Elastic rules: 0s

[metadata]
creation_date = "2024/08/28"
integration = ["endpoint", "crowdstrike", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2026/03/24"

[rule]
author = ["Elastic"]
description = """
Adversaries may attempt to disable the Auditd service to evade detection. Auditd is a Linux service that provides system
auditing and logging. Disabling the Auditd service can prevent the system from logging important security events, which
can be used to detect malicious activity.
"""
from = "now-9m"
index = [
    "logs-endpoint.events.process*",
    "endgame-*",
    "logs-crowdstrike.fdr*",
    "logs-sentinel_one_cloud_funnel.*",
]
language = "eql"
license = "Elastic License v2"
name = "Attempt to Disable Auditd Service"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Attempt to Disable Auditd Service

Auditd is a critical Linux service responsible for system auditing and logging, capturing security-relevant events. Adversaries may target this service to evade detection by disabling it, thus preventing the logging of their activities. The detection rule identifies suspicious processes attempting to stop or disable Auditd, such as using commands like `service stop` or `systemctl disable`, signaling potential defense evasion tactics.

### Possible investigation steps

- Review the process details to identify the user account associated with the suspicious command execution, focusing on the process fields such as process.name and process.args.
- Check the system logs for any preceding or subsequent suspicious activities around the time of the alert, particularly looking for other defense evasion tactics or unauthorized access attempts.
- Investigate the command history of the user identified to determine if there are any other unauthorized or suspicious commands executed.
- Verify the current status of the Auditd service on the affected host to ensure it is running and properly configured.
- Correlate the alert with any other security events or alerts from the same host or user to identify potential patterns or broader attack campaigns.

### False positive analysis

- System administrators may intentionally stop or disable the Auditd service during maintenance or troubleshooting. To handle this, create exceptions for known maintenance windows or specific administrator accounts.
- Automated scripts or configuration management tools might stop or disable Auditd as part of routine system updates or deployments. Identify these scripts and whitelist their activities to prevent false alerts.
- Some Linux distributions or custom setups might have alternative methods for managing services that could trigger this rule. Review and adjust the detection criteria to align with the specific service management practices of your environment.
- In environments where Auditd is not used or is replaced by another logging service, the rule might trigger unnecessarily. Consider disabling the rule or adjusting its scope in such cases.

### Response and remediation

- Immediately isolate the affected system from the network to prevent further malicious activity and potential lateral movement by the adversary.
- Terminate any suspicious processes identified in the alert that are attempting to disable the Auditd service to stop the adversary's actions.
- Re-enable and restart the Auditd service on the affected system to ensure that auditing and logging are resumed, capturing any further suspicious activities.
- Conduct a thorough review of the system logs and audit records to identify any unauthorized changes or additional indicators of compromise that may have occurred prior to the alert.
- Apply any necessary security patches or updates to the affected system to address vulnerabilities that may have been exploited by the adversary.
- Escalate the incident to the security operations team for further investigation and to determine if additional systems may be affected.
- Implement enhanced monitoring and alerting for similar activities across the network to detect and respond to future attempts to disable critical security services."""
risk_score = 47
rule_id = "6a058ed6-4e9f-49f3-8f8e-f32165ae7ebf"
setup = """## Setup

This rule requires data coming in from Elastic Defend.

### Elastic Defend Integration Setup
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.

#### Prerequisite Requirements:
- Fleet is required for Elastic Defend.
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).

#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
- Go to the Kibana home page and click "Add integrations".
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
- Click "Add Elastic Defend".
- Configure the integration name and optionally add a description.
- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
- Click "Save and Continue".
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
"""
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: Linux",
    "Use Case: Threat Detection",
    "Tactic: Defense Evasion",
    "Data Source: Elastic Defend",
    "Data Source: Elastic Endgame",
    "Data Source: Crowdstrike",
    "Data Source: SentinelOne",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"
query = '''
process where host.os.type == "linux" and event.type == "start" and event.action in ("exec", "exec_event", "start", "ProcessRollup2") and (
  (process.name == "service" and process.args == "stop") or
  (process.name == "chkconfig" and process.args == "off") or
  (process.name == "update-rc.d" and process.args in ("remove", "disable")) or
  (process.name == "systemctl" and process.args in ("disable", "stop", "kill", "mask"))
) and
process.args in ("auditd", "auditd.service") and 
not ?process.parent.name == "auditd.prerm"
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"

[[rule.threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1489"
name = "Service Stop"
reference = "https://attack.mitre.org/techniques/T1489/"

[rule.threat.tactic]
id = "TA0040"
name = "Impact"
reference = "https://attack.mitre.org/tactics/TA0040/"

[metadata]
creation_date = "2026/08/14"
integration = ["aws"]
maturity = "production"
updated_date = "2026/08/14"

[rule]
author = ["Elastic"]
description = """
Detects when MFA Delete is disabled on an Amazon S3 bucket. MFA Delete is an additional layer of
security for versioned S3 buckets that requires multi-factor authentication to permanently delete
object versions or disable versioning. When MFA Delete is disabled, an adversary with S3 write
access and a compromised long-term access key can permanently delete object versions, a critical
step in ransomware attacks that target S3 versioning as a backup mechanism. MFA Delete is
configured via PutBucketVersioning with the MfaDelete parameter set to Disabled.
"""
false_positives = [
    """
    Disabling MFA Delete when rotating the root account credentials used to manage versioning
    may trigger this rule. This operation requires root account credentials and is uncommon
    in automated pipelines.
    """,
]
from = "now-6m"
index = ["logs-aws.cloudtrail-*"]
language = "kuery"
license = "Elastic License v2"
name = "AWS S3 Bucket MFA Delete Disabled"
note = """## Triage and analysis

### Investigating AWS S3 Bucket MFA Delete Disabled

MFA Delete protects versioned S3 buckets by requiring MFA authentication to permanently delete object versions or change the versioning state. This protection is specifically designed to prevent ransomware from destroying version history after encrypting the current object copies. Disabling MFA Delete removes this safeguard and is a recognized ransomware preparation step.

Importantly, only the AWS account root user can enable or disable MFA Delete. A `PutBucketVersioning` call disabling MFA Delete from a non-root identity is a strong indicator of root credential compromise or unauthorized use.

