMAgent\\scripting\\customscript_gen_?.bat-ninjascript.bat",
             "C:\\Storage\\VisualStudioProjects\\connect_wise_script\\install_speerity.bat",
             "C:\\PGM_TC~1\\DHL_FR~1\\xls2csv.bat",
             "C:\\MBS\\UTIL\\repl.bat",
             "C:\\MBS\\UTIL\\PBSCOVER.BAT",
             "M:\\sendkeys.bat Mayer",
             "F:\\wamp64\\www\\centralstores\\cronjobs\\*.bat"))
'''

min_endpoint_version = "7.15.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.005"
name = "Visual Basic"
reference = "https://attack.mitre.org/techniques/T1059/005/"

[[threat.technique.subtechnique]]
id = "T1059.007"
name = "JavaScript"
reference = "https://attack.mitre.org/techniques/T1059/007/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "7.15.0"

[metadata]
creation_date = "2023/04/03"
integration = ["endpoint", "windows", "system"]
maturity = "production"
updated_date = "2026/06/23"

[rule]
author = ["Elastic"]
description = """
Adversaries may install legitimate remote monitoring and management (RMM) tools or remote access software on compromised endpoints for command-and-control (C2), persistence, and execution of native commands. This rule detects when a process is started whose name or code signature matches commonly abused RMM or remote access tools. New Terms type: the host.id and process.name pair has not been seen before within the configured 7-day history window.
"""
from = "now-9m"
index = [
    "logs-endpoint.events.process-*",
    "endgame-*",
    "winlogbeat-*",
    "logs-windows.forwarded*",
    "logs-windows.sysmon_operational-*",
    "logs-system.security*",
]
language = "kuery"
license = "Elastic License v2"
name = "First Time Seen Remote Monitoring and Management Tool"
references = [
    "https://thedfirreport.com/2023/04/03/malicious-iso-file-leads-to-domain-wide-ransomware/",
    "https://github.com/redcanaryco/surveyor/blob/master/definitions/remote-admin.json",
    "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-025a",
    "https://www.cisa.gov/sites/default/files/2025-06/aa25-163a-ransomware-simplehelp-rmm-compromise.pdf",
    "https://lolrmm.io/",
]
risk_score = 47
rule_id = "6e1a2cc4-d260-11ed-8829-f661ea17fbcc"
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Command and Control",
    "Resources: Investigation Guide",
    "Data Source: Elastic Defend",
    "Data Source: Elastic Endgame",
    "Data Source: Windows Security Event Logs",
    "Data Source: Sysmon",
]
timestamp_override = "event.ingested"
type = "new_terms"

query = '''
host.os.type: "windows" and
    event.category: "process" and event.type: "start" and
    (
        process.code_signature.subject_name : (
            "Action1 Corporation" or
            "Aeroadmin LLC" or
            "AeroAdmin LLC" or
            "AmidaWare LLC" or
            "Ammyy LLC" or
            "AnyDesk Software GmbH" or
            "AOMEI International Network Limited" or
            "Atera Networks Ltd" or
            "AWERAY PTE. LTD." or
            "BeamYourScreen GmbH" or
            "Bomgar Corporation" or
            "BreakingSecurity.net" or
            "ConnectWise, Inc." or
            "ConnectWise, LLC" or
            "Connectwise, LLC" or
            "Devolutions Inc" or
            "Devolutions inc." or
            "DOMOTZ INC." or
            "DUC FABULOUS CO.,LTD" or
            "DWSNET OÜ" or
            "DWSNET srl" or
            "Electronic Team, Inc." or
            "Famatech Corp." or
            "FleetDeck Inc" or
            "GlavSoft LLC" or
            "GlavSoft LLC." or
            "GoTo Technologies USA, LLC" or
            "Hefei Pingbo Network Technology Co. Ltd" or
            "IDrive, Inc." or
            "Impero Solutions Limited" or
            "IMPERO SOLUTIONS LIMITED" or
            "Instant Housecall" or
            "ISL Online Ltd." or
            "JumpCloud Inc" or
            "Level Software, Inc." or
            "LogMeIn, Inc." or
            "LUNIXAR SAS DE CV" or
            "MMSOFT Design Ltd." or
            "Monitoring Client" or
            "MSPBytes Corp" or
            "MSPBytes, Corp." or
            "N-ABLE TECHNOLOGIES LTD" or
            "Nanosystems S.r.l." or
            "NetSupport Ltd" or
            "NetSupport Ltd." or
            "NETSUPPORT LTD." or
            "NinjaOne LLC" or
            "NinjaRMM, LLC" or
            "Open Source Developer, Huabing Zhou" or
            "Parallels International GmbH" or
            "philandro Software GmbH" or
            "Pro Softnet Corporation" or
            "PURSLANE" or
            "RealVNC" or
            "RealVNC Limited" or
            "REMOTE UTILITIES PTE. LTD." or
            "Remote Utilities LLC" or
            "Rocket Software, Inc." or
            "Rsupport Co., Ltd." or
            "SAFIB" or
            "ScreenConnect Client" or
            "Servably, Inc." or
            "Servably Inc." or
            "ShowMyPC INC" or
            "SimpleHelp Ltd" or
            "Splashtop Inc." or
            "Superops Inc." or
            "Tailscale Inc." or
            "TeamViewer" or
            "TeamViewer GmbH" or
            "TeamViewer Germany GmbH" or
            "Techinline Limited" or
            "uvnc bvba" or
            "Yakhnovets Denis Aleksandrovich IP" or
            "Zhou Huabing" or
            "ZOHO Corporation Private Limited"
        ) or

