Elastic rules: 0x

[rule]
description = """
Monitors for the deletion of the kernel ring buffer events through dmesg. Attackers may clear kernel ring buffer events
to evade detection after installing a Linux kernel module (LKM). This activity is commonly observed by intrusions that
leverage kernel-level rootkits to maintain persistence on a compromised host.
"""
id = "116d477e-8dd3-4de6-bbfd-9c19ca37fb8b"
license = "Elastic License v2"
name = "Attempt to Clear Kernel Ring Buffer via Dmesg"
os_list = ["linux"]
version = "1.0.2"

query = '''
process where event.type == "start" and event.action == "exec" and
process.name == "dmesg" and process.args in ("-c", "-C", "--clear", "--read-clear") and
not process.parent.executable == "/tmp/newroot/usr/bin/sudo"
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1070"
name = "Indicator Removal"
reference = "https://attack.mitre.org/techniques/T1070/"
[[threat.technique.subtechnique]]
id = "T1070.002"
name = "Clear Linux or Mac System Logs"
reference = "https://attack.mitre.org/techniques/T1070/002/"


[[threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.15.0"

[rule]
description = """
Detects when auditctl is executed with the `-e 0` option to disable auditing via a shell process. Malware is seen to
disable auditing to avoid detection and to cover its tracks.
"""
id = "36a8d397-7fef-4bdf-9152-71c750168580"
license = "Elastic License v2"
name = "Auditctl Disabled via Shell Process"
os_list = ["linux"]
version = "1.0.4"

query = '''
process where event.type == "start" and event.action == "exec" and
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and process.args == "-c" and
process.command_line like "*auditctl *-e*0*" and not (
  process.parent.name == "sudo" or
  (process.parent.name like ("python3*", "platform-python3*") and process.args like "declare*")
)
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.15.0"

[metadata]
creation_date = "2026/07/08"
integration = ["aws_bedrock_agentcore"]
maturity = "production"
updated_date = "2026/07/08"

[rule]
author = ["Elastic"]
description = """
Identifies prompts sent to an Amazon Bedrock AgentCore runtime that attempt to harvest credentials or coerce the agent
into exfiltrating data. The runtime application logs capture the caller-supplied prompt; this rule flags prompts that
reference the cloud instance metadata service (169.254.169.254, the ECS task metadata address, or the
"latest/meta-data" / "security-credentials" paths), prompts that name AWS access or secret keys directly, and
prompt-injection or jailbreak language ("ignore previous instructions", "developer mode", "do anything now") combined
with intent to reveal secrets, system prompts, or send data to an external endpoint. Asking an agent to read instance
metadata credentials or to exfiltrate secrets is rarely legitimate and indicates an attempt to weaponize the agent for
credential theft, even when the model refuses the request.
"""
false_positives = [
    """
    Security testing, red-team exercises, or guardrail validation may intentionally send prompt-injection or
    credential-harvesting payloads to an agent. Confirm the source session and caller, and exclude approved testing
    identities after validation.
    """,
    """
    Developer or documentation content that legitimately discusses the instance metadata service or AWS key formats
    could match. Review the prompt in "aws.bedrock_agentcore.request_payload.prompt" to confirm intent.
    """,
]
from = "now-30m"
interval = "10m"
language = "esql"
license = "Elastic License v2"
name = "AWS Bedrock AgentCore Runtime Prompt Targeting Credentials or Instance Metadata"
note = """## Triage and analysis

### Investigating AWS Bedrock AgentCore Runtime Prompt Targeting Credentials or Instance Metadata

Amazon Bedrock AgentCore runtimes execute agents that can call tools, run code, and reach network resources. A prompt that instructs the agent to read the cloud instance metadata service, return AWS credentials, or send data to an external endpoint is an attempt to turn the agent into a confused deputy for credential theft and exfiltration. The agent may refuse, but the attempt itself is a strong indicator of targeting; a more capable or misconfigured agent (one with code execution or outbound network access) could comply.

This rule inspects the caller-supplied prompt recorded in the AgentCore runtime application logs and fires on instance-metadata or credential-endpoint references, explicit AWS key references, or jailbreak/override language paired with secret-extraction or exfiltration intent.

### Possible investigation steps

- Review the full prompt in "aws.bedrock_agentcore.request_payload.prompt" to determine whether it targets instance metadata, names credentials, or attempts a jailbreak with exfiltration intent.
- Identify the agent in "aws.bedrock_agentcore.agent_name"/"aws.bedrock_agentcore.resource_arn" and the session in "aws.bedrock_agentcore.session_id"; pivot on the session for the surrounding prompts in the same conversation.
- Determine the caller path to the runtime (front-end application, gateway, or direct InvokeAgentRuntime) and whether the source is expected.
- Assess the agent's capabilities: whether it has code execution, outbound network access, or tools that could fetch metadata or reach external endpoints, which raises the impact if the agent had complied.
- Correlate with the execution role's activity in CloudTrail for any credential use outside the runtime around the same time.

### False positive analysis

- Security testing and guardrail validation can deliberately send these payloads. Confirm the caller and exclude approved testing identities after validation.
- Content that legitimately discusses the metadata service or AWS key formats can match; review the prompt to confirm intent.

### Response and remediation

- If the activity is unauthorized, identify the source application or identity driving the prompts and block it; review the conversation session for related attempts.
- Verify the agent did not return credentials or reach the metadata service; if the agent has code execution, ensure the instance metadata service requires session tokens (IMDSv2) and that the execution role is least privilege.
- Add or tune AgentCore guardrails to block instance-metadata and credential-exfiltration prompts, and monitor the agent's execution role for use outside the runtime.
"""
references = [
    "https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/observability.html",
    "https://unit42.paloaltonetworks.com/bypass-of-aws-sandbox-network-isolation-mode/",
]
risk_score = 73
rule_id = "9c2f1d6a-4e8b-4c7a-9f3d-2b6e1a0c5d44"
setup = """This rule requires Amazon Bedrock AgentCore runtime application logs collected via the Elastic AWS Bedrock AgentCore integration (observability logs delivered to S3 and ingested into the aws_bedrock_agentcore.runtime_application_logs dataset). See https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/observability.html for enabling AgentCore observability."""
severity = "high"
tags = [
    "Domain: Cloud",
    "Data Source: AWS",
    "Data Source: Amazon Web Services",
    "Data Source: Amazon Bedrock",
    "Use Case: Threat Detection",
    "Tactic: Credential Access",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "esql"

query = '''
from logs-aws_bedrock_agentcore.runtime_application_logs-* metadata _id, _version, _index
| eval Esql_priv.aws_bedrock_agentcore_request_payload_prompt_lower = to_lower(aws.bedrock_agentcore.request_payload.prompt)
| where aws.bedrock_agentcore.operation == "InvokeAgentRuntime" and (
    Esql_priv.aws_bedrock_agentcore_request_payload_prompt_lower rlike """.*(169\.254\.169\.254|169\.254\.170\.2|/latest/meta-data|/latest/api/token|security-credentials).*"""
    or Esql_priv.aws_bedrock_agentcore_request_payload_prompt_lower rlike """.*(aws_secret_access_key|aws_access_key_id|secret access key|access key id).*"""
    or (
        Esql_priv.aws_bedrock_agentcore_request_payload_prompt_lower rlike """.*(ignore (all )?(your )?(previous|prior|above) instructions|disregard (your |the )?(previous |above )?instructions|developer mode|do anything now|jailbreak).*"""
        and Esql_priv.aws_bedrock_agentcore_request_payload_prompt_lower rlike """.*(system prompt|reveal|exfiltrate|credential|secret|password|api key|token|send .* to https?://).*"""
    )
  )
| keep _id, _version, _index, @timestamp, aws.*, cloud.*, event.*
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"
[[rule.threat.technique.subtechnique]]
id = "T1552.005"
name = "Cloud Instance Metadata API"
reference = "https://attack.mitre.org/techniques/T1552/005/"


