Elastic rules: 15

[metadata]
creation_date = "2023/08/23"
integration = ["endpoint", "auditd_manager", "crowdstrike"]
maturity = "production"
updated_date = "2026/03/24"

[rule]
author = ["Elastic"]
building_block_type = "default"
description = """
Identifies the execution of Linux built-in commands related to account or group enumeration. Adversaries may use account
and group information to orient themselves before deciding how to act.
"""
from = "now-119m"
index = ["logs-endpoint.events.*", "endgame-*", "auditbeat-*", "logs-auditd_manager.auditd-*", "logs-crowdstrike.fdr*"]
interval = "60m"
language = "eql"
license = "Elastic License v2"
name = "Discovery of Domain Groups"
risk_score = 21
rule_id = "b92d5eae-70bb-4b66-be27-f98ba9d0ccdc"
severity = "low"
tags = [
  "Domain: Endpoint",
  "OS: Linux",
  "Use Case: Threat Detection",
  "Tactic: Discovery",
  "Rule Type: BBR",
  "Data Source: Elastic Defend",
  "Data Source: Elastic Endgame",
  "Data Source: Auditd Manager",
  "Data Source: Crowdstrike",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
process where host.os.type == "linux" and event.type == "start" and event.action in ("exec", "exec_event", "executed", "process_started", "ProcessRollup2")
 and (
  process.name in ("ldapsearch", "dscacheutil") or (process.name == "dscl" and process.args : "*-list*")
)
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1069"
name = "Permission Groups Discovery"
reference = "https://attack.mitre.org/techniques/T1069/"

[[rule.threat.technique.subtechnique]]
id = "T1069.002"
name = "Domain Groups"
reference = "https://attack.mitre.org/techniques/T1069/002/"

[rule.threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"

[rule]
description = """
Identifies when a Microsoft signed binary is copied to a directory and shortly followed by the loading of an unsigned
DLL from the same directory. Adversaries may opt for moving Microsoft signed binaries to a random directory and use them
as a host for malicious DLL sideloading during the installation phase.
"""
id = "d84090d7-91e4-4063-84c1-c1f410dd717b"
license = "Elastic License v2"
name = "DLL Side Loading via a Copied Microsoft Executable"
os_list = ["windows"]
reference = [
    "https://www.elastic.co/security-labs/upping-the-ante-detecting-in-memory-threats-with-kernel-call-stacks",
    "https://www.microsoft.com/en-us/security/blog/2018/03/01/finfisher-exposed-a-researchers-tale-of-defeating-traps-tricks-and-complex-virtual-machines/",
]
version = "1.0.32"

query = '''
sequence by user.id with maxspan=5m
 [file where event.action != "deletion" and
  not user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20") and file.Ext.header_bytes : "4d5a*" and

  /* PE file copied */
  _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info: ("*CopyFileEx*", "*MoveFileExW*")) and 
  
  /* DismHost is copied by CleanMgr */
  not (file.name : "DismHost.exe" and process.thread.Ext.call_stack_summary : "*|dismcore.dll|*") and
       
  not (file.path : "?:\\Program Files*\\Microsoft\\EdgeUpdate\\*\\MicrosoftEdgeUpdateComRegisterShell*.exe" and 
       process.executable : "?:\\Program Files*\\Microsoft\\Temp\\*\\MicrosoftEdgeUpdate.exe") and

  not (process.executable : "?:\\Program Files*\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" and
       file.path : "?:\\Program Files*\\Common Files\\microsoft shared\\ClickToRun\\Updates\\*\\OfficeClickToRun.exe") and 

  not process.executable : ("?:\\Program Files\\Microsoft Visual Studio\\*\\Common?\\IDE\\devenv.exe", 
                            "?:\\Program Files (x86)\\Microsoft Visual Studio\\*\\Common?\\IDE\\devenv.exe", 
                            "?:\\Program Files\\Microsoft Visual Studio\\*\\MSBuild.exe", 
                            "?:\\Program Files\\dotnet\\dotnet.exe") and

  not (file.path : "C:\\SuperGrate\\mighost.exe" and process.executable : "D:\\SuperGrate\\SuperGrate.exe")

 ] by file.path
 [library where
  process.code_signature.subject_name : "Microsoft*" and process.code_signature.trusted == true and
  not startswith~(dll.name, process.name) and dll.hash.sha256 != null and 
  (dll.Ext.relative_file_creation_time <= 500 or dll.Ext.relative_file_name_modify_time <= 500) and
  not dll.code_signature.status : "trusted" and

  /* DLL loaded from the process.executable directory */
  endswith~(substring(dll.path, 0, length(dll.path) - (length(dll.name) + 1)), substring(process.executable, 0, length(process.executable) - (length(process.name) + 1))) and

  not dll.hash.sha256 :
              ("3e278f47c124c44e8e5a18a12364f3b7af723292b6a4c6011e8f558325bbd7cb",
               "bd7874d8b30a39e306d53f83588478622d3e152fe1c7d29a1e0e04fa8844b1e3",
               "ecd44288b475131a8cc14a1fff497af478bcb26a772e838fa711cd654835a233",
               "6c48d66731fcf6a60e7aef335c91e55ee27743df9912856c63302f7dfecde906",
               "2e0559d248a68402d209d65e6009c05628fe6c30f892a1047fa3365a89d7d9a6",
               "c7601b2f8b2439211433de59bda62a09347480bfdbbe03b4c560aa350c543e3a",
               "7e1a25b50775cb246303ae162bba86c9d5fe2bd7fa98044899ffb58919b4ed3a", 
               "44f3a05334de6ca0b43ebd17f6c7f1935630e026f049f28828566e364b7f41aa", 
               "45715793b8c8571554b0bfb4eccc29e2884c16481e1c7dbee78363bbe4da3dd9", 
               "99c109628e7d9bccf0961c0fd40d2f0e98e43fca59fe88e8467cd0f9be6bfdd9") and

  not (dll.path : "?:\\$WINDOWS.~BT\\Sources\\*.dll" and process.executable : "?:\\$WINDOWS.~BT\\Sources\\SetupHost.exe") and
  not dll.path : "C:\\Program Files (x86)\\Microsoft Visual Studio\\Installer\\*.dll"
  ] by process.executable
'''

min_endpoint_version = "8.7.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1574"
name = "Hijack Execution Flow"
reference = "https://attack.mitre.org/techniques/T1574/"
[[threat.technique.subtechnique]]
id = "T1574.001"
name = "DLL"
reference = "https://attack.mitre.org/techniques/T1574/001/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.7.0"

[metadata]
creation_date = "2022/01/06"
integration = ["azure"]
maturity = "production"
updated_date = "2026/04/10"

[rule]
author = ["Elastic"]
description = """
In Microsoft Entra ID, permissions to manage resources are assigned using roles. The Global Administrator
is a role that enables users to have access to all administrative features in Microsoft Entra ID and services that use Microsoft Entra ID
identities like the Microsoft 365 Defender portal, the Microsoft 365 compliance center, Exchange, SharePoint Online, and
Skype for Business Online. Attackers can add users as Global Administrators to maintain access and manage all
subscriptions and their settings and resources. They can also elevate privilege to User Access Administrator to pivot into Azure resources.
"""
from = "now-9m"
index = ["filebeat-*", "logs-azure.auditlogs-*"]
language = "kuery"
license = "Elastic License v2"
name = "Entra ID Global Administrator Role Assigned"
note = """## Triage and analysis

### Investigating Entra ID Global Administrator Role Assigned

Microsoft Entra ID's Global Administrator role grants comprehensive access to manage Microsoft Entra ID and associated services. Adversaries may exploit this by assigning themselves or others to this role, ensuring persistent control over resources. The detection rule identifies such unauthorized assignments by monitoring specific audit logs for role changes, focusing on the addition of members to the Global Administrator role, thus helping to mitigate potential security breaches.

### Possible investigation steps

- Review the Microsoft Entra ID audit logs to identify the user account that performed the "Add member to role" operation, focusing on the specific event dataset and operation name.
- Verify the identity of the user added to the Global Administrator role by examining the modified properties in the audit logs, specifically the new_value field indicating "Global Administrator".
- Check the history of role assignments for the identified user to determine if this is a recurring pattern or a one-time event.
- Investigate the source IP address and location associated with the role assignment event to assess if it aligns with expected user behavior or if it indicates potential unauthorized access.
- Review any recent changes or activities performed by the newly assigned Global Administrator to identify any suspicious actions or configurations that may have been altered.
- Consult with the organization's IT or security team to confirm if the role assignment was authorized and aligns with current administrative needs or projects.
- Correlate with Microsoft Entra ID sign-in logs to check for any unusual login patterns or failed login attempts associated with the user who assigned the role.
- Review the reported device to determine if it is a known and trusted device or if it raises any security concerns such as unexpected relationships with the source user.