### Possible investigation steps

- Identify the caller from `aws.cloudtrail.user_identity.type`. If this is not a `Root` identity, treat it as high-confidence unauthorized access.
- Check `aws.cloudtrail.request_parameters` to confirm `VersioningConfiguration={... MfaDelete=Disabled}` is present.
- Review all API calls by the same identity in the surrounding window for other data-destruction or encryption-related actions.
- Check whether object versioning remains enabled on the affected bucket. If both versioning and MFA Delete are disabled, the bucket has no object-level recovery protection.
- Investigate whether MFA was presented (`aws.cloudtrail.additional_eventdata` contains MFA information for requests that required it).

### Response and remediation

- If unauthorized, immediately re-enable MFA Delete using root credentials and verify that object version history is intact.
- Rotate all credentials associated with the calling identity.
- Review S3 object versions for any permanent deletions that occurred after MFA Delete was disabled.
- Enable AWS Config rules to detect versioning and MFA Delete configuration changes.
"""
references = [
    "https://docs.aws.amazon.com/AmazonS3/latest/userguide/MultiFactorAuthenticationDelete.html",
    "https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketVersioning.html",
    "https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/",
    "https://www.halcyon.ai/blog/abusing-aws-native-services-ransomware-encrypting-s3-buckets-with-sse-c",
]
risk_score = 73
rule_id = "b8654454-2757-41b4-ae1a-69b3be704c28"
setup = "The AWS integration must be ingesting management events into `logs-aws.cloudtrail-*`. S3 management events are logged by default."
severity = "high"
tags = [
    "Domain: Cloud",
    "Platform: AWS",
    "Data Source: AWS CloudTrail",
    "Service: AWS S3",
    "Rule Type: Custom Query (KQL)",
    "Tactic: Impact",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset: "aws.cloudtrail"
    and event.provider: "s3.amazonaws.com"
    and event.action: "PutBucketVersioning"
    and event.outcome: "success"
    and aws.cloudtrail.flattened.request_parameters.VersioningConfiguration.MfaDelete: "Disabled"
'''

[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1490"
name = "Inhibit System Recovery"
reference = "https://attack.mitre.org/techniques/T1490/"

[rule.threat.tactic]
id = "TA0040"
name = "Impact"
reference = "https://attack.mitre.org/tactics/TA0040/"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "aws.cloudtrail.user_identity.arn",
    "aws.cloudtrail.user_identity.type",
    "user.name",
    "event.action",
    "event.outcome",
    "service.target.entity.id",
    "aws.cloudtrail.request_parameters",
    "source.ip",
    "cloud.region",
    "cloud.account.id",
]

[metadata]
creation_date = "2020/08/19"
integration = ["azure"]
maturity = "production"
updated_date = "2026/04/10"

[rule]
author = ["Elastic"]
description = """
Identifies a rotation to storage account access keys in Azure. Regenerating access keys can affect any applications or
Azure services that are dependent on the storage account key. Adversaries may regenerate a key as a means of acquiring
credentials to access systems and resources.
"""
false_positives = [
    """
    It's recommended that you rotate your access keys periodically to help keep your storage account secure. Normal key
    rotation can be exempted from the rule. An abnormal time frame and/or a key rotation from unfamiliar users, hosts,
    or locations should be investigated.
    """,
]
from = "now-9m"
index = ["logs-azure.activitylogs-*", "filebeat-*"]
language = "kuery"
license = "Elastic License v2"
name = "Azure Storage Account Key Regenerated"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Azure Storage Account Key Regenerated

Azure Storage Account keys are critical credentials that grant access to storage resources. They are often used by applications and services to authenticate and interact with Azure Storage. Adversaries may regenerate these keys to gain unauthorized access, potentially disrupting services or exfiltrating data. The detection rule monitors for key regeneration events, flagging successful operations as potential indicators of credential misuse, thus enabling timely investigation and response.

### Possible investigation steps

- Review the Azure activity logs to identify the specific storage account associated with the key regeneration event by examining the operation_name field for "MICROSOFT.STORAGE/STORAGEACCOUNTS/REGENERATEKEY/ACTION".
- Check the event.outcome field to confirm the success of the key regeneration and gather details about the user or service principal that initiated the action.
- Investigate the user or service principal's recent activities in Azure to determine if there are any other suspicious actions or patterns that could indicate unauthorized access or misuse.
- Assess the impact on applications and services that rely on the affected storage account key by identifying dependencies and checking for any service disruptions or anomalies.
- Review access policies and permissions for the storage account to ensure they are appropriately configured and consider implementing additional security measures, such as Azure Key Vault, to manage and rotate keys securely.

### False positive analysis

- Routine key rotation by administrators or automated scripts can trigger alerts. To manage this, identify and document regular key rotation schedules and exclude these events from alerts.
- Development and testing environments often regenerate keys frequently. Exclude these environments from alerts by filtering based on environment tags or resource names.
- Third-party integrations or services that require periodic key regeneration might cause false positives. Work with service owners to understand these patterns and create exceptions for known, legitimate services.
- Azure policies or compliance checks that enforce key rotation can also lead to false positives. Coordinate with compliance teams to align detection rules with policy schedules and exclude these events.
- Ensure that any automated processes that regenerate keys are logged and documented. Use this documentation to create exceptions for these processes in the detection rule.

### Response and remediation

- Immediately revoke the regenerated storage account keys to prevent unauthorized access. This can be done through the Azure portal or using Azure CLI commands.
- Identify and update all applications and services that rely on the compromised storage account keys with new, secure keys to restore functionality and prevent service disruption.
- Conduct a thorough review of access logs and audit trails to identify any unauthorized access or data exfiltration attempts that may have occurred using the regenerated keys.
- Escalate the incident to the security operations team for further investigation and to determine if additional systems or accounts have been compromised.
- Implement conditional access policies and multi-factor authentication (MFA) for accessing Azure resources to enhance security and prevent similar incidents.
- Review and update the storage account's access policies and permissions to ensure that only authorized users and applications have the necessary access.
- Enhance monitoring and alerting mechanisms to detect future unauthorized key regeneration attempts promptly, ensuring timely response to potential threats.

