Elastic rules: 1b

[rule]
description = """
Adversaries may use access tokens to operate under a different user or system security context to elevate privileges and
evade detection. For example, an attacker can create a new process that runs under the security context of another user
in order to perform actions they would not normally have privileges for.
"""
id = "8bdd523d-7a18-4706-bbe0-1a2525c6979f"
license = "Elastic License v2"
name = "Access Token Manipulation via Child Process"
os_list = ["windows"]
version = "1.0.30"

query = '''
sequence
 [process where event.action == "start" and
  process.Ext.token.integrity_level_name in ("low", "medium", "high") and user.id != null and
  (
    /* limit to recently created files or */
    process.Ext.relative_file_creation_time < 500 or

    /* commonly abused lolbins */
    process.name : ("rundll32.exe", "regsvr32.exe", "msbuild.exe")
   ) and

  not (process.executable : "C:\\Windows\\System32\\rundll32.exe" and process.parent.name : "explorer.exe" and
       process.args : ("printui.dll,PrintUIEntryDPIAware", "cryptext.dll,CryptExtAddPFX")) and

  not (process.code_signature.trusted == true and
       process.executable :
              ("?:\\Program Files\\*",
               "?:\\Program Files (x86)\\*",
               "?:\\Users\\*",
               "?:\\ProgramData\\*",
               "?:\\Windows\\Temp\\*")) and

  not (process.name : ("wscript.exe", "cscript.exe", "powershell.exe") and process.args : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*")) and 
  not (process.name : "regsvr32.exe" and process.args : "C:\\Windows\\System32\\mqrt.dll") and
  not (process.name : "rundll32.exe" and process.args : "22d8c27b-47a1-48d1-ad08-7da7abd79617" and process.parent.name : "dllhost.exe") and
  not process.parent.executable : "C:\\Windows\\System32\\msiexec.exe" and
  not process.parent.command_line : "C:\\Windows\\system32\\svchost.exe -k WebClientGroup" and
  not (process.parent.name : "explorer.exe" and process.executable : "\\Device\\Mup\\*.exe") and
  not (process.name : "rundll32.exe" and
       process.args : ("WSClient.dll,RefreshBannedAppsList", "xrWCbgnd.dll,LaunchBgTask", "uxtheme.dll,#64",
                       "C:\\Windows\\System32\\shell32.dll,SHCreateLocalServerRunDll", "C:\\Windows\\system32\\WerConCpl.dll,",
                       "C:\\WINDOWS\\system32\\WerConCpl.dll,", "InetCpl.cpl,ClearMyTracksByProcess",
                       "shell32.dll,SHCreateLocalServerRunDll", "Shell32.dll,Control_RunDLL")) and
  not process.parent.executable :
                      ("C:\\Program Files\\Symantec\\Symantec Endpoint Protection\\*\\Bin64\\ccSvcHst.exe",
                       "C:\\Program Files\\ACCUPLACER Score Client\\ACCUPLACER Score Client.exe") and
  process.hash.sha256 != "9e23e07e042943e1862b86d8c9dc05483a118938f5b19f359cb8f9aa6a14a452" and
  not (process.pe.original_file_name : "vs_*.exe" and process.code_signature.subject_name == "Microsoft Corporation" and process.code_signature.trusted == true)
  ] by process.entity_id as event0
 [process where event.action == "start" and user.id != null and
  not process.Ext.token.integrity_level_name : "system" and

  /* running as a different user than its parent process */
  user.id != event0.user.id and

  /* common FP patterns */
  not (process.name : "rundll32.exe" and process.args : "?:\\Windows\\System32\\SHELL32.dll,RunAsNewUser_RunDLL") and

  /* non MS signed FPs */
  not (process.code_signature.subject_name :
                   ("Lenovo", "Adobe Inc.", "Brave Software, Inc.", "HP Inc.", "Splashtop Inc.", "GN AUDIO A/S",
                    "Oracle America, Inc.", "Brother Industries, Ltd.", "Bosch Automotive Service Solutions Ltd",
                    "OpenShot Studios, LLC", "CISCO SYSTEMS, INC.", "SERVICO FEDERAL DE PROCESSAMENTO DE DADOS (SERPRO)", 
                    "Wacom Co., Ltd.") and
                    process.code_signature.trusted == true) and

  not process.executable :
            ("?:\\Windows\\System32\\ntprint.exe",
             "?:\\Windows\\System32\\timeout.exe",
             "?:\\Windows\\System32\\printui.exe",
             "?:\\Windows\\System32\\SndVol.exe",
             "?:\\Windows\\System32\\MultiDigiMon.exe",
             "C:\\Windows\\SysWOW64\\vsjitdebugger.exe",
             "C:\\Windows\\System32\\shutdown.exe",
             "C:\\Windows\\System32\\WerFault.exe",
             "C:\\Windows\\System32\\OptionalFeatures.exe",
             "C:\\Windows\\System32\\conhost.exe",
             "C:\\Windows\\SysWOW64\\net1.exe",
             "C:\\Windows\\SysWOW64\\net.exe",
             "?:\\WINDOWS\\splwow64.exe",
             "?:\\Windows\\System32\\SystemPropertiesAdvanced.exe",
             "?:\\Program Files\\*",
             "?:\\Program Files (x86)\\*") and
  not process.parent.executable : ("C:\\Windows\\System32\\gpscript.exe",
                                   "C:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe",
                                   "C:\\Windows\\System32\\ServerManagerLauncher.exe",
                                   "C:\\Program Files\\Accops\\AccopsSessionServerExtensions\\lspPortMapper.exe",
                                   "C:\\Windows\\SysWOW64\\Watchdata\\PROXKey CSP India V3.0\\SPSocketServer.exe") and
  not (process.pe.original_file_name : ("Bootstrapper.exe") and process.code_signature.trusted == true) and
  not process.hash.sha256 in
            ("b2b8a7156ec0079a1801db1647d6dbc4206345689772495eac311e0e6afcad57",
             "2c476f212dc61977ae3deb9319fa21242524f3b6dd30803715659a9618316089",
             "b2f6de33dc0dfd256f9708a09b853a96d5cf5bffcaf52aa1331b3b4242421667",
             "a02e0984d790393aea56252f45dd58d25cdfa4501efb40efadecd90145717c35",
             "5212286922b7b1bce5fda2c2b25a9dfdef9300736ded91350d08c837ae1e9e1c",
             "e18fbe144c938627e3c383e942e8da74ed301612d035f1e7e92557db70d05277",
             "c83ef42b6c4c85e24666c8e55b93fb64cf08164e34b85fde0270c03dd463c11f",
             "af483a6e34a9b12ed2adcdb388b50311e5c322947718a41bbc325c2d1f3a7393", 
             "bf73d2a3812ebef4f57cf81a2d24e23287cddefd57183c89535603e878eb7b11", 
             "24e76fe67435e9c7c1aa9ec22d736de3873fbd2e880d8ae716dffec0e146fc53",
             "2a12e554e19d7b59294def0c3047f77c44e8ed899d6bca264935ce03abc82abe",
             "e8f1081e08c28f80997b06f0f383957b6ece29347d042387e8ae2dcf93107adc",
             "ed7c9415508e0cb0893c77d67400ee52a0c2f54a9992d55e309b14d906fc8545",
             "ac3ea3ee1f4d7925888751c05911eaa237786346ad27637d1d4b140b08f1033c") and
  not (process.name : ("*setup*.exe", "resource_*.exe") and process.parent.name : "*.tmp" and process.executable : "?:\\Users\\*") and 
  not process.command_line : "*/SPAWNWND=*/NOTIFYWND=*" and
  not (process.pe.imphash == "acbfc62280771933334b67077d6deaba" and process.args : "-burn.elevated") and
  not (process.code_signature.trusted == true and not process.code_signature.subject_name : "Microsoft*") and
  not event0.process.hash.sha256 == process.hash.sha256 and
  not (process.executable : "C:\\Windows\\System32\\userinit.exe" and process.parent.executable : "C:\\Windows\\System32\\winlogon.exe") and
  not (process.executable : "C:\\Windows\\System32\\tabcal.exe" and process.parent.executable : "C:\\Windows\\System32\\rundll32.exe" and
       process.parent.args : "C:\\WINDOWS\\System32\\tabletpc.cpl") and
  not (process.executable : "C:\\Windows\\System32\\rdpshell.exe" and process.parent.executable : "C:\\Windows\\System32\\rdpinit.exe") and
  not (process.executable : "C:\\Windows\\System32\\rdpinit.exe" and process.parent.executable : "C:\\Windows\\System32\\userinit.exe") and
  not (process.executable : ("C:\\Windows\\SysWOW64\\taskkill.exe", "C:\\Windows\\SysWOW64\\cmd.exe") and
       process.working_directory : ("C:\\Program Files (x86)\\Comhard-Plus\\UserDeskTop\\files\\",
                                    "C:\\Program Files (x86)\\TSplus\\UserDeskTop\\files\\"))
  ] by process.parent.entity_id

  until [process where event.action:"end"] by process.parent.entity_id
'''

min_endpoint_version = "8.6.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1134"
name = "Access Token Manipulation"
reference = "https://attack.mitre.org/techniques/T1134/"
[[threat.technique.subtechnique]]
id = "T1134.002"
name = "Create Process with Token"
reference = "https://attack.mitre.org/techniques/T1134/002/"



[threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[internal]
min_endpoint_version = "8.6.0"

[metadata]
creation_date = "2026/07/27"
integration = ["aws_bedrock"]
maturity = "production"
updated_date = "2026/07/27"

[rule]
author = ["Elastic"]
description = """
Detects when a Bedrock model is prompted to invoke high-risk tools associated with shell execution, filesystem
operations, or process spawning. Adversaries may use compromised AI agent pipelines or manipulated prompts to
instruct the model to execute arbitrary system commands, read or write sensitive files, or spawn subprocesses —
extending the blast radius of a credential compromise or prompt injection attack.
"""
false_positives = [
    """
    Authorized AI agent workflows that include shell or filesystem tools may trigger this rule. Validate that the
    user identity and tool usage pattern are consistent with expected application behavior.
    """,
]
from = "now-60m"
interval = "10m"
language = "esql"
license = "Elastic License v2"
name = "AWS Bedrock High Risk Filesystem or Execution Tool Invocation"
note = """## Triage and analysis

### Investigating AWS Bedrock High Risk Filesystem or Execution Tool Invocation

This rule detects Bedrock model invocations where the prompt contains patterns associated with shell execution, filesystem access, or process spawning. These patterns may indicate a prompt injection attack, a compromised AI agent pipeline, or an insider attempting to use a Bedrock-backed application to execute unauthorized system operations.

### Possible investigation steps

- Review `gen_ai.prompt` to identify the specific tool invocation pattern that triggered the rule and determine whether it represents a legitimate tool call or a malicious instruction.
- Identify the user (`user.id`) and determine whether they are expected to interact with tools that perform filesystem or shell operations.
- Review the model ID (`gen_ai.request.model.id`) and the application context to understand whether shell or filesystem tools are part of the intended agent architecture.
- Correlate with other Bedrock invocation events from the same user in the preceding hour to assess whether this is an isolated event or part of a pattern.
- If the application uses Bedrock Agents, review the agent's configured action groups and Lambda functions to determine whether the tool invocation could have resulted in actual execution.
- Check for downstream evidence of execution: CloudTrail Lambda invocation events, SSM RunCommand, or EC2 activity correlated with the same time window.

### False positive analysis

- AI coding assistants and developer tools built on Bedrock may legitimately reference shell commands or file operations in their prompt templates.
- Security tooling that uses Bedrock to analyze shell scripts or code may produce prompts containing these patterns.

### Response and remediation

- If a prompt injection is confirmed, identify the injection source and remediate the input validation gap in the application layer.
- Review and restrict the tools available to the Bedrock Agent to the minimum required for its function.
- Apply Bedrock Guardrails to block or flag prompts containing high-risk tool invocation patterns.
- If credentials were compromised, rotate them immediately and audit all Bedrock and downstream API activity.
"""
references = [
    "https://docs.aws.amazon.com/bedrock/latest/userguide/agents-action-groups.html",
    "https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html",
    "https://owasp.org/www-project-top-10-for-large-language-model-applications/",
]
risk_score = 73
rule_id = "51d50385-aa3d-448c-bc48-7d6bc39108a3"
setup = """The AWS Bedrock integration must be enabled with model invocation logging configured to capture prompt
and completion content. Ensure `logs-aws_bedrock.invocation-*` is ingested into Elasticsearch."""
severity = "high"
tags = [
    "Domain: Cloud",
    "Domain: LLM",
    "Data Source: AWS Bedrock",
    "Use Case: Threat Detection",
    "Tactic: Execution",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "esql"

query = '''
from logs-aws_bedrock.invocation-* metadata _id, _version, _index

| eval Esql.lowercase_prompt = TO_LOWER(gen_ai.prompt)

| where
    Esql.lowercase_prompt like "*/bin/sh*" or
    Esql.lowercase_prompt like "*/bin/bash*" or
    Esql.lowercase_prompt like "*sh -c*" or
    Esql.lowercase_prompt like "*cmd.exe*" or
    Esql.lowercase_prompt like "*powershell*" or
    Esql.lowercase_prompt like "*exec(*" or
    Esql.lowercase_prompt like "*os.system*" or
    Esql.lowercase_prompt like "*subprocess*" or
    Esql.lowercase_prompt like "*python -c*" or
    Esql.lowercase_prompt like "*python3 -c*" or
    Esql.lowercase_prompt like "*curl *" or
    Esql.lowercase_prompt like "*wget *" or
    Esql.lowercase_prompt like "*/dev/tcp/*" or
    Esql.lowercase_prompt like "*nc -e*" or
    Esql.lowercase_prompt like "*ncat *" or
    Esql.lowercase_prompt like "*socat *" or
    Esql.lowercase_prompt like "*openssl s_client*" or
    Esql.lowercase_prompt like "*perl -e*" or
    Esql.lowercase_prompt like "*ruby -e*" or
    Esql.lowercase_prompt like "*php -r*" or
    Esql.lowercase_prompt like "*node -e*" or
    Esql.lowercase_prompt like "*base64 -d*" or
    Esql.lowercase_prompt like "*bash -i*"

| keep _id, _version, _index, @timestamp, user.id, cloud.account.id, gen_ai.request.model.id, gen_ai.prompt, gen_ai.completion
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[rule.alert_suppression]
group_by = ["user.id", "cloud.account.id"]
duration = {value = 1, unit = "h"}
missing_fields_strategy = "suppress"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.id",
    "cloud.account.id",
    "gen_ai.request.model.id",
    "gen_ai.prompt",
    "gen_ai.completion",
]

[metadata]
creation_date = "2026/08/31"
integration = ["aws"]
maturity = "production"
updated_date = "2026/08/31"

[rule]
author = ["Elastic"]
description = """
Detects an SES email identity being verified and subsequently deleted within a 30-minute window,
performed by the same AWS identity. Amazon SES requires email addresses and domains
to be verified before they can be used as senders. An adversary who obtains SES credentials
may verify a domain or address they control, use it to send phishing or spam email, then delete
the identity to remove evidence of the sending domain from the account's verified identity list.
This verify-use-delete pattern is a recognized attacker technique for SES abuse.
"""
false_positives = [
    """
    Testing workflows that verify a sandbox email address and then clean it up may trigger this
    rule. Confirm that the email identity verified and deleted corresponds to a planned test
    rather than a production or attacker-controlled domain.
    """,
]
from = "now-60m"
interval = "30m"
language = "esql"
license = "Elastic License v2"
name = "AWS SES Email Identity Verified Then Deleted"
note = """## Triage and analysis

### Investigating AWS SES Email Identity Verified Then Deleted

Amazon SES requires that email addresses and domains be verified (via DNS record or a verification email) before they can be used as `From:` addresses. An adversary who obtains SES write credentials can verify a domain they control, send bulk email from that domain using the victim account's sending quota and reputation, then delete the identity to hide the sending domain from security reviews.

The verify-then-delete sequence is the evidence-destruction component of the SES phishing technique: it removes the compromised identity from `ListIdentities` output, making post-incident attribution harder.