[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[metadata]
creation_date = "2024/04/14"
integration = ["aws"]
maturity = "production"
updated_date = "2026/08/05"

[rule]
author = ["Elastic"]
description = """
Identifies discovery request DescribeInstanceAttribute with the attribute userData and instanceId in AWS CloudTrail
logs. This may indicate an attempt to retrieve user data from an EC2 instance. Adversaries may use this information to
gather sensitive data from the instance such as hardcoded credentials or to identify potential vulnerabilities. This is
a New Terms rule that identifies the first time an IAM user or role requests the user data for a specific EC2 instance.
"""
from = "now-6m"
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
language = "kuery"
license = "Elastic License v2"
name = "AWS EC2 User Data Retrieval for EC2 Instance"
note = """
## Triage and Analysis

### Investigating AWS EC2 User Data Retrieval for EC2 Instance

This rule detects requests to retrieve the `userData` attribute of an EC2 instance using the `DescribeInstanceAttribute` API action. The `userData` field can contain sensitive information, such as hardcoded credentials or configuration scripts, that adversaries may exploit for further attacks.

#### Possible Investigation Steps

- **Identify the Target Instance**:
  - **Instance ID**: Review the `aws.cloudtrail.flattened.request_parameters.instanceId` field to identify the EC2 instance targeted by the request. Confirm whether this instance should expose its `userData` and whether it is associated with sensitive workloads.
  - **Analyze userData**: If possible, retrieve and inspect the `userData` field to identify sensitive information like hardcoded credentials or configuration scripts.

- **Review User Context**:
  - **User Identity**: Inspect the `aws.cloudtrail.user_identity.arn` field to identify the user or role that executed the `DescribeInstanceAttribute` action. Investigate whether this user typically performs such actions.
  - **Access Patterns**: Validate whether the user or role has the necessary permissions and whether the frequency of this action aligns with expected behavior.
  - **Access Key ID**: Check the `aws.cloudtrail.user_identity.access_key_id` field to determine the key used to make the request as it may be compromised.
  - **Source IP and Geolocation**: Check the `source.address` and `source.geo` fields to validate whether the request originated from a trusted location or network. Unexpected geolocations can indicate adversarial activity.
  - **User Agent**: Inspect the `user_agent.original` field to determine the tool or client used (e.g., Terraform, AWS CLI). Legitimate automation tools may trigger this activity, but custom or unknown user agents may indicate malicious intent.

- **Check for Related Activity**:
  - **IAM Changes**: Correlate this event with any IAM changes or temporary credential creation to identify potential privilege escalation attempts.
  - **API Usage**: Look for other unusual API calls (e.g., `RunInstances`, `GetObject`, `AssumeRole`) by the same user or IP to detect lateral movement or data exfiltration attempts.

- **Validate Intent**:
  - **Permissions and Justification**: Ensure that the user has the least privilege required to perform this action. Investigate whether there is a valid reason for accessing the `userData` field.

### False Positive Analysis

- **Automation**: This event is often triggered by legitimate automation tools, such as Terraform or custom scripts, that require access to `userData` during instance initialization.
- **Maintenance Activity**: Verify whether this event aligns with expected administrative activities, such as debugging or instance configuration updates.

### Response and Remediation

- **Revoke Excessive Permissions**: If unauthorized, immediately remove `DescribeInstanceAttribute` permissions from the user or role.
- **Quarantine the Target Instance**: If malicious behavior is confirmed, isolate the affected EC2 instance to limit further exposure.
- **Secure User Data**:
  - Avoid storing sensitive information, such as credentials, in `userData`. Use AWS Secrets Manager or Parameter Store instead.
  - Encrypt user data and ensure only authorized users can decrypt it.
- **Audit IAM Policies**: Regularly review IAM policies to ensure they adhere to the principle of least privilege.
- **Monitor and Detect**: Set up additional alerts for unexpected `DescribeInstanceAttribute` calls or other suspicious API activity.

### Additional Information

For more details on managing EC2 user data securely, refer to the [AWS EC2 User Data Documentation](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html).
"""
references = [
    "https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstanceAttribute.html",
    "https://hackingthe.cloud/aws/exploitation/local_ec2_priv_esc_through_user_data",
]
risk_score = 47
rule_id = "c1e79a70-fa6f-11ee-8bc8-f661ea17fbce"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Platform: AWS",
    "Data Source: AWS CloudTrail",
    "Service: AWS EC2",
    "Tactic: Discovery",
    "Rule Type: New Terms",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "new_terms"

query = '''
data_stream.dataset: "aws.cloudtrail"
    and event.provider: "ec2.amazonaws.com"
    and event.action: "DescribeInstanceAttribute"
    and event.outcome: "success"
    and aws.cloudtrail.flattened.request_parameters.attribute: "userData"
    and not aws.cloudtrail.user_identity.invoked_by: (
        "AWS Internal" or
        "cloudformation.amazonaws.com" or 
        "aidevops.amazonaws.com" or 
        "elasticmapreduce.amazonaws.com" or 
        "aiops.amazonaws.com"
    )
    and not user_agent.original: (*Terraform*)
'''

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user_agent.original",
    "source.ip",
    "aws.cloudtrail.user_identity.arn",
    "aws.cloudtrail.user_identity.type",
    "aws.cloudtrail.user_identity.access_key_id",
    "event.action",
    "event.outcome",
    "cloud.account.id",
    "cloud.region",
    "aws.cloudtrail.request_parameters",
    "aws.cloudtrail.response_elements"
]

[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1580"
name = "Cloud Infrastructure Discovery"
reference = "https://attack.mitre.org/techniques/T1580/"


[rule.threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"
[[rule.threat.technique.subtechnique]]
id = "T1552.005"
name = "Cloud Instance Metadata API"
reference = "https://attack.mitre.org/techniques/T1552/005/"



[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[rule.new_terms]
field = "new_terms_fields"
value = ["cloud.account.id", "user.name", "aws.cloudtrail.flattened.request_parameters.instanceId"]
[[rule.new_terms.history_window_start]]
field = "history_window_start"
value = "now-5d"

[metadata]
creation_date = "2026/06/18"
integration = ["aws"]
maturity = "production"
updated_date = "2026/06/18"

