Elastic rules: 1g

[metadata]
creation_date = "2020/05/21"
integration = ["okta"]
maturity = "production"
updated_date = "2026/04/10"

[rule]
author = ["Elastic"]
description = """
Detects attempts to create an Okta API token. An adversary may create an Okta API token to maintain access to an
organization's network while they work to achieve their objectives. An attacker may abuse an API token to execute
techniques such as creating user accounts or disabling security rules or policies.
"""
false_positives = [
    """
    If the behavior of creating Okta API tokens is expected, consider adding exceptions to this rule to filter false
    positives.
    """,
]
index = ["filebeat-*", "logs-okta*"]
language = "kuery"
license = "Elastic License v2"
name = "Attempt to Create Okta API Token"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Attempt to Create Okta API Token

Okta API tokens are crucial for automating and managing identity and access tasks within an organization. However, if compromised, these tokens can be exploited by adversaries to gain persistent access, manipulate user accounts, or alter security settings. The detection rule identifies suspicious token creation activities by monitoring specific Okta system events, helping to thwart unauthorized access attempts.

### Possible investigation steps

- Review the event logs for entries with event.dataset:okta.system and event.action:system.api_token.create to identify the specific instance of API token creation.
- Identify the user account associated with the token creation event to determine if the action aligns with their typical behavior or role within the organization.
- Check the timestamp of the event to correlate with other security events or anomalies that occurred around the same time.
- Investigate the IP address and location from which the API token creation request originated to assess if it matches the user's usual access patterns.
- Examine any recent changes to user accounts or security settings that may have been executed using the newly created API token.
- Review the organization's policy on API token creation to ensure compliance and determine if the action was authorized.

### False positive analysis

- Routine administrative tasks may trigger the rule when legitimate IT staff create API tokens for automation or integration purposes. To manage this, maintain a list of authorized personnel and their expected activities, and create exceptions for these known users.
- Scheduled system maintenance or updates might involve creating API tokens, leading to false positives. Document these events and adjust the monitoring window or create temporary exceptions during these periods.
- Third-party integrations that require API tokens for functionality can also trigger alerts. Identify and whitelist these integrations by verifying their necessity and security compliance.
- Development and testing environments often involve frequent token creation for testing purposes. Exclude these environments from the rule or set up separate monitoring with adjusted thresholds to avoid unnecessary alerts.

### Response and remediation

- Immediately revoke the suspicious Okta API token to prevent any unauthorized access or actions within the organization's network.
- Conduct a thorough review of recent activities associated with the compromised token to identify any unauthorized changes or access attempts.
- Reset credentials and enforce multi-factor authentication for any accounts that were accessed or potentially compromised using the API token.
- Notify the security team and relevant stakeholders about the incident to ensure awareness and coordination for further investigation and response.
- Implement additional monitoring on Okta API token creation events to detect and respond to any further unauthorized attempts promptly.
- Review and update access controls and permissions related to API token creation to ensure they align with the principle of least privilege.
- Escalate the incident to senior security management if there is evidence of broader compromise or if the threat actor's objectives are unclear.

## Setup

The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
references = [
    "https://developer.okta.com/docs/reference/api/system-log/",
    "https://developer.okta.com/docs/reference/api/event-types/",
    "https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy",
    "https://www.elastic.co/security-labs/monitoring-okta-threats-with-elastic-security",
    "https://www.elastic.co/security-labs/starter-guide-to-understanding-okta",
]
risk_score = 47
rule_id = "96b9f4ea-0e8c-435b-8d53-2096e75fcac5"
severity = "medium"
tags = [
    "Use Case: Identity and Access Audit",
    "Data Source: Okta",
    "Tactic: Persistence",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset:okta.system and event.action:system.api_token.create
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"

[[rule.threat.technique.subtechnique]]
id = "T1098.001"
name = "Additional Cloud Credentials"
reference = "https://attack.mitre.org/techniques/T1098/001/"

[[rule.threat.technique]]
id = "T1136"
name = "Create Account"
reference = "https://attack.mitre.org/techniques/T1136/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[metadata]
creation_date = "2023/02/22"
integration = ["endpoint", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2026/03/24"

[rule]
author = ["Elastic"]
description = """
Adversaries may attempt to disable the iptables or firewall service in an attempt to affect how a host is allowed to
receive or send network traffic.
"""
from = "now-9m"
index = ["endgame-*", "logs-endpoint.events.process*", "logs-sentinel_one_cloud_funnel.*"]
language = "eql"
license = "Elastic License v2"
name = "Attempt to Disable IPTables or Firewall"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Attempt to Disable IPTables or Firewall

Firewalls like IPTables on Linux systems are crucial for controlling network traffic and protecting against unauthorized access. Adversaries may attempt to disable these firewalls to bypass security measures and facilitate malicious activities. The detection rule identifies suspicious processes that attempt to disable or stop firewall services, such as using commands to flush IPTables rules or halt firewall services, indicating potential defense evasion tactics.

### Possible investigation steps

- Review the process details, including process.name and process.args, to confirm if the command was intended to disable or stop firewall services.
- Check the process.parent.args to understand the context in which the suspicious process was executed, especially if it was triggered by a parent process with arguments like "force-stop".
- Investigate the user account associated with the process execution to determine if it was an authorized user or potentially compromised.
- Examine the host's recent activity logs for any other suspicious behavior or anomalies around the time of the alert, focusing on event.type "start" and event.action "exec" or "exec_event".
- Assess the network traffic logs to identify any unusual inbound or outbound connections that might have occurred after the firewall was disabled or stopped.
- Correlate this event with other alerts or incidents involving the same host or user to identify potential patterns or coordinated attack attempts.

### False positive analysis

- Routine system maintenance or updates may trigger the rule when legitimate processes like systemctl or service are used to stop or restart firewall services. To manage this, create exceptions for known maintenance scripts or scheduled tasks that perform these actions.
- Network troubleshooting activities often involve temporarily disabling firewalls to diagnose connectivity issues. Users can exclude specific user accounts or IP addresses associated with network administrators from triggering the rule during these activities.
- Automated deployment scripts that configure or reconfigure firewall settings might match the rule's criteria. Identify and whitelist these scripts by their process names or execution paths to prevent false positives.
- Security software updates or installations may require temporary firewall adjustments, which could be flagged by the rule. Consider excluding processes associated with trusted security software vendors during update windows.
- Development or testing environments often have different security requirements, leading to frequent firewall changes. Implement environment-specific exceptions to avoid false positives in these contexts.