        process.name.caseless : (
            AA_v*.exe or
            "AcronisCyberProtectConnectAgent.exe" or
            "AeroAdmin.exe" or
            "AgentMon.exe" or
            "AnyDesk.exe" or
            "apc_Admin.exe" or
            "apc_host.exe" or
            "AteraAgent.exe" or
            aweray_remote*.exe or
            "AweSun.exe" or
            "B4-Service.exe" or
            "BASupSrvc.exe" or
            "bomgar-scc.exe" or
            "CagService.exe" or
            "CloudRaCmd.exe" or
            "CloudRaSd.exe" or
            "CloudRaService.exe" or
            ConnectWiseControl*.exe or
            "connectwisecontrol.client.exe" or
            "domotzagent.exe" or
            "domotz-windows-x64-10.exe" or
            "dwagsvc.exe" or
            "DWRCC.exe" or
            "dwrcs.exe" or
            "dwrcst.exe" or
            fleetdeck_commander*.exe or
            "g2aservice.exe" or
            "getscreen.exe" or
            "GoToAssistService.exe" or
            "GoToResolveProcessChecker.exe" or
            "GoToResolveRemoteControl.exe" or
            "GoToResolveService.exe" or
            "GoToResolveTerminal.exe" or
            "GoToResolveUnattended.exe" or
            "gotohttp.exe" or
            "helpwire.exe" or
            "ImmyAgent.exe" or
            "ImmyBot.Agent.Ephemeral.exe" or
            "ImmyUpdater.exe" or
            "ImperoClientSVC.exe" or
            "ImperoServerSVC.exe" or
            "ISLLight.exe" or
            "ISLLightClient.exe" or
            "jumpcloud-agent.exe" or
            "komari.exe" or
            "komari-agent.exe" or
            "level.exe" or
            "lmi_rescue.exe" or
            "lmi_rescue_srv.exe" or
            "LMIIgnition.exe" or
            "LogMeIn.exe" or
            "ltsvc.exe" or
            "ltsvcmon.exe" or
            "lttray.exe" or
            "Lunixar.exe" or
            "LunixarRemote.exe" or
            "LunixarUpdater.exe" or
            "LvAgent.exe" or
            "ManageEngine_Remote_Access_Plus.exe" or
            "MeshAgent.exe" or
            "Mikogo-Service.exe" or
            "nezha-agent.exe" or
            "NinjaRMMAgent.exe" or
            "NinjaRMMAgentPatcher.exe" or
            "ninjarmm-cli.exe" or
            "parsec.exe" or
            "PService.exe" or
            "quickassist.exe" or
            "r_server.exe" or
            "radmin.exe" or
            "radmin3.exe" or
            "rcengmgru.exe" or
            "RCClient.exe" or
            "rcmgrsvc.exe" or
            "RCService.exe" or
            "Remote Support.exe" or
            "RemoteDesktopManager.exe" or
            "Remotely_Agent.exe" or
            "Remotely_Desktop.exe" or
            "RemotePC.exe" or
            "RemotePCDesktop.exe" or
            "RemotePCService.exe" or
            "remoteview.exe" or
            "rfusclient.exe" or
            "RMM.Agent.exe" or
            "ROMServer.exe" or
            "ROMViewer.exe" or
            "RPCSuite.exe" or
            "rserver3.exe" or
            "rustdesk.exe" or
            "rutserv.exe" or
            "rutview.exe" or
            "rvagent.exe" or
            "rvagtray.exe" or
            "saazapsc.exe" or
            ScreenConnect*.exe or
            "ScreenConnect.ClientService.exe" or
            "session_win.exe" or
            "simplegatewayservice.exe" or
            "simplehelpcustomer.exe" or
            "smpcview.exe" or
            "spclink.exe" or
            "Splashtop-streamer.exe" or
            "SplashtopSOS.exe" or
            "spsrv.exe" or
            "sragent.exe" or
            "SRService.exe" or
            "srmanager.exe" or
            "srserver.exe" or
            "strwinclt.exe" or
            "Supremo.exe" or
            "SupremoService.exe" or
            "Syncro.App.Runner.exe" or
            "Syncro.Installer.exe" or
            "Syncro.Overmind.Service.exe" or
            "Syncro.Service.exe" or
            "SyncroLive.Agent.exe" or
            "SyncroLive.Agent.Runner.exe" or
            "SyncroLive.Service.exe" or
            "tacticalrmm.exe" or
            "tailscale.exe" or
            "tailscaled.exe" or
            "teamviewer.exe" or
            "teamviewer_desktop.exe" or
            "teamviewer_service.exe" or
            "TiAgent.exe" or
            "TiClientCore.exe" or
            "ToDesk_Service.exe" or
            "ToolsIQ.exe" or
            "TSClient.exe" or
            "tvn.exe" or
            "tvnserver.exe" or
            "tvnviewer.exe" or
            "twingate.exe" or
            UltraVNC*.exe or
            UltraViewer*.exe or
            "Velociraptor.exe" or
            "vncserver.exe" or
            "vncviewer.exe" or
            "winvnc.exe" or
            "winwvc.exe" or
            "ZA_Access.exe" or
            "za_connect.exe" or
            "Zaservice.exe" or
            "ZMAgent.exe" or
            "ZohoMeeting.exe" or
            "zohotray.exe" or
            "ZohoURS.exe" or
            "ZohoURSService.exe"
        )
  ) and
  not (process.pe.original_file_name : ("G2M.exe" or "Updater.exe" or "powershell.exe") and process.code_signature.subject_name : "LogMeIn, Inc.")
'''


