Elastic rules: 1j

[metadata]
creation_date = "2020/05/21"
integration = ["okta"]
maturity = "production"
updated_date = "2026/04/10"

[rule]
author = ["Elastic"]
description = """
Identifies attempts to revoke an Okta API token. An adversary may attempt to revoke or delete an Okta API token to
disrupt an organization's business operations.
"""
false_positives = [
    """
    If the behavior of revoking Okta API tokens is expected, consider adding exceptions to this rule to filter false
    positives.
    """,
]
index = ["filebeat-*", "logs-okta*"]
language = "kuery"
license = "Elastic License v2"
name = "Attempt to Revoke Okta API Token"
note = """## Triage and analysis

### Investigating Attempt to Revoke Okta API Token

The rule alerts when attempts are made to revoke an Okta API token. The API tokens are critical for integration services, and revoking them may lead to disruption in services. Therefore, it's important to validate these activities.

#### Possible investigation steps:
- Identify the actor associated with the API token revocation attempt. You can use the `okta.actor.alternate_id` field for this purpose.
- Determine the client used by the actor. Review the `okta.client.device`, `okta.client.ip`, `okta.client.user_agent.raw_user_agent`, `okta.client.ip_chain.ip`, and `okta.client.geographical_context` fields.
- Verify if the API token revocation was authorized or part of some planned activity.
- Check the `okta.outcome.result` and `okta.outcome.reason` fields to see if the attempt was successful or failed.
- Analyze the past activities of the actor involved in this action. An actor who usually performs such activities may indicate a legitimate reason.
- Evaluate the actions that happened just before and after this event. It can help understand the full context of the activity.

### False positive analysis:
- It might be a false positive if the action was part of a planned activity or was performed by an authorized person.

### Response and remediation:
- If unauthorized revocation attempts are confirmed, initiate the incident response process.
- Block the IP address or device used in the attempts, if they appear suspicious.
- Reset the user's password and enforce MFA re-enrollment, if applicable.
- Conduct a review of Okta policies and ensure they are in accordance with security best practices.
- If the revoked token was used for critical integrations, coordinate with the relevant team to minimize the impact.

## Setup

The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
"""
references = [
    "https://developer.okta.com/docs/reference/api/system-log/",
    "https://developer.okta.com/docs/reference/api/event-types/",
    "https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy",
    "https://www.elastic.co/security-labs/monitoring-okta-threats-with-elastic-security",
    "https://www.elastic.co/security-labs/starter-guide-to-understanding-okta",
]
risk_score = 21
rule_id = "676cff2b-450b-4cf1-8ed2-c0c58a4a2dd7"
severity = "low"
tags = [
    "Use Case: Identity and Access Audit",
    "Data Source: Okta",
    "Tactic: Impact",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset:okta.system and event.action:system.api_token.revoke
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1531"
name = "Account Access Removal"
reference = "https://attack.mitre.org/techniques/T1531/"


[rule.threat.tactic]
id = "TA0040"
name = "Impact"
reference = "https://attack.mitre.org/tactics/TA0040/"

[rule]
description = """
Identifies attempts to access AutoLogons credentials via registry value query. Adversaries may search local file systems
and remote file shares for files containing insecurely stored credentials.
"""
id = "c0a977b4-1342-4794-9cd2-5d726c26c1b9"
license = "Elastic License v2"
name = "AutoLogons Access Attempt via Registry"
os_list = ["windows"]
reference = ["https://github.com/GhostPack/SharpUp/blob/master/SharpUp/Checks/RegistryAutoLogons.cs#L26"]
version = "1.0.17"

query = '''
registry where event.action == "query" and process.executable != null and
 registry.path : "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\DefaultPassword" and
 not process.executable :
            ("?:\\Windows\\System32\\LogonUI.exe",
             "?:\\$WINDOWS.~BT\\Sources\\SetupHost.exe",
             "?:\\$WINDOWS.~BT\\Sources\\SetupPlatform.exe",
             "?:\\$WINDOWS.~BT\\Sources\\WindowsUpdateBox.exe",
             "?:\\Windows\\System32\\svchost.exe",
             "?:\\Windows\\System32\\wbem\\WmiPrvSE.exe",
             "?:\\Windows\\SysWOW64\\wbem\\WmiPrvSE.exe",
             "?:\\Windows\\System32\\MusNotification.exe", 
             "?:\\Windows\\SysWOW64\\MusNotification.exe",
             "?:\\Windows\\System32\\wsmprovhost.exe",
             "?:\\Windows\\System32\\conhost.exe",
             "?:\\Windows\\System32\\SecurityHealthSystray.exe",
             "?:\\Windows\\System32\\reg.exe",
             "?:\\Windows\\regedit.exe", 
             "?:\\Program Files\\*.exe", 
             "?:\\Program Files (x86)\\*.exe",
             "?:\\Windows\\System32\\cmd.exe",
             "C:\\ProgramData\\Guardicore\\utils\\gc-insight.exe",
             "?:\\Windows\\System32\\WindowsPowerShell\\v*\\powershell.exe", 
             "?:\\Windows\\System32\\WindowsPowerShell\\v*\\powershell_ise.exe",
             "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MpCmdRun.exe",
             "?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe",
             "?:\\Windows\\SystemApps\\MicrosoftWindows.Client.*\\SearchHost.exe",
             "?:\\Windows\\Temp\\MSS\\IRTKDeploy\\fennec-windows-x64.exe",
             "\\Device\\Mup\\*\\Autologon.exe",
             "?:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\ServicePortalAgent\\current\\emulator\\MmrAgent.NetFxEmulator.exe") and
  not (process.code_signature.trusted == true and not process.code_signature.subject_name : "Microsoft*") and
  not (process.name : "Autologon.exe" and process.code_signature.subject_name : "Microsoft*")
'''

min_endpoint_version = "8.6.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"
[[threat.technique.subtechnique]]
id = "T1552.001"
name = "Credentials In Files"
reference = "https://attack.mitre.org/techniques/T1552/001/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "8.6.0"

[metadata]
creation_date = "2026/06/29"
integration = ["aws"]
maturity = "production"
updated_date = "2026/06/29"

[rule]
author = ["Elastic"]
description = """
Identifies an IAM user that successfully signs in to the AWS Management Console from two or more distinct countries
within a short window. A single user authenticating from multiple geographic locations in a brief period is physically
implausible and indicates that the account's credentials or console session are being used from more than one place at
once. This is a hallmark of adversary-in-the-middle (AiTM) phishing and session theft, where the legitimate user signs
in from their location while the attacker replays the captured session or credentials from their own infrastructure.
Because the attacker logs in from a different network, the divergent sign-in geolocations are the detectable signal even
when MFA appears satisfied (AiTM relays the live MFA challenge). This is the CloudTrail-native analog of
identity-provider impossible-travel sign-in detections.
"""
false_positives = [
    """
    Legitimate users may appear in multiple countries within the window when using VPNs or proxies with exit nodes in
    different countries, when traveling near borders, or when mobile networks geolocate to different countries. Verify
    the source IPs and ASNs in "Esql.source_ip_values", confirm whether the locations are consistent with the user's
    expected activity, and exclude known VPN egress patterns after validation. Shared IAM users (an anti-pattern) used
    by multiple people will also match.
    """,
]
from = "now-65m"
interval = "10m"
language = "esql"
license = "Elastic License v2"
name = "AWS IAM User Console Login from Multiple Geolocations"
note = """## Triage and analysis

### Investigating AWS IAM User Console Login from Multiple Geolocations

This rule aggregates successful "ConsoleLogin" events for each IAM user over the lookback window and alerts when the logins originate from two or more distinct countries. Concurrent sign-ins from different geographies indicate the credentials or console session are in use from more than one location, a strong signal of adversary-in-the-middle (AiTM) phishing or session theft. AiTM relays the victim's live MFA, so the console login records MFA as used; the divergent geolocations, not the MFA field, are the indicator.