### Response and remediation

- Immediately isolate the affected host from the network to prevent further unauthorized access or potential lateral movement by the adversary.
- Terminate any suspicious processes identified in the alert, such as those attempting to disable or stop firewall services, to halt ongoing malicious activities.
- Review and restore the firewall configurations to their last known good state to ensure that network traffic is properly controlled and unauthorized access is blocked.
- Conduct a thorough examination of the affected system for any signs of compromise or additional malicious activity, focusing on logs and system changes around the time of the alert.
- Escalate the incident to the security operations team for further analysis and to determine if the threat is part of a larger attack campaign.
- Implement additional monitoring and alerting for similar activities across the network to detect and respond to future attempts to disable firewall services promptly.
- Review and update firewall policies and configurations to enhance security measures and prevent similar defense evasion tactics in the future."""
references = ["https://www.elastic.co/security-labs/detecting-log4j2-with-elastic-security"]
risk_score = 47
rule_id = "83e9c2b3-24ef-4c1d-a8cd-5ebafb5dfa2f"
setup = """## Setup

This rule requires data coming in from Elastic Defend.

### Elastic Defend Integration Setup
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.

#### Prerequisite Requirements:
- Fleet is required for Elastic Defend.
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).

#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
- Go to the Kibana home page and click "Add integrations".
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
- Click "Add Elastic Defend".
- Configure the integration name and optionally add a description.
- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
- Click "Save and Continue".
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
"""
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: Linux",
    "Use Case: Threat Detection",
    "Tactic: Defense Evasion",
    "Data Source: Elastic Defend",
    "Data Source: Elastic Endgame",
    "Data Source: SentinelOne",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"
query = '''
process where host.os.type == "linux" and event.type == "start" and event.action in ("exec", "exec_event", "start") and
(
   /* disable FW */
  (
    (process.name == "ufw" and process.args == "disable") or
    (process.name == "iptables" and process.args in ("-F", "--flush", "-X", "--delete-chain") and process.args_count == 2) or
    (process.name in ("iptables", "ip6tables") and process.parent.args == "force-stop")
  ) or

   /* stop FW service */
  (
    (
      (process.name == "service" and process.args == "stop") or
      (process.name == "chkconfig" and process.args == "off") or
      (process.name == "update-rc.d" and process.args in ("remove", "disable")) or
      (process.name == "systemctl" and process.args in ("disable", "stop", "kill", "mask"))
    ) and
    process.args in ("firewalld", "ip6tables", "iptables", "firewalld.service", "ip6tables.service", "iptables.service")
  )
)
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"

[[rule.threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"

[[rule.threat.technique.subtechnique]]
id = "T1562.004"
name = "Disable or Modify System Firewall"
reference = "https://attack.mitre.org/techniques/T1562/004/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1489"
name = "Service Stop"
reference = "https://attack.mitre.org/techniques/T1489/"

[rule.threat.tactic]
id = "TA0040"
name = "Impact"
reference = "https://attack.mitre.org/tactics/TA0040/"

[metadata]
creation_date = "2026/06/04"
integration = ["aws"]
maturity = "production"
updated_date = "2026/06/04"

[rule]
author = ["Elastic"]
description = """
Identifies AWS Bedrock Agent creation performed directly by an IAM user or the root account. Bedrock Agents are
autonomous AI systems that execute multi-step tasks, invoke Lambda action groups to call external APIs, and query
knowledge bases. Adversaries with access to an AWS account can create rogue agents configured to exfiltrate data via
action group Lambda functions, pivot to other services, or act as a persistent AI-driven command-and-control channel.
This rule is scoped to IAMUser and Root identity types — AssumedRole sessions (which represent automated CI/CD pipelines
and SSO-federated engineers) are excluded to avoid global false positives from legitimate deployment automation that
varies widely across customer environments.
"""
false_positives = [
    """
    Developers or administrators creating Bedrock agents interactively using personal IAM user credentials. This is the
    intended detection surface — validate the identity against known developer accounts and confirm the agent
    configuration (instruction, action groups, model) matches a known project.
    """,
]
from = "now-6m"
index = ["logs-aws.cloudtrail-*"]
language = "kuery"
license = "Elastic License v2"
name = "AWS Bedrock Agent Created by IAM User or Root"
note = """## Triage and analysis

### Investigating AWS Bedrock Agent Created by IAM User or Root

AWS Bedrock Agents can autonomously perform complex tasks by combining foundation models with action groups
(Lambda functions) and knowledge bases. A rogue agent could serve as a persistent AI-driven foothold, executing
attacker-controlled instructions via inference requests.

#### Possible investigation steps

- **Identity**: `aws.cloudtrail.user_identity.arn` and `aws.cloudtrail.user_identity.type`. This rule fires only
  for IAMUser or Root — both are direct human credentials, not automated pipeline roles. Confirm the user is
  known and authorized to create agents.

- **Agent configuration** in `aws.cloudtrail.request_parameters`:
  - `agentName` — does the name match known internal projects?
  - `foundationModel` — which model was selected? Expensive models (Claude Opus-class) indicate higher cost risk.
  - `instruction` — the system prompt. Adversarial, minimal, or exfiltration-oriented instructions are a red flag.
  - `actionGroupExecutor.lambda` — Lambda ARN presence means the agent can invoke external code.

- **Cross-account indicators**: Lambda ARNs in action groups belonging to a different account than
  `cloud.account.id` indicate external code execution capability.

- **Follow-on activity**: Look for `PrepareAgent`, `CreateAgentAlias`, `CreateAgentActionGroup`, or
  `AssociateAgentKnowledgeBase` from the same identity within the next hour.

### False positive analysis
- Developers creating agents interactively with personal IAM user credentials. Confirm the agent is for a known
  project and the IAM user is authorized. Production agent deployment should use IAM roles — personal key use
  is itself a misconfiguration worth noting.