note = """## Triage and analysis

### Investigating First Time Seen Remote Monitoring and Management Tool

#### Possible investigation steps

- Validate the alert-local process event and identify the matched RMM artifact.
  - Focus: `host.name`, `host.id`, `process.name`, `process.executable`, `process.code_signature.subject_name`.
  - Review the exact process entity on the alerted host with $investigate_0
  - Implication: The alert proves one Windows process start from the supported process data sources where the `host.id` and `process.name` pair is first seen within the 7-day new terms window; it does not prove the remote session or legitimacy. Close only if the exact host, account, process name, executable, signer, and support or deployment window match a validated change record or verified owner confirmation; otherwise continue.
- Determine why this RMM process is new for the host.
  - Focus: `host.id`, `process.name`, `process.executable`, `process.command_line`, `process.hash.sha256`.
  - Review same-host executions across the rule history window with $investigate_1
  - Implication: Repeated executions clustered around the same deployment or support window can support a bounded benign explanation only when the exact executable, command line, hash, host, and account match the recovered business context. A new hash, renamed executable, unexpected arguments, or executions outside that window keep the case suspicious.
- Reconstruct the parent process and logon context that launched the tool.
  - Focus: `process.parent.name`, `process.parent.executable`, `process.parent.command_line`, `process.Ext.session_info.logon_type`, `user.name`.
  - Review the parent process entity on the same host with $investigate_2
  - Implication: A parent and session that match the same validated change record and account owner confirmation can bound the activity to one workflow. A launch from user-download, browser, archive, script, or unrelated service context is suspicious for social engineering or staged access.
- Inspect endpoint artifacts and child behavior before broader scoping.
  - Focus: `process.entity_id`, `process.Ext.ancestry`, `process.args`, `process.working_directory`, `process.Ext.token.elevation_level`.
  - Implication: Recover child process, service, file, registry, and persistence evidence from endpoint timeline or live host data before interpretation because those artifact fields are not guaranteed on the alert. Child execution, persistence, unusual working directories, or elevated token use by the matched RMM process supports escalation; absence of recoverable artifacts does not prove benign.
- If local process, parent, and endpoint-artifact evidence is suspicious or incomplete, broaden scope for the RMM hypothesis.
  - Focus: `host.id`, `user.name`, `process.name`, `process.hash.sha256`, `process.code_signature.subject_name`.
  - Review same host and account activity with $investigate_3
  - Review the same executable hash across available process events with $investigate_4
  - Implication: The hypothesis is RMM staging or reuse across hosts or accounts; matching hash activity, related alerts, or repeated account use should drive host and account scoping plus evidence preservation. No related alerts or hash matches only limits currently observed spread and does not prove benign; exact matches limited to the validated host, account, and time window may support closure after the earlier evidence aligns.

Disposition: Escalate suspicious RMM artifacts, launch chains, or expanded scope; close only when alert-local evidence and recovered context prove one expected support or deployment workflow on the exact host and account; preserve and escalate mixed or incomplete cases for more context before final disposition.

### False positive analysis

- Potential benign cases include first deployment of a remote support tool, first use after host rebuild, a product update that changes `process.name`, or a one-time support session only when alert-local and recovered process evidence match `host.id`, `user.name`, `process.name`, `process.executable`, `process.code_signature.subject_name`, `process.code_signature.trusted`, `process.pe.original_file_name`, and `process.hash.sha256` when available, and that evidence aligns with a verified owner confirmation or validated change record for the observed support or deployment window.
- Do not close on the tool name, signer, executable path, or lack of related alerts alone. Escalate when artifacts indicate social engineering, an unexpected parent or session, a renamed executable, hash mismatch, or unbounded account or host spread.
- Scope exceptions only to durable future-alert fields that match the validated benign workflow, using `host.id`, `user.name`, `process.name`, `process.executable`, `process.code_signature.subject_name`, `process.code_signature.trusted`, `process.pe.original_file_name`, and `process.hash.sha256` when available. Do not scope exceptions by prose-only groups such as support teams or known RMM activity; preserve and escalate mixed or incomplete cases instead of creating broad exclusions.

### Response and remediation

- Preserve or export case evidence plus volatile process, memory, executable, or file-system artifacts that could be lost before isolation, process termination, cleanup, or other disruptive action.
- For confirmed malicious activity, scope first by reviewing the matched process, parent and child processes, persistence artifacts, same-hash executions, related alerts, and account activity across affected hosts.
- After evidence capture and initial scoping, isolate affected hosts or disable active remote access paths when containment is required to prevent continued access.
- After containment decisions and evidence review, terminate malicious RMM processes, remove persistence, clean up dropped files or services, revoke active sessions, and reset credentials exposed through the RMM session or related activity.
- If social engineering led to the remote access, validate the user interaction, collect relevant communications or download sources when available, and include affected accounts in credential review.
- Document confirmed indicators and logging or detection gaps for the responsible detection or logging owners after scoping and containment.
"""

setup = """## Setup

This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.