### False positive analysis

- Routine administrative tasks may trigger alerts when legitimate IT staff are assigned the Global Administrator role temporarily for maintenance or configuration purposes. To manage this, create exceptions for known IT personnel or scheduled maintenance windows.
- Automated scripts or third-party applications that require elevated permissions might be flagged if they are configured to add users to the Global Administrator role. Review and whitelist these scripts or applications if they are verified as safe and necessary for operations.
- Organizational changes, such as mergers or restructuring, can lead to legitimate role assignments that appear suspicious. Implement a review process to verify these changes and exclude them from triggering alerts if they align with documented organizational changes.
- Training or onboarding sessions for new IT staff might involve temporary assignment to the Global Administrator role. Establish a protocol to document and exclude these training-related assignments from detection alerts.

### Response and remediation

- Immediately remove any unauthorized users from the Global Administrator role to prevent further unauthorized access and control over Azure AD resources.
- Conduct a thorough review of recent audit logs to identify any additional unauthorized changes or suspicious activities associated with the compromised account or role assignments.
- Reset the credentials of the affected accounts and enforce multi-factor authentication (MFA) to enhance security and prevent further unauthorized access.
- Notify the security operations team and relevant stakeholders about the incident for awareness and further investigation.
- Implement conditional access policies to restrict Global Administrator role assignments to specific, trusted locations or devices.
- Review and update role assignment policies to ensure that only a limited number of trusted personnel have the ability to assign Global Administrator roles.
- Enhance monitoring and alerting mechanisms to detect similar unauthorized role assignments in the future, ensuring timely response to potential threats.
"""
references = [
    "https://securitylabs.datadoghq.com/articles/i-spy-escalating-to-entra-id-global-admin/",
    "https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#global-administrator",
    "https://www.microsoft.com/en-us/security/blog/2025/08/27/storm-0501s-evolving-techniques-lead-to-cloud-based-ransomware/"
]
risk_score = 73
rule_id = "04c5a96f-19c5-44fd-9571-a0b033f9086f"
severity = "high"
tags = [
    "Domain: Cloud",
    "Domain: Identity",
    "Data Source: Azure",
    "Data Source: Microsoft Entra ID",
    "Data Source: Microsoft Entra ID Audit Logs",
    "Use Case: Identity and Access Audit",
    "Tactic: Persistence",
    "Resources: Investigation Guide"
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset:azure.auditlogs and
    azure.auditlogs.properties.category:RoleManagement and
    azure.auditlogs.operation_name:"Add member to role" and
    azure.auditlogs.properties.target_resources.*.modified_properties.*.new_value: "\"Global Administrator\""
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"

[[rule.threat.technique.subtechnique]]
id = "T1098.003"
name = "Additional Cloud Roles"
reference = "https://attack.mitre.org/techniques/T1098/003/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"

[[rule.threat.technique.subtechnique]]
id = "T1098.003"
name = "Additional Cloud Roles"
reference = "https://attack.mitre.org/techniques/T1098/003/"

[rule.threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[metadata]
creation_date = "2026/04/09"
integration = ["endpoint", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2026/07/10"

[rule]
author = ["Elastic"]
description = """
This rule detects the creation of files in world-writable directories by an unusual process. Attackers may
attempt to hide their activities by creating files in world-writable directories, which are commonly used
for temporary file storage. This behavior is often associated with lateral movement and can be an indicator
of an attacker attempting to move laterally within a network.
"""
from = "now-9m"
index = [
    "endgame-*",
    "logs-endpoint.events.file*",
    "logs-sentinel_one_cloud_funnel.*",
]
language = "kuery"
license = "Elastic License v2"
name = "File Creation in World-Writable Directory by Unusual Process"
note = """
## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating File Creation in World-Writable Directory by Unusual Process

This alert flags a Linux process that normally should not stage content in shared writable locations such as /tmp, /var/tmp, /run, or /dev/shm. Attackers abuse these directories because many users and services can write there, which makes payloads and helper scripts easier to hide; for example, a compromised shell may use curl or python to drop an ELF backdoor into /dev/shm and execute it from that transient path.

### Possible investigation steps

- Reconstruct the full process lineage and execution context around the file creation to determine whether it originated from an interactive session, scheduled task, container, service account, or a parent process already running from an unusual location.
- Inspect the dropped file's type, permissions, ownership, hash, and contents to assess whether it is a script, ELF, archive, or disguised payload, and determine if it was later executed, renamed, or moved to a more persistent path.
- Correlate the alert with nearby authentication, privilege escalation, and network activity on the same host to identify signs of compromise such as recent SSH access, sudo use, remote command execution, or outbound connections to untrusted infrastructure.
- Validate whether the activity aligns with known administrative or software deployment behavior by checking package ownership, change records, automation tooling, and host or user prevalence, since one-off staging in shared writable paths is more suspicious than common fleetwide behavior.

### False positive analysis

- Legitimate package installation, OS update, or local maintenance script activity can use interpreters or utilities such as cp, mv, chmod, curl, or python to stage temporary files in /tmp or /var/tmp before moving them into place, so verify whether the process tree, user, and event time align with expected system change or package management activity on the host.
- Normal service startup or deployment automation may create transient files in /run or /dev/shm for configuration generation, caching, or runtime state, so confirm the file owner, contents, and parent process match a known application or boot-time workflow and that the same behavior is regularly seen on comparable systems.

### Response and remediation
- Isolate the affected Linux host from the network while preserving forensic access, stop the malicious process and any spawned tools, and collect copies of the dropped file before cleanup.
- Remove attacker footholds by deleting the dropped file.
- Restore the system to a known-good state by rebuilding from a trusted image or validated backup and verifying core packages, shell configuration files, scheduled tasks, and remote access settings match the approved baseline before reconnecting it.
- Escalate to incident response immediately if the file creation was followed by privilege escalation, credential access, outbound tool downloads, lateral movement over SSH, or the same behavior is identified on multiple hosts, and expand scoping to related accounts and systems.
"""
references = ["https://www.rapid7.com/blog/post/tr-new-whitepaper-stealthy-bpfdoor-variants/"]
risk_score = 47
rule_id = "1f56f548-94ec-4678-b1ed-b1a14cca4e3a"
setup = """## Setup

This rule requires data coming in from Elastic Defend.

### Elastic Defend Integration Setup
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.

#### Prerequisite Requirements:
- Fleet is required for Elastic Defend.
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).

#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
- Go to the Kibana home page and click "Add integrations".
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
- Click "Add Elastic Defend".
- Configure the integration name and optionally add a description.
- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
- Click "Save and Continue".
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
"""
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: Linux",
    "Use Case: Threat Detection",
    "Tactic: Defense Evasion",
    "Data Source: Elastic Defend",
    "Data Source: Elastic Endgame",
    "Data Source: SentinelOne",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "new_terms"
query = '''
host.os.type:linux and event.category:file and event.type:creation and (
  process.name:("cp" or "mv") or
  process.executable:(
    ./* or /tmp/* or /var/tmp/* or /dev/shm/* or /run/user/* or /var/run/user/* or /boot/* or /sys/* or
    /lost+found/* or /proc/* or /var/mail/* or /var/www/*
  )
) and
file.path:(/run/* or /var/run/* or /dev/shm/* or /tmp/* or /var/tmp/*) and
not (
  file.path:(
    /var/tmp/dracut.* or /var/tmp/mkinitramfs_* or /tmp/.*-00000000.so or /run/udev/rules.d/* or
    /tmp/new_root/* or /tmp/newroot/* or /run/user/*/.bubblewrap/newroot/* or /tmp/tmp.*/docker-scout_* or
    /var/tmp/portage/* or /tmp/yarn--* or /run/k3s/containerd/* or /var/tmp/pamac-build-* or
    /tmp/mkinitcpio* or /run/user/*/netns/netns-* or /tmp/apt-key* or /tmp/tmp.*/pubring.orig.gpg or
    /tmp/CVU_19_* or /tmp/ut-backup-files.* or /tmp/tmp.*/terraform/* or
    /run/initramfs/* or /run/samba/* or /run/qemu/* or /var/run/qemu/* or /run/containerd/* or
    /var/run/sophos/* or /tmp/*sophos-tmpfs* or /tmp/*sophos_sensor*
  ) or
  file.extension:("json" or "txt" or "log" or "pid" or "conf" or "cnf" or "pem" or "lock" or "xml" or "bak" or "gz") or
  process.executable:(
    /tmp/par-* or /tmp/par_tmp.* or /tmp/snap.rootfs_* or /tmp/CVU_*/exectask or /tmp/.mount_*/usr/bin/QGroundControl or
    ./snap/snapd/*/usr/lib/snapd/snap-update-ns or "./usr/lib/snapd/snap-update-ns" or
    "/tmp/newroot/snap/snapd/current/usr/bin/snap" or /tmp/newroot/snap/snapd/*/usr/lib/snapd/snap-confine or
    "./usr/bin/podman" or "/tmp/newroot/usr/lib/systemd/systemd" or
    /tmp/pip-install-* or /tmp/pip-build-env-* or /tmp/*Actions*/* or /tmp/GridSetupActions*/*
  ) or
  process.name:("build-script-build" or "conftest" or "maturin")
)
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1222"
name = "File and Directory Permissions Modification"
reference = "https://attack.mitre.org/techniques/T1222/"

