Elastic rules: 0t

[metadata]
creation_date = "2022/01/31"
integration = ["system", "windows"]
maturity = "production"
updated_date = "2026/05/03"

[rule]
author = ["Elastic"]
description = """
Detects modifications in the AdminSDHolder object. Attackers can abuse the SDProp process to implement a persistent
backdoor in Active Directory. SDProp compares the permissions on protected objects with those defined on the
AdminSDHolder object. If the permissions on any of the protected accounts and groups do not match, the permissions on
the protected accounts and groups are reset to match those of the domain's AdminSDHolder object, regaining their
Administrative Privileges.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-system.security*", "logs-windows.forwarded*"]
language = "kuery"
license = "Elastic License v2"
name = "AdminSDHolder Backdoor"
references = [
    "https://adsecurity.org/?p=1906",
    "https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-c--protected-accounts-and-groups-in-active-directory",
]
risk_score = 73
rule_id = "6e9130a5-9be6-48e5-943a-9628bfc74b18"
severity = "high"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Persistence",
    "Use Case: Active Directory Monitoring",
    "Data Source: Active Directory",
    "Data Source: Windows Security Event Logs",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
event.code:5136 and host.os.type:"windows" and winlog.event_data.ObjectDN:CN=AdminSDHolder,CN=System*
'''

note = """## Triage and analysis

### Investigating AdminSDHolder Backdoor

#### Possible investigation steps

- What AdminSDHolder change did the alert preserve?
  - Focus: confirm `winlog.event_data.ObjectDN` under AdminSDHolder, then read `winlog.event_data.AttributeLDAPDisplayName`, `winlog.event_data.OperationType`, `winlog.event_data.AttributeValue`, and `winlog.event_data.AttributeSyntaxOID`.
  - Implication: escalate on "nTSecurityDescriptor", ownership data, or any value that can alter control of protected objects; lower concern only for non-security metadata tied to a recognized tier-0 maintenance workflow.

- What did the correlated 5136 operation contain?
  - Why: one alert document may show only part of a logical directory change; `winlog.event_data.OpCorrelationID` reconstructs the rest of the operation.
  - Focus: review same-controller `5136` events for the same `host.id`, `winlog.computer_name`, and `winlog.event_data.OpCorrelationID`; compare attribute, value, and operation type. $investigate_0
  - Implication: escalate when the operation adds multiple ACL changes, touches unrelated sensitive attributes, or suggests a staged AdminSDHolder template rewrite; lower concern only when bounded to one expected non-security update on the same object.

- Does the recovered value grant or preserve access that SDProp can stamp onto protected identities?
  - Why: AdminSDHolder is the ACL template for protected accounts and groups, so a small template edit can become persistent privileged access after SDProp runs.
  - Focus: interpret attribute name, value, and syntax for a new trustee, ACE, owner reference, or delegated right rather than non-security metadata.
  - Implication: escalate when the value adds a SID, DN, ACE, owner path, Full Control, Modify, WriteDacl, WriteOwner, or GenericAll outside the expected tier-0 admin set; truncated or opaque values keep permission impact unresolved and require preserving raw change data.

- Who initiated the modification, and where did the session originate?
  - Focus: identify the writer and controller with `user.id`, `winlog.event_data.SubjectUserSid`, `winlog.event_data.SubjectLogonId`, and `winlog.computer_name`.
  - Hint: on the same `winlog.computer_name`, match `5136` `winlog.event_data.SubjectLogonId` to `4624` `winlog.event_data.TargetLogonId`; search `4648` for the same `winlog.event_data.SubjectLogonId` when explicit credentials matter, then read `source.ip` and `winlog.event_data.AuthenticationPackageName`. Missing linked authentication records or `source.ip` leaves origin unresolved, not benign.
    - $investigate_1
    - $investigate_2
  - Implication: escalate when the writer is unexpected, source or auth method does not fit tier-0 administration, or origin remains unresolved with a security-relevant change; do not wait on auth pivots when the attribute/value and change set already prove unauthorized rights.

- Did the template change propagate or get forced onto protected objects?
  - Why: SDProp can apply the AdminSDHolder template to protected accounts and groups, so impact may appear after the initial directory-change event.
  - Focus: on the same `winlog.event_data.DSName` or `winlog.computer_name`, review later `5136` events for object, attribute, writer, and time on protected users or groups.
  - Hint: if the logging controller has no follow-on records, search the same `winlog.event_data.DSName` across domain controllers; absence on one controller does not clear propagation. $investigate_3
  - Implication: escalate when later events show security-descriptor, owner, or trustee changes on protected identities after the AdminSDHolder edit; no follow-on `5136` visibility leaves propagation unresolved, not benign.

- Escalate when object, security-relevant attribute/value, `winlog.event_data.OpCorrelationID`, writer/session origin, or propagation evidence shows unauthorized control; close only when the exact change, bounded `5136` set, actor/session origin, and available change or baseline record all point to one recognized tier-0 workflow; preserve directory-change evidence and escalate mixed or incomplete answers. If local answers stay suspicious or unresolved, review alerts for the modifying `user.id`; use controller `host.id` alert history only when actor evidence is sparse or controller compromise is plausible.
    - $investigate_4
    - $investigate_5

### False positive analysis

- AdminSDHolder ACL hardening, delegated-directory cleanup, security-baseline tooling, or migration automation are narrow tier-0 exceptions, not routine administration. Confirm the exact attribute/value/operation for `winlog.event_data.ObjectDN`, expected admin or service-account session, bounded `winlog.event_data.OpCorrelationID`, matching controller/template rollout, and no unrelated actor or controller alerts. If change records, automation inventory, or deployment records exist, require alignment; otherwise prove the current actor/action or service-account/template fit from telemetry first, then use prior recurrence only to support exception stability.
- Before creating an exception, validate recurrence of the same `user.id` or `winlog.event_data.SubjectUserSid`, specific attribute, object, `winlog.event_data.DSName`, bounded operation shape, and controller pattern across prior alerts from this rule. Build the exception from that minimum confirmed workflow only after the current event is fully explained, and avoid exceptions on AdminSDHolder changes, Windows Security event "5136", or the rule name alone.

### Response and remediation

- If confirmed benign, reverse any temporary containment and record the exact actor, session, AdminSDHolder object, changed attribute, operation-correlation, and controller pattern that proved the recognized workflow. Do not keep a broad exception unless the same workflow recurs.
- If suspicious but unconfirmed, preserve the triggering `5136` event, the correlated `winlog.event_data.OpCorrelationID` change set, the current AdminSDHolder security descriptor, linked `4624` or `4648` session records, and case exports before containment. Apply reversible containment first, such as temporarily restricting the modifying account's directory-write path or increasing monitoring on the recovered actor and controller. Use broader account disablement or domain-controller isolation only if related alerts or follow-on directory abuse show active compromise and the AD response owner accepts the operational impact.
- If confirmed malicious, export the current AdminSDHolder security descriptor, recovered `5136` change set, replication context, implicated object identity, actor SID, logon session, and source-origin evidence before rollback or account action. Contain the modifying account and any recovered source endpoint or IP through identity-response or endpoint-response tooling; if direct response is unavailable, escalate that preserved evidence set to the AD or incident-response team that can act.
- After containment, review protected users and groups for unauthorized ACEs, owner changes, or delegated rights that may have been restamped from the tampered template before removing them. Restore the AdminSDHolder ACL to a known-good state, verify clean replication across domain controllers, then reset or rotate privileged credentials exposed or newly granted through the unauthorized template.
- Post-incident hardening: restrict AdminSDHolder write access to dedicated tier-0 administration paths, baseline the expected AdminSDHolder security descriptor, keep directory-service change auditing for `5136` and linked authentication logging enabled on domain controllers, and record telemetry gaps that limited the investigation.
"""

setup = """## Setup

Audit Directory Service Changes must be enabled to generate the events used by this rule.
Setup instructions: https://ela.st/audit-directory-service-changes
"""

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.id",
    "winlog.event_data.SubjectUserName",
    "winlog.event_data.SubjectUserSid",
    "winlog.event_data.SubjectLogonId",
    "winlog.event_data.ObjectDN",
    "winlog.event_data.ObjectClass",
    "winlog.event_data.AttributeLDAPDisplayName",
    "winlog.event_data.AttributeValue",
    "winlog.event_data.OperationType",
    "winlog.event_data.OpCorrelationID",
    "winlog.event_data.DSName",
    "host.id",
    "winlog.computer_name",
]

