Elastic rules: 1h

[rule]
description = """
Detects the creation of a bind shell via socket. Attackers may spawn bind shells to establish persistence onto a target
system.
"""
id = "37f6659f-dff4-42bc-91ae-7ed7a9264529"
license = "Elastic License v2"
name = "Bind Shell via Socket"
os_list = ["linux"]
reference = ["https://gtfobins.github.io/gtfobins/socket/"]
version = "1.0.4"

query = '''
process where event.type == "start" and event.action == "exec" and process.name == "socket" and
process.args : "-*s*" and process.args : "-*p*" and process.args : "*sh*" and process.args_count >= 3
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
tree = true

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "7.15.0"

[metadata]
creation_date = "2023/01/31"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2026/05/04"

[transform]
[[transform.osquery]]
label = "Osquery - Retrieve All Non-Microsoft Drivers with Virustotal Link"
query = """
SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, class, description, directory, image,
issuer_name, manufacturer, service, signed, subject_name FROM drivers JOIN authenticode ON drivers.image =
authenticode.path JOIN hash ON drivers.image = hash.path WHERE NOT (provider == "Microsoft" AND signed == "1")
"""

[[transform.osquery]]
label = "Osquery - Retrieve All Unsigned Drivers with Virustotal Link"
query = """
SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, class, description, directory, image,
issuer_name, manufacturer, service, signed, subject_name FROM drivers JOIN authenticode ON drivers.image =
authenticode.path JOIN hash ON drivers.image = hash.path WHERE signed == "0"
"""


[rule]
author = ["Elastic"]
description = """
Identifies attempts to disable/modify the code signing policy through system native utilities. Code signing provides
authenticity on a program, and grants the user with the ability to check whether the program has been tampered with. By
allowing the execution of unsigned or self-signed code, threat actors can craft and execute malicious code.
"""
from = "now-9m"
index = [
    "endgame-*",
    "logs-crowdstrike.fdr*",
    "logs-endpoint.events.process-*",
    "logs-m365_defender.event-*",
    "logs-sentinel_one_cloud_funnel.*",
    "logs-system.security*",
    "logs-windows.forwarded*",
    "logs-windows.sysmon_operational-*",
    "winlogbeat-*",
]
language = "eql"
license = "Elastic License v2"
name = "Code Signing Policy Modification Through Built-in tools"
note = """## Triage and analysis

### Investigating Code Signing Policy Modification Through Built-in tools

Windows Driver Signature Enforcement (DSE) is a security feature introduced by Microsoft to enforce that only signed drivers can be loaded and executed into the kernel (ring 0). This feature was introduced to prevent attackers from loading their malicious drivers on targets. If the driver has an invalid signature, the system will not allow it to be loaded.

This protection is essential for maintaining the security of the system. However, attackers or even administrators can disable this feature and load untrusted drivers, as this can put the system at risk. Therefore, it is important to keep this feature enabled and only load drivers from trusted sources to ensure the integrity and security of the system.

This rule identifies commands that can disable the Driver Signature Enforcement feature.

> **Note**:
> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/current/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.

#### Possible investigation steps

- Identify the user account that performed the action and whether it should perform this kind of action.
- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
- Investigate other alerts associated with the user/host during the past 48 hours.
- Use Osquery and endpoint driver events (`event.category = "driver"`) to investigate if suspicious drivers were loaded into the system after the command was executed.
  - $osquery_0
  - $osquery_1
- Identify the driver's `Device Name` and `Service Name`.
- Check for alerts from the rules specified in the `Related Rules` section.

### False positive analysis

- This activity should not happen legitimately. The security team should address any potential benign true positive (B-TP), as this configuration can put the user and the domain at risk.

### Related Rules

- First Time Seen Driver Loaded - df0fd41e-5590-4965-ad5e-cd079ec22fa9
- Untrusted Driver Loaded - d8ab1ec1-feeb-48b9-89e7-c12e189448aa
- Code Signing Policy Modification Through Registry - da7733b1-fe08-487e-b536-0a04c6d8b0cd

### Response and remediation

- Initiate the incident response process based on the outcome of the triage.
- Isolate the involved host to prevent further post-compromise behavior.
- Disable and uninstall all suspicious drivers found in the system. This can be done via Device Manager. (Note that this step may require you to boot the system into Safe Mode.)
- Remove the related services and registry keys found in the system. Note that the service will probably not stop if the driver is still installed.
  - This can be done via PowerShell `Remove-Service` cmdlet.
- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
- Remove and block malicious artifacts identified during triage.
- Ensure that the Driver Signature Enforcement is enabled on the system.
- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
"""

setup = """## Setup

This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.

Setup instructions: https://ela.st/install-elastic-defend

### Additional data sources

This rule also supports the following third-party data sources. For setup instructions, refer to the links below:

- [CrowdStrike](https://ela.st/crowdstrike-integration)
- [Microsoft Defender XDR](https://ela.st/m365-defender)
- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
- [Sysmon Event ID 1 - Process Creation](https://ela.st/sysmon-event-1-setup)
- [Windows Process Creation Logs](https://ela.st/audit-process-creation)
"""

risk_score = 47
rule_id = "b43570de-a908-4f7f-8bdb-b2df6ffd8c80"
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Defense Evasion",
    "Data Source: Elastic Endgame",
    "Resources: Investigation Guide",
    "Data Source: Elastic Defend",
    "Data Source: Windows Security Event Logs",
    "Data Source: Microsoft Defender XDR",
    "Data Source: Sysmon",
    "Data Source: SentinelOne",
    "Data Source: Crowdstrike",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
process where host.os.type == "windows" and event.type == "start" and
  (process.name: "bcdedit.exe" or ?process.pe.original_file_name == "bcdedit.exe") and process.args: ("-set", "/set") and 
  process.args: ("TESTSIGNING", "nointegritychecks", "loadoptions", "DISABLE_INTEGRITY_CHECKS")
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1553"
name = "Subvert Trust Controls"
reference = "https://attack.mitre.org/techniques/T1553/"
[[rule.threat.technique.subtechnique]]
id = "T1553.006"
name = "Code Signing Policy Modification"
reference = "https://attack.mitre.org/techniques/T1553/006/"



[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[metadata]
creation_date = "2020/08/13"
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender", "crowdstrike"]
maturity = "production"
updated_date = "2026/04/22"