### Possible investigation steps

- Review "Esql.source_geo_country_iso_code_values" and "Esql.source_ip_values" to identify the locations and networks, and determine which (if any) is the user's expected origin.
- Compare "Esql.timestamp_min" and "Esql.timestamp_max" to assess how implausible the travel is.
- Identify the user in "aws.cloudtrail.user_identity.arn" and check for hands-on-keyboard activity immediately after the logins (CreateAccessKey, login profile or MFA changes, IAM policy changes, data access).
- Determine whether any of the source networks are VPNs, proxies, or hosting providers inconsistent with the user.

### False positive analysis

- VPN/proxy exit nodes, border travel, and mobile roaming can place a legitimate user in multiple countries. Confirm the activity is expected and exclude known networks after validation. Shared IAM users will also trigger this and should be remediated.

### Response and remediation

- If unauthorized, revoke the user's console sessions, reset the password and MFA, and rotate access keys.
- Review and revert changes made during the sessions, and migrate console access to IAM Identity Center with phishing-resistant MFA (FIDO2/passkeys), which defeats AiTM relay.

### Additional information

- [AWS sign-in CloudTrail events](https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html)
"""
references = ["https://securitylabs.datadoghq.com/articles/behind-the-console-aws-aitm-phishing-kit-and-beyond/"]
risk_score = 47
rule_id = "5301ac83-7a43-4c92-95e7-c372afea807d"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Domain: Identity",
    "Data Source: AWS",
    "Data Source: Amazon Web Services",
    "Data Source: AWS Sign-In",
    "Use Case: Identity and Access Audit",
    "Tactic: Initial Access",
    "Tactic: Credential Access",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "esql"

query = '''
FROM logs-aws.cloudtrail-*
| WHERE event.provider == "signin.amazonaws.com"
  AND event.action == "ConsoleLogin"
  AND event.outcome == "success"
  AND aws.cloudtrail.user_identity.type == "IAMUser"
  AND source.geo.country_iso_code IS NOT NULL
| STATS
    Esql.source_geo_country_iso_code_count_distinct = COUNT_DISTINCT(source.geo.country_iso_code),
    Esql.source_as_organization_name_count_distinct = COUNT_DISTINCT(source.as.organization.name),
    Esql.source_ip_values = VALUES(source.ip),
    Esql.source_geo_country_iso_code_values = VALUES(source.geo.country_iso_code),
    Esql.timestamp_min = MIN(@timestamp),
    Esql.timestamp_max = MAX(@timestamp)
  BY aws.cloudtrail.user_identity.arn, cloud.account.id
| WHERE Esql.source_geo_country_iso_code_count_distinct >= 2
| KEEP aws.cloudtrail.user_identity.arn, cloud.account.id, Esql.source_geo_country_iso_code_count_distinct, Esql.source_as_organization_name_count_distinct, Esql.source_ip_values, Esql.source_geo_country_iso_code_values, Esql.timestamp_min, Esql.timestamp_max
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"
[[rule.threat.technique.subtechnique]]
id = "T1078.004"
name = "Cloud Accounts"
reference = "https://attack.mitre.org/techniques/T1078/004/"



[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1539"
name = "Steal Web Session Cookie"
reference = "https://attack.mitre.org/techniques/T1539/"


[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[metadata]
creation_date = "2026/06/18"
integration = ["aws"]
maturity = "production"
updated_date = "2026/06/18"

[rule]
author = ["Elastic"]
description = """
Identifies an AWS Lambda function invoked directly by a principal from a source network (ASN) not seen for that
principal in the prior 10 days, excluding common cloud provider networks. Direct invocation from an unfamiliar external
network can indicate use of stolen execution-role or user credentials from attacker-controlled infrastructure to execute
functions or retrieve the data they return. This rule relies on AWS Lambda data event logging, which is not enabled by
default.
"""
false_positives = [
    """
    Operators and automation may legitimately invoke functions from new networks (new offices, VPNs, home IPs, or new
    egress infrastructure). Verify the principal in `aws.cloudtrail.user_identity.arn`, the source network, and the
    function, and exclude known operator networks or identities after validation.
    """,
]
from = "now-6m"
index = ["logs-aws.cloudtrail-*"]
interval = "5m"
language = "kuery"
license = "Elastic License v2"
name = "AWS Lambda Function Invoked from an Unusual Source ASN"
note = """## Triage and analysis

### Investigating AWS Lambda Function Invoked from an Unusual Source ASN

Lambda execution-role credentials and user credentials are frequently abused after theft (for example via SSRF or RCE against a function, or leaked access keys). When such credentials are replayed from attacker infrastructure, the resulting direct `Invoke` calls originate from a network the legitimate principal has not used. This rule uses a new terms approach over the source ASN organization and the principal, excluding common cloud provider networks, to surface invocation from unfamiliar external networks.

### Possible investigation steps

- Review `source.ip`, `source.as.organization.name`, and `source.geo` for the invoking network and determine whether it is expected for the principal in `aws.cloudtrail.user_identity.arn`.
- Inspect `aws.cloudtrail.request_parameters` for the `functionName` and `user_agent.original` for the client used.
- Determine whether the credential (`aws.cloudtrail.user_identity.access_key_id`) was recently seen used elsewhere or outside the Lambda runtime, which would corroborate credential theft.
- Correlate with other activity by the same principal from the same network, including data-plane access, IAM, or STS calls.

### False positive analysis

- New legitimate networks (offices, VPNs, home IPs, new egress) will generate this alert. Confirm the principal and network are expected and exclude known operator networks or identities after validation.
- If source ASN is legitimate and expected, add as an exclusion to reduce false-positives.

### Response and remediation

- If credential abuse is confirmed, rotate or revoke the affected credentials and execution-role permissions, and review what the invoked function accessed or returned.
- Constrain `lambda:InvokeFunction` to expected identities and, where possible, restrict invocation to known networks using IAM conditions.

### Additional information

- [Invoke API](https://docs.aws.amazon.com/lambda/latest/api/API_Invoke.html)
- [Logging Lambda data events with CloudTrail](https://docs.aws.amazon.com/lambda/latest/dg/logging-using-cloudtrail.html)
"""
references = [
    "https://docs.aws.amazon.com/lambda/latest/api/API_Invoke.html",
    "https://docs.aws.amazon.com/lambda/latest/dg/logging-using-cloudtrail.html",
]
risk_score = 47
rule_id = "c8cc8192-f4f5-4ed3-8368-544ca738d506"
setup = """## Setup

This rule requires AWS Lambda data events to be logged in CloudTrail and ingested via the AWS integration
(`aws.cloudtrail` data stream). Lambda invocation (`Invoke`) is a data-plane event and is NOT logged by default; enable
data event logging for Lambda functions in the trail (optionally scoped to sensitive functions to manage volume). Source
ASN enrichment (`source.as.organization.name`) must be available on the ingested events.
"""
severity = "medium"
tags = [
    "Domain: Cloud",
    "Data Source: AWS",
    "Data Source: Amazon Web Services",
    "Data Source: AWS Lambda",
    "Use Case: Threat Detection",
    "Tactic: Execution",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "new_terms"

query = '''
data_stream.dataset: "aws.cloudtrail"
    and event.provider: "lambda.amazonaws.com"
    and event.action: Invoke*
    and event.outcome: "success"
    and not aws.cloudtrail.user_identity.invoked_by: *
    and source.as.organization.name:(* and not (Amazon* or AMAZON* or Google* or GOOGLE* or Microsoft* or MICROSOFT*))
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1648"
name = "Serverless Execution"
reference = "https://attack.mitre.org/techniques/T1648/"


[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user_agent.original",
    "source.ip",
    "source.as.organization.name",
    "source.geo.country_name",
    "aws.cloudtrail.user_identity.arn",
    "aws.cloudtrail.user_identity.type",
    "aws.cloudtrail.user_identity.access_key_id",
    "aws.cloudtrail.user_identity.session_context.session_issuer.arn",
    "aws.cloudtrail.request_parameters",
    "event.action",
    "cloud.account.id",
]

[rule.new_terms]
field = "new_terms_fields"
value = ["source.as.organization.name", "cloud.account.id", "user.name"]
[[rule.new_terms.history_window_start]]
field = "history_window_start"
value = "now-10d"

[metadata]
creation_date = "2021/05/10"
integration = ["aws"]
maturity = "production"
updated_date = "2026/04/10"