## Setup

The Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
references = [
    "https://docs.microsoft.com/en-us/azure/storage/common/storage-account-keys-manage?tabs=azure-portal",
]
risk_score = 21
rule_id = "1e0b832e-957e-43ae-b319-db82d228c908"
severity = "low"
tags = [
    "Domain: Cloud",
    "Data Source: Azure",
    "Use Case: Identity and Access Audit",
    "Tactic: Credential Access",
    "Resources: Investigation Guide",

]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset:azure.activitylogs and azure.activitylogs.operation_name:"MICROSOFT.STORAGE/STORAGEACCOUNTS/REGENERATEKEY/ACTION" and event.outcome:(Success or success)
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"

[[rule.threat.technique.subtechnique]]
id = "T1552.005"
name = "Cloud Instance Metadata API"
reference = "https://attack.mitre.org/techniques/T1552/005/"

[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"

[[rule.threat.technique.subtechnique]]
id = "T1098.001"
name = "Additional Cloud Credentials"
reference = "https://attack.mitre.org/techniques/T1098/001/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[metadata]
creation_date = "2025/07/31"
integration = ["crowdstrike"]
maturity = "production"
promotion = true
updated_date = "2025/10/17"

[rule]
author = ["Elastic"]
description = """
Generates a detection alert for each CrowdStrike alert written to the configured indices. Enabling this rule allows you
to immediately begin investigating CrowdStrike alerts in the app.
"""
from = "now-2m"
index = ["logs-crowdstrike.alert-*"]
interval = "1m"
language = "kuery"
license = "Elastic License v2"
max_signals = 1000
name = "CrowdStrike External Alerts"
note = """## Triage and analysis

### Investigating CrowdStrike External Alerts

CrowdStrike Falcon is a cloud-native endpoint protection platform that delivers real-time threat detection and response capabilities. The rule captures security alerts generated by Falcon and enables analysts to investigate threats rapidly based on behavioral indicators and threat intelligence.

### Possible investigation steps

- Review the associated process, file path, and command line to determine whether the activity is legitimate or suspicious.
- Investigate the user account and host involved in the alert to validate whether the activity was authorized.
- Cross-reference the alert with CrowdStrike Falcon console for additional context, including process tree, behavioral tags, and threat intelligence matches.
- Check for any related alerts from the same host, user, or file hash to identify whether this is part of a larger attack chain.
- Consult the Crowdstrike investigation guide and resources tagged in the alert for specific guidance on handling similar threats.

### False positive analysis

- Alerts involving known and trusted software tools (e.g., remote administration tools) may be false positives. Confirm intent before excluding.
- Security assessments or penetration testing activities might mimic real threats. Validate the activity with responsible teams.
- Scheduled jobs, IT scripts, or automation tools may trigger alerts if they behave similarly to malicious code.
- Review alerts based on detection confidence levels and behavioral scoring to filter out low-confidence or known-benign triggers.

### Response and remediation

- Isolate affected endpoints to prevent lateral movement if malicious behavior is confirmed.
- Quarantine any identified malicious files and block related hashes or domains.
- Investigate how the threat entered the environment and close any exploited vulnerabilities.
- Reset credentials for compromised user accounts or escalate to incident response.
- Review CrowdStrike Falcon policies and detections to fine-tune future alerting and response coverage.
- Document the findings and update detection logic or exceptions accordingly.
"""
references = ["https://docs.elastic.co/en/integrations/crowdstrike"]
risk_score = 47
rule_id = "aeebe561-c338-4118-9924-8cb4e478aa58"
rule_name_override = "crowdstrike.alert.name"
setup = """## Setup

### CrowdStrike Alert Integration
This rule is designed to capture alert events generated by the CrowdStrike integration and promote them as Elastic detection alerts.

To capture CrowdStrike alerts, install and configure the CrowdStrike integration to ingest alert events into the `logs-crowdstrike.alert-*` index pattern.

If this rule is enabled alongside the External Alerts promotion rule (UUID: eb079c62-4481-4d6e-9643-3ca499df7aaa), you may receive duplicate alerts for the same CrowdStrike events. Consider adding a rule exception for the External Alert rule to exclude data_stream.dataset:crowdstrike.alert to avoid receiving duplicate alerts.

### Additional notes

For information on troubleshooting the maximum alerts warning please refer to this [guide](https://www.elastic.co/guide/en/security/current/alerts-ui-monitor.html#troubleshoot-max-alerts).
"""
severity = "medium"
tags = [
    "Data Source: Crowdstrike",
    "Use Case: Threat Detection",
    "Resources: Investigation Guide",
    "Promotion: External Alerts",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
event.kind: alert and data_stream.dataset: crowdstrike.alert
'''


[[rule.risk_score_mapping]]
field = "crowdstrike.alert.incident.score"
operator = "equals"
value = ""

[[rule.severity_mapping]]
field = "event.severity"
operator = "equals"
severity = "low"
value = "21"

[[rule.severity_mapping]]
field = "event.severity"
operator = "equals"
severity = "medium"
value = "47"

[[rule.severity_mapping]]
field = "event.severity"
operator = "equals"
severity = "high"
value = "73"

[[rule.severity_mapping]]
field = "event.severity"
operator = "equals"
severity = "critical"
value = "99"

[metadata]
creation_date = "2025/11/20"
integration = ["endpoint"]
maturity = "production"
updated_date = "2026/03/24"

[rule]
author = ["Elastic"]
description = """
This rule detects the execution of curl or wget binaries through a GTFOBin (living-off-the-land) technique in Linux
environments. Attackers may exploit these utilities to download and execute malicious files from the internet while
attempting to evade detection. The rule specifically targets binaries that are capable of executing shell commands
directly from the proxied binary, rather than just spawning a shell.
"""
from = "now-9m"
index = ["logs-endpoint.events.process*", "logs-endpoint.events.network*"]
language = "eql"
license = "Elastic License v2"
name = "Curl or Wget Egress Network Connection via LoLBin"
note = """ ## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Curl or Wget Egress Network Connection via LoLBin

This detects outbound connections from curl or wget when they are launched via living-off-the-land binaries that can execute shell commands, signaling proxy execution to mask activity. It matters because attackers abuse trusted utilities to fetch payloads, stage command-and-control, or exfiltrate while evading simple controls. Example: an attacker uses awk or busybox to run curl to an external host, downloads a script into /tmp, pipes it to sh, or saves a binary and runs it under the proxy’s context.