[rule]
author = ["Elastic"]
description = """
Identifies the creation of an AWS Lambda event source mapping, which connects an event source such as an Amazon SQS
queue, an Amazon Kinesis or DynamoDB stream, an Amazon MSK or self-managed Apache Kafka topic, or an Amazon MQ broker to
a Lambda function so the function is automatically invoked when new records arrive. Adversaries with
"lambda:CreateEventSourceMapping" permissions can abuse this to establish stealthy, event-driven persistence and
execution, or to continuously siphon records from a stream or queue into attacker-controlled function code. Because the
function then runs on its own whenever the source produces events, this grants durable execution without any further
interactive activity by the adversary.
"""
false_positives = [
    """
    Application teams and infrastructure-as-code pipelines routinely create event source mappings to wire data
    pipelines, queue consumers, and stream processors to Lambda functions. Verify whether the principal in
    `aws.cloudtrail.user_identity.arn`, the function, and the event source are expected for the workload. Known
    deployment roles and automation can be excluded after validation.
    """,
]
from = "now-6m"
index = ["logs-aws.cloudtrail-*"]
interval = "5m"
language = "kuery"
license = "Elastic License v2"
name = "AWS Lambda Event Source Mapping Creation"
note = """## Triage and analysis

### Investigating AWS Lambda Event Source Mapping Creation

AWS Lambda event source mappings poll an event source (Amazon SQS, Kinesis or DynamoDB streams, Amazon MSK or self-managed Kafka, or Amazon MQ) and invoke a target function as records arrive. Creating a mapping is a low-frequency, high-impact configuration change: it can establish event-driven persistence and execution, or quietly relay sensitive records from a stream or queue into attacker-controlled code.

This rule detects successful `CreateEventSourceMapping` calls. Investigate whether the principal, the target function, and the event source are expected for the environment.

#### Possible investigation steps

- Identify the actor in `aws.cloudtrail.user_identity.arn` and `aws.cloudtrail.user_identity.type`, and review `source.ip` and `user_agent.original` to determine whether the call came from the console, CLI, SDK, or automation.
- Inspect `aws.cloudtrail.request_parameters` for the `functionName`/`functionArn` and the `eventSourceArn` to identify the target function and the source queue, stream, topic, or broker.
- Determine whether the target function and the event source belong to the same application and account, and whether the function code, role, and recent changes are trusted (correlate with `CreateFunction`, `UpdateFunctionCode`, and `AddPermission`).
- Review whether the event source contains sensitive data (for example a DynamoDB stream or SQS queue carrying business records) that the mapping could be used to exfiltrate.
- Pivot on the same principal and access key for other recent Lambda, IAM, or data-plane activity.

### False positive analysis

- Event source mappings are a normal building block of serverless data pipelines and queue/stream consumers. Mappings created by approved deployment roles, CI/CD pipelines, or application teams are expected. Tune on `aws.cloudtrail.user_identity.arn`, `user_agent.original`, or known automation roles after validation.

### Response and remediation

- If the mapping is unauthorized, disable or delete it (`DeleteEventSourceMapping`) and review the target function's code, configuration, and execution role.
- Determine whether records were processed by the function while the mapping was active and assess potential data exposure.
- Rotate or restrict credentials for the principal that created the mapping if compromise is suspected, and constrain `lambda:CreateEventSourceMapping` to a small set of trusted roles.

### Additional information

- [AWS Lambda event source mappings](https://docs.aws.amazon.com/lambda/latest/dg/invocation-eventsourcemapping.html)
- [CreateEventSourceMapping API](https://docs.aws.amazon.com/lambda/latest/api/API_CreateEventSourceMapping.html)
"""
references = [
    "https://docs.aws.amazon.com/lambda/latest/dg/invocation-eventsourcemapping.html",
    "https://docs.aws.amazon.com/lambda/latest/api/API_CreateEventSourceMapping.html",
]
risk_score = 21
rule_id = "5619545b-9738-408c-bdb5-a2807e19133e"
severity = "low"
tags = [
    "Domain: Cloud",
    "Data Source: AWS",
    "Data Source: Amazon Web Services",
    "Data Source: AWS CloudTrail",
    "Data Source: AWS Lambda",
    "Use Case: Threat Detection",
    "Tactic: Persistence",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset: "aws.cloudtrail"
    and event.provider: "lambda.amazonaws.com"
    and event.action: CreateEventSourceMapping*
    and event.outcome: "success"
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1546"
name = "Event Triggered Execution"
reference = "https://attack.mitre.org/techniques/T1546/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1648"
name = "Serverless Execution"
reference = "https://attack.mitre.org/techniques/T1648/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1578"
name = "Modify Cloud Compute Infrastructure"
reference = "https://attack.mitre.org/techniques/T1578/"

[[rule.threat.technique.subtechnique]]
id = "T1578.005"
name = "Modify Cloud Compute Configurations"
reference = "https://attack.mitre.org/techniques/T1578/005/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user_agent.original",
    "source.ip",
    "aws.cloudtrail.user_identity.arn",
    "aws.cloudtrail.user_identity.type",
    "aws.cloudtrail.user_identity.access_key_id",
    "aws.cloudtrail.user_identity.session_context.session_issuer.arn",
    "aws.cloudtrail.request_parameters",
    "aws.cloudtrail.response_elements",
    "event.action",
    "event.outcome",
    "cloud.account.id",
    "cloud.region",
]

[metadata]
creation_date = "2025/04/15"
integration = ["aws"]
maturity = "production"
updated_date = "2026/07/08"

[rule]
author = ["Elastic"]
description = """
This rule detects when a JavaScript file is uploaded in an S3 static site directory (`static/js/`) by an IAM
user or assumed role. This can indicate suspicious modification of web content hosted on S3, such as injecting malicious
scripts into a static website frontend.
"""
false_positives = [
    """
    Development or deployment pipelines that update static frontends frequently (e.g., React/Vue apps) may trigger this.
    Verify the user agent, source IP, and whether the modification was expected.
    """,
]
from = "now-6m"
language = "esql"
license = "Elastic License v2"
name = "AWS S3 Static Site JavaScript File Uploaded"
note = """## Triage and Analysis

### Investigating AWS S3 Static Site JavaScript File Uploaded

An S3 `PutObject` action that targets a path like `static/js/` and uploads a `.js` file is a potential signal for web content modification. If done by an unexpected IAM user or outside of CI/CD workflows, it may indicate a compromise.

#### Possible Investigation Steps

- **Identify the Source User**: Check `aws.cloudtrail.user_identity.arn`, access key ID, and session type (`IAMUser`, `AssumedRole`, etc).
- **Review File Content**: Use the S3 `GetObject` or CloudTrail `requestParameters` to inspect the uploaded file for signs of obfuscation or injection.
- **Correlate to Other Events**: Review events from the same IAM user before and after the upload (e.g., `ListBuckets`, `GetCallerIdentity`, IAM activity).
- **Look for Multiple Uploads**: Attackers may attempt to upload several files or modify multiple directories.

### False Positive Analysis

- This behavior may be expected during app deployments. Look at:
  - The `user_agent.original` to detect legitimate CI tools (like Terraform or GitHub Actions).
  - Timing patterns—does this match a regular release window?
  - The origin IP and device identity.