This is an ES|QL rule that aggregates SES verification and deletion events per calling identity within 30-minute windows and alerts when the same identity performed both, with the verification preceding the deletion.

### Possible investigation steps

- Identify the caller from `aws.cloudtrail.user_identity.arn` and the aggregated `user_names` column.
- Pivot to the raw CloudTrail events for this ARN in the `first_verify` to `last_delete` time range to determine the verified identity from the `VerifyEmailIdentity` or `VerifyDomainIdentity` request parameters and the deleted identity from the `DeleteIdentity` request parameters.
- Query SES `SendEmail` / `SendRawEmail` CloudTrail events (if CloudTrail management events are being collected) or SES sending statistics between the verification and deletion timestamps to determine whether email was sent from the verified identity.
- Check your email service provider's delivery logs for any email sourced from the SES identity.
- Review all SES actions taken by this identity in the surrounding time window.

### Response and remediation

- If unauthorized email was sent, notify affected recipients and file an SES abuse report.
- Rotate all IAM credentials that had SES write access during the incident window.
- Enable SES sending quotas and alerts to detect unusual send volume in real time.
- Restrict `ses:VerifyEmailIdentity`, `ses:VerifyDomainIdentity`, and `ses:DeleteIdentity` to a dedicated SES-management role via IAM policy.
"""
references = [
    "https://docs.aws.amazon.com/ses/latest/APIReference/API_VerifyEmailIdentity.html",
    "https://docs.aws.amazon.com/ses/latest/APIReference/API_DeleteIdentity.html",
    "https://permiso.io/blog/s/aws-ses-pionage-detecting-ses-abuse/",
]
risk_score = 47
rule_id = "8e4bde35-125d-4eb3-9a2e-d7e77a053a08"
setup = "The AWS integration must be ingesting management events into `logs-aws.cloudtrail-*`. SES management APIs are logged by default."
severity = "medium"
tags = [
    "Domain: Cloud",
    "Platform: AWS",
    "Data Source: AWS CloudTrail",
    "Service: AWS SES",
    "Rule Type: ESQL",
    "Tactic: Resource Development",
    "Tactic: Defense Evasion",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "esql"

query = '''
from logs-aws.cloudtrail-* metadata _id, _version, _index
| where data_stream.dataset == "aws.cloudtrail"
    and event.provider == "ses.amazonaws.com"
    and event.action in ("VerifyEmailIdentity", "VerifyDomainIdentity", "VerifyEmailAddress", "VerifyDomainDkim", "DeleteIdentity")
    and event.outcome == "success"
    and aws.cloudtrail.user_identity.arn is not null
| eval Esql.ses_verify_flag = case(event.action != "DeleteIdentity", 1, 0),
       Esql.ses_delete_flag = case(event.action == "DeleteIdentity", 1, 0)
| stats Esql.ses_verify_count = sum(Esql.ses_verify_flag),
        Esql.ses_delete_count = sum(Esql.ses_delete_flag),
        Esql.ses_verify_timestamp_min = min(case(Esql.ses_verify_flag == 1, @timestamp)),
        Esql.ses_delete_timestamp_max = max(case(Esql.ses_delete_flag == 1, @timestamp)),
        Esql.event_action_values = values(event.action),
        Esql_priv.user_name_values = values(user.name),
        Esql.cloud_account_id_values = values(cloud.account.id)
    by aws.cloudtrail.user_identity.arn
| where Esql.ses_verify_count > 0 and Esql.ses_delete_count > 0
    and Esql.ses_verify_timestamp_min < Esql.ses_delete_timestamp_max
    and date_diff("minutes", Esql.ses_verify_timestamp_min, Esql.ses_delete_timestamp_max) <= 30
| keep aws.cloudtrail.user_identity.arn, Esql.ses_verify_count, Esql.ses_delete_count, Esql.ses_verify_timestamp_min, Esql.ses_delete_timestamp_max, Esql.event_action_values, Esql_priv.user_name_values, Esql.cloud_account_id_values
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1583"
name = "Acquire Infrastructure"
reference = "https://attack.mitre.org/techniques/T1583/"

[[rule.threat.technique.subtechnique]]
id = "T1583.001"
name = "Domains"
reference = "https://attack.mitre.org/techniques/T1583/001/"

[rule.threat.tactic]
id = "TA0042"
name = "Resource Development"
reference = "https://attack.mitre.org/tactics/TA0042/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1070"
name = "Indicator Removal"
reference = "https://attack.mitre.org/techniques/T1070/"


[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[rule.investigation_fields]
field_names = [
    "aws.cloudtrail.user_identity.arn",
    "Esql.ses_verify_count",
    "Esql.ses_delete_count",
    "Esql.ses_verify_timestamp_min",
    "Esql.ses_delete_timestamp_max",
    "Esql.event_action_values",
    "Esql_priv.user_name_values",
    "Esql.cloud_account_id_values",
]

[metadata]
creation_date = "2020/02/18"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2026/05/04"

[rule]
author = ["Elastic"]
description = """
Identifies use of the netsh.exe to disable or weaken the local firewall. Attackers will use this command line tool to
disable the firewall during troubleshooting or to enable network mobility.
"""
from = "now-9m"
index = [
    "endgame-*",
    "logs-crowdstrike.fdr*",
    "logs-endpoint.events.process-*",
    "logs-m365_defender.event-*",
    "logs-sentinel_one_cloud_funnel.*",
    "logs-system.security*",
    "logs-windows.forwarded*",
    "logs-windows.sysmon_operational-*",
    "winlogbeat-*",
]
language = "eql"
license = "Elastic License v2"
name = "Disable Windows Firewall Rules via Netsh"
note = """## Triage and analysis

### Investigating Disable Windows Firewall Rules via Netsh

The Windows Defender Firewall is a native component which provides host-based, two-way network traffic filtering for a device, and blocks unauthorized network traffic flowing into or out of the local device.

Attackers can disable the Windows firewall or its rules to enable lateral movement and command and control activity.

This rule identifies patterns related to disabling the Windows firewall or its rules using the `netsh.exe` utility.

#### Possible investigation steps

- Identify the user account that performed the action and whether it should perform this kind of action.
- Contact the user to check if they are aware of the operation.
- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
- Investigate other alerts associated with the user/host during the past 48 hours.

### False positive analysis

- This mechanism can be used legitimately. Check whether the user is an administrator and is legitimately performing troubleshooting.
- In case of an allowed benign true positive (B-TP), assess adding rules to allow needed traffic and re-enable the firewall.

### Response and remediation

- Initiate the incident response process based on the outcome of the triage.
- Isolate the involved hosts to prevent further post-compromise behavior.
- Review the privileges assigned to the involved users to ensure that the least privilege principle is being followed.
- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
"""

setup = """## Setup

This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.

Setup instructions: https://ela.st/install-elastic-defend

### Additional data sources

This rule also supports the following third-party data sources. For setup instructions, refer to the links below:

- [CrowdStrike](https://ela.st/crowdstrike-integration)
- [Microsoft Defender XDR](https://ela.st/m365-defender)
- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
- [Sysmon Event ID 1 - Process Creation](https://ela.st/sysmon-event-1-setup)
- [Windows Process Creation Logs](https://ela.st/audit-process-creation)
"""

risk_score = 47
rule_id = "4b438734-3793-4fda-bd42-ceeada0be8f9"
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Defense Evasion",
    "Resources: Investigation Guide",
    "Data Source: Elastic Endgame",
    "Data Source: Elastic Defend",
    "Data Source: Windows Security Event Logs",
    "Data Source: Microsoft Defender XDR",
    "Data Source: Sysmon",
    "Data Source: SentinelOne",
    "Data Source: Crowdstrike",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
process where host.os.type == "windows" and event.type == "start" and
  process.name : "netsh.exe" and
  (
    (process.args : "disable" and process.args : "firewall" and process.args : "set") or
    (process.args : "advfirewall" and process.args : "off" and process.args : "state")
  )
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[rule.threat.technique.subtechnique]]
id = "T1562.004"
name = "Disable or Modify System Firewall"
reference = "https://attack.mitre.org/techniques/T1562/004/"



[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[metadata]
creation_date = "2026/05/26"
integration = ["azure", "o365"]
maturity = "production"
updated_date = "2026/05/26"