### Possible investigation steps

- Pull the full process tree around the event and review the parent LoLBin’s command line for signs of proxy execution such as pipelines to a shell, write-to-file flags (-o/-O), exfil options (--data/--upload-file), or TLS bypass (-k), noting working directory and effective user for context.
- Identify any paths or filenames used by the transfer and inspect the filesystem for newly created or modified artifacts in temp locations, recording hashes, timestamps, permission changes (e.g., chmod +x), and any immediate execution or persistence actions.
- Correlate the outbound destination with threat intelligence and internal allowlists, examine DNS/SNI/certificate details, and flag unusual ports or use of proxies/TOR that suggest evasion.
- Validate whether the parent LoLBin and its execution path align with legitimate software or maintenance workflows on the host, and broaden the search for similar executions across hosts within the same timeframe.
- Hunt for follow-on activity including new listeners, reverse shells, additional outbound beacons, or other GTFOBins invoking curl/wget, and tie findings back to the same domains/IPs or dropped filesystem artifacts.

### False positive analysis

- During legitimate dependency installation or build workflows, pip/npm/gem/bundler/yarn may run post-install hooks that invoke curl/wget to fetch supplemental files from public mirrors, with the package manager as the parent process.
- Operations or maintenance tasks may use watch/busybox/run-parts/awk to proxy execution of curl/wget for external availability checks or bootstrap downloads in init scripts, producing short-lived egress that matches the LoLBin-parent pattern.

### Response and remediation

- Immediately isolate the affected Linux host or apply an outbound block, terminate active curl/wget and their invoking LoLBins (e.g., awk, busybox, run-parts), and add temporary firewall/DNS rules to deny the contacted domain/IP and port.
- Enumerate and delete files fetched via curl/wget (-o/-O) in /tmp, /var/tmp, /dev/shm, and user home (including scripts piped to sh), remove any persistence added (new cron entries, systemd units, rc.local edits), and record hashes/paths for evidence.
- Rotate credentials or tokens exposed via -u/--header or ~/.netrc, purge malicious proxy settings and config files (http_proxy/https_proxy environment, ~/.wgetrc, ~/.curlrc), and revoke SSH keys or cookies discovered alongside the downloads.
- Restore the system by reimaging or reinstalling if tampering is suspected, re-enable egress only after validation, verify application functionality, and re-enroll the endpoint with EDR while limiting curl/wget usage to approved service accounts.
- Escalate to incident response if curl/wget is piped to a shell (e.g., curl https://... | sh), a downloaded binary is made executable and run (chmod +x followed by execution), the destination matches known malicious infrastructure, or torify/torsocks/proxy chaining is used.
- Harden by mounting /tmp, /var/tmp, and /dev/shm with noexec/nosuid/nodev, enforcing AppArmor/SELinux to restrict curl/wget network access and file writes, constraining GTFOBins from spawning shells, and requiring egress via a proxy allowlist with TLS validation (disallow --insecure/-k).
"""
references = ["https://gtfobins.github.io/#+shell"]
risk_score = 47
rule_id = "d1ee711a-a3ba-4d73-b5ab-84cab5b37fb3"
setup = """## Setup

This rule requires data coming in from Elastic Defend.

### Elastic Defend Integration Setup
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.

#### Prerequisite Requirements:
- Fleet is required for Elastic Defend.
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).

#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
- Go to the Kibana home page and click "Add integrations".
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
- Click "Add Elastic Defend".
- Configure the integration name and optionally add a description.
- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
- Click "Save and Continue".
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
"""
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: Linux",
    "Use Case: Threat Detection",
    "Tactic: Defense Evasion",
    "Tactic: Execution",
    "Tactic: Command and Control",
    "Tactic: Exfiltration",
    "Data Source: Elastic Defend",
    "Resources: Investigation Guide",
]
type = "eql"
query = '''
sequence with maxspan=3s
  [process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and process.name in (
     "aa-exec", "aoss", "awk", "run-parts", "bundle", "bundler", "busctl", "busybox", "byebug", "c89", "c99", "cabal",
     "capsh", "cdist", "certbot", "check_by_ssh", "choom", "cobc", "cowsay", "cowthink", "cpio", "cpulimit", "csvtool",
     "dc", "distcc", "easy_install", "emacs", "enscript", "expect", "find", "flock", "gawk", "gcc", "gdb", "gem",
     "genie", "ghc", "ghci", "gimp", "grc", "gtester", "ionice", "irb", "jjs", "jrunscript", "knife", "latex",
     "latexmk", "lftp", "logsave", "ltrace", "mail", "mawk", "msgfilter", "multitime", "mysql", "nawk", "neofetch",
     "nice", "nohup", "npm", "nroff", "nsenter", "octave", "openvpn", "pandoc", "pdb", "pdflatex", "pdftex", "perf",
     "pexec", "pip", "rake", "rc", "rlwrap", "rpmdb", "rpmquery", "rpmverify", "rsync", "rtorrent", "runscript",
     "rview", "rvim", "script", "scrot", "sed", "service", "setarch", "setlock", "sg", "socat", "softlimit", "split",
     "sqlite3", "sqlmap", "sshpass", "start-stop-daemon", "stdbuf", "tar", "taskset",
     "tasksh", "tex", "time", "tmate", "torify", "torsocks", "tshark", "valgrind", "vi", "view",
     "vim", "vimdiff", "watch", "xdg-user-dir", "xdotool", "xelatex", "xetex", "yarn", "zip", "zypper"
   ) and not (
     process.executable == "/tmp/newroot/unshare" or
     process.parent.args in (
       "/etc/.agent/server_agent.sh", "/nessus/update2.sh", "/etc/cron.daily/spamassassin", "/etc/cron.daily/rkhunter",
       "buildkit-runc", "/usr/sbin/spamassassin-maint"
     ) or
     process.parent.executable like (
       "/usr/local/bin/fail2ban_cluster.sh", "/script/downloadArtifacts.sh", "/etc/cron.daily/rkhunter",
       "/usr/bin/bbb-conf", "/usr/sbin/sos", "/usr/bin/make", "/var/lib/amagent/*", "/etc/cron.daily/spamassassin",
       "/usr/lib/cron/run-crons", "/usr/sbin/spamassassin-maint", "/usr/sbin/oracle-libs-update"
     ) or
     process.parent.name in ("rkhunter", "vivaldi-stable.postinst", "runc") or
     process.parent.command_line == "runc init" or
     process.parent.command_line like "/home/*/bin/DownloadExchangeFiles_mcx*" or
     process.command_line in (
       "nice -10 /opt/aws/discovery/update", "xargs -n 1 curl -o lpsc -L", "/usr/bin/ruby /usr/bin/rake run:server_hooks",
       "nohup ./update2.sh"
     ) or
     process.parent.command_line in ("/bin/sh -c nice -n 15 $HOME/bin/cron.pl > /dev/null 2>&1", "/bin/sh /etc/cron.daily/rkhunter") or
     process.command_line like ("*/home/linuxbrew/.linuxbrew/*", "*Homebrew*", "*webhook*") or
     process.args like ("/usr/lib/jvm/*", "/root/.forge/provision-*.sh", "/usr/src/ucrm/scripts/update-certificates.sh", "/etc/periodic/weekly/update_mmdb.sh") or
     (process.name == "nohup" and process.command_line like "nohup /usr/*/*.sh") or
     (process.name == "julia" and process.parent.name == "julia")
   )
  ] by process.entity_id
  [network where host.os.type == "linux" and event.type == "start" and event.action == "connection_attempted" and
   process.name in ("wget", "curl") and not (
     destination.ip == null or destination.ip == "0.0.0.0" or cidrmatch(
       destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.0.0/29",
       "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
       "192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10",
       "192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1", "FE80::/10",
       "FF00::/8"
     )
   )
  ] by process.parent.entity_id
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1202"
name = "Indirect Command Execution"
reference = "https://attack.mitre.org/techniques/T1202/"