[rule]
author = ["Elastic"]
description = """
Identifies the creation or modification of Domain Backup private keys. Adversaries may extract the Data Protection API
(DPAPI) domain backup key from a Domain Controller (DC) to be able to decrypt any domain user master key file.
"""
from = "now-9m"
index = [
    "winlogbeat-*",
    "logs-endpoint.events.file-*",
    "logs-windows.sysmon_operational-*",
    "endgame-*",
    "logs-sentinel_one_cloud_funnel.*",
    "logs-m365_defender.event-*",
    "logs-crowdstrike.fdr*",
]
language = "eql"
license = "Elastic License v2"
name = "Creation or Modification of Domain Backup DPAPI private key"
references = [
    "https://www.dsinternals.com/en/retrieving-dpapi-backup-keys-from-active-directory/",
    "https://posts.specterops.io/operational-guidance-for-offensive-user-dpapi-abuse-1fb7fac8b107",
]
risk_score = 73
rule_id = "b83a7e96-2eb3-4edf-8346-427b6858d3bd"
severity = "high"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Credential Access",
    "Data Source: Elastic Endgame",
    "Data Source: Elastic Defend",
    "Data Source: Sysmon",
    "Data Source: SentinelOne",
    "Data Source: Microsoft Defender XDR",
    "Data Source: Crowdstrike",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
file where host.os.type == "windows" and event.type != "deletion" and file.name : ("ntds_capi_*.pfx", "ntds_capi_*.pvk")
'''

note = """## Triage and analysis

### Investigating Creation or Modification of Domain Backup DPAPI private key

#### Possible investigation steps

- Does the alert show a new or changed domain DPAPI backup key artifact?
  - Focus: `event.type`, `event.action`, `file.name`, `file.path`, and `file.size`; distinguish `ntds_capi_*.pfx` or `ntds_capi_*.pvk` in temp, user, share, removable, archive, or controlled recovery paths.
  - Implication: escalate on create or modify activity in staging paths or analyst home directories because the artifact can unlock domain DPAPI-protected secrets; lower suspicion only when the path is a controlled DC recovery or IR location tied to the same case.

- Is the acting process a recognized recovery tool or an export utility being abused?
  - Why: live DC retrieval and offline AD database extraction both create domain-scale DPAPI exposure once backup keys leave controlled recovery.
  - Focus: process-start events scoped by `host.id` and `process.entity_id`, checking `process.executable`, `process.command_line`, `process.pe.original_file_name`, `process.parent.command_line`, and `process.code_signature.subject_name`. $investigate_0
  - Implication: escalate when a shell, script host, renamed binary, or command line expresses backup-key export outside controlled recovery; lower concern only when tool identity, parent, and output path fit one controlled recovery workflow.

- Did the same process export companion key material or package the result?
  - Focus: file events scoped to `process.entity_id`, or `host.id` plus `process.pid` in a tight time window, checking `file.name`, `file.path`, `file.Ext.original.path`, and `file.Ext.original.name`. $investigate_1
  - Implication: escalate when the process creates multiple backup-key outputs, writes companion legacy-key material, renames the files, archives them, or stages other credential-sensitive artifacts.
  - Hint: if `ntds_capi_*` disappears quickly, trace rename events through `file.Ext.original.path` and `file.Ext.original.name`; if those fields are absent, fall back to current `file.path` plus the same `process.entity_id` or host/PID time window.

- Do the user and host telemetry fit a tightly scoped recovery operator path?
  - Focus: `user.id`, `user.name`, `user.domain`, `host.id`, and `host.name`; separate domain recovery, backup, or IR identities from standard users and ad hoc workstations.
  - Implication: escalate when the user or host identity is mismatched, generic, or unexplained for domain backup-key handling; treat a plausible operator and host pairing as candidate benign only after the file, process, and artifact evidence also fit the same workflow.

- Did follow-on activity stage the export for off-host use?
  - Focus: process, child-process, file, and network events for the recovered process scope, especially `process.command_line`, `process.parent.command_line`, UNC, removable-media, archive, or share values in `file.path`, and off-host connections. $investigate_4 $investigate_5
  - Implication: escalate when copy, archive, compression, removable-media, or share-write activity follows the export, especially from a non-DC host; absence of staging evidence narrows scope but does not close the alert by itself.

- If local evidence remains suspicious or unresolved and related-alert telemetry is available, does the same user or host show credential-access, staging, or tier-0 alerts?
  - Focus: optional related-alert views for `user.id`, especially DPAPI abuse, LSASS or credential dumping, DCSync, archive or share staging, lateral movement to DCs, or tier-0 persistence. $investigate_2
  - Hint: Pivot by `host.id` when user scope is sparse or host role changes urgency; absence of related-alert telemetry is unresolved, not benign. $investigate_3
  - Implication: broaden to domain-compromise scoping when related alerts show credential access, DC access, or staging around the same time; absence of related alerts can narrow scope but must not close the alert without local file, process, artifact, and context alignment.

- Escalate on unrecognized export path, export-tool intent, companion artifacts, mismatched user or host, staging, or corroborating tier-0 alerts; close only when telemetry and recovery, backup, or IR verification bind one controlled workflow; preserve and escalate if evidence is mixed or visibility is incomplete.

### False positive analysis

- AD disaster-recovery, backup validation, or IR collection can legitimately export DPAPI domain backup material. Confirm telemetry first: `process.executable`, `process.command_line`, `file.path`, `user.id`, and `host.id` must all align with the same exact workflow.
- Use a recovery ticket, backup job, or IR case only to verify an already aligned telemetry pattern; do not close on records alone. If records are unavailable, recurring telemetry is a candidate benign pattern, not closure, until it verifies one controlled recovery path without contradictory staging.
- Before creating an exception, validate that the same `process.executable`, `process.command_line`, `file.path`, `user.id`, and `host.id` recur across prior alerts from this rule. Build the exception from that confirmed workflow, and avoid exceptions on `file.name` alone, `.pvk` or `.pfx` extensions alone, or the host alone.

### Response and remediation

- If confirmed benign, reverse any temporary containment and record the process path, command-line pattern, export location, operator identity, and host role that justified closure. Create an exception only if that same workflow recurs consistently across prior alerts from this rule.
- If suspicious but unconfirmed, preserve the exported `file.path`, rename evidence from `file.Ext.original.path` or `file.Ext.original.name`, the file-event timeline, recovered `process.entity_id` or `process.pid`, `process.command_line`, responsible `user.id`, `host.id`, and any UNC, removable-media, archive, or share paths before destructive changes. Apply reversible containment first, such as temporarily restricting share access or outbound connectivity for the affected `host.id`; escalate to host isolation or account containment only if companion staging, corroborating alerts, or other findings show broader compromise and the asset role can tolerate it.
- If confirmed malicious, preserve the same artifacts and use endpoint response to isolate the host or terminate the responsible process. If direct response is unavailable, escalate with the preserved artifact set to the team that can act. For domain controllers, weigh service impact before isolation but do not leave the export accessible.
- If unauthorized domain backup-key export is confirmed on a domain controller, activate the organization's Active Directory compromise response plan, preserve evidence needed to scope DPAPI-protected credential exposure, and begin privileged-account hygiene according to that plan.
- Before deleting or rotating anything, review related `host.id` and `user.id` activity for the same exported filenames, companion legacy-key artifacts, archive names, and UNC or share paths. Then eradicate the unauthorized export files, staging archives, copy utilities, scripts, and persistence mechanisms uncovered during the investigation, and remediate the privilege path or access vector that allowed the export.
- After containment, hunt for the same exported filenames, archive names, and UNC or share paths across other hosts.
"""

setup = """## Setup

This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.