Setup instructions: https://ela.st/install-elastic-defend

### Additional data sources

This rule also supports the following third-party data sources. For setup instructions, refer to the links below:

- [Sysmon Event ID 1 - Process Creation](https://ela.st/sysmon-event-1-setup)
- [Windows Process Creation Logs](https://ela.st/audit-process-creation)
"""

[rule.investigation_fields]
field_names = [
    "host.id",
    "host.name",
    "user.name",
    "process.entity_id",
    "process.name",
    "process.executable",
    "process.command_line",
    "process.hash.sha256",
    "process.code_signature.subject_name",
    "process.code_signature.trusted",
    "process.pe.original_file_name",
    "process.parent.entity_id",
    "process.parent.name",
    "process.parent.executable",
    "process.parent.command_line",
]

[[transform.investigate]]
label = "Matched process context"
description = "Find the exact alerted process entity on the same host around the alert window."
providers = [
    [
        { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
        { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" },
    ],
]
relativeFrom = "now-1h"
relativeTo = "now"

[[transform.investigate]]
label = "Same host process name history"
description = "Find same-host executions of the matched process name across the rule history window."
providers = [
    [
        { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
        { excluded = false, field = "process.name", queryType = "phrase", value = "{{process.name}}", valueType = "string" },
    ],
]
relativeFrom = "now-7d/d"
relativeTo = "now"

[[transform.investigate]]
label = "Parent process activity"
description = "Recover events for the parent process entity that launched the matched RMM process."
providers = [
    [
        { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
        { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.parent.entity_id}}", valueType = "string" },
    ],
]
relativeFrom = "now-24h"
relativeTo = "now"

[[transform.investigate]]
label = "Host account activity"
description = "Review activity by the same account on the same host before broader scoping."
providers = [
    [
        { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
        { excluded = false, field = "user.name", queryType = "phrase", value = "{{user.name}}", valueType = "string" },
    ],
]
relativeFrom = "now-48h/h"
relativeTo = "now"

[[transform.investigate]]
label = "Executable hash scope"
description = "Find other executions of the same executable hash when local evidence is suspicious or unresolved."
providers = [
    [
        { excluded = false, field = "process.hash.sha256", queryType = "phrase", value = "{{process.hash.sha256}}", valueType = "string" },
    ],
]
relativeFrom = "now-7d/d"
relativeTo = "now"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1219"
name = "Remote Access Tools"
reference = "https://attack.mitre.org/techniques/T1219/"

[[rule.threat.technique.subtechnique]]
id = "T1219.002"
name = "Remote Desktop Software"
reference = "https://attack.mitre.org/techniques/T1219/002/"

[rule.threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[rule.new_terms]
field = "new_terms_fields"
value = ["host.id", "process.name"]
[[rule.new_terms.history_window_start]]
field = "history_window_start"
value = "now-7d"

[metadata]
creation_date = "2026/07/13"
integration = ["gcp"]
maturity = "production"
updated_date = "2026/07/13"

[rule]
author = ["Elastic"]
description = """
Detects allowed updates or patches to the pods/ephemeralcontainers subresource on GKE by a non-system identity.
Ephemeral containers are commonly used for debugging (kubectl debug) but can also be abused to inject tooling into a
running pod, access mounted secrets, and execute commands in the target pod context. Attackers with sufficient RBAC may
use ephemeral containers to escalate privileges, move laterally, or establish persistence without deploying a new
workload.
"""
false_positives = [
    """
    Cluster operators or SREs may legitimately use ephemeral containers for debugging production workloads. Baseline
    approved admin identities and tune exclusions for known automation.
    """,
]
from = "now-6m"
index = ["logs-gcp.audit-*"]
language = "kuery"
license = "Elastic License v2"
name = "GKE Ephemeral Container Added to Pod"
note = """## Triage and analysis

### Investigating GKE Ephemeral Container Added to Pod

Ephemeral containers allow adding a container to an existing pod for troubleshooting. When abused, they can gain
interactive access to a workload, read sensitive files, and run tools that were not present in the original image.

### Possible investigation steps

- Review `client.user.email`, `source.ip`, and `user_agent.original` and confirm the identity is authorized to use
  ephemeral containers.
- Inspect `gcp.audit.resource_name` to identify the targeted pod and owning workload.
- If request bodies are captured, review the ephemeral container image, command, and securityContext for privilege
  indicators.
- Correlate with follow-on audit activity such as pod exec, secret reads, TokenRequest, or RBAC modifications.

### False positive analysis

- Approved on-call debugging with `kubectl debug` may match. Allowlist known admin identities after review.

### Response and remediation

- If unauthorized, remove excessive RBAC that grants update or patch on pods/ephemeralcontainers and rotate exposed
  credentials.
- Quarantine or redeploy impacted workloads and hunt for additional compromised pods or identities.

"""
setup = """
The GCP Fleet integration with GKE audit logs enabled is required to be compatible with this rule.
"""
references = [
    "https://kubernetes.io/docs/concepts/workloads/pods/ephemeral-containers/",
]
risk_score = 47
rule_id = "d52e2418-978c-4184-9eab-e084af1f76b7"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Domain: Kubernetes",
    "Data Source: GCP",
    "Data Source: Google Cloud Platform",
    "Use Case: Threat Detection",
    "Tactic: Privilege Escalation",
    "Tactic: Execution",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset:gcp.audit and service.name:"k8s.io" and event.outcome:success and
event.action:(
  "io.k8s.core.v1.pods.ephemeralcontainers.update" or
  "io.k8s.core.v1.pods.ephemeralcontainers.patch"
) and not client.user.email:(
  system\:node\:* or
  system\:serviceaccount\:kube-system\:*
)
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1611"
name = "Escape to Host"
reference = "https://attack.mitre.org/techniques/T1611/"

[rule.threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1609"
name = "Container Administration Command"
reference = "https://attack.mitre.org/techniques/T1609/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "client.user.email",
    "source.ip",
    "user_agent.original",
    "event.action",
    "event.outcome",
    "gcp.audit.resource_name",
    "gcp.audit.request",
    "data_stream.namespace",
]