[[rule.threat.technique.subtechnique]]
id = "T1222.002"
name = "Linux and Mac File and Directory Permissions Modification"
reference = "https://attack.mitre.org/techniques/T1222/002/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[rule.new_terms]
field = "new_terms_fields"
value = ["host.id", "process.executable"]

[[rule.new_terms.history_window_start]]
field = "history_window_start"
value = "now-5d"

[metadata]
creation_date = "2023/01/15"
integration = ["google_workspace"]
maturity = "production"
promotion = true
updated_date = "2026/05/19"

[rule]
author = ["Elastic"]
description = """
Identifies the occurrence of a security alert from the Google Workspace alerts center. Google Workspace's security alert
center provides an overview of actionable alerts that may be affecting an organization's domain. An alert is a warning
of a potential security issue that Google has detected.
"""
false_positives = [
    """
    To tune this rule, add exceptions to exclude any google_workspace.alert.type or rule.name which should not trigger this rule.
    """,
    "For additional tuning, severity exceptions for google_workspace.alert.metadata.severity can be added.",
]
from = "now-130m"
index = ["logs-google_workspace.alert-*"]
interval = "5m"
language = "kuery"
license = "Elastic License v2"
name = "Forwarded Google Workspace Security Alert"
note = """## Setup

## Triage and analysis

This is a promotion rule for Google Workspace security events, which are alertable events per the vendor.
Consult vendor documentation on interpreting specific events.
"""
references = [
    "https://workspace.google.com/products/admin/alert-center/",
    "https://www.elastic.co/security-labs/google-workspace-attack-surface-part-one",
    "https://www.elastic.co/security-labs/google-workspace-attack-surface-part-two"
]
risk_score = 73
rule_id = "f1a6d0f4-95b8-11ed-9517-f661ea17fbcc"
rule_name_override = "google_workspace.alert.type"
severity = "high"
tags = [
    "Domain: Cloud",
    "Data Source: Google Workspace",
    "Use Case: Log Auditing",
    "Use Case: Threat Detection",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset: google_workspace.alert
'''


[[rule.severity_mapping]]
field = "google_workspace.alert.metadata.severity"
operator = "equals"
severity = "low"
value = "LOW"

[[rule.severity_mapping]]
field = "google_workspace.alert.metadata.severity"
operator = "equals"
severity = "medium"
value = "MEDIUM"

[[rule.severity_mapping]]
field = "google_workspace.alert.metadata.severity"
operator = "equals"
severity = "high"
value = "HIGH"

[metadata]
creation_date = "2025/04/25"
integration = ["endpoint", "crowdstrike", "sentinel_one_cloud_funnel", "auditd_manager"]
maturity = "production"
updated_date = "2026/03/24"

[rule]
author = ["Elastic"]
description = """
This rule detects manual mount discovery via the /etc/exports or /etc/fstab file on Linux systems. These files are used
by NFS (Network File System) to define which directories are shared with remote hosts. Attackers may access this
file to gather information about shared directories and potential targets for further exploitation.
"""
from = "now-9m"
index = [
    "auditbeat-*",
    "endgame-*",
    "logs-crowdstrike.fdr*",
    "logs-endpoint.events.process*",
    "logs-sentinel_one_cloud_funnel.*",
    "logs-auditd_manager.auditd-*",
]
language = "eql"
license = "Elastic License v2"
name = "Manual Mount Discovery via /etc/exports or /etc/fstab"
note = """ ## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Manual Mount Discovery via /etc/exports or /etc/fstab

In Linux environments, the `/etc/exports` and `/etc/fstab` files are crucial for managing shared directories and mounting filesystems, respectively. Adversaries may exploit these files to identify shared resources and potential targets for lateral movement. The detection rule identifies suspicious processes accessing these files, using common command-line utilities, to flag potential reconnaissance activities by attackers.

### Possible investigation steps

- Review the process details to identify the user account associated with the suspicious activity, focusing on the process.name and process.command_line fields.
- Examine the command line arguments in the process.command_line field to determine the specific actions taken and whether they align with legitimate administrative tasks.
- Check the process start time and correlate it with other system activities to identify any unusual patterns or sequences of events.
- Investigate the source IP address or hostname if the process was initiated remotely, to assess whether it is a known or trusted entity.
- Look for any other related alerts or logs around the same timeframe to identify potential lateral movement or further reconnaissance activities.
- Verify if the accessed directories in /etc/exports or /etc/fstab are critical or sensitive, and assess the potential impact of unauthorized access.

### False positive analysis

- Routine system administration tasks may trigger alerts when administrators use command-line utilities to view or edit /etc/exports or /etc/fstab. To mitigate this, consider excluding processes executed by known administrator accounts or during scheduled maintenance windows.
- Automated scripts for system monitoring or configuration management might access these files regularly. Identify and whitelist these scripts by their process names or command-line patterns to reduce false positives.
- Backup operations often involve reading configuration files like /etc/exports or /etc/fstab. Exclude processes associated with backup software or services to prevent unnecessary alerts.
- Security tools or compliance checks may scan these files as part of their regular operations. Review and whitelist these tools based on their process names or command-line arguments to avoid false positives.
- Developers or testers might access these files in development environments for testing purposes. Consider excluding processes from development servers or specific user accounts associated with testing activities.

### Response and remediation

- Immediately isolate the affected system from the network to prevent potential lateral movement by the attacker.
- Conduct a thorough review of the `/etc/exports` and `/etc/fstab` files on the affected system to identify any unauthorized changes or suspicious entries.
- Revoke any unauthorized access to shared directories identified in the `/etc/exports` file and ensure that only trusted hosts have access.
- Reset credentials and review access permissions for users and services that have access to the affected system to prevent further unauthorized access.
- Monitor network traffic for any unusual activity originating from the affected system, focusing on connections to external IPs or unexpected internal hosts.
- Escalate the incident to the security operations team for further investigation and to determine if additional systems have been compromised.
- Implement enhanced monitoring and logging for access to critical configuration files like `/etc/exports` and `/etc/fstab` to detect similar threats in the future.
"""
risk_score = 47
rule_id = "bd18f4a3-c4c6-43b9-a1e4-b05e09998110"
setup = """## Setup

This rule requires data coming in from Elastic Defend.

### Elastic Defend Integration Setup
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.

#### Prerequisite Requirements:
- Fleet is required for Elastic Defend.
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).

