Elastic rules: 12

[rule]
description = """
Identifies attempts to modify the permissions or write to Microsoft Anti Malware Scan Interface DLL from unbacked
memory.
"""
id = "06516087-9305-482b-af9a-92f4386d2f19"
license = "Elastic License v2"
name = "AMSI Bypass via Unbacked Memory"
os_list = ["windows"]
reference = [
    "https://aidenpearce369.github.io/offsec/AMSI-Memory-Bypass/",
    "https://modexp.wordpress.com/2019/06/03/disable-amsi-wldp-dotnet/",
]
version = "1.0.9"

query = '''
api where process.Ext.api.summary : "* amsi.dll*" and 
 ((process.Ext.api.name in ("VirtualProtect", "VirtualProtectEx") and process.Ext.api.parameters.protection like "?W*") or
  process.Ext.api.name == "WriteProcessMemory") and
 process.executable != null and process.thread.Ext.call_stack_summary like "?*" and process.thread.Ext.call_stack_final_user_module.name != null and
 process.thread.Ext.call_stack_final_user_module.name == "Unbacked" and
 process.thread.Ext.call_stack_final_user_module.protection_provenance != null and 
 not process.thread.Ext.call_stack_final_user_module.protection_provenance like ("Kernel", "Kernel|*") and
 not (process.thread.Ext.call_stack_summary == "Unbacked" and process.thread.Ext.call_stack_final_user_module.protection_provenance == "Unbacked") and
 process.thread.Ext.call_stack_final_user_module.hash.sha256 != "07e82c4bc4f48e94a634480ff5140b94b2026a7716473867806355957dc4d291" and
 not process.parent.executable : "C:\\Program Files (x86)\\Steam\\steamapps\\common\\BattleBit Remastered\\EasyAntiCheat.exe" and
 not _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.trusted == true and
                  $entry.subject_name in ("Microsoft Windows Hardware Compatibility Publisher", "Microsoft Windows Software Compatibility Publisher")) and
 not (process.executable : "?:\\Windows\\Microsoft.NET\\Framework\\*\\ngen.exe" and
      process.thread.Ext.call_stack_summary == "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|Unbacked|protector32.dll")
'''

min_endpoint_version = "8.10.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"

[metadata]
creation_date = "2020/05/21"
integration = ["okta"]
maturity = "production"
updated_date = "2026/04/10"

[rule]
author = ["Elastic"]
description = """
Detects attempts to modify a rule within an Okta policy. An adversary may attempt to modify an Okta policy rule in order
to weaken an organization's security controls.
"""
false_positives = [
    """
    Consider adding exceptions to this rule to filter false positives if Okta MFA rules are regularly modified in your
    organization.
    """,
]
index = ["filebeat-*", "logs-okta*"]
language = "kuery"
license = "Elastic License v2"
name = "Attempt to Modify an Okta Policy Rule"
note = """## Triage and analysis

### Investigating Attempt to Modify an Okta Policy Rule

The modification of an Okta policy rule can be an indication of malicious activity as it may aim to weaken an organization's security controls.

#### Possible investigation steps:

- Identify the actor related to the alert by reviewing `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, or `okta.actor.display_name` fields in the alert.
- Review the `okta.client.user_agent.raw_user_agent` field to understand the device and software used by the actor.
- Examine the `okta.outcome.reason` field for additional context around the modification attempt.
- Check the `okta.outcome.result` field to confirm the rule modification attempt.
- Check if there are multiple rule modification attempts from the same actor or IP address (`okta.client.ip`).
- Check for successful logins immediately following the modification attempt.
- Verify whether the actor's activity aligns with typical behavior or if any unusual activity took place around the time of the modification attempt.

### False positive analysis:

- Check if there were issues with the Okta system at the time of the modification attempt. This could indicate a system error rather than a genuine threat activity.
- Check the geographical location (`okta.request.ip_chain.geographical_context`) and time of the modification attempt. If these match the actor's normal behavior, it might be a false positive.
- Verify the actor's administrative rights to ensure they are correctly configured.

### Response and remediation:

- If unauthorized modification is confirmed, initiate the incident response process.
- Immediately lock the affected actor account and require a password change.
- Consider resetting MFA tokens for the actor and require re-enrollment.
- Check if the compromised account was used to access or alter any sensitive data or systems.
- If a specific modification technique was used, ensure your systems are patched or configured to prevent such techniques.
- Assess the criticality of affected services and servers.
- Work with your IT team to minimize the impact on users and maintain business continuity.
- If multiple accounts are affected, consider a broader reset or audit of MFA tokens.
- Implement security best practices [outlined](https://www.okta.com/blog/2019/10/9-admin-best-practices-to-keep-your-org-secure/) by Okta.
- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).

## Setup

The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
references = [
    "https://help.okta.com/en/prod/Content/Topics/Security/Security_Policies.htm",
    "https://developer.okta.com/docs/reference/api/system-log/",
    "https://developer.okta.com/docs/reference/api/event-types/",
    "https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy",
    "https://www.elastic.co/security-labs/monitoring-okta-threats-with-elastic-security",
    "https://www.elastic.co/security-labs/starter-guide-to-understanding-okta",
]
risk_score = 21
rule_id = "000047bb-b27a-47ec-8b62-ef1a5d2c9e19"
severity = "low"
tags = [
    "Use Case: Identity and Access Audit",
    "Tactic: Defense Evasion",
    "Data Source: Okta",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset:okta.system and event.action:policy.rule.update
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1484"
name = "Domain or Tenant Policy Modification"
reference = "https://attack.mitre.org/techniques/T1484/"

[[rule.threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"

[[rule.threat.technique.subtechnique]]
id = "T1562.007"
name = "Disable or Modify Cloud Firewall"
reference = "https://attack.mitre.org/techniques/T1562/007/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[metadata]
creation_date = "2024/07/12"
integration = ["aws"]
maturity = "production"
updated_date = "2026/08/05"

[rule]
author = ["Elastic"]
description = """
Identifies the creation or modification of an S3 bucket replication configuration that sends data to a bucket in a
different AWS account. Cross-account replication can be used legitimately for backup, disaster recovery, and
multi-account architectures, but adversaries with write access to an S3 bucket may abuse replication rules to silently
exfiltrate large volumes of data to attacker-controlled accounts. This rule detects "PutBucketReplication" events where
the configured destination account differs from the source bucket's account, indicating potential unauthorized
cross-account data movement.
"""
event_category_override = "event.type"
false_positives = [
    """
    Cross-account S3 replication is common in multi-account AWS Organizations, centralized logging architectures, and
    disaster-recovery designs. Confirm whether the destination account is an approved replication target. Unexpected
    replication configuration changes should be treated as suspicious.
    """,
]
from = "now-6m"
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
language = "eql"
license = "Elastic License v2"
name = "AWS S3 Bucket Replicated to Another Account"
note = """## Triage and analysis

### Investigating AWS S3 Bucket Replicated to Another Account

Cross-account S3 replication enables automated copying of S3 objects into a different AWS bucket. While useful for backup and organizational data flows, adversaries may exploit it as a covert exfiltration channel. Once replication is configured, any future writes to the bucket are silently copied to the destination bucket—even if object-level access controls block the attacker’s direct downloads. For this reason, unauthorized replication configuration should be considered high-risk.

This rule detects successful `PutBucketReplication` events and flags cases where the replication configuration specifies a destination AWS account different from the source.

#### Possible investigation steps

**Understand who initiated the replication change**
- Inspect `aws.cloudtrail.user_identity.arn` and `aws.cloudtrail.user_identity.access_key_id` to identify the actor.
- Review authentication patterns such as federated session names, role chaining via STS, or unfamiliar IAM roles.
- Examine `source.ip`, `source.geo` fields, and `user_agent.original` for unusual locations, automation tools, or anomalous access paths.

**Examine the replication rule details**
- Inspect `aws.cloudtrail.request_parameters` for:
  - The **destination account ID** (`Account=`).
  - The **IAM role ARN** used for replication. (`Role=`)
  - Any filtering rules (prefixes, tags) that narrow or broaden what will be replicated.