[metadata]
creation_date = "2026/05/14"
integration = ["google_workspace"]
maturity = "production"
updated_date = "2026/05/14"

[rule]
author = ["Elastic"]
description = """
Detects the first time a Google Workspace user successfully signs in from a given source ASN within a 14-day historical
window. Most users have a stable set of egress ASNs (home ISP, corporate VPN, mobile carrier). A new ASN for a user is a
meaningful anomaly as it surfaces ISP changes and travel, but also catches AiTM phishing-kit relays whose egress ASN was
never previously associated with the user.
"""
false_positives = [
    """
    Legitimate first-time use of a new network: ISP change, new VPN provider, travel to a region using a different
    mobile carrier, new home office.
    """,
    """
    Carrier-grade NAT or load-balanced corporate egress that occasionally routes through alternate ASNs.
    """
]
from = "now-130m"
index = ["logs-google_workspace.login*", "logs-google_workspace.token*"]
interval = "10m"
language = "kuery"
license = "Elastic License v2"
name = "Google Workspace User Login with Unusual ASN"
note = """## Triage and analysis

### Investigating Google Workspace User Login with Unusual ASN

This rule emits when a user signs in successfully from an ASN that has not been observed for that user in the prior 14 days. Most legitimate users cluster around a small number of egress ASNs (corporate VPN, home ISP, primary mobile carrier). New ASNs are not all malicious, but new ASNs that match hosting providers, anonymization networks, or geographies inconsistent with the user's profile are high-fidelity suspicious.

### Possible investigation steps

- Inspect `source.as.organization.name` and `source.as.number`. Categorize: residential ISP (low concern absent other indicators), corporate VPN (validate against tenant baseline), mobile carrier (validate by region), hosting provider / VPS (Clouvider, Host Telecom, Alibaba, OVH, M247, DigitalOcean, Vultr) - high concern for interactive sign-ins.
- Inspect `source.geo.country_name` and `source.geo.region_name`. New geo + known travel is fine. New geo + unexpected travel needs user confirmation.
- Pull the user's full `google_workspace.login` history across the lookback. Is this a one-off sign-in or sustained activity from the new ASN?
- Cross-reference `logs-google_workspace.token` for any `event.action: "authorize"` events from the same `user.email` immediately following the sign-in. An OAuth grant minted from the new ASN within seconds of sign-in is the AiTM kit signature.
- Cross-reference `logs-google_workspace.device` for any `DEVICE_REGISTER_UNREGISTER_EVENT` with `account_state: "REGISTERED"` from the same user near the same time. New device + new ASN is a stronger compromise signal than either alone.
- Confirm with the user whether they signed in from a new network intentionally.

### False positive analysis

- Users on rotating VPN exits, hotspot sharing, or coffee-shop Wi-Fi will produce new ASNs legitimately.
- Mobile users in unfamiliar regions (travel, conference attendance) will geo-resolve to new ASNs.
- Engineering teams using cloud workstations (Cloud Workstations, Codespaces, etc.) will egress through hosting ASNs even for legitimate sign-ins. Tune by allowlisting your tenant's known cloud-workstation egress.
- For high-noise tenants, expand `history_window_start` to 14 days to reduce false-positive rate at the cost of slower-to-fire detection for genuinely new ASNs.

### Response and remediation

- If the new ASN is a hosting provider and the user has not knowingly used such a network: treat as likely AiTM. Suspend user, revoke OAuth tokens, reset password, clear recovery info, sign out all sessions.
- If the new ASN is benign (verified ISP change, travel, new VPN): add to the user's baseline. Consider broader hardening (require MFA re-verification on new-network sign-in via Workspace Context-Aware Access).
"""
references = [
    "https://any.run/malware-trends/tycoon/",
    "https://www.elastic.co/security-labs/google-workspace-attack-surface-part-one",
]
risk_score = 21
rule_id = "1f489c86-d9c4-40de-9316-931721ca9b45"
setup = """## Setup

### Important Information Regarding Google Workspace Event Lag Times
- Google Workspace Reports API ingestion lag commonly runs in the 30-minute to 3-hour range. This rule's 130-minute lookback gives partial coverage but will miss events delayed beyond that envelope.
- See https://support.google.com/a/answer/7061566 for Google's published guidance on event availability.
- Check your integration's Login lag time to ensure it is configured to meet the needs of this rule.
"""
severity = "low"
tags = [
    "Domain: Cloud",
    "Domain: Identity",
    "Data Source: Google Workspace",
    "Data Source: Google Workspace Audit Logs",
    "Data Source: Google Workspace User Log Events",
    "Use Case: Threat Detection",
    "Use Case: Identity and Access Audit",
    "Tactic: Initial Access",
    "Tactic: Credential Access",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "new_terms"

query = '''
data_stream.dataset: ("google_workspace.login" or "google_workspace.token") and
    event.action: ("login_success" or "authorize") and
    source.as.number: * and
    user.email: *
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"
[[rule.threat.technique.subtechnique]]
id = "T1078.004"
name = "Cloud Accounts"
reference = "https://attack.mitre.org/techniques/T1078/004/"



[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1528"
name = "Steal Application Access Token"
reference = "https://attack.mitre.org/techniques/T1528/"

[[rule.threat.technique]]
id = "T1557"
name = "Adversary-in-the-Middle"
reference = "https://attack.mitre.org/techniques/T1557/"


[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.email",
    "user.name",
    "source.ip",
    "source.as.number",
    "source.as.organization.name",
    "source.geo.country_name",
    "source.geo.region_name",
    "google_workspace.login.type",
    "google_workspace.login.challenge_method",
]