[rule]
author = ["Elastic", "Austin Songer"]
description = """
Identifies when an AWS Route 53 domain is transferred to another AWS account. Transferring a domain changes
administrative control of the DNS namespace, enabling the receiving account to modify DNS records, route traffic,
request certificates, and potentially hijack operational workloads. Adversaries who gain access to privileged IAM users
or long-lived credentials may leverage domain transfers to establish persistence, redirect traffic, conduct phishing, or
stage infrastructure for broader attacks. This rule detects successful domain transfer requests.
"""
false_positives = [
    """
    Internal account restructuring, mergers and acquisitions, or legitimate ownership transfers between business units
    may involve transferring DNS domains to other AWS accounts. Confirm the transfer is approved and documented in
    change management processes before taking action. Transfers performed by unfamiliar identities, originating from
    atypical locations, or outside expected maintenance windows should be investigated.
    """,
]
from = "now-6m"
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
language = "kuery"
license = "Elastic License v2"
name = "AWS Route 53 Domain Transferred to Another Account"
note = """## Triage and analysis

### Investigating AWS Route 53 Domain Transferred to Another Account

Transferring a Route 53 domain to another AWS account is a high-impact administrative action. A successful transfer enables the
recipient account to fully manage the domain and all associated DNS resources. Unauthorized transfers can result in loss of
visibility and control, traffic redirection, service outages, or domain hijacking for phishing, credential harvesting, or command-and-control.

This rule detects successful calls to `TransferDomainToAnotherAwsAccount`. These events are rare and should be considered
high-risk unless explicitly documented and approved.

### Possible investigation steps

- **Identify the actor and authentication context**
  - Review `aws.cloudtrail.user_identity.arn` and `aws.cloudtrail.user_identity.access_key_id` to determine who initiated the transfer. Determine whether the actor typically performs Route 53 administrative actions or if this represents anomalous behavior.

- **Review request details and target account**
  - Inspect `aws.cloudtrail.request_parameters` for: `DomainName`, `AccountId` receiving the transfer, Request tokens or validation parameters. Validate whether the destination AWS account is recognized, trusted, or documented in ownership transfer procedures.

- **Assess environment and timing**
  - Compare `@timestamp` against maintenance windows, deployment pipelines, or approved domain operations. Review the region and endpoint used; domain transfers occurring from unexpected regions may indicate unauthorized access.

- **Analyze source and execution context**
  - Review `source.ip`, `source.geo.country_iso_code`, and `user_agent.original` to determine:
    - If the request originated from known networks, Whether it matches typical administrator access patterns or if suspicious automation tools, outdated SDK versions, or unknown agents were used.

- **Correlate with broader activity**
  - Pivot on the same IAM principal or access key ID to identify:
    - Recent IAM policy changes or privilege escalation
    - `DisableDomainTransferLock`, which normally precedes domain transfers
    - AWS console sign-ins from new geolocations or ASNs
    - API calls involving certificate requests, hosted zone changes, or DNS record edits
  - Look for evidence of lateral movement or credential theft preceding the transfer.

- **Validate with business owners**
  - Confirm with domain owners, development teams, or asset managers whether The transfer was intentional.

### False positive analysis

- **Expected domain migrations**
  - Organizations with multi-account strategies may transfer domains between operational, security, or sandbox accounts.
- **Business events**
  - Mergers, acquisitions, or contractual transitions between managed service providers often involve bulk domain transfers.
- **Automated administrative tooling**
  - Domain lifecycle automation or infrastructure-as-code pipelines may trigger transfers if misconfigured.
  
### Response and remediation

- **Contain and revoke access**
  - If unauthorized, immediately invalidate the IAM session or access keys used in the transfer.
  - Rotate credentials for the implicated IAM user or role and require MFA for privileged operations.

- **Reverse or halt the transfer**
  - Contact AWS Support as soon as possible to request assistance reversing or blocking the transfer if it was not approved.
  - Re-enable transfer lock (`DisableDomainTransferLock=false`) to prevent further modifications.

- **Investigate the extent of compromise**
  - Review CloudTrail to identify all actions performed by the actor before and after the transfer.
  - Check for additional changes to hosted zones, DNS records, certificates, or registrar contact details.

- **Restore operational integrity**
  - Validate DNS routing, certificate issuance, and application endpoints for signs of redirection or tampering.
  - Communicate with impacted teams and external stakeholders if customer-facing domains were affected.

- **Hardening and long-term improvements**
  - Restrict domain transfer permissions to a minimal set of roles using IAM Conditions such as `aws:PrincipalArn` and `aws:MultiFactorAuthPresent`
  - Consider SCPs to block domain-transfer APIs in production accounts.
  - Add change-management tracking for domain ownership modifications.

### Additional information
- **[AWS IR Playbooks](https://github.com/aws-samples/aws-incident-response-playbooks/blob/c151b0dc091755fffd4d662a8f29e2f6794da52c/playbooks/)** 
- **[AWS Customer Playbook Framework](https://github.com/aws-samples/aws-customer-playbook-framework/tree/a8c7b313636b406a375952ac00b2d68e89a991f2/docs)** 
- **[AWS Knowledge Center – Security Best Practices](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/)**
"""
references = ["https://docs.aws.amazon.com/Route53/latest/APIReference/API_Operations_Amazon_Route_53.html"]
risk_score = 73
rule_id = "2045567e-b0af-444a-8c0b-0b6e2dae9e13"
severity = "high"
tags = [
    "Domain: Cloud",
    "Data Source: AWS",
    "Data Source: Amazon Web Services",
    "Data Source: AWS Route 53",
    "Use Case: Asset Visibility",
    "Tactic: Persistence",
    "Tactic: Resource Development",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset: aws.cloudtrail 
    and event.provider: route53domains.amazonaws.com 
    and event.action: TransferDomainToAnotherAwsAccount 
    and event.outcome: success
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"


[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1584"
name = "Compromise Infrastructure"
reference = "https://attack.mitre.org/techniques/T1584/"
[[rule.threat.technique.subtechnique]]
id = "T1584.001"
name = "Domains"
reference = "https://attack.mitre.org/techniques/T1584/001/"



[rule.threat.tactic]
id = "TA0042"
name = "Resource Development"
reference = "https://attack.mitre.org/tactics/TA0042/"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user_agent.original",
    "source.ip",
    "aws.cloudtrail.user_identity.arn",
    "aws.cloudtrail.user_identity.type",
    "aws.cloudtrail.user_identity.access_key_id",
    "event.action",
    "event.outcome",
    "cloud.account.id",
    "cloud.region",
    "aws.cloudtrail.request_parameters",
    "aws.cloudtrail.response_elements",
]

[metadata]
creation_date = "2020/12/18"
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2026/05/03"

[rule]
author = ["Elastic"]
description = """
Identifies the creation of a hidden local user account by appending the dollar sign to the account name. This is
sometimes done by attackers to increase access to a system and avoid appearing in the results of accounts listing using
the net users command.
"""
from = "now-9m"
index = [
    "winlogbeat-*",
    "logs-endpoint.events.registry-*",
    "logs-windows.sysmon_operational-*",
    "endgame-*",
    "logs-m365_defender.event-*",
    "logs-sentinel_one_cloud_funnel.*",
    "logs-crowdstrike.fdr*",
]
language = "eql"
license = "Elastic License v2"
name = "Creation of a Hidden Local User Account"
references = [
    "http://web.archive.org/web/20230329153858/https://blog.menasec.net/2019/02/threat-hunting-6-hiding-in-plain-sights_8.html",
    "https://github.com/CyberMonitor/APT_CyberCriminal_Campagin_Collections/tree/master/2020/2020.12.15.Lazarus_Campaign",
]
risk_score = 73
rule_id = "2edc8076-291e-41e9-81e4-e3fcbc97ae5e"
severity = "high"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Persistence",
    "Resources: Investigation Guide",
    "Data Source: Elastic Endgame",
    "Data Source: Elastic Defend",
    "Data Source: Sysmon",
    "Data Source: Microsoft Defender XDR",
    "Data Source: SentinelOne",
    "Data Source: Crowdstrike",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
registry where host.os.type == "windows" and event.type in ("change", "creation") and
  registry.path : (
    "HKLM\\SAM\\SAM\\Domains\\Account\\Users\\Names\\*$\\",
    "\\REGISTRY\\MACHINE\\SAM\\SAM\\Domains\\Account\\Users\\Names\\*$\\",
    "MACHINE\\SAM\\SAM\\Domains\\Account\\Users\\Names\\*$\\"
)
'''

note = """## Triage and analysis

### Investigating Creation of a Hidden Local User Account

#### Possible investigation steps

- What hidden local account did the SAM write create?
  - Why: a `$` suffix is ambiguous in many logs, but `registry.path` under `SAM\\SAM\\Domains\\Account\\Users\\Names` is a local account-name entry and can be omitted from casual `net user` review.
  - Focus: `registry.hive`, `registry.path`, `registry.key`, and `@timestamp` for the exact account name and creation time.
  - Implication: high concern unless the exact `$`-suffixed account, `host.id`, and time fit one narrowly recognized provisioning or recovery workflow; lower concern only when creator, use, and scope checks do not contradict it.

