Elastic rules: 19

[rule]
description = """
Identifies access attempts to non existing cryptocurrency wallet files. Adversaries may perform discovery to steal
potential cryptocurrency related files for for financial gains.
"""
id = "ae071666-e38b-4309-9714-0d014befa01e"
license = "Elastic License v2"
name = "Access Attempt to Non Existing Cryptocurrency Wallet"
os_list = ["windows"]
version = "1.0.7"

query = '''
file where event.type == "access" and process.pid != 4 and not user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20") and
 event.outcome == "failure" and process.executable != null and not file.name : "desktop.ini" and
   file.path :
      ("*\\ElectronCash\\wallets*",
       "*\\Electrum-LTC\\wallets*",
       "*\\Electrum\\wallets*",
       "*\\Ethereum\\keystore*",
       "*\\Exodus\\exodus.wallet*",
       "*\\Bitcoin\\wallets*",
       "*\\Coinomi\\wallets*",
       "*\\Appdata\\Roaming\\Raven\\*wallet*",
       "*\\DaedalusMainnet\\wallets*",
       "*\\Blockstream\\Green\\wallets*",
       "*\\MultiDoge\\multidoge.wallet*",
       "*\\WalletWasabi\\Client\\Wallets*",
       "*\\com.liberty.jaxx\\IndexedDB\\file__0.indexeddb.leveldb",
       "*\\Appdata\\Roaming\\atomic\\LocalStorage\\leveldb*",
       "*AppData\\Roaming\\Guarda\\LocalStorage\\leveldb*",
       "*fhbohimaelbohpjbbldcngcnapndodjp*",
       "*aeachknmefphepccionboohckonoeemg*",
       "*hnfanknocfeofbddgcijnmhnfnkdnaad*",
       "*hifafgmccdpekplomjjkcfgodnhcellj*",
       "*nkbihfbeogaeaoehlefnkodbefgpgknn*",
       "*ejbalbakoplchlghecdalmeeeajnimhm*",
       "*bfnaelmomeimhlpmgjnjophhpkkoljpa*",
       "*fnjhmkhhmkbjkkabndcnnogagogbneec*",
       "ibnejdfjmmkpcnlpebklmnkoeoihofec*",
       "*klfhbdnlcfcaccoakhceodhldjojboga*",
       "*aanjhgiamnacdfnlfnmgehjikagdbafd*",
       "*bblmcdckkhkhfhhpfcchlpalebmonecp*",
       "*hpglfhgfnhbgpjdenjgmdgoeiappafln*",
       "*afbcbjpbpfadlkmhmclhkeeodmamcflc*",
       "*kncchdigobghenbbaddojjnnaogfppfj*") and
not (process.executable : "?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe" and
     process.code_signature.subject_name == "Microsoft Corporation" and process.code_signature.trusted == true) and
not process.executable : "?:\\Windows\\explorer.exe" and
not (process.code_signature.subject_name : ("Exodus Movement Inc", "Exodus Movement, Inc.", "Blockstream USA Corp") and process.code_signature.trusted == true and
     file.path : "?:\\Users\\*\\Exodus\\exodus.wallet*") and
not (process.executable == "C:\\Program Files\\WasabiWallet\\wassabee.exe" and file.name == "Wallet.json.old")
'''

min_endpoint_version = "8.1.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"
[[threat.technique.subtechnique]]
id = "T1552.001"
name = "Credentials In Files"
reference = "https://attack.mitre.org/techniques/T1552/001/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "8.1.0"

[rule]
description = """
Detects the creation or modification of an At job by a suspicious process. This activity should almost never take place
as Apple is slowly deprecating it and atrun execution is disabled by default. If this rule fires it should indicate
highly abnormal or malicious activity. Threat actors can abuse the atrun scheduler to persist their binaries on a
system.
"""
id = "779f18ce-1457-457c-80e1-3a5d146c2dc0"
license = "Elastic License v2"
name = "At Job Creation or Modification via Shell Command"
os_list = ["macos"]
reference = ["https://theevilbit.github.io/beyond/beyond_0014/"]
version = "1.0.23"

query = '''
sequence by process.entity_id with maxspan=5s
[process where event.type == "start" and (process.name in ("bash", "sh", "zsh", "dash", "csh", "tcsh", "ksh", "tclsh", "fish") or process.name like "tclsh*") and process.args == "-c"]
[file where event.action != "deletion" and 
  file.path like "/private/var/at/jobs/*" and not
  file.path == "/private/var/at/jobs/root"]
'''

min_endpoint_version = "8.11.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1053"
name = "Scheduled Task/Job"
reference = "https://attack.mitre.org/techniques/T1053/"
[[threat.technique.subtechnique]]
id = "T1053.002"
name = "At"
reference = "https://attack.mitre.org/techniques/T1053/002/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1053"
name = "Scheduled Task/Job"
reference = "https://attack.mitre.org/techniques/T1053/"
[[threat.technique.subtechnique]]
id = "T1053.002"
name = "At"
reference = "https://attack.mitre.org/techniques/T1053/002/"



[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[internal]
min_endpoint_version = "8.11.0"

[rule]
description = """
Identifies registry modification to disallow a driver by name using the undocumented Code Integrity registry value
HVCIDisallowedImages. An adversary may abuse this setting to block Endpoint security drivers from loading after system
reboot.
"""
id = "908bec9a-39c6-4de4-b8e5-25f0b57faa38"
license = "Elastic License v2"
name = "Attempt to Disable Driver via HVCIDisallowedImages"
os_list = ["windows"]
reference = [
    "https://learn.microsoft.com/en-us/windows-hardware/drivers/bringup/device-guard-and-credential-guard",
    "https://github.com/yardenshafir/conference_talks/blob/main/OffensiveCon_2023_Your_Mitigations_are_My_Opportunities.pdf",
]
version = "1.0.11"

query = '''
registry where registry.path : "HKLM\\SYSTEM\\*ControlSet*\\CI\\*HVCIDisallowedImages*"
'''

min_endpoint_version = "7.15.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1112"
name = "Modify Registry"
reference = "https://attack.mitre.org/techniques/T1112/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.15.0"

[metadata]
creation_date = "2026/07/27"
integration = ["aws"]
maturity = "production"
updated_date = "2026/07/27"

[rule]
author = ["Elastic"]
description = """
Detects a principal modifying an S3 bucket ACL to grant public read or write access that has not
been observed doing so within the history window, using canned ACLs such as public-read or 
public-read-write. ACL-based public access is a distinct API path (PutBucketAcl) that can bypass 
some Block Public Access controls. Monitoring for new identities performing this change helps surface 
freshly compromised credentials being used to stage data for exfiltration or inadvertently expose sensitive 
content.
"""
false_positives = [
    """
    Static website hosting configurations may intentionally use a public-read ACL on S3 buckets
    that serve web content. Validate that the target bucket is a known public-facing asset and that
    the change was authorized. Consider adding exclusions for specific bucket names used for static
    hosting.
    """,
]
from = "now-6m"
index = ["logs-aws.cloudtrail-*"]
interval = "5m"
language = "kuery"
license = "Elastic License v2"
name = "AWS S3 Bucket ACL Modified to Allow Public Access by New Identity"
note = """## Triage and analysis

### Investigating AWS S3 Bucket ACL Modified to Allow Public Access by New Identity

This rule fires when a `PutBucketAcl` call sets a canned ACL that grants public or broad access. Unlike bucket policies, bucket ACLs are a legacy mechanism that bypasses some newer Block Public Access controls and can inadvertently or deliberately expose bucket contents to unauthenticated internet users.

### Possible investigation steps

- Identify the modifying principal (`aws.cloudtrail.user_identity.arn`) and determine whether they are authorized to modify S3 bucket ACLs.
- Review `aws.cloudtrail.request_parameters` to confirm the specific canned ACL applied (`public-read`, `public-read-write`).
- Check whether AWS S3 Block Public Access is enabled at the account or bucket level — if so, it may still be preventing effective public exposure even though this ACL change succeeded.
- Enumerate the bucket contents to assess the sensitivity of any exposed data.
- Check for recent `GetObject` or `ListObjects` calls from unauthenticated sources against the same bucket.