[transform]

[[transform.investigate]]
label = "All 5136 events in this AdminSDHolder change set"
description = ""
providers = [
  [
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "winlog.event_data.OpCorrelationID", queryType = "phrase", value = "{{winlog.event_data.OpCorrelationID}}", valueType = "string" },
    { excluded = false, field = "event.code", queryType = "phrase", value = "5136", valueType = "string" }
  ]
]
relativeFrom = "now-24h/h"
relativeTo = "now"

[[transform.investigate]]
label = "Linked logon for the modifying session"
description = ""
providers = [
  [
    { excluded = false, field = "winlog.computer_name", queryType = "phrase", value = "{{winlog.computer_name}}", valueType = "string" },
    { excluded = false, field = "winlog.event_data.TargetLogonId", queryType = "phrase", value = "{{winlog.event_data.SubjectLogonId}}", valueType = "string" },
    { excluded = false, field = "event.code", queryType = "phrase", value = "4624", valueType = "string" }
  ]
]
relativeFrom = "now-24h/h"
relativeTo = "now"

[[transform.investigate]]
label = "Explicit credential events for the modifying session"
description = ""
providers = [
  [
    { excluded = false, field = "winlog.computer_name", queryType = "phrase", value = "{{winlog.computer_name}}", valueType = "string" },
    { excluded = false, field = "winlog.event_data.SubjectLogonId", queryType = "phrase", value = "{{winlog.event_data.SubjectLogonId}}", valueType = "string" },
    { excluded = false, field = "event.code", queryType = "phrase", value = "4648", valueType = "string" }
  ]
]
relativeFrom = "now-24h/h"
relativeTo = "now"

[[transform.investigate]]
label = "Later 5136 changes in the same directory service"
description = ""
providers = [
  [
    { excluded = false, field = "winlog.event_data.DSName", queryType = "phrase", value = "{{winlog.event_data.DSName}}", valueType = "string" },
    { excluded = false, field = "event.code", queryType = "phrase", value = "5136", valueType = "string" }
  ],
  [
    { excluded = false, field = "winlog.computer_name", queryType = "phrase", value = "{{winlog.computer_name}}", valueType = "string" },
    { excluded = false, field = "event.code", queryType = "phrase", value = "5136", valueType = "string" }
  ]
]
relativeFrom = "now"
relativeTo = "now"

[[transform.investigate]]
label = "Recent alerts tied to this modifying identity"
description = ""
providers = [
  [
    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
    { excluded = false, field = "user.id", queryType = "phrase", value = "{{user.id}}", valueType = "string" }
  ]
]
relativeFrom = "now-48h/h"
relativeTo = "now"

[[transform.investigate]]
label = "Recent alerts on this domain controller"
description = ""
providers = [
  [
    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" }
  ]
]
relativeFrom = "now-48h/h"
relativeTo = "now"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"

[[rule.threat.technique.subtechnique]]
id = "T1078.002"
name = "Domain Accounts"
reference = "https://attack.mitre.org/techniques/T1078/002/"

[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[metadata]
creation_date = "2020/11/06"
integration = ["okta"]
maturity = "production"
updated_date = "2026/04/10"

[rule]
author = ["Elastic"]
description = """
Detects attempts to deactivate an Okta application. An adversary may attempt to modify, deactivate, or delete an Okta
application in order to weaken an organization's security controls or disrupt their business operations.
"""
false_positives = [
    """
    Consider adding exceptions to this rule to filter false positives if your organization's Okta applications are
    regularly deactivated and the behavior is expected.
    """,
]
index = ["filebeat-*", "logs-okta*"]
language = "kuery"
license = "Elastic License v2"
name = "Attempt to Deactivate an Okta Application"
note = """## Triage and analysis

### Investigating Attempt to Deactivate an Okta Application

This rule detects attempts to deactivate an Okta application. Unauthorized deactivation could lead to disruption of services and pose a significant risk to the organization.

#### Possible investigation steps:
- Identify the actor associated with the deactivation attempt by examining the `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, and `okta.actor.display_name` fields.
- Determine the client used by the actor. Review the `okta.client.ip`, `okta.client.user_agent.raw_user_agent`, `okta.client.zone`, `okta.client.device`, and `okta.client.id` fields.
- If the client is a device, check the `okta.device.id`, `okta.device.name`, `okta.device.os_platform`, `okta.device.os_version`, and `okta.device.managed` fields.
- Understand the context of the event from the `okta.debug_context.debug_data` and `okta.authentication_context` fields.
- Check the `okta.outcome.result` and `okta.outcome.reason` fields to see if the attempt was successful or failed.
- Review the past activities of the actor involved in this action by checking their previous actions logged in the `okta.target` field.
- Analyze the `okta.transaction.id` and `okta.transaction.type` fields to understand the context of the transaction.
- Evaluate the actions that happened just before and after this event in the `okta.event_type` field to help understand the full context of the activity.

### False positive analysis:
- It might be a false positive if the action was part of a planned activity, performed by an authorized person, or if the `okta.outcome.result` field shows a failure.
- An unsuccessful attempt might also indicate an authorized user having trouble rather than a malicious activity.

### Response and remediation:
- If unauthorized deactivation attempts are confirmed, initiate the incident response process.
- Block the IP address or device used in the attempts if they appear suspicious, using the data from the `okta.client.ip` and `okta.device.id` fields.
- Reset the user's password and enforce MFA re-enrollment, if applicable.
- Conduct a review of Okta policies and ensure they are in accordance with security best practices.
- If the deactivated application was crucial for business operations, coordinate with the relevant team to reactivate it and minimize the impact.

## Setup

The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
"""
references = [
    "https://help.okta.com/en/prod/Content/Topics/Apps/Apps_Apps.htm",
    "https://developer.okta.com/docs/reference/api/system-log/",
    "https://developer.okta.com/docs/reference/api/event-types/",
    "https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy",
    "https://www.elastic.co/security-labs/monitoring-okta-threats-with-elastic-security",
    "https://www.elastic.co/security-labs/starter-guide-to-understanding-okta",
]
risk_score = 21
rule_id = "edb91186-1c7e-4db8-b53e-bfa33a1a0a8a"
severity = "low"
tags = [
    "Use Case: Identity and Access Audit",
    "Data Source: Okta",
    "Tactic: Impact",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset:okta.system and event.action:application.lifecycle.deactivate
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1489"
name = "Service Stop"
reference = "https://attack.mitre.org/techniques/T1489/"

[rule.threat.tactic]
id = "TA0040"
name = "Impact"
reference = "https://attack.mitre.org/tactics/TA0040/"

[metadata]
creation_date = "2020/05/21"
integration = ["aws"]
maturity = "production"
updated_date = "2026/08/05"

[rule]
author = ["Elastic"]
description = """
Identifies the deletion of an Amazon RDS DB instance, Aurora cluster, or global database cluster. Deleting these
resources permanently destroys stored data and can cause major service disruption. Adversaries with sufficient
permissions may delete RDS resources to impede recovery, destroy evidence, or inflict operational impact on the
environment.
"""
false_positives = [
    """
    RDS instances or clusters may be intentionally deleted by database administrators or during planned decommissioning
    activities. Verify the user identity, source IP, and change context to ensure the deletion is expected.
    CloudFormation stack removals and automated cleanup workflows may also trigger these events and can be exempted if
    known and authorized.
    """,
]
from = "now-6m"
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
language = "kuery"
license = "Elastic License v2"
name = "AWS RDS DB Instance or Cluster Deleted"
note = """## Triage and analysis

### Investigating AWS RDS DB Instance or Cluster Deleted

This rule detects the deletion of an RDS DB instance, Aurora DB cluster, or global database cluster. These operations permanently remove stored data and backups unless final snapshots are explicitly retained. Adversaries may delete RDS resources as part of a destructive attack, to eliminate forensic evidence, or to disrupt critical workloads. Because deletions are irreversible without backups, immediate review is required to determine whether the action was authorized and assess potential data loss.

#### Possible investigation steps

**Identify the Actor**
- Review `aws.cloudtrail.user_identity.arn` and `aws.cloudtrail.user_identity.access_key_id` to determine who performed the action.
- Validate:
  - Is this user/role authorized to delete DB instances or clusters?
  - Does this action align with past behavior?

**Review the Deletion Event**
- Confirm which action was invoked: `DeleteDBInstance`, `DeleteDBCluster` or `DeleteGlobalCluster`
- Examine `aws.cloudtrail.request_parameters`. Identify which resource was deleted and whether a final snapshot was created before deletion.