Setup instructions: https://ela.st/install-elastic-defend

### Additional data sources

This rule also supports the following third-party data sources. For setup instructions, refer to the links below:

- [CrowdStrike](https://ela.st/crowdstrike-integration)
- [Microsoft Defender XDR](https://ela.st/m365-defender)
- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
- [Sysmon Event ID 11 - File Create](https://ela.st/sysmon-event-11-setup)
"""

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "event.type",
    "host.id",
    "host.name",
    "user.name",
    "user.id",
    "user.domain",
    "process.entity_id",
    "process.pid",
    "process.executable",
    "process.command_line",
    "process.parent.command_line",
    "process.code_signature.subject_name",
    "file.path",
    "file.Ext.original.path",
]

[[transform.investigate]]
label = "Process events for the alerting process"
description = ""
providers = [
  [
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" },
    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" }
  ],
  [
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "process.pid", queryType = "phrase", value = "{{process.pid}}", valueType = "string" },
    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" }
  ]
]
relativeFrom = "now-1h"
relativeTo = "now"

[[transform.investigate]]
label = "File activity for the alerting process"
description = ""
providers = [
  [
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" },
    { excluded = false, field = "event.category", queryType = "phrase", value = "file", valueType = "string" }
  ],
  [
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "process.pid", queryType = "phrase", value = "{{process.pid}}", valueType = "string" },
    { excluded = false, field = "event.category", queryType = "phrase", value = "file", valueType = "string" }
  ]
]
relativeFrom = "now-1h"
relativeTo = "now"

[[transform.investigate]]
label = "Alerts associated with this user"
description = ""
providers = [
  [
    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
    { excluded = false, field = "user.id", queryType = "phrase", value = "{{user.id}}", valueType = "string" }
  ]
]
relativeFrom = "now-48h/h"
relativeTo = "now"

[[transform.investigate]]
label = "Alerts associated with this host"
description = ""
providers = [
  [
    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" }
  ]
]
relativeFrom = "now-48h/h"
relativeTo = "now"

[[transform.investigate]]
label = "Child processes of the export process"
description = ""
providers = [
  [
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "process.parent.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" },
    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" }
  ]
]
relativeFrom = "now-1h"
relativeTo = "now"

[[transform.investigate]]
label = "Network activity for the export process and children"
description = ""
providers = [
  [
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" },
    { excluded = false, field = "event.category", queryType = "phrase", value = "network", valueType = "string" }
  ],
  [
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "process.parent.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" },
    { excluded = false, field = "event.category", queryType = "phrase", value = "network", valueType = "string" }
  ]
]
relativeFrom = "now-1h"
relativeTo = "now"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1003"
name = "OS Credential Dumping"
reference = "https://attack.mitre.org/techniques/T1003/"

[[rule.threat.technique.subtechnique]]
id = "T1003.003"
name = "NTDS"
reference = "https://attack.mitre.org/techniques/T1003/003/"

[[rule.threat.technique]]
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"

[[rule.threat.technique.subtechnique]]
id = "T1552.004"
name = "Private Keys"
reference = "https://attack.mitre.org/techniques/T1552/004/"

[[rule.threat.technique]]
id = "T1555"
name = "Credentials from Password Stores"
reference = "https://attack.mitre.org/techniques/T1555/"

[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[metadata]
creation_date = "2026/01/30"
integration = ["endpoint"]
maturity = "production"
updated_date = "2026/03/24"

[rule]
author = ["Elastic"]
description = """
Detects when a discovery command is executed followed by the immediate modification of a suspicious file via 
the same process. Many types of malware execute discovery commands, save the output to a file, and then 
exfiltrate that file via their C2 channel.
"""
from = "now-9m"
index = ["logs-endpoint.events.process-*", "logs-endpoint.events.file-*"]
language = "eql"
license = "Elastic License v2"
name = "Discovery Command Output Written to Suspicious File"
note = """ ## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Discovery Command Output Written to Suspicious File

This rule flags a macOS discovery utility launched from an interactive shell and, within seconds, the same process writing to an unusual or hidden file location, indicating staged reconnaissance for later theft. Adversaries commonly run commands like `whoami`, `ifconfig`, `dscl`, or `system_profiler` and redirect output into `/tmp`, `/Users/Shared`, or a dotfile path to bundle host details before exfiltrating the collected text.

### Possible investigation steps

- Review the created/modified file’s contents, size, and timestamps to confirm it contains discovery output and whether it is being appended across multiple executions.  
- Pivot from the initiating process to identify subsequent child processes or shell commands that compress, encrypt, move, or delete the file, indicating staging and cleanup.  
- Examine concurrent network activity from the same process tree for outbound connections, file uploads, or suspicious DNS/HTTP requests immediately after the write event.  
- Validate the interactive session context by correlating to the logged-in user, terminal/TTY (if available), remote access artifacts (SSH/VPN/remote management), and recent authentication events for that account.  
- Hunt on the host for related staging patterns such as additional hidden files in common drop locations, recent archive creation, or persistence changes (LaunchAgents/LaunchDaemons/crontab) around the alert time.

### False positive analysis

- An administrator or troubleshooting script run from bash/zsh may execute built-in discovery commands (e.g., `system_profiler`, `ifconfig`, `dscl`) and redirect the output into `/tmp`, `/private/tmp`, or `/Users/Shared` as a temporary log or support bundle artifact.  
- A login/profile shell customization (e.g., `.zshrc`/`.bash_profile`) or local diagnostic routine may run `whoami`/`arch`/`csrutil` and append results into a hidden dotfile path (e.g., `/*/.*`) for auditing or environment validation, creating a short command-then-write pattern.

### Response and remediation

- Isolate the macOS host from the network and suspend or terminate the implicated shell/process tree that executed the discovery command and immediately wrote into locations like `/tmp`, `/Users/Shared`, or hidden dotfiles to prevent further staging or exfiltration.  
- Quarantine the written file(s) and any adjacent artifacts (archives, encrypted blobs, renamed copies) from the same directories, preserve them for analysis, and remove the staged data once collection is complete.  
- Identify and eradicate the launch point by reviewing the invoking shell history and user startup scripts (e.g., `.zshrc`, `.bash_profile`) for redirection or scripted discovery, and delete any associated persistence (LaunchAgents/LaunchDaemons, cron entries) tied to the same user or file path.  
- Rotate credentials and invalidate active sessions for the logged-in user that ran the command, and audit recent remote access methods (SSH, remote management, VPN) used on the host to ensure the account was not compromised.  
- Restore the host to a known-good state by reinstalling or reimaging if tampering is suspected, then monitor for re-creation of the same suspicious file paths and repeat discovery-to-file-write behavior from any interactive shell.  
- Escalate to IR leadership immediately if the staged file contains host/user inventory data and there is evidence of outbound transfer attempts (new external connections, upload utilities like `curl`/`scp`, or rapid archive creation) following the write event.
"""
risk_score = 47
rule_id = "60da1bd7-c0b9-4ba2-b487-50a672274c04"
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: macOS",
    "Use Case: Threat Detection",
    "Tactic: Collection",
    "Tactic: Discovery",
    "Data Source: Elastic Defend",
    "Resources: Investigation Guide",
]
type = "eql"
query = '''
sequence by process.entity_id with maxspan=15s
  [process where host.os.type == "macos" and event.type == "start" and event.action == "exec" and
    process.parent.name in ("bash", "sh", "zsh") and
    process.name in ("whoami", "ifconfig", "system_profiler", "dscl", "arch", "csrutil") and
    process.args_count == 1]
  [file where host.os.type == "macos" and event.action == "modification" and
    file.path like ("/Users/Shared/*", "/tmp/*", "/private/tmp/*", "/Library/WebServer/*",
                    "/Library/Graphics/*", "/Library/Fonts/*", "/private/var/root/Library/HTTPStorages/*", "/*/.*") and
    not file.path like ("/private/tmp/*.fifo", "/private/tmp/tcl-tk*")]
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1074"
name = "Data Staged"
reference = "https://attack.mitre.org/techniques/T1074/"