### Response and remediation
- Delete the unauthorized agent using `DeleteAgent`.
- Review and remove associated action groups and aliases.
- Audit Lambda functions referenced in action group executors for malicious code.
- Restrict `bedrock:CreateAgent` to specific deployment roles via IAM policy or SCP.
"""
references = [
    "https://docs.aws.amazon.com/bedrock/latest/userguide/agents.html",
    "https://docs.aws.amazon.com/bedrock/latest/APIReference/API_agent_CreateAgent.html",
]
risk_score = 21
rule_id = "4e2dcdf4-f012-4b67-980b-1551b7149305"
severity = "low"
tags = [
    "Domain: Cloud",
    "Domain: LLM",
    "Data Source: AWS",
    "Data Source: AWS CloudTrail",
    "Data Source: Amazon Web Services",
    "Data Source: Amazon Bedrock",
    "Use Case: Threat Detection",
    "Tactic: Persistence",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset: "aws.cloudtrail"
    and event.provider: "bedrock.amazonaws.com"
    and event.action: "CreateAgent"
    and event.outcome: "success"
    and aws.cloudtrail.user_identity.type: ("IAMUser" or "Root")
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1505"
name = "Server Software Component"
reference = "https://attack.mitre.org/techniques/T1505/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user_agent.original",
    "source.ip",
    "aws.cloudtrail.user_identity.arn",
    "aws.cloudtrail.user_identity.type",
    "aws.cloudtrail.user_identity.access_key_id",
    "event.action",
    "event.outcome",
    "cloud.account.id",
    "cloud.region",
    "aws.cloudtrail.request_parameters",
    "aws.cloudtrail.response_elements",
]

[rule]
description = """
Detects when curl is used to access a Telegram API or web endpoint. Several malware samples have been observed utilizing
Telegram as a C2, payload delivery, and domain rotation channel, including via t.me bot URLs.
"""
id = "479a2a9e-caba-43ea-b28b-88b1b242edd2"
license = "Elastic License v2"
name = "Curl to Telegram API"
os_list = ["macos"]
version = "1.0.6"

query = '''
sequence by process.entity_id with maxspan=15s
[process where event.type == "start" and event.action == "exec" and 
  process.name in ("curl", "nscurl") and 
  not (process.parent.name == "Telegram" or process.Ext.effective_parent.name == "Telegram")]
[network where event.type == "start" and process.name in ("curl", "nscurl") and destination.domain in ("api.telegram.org", "api.telegram.org.", "t.me", "t.me.")]
'''

min_endpoint_version = "8.16.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"
[[threat.technique.subtechnique]]
id = "T1071.001"
name = "Web Protocols"
reference = "https://attack.mitre.org/techniques/T1071/001/"



[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "8.16.0"

[rule]
description = """
This rule detects DNS queries to suspicious file upload/download services via living-off-the-land executables or
executables in world/user-writable directories. Malware authors may use these services to exfiltrate data from the
target system or to download payloads for later execution.
"""
id = "4b648636-f4d4-4ac8-ac34-df7758201824"
license = "Elastic License v2"
name = "DNS Request to Suspicious File Upload/Download Service"
os_list = ["linux"]
reference = ["https://lolexfil.github.io/"]
version = "1.0.5"

query = '''
sequence by process.entity_id with maxspan=10s
  [process where event.type == "start" and event.action == "exec" and (
    process.name in ("curl", "wget", "bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "busybox", "timeout", "env") or
    process.name like (".*", "python*", "perl*", "php*", "ruby*", "lua*", "node", "deno") or
    process.executable like (
      "./*", "/tmp/*", "/var/tmp/*", "/dev/shm/*", "/run/*", "/var/run/*", "/boot/*", "/sys/*",
      "/lost+found/*", "/proc/*", "/var/mail/*", "/var/www/*", "/home/*/*", "/root/*"
    )
  ) and not (
    (process.name like "php*" and process.parent.name == "timeout" and process.args == "/var/tools/koalaping/bin/ping.php") or
    process.executable like "/home/*/OtherApps/firefox/firefox-bin" or
    process.working_directory like "/srv/sao/Processing/Workdir/*" or
    (
      process.parent.executable == "/usr/bin/gnome-shell" and
      process.args like (
        "/snap/firefox/*/firefox.launcher", "/usr/bin/firefox", "/home/*/OtherApps/firefox/firefox"
      )
    ) or
    process.executable like "*/hermes-agent/.hermes-runtime/python/*/bin/python*"
  )]
  [dns where event.action == "lookup_result" and dns.question.name like~ (
    /* Generic suspicious upload/download services */
    "*pastebin.com", "*hastebin.com", "*dpaste.org", "*controlc.com", "*0bin.net", "*p.ip.fi", "*sprunge.us",
    "*paste.ee", "*paste.ofcode.org", "*textbin.net", "*send.now", "*send.cm", "*pixeldrain.com", "*megaupload.com",
    "*mediafire.com", "*bashupload.com", "*bujang.online", "*sendit.sh", "*paste4btc.com", "*ghostbin.com", "*filebin.net",
    "*paste.wakas.org", "*paste.c-net.org", "*paste.hexaspaces.com",

    /* https://lolexfil.github.io/ */
    "*anonfiles.com", "*bayfiles.com" , "*bublup.com", "*catbox.moe", "*dropfiles.org", "*dropmefiles.com",
    "*easyupload.io", "*file.io", "*filetransfer.io", "*gofile.io", "*qaz.im", "*send.exploit.in", "*sendspace.com",
    "*share.riseup.net", "*temp.sh", "*tempsend.com", "*transfer.sh", "*ufile.io", "*paste.rs", "*nopaste.net"
  )]
'''

min_endpoint_version = "9.3.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"
[[threat.technique.subtechnique]]
id = "T1071.004"
name = "DNS"
reference = "https://attack.mitre.org/techniques/T1071/004/"


[[threat.technique]]
id = "T1102"
name = "Web Service"
reference = "https://attack.mitre.org/techniques/T1102/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "9.3.0"

[rule]
description = """
Identifies a dropped unsigned program making a DNS request to a known public IP address lookup web service. Malwares
tend to perform this action to assess potential targets.
"""
id = "dfe28e03-9b0b-47f5-9753-65ed2666663f"
license = "Elastic License v2"
name = "External IP Address Discovery via Untrusted Program"
os_list = ["windows"]
version = "1.0.44"

query = '''
sequence by process.entity_id with maxspan=1m

 /* execution of an unsigned PE file followed by dns request to public ip discovery web services */