**Analyze Source and Access Context**
- Check `source.ip`, `source.geo` fields and `user_agent.original`
- Validate whether:
  - The request originated from a known network or VPN.
  - The user normally logs in from this location.
  - The call was made via AWS Console vs CLI vs SDK.

**Correlate Surrounding Activity**
Search CloudTrail for:
- Recent IAM role or policy changes.
- Privilege escalation events (STS AssumeRole, CreateAccessKey, AttachUserPolicy).
- Disablement of related safety controls:
  - deletionProtection modified to `false`
  - backupRetentionPeriod set to `0`
- Suspicious sequencing:
  - Snapshots deleted before the instance/cluster deletion.
  - Network security group modifications enabling broader access before deletion.

**Validate Organizational Intent**
- Contact the service owner or DB administrator to confirm whether the deletion is expected.

**Assess Impact and Data Recovery Path**
- Identify which DB instance or cluster was deleted
- Evaluate:
  - Whether automated backups existed.
  - Whether point-in-time recovery is still possible.
  - Whether a final snapshot was created.

### False positive analysis

- **Planned decommissioning**:  
  - Confirm if this action aligns with a scheduled removal or environment cleanup.
- **CloudFormation stack deletion**:  
  - Stack teardown often deletes RDS resources; confirm if this occurred.
- **Automated testing or ephemeral environments**:  
  - Test/dev pipelines may frequently create and delete clusters.
- **Infrastructure-as-code workflows**:  
  - Terraform destroys or GitOps cleanup jobs can generate legitimate deletion events.

### Response and remediation

**If the deletion was unauthorized:**
**Immediately restrict the actor**
   - Disable or revoke the user’s access keys.
   - Revoke active session tokens.

**Attempt recovery**
   - Restore from:
     - Final snapshot (if created)
     - Automated backups
   - Rebuild cluster/instance configurations based on IaC or documented templates.

**Perform full log review**
   - CloudTrail, RDS Enhanced Monitoring, and VPC Flow Logs
   - Identify lateral movement or privilege escalation preceding the deletion.

**Scope and contain the incident**
   - Determine whether:
     - Additional RDS resources were targeted
     - IAM permissions were modified
     - Other destructive API calls were made

**Hardening actions**
   - Enable deletionProtection on all critical instances/clusters.
   - Require final snapshot creation for all deletion operations.
   - Enforce MFA for IAM users with RDS privileges.
   - Limit RDS modification/deletion permissions to specific IAM roles.

**Documentation and Follow-Up**
   - Update incident response runbooks.
   - Communicate with service owners and leadership.
   - Add enhanced monitoring rules around:
     - Snapshot deletions
     - Backup retention modifications
     - RDS role changes
     - DeletionProtection disable events

### Additional information

- **[AWS IR Playbooks](https://github.com/aws-samples/aws-incident-response-playbooks/blob/c151b0dc091755fffd4d662a8f29e2f6794da52c/playbooks/)** 
- **[AWS Customer Playbook Framework](https://github.com/aws-samples/aws-customer-playbook-framework/tree/a8c7b313636b406a375952ac00b2d68e89a991f2/docs)** 
- **Security Best Practices:** [AWS Knowledge Center – Security Best Practices](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/).
"""
references = [
    "https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DeleteDBCluster.html",
    "https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DeleteGlobalCluster.html",
    "https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DeleteDBInstance.html",
]
risk_score = 47
rule_id = "9055ece6-2689-4224-a0e0-b04881e1f8ad"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Platform: AWS",
    "Data Source: AWS CloudTrail",
    "Service: AWS RDS",
    "Tactic: Impact",
    "Rule Type: Custom Query (KQL)",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset: aws.cloudtrail 
    and event.provider: rds.amazonaws.com 
    and event.action: (DeleteDBCluster or DeleteGlobalCluster or DeleteDBInstance)
    and event.outcome: success
    and not user_agent.original: (*Terraform* or *Pulumi*)
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1485"
name = "Data Destruction"
reference = "https://attack.mitre.org/techniques/T1485/"


[rule.threat.tactic]
id = "TA0040"
name = "Impact"
reference = "https://attack.mitre.org/tactics/TA0040/"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user_agent.original",
    "source.ip",
    "aws.cloudtrail.user_identity.arn",
    "aws.cloudtrail.user_identity.type",
    "aws.cloudtrail.user_identity.access_key_id",
    "event.action",
    "event.outcome",
    "cloud.account.id",
    "cloud.region",
    "aws.cloudtrail.request_parameters",
    "aws.cloudtrail.response_elements",
]

[metadata]
creation_date = "2020/08/17"
integration = ["azure"]
maturity = "production"
updated_date = "2026/06/10"

[rule]
author = ["Elastic"]
description = """
Identifies synchronous command execution on a virtual machine (VM) or virtual machine scale set (VMSS) in Azure via the
action-based Run Command ("runCommand/action"). A Virtual Machine Contributor role lets you manage virtual machines, but
not access them, nor access the virtual network or storage account they’re connected to. However, commands can be run on
the VM via the Run Command feature, which execute as System (Windows) or root (Linux). Other roles, such as certain
Administrator roles, may be able to execute commands on a VM as well.
"""
false_positives = [
    """
    Command execution on a virtual machine may be done by a system or network administrator. Verify whether the
    username, hostname, and/or resource name should be making changes in your environment. Command execution from
    unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted
    from the rule.
    """,
]
from = "now-9m"
index = ["logs-azure.activitylogs-*", "filebeat-*"]
language = "kuery"
license = "Elastic License v2"
name = "Azure Compute VM Command Executed"
note = """## Triage and analysis

### Investigating Azure Compute VM Command Executed

Azure Virtual Machines (VMs) allow users to run applications and services in the cloud. While roles like Virtual Machine Contributor can manage VMs, they typically can't access them directly. However, commands can be executed remotely via PowerShell, running as System. Adversaries may exploit this to execute unauthorized commands. The detection rule monitors Azure activity logs for command execution events, flagging successful operations to identify potential misuse.

### Possible investigation steps

- Review the Azure activity logs to identify the specific user or service principal that initiated the command execution event, focusing on the operation_name values "MICROSOFT.COMPUTE/VIRTUALMACHINES/RUNCOMMAND/ACTION" and "MICROSOFT.COMPUTE/VIRTUALMACHINESCALESETS/VIRTUALMACHINES/RUNCOMMAND/ACTION".
- Identify the VM in question via the `azure.resource.name` field. This can aid with pivoting into endpoint analysis of the commands executed.
- Check the event.outcome field to confirm the success of the command execution and gather details about the command executed.
- Investigate the role and permissions of the user or service principal involved to determine if they have legitimate reasons to execute commands on the VM.
- Analyze the context of the command execution, including the time and frequency of the events, to identify any unusual patterns or anomalies.
- Correlate the command execution event with other logs or alerts from the same time period to identify any related suspicious activities or potential lateral movement.
- If unauthorized access is suspected, review the VM's security settings and access controls to identify and mitigate any vulnerabilities or misconfigurations.

### False positive analysis

- Routine maintenance tasks executed by IT administrators can trigger the rule. To manage this, create exceptions for known maintenance scripts or scheduled tasks that are regularly executed.
- Automated deployment processes that use PowerShell scripts to configure or update VMs may be flagged. Identify these processes and exclude them from the rule to prevent unnecessary alerts.
- Security tools or monitoring solutions that perform regular checks on VMs might execute commands that are benign. Whitelist these tools by identifying their specific command patterns and excluding them from detection.
- Development and testing environments often involve frequent command executions for testing purposes. Consider excluding these environments from the rule or setting up a separate monitoring policy with adjusted thresholds.
- Ensure that any exclusion or exception is documented and reviewed periodically to maintain security posture and adapt to any changes in the environment or processes.