**Determine whether the destination account is authorized**
- Validate whether the destination AWS account belongs to your AWS Organization.
- Check internal documentation, IaC templates, or tagging standards to confirm whether replication to this account is expected.
- Look for prior legitimate infrastructure workflows such as:
  - Centralized logging
  - Backup/DR accounts
  - Cross-region compliance replicas

Unrecognized accounts should be treated as a strong exfiltration signal.

**Assess the scope of potential data exposure**
- Determine whether the bucket contains sensitive or regulated data (PII, financial records, secrets, logs, etc.).
- Identify whether object versioning, lifecycle rules, or access logging were modified recently.
- Check for preceding or subsequent actions such as:
  - `PutBucketPolicy` updates granting new principals access
  - Creation or modification of IAM roles tied to replication
  - `DeleteObject` or `PutObjectRetention` attempts that might pair with exfiltration

**Correlate with other suspicious activity**
Pivot in CloudTrail on the same principal or same bucket:
- Prior reconnaissance such as `ListBuckets`, `GetBucketReplication`, or `GetBucketPolicy`
- Modification of KMS policies or unexpected encryption key usage
- New access patterns from external IP addresses or unusual automation

### False positive analysis

**Legitimate cross-account replication**
Validate:
- The destination account belongs to a known OU or business unit
- The replication role ARN matches expected automation
- The change aligns with documented deployment or maintenance schedules

**Temporary migrations or transitions**
During account restructuring or workload migration, administrators may temporarily redirect replication to new accounts.

Tuning options:
- Exception lists based on IAM role ARNs
- Tag-based environment scoping
- Change-window-based suppression

### Response and remediation

**Contain potential exfiltration**
- Remove or update replication rules to eliminate unauthorized destinations.
- Disable or restrict the replication IAM role until the investigation is complete.
- Review S3 object access logs to determine whether data has begun replicating to the external account.

**Investigate scope and impact**
- Identify the volume and types of data at risk of replication.
- Determine whether the external bucket shows successful replication traffic (if logs or access are available).
- Assess whether the actor also modified bucket policies, encryption settings, or KMS keys.

**Credential and role hygiene**
- Rotate credentials for the initiating user or role if compromise is suspected.
- Review IAM role trust policies, especially if STS sessions or EC2 role assumptions were involved.
- Enable MFA and tighten conditions for administrative roles capable of modifying replication.

**Hardening and preventive controls**
- Enforce SCPs that restrict cross-account replication except for explicitly approved destinations.
- Require approval workflows before modifying replication or retention settings.
- Use AWS Config and Security Hub controls to detect:
  - Buckets with unexpected replication rules
  - Newly added cross-account permissions
  - Changes to bucket policies, block-public-access settings, or KMS key policies

### Additional information

- **[AWS IR Playbooks](https://github.com/aws-samples/aws-incident-response-playbooks/blob/c151b0dc091755fffd4d662a8f29e2f6794da52c/playbooks/)** 
- **[AWS Customer Playbook Framework](https://github.com/aws-samples/aws-customer-playbook-framework/tree/a8c7b313636b406a375952ac00b2d68e89a991f2/docs)** 
- **Security Best Practices:** [AWS Knowledge Center – Security Best Practices](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/).
"""
references = [
    "https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication-walkthrough-2.html/",
    "https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketReplication.html/",
]
risk_score = 73
rule_id = "d488f026-7907-4f56-ad51-742feb3db01c"
severity = "high"
tags = [
    "Domain: Cloud",
    "Platform: AWS",
    "Data Source: AWS CloudTrail",
    "Service: AWS S3",
    "Tactic: Exfiltration",
    "Rule Type: Event Correlation (EQL)",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
info where data_stream.dataset == "aws.cloudtrail"
   and event.action == "PutBucketReplication"
   and event.outcome == "success"
   and stringContains(aws.cloudtrail.request_parameters, "Account=")
   and not user_agent.original like~ ("*Terraform*", "*Pulumi*")
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1537"
name = "Transfer Data to Cloud Account"
reference = "https://attack.mitre.org/techniques/T1537/"

[[rule.threat.technique]]
id = "T1567"
name = "Exfiltration Over Web Service"
reference = "https://attack.mitre.org/techniques/T1567/"

[[rule.threat.technique.subtechnique]]
id = "T1567.002"
name = "Exfiltration to Cloud Storage"
reference = "https://attack.mitre.org/techniques/T1567/002/"

[rule.threat.tactic]
id = "TA0010"
name = "Exfiltration"
reference = "https://attack.mitre.org/tactics/TA0010/"
[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user_agent.original",
    "source.ip",
    "aws.cloudtrail.user_identity.arn",
    "aws.cloudtrail.user_identity.type",
    "aws.cloudtrail.user_identity.access_key_id",
    "aws.cloudtrail.resources.arn",
    "aws.cloudtrail.resources.type",
    "event.action",
    "event.outcome",
    "cloud.account.id",
    "cloud.region",
    "aws.cloudtrail.request_parameters",
]

[metadata]
creation_date = "2025/02/11"
integration = ["aws"]
maturity = "production"
updated_date = "2026/04/10"

[rule]
author = ["Elastic"]
description = """
Identifies when an SNS topic is created by a user who does not typically perform this action. Adversaries may create SNS
topics to stage capabilities for data exfiltration or other malicious activities. This is a New Terms rule that only flags
when this behavior is observed for the first time by a user or role.
"""
false_positives = [
    """
    Legitimate users may create SNS topics for legitimate purposes. Ensure that the creation is authorized before taking
    action.
    """,
]
from = "now-6m"
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
language = "kuery"
license = "Elastic License v2"
name = "AWS SNS Topic Created by Rare User"
note = """## Triage and Analysis

### Investigating AWS SNS Topic Created by Rare User

This rule detects the creation of an AWS Simple Notification Service (SNS) topic by a user who does not typically perform this action. Adversaries may create SNS topics to facilitate data exfiltration or other malicious activities.

This is a [New Terms](https://www.elastic.co/guide/en/security/current/rules-ui-create.html#create-new-terms-rule) rule that only flags when this behavior is observed for the first time by a user or role.

### Possible investigation steps

**Identify the actor and context**
  - Examine `aws.cloudtrail.user_identity.arn` to determine **who** created the SNS topic.
  - Identify whether the actor assumed a privileged IAM role (`aws.cloudtrail.user_identity.type: "AssumedRole"`) or used a long term access keys (`aws.cloudtrail.user_identity.access_key_id`).
  - Check `user_agent.original` to determine if this action was performed via the AWS CLI, SDK, or Console.
  - If `aws-cli` was used, review whether it aligns with typical automation or administrative behavior.
  - Review `source.ip` and `source.geo` fields to confirm if the request originated from a trusted or unexpected location.

**Evaluate the SNS topic creation**
  - Check `aws.cloudtrail.request_parameters` for the SNS topic name and determine whether it appears suspicious (e.g., random strings, unusual keywords).
  - Verify `cloud.region` and `cloud.account.id` to ensure the SNS topic was created in an expected environment.
  - Identify additional actions **before or after** this event using `event.action` values like:
    - `Subscribe`
    - `Publish`
    - `SetTopicAttributes`
  - These may indicate follow-up steps taken to misuse the SNS topic.

**Analyze potential malicious intent**
  - Check if this user has previously created SNS topics using historical CloudTrail logs.
  - Look for multiple topic creations in a short period, which may suggest an automation script or malicious behavior.
  - If `aws.cloudtrail.user_identity.arn` references an EC2 instance role, verify whether that instance typically performs SNS operations.
  - Review whether new subscriptions were added (`Subscribe` API action) to forward data externally.
  - If an SNS topic was configured to trigger Lambda functions or S3 events, it may indicate an attempt to persist in the environment.

### False positive analysis
- Check whether the SNS topic creation aligns with known DevOps, automation, or monitoring activities.
- If the user typically interacts with SNS, consider allowlisting expected IAM roles for this action.
- Some AWS services may auto-create SNS topics for alerts and monitoring. Confirm whether the creation was system-generated.