### Response and Remediation

- **Revert Malicious Code**: Replace the uploaded JS file with a clean version and invalidate CloudFront cache if applicable.
- **Revoke Access**: If compromise is confirmed, revoke the IAM credentials and disable the user.
- **Audit IAM Policies**: Ensure that only deployment users can modify static site buckets.
- **Enable Bucket Versioning**: This can allow for quick rollback and historical review.
"""
references = [
    "https://www.sygnia.co/blog/sygnia-investigation-bybit-hack/",
    "https://docs.aws.amazon.com/AmazonS3/latest/userguide/WebsiteHosting.html",
    "https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObject.html",
]
risk_score = 73
rule_id = "16acac42-b2f9-4802-9290-d6c30914db6e"
severity = "high"
tags = [
    "Domain: Cloud",
    "Data Source: AWS",
    "Data Source: Amazon Web Services",
    "Data Source: AWS S3",
    "Tactic: Impact",
    "Use Case: Web Application Compromise",
    "Use Case: Cloud Threat Detection",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "esql"

query = '''
from logs-aws.cloudtrail* metadata _id, _version, _index

| where
    // S3 object write activity
    data_stream.dataset == "aws.cloudtrail"
    and event.provider == "s3.amazonaws.com"
    and event.action == "PutObject"
    and event.outcome == "success"

    // IAM users or assumed roles only
    and aws.cloudtrail.user_identity.type in ("IAMUser", "AssumedRole")

    // Requests for static site bundles
    and aws.cloudtrail.request_parameters like "*static/js/*.js*"

    // Exclude IaC and automation tools
    and not (
        user_agent.original like "*Terraform*"
        or user_agent.original like "*Ansible*"
        or user_agent.original like "*Pulumi*"
    )

// Extract fields from request parameters
| dissect aws.cloudtrail.request_parameters
    "%{{?bucket.name.key}=%{Esql.aws_cloudtrail_request_parameters_bucket_name}, %{?host.key}=%{Esql_priv.aws_cloudtrail_request_parameters_host}, %{?bucket.object.location.key}=%{Esql.aws_cloudtrail_request_parameters_bucket_object_location}}"

// Extract file name portion from full object path
| dissect Esql.aws_cloudtrail_request_parameters_bucket_object_location "%{}static/js/%{Esql.aws_cloudtrail_request_parameters_object_key}"

// Match on JavaScript files
| where ends_with(Esql.aws_cloudtrail_request_parameters_object_key, ".js")

// Retain relevant ECS and dissected fields
| keep
    aws.cloudtrail.user_identity.arn,
    aws.cloudtrail.user_identity.access_key_id,
    aws.cloudtrail.user_identity.type,
    aws.cloudtrail.request_parameters,
    Esql.aws_cloudtrail_request_parameters_bucket_name,
    Esql.aws_cloudtrail_request_parameters_object_key,
    user_agent.original,
    source.ip,
    event.action,
    @timestamp,
    _id,
    _version,
    _index
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1491"
name = "Defacement"
reference = "https://attack.mitre.org/techniques/T1491/"

[[rule.threat.technique.subtechnique]]
id = "T1491.002"
name = "External Defacement"
reference = "https://attack.mitre.org/techniques/T1491/002/"

[[rule.threat.technique]]
id = "T1565"
name = "Data Manipulation"
reference = "https://attack.mitre.org/techniques/T1565/"

[[rule.threat.technique.subtechnique]]
id = "T1565.001"
name = "Stored Data Manipulation"
reference = "https://attack.mitre.org/techniques/T1565/001/"

[rule.threat.tactic]
id = "TA0040"
name = "Impact"
reference = "https://attack.mitre.org/tactics/TA0040/"
[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user_agent.original",
    "source.ip",
    "aws.cloudtrail.user_identity.arn",
    "aws.cloudtrail.user_identity.type",
    "aws.cloudtrail.user_identity.access_key_id",
    "aws.cloudtrail.resources.arn",
    "aws.cloudtrail.resources.type",
    "event.action",
    "event.outcome",
    "cloud.account.id",
    "cloud.region",
    "aws.cloudtrail.request_parameters",
    "aws.cloudtrail.response_elements"
]

[metadata]
creation_date = "2020/08/17"
integration = ["azure"]
maturity = "production"
updated_date = "2026/04/10"

[rule]
author = ["Elastic"]
description = """
Identifies the deletion of a resource group in Azure, which includes all resources within the group. Deletion is
permanent and irreversible. An adversary may delete a resource group in an attempt to evade defenses or intentionally
destroy data.
"""
false_positives = [
    """
    Deletion of a resource group may be done by a system or network administrator. Verify whether the username,
    hostname, and/or resource name should be making changes in your environment. Resource group deletions from
    unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted
    from the rule.
    """,
]
from = "now-9m"
index = ["logs-azure.activitylogs-*", "filebeat-*"]
language = "kuery"
license = "Elastic License v2"
name = "Azure Resource Group Deleted"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Azure Resource Group Deleted

Azure Resource Groups are containers that hold related resources for an Azure solution, enabling efficient management and organization. Adversaries may exploit this by deleting entire groups to disrupt services or erase data, causing significant impact. The detection rule monitors Azure activity logs for successful deletion operations, flagging potential malicious actions for further investigation.

### Possible investigation steps

- Review the Azure activity logs to confirm the deletion event by checking for the operation name "MICROSOFT.RESOURCES/SUBSCRIPTIONS/RESOURCEGROUPS/DELETE" and ensure the event outcome is marked as "Success" or "success".
- Identify the user or service principal responsible for the deletion by examining the associated user identity or service principal ID in the activity logs.
- Check the timestamp of the deletion event to determine when the resource group was deleted and correlate this with any other suspicious activities around the same time.
- Investigate the resources contained within the deleted resource group to assess the potential impact, including any critical services or data that may have been affected.
- Review any recent changes in permissions or roles assigned to the user or service principal involved in the deletion to identify potential privilege escalation or misuse.
- Examine any related alerts or logs for unusual activities or patterns that might indicate a broader attack or compromise within the Azure environment.

### False positive analysis

- Routine maintenance activities by IT teams may trigger alerts when resource groups are intentionally deleted as part of regular updates or infrastructure changes. To manage this, create exceptions for known maintenance windows or specific user accounts responsible for these tasks.
- Automated scripts or deployment tools that manage resource lifecycles might delete resource groups as part of their normal operation. Identify these scripts and exclude their activity from alerts by filtering based on the service principal or automation account used.
- Testing environments often involve frequent creation and deletion of resource groups. Exclude these environments from alerts by tagging them appropriately and configuring the detection rule to ignore actions on tagged resources.
- Mergers or organizational restructuring can lead to legitimate resource group deletions. Coordinate with relevant departments to anticipate these changes and temporarily adjust monitoring rules to prevent false positives.
- Ensure that any third-party services or consultants with access to your Azure environment are accounted for, as their activities might include resource group deletions. Establish clear communication channels to verify their actions and adjust monitoring rules accordingly.