### Response and remediation

- Immediately isolate the affected virtual machine from the network to prevent further unauthorized command execution and potential lateral movement.
- Review the Azure activity logs to identify the source of the command execution and determine if it was authorized or part of a larger attack pattern.
- Revoke any unnecessary permissions from users or roles that have the ability to execute commands on virtual machines, focusing on those with Virtual Machine Contributor roles.
- Conduct a thorough investigation of the executed commands to assess any changes or impacts on the system, and restore the VM to a known good state if necessary.
- Implement additional monitoring and alerting for similar command execution activities, ensuring that any future unauthorized attempts are detected promptly.
- Escalate the incident to the security operations team for further analysis and to determine if additional systems or data may have been compromised.
- Review and update access control policies and role assignments to ensure that only necessary permissions are granted, reducing the risk of similar incidents in the future.
"""
references = [
    "https://adsecurity.org/?p=4277",
    "https://posts.specterops.io/attacking-azure-azure-ad-and-introducing-powerzure-ca70b330511a",
    "https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#virtual-machine-contributor",
    "https://www.netspi.com/blog/technical-blog/adversary-simulation/7-ways-to-execute-command-on-azure-virtual-machine-virtual-machine-scale-sets/",
    "https://hackingthe.cloud/azure/run-command-abuse/",
    "https://learn.microsoft.com/en-us/azure/virtual-machines/windows/run-command-managed",
]
risk_score = 47
rule_id = "60884af6-f553-4a6c-af13-300047455491"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Domain: Endpoint",
    "Data Source: Azure",
    "Data Source: Azure Activity Logs",
    "Use Case: Threat Detection",
    "Tactic: Execution",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "new_terms"

query = '''
data_stream.dataset:azure.activitylogs and
    azure.activitylogs.operation_name:(
        "MICROSOFT.COMPUTE/VIRTUALMACHINES/RUNCOMMAND/ACTION" or
        "MICROSOFT.COMPUTE/VIRTUALMACHINESCALESETS/VIRTUALMACHINES/RUNCOMMAND/ACTION"
    ) and event.outcome:(Success or success) and
    azure.activitylogs.identity.authorization.evidence.principal_id: * and
    source.as.number: * and
    azure.resource.name: *
'''

[rule.new_terms]
field = "new_terms_fields"
value = [
    "azure.activitylogs.identity.authorization.evidence.principal_id",
    "azure.resource.name",
    "source.as.number"
]
[[rule.new_terms.history_window_start]]
field = "history_window_start"
value = "now-7d"


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1651"
name = "Cloud Administration Command"
reference = "https://attack.mitre.org/techniques/T1651/"


[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[rule]
description = """
Identifies DNS queries to common web services by a signed Microsoft binary execution proxy. Adversaries may implement
command and control communications that use common web services in order to hide their activity.
"""
id = "c567240c-445b-4000-9612-b5531e21e050"
license = "Elastic License v2"
name = "Connection to WebService by a Signed Binary Proxy"
os_list = ["windows"]
reference = [
    "https://www.elastic.co/security-labs/doing-time-with-the-yipphb-dropper",
    "https://www.elastic.co/security-labs/globally-distributed-stealers",
]
version = "1.0.70"

query = '''
sequence by process.entity_id with maxspan=5m
  [process where event.action == "start" and user.id like ("S-1-5-21*", "S-1-12-*") and
    (
     process.name : ("wscript.exe", "cscript.exe", "regsvr32.exe", "mshta.exe", "rundll32.exe", "vbc.exe",
                     "msbuild.exe", "wmic.exe", "cmstp.exe", "RegAsm.exe", "installutil.exe","RegSvcs.exe",
                     "msxsl.exe", "xwizard.exe", "csc.exe", "net.exe", "certutil.exe", "ssh.exe",
                     "scp.exe", "msiexec.exe", "bitsadmin.exe") or
     process.pe.original_file_name : ("wscript.exe", "cscript.exe", "regsvr32.exe", "mshta.exe", "rundll32.exe", 
                                      "vbc.exe", "msbuild.exe", "wmic.exe", "cmstp.exe", "RegAsm.exe", "installutil.exe", 
                                      "RegSvcs.exe", "msxsl.exe", "xwizard.exe", "csc.exe", "net.exe",
                                      "certutil.exe", "ssh.exe", "scp.exe", "msiexec.exe", "bitsadmin.exe") or
     process.code_signature.subject_name == "OpenJS Foundation" or
     process.executable : ("?:\\Program Files\\Java\\jre*\\bin\\javaw.exe",
                           "?:\\Program Files (x86)\\Java\\jre*\\bin\\javaw.exe",
                           "?:\\Users\\*\\AppData\\*\\jre\\bin\\javaw.exe",
                           "?:\\ProgramData\\*\\javaw.exe",
                           "?:\\ProgramData\\javaw.exe",
                           "?:\\Users\\Public\\*\\javaw.exe",
                           "?:\\Windows\\Microsoft.NET\\*.exe") or
     ((process.name : "powershell.exe" or process.pe.original_file_name == "PowerShell.EXE") and process.args_count >= 2)
     ) and
     not (process.name : "rundll32.exe" and process.command_line : "*davclnt.dll,DavSetCookie*") and
     not (process.parent.executable : ("?:\\Program Files\\Microsoft SQL Server\\MSSQL*.EXE", "?:\\Program Files\\WindowsApps\\Microsoft.*.exe") and
          process.name : ("powershell.exe", "pwsh.exe")) and
     not (process.name : "java.exe" and process.parent.executable : "?:\\Program Files\\OWASP\\Zed Attack Proxy\\ZAP.exe") and
     not (process.name : "java.exe" and process.args_count >= 5) and
     not process.executable : ("?:\\Program Files\\Microsoft Visual Studio\\*\\MSBuild.exe", "?:\\Program Files (x86)\\Microsoft Visual Studio\\*\\MSBuild.exe") and
     not (process.name : "javaw.exe" and
          process.parent.executable : ("?:\\Program Files\\QZ Tray\\qz-tray.exe", "?:\\Program Files (x86)\\PGP Tool\\pgptool.exe", "?:\\Program Files\\OWASP\\Zed Attack Proxy\\ZAP.exe")) and
     not (process.name : "rundll32.exe" and process.args : "?:\\WINDOWS\\Installer\\MSI*.tmp,zzzzInvokeManagedCustomActionOutOfProc") and
     /* BlueIris - Camera IOT monitoring sw using telegram to upload pictures */
     not (process.name : "curl.exe" and process.parent.name : "cmd.exe" and process.parent.args : "C:\\BlueIris\\Telegram-Upload\\upload.cmd ") and
     not (process.name : "curl.exe" and process.parent.executable : "?:\\Program Files\\Neovim\\bin\\nvim.exe") and
     not (process.code_signature.subject_name in ("EFI Software (Electronics for Imaging, Inc.)", "Fiery, LLC", "EFI Software (Electronics for Imaging Inc.)") and
          process.code_signature.trusted == true) and
     not process.hash.sha256 in ("4337adaa6b26ea9ad6d7bd0871d49531442ba3d8a24aecc1a5a0f26378de4f78", "56b1c3941b781a00e3cd0df0c523242a4521930964f889c4b8baecd282c419b3") and
     not process.executable :
                       ("?:\\Program Files\\Git\\mingw64\\bin\\curl.exe",
                        "?:\\Program Files\\Fiery\\Components\\Common files\\curl.exe",
                        "?:\\Program Files\\Fiery\\Fiery Command WorkStation\\curl.exe",
                        "?:\\Program Files\\Microsoft Visual Studio\\*\\node.exe") and
     not (process.name : "rundll32.exe" and
          process.args : ("?:\\Program Files\\Microsoft Office\\root\\*",
                          "?:\\PROGRA~2\\MICROS~1\\Office*.CPL*",
                          "?:\\Program Files (x86)\\F5 VPN\\*",
                          "?:\\Program Files\\F5 VPN\\*",
                          "?:\\Program Files (x86)\\Microsoft Office\\root\\*",
                          "?:\\Windows\\system32\\shell32.dll,Control_RunDLL",
                          "?:\\WINDOWS\\SYSTEM32\\EDGEHTML.dll,#141",
                          "?:\\WINDOWS\\System32\\shell32.dll,SHCreateLocalServerRunDll",
                          "C:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll,",
                          "?:\\PROGRA~2\\MICROS~2\\Office*\\*.CPL*",
                          "?:\\Windows\\System32\\mshtml.dll,PrintHTML", 
                          "?:\\PROGRA~?\\MICROS~?\\Office??\\MLCFG32.CPL,@0", 
                          "AppXDeploymentExtensions.OneCore.dll,ShellRefresh",
                          "C:\\Windows\\System32\\LogiLDA.dll,LogiFetch",
                          "C:\\Windows\\System32\\mshtml.dll,PrintHTML*")) and
      not process.parent.executable : "C:\\Program Files\\Microsoft SQL Server\\150\\DTS\\Binn\\ISServerExec.exe" and
      not process.parent.executable : ("C:\\Program Files\\Logi\\LogiBolt\\LogiBolt.exe",
                                       "C:\\Program Files (x86)\\Avaya\\Avaya one-X Agent\\OneXAgentUI.exe",
                                       "C:\\Program Files (x86)\\HP\\StatusAlerts\\bin\\HPStatusAlerts.exe",
                                       "C:\\Program Files\\AutoHotkey\\AutoHotkeyU64.exe",
                                       "C:\\Program Files\\Microsoft VS Code\\Code.exe") and
      not (process.name : "powershell.exe" and process.parent.name : "wsmprovhost.exe" and
           process.command_line : "\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -Version 5.1 -s -NoLogo -NoProfile") and
      not (process.name : "curl.exe" and process.parent.name : "powershell.exe" and
           process.command_line : "\"C:\\Windows\\System32\\curl.exe\" -L -s -H \"User-Agent: PowerShell\" -H \"Accept: application/vnd.github+json\" https://api.github.com/repos/PowerShell/PowerShell/releases") and
      not (process.name : "curl.exe" and process.args :  ("DNS: %{time_namelookup}s\\nConnect: %{time_connect}s\\nStartTransfer: %{time_starttransfer}s\\nTotal: %{time_total}s\\n", "https://login.microsoftonline.com/*"))
  ]
  [dns where
    dns.question.name :
    (
        "raw.githubusercontent.*",
        "pastebin.*",
        "paste.ee",
        "ghostbin.com",
        "drive.google.com",
        "?.docs.live.net",
        "api.dropboxapi.*",
        "content.dropboxapi.*",
        "*dl.dropboxusercontent.*",
        "api.onedrive.com",
        "*.onedrive.org",
        "onedrive.live.com",
        "storage.googleapis.com",
        "www.googleapis.com",
        "filebin.net",
        "*.ngrok.io",
        "ngrok.com",
        "*.portmap.*",
        "*serveo.net",
        "*localtunnel.me",
        "*pagekite.me",
        "*localxpose.io",
        "*notabug.org",
        "rawcdn.githack.*",
        "paste.nrecom.net",
        "zerobin.net",
        "controlc.com",
        "requestbin.net",
        "slack.com",
        "api.slack.com",
        "slack-redir.net",
        "slack-files.com",
        "cdn.discordapp.com",
        "discordapp.com",
        "discord.com",
        "apis.azureedge.net",
        "cdn.sql.gg",
        "?.top4top.io",
        "top4top.io",
        "www.uplooder.net",
        "*.cdnmegafiles.com",
        "transfer.sh",
        "updates.peer2profit.com",
        "api.telegram.org",
        "t.me",
        "meacz.gq",
        "rwrd.org",
        "*.publicvm.com",
        "*.blogspot.com",
        "api.mylnikov.org",
        "script.google.com",
        "script.googleusercontent.com",
        "paste4btc.com",
        "workupload.com",
        "temp.sh",
        "filetransfer.io",
        "gofile.io",
        "store?.gofile.io",
        "tiny.one",
        "api.notion.com",
        "graph.microsoft.com",
        "*.sharepoint.com",
        "*upload.ee",
        "bit.ly",
        "t.ly",
        "cutt.ly",
        "mbasic.facebook.com",
        "login.live.com",
        "login.microsoftonline.com",
        "api.gofile.io",
        "file.io",
        "api.anonfiles.com",
        "api.trello.com",
        "api.notion.com",
        "gist.githubusercontent.com",
        "dpaste.com",
        "*azurewebsites.net",
        "*.zulipchat.com",
        "*.4shared.com",
        "filecloud.me",
        "i.ibb.co",
        "files.catbox.moe",
        "*.getmyip.com",
        "files.pythonhosted.org",
        "mockbin.org",
        "webhook.site",
        "run.mocky.io",
        "*infinityfreeapp.com",
        "free.keep.sh",
        "tinyurl.com",
        "ftpupload.net",
        "lobfile.com",
        "*.ngrok-free.app",
        "www.myexternalip.com",
        "*.aternos.me",
        "cdn??.space",
        "*.pcloud.com",
        "mediafire.zip",
        "urlz.fr",
        "api.github.com",
        "rentry.co",
        "*.b-cdn.net", 
        "pastecode.dev",
        "the.earth.li",
        "*.trycloudflare.com",
        "shorturl.at",
        "bitly.cx",
        "*.netlify.app", 
        "*.supabase.co",
        "envs.sh"
    ) and
    /* common to use powershell script by Microsoft Cloud sysadmins */
    not (process.name : ("powershell.exe", "pwsh.exe", "javaw.exe", "node.exe", "dfsvc.exe", "rundll32.exe") and
         dns.question.name : ("graph.microsoft.com", "*.sharepoint.com", "login.microsoftonline.com", "login.live.com",
                              "raw.githubusercontent.com", "api.github.com", "storage.googleapis.com")) and
    not (dns.question.name : "rev-resolve.azurewebsites.net" and process.name : "wscript.exe") and
    not (process.name : "powershell.exe" and dns.question.name like "*.azurewebsites.net") and
    not (process.name == "dfsvc.exe" and dns.question.name in ("innateclient.azurewebsites.net", "hybridconfigwizard.azurewebsites.net", "tmtdist.azurewebsites.net")) and
    not (process.executable : ("?:\\Program Files\\Git\\mingw64\\bin\\curl.exe", "C:\\Users\\*\\.babun\\cygwin\\bin\\curl.exe", "C:\\Users\\*\\Git\\mingw64\\bin\\curl.exe", "C:\\curl\\bin\\curl.exe") and
         dns.question.name in ("api.github.com", "raw.githubusercontent.com", "graph.microsoft.com"))
  ]
'''