[rule]
author = ["Elastic"]
description = """
Identifies the default user agent string associated with Kali365 (also referred to as Kali365 Live), a
phishing-as-a-service (PhaaS) platform that automates OAuth 2.0 device code phishing and adversary-in-the-middle (AiTM)
session capture against Microsoft 365 and Microsoft Entra ID. The Kali365 Electron desktop client identifies itself with
the user agent `kali365-live/1.0.0` when polling for and replaying captured OAuth tokens, so its appearance in Entra ID
sign-in logs, Entra ID audit logs, or the Microsoft 365 unified audit log indicates that an attacker-controlled Kali365
client is interacting with the tenant using stolen tokens. Unlike dual-use offensive tooling, Kali365 is a criminal
service with no legitimate enterprise use, making this user agent a high-fidelity indicator of active account
compromise.
"""
false_positives = [
    """
    Security researchers, sandbox detonations, or red team engagements that intentionally run the Kali365 client against
    a monitored tenant may generate this user agent. Document approved research activity and exclude the associated
    principals, source IPs, or tenants if expected.
    """,
]
from = "now-9m"
index = ["logs-azure.auditlogs-*", "logs-azure.signinlogs-*", "logs-o365.audit-*"]
language = "kuery"
license = "Elastic License v2"
name = "Entra ID Kali365 Default User-Agent Detected"
note = """## Triage and analysis

### Investigating Entra ID Kali365 Default User-Agent Detected

Kali365 (Kali365 Live) is a phishing-as-a-service platform distributed via Telegram that provides affiliates with
AI-generated lures, automated device code phishing campaigns, target-tracking dashboards, and OAuth token capture. The
typical flow is: a lure delivers a Microsoft device code, the victim enters it on the legitimate Microsoft verification
page and unknowingly authorizes the attacker, Kali365 captures the resulting OAuth access and refresh tokens, and the
attacker uses those tokens for persistent, MFA-free access to Microsoft 365 (Outlook, Teams, OneDrive).

The Kali365 desktop client presents the user agent `kali365-live/1.0.0`. This rule fires when that user agent is observed
in Entra ID sign-in logs, Entra ID audit logs, or the Microsoft 365 unified audit log. Because the user agent maps to a
criminal service with no legitimate use, an alert generally indicates that stolen tokens are already being replayed
against the tenant.

### Possible investigation steps

- Confirm the tool and identify the affected identity.
    - `user_agent.original` matches `kali365-live/*`.
    - Pivot on `user.name`, `azure.signinlogs.properties.user_principal_name`, or the M365 audit `user.id`.
- Review the origin and compare against the user's normal sign-in behavior.
    - `source.ip`, `source.geo.*`, and `source.as.organization.name`; flag hosting/VPS ASNs and unexpected geographies.
    - Cross-reference published Kali365 infrastructure (`216.203.20.95`, `162.243.166.119`, `199.91.220.111`).
- Confirm the device code grant in sign-in logs.
    - `azure.signinlogs.properties.authentication_protocol` is `deviceCode`.
    - Review `app_id`/`app_display_name` and `resource_display_name` for the brokered mail or collaboration API.
- Scope follow-on access in the Microsoft 365 unified audit log for the same user and timeframe.
    - Look for mailbox access, inbox rule creation, OneDrive/SharePoint downloads, or Teams activity from the same session or IP.
- Check the Entra ID audit log for a device registration by the same identity around the alert window.
    - A `Register device` event by the identity paired (via `azure.correlation_id`) with an `Add device` event from the `Device Registration Service` indicates a Primary Refresh Token (PRT) was issued for persistence that survives password resets.

### False positive analysis

- This user agent has no legitimate enterprise use.
    - The only expected matches are authorized security research or red team exercises running the Kali365 client; validate and document before dismissing.

### Response and remediation

- Remove rogue device registrations created by the user BEFORE revoking sessions.
    - Device-bound PRTs survive `revokeSignInSessions`, so a device left in place re-establishes access.
    - `GET /v1.0/users/{id}/registeredDevices` and `/ownedDevices`, then `DELETE /v1.0/devices/{deviceObjectId}` for unrecognized devices.
- Revoke refresh tokens and sessions, then reset credentials and re-register MFA.
    - `POST /v1.0/users/{id}/revokeSignInSessions`.
- Temporarily disable the account if you need to halt activity during investigation.
    - `PATCH /v1.0/users/{id}` with body `{"accountEnabled": false}`.
- Remove other attacker persistence: malicious inbox/forwarding rules, OAuth consents, and app passwords.
- Block or monitor Kali365 source IPs and infrastructure, and hunt for the user agent across other users and tenants.
- Apply Conditional Access to the device code grant.
    - Require a managed/compliant device, or block the device-code flow outside approved app and user populations.
"""
references = [
    "https://arcticwolf.com/resources/blog/token-bingo-dont-let-your-code-be-the-winner/",
    "https://www.ic3.gov/PSA/2026/PSA260521",
]
risk_score = 73
rule_id = "4b11dbab-ce37-49c4-bdf1-cdf64b405d96"
severity = "high"
tags = [
    "Domain: Cloud",
    "Domain: Identity",
    "Data Source: Azure",
    "Data Source: Microsoft Entra ID",
    "Data Source: Microsoft Entra ID Sign-in Logs",
    "Data Source: Microsoft Entra ID Audit Logs",
    "Data Source: Microsoft 365",
    "Data Source: Microsoft 365 Audit Logs",
    "Use Case: Identity and Access Audit",
    "Use Case: Threat Detection",
    "Threat: Kali365",
    "Tactic: Initial Access",
    "Tactic: Credential Access",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset : ("azure.signinlogs" or "azure.auditlogs" or "o365.audit") and user_agent.original: kali365-live/*
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"
[[rule.threat.technique.subtechnique]]
id = "T1078.004"
name = "Cloud Accounts"
reference = "https://attack.mitre.org/techniques/T1078/004/"


[[rule.threat.technique]]
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"
[[rule.threat.technique.subtechnique]]
id = "T1566.002"
name = "Spearphishing Link"
reference = "https://attack.mitre.org/techniques/T1566/002/"



[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1528"
name = "Steal Application Access Token"
reference = "https://attack.mitre.org/techniques/T1528/"


[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1550"
name = "Use Alternate Authentication Material"
reference = "https://attack.mitre.org/techniques/T1550/"
[[rule.threat.technique.subtechnique]]
id = "T1550.001"
name = "Application Access Token"
reference = "https://attack.mitre.org/techniques/T1550/001/"



[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[metadata]
creation_date = "2025/07/03"
integration = ["azure"]
maturity = "production"
updated_date = "2026/08/12"

[rule]
author = ["Elastic"]
description = """
Identifies rare occurrences of OAuth workflow for a user principal that is single factor authenticated, with an OAuth
scope containing user_impersonation for a token issued by Entra ID. Adversaries may use this scope to gain unauthorized
access to user accounts, particularly when the sign-in session status is unbound, indicating that the session is not
associated with a specific device or session. This behavior is indicative of potential account compromise or
unauthorized access attempts. This rule flags when this pattern is detected for a user principal that has not been seen
in the last 10 days, indicating potential abuse or unusual activity.
"""
from = "now-9m"
index = ["filebeat-*", "logs-azure.signinlogs-*"]
language = "kuery"
license = "Elastic License v2"
name = "Entra ID OAuth user_impersonation Scope for Unusual User and Client"
note = """## Triage and analysis

### Investigating Entra ID OAuth user_impersonation Scope for Unusual User and Client

Identifies rare occurrences of OAuth workflow for a user principal that is single factor authenticated, with an OAuth scope containing `user_impersonation`, and a token issuer type of `AzureAD`. This rule is designed to detect suspicious
OAuth user impersonation attempts in Microsoft Entra ID, particularly those involving the `user_impersonation` scope, which is often used by adversaries to gain unauthorized access to user accounts. The rule focuses on sign-in events where
the sign-in session status is `unbound`, indicating that the session is not associated with a specific device or session, making it more vulnerable to abuse. This behavior is indicative of potential account compromise or
unauthorized access attempts, especially when the user type is `Member` and the sign-in outcome is `success`. The rule aims to identify these events to facilitate timely investigation and response to potential security incidents. This is a New Terms rule that flags when this pattern is detected for a user principal that has not been seen in the last 10 days, indicating potential abuse or unusual activity.