### Response and remediation

- Immediately isolate the affected Azure subscription to prevent further unauthorized actions. This can be done by temporarily disabling access or applying strict access controls.
- Review and revoke any suspicious or unauthorized access permissions associated with the affected resource group to prevent further exploitation.
- Restore the deleted resources from backups if available. Ensure that backup and recovery processes are validated and functioning correctly.
- Conduct a thorough audit of recent Azure activity logs to identify any other potentially malicious actions or compromised accounts.
- Escalate the incident to the security operations team for a detailed investigation and to determine if there are broader implications or related threats.
- Implement additional monitoring and alerting for similar deletion activities across all Azure subscriptions to enhance early detection of such threats.
- Review and strengthen access management policies, ensuring that only authorized personnel have the necessary permissions to delete resource groups.

## Setup

The Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
references = [
    "https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/manage-resource-groups-portal",
]
risk_score = 47
rule_id = "bb4fe8d2-7ae2-475c-8b5d-55b449e4264f"
severity = "medium"
tags = ["Domain: Cloud", "Data Source: Azure", "Use Case: Log Auditing", "Tactic: Impact", "Resources: Investigation Guide"]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset:azure.activitylogs and azure.activitylogs.operation_name:"MICROSOFT.RESOURCES/SUBSCRIPTIONS/RESOURCEGROUPS/DELETE" and event.outcome:(Success or success)
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1529"
name = "System Shutdown/Reboot"
reference = "https://attack.mitre.org/techniques/T1529/"

[[rule.threat.technique]]
id = "T1490"
name = "Inhibit System Recovery"
reference = "https://attack.mitre.org/techniques/T1490/"

[[rule.threat.technique]]
id = "T1489"
name = "Service Stop"
reference = "https://attack.mitre.org/techniques/T1489/"

[[rule.threat.technique]]
id = "T1485"
name = "Data Destruction"
reference = "https://attack.mitre.org/techniques/T1485/"


[rule.threat.tactic]
id = "TA0040"
name = "Impact"
reference = "https://attack.mitre.org/tactics/TA0040/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"

[[rule.threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"


[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[rule]
description = """
Detects when Osascript executes AppleScript containing a base64 encoded string. Many stealer samples execute AppleScript
and some encode the script using base64 in order to avoid detection.
"""
id = "32b43493-dd69-47b3-ad63-34242aeebe39"
license = "Elastic License v2"
name = "Base64 Encoded String Execution via Osascript"
os_list = ["macos"]
version = "1.0.7"

query = '''
process where event.type == "start" and event.action == "exec" and process.name == "osascript" and
 process.args == "-e" and
 process.args regex~ """.*[A-Za-z0-9\+\/]{30,}\={0,2}.*""" and 
 process.command_line : "*base64*" and
 not process.parent.code_signature.team_id == "9BNSXJN65R" and
 not process.Ext.effective_parent.executable like "/Applications/Docker.app/Contents/MacOS/com.docker.backend"
'''

min_endpoint_version = "8.16.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.002"
name = "AppleScript"
reference = "https://attack.mitre.org/techniques/T1059/002/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1027"
name = "Obfuscated Files or Information"
reference = "https://attack.mitre.org/techniques/T1027/"

[[threat.technique]]
id = "T1140"
name = "Deobfuscate/Decode Files or Information"
reference = "https://attack.mitre.org/techniques/T1140/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.16.0"

[rule]
description = """
This rule identifies when a built-in utility decodes a payload containing a shebang line (e.g. `#!/bin/sh` or
`#!/bin/python`). Malware authors may attempt to evade detection and trick users into executing malicious code by
encoding and obfuscating their payloads.
"""
id = "e659b4b9-5bbf-4839-96b9-b489334b4ca1"
license = "Elastic License v2"
name = "Base64 Shebang Payload Decoded via Built-in Utility"
os_list = ["linux"]
reference = ["https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1140/T1140.yaml"]
version = "1.0.3"

query = '''
process where event.type == "start" and event.action == "exec" and process.parent.executable != null and (
  (process.name == "base64" and process.args : "*-*d*") or
  (process.name == "openssl" and process.args == "enc" and process.args in ("-d", "-base64")) or
  (process.name : "python*" and
    (process.args == "base64" and process.args in ("-d", "-u", "-t")) or
    (process.args == "-c" and process.args : "*base64*" and process.args : "*b64decode*")
  ) or
  (process.name : "perl*" and process.args : "*decode_base64*") or
  (process.name : "ruby*" and process.args == "-e" and process.args : "*Base64.decode64*")
) and process.command_line : (
  // python and python3
  "*IyEvdXNyL2Jpbi9weXRob24*", "*IyEvYmluL3B5dGhvbg*", "*IyEvdXNyL2Jpbi9weXRob24z*", "*IyEvYmluL3B5dGhvbjM*",
  // bash and dash
  "*IyEvdXNyL2Jpbi9iYXNo*", "*IyEvYmluL2Jhc2g*", "IyEvdXNyL2Jpbi9kYXNo*", "*IyEvYmluL2Rhc2g*",
  // zsh and fish
  "*IyEvdXNyL2Jpbi96c2g*", "*IyEvYmluL3pzaA*", "IyEvdXNyL2Jpbi9maXNo*", "*IyEvYmluL2Zpc2g*",
  // sh
  "*IyEvdXNyL2Jpbi9zaA*", "*IyEvYmluL3No*"
)
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"


[[threat.technique]]
id = "T1204"
name = "User Execution"
reference = "https://attack.mitre.org/techniques/T1204/"
[[threat.technique.subtechnique]]
id = "T1204.002"
name = "Malicious File"
reference = "https://attack.mitre.org/techniques/T1204/002/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1027"
name = "Obfuscated Files or Information"
reference = "https://attack.mitre.org/techniques/T1027/"

[[threat.technique]]
id = "T1140"
name = "Deobfuscate/Decode Files or Information"
reference = "https://attack.mitre.org/techniques/T1140/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.15.0"

[rule]
description = """
This rule identifies a process that executes a binary from an unusual location through a shell profile configuration.
Threat actors can establish persistence by altering shell profile configurations to execute malicious commands or
scripts upon user login. These modifications cause the shell launched during login to execute the malicious payload,
resulting in a sequence where an authentication event is followed by the execution of a payload in a suspicious
location.
"""
id = "47903010-d527-4200-b43d-971955a80924"
license = "Elastic License v2"
name = "Binary Execution from Unusual Location through Shell Profile"
os_list = ["linux"]
reference = [
    "https://pberba.github.io/security/2022/02/06/linux-threat-hunting-for-persistence-initialization-scripts-and-shell-configuration/",
    "https://www.elastic.co/security-labs/primer-on-persistence-mechanisms",
]
version = "1.0.9"