### Response and remediation
- **Confirm Authorization**:
  - If the user was not expected to create SNS topics, verify whether their IAM permissions should be restricted.
  - If unauthorized, disable the access keys or IAM role associated with the event.
- **Monitor for Further SNS Modifications**:
  - Set up additional monitoring for SNS Publish or Subscription events (`Publish`, `Subscribe`).
- **Investigate for Persistence**:
  - Check whether the SNS topic is being used as a notification channel for Lambda, S3, or other AWS services.
- **Enhance IAM Policy Controls**:
  - Consider enforcing least privilege IAM policies and enabling multi-factor authentication (MFA) where applicable.
"""
references = [
      "https://docs.aws.amazon.com/sns/latest/api/API_CreateTopic.html",
      "https://permiso.io/blog/s/smishing-attack-on-aws-sms-new-phone-who-dis/",
      "https://www.sentinelone.com/labs/sns-sender-active-campaigns-unleash-messaging-spam-through-the-cloud/",
]
risk_score = 21
rule_id = "3c3f65b8-e8b4-11ef-9511-f661ea17fbce"
severity = "low"
tags = [
    "Domain: Cloud",
    "Data Source: AWS",
    "Data Source: Amazon Web Services",
    "Data Source: AWS SNS",
    "Resources: Investigation Guide",
    "Use Case: Threat Detection",
    "Tactic: Resource Development",
    "Tactic: Impact",
]
timestamp_override = "event.ingested"
type = "new_terms"

query = '''
data_stream.dataset: "aws.cloudtrail"
    and event.provider: "sns.amazonaws.com"
    and event.action: "CreateTopic"
    and event.outcome: "success"
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1608"
name = "Stage Capabilities"
reference = "https://attack.mitre.org/techniques/T1608/"


[rule.threat.tactic]
id = "TA0042"
name = "Resource Development"
reference = "https://attack.mitre.org/tactics/TA0042/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1496"
name = "Resource Hijacking"
reference = "https://attack.mitre.org/techniques/T1496/"
[[rule.threat.technique.subtechnique]]
id = "T1496.004"
name = "Cloud Service Hijacking"
reference = "https://attack.mitre.org/techniques/T1496/004/"


[rule.threat.tactic]
id = "TA0040"
name = "Impact"
reference = "https://attack.mitre.org/tactics/TA0040/"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user_agent.original",
    "source.ip",
    "aws.cloudtrail.user_identity.arn",
    "aws.cloudtrail.user_identity.type",
    "aws.cloudtrail.user_identity.access_key_id",
    "event.action",
    "event.outcome",
    "cloud.account.id",
    "cloud.region",
    "aws.cloudtrail.request_parameters",
    "aws.cloudtrail.response_elements"
]
[rule.new_terms]
field = "new_terms_fields"
value = ["cloud.account.id", "user.name"]
[[rule.new_terms.history_window_start]]
field = "history_window_start"
value = "now-10d"

[rule]
description = """
Identifies the execution of a binary via the Time Traver Debugging Application Injector utility. Adversaries may bypass
process and signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted,
binaries.
"""
id = "658efff4-b1b7-4ab7-ba1f-7ce295d3df05"
license = "Elastic License v2"
name = "Binary Proxy Execution via TTDInject"
os_list = ["windows"]
reference = ["https://lolbas-project.github.io/lolbas/Binaries/Ttdinject/"]
version = "1.0.5"

query = '''
process where event.action == "start" and 
 (
 (process.parent.name : "TTDInject.EXE" and process.parent.args : "/Launch") or 
 (process.pe.original_file_name : "TTDInject.EXE" and process.args : "/Launch" and
  not process.executable : "?:\\Windows\\Sys*\\ttdinject.exe")
 )
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.15.0"

[metadata]
creation_date = "2021/01/04"
integration = ["endpoint"]
maturity = "production"
updated_date = "2025/03/18"

[rule]
author = ["Elastic"]
description = """
Adversaries may dump the content of the keychain storage data from a system to acquire credentials. Keychains are the
built-in way for macOS to keep track of users' passwords and credentials for many services and features, including Wi-Fi
and website passwords, secure notes, certificates, and Kerberos.
"""
from = "now-9m"
index = ["logs-endpoint.events.process*"]
language = "eql"
license = "Elastic License v2"
name = "Dumping of Keychain Content via Security Command"
references = ["https://ss64.com/osx/security.html"]
risk_score = 73
rule_id = "565d6ca5-75ba-4c82-9b13-add25353471c"
setup = """## Setup

This rule requires data coming in from Elastic Defend.

### Elastic Defend Integration Setup
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.

#### Prerequisite Requirements:
- Fleet is required for Elastic Defend.
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).

#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
- Go to the Kibana home page and click "Add integrations".
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
- Click "Add Elastic Defend".
- Configure the integration name and optionally add a description.
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
- Click "Save and Continue".
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
"""
severity = "high"
tags = [
    "Domain: Endpoint",
    "OS: macOS",
    "Use Case: Threat Detection",
    "Tactic: Credential Access",
    "Data Source: Elastic Defend",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
process where host.os.type == "macos" and event.type in ("start", "process_started") and 
 process.args like~ "dump-keychain" and process.args == "-d"
'''
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Dumping of Keychain Content via Security Command

Keychains in macOS securely store user credentials, including passwords and certificates. Adversaries exploit this by using commands to extract keychain data, aiming to access sensitive information. The detection rule identifies suspicious activity by monitoring processes that initiate keychain dumps, specifically looking for command-line arguments associated with this malicious behavior, thus alerting analysts to potential credential theft attempts.

### Possible investigation steps

- Review the process details to identify the parent process and determine if the keychain dump was initiated by a legitimate application or user.
- Examine the user account associated with the process to verify if the activity aligns with their typical behavior or if the account may be compromised.
- Check the timestamp of the event to correlate with any other suspicious activities or anomalies on the system around the same time.
- Investigate the command-line arguments used in the process to confirm if they match known patterns of malicious keychain dumping attempts.
- Analyze any network connections or data transfers initiated by the process to identify potential exfiltration of the dumped keychain data.
- Look for additional alerts or logs from the same host or user to assess if this is part of a broader attack campaign.

### False positive analysis

- Legitimate administrative tasks or system maintenance activities may trigger the rule if they involve keychain access. Users should review the context of the process initiation to determine if it aligns with routine administrative operations.
- Security or IT tools that perform regular audits or backups of keychain data might be flagged. Users can create exceptions for these tools by identifying their specific process names or paths and excluding them from the rule.
- Developers or advanced users testing applications that require keychain access might inadvertently trigger the rule. Users should document these activities and consider temporary exclusions during development phases.
- Automated scripts or workflows that interact with keychain data for legitimate purposes could be mistaken for malicious activity. Users should ensure these scripts are well-documented and consider adding them to an allowlist if they are frequently used.

### Response and remediation

- Immediately isolate the affected macOS system from the network to prevent further unauthorized access or data exfiltration.
- Terminate any suspicious processes identified by the detection rule, specifically those involving the "dump-keychain" command, to halt ongoing credential theft attempts.
- Conduct a thorough review of the system's keychain access logs to identify any unauthorized access or export of credentials and determine the scope of the compromise.
- Change all credentials stored in the keychain, including passwords for Wi-Fi, websites, and any other services, to mitigate the risk of unauthorized access using stolen credentials.
- Restore the system from a known good backup if any unauthorized changes or malware are detected, ensuring that the backup predates the compromise.
- Escalate the incident to the security operations team for further investigation and to assess whether additional systems may be affected.
- Implement enhanced monitoring and alerting for similar suspicious activities, focusing on keychain access and command-line arguments related to credential dumping, to prevent future incidents."""