#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
- Go to the Kibana home page and click "Add integrations".
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
- Click "Add Elastic Defend".
- Configure the integration name and optionally add a description.
- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
- Click "Save and Continue".
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
"""
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: Linux",
    "Use Case: Threat Detection",
    "Tactic: Discovery",
    "Data Source: Elastic Defend",
    "Data Source: Elastic Endgame",
    "Data Source: Crowdstrike",
    "Data Source: SentinelOne",
    "Data Source: Auditd Manager",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"
query = '''
process where host.os.type == "linux" and event.type == "start" and
event.action in ("exec", "exec_event", "start", "ProcessRollup2", "executed", "process_started") and
process.name in ("cat", "grep", "tail", "less", "more", "egrep", "fgrep", "awk") and
process.command_line like ("/etc/exports", "/etc/fstab")
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1082"
name = "System Information Discovery"
reference = "https://attack.mitre.org/techniques/T1082/"

[[rule.threat.technique]]
id = "T1135"
name = "Network Share Discovery"
reference = "https://attack.mitre.org/techniques/T1135/"

[rule.threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"

[metadata]
bypass_bbr_timing = true
creation_date = "2023/09/21"
integration = ["endpoint"]
maturity = "production"
updated_date = "2024/05/21"

[rule]
author = ["Elastic"]
building_block_type = "default"
description = """
Identifies the creation of a memory dump file with an unusual extension, which can indicate an attempt to disguise a
memory dump as another file type to bypass security defenses.
"""
from = "now-9m"
index = ["logs-endpoint.events.file-*"]
language = "eql"
license = "Elastic License v2"
name = "Memory Dump File with Unusual Extension"
risk_score = 21
rule_id = "c0b9dc99-c696-4779-b086-0d37dc2b3778"
severity = "low"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Credential Access",
    "Tactic: Defense Evasion",
    "Data Source: Elastic Defend",
    "Rule Type: BBR",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
file where host.os.type == "windows" and event.type == "creation" and

  /* MDMP header */
  file.Ext.header_bytes : "4d444d50*" and
  not file.extension : ("dmp", "mdmp", "hdmp", "edmp", "full", "tdref", "cg", "tmp", "dat") and
  not 
  (
    process.executable : "?:\\Program Files\\Endgame\\esensor.exe" and
    process.code_signature.trusted == true and length(file.extension) == 0
  ) and
  not
  (
    process.name : "System" and file.extension : "tmpscan"
  )
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1003"
name = "OS Credential Dumping"
reference = "https://attack.mitre.org/techniques/T1003/"
[[rule.threat.technique.subtechnique]]
id = "T1003.001"
name = "LSASS Memory"
reference = "https://attack.mitre.org/techniques/T1003/001/"



[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1036"
name = "Masquerading"
reference = "https://attack.mitre.org/techniques/T1036/"
[[rule.threat.technique.subtechnique]]
id = "T1036.008"
name = "Masquerade File Type"
reference = "https://attack.mitre.org/techniques/T1036/008/"



[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[rule]
description = """
Identifies the load of NTDLL for the second time and from an unbacked call stack. This may indicate the use of direct
system calls to evade endpoint security solutions hooking Windows APIs.
"""
id = "69267bb2-e2d9-4621-9bf6-064ac885e49c"
license = "Elastic License v2"
name = "Parallel NTDLL Loaded from Unbacked Memory"
os_list = ["windows"]
reference = [
    "https://www.elastic.co/security-labs/upping-the-ante-detecting-in-memory-threats-with-kernel-call-stacks",
    "https://www.ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs",
]
version = "1.0.20"

query = '''
library where dll.name : "ntdll.dll" and
 dll.Ext.load_index >= 2 and
 process.thread.Ext.call_stack_summary :
                   ("*kernelbase.dll|Unbacked*",
                    "Unbacked*",
                    "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|Unbacked",
                    "ntdll.dll|Unbacked",
                    "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|Unbacked|kernel32.dll|ntdll.dll",
                    "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|Unbacked|clr.dll|mscorlib.ni.dll|Unbacked|clr.dll|mscorlib.ni.dll|Unbacked|clr.dll|mscoreei.dll|mscoree.dll|ntdll.dll") and
 not (process.code_signature.subject_name == "Check Point Software Technologies Ltd." and
      process.code_signature.trusted == true and process.thread.Ext.call_stack_summary : "ntdll.dll|Unbacked") and
 not (process.executable : "?:\\Windows\\System32\\taskhostw.exe" and user.id : "S-1-5-18" and
      process.thread.Ext.call_stack_summary : "Unbacked") and
 not process.executable : "C:\\Program Files (x86)\\Steam\\steamapps\\common\\MonsterHunterWilds\\MonsterHunterWilds.exe"
'''

min_endpoint_version = "8.7.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.7.0"

[rule]
description = """
Identifies use of Bifrost, a known macOS Kerberos pentesting tool, which can be used to dump cached Kerberos tickets or
attempt unauthorized authentication techniques such as pass-the-ticket/hash and kerberoasting.
"""
id = "fecebe4f-2d28-46e7-9bc1-71cdd8ecdd60"
license = "Elastic License v2"
name = "Potential Kerberos Attack via Bifrost"
os_list = ["macos"]
reference = ["https://github.com/its-a-feature/bifrost"]
version = "1.0.28"

query = '''
process where event.type == "start" and process.args like~ "-action" and
 (
  process.args like~ ("-kerberoast", "askhash", "asktgs", "asktgt", "s4u") or
  (process.args like~ "-ticket" and process.args like~ "ptt") or
  (process.args like~ "dump" and process.args in~ ("tickets", "keytab"))
  )
'''

min_endpoint_version = "8.10.2"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1558"
name = "Steal or Forge Kerberos Tickets"
reference = "https://attack.mitre.org/techniques/T1558/"
[[threat.technique.subtechnique]]
id = "T1558.003"
name = "Kerberoasting"
reference = "https://attack.mitre.org/techniques/T1558/003/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1550"
name = "Use Alternate Authentication Material"
reference = "https://attack.mitre.org/techniques/T1550/"
[[threat.technique.subtechnique]]
id = "T1550.003"
name = "Pass the Ticket"
reference = "https://attack.mitre.org/techniques/T1550/003/"



[threat.tactic]
id = "TA0008"
name = "Lateral Movement"
reference = "https://attack.mitre.org/tactics/TA0008/"

[internal]
min_endpoint_version = "8.10.2"

[metadata]
creation_date = "2024/04/23"
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2026/05/03"

[rule]
author = ["Elastic"]
description = """
Identifies a potential privilege escalation attempt via CVE-2022-38028 through modification of the protected Print to PDF
MPDW constraints script.
"""
from = "now-9m"
index = [
    "logs-endpoint.events.file-*",
    "logs-windows.sysmon_operational-*",
    "endgame-*",
    "winlogbeat-*",
    "logs-m365_defender.event-*",
    "logs-sentinel_one_cloud_funnel.*",
    "logs-crowdstrike.fdr*",
]
language = "eql"
license = "Elastic License v2"
name = "Potential privilege escalation via CVE-2022-38028"
references = [
    "https://www.microsoft.com/en-us/security/blog/2024/04/22/analyzing-forest-blizzards-custom-post-compromise-tool-for-exploiting-cve-2022-38028-to-obtain-credentials/",
]
risk_score = 73
rule_id = "dffbd37c-d4c5-46f8-9181-5afdd9172b4c"
severity = "high"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Privilege Escalation",
    "Data Source: Elastic Endgame",
    "Data Source: Elastic Defend",
    "Data Source: Sysmon",
    "Data Source: Microsoft Defender XDR",
    "Data Source: SentinelOne",
    "Data Source: Crowdstrike",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
file where host.os.type == "windows" and event.type != "deletion" and
    file.name : "MPDW-constraints.js" and
    file.path : (
        "?:\\*\\Windows\\system32\\DriverStore\\FileRepository\\*\\MPDW-constraints.js",
        "?:\\*\\Windows\\WinSxS\\amd64_microsoft-windows-printing-printtopdf_*\\MPDW-constraints.js", 
        "\\Device\\HarddiskVolume*\\*\\Windows\\system32\\DriverStore\\FileRepository\\*\\MPDW-constraints.js",
        "\\Device\\HarddiskVolume*\\*\\Windows\\WinSxS\\amd64_microsoft-windows-printing-printtopdf_*\\MPDW-constraints.js"
    ) and
    not process.executable : (
          "?:\\$WINDOWS.~BT\\Sources\\SetupHost.exe",
          "?:\\Windows\\System32\\taskhostw.exe"
    ) and
    not file.path : (
        "?:\\$WINDOWS.~BT\\NewOS\\Windows\\WinSxS\\*\\MPDW-constraints.js",
        "\\Device\\HarddiskVolume*\\$WINDOWS.~BT\\NewOS\\Windows\\WinSxS\\*\\MPDW-constraints.js"
    )
'''