- Which process and parent caused the SAM entry?
  - Focus: `process.entity_id`, `process.executable`, `process.command_line`, `process.parent.executable`, and `process.parent.command_line`.
  - Implication: escalate for shells, script interpreters, remote-service launchers such as sc.exe, service-created cmd/net user chains, PsExec-like tools, user-writable binaries, or mismatched parents; lower concern only when creator path, parent, and arguments match one recognized account-management workflow.

- Did the creator or its children perform other account, privilege, or persistence actions?
  - Why: remote account creation can surface as a service-launched command, and the decisive `net user`, local-group, or cleanup action may be in the creator's process tree rather than the registry event alone.
  - Focus: same-host registry and process activity for creator `process.entity_id` and child `process.parent.entity_id`: `process.command_line`, `registry.path`, `registry.value`, and `registry.data.strings`. $investigate_0
  - Hint: if the parent is service-control or PsExec-like, keep service-created cmd/net user children in scope even when signed.
  - Implication: escalate when the tree adds local-group membership, touches extra SAM or LSA paths, deletes staging commands, or creates other persistence; lower concern when activity stays limited to the recovered account inside the same recognized workflow.

- Was the hidden account used by later process activity after creation?
  - Why: remote or service use of `$`-suffixed accounts may leave little profile evidence, so process and session context carries more weight than profile artifacts.
  - Focus: extract the account leaf from `registry.path`, then search same-host process starts after `@timestamp` where `user.name` matches it, reading `process.Ext.session_info.logon_type`, `process.executable`, and `process.command_line`.
  - Hint: this pivot is manual unless the account name is normalized into a standalone alert field; avoid using the full SAM registry path as an account value.
  - Implication: account use after creation strongly escalates when the account runs processes, appears in remote-interactive, network, service, or batch sessions, or launches administrative tooling; lower concern only when no process use appears and creator evidence fits a recognized provisioning path.

- If local evidence is suspicious or unresolved, do recent same-actor or same-host alerts change scope?
  - Focus: related alerts for creating `user.id` and `host.id`: account abuse, privilege escalation, remote execution, credential access, or additional persistence.
  - Hint: use the creating-identity alert pivot. $investigate_1
  - Hint: use the host alert pivot. $investigate_2
  - Implication: broaden response when the same actor or host has related account, persistence, or privilege alerts; keep local when history is clean and local evidence already fits one recognized workflow.

- What disposition is supported?
  - Escalate for unexpected account or creator lineage, privilege or cleanup activity, later account use, or wider scope; close only when same-host telemetry proves one exact recognized workflow, using records only as corroboration; preserve evidence and escalate when answers stay mixed or incomplete.

### False positive analysis

- A pre-established local support-account provisioning or recovery workflow can create a `$`-suffixed local account, but close only on a complete telemetry match: exact `registry.path`, creator `process.executable`, `process.command_line`, parent process, `user.id`, and `host.id`, with no extra SAM, LSA, privilege-grant, or cleanup activity outside it. Use build, vendor, or maintenance records only to corroborate that match; never close or exception on records alone.
- Treat one-off interactive creation, remote service-created cmd.exe or net.exe, script-driven creation, and creation on ordinary workstations or servers as suspicious by default. Hidden support accounts elsewhere or a signed creator binary are not enough to close.
- Build exceptions only from the minimum confirmed workflow: exact hidden-account `registry.path`, stable creator executable and command pattern, parent workflow, `user.id`, and bounded `host.id` cohort. Avoid exceptions on all `$`-suffixed names, the SAM hive, `process.name` alone, or the rule name.

### Response and remediation

- If confirmed benign, reverse temporary containment and record the exact account path, creator lineage, user, and host cohort that proved the recurring workflow. Keep any exception as narrow as that confirmed pattern.
- If suspicious but unconfirmed, export the alert, the triggering registry event, creator process details, current hidden-account state, privilege evidence found in process or registry review, and any process or session use by the hidden account before containment. Apply reversible actions first: disable the account, restrict its logon rights, or increase monitoring on the affected `host.id` and creating `user.id`; avoid deleting the account until evidence is preserved.
- If confirmed malicious, preserve account state, creator process lineage, and related registry or process artifacts first. Then isolate the host when its role allows, disable the hidden account, and contain the creating identity or remote source when the evidence identifies one. After preservation and containment, remove unauthorized privilege, SAM, LSA, service, or scheduled-task changes introduced around the same time.
- Post-incident hardening: restrict hidden support-account creation to controlled management tooling, audit the host for other local accounts ending in `$`, retain registry and process telemetry needed to reconstruct future account creation, and document blind spots around preexisting hidden accounts or later privilege grants.
"""

setup = """## Setup

This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.

Setup instructions: https://ela.st/install-elastic-defend

### Additional data sources

This rule also supports the following third-party data sources. For setup instructions, refer to the links below:

- [CrowdStrike](https://ela.st/crowdstrike-integration)
- [Microsoft Defender XDR](https://ela.st/m365-defender)
- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
- [Sysmon Registry Events](https://ela.st/sysmon-event-reg-setup)
"""

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "host.name",
    "host.id",
    "user.id",
    "process.entity_id",
    "process.pid",
    "process.executable",
    "process.command_line",
    "process.parent.name",
    "process.parent.executable",
    "process.parent.command_line",
    "registry.hive",
    "registry.path",
    "registry.key",
    "registry.value",
]

[transform]

[[transform.investigate]]
label = "Creator process and child activity on this host"
description = ""
providers = [
  [
    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" },
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" }
  ],
  [
    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" },
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "process.parent.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" }
  ],
  [
    { excluded = false, field = "event.category", queryType = "phrase", value = "registry", valueType = "string" },
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" }
  ],
  [
    { excluded = false, field = "event.category", queryType = "phrase", value = "registry", valueType = "string" },
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "process.parent.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" }
  ]
]
relativeFrom = "now-24h/h"
relativeTo = "now"

[[transform.investigate]]
label = "Alerts associated with the creating identity"
description = ""
providers = [
  [
    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
    { excluded = false, field = "user.id", queryType = "phrase", value = "{{user.id}}", valueType = "string" }
  ]
]
relativeFrom = "now-48h/h"
relativeTo = "now"

[[transform.investigate]]
label = "Alerts associated with the host"
description = ""
providers = [
  [
    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" }
  ]
]
relativeFrom = "now-48h/h"
relativeTo = "now"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1136"
name = "Create Account"
reference = "https://attack.mitre.org/techniques/T1136/"

[[rule.threat.technique.subtechnique]]
id = "T1136.001"
name = "Local Account"
reference = "https://attack.mitre.org/techniques/T1136/001/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1564"
name = "Hide Artifacts"
reference = "https://attack.mitre.org/techniques/T1564/"

[[rule.threat.technique.subtechnique]]
id = "T1564.002"
name = "Hidden Users"
reference = "https://attack.mitre.org/techniques/T1564/002/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[metadata]
creation_date = "2020/07/08"
integration = ["endpoint"]
maturity = "production"
promotion = true
updated_date = "2025/03/21"

[rule]
author = ["Elastic"]
description = """
Generates a detection alert each time an Elastic Defend alert is received. Enabling this rule allows you to immediately
begin investigating your Endpoint alerts.
"""
enabled = true
from = "now-2m"
index = ["logs-endpoint.alerts-*"]
interval = "1m"
language = "kuery"
license = "Elastic License v2"
max_signals = 1000
name = "Endpoint Security (Elastic Defend)"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Endpoint Security (Elastic Defend)

Elastic Defend is a robust endpoint security solution that monitors and protects systems by analyzing events and generating alerts for suspicious activities. Adversaries may exploit endpoints by executing unauthorized code or manipulating system processes. The detection rule leverages event data to identify alerts from Elastic Defend, focusing on potential threats while excluding non-relevant modules, thus enabling timely investigation of endpoint anomalies.