[[rule.threat.technique.subtechnique]]
id = "T1074.001"
name = "Local Data Staging"
reference = "https://attack.mitre.org/techniques/T1074/001/"

[rule.threat.tactic]
id = "TA0009"
name = "Collection"
reference = "https://attack.mitre.org/tactics/TA0009/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1016"
name = "System Network Configuration Discovery"
reference = "https://attack.mitre.org/techniques/T1016/"

[[rule.threat.technique]]
id = "T1033"
name = "System Owner/User Discovery"
reference = "https://attack.mitre.org/techniques/T1033/"

[[rule.threat.technique]]
id = "T1082"
name = "System Information Discovery"
reference = "https://attack.mitre.org/techniques/T1082/"

[rule.threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"

[rule]
description = """
Detects when Curl or NsCurl is used to download a disk image file (.dmg) followed immediately by mounting that disk
image using the native Hdiutil binary within a short timespan. Threat actors leverage disk images to deliver additional
payload stages and evade security defenses during initial infection chains.
"""
id = "8eeb017a-0a3f-4e8f-9166-5a695204afb6"
license = "Elastic License v2"
name = "Disk Image Download and Mount via Hdiutil"
os_list = ["macos"]
reference = [
    "https://pberba.github.io/security/2025/11/11/macos-infection-vector-applescript-bypass-gatekeeper/",
]
version = "1.0.1"

query = '''
sequence with maxspan=20s
[file where event.action in ("modification", "creation") and process.name in ("curl", "nscurl") and
  file.extension == "dmg"] by Effective_process.entity_id
[process where event.type == "start" and event.action == "exec" and process.name == "hdiutil" and
  process.args == "mount"] by process.parent.entity_id
'''

min_endpoint_version = "8.16.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "Effective_process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"

[[threat.technique]]
id = "T1204"
name = "User Execution"
reference = "https://attack.mitre.org/techniques/T1204/"
[[threat.technique.subtechnique]]
id = "T1204.002"
name = "Malicious File"
reference = "https://attack.mitre.org/techniques/T1204/002/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1105"
name = "Ingress Tool Transfer"
reference = "https://attack.mitre.org/techniques/T1105/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "8.16.0"

[rule]
description = """
This rule detects when a network connection is established via a descendant of a Node.js process. Attackers may use
Node.js to run scripts that create network connections for various malicious purposes, such as downloading and executing
payloads, establishing persistence, or exfiltrating data.
"""
id = "adf59538-f71f-45e2-a3ae-af95b31c41df"
license = "Elastic License v2"
name = "Egress Network Connection from Node.js Descendant"
os_list = ["macos"]
version = "1.0.8"

query = '''
sequence by process.entity_id with maxspan=1m
  [process where event.type == "start" and event.action == "exec" and not process.name == "node" and 
   (
     descendant of [process where event.type == "start" and event.action == "exec" and process.name == "node" and 
       (
         process.command_line : ("*post-install*", "*preinstall*") or 
         (process.args like "*/npm" and process.args in ("install", "update"))
      )] or 
     (process.parent.name == "node" and process.parent.command_line like ("*post-install*", "*preinstall*")) or 
     (process.parent.name == "node" and process.parent.args like "*/npm" and process.parent.args in ("install", "update"))
    ) and not (
      (process.name == "sh" and process.args == "-c" and process.args == "node") or
      process.args like ("rebuild", "build", "compile", "copyfiles*") or
      process.command_line in (
        "sh -c :; (node ./preinstall.js > /dev/null 2>&1 || true)",
        """sh -c  node -e "try{require('./_postinstall')}catch(e){}" || exit 0"""
      )
    ) and (
    process.name like (
      "nohup", "setsid", "nc", "ncat", "netcat", "netcat.openbsd", "netcat.traditional", "nc.openbsd",
      "nc.traditional", "socat", "telnet", "busybox", "mkfifo", "xterm"
    ) or
    process.executable like (
      "/tmp/*", "/var/tmp/*", "/dev/shm/*", "./*", "/run/*", "/var/run/*", "/boot/*", "/sys/*", "/lost+found/*",
      "/proc/*", "/var/mail/*", "/var/www/*"
    ) or
    (
       process.name == "curl" and process.args like "*http*" and process.args in ("-o", "--output") and
       process.args like ("/tmp/*", "/var/tmp/*", "/dev/shm/*", "/private/tmp/*")
    ) or
    (
      process.name == "wget" and process.args like "*http*" and process.args in ("-O", "--output-document") and
      process.args like ("/tmp/*", "/var/tmp/*", "/dev/shm/*", "/private/tmp/*")
    ) or
    (process.name : "python*" and process.args : "-c" and process.args : (
     "*import*pty*spawn*", "*import*subprocess*call*"
    )) or
    (process.name : "perl*" and process.args : "-e" and process.args : "*socket*" and process.args : (
     "*exec*", "*system*"
    )) or
    (process.name : "ruby*" and process.args : ("-e", "-rsocket") and process.args : (
     "*TCPSocket.new*", "*TCPSocket.open*"
     )) or
    (process.name : "lua*" and process.args : "-e" and process.args : "*socket.tcp*" and process.args : (
     "*io.popen*", "*os.execute*"
    )) or
    (process.name : "php*" and process.args : "-r" and process.args : "*fsockopen*" and process.args : "*/bin/*sh*") or 
    (process.name : ("awk", "gawk", "mawk", "nawk") and process.args : "*/inet/tcp/*") or
    (process.name in ("rvim", "vim", "vimdiff", "rview", "view") and process.args == "-c" and process.args : "*socket*")
  ) and not (
      process.executable like (
        "/usr/bin/terraform", "/opt/homebrew/Cellar/git/*/libexec/git-core/git-remote-http", "/usr/local/aws-cli/aws", "/usr/bin/env",
        "/Applications/Xcode.app/Contents/Developer/usr/libexec/git-core/git-remote-http", "/usr/lib/git-core/git-remote-https", "/usr/bin/ssh",
        "/home/linuxbrew/.linuxbrew/opt/git/libexec/git-core/git-remote-https", "/usr/lib/git-core/git-remote-https", "/usr/bin/git-remote-https",
        "/usr/bin/ssh", "/var/lib/docker/*/git-remote-https", "/usr/libexec/git-core/git", "/home/linuxbrew/.linuxbrew/*", "/usr/lib/git-core/git"
      ) or
      process.parent.executable like (
        "/opt/homebrew/Library/Homebrew/vendor/portable-ruby/*/bin/ruby", "/usr/local/Homebrew/Library/Homebrew/vendor/portable-ruby/*/bin/ruby",
        "/usr/bin/git"
      )
    )
  ]
  [network where event.type == "start" and event.action == "connection_attempted" and (
    process.name like (
      "nohup", "setsid", "nc", "ncat", "netcat", "netcat.openbsd", "netcat.traditional", "nc.openbsd",
      "nc.traditional", "socat", "telnet", "busybox", "mkfifo", "xterm",
      "curl", "wget", "python*", "perl*", "ruby*", "lua*", "php*", "awk", "gawk", "mawk", "nawk", "rvim", "vim", "vimdiff", "rview",
      "view"
    ) or
    process.executable like (
      "/tmp/*", "/var/tmp/*", "/dev/shm/*", "./*", "/run/*", "/var/run/*", "/boot/*", "/sys/*", "/lost+found/*",
      "/proc/*", "/var/mail/*", "/var/www/*"
    )
  ) and not (
     destination.ip == null or destination.ip == "0.0.0.0" or
     cidrmatch(
       destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.0.0/29",
       "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
       "192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10",
       "192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1", "FE80::/10",
       "FF00::/8"
     )
   )
  ]
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"
[[threat.technique.subtechnique]]
id = "T1071.001"
name = "Web Protocols"
reference = "https://attack.mitre.org/techniques/T1071/001/"