### False positive analysis

- Static website hosting buckets are commonly configured with `public-read` ACLs.

### Response and remediation

- If unauthorized, immediately reset the bucket ACL to `private` using `PutBucketAcl`.
- Enable S3 Block Public Access at the account level to prevent future ACL-based public exposure across all buckets.
- Review the bucket's object-level access log for any unauthorized reads that occurred after the ACL change.
"""
references = [
    "https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketAcl.html",
    "https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-overview.html",
]
risk_score = 47
rule_id = "3e7c1b84-9f52-4d63-8a17-6b0e4c2f9d31"
setup = "The AWS CloudTrail integration must be enabled and configured to collect S3 management events (`s3.amazonaws.com`)."
severity = "medium"
tags = [
    "Domain: Cloud",
    "Data Source: AWS",
    "Data Source: Amazon Web Services",
    "Data Source: Amazon S3",
    "Use Case: Threat Detection",
    "Tactic: Collection",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "new_terms"

query = '''
data_stream.dataset: "aws.cloudtrail"
    and event.provider: "s3.amazonaws.com"
    and event.action: "PutBucketAcl"
    and event.outcome: "success"
    and not aws.cloudtrail.user_identity.type: "AWSService"
    and aws.cloudtrail.flattened.request_parameters.x-amz-acl: ("public-read" or "public-read-write")
    and not user_agent.original: (*Terraform* or *terraform* or "cloudformation.amazonaws.com" or *pulumi* or *Pulumi*)
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1530"
name = "Data from Cloud Storage"
reference = "https://attack.mitre.org/techniques/T1530/"

[rule.threat.tactic]
id = "TA0009"
name = "Collection"
reference = "https://attack.mitre.org/tactics/TA0009/"

[rule.new_terms]
field = "new_terms_fields"
value = ["aws.cloudtrail.user_identity.arn"]
[[rule.new_terms.history_window_start]]
field = "history_window_start"
value = "now-7d"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "aws.cloudtrail.user_identity.arn",
    "aws.cloudtrail.user_identity.type",
    "event.action",
    "event.outcome",
    "aws.cloudtrail.request_parameters",
    "source.ip",
    "cloud.region",
    "cloud.account.id",
]

[metadata]
creation_date = "2025/10/30"
integration = ["aws"]
maturity = "production"
updated_date = "2026/04/10"

[rule]
author = ["Elastic"]
description = """
Detects when an Amazon S3 bucket policy is modified to grant public access using a wildcard (Principal:"*") statement.
This rule analyzes PutBucketPolicy events that include both Effect=Allow and Principal:"*" in the request parameters,
indicating that permissions were extended to all identities, potentially making the bucket or its contents publicly
accessible. Publicly exposing an S3 bucket is one of the most common causes of sensitive data leaks in AWS environments.
Adversaries or misconfigurations can leverage this exposure to exfiltrate data, host malicious content, or collect
credentials and logs left in open storage.
"""
event_category_override = "event.type"
false_positives = [
    """
    This rule does not differentiate by itself whether the same policy also includes Deny statements that restrict
    public access. If a policy includes both Effect=Allow and Effect=Deny with Principal:"*", this rule may still
    trigger. Such cases should be manually analyzed to verify whether the Deny statement effectively negates the public
    exposure.
    """,
]
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
language = "eql"
license = "Elastic License v2"
name = "AWS S3 Bucket Policy Added to Allow Public Access"
note = """## Triage and analysis

### Investigating AWS S3 Bucket Policy Added to Allow Public Access

This rule detects modifications to Amazon S3 bucket policies using the `PutBucketPolicy` API where both `Effect=Allow`
and `Principal:"*"` are present. This effectively grants permissions to all AWS identities, including unauthenticated users.  
Such exposure can result in sensitive data leaks, ransomware staging, or unauthorized data collection.  

This rule focuses on policy-based exposure rather than ACL-based or block-public-access configurations.  
It will still trigger if a bucket policy includes both `Effect=Allow` and `Effect=Deny` statements that contain `Principal:"*"`. Those cases should be reviewed to confirm whether the `Deny` statement restricts access sufficiently.

#### Possible investigation steps

- **Identify the Actor**
  - Review `aws.cloudtrail.user_identity.arn`, `aws.cloudtrail.user_identity.type`, and `aws.cloudtrail.user_identity.access_key_id` to identify who made the change.
  - Validate whether this user or role is authorized to modify S3 bucket policies.
  - Examine `source.ip`, `source.geo`, and `user_agent.original` to identify unusual sources or tools (e.g., CLI or SDK-based activity).

- **Analyze the Bucket Policy Content**
  - Extract the full JSON from `aws.cloudtrail.request_parameters`.
  - Look for `Effect=Allow` statements paired with `Principal:"*"`.
  - Identify what permissions were granted — for example:
    - `s3:GetObject` (read access to all objects)
    - `s3:PutObject` or `s3:*` (read/write access)
  - Check if the policy also contains any `Effect=Deny` statements targeting `Principal:"*"`.  
    If present, determine whether these statements fully restrict public access, if so this alert can be closed.

- **Assess the Impact and Scope**
  - Review `aws.cloudtrail.resources.arn` to confirm which bucket was affected.
  - Determine if the bucket contains sensitive, regulated, or internal data.
  - Check for `PutPublicAccessBlock` or `DeleteBucketPolicy` events in close proximity, as attackers often disable protections first.

- **Correlate with Related Activity**
  - Review CloudTrail for `GetObject` or `ListBucket` events following the policy change to identify possible data access.
  - Look for policy changes across multiple buckets by the same actor, suggesting scripted or automated misuse.

- **Validate Intent**
  - Contact the bucket owner or application owner to determine whether this change was part of a legitimate operation (e.g., website hosting or public dataset publishing).
  - Review change management logs or ticketing systems for documented approval.

### False positive analysis

- **Intended Public Access**
  - Buckets used for static websites, documentation hosting, or public datasets may legitimately contain `Principal:"*"`.
  - Verify such use cases are covered by organizational policies and hardened with least-privilege permissions (e.g., read-only).

- **Effect=Deny Condition**
  - This rule does not currently exclude cases where `Principal:"*"` appears under both `Effect=Allow` and `Effect=Deny`.
  - Analysts should review the bucket policy JSON to confirm whether `Deny` statements restrict the same resources.
  - If access remains blocked to unauthorized entities, the alert can be dismissed as a false positive.

- **Automation or Pipeline Behavior**
  - Some automated pipelines or templates (e.g., Terraform, CloudFormation) create temporary policies with `Principal:"*"` for bootstrap access.  
    Review timing, user agent, and role identity for expected automation patterns.

### Response and remediation

- **Containment**
  - If exposure is unauthorized, immediately remove the public access policy using:
    - `aws s3api delete-bucket-policy` or restore from version control.
  - Re-enable Block Public Access at the account and bucket levels.

- **Investigation and Scoping**
  - Review CloudTrail and S3 access logs to identify whether external IPs accessed bucket objects after the policy change.
  - Search for similar policy updates across other buckets in the same account or region.
  - Validate AWS Config history for baseline deviations and determine how long the bucket was publicly exposed.

- **Recovery and Hardening**
  - Reinstate the intended bucket policy from backups or version control.
  - Implement AWS Config rules:
    - `s3-bucket-public-read-prohibited`
    - `s3-bucket-public-write-prohibited`
  - Restrict `s3:PutBucketPolicy` permissions to trusted administrative roles.
  - Apply service control policies (SCPs) that prevent policies containing `Principal:"*"` unless explicitly approved.
  - Enable continuous monitoring through AWS Security Hub or GuardDuty for any new public exposure events.