[[rule.threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"

[[rule.threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1105"
name = "Ingress Tool Transfer"
reference = "https://attack.mitre.org/techniques/T1105/"

[rule.threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[rule.threat.tactic]
id = "TA0010"
name = "Exfiltration"
reference = "https://attack.mitre.org/tactics/TA0010/"

[rule]
description = "Detects an attempt to exploit the CVE-2023-0386 local privilege escalation vulnerability."
id = "22145fc0-dc4c-4187-8397-4d20162fc391"
license = "Elastic License v2"
name = "CVE-2023-0386 Exploitation Attempt"
os_list = ["linux"]
reference = [
    "https://securityonline.info/poc-exploit-released-for-linux-kernel-privilege-escalation-cve-2023-0386-bug/",
    "https://github.com/xkaneiki/CVE-2023-0386",
]
version = "1.0.12"

query = '''
process where event.type == "start" and event.action == "exec" and 
    process.name : "fusermount*" and 
    process.args : "-o" and 
    process.args : "rw,nosuid,nodev" and 
    process.args : "./*" and 
    process.parent.name : "fuse"
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1068"
name = "Exploitation for Privilege Escalation"
reference = "https://attack.mitre.org/techniques/T1068/"


[threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[internal]
min_endpoint_version = "7.15.0"

[rule]
description = """
Identifies the creation of two persistence items via startup followed by scheduled task by an unsigned executable.
Adversaries may use this technique to maintain multiple methods of persistence on an endpoint.
"""
id = "8eb8bf95-872b-43c9-9f7c-528d795d6b4e"
license = "Elastic License v2"
name = "Dual Persistence via Startup and Scheduled Task"
os_list = ["windows"]
reference = ["https://docs.microsoft.com/en-us/previous-versions/technet-magazine/ee851671(v=msdn.10)"]
version = "1.0.16"

query = '''
sequence with maxspan=3m
 [any where event.category in ("registry", "file") and
  process.executable : ("?:\\*", "\\Device\\Mup*") and
  event.action != "deletion" and user.id like ("S-1-5-21*", "S-1-12-*") and 
  not process.code_signature.status like ("trusted", "errorExpired", "errorCode_endpoint*") and 
   (
    (registry.data.strings != null and 
     not registry.data.strings : ("*:\\Program Files\\*", "*:\\Program Files (x86)\\*") and
     registry.path :
              ("H*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*", 
	       "H*\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
	       "H*\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*", 
	       "H*\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*", 
	       "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\Load", 
	       "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell", 
	       "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell", 
	       "HKEY_USERS\\*\\Environment\\UserInitMprLogonScript", 
	       "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Userinit", 
	       "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Shell", 
	       "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Logoff\\Script", 
	       "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Logon\\Script", 
	       "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Shutdown\\Script", 
	       "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Startup\\Script", 
	       "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Ctf\\LangBarAddin\\*\\FilePath", 
	       "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Internet Explorer\\Extensions\\*\\Exec", 
	       "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Command Processor\\Autorun")) or
    (file.name != null and file.path : "?:\\*\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*" and not file.name : "desktop.ini")
   )] by process.entity_id
  [file where event.action != "deletion" and
   file.path : "?:\\Windows\\System32\\Tasks\\*" and file.name != null] by Effective_process.entity_id
'''

min_endpoint_version = "8.4.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1053"
name = "Scheduled Task/Job"
reference = "https://attack.mitre.org/techniques/T1053/"
[[threat.technique.subtechnique]]
id = "T1053.005"
name = "Scheduled Task"
reference = "https://attack.mitre.org/techniques/T1053/005/"


[[threat.technique]]
id = "T1547"
name = "Boot or Logon Autostart Execution"
reference = "https://attack.mitre.org/techniques/T1547/"
[[threat.technique.subtechnique]]
id = "T1547.001"
name = "Registry Run Keys / Startup Folder"
reference = "https://attack.mitre.org/techniques/T1547/001/"



[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1112"
name = "Modify Registry"
reference = "https://attack.mitre.org/techniques/T1112/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.4.0"