[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "7.15.0"

[rule]
description = """
Identifies the execution of a file that was created by the virtual system process and subsequently executed. This may
indicate lateral movement via network file shares.
"""
id = "be55434a-ae96-437e-aaaf-9fb60cd7dff4"
license = "Elastic License v2"
name = "Execution of a File Dropped from SMB"
os_list = ["windows"]
version = "1.0.35"

query = '''
sequence with maxspan=5m
  [file where event.action != "deletion" and
   /* library dropped via SMB */
   process.pid == 4 and user.id : ("S-1-5-21*", "S-1-12-*") and
   (file.extension : "exe" or file.Ext.header_bytes : "4d5a*")] by file.path
  [process where event.action == "start" and
    (
     process.parent.name : ("wmiprvse.exe", "wsmprovhost.exe", "RemComSvc*.exe", "psexesvc*.exe", "KaseyaEndpoint.exe", "powershell.exe") or 
     descendant of [process where event.action == "start" and process.name : ("wmiprvse.exe", "wsmprovhost.exe", "RemComSvc*.exe", "psexesvc*.exe")] or 
     (process.parent.name : "cmd.exe" and process.Ext.session_info.logon_type : "Network")
     ) and

         /* Signed False Positives */

	 not (process.code_signature.subject_name :
	                  ("RAPIDFIRE TOOLS INC.",
					   "Arcserve (USA) LLC",
					   "PDQ.COM CORPORATION",
					   "Veeam Software Group GmbH",
					   "Veeam Software AG",
					   "LANDesk Software, Inc.",
					   "Cynet Security LTD",
					   "CyberArk Software Ltd.",
					   "Barracuda Networks, Inc.",
					   "AVG Technologies Canada, Inc.",
					   "ConnectWise, Inc.",
					   "Ivanti, Inc.",
					   "FUJITSU LIMITED",
					   "Shavlik Technologies",
					   "Kaspersky Lab JSC",
					   "Netalytics Security Inc",
					   "Elasticsearch, Inc.",
					   "Netwrix Corporation",
					   "Power Admin LLC",
					   "Notepad++",
					   "The Apache Software Foundation",
					   "HashInclude Computech Pvt. Ltd.",
					   "DIGITAL DEFENSE, INC",
					   "Snow Software AB",
					   "GOVERLAN, LLC",
					   "Veritas Technologies LLC",
					   "Bitdefender SRL",
					   "Kaseya Corporation",
					   "Insecure.Com LLC",
					   "ZOHO Corporation Private Limited",
					   "VMware, Inc.",
					   "Medical Information Technology, Inc.",
					   "baramundi software AG",
					   "ServiceNow, Inc.",
					   "Panda Security, S.L.",
					   "CoSoSys SRL",
					   "N-ABLE TECHNOLOGIES LTD",
					   "CISCO SYSTEMS, INC.",
					   "TeamViewer Germany GmbH",
					   "SysAid Technologies LTD",
					   "Sophos Ltd",
					   "Ericsson",
					   "Quest Software Inc.",
					   "Commvault Systems, Inc.",
					   "Red Gate Software Ltd",
					   "itelio GmbH",
					   "Cocobolo Software, LLC",
					   "Tenable Network Security Inc.",
					   "CS.NIWC-ATLANTIC.001",
					   "Lansweeper",
					   "Lenovo",
					   "Acronis International GmbH",
					   "Cisco WebEx LLC",
					   "Helge Klein GmbH",
					   "FireEye, Inc.",
					   "Oracle America, Inc.",
					   "Chocolatey Software, Inc.",
					   "Micro Focus Group Limited",
					   "Solarwinds Worldwide, LLC",
					   "Cyberark Software Ltd.",
					   "AO Kaspersky Lab",
					   "Symantec Corporation",
					   "Hornetsecurity GmbH",
	                   "KASEYA US LLC",
	                   "ForeScout Technologies, Inc",
					   "KASEYA HOLDINGS INC.",
					   "Kaseya Holdings Inc",
					   "ConnectSecure LLC",
					   "Red Gate Software Limited",
					   "Dell Inc.",
					   "WatchGuard Technologies, Inc.",
					   "EFOLDER, INC.",
					   "Laserfiche") and process.code_signature.trusted == true) and

	not (process.code_signature.subject_name in ("Medical Information Technology, Inc.", "CyberArk Software Ltd.", "VMware, Inc.", "Veritas Technologies LLC") and
	       process.code_signature.status in ("errorTimeStamp", "errorChaining")) and

    not (process.code_signature.subject_name : "Microsoft *" and
	       process.code_signature.trusted == true and
	       process.pe.original_file_name : ("MOMAgentInstaller.exe", "dotnet-hosting-*-win.exe", "dpmac.exe", "PushClient.exe",
	                                         "migrate.exe", "Ms.Dsp.Do.Inc.Installer.exe", "OpenHandleCollector.exe", "VC_redist*.exe")) and