query = '''
sequence with maxspan=3s
  [process where event.type == "change" and event.action == "uid_change" and (
     process.name in ("su", "sudo", "sshd", "bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") or
     process.name like ("python*", "php*", "perl*", "ruby*", "lua*")
   ) and not (
     process.executable like ("/srv/snp/docker/*", "/nix/store/*") or
       process.args in (
         "/usr/lib/ubuntu-advantage/apt_news.py", "/usr/lib/ubuntu-advantage/esm_cache.py", "apt-get", "apt",
         "systemctl"
      ) or
       process.command_line like "su cloudendure -c /usr/bin/nice*"
     )
  ] by process.entity_id
  [process where event.type == "start" and event.action == "exec" and process.executable like (
     "/boot/*", "/dev/shm/*", "/etc/cron.*/*", "/etc/init.d/*", "/etc/update-motd.d/*", "/srv/*", "/tmp/*",
     "/var/tmp/*", "/var/log/*"
   ) and process.args_count == 1 and
   not (
     process.executable like (
       "/run/*/newroot/*", "/srv/snp/docker/*", "/tmp/newroot/*", "/var/tmp/cpuid/cpuid", "/tmp/.mount_*/jetbrains-toolbox",
       "/var/tmp/buildah*/mnt/rootfs/bin/readlink", "/var/tmp/rackware/bin/rwdmi", "/srv/zorg-sync/venv/bin/python",
       "/tmp/makeself.*", "/tmp/selfgz*", "/tmp/tmp.*/rustup-init", "/tmp/go-build*"
     ) or
     process.parent.executable like (
       "/tmp/newroot/*", "/tmp/usr/bin/sudo", "/tmp/usr/sbin/sshd", "/tmp/go-build*", "/snap/btop/*/usr/local/bin/btop",
       "/opt/appimagelauncher.AppDir/usr/lib/*/appimagelauncher/binfmt-bypass", "/tmp/snap.rootfs_*"
     )
   )
  ] by process.parent.entity_id
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1546"
name = "Event Triggered Execution"
reference = "https://attack.mitre.org/techniques/T1546/"
[[threat.technique.subtechnique]]
id = "T1546.004"
name = "Unix Shell Configuration Modification"
reference = "https://attack.mitre.org/techniques/T1546/004/"



[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[internal]
min_endpoint_version = "7.15.0"

[metadata]
creation_date = "2026/08/05"
integration = ["endpoint"]
maturity = "production"
updated_date = "2026/08/06"

[rule]
author = ["Elastic"]
description = """
Detects unexpected modification of Claude Desktop Cowork VM boot images (kernel, initrd, root filesystem). Adversaries
with user-context access can rewrite these stored images so later Cowork sessions boot attacker-controlled code inside a
virtual instance that host EDR cannot inspect by default.
"""
from = "now-9m"
index = ["logs-endpoint.events.file-*"]
language = "eql"
license = "Elastic License v2"
name = "Claude Cowork VM Boot Image Tamper"
note = """## Triage and analysis

### Investigating Claude Cowork VM Boot Image Tamper

Cowork boots a local Linux VM from images under the user's Claude AppData / Application Support tree. Those files are
writable by the user and are not integrity-checked before boot. A non-Claude writer changing them is a strong signal of
post-compromise defense evasion: later Cowork sessions can run attacker code inside a sanctioned Hyper-V /
Virtualization.framework guest that host EDR does not see by default. This does not grant new privileges.

### Possible investigation steps

- Confirm the writer: `process.name`, `process.executable`, `process.parent.executable`, and `user.name`. This rule
  already excludes Claude Desktop (`claude.exe` under `WindowsApps\\Claude_*\\app\\`, and `Claude` /
  `Claude Helper` under `/Applications/Claude.app/`). Any other writer (script host, LOLBin, unsigned binary) is
  unexpected.
- Note which artifact changed (`file.name` / `file.path`) and `event.action`:
  - `initrd` / `initrd.zst`: primary PoC target; both are often replaced together so the service cannot re-extract a
    clean initrd from the `.zst`.
  - `vmlinuz` / `rootfs.*` / `smol-bin.vhdx`: full guest control if replaced.
- Pivot on `process.entity_id` / `host.id` for ~30m around the alert: how the writer started, other file writes under
  the Claude package path, and whether `claude.exe` / Claude.app then started a Cowork session.
- If Cowork runs afterward, check whether the session failed and Claude re-downloaded images (careless tamper) or
  continued normally (payload may have kept the expected guest daemon alive).
- Treat this as evidence of existing host compromise; hunt for the initial access that produced the writer process.

### False positive analysis

- Claude Desktop updates should not alert; if they do, the install path likely changed (new WindowsApps package layout
  or non-AppX install) and the allowlist needs updating, not an exception for the writer name alone.
- Backup or sync tools rewriting these exact filenames are uncommon; require a stable `process.executable` before
  adding an exception. This rule watches create/overwrite/rename/modification only; deletions are out of scope.

### Response and remediation

- Delete or restore the affected bundle directory (Windows:
  `%LOCALAPPDATA%\\Packages\\Claude_*\\LocalCache\\Roaming\\Claude\\vm_bundles\\claudevm.bundle\\`; macOS:
  `~/Library/Application Support/Claude/vm_bundles/claudevm.bundle/`) and let Claude re-download trusted images, or
  restore from a known-good backup.
- Isolate the host and investigate the writer process lineage; rotate credentials and secrets available to that user.
- Search the environment for the same writer hash/path and for other unexpected modifications under Claude package
  paths.
"""
references = ["https://y637f9qq2x.com/posts/cowork-boot-trust"]
risk_score = 47
rule_id = "a0939500-a817-4ce9-85a9-191133352a9e"
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: macOS",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Defense Evasion",
    "Data Source: Elastic Defend",
    "Resources: Investigation Guide",
    "Domain: LLM",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
file where host.os.type in ("windows", "macos") and
  event.action in ("creation", "modification", "overwrite", "rename") and
  event.outcome == "success" and
  file.path : (
    "/Users/*/Library/Application Support/Claude/vm_bundles/claudevm.bundle/initrd",
    "/Users/*/Library/Application Support/Claude/vm_bundles/claudevm.bundle/initrd.zst",
    "/Users/*/Library/Application Support/Claude/vm_bundles/claudevm.bundle/vmlinuz",
    "/Users/*/Library/Application Support/Claude/vm_bundles/claudevm.bundle/vmlinuz.zst",
    "/Users/*/Library/Application Support/Claude/vm_bundles/claudevm.bundle/rootfs.img",
    "?:\\Users\\*\\AppData\\Local\\Packages\\Claude_*\\LocalCache\\Roaming\\Claude\\vm_bundles\\claudevm.bundle\\initrd",
    "?:\\Users\\*\\AppData\\Local\\Packages\\Claude_*\\LocalCache\\Roaming\\Claude\\vm_bundles\\claudevm.bundle\\initrd.zst",
    "?:\\Users\\*\\AppData\\Local\\Packages\\Claude_*\\LocalCache\\Roaming\\Claude\\vm_bundles\\claudevm.bundle\\vmlinuz",
    "?:\\Users\\*\\AppData\\Local\\Packages\\Claude_*\\LocalCache\\Roaming\\Claude\\vm_bundles\\claudevm.bundle\\rootfs.vhdx",
    "?:\\Users\\*\\AppData\\Local\\Packages\\Claude_*\\LocalCache\\Roaming\\Claude\\vm_bundles\\claudevm.bundle\\smol-bin.vhdx"
  ) and
  not (
    (process.name : "claude.exe" and
     process.executable : "?:\\Program Files\\WindowsApps\\Claude_*\\app\\claude.exe") or
    (process.name : ("Claude", "Claude Helper") and
     process.executable like "/Applications/Claude.app/*")
  )
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1564"
name = "Hide Artifacts"
reference = "https://attack.mitre.org/techniques/T1564/"
[[rule.threat.technique.subtechnique]]
id = "T1564.006"
name = "Run Virtual Instance"
reference = "https://attack.mitre.org/techniques/T1564/006/"