### Possible investigation steps

- Review the alert details to understand the specific event.kind:alert and event.module: endpoint that triggered the alert, ensuring it is not related to the excluded endgame module.
- Examine the timeline of events leading up to the alert to identify any unusual or unauthorized activities, such as unexpected process executions or system changes.
- Correlate the alert with other security events or logs from the same endpoint to gather additional context and determine if there is a pattern of suspicious behavior.
- Investigate the source and destination of any network connections associated with the alert to identify potential command and control activity or data exfiltration attempts.
- Check for any recent changes or updates to the endpoint's software or configuration that could explain the alert, ensuring they are legitimate and authorized.
- Assess the risk score and severity of the alert in conjunction with other alerts from the same endpoint to prioritize the investigation and response efforts.

### False positive analysis

- Alerts triggered by routine software updates can be false positives. Users can create exceptions for known update processes to prevent unnecessary alerts.
- System maintenance activities, such as scheduled scans or backups, may generate alerts. Exclude these activities by identifying their specific event signatures and adding them to the exception list.
- Legitimate administrative actions, like remote desktop sessions or script executions by IT staff, might be flagged. Define exceptions for these actions by correlating them with authorized user accounts or IP addresses.
- Frequent alerts from non-malicious applications that interact with system processes can be excluded by whitelisting these applications based on their hash or path.
- Network monitoring tools that simulate attack patterns for testing purposes may trigger alerts. Exclude these tools by specifying their known behaviors and IP ranges in the exception settings.

### Response and remediation

- Isolate the affected endpoint immediately to prevent further unauthorized access or lateral movement within the network.
- Analyze the alert details to identify the specific unauthorized code or process manipulation involved, and terminate any malicious processes identified.
- Remove any unauthorized code or files from the affected endpoint, ensuring that all traces of the threat are eradicated.
- Conduct a thorough review of system logs and event data to identify any additional indicators of compromise or related suspicious activities.
- Update endpoint security configurations and signatures to prevent similar threats from exploiting the same vulnerabilities in the future.
- Restore the affected endpoint from a known good backup if necessary, ensuring that the system is free from any residual threats.
- Escalate the incident to the security operations center (SOC) or relevant team for further analysis and to determine if additional systems may be affected."""
risk_score = 47
rule_id = "9a1a2dae-0b5f-4c3d-8305-a268d404c306"
rule_name_override = "message"
setup = """## Setup

### Elastic Defend Alerts
If this rule is disabled, you will not receive alerts for Elastic Defend alerts. This rule is designed to capture all alerts generated by Elastic Defend. For more granular alerting, consider using additional prebuilt-rules that capture specific Elastic Defend alerts.

If this rule is enabled, along with the related rules listed below, you will receive duplicate alerts for the same events. To avoid this, it is recommended to disable this generic rule and enable the more specific rules that capture these alerts separately.

Related rules:
- Behavior - Detected - Elastic Defend (UUID: 0f615fe4-eaa2-11ee-ae33-f661ea17fbce)
- Behavior - Prevented - Elastic Defend (UUID: eb804972-ea34-11ee-a417-f661ea17fbce)
- Malicious File - Detected - Elastic Defend (UUID: f2c3caa6-ea34-11ee-a417-f661ea17fbce)
- Malicious File - Prevented - Elastic Defend (UUID: f87e6122-ea34-11ee-a417-f661ea17fbce)
- Memory Threat - Detected - Elastic Defend (UUID: 017de1e4-ea35-11ee-a417-f661ea17fbce)
- Memory Threat - Prevented - Elastic Defend (UUID: 06f3a26c-ea35-11ee-a417-f661ea17fbce)
- Ransomware - Detected - Elastic Defend (UUID: 0c74cd7e-ea35-11ee-a417-f661ea17fbce)
- Ransomware - Prevented - Elastic Defend (UUID: 10f3d520-ea35-11ee-a417-f661ea17fbce)

### Additional notes

For information on troubleshooting the maximum alerts warning please refer to this [guide](https://www.elastic.co/guide/en/security/current/alerts-ui-monitor.html#troubleshoot-max-alerts).
"""
severity = "medium"
tags = ["Data Source: Elastic Defend", "Resources: Investigation Guide"]
timestamp_override = "event.ingested"
type = "query"

query = '''
event.kind:alert and event.module:(endpoint and not endgame)
'''


[[rule.exceptions_list]]
id = "endpoint_list"
list_id = "endpoint_list"
namespace_type = "agnostic"
type = "endpoint"

[[rule.risk_score_mapping]]
field = "event.risk_score"
operator = "equals"
value = ""

[[rule.severity_mapping]]
field = "event.severity"
operator = "equals"
severity = "low"
value = "21"

[[rule.severity_mapping]]
field = "event.severity"
operator = "equals"
severity = "medium"
value = "47"

[[rule.severity_mapping]]
field = "event.severity"
operator = "equals"
severity = "high"
value = "73"

[[rule.severity_mapping]]
field = "event.severity"
operator = "equals"
severity = "critical"
value = "99"

[rule]
description = """
Identifies the execution of a file that was created by the virtual system process and subsequently executed as a child
of services.exe. This may indicate lateral movement via remote services.
"""
id = "713501c8-d1fa-49be-bf91-0ae916a088f6"
license = "Elastic License v2"
name = "Execution of a File Dropped from SMB via Services"
os_list = ["windows"]
version = "1.0.20"

query = '''
sequence with maxspan=3m
  [file where event.action != "deletion" and
   /* library dropped via SMB */
   process.pid == 4 and user.id : ("S-1-5-21*", "S-1-12-*") and
   (file.extension : "exe" or file.Ext.header_bytes : "4d5a*")] by file.path

  [process where event.action == "start" and

    process.parent.name : "services.exe" and

    (
     process.executable : ("?:\\ProgramData\\*", "?:\\Users\\*", "?:\\Windows\\Tasks\\*") or
     (process.executable regex~ """[A-Za-z]:\\Windows\\[a-zA-Z0-9\-\_\.]+""" and process.code_signature.exists == false)
    ) and

    /* Signed False Positives */

	 not (process.code_signature.subject_name :
	                  ("RAPIDFIRE TOOLS INC.",
					   "Arcserve (USA) LLC",
					   "PDQ.COM CORPORATION",
					   "Veeam Software Group GmbH",
					   "Veeam Software AG",
					   "LANDesk Software, Inc.",
					   "Cynet Security LTD",
					   "CyberArk Software Ltd.",
					   "Barracuda Networks, Inc.",
					   "AVG Technologies Canada, Inc.",
					   "ConnectWise, Inc.",
					   "Ivanti, Inc.",
					   "FUJITSU LIMITED",
					   "Shavlik Technologies",
					   "Kaspersky Lab JSC",
					   "Netalytics Security Inc",
					   "Elasticsearch, Inc.",
					   "Netwrix Corporation",
					   "Power Admin LLC",
					   "Notepad++",
					   "The Apache Software Foundation",
					   "HashInclude Computech Pvt. Ltd.",
					   "DIGITAL DEFENSE, INC",
					   "Snow Software AB",
					   "GOVERLAN, LLC",
					   "Veritas Technologies LLC",
					   "Bitdefender SRL",
					   "Kaseya Corporation",
					   "Insecure.Com LLC",
					   "ZOHO Corporation Private Limited",
					   "VMware, Inc.",
					   "Medical Information Technology, Inc.",
					   "baramundi software AG",
					   "ServiceNow, Inc.",
					   "Panda Security, S.L.",
					   "CoSoSys SRL",
					   "N-ABLE TECHNOLOGIES LTD",
					   "CISCO SYSTEMS, INC.",
					   "TeamViewer Germany GmbH",
					   "SysAid Technologies LTD",
					   "Sophos Ltd",
					   "Ericsson",
					   "Tenable Network Security Inc.",
					   "NETSUPPORT LTD.",
					   "Lansweeper",
					   "Helge Klein GmbH",
					   "Netwrix Corporation",
					   "highsystem ag",
					   "Beyondtrust Software Inc",
					   "Oracle America, Inc.",
					   "KnowBe4 Inc.",
					   "GoTo Technologies USA, LLC",
					   "Icona S.R.L.",
					   "LogMeIn, Inc.",
					   "Dell Inc.") and process.code_signature.trusted == true) and

	  not (process.code_signature.subject_name in ("Medical Information Technology, Inc.", "CyberArk Software Ltd.", "VMware, Inc.") and
	       process.code_signature.status in ("errorTimeStamp", "errorChaining")) and