min_endpoint_version = "7.15.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"
[[threat.technique.subtechnique]]
id = "T1071.004"
name = "DNS"
reference = "https://attack.mitre.org/techniques/T1071/004/"


[[threat.technique]]
id = "T1102"
name = "Web Service"
reference = "https://attack.mitre.org/techniques/T1102/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "7.15.0"

[rule]
description = """
Detects when the ssh-keygen binary is executed with the -D argument which can be used to load a malicious dylib into
memory.
"""
id = "53a6460a-a204-42e0-9c92-c3bef161b6c1"
license = "Elastic License v2"
name = "Dylib Load via SSH-Keygen"
os_list = ["macos"]
reference = ["https://medium.com/@D00MFist/generate-keys-or-generate-dylib-loads-c99ed48f323d"]
version = "1.0.9"

query = '''
process where event.type == "start" and process.name == "ssh-keygen" and process.args == "-D"
'''

min_endpoint_version = "8.10.2"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1574"
name = "Hijack Execution Flow"
reference = "https://attack.mitre.org/techniques/T1574/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.2"

[metadata]
creation_date = "2020/10/30"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2026/05/04"

[transform]
[[transform.osquery]]
label = "Osquery - Retrieve DNS Cache"
query = "SELECT * FROM dns_cache"

[[transform.osquery]]
label = "Osquery - Retrieve All Services"
query = "SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"

[[transform.osquery]]
label = "Osquery - Retrieve Services Running on User Accounts"
query = """
SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE
NOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR
user_account == null)
"""

[[transform.osquery]]
label = "Osquery - Retrieve Service Unsigned Executables with Virustotal Link"
query = """
SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,
services.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =
authenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'
"""


[rule]
author = ["Elastic"]
description = """
Identifies process execution from suspicious default Windows directories. This may be abused by adversaries to hide
malware in trusted paths.
"""
from = "now-9m"
index = [
    "endgame-*",
    "logs-endpoint.events.process-*",
    "logs-m365_defender.event-*",
    "logs-sentinel_one_cloud_funnel.*",
    "logs-system.security*",
    "logs-windows.forwarded*",
    "logs-windows.sysmon_operational-*",
    "winlogbeat-*",
]
language = "eql"
license = "Elastic License v2"
name = "Execution from Unusual Directory - Command Line"
note = """## Triage and analysis

### Investigating Execution from Unusual Directory - Command Line

This rule looks for the execution of scripts from unusual directories. Attackers can use system or application paths to hide malware and make the execution less suspicious.

> **Note**:
> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/current/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.