  [process where event.action == "start" and not user.id : "S-1-5-18" and
   not process.code_signature.trusted == true and
   process.executable : ("?:\\Users\\*", "?:\\ProgramData\\*", "?:\\Windows\\Temp\\*", "?:\\Windows\\Tasks\\*") and
   (process.Ext.relative_file_creation_time <= 300 or process.Ext.relative_file_name_modify_time <= 300) and
   not process.hash.sha256 :
                   ("99f9ed0629c5bd62413ecbc670092da217862d21db1e1bea786a4d921289571c",
                    "e739d08d695cfe2a68d4566c71d756ca25602e4c7e050e93ecbe3cdc7aa44b58",
                    "f58f2d82bba0477e64f124c9e75523524927dc9c72f60e2b4f00c482cc57313b", 
                    "37d66cf4990eabe4cfa65e4f73d673a03cbce33d1bdf7b64f0b661f4a0872b9a", 
                    "7592a2943c2af6b9b84ebd1c8a577fdffdbf867286c8e97d16cc2087637c0ce0", 
                    "4d7574026cfd3bfb159ed7d4780f9e1462b5e8828a7ed7979a13977e4cd6611e", 
                    "db2c94936e13eb47fc6bff6ee9c03ee43d0a5bcb4b27df598a00c962b604f641", 
                    "3637ef7b9ab2b80940572a7e80102bbecb75d862ae4dcf16945cbea3368a3777", 
                    "c9b49399b3dec9003ae924736f7c947ca2a8821ef31797145a9c241dd91429c1", 
                    "73277600db6c0586fa2016001dd4a8affdf4a83f194a8afb16956cde0b79b58f", 
                    "89cd13792d1a14fa965e8e430a40438929de00c00e4afa2e8710b94b9d346852", 
                    "b19334da610a7ead290419f28bad0e51704aaadfcec56ddccaefdc3097568c18",
                    "e8d970029133b8aad87ccab772d3acbc039fa392ad8f5a64f48e5921aea16f2c",
                    "2d13dabb8766483884b13cbe87eb5f80f7c1f25f7692ef718611808d2c0d4a2e",
                    "ea0c4140fe1f6af856e99fe90af5bd2ebd11f752811f2aa65aee028dbd0406d1",
                    "c08408c64870d36a9679f11f7d0291116a0cf63a9c3de7c1a90dbeeb21f73c56",
                    "7cf3535608862868067514741bf859d6f4d9b72ec8c04987e2d1f28a01fe4fd1",
                    "403ebb78ec10ccbc060cd9bdb5ecd6d6d8565d468017fcaa852ffd1fa610bf83",
                    "93cd90ef0ba8d8e943591c209ca14b1bf83ff33734328c356ec74c5ae090d437",
                    "e63ca8cb5b49daac2f3be62065d6b199390ff187aa7d42703e4b14bfa2ec1391",
                    "1621af8b21a3d3e7c5205e7e6bd6ac6e42affffc8383cb1d3f2811d53379131f",
                    "bf33445f21aa6f90f1ff6bc243bf54f06b4661ca423d50731a340a3d60264e27",
                    "d6cb3408f10dfd6c26233daefdba24007fc971e3dd08f4f82a505a721e19fc8b",
                    "221ce70deba5b82fa9910a2f320078ee1cf773050cffaa98f9c5fbb5b45f45ee",
                    "268130c19d5b8691990c07f5d133c39a8012d6f1726c8e20f0e5c7071ce9bd5d",
                    "05eb7332d3711dfdd2a90c7860162e8d1a1d55ef75ba806da40fb98d60edbabd",
                    "821bd11693bf4b4b2b9f3c196036e1f4902abd95fb26873ea6c43e123b8c9431",
                    "0b7161d83ea48142a8593ad721a1546440fcbe09fb83cf644fecd456e3a0c38e",
                    "ef1941d82bb658e614b9857493bb2e0eedf14f619d28404294628d136573b3cd",
                    "96ada02d961dcfacb396a911c495073887d8bd2a0dda4b491294c573e76af750", 
                    "f60c5057286d6f5ca454be1f59f519e6480111868b52a70af1c3ff1b6e736f4b")]
  [dns where
    dns.question.name :
         (
          "ip-api.com",
          "checkip.dyndns.org",
          "api.ipify.org",
          "whatismyip.akamai.com",
          "bot.whatismyipaddress.com",
          "ifcfg.me",
          "ident.me",
          "ipof.in",
          "ip.tyk.nu",
          "icanhazip.com",
          "curlmyip.com",
          "wgetip.com",
          "eth0.me",
          "ipecho.net",
          "ip.appspot.com",
          "api.myip.com",
          "geoiptool.com",
          "api.2ip.ua",
          "api.ip.sb",
          "ipinfo.io",
          "checkip.amazonaws.com",
          "wtfismyip.com",
          "iplogger.*",
          "freegeoip.net",
          "freegeoip.app",
          "ipinfo.io",
          "geoplugin.net",
          "myip.dnsomatic.com",
          "www.geoplugin.net",
          "api64.ipify.org",
          "ip4.seeip.org",
          "*.geojs.io",
          "*portmap.io",
          "api.2ip.ua",
          "api.db-ip.com",
          "geolocation-db.com",
          "httpbin.org",
          "myip.opendns.com",
          "ipwho.is"
         )
         ]
'''

min_endpoint_version = "8.4.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1016"
name = "System Network Configuration Discovery"
reference = "https://attack.mitre.org/techniques/T1016/"


[threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"

[internal]
min_endpoint_version = "8.4.0"

[metadata]
creation_date = "2023/09/27"
integration = ["endpoint"]
maturity = "production"
updated_date = "2026/03/24"

[rule]
author = ["Elastic"]
building_block_type = "default"
description = """
Identifies unusual files downloaded from outside the local network that have the potential to be abused for code
execution.
"""
from = "now-119m"
index = ["logs-endpoint.events.file-*"]
interval = "60m"
language = "eql"
license = "Elastic License v2"
name = "File with Suspicious Extension Downloaded"
references = [
    "https://x.com/Laughing_Mantis/status/1518766501385318406",
    "https://wikileaks.org/ciav7p1/cms/page_13763375.html",
]
risk_score = 21
rule_id = "8d366588-cbd6-43ba-95b4-0971c3f906e5"
severity = "low"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Defense Evasion",
    "Data Source: Elastic Defend",
    "Rule Type: BBR",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
file where host.os.type == "windows" and event.type == "creation" and
  file.extension : (
    "appinstaller", "application", "appx", "appxbundle", "cpl", "diagcab", "diagpkg", "diagcfg", "manifest",
    "msix", "pif", "search-ms", "searchConnector-ms", "settingcontent-ms", "symlink", "theme", "themepack" 
  ) and file.Ext.windows.zone_identifier > 1 and
  not
  (
    (
      file.extension : "msix" and 
      file.path : (
        "?:\\Users\\*\\AppData\\Local\\Temp\\WinGet\\Microsoft.Winget.Source*",
        "?:\\Windows\\system32\\config\\systemprofile\\AppData\\Local\\Microsoft\\WinGet\\State\\defaultState\\Microsoft.PreIndexed.Package\\Microsoft.Winget.Source*"
      )
    ) or
    (
      process.name : "Teams.exe" and process.code_signature.trusted == true and
      file.extension : "msix" and 
      file.path : "?:\\Users\\*\\AppData\\Roaming\\Microsoft\\Teams\\tmp\\*"
    )
  )
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"