    /* unsigned FP - PowerAdmin LLC 8a203d0dd4821b42ca399140e093919348b60ac43140e92f88d047263e2c57b4 */
    not (process.pe.original_file_name == "PAExec.exe" and
         process.executable : "?:\\Windows\\PAExec-*.exe" and process.parent.name : "services.exe") and

    not (process.pe.original_file_name : "psexesvc.exe" and
	     process.code_signature.subject_name in ("Sysinternals", "Microsoft Corporation") and
         process.code_signature.trusted == true and process.name : "PSEXESVC.EXE") and

    not (process.pe.original_file_name == "psloglist.exe" and
	     process.code_signature.subject_name in ("Sysinternals", "Microsoft Corporation") and
         process.code_signature.trusted == true and not process.args : "-c") and

    not (process.code_signature.subject_name == "Microsoft Corporation" and
	       process.code_signature.trusted == true and
	       process.pe.original_file_name : ("MOMAgentInstaller.exe", "dotnet-hosting-*-win.exe", "dpmac.exe",
	                                         "migrate.exe", "Ms.Dsp.Do.Inc.Installer.exe", "OpenHandleCollector.exe")) and


    /* unsigned FPs */

    /* Alignia Remote Command Execution Manager  */
    not (process.pe.original_file_name == "T4RCEM.exe" and process.args : "10000" and
	     process.parent.name : "services.exe" and process.args_count >= 4) and

    /* unsigned McAfee Remote Installer */
    not (process.pe.original_file_name == "wstub32.exe" and
	     process.args : "/InstDir=<PROGRAM_FILES_DIR>\\McAfee\\Agent" and
         process.args : "/Install=Agent" and process.parent.name : "services.exe") and

    /* FortiClientSetup - unsigned */
    not (process.pe.original_file_name == "FortiClientSetup.exe" and
	     process.args : "/schid" and process.args : "/deviceid" and process.parent.name : "services.exe") and

    /* fart-it.sourceforge.net, IseExecSvc, OCS Inventory Agent,Tenable MW Scanner and HPCmdSvc */
    not process.hash.sha256 in
	         ("c9ef35bed70ffa0981bafd0071185b56fdad8f9c97f3582a4dae9b420959fb97",
	          "18dc098895ccc8246d417445a36d933c5f8487419b848ebe651fd0e11cb22afa",
	          "ea98309a35f92443b9c50736ce208656ec72af114ec8aceeb02dfa041ec2d6bc",
	          "bcf07679ea026f1dfba6f9ab63251e4834dc007bd2c5b9039deb9d900fe1c5e6",
	          "1c6af94b26f369e2c10819eefb869f873e5540e2c1b7bf4c7c632fc03d67368a",
	          "6dfc3a0733f427779b250913811baa429002042cb8e7732ea7d334bf725b8bd0",
	          "ae0fb4bf4a6faa4b808794b6e6ccbdf9f10c1ce01a86ccece002ac63cf09ff29",
	          "cd5ff596b7bacb117f90893f94fd8c542b659cc58f90ed1fbd0471fe85148bff",
	          "5e7785fede192d69e408c8c41ba14aead2f4b297c9faecc991e061b093b91f70",
	          "08d019e46a8755c33ad9ff9b96b5409a9005d87ba4e3cc58bdd8cf10eb0cd987",
	          "81e6e6feaac8b3267608af98667d3ccf78a15e540e6a5d18858d9147aacd1e16",
	          "a07b0b72bb00d9e9debd38c2b4bd770beb7d6cf6148d2f7fba50d7a7078deb04",
	          "bc10fdc46d17765c619db70ef19cd3755a3270692481d8417bfff3fceb4eba10",
	          "bb53243baeb4e4cc204e5b9981cc0c671e0855f56293df5106b9b3beac30cc15",
	          "c5593f5d965994a50985b529e77b97c348c7af084dbbaba270d83b1b06302d2c",
	          "7f8e465edd27cdcd1d28292c35440d745b8bd528e21d6f56eb683b65d922eaed",
	          "ef7dbfe3a3910ddb93989f0d5d8f1fb4d39e0df7e53f55d042f4ccd80699c81f",
	          "bb53243baeb4e4cc204e5b9981cc0c671e0855f56293df5106b9b3beac30cc15",
	          "bc10fdc46d17765c619db70ef19cd3755a3270692481d8417bfff3fceb4eba10",
	          "ef7dbfe3a3910ddb93989f0d5d8f1fb4d39e0df7e53f55d042f4ccd80699c81f",
	          "39b3ae96186b7e62b9176e6d2ae27db3e164a7c8c52c094c811dd19d651577f2",
	          "5e7785fede192d69e408c8c41ba14aead2f4b297c9faecc991e061b093b91f70",
	          "b9fc7dea50ce1e0637a3628abc89f96d8cfaad1b7c6ad33dd8bb17028ed3eaee",
	          "5e81eaedc6bba9c9b475f990cdc31ee3c48962fffb63d65afc1447ea6b95f910",
	          "ec7d2582c06d28191b2efaf6780cdfa5c1319f3081bd001d4572cbeea0068b48",
	          "4208e349ff97a2dc6100ee9e5e61e23ab650b316e62dd4a25d1119a08a59f298",
	          "c4c6b0db707020364cd398d2a7a3eb2516cfeb0a011557dce3393e25eaa90be4",
	          "4feacc0b469215c816865909aedcb52834acab86d9677a74ec559529290373e9",
	          "141b2190f51397dbd0dfde0e3904b264c91b6f81febc823ff0c33da980b69944",
	          "ae43b51f5c5795eba6fffbcf901ced7215b86342451aa4ef39b4f2d8f649fa81",
	          "11a4758eaaf7bd88ff826860441658905ee2d5198efbdc61259136a3f968c8f5",
	          "47dbc1fda7e540f996a6ef035b476cd50987c5bf163c04334752a051c05ae37d",
	          "c71ddd9aeaed18b6a3e6c80119504ececdfa329328e4a814913be6113c8efb1d",
	          "dbc16e5afe0c0922df779952350d7fb5103a54ae7767b97d192e2d90a76ed88a",
	          "5e1e2c6a88711a716805695996d2e9906de713ec3abd9eb5376b087438f33a40",
	          "79db4d8a9a8e87214d20eef964bc9bfc3a7f5abf162d98fa7eae2dd7e96ef272",
	          "7f8e465edd27cdcd1d28292c35440d745b8bd528e21d6f56eb683b65d922eaed",
	          "3b47eeb28734ced42682be0806786ae4ac460bf7545934bae5fc367df23fa6e9",
	          "2b25e0331289460dbaed2d851b92f43e6999f694bf17964a8786f3a4cce602a6",
	          "67201716f8126a0445cda79f55336140066071acb4d72d9a489e19125d3aa8f6",
	          "87952d419caf8fe11dad35f63ac1d09ba58fb9347567557750e24d1ff271fbb7",
	          "9c2ffb59617d1e0710f04aa0b3541a089c2b5e0e81072511a16b78922fe204a9") and

    not (process.pe.original_file_name == "PortalService.exe" and
	     process.executable : "E:\\EZ\\EZAccess\\Service\\*\\PortalService.exe" and process.parent.name : "services.exe") and

	not (process.code_signature.subject_name == "CyberArk Software Ltd." and
	     process.executable : "?:\\Windows\\CAInvokerService.exe" and process.pe.original_file_name == "PSMWinAgentInvoker.exe")
  ] by process.executable
'''

min_endpoint_version = "7.15.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1
tree = true