[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[metadata]
creation_date = "2023/09/25"
integration = ["endpoint"]
maturity = "production"
updated_date = "2026/03/24"

[rule]
author = ["Elastic"]
building_block_type = "default"
description = """
Identifies the execution of DotNet ClickOnce installer via Dfsvc.exe trampoline. Adversaries may take advantage of
ClickOnce to proxy execution of malicious payloads via trusted Microsoft processes.
"""
from = "now-119m"
index = ["logs-endpoint.events.*"]
interval = "60m"
language = "eql"
license = "Elastic License v2"
name = "Execution via Microsoft DotNet ClickOnce Host"
risk_score = 21
rule_id = "5297b7f1-bccd-4611-93fa-ea342a01ff84"
severity = "low"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Defense Evasion",
    "Rule Type: BBR",
    "Data Source: Elastic Defend",
]
type = "eql"

query = '''
sequence by user.id with maxspan=5s
 [process where host.os.type == "windows" and event.action == "start" and
  process.name : "rundll32.exe" and process.command_line : ("*dfshim*ShOpenVerbApplication*", "*dfshim*#*")]
 [network where host.os.type == "windows" and process.name : "dfsvc.exe"]
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1127"
name = "Trusted Developer Utilities Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1127/"

[[rule.threat.technique.subtechnique]]
id = "T1127.002"
name = "ClickOnce"
reference = "https://attack.mitre.org/techniques/T1127/002/"

[[rule.threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"

[[rule.threat.technique.subtechnique]]
id = "T1218.011"
name = "Rundll32"
reference = "https://attack.mitre.org/techniques/T1218/011/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[metadata]
creation_date = "2023/08/28"
integration = ["endpoint"]
maturity = "production"
updated_date = "2026/03/24"

[rule]
author = ["Elastic"]
description = """
This rule monitors for the creation of a file, followed by its execution and self-deletion in a short timespan within a
directory often used for malicious purposes by threat actors. This behavior is often used by malware to execute
malicious code and delete itself to hide its tracks.
"""
from = "now-9m"
index = ["logs-endpoint.events.file*", "logs-endpoint.events.process*"]
language = "eql"
license = "Elastic License v2"
name = "File Creation, Execution and Self-Deletion in Suspicious Directory"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating File Creation, Execution and Self-Deletion in Suspicious Directory

In Linux environments, temporary directories like `/tmp` and `/var/tmp` are often used for storing transient files. Adversaries exploit these directories to execute malicious payloads and erase traces by creating, running, and deleting files swiftly. The detection rule identifies this pattern by monitoring file creation, execution, and deletion events within these directories, flagging suspicious activities that align with common malware behaviors.

### Possible investigation steps

- Review the file creation event details, focusing on the file path and name to determine if it matches known malicious patterns or if it is a legitimate file.
- Examine the process execution event, paying attention to the process name and parent process name to identify if the execution was initiated by a suspicious or unauthorized shell.
- Investigate the user.id and host.id associated with the events to determine if the activity aligns with expected user behavior or if it indicates potential compromise.
- Check for any network activity or connections initiated by the process to identify potential data exfiltration or communication with command and control servers.
- Analyze the deletion event to confirm whether the file was removed by a legitimate process or if it was part of a self-deletion mechanism used by malware.
- Correlate these events with any other alerts or logs from the same host or user to identify patterns or additional indicators of compromise.

### False positive analysis

- Development and testing activities in temporary directories can trigger false positives. Exclude specific paths or processes related to known development tools or scripts that frequently create, execute, and delete files in these directories.
- Automated system maintenance scripts may perform similar actions. Identify and whitelist these scripts by their process names or paths to prevent unnecessary alerts.
- Backup or deployment tools like Veeam or Spack may use temporary directories for legitimate operations. Add exceptions for these tools by specifying their executable paths or process names.
- Temporary file operations by legitimate applications such as web servers or database services might be flagged. Monitor and exclude these applications by their known behaviors or specific file paths they use.
- Regular system updates or package installations can involve temporary file handling. Recognize and exclude these activities by identifying the associated package manager processes or update scripts.

### Response and remediation

- Isolate the affected host immediately to prevent further spread of the potential malware. Disconnect it from the network to contain the threat.
- Terminate any suspicious processes identified in the alert, especially those executed from temporary directories, to stop any ongoing malicious activity.
- Conduct a thorough examination of the affected directories (/tmp, /var/tmp, etc.) to identify and remove any remaining malicious files or scripts.
- Restore any affected systems from a known good backup to ensure that no remnants of the malware remain.
- Update and patch the affected system to close any vulnerabilities that may have been exploited by the threat actor.
- Enhance monitoring and logging on the affected host and similar systems to detect any recurrence of this behavior, focusing on file creation, execution, and deletion events in temporary directories.
- Escalate the incident to the security operations center (SOC) or incident response team for further analysis and to determine if additional systems may be compromised."""
risk_score = 73
rule_id = "09bc6c90-7501-494d-b015-5d988dc3f233"
setup = """## Setup

This rule requires data coming in from Elastic Defend.

### Elastic Defend Integration Setup
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.

#### Prerequisite Requirements:
- Fleet is required for Elastic Defend.
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).

#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
- Go to the Kibana home page and click "Add integrations".
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
- Click "Add Elastic Defend".
- Configure the integration name and optionally add a description.
- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
- Click "Save and Continue".
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
"""
severity = "high"
tags = [
    "Domain: Endpoint",
    "OS: Linux",
    "Use Case: Threat Detection",
    "Tactic: Execution",
    "Data Source: Elastic Defend",
    "Resources: Investigation Guide",
]
type = "eql"
query = '''
sequence by host.id, user.id with maxspan=1m
  [file where host.os.type == "linux" and event.action == "creation" and
   process.name in ("curl", "wget", "fetch", "ftp", "sftp", "scp", "rsync", "ld") and
   file.path : ("/dev/shm/*", "/run/shm/*", "/tmp/*", "/var/tmp/*",
     "/run/*", "/var/run/*", "/var/www/*", "/proc/*/fd/*")] by file.name
  [process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and
   process.parent.name in ("bash", "dash", "ash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and
   not process.parent.executable like (
     "/tmp/VeeamApp*", "/tmp/rajh/spack-stage/*", "plz-out/bin/vault/bridge/test/e2e/base/bridge-dev",
     "/usr/bin/ranlib", "/usr/bin/ar", "plz-out/bin/vault/bridge/test/e2e/base/local-k8s"
   )] by process.name
  [file where host.os.type == "linux" and event.action == "deletion" and
   file.path : (
     "/dev/shm/*", "/run/shm/*", "/tmp/*", "/var/tmp/*", "/run/*", "/var/run/*", "/var/www/*", "/proc/*/fd/*"
    ) and not process.name in ("rm", "ld", "conftest", "link", "gcc", "getarch", "ld")] by file.name
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"