[rule]
description = """
Identifies the execution of PowerShell with potentially obfuscated content. This behavior is often observed during
malware installation leveraging PowerShell.
"""
id = "ce95fc52-051e-4409-9c99-f2daf3e6e609"
license = "Elastic License v2"
name = "Execution via Obfuscated PowerShell Script"
os_list = ["windows"]
version = "1.0.11"

query = '''
api where process.Ext.api.name == "AmsiScanBuffer" and
 process.name : "powershell.exe" and user.id != "S-1-5-18" and

  /* obfuscated content */
  process.Ext.api.parameters.buffer : ("*-bxor*", "*:sptth*", "*//:p##h*", "*.rEplAcE(([chAr]*", "*$pShOMe[*", "*$ShellId[*", "*$env:Public[*",
  "*$env:ComSpec[*", "*ecalper-*", "*]rahc[*", "*NoiSsErpXe-eKoVNi*", "*elbairav-*", "*ECNErEFERpESObREv$*", "*.Name[3,11,2]*",
  "*sailA-teS*", "*]rtPtnI[*", "*-ekovnI*", "*TVqQAAMAAAAEAAAA*", "*System.Management.Automation.$([cHAr]*") and

  not (process.Ext.api.parameters.buffer : "*-bxor*" and process.Ext.api.parameters.buffer : "#powershellskript *") and
  not (process.Ext.api.parameters.buffer : "*-bxor*" and process.Ext.api.parameters.buffer : ("*-bxor 0xFFFF0000*", "*Ansible.Basic.AnsibleModule*")) and
  not (process.Ext.api.parameters.buffer : ("function Get-DbaProductKey*", "function Invoke-DbaDbDecryptObjec*") and process.Ext.api.parameters.buffer : "* -bxor *") and
  not (process.Ext.api.parameters.size >= 155000 and process.Ext.api.parameters.buffer : "*HSTITest_Encoded*TVqQAAMAAAAEAAAA*") and
  not (process.Ext.api.parameters.size == 38324 and
       process.command_line : "*AkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApAC*") and
  not process.Ext.api.parameters.content_name :
                    ("?:\\Program Files\\*.ps1",
                     "?:\\Program Files (x86)\\*.ps1",
                     "D:\\*", "E:\\*", "F:\\*", "I:\\*", "X:\\*",
                     "C:\\ProgramData\\NinjaRMMAgent\\scripting\\*.ps1",
                     "C:\\ProgramData\\chocolatey\\*.ps1",
                     "C:\\WINDOWS\\IMECache\\*",
                     "C:\\ProgramData\\CentraStage\\Packages\\*\\command.ps1") and
  not process.command_line : "\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -windowstyle hidden -nologo Invoke-Expression $env:Include" and
  not process.parent.executable : ("C:\\Program Files (x86)\\ManageSoft\\Tracker\\ndtrack.exe",
                                   "C:\\Program Files (x86)\\CentraStage\\Gui.exe",
                                   "C:\\Program Files (x86)\\Spiceworks Agent Shell\\AgentShell.exe",
                                   "C:\\Program Files\\SentinelOne\\Sentinel Agent *\\Addons\\SentinelAddonHost.exe",
                                   "C:\\Program Files (x86)\\Spiceworks Agent Shell\\AgentShellService.exe",
                                   "C:\\Program Files\\Microsoft VS Code\\Code.exe",
                                   "C:\\Windows\\System32\\gpscript.exe",
                                   "C:\\Program Files\\Windows Defender Advanced Threat Protection\\SenseIR.exe",
                                   "C:\\Program Files (x86)\\Microsoft Intune Management Extension\\AgentExecutor.exe",
                                   "C:\\Windows\\System32\\drivers\\Intel\\ICPS\\IntelConnectivityNetworkService.exe",
                                   "C:\\Program Files\\Axis Communications\\AXIS Camera Station\\Components\\AXIS System Health Monitoring\\AXISSystemHealthMonitoring.exe")
'''

min_endpoint_version = "8.16.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.001"
name = "PowerShell"
reference = "https://attack.mitre.org/techniques/T1059/001/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "8.16.0"

[rule]
description = """
This rule detects when the curl or wget command is used to download a file to a writeable hidden directory, such as
/tmp, /var/tmp, or /dev/shm. This behavior is used by threat actors to evade detection and may indicate command and
control activity.
"""
id = "dc1cee03-4923-4c6b-b00b-8a5c323bb753"
license = "Elastic License v2"
name = "File Downloaded via Curl or Wget to Hidden Directory"
os_list = ["linux"]
version = "1.0.12"

query = '''
process where event.type == "start" and event.action == "exec" and (
  (process.name == "wget" and process.args like ("-o", "--output-*") and
   process.args like ("/tmp*/.*", "/var/tmp*/.*", "/dev/shm/*", "-o-")) or
  (process.name == "curl" and process.args in ("--output", "-o") and
   process.args like ("/tmp*/.*", "/var/tmp*/.*", "/dev/shm/*"))
) and not (
  process.parent.executable in (
    "/Tools/aw_api.sh", "tools/dialyzer/run.sh", "/bin/kubectl", "/srv/kube-proxy-run", "/srv/kubelet/run",
    "/usr/bin/makepkg"
  ) or
  process.parent.executable like ("/run/containerd/*", "/tmp/.mount_vagran*/usr/bin/ruby") or
  process.parent.command_line in ("bash /usr/bin/maldet -u", "runc init") or
  process.command_line like (
    "*/tmp/.dialyzer_analysis*", "*.ansible*", "curl -s https://gist.githubusercontent.com/*bashrc_downlord",
    "*github.com/prefix-dev/pixi*", "*heroku-java-metrics-agent*"
  ) or
  process.args like (
    "https://release-registry.services.sentry.io/apps/sentry-cli/*package=sentry-cli",
    "https*github*astral-sh/rye/*",
    "https://github.com/codecrafters-io/*"
  ) or
  process.working_directory like ("/tmp/wbrashear/easybuild/*", "/var/tmp/pamac-build-*")
)
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
tree = true

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1564"
name = "Hide Artifacts"
reference = "https://attack.mitre.org/techniques/T1564/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[[threat]]
framework = "MITRE ATT&CK"