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1555"
name = "Credentials from Password Stores"
reference = "https://attack.mitre.org/techniques/T1555/"
[[rule.threat.technique.subtechnique]]
id = "T1555.001"
name = "Keychain"
reference = "https://attack.mitre.org/techniques/T1555/001/"



[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[rule]
description = """
Identifies when a Microsoft Office process spawns a child process and from a call stack pointing to Microsoft Office
Visual Basic for Applications modules. This may indicate an attempt to get initial access using malicious macro enabled
documents.
"""
id = "1c4047ca-a69b-473f-a93e-5660e012d9a5"
license = "Elastic License v2"
name = "Execution from a Macro Enabled Office Document"
os_list = ["windows"]
reference = [
    "https://www.elastic.co/security-labs/upping-the-ante-detecting-in-memory-threats-with-kernel-call-stacks",
]
version = "1.0.32"

query = '''
process where event.action == "start" and
   process.parent.name : ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "mspub.exe", "fltldr.exe", "visio.exe") and
   process.parent.thread.Ext.call_stack_summary : "*|VBE?.dll*" and process.executable : "C:\\*" and

   not (process.executable : "?:\\Windows\\splwow64.exe" and
        _arraysearch(process.parent.thread.Ext.call_stack, $entry, $entry.symbol_info: "?:\\Windows\\Sys*\\winspool.drv*")) and

   not (process.executable : "?:\\Program Files*\\Microsoft Office\\root\\Office*\\MSACCESS.EXE" and
         process.parent.name : "MSACCESS.EXE" and
        _arraysearch(process.parent.thread.Ext.call_stack, $entry, $entry.symbol_info: "?:\\Program Files*\\Microsoft Office\\root\\Office*\\MSACCESS.EXE!FDeliverDb*")) and

   not (process.executable : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*") and
        not process.code_signature.subject_name : "Microsoft*") and

   not (process.name : "rundll32.exe" and process.args : ("?:\\WINDOWS\\system32\\spool\\DRIVERS\\*MonitorPrintJobStatus", "url.dll,FileProtocolHandler")) and

   not (process.command_line : "powershell.exe -WindowStyle hidden kill -processname winword" and process.working_directory : "\\\\*$\\*\\Documents\\") and

   not process.hash.sha256 : ("3d4926dbf5c4fc8edd3382850cdd54fc5b4e866b34251f7cff5ba0b50179dedb",
                              "bf879ebb625dbc1d2561e5aa6d9bb3bf16ad1d834743456568ec40dddace6fb0",
                              "0697a5a9fecac88cd1a875f32ebbb5fecefdcdc9ddd3e1c17e391527abf47aa0",
                              "5fa6ed1524d60215307f7c84df56f1fa8c852321df1fe0931521c76cbb6d6821",
                              "be4d0288c69fba437e369110f27cbc4f5448bb7c3d2fe204c6ea8a053f426620",
                              "ee8141ceae149b3b2f1fb89bfea36d287b2157b9279377b318fdaf717158eaf1",
                              "4659ad634dce7b746929590173abbf341a456042d5a70acce462f7806c859d01",
                              "a892c32f9c80f15716cff118a1287036c4c6d4b18ca81b0141f353bffd662134",
                              "c568d3dd471f06d0d38b711efb04a1d6fba11bc87522aeb58b42267f5e04af89",
                              "71bd6fd7d83af510485abe2f400311600dd8432a70ecb767c352ee6b3675ebc2",
                              "197dd5559e979df757312a5235f453eb71c7b80d4229bce1720f57c1c8b19ab9",
                              "993a81cbaa686eb56997e5bd49f0e348166a4ffbf86001f589f73939778b3baa",
                              "280c6e19e80864faf90dd97905aacf999f58778a5adac1a8ee06477c6f80fb65",
                              "1037f978350bb4b52c8698b81d0a377675c98d0ca9a82070174cc0f46e8cb51e",
                              "83b5a19f2df77b735069a4f9f1def9c0e207f8636bdd6856ef52977bc23f874b",
                              "d248007eb375cab3994b48ba1346b508de29d1f441a395b9e6fa14fc7913294d",
                              "bf3a8aa99f62748edb9c7921c50778bff5dd0f4d47f7a1263516e10b99903a28",
                              "ce4a8d8ebe5bcb5ba5ee9a6733bbd6c06433d3fc3a14aef95065689ca06bff06",
                              "dda38aee1ada246114121c82df7441c3b4a7c0b27767a4ea8781623f5ee5df02",
                              "24a7d85e2b983037985d6dbaa9befd3b48e08ed9bbbe6b242501a250776ec6bc",
                              "5d4cb2c29245c7c12df3d3a7609ed4b7f24d47c991758c2f73c5131c2be53d03",
                              "d6236f9ea1a7f98008fc03a761c5373badb79dc70a5e9e17e11f1302d405e011") and

   not process.executable : ("?:\\Windows\\explorer.exe",
                             "?:\\Windows\\SysWOW64\\explorer.exe",
                             "?:\\Windows\\SysWOW64\\cmd.exe",
                             "?:\\Windows\\System32\\cmd.exe",
                             "C:\\Windows\\SysWOW64\\cmd.exe",
                             "?:\\Windows\\hh.exe",
                             "?:\\Windows\\System32\\spool\\drivers\\*",
                             "?:\\Program Files (x86)\\Microsoft Office\\root\\*.EXE",
                             "?:\\Program Files\\Microsoft Office\\root\\*.EXE",
                             "?:\\Program Files (x86)\\AV\\AV.EXE",
                             "?:\\Program Files\\AV\\AV.EXE",
                             "?:\\Program Files (x86)\\PDFtk\\bin\\pdftk.exe",
                             "?:\\Program Files\\PDFtk\\bin\\pdftk.exe",
                             "?:\\Windows\\SysWOW64\\DWWIN.EXE",
                             "?:\\WINDOWS\\system32\\dwwin.exe",
                             "?:\\Windows\\System32\\wermgr.exe",
                             "?:\\Windows\\SysWOW64\\wermgr.exe",
                             "?:\\Windows\\System32\\taskkill.exe",
                             "?:\\Windows\\System32\\Robocopy.exe",
                             "C:\\Windows\\SysWOW64\\verclsid.exe",
                             "C:\\Program Files\\Microsoft VS Code\\Code.exe",
                             "\\Device\\Mup\\*",
                             "?:\\Program Files\\Common Files\\microsoft shared\\DW\\DW20.EXE",
                             "?:\\Program Files (x86)\\Common Files\\Microsoft Shared\\DW\\DW20.EXE",
                             "?:\\Program Files (x86)\\DivorceMate Software\\DIVORCEmate.exe",
                             "?:\\Program Files (x86)\\DivorceMate Software\\dmFile.exe",
                             "?:\\Program Files (x86)\\Efalia GmbH\\Efalia ECM WinClient\\DSDMS.FileDirector.WinClient.exe",
                             "?:\\Program Files (x86)\\Spielberg Solutions GmbH\\FileDirector WinClient\\DSDMS.FileDirector.WinClient.exe",
                             "?:\\Windows\\Microsoft.NET\\Framework*\\csc.exe",
                             "?:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
                             "?:\\Program Files\\Internet Explorer\\iexplore.exe",
                             "?:\\Program Files\\7-Zip\\7z.exe",
                             "?:\\Program Files (x86)\\Microsoft Office\\Office??\\MsoSync.exe",
                             "C:\\Program Files\\WindowsApps\\Microsoft.WindowsNotepad_*\\Notepad\\Notepad.exe",
                             "?:\\Windows\\SysWOW64\\taskkill.exe",
                             "?:\\Windows\\System32\\WerFault.exe")
'''

min_endpoint_version = "8.7.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"
[[threat.technique.subtechnique]]
id = "T1566.001"
name = "Spearphishing Attachment"
reference = "https://attack.mitre.org/techniques/T1566/001/"



[threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"

[internal]
min_endpoint_version = "8.7.0"

[rule]
description = """
Identifies when the Microsoft HTML Help Executable (hh.exe) creates a portable executable (PE) file and the file is
subsequently executed. Adversaries may conceal malicious code in a CHM file and deliver it to a victim for execution.
"""
id = "9c3b13f6-bc26-4397-9721-4ba23ddd1014"
license = "Elastic License v2"
name = "File Execution via Microsoft HTML Help"
os_list = ["windows"]
reference = [
    "https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/",
]
version = "1.0.30"

query = '''
sequence with maxspan=2m
 [file where event.action != "deletion" and process.name : "hh.exe"] by file.path
 [process where event.action == "start"] by process.executable
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"
[[threat.technique.subtechnique]]
id = "T1566.001"
name = "Spearphishing Attachment"
reference = "https://attack.mitre.org/techniques/T1566/001/"



[threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[[threat.technique.subtechnique]]
id = "T1218.001"
name = "Compiled HTML File"
reference = "https://attack.mitre.org/techniques/T1218/001/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.15.0"

[metadata]
creation_date = "2020/11/17"
integration = ["google_workspace"]
maturity = "production"
updated_date = "2026/07/08"