### Additional information
  - **[AWS IR Playbooks](https://github.com/aws-samples/aws-incident-response-playbooks/blob/c151b0dc091755fffd4d662a8f29e2f6794da52c/playbooks/)** 
  - **[AWS Customer Playbook Framework](https://github.com/aws-samples/aws-customer-playbook-framework/tree/a8c7b313636b406a375952ac00b2d68e89a991f2/docs)** 
  - **Security Best Practices:** [AWS Knowledge Center – Security Best Practices](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/).
"""
references = [
    "https://stratus-red-team.cloud/attack-techniques/AWS/aws.exfiltration.s3-backdoor-bucket-policy/",
    "https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketPolicy.html",
]
risk_score = 47
rule_id = "618bb351-00f0-467b-8956-8cace8b81f07"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Data Source: AWS",
    "Data Source: Amazon Web Services",
    "Data Source: AWS S3",
    "Use Case: Threat Detection",
    "Tactic: Exfiltration",
    "Tactic: Collection",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
info where data_stream.dataset == "aws.cloudtrail"
    and event.provider == "s3.amazonaws.com"
    and event.action == "PutBucketPolicy" 
    and event.outcome == "success"
    and stringContains(aws.cloudtrail.request_parameters, "Effect=Allow")
    and stringContains(aws.cloudtrail.request_parameters, "Principal=\\*")
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1537"
name = "Transfer Data to Cloud Account"
reference = "https://attack.mitre.org/techniques/T1537/"


[rule.threat.tactic]
id = "TA0010"
name = "Exfiltration"
reference = "https://attack.mitre.org/tactics/TA0010/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1530"
name = "Data from Cloud Storage"
reference = "https://attack.mitre.org/techniques/T1530/"


[rule.threat.tactic]
id = "TA0009"
name = "Collection"
reference = "https://attack.mitre.org/tactics/TA0009/"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user_agent.original",
    "source.ip",
    "aws.cloudtrail.user_identity.arn",
    "aws.cloudtrail.user_identity.type",
    "aws.cloudtrail.user_identity.access_key_id",
    "aws.cloudtrail.resources.arn",
    "aws.cloudtrail.resources.type",
    "event.action",
    "event.outcome",
    "cloud.account.id",
    "cloud.region",
    "aws.cloudtrail.request_parameters",
    "aws.cloudtrail.response_elements",
]

[metadata]
creation_date = "2022/07/22"
integration = ["endpoint", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2026/03/24"

[transform]
[[transform.osquery]]
label = "Osquery - Retrieve File Listing Information"
query = "SELECT * FROM file WHERE (path LIKE '/etc/init.d/%' OR path LIKE '/etc/rc%.d/%')"

[[transform.osquery]]
label = "Osquery - Retrieve Additional File Listing Information"
query = """
SELECT f.path, u.username AS file_owner, g.groupname AS group_owner, datetime(f.atime, 'unixepoch') AS
file_last_access_time, datetime(f.mtime, 'unixepoch') AS file_last_modified_time, datetime(f.ctime, 'unixepoch') AS
file_last_status_change_time, datetime(f.btime, 'unixepoch') AS file_created_time, f.size AS size_bytes FROM file f LEFT
JOIN users u ON f.uid = u.uid LEFT JOIN groups g ON f.gid = g.gid WHERE (path LIKE '/etc/init.d/%' OR path LIKE
'/etc/rc%.d/%')
"""

[[transform.osquery]]
label = "Osquery - Retrieve Running Processes by User"
query = "SELECT pid, username, name FROM processes p JOIN users u ON u.uid = p.uid ORDER BY username"

[[transform.osquery]]
label = "Osquery - Retrieve Crontab Information"
query = "SELECT * FROM crontab"

[[transform.osquery]]
label = "Osquery - Retrieve Listening Ports"
query = "SELECT pid, address, port, socket, protocol, path FROM listening_ports"

[[transform.osquery]]
label = "Osquery - Retrieve Open Sockets"
query = "SELECT pid, family, remote_address, remote_port, socket, state FROM process_open_sockets"

[[transform.osquery]]
label = "Osquery - Retrieve Information for a Specific User"
query = "SELECT * FROM users WHERE username = {{user.name}}"

[[transform.osquery]]
label = "Osquery - Investigate the Account Authentication Status"
query = "SELECT * FROM logged_in_users WHERE user = {{user.name}}"


[rule]
author = ["Elastic"]
description = """
Detects the use of the chkconfig binary to manually add a service for management by chkconfig. Threat actors may utilize
this technique to maintain persistence on a system. When a new service is added, chkconfig ensures that the service has
either a start or a kill entry in every runlevel and when the system is rebooted the service file added will run
providing long-term persistence.
"""
from = "now-9m"
index = ["endgame-*", "logs-endpoint.events.process*", "logs-sentinel_one_cloud_funnel.*"]
language = "eql"
license = "Elastic License v2"
name = "Chkconfig Service Add"
note = """## Triage and analysis

### Investigating Chkconfig Service Add
Service files are configuration files in Linux systems used to define and manage system services. The `Chkconfig` binary can be used to manually add, delete or modify a service. 

Malicious actors can leverage services to achieve persistence by creating or modifying service files to execute malicious commands or payloads during system startup. This allows them to maintain unauthorized access, execute additional malicious activities, or evade detection.

This rule monitors the usage of the `chkconfig` binary to manually add a service for management by `chkconfig`, potentially indicating the creation of a persistence mechanism.

> **Note**:
> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/current/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.

#### Possible Investigation Steps

- Investigate the service that was created or modified.
- Investigate the currently enabled system services through the following commands `sudo chkconfig --list | grep on` and `sudo systemctl list-unit-files`.
- Investigate the status of potentially suspicious services through the `chkconfig --list service_name` command. 
- Search for the `rc.d` or `init.d` service files that were created or modified, and analyze their contents.
- Investigate whether any other files in any of the available `rc.d` or `init.d` directories have been altered through OSQuery.
  - $osquery_0
  - $osquery_1
- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence and whether they are located in expected locations.
  - $osquery_2
- Investigate syslog through the `sudo cat /var/log/syslog | grep 'LSB'` command to find traces of the LSB header of the script (if present). If syslog is being ingested into Elasticsearch, the same can be accomplished through Kibana.
- Investigate other alerts associated with the user/host during the past 48 hours.
- Validate the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.
- Investigate whether the altered scripts call other malicious scripts elsewhere on the file system. 
  - If scripts or executables were dropped, retrieve the files and determine if they are malicious:
    - Use a private sandboxed malware analysis system to perform analysis.
      - Observe and collect information about the following activities:
        - Attempts to contact external domains and addresses.
          - Check if the domain is newly registered or unexpected.
          - Check the reputation of the domain or IP address.
        - File access, modification, and creation activities.
        - Cron jobs, services and other persistence mechanisms.
            - $osquery_3
- Investigate abnormal behaviors by the subject process/user such as network connections, file modifications, and any other spawned child processes.
  - Investigate listening ports and open sockets to look for potential command and control traffic or data exfiltration.
    - $osquery_4
    - $osquery_5
  - Identify the user account that performed the action, analyze it, and check whether it should perform this kind of action.
    - $osquery_6
- Investigate whether the user is currently logged in and active.
    - $osquery_7

### False Positive Analysis

- If this activity is related to new benign software installation activity, consider adding exceptions — preferably with a combination of user and command line conditions.
- If this activity is related to a system administrator who uses the `chkconfig` binary for administrative purposes, consider adding exceptions for this specific administrator user account. 
- Try to understand the context of the execution by thinking about the user, machine, or business purpose. A small number of endpoints, such as servers with unique software, might appear unusual but satisfy a specific business need.