[[rule.threat.technique.subtechnique]]
id = "T1566.001"
name = "Spearphishing Attachment"
reference = "https://attack.mitre.org/techniques/T1566/001/"

[[rule.threat.technique.subtechnique]]
id = "T1566.002"
name = "Spearphishing Link"
reference = "https://attack.mitre.org/techniques/T1566/002/"

[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1204"
name = "User Execution"
reference = "https://attack.mitre.org/techniques/T1204/"

[[rule.threat.technique.subtechnique]]
id = "T1204.002"
name = "Malicious File"
reference = "https://attack.mitre.org/techniques/T1204/002/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[rule]
description = """
Identifies the modification of WinInet registry related keys by a process where the creating thread's stack contains
frames pointing outside any known executable image. This may indicate evasion via process injection.
"""
id = "7dca0e22-0e3f-4ed0-ad28-eff5617adf75"
license = "Elastic License v2"
name = "Internet Activity from Suspicious Unbacked Memory"
os_list = ["windows"]
version = "1.0.21"

query = '''
registry where process.executable : ("C:\\*", "D:\\*") and
 registry.path : "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\*" and
 process.thread.Ext.call_stack_summary :
                  ("ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked|kernel32.dll|ntdll.dll",
                   "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|wininet.dll|ntdll.dll|kernelbase.dll|wininet.dll|Unbacked|*",
                   "*wininet.dll|Unbacked|kernel32.dll*",
                   "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked|*",
                   "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked",
                   "ntdll.dll|kernelbase.dll|Unbacked",
                   "ntdll.dll|iphlpapi.dll|Unbacked",
                   "ntdll.dll|kernelbase.dll|Unbacked|kernel32.dll|ntdll.dll",
                   "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|Unbacked",
                   "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|wininet.dll|Unbacked|ntdll.dll",
                   "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|Unbacked|kernel32.dll|ntdll.dll",
                   "ntdll.dll|kernelbase.dll|Unbacked|kernelbase.dll|ntdll.dll|kernel32.dll|ntdll.dll", 
                   "ntdll.dll|kernelbase.dll|aclayers.dll|wininet.dll|ntdll.dll|kernelbase.dll|wininet.dll|Unbacked") and
 not process.thread.Ext.call_stack_summary :
            ("*mscorlib.dll*","*|clr.dll*", "*coreclr.dll*", "*mscoreei.dll*", "*mscoree.dll*", "*system.ni.dll*",
             "*mscorlib.ni.dll*", "*mscorwks.dll*", "*mscorsvc.dll*", "*system.private.corelib.dll*", "*java.dll|Unbacked*", 
             "*user32.dll|bdhkm32.dll*", "*wininet.dll|Unbacked|system.core.ni.dll|Unbacked", "*wininet.dll|Unbacked|cmserver.exe|kernel32.dll|ntdll.dll") and
 not (process.executable : ("?:\\Windows\\System32\\inetsrv\\w3wp.exe",
                            "?:\\Program Files (x86)\\Lenovo\\VantageService\\*\\LenovoVantageService.exe",
                            "?:\\Program Files\\Lenovo\\VantageService\\*\\LenovoVantageService.exe") and
      process.thread.Ext.call_stack_summary : "ntdll.dll|kernelbase.dll|Unbacked") and
 not process.executable : ("?:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\ADNotificationManager.exe",
                           "?:\\Program Files\\ByteFence\\ByteFenceScan.exe",
                           "?:\\Program Files\\Adobe\\Acrobat Reader DC\\Reader\\ADNotificationManager.exe",
                           "?:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AdobeCollabSync.exe",
                           "?:\\Program Files\\Adobe\\Acrobat Reader DC\\Reader\\AdobeCollabSync.exe", 
                           "?:\\Program Files (x86)\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe", 
                           "?:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\LogTransport2.exe", 
                           "?:\\Program Files (x86)\\Common Files\\Adobe\\Adobe Desktop Common\\ADS\\CRWindowsClientService.exe", 
                           "?:\\Program Files (x86)\\Adobe\\Acrobat DC\\Acrobat\\AdobeCollabSync.exe",
                           "?:\\Program Files (x86)\\Common Files\\Adobe\\Adobe Desktop Common\\ADS\\Adobe Crash Processor.exe",
                           "?:\\Program Files (x86)\\Adobe\\Acrobat DC\\Acrobat\\Adobe Crash Processor.exe", 
                           "?:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Adobe Crash Processor.exe",
                           "?:\\Program Files (x86)\\Western Digital\\WD SmartWare\\WDBackupEngine.exe",
                           "?:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil*.exe", 
                           "?:\\Windows\\system32\\Macromed\\Flash\\FlashUtil*.exe", 
                           "?:\\Program Files (x86)\\Romac\\Length Nesting\\LenNest.exe",
                           "?:\\Program Files (x86)\\Lavasoft\\Web Companion\\Application\\Lavasoft.WCAssistant.WinService.exe", 
                           "?:\\Program Files (x86)\\Microsoft Dynamics 365 for Operations - Document Routing\\Microsoft.Dynamics.AX.Framework.DocumentRouting.Agent.exe",
                           "?:\\Program Files (x86)\\JKI\\VI Package Manager\\VI Package Manager.exe",
                           "?:\\Program Files (x86)\\Schneider Electric\\ION Setup\\ionsetup.exe",
                           "?:\\Program Files (x86)\\Romac\\PC8.exe",
                           "?:\\Program Files\\Common Files\\microsoft shared\\VSTO\\??.?\\VSTOInstaller.exe",
                           "C:\\Comsof\\Comsof Fiber 24.1.?.??\\CopyMinder\\designer.exe.cm64.exe",
                           "C:\\Mark-10 Software\\MESURgauge Plus\\MESURgauge Plus.exe",
                           "C:\\Program Files (x86)\\Airwatch\\AgentUI\\TaskScheduler.exe",
                           "C:\\Program Files (x86)\\CriticalArc\\SafeZone\\SafeZoneApp.exe",
                           "C:\\Program Files (x86)\\HP\\HP Support Framework\\Modules\\HPSSFUpdater.exe",
                           "C:\\Program Files (x86)\\Laserfiche\\Client\\Scanning\\LFScan.exe") and
 not (process.code_signature.subject_name : "Cisco WebEx LLC" and process.executable : "?:\\Users\\*\\AppData\\Local\\WebEx\\webexAppLauncher.exe") and 
 not (process.code_signature.subject_name : ("GolfNow, LLC", "Pluralsight, LLC", "Blizzard Entertainment, Inc.", "Appgate Cybersecurity, INC.", 
                                             "Zoom Video Communications, Inc.", "Vertafore, Inc.", "Anatomage, Inc.", "Articulate Global, Inc.", 
                                             "Lenovo", "Mozilla Corporation", "TurbolabData_ABSKey.pfx", "eVision Holdings, LLC", "Zscaler, Inc.", 
                                             "March Networks Corporation", "EZLinks Golf LLC", "Prop Modest", "Audit Detective, LLC",
                                             "Shanghai Microvirt Software Technology CO., LTD.", "Laserfiche", "MAGNET FORENSICS INC.") and
      process.code_signature.trusted == true) and
 not (process.code_signature.subject_name : "Internet Testing Systems, LLC" and process.code_signature.trusted == true and
          process.name : ("PCSecureBrowser*.exe", "ETS Online Testing Browser.exe", "sb.exe")) and
 not _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info : "Unbacked*" and
                  $entry.callsite_trailing_bytes : ("*908b45ac488b55a0c6420c01488b55a0488b8d68ffffff48894a10488d65",
                                                    "*488b8d70ffffff49894c24104881c4a80000005b5e5f415c",
                                                    "50528bcb8b03ff50245a58e9ab000000558bec538b5d0ceb07558bec538b5d0856578bcb8b03ff50042be08bfc8d75088bcb8b03ff501c83f8087e068b0683c6",
                                                    "cc8945fc8b45fcc9c3558bec51ff0ddba50d1ba50d5ba50d9ae20edaa5536fba5a5a96c20e95e20e95c6660fe2944fa50d58a50d9ba50ddba50d1ba50d5ba50d",
                                                    "85c07444b8ffffffff89442444669085c074354c8d4c244441b800040000488d5530*",
                                                    "85c00f84f90000006a008d85e0faffffc785e0faffff00010000508d85f0feffff506a1356*",
                                                    "8b4d9cc6410801833d*5a58c74588000000008945a88955ac*"))
'''