[rule]
author = ["Elastic"]
description = """
Detects when an administrator disables multi-factor authentication enforcement or removes the ability for users
to enroll in 2-step verification across a Google Workspace organization or organizational unit. Adversaries with
administrative access may weaken tenant-wide authentication requirements to enable password-only sign-ins, facilitate
credential abuse at scale, and reduce friction for follow-on account takeover across the domain.
"""
false_positives = [
    """
    MFA policies may be modified by system administrators. Verify that the configuration change was expected. Exceptions
    can be added to this rule to filter expected behavior.
    """,
]
from = "now-130m"
index = ["filebeat-*", "logs-google_workspace.admin-*"]
interval = "10m"
language = "kuery"
license = "Elastic License v2"
name = "Google Workspace MFA Enforcement Disabled For Organization"
note = """## Triage and analysis

### Investigating Google Workspace MFA Enforcement Disabled For Organization

Threat actors with Google Workspace administrative access may disable organization-wide 2-step verification (2SV)
controls to weaken authentication for many users at once. Unlike a single user turning off 2SV on their own account,
this change affects tenant policy and can allow password-only sign-ins across an organizational unit or the entire
domain. This supports large-scale credential abuse, reduces MFA friction for follow-on compromise, and can blind
security teams if paired with other admin tampering.

This rule identifies when an administrator sets `google_workspace.admin.new_value` to `false` for either
`ENFORCE_STRONG_AUTHENTICATION` (2SV enforcement turned off) or `ALLOW_STRONG_AUTHENTICATION` (users can no longer turn
on 2SV).

### Possible investigation steps

- Identify the initiating (actor) administrator by reviewing `user.email` or `user.name`, and note the `source.ip` and `event.ingested` timestamps.
- Identify the setting changed by reviewing `event.action`:
  - `ENFORCE_STRONG_AUTHENTICATION` — 2SV enforcement was disabled for the affected scope.
  - `ALLOW_STRONG_AUTHENTICATION` — users were prevented from turning on 2SV.
- Review `google_workspace.admin.old_value` and `google_workspace.admin.new_value` to confirm the prior and updated policy state.
- Determine the scope of impact by reviewing `google_workspace.admin.org_unit.name` (if present) and identifying which users or groups inherit the weakened policy.
- Determine whether the change is expected and authorized:
  - Validate there is an approved change request/ticket and that the actor is authorized to modify authentication policy.
  - If the actor account or `source.ip` is unusual, treat the alert as higher priority until proven benign.
- Search Kibana for related authentication and admin activity:
  - Use the following KQL example to find other MFA policy changes by the same actor:
    ```
    data_stream.dataset: "google_workspace.admin" and user.email: "<ACTOR_EMAIL>" and event.action: ("ENFORCE_STRONG_AUTHENTICATION" or "ALLOW_STRONG_AUTHENTICATION")
    ```
  - Search for user-level 2SV disables that follow this change:
    ```
    data_stream.dataset: ("google_workspace.login" or "google_workspace.user_accounts") and event.action: "2sv_disable"
    ```
  - Scope for other security-weakening admin actions from the same `user.email` within the last 48 hours, such as password policy changes, SSO/SAML modifications, or role assignments.

### False positive analysis

- Verify the MFA policy change aligns with an approved change window, migration, or troubleshooting activity.
- Confirm the initiating administrator is legitimate and not acting from unusual IPs, devices, or locations.
- Even authorized changes materially weaken tenant security, validate business justification and time-bound rollback plans.

### Response and remediation

- Initiate the incident response process based on triage findings.
- If the change is not clearly authorized, restore 2SV enforcement and re-enable Allow users to turn on 2-Step Verification for the affected scope while the investigation proceeds.
- If the initiating admin account is suspected compromised, reset credentials, revoke active sessions, and review delegated admin roles assigned to that account.
- Identify the possible impact of the incident and prioritize accordingly; the following actions can help you gain context:
    - Identify the account role in the cloud environment.
    - Assess the criticality of affected services and servers.
    - Work with your IT team to identify and minimize the impact on users.
    - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
    - Identify any regulatory or legal ramifications related to this activity.
- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
- Review the permissions assigned to the implicated administrator to ensure that the least privilege principle is being followed.
- Implement security best practices [outlined](https://support.google.com/a/answer/7587183) by Google.
- Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).

## Setup

The Google Workspace Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.

### Important Information Regarding Google Workspace Event Lag Times

- As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs.
- This rule is configured to run every 10 minutes with a lookback time of 130 minutes.
- To reduce the risk of false negatives, consider reducing the interval that the Google Workspace (formerly G Suite) Filebeat module polls Google's reporting API for new events.
- By default, `var.interval` is set to 2 hours (2h). Consider changing this interval to a lower value, such as 10 minutes (10m).
- See the following references for further information:
  - https://support.google.com/a/answer/7061566
  - https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-google_workspace.html"""
references = [
    "https://support.google.com/a/answer/9176657?hl=en#",
    "https://www.elastic.co/security-labs/google-workspace-attack-surface-part-one",
    "https://www.elastic.co/security-labs/google-workspace-attack-surface-part-two"
]
risk_score = 73
rule_id = "cad4500a-abd7-4ef3-b5d3-95524de7cfe1"
severity = "high"
tags = [
    "Domain: Cloud",
    "Data Source: Google Workspace",
    "Use Case: Configuration Audit",
    "Tactic: Impact",
    "Tactic: Credential Access",
    "Tactic: Defense Evasion",
    "Tactic: Persistence",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset:google_workspace.admin
  and event.action:(ENFORCE_STRONG_AUTHENTICATION or ALLOW_STRONG_AUTHENTICATION)
  and google_workspace.admin.new_value:false
'''

[rule.investigation_fields]
field_names = [
    "user.name",
    "user.email",
    "source.ip",
    "event.action",
    "google_workspace.admin.org_unit.name",
    "google_workspace.admin.old_value",
    "google_workspace.admin.new_value",
]

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1531"
name = "Account Access Removal"
reference = "https://attack.mitre.org/techniques/T1531/"

[rule.threat.tactic]
id = "TA0040"
name = "Impact"
reference = "https://attack.mitre.org/tactics/TA0040/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1556"
name = "Modify Authentication Process"
reference = "https://attack.mitre.org/techniques/T1556/"

[[rule.threat.technique.subtechnique]]
id = "T1556.006"
name = "Multi-Factor Authentication"
reference = "https://attack.mitre.org/techniques/T1556/006/"

[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1556"
name = "Modify Authentication Process"
reference = "https://attack.mitre.org/techniques/T1556/"

[[rule.threat.technique.subtechnique]]
id = "T1556.006"
name = "Multi-Factor Authentication"
reference = "https://attack.mitre.org/techniques/T1556/006/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1556"
name = "Modify Authentication Process"
reference = "https://attack.mitre.org/techniques/T1556/"

[[rule.threat.technique.subtechnique]]
id = "T1556.006"
name = "Multi-Factor Authentication"
reference = "https://attack.mitre.org/techniques/T1556/006/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[metadata]
creation_date = "2026/05/15"
integration = ["google_workspace"]
maturity = "production"
updated_date = "2026/05/15"

[rule]
author = ["Elastic"]
description = """
Detects the first time a Google Workspace user is observed authenticating from a device of a given type (e.g., WINDOWS,
MAC, ANDROID, IOS, LINUX) within a historical window. Note that "DEVICE_REGISTER_UNREGISTER_EVENT" events do not
represent one-time physical device enrollments; the Google Reports API emits a fresh "google_workspace.device.id" on
each event, and the same physical device may produce multiple events per day as sessions/sync renewals occur. The rule
therefore surfaces a user authenticating from a new device type, not a new physical device. This is still high-fidelity
because adversaries who compromise a Workspace identity via AiTM kits or stolen OAuth refresh tokens frequently relay
sessions from device types that diverge from the legitimate user's baseline (e.g., a WINDOWS session appearing for a
known macOS user, or simultaneous WINDOWS+MAC sessions within minutes), which is the canonical kit fingerprint. Because
the underlying token retains access after password rotation, treat unexpected device-type divergence as a compromise
indicator and revoke tokens, not just credentials.
"""
false_positives = [
    """
    A user legitimately enrolling a new personal or corporate device (new laptop, replacement phone, BYOD enrollment).
    Validate by confirming the device registration timing aligns with a known device refresh, IT hardware ticket, or
    onboarding event.
    """,
    """
    Bulk device enrollment campaigns (e.g., MDM rollout, fleet refresh) where many users register the same new device
    type in a short window. Consider suppressing during planned rollouts.
    """,
]
from = "now-9m"
index = ["logs-google_workspace.device*"]
language = "kuery"
license = "Elastic License v2"
name = "Google Workspace User Sign-in from Atypical Device Type"
note = """## Triage and analysis

### Investigating Google Workspace User Sign-in from Atypical Device Type

This rule emits when a user authenticates from a device whose type (`google_workspace.device.type`) has not been observed for that user in the prior 14 days.