### Possible investigation steps

- Review the `azure.signinlogs.properties.user_principal_name` field to identify the user principal involved in the OAuth workflow.
- Check the `azure.signinlogs.properties.authentication_processing_details.Oauth Scope Info` field for the presence of `user_impersonation`. This scope is commonly used in OAuth flows to allow applications to access user resources on behalf of the user.
- Confirm that the `azure.signinlogs.properties.authentication_requirement` is set to `singleFactorAuthentication`, indicating that the sign-in did not require multi-factor authentication (MFA). This can be a red flag, as MFA is a critical security control that helps prevent unauthorized access.
- Review the `azure.signinlogs.properties.app_display_name` or `azure.signinlogs.properties.app_id` to identify the application involved in the OAuth workflow. Check if this application is known and trusted, or if it appears suspicious or unauthorized. FOCI applications are commonly abused by adversaries to evade security controls or conditional access policies.
- Analyze the `azure.signinlogs.properties.client_ip` to determine the source of the sign-in attempt. Look for unusual or unexpected IP addresses, especially those associated with known malicious activity or geographic locations that do not align with the user's typical behavior.
- Examine the `azure.signinlogs.properties.resource_display_name` or `azure.signinlogs.properties.resource_id` to identify the resource being accessed during the OAuth workflow. This can help determine if the access was legitimate or if it targeted sensitive resources. It may also help pivot to other related events or activities.
- Use the `azure.signinlogs.properties.session_id` or `azure.signinlogs.properties.correlation_id` to correlate this event with other related sign-in events or activities. This can help identify patterns of suspicious behavior or potential account compromise.

### False positive analysis

- Some legitimate applications may use the `user_impersonation` scope for valid purposes, such as accessing user resources on behalf of the user. If this is expected behavior, consider adjusting the rule or adding exceptions for specific applications or user principals.
- Users may occasionally authenticate using single-factor authentication for specific applications or scenarios, especially in environments where MFA is not enforced or required. If this is expected behavior, consider adjusting the rule or adding exceptions for specific user principals or applications.
- Some applications may use the `user_impersonation` scope for legitimate purposes, such as accessing user resources in a controlled manner. If this is expected behavior, consider adjusting the rule or adding exceptions for specific applications or user principals.
- The `restricted_user_impersonation` scope is distinct from `user_impersonation` and is excluded.
- Expected OCaaS bootstrap requests from Exchange Online or Microsoft Forms Web are excluded when they originate from compliant, managed, joined Windows devices and do not use an incoming refresh token or primary refresh token.

### Response and remediation

- Contact the user to validate the OAuth workflow and assess whether they were targeted or tricked by a malicious actor.
- If the OAuth workflow is confirmed to be malicious:
  - Block the user account and reset the password to prevent further unauthorized access.
  - Revoke active sessions and refresh tokens associated with the user principal.
  - Review the application involved in the OAuth workflow and determine if it should be blocked or removed from the tenant.
  - Investigate the source of the sign-in attempt, including the application and IP address, to determine if there are any additional indicators of compromise or ongoing malicious activity.
  - Monitor the user account and related resources for any further suspicious activity or unauthorized access attempts, and take appropriate actions to mitigate any risks identified.
- Educate users about the risks associated with OAuth user impersonation and encourage them to use more secure authentication methods, such as OAuth 2.0 or OpenID Connect, whenever possible.
"""
references = [
    "https://aadinternals.com/post/phishing/",
    "https://dirkjanm.io/assets/raw/Finding%20Entra%20ID%20CA%20Bypasses%20-%20the%20structured%20way.pdf",
    "https://github.com/Flangvik/TeamFiltration",
    "https://www.proofpoint.com/us/blog/threat-insight/attackers-unleash-teamfiltration-account-takeover-campaign",
]
risk_score = 47
rule_id = "9563dace-5822-11f0-b1d3-f661ea17fbcd"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Domain: Identity",
    "Use Case: Threat Detection",
    "Data Source: Azure",
    "Data Source: Microsoft Entra ID",
    "Data Source: Microsoft Entra ID Sign-in Logs",
    "Platform: Entra ID",
    "Tactic: Initial Access",
    "Tactic: Defense Evasion",
    "Rule Type: New Terms",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "new_terms"

query = '''
data_stream.dataset:azure.signinlogs and
azure.signinlogs.properties.authentication_processing_details:(*user_impersonation* and not *restricted_user_impersonation*) and
azure.signinlogs.properties.authentication_requirement:singleFactorAuthentication and
azure.signinlogs.properties.token_issuer_type:AzureAD and
azure.signinlogs.properties.token_protection_status_details.sign_in_session_status:unbound and
azure.signinlogs.properties.user_type:Member and
azure.signinlogs.properties.conditional_access_status:"notApplied" and
not user_agent.original:(Microsoft*Authentication*iPhone* or Mozilla*PKeyAuth/1.0) and
not azure.signinlogs.properties.device_detail.operating_system:(Android* or Ios*) and
event.outcome:success and
not azure.signinlogs.properties.app_id:(
    0000000c-0000-0000-c000-000000000000 or
    0a5f63c0-b750-4f38-a71c-4fc0d58b89e2 or
    48af08dc-f6d2-435f-b2a7-069abd99c086 or
    5e3ce6c0-2b1f-4285-8d4b-75ee78787346 or
    65d91a3d-ab74-42e6-8a2f-0add61688c74 or
    66a88757-258c-4c72-893c-3e8bed4d6899 or
    6bc3b958-689b-49f5-9006-36d165f30e00 or
    8c59ead7-d703-4a27-9e55-c96a0054c8d2 or
    95de633a-083e-42f5-b444-a4295d8e9314 or
    ab9b8c07-8f02-4f72-87fa-80105867a763 or
    cc15fd57-2c6c-4117-a88c-83b1d56b4bbe or
    d52792f4-ba38-424d-8140-ada5b883f293 or
    e8be65d6-d430-4289-a665-51bf2a194bda or
    fc0f3af4-6835-4174-b806-f7db311fd2f3
) and
not (
    azure.signinlogs.properties.resource_id:c2ada927-a9e2-4564-aae2-70775a2fa0af and
    (
        azure.signinlogs.properties.app_id:00000002-0000-0ff1-ce00-000000000000 and
        azure.signinlogs.properties.device_detail.operating_system:Windows or
        azure.signinlogs.properties.app_id:5f00fd34-f302-417f-81ef-1adda179d8fd and
        azure.signinlogs.properties.device_detail.operating_system:Windows*
    ) and
    azure.signinlogs.properties.device_detail.is_managed:true and
    azure.signinlogs.properties.device_detail.is_compliant:true and
    azure.signinlogs.properties.device_detail.trust_type:("Azure AD joined" or "Hybrid Azure AD joined") and
    azure.signinlogs.properties.device_detail.device_id:(* and not "") and
    azure.signinlogs.properties.incoming_token_type:none and
    azure.signinlogs.properties.client_app_used:Browser and
    azure.signinlogs.category:NonInteractiveUserSignInLogs
)
'''

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "azure.correlation_id",
    "azure.signinlogs.category",
    "azure.signinlogs.identity",
    "azure.signinlogs.properties.app_display_name",
    "azure.signinlogs.properties.app_id",
    "azure.signinlogs.properties.app_owner_tenant_id",
    "azure.signinlogs.properties.authentication_requirement",
    "azure.signinlogs.properties.client_credential_type",
    "azure.signinlogs.properties.conditional_access_status",
    "azure.signinlogs.properties.device_detail.operating_system",
    "azure.signinlogs.properties.is_interactive",
    "azure.signinlogs.properties.session_id",
    "azure.signinlogs.properties.user_principal_name",
    "azure.signinlogs.properties.user_type",
    "azure.signinlogs.result_signature",
    "azure.tenant_id",
    "source.address",
    "user.id"
]


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"
[[rule.threat.technique.subtechnique]]
id = "T1078.004"
name = "Cloud Accounts"
reference = "https://attack.mitre.org/techniques/T1078/004/"