[[rule.threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1105"
name = "Ingress Tool Transfer"
reference = "https://attack.mitre.org/techniques/T1105/"

[rule.threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1070"
name = "Indicator Removal"
reference = "https://attack.mitre.org/techniques/T1070/"

[[rule.threat.technique.subtechnique]]
id = "T1070.004"
name = "File Deletion"
reference = "https://attack.mitre.org/techniques/T1070/004/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[metadata]
bypass_bbr_timing = true
creation_date = "2023/10/11"
integration = ["github"]
maturity = "production"
updated_date = "2026/03/24"

[rule]
author = ["Elastic"]
building_block_type = "default"
description = "A new PAT was used for a GitHub user not previously seen in the last 14 days.\n"
from = "now-9m"
index = ["logs-github.audit-*"]
language = "kuery"
license = "Elastic License v2"
name = "First Occurrence of Personal Access Token (PAT) Use For a GitHub User"
risk_score = 21
rule_id = "f94e898e-94f1-4545-8923-03e4b2866211"
severity = "low"
tags = [
    "Domain: Cloud",
    "Use Case: Threat Detection",
    "Use Case: UEBA",
    "Tactic: Persistence",
    "Rule Type: BBR",
    "Data Source: Github",
]
timestamp_override = "event.ingested"
type = "new_terms"

query = '''
event.dataset:"github.audit" and event.category:"configuration" and
github.hashed_token:* and user.name:* and
github.programmatic_access_type:("OAuth access token" or "Fine-grained personal access token")
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"

[[rule.threat.technique.subtechnique]]
id = "T1098.001"
name = "Additional Cloud Credentials"
reference = "https://attack.mitre.org/techniques/T1098/001/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"

[[rule.threat.technique.subtechnique]]
id = "T1078.004"
name = "Cloud Accounts"
reference = "https://attack.mitre.org/techniques/T1078/004/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[rule.new_terms]
field = "new_terms_fields"
value = ["user.name", "github.hashed_token"]
[[rule.new_terms.history_window_start]]
field = "history_window_start"
value = "now-5d"

[metadata]
creation_date = "2026/07/16"
integration = ["gcp"]
maturity = "production"
updated_date = "2026/07/16"

[rule]
author = ["Elastic"]
description = """
Detects the first occurrence of a failed GKE API request from a previously unseen user agent. Adversary tooling often
uses non-standard clients; combined with authorization failures this can indicate RBAC probing or exploitation attempts.
"""
false_positives = [
    """
    New internal tools, SDKs, or CI runners introduce novel user agents. Baseline expected clients, then exclude stable
    automation UAs after review.
    """,
]
from = "now-6m"
index = ["logs-gcp.audit-*"]
language = "kuery"
license = "Elastic License v2"
name = "GKE Forbidden Request from Unusual User Agent"
note = """## Triage and analysis

### Investigating GKE Forbidden Request from Unusual User Agent

A novel user agent with failed API calls may be scanner or post-compromise tooling probing RBAC.

### Investigation steps

- Review `user_agent.original`, `client.user.email`, `event.action`, `gcp.audit.resource_name`, and `source.ip`.
- Determine whether the client is expected (new SDK, CI image) or external reconnaissance.
- Hunt for successful requests from the same UA or source after the failures.

### False positives

- First use of a legitimate new client library; add a scoped UA exception after validation.

"""
references = [
    "https://kubernetes.io/docs/reference/access-authn-authz/authorization/",
    "https://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging",
]
risk_score = 47
rule_id = "e1147459-a3e1-4bdc-bab9-965807801774"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Domain: Kubernetes",
    "Data Source: GCP",
    "Data Source: Google Cloud Platform",
    "Use Case: Threat Detection",
    "Tactic: Execution",
    "Tactic: Discovery",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "new_terms"
setup = "The GCP Fleet integration with GKE audit logs enabled is required to be compatible with this rule."

query = '''
data_stream.dataset:gcp.audit and service.name:k8s.io and event.outcome:failure and
user_agent.original:(* and not (*kubernetes/$Format or kube-probe* or gke-exec-auth-plugin*)) and
not client.user.email:(
  "system:addon-manager" or system\:*controller* or system\:gke-* or
  "system:apiserver" or "system:kube-scheduler" or "system:metrics-server-nanny" or
  "system:kube-proxy" or "system:clustermetrics" or "system:vpa-recommender" or
  "system:cluster-autoscaler" or "system:kubestore-collector" or
  "system:konnectivity-server" or
  "system:serviceaccount:kube-system:pod-garbage-collector" or
  "system:serviceaccount:kube-system:generic-garbage-collector" or system\:node\:* or
  "gcp:kube-bootstrap" or *container-engine-robot*
)
'''

[rule.new_terms]
field = "new_terms_fields"
value = ["user_agent.original"]

[[rule.new_terms.history_window_start]]
field = "history_window_start"
value = "now-7d"

[[rule.threat]]
framework = "MITRE ATT&CK"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1613"
name = "Container and Resource Discovery"
reference = "https://attack.mitre.org/techniques/T1613/"

[rule.threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "client.user.email",
    "source.ip",
    "user_agent.original",
    "event.action",
    "event.outcome",
    "gcp.audit.resource_name",
    "orchestrator.resource.name",
    "orchestrator.namespace",
]

[rule]
description = """
Identifies the use of native Windows tool, forfiles to execute a file. Adversaries may abuse utilities that allow for
command execution to bypass security restrictions that limit the use of command-line interpreters.
"""
id = "78afa378-d1c4-4b83-a261-ce1c90f1cbf9"
license = "Elastic License v2"
name = "Indirect Command Execution via ForFiles"
os_list = ["windows"]
reference = ["https://lolbas-project.github.io/lolbas/Binaries/Forfiles/"]
version = "1.0.28"

query = '''
process where event.action == "start" and
  process.parent.name : "forfiles.exe" and process.parent.args : "/c" and
  process.parent.args : "/p" and process.parent.args : "/m" and

  not process.executable : "?:\\Windows\\System32\\conhost.exe" and
  not user.id in ("S-1-5-18", "S-1-5-19", "S-1-5-20") and
  not (process.name : "cmd.exe" and process.args: ("del", "xcopy", "cmd /c del @PATH", "move")) and
  not (process.name : "cmd.exe" and process.command_line :  "/c if TRUE==TRUE rmdir /s /q \"nw*\"") and
  not (process.name : "cmd.exe" and process.command_line : "*echo *J2A* Autolog*") and
  not (process.name : "cmd.exe" and process.args : "echo" and length(process.command_line) <= 25) and
  process.working_directory : ("?:\\", "?:\\*\\AppData\\*", "?:\\Windows\\*") and
  not (process.name : "cmd.exe" and process.command_line : "*Datei*TempAttachments*") and
  not (process.name : "cmd.exe" and process.args : "?:\\Program Files\\CZM\\Tools\\FileCommit.bat") and
  not process.parent.args : "cmd /c echo @PATH"
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1202"
name = "Indirect Command Execution"
reference = "https://attack.mitre.org/techniques/T1202/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.15.0"