**Important: this is not a true "device enrollment" event.** Google's Reports API emits `DEVICE_REGISTER_UNREGISTER_EVENT` from the `mobile` provider on every session/sync registration, with a fresh `google_workspace.device.id` each time. A single physical device can produce many such events per day. The rule therefore identifies a *device-type-per-user* anomaly: a session originating from a class of device the user has not been seen on in the prior 14 days, not a one-time physical device join.

The detection value remains high because adversaries who relay sessions via AiTM kits (Tycoon2FA Google variant, EvilGinx phishlets) or who replay stolen OAuth refresh tokens typically egress from device fingerprints that diverge from the victim's baseline. Two patterns are especially diagnostic:

- A device type appearing for a user that does not match the user's known OS (e.g., WINDOWS sessions for a user whose corporate laptop is macOS).
- Simultaneous WINDOWS+MAC (or similar cross-type) sessions for the same user within a short window, indicating the kit and the victim are active at the same time.

Because the underlying OAuth refresh token continues to grant access after a password reset, password rotation alone does not remediate this; only token revocation does.

### Possible investigation steps

- Identify the user (`user.email`), the device type (`google_workspace.device.type`), and the device model and OS (`google_workspace.device.model`, `host.os.version`).
- Compare the registered device type to the user's known device baseline. A WINDOWS device for a known macOS user, or an ANDROID device for a known iOS user, is a high-confidence adversary signal.
- Pull all `logs-google_workspace.login` events for the same `user.email` in the 24 hours leading up to the device registration. Inspect `source.geo.country_name`, `source.as.organization.name`, and `user_agent.original` for each sign-in. A device registration immediately following a sign-in from a non-baseline ASN (hosting providers, cheap VPS, AiTM kit egress like Clouvider or Host Telecom) is the kit-driven persistence signature.
- Cross-reference `logs-google_workspace.token` for `event.action: "authorize"` events from the same user near the same time. OAuth grants minted around the device registration window indicate the kit has minted additional tokens for the attacker-controlled device.
- Inspect `google_workspace.device.id` and `google_workspace.device.resource.id` for the registered device. Capture both, since `device.id` is required for the device removal API call during remediation.
- Confirm with the user whether the device registration is theirs (new hardware, BYOD enrollment) or unexpected.

### False positive analysis

- Legitimate first-time device enrollment for new hardware, BYOD onboarding, or device refresh cycles. Validate by checking IT hardware tickets, onboarding records, or HR.
- Planned MDM rollouts that register many users' devices in a short window. Consider a temporary rule suppression during scheduled rollouts.
- Users who legitimately use multiple device types and happened to first enroll a given type outside the lookback window (e.g., always had a personal Android but only just enrolled it in Workspace).

### Response and remediation

- If the device registration is unexpected: treat as compromise. Immediately suspend the user, revoke all OAuth tokens (`DELETE /admin/directory/v1/users/<email>/tokens/<clientId>`), reset the password, and clear recovery email/phone.
- Remove the attacker-controlled device via the Admin SDK Directory API: `POST /admin/directory/v1/customer/<customerId>/devices/chromeos/<deviceId>/action` (or the mobile device variant) to wipe / remove the device.
- Audit any post-registration mailbox, Drive, and Calendar activity for adversary data access or exfiltration.
- Cross-check `logs-gcp.audit-*` if the tenant exposes GCP resources to the user: look for `authenticationInfo.principalEmail` matching the user from a non-baseline `callerIp` in the same window, since token theft frequently extends to cross-cloud access.
"""
references = [
    "https://developers.google.com/workspace/admin/reports/v1/appendix/activity/mobile",
    "https://www.elastic.co/security-labs/google-workspace-attack-surface-part-one",
    "https://any.run/malware-trends/tycoon/",
]
risk_score = 47
rule_id = "e0916edd-ea8c-49d2-882e-2cf6af161dd7"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Domain: Identity",
    "Data Source: Google Workspace",
    "Data Source: Google Workspace Device Logs",
    "Use Case: Threat Detection",
    "Use Case: Identity and Access Audit",
    "Tactic: Persistence",
    "Tactic: Initial Access",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "new_terms"

query = '''
data_stream.dataset: "google_workspace.device" and
event.action: "DEVICE_REGISTER_UNREGISTER_EVENT" and
google_workspace.device.account_state: "REGISTERED" and
google_workspace.device.type: * and
user.email: *
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"
[[rule.threat.technique.subtechnique]]
id = "T1098.005"
name = "Device Registration"
reference = "https://attack.mitre.org/techniques/T1098/005/"



[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"
[[rule.threat.technique.subtechnique]]
id = "T1078.004"
name = "Cloud Accounts"
reference = "https://attack.mitre.org/techniques/T1078/004/"



[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.email",
    "google_workspace.device.type",
    "google_workspace.device.model",
    "google_workspace.device.id",
    "google_workspace.device.resource.id",
    "google_workspace.device.account_state",
    "host.os.version",
    "event.provider",
]

[rule.new_terms]
field = "new_terms_fields"
value = ["google_workspace.device.type", "user.email"]
[[rule.new_terms.history_window_start]]
field = "history_window_start"
value = "now-14d"

[rule]
description = """
Identifies the execution of Windows utilities to tamper with system recovery settings and subsequently followed by a
suspicious file rename operation. This may indicate Ransomware behavior.
"""
id = "92f114fb-7113-4e82-b021-6c2c4ca0a507"
license = "Elastic License v2"
name = "Inhibit System Recovery Followed by a Suspicious File Rename"
os_list = ["windows"]
version = "1.0.31"

query = '''
sequence with maxspan=5s
 [process where event.action == "start" and
  (
    (process.pe.original_file_name == "wmic.exe" and process.command_line : "*shadowcopy*" and process.command_line : "*delete*") or
    (process.pe.original_file_name == "VSSADMIN.EXE" and process.command_line : "*shadows*" and process.command_line : ("*delete*", "*resize*")) or
    (process.pe.original_file_name == "bcdedit.exe" and process.command_line : ("*bootstatuspolicy*", "*recoveryenabled*")) or
    (process.pe.original_file_name == "WBADMIN.EXE" and process.command_line : ("*catalog*", "*systemstatebackup*") and process.command_line : "*delete*") or
    (process.pe.original_file_name == "iCACLS.EXE" and process.command_line : ("*/deny*S-1-1-0*", "*?:\\*\" /grant*Everyone:F*"))
  ) and
  not (process.name : "bcdedit.exe" and process.parent.executable : "?:\\Program Files (x86)\\Faronics\\Deep Freeze\\Install C-0\\DFServ.exe")]
 [file where event.action : "rename" and process.pid != 4 and
  file.extension != null and file.Ext.entropy >= 7 and
  file.Ext.original.name : ("*.jpg", "*.bmp", "*.png", "*.pdf", "*.doc", "*.docx", "*.xls", "*.xlsx", "*.ppt", "*.pptx") and
  not file.extension : ("tmp", "~tmp", "diff", "gz", "download", "bak", "bck", "lnk", "part", "save", "url") and
  not (process.name : "msiexec.exe" and file.path : "?:\\Config.Msi\\*.rbf") and
  not process.executable : ("?:\\Program Files\\Microsoft OneDrive\\OneDrive.exe",
                            "?:\\Program Files\\Fiery\\Components\\Fiery XF\\Job Editor.exe",
                            "?:\\Windows\\explorer.exe")]
'''

min_endpoint_version = "7.15.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1486"
name = "Data Encrypted for Impact"
reference = "https://attack.mitre.org/techniques/T1486/"