#### Possible investigation steps

- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
- Investigate other alerts associated with the user/host during the past 48 hours.
- Examine the command line to determine which commands or scripts were executed.
- Examine the host for derived artifacts that indicate suspicious activities:
  - Analyze the script using a private sandboxed analysis system.
  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
    - Attempts to contact external domains and addresses.
      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
      - Examine the DNS cache for suspicious or anomalous entries.
        - $osquery_0
    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
    - Examine the host services for suspicious or anomalous entries.
      - $osquery_1
      - $osquery_2
      - $osquery_3
  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.

### False positive analysis

- If this activity is expected and noisy in your environment, consider adding exceptions — preferably with a combination of parent process executable and command line conditions.

### Related rules

- Process Execution from an Unusual Directory - ebfe1448-7fac-4d59-acea-181bd89b1f7f

### Response and remediation

- Initiate the incident response process based on the outcome of the triage.
- Isolate the involved host to prevent further post-compromise behavior.
- If the triage identified malware, search the environment for additional compromised hosts.
  - Implement temporary network rules, procedures, and segmentation to contain the malware.
  - Stop suspicious processes.
  - Immediately block the identified indicators of compromise (IoCs).
  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
- Remove and block malicious artifacts identified during triage.
- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
"""

setup = """## Setup

This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.

Setup instructions: https://ela.st/install-elastic-defend

### Additional data sources

This rule also supports the following third-party data sources. For setup instructions, refer to the links below:

- [Microsoft Defender XDR](https://ela.st/m365-defender)
- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
- [Sysmon Event ID 1 - Process Creation](https://ela.st/sysmon-event-1-setup)
- [Windows Process Creation Logs](https://ela.st/audit-process-creation)
"""

references = [
    "https://www.elastic.co/security-labs/elastic-protects-against-data-wiper-malware-targeting-ukraine-hermeticwiper",
    "https://www.elastic.co/security-labs/hunting-for-lateral-movement-using-event-query-language",
]
risk_score = 47
rule_id = "cff92c41-2225-4763-b4ce-6f71e5bda5e6"
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Execution",
    "Tactic: Defense Evasion",
    "Resources: Investigation Guide",
    "Data Source: Elastic Endgame",
    "Data Source: Elastic Defend",
    "Data Source: Windows Security Event Logs",
    "Data Source: Microsoft Defender XDR",
    "Data Source: Sysmon",
    "Data Source: SentinelOne",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
process where host.os.type == "windows" and event.type == "start" and
  process.name : ("wscript.exe",
                  "cscript.exe",
                  "rundll32.exe",
                  "regsvr32.exe",
                  "cmstp.exe",
                  "RegAsm.exe",
                  "installutil.exe",
                  "mshta.exe",
                  "RegSvcs.exe",
                  "powershell.exe",
                  "pwsh.exe",
                  "cmd.exe") and

  /* add suspicious execution paths here */
  process.args : ("C:\\PerfLogs\\*",
                  "C:\\Users\\Public\\*",
                  "C:\\Windows\\Tasks\\*",
                  "C:\\Intel\\*",
                  "C:\\AMD\\Temp\\*",
                  "C:\\Windows\\AppReadiness\\*",
                  "C:\\Windows\\ServiceState\\*",
                  "C:\\Windows\\security\\*",
                  "C:\\Windows\\IdentityCRL\\*",
                  "C:\\Windows\\Branding\\*",
                  "C:\\Windows\\csc\\*",
                  "C:\\Windows\\DigitalLocker\\*",
                  "C:\\Windows\\en-US\\*",
                  "C:\\Windows\\wlansvc\\*",
                  "C:\\Windows\\Prefetch\\*",
                  "C:\\Windows\\Fonts\\*",
                  "C:\\Windows\\diagnostics\\*",
                  "C:\\Windows\\TAPI\\*",
                  "C:\\Windows\\INF\\*",
                  "C:\\Windows\\System32\\Speech\\*",
                  "C:\\windows\\tracing\\*",
                  "c:\\windows\\IME\\*",
                  "c:\\Windows\\Performance\\*",
                  "c:\\windows\\intel\\*",
                  "c:\\windows\\ms\\*",
                  "C:\\Windows\\dot3svc\\*",
                  "C:\\Windows\\panther\\*",
                  "C:\\Windows\\RemotePackages\\*",
                  "C:\\Windows\\OCR\\*",
                  "C:\\Windows\\appcompat\\*",
                  "C:\\Windows\\apppatch\\*",
                  "C:\\Windows\\addins\\*",
                  "C:\\Windows\\Setup\\*",
                  "C:\\Windows\\Help\\*",
                  "C:\\Windows\\SKB\\*",
                  "C:\\Windows\\Vss\\*",
                  "C:\\Windows\\servicing\\*",
                  "C:\\Windows\\CbsTemp\\*",
                  "C:\\Windows\\Logs\\*",
                  "C:\\Windows\\WaaS\\*",
                  "C:\\Windows\\twain_32\\*",
                  "C:\\Windows\\ShellExperiences\\*",
                  "C:\\Windows\\ShellComponents\\*",
                  "C:\\Windows\\PLA\\*",
                  "C:\\Windows\\Migration\\*",
                  "C:\\Windows\\debug\\*",
                  "C:\\Windows\\Cursors\\*",
                  "C:\\Windows\\Containers\\*",
                  "C:\\Windows\\Boot\\*",
                  "C:\\Windows\\bcastdvr\\*",
                  "C:\\Windows\\TextInput\\*",
                  "C:\\Windows\\security\\*",
                  "C:\\Windows\\schemas\\*",
                  "C:\\Windows\\SchCache\\*",
                  "C:\\Windows\\Resources\\*",
                  "C:\\Windows\\rescache\\*",
                  "C:\\Windows\\Provisioning\\*",
                  "C:\\Windows\\PrintDialog\\*",
                  "C:\\Windows\\PolicyDefinitions\\*",
                  "C:\\Windows\\media\\*",
                  "C:\\Windows\\Globalization\\*",
                  "C:\\Windows\\L2Schemas\\*",
                  "C:\\Windows\\LiveKernelReports\\*",
                  "C:\\Windows\\ModemLogs\\*",
                  "C:\\Windows\\ImmersiveControlPanel\\*",
                  "C:\\$Recycle.Bin\\*") and

  /* noisy FP patterns */

  not process.parent.executable : ("C:\\WINDOWS\\System32\\DriverStore\\FileRepository\\*\\igfxCUIService*.exe",
                                   "C:\\Windows\\System32\\spacedeskService.exe",
                                   "C:\\Program Files\\Dell\\SupportAssistAgent\\SRE\\SRE.exe") and
  not (process.name : "rundll32.exe" and
       process.args : ("uxtheme.dll,#64",
                       "PRINTUI.DLL,PrintUIEntry",
                       "?:\\Windows\\System32\\FirewallControlPanel.dll,ShowNotificationDialog",
                       "?:\\WINDOWS\\system32\\Speech\\SpeechUX\\sapi.cpl",
                       "?:\\Windows\\system32\\shell32.dll,OpenAs_RunDLL")) and

  not (process.name : "cscript.exe" and process.args : "?:\\WINDOWS\\system32\\calluxxprovider.vbs") and

  not (process.name : "cmd.exe" and process.args : "?:\\WINDOWS\\system32\\powercfg.exe" and process.args : "?:\\WINDOWS\\inf\\PowerPlan.log") and

  not (process.name : "regsvr32.exe" and process.args : "?:\\Windows\\Help\\OEM\\scripts\\checkmui.dll") and

  not (process.name : "cmd.exe" and
       process.parent.executable : ("?:\\Windows\\System32\\oobe\\windeploy.exe",
                                    "?:\\Program Files (x86)\\ossec-agent\\wazuh-agent.exe",
                                    "?:\\Windows\\System32\\igfxCUIService.exe",
                                    "?:\\Windows\\Temp\\IE*.tmp\\IE*-support\\ienrcore.exe"))
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"

[[rule.threat.technique.subtechnique]]
id = "T1059.001"
name = "PowerShell"
reference = "https://attack.mitre.org/techniques/T1059/001/"

[[rule.threat.technique.subtechnique]]
id = "T1059.003"
name = "Windows Command Shell"
reference = "https://attack.mitre.org/techniques/T1059/003/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1036"
name = "Masquerading"
reference = "https://attack.mitre.org/techniques/T1036/"

[[rule.threat.technique.subtechnique]]
id = "T1036.005"
name = "Match Legitimate Resource Name or Location"
reference = "https://attack.mitre.org/techniques/T1036/005/"

[[rule.threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"