[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1550"
name = "Use Alternate Authentication Material"
reference = "https://attack.mitre.org/techniques/T1550/"
[[rule.threat.technique.subtechnique]]
id = "T1550.001"
name = "Application Access Token"
reference = "https://attack.mitre.org/techniques/T1550/001/"

[[rule.threat.technique]]
id = "T1656"
name = "Impersonation"
reference = "https://attack.mitre.org/techniques/T1656/"



[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[rule.new_terms]
field = "new_terms_fields"
value = ["azure.signinlogs.properties.user_principal_name", "azure.signinlogs.properties.app_id"]
[[rule.new_terms.history_window_start]]
field = "history_window_start"
value = "now-10d"

[metadata]
creation_date = "2025/11/26"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike", "auditd_manager"]
maturity = "production"
updated_date = "2026/04/22"


[rule]
author = ["Elastic"]
description = """
This rule detects potentially dangerous commands spawned by the GitHub Actions Runner.Worker process or by shell
interpreters launched via a runner entrypoint script on self-hosted runner machines. Adversaries who gain the ability
to modify or trigger workflows in a linked GitHub repository can execute arbitrary commands on the runner host. This
behavior may indicate malicious or unexpected workflow activity, including code execution, reconnaissance, credential
harvesting, or network exfiltration initiated through a compromised repository or unauthorized workflow.
"""
false_positives = [
    "Authorized GitHub actions runner with no malicious workflow actions.",
]
from = "now-9m"
index = [
    "endgame-*",
    "logs-crowdstrike.fdr*",
    "logs-endpoint.events.process-*",
    "logs-m365_defender.event-*",
    "logs-sentinel_one_cloud_funnel.*",
    "logs-system.security*",
    "logs-windows.forwarded*",
    "logs-windows.sysmon_operational-*",
    "winlogbeat-*",
    "auditbeat-*",
    "logs-auditd_manager.auditd-*"
]
language = "eql"
license = "Elastic License v2"
name = "Execution via GitHub Actions Runner"
note = """## Triage and analysis

### Investigating Execution via GitHub Actions Runner

Adversaries who gain the ability to modify or trigger workflows in a linked GitHub repository can execute arbitrary
commands on the runner host. This rule covers two parent process paths:
- **Direct execution**: process spawned directly by `Runner.Worker` / `Runner.Worker.exe`.
- **Entrypoint script execution**: process spawned by a shell (`sh`, `bash`, `zsh`) whose command line references
  a runner `entrypoint.sh` script, a common pattern when the runner bootstraps workflow steps via a shell script.

### Possible investigation steps

- Review `process.command_line` and `process.parent.command_line` to determine whether the activity matches a known,
  authorized workflow step.
- For `grep`, `find`, `pgrep`, `printenv`, and `env` hits, assess whether the command targets sensitive paths, environment
  variables (e.g. secrets, tokens), or process listings inconsistent with the declared workflow.
- For `openssl` and `base64` hits, inspect arguments for encoding/decoding operations that may indicate credential
  harvesting, data staging, or a C2 channel.
- For `tr` and `cat` hits, assess whether they are chained with other suspicious commands (e.g. `cat /etc/passwd | base64`,
  `cat ~/.ssh/id_rsa`) to read and encode sensitive files for exfiltration.
- For `nc`, `ncat`, `netcat`, and `socat` hits, check arguments for reverse shell patterns or port-forwarding to
  attacker-controlled infrastructure.
- For `wg` and `wg-quick` hits, inspect arguments for tunnel configuration that may establish a covert egress channel.
- For `ssh` hits, review arguments for reverse tunnel flags (`-R`) or connections to unexpected remote hosts.
- For `kubectl` and `helm` hits, assess whether commands target sensitive namespaces, extract secrets, or deploy
  workloads inconsistent with the declared workflow.
- For `vault` hits, inspect arguments for secret reads (`vault kv get`) or token operations that may indicate
  credential harvesting from a HashiCorp Vault instance.
- For `gh` hits, review arguments for repository cloning, secret access (`gh secret`), or actions that escalate
  access via the runner's GitHub token.
- For `nmap` hits, assess whether the command performs host or port discovery against internal network ranges,
  indicating lateral movement preparation.
- Examine associated network activity for unexpected outbound connections, especially following `curl`, `wget`, or
  `openssl s_client` invocations.
- Verify whether the triggering workflow run was initiated by an authorized actor and matches the repository's
  expected workflow definitions.
- Correlate with file-write and file-access events to identify any sensitive file staging or collection activity.
- Correlate with other alerts to determine if this activity is part of a broader supply chain or CI/CD compromise.

### False positive analysis

- Authorized GitHub workflow actions that legitimately use discovery utilities (`find`, `grep`, `env`, `nmap`), data
  manipulation tools (`cat`, `tr`), encoding tools (`openssl`, `base64`), remote access tools (`ssh`), or
  infrastructure CLIs (`kubectl`, `helm`, `vault`, `gh`) as part of their build, test, or deploy steps may trigger
  this rule. Validate against known workflow definitions and consider adding workflow-specific exclusions if the
  volume is high.

### Response and remediation

- Immediately isolate the affected system from the network to prevent further unauthorized command execution and potential lateral movement.
- Terminate any suspicious child processes that were initiated by the Github actions runner.
- Conduct a thorough review of the affected system's logs and configurations to identify any unauthorized changes or additional indicators of compromise.
- Restore the system from a known good backup if any unauthorized changes or malicious activities are confirmed.
- Implement application whitelisting to prevent unauthorized execution.
- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to assess the potential impact on the broader network."""
references = [
    "https://www.elastic.co/blog/shai-hulud-worm-npm-supply-chain-compromise",
    "https://socket.dev/blog/shai-hulud-strikes-again-v2",
]
risk_score = 47
rule_id = "a640ef5b-e1da-4b17-8391-468fdbd1b517"
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: Linux",
    "OS: Windows",
    "OS: macOS",
    "Use Case: Threat Detection",
    "Tactic: Execution",
    "Tactic: Initial Access",
    "Data Source: Elastic Endgame",
    "Data Source: Elastic Defend",
    "Data Source: Windows Security Event Logs",
    "Data Source: Microsoft Defender XDR",
    "Data Source: Sysmon",
    "Data Source: SentinelOne",
    "Data Source: Crowdstrike",
    "Data Source: Auditd Manager",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
process where event.type == "start" and event.action in ("exec", "exec_event", "start", "ProcessRollup2", "executed", "process_started") and
 (
   /* Direct child of the GitHub Actions Runner.Worker process */
   process.parent.name in ("Runner.Worker", "Runner.Worker.exe") or

   /* Child of a shell interpreter launched via a runner entrypoint script
      (e.g. /home/runner/runners/<ver>/run/entrypoint.sh or similar paths) */
   (
     process.parent.name in ("sh", "bash", "zsh") and
     process.parent.command_line like "*runner*entrypoint.sh"
   )
 ) and
 (
   process.name : (
     /* Network / download utilities */
     "curl", "curl.exe", "wget", "wget.exe",
     /* Windows scripting & LOLBins */
     "powershell.exe", "cmd.exe", "pwsh.exe", "certutil.exe", "rundll32.exe",
     /* Unix shells */
     "bash", "sh", "zsh", "dash", "ash", "tcsh", "csh", "ksh", "fish", "mksh", "busybox", "pwsh",
     /* File / archive manipulation */
     "tar", "gzip", "rm", "sed", "chmod",
     /* macOS-specific */
     "osascript",
     /* Process persistence helpers */
     "nohup", "setsid",
     /* Scripting runtimes */
     "python*", "perl*", "ruby*", "lua*", "php*", "node", "nodejs", "node.exe",
     /* Discovery & reconnaissance */
     "pgrep", "grep", "find", "printenv", "env", "nmap",
     /* Crypto / encoding (potential exfiltration or C2 channel) */
     "openssl", "base64", "basez", "base64plain", "base64url", "base64mime", "base64pem", "basenc", "base32", "base16", "xxd",
     /* Data manipulation / inspection */
     "tr", "cat",
     /* Network relay / tunneling */
     "nc", "ncat", "netcat", "nc.traditional", "nc.openbsd", "socat", "wg", "wg-quick",
     /* Remote access */
     "ssh", "ssh.exe", "ftp", "tftp", "scp", "sftp",
     /* Kubernetes / infrastructure */
     "kubectl", "helm", "docker", "ctr", "crictl",
     /* Secret management */
     "vault",
     /* GitHub CLI */
     "gh",
     /* AWS CLI */
     "aws",
     /*Azure CLI */
     "az",
     /*GCP CLI */
     "gcloud",
     /* Google Workspace CLI */
     "gws"
   ) or
   process.executable : ("/tmp/*", "/private/tmp/*", "/var/tmp/*", "/dev/shm/*", "/run/*", "/var/run/*", "?:\\Users\\*")
 )
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"