### Related Rules

- Suspicious File Creation in /etc for Persistence - 1c84dd64-7e6c-4bad-ac73-a5014ee37042
- Potential Persistence Through Run Control Detected - 0f4d35e4-925e-4959-ab24-911be207ee6f
- Potential Persistence Through init.d Detected - 474fd20e-14cc-49c5-8160-d9ab4ba16c8b
- New Systemd Timer Created - 7fb500fa-8e24-4bd1-9480-2a819352602c
- New Systemd Service Created by Previously Unknown Process - 17b0a495-4d9f-414c-8ad0-92f018b8e001

### Response and remediation

- Initiate the incident response process based on the outcome of the triage.
- Isolate the involved host to prevent further post-compromise behavior.
- If the triage identified malware, search the environment for additional compromised hosts.
  - Implement temporary network rules, procedures, and segmentation to contain the malware.
  - Stop suspicious processes.
  - Immediately block the identified indicators of compromise (IoCs).
  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
- Delete the service/timer or restore its original configuration.
- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
- Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
"""
references = ["https://www.intezer.com/blog/research/lightning-framework-new-linux-threat/"]
risk_score = 47
rule_id = "b910f25a-2d44-47f2-a873-aabdc0d355e6"
setup = """## Setup

This rule requires data coming in from Elastic Defend.

### Elastic Defend Integration Setup
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.

#### Prerequisite Requirements:
- Fleet is required for Elastic Defend.
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).

#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
- Go to the Kibana home page and click "Add integrations".
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
- Click "Add Elastic Defend".
- Configure the integration name and optionally add a description.
- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
- Click "Save and Continue".
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
"""
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: Linux",
    "Use Case: Threat Detection",
    "Tactic: Persistence",
    "Threat: Lightning Framework",
    "Data Source: Elastic Endgame",
    "Data Source: Elastic Defend",
    "Data Source: SentinelOne",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"
query = '''
process where host.os.type == "linux" and event.action in ("exec", "exec_event", "start") and
process.executable != null and
( 
  (process.executable : "/usr/sbin/chkconfig" and process.args : "--add") or
  (process.args : "*chkconfig" and process.args : "--add")
) and not (
  process.parent.name in ("rpm", "qualys-scan-util", "qualys-cloud-agent", "update-alternatives") or
  process.parent.executable in ("/opt/commvault/.gxsetup/silent_install/install", "/usr/sbin/alternatives") or
  process.parent.args : ("/var/tmp/rpm*", "/var/lib/waagent/*", "/usr/bin/puppet*") or
  process.args in ("jexec", "sapinit", "httpd", "dbora" , "selfprotection")
)
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1037"
name = "Boot or Logon Initialization Scripts"
reference = "https://attack.mitre.org/techniques/T1037/"

[[rule.threat.technique]]
id = "T1543"
name = "Create or Modify System Process"
reference = "https://attack.mitre.org/techniques/T1543/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[rule]
description = """
Identifies when curl is used to download a JavaScript payload and subsequently execute it using the built-in osascript
utility. An adversary may use this technique to execute their malicious payload and obtain initial access to an
endpoint.
"""
id = "871f0c30-a7c5-40a5-80e3-a50c6714632f"
license = "Elastic License v2"
name = "Curl Download and Execution of JavaScript Payload"
os_list = ["macos"]
reference = ["https://github.com/its-a-feature/Mythic"]
version = "1.0.46"

query = '''
sequence by process.parent.entity_id with maxspan=15s
  [process where event.action == "exec" and
    process.name in ("curl", "nscurl") and process.args like ("-o", "--output", "-O", "--remote-name") and process.parent.name in~ ("bash", "zsh", "sh", "Terminal") and 
    not process.args like ("https://*.jamfcloud.com/JSSResource/computercommands/command/BlankPush/id/*", "POST")]
  [process where event.action == "exec" and process.name == "osascript" and
    (process.args == "-e" or process.args == "-l") and
    not process.Ext.effective_parent.executable in
                                                  ("/usr/local/jamf/bin/jamf",
                                                   "/Library/Addigy/auditor",
                                                   "/opt/jc/bin/jumpcloud-agent",
                                                   "/Library/Intune/Microsoft Intune Agent.app/Contents/MacOS/IntuneMdmDaemon", 
                                                   "/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfDaemon.app/Contents/MacOS/JamfDaemon", 
                                                   "/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfManagementService.app/Contents/MacOS/JamfManagementService") and 
    not process.command_line : ("osascript -e display dialog \"Please advise your Support Representative of the following error:\\r\\r• Dialog Team ID verification failed\\r\\r\" with title \"Setup Your Mac: Error\" buttons {\"Close\"} with icon caution", 
                                "osascript -e display dialog \"Please advise your Support Representative of the following error:\\r\\r• Dialog Team ID verification failed\\r\\r\" with title \"App Auto-Patch: Error\" buttons {\"Close\"} with icon caution") and
    not process.parent.command_line == "/bin/bash /Library/Management/super/super"
    ]
'''

min_endpoint_version = "8.16.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.007"
name = "JavaScript"
reference = "https://attack.mitre.org/techniques/T1059/007/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "8.16.0"

[rule]
description = """
Identifies an unsigned process enabling the SeDebugPrivilege required to debug and adjust the memory of a process owned
by another account.
"""
id = "82547ffb-7186-4317-8a15-599a291d1f73"
license = "Elastic License v2"
name = "Debug Privilege Enabled by a Low Reputation Process"
os_list = ["windows"]
reference = [
    "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4703",
]
version = "1.0.4"

query = '''
sequence by process.entity_id with maxspan=1m
[process where event.action == "start" and
  (process.Ext.relative_file_creation_time <= 900 or process.Ext.relative_file_name_modify_time <= 900) and
  (process.code_signature.trusted == false or process.code_signature.exists == false) and not process.code_signature.status like "errorCode_endpoint*" and 
  not process.parent.executable : "C:\\Program Files (x86)\\Common Files\\VAudio\\Interop.Exe" and
  not process.hash.sha256 in ("6ab0815affa73b779a0da5bfff3e8498f279a4254ca67948d068811d58b89118",
                              "167d04f2824b3af925c2d34228f2c5b3aa44dd3ae0b8e0a146076c0b7794f56c",
                              "555dc00f5988f1106adc1254aca6fab54ed25a0a4c1dff787f1b85a50c686d55",
                              "2ab171f42975d7539965d96c0750d43be14335e8f604a403cd8574ef7936e700")]
[any where event.category == "iam" and event.action == "token_right_adjusted" and winlog.event_data.EnabledPrivilegeList == "SeDebugPrivilege" and
 not winlog.event_data.EnabledPrivilegeList == "SeLockMemoryPrivilege"]
'''

min_endpoint_version = "8.18.0"
optional_actions = []
reputation = true
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1134"
name = "Access Token Manipulation"
reference = "https://attack.mitre.org/techniques/T1134/"


[threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[internal]
min_endpoint_version = "8.18.0"

[rule]
description = """
Identifies attempts to call a System call directly using assembly instructions and from unusual native system module
ntdll. This may indicate the use of direct system calls to evade endpoint security solutions hooking Windows APIs.
"""
id = "e0abc200-a578-4e3a-bd1a-eded0c32a245"
license = "Elastic License v2"
name = "Direct Syscall via Assembly Bytes"
os_list = ["windows"]
version = "1.0.24"

query = '''
any where process.executable != null and
(
(event.category in ("registry", "file") and
 process.thread.Ext.call_stack_summary like "?*" and not process.thread.Ext.call_stack_summary like "ntdll.dll*" and
 not process.thread.Ext.call_stack_summary in ("Unknown", "Unknown|Unbacked") and 
 /* mov r10,rcx, mov eax,ssn, syscall */
 _arraysearch(process.thread.Ext.call_stack, $entry,
               $entry.callsite_leading_bytes like ("*4c8bd1b8??????000f05", "*4989cab8??????000f05", "*4c8bd10f05", "*4989ca0f05"))) or