[[threat.technique]]
id = "T1490"
name = "Inhibit System Recovery"
reference = "https://attack.mitre.org/techniques/T1490/"


[threat.tactic]
id = "TA0040"
name = "Impact"
reference = "https://attack.mitre.org/tactics/TA0040/"

[internal]
min_endpoint_version = "7.15.0"

[rule]
description = """
Identifies attempts to enumerate the state of keyboard keys and the call is coming from an unsigned DLL. Adversaries may
log user keystrokes to intercept credentials or other information from the user as the user types them.
"""
id = "8ab0b921-38fb-495c-b5b8-075d1cbc731c"
license = "Elastic License v2"
name = "Keystrokes Input Capture from Unsigned DLL"
os_list = ["windows"]
reference = [
    "https://attack.mitre.org/techniques/T1056/001/",
    "https://www.elastic.co/security-labs/protecting-your-devices-from-information-theft-keylogger-protection",
]
version = "1.0.15"

query = '''
sequence by process.entity_id with maxspan=2m
 [library where
  dll.Ext.relative_file_creation_time <= 300 and not startswith~(dll.name, process.name) and
  dll.hash.sha256 : "??*" and dll.path : "?*" and not dll.code_signature.status : "trusted" and 
  not dll.hash.sha256 : 
                ("fc23a64cc52f5b19e310a8d96b1fbfec981310359bda907f5931a53360485fbc", 
                 "47c2871dff8948de40424df497962ea6167c56bd4d487dd2e660aa2837485e25",
                 "0a70f6e2ae3e77fa9406a38b244cd49cd46356af6a6880c913be9df98c4d5136",
                 "13b2cac3f50368ab97fa2e3b0d0d2cb612f68449d5bbd6de187fc85ee4469d03",
                 "35fce2a0bb291f9c2a7dc7b4620892cae16c71422a1ee3083c5d8c20720c8df6",
                 "dbf484369fccb68c1c573c978b67cc16d86bb7e8d13308fc8e9e0cfb0ef6724f",
                 "a8d9181b8bad99f52a81390a035694ab6541f44c7dd9d5ad10ba97fb5b209074",
                 "332c71776659988159f98e0e6621b1e37694a7a57f954e0c5ca2f95c939b8f59",
                 "14483624af18b2661c8a11df1d9333049cf582b3a31782491895fc138966ef2a",
                 "a4e18d5896c5889635efe31c6f1a0ce8ccafeabe9521e0f92c46a5861e8c290b",
                 "e7a95093be08f73aea2333cb6387eb7127a2639ab358d2e0c587d776972f2523",
                 "d988f77608000008cc7b81cbc5e5a632a3b7dfbde5e768e0f76f4cc0c802fc7e",
                 "13b2cac3f50368ab97fa2e3b0d0d2cb612f68449d5bbd6de187fc85ee4469d03",
                 "b461a01e0855014610cc1d7047a5f7939d13b803bc835c37f0be9704698af570",
                 "8232e3b928e41feacd643dc45d2ffc702ac40640910e9a232fc5df8ed90d6c97",
                 "46f43ba8a2cb1198ba84341448812a37a3b545f2dd70e5f127d7bfc7807c2ced",
                 "a9b70a8c2b495badc2cccf96408c8838d7fedd1013590b11166323629ec36b16",
                 "c47c572f7b74d7073b6ab008a730d26ec885c67d1dcdb187839ed52cb8856287",
                 "5a730d11d2d5a38b33360e6e524f53eaf93225f196016a4f1d313e7eab16b655",
                 "b8c331c9f915960201da9af9c9dc8309e95e7d533741e71f4a5d13ca007d3e18",
                 "b2c93337e49bdba121f679bcfa91eb3d3ddfe1776417dd80da4c6500205130d3",
                 "a037787360c924e15415b44ac64d06dfdf8265dd136d87d2354e44dd3b151894",
                 "d72f31bf226cd2de3fef3948e22c16c118fa1cc013c5358f4ea597fd0d93642d") and
  not process.executable : "C:\\Program Files\\Autodesk\\Revit 202?\\Revit.exe" and
  not dll.path : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*") and
  not (process.code_signature.subject_name in ("Ferox Games B.V.", "Prometric, LLC", "NCS Pearson, Inc.") and process.code_signature.trusted == true)] as event0
 [api where

  (process.Ext.api.name == "GetAsyncKeyState" or
   (process.Ext.api.name == "RegisterRawInputDevices" and
    process.Ext.api.parameters.usage == "KEYBOARD" and process.Ext.api.parameters.flags like "*INPUTSINK*") or
   (process.Ext.api.name == "SetWindowsHookEx" and process.Ext.api.parameters.hook_type == "WH_KEYBOARD_LL")) and

   startswith~(process.thread.Ext.call_stack_final_user_module.name, event0.dll.name)]
'''

min_endpoint_version = "8.10.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1056"
name = "Input Capture"
reference = "https://attack.mitre.org/techniques/T1056/"
[[threat.technique.subtechnique]]
id = "T1056.001"
name = "Keylogging"
reference = "https://attack.mitre.org/techniques/T1056/001/"



[threat.tactic]
id = "TA0009"
name = "Collection"
reference = "https://attack.mitre.org/tactics/TA0009/"

[internal]
min_endpoint_version = "8.10.0"

[rule]
description = """
This rule monitors for the potential memory dump of the init process (PID 1) through gdb. Attackers may leverage memory
dumping techniques to attempt secret extraction from privileged processes. Tools that display this behavior include
"truffleproc" and "bash-memory-dump". This behavior should not happen by default, and should be investigated thoroughly.
"""
id = "ba70be59-bf50-48a9-8b36-0f0808a50fb8"
license = "Elastic License v2"
name = "Linux init (PID 1) Secret Dump via GDB"
os_list = ["linux"]
reference = ["https://github.com/controlplaneio/truffleproc", "https://github.com/hajzer/bash-memory-dump"]
version = "1.0.6"

query = '''
process where event.type == "start" and event.action == "exec" and process.name == "gdb" and 
process.args in ("--pid", "-p") and process.args == "1"
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1003"
name = "OS Credential Dumping"
reference = "https://attack.mitre.org/techniques/T1003/"
[[threat.technique.subtechnique]]
id = "T1003.007"
name = "Proc Filesystem"
reference = "https://attack.mitre.org/techniques/T1003/007/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "7.15.0"

[rule]
description = """
Detects the creation of a reverse shell through a shell with suspicious command line arguments. Attackers may spawn
reverse shells to establish persistence onto a target system.
"""
id = "00a97e57-4834-47ec-880d-48ce3783e0b4"
license = "Elastic License v2"
name = "Linux Reverse Shell via Child"
os_list = ["linux"]
reference = ["https://www.elastic.co/security-labs/primer-on-persistence-mechanisms"]
version = "1.0.7"

query = '''
sequence by process.entity_id with maxspan=5s
  [network where event.type == "start" and event.action in ("connection_attempted", "connection_accepted") and 
   process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "socat") and destination.ip != null and 
   not cidrmatch(destination.ip, "127.0.0.0/8", "169.254.0.0/16", "224.0.0.0/4", "::1")]
  [process where event.type == "start" and event.action == "exec" and 
   process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and (
     process.args in ("-i", "-il", "-li") or
     (process.parent.name == "socat" and process.parent.command_line like~ "*exec*")
   )
  ]
'''

min_endpoint_version = "8.5.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "8.5.0"