[rule.new_terms]
field = "new_terms_fields"
value = ["user.email", "source.as.number"]
[[rule.new_terms.history_window_start]]
field = "history_window_start"
value = "now-7d"

[rule]
description = """
Identifies attempts to enumerate the state of keyboard keys and the call is coming from Python, AutoIt, NodeJs or LUA
libraries. Adversaries may log user keystrokes to intercept credentials or other information from the user as the user
types them.
"""
id = "ca00acf2-6e1b-4823-8fdd-7339ffa7079f"
license = "Elastic License v2"
name = "Keystrokes Input Capture from a Suspicious Module"
os_list = ["windows"]
reference = [
    "https://attack.mitre.org/techniques/T1056/001/",
    "https://www.elastic.co/security-labs/protecting-your-devices-from-information-theft-keylogger-protection",
]
version = "1.0.9"

query = '''
api where process.executable != null and
 (
  (process.Ext.api.name == "GetAsyncKeyState" and process.Ext.api.metadata.background_callcount >= 400 and
  process.Ext.api.metadata.ms_since_last_keyevent >= 100) or

  (process.Ext.api.name == "SetWindowsHookEx" and process.Ext.api.parameters.hook_type == "WH_KEYBOARD_LL")
  ) and
  (
   process.thread.Ext.call_stack_final_user_module.name : ("libffi*.dll", "python*.dll", "luacom.dll", "lua?.?.dll", "lua??.dll") or 
   process.code_signature.subject_name in ("AutoIt Consulting Ltd", "OpenJS Foundation")
  ) and

  not (process.code_signature.subject_name == "NV Access Limited" and process.code_signature.trusted == true) and
  not process.executable : ("C:\\Program Files\\Python39\\pythonw.exe", "C:\\Program Files\\WSL\\msrdc.exe") and
  not process.thread.Ext.call_stack_final_user_module.hash.sha256 in ("eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a", "0817a2a657a24c0d5fbb60df56960f42fc66b3039d522ec952dab83e2d869364", "f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081")
'''

min_endpoint_version = "8.12.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1056"
name = "Input Capture"
reference = "https://attack.mitre.org/techniques/T1056/"
[[threat.technique.subtechnique]]
id = "T1056.001"
name = "Keylogging"
reference = "https://attack.mitre.org/techniques/T1056/001/"



[threat.tactic]
id = "TA0009"
name = "Collection"
reference = "https://attack.mitre.org/tactics/TA0009/"

[internal]
min_endpoint_version = "8.12.0"

[metadata]
creation_date = "2025/02/21"
integration = ["endpoint"]
maturity = "production"
updated_date = "2026/03/24"

[rule]
author = ["Elastic"]
description = """
This rule detects the execution of kill, pkill, and killall commands on Linux systems. These commands are used to terminate
processes on a system. Attackers may use these commands to kill security tools or other processes to evade detection or
disrupt system operations.
"""
from = "now-9m"
index = ["logs-endpoint.events.process*"]
language = "kuery"
license = "Elastic License v2"
name = "Kill Command Execution"
note = """ ## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Kill Command Execution
In Linux environments, commands like kill, pkill, and killall are essential for managing processes, allowing users to terminate them as needed. However, adversaries can exploit these commands to disable security tools or disrupt operations, aiding in evasion tactics. The detection rule identifies such misuse by monitoring process execution events, specifically targeting these commands to flag potential threats.

### Possible investigation steps

- Review the process execution event details to identify the user account associated with the kill, pkill, or killall command execution. This can help determine if the action was performed by a legitimate user or a potential adversary.
- Examine the parent process of the command execution to understand the context in which the kill command was initiated. This can provide insights into whether the command was part of a script or an interactive session.
- Check the target process IDs (PIDs) that were terminated by the kill command to assess if critical or security-related processes were affected, which might indicate malicious intent.
- Investigate the timing and frequency of the command execution to identify patterns or anomalies, such as repeated or scheduled executions, which could suggest automated or scripted activity.
- Correlate the event with other security alerts or logs from the same host around the same timeframe to identify any related suspicious activities or indicators of compromise.

### False positive analysis

- Routine system maintenance tasks may trigger the rule when administrators use kill commands to manage processes. To handle this, create exceptions for known maintenance scripts or processes by identifying their unique attributes, such as user or command line arguments.
- Automated scripts or monitoring tools that use kill commands for legitimate purposes, like restarting services, can cause false positives. Exclude these by specifying the script names or paths in the detection rule.
- Development environments where developers frequently use kill commands during testing can lead to alerts. Consider excluding processes executed by specific user accounts associated with development activities.
- System updates or package management tools might use kill commands as part of their operation. Identify these processes and exclude them based on their parent process or command line patterns.
- Backup or recovery operations that involve stopping services may trigger the rule. Exclude these by recognizing the specific backup software or service names involved.

### Response and remediation

- Immediately isolate the affected Linux system from the network to prevent further malicious activity or lateral movement by the attacker.
- Identify and terminate any unauthorized or suspicious processes that were started around the time of the alert, focusing on those that may have been targeted by the kill, pkill, or killall commands.
- Review system logs and process execution history to determine the origin of the kill command execution and assess whether it was initiated by a legitimate user or a compromised account.
- Restore any terminated security tools or critical processes to ensure the system's defenses are fully operational.
- Conduct a thorough scan of the affected system using updated antivirus or endpoint detection tools to identify and remove any additional malware or persistence mechanisms.
- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if other systems may be affected.
- Implement additional monitoring and alerting for similar command executions across the network to enhance detection and response capabilities for future incidents.
"""
risk_score = 21
rule_id = "f391d3fd-219b-42a3-9ba9-2f66eb0155aa"
setup = """## Setup

This rule requires data coming in from Elastic Defend.