 (event.category == "process" and
  process.parent.thread.Ext.call_stack_summary like "?*" and not process.parent.thread.Ext.call_stack_summary like "ntdll.dll*" and
  /* mov r10,rcx, mov eax,ssn, syscall */
  _arraysearch(process.parent.thread.Ext.call_stack, $entry,
               $entry.callsite_leading_bytes : ("*4c8bd1b8??????000f05", "*4989cab8??????000f05", "*4c8bd10f05", "*4989ca0f05")))
) and
not process.executable :
            ("?:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
             "?:\\Program Files\\Google\\Chrome\\Application\\chrome.exe",
             "?:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe",
             "?:\\Program Files (x86)\\Chromium\\Application\\chrome.exe",
             "?:\\Program Files\\Mozilla Firefox\\firefox.exe",
             "?:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe",
             "?:\\Windows\\System32\\inetsrv\\w3wp.exe",
             "?:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe",
             "?:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\acrocef_*\\AcroCEF.exe",
             "?:\\Program Files (x86)\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe",
             "?:\\Program Files (x86)\\Adobe\\Acrobat DC\\Acrobat\\acrocef_*\\AcroCEF.exe",
             "?:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe",
             "?:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe",
             "?:\\Program Files\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe",
             "?:\\Program Files\\BackupClient\\TrayMonitor\\MmsMonitor.exe",
             "?:\\Program Files (x86)\\Google\\Update\\GoogleUpdate.exe",
             "?:\\Program Files\\Google\\Update\\GoogleUpdate.exe",
             "?:\\Program Files\\BackupClient\\TrayMonitor\\MmsMonitor.exe",
             "?:\\Program Files (x86)\\BackupClient\\TrayMonitor\\MmsMonitor.exe", 
             "?:\\Program Files\\Mozilla Firefox\\updated\\firefox.exe", 
             "?:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\*\\msedgewebview2.exe", 
             "?:\\Program Files\\Microsoft\\EdgeWebView\\Application\\*\\msedgewebview2.exe",
             "?:\\Users\\*\\AppData\\Local\\Microsoft\\EdgeWebView\\Application\\*\\msedgewebview2.exe", 
             "?:\\Users\\*\\AppData\\Local\\Microsoft\\Teams\\*\\Teams.exe", 
             "?:\\Program Files\\Veeam\\Endpoint Backup\\Veeam.EndPoint.Manager.exe",
             "?:\\Program Files\\Netmarble\\Netmarble Game\\*",
             "?:\\Program Files (x86)\\SolarWinds\\Agent\\Plugins\\ADMProbe\\SolarWinds.ADM.AgentPlugin.exe",
             "?:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe",
             "?:\\Program Files\\New Relic\\newrelic-infra\\newrelic-integrations\\nr-winpkg.exe") and
 not (process.code_signature.subject_name in~ 
               ("Google LLC", "Mozilla Corporation", "Rockstar Games, Inc.", "Commvault Systems, Inc.", "Galooli Ltd", "TOTVS S.A", "ROBLOX CORPORATION",
                "Roblox Corporation", "SIGNODE PACKAGING GROUP NZ", "GraphOn Corporation", "Blizzard Entertainment, Inc.", "343 Industries (Microsoft Corporation)") and
      process.code_signature.trusted == true) and
 not (process.executable : "?:\\Windows\\System32\\LogonUI.exe" and process.parent.executable : "?:\\Windows\\System32\\winlogon.exe") and
 not (process.executable : "?:\\Windows\\System32\\auditpol.exe" and process.parent.executable : "?:\\Program Files\\ColorTokens\\LGM\\ct-lgm.exe") and
 not (process.executable : "?:\\Windows\\Microsoft.NET\\Framework*\\cvtres.exe" and process.code_signature.trusted == true and process.code_signature.subject_name : "Microsoft Corporation") and
 not (process.executable : "?:\\Windows\\System32\\quser.exe" and process.parent.executable : "?:\\Windows\\LTSvc\\LTSVC.exe") and
 not (process.executable : "?:\\Windows\\SysWOW64\\sc.exe" and process.parent.executable : "?:\\Program Files (x86)\\NinjaRMMAgent\\NinjaRMMAgent.exe") and
 not (process.executable : "?:\\Windows\\Microsoft.NET\\Framework*\\csc.exe" and process.code_signature.trusted == true and process.code_signature.subject_name : "Microsoft Corporation") and
 not (process.executable : "?:\\Windows\\Microsoft.NET\\Framework*\\ngen.exe" and process.code_signature.trusted == true and process.code_signature.subject_name : "Microsoft Corporation") and
 not (process.executable : "?:\\Windows\\System32\\cscript.exe" and process.parent.executable : "?:\\Program Files\\Microsoft Monitoring Agent\\Agent\\MonitoringHost.exe") and
 /* chromium and last one for Acrobat */
 not _arraysearch(process.thread.Ext.call_stack, $entry,
                   $entry.callsite_trailing_bytes :
                         ("c3cd2ec30f1f84000000000000000000000000000000000000000000000000000000000000000000000000004c8bd1b82a000000f604250803fe7f0175030f05",
                          "c3cd2ec30f1f8400000000004c8bd1b829000000f604250800000000000000000000000000000000000000004c8bd1b82a000000f604250803fe7f0175030f05", 
                          "c3cd2ec30f1f84000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", 
                          "c30f1f4400004c8bd1b8280000000f05c30f1f44000000000000000000000000000000000000000000000000000000000000000000004c8bd1b8290000000f05", 
                          "c30f1f4400004c8bd1b8280000000f05c30f1f4400004c8bd1b8290000000f05c30f00000000000000000000000000000000000000004c8bd1b8290000000f05", 
                          "c30f1f440000ff25000000007004fd89ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
                          "c3ff25000000005b14*7f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", 
                          "ff2554000000cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc4ecc4c8bd1b8*", 
                          "c30f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", 
                          "c341514150525166660f1f840000000000909090e81c0000005c004400650076006900630065005c00470047005300530052000000681a001c00488bc46a006a",
                          "e99b3808200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000")) and
 not _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info: "?:\\Windows\\WinSxS\\Temp\\PendingDeletes\\$$DeleteMe*") and
 not _arraysearch(process.parent.thread.Ext.call_stack, $entry, $entry.symbol_info: "?:\\Windows\\WinSxS\\Temp\\PendingDeletes\\$$DeleteMe*") and
 not _arraysearch(process.parent.thread.Ext.call_stack, $entry,
                   $entry.callsite_trailing_bytes like
                                 ("ff2554000000cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc4ecc4c8bd1b8*",
                                  "ff2500000000da12d2bdf97f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
                                  "c30f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
                                  "e9cb2e08200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"))
'''

min_endpoint_version = "8.10.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"

[metadata]
creation_date = "2026/05/14"
integration = ["google_workspace"]
maturity = "production"
min_stack_comments = "ES|QL FIRST and LAST aggregation functions are GA in 9.4."
min_stack_version = "9.4.0"
updated_date = "2026/05/14"

[rule]
author = ["Elastic"]
description = """
Detects successful Google Workspace sign-ins for the same user from two geographically separated locations within a
90-minute window, where the implied travel speed between the two points exceeds what is physically possible (>=800 km/h,
faster than modern commercial airliners) and the geographic separation is at least 500 km. This pattern indicates either
VPN/proxy use or an adversary signing in to a compromised account from a different location than the legitimate user.
"""
false_positives = [
    """
    Users on VPN or proxy egress that geo-resolves through a region distant from the user's physical location. Mobile
    clients on cellular carrier networks that peer through regional hubs may geo-resolve to a different region than the
    user's physical location.
    """,
]
from = "now-180m"
interval = "30m"
language = "esql"
license = "Elastic License v2"
name = "Google Workspace Impossible Travel Login"
note = """## Triage and analysis

### Investigating Google Workspace Impossible Travel Login

Google Workspace is accessible globally; legitimate users authenticate from one location at a time. Two successful sign-ins for the same user separated by a distance and time delta implying travel faster than a commercial airliner cannot be the same human being physically moving, and indicate either a VPN/proxy egress mismatch or a compromised account being accessed from a separate location by an adversary.