[[rule.threat.technique.subtechnique]]
id = "T1218.003"
name = "CMSTP"
reference = "https://attack.mitre.org/techniques/T1218/003/"

[[rule.threat.technique.subtechnique]]
id = "T1218.004"
name = "InstallUtil"
reference = "https://attack.mitre.org/techniques/T1218/004/"

[[rule.threat.technique.subtechnique]]
id = "T1218.005"
name = "Mshta"
reference = "https://attack.mitre.org/techniques/T1218/005/"

[[rule.threat.technique.subtechnique]]
id = "T1218.009"
name = "Regsvcs/Regasm"
reference = "https://attack.mitre.org/techniques/T1218/009/"

[[rule.threat.technique.subtechnique]]
id = "T1218.010"
name = "Regsvr32"
reference = "https://attack.mitre.org/techniques/T1218/010/"

[[rule.threat.technique.subtechnique]]
id = "T1218.011"
name = "Rundll32"
reference = "https://attack.mitre.org/techniques/T1218/011/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[rule]
description = """
Detects the rename or modification of a hidden executable file within the /Users/Shared directory. This is a consistent
technique seen utilized by DPRK actors in several separate and recent campaigns. The /Users/Shared directory is where
hidden payloads have been staged.
"""
id = "e89d9e7d-54b8-4bda-9b00-fd669c15b18f"
license = "Elastic License v2"
name = "Execution of Hidden File from the Shared Directory"
os_list = ["macos"]
version = "1.0.6"

query = '''
any where 
 (
  (event.category == "file" and event.action != "deletion" and file.Ext.header_bytes like~ ("cffaedfe*", "cafebabe*") and
   file.path like "/Users/Shared/*" and file.name like~ ".*" ) or
  
  (event.category == "process" and event.action == "exec" and process.executable like "/Users/Shared/*" and
   (process.code_signature.trusted == false or process.code_signature.exists == false) and process.name like~ ".*")
 )
'''

min_endpoint_version = "8.8.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1564"
name = "Hide Artifacts"
reference = "https://attack.mitre.org/techniques/T1564/"
[[threat.technique.subtechnique]]
id = "T1564.001"
name = "Hidden Files and Directories"
reference = "https://attack.mitre.org/techniques/T1564/001/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.8.0"

[metadata]
creation_date = "2024/09/27"
integration = ["endpoint", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2026/03/24"

[rule]
author = ["Elastic"]
description = """
This detection rule addresses multiple vulnerabilities in the CUPS printing system, including CVE-2024-47176,
CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177. Specifically, this rule detects suspicious file creation events
executed by child processes of foomatic-rip. These flaws impact components like cups-browsed, libcupsfilters, libppd,
and foomatic-rip, allowing remote unauthenticated attackers to manipulate IPP URLs or inject malicious data through
crafted UDP packets or network spoofing. This can result in arbitrary command execution when a print job is initiated.
"""
from = "now-9m"
index = ["logs-endpoint.events.file*", "logs-endpoint.events.process*", "logs-sentinel_one_cloud_funnel.*"]
language = "eql"
license = "Elastic License v2"
name = "File Creation by Cups or Foomatic-rip Child"
note = """## Triage and analysis

### Investigating File Creation by Cups or Foomatic-rip Child

This rule identifies potential exploitation attempts of several vulnerabilities in the CUPS printing system (CVE-2024-47176, CVE-2024-47076, CVE-2024-47175, CVE-2024-47177). These vulnerabilities allow attackers to send crafted IPP requests or manipulate UDP packets to execute arbitrary commands or modify printer configurations. Attackers can exploit these flaws to inject malicious data, leading to Remote Code Execution (RCE) on affected systems.

#### Possible Investigation Steps

- Investigate the incoming IPP requests or UDP packets targeting port 631.
- Examine the printer configurations on the system to determine if any unauthorized printers or URLs have been added.
- Investigate the process tree to check if any unexpected processes were triggered as a result of IPP activity. Review the executable files for legitimacy.
- Check for additional alerts related to the compromised system or user within the last 48 hours.
- Investigate network traffic logs for suspicious outbound connections to unrecognized domains or IP addresses.
- Check if any of the contacted domains or addresses are newly registered or have a suspicious reputation.
- Retrieve any scripts or executables dropped by the attack for further analysis in a private sandbox environment:
- Analyze potential malicious activity, including:
  - Attempts to communicate with external servers.
  - File access or creation of unauthorized executables.
  - Cron jobs, services, or other persistence mechanisms.

### Related Rules
- Cupsd or Foomatic-rip Shell Execution - 476267ff-e44f-476e-99c1-04c78cb3769d
- Printer User (lp) Shell Execution - f86cd31c-5c7e-4481-99d7-6875a3e31309
- Network Connection by Cups or Foomatic-rip Child - e80ee207-9505-49ab-8ca8-bc57d80e2cab
- Suspicious Execution from Foomatic-rip or Cupsd Parent - 986361cd-3dac-47fe-afa1-5c5dd89f2fb4

### False Positive Analysis

- This activity is rarely legitimate. However, verify the context to rule out non-malicious printer configuration changes or legitimate IPP requests.

### Response and Remediation

- Initiate the incident response process based on the triage outcome.
- Isolate the compromised host to prevent further exploitation.
- If the investigation confirms malicious activity, search the environment for additional compromised hosts.
- Implement network segmentation or restrictions to contain the attack.
- Stop suspicious processes or services tied to CUPS exploitation.
- Block identified Indicators of Compromise (IoCs), including IP addresses, domains, or hashes of involved files.
- Review compromised systems for backdoors, such as reverse shells or persistence mechanisms like cron jobs.
- Investigate potential credential exposure on compromised systems and reset passwords for any affected accounts.
- Restore the original printer configurations or uninstall unauthorized printer entries.
- Perform a thorough antimalware scan to identify any lingering threats or artifacts from the attack.
- Investigate how the attacker gained initial access and address any weaknesses to prevent future exploitation.
- Use insights from the incident to improve detection and response times in future incidents (MTTD and MTTR).
"""
references = [
    "https://www.elastic.co/security-labs/cups-overflow",
    "https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/",
    "https://gist.github.com/stong/c8847ef27910ae344a7b5408d9840ee1",
    "https://github.com/RickdeJager/cupshax/blob/main/cupshax.py",
]
risk_score = 47
rule_id = "b9b14be7-b7f4-4367-9934-81f07d2f63c4"
setup = """## Setup

This rule requires data coming in from Elastic Defend.

### Elastic Defend Integration Setup
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.

#### Prerequisite Requirements:
- Fleet is required for Elastic Defend.
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).

#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
- Go to the Kibana home page and click "Add integrations".
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
- Click "Add Elastic Defend".
- Configure the integration name and optionally add a description.
- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
- Click "Save and Continue".
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
"""
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: Linux",
    "Use Case: Threat Detection",
    "Use Case: Vulnerability",
    "Tactic: Execution",
    "Data Source: Elastic Defend",
    "Data Source: SentinelOne",
    "Resources: Investigation Guide",
]
type = "eql"
query = '''
sequence by host.id with maxspan=10s
  [process where host.os.type == "linux" and event.type == "start" and event.action in ("exec", "start") and
   process.parent.name == "foomatic-rip" and
   process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish")] by process.entity_id
  [file where host.os.type == "linux" and event.type != "deletion" and
   not (
     (process.name == "gs" and file.path like ("/tmp/gs_*", "/var/spool/cups/tmp/gs_*")) or
     (process.name == "pdftops" and file.path like "/tmp/0*")
   )] by process.parent.entity_id
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"

[[rule.threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"

[[rule.threat.technique]]
id = "T1203"
name = "Exploitation for Client Execution"
reference = "https://attack.mitre.org/techniques/T1203/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[rule]
description = """
Detects when the Chflags utility is used with the hidden option in order to hide a file on the filesystem. Threat actors
will use this in order to hide their payloads in order to prevent them from being noticed.
"""
id = "56982407-82a2-4423-aa43-bdddb80eb9ad"
license = "Elastic License v2"
name = "File hidden via Chflags"
os_list = ["macos"]
reference = ["https://www.jamf.com/blog/jamf-threat-labs-observes-targeted-attacks-amid-fbi-warnings/"]
version = "1.0.8"

query = '''
process where event.type == "start" and event.action == "exec" and process.name == "chflags" and 
 process.command_line like~ "* hidden *" and process.command_line like~ ("* /Users/*", "* /tmp/*") and
 not process.parent.executable like ("/usr/libexec/xpcproxy", "/usr/local/jamf/bin/jamf") and
 not (process.parent.code_signature.team_id == "738UU3Y57V" and process.parent.code_signature.trusted == true) and
 not process.Ext.effective_parent.executable like ("/Applications/Adobe After Effects */Adobe After Effects *.app/Contents/MacOS/After Effects",
                                                   "/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfDaemon.app/Contents/MacOS/JamfDaemon")
'''

min_endpoint_version = "8.11.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1564"
name = "Hide Artifacts"
reference = "https://attack.mitre.org/techniques/T1564/"
[[threat.technique.subtechnique]]
id = "T1564.001"
name = "Hidden Files and Directories"
reference = "https://attack.mitre.org/techniques/T1564/001/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.11.0"