### Elastic Defend Integration Setup
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.

#### Prerequisite Requirements:
- Fleet is required for Elastic Defend.
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).

#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
- Go to the Kibana home page and click "Add integrations".
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
- Click "Add Elastic Defend".
- Configure the integration name and optionally add a description.
- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
- Click "Save and Continue".
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
"""
severity = "low"
tags = [
    "Domain: Endpoint",
    "OS: Linux",
    "Use Case: Threat Detection",
    "Tactic: Defense Evasion",
    "Data Source: Elastic Defend",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "new_terms"
query = '''
event.category:process and host.os.type:linux and event.type:start and event.action:exec and
process.name:(kill or pkill or killall) and not (
  process.args:("-HUP" or "-SIGUSR1" or "-USR2" or "-WINCH" or "-USR1") or
  process.parent.command_line:"runc init" or
  process.parent.executable:(
    "/usr/lib/systemd/systemd" or "/usr/local/qualys/cloud-agent/bin/qualys-cloud-agent" or "/bin/xargs" or
    "/usr/bin/xargs" or "/usr/bin/sudo" or "/usr/sbin/safe_asterisk" or "/usr/local/manageengine/uems_agent/bin/dcservice" or
    "/lib/systemd/systemd" or "/opt/nessus_agent/sbin/nessuscli" or "/etc/rubrik/start_stop_bootstrap.sh" or
    "/usr/local/manageengine/uems_agent/bin/dcpatchscan")
)
'''
[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"

[[rule.threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"

[[rule.threat.technique.subtechnique]]
id = "T1562.006"
name = "Indicator Blocking"
reference = "https://attack.mitre.org/techniques/T1562/006/"

[[rule.threat.technique]]
id = "T1564"
name = "Hide Artifacts"
reference = "https://attack.mitre.org/techniques/T1564/"

[[rule.threat.technique.subtechnique]]
id = "T1564.001"
name = "Hidden Files and Directories"
reference = "https://attack.mitre.org/techniques/T1564/001/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"

[[rule.threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1489"
name = "Service Stop"
reference = "https://attack.mitre.org/techniques/T1489/"

[rule.threat.tactic]
id = "TA0040"
name = "Impact"
reference = "https://attack.mitre.org/tactics/TA0040/"
[rule.new_terms]
field = "new_terms_fields"
value = ["host.id", "process.parent.executable"]

[[rule.new_terms.history_window_start]]
field = "history_window_start"
value = "now-5d"

[metadata]
bypass_bbr_timing = true
creation_date = "2026/02/20"
integration = ["o365"]
maturity = "production"
updated_date = "2026/06/30"

[rule]
author = ["Elastic"]
building_block_type = "default"
description = """
Identifies alerts generated by Microsoft Defender products including Windows Defender for Endpoint (WDATP), Microsoft
Cloud App Security (MCAS), Microsoft Defender for Identity, Microsoft 365 Defender custom detections, and Defender
Experts for XDR via M365 Unified Audit Logs (UAL). These cross-platform alerts indicate detected threats across
endpoints, cloud applications, and identity systems. This building block rule generates security events for correlation,
threat hunting, and telemetry collection to support comprehensive threat detection.
"""
from = "now-9m"
index = ["logs-o365.audit-*"]
language = "kuery"
license = "Elastic License v2"
name = "M365 Defender Alerts Signal (UAL)"
note = """## Triage and analysis

This rule identifies Microsoft Defender alerts forwarded through the Microsoft 365 Unified Audit Log (`logs-o365.audit-*`). For alerts and incidents ingested directly from the Microsoft Defender XDR integration data streams (`logs-m365_defender.alert-*` and `logs-m365_defender.incident-*`), enable the corresponding promotion rules instead:

- Microsoft Defender XDR Alert External Alerts (rule_id: c2a0e42b-ac3d-468f-82a5-0082066e1b59)
- Microsoft Defender XDR Incident External Alerts (rule_id: 3c99579e-6491-4562-87f4-4d10f0a822b4)
"""
references = [
    "https://learn.microsoft.com/en-us/defender-endpoint/",
    "https://learn.microsoft.com/en-us/defender-cloud-apps/",
    "https://learn.microsoft.com/en-us/defender-for-identity/",
    "https://learn.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema#enum-auditlogrecordtype---type-edmint32",
]
risk_score = 47
rule_id = "054853f3-2ce0-41f3-a6eb-4a4867f39cdc"
setup = """### Additional notes

For information on troubleshooting the maximum alerts warning please refer to this [guide](https://www.elastic.co/guide/en/security/current/alerts-ui-monitor.html#troubleshoot-max-alerts).
"""
severity = "medium"
tags = [
    "Domain: Cloud",
    "Domain: SaaS",
    "Domain: Endpoint",
    "Data Source: Microsoft 365",
    "Data Source: Microsoft 365 Audit Logs",
    "Data Source: Microsoft Defender XDR",
    "Data Source: Microsoft Defender for Cloud Apps",
    "Data Source: Microsoft Defender for Identity",
    "Use Case: Threat Detection",
    "Tactic: Initial Access",
    "Tactic: Execution",
    "Tactic: Defense Evasion",
    "Rule Type: BBR",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
event.dataset:o365.audit and
    event.code:(WDATPAlerts or MCASAlerts or MicrosoftDefenderForIdentityAudit or MS365DCustomDetection or DefenderExpertsforXDRAdmin)
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[rule.threat]]
framework = "MITRE ATT&CK"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[rule.threat]]
framework = "MITRE ATT&CK"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[metadata]
creation_date = "2023/11/06"
integration = ["okta"]
maturity = "production"
updated_date = "2026/04/10"