[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "7.15.0"

[metadata]
creation_date = "2026/07/10"
integration = ["gcp"]
maturity = "production"
updated_date = "2026/07/10"

[rule]
author = ["Elastic"]
description = """
Detects creation or modification of GKE Roles or ClusterRoles that grant high-risk permissions, such as wildcard
access or RBAC escalation verbs (bind, escalate, impersonate), which may enable privilege escalation or unauthorized
access within the cluster.
"""
false_positives = [
    """
    Platform installers, GitOps controllers, and RBAC refactoring may legitimately create roles with broad permissions.
    Baseline approved automation and tune exclusions for known operators.
    """,
]
from = "now-6m"
index = ["logs-gcp.audit-*"]
language = "kuery"
license = "Elastic License v2"
name = "GKE Creation or Modification of Sensitive Role"
note = """## Triage and analysis

### Investigating GKE Creation or Modification of Sensitive Role

This rule detects allowed create, update, or patch actions on Roles and ClusterRoles that introduce high-risk RBAC
permissions, including wildcard access and escalation verbs like bind, escalate, or impersonate.

### Possible investigation steps

- Identify `client.user.email`, `source.ip`, and `user_agent.original`.
- Review `gcp.audit.resource_name`, `event.action`, and `gcp.audit.request` for the changed role.
- Enumerate RoleBindings or ClusterRoleBindings that reference the role and hunt for follow-on secret or exec activity.

### False positive analysis

- GitOps or platform bootstrap may create broad roles during onboarding. `system:addon-manager` patch reconciliation on built-in Roles and ClusterRoles is excluded.

### Response and remediation

- Revert unauthorized roles, remove unexpected bindings, and restrict RBAC change permissions to governed pipelines.

"""
setup = "The GCP Fleet integration with GKE audit logs enabled is required. Request body capture on RBAC resources is required."
references = [
    "https://kubernetes.io/docs/reference/access-authn-authz/rbac/",
    "https://heilancoos.github.io/research/2025/12/16/kubernetes.html#overly-permissive-role-based-access-control",
]
risk_score = 47
rule_id = "2af7f1d7-d02c-476f-a130-e17ea4e556e6"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Domain: Kubernetes",
    "Data Source: GCP",
    "Data Source: Google Cloud Platform",
    "Use Case: Threat Detection",
    "Tactic: Persistence",
    "Tactic: Privilege Escalation",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset:gcp.audit and service.name:"k8s.io" and event.outcome:success and
event.action:(
  "io.k8s.authorization.rbac.v1.roles.create" or
  "io.k8s.authorization.rbac.v1.roles.update" or
  "io.k8s.authorization.rbac.v1.roles.patch" or
  "io.k8s.authorization.rbac.v1.clusterroles.create" or
  "io.k8s.authorization.rbac.v1.clusterroles.update" or
  "io.k8s.authorization.rbac.v1.clusterroles.patch"
) and not source.ip:("::1" or "127.0.0.1") and not (
  client.user.email:"system:serviceaccount:kube-system:clusterrole-aggregation-controller" and
  gcp.audit.request.metadata.name:(admin or edit) and
  event.action:"io.k8s.authorization.rbac.v1.clusterroles.patch"
) and not (
  client.user.email:"system:addon-manager" and
  event.action:(
    "io.k8s.authorization.rbac.v1.roles.patch" or
    "io.k8s.authorization.rbac.v1.clusterroles.patch"
  )
) and (
  gcp.audit.request.rules.verbs:("*" or escalate or bind or impersonate) or
  (
    gcp.audit.request.rules.verbs:("*" or create or patch or update) and
    gcp.audit.request.rules.resources:(
      "*" or clusterroles or clusterrolebindings or roles or rolebindings or
      pods/exec or serviceaccounts/token or nodes/proxy or daemonsets
    )
  ) or
  (
    gcp.audit.request.rules.verbs:("*" or get or list) and
    gcp.audit.request.rules.resources:("*" or secrets)
  ) or
  gcp.audit.response.rules.verbs:("*" or escalate or bind or impersonate) or
  (
    gcp.audit.response.rules.verbs:("*" or create or patch or update) and
    gcp.audit.response.rules.resources:(
      "*" or clusterroles or clusterrolebindings or roles or rolebindings or
      pods/exec or serviceaccounts/token or nodes/proxy or daemonsets
    )
  ) or
  (
    gcp.audit.response.rules.verbs:("*" or get or list) and
    gcp.audit.response.rules.resources:("*" or secrets)
  )
)
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"

[[rule.threat.technique.subtechnique]]
id = "T1098.006"
name = "Additional Container Cluster Roles"
reference = "https://attack.mitre.org/techniques/T1098/006/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"

[[rule.threat.technique.subtechnique]]
id = "T1098.006"
name = "Additional Container Cluster Roles"
reference = "https://attack.mitre.org/techniques/T1098/006/"

[rule.threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "client.user.email",
    "source.ip",
    "user_agent.original",
    "event.action",
    "event.outcome",
    "gcp.audit.resource_name",
    "gcp.audit.request.kind",
    "data_stream.namespace",
]

[metadata]
creation_date = "2026/07/10"
integration = ["gcp"]
maturity = "production"
updated_date = "2026/07/10"

[rule]
author = ["Elastic"]
description = """
Detects a request to attach a built-in kube-controller-manager service account to a pod running in the kube-system
namespace on GKE. These service accounts are admin-equivalent and are not normally assigned to arbitrary pods. An attacker
who can create pods in kube-system can abuse these tokens for cluster-wide privilege escalation.
"""
false_positives = [
    """
    Built-in controller service accounts are rarely assigned to running pods. False positives should be rare; allowlist
    documented platform automation by actor when baselined.
    """,
]
from = "now-6m"
index = ["logs-gcp.audit-*"]
language = "kuery"
license = "Elastic License v2"
name = "GKE Suspicious Assignment of Controller Service Account"
note = """## Triage and analysis

### Investigating GKE Suspicious Assignment of Controller Service Account

This rule flags pod create events in kube-system that assign a built-in kube-controller-manager service account.