[rule]
description = """
Identifies attempt to call memory manipulation APIs or load a library where call stack is pointing to the RPC function
NdrServerCall, this may indicate an attempt to exploit a vulnerability using fake RPC messages to bypass CFG mitigation.
A known example of vulnerability using this primitive is CVE-2021-26411.
"""
id = "e0114670-7598-4f1a-90ce-157ade6932b9"
license = "Elastic License v2"
name = "Potential Browser Exploit via Fake RPC Messages"
os_list = ["windows"]
reference = [
    "https://iamelli0t.github.io/2021/04/10/RPC-Bypass-CFG.html",
    "https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2021/CVE-2021-26411.html",
]
version = "1.0.15"

query = '''
any where event.category in ("api", "library") and
 process.name in~ ("chrome.exe", "msedge.exe", "iexplore.exe", "brave.exe", "whale.exe", "browser.exe", "dragon.exe", "vivaldi.exe",
                 "opera.exe", "seamonkey.exe", "safari.exe", "waterfox.exe") and
 _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info: "*NdrServerCall2*") and 
 not process.Ext.api.summary :  ("VirtualProtect( koaxoj_?.dll,*)", "WriteProcessMemory( onedrive*") and 
 not dll.code_signature.trusted == true and 
 not dll.path : ("?:\\Windows\\System32\\jscript9.dll",
                 "?:\\Windows\\System32\\vaultcli.dll",
                 "?:\\Windows\\SysWOW64\\jscript9.dll",
                 "?:\\Windows\\SysWOW64\\vaultcli.dll",
                 "?:\\Windows\\System32\\wbem\\fastprox.dll") and
 not _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info: ("?:\\windows\\system32\\rpcrt4.dll!RpcBindingFromStringBindingW*", "c:\\windows\\system32\\rpcrt4.dll!I_RpcExceptionFilter+*"))
'''

min_endpoint_version = "8.8.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1189"
name = "Drive-by Compromise"
reference = "https://attack.mitre.org/techniques/T1189/"


[threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1203"
name = "Exploitation for Client Execution"
reference = "https://attack.mitre.org/techniques/T1203/"


[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "8.8.0"

[rule]
description = """
Identifies potential credential access through ptrace. Attackers may abuse ptrace to inspect sensitive authentication
processes such as sshd, su, or sudo and extract credentials or session material from memory. This rule correlates
process execution with a ptrace request targeting one of these sensitive processes. Such behavior is uncommon by default
and should be investigated.
"""
id = "5243e34d-ce00-4fda-82bb-79f1e4e655ea"
license = "Elastic License v2"
name = "Potential Credential Access via Ptrace"
os_list = ["linux"]
reference = ["https://platformsecurity.com/blog/hawks-prey-snatching-ssh-credentials"]
version = "1.0.2"

query = '''
sequence with maxspan=15s
  [process where event.type == "start" and event.action == "exec" and process.name in (
    "sshd", "ssh",
    "su", "sudo", "sudoedit",
    "passwd", "chsh", "chfn", "newgrp", "gpasswd",
    "login", "agetty", "getty", "unix_chkpwd",
    "pkexec", "polkitd",
    "sssd", "sssd_pam", "sssd_nss",
    "krb5_child", "ldap_child", "nslcd", "winbindd"
  )] by process.pid 
  [process where event.type == "start" and event.action == "ptrace"] by process.Ext.ptrace.child_pid
'''

min_endpoint_version = "9.1.4"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1003"
name = "OS Credential Dumping"
reference = "https://attack.mitre.org/techniques/T1003/"
[[threat.technique.subtechnique]]
id = "T1003.007"
name = "Proc Filesystem"
reference = "https://attack.mitre.org/techniques/T1003/007/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "9.1.4"

[rule]
description = """
Identifies an attempt to load a network module from unbacked memory or perform suspicious Windows API calls by an
executable with erroneous code signature. Malware may append malicious code to benign signed binaries or use invalid
code signature to bypass certain security controls.
"""
id = "f3f769b9-0695-49ed-ab6e-c8f199a7d2c8"
license = "Elastic License v2"
name = "Potential Evasion via Invalid Code Signature"
os_list = ["windows"]
reference = ["https://www.elastic.co/security-labs/doubling-down-etw-callstacks"]
version = "1.0.20"

query = '''
any where
 process.executable != null and process.code_signature.status == "errorBadDigest" and   
 (
  (event.category == "api" and event.category == "intrusion_detection" and 
   process.Ext.api.behaviors in ("shellcode", "allocate_shellcode", "execute_shellcode") and
   not process.Ext.api.name in ("SetWindowsHookEx", "IoCreateDevice") and
   process.thread.Ext.call_stack_final_user_module.name != null and
   not process.thread.Ext.call_stack_final_user_module.name in ("Kernel", "Unknown", "Undetermined") and
   not process.thread.Ext.call_stack_final_user_module.protection_provenance like ("Kernel", "Kernel|*")) or

  (event.category == "library" and dll.name in~ ("ws2_32.dll", "wininet.dll", "winhttp.dll") and
   process.thread.Ext.call_stack_summary like
            ("*kernelbase.dll|Unbacked*", "*ntdll.dll|Unbacked*", "*wininet.dll|Unbacked*",
             "*dnsapi.dll|Unbacked*", "*ws2_32.dll|Unbacked*", "*iphlpapi.dll|Unbacked*",
             "*winhttp.dll|Unbacked*", "Unbacked|*"))
 ) and
 not process.executable : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*") and 
 not (process.executable : "D:\\d3\\view\\viewapp.exe" and process.code_signature.subject_name == "d.velop AG") and
 not (process.executable : "D:\\*\\AuditExplorer.exe" and process.code_signature.subject_name == "Eclipse.org Foundation, Inc.") and
 not (dll.name == "ws2_32.dll" and process.code_signature.subject_name in ("Azul Systems, Inc.", "Ghisler Software GmbH", "Cellebrite DI LTD", "Pagebites, Inc.")) and
 not (process.Ext.api.name in ("NtQueueApcThread", "OpenProcess", "ResumeThread") and process.code_signature.subject_name in ("Azul Systems, Inc.", "Eclipse.org Foundation, Inc.")) and
 not (process.executable : "C:\\AutoVue_Client\\jre\\bin\\javaw.exe" and process.code_signature.subject_name == "Oracle America, Inc.") and
 not (process.executable : ("?:\\Users\\*\\AppData\\Local\\Turbo.net\\Sandbox\\GEARView\\*\\GEARViewBasic.exe",
                             "\\\\?\\Volume{*}\\VMS_PortableClient_x64\\local\\stubexe\\*\\VMS_Client.exe") and
      process.code_signature.subject_name == "Code Systems Corporation") and
 not process.executable : 
             ("?:\\Users\\*\\AppData\\Local\\Microsoft\\Teams\\current\\Teams.exe", 
              "?:\\Program Files (x86)\\Teams Installer\\Teams.exe", 
              "?:\\Program Files\\Microsoft Mouse and Keyboard Center\\CEIP.exe", 
              "?:\\Program Files (x86)\\Microsoft Mouse and Keyboard Center\\CEIP.exe",
              "C:\\Informatica\\10.5.1\\clients\\DeveloperClient\\developerCore.exe",
              "C:\\Users\\*\\AppData\\Roaming\\Spotify\\Spotify.exe") and
 not (process.executable : "D:\\SteamLibrary\\steamapps\\common\\*" and
      process.parent.executable : "C:\\Program Files (x86)\\Steam\\steam.exe") and
 not _arraysearch(process.thread.Ext.call_stack, $entry,
                     $entry.symbol_info : ("?:\\Program Files\\*.dll*",
                                           "?:\\Program Files (x86)\\*.dll*",
                                           "?:\\windows\\system32\\*\\tmmon*.dll*",
                                           "?:\\Windows\\SysWOW64\\esensordbi.dll*",
                                           "?:\\Windows\\System32\\esensordbi.dll*",
                                           "?:\\Windows\\System32\\umppc*.dll*",
                                           "?:\\Windows\\FireEye\\AppMonitorDll*.dll*",
                                           "?:\\Windows\\apppatch\\AppPatch*\\exploitblocker.dll*",
                                           "?:\\windows\\system32\\hmpalert.dll!*")) and
 not process.thread.Ext.call_stack_final_user_module.hash.sha256 in
                                               ("234360be58be376a77169fcc447cf8cbcba959f5c1db256ea2a50eeb92e65f44",
                                                "fcdde72cfb1b2ff1bf953b2ded03b74c7d7273fa7dcef282a594c2819b2c497c",
                                                "f5071fb08095973d5499e50e6ac176a1bdc33d774ea61e0e3c82605d468e0045",
                                                "0a32e883d669a5b9bbb7aecc1cee31623aa69950ca9e3fce9d5270caa6ae0f39")
'''

min_endpoint_version = "8.10.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1036"
name = "Masquerading"
reference = "https://attack.mitre.org/techniques/T1036/"

[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"