[rule]
author = ["Elastic"]
description = """
Detects sign-in events where authentication is carried out via a third-party Identity Provider (IdP) that has not been
seen before. Adversaries may add an unauthorized IdP to an Okta tenant to gain persistent access. This rule uses New
Terms detection to only alert when a previously unseen IdP is used for authentication, reducing noise from legitimate
federated identity providers while highlighting potentially rogue IdP additions.
"""
from = "now-9m"
index = ["logs-okta.system-*"]
language = "kuery"
license = "Elastic License v2"
name = "Okta Sign-In Events via Third-Party IdP"
note = """## Triage and analysis

### Investigating Okta Sign-In Events via Third-Party IdP

This rule detects sign-in events where authentication is carried out via a third-party Identity Provider (IdP).

Adversaries may attempt to add an unauthorized IdP to an Okta tenant to gain access to the tenant. Following this action, adversaries may attempt to sign in to the tenant using the unauthorized IdP. This rule detects both the addition of an unauthorized IdP and the subsequent sign-in attempt.

#### Possible investigation steps:
- Identify the third-party IdP by examining the `okta.authentication_context.issuer.id` field.
- Once the third-party IdP is identified, determine if this IdP is authorized to be used by the tenant.
- If the IdP is unauthorized, deactivate it immediately via the Okta console.
- Identify the actor associated with the IdP creation by examining the `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, and `okta.actor.display_name` fields in historical data.
    - The `New Okta Identity Provider (IdP) Added by Admin` rule may be helpful in identifying the actor and the IdP creation event.
- Determine the client used by the actor. Review the `okta.client.ip`, `okta.client.user_agent.raw_user_agent`, `okta.client.zone`, `okta.client.device`, and `okta.client.id` fields.
- If the client is a device, check the `okta.device.id`, `okta.device.name`, `okta.device.os_platform`, `okta.device.os_version`, and `okta.device.managed` fields.
- Review the past activities of the actor involved in this action by checking their previous actions logged in the `okta.target` field.
- Examine the `okta.request.ip_chain` field to potentially determine if the actor used a proxy or VPN to perform this action.
- Evaluate the actions that happened just before and after this event in the `okta.event_type` field to help understand the full context of the activity.

### False positive analysis:
- It might be a false positive if this IdP is authorized to be used by the tenant.
- This may be a false positive if an authorized third-party IdP is used to sign in to the tenant but failures occurred due to an incorrect configuration.

### Response and remediation:
- If the IdP is unauthorized, deactivate it immediately via the Okta console.
- Reset the effected user's password and enforce MFA re-enrollment, if applicable.
- Mobile device forensics may be required to determine if the user's device is compromised.
- If the IdP is authorized, ensure that the actor who created it is authorized to do so.
- If the actor is unauthorized, deactivate their account via the Okta console.
- If the actor is authorized, ensure that the actor's account is not compromised.

- Block the IP address or device used in the attempts if they appear suspicious, using the data from the `okta.client.ip` and `okta.device.id` fields.
- Conduct a review of Okta policies and ensure they are in accordance with security best practices.
- If the deactivated IdP was crucial to the organization, consider adding a new IdP and removing the unauthorized IdP.

## Setup

The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
"""
references = [
    "https://blog.cloudflare.com/cloudflare-investigation-of-the-january-2022-okta-compromise/",
    "https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy",
    "https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection",
    "https://unit42.paloaltonetworks.com/muddled-libra/",
    "https://www.elastic.co/security-labs/monitoring-okta-threats-with-elastic-security",
    "https://www.elastic.co/security-labs/starter-guide-to-understanding-okta",
]
risk_score = 47
rule_id = "1ceb05c4-7d25-11ee-9562-f661ea17fbcd"
severity = "medium"
tags = [
    "Domain: Identity",
    "Use Case: Identity and Access Audit",
    "Tactic: Initial Access",
    "Data Source: Okta",
    "Resources: Investigation Guide",

]
timestamp_override = "event.ingested"
type = "new_terms"

query = '''
data_stream.dataset: "okta.system"
    and okta.authentication_context.issuer.id: (* and not "Okta")
    and (
        event.action: (
            "user.authentication.auth_via_IDP"
            or "user.authentication.auth_via_inbound_SAML"
            or "user.authentication.auth_via_social"
        )
        or (
            event.action: "user.authentication.auth_via_IDP"
            and okta.outcome.result: "FAILURE"
            and okta.outcome.reason: (
                "A SAML assert with the same ID has already been processed by Okta for a previous request"
                or "Unable to match transformed username"
                or "Unable to resolve IdP endpoint"
                or "Unable to validate SAML Response"
                or "Unable to validate incoming SAML Assertion"
            )
        )
    )
'''

[rule.new_terms]
field = "new_terms_fields"
value = ["okta.authentication_context.issuer.id"]

[[rule.new_terms.history_window_start]]
field = "history_window_start"
value = "now-5d"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1199"
name = "Trusted Relationship"
reference = "https://attack.mitre.org/techniques/T1199/"

[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"

[[rule.threat.technique.subtechnique]]
id = "T1078.004"
name = "Cloud Accounts"
reference = "https://attack.mitre.org/techniques/T1078/004/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"