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1021"
name = "Remote Services"
reference = "https://attack.mitre.org/techniques/T1021/"
[[threat.technique.subtechnique]]
id = "T1021.002"
name = "SMB/Windows Admin Shares"
reference = "https://attack.mitre.org/techniques/T1021/002/"



[threat.tactic]
id = "TA0008"
name = "Lateral Movement"
reference = "https://attack.mitre.org/tactics/TA0008/"

[internal]
min_endpoint_version = "7.15.0"

[metadata]
creation_date = "2026/06/25"
integration = ["network_traffic"]
maturity = "production"
updated_date = "2026/06/25"

[rule]
author = ["Elastic"]
description = """
Identifies the first source and destination IP pair observed in a five-day history window where an NFS client asserts
AUTH_SYS (RPC UNIX) credentials with UID 0 (root). NFSv3 and NFSv4 clients can claim arbitrary UIDs through AUTH_SYS,
and weak export controls may honor root-equivalent access from unexpected hosts. This is a common precursor to
unauthorized mounts, sensitive file reads, and remote encryption of exported shares.
"""
false_positives = [
    """
    Legitimate NFS root squashing misconfiguration, administrative automation, or backup appliances may present UID 0
    from known infrastructure. Confirm the source IP against approved NFS client inventories before closing.
    """,
]
from = "now-9m"
index = ["logs-network_traffic.nfs*"]
language = "kuery"
license = "Elastic License v2"
name = "First Time Seen NFS AUTH_SYS Root UID Access"
note = """## Triage and analysis

### Investigating First Time Seen NFS AUTH_SYS Root UID Access

NFS AUTH_SYS allows the client to assert UID/GID values on the wire. UID 0 maps to superuser access on many exports unless root squashing or Kerberos (RPCSEC_GSS) is enforced. Attackers abuse this to read secrets, traverse exports, or stage ransomware writes without a local root shell on the NFS server. This rule uses a five-day history window to identify the first observed source and destination IP pair presenting root credentials.

### Possible investigation steps

- Identify `source.ip` and confirm whether it is an approved NFS client for the targeted `destination.ip` export server.
- Review adjacent NFS operations from the same source for `READDIR`, `READ`, `WRITE`, or `REMOVE` activity that suggests enumeration, collection, or impact.
- Validate export policy on the server (`/etc/exports`, `exportfs -v`) for `no_root_squash`, overly broad client lists, or missing `sec=krb5`.
- Check endpoint telemetry on the source host for tooling such as `showmount`, `mount.nfs`, or Impacket-style NFS abuse.

### False positive analysis

- Known backup, imaging, or virtualization platforms sometimes mount exports as root from fixed infrastructure IPs. Create exceptions for those sources only after confirming stable client identity and expected operation mix.
- Migration or DR runbooks may temporarily mount with root to preserve ownership. Correlate with change tickets and bounded maintenance windows.

### Response and remediation

- Block unauthorized `source.ip` at the host firewall or export ACL and rotate any credentials read from the export.
- Enforce `root_squash`, narrow client allowlists, and RPCSEC_GSS on sensitive exports.
- Hunt for follow-on `WRITE`/`RENAME` bursts from the same client that may indicate ransomware activity.
"""
references = ["https://attack.mitre.org/techniques/T1213/", "https://attack.mitre.org/techniques/T1039/"]
risk_score = 47
rule_id = "35ef761a-7136-4cb9-a32d-4e7abddb3bac"
setup = """## Setup

This rule requires the Elastic **network_traffic** integration (Packetbeat via Elastic Agent) with the **NFS** protocol
module enabled on a sensor that observes NFS traffic to or from monitored exports (host agent, SPAN/mirror, or gateway).
"""
severity = "medium"
tags = [
    "Domain: Network",
    "Use Case: Threat Detection",
    "Use Case: Network Security Monitoring",
    "Tactic: Collection",
    "Data Source: Network Packet Capture",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "new_terms"

query = '''
data_stream.dataset:network_traffic.nfs and
network_traffic.nfs.rpc.cred.uid:0 and
network_traffic.nfs.rpc.auth_flavor:unix and
source.ip:* and destination.ip:*
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1039"
name = "Data from Network Shared Drive"
reference = "https://attack.mitre.org/techniques/T1039/"

[[rule.threat.technique]]
id = "T1213"
name = "Data from Information Repositories"
reference = "https://attack.mitre.org/techniques/T1213/"


[rule.threat.tactic]
id = "TA0009"
name = "Collection"
reference = "https://attack.mitre.org/tactics/TA0009/"

[rule.new_terms]
field = "new_terms_fields"
value = ["source.ip", "destination.ip"]
[[rule.new_terms.history_window_start]]
field = "history_window_start"
value = "now-5d"

[metadata]
creation_date = "2025/12/04"
integration = ["endpoint"]
maturity = "production"
updated_date = "2026/07/06"

[rule]
author = ["Elastic"]
description = """
Detects when GenAI tools access sensitive files such as cloud credentials, SSH keys, browser password databases, or
shell configurations. Attackers leverage GenAI agents to systematically locate and exfiltrate credentials, API keys, and
tokens. Access to credential stores (.aws/credentials, .ssh/id_*) suggests harvesting, while writes to shell configs
(.bashrc, .zshrc) indicate persistence attempts. Note: On linux only creation events are available. Access events are
not yet implemented.
"""
from = "now-9m"
index = ["logs-endpoint.events.file*"]
language = "eql"
license = "Elastic License v2"
name = "GenAI Process Accessing Sensitive Files"
note = """## Triage and analysis

### Investigating GenAI Process Accessing Sensitive Files

This rule detects GenAI tools accessing credential files, SSH keys, browser data, or shell configurations. While GenAI tools legitimately access project files, access to sensitive credential stores is unusual and warrants investigation.

### Possible investigation steps

- Review the GenAI process that triggered the alert to identify which tool is being used and verify if it's an expected/authorized tool.
- Investigate the user account associated with the GenAI process to determine if this activity is expected for that user.
- Review the types of sensitive files being accessed (credentials, keys, browser data, etc.) to assess the potential impact of credential harvesting or data exfiltration.
- Check for other alerts or suspicious activity on the same host around the same time, particularly network exfiltration events.
- Verify if the GenAI tool or extension is from a trusted source and if it's authorized for use in your environment.
- Determine if the GenAI process accessed multiple sensitive directories in sequence, an indication of credential harvesting.
- Check if the GenAI tool recently created or accessed AI agent config files, which may contain instructions enabling autonomous file scanning.
- Review whether the access was preceded by an MCP server, LangChain agent, or background automation.

### False positive analysis

- Automated security scanning or auditing tools that leverage GenAI may access sensitive files as part of their normal operation.
- Development workflows that use GenAI tools for code analysis may occasionally access credential files.

### Response and remediation

- Immediately review the GenAI process that accessed the documents to determine if it's compromised or malicious.
- Review, rotate, and revoke any API keys, tokens, or credentials that may have been exposed or used by the GenAI tool.
- Investigate the document access patterns to determine the scope of potential data exfiltration.
- Update security policies to restrict or monitor GenAI tool usage in the environment, especially for access to sensitive files.
"""
references = [
    "https://atlas.mitre.org/techniques/AML.T0085",
    "https://atlas.mitre.org/techniques/AML.T0085.001",
    "https://atlas.mitre.org/techniques/AML.T0055",
    "https://glama.ai/blog/2025-11-11-the-lethal-trifecta-securing-model-context-protocol-against-data-flow-attacks",
    "https://www.elastic.co/security-labs/elastic-advances-llm-security",
    "https://specterops.io/blog/2025/11/21/an-evening-with-claude-code",
]
risk_score = 73
rule_id = "c0136397-f82a-45e5-9b9f-a3651d77e21a"
severity = "high"
tags = [
    "Domain: Endpoint",
    "OS: Linux",
    "OS: macOS",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Collection",
    "Tactic: Credential Access",
    "Data Source: Elastic Defend",
    "Resources: Investigation Guide",
    "Domain: LLM",
    "Mitre Atlas: T0085",
    "Mitre Atlas: T0085.001",
    "Mitre Atlas: T0055",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
file where event.action in ("open", "creation", "modification") and event.outcome == "success" and