[[rule.threat.technique.subtechnique]]
id = "T1059.001"
name = "PowerShell"
reference = "https://attack.mitre.org/techniques/T1059/001/"

[[rule.threat.technique.subtechnique]]
id = "T1059.002"
name = "AppleScript"
reference = "https://attack.mitre.org/techniques/T1059/002/"

[[rule.threat.technique.subtechnique]]
id = "T1059.003"
name = "Windows Command Shell"
reference = "https://attack.mitre.org/techniques/T1059/003/"

[[rule.threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"

[[rule.threat.technique.subtechnique]]
id = "T1059.006"
name = "Python"
reference = "https://attack.mitre.org/techniques/T1059/006/"

[[rule.threat.technique.subtechnique]]
id = "T1059.007"
name = "JavaScript"
reference = "https://attack.mitre.org/techniques/T1059/007/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1195"
name = "Supply Chain Compromise"
reference = "https://attack.mitre.org/techniques/T1195/"

[[rule.threat.technique.subtechnique]]
id = "T1195.002"
name = "Compromise Software Supply Chain"
reference = "https://attack.mitre.org/techniques/T1195/002/"

[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"

[[rule.threat.technique.subtechnique]]
id = "T1218.011"
name = "Rundll32"
reference = "https://attack.mitre.org/techniques/T1218/011/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[metadata]
creation_date = "2026/07/15"
integration = ["gcp"]
maturity = "production"
updated_date = "2026/07/15"

[rule]
author = ["Elastic"]
description = """
Detects successful GKE pod exec sessions where the executed command implies curl or wget fetching an HTTPS URL.
Attackers with pods/exec often run one-liners to stage tooling, pull scripts or binaries, or exfiltrate data over
HTTPS—activity that should be rare compared to shells, debuggers, or expected health checks. Common cluster health,
localhost, and OIDC/JWKS endpoint patterns are excluded to reduce benign automation noise. GKE records the command in
gcp.audit.labels.command.gke.io/command when an explicit command is passed to exec.
"""
false_positives = [
    """
    Approved runbooks or support sessions may use kubectl exec with curl/wget to test egress or download vendor tools.
    """,
]
from = "now-6m"
index = ["logs-gcp.audit-*"]
language = "kuery"
license = "Elastic License v2"
name = "GKE Pod Exec with Curl or Wget to HTTPS"
note = """## Triage and analysis

### Investigating GKE Pod Exec with Curl or Wget to HTTPS

This alert fires when a successful pods/exec API call includes a curl or wget command targeting HTTPS.
Review `gcp.audit.labels.command.gke.io/command` for the full command and destination URL.

### Possible investigation steps

- Confirm who may exec into the target namespace: `client.user.email`, source IP, and user agent (kubectl, CI, automation).
- Map `gcp.audit.resource_name` to the pod/workload owner and retrieve the exact command from the alert document.
- Search for adjacent audit events from the same identity: secret reads, additional execs, RBAC changes, or anonymous access.
- If malicious, revoke credentials used for exec, review RoleBindings for pods/exec, and inspect the pod for dropped artifacts.

### False positive analysis

- Approved egress or tool-download tests may match; allowlist those identities after validation.
- Some cluster components use HTTPS to kubernetes.default.svc or .well-known endpoints; expand exclusions if needed.

### Response and remediation

- Rotate secrets accessible from the pod, cordon or delete the workload if compromised, and tighten RBAC so only
  required principals retain pods/exec on sensitive namespaces.
"""
setup = "The GCP Fleet integration with GKE audit logs enabled is required to be compatible with this rule."
references = [
    "https://attack.mitre.org/techniques/T1609/",
    "https://attack.mitre.org/techniques/T1105/",
]
risk_score = 73
rule_id = "3a68325b-6169-44c1-a5f0-0102ef82b6f1"
severity = "high"
tags = [
    "Domain: Cloud",
    "Domain: Kubernetes",
    "Data Source: GCP",
    "Data Source: GCP Audit Logs",
    "Data Source: Google Cloud Platform",
    "Use Case: Threat Detection",
    "Tactic: Execution",
    "Tactic: Command and Control",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset:gcp.audit and service.name:"k8s.io" and event.outcome:success and
event.type:start and
event.action:("io.k8s.core.v1.pods.exec.create" or "io.k8s.core.v1.pods.exec.get") and
gcp.audit.labels.command.gke.io/command:(
  (*curl*https* or *wget*https*) and not (
    */.well-known/jwks.json* or */.well-known/openid-configuration* or
    */api/v1/health* or */healthz* or */livez* or */readyz* or
    */openid-connect/certs* or */openid/v1/jwks* or
    *127.0.0.1* or *kubernetes.default.svc* or *localhost*
  )
)
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1609"
name = "Container Administration Command"
reference = "https://attack.mitre.org/techniques/T1609/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1105"
name = "Ingress Tool Transfer"
reference = "https://attack.mitre.org/techniques/T1105/"

[rule.threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "client.user.email",
    "source.ip",
    "user_agent.original",
    "event.action",
    "event.outcome",
    "event.type",
    "gcp.audit.labels.command.gke.io/command",
    "gcp.audit.resource_name",
    "data_stream.namespace",
]

[metadata]
creation_date = "2025/06/26"
integration = ["endpoint", "cloud_defend"]
maturity = "production"
min_stack_comments = "Defend for Containers integration was re-introduced in 9.3.0"
min_stack_version = "9.3.0"
updated_date = "2026/03/24"

[rule]
author = ["Elastic"]
description = """
This rule detects the creation or modification of sensitive Kubernetes configuration files on Linux systems. These files
include Kubernetes manifests, PKI files, and configuration files that are critical for the operation of Kubernetes clusters.
Monitoring these files helps identify potential unauthorized changes or misconfigurations that could lead to security
vulnerabilities in Kubernetes environments. Attackers may attempt to modify these files to gain persistence or to
deploy malicious containers within the Kubernetes cluster.
"""
from = "now-9m"
index = ["logs-endpoint.events.file*", "logs-cloud_defend.file*"]
language = "eql"
license = "Elastic License v2"
name = "Kubernetes Sensitive Configuration File Activity"
note = """ ## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Kubernetes Sensitive Configuration File Activity

Kubernetes relies on configuration files to manage cluster operations, including manifests and PKI files. These files are crucial for defining the desired state and security of the cluster. Adversaries may exploit these files to gain persistence or deploy unauthorized containers. The detection rule monitors for unauthorized changes to these files, excluding legitimate processes, to identify potential security threats.

### Possible investigation steps

- Review the alert details to identify the specific file path that triggered the alert, focusing on paths like "/etc/kubernetes/manifests/*", "/etc/kubernetes/pki/*", or "/etc/kubernetes/*.conf".
- Check the process that attempted to modify the file by examining the process name and compare it against the list of excluded legitimate processes ("kubeadm", "kubelet", "dpkg", "sed") to determine if it is suspicious.
- Investigate the user account associated with the process that made the change to assess if the account has the necessary permissions and if it has been compromised.
- Analyze recent activity on the host to identify any other unusual or unauthorized actions that might correlate with the file modification, such as unexpected network connections or process executions.
- Review the history of changes to the affected file to determine if there have been other unauthorized modifications or if this is an isolated incident.
- Consult Kubernetes audit logs, if available, to gather additional context on the actions performed around the time of the alert, focusing on any anomalies or unauthorized access attempts.