note = """## Triage and analysis

### Investigating Potential privilege escalation via CVE-2022-38028

#### Possible investigation steps

- Does the alert show protected-path MPDW-constraints.js placement outside Windows servicing?
  - Why: the rule proves a Print to PDF constraints-script write, not Print Spooler execution of the modified script.
  - Focus: confirm `file.path` is DriverStore or Print to PDF WinSxS for MPDW-constraints.js, then read `process.executable`, `process.command_line`, `process.parent.executable`, and `process.parent.command_line`. $investigate_0
  - Implication: escalate when the target is protected DriverStore or WinSxS and the writer is not Windows setup, repair, or print-component servicing; lower suspicion only when path, writer, parent, and surrounding servicing files match the same recognized OS or Print to PDF repair activity.
- Does the writer process look like GooseEgg staging rather than servicing?
  - Why: Microsoft observed GooseEgg launchers and batch scripts before Print Spooler redirection; writer identity and parentage separate servicing from exploit staging.
  - Focus: recover the writer start event with `process.entity_id`; compare `process.executable`, `process.hash.sha256`, `process.code_signature.subject_name`, `process.parent.executable`, and `process.parent.command_line`.
  - Implication: escalate when writer or parent is a batch/script host, user-writable or renamed binary, known GooseEgg launcher, or unsigned/unrecognized executable; lower suspicion when identity and lineage remain signed Windows servicing or recognized print-management tooling.
- Did the same writer stage GooseEgg files or copied driver-store content?
  - Why: published GooseEgg examples stage batch files, wayzgoose*.dll, and copied print-driver directories under version-like C:\\ProgramData\\<vendor>\\v#.#.# paths.
  - Focus: same `host.id` and `process.entity_id` file events: `file.path`, `file.name`, `file.Ext.original.path`, and `file.Ext.header_bytes` for staging, rename, or content clues. $investigate_1
  - Implication: escalate when those filenames, ProgramData version paths, copied driver-store directories, .save / .zip hive outputs, or rename chains appear around the writer; lower suspicion when the same-process file set is limited to recognized servicing content and no GooseEgg artifact family appears.
- If registry telemetry is available, did the writer create GooseEgg protocol or CLSID redirection?
  - Focus: same `host.id` and `process.entity_id` registry events, especially `registry.path`, `registry.value`, `registry.data.strings`, and `process.executable` for rogue protocol handler, CLSID, or wayzgoose*.dll paths. $investigate_2
  - Hint: missing registry telemetry is unresolved, not benign; continue with file, process, and spooler evidence.
  - Implication: escalate when registry changes register the rogue protocol or CLSID or point Print Spooler resolution to actor-controlled ProgramData content; lower suspicion only when available registry data remains recognized print-component configuration and file/process evidence is also clean.
- Did activation or spooler follow-on show SYSTEM-level execution?
  - Focus: process starts after the write on `host.id`: `process.name`, `process.parent.name`, `process.parent.executable`, `process.command_line`, and `process.Ext.token.integrity_level_name` for scheduled-task launch, spoolsv.exe, PrintIsolationHost.exe, or SYSTEM command tests. $investigate_3
  - Hint: with library telemetry, check `dll.name` and `dll.path` for wayzgoose*.dll or loads from the written driver-store path; missing library telemetry is unresolved for load proof, not benign.
  - Implication: escalate when the host shows scheduled-task activation as SYSTEM, spooler or print isolation child processes, a SYSTEM whoami test, or a wayzgoose*.dll load after the write; absence is no execution proof, not proof the write was benign.
- Does the suspicious artifact set recur enough to change scope?
  - Focus: after suspicious or unresolved local evidence, review recent alerts for `host.id`, then search `file.path`, suspicious `process.hash.sha256`, and GooseEgg filenames across hosts. $investigate_4
  - Implication: broaden containment and hunting when the same writer hash, ProgramData version path, wayzgoose*.dll, or protected MPDW-constraints.js placement appears on other hosts or pairs with spooler/privilege-escalation alerts; keep scope local when recurrence is absent and local evidence resolves to one recognized workflow.
- Escalate when protected-path placement aligns with non-servicing lineage or any GooseEgg, registry, scheduled-task, or spooler corroborator; close only when path, writer, parent, file set, user/host scope, and recovery bind to one recognized servicing or print workflow; preserve artifacts and escalate when evidence is mixed, missing, or contradictory.

### False positive analysis

- Windows servicing, Print to PDF repair, printer-driver packaging, image-build, or print-management workflows can touch these paths. Confirm `file.path`, writer, parent, signer, `host.id` cohort, surrounding file set, and spooler follow-on all bind to one such workflow, with no GooseEgg artifacts, rogue registry evidence, or spooler child-process anomalies. Change records, patch windows, build records, or management tickets can corroborate; if unavailable, close only when telemetry independently proves the bounded workflow.
- Before creating an exception, validate a stable benign workflow across prior alerts: keep writer identity, `process.parent.executable`, `file.path`, `host.id` cohort, and bounded file set stable. Avoid exceptions on MPDW-constraints.js alone, DriverStore or WinSxS paths alone, or spoolsv.exe activity alone.

### Response and remediation

- If confirmed benign, reverse temporary containment and record the `file.path`, writer identity, parent lineage, `host.id` cohort, and servicing or print-management file pattern that justified closure. Create an exception only for that recurring workflow.
- If suspicious but unconfirmed, preserve the written MPDW-constraints.js, its path and hash when available, the writer `process.entity_id`, `process.executable`, `process.command_line`, parent lineage, `user.id`, GooseEgg scripts or DLLs, ProgramData staging directories, scheduled-task evidence, and any registry or library corroboration before cleanup. Apply reversible containment first, such as pausing nonessential printing, limiting print-management access, isolating the host when business impact permits, or increasing monitoring. Avoid deleting files, stopping spoolsv.exe, or restoring registry state until the evidence is preserved.
- If confirmed malicious, preserve the same file, process, registry, library, scheduled-task, and spooler evidence first, then isolate the host through endpoint response when available and proportionate to host criticality. If direct response is unavailable, escalate with the preserved `file.path`, writer lineage, staging directory, registry redirection, and spooler follow-on evidence to the team that can act. After scope is clear, remove the malicious JavaScript, GooseEgg scripts, wayzgoose*.dll, ProgramData staging directory, scheduled task, and rogue registry/protocol state; restore affected print configuration, close the staging mechanism, and rotate credentials only for accounts or hives exposed by collected evidence.
- Post-incident hardening: apply the Microsoft security update for CVE-2022-38028, disable Print Spooler on systems that do not need it, restrict print-management rights, retain file/process coverage plus registry or library telemetry where it limited the investigation, and document the confirmed MPDW-constraints.js, ProgramData, wayzgoose, or scheduled-task pattern for future triage.
"""

setup = """## Setup

This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.

Setup instructions: https://ela.st/install-elastic-defend

### Additional data sources

This rule also supports the following third-party data sources. For setup instructions, refer to the links below:

- [CrowdStrike](https://ela.st/crowdstrike-integration)
- [Microsoft Defender XDR](https://ela.st/m365-defender)
- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
- [Sysmon Event ID 11 - File Create](https://ela.st/sysmon-event-11-setup)
"""

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "host.name",
    "host.id",
    "user.id",
    "process.executable",
    "process.command_line",
    "process.pid",
    "process.entity_id",
    "process.parent.executable",
    "process.parent.command_line",
    "process.hash.sha256",
    "process.code_signature.subject_name",
    "process.code_signature.trusted",
    "file.path",
    "file.name",
]

[transform]

[[transform.investigate]]
label = "File events for the same suspicious JavaScript path"
description = ""
providers = [
  [
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "file.path", queryType = "phrase", value = "{{file.path}}", valueType = "string" }
  ]
]
relativeFrom = "now-2h"
relativeTo = "now"

[[transform.investigate]]
label = "File events from the writer process"
description = ""
providers = [
  [
    { excluded = false, field = "event.category", queryType = "phrase", value = "file", valueType = "string" },
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" }
  ]
]
relativeFrom = "now-2h"
relativeTo = "now"

[[transform.investigate]]
label = "Registry events from the writer process"
description = ""
providers = [
  [
    { excluded = false, field = "event.category", queryType = "phrase", value = "registry", valueType = "string" },
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" }
  ]
]
relativeFrom = "now-2h"
relativeTo = "now"

[[transform.investigate]]
label = "Process events after the protected file write"
description = ""
providers = [
  [
    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" },
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" }
  ]
]
relativeFrom = "now"
relativeTo = "now"

[[transform.investigate]]
label = "Alerts associated with the host"
description = ""
providers = [
  [
    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" }
  ]
]
relativeFrom = "now-48h/h"
relativeTo = "now"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1068"
name = "Exploitation for Privilege Escalation"
reference = "https://attack.mitre.org/techniques/T1068/"

[[rule.threat.technique]]
id = "T1574"
name = "Hijack Execution Flow"
reference = "https://attack.mitre.org/techniques/T1574/"

[[rule.threat.technique.subtechnique]]
id = "T1574.010"
name = "Services File Permissions Weakness"
reference = "https://attack.mitre.org/techniques/T1574/010/"