### Possible investigation steps

- Identify the user (`user.email`) and the geographic separation observed: `Esql.distance_km`, `Esql.travel_kmh`, `Esql.window_minutes` (bbox path over region centroids), and the set of distinct countries, regions, and cities (`Esql.source_geo_country_name_values`, `Esql.source_geo_region_name_values`, `Esql.source_geo_city_name_values`).
- Cross-check `Esql.honest_distance_km`, `Esql.honest_travel_kmh`, `Esql.honest_window_minutes` these measure the real great-circle distance between the user's actual first and last sign-in events with timestamps locked to those same events. When the honest distance is small but the bbox distance is large, the user appeared in an outlier region in the middle of the window (A->B->A pattern -- typical AiTM kit replay). When both agree, it's a clean two-region case.
- Pull all `google_workspace.login` events for the user across the alert window. Sort by `@timestamp` and inspect each `source.ip`, `source.as.organization.name`, `source.geo.country_name`, and `user_agent.original` (when present).
- Determine which sign-ins are consistent with the user's baseline (corporate VPN egress, home ISP, mobile carrier) and which are not.
- For each non-baseline sign-in: check the ASN. Hosting-provider ASNs (Clouvider, Host Telecom, Alibaba, cheap-VPS providers) for interactive sign-ins are high-fidelity suspicious because legitimate end users do not typically egress through those networks.
- Cross-reference `logs-google_workspace.token` for `event.action: authorize` events from the same `user.email` around the same time. An OAuth grant minted from a non-baseline ASN immediately after a non-baseline sign-in is the AiTM kit signature.
- Check `logs-google_workspace.user_accounts` for `2sv_enroll`, recovery email/phone additions, or other state changes that an attacker would make to establish persistence.
- Confirm with the user whether the sign-ins are theirs (VPN, travel) or unexpected.

### False positive analysis

- Users on VPN or proxy infrastructure egressing through a distant region: validate against the user's known VPN ranges and consider excluding by ASN.
- Mobile carriers that geo-resolve outside the user's home country (cellular providers often peer through regional hubs): validate by user-agent (mobile UA fingerprint) and source ASN (carrier networks).

### Response and remediation

- If the pattern is unexpected, suspend the user immediately, then revoke OAuth tokens (`DELETE /admin/directory/v1/users/<upn>/tokens/<clientId>`), reset password, and clear recovery email/phone.
- Investigate any `google_workspace.token: authorize` events fired around the same window for tokens minted to the adversary.
- Review `google_workspace.device` for any `DEVICE_REGISTER_UNREGISTER_EVENT` with `account_state: REGISTERED` near the same window: kit-side device registrations are a persistence vector that survives password rotation if the underlying OAuth tokens were not revoked.
- Cross-check `logs-gcp.audit-*` if the tenant exposes any GCP resources to the user: look for `authenticationInfo.principalEmail` matching the user from a non-baseline `callerIp`.
"""
references = [
    "https://www.elastic.co/security-labs/google-workspace-attack-surface-part-one",
    "https://www.elastic.co/security-labs/google-workspace-attack-surface-part-two",
    "https://security.googlecloudcommunity.com/community-blog-42/detecting-impossible-travel-with-google-secops-part-1-3892",
]
risk_score = 73
rule_id = "aff74d85-5bfa-4ff1-ace2-4e3995a37cfa"
severity = "high"
tags = [
    "Domain: Cloud",
    "Domain: Identity",
    "Data Source: Google Workspace",
    "Data Source: Google Workspace Audit Logs",
    "Data Source: Google Workspace User log events",
    "Use Case: Threat Detection",
    "Use Case: Identity and Access Audit",
    "Tactic: Initial Access",
    "Tactic: Credential Access",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "esql"

query = '''
// successful Google Workspace logins with country + region populated.
from logs-google_workspace.login-*
| where event.dataset == "google_workspace.login"
    and event.action == "login_success"
    and event.outcome == "success"
    and user.email is not null
    and source.geo.location is not null
    and source.geo.country_name is not null
    and source.geo.region_name is not null
| eval Esql.source_geo_lat = st_y(source.geo.location),
       Esql.source_geo_lon = st_x(source.geo.location)

// collapse each (user, country, region) into one centroid + the actual lat/lon
// of the first and last event in that region. FIRST/LAST lock coords to the
// timestamp ordering so we can later build the honest event pair.
| stats
    Esql.region_centroid_lat = avg(Esql.source_geo_lat),
    Esql.region_centroid_lon = avg(Esql.source_geo_lon),
    Esql.region_first_lat    = first(Esql.source_geo_lat, @timestamp),
    Esql.region_first_lon    = first(Esql.source_geo_lon, @timestamp),
    Esql.region_last_lat     = last(Esql.source_geo_lat,  @timestamp),
    Esql.region_last_lon     = last(Esql.source_geo_lon,  @timestamp),
    Esql.region_first_seen   = min(@timestamp),
    Esql.region_last_seen    = max(@timestamp),
    Esql.region_event_count  = count(*),
    Esql.region_city_values   = values(source.geo.city_name),
    Esql.region_asn_values    = values(source.`as`.organization.name),
    Esql.region_ip_values     = values(source.ip)
  by user.email,
     source.geo.country_name,
     source.geo.region_name

// roll up to the user. two parallel measurements:
// bbox: corners over region centroids.
// honest: real coords at the user's actual first and last events (nested FIRST/LAST).
| stats
    Esql.min_lat = min(Esql.region_centroid_lat),
    Esql.max_lat = max(Esql.region_centroid_lat),
    Esql.min_lon = min(Esql.region_centroid_lon),
    Esql.max_lon = max(Esql.region_centroid_lon),
    Esql.honest_first_lat = first(Esql.region_first_lat, Esql.region_first_seen),
    Esql.honest_first_lon = first(Esql.region_first_lon, Esql.region_first_seen),
    Esql.honest_last_lat  = last(Esql.region_last_lat,   Esql.region_last_seen),
    Esql.honest_last_lon  = last(Esql.region_last_lon,   Esql.region_last_seen),
    Esql.timestamp_first_seen = min(Esql.region_first_seen),
    Esql.timestamp_last_seen  = max(Esql.region_first_seen), // first arrival in last region > tighter bbox window
    Esql.honest_last_time     = max(Esql.region_last_seen),  // user's actual last event > honest window
    Esql.region_count  = count_distinct(source.geo.region_name),
    Esql.country_count = count_distinct(source.geo.country_name),
    Esql.event_count   = sum(Esql.region_event_count),
    Esql.source_geo_country_name_values     = values(source.geo.country_name),
    Esql.source_geo_region_name_values      = values(source.geo.region_name),
    Esql.source_geo_city_name_values        = values(Esql.region_city_values),
    Esql.source_as_organization_name_values = values(Esql.region_asn_values),
    Esql.source_ip_values                   = values(Esql.region_ip_values)
  by user.email

// need at least 2 regions to have anything to compare. cap at 5 because regions
// are finer-grained than countries (a traveling user can hit 3-4 in 90m via
// carrier hub bouncing) > bbox drift stays bounded below this.
| where Esql.region_count >= 2 and Esql.region_count <= 5

// bbox path (primary trigger): corners over region centroids.
| eval Esql.p1 = to_geopoint(concat("POINT(", to_string(Esql.min_lon), " ", to_string(Esql.min_lat), ")")),
       Esql.p2 = to_geopoint(concat("POINT(", to_string(Esql.max_lon), " ", to_string(Esql.max_lat), ")"))
| eval Esql.distance_km    = round(st_distance(Esql.p1, Esql.p2) / 1000.0, 0),
       Esql.window_minutes = date_diff("minute", Esql.timestamp_first_seen, Esql.timestamp_last_seen),
       Esql.travel_kmh     = case(Esql.window_minutes > 0,
                                  round(Esql.distance_km * 60.0 / Esql.window_minutes, 0), null)