    /* fart-it.sourceforge.net, IseExecSvc, OCS Inventory Agent,Tenable MW Scanner and HPCmdSvc */
    not process.hash.sha256 in
	         ("c9ef35bed70ffa0981bafd0071185b56fdad8f9c97f3582a4dae9b420959fb97",
	          "18dc098895ccc8246d417445a36d933c5f8487419b848ebe651fd0e11cb22afa",
	          "ea98309a35f92443b9c50736ce208656ec72af114ec8aceeb02dfa041ec2d6bc",
	          "bcf07679ea026f1dfba6f9ab63251e4834dc007bd2c5b9039deb9d900fe1c5e6",
	          "1c6af94b26f369e2c10819eefb869f873e5540e2c1b7bf4c7c632fc03d67368a",
	          "6dfc3a0733f427779b250913811baa429002042cb8e7732ea7d334bf725b8bd0",
	          "ae0fb4bf4a6faa4b808794b6e6ccbdf9f10c1ce01a86ccece002ac63cf09ff29",
	          "cd5ff596b7bacb117f90893f94fd8c542b659cc58f90ed1fbd0471fe85148bff",
	          "5e7785fede192d69e408c8c41ba14aead2f4b297c9faecc991e061b093b91f70",
	          "08d019e46a8755c33ad9ff9b96b5409a9005d87ba4e3cc58bdd8cf10eb0cd987",
	          "81e6e6feaac8b3267608af98667d3ccf78a15e540e6a5d18858d9147aacd1e16",
	          "a07b0b72bb00d9e9debd38c2b4bd770beb7d6cf6148d2f7fba50d7a7078deb04",
	          "bc10fdc46d17765c619db70ef19cd3755a3270692481d8417bfff3fceb4eba10",
	          "bb53243baeb4e4cc204e5b9981cc0c671e0855f56293df5106b9b3beac30cc15",
	          "c5593f5d965994a50985b529e77b97c348c7af084dbbaba270d83b1b06302d2c",
	          "7f8e465edd27cdcd1d28292c35440d745b8bd528e21d6f56eb683b65d922eaed",
	          "ef7dbfe3a3910ddb93989f0d5d8f1fb4d39e0df7e53f55d042f4ccd80699c81f",
	          "bb53243baeb4e4cc204e5b9981cc0c671e0855f56293df5106b9b3beac30cc15",
	          "bc10fdc46d17765c619db70ef19cd3755a3270692481d8417bfff3fceb4eba10",
	          "ef7dbfe3a3910ddb93989f0d5d8f1fb4d39e0df7e53f55d042f4ccd80699c81f",
	          "39b3ae96186b7e62b9176e6d2ae27db3e164a7c8c52c094c811dd19d651577f2",
	          "5e7785fede192d69e408c8c41ba14aead2f4b297c9faecc991e061b093b91f70",
	          "b9fc7dea50ce1e0637a3628abc89f96d8cfaad1b7c6ad33dd8bb17028ed3eaee",
	          "5e81eaedc6bba9c9b475f990cdc31ee3c48962fffb63d65afc1447ea6b95f910",
	          "ec7d2582c06d28191b2efaf6780cdfa5c1319f3081bd001d4572cbeea0068b48",
	          "68591e82d0091f12e15f3c21cbf643793bc2b5a14ef46408bb06f794669f7f0b",
	          "156f567b058b5e067a64f3d5736a78bbf9669c822fc5f95620a759c288e2224b",
	          "e659b5a7045bd1820a0efd3e324ebd4a72ecebd0981deb6cbe1899c95351dc91",
	          "84633fd9a39188ca937188decdeb746a0be3476d68f7ccde4d742fa8ca5dc1f6",
	          "4208e349ff97a2dc6100ee9e5e61e23ab650b316e62dd4a25d1119a08a59f298",
	          "52b196bbe9016488c735e7b41805b651261ffa5d7aa86eb6a1d0095be83687b2",
	          "85640066a45c1fd934f3faf2a8db926ed77b622be7cfcce15a25707abf604d55",
	          "cb7f34839ce80b7aaef9f8d61bc61b1f471fdfc514c13a675350077bbf27b24c",
	          "c6d195690a617791e7e9f483597cea1f68fbe59e3f9b1989a1d324f00e9d1c80",
	          "c6d195690a617791e7e9f483597cea1f68fbe59e3f9b1989a1d324f00e9d1c80",
	          "9e3cd4d957f1130e8308357b921d2475afd1519704f0a176a062d06d96199da2",
	          "5485ca7e2be4afc76aadd97536192cf2850228fe338083d6bab4c981bd6ddf92",
	          "0a765aa0610aba8d792b0153779a52a922ae5a5741af52373abb17e9e10c24ed",
	          "5968e3951cb6bf4368b866597f06317e576e6efc14d360dfffc336f1213e3a08",
	          "10d422f089daeeff80644ff1e45ecfcf83a7501dd5edc22477f3717f36b321f6") and

   not (process.code_signature.subject_name == "CyberArk Software Ltd." and
	    process.executable : "?:\\Windows\\CAInvokerService.exe" and process.pe.original_file_name == "PSMWinAgentInvoker.exe") and

   not (process.pe.original_file_name in ("ccmsetup.exe", "OneDriveSetup.exe") and process.code_signature.subject_name : "Microsoft*" and
        process.code_signature.trusted == true) and

   not (process.parent.name : "powershell.exe" and process.executable : ("?:\\Program Files (x86)\\*", "?:\\Program Files\\*")) and

   not (process.executable : "?:\\Program Files\\BearingPoint\\*\\KRS.CorrespondenceJobService.exe" and process.parent.name : "wsmprovhost.exe")
  ] by process.executable
'''

min_endpoint_version = "8.10.0"
optional_actions = []
reputation = true
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1021"
name = "Remote Services"
reference = "https://attack.mitre.org/techniques/T1021/"
[[threat.technique.subtechnique]]
id = "T1021.002"
name = "SMB/Windows Admin Shares"
reference = "https://attack.mitre.org/techniques/T1021/002/"



[threat.tactic]
id = "TA0008"
name = "Lateral Movement"
reference = "https://attack.mitre.org/tactics/TA0008/"

[internal]
min_endpoint_version = "8.10.0"

[metadata]
creation_date = "2026/07/13"
integration = ["gcp"]
maturity = "production"
updated_date = "2026/07/13"

[rule]
author = ["Elastic"]
description = """
Detects creation or modification of a GKE Service with type NodePort. NodePort exposes a static port on every worker
node that hosts matching pods, which widens the cluster's external attack surface and can bypass load-balancer and
firewall controls. Attackers may create NodePort Services to intercept traffic or establish a direct path into the
cluster.
"""
false_positives = [
    """
    Developers may legitimately use NodePort for frontends without cloud load balancers, or for nonstandard networking.
    system:addon-manager patch reconciliation of existing NodePort Services is excluded; create and update from
    addon-manager still alert.
    """,
]
from = "now-6m"
index = ["logs-gcp.audit-*"]
language = "kuery"
license = "Elastic License v2"
name = "GKE Exposed Service Created With Type NodePort"
note = """## Triage and analysis

### Investigating GKE Exposed Service Created With Type NodePort

NodePort opens a port on each worker node hosting the service and forwards external traffic to labeled pods. Confirm
whether the exposure was approved and which workloads are reachable.