min_endpoint_version = "8.10.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"

[rule]
description = """
Detects the creation of a reverse shell through a suspicious process chain spawned via a utility with suspicious command
line arguments. Reverse shells spawned by the specified utilities that are initialized from a single process followed by
a network connection attempt will be captured through this rule. Attackers may spawn reverse shells to establish
persistence onto a target system.
"""
id = "c71b9783-ca42-4532-8eb3-e8f2fe32ff39"
license = "Elastic License v2"
name = "Linux Reverse Shell via Suspicious Utility"
os_list = ["linux"]
reference = ["https://www.elastic.co/security-labs/primer-on-persistence-mechanisms"]
version = "1.0.10"

query = '''
sequence by process.entity_id with maxspan=5s
  [process where event.type == "start" and event.action  == "exec" and (
    (process.name like "python*" and process.args == "-c" and process.command_line like~ (
     "*import*pty*spawn*", "*import*subprocess*call*"
    )) or
    (process.name like "perl*" and process.args == "-e" and process.command_line like~ "*socket*" and process.command_line like~ (
     "*exec*", "*system*"
    )) or
    (process.name like "ruby*" and process.args in ("-e", "-rsocket") and process.command_line like~ (
     "*TCPSocket.new*", "*TCPSocket.open*"
     )) or
    (process.name like "lua*" and process.args == "-e" and process.command_line like~ "*socket.tcp*" and process.command_line like~ (
     "*io.popen*", "*os.execute*"
    )) or
    (process.name like "php*" and process.args == "-r" and process.command_line like~ "*fsockopen*" and process.command_line like~ "*/bin/*sh*") or 
    (process.name == "node" and process.args == "-e" and process.command_line like~ "*spawn*sh*" and process.command_line like~ "*connect*") or
    (process.name in ("awk", "gawk", "mawk", "nawk") and process.command_line like~ "*/inet/tcp/*")
   )]
  [network where event.type == "start" and event.action == "connection_attempted" and 
   process.name like ("python*", "php*", "perl", "ruby", "lua*", "*awk", "node") and not (
     destination.ip == null or destination.ip == "0.0.0.0" or cidrmatch(
       destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.0.0/29",
       "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
       "192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10",
       "192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1", "FE80::/10",
       "FF00::/8"
       )
    )]
'''

min_endpoint_version = "8.5.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1
tree = true

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
tree = true

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 1
tree = true

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "8.5.0"

[metadata]
creation_date = "2025/02/21"
integration = ["endpoint"]
maturity = "production"
updated_date = "2026/03/24"

[rule]
author = ["Elastic"]
description = """
This rule detects Linux user account credential modification events where the echo command is
used to directly echo a password into the passwd or shadow utilities. This technique is used by
malware to automate the process of user account credential modification on Linux systems post-infection.
"""
from = "now-9m"
index = ["logs-endpoint.events.process*"]
language = "eql"
license = "Elastic License v2"
name = "Linux User Account Credential Modification"
note = """ ## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Linux User Account Credential Modification

In Linux environments, user account credentials are crucial for system access and management. Adversaries may exploit command-line utilities to modify credentials, often using scripts to automate this process post-infection. The detection rule identifies suspicious use of shell commands that echo passwords into the passwd utility, a technique indicative of unauthorized credential changes, by monitoring specific command patterns and excluding benign processes.