// honest pair (triage signal): real coords at the user's actual first and last
// events, time locked to those same two events.
| eval Esql.honest_p1 = to_geopoint(concat("POINT(", to_string(Esql.honest_first_lon), " ", to_string(Esql.honest_first_lat), ")")),
       Esql.honest_p2 = to_geopoint(concat("POINT(", to_string(Esql.honest_last_lon),  " ", to_string(Esql.honest_last_lat),  ")"))
| eval Esql.honest_distance_km     = round(st_distance(Esql.honest_p1, Esql.honest_p2) / 1000.0, 0),
       Esql.honest_window_minutes  = date_diff("minute", Esql.timestamp_first_seen, Esql.honest_last_time),
       Esql.honest_travel_kmh      = case(Esql.honest_window_minutes > 0,
                                          round(Esql.honest_distance_km * 60.0 / Esql.honest_window_minutes, 0), null)

// 500 km separation + faster than a commercial airliner. bbox is the trigger
// honest fields are kept purely as triage signal.
| where Esql.distance_km >= 500 and Esql.travel_kmh >= 800

| keep user.email,
    Esql.source_geo_country_name_values,
    Esql.source_geo_region_name_values,
    Esql.source_geo_city_name_values,
    Esql.source_as_organization_name_values,
    Esql.source_ip_values,
    Esql.country_count,
    Esql.region_count,
    Esql.event_count,
    Esql.timestamp_first_seen,
    Esql.timestamp_last_seen,
    Esql.window_minutes,
    Esql.distance_km,
    Esql.travel_kmh,
    Esql.honest_distance_km,
    Esql.honest_travel_kmh,
    Esql.honest_window_minutes
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"
[[rule.threat.technique.subtechnique]]
id = "T1078.004"
name = "Cloud Accounts"
reference = "https://attack.mitre.org/techniques/T1078/004/"



[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1528"
name = "Steal Application Access Token"
reference = "https://attack.mitre.org/techniques/T1528/"

[[rule.threat.technique]]
id = "T1557"
name = "Adversary-in-the-Middle"
reference = "https://attack.mitre.org/techniques/T1557/"


[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[rule.alert_suppression]
group_by = ["user.email"]
missing_fields_strategy = "suppress"

[rule.investigation_fields]
field_names = ["user.email"]

[rule.alert_suppression.duration]
unit = "m"
value = 180

[metadata]
creation_date = "2020/02/18"
integration = ["endpoint", "auditd_manager", "crowdstrike", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2026/03/24"

[rule]
author = ["Elastic"]
description = """
Hping ran on a Linux host. Hping is a FOSS command-line packet analyzer and has the ability to construct network packets
for a wide variety of network security testing applications, including scanning and firewall auditing.
"""
false_positives = [
    """
    Normal use of hping is uncommon apart from security testing and research. Use by non-security engineers is very
    uncommon.
    """,
]
from = "now-9m"
index = [
    "auditbeat-*",
    "endgame-*",
    "logs-auditd_manager.auditd-*",
    "logs-crowdstrike.fdr*",
    "logs-endpoint.events.process*",
    "logs-sentinel_one_cloud_funnel.*",
]
language = "eql"
license = "Elastic License v2"
name = "Hping Process Activity"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Hping Process Activity

Hping is a versatile command-line tool used for crafting and analyzing network packets, often employed in network security testing. Adversaries may exploit Hping to perform reconnaissance, such as scanning networks or probing firewalls, to gather system information. The detection rule identifies Hping's execution on Linux systems by monitoring specific process start events, helping to flag potential misuse indicative of discovery tactics.

### Possible investigation steps

- Review the process start event details to confirm the execution of Hping, focusing on the process.name field to ensure it matches "hping", "hping2", or "hping3".
- Identify the user account associated with the Hping process by examining the user context in the event data to determine if the activity aligns with expected behavior for that user.
- Analyze the command line arguments used with the Hping process to understand the intent of the execution, such as specific network targets or options that indicate scanning or probing activities.
- Check the timing and frequency of the Hping process execution to assess whether it aligns with routine network testing schedules or if it appears anomalous.
- Investigate the source and destination IP addresses involved in the Hping activity to identify potential targets and assess whether they are internal or external to the organization.
- Correlate the Hping activity with other security events or alerts from the same host or network segment to identify any related suspicious activities or patterns.
- Consult with the system owner or network security team to verify if the Hping activity was authorized as part of legitimate security testing or if it requires further investigation.

### False positive analysis

- Routine network testing by IT teams may trigger the rule when using Hping for legitimate purposes. To manage this, create exceptions for known IP addresses or user accounts involved in regular network audits.
- Automated scripts or cron jobs that utilize Hping for monitoring network performance can lead to false positives. Identify these scripts and exclude their execution paths or associated user accounts from the detection rule.
- Security training exercises or penetration testing activities might involve Hping usage. Coordinate with security teams to whitelist these activities by specifying time windows or specific user roles.
- Development or testing environments where Hping is used for application testing can cause alerts. Exclude these environments by filtering based on hostnames or network segments associated with non-production systems.

### Response and remediation

- Immediately isolate the affected Linux host from the network to prevent further reconnaissance or potential lateral movement by the adversary.
- Terminate any active Hping processes on the affected host to stop ongoing packet crafting or network probing activities.
- Conduct a thorough review of network logs and firewall configurations to identify any unauthorized access or anomalies that may have been exploited using Hping.
- Perform a comprehensive scan of the affected system for additional indicators of compromise, such as unauthorized user accounts or unexpected changes to system files.
- Reset credentials and review access permissions for accounts on the affected host to ensure no unauthorized access persists.
- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if additional systems are affected.
- Update detection and monitoring systems to enhance visibility and alerting for similar reconnaissance activities, ensuring rapid response to future threats."""
references = ["https://en.wikipedia.org/wiki/Hping"]
risk_score = 47
rule_id = "90169566-2260-4824-b8e4-8615c3b4ed52"
setup = """## Setup

This rule requires data coming in from one of the following integrations:
- Elastic Defend
- Auditbeat

### Elastic Defend Integration Setup
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.

#### Prerequisite Requirements:
- Fleet is required for Elastic Defend.
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).

#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
- Go to the Kibana home page and click "Add integrations".
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
- Click "Add Elastic Defend".
- Configure the integration name and optionally add a description.
- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
- Click "Save and Continue".
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).

### Auditbeat Setup
Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.

#### The following steps should be executed in order to add the Auditbeat on a Linux System:
- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html).
- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html).
- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html).
- For complete “Setup and Run Auditbeat” information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html).
"""
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: Linux",
    "Use Case: Threat Detection",
    "Tactic: Discovery",
    "Data Source: Elastic Endgame",
    "Data Source: Elastic Defend",
    "Data Source: Auditd Manager",
    "Data Source: Crowdstrike",
    "Data Source: SentinelOne",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
process where host.os.type == "linux" and event.type == "start" and
 event.action in ("exec", "exec_event", "start", "ProcessRollup2", "executed", "process_started") and
 process.name in ("hping", "hping2", "hping3")
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1046"
name = "Network Service Discovery"
reference = "https://attack.mitre.org/techniques/T1046/"

[[rule.threat.technique]]
id = "T1082"
name = "System Information Discovery"
reference = "https://attack.mitre.org/techniques/T1082/"

[rule.threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"

[metadata]
creation_date = "2025/01/07"
integration = ["endpoint"]
maturity = "production"
updated_date = "2025/12/24"