### False positive analysis

- Routine updates or maintenance activities by system administrators can trigger alerts. To manage this, consider excluding processes or users known to perform regular maintenance from the rule.
- Automated scripts or configuration management tools like Ansible or Puppet may modify configuration files as part of their normal operation. Identify these tools and add them to the exclusion list to prevent unnecessary alerts.
- Scheduled backups or system snapshots might access or modify configuration files. Ensure that these processes are recognized and excluded if they are part of a regular, non-threatening operation.
- Legitimate software updates or patches may alter configuration files. Monitor update schedules and exclude these processes during known update windows to reduce false positives.
- Custom scripts developed in-house for cluster management might not be recognized by default. Review these scripts and add them to the exclusion list if they are verified as safe and necessary for operations.

### Response and remediation

- Immediately isolate the affected node or container to prevent further unauthorized access or changes to the Kubernetes configuration files.
- Review the modified configuration files to identify unauthorized changes and revert them to their last known good state using backups or version control systems.
- Conduct a thorough investigation to identify the source of the unauthorized changes, focusing on process names and user accounts involved in the modification.
- Escalate the incident to the security operations team for further analysis and to determine if additional systems or nodes have been compromised.
- Implement additional access controls and monitoring on the affected systems to prevent recurrence, such as restricting write permissions to sensitive directories and files.
- Update and patch the Kubernetes environment and related components to address any vulnerabilities that may have been exploited.
- Enhance detection capabilities by ensuring that alerts are configured to notify the security team of any future unauthorized changes to critical Kubernetes configuration files.
"""
risk_score = 47
rule_id = "0fe2290a-2664-4c9c-8263-b88904f12f0d"
setup = """## Setup

This rule requires data coming in from Elastic Defend.

### Elastic Defend Integration Setup
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.

#### Prerequisite Requirements:
- Fleet is required for Elastic Defend.
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).

#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
- Go to the Kibana home page and click "Add integrations".
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
- Click "Add Elastic Defend".
- Configure the integration name and optionally add a description.
- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
- Click "Save and Continue".
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
"""
severity = "medium"
tags = [
    "Domain: Endpoint",
    "Domain: Kubernetes",
    "Domain: Container",
    "OS: Linux",
    "Use Case: Threat Detection",
    "Tactic: Persistence",
    "Data Source: Elastic Defend",
    "Data Source: Elastic Defend for Containers",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"
query = '''
file where host.os.type == "linux" and event.type != "deletion" and file.path like (
  "/etc/kubernetes/manifests/*",
  "/etc/kubernetes/pki/*",
  "/etc/kubernetes/*.conf"
) and not (
  process.name in ("kubeadm", "kubelet", "dpkg", "sed") or
  (process.name in ("vi", "vim", "vim.basic") and file.extension in ("swx", "swp"))
)
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1053"
name = "Scheduled Task/Job"
reference = "https://attack.mitre.org/techniques/T1053/"

[[rule.threat.technique.subtechnique]]
id = "T1053.007"
name = "Container Orchestration Job"
reference = "https://attack.mitre.org/techniques/T1053/007/"

[[rule.threat.technique]]
id = "T1543"
name = "Create or Modify System Process"
reference = "https://attack.mitre.org/techniques/T1543/"

[[rule.threat.technique.subtechnique]]
id = "T1543.005"
name = "Container Service"
reference = "https://attack.mitre.org/techniques/T1543/005/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1610"
name = "Deploy Container"
reference = "https://attack.mitre.org/techniques/T1610/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1543"
name = "Create or Modify System Process"
reference = "https://attack.mitre.org/techniques/T1543/"

[[rule.threat.technique.subtechnique]]
id = "T1543.005"
name = "Container Service"
reference = "https://attack.mitre.org/techniques/T1543/005/"

[rule.threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[metadata]
creation_date = "2023/07/27"
integration = ["endpoint", "auditd_manager", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2026/08/21"

[rule]
author = ["Elastic"]
description = """
This rule monitors for the usage of the most common clipboard utilities on unix systems by an uncommon process parent.
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
"""
from = "now-9m"
index = [
          "logs-endpoint.events.process*",
          "logs-sentinel_one_cloud_funnel.*",
          "endgame-*",
          "auditbeat-*",
          "logs-auditd_manager.auditd-*",
        ]
language = "kuery"
license = "Elastic License v2"
name = "Linux Clipboard Activity Detected"
references = ["https://www.trellix.com/blogs/research/when-agents-go-rogue-openclaw-supply-chain-crisis/"]
risk_score = 21
rule_id = "884e87cc-c67b-4c90-a4ed-e1e24a940c82"
severity = "low"
tags = [
    "Domain: Endpoint",
    "OS: Linux",
    "Use Case: Threat Detection",
    "Tactic: Collection",
    "Data Source: Elastic Defend",
    "Data Source: Elastic Endgame",
    "Data Source: Auditd Manager",
    "Data Source: SentinelOne",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "new_terms"
query = '''
event.category:process and host.os.type:"linux" and event.type:"start" and
event.action:("exec" or "exec_event" or "executed" or "process_started" or "start") and
process.name:("xclip" or "xsel" or "wl-clipboard" or "clipman" or "copyq" or "pbcopy" or "wl-copy") and
not process.parent.name:("bwrap" or "micro")
'''
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Linux Clipboard Activity Detected

Clipboard utilities on Linux, such as xclip and xsel, facilitate data transfer between applications by storing copied content temporarily. Adversaries exploit this by capturing sensitive data copied by users. The detection rule identifies unusual clipboard activity by monitoring processes that start these utilities, excluding common parent processes, to flag potential misuse. This helps in identifying unauthorized data collection attempts.

### Possible investigation steps

- Review the alert details to identify the specific process name that triggered the alert, focusing on clipboard utilities like xclip, xsel, wl-clipboard, clipman, or copyq.
- Examine the parent process of the detected clipboard utility to understand the context of its execution, ensuring it is not a common parent process like bwrap or micro.
- Investigate the user account associated with the process to determine if the activity aligns with their typical behavior or if it appears suspicious.
- Check the timing and frequency of the clipboard utility's execution to assess if it coincides with any known user activities or if it suggests automated or unauthorized access.
- Analyze any related process events or logs around the time of the alert to identify potential data exfiltration attempts or other malicious activities.
- Consider correlating this alert with other security events or alerts to identify patterns or broader attack campaigns targeting clipboard data.

### False positive analysis

- Frequent use of clipboard utilities by legitimate applications or scripts can trigger false positives. Identify and document these applications to create exceptions in the detection rule.
- Developers and system administrators often use clipboard utilities in automated scripts. Review and whitelist these scripts to prevent unnecessary alerts.
- Some desktop environments or window managers may use clipboard utilities as part of their normal operation. Monitor and exclude these processes if they are verified as non-threatening.
- Regular user activities involving clipboard utilities for productivity tasks can be mistaken for suspicious behavior. Educate users on safe practices and adjust the rule to exclude known benign parent processes.
- Consider the context of the clipboard utility usage, such as time of day or user role, to refine detection criteria and reduce false positives.

### Response and remediation

- Immediately isolate the affected system from the network to prevent potential data exfiltration or further unauthorized access.
- Terminate any suspicious processes identified as running clipboard utilities without a common parent process, such as xclip or xsel, to stop potential data capture.
- Conduct a thorough review of recent clipboard activity logs to identify any sensitive data that may have been captured and assess the potential impact.
- Change passwords and rotate any credentials that may have been copied to the clipboard recently to mitigate the risk of credential theft.
- Escalate the incident to the security operations team for further investigation and to determine if additional systems are affected.
- Implement additional monitoring on the affected system to detect any further unauthorized clipboard activity or related suspicious behavior.
- Review and update endpoint security configurations to ensure that only authorized processes can access clipboard utilities, reducing the risk of future exploitation."""

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1115"
name = "Clipboard Data"
reference = "https://attack.mitre.org/techniques/T1115/"

[rule.threat.tactic]
id = "TA0009"
name = "Collection"
reference = "https://attack.mitre.org/tactics/TA0009/"

[rule.new_terms]
field = "new_terms_fields"
value = ["host.id", "process.parent.executable"]

[[rule.new_terms.history_window_start]]
field = "history_window_start"
value = "now-5d"