### Possible investigation steps

- Review `client.user.email`, `source.ip`, and `user_agent.original`.
- Inspect `gcp.audit.resource_name` and `gcp.audit.request` for the service name, namespace, selector, and port.
- Identify the backing pods and whether the NodePort is required for a legitimate external entrypoint.
- Correlate with recent Service or networking changes from the same actor.

### False positive analysis

- Approved NodePort Services for lab frontends or custom load balancing may match. Allowlist known automation or
  namespaces after review.
- GKE addon reconciliation via `system:addon-manager` patch is excluded; unexpected create or update from that actor
  should still be investigated.

### Response and remediation

- Remove or change unauthorized NodePort Services, revoke excess RBAC for Services writes, and review firewall exposure
  for the opened node ports.

"""
setup = """
The GCP Fleet integration with GKE audit logs enabled is required. Request body capture for Service resources is
required so `gcp.audit.request.spec.type` is populated.
"""
references = [
    "https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types",
    "https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport",
    "https://www.tigera.io/blog/new-vulnerability-exposes-kubernetes-to-man-in-the-middle-attacks-heres-how-to-mitigate/",
]
risk_score = 47
rule_id = "05ac190c-5d02-4b81-bb57-221d33479570"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Domain: Kubernetes",
    "Data Source: GCP",
    "Data Source: Google Cloud Platform",
    "Use Case: Threat Detection",
    "Tactic: Persistence",
    "Tactic: Initial Access",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset:gcp.audit and service.name:"k8s.io" and event.outcome:success and
event.action:(
  "io.k8s.core.v1.services.create" or
  "io.k8s.core.v1.services.update" or
  "io.k8s.core.v1.services.patch"
) and gcp.audit.request.spec.type:"NodePort" and not (
  client.user.email:"system:addon-manager" and
  event.action:"io.k8s.core.v1.services.patch"
)
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1133"
name = "External Remote Services"
reference = "https://attack.mitre.org/techniques/T1133/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1133"
name = "External Remote Services"
reference = "https://attack.mitre.org/techniques/T1133/"

[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "client.user.email",
    "source.ip",
    "user_agent.original",
    "event.action",
    "event.outcome",
    "gcp.audit.resource_name",
    "gcp.audit.request.spec.type",
    "gcp.audit.request",
    "data_stream.namespace",
]

[rule]
description = """
Identifies attempt to modify the content of a loaded module and from a suspicious call stack. This may indicate an
attempt to inject code using module stomping or DLL hollowing via overwriting the content of a legit DLL with malicious
code.
"""
id = "446e61bf-8370-45df-88ab-7b213ee653db"
license = "Elastic License v2"
name = "Image Hollow from Unusual Stack"
os_list = ["windows"]
version = "1.0.22"

query = '''
api where process.Ext.api.behaviors == "hollow_image" and
  process.Ext.api.name == "VirtualProtect" and
  process.Ext.api.parameters.size >= 10000 and process.executable != null and
  process.thread.Ext.call_stack_summary in
                     ("ntdll.dll|kernelbase.dll|Unbacked",
                      "ntdll.dll|kernelbase.dll|kernel32.dll|Unbacked",
                      "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked",
                      "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked|kernel32.dll|ntdll.dll") and
  process.Ext.api.metadata.target_address_path like "c:\\windows\\sys?????\\*.dll" and
  process.thread.Ext.call_stack_final_user_module.hash.sha256 != null and
  not _arraysearch(process.thread.Ext.call_stack, $entry, 
                   $entry.protection_provenance like ("Kernel*", "tcaddin.dll", "clr.dll", "appvisvsubsystems64.dll", 
                                                  "appvisvsubsystems.dll", "softmon.exe|*", "appventsubsystems32.dll", 
                                                  "appventsubsystems64.dll", "appventsubsystems.dll")) and
  not (process.Ext.api.summary : ("*qipcap64.dll*", "*redemption64*", "*eowp.22.1.94.0.exe*", "*conemuhk64.dll*", "*xalan-c_1_10.dll*", "* av.dll*",
                                 "*crpe32.dll*", "*_*.dll*", "*-*.dll*", "*sqlite?.dll*", "*appprofiler.x64.dll*", "*appprofiler.x86.dll*", "*qmgr.dll*", "*cxll*.llx*", "*.exe*") and
                                  not process.Ext.api.summary : "*ws2_32*") and
  not (process.parent.executable : "?:\\Program Files (x86)\\think-cell\\tcasr.exe" and 
       process.executable : "?:\\Program Files\\Microsoft Office\\root\\Office*\\EXCEL.EXE") and
  not (process.code_signature.subject_name : ("Code Systems Corporation", "Essential Objects, Inc.", "JAM Software GmbH",
                                              "IMSI Design, LLC", "Nuance Communications, Inc.", "Rocket Software, Inc.", 
                                              "Tracker Software Products (Canada) Ltd", "Sage Software, Inc.", "Azul Systems, Inc.",
                                              "Essential Objects, Inc.") and
       process.code_signature.trusted == true) and
  not (process.parent.executable : ("?:\\Program Files (x86)\\Google\\Update\\GoogleUpdate.exe", "?:\\Program Files\\Google\\Update\\GoogleUpdate.exe") and
       process.executable : ("?:\\Program Files (x86)\\Google\\Update\\*\\GoogleCrashHandler*.exe", "?:\\Program Files\\Google\\Update\\*\\GoogleCrashHandler*.exe")) and
  not process.executable :
               ("?:\\Program Files\\*.exe",
                "?:\\Program Files (x86)\\*.exe",
                "?:\\Windows\\System32\\inetsrv\\w3wp.exe", 
                "?:\\Windows\\SysWOW64\\inetsrv\\w3wp.exe", 
                "?:\\Windows\\SystemApps\\*.exe", 
                "?:\\Windows\\System32\\taskhostw.exe") and
  not (process.executable : "?:\\Windows\\Sys*\\msiexec.exe" and process.Ext.api.summary : "*msi*.tmp*") and
  not (process.executable : "?:\\Windows\\Sys*\\rundll32.exe" and process.command_line : ("*--no-sandbox*", "*--eoim*")) and
  not (process.executable : "?:\\Windows\\System32\\backgroundTaskHost.exe" and
       process.parent.executable : "?:\\Windows\\System32\\svchost.exe") and
  not process.parent.executable : ("?:\\Program Files (x86)\\Steam\\steam.exe", "?:\\Program Files\\Steam\\steam.exe") and
  not (process.Ext.api.metadata.target_address_name : "cxll27*.llx" and process.parent.executable : "C:\\Program Files (x86)\\Citrix\\HDX\\bin\\WfShell.exe") and
  not (process.Ext.api.metadata.target_address_name == "libcapki.dll" and process.parent.executable : "C:\\Program Files (x86)\\CA\\DSM\\Bin\\*.exe") and
  not process.thread.Ext.call_stack_final_user_module.hash.sha256 in ("2ef1f7e839e332d97e32ee0213c92d0e74536fb3af04b6df1d335e2f101f968e",
   "a20a14118c2f06a1cc502095a1f18b3cb34ad75f1684f7ec26e24a68d4e3114c", "da502d1a77883ab56d110889237ce7f18527a1d78e85078f40d269966059e267",
   "2a2f9dc5f88e4596ade6a57ec2baa8586dbade44e6df9ecb32035cfd1d8bd85d", "c7d833a8fdfac8a79f9f861af7f6f476bb7b36c71c5fa60e668728008b16a43e") and
  not _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.trusted == true)
'''

min_endpoint_version = "8.10.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"