[rule.threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1036"
name = "Masquerading"
reference = "https://attack.mitre.org/techniques/T1036/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[rule]
description = """
Identifies attempt to allocate an executable memory region in a remote process followed by writing content to it. This
behavior is consistent with remote code injection attacks.
"""
id = "f1d05929-4271-4d39-9cae-05eab6d4efca"
license = "Elastic License v2"
name = "Potential Remote Code Injection"
os_list = ["windows"]
version = "1.0.12"

query = '''
sequence by process.entity_id, process.Ext.api.parameters.address, Target.process.pid with maxspan=60s
 [api where process.Ext.api.behaviors == "cross-process" and not process.Ext.api.behaviors == "parent-child" and
  process.executable != null and process.thread.Ext.call_stack_final_user_module.name != null and 
  process.Ext.api.name in ("VirtualAllocEx", "MapViewOfFile", "MapViewOfFile2", "VirtualProtect", "VirtualProtectEx") and process.Ext.api.parameters.protection like "*X*" and
  (process.code_signature.trusted == false or process.code_signature.exists == false or process.name : "rundll32.exe" or 
   process.executable : ("?:\\Windows\\Microsoft.NET\\*", "?:\\Users\\Public")) and 
   not process.executable : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*") and 
   not _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info: "?:\\program files*\\cisco\\amp\\exprev\\protector*.dll*") and 
   not (process.code_signature.trusted == true and startswith~(process.thread.Ext.call_stack_final_user_module.path, process.executable)) and 
   not process.thread.Ext.call_stack_final_user_module.name in ("Unknown", "Undetermined", "Kernel") and
   not process.thread.Ext.call_stack_final_user_module.path like
                                         ("?:\\program files\\*",
                                          "?:\\program files (x86)\\*",
                                          "\\program files\\*", 
                                          "\\program files (x86)\\*",
                                          "?:\\windows\\microsoft.net\\framework*.dll", 
                                          "\\windows\\microsoft.net\\framework*.dll", 
                                          "?:\\windows\\system32\\*", 
                                          "\\windows\\system32\\*", 
                                          "?:\\windows\\winsxs\\*", 
                                          "\\windows\\winsxs\\*", 
                                          "?:\\windows\\syswow64\\*", 
                                          "\\windows\\syswow64\\*", 
                                          "?:\\windows\\assembly\\*",
                                          "\\windows\\assembly\\*",
                                          "?:\\windows\\veeamvsssupport\\veeamvsssupport.dll") and 
   not process.thread.Ext.call_stack_final_user_module.hash.sha256 in
                                          ("70a8c4ae129e3d79854c6658b199faf27590800cb2d7fa5681d6bfdbe0111993", 
                                           "13d8d9823d8f9e41247f32831e5a044fb4b09187571e498b807c07caa8c3004f", 
                                           "51409099241d9af2b9005a0de21081ae9dbb64c0c98eb4a6460e1d1946461ce0", 
                                           "6ad87a98d9e91e784fb1e275b9e37709a1ae85f8d6096cbf5a8ce3104314d5ed", 
                                           "d9070a90ea8a8bc1c9120397c2588d3e8f588bcce4a261cc9f0e9f0c37c8d726", 
                                           "2ac92e1b48ad518efa47313aac59b67950da234d20e651b221b7232e4ae9e65d", 
                                           "c8469c12a2cf76b8b4225d8910958810847e31263487df0065c8648b572467ef", 
                                           "9bb82a8b466b48176bd876a8fa7a9b3708cf3d86aa1b6c420cf73b003d41495d", 
                                           "c9f420fb873c8d26c134314cd2543442685b98349a79cb51f06bd364c16aa298", 
                                           "06e8f5fc9ac8ab8a9390531eebac30372fed6982cceac4d54bb6653f9f6603f7", 
                                           "27d34c6032491d4dce1060eb3bf8382357a8fde4909aed3855e5c250e0789433", 
                                           "31f65b7afe91e23ae88d8229fd54c5eb494ffd4594bdc3d6a91d2d69892b284b", 
                                           "91ff5261cd17ad19edfacfb905a375c300cc6e323e6eaa42446a005a701880b4", 
                                           "c8469c12a2cf76b8b4225d8910958810847e31263487df0065c8648b572467ef", 
                                           "e77507caca8b74b197329f3584a540d7015aad5a94d9aa29a3427959cf129bcd", 
                                           "cacf583a07df75fd7d76a43a78338c1d032833e1cc2d9945229df04385cfc10f", 
                                           "a1bbeed70452386d4d3b4383dd47180e9a96440011dbdcadcc6c48c3e1337eac", 
                                           "f71ae100e2c4a6de86033f7664db07dcba74319de4da0e72f9b5908f09257519", 
                                           "a63dffea3202a2499abef6c507a3a84aab04e1f43a086ba79784ccb29f4a3156", 
                                           "dd69b5adcc1832c449ee31ede33ba17dfafba278eb3627dbabf3a42b02a457d8", 
                                           "dd1eaa53b13e901e8236d034400e36bda7249bf7bb74f50b46d31ebe4896ebb9",
                                           "e3fdcd2b4c5215e74b0cabe91ce7fe2800cbf8e2a28157342960bca61bbd6b5d",
                                           "f24968ff313caf2d1f6a87b5b2265bcb7278ab598e414fd60b1037aa9b226370",
                                           "2a08e0247dcd2363430f48db72ca6c3d2f5d84486c7894cff54e6aae2eb45721",
                                           "e9f8a89ccb79d3ce6c148022f9ba830521ece008749fb98ea129c7073b9449f9",
                                           "3226b506e186e98c68d57b3dcd046695e59ab0b818a58b4fb9613cbe1e9049a0",
                                           "f30518fad5e56b63c807c306b3b3ab70f043eb24956aa128e96e1482380c5e80",
                                           "0723de6b33653635781c72d282552ad13d3a5dbe37ca6f4fd62b1f3173dc085d",
                                           "3a2a379f7fcea34ea52fe908c57cd5bb1c76bf58306261ea30aeef35ca17e4ed",
                                           "097a19028e711f08600ea254bbff08d03539f6d54accc297255cdd13dbede01e",
                                           "91744edcc8efb66deda82a2ac1e560da85cd84735b0ad42ad77d28e559741015",
                                           "ae04a881df5e2256eae703efda6f021145dbdde5230201e1501433c67f29dfb1",
                                           "4c5391497df553576490432e32dfc5dc2e7e195027cd6faa3c8058a63899d6ab",
                                           "c4ced30ef9ad364d35edca795bb03b128849bcdf9d4c958086309327341d7107",
                                           "2c5c370bd7c51e834784b97af7da480653eb3e61aa2e7c662d70c1875ace0c03",
                                           "2f8eb40944200c4b4ddf36c78a4d2e758d9ec6e43396cf85f03970ffa268c334",
                                           "77b08483aa5d9cc5ac6050169edff7293522ce865786f181edb6fcc2e41652ca",
                                           "ceafaeb950cae0fb4a6b8f6dd68aec8311ebad923f658335b6abc0f7114a62ac",
                                           "b50f97afb49255d1ca37968e3fdc51515b9b9ef447d0460744ece428dc0f850c",
                                           "e948b1c8189fbd76a85a0a4e50d7db33991ff2a0c3993d44ab54530bf8a0287e",
                                           "e0552b8681250e081dce00fc1745926106f5c638030d0a2bbe529b152960ae15",
                                           "5442ecad629b42c4ebc8df3c8fab67783bacbc0d4c5121845b91ef538099073d",
                                           "19c2b71f25587376e352aeb7a9f62ea52096b41461817fadc067a9e8b46379f2",
                                           "c729c4b5a6ad8d247acd4b0d32d5a5999647461ee5f565c618b26d339caebbca") and
   not _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.trusted == true and
                  $entry.subject_name in ("Microsoft Windows Hardware Compatibility Publisher",
                                          "Microsoft Windows Software Compatibility Publisher",
                                          "Barco N.V.",
                                          "Eclipse.org Foundation, Inc.",
                                          "Shanghai Best Oray Information S&T Co. Ltd."))
  ]
 [api where process.Ext.api.behaviors : "cross-process" and 
  not process.Ext.api.behaviors == "parent-child" and process.Ext.api.name == "WriteProcessMemory"]
'''

min_endpoint_version = "8.10.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"