### Possible investigation steps

- Review `client.user.email`, `gcp.audit.request.spec.serviceAccountName`, and container images.
- Determine whether the pod aligns with expected platform operations.
- Assess permissions of the assigned service account and hunt for follow-on secret or RBAC activity.

### False positive analysis

- Built-in controller service accounts should not be mounted on user-created pods. Allowlist known automation by actor if a documented exception exists.

### Response and remediation

- Delete suspicious pods, revoke the service account token, and restrict pod create permissions in kube-system.

"""
setup = "The GCP Fleet integration with GKE audit logs enabled is required to be compatible with this rule."
references = [
    "https://www.paloaltonetworks.com/apps/pan/public/downloadResource?pagePath=/content/pan/en_US/resources/whitepapers/kubernetes-privilege-escalation-excessive-permissions-in-popular-platforms",
    "https://kubernetes.io/docs/reference/access-authn-authz/rbac/#controller-roles",
]
risk_score = 47
rule_id = "e2f60d42-e0ea-4a03-a151-942bb5b86c0b"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Domain: Kubernetes",
    "Data Source: GCP",
    "Data Source: Google Cloud Platform",
    "Use Case: Threat Detection",
    "Tactic: Execution",
    "Tactic: Privilege Escalation",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset:gcp.audit and service.name:"k8s.io" and event.outcome:success and
event.action:"io.k8s.core.v1.pods.create" and gcp.audit.request.metadata.namespace:"kube-system" and
gcp.audit.request.spec.serviceAccountName:(
  attachdetach-controller or certificate-controller or cloud-provider or
  clusterrole-aggregation-controller or cronjob-controller or daemon-set-controller or deployment-controller or
  disruption-controller or endpoint-controller or expand-controller or generic-garbage-collector or
  horizontal-pod-autoscaler or job-controller or namespace-controller or node-controller or
  persistent-volume-binder or pod-garbage-collector or pv-protection-controller or pvc-protection-controller or
  replicaset-controller or replication-controller or resourcequota-controller or root-ca-cert-publisher or
  route-controller or service-account-controller or service-controller or statefulset-controller or ttl-controller
)
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"

[[rule.threat.technique.subtechnique]]
id = "T1078.001"
name = "Default Accounts"
reference = "https://attack.mitre.org/techniques/T1078/001/"

[rule.threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1610"
name = "Deploy Container"
reference = "https://attack.mitre.org/techniques/T1610/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "client.user.email",
    "source.ip",
    "user_agent.original",
    "event.action",
    "event.outcome",
    "gcp.audit.resource_name",
    "gcp.audit.request.spec.serviceAccountName",
    "gcp.audit.request.spec.containers.image",
    "data_stream.namespace",
]

[rule]
description = """
Identifies the execution of a Java JAR application from suspicious file paths such as downloads and compression
utilities extraction paths.
"""
id = "b5d02713-e392-47c4-b38b-10b68dbc00a6"
license = "Elastic License v2"
name = "JAVA Application Execution from Suspicious Paths"
os_list = ["windows"]
version = "1.0.5"

query = '''
sequence by process.entity_id with maxspan=5s
[process where event.action == "start" and
  process.name : "javaw.exe" and process.args_count == 3 and process.args : "-jar" and
  process.args :
             ("C:\\Users\\*\\Downloads\\*.jar",
              "c:\\Users\\*\\Desktop\\*.jar",
              "C:\\Users\\*\\AppData\\Local\\Temp\\7z*\\",
              "C:\\Users\\*\\AppData\\Local\\Temp\\Rar$*\\*",
              "C:\\Users\\*\\AppData\\Local\\Temp\\Temp?_*\\*",
              "C:\\Users\\*\\AppData\\Local\\Temp\\BNZ.*")
  ]
[network where event.action in ("connection_accepted", "connection_attempted") and
 not cidrmatch(destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24",
       "192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32",
       "192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24", "192.88.99.0/24", "224.0.0.0/4",
       "100.64.0.0/10", "192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1",
       "FE80::/10", "FF00::/8", "129.153.192.0/19", "128.194.0.0/16") and
 not (process.executable : "C:\\Program Files\\Amazon Corretto\\jdk*\\bin\\javaw.exe" and destination.ip == "164.154.131.141") and
 not (process.executable : "C:\\Program Files\\Zulu\\zulu-??\\bin\\javaw.exe" and destination.ip == "146.75.93.145")]
'''

min_endpoint_version = "7.16.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"


[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "7.16.0"

[rule]
description = """
Adversaries may load a driver to a compromised machine to execute code in kernel mode. A majority of legitimate kernel
driver installations involve a new service creation via the Windows Service Control Manager (SCM) which generate audit
logs. Adversaries can leverage the undocumented Windows API NtLoadDriver to load a driver directly, avoiding service
creation traces.
"""
id = "5b5fa228-596a-4df2-a0ff-4d98b97e67b3"
license = "Elastic License v2"
name = "Kernel Driver Registered via NtLoadDriver"
os_list = ["windows"]
reference = [
    "http://undocumented.ntinternals.net/index.html?page=UserMode%2FUndocumented%20Functions%2FExecutable%20Images%2FNtLoadDriver.html",
]
version = "1.0.27"

query = '''
sequence by process.entity_id with maxspan=5m
 [process where event.action == "start" and 
  (process.code_signature.trusted == false or process.code_signature.exists == false) and 
  (process.Ext.relative_file_creation_time <= 3600 or process.Ext.relative_file_name_modify_time <= 500)]
 [registry where
  registry.path : "HKLM\\SYSTEM\\ControlSet001\\*\\Type" and registry.data.strings : "1"]
'''

min_endpoint_version = "8.10.0"
reputation = true
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1068"
name = "Exploitation for Privilege Escalation"
reference = "https://attack.mitre.org/techniques/T1068/"

[[threat.technique]]
id = "T1543"
name = "Create or Modify System Process"
reference = "https://attack.mitre.org/techniques/T1543/"
[[threat.technique.subtechnique]]
id = "T1543.003"
name = "Windows Service"
reference = "https://attack.mitre.org/techniques/T1543/003/"



[threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[internal]
min_endpoint_version = "8.10.0"