[rule]
author = ["Elastic"]
building_block_type = "default"
description = """
This rule identifies Linux system information discovery via the "getconf" command. The "getconf" command is used to query system configuration
variables and system limits. Adversaries may use this command to gather information about the system, such as the page size, maximum number
of open files, and other system limits, to aid in further exploration and exploitation of the system.
"""
from = "now-119m"
index = ["logs-endpoint.events.process*"]
interval = "60m"
language = "kuery"
license = "Elastic License v2"
name = "Linux System Information Discovery via Getconf"
references = ["https://blog.exatrack.com/Perfctl-using-portainer-and-new-persistences/"]
risk_score = 21
rule_id = "90e5976d-ed8c-489a-a293-bfc57ff8ba89"
severity = "low"
tags = [
  "Domain: Endpoint",
  "OS: Linux",
  "Use Case: Threat Detection",
  "Tactic: Discovery",
  "Rule Type: BBR",
  "Data Source: Elastic Defend",
]
timestamp_override = "event.ingested"
type = "new_terms"
query = '''
event.category:process and host.os.type:linux and event.type:start and event.action:exec and process.name:getconf and not (
  process.parent.executable:(
    "/usr/bin/google_guest_agent_manager" or "/opt/commvault/Base64/cvlaunchd" or /usr/local/manageengine/uems_agent/bin/*
  ) or
  process.working_directory:(
    "/opt/oracle/mgmt_agent/agent_inst/bin" or "/var/lib/oracle-cloud-agent/plugins/oci-managementagent/polaris" or
    "/opt/commvault/Base/cvlaunchd" or "/opt/simpana" or "/opt/commvault" or "/opt/ITSPlatform/agentcore" or
    "/u01/app/oracle/EMBase/agent_inst/sysman/emd" or "/opt/abacus/lib"
  ) or
  process.parent.args:(
    /opt/oracle/mgmt_agent/agent_inst/* or "/opt/datadog-agent/bin/agent/agent" or "/usr/bin/byobu-status" or
    "/usr/local/nagios/libexec/check_ssl_cert" or "/usr/lib64/nagios/plugins/cpanel/check_ssl_cert"
  ) or
  process.parent.command_line:(
    "/bin/sh -s unix:cmd" or "ruby /usr/local/bundle/bin/bundle exec rackup"
  )
)
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1082"
name = "System Information Discovery"
reference = "https://attack.mitre.org/techniques/T1082/"

[rule.threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"

[rule.new_terms]
field = "new_terms_fields"
value = ["process.parent.executable"]

[[rule.new_terms.history_window_start]]
field = "history_window_start"
value = "now-5d"

[metadata]
creation_date = "2025/04/29"
integration = ["endpoint", "crowdstrike", "sentinel_one_cloud_funnel", "auditd_manager"]
maturity = "production"
updated_date = "2026/03/24"

[rule]
author = ["Elastic"]
description = """
This rule detects when a process executes the curl or wget command with an argument that includes the
api.telegram.org domain. This may indicate command and control behavior.
"""
from = "now-9m"
index = [
    "endgame-*",
    "logs-crowdstrike.fdr*",
    "logs-endpoint.events.process*",
    "logs-sentinel_one_cloud_funnel.*",
    "auditbeat-*",
    "logs-auditd_manager.auditd-*",
]
language = "eql"
license = "Elastic License v2"
name = "Linux Telegram API Request"
note = """ ## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Linux Telegram API Request

Telegram's API allows applications to interact with its messaging platform, often used for legitimate automation and communication tasks. However, adversaries may exploit this by using commands like `curl` or `wget` to communicate with Telegram's API for command and control purposes. The detection rule identifies such suspicious activity by monitoring for these commands accessing the Telegram API, indicating potential misuse.

### Possible investigation steps

- Review the process details to confirm the execution of the curl or wget command with the api.telegram.org domain in the command line, as indicated by the process.command_line field.
- Investigate the user account associated with the process to determine if the activity aligns with expected behavior or if the account may be compromised.
- Check the network activity logs to identify any additional connections to api.telegram.org or other suspicious domains, which may indicate further command and control communication.
- Analyze the parent process of the detected curl or wget command to understand how the process was initiated and if it was triggered by another suspicious activity.
- Examine the system for any other indicators of compromise, such as unusual file modifications or additional unauthorized processes, to assess the scope of potential malicious activity.

### False positive analysis

- Legitimate automation scripts or applications may use curl or wget to interact with Telegram's API for non-malicious purposes. Review the context and purpose of these scripts to determine if they are authorized.
- System administrators or developers might use curl or wget for testing or maintenance tasks involving Telegram's API. Verify if these activities are part of routine operations and consider excluding them if they are deemed safe.
- Monitoring tools or integrations that rely on Telegram for notifications could trigger this rule. Identify these tools and add exceptions for their known processes to prevent unnecessary alerts.
- If a specific user or service account frequently triggers this rule due to legitimate use, consider creating an exception for that account to reduce noise while maintaining security oversight.

### Response and remediation

- Immediately isolate the affected system from the network to prevent further communication with the Telegram API and potential data exfiltration.
- Terminate any suspicious processes identified as using curl or wget to interact with api.telegram.org to halt ongoing malicious activities.
- Conduct a thorough review of the affected system's process logs and network connections to identify any additional indicators of compromise or related malicious activity.
- Remove any unauthorized scripts or binaries that may have been used to automate the interaction with the Telegram API.
- Reset credentials and review access permissions for any accounts that were active on the affected system to prevent unauthorized access.
- Update and patch the affected system to the latest security standards to mitigate vulnerabilities that could be exploited in similar attacks.
- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if additional systems are affected.
"""
risk_score = 47
rule_id = "af1e36fe-0abd-4463-b5ec-4e276dec0b26"
setup = """## Setup

This rule requires data coming in from Elastic Defend.

### Elastic Defend Integration Setup
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.

#### Prerequisite Requirements:
- Fleet is required for Elastic Defend.
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).

#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
- Go to the Kibana home page and click "Add integrations".
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
- Click "Add Elastic Defend".
- Configure the integration name and optionally add a description.
- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
- Click "Save and Continue".
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).

Elastic Defend integration does not collect environment variable logging by default.
In order to capture this behavior, this rule requires a specific configuration option set within the advanced settings of the Elastic Defend integration.
 #### To set up environment variable capture for an Elastic Agent policy:
- Go to “Security → Manage → Policies”.
- Select an “Elastic Agent policy”.
- Click “Show advanced settings”.
- Scroll down or search for “linux.advanced.capture_env_vars”.
- Enter the names of environment variables you want to capture, separated by commas.
- For this rule the linux.advanced.capture_env_vars variable should be set to "HTTP_PROXY,HTTPS_PROXY,ALL_PROXY".
- Click “Save”.
After saving the integration change, the Elastic Agents running this policy will be updated and the rule will function properly.
For more information on capturing environment variables refer to the [helper guide](https://www.elastic.co/guide/en/security/current/environment-variable-capture.html).
"""
severity = "medium"
tags = [
  "Domain: Endpoint",
  "OS: Linux",
  "Use Case: Threat Detection",
  "Tactic: Command and Control",
  "Data Source: Elastic Defend",
  "Data Source: Elastic Endgame",
  "Data Source: Crowdstrike",
  "Data Source: SentinelOne",
  "Data Source: Auditd Manager",
  "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"
query = '''
process where host.os.type == "linux" and event.type == "start" and
event.action in ("exec", "start", "exec_event", "ProcessRollup2", "executed", "exec_event", "process_started") and
process.name in ("curl", "wget") and process.command_line like "*api.telegram.org*"
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"

[[rule.threat.technique.subtechnique]]
id = "T1071.001"
name = "Web Protocols"
reference = "https://attack.mitre.org/techniques/T1071/001/"

[[rule.threat.technique]]
id = "T1102"
name = "Web Service"
reference = "https://attack.mitre.org/techniques/T1102/"

[[rule.threat.technique.subtechnique]]
id = "T1102.002"
name = "Bidirectional Communication"
reference = "https://attack.mitre.org/techniques/T1102/002/"

[rule.threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"