[metadata]
bypass_bbr_timing = true
creation_date = "2023/10/11"
integration = ["github"]
maturity = "production"
updated_date = "2025/03/20"

[rule]
author = ["Elastic"]
building_block_type = "default"
description = "A GitHub user was blocked from access to an organization.\n"
from = "now-9m"
index = ["logs-github.audit-*"]
language = "eql"
license = "Elastic License v2"
name = "GitHub User Blocked From Organization"
risk_score = 21
rule_id = "4030c951-448a-4017-a2da-ed60f6d14f4f"
severity = "low"
tags = [
    "Domain: Cloud",
    "Use Case: Threat Detection",
    "Use Case: UEBA",
    "Tactic: Impact",
    "Rule Type: BBR",
    "Data Source: Github",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
configuration where event.dataset == "github.audit" and event.action == "org.block_user"
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1531"
name = "Account Access Removal"
reference = "https://attack.mitre.org/techniques/T1531/"


[rule.threat.tactic]
id = "TA0040"
name = "Impact"
reference = "https://attack.mitre.org/tactics/TA0040/"

[metadata]
creation_date = "2025/06/23"
integration = ["endpoint", "windows", "system", "crowdstrike", "sentinel_one_cloud_funnel", "auditd_manager", "cloud_defend"]
maturity = "production"
min_stack_comments = "Defend for Containers integration was re-introduced in 9.3.0"
min_stack_version = "9.3.0"
updated_date = "2026/03/30"

[rule]
author = ["Elastic"]
description = """
This rule monitors for the execution of curl or wget commands that directly access Kubernetes API endpoints,
which may indicate an attempt to interact with Kubernetes resources in a potentially unauthorized manner. This
technique is often used by adversaries to gather information about the Kubernetes environment, such as secrets,
config maps, and other sensitive data, without using the official Kubernetes client tools such as "kubectl".
"""
from = "now-9m"
index = [
    "auditbeat-*",
    "endgame-*",
    "logs-crowdstrike.fdr*",
    "logs-endpoint.events.process*",
    "logs-sentinel_one_cloud_funnel.*",
    "logs-auditd_manager.auditd-*",
    "logs-cloud_defend.process*",
    "logs-system.security*",
    "logs-windows.forwarded*",
    "logs-windows.sysmon_operational-*",
    "winlogbeat-*"
]
language = "eql"
license = "Elastic License v2"
name = "Kubernetes Direct API Request via Curl or Wget"
note = """ ## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Kubernetes Direct API Request via Curl or Wget

Kubernetes API endpoints are crucial for managing cluster resources. Adversaries may exploit tools like curl or wget to directly query these endpoints, bypassing standard clients like kubectl, to extract sensitive data such as secrets or config maps. The detection rule identifies such unauthorized access attempts by monitoring command executions that target specific API paths, flagging potential security threats.

### Possible investigation steps

- Review the process details to confirm the execution of curl or wget, focusing on the process.name and process.args fields to understand the exact command used and the specific Kubernetes API endpoint targeted.
- Check the user context under which the curl or wget command was executed, including user ID and group ID, to determine if the action was performed by a legitimate user or an unauthorized entity.
- Investigate the source IP address and host information to identify the origin of the request and assess whether it aligns with expected network activity within the Kubernetes environment.
- Examine recent authentication and authorization logs for any anomalies or failed attempts that might indicate unauthorized access attempts to the Kubernetes API.
- Correlate the alert with other security events or logs from the same timeframe to identify any related suspicious activities, such as unusual network traffic or access patterns.
- Assess the potential impact by reviewing the specific Kubernetes resources targeted, such as secrets or config maps, to determine if sensitive data might have been exposed or compromised.

### False positive analysis

- Routine monitoring scripts or health checks that use curl or wget to verify the availability of Kubernetes API endpoints may trigger this rule. To manage this, identify and whitelist the specific scripts or IP addresses that are known to perform these checks regularly.
- Automated backup processes that access Kubernetes secrets or config maps using curl or wget could be flagged. Exclude these processes by specifying their unique command patterns or execution contexts in the detection rule.
- Developers or administrators using curl or wget for legitimate troubleshooting or testing purposes might inadvertently trigger the rule. Implement user-based exceptions for known and trusted personnel who require such access for their roles.
- Integration tools or CI/CD pipelines that interact with Kubernetes APIs using curl or wget for deployment or configuration tasks may cause false positives. Create exceptions for these tools by identifying their process names or execution environments.
- Security scanners or vulnerability assessment tools that probe Kubernetes API endpoints as part of their scanning routines can be mistaken for unauthorized access attempts. Whitelist these tools by their known signatures or execution patterns to prevent false alerts.

### Response and remediation

- Immediately isolate the affected system from the network to prevent further unauthorized access to Kubernetes API endpoints.
- Revoke any potentially compromised credentials or tokens that may have been used in the unauthorized API requests.
- Conduct a thorough review of Kubernetes audit logs to identify the scope of the unauthorized access and determine if any sensitive data was exfiltrated.
- Reset and rotate all secrets and config maps that may have been accessed during the incident to ensure they are no longer valid.
- Implement network segmentation and access controls to restrict direct access to Kubernetes API endpoints, ensuring only authorized clients can communicate with the API.
- Escalate the incident to the security operations team for further investigation and to assess the need for additional security measures or incident response actions.
- Enhance monitoring and alerting for similar unauthorized access attempts by integrating additional threat intelligence and refining detection capabilities.
"""
risk_score = 47
rule_id = "b53f1d73-150d-484d-8f02-222abeb5d5fa"
setup = """## Setup

This rule requires data coming in from Elastic Defend.

### Elastic Defend Integration Setup
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.

#### Prerequisite Requirements:
- Fleet is required for Elastic Defend.
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).

#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
- Go to the Kibana home page and click "Add integrations".
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
- Click "Add Elastic Defend".
- Configure the integration name and optionally add a description.
- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
- Click "Save and Continue".
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
"""
severity = "medium"
tags = [
    "Domain: Endpoint",
    "Domain: Container",
    "Domain: Kubernetes",
    "OS: Linux",
    "OS: macOS",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Execution",
    "Tactic: Discovery",
    "Data Source: Sysmon",
    "Data Source: Windows Security Event Logs",
    "Data Source: Auditd Manager",
    "Data Source: Elastic Defend",
    "Data Source: Elastic Endgame",
    "Data Source: Crowdstrike",
    "Data Source: SentinelOne",
    "Data Source: Elastic Defend for Containers",
    "Resources: Investigation Guide"
]
timestamp_override = "event.ingested"
type = "eql"
query = '''
process where event.type == "start" and
event.action in ("exec", "exec_event", "start", "executed", "process_started", "ProcessRollup2") and
process.name : ("curl", "wget", "curl.exe", "wget.exe") and process.command_line like~ (
  "*http*//*/apis/authorization.k8s.io/*",
  "*http*//*/apis/rbac.authorization.k8s.io/*",
  "*http*//*/api/v1/secrets*",
  "*http*//*/api/v1/namespaces/*/secrets*",
  "*http*//*/api/v1/configmaps*",
  "*http*//*/api/v1/pods*",
  "*http*//*/apis/apps/v1/deployments*"
)
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"

[[rule.threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1069"
name = "Permission Groups Discovery"
reference = "https://attack.mitre.org/techniques/T1069/"

[[rule.threat.technique]]
id = "T1613"
name = "Container and Resource Discovery"
reference = "https://attack.mitre.org/techniques/T1613/"

[rule.threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"

[[rule.threat.technique.subtechnique]]
id = "T1552.007"
name = "Container API"
reference = "https://attack.mitre.org/techniques/T1552/007/"

[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"