[rule]
description = """
Identifies recursive clearing of extended attributes with xattr -rc immediately followed by ad-hoc codesigning using a
dash identity (codesign --sign -). Malware and stealers use this chain to remove the quarantine flag from downloaded
payloads and apply an ad-hoc signature so binaries can run with fewer Gatekeeper prompts.
"""
id = "2b792fe4-bcda-4ee7-ba6c-4a90c7fc9c4e"
license = "Elastic License v2"
name = "Quarantine Cleared via Xattr Followed by Ad-hoc Codesign"
os_list = ["macos"]
version = "1.0.1"

query = '''
sequence by process.parent.entity_id with maxspan=30s
  [process where event.type == "start" and event.action == "exec" and process.name == "xattr" and 
   (
     process.args in ("-rc", "-cr") or 
     (process.args == "-r" and process.args == "-c") or 
     (process.args == "-d" and process.args == "com.apple.quarantine")
    ) and 
    
   /* https://github.com/NousResearch/hermes-agent/blob/main/scripts/install.sh#L2349 */
   not process.Ext.effective_parent.executable like "/Volumes/Hermes*/Hermes.app/Contents/MacOS/Hermes-Setup" and 
   not process.args like "/Users/*/.hermes/hermes-agent/apps/desktop/release/mac-arm64/Hermes.app" and 

   not process.Ext.effective_parent.executable == "/Applications/Cursor.app/Contents/MacOS/Cursor"
   ]
  [process where event.type == "start" and event.action == "exec" and
   process.name == "codesign" and
   process.args in ("--sign", "-s") and process.args in ("--force", "-f") and process.args == "--deep"]
'''

min_endpoint_version = "8.11.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1553"
name = "Subvert Trust Controls"
reference = "https://attack.mitre.org/techniques/T1553/"
[[threat.technique.subtechnique]]
id = "T1553.001"
name = "Gatekeeper Bypass"
reference = "https://attack.mitre.org/techniques/T1553/001/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.11.0"

[metadata]
creation_date = "2023/09/22"
integration = ["beaconing", "endpoint"]
maturity = "production"
updated_date = "2026/07/27"

[rule]
author = ["Elastic"]
description = """
A statistical model has identified command-and-control (C2) beaconing activity. Beaconing can help attackers maintain
stealthy communication with their C2 servers, receive instructions and payloads, exfiltrate data and maintain
persistence in a network.
"""
from = "now-1h"
index = ["ml_beaconing.all"]
language = "kuery"
license = "Elastic License v2"
name = "Statistical Model Detected C2 Beaconing Activity"
references = [
    "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html",
    "https://docs.elastic.co/en/integrations/beaconing",
    "https://www.elastic.co/security-labs/identifying-beaconing-malware-using-elastic",
]
risk_score = 21
rule_id = "5397080f-34e5-449b-8e9c-4c8083d7ccc6"
setup = """## Setup

The rule requires the Network Beaconing Identification integration assets to be installed, as well as network logs collected by the Elastic Defend integration.

### Network Beaconing Identification Setup
The Network Beaconing Identification integration consists of a statistical framework to identify C2 beaconing activity in network logs.

#### Prerequisite Requirements:
- Fleet is required for Network Beaconing Identification.
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
- Network events collected by the [Elastic Defend](https://docs.elastic.co/en/integrations/endpoint) integration.
- To install Elastic Defend, refer to the [documentation](https://www.elastic.co/guide/en/security/current/install-endpoint.html).

#### The following steps should be executed to install assets associated with the Network Beaconing Identification integration:
- Go to the Kibana homepage. Under Management, click Integrations.
- In the query bar, search for Network Beaconing Identification and select the integration to see more details about it.
- Follow the instructions under the **Installation** section.
"""
severity = "low"
tags = [
    "Domain: Network",
    "Data Source: Elastic Defend",
    "Use Case: C2 Beaconing Detection",
    "Tactic: Command and Control",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
beacon_stats.is_beaconing: true and
not process.name: ("WaAppAgent.exe" or "metricbeat.exe" or "packetbeat.exe" or "WindowsAzureGuestAgent.exe" or "HealthService.exe" or "Widgets.exe" or "lsass.exe" or "msedgewebview2.exe" or
                   "MsMpEng.exe" or "OUTLOOK.EXE" or "msteams.exe" or "FileSyncHelper.exe" or "SearchProtocolHost.exe" or "Creative Cloud.exe" or "ms-teams.exe" or "ms-teamsupdate.exe" or
                   "curl.exe" or "rundll32.exe" or "MsSense.exe" or "wermgr.exe" or "java" or "olk.exe" or "iexplore.exe" or "NetworkManager" or "packetbeat" or "Ssms.exe" or "NisSrv.exe" or
                   "gamingservices.exe" or "appidcertstorecheck.exe" or "POWERPNT.EXE" or "miiserver.exe" or "Grammarly.Desktop.exe" or "SnagitEditor.exe" or "CRWindowsClientService.exe" or
                   "agentbeat" or "dnf" or "yum" or "apt"
                  )
'''
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Statistical Model Detected C2 Beaconing Activity

Statistical models analyze network traffic patterns to identify anomalies indicative of C2 beaconing, a tactic used by attackers to maintain covert communication with compromised systems. Adversaries exploit this by sending periodic signals to C2 servers, often mimicking legitimate traffic. The detection rule leverages statistical analysis to flag unusual beaconing while excluding known benign processes, thus highlighting potential threats without overwhelming analysts with false positives.

### Possible investigation steps

- Review the network traffic logs to identify the source and destination IP addresses associated with the beaconing activity flagged by the statistical model.
- Cross-reference the identified IP addresses with threat intelligence databases to determine if they are associated with known malicious C2 servers.
- Analyze the frequency and pattern of the beaconing signals to assess whether they mimic legitimate traffic or exhibit characteristics typical of C2 communication.
- Investigate the processes running on the source system to identify any suspicious or unauthorized applications that may be responsible for the beaconing activity.
- Check for any recent changes or anomalies in the system's configuration or installed software that could indicate a compromise.
- Examine the historical network activity of the source system to identify any other unusual patterns or connections that may suggest a broader compromise.

### False positive analysis

- The rule may flag legitimate processes that exhibit periodic network communication patterns similar to C2 beaconing. Processes like "metricbeat.exe" and "packetbeat.exe" are known to generate regular network traffic for monitoring purposes.
- Users can manage these false positives by adding exceptions for these known benign processes in the detection rule, ensuring they are not flagged as threats.
- Regularly review and update the list of excluded processes to include any new legitimate applications that may mimic beaconing behavior, reducing unnecessary alerts.
- Consider implementing a whitelist approach for processes that are verified as non-threatening, allowing the statistical model to focus on truly anomalous activities.
- Engage with network and security teams to understand the normal traffic patterns of your environment, which can help in refining the detection rule and minimizing false positives.

### Response and remediation

- Isolate the affected system from the network to prevent further communication with the C2 server and limit potential data exfiltration.
- Terminate any suspicious processes identified by the alert that are not part of the known benign list, ensuring that any malicious activity is halted.
- Conduct a thorough scan of the isolated system using updated antivirus and anti-malware tools to identify and remove any malicious software or files.
- Review and analyze network logs to identify any other systems that may have communicated with the same C2 server, and apply similar containment measures to those systems.
- Restore the affected system from a known good backup to ensure that any persistent threats are removed, and verify the integrity of the restored system.
- Implement network segmentation to limit the ability of compromised systems to communicate with critical infrastructure and sensitive data.
- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if additional measures are needed to prevent recurrence."""