[metadata]
creation_date = "2022/06/20"
integration = ["endpoint"]
maturity = "production"
updated_date = "2026/03/24"

[rule]
author = ["Elastic"]
description = """
This rule monitors for suspicious activities that may indicate an attacker attempting to execute arbitrary code within a
PostgreSQL environment. Attackers can execute code via PostgreSQL as a result of gaining unauthorized access to a public
facing PostgreSQL database or exploiting vulnerabilities, such as remote command execution and SQL injection attacks,
which can result in unauthorized access and malicious actions, and facilitate post-exploitation activities for
unauthorized access and malicious actions.
"""
from = "now-9m"
index = ["endgame-*", "logs-endpoint.events.process*"]
language = "eql"
license = "Elastic License v2"
name = "Potential Code Execution via Postgresql"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Potential Code Execution via Postgresql

PostgreSQL, a robust open-source database system, can be exploited by attackers to execute arbitrary code if they gain unauthorized access or exploit vulnerabilities like SQL injection. Adversaries may leverage command execution capabilities to perform malicious actions. The detection rule identifies suspicious processes initiated by the PostgreSQL user, focusing on shell executions that resemble command injection patterns, while excluding legitimate operations, to flag potential threats.

### Possible investigation steps

- Review the process details to confirm the presence of suspicious shell executions by the PostgreSQL user, focusing on processes with arguments containing "*sh" and "echo*".
- Check the parent process information to determine if the process was initiated by a known legitimate service, such as "puppet", or if it includes "BECOME-SUCCESS-" in the command line, which are excluded from the rule.
- Investigate the source of the PostgreSQL access to identify if it originated from an unauthorized or unusual IP address or user account.
- Analyze the timeline of events leading up to and following the alert to identify any patterns or additional suspicious activities that may indicate a broader attack.
- Correlate the alert with other security events or logs from the same host or network segment to assess if there are related indicators of compromise or ongoing threats.

### False positive analysis

- Puppet processes may trigger false positives due to their legitimate use of shell commands. To mitigate this, ensure that puppet-related processes are excluded by verifying that process.parent.name is set to "puppet".
- Automation tools that use shell scripts for configuration management might be flagged. Review and exclude these by checking for specific command patterns that are known to be safe, such as those containing "BECOME-SUCCESS".
- Scheduled maintenance scripts executed by the postgres user could be misidentified as threats. Identify these scripts and add them to an exclusion list based on their command line patterns.
- Regular database backup operations that involve shell commands might be mistakenly flagged. Document these operations and exclude them by matching their specific command line arguments.
- Custom monitoring scripts that execute shell commands under the postgres user should be reviewed and excluded if they are verified as non-malicious.

### Response and remediation

- Immediately isolate the affected PostgreSQL server from the network to prevent further unauthorized access or malicious actions.
- Terminate any suspicious processes identified by the detection rule to halt potential malicious activities.
- Conduct a thorough review of the PostgreSQL server logs to identify any unauthorized access attempts or successful exploitations, focusing on the timeframes around the detected events.
- Reset credentials for the PostgreSQL user and any other potentially compromised accounts to prevent further unauthorized access.
- Apply the latest security patches and updates to the PostgreSQL server to mitigate known vulnerabilities that could be exploited.
- Implement network segmentation to limit access to the PostgreSQL server, ensuring only authorized systems and users can connect.
- Escalate the incident to the security operations team for further investigation and to assess the potential impact on other systems within the network."""
risk_score = 47
rule_id = "2a692072-d78d-42f3-a48a-775677d79c4e"
setup = """## Setup

This rule requires data coming in from Elastic Defend.

### Elastic Defend Integration Setup
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.

#### Prerequisite Requirements:
- Fleet is required for Elastic Defend.
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).

#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
- Go to the Kibana home page and click "Add integrations".
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
- Click "Add Elastic Defend".
- Configure the integration name and optionally add a description.
- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
- Click "Save and Continue".
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
"""
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: Linux",
    "Use Case: Threat Detection",
    "Tactic: Execution",
    "Data Source: Elastic Endgame",
    "Data Source: Elastic Defend",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"
query = '''
process where host.os.type == "linux" and event.type == "start" and
event.action in ("exec", "exec_event", "fork", "fork_event") and user.name == "postgres" and (
  (process.parent.args : "*sh" and process.parent.args : "echo*") or
  (process.args : "*sh" and process.args : "echo*")
) and not (
  process.parent.name == "puppet" or
  process.command_line like (
    "*BECOME-SUCCESS-*", "bash -c while true; do sleep 1;*", "df -l", "sleep 1", "who", "head -v -n *", "tail -v -n *",
    "/bin/sh -c echo BECOME-SUCCESS*", "/usr/bin/python3 /var/tmp/ansible-tmp*", "*chpasswd*"
  ) or
  process.parent.command_line like ("*BECOME-SUCCESS-*", "-bash -c echo $HOME", "su - postgres -c echo $HOME") or
  process.parent.executable in ("/usr/bin/watch", "/bin/diskmgr", "/usr/bin/diskmgr")
)
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"

[[rule.threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1190"
name = "Exploit Public-Facing Application"
reference = "https://attack.mitre.org/techniques/T1190/"

[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"

[rule]
description = """
Identifies Python interpreters started with -c (inline code) where the command line suggests looking up credentials from
a browser's password store.
"""
id = "d2f85eb5-4ea2-484e-82a1-98399a532f97"
license = "Elastic License v2"
name = "Potential Credential Harvesting via Python"
os_list = ["macos"]
reference = ["https://www.wiz.io/blog/threat-actors-target-crypto-orgs"]
version = "1.0.1"

query = '''
process where event.type == "start" and event.action in ("start", "exec") and
process.name like~ ("python*", "py.exe", "py", "pypy*") and process.args == "-c" and
process.command_line like~ "*Secret.password_lookup_sync*" and
process.command_line like~ ("*microsoft-edge*", "*brave*", "*chromium*", "*chrome*", "*vivaldi*", "*opera*")
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.006"
name = "Python"
reference = "https://attack.mitre.org/techniques/T1059/006/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1555"
name = "Credentials from Password Stores"
reference = "https://attack.mitre.org/techniques/T1555/"


[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "7.15.0"