### Possible investigation steps

- Review the process command line to confirm the presence of the suspicious pattern "*echo*passwd*" and assess if it aligns with known malicious activity.
- Identify the user account associated with the process to determine if it is a legitimate user or potentially compromised.
- Examine the parent process details, including the command line and executable path, to understand the context of how the suspicious process was initiated.
- Check for any recent changes to user accounts on the system, focusing on password modifications or new account creations around the time of the alert.
- Investigate the system for any additional signs of compromise, such as unexpected network connections or other suspicious processes running concurrently.
- Correlate the event with other security alerts or logs to identify if this activity is part of a broader attack pattern or campaign.

### False positive analysis

- Automated build processes may trigger this rule if they use shell scripts that include echoing passwords for testing or configuration purposes. To handle this, exclude processes with parent command lines or executables related to build tools like make.
- System administration scripts that automate user account management might use similar command patterns. Review these scripts and exclude them by specifying their parent process or executable paths.
- Custom user scripts for password management could inadvertently match the rule's criteria. Identify these scripts and add exceptions based on their unique command line or parent process attributes.
- Some legitimate software installations might use echo and passwd in their setup scripts. Monitor installation logs and exclude known safe installation processes by their parent command line or executable.

### Response and remediation

- Immediately isolate the affected Linux system from the network to prevent further unauthorized access or lateral movement by the adversary.
- Terminate any suspicious processes identified by the detection rule, particularly those involving the echo command being used with the passwd utility.
- Change the passwords of any user accounts that may have been compromised, ensuring the use of strong, unique passwords.
- Review and audit recent user account changes and access logs to identify any unauthorized modifications or access attempts.
- Restore any affected user accounts to their previous state using backups or system snapshots, if available.
- Escalate the incident to the security operations team for further investigation and to determine if additional systems are affected.
- Implement additional monitoring and alerting for similar command patterns to enhance detection and prevent recurrence of this threat.
"""
risk_score = 47
rule_id = "79e7291f-9e3b-4a4b-9823-800daa89c8f9"
setup = """## Setup
This rule requires data coming in from Elastic Defend.
### Elastic Defend Integration Setup
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
#### Prerequisite Requirements:
- Fleet is required for Elastic Defend.
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
- Go to the Kibana home page and click "Add integrations".
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
- Click "Add Elastic Defend".
- Configure the integration name and optionally add a description.
- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
- Click "Save and Continue".
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
"""
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: Linux",
    "Use Case: Threat Detection",
    "Tactic: Persistence",
    "Data Source: Elastic Defend",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"
query = '''
process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and
process.command_line like (
  "*echo*> /etc/passwd*", "*echo*>/etc/passwd*",
  "*echo*> /etc/shadow*", "*echo*>/etc/shadow*"
) and
not (
  process.parent.command_line == "runc init" or
  process.parent.executable in ("/usr/bin/make", "/bin/make")
)
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"

[rule.threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[rule]
description = """
Detects execution of common cloud and DevOps CLI commands used to print or export access tokens, often as a child of a
Bun process. This pattern may indicate supply chain compromise where a malicious npm or Bun package invokes host CLIs to
harvest cloud credentials during install or runtime scripts.
"""
id = "a8c3e891-4f2d-4b7e-9c1a-6e5d8b2f0a43"
license = "Elastic License v2"
name = "Potential Cloud Credential Harvesting via Bun"
os_list = ["macos"]
reference = [
    "https://futuresearch.ai/blog/litellm-pypi-supply-chain-attack/",
    "https://socket.dev/blog/sandworm-mode-npm-worm-ai-toolchain-poisoning",
    "https://www.koi.security/blog/postmark-mcp-npm-malicious-backdoor-email-theft",
]
version = "1.0.3"

query = '''
process where event.type == "start" and event.action in ("start", "exec") and
process.parent.name : ("bun", "bun.exe") and  process.parent.command_line : ("*.js", "*.mjs", "*.ts") and 
process.command_line like~ (
  "*gcloud config config-helper --format json*",
  "*gh auth token*",
  "*az account get-access-token*",
  "*kubectl*get*secret*"
) and 
not process.args in ("az account get-access-token --output json --resource https://database.windows.net", "az account get-access-token --output json --resource https://storage.azure.com", "https://storage.azure.com")
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
tree = true

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1195"
name = "Supply Chain Compromise"
reference = "https://attack.mitre.org/techniques/T1195/"
[[threat.technique.subtechnique]]
id = "T1195.001"
name = "Compromise Software Dependencies and Development Tools"
reference = "https://attack.mitre.org/techniques/T1195/001/"



[threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1528"
name = "Steal Application Access Token"
reference = "https://attack.mitre.org/techniques/T1528/"

[[threat.technique]]
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"
[[threat.technique.subtechnique]]
id = "T1552.001"
name = "Credentials In Files"
reference = "https://attack.mitre.org/techniques/T1552/001/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "7.15.0"

[rule]
description = """
Identifies the execution of the ClipUp process from an unusual parent and with the -ppl argument. This may indicate an
attempt to overwrite protected files to tamper with endpoint security solutions.
"""
id = "af6ca1a9-650f-4984-b83d-fc0a3b118c74"
license = "Elastic License v2"
name = "Potential Evasion via ClipUp Execution"
os_list = ["windows"]
reference = ["https://www.zerosalarium.com/2025/08/countering-edrs-with-backing-of-ppl-protection.html"]
version = "1.0.3"

query = '''
process where event.action == "start" and
 process.executable : "?:\\Windows\\System32\\ClipUp.exe" and process.args : "-ppl" and process.Ext.protection like "PsProtectedSigner*" and
 not process.parent.executable : ("?:\\Windows\\System32\\ClipUp.exe", "?:\\Windows\\System32\\smss.exe", "?:\\Windows\\System32\\conhost.exe") and
 process.parent.executable != null
'''

min_endpoint_version = "8.0.0"
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
tree = true

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.0.0"

[metadata]
creation_date = "2023/09/27"
integration = ["endpoint"]
maturity = "production"
updated_date = "2026/05/04"