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"

[[rule.threat.technique]]
id = "T1102"
name = "Web Service"
reference = "https://attack.mitre.org/techniques/T1102/"

[[rule.threat.technique.subtechnique]]
id = "T1102.002"
name = "Bidirectional Communication"
reference = "https://attack.mitre.org/techniques/T1102/002/"

[rule.threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[rule]
description = """
Identifies when a System protected process loads a library from a network file share. This may indicate an attempt to
bypass PPL protection and inject malicious code into a protected process or disable security software.
"""
id = "5007b805-0cee-44e8-b807-22c95d5d2998"
license = "Elastic License v2"
name = "Suspicious Image Load by System Protected Process"
os_list = ["windows"]
reference = [
    "https://learn.microsoft.com/en-us/windows/win32/services/protecting-anti-malware-services-",
    "https://github.com/gabriellandau/PPLFault",
    "https://www.blackhat.com/asia-23/briefings/schedule/#ppldump-is-dead-long-live-ppldump-31052",
    "https://www.elastic.co/security-labs/forget-vulnerable-drivers-admin-is-all-you-need",
]
version = "1.0.14"

query = '''
sequence by process.entity_id
 [process where event.action == "start" and process.Ext.protection : "PsProtected*" and 
  not (process.executable : "?:\\Windows\\Microsoft.NET\\Framework\\*\\mscorsvw.exe" and 
       process.parent.executable : "?:\\Windows\\Microsoft.NET\\Framework*\\ngen.exe" and 
       process.Ext.protection : "PsProtectedSignerCodeGen-Light")]
 [library where dll.path : ("\\Device\\Mup\\*", "\\\\127.*\\*")]
  until [process where event.action:"end"]
'''

min_endpoint_version = "8.7.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1211"
name = "Exploitation for Defense Evasion"
reference = "https://attack.mitre.org/techniques/T1211/"

[[threat.technique]]
id = "T1574"
name = "Hijack Execution Flow"
reference = "https://attack.mitre.org/techniques/T1574/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.7.0"

[metadata]
creation_date = "2021/01/04"
integration = ["endpoint"]
maturity = "production"
updated_date = "2026/05/07"

[rule]
author = ["Elastic"]
description = """
Identifies suspicious child processes of frequently targeted Microsoft Office applications (Word, PowerPoint, and
Excel). These child processes are often launched during exploitation of Office applications or by documents with
malicious macros.
"""
from = "now-9m"
index = ["logs-endpoint.events.process*"]
language = "eql"
license = "Elastic License v2"
name = "Suspicious macOS MS Office Child Process"
references = ["https://blog.malwarebytes.com/cybercrime/2017/02/microsoft-office-macro-malware-targets-macs/"]
risk_score = 47
rule_id = "66da12b1-ac83-40eb-814c-07ed1d82b7b9"
setup = """## Setup

This rule requires data coming in from Elastic Defend.

### Elastic Defend Integration Setup
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.

#### Prerequisite Requirements:
- Fleet is required for Elastic Defend.
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).

#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
- Go to the Kibana home page and click "Add integrations".
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
- Click "Add Elastic Defend".
- Configure the integration name and optionally add a description.
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
- Click "Save and Continue".
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
"""
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: macOS",
    "Use Case: Threat Detection",
    "Tactic: Initial Access",
    "Data Source: Elastic Defend",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
process where event.action == "exec" and host.os.type == "macos" and
    process.parent.name: (
      "Microsoft Word",
      "Microsoft Outlook",
      "Microsoft Excel",
      "Microsoft PowerPoint",
      "Microsoft OneNote"
    ) and
  process.name : (
    "curl",
    "nscurl",
    "bash",
    "sh",
    "osascript",
    "python*",
    "perl*",
    "mktemp",
    "chmod",
    "php",
    "nohup",
    "openssl",
    "plutil",
    "PlistBuddy",
    "xattr",
    "mktemp",
    "sqlite3",
    "funzip",
    "popen"
  ) and

  // Filter FPs related to product version discovery and Office error reporting behavior
  not process.args:
    (
      "ProductVersion",
      "hw.model",
      "ioreg",
      "ProductName",
      "ProductUserVisibleVersion",
      "ProductBuildVersion",
      "/Library/Application Support/Microsoft/MERP*/Microsoft Error Reporting.app/Contents/MacOS/Microsoft Error Reporting",
      "open -a Safari *",
      "defaults read *",
      "sysctl hw.model*",
      "ioreg -d2 -c IOPlatformExpertDevice *",
      "ps aux | grep 'ToDesk_Desktop' | grep -v grep",
      "PIPE=\"$CFFIXED_USER_HOME/.zoteroIntegrationPipe*"
    ) and

   not process.parent.executable :
        (
          "/Applications/ToDesk.app/Contents/MacOS/ToDesk_Service",
          "/usr/local/Privacy-i/PISupervisor",
          "/Library/Addigy/lan-cache",
          "/Library/Elastic/Agent/*",
          "/opt/jc/bin/jumpcloud-agent",
          "/usr/sbin/networksetup"
        ) and
   not (process.name : "sh" and process.command_line : "*$CFFIXED_USER_HOME/.zoteroIntegrationPipe*") and

   not process.Ext.effective_parent.executable : (
        "/Applications/ToDesk.app/Contents/MacOS/ToDesk_Service",
        "/usr/local/Privacy-i/PISupervisor",
        "/Library/Addigy/auditor",
        "/Library/Elastic/Agent/*",
        "/opt/jc/bin/jumpcloud-agent",
        "/usr/sbin/networksetup"
      ) and
    not (
      process.name in ("sh", "bash") and
      process.command_line like "*com.microsoft.Outlook/Data/tmp/Outlook*Temp*" and
      process.parent.executable in (
        "/Applications/Microsoft Outlook.app/Contents/MacOS/Microsoft Outlook",
        "/Applications/Microsoft Outlook 2.app/Contents/MacOS/Microsoft Outlook",
        "/Applications/Microsoft/Microsoft Outlook.app/Contents/MacOS/Microsoft Outlook"
      )
    )
'''
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Suspicious macOS MS Office Child Process

Microsoft Office applications on macOS can be exploited by adversaries to execute malicious child processes, often through malicious macros or document exploits. These child processes may include scripting languages or utilities that can be leveraged for unauthorized actions. The detection rule identifies such suspicious activity by monitoring for unexpected child processes spawned by Office apps, while filtering out known benign behaviors and false positives, thus helping to pinpoint potential threats.

### Possible investigation steps

- Review the parent process name and executable path to confirm if the Office application is legitimate and expected on the host.
- Examine the child process name and command line arguments to identify any potentially malicious or unexpected behavior, such as the use of scripting languages or network utilities like curl or nscurl.
- Check the process arguments for any indicators of compromise or suspicious patterns that are not filtered out by the rule, such as unexpected network connections or file modifications.
- Investigate the effective parent executable path to ensure it is not associated with known benign applications or services that are excluded by the rule.
- Correlate the alert with any recent phishing attempts or suspicious email activity that might have led to the execution of malicious macros or document exploits.
- Analyze the host's recent activity and system logs to identify any other anomalies or related alerts that could provide additional context or evidence of compromise.

### False positive analysis

- Product version discovery commands can trigger false positives. Exclude processes with arguments like "ProductVersion" and "ProductBuildVersion" to reduce noise.
- Office error reporting may cause alerts. Exclude paths related to Microsoft Error Reporting to prevent unnecessary alerts.
- Network setup and management tools such as "/usr/sbin/networksetup" can be benign. Exclude these executables if they are part of regular system operations.
- Third-party applications like ToDesk and JumpCloud Agent might be flagged. Exclude their executables if they are verified as safe and part of normal operations.
- Zotero integration can cause false positives with shell processes. Exclude specific command lines involving "CFFIXED_USER_HOME/.zoteroIntegrationPipe" to avoid these alerts.

### Response and remediation

- Immediately isolate the affected macOS device from the network to prevent further malicious activity or lateral movement.
- Terminate any suspicious child processes identified by the alert, such as those involving scripting languages or utilities like curl, bash, or osascript.
- Conduct a thorough review of the parent Microsoft Office application and associated documents to identify and remove any malicious macros or document exploits.
- Restore the affected system from a known good backup if malicious activity has compromised system integrity or data.
- Update all Microsoft Office applications to the latest version to patch any known vulnerabilities that could be exploited by similar threats.
- Implement application whitelisting to restrict the execution of unauthorized scripts and utilities, reducing the risk of exploitation through Office applications.
- Escalate the incident to the security operations team for further investigation and to assess the potential impact on other systems within the network."""


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"

[[rule.threat.technique.subtechnique]]
id = "T1566.001"
name = "Spearphishing Attachment"
reference = "https://attack.mitre.org/techniques/T1566/001/"

[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"

[[rule.threat.technique.subtechnique]]
id = "T1059.002"
name = "AppleScript"
reference = "https://attack.mitre.org/techniques/T1059/002/"

[[rule.threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"

[[rule.threat.technique.subtechnique]]
id = "T1059.006"
name = "Python"
reference = "https://attack.mitre.org/techniques/T1059/006/"

[[rule.threat.technique]]
id = "T1203"
name = "Exploitation for Client Execution"
reference = "https://attack.mitre.org/techniques/T1203/"

[[rule.threat.technique]]
id = "T1204"
name = "User Execution"
reference = "https://attack.mitre.org/techniques/T1204/"

[[rule.threat.technique.subtechnique]]
id = "T1204.002"
name = "Malicious File"
reference = "https://attack.mitre.org/techniques/T1204/002/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"