[rule]
author = ["Elastic"]
description = """
Identifies the execution of a hosted XSL script using the Microsoft.XMLDOM COM interface via Microsoft Office processes.
This behavior may indicate adversarial activity to execute malicious JScript or VBScript on the system.
"""
from = "now-9m"
index = ["logs-endpoint.events.process-*", "logs-endpoint.events.library-*"]
language = "eql"
license = "Elastic License v2"
name = "Remote XSL Script Execution via COM"
risk_score = 21
rule_id = "48f657ee-de4f-477c-aa99-ed88ee7af97a"
severity = "low"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Initial Access",
    "Tactic: Defense Evasion",
    "Data Source: Elastic Defend",
    "Resources: Investigation Guide",
]
type = "eql"

query = '''
sequence with maxspan=1m
 [library where host.os.type == "windows" and dll.name : "msxml3.dll" and
  process.name : ("winword.exe", "excel.exe", "powerpnt.exe", "mspub.exe")] by process.entity_id
 [process where host.os.type == "windows" and event.action == "start" and
  process.parent.name : ("winword.exe", "excel.exe", "powerpnt.exe", "mspub.exe") and
  not process.executable :
        ("?:\\Windows\\System32\\WerFault.exe",
         "?:\\Windows\\SysWoW64\\WerFault.exe",
         "?:\\windows\\splwow64.exe",
         "?:\\Windows\\System32\\conhost.exe",
         "?:\\Program Files\\*.exe",
         "?:\\Program Files (x86)\\*exe")] by process.parent.entity_id
'''

setup = """## Setup

This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.

Setup instructions: https://ela.st/install-elastic-defend
"""

note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Remote XSL Script Execution via COM

The Microsoft.XMLDOM COM interface allows applications to parse and transform XML documents using XSL scripts. Adversaries exploit this by embedding malicious scripts in Office documents, triggering execution via Office processes like Word or Excel. The detection rule identifies suspicious activity by monitoring for the loading of specific DLLs and the execution of unexpected child processes, indicating potential script execution attempts.

### Possible investigation steps

- Review the alert details to identify the specific Office process (e.g., winword.exe, excel.exe) that triggered the alert and note the process entity ID for further investigation.
- Check the process tree to identify any unexpected child processes spawned by the Office application, focusing on those not matching typical system executables like WerFault.exe or conhost.exe.
- Investigate the loaded DLLs, specifically msxml3.dll, to confirm its legitimate use and check for any anomalies or unusual patterns in its loading sequence.
- Analyze the parent and child process relationships to determine if the execution flow aligns with typical user activity or if it suggests malicious behavior.
- Gather additional context by reviewing recent user activity and document interactions to identify any potential phishing attempts or suspicious document handling that could have led to the alert.
- Correlate the findings with other security events or alerts in the environment to assess if this activity is part of a broader attack pattern or isolated incident.

### False positive analysis

- Legitimate use of Microsoft Office applications for XML processing can trigger the rule. Users should identify and whitelist known applications or scripts that regularly perform XML transformations using the Microsoft.XMLDOM COM interface.
- Automated document processing systems that utilize Office applications to handle XML data might cause false positives. Exclude these systems by specifying their process names or executable paths in the detection rule.
- Software updates or installations that involve Office applications may load the msxml3.dll and start child processes. Temporarily disable the rule during scheduled maintenance or update windows to prevent false alerts.
- Custom Office add-ins or macros that interact with XML files could be misidentified as threats. Review and approve these add-ins, then adjust the rule to exclude their specific behaviors.
- Regular business processes that involve document conversion or data extraction using Office tools might be flagged. Document these processes and create exceptions based on their unique characteristics, such as specific file paths or process names.

### Response and remediation

- Immediately isolate the affected system from the network to prevent further spread of the malicious script execution.
- Terminate any suspicious processes identified as child processes of Office applications, such as winword.exe or excel.exe, that are not part of the standard executable paths.
- Conduct a thorough scan of the affected system using updated antivirus or endpoint detection and response (EDR) tools to identify and remove any malicious scripts or files.
- Review and restore any altered or deleted files from secure backups to ensure data integrity and system functionality.
- Escalate the incident to the security operations center (SOC) or incident response team for further analysis and to determine if additional systems are affected.
- Implement application whitelisting to restrict the execution of unauthorized scripts and executables, particularly those not located in standard directories.
- Enhance monitoring and alerting for similar activities by ensuring that the detection rule is actively deployed and that alerts are configured to notify the appropriate personnel promptly."""


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"

[[rule.threat.technique.subtechnique]]
id = "T1566.002"
name = "Spearphishing Link"
reference = "https://attack.mitre.org/techniques/T1566/002/"

[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1220"
name = "XSL Script Processing"
reference = "https://attack.mitre.org/techniques/T1220/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"

[[rule.threat.technique.subtechnique]]
id = "T1059.005"
name = "Visual Basic"
reference = "https://attack.mitre.org/techniques/T1059/005/"

[[rule.threat.technique.subtechnique]]
id = "T1059.007"
name = "JavaScript"
reference = "https://attack.mitre.org/techniques/T1059/007/"

[[rule.threat.technique]]
id = "T1559"
name = "Inter-Process Communication"
reference = "https://attack.mitre.org/techniques/T1559/"

[[rule.threat.technique.subtechnique]]
id = "T1559.001"
name = "Component Object Model"
reference = "https://attack.mitre.org/techniques/T1559/001/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[rule]
description = """
Detects untrusted binaries spawning shell interpreters to execute discovery commands like whoami, osascript, and
dscacheutil within 15 seconds. This pattern indicates malicious reconnaissance activities.
"""
id = "a1d2c79e-bb1f-4191-8e48-9f240cfcfb40"
license = "Elastic License v2"
name = "Shell Command Discovery Execution via Untrusted Binary"
os_list = ["macos"]
version = "1.0.11"

query = '''
sequence with maxspan=15s
[process where event.type == "start" and process.parent.code_signature.trusted == false and (process.name in ("bash", "sh", "zsh", "dash", "csh", "tcsh", "ksh", "tclsh", "fish") or process.name like "tclsh*") and
 process.args == "-c" and not process.parent.executable like ("/opt/homebrew/*", "/usr/local/Cellar/*")] by process.entity_id
[process where event.type == "start" and event.action == "exec" and (process.parent.name in ("bash", "sh", "zsh", "dash", "csh", "tcsh", "ksh", "tclsh", "fish") or process.parent.name like "tclsh*") and
 process.name in ("osascript", "whoami", "dscacheutil", "dsconfigad", "dsexport", "sqlite3") and
 not process.Ext.effective_parent.executable like ("/Applications/*", "/opt/homebrew/*")] by process.parent.entity_id
'''

min_endpoint_version = "8.10.2"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"

[threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"

[internal]
min_endpoint_version = "8.10.2"