  // GenAI process 
    (
      process.name in~ (
        "ollama.exe", "ollama",
        "textgen.exe", "textgen", "text-generation-webui.exe", "oobabooga.exe",
        "lmstudio.exe", "lmstudio", "LM Studio",
        "claude.exe", "claude",
        "cursor.exe", "cursor",
        "copilot.exe", "copilot",
        "codex.exe", "codex",
        "jan.exe", "jan",
        "gpt4all.exe", "gpt4all",
        "gemini-cli.exe", "gemini-cli", "gemini.exe",
        "genaiscript.exe", "genaiscript",
        "grok.exe", "grok",
        "qwen.exe", "qwen",
        "koboldcpp.exe", "koboldcpp",
        "llama-server", "llama-cli",
        "windsurf.exe", "windsurf",
        "zed.exe", "zed",
        "opencode.exe", "opencode",
        "goose.exe", "goose"
      )
    ) and

  // Sensitive file paths
  (
    // Persistence via Shell configs
    file.name in (".bashrc", ".bash_profile", ".zshrc", ".zshenv", ".zprofile", ".profile", ".bash_logout") or

    // Credentials In Files 
    file.name like~ 
                 ("key?.db", 
                  "logins.json", 
                  "Login Data", 
                  "Local State",
                  "signons.sqlite",
                  "Cookies", 
                  "cookies.sqlite",
                  "Cookies.binarycookies", 
                  "login.keychain-db", 
                  "System.keychain", 
                  "credentials.db", 
                  "credentials", 
                  "access_tokens.db", 
                  "accessTokens.json", 
                  "azureProfile.json",
                  "RDCMan.settings", 
                  "known_hosts", 
                  "KeePass.config.xml", 
                  "Unattended.xml")
  ) and not (
    host.os.type == "windows" and
    file.name like~ "Local State" and
    file.path : (
      "?:\\Users\\*\\AppData\\Roaming\\*\\Local State",
      "?:\\Users\\*\\AppData\\Local\\Packages\\*\\LocalCache\\Roaming\\*\\Local State"
    )
  )
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"
[[rule.threat.technique.subtechnique]]
id = "T1552.001"
name = "Credentials In Files"
reference = "https://attack.mitre.org/techniques/T1552/001/"


[[rule.threat.technique]]
id = "T1555"
name = "Credentials from Password Stores"
reference = "https://attack.mitre.org/techniques/T1555/"


[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1005"
name = "Data from Local System"
reference = "https://attack.mitre.org/techniques/T1005/"


[rule.threat.tactic]
id = "TA0009"
name = "Collection"
reference = "https://attack.mitre.org/tactics/TA0009/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1037"
name = "Boot or Logon Initialization Scripts"
reference = "https://attack.mitre.org/techniques/T1037/"
[[rule.threat.technique.subtechnique]]
id = "T1037.004"
name = "RC Scripts"
reference = "https://attack.mitre.org/techniques/T1037/004/"



[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[metadata]
creation_date = "2025/06/17"
integration = ["kubernetes"]
maturity = "production"
updated_date = "2026/04/10"

[rule]
author = ["Elastic"]
description = """
This rule detects when a forbidden request is made from an unusual user agent in a Kubernetes environment.
Adversary tooling may use non-standard or unexpected user agents to interact with the Kubernetes API, which
can indicate an attempt to evade detection or blend in with legitimate traffic. In combination with a forbidden
request, this behavior can suggest an adversary is attempting to exploit vulnerabilities or misconfigurations
in the Kubernetes cluster.
"""
index = ["logs-kubernetes.audit_logs-*"]
language = "kuery"
license = "Elastic License v2"
name = "Kubernetes Forbidden Request from Unusual User Agent"
note = """ ## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Kubernetes Forbidden Request from Unusual User Agent

Kubernetes, a container orchestration platform, manages applications across clusters. It uses APIs for communication, which can be targeted by adversaries using atypical user agents to mask malicious activities. These agents may attempt unauthorized actions, exploiting vulnerabilities. The detection rule identifies such anomalies by flagging forbidden requests from non-standard user agents, indicating potential threats.

### Possible investigation steps

- Review the Kubernetes audit logs to identify the source IP address and user associated with the forbidden request. This can help determine if the request originated from a known or unknown entity.
- Analyze the user agent string in the audit logs to understand its origin and purpose. Cross-reference it with known legitimate user agents to assess its legitimacy.
- Check for any recent changes or deployments in the Kubernetes environment that might have introduced new user agents or configurations, potentially leading to the forbidden request.
- Investigate the specific resource or API endpoint that was targeted by the forbidden request to understand what the adversary might have been attempting to access or exploit.
- Correlate the event with other security logs and alerts to identify any patterns or additional suspicious activities that might indicate a broader attack or reconnaissance effort.
- Assess the current security posture and configurations of the Kubernetes cluster to identify any vulnerabilities or misconfigurations that could be exploited by adversaries using unusual user agents.

### False positive analysis

- Legitimate internal tools or scripts may use non-standard user agents that are not included in the exclusion list. Review and identify these tools, then update the exclusion list to prevent them from being flagged.
- Automated processes or third-party integrations might use unique user agents that trigger the rule. Verify these processes and consider adding their user agents to the exclusion list if they are deemed safe.
- Development or testing environments often use custom user agents for API interactions. Ensure these environments are accounted for by excluding their user agents to avoid unnecessary alerts.
- Regularly review and update the exclusion list to reflect changes in legitimate user agents used within your organization, ensuring that only truly unusual and potentially malicious agents are flagged.

### Response and remediation

- Immediately isolate the affected Kubernetes node or cluster to prevent further unauthorized access or potential lateral movement by the adversary.
- Revoke any suspicious or unauthorized credentials or tokens that may have been used in the forbidden request to ensure they cannot be reused.
- Conduct a thorough review of the Kubernetes audit logs to identify any additional unauthorized or suspicious activities that may have occurred around the time of the alert.
- Patch any identified vulnerabilities or misconfigurations in the Kubernetes environment that may have been exploited, ensuring all components are up to date with the latest security patches.
- Implement stricter access controls and user agent validation to prevent non-standard user agents from interacting with the Kubernetes API unless explicitly allowed.
- Escalate the incident to the security operations team for further investigation and to determine if additional containment or remediation actions are necessary.
- Enhance monitoring and alerting for similar activities by tuning detection systems to recognize patterns associated with this type of threat, ensuring rapid response to future incidents.
"""
risk_score = 47
rule_id = "4b77d382-b78e-4aae-85a0-8841b80e4fc4"
severity = "medium"
tags = [
  "Data Source: Kubernetes",
  "Domain: Kubernetes",
  "Use Case: Threat Detection",
  "Tactic: Execution",
  "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "new_terms"
query = '''
data_stream.dataset:"kubernetes.audit_logs" and
kubernetes.audit.stage:"ResponseComplete" and
kubernetes.audit.annotations.authorization_k8s_io/decision:"forbid" and
user_agent.original:(* and not (*kubernetes/$Format))
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1613"
name = "Container and Resource Discovery"
reference = "https://attack.mitre.org/techniques/T1613/"

[rule.threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"
[rule.new_terms]
field = "new_terms_fields"
value = ["user_agent.original"]

[[rule.new_terms.history_window_start]]
field = "history_window_start"
value = "now-7d"

[metadata]
creation_date = "2026/07/30"
integration = ["endpoint"]
maturity = "production"
updated_date = "2026/07/30"

[rule]
author = ["Elastic"]
description = """
Identifies an unusual process deleting the Zone.Identifier alternate data stream from an executable or Windows Installer
package. Attackers can remove this stream to bypass Mark-of-the-Web protections.
"""
false_positives = [
    "Browsers, download utilities, and security tools may remove Mark-of-the-Web during legitimate file handling.",
    "Administrative scripts and software deployment tools may intentionally unblock trusted executables or installers.",
]
from = "now-9m"
index = ["logs-endpoint.events.file-*"]
language = "eql"
license = "Elastic License v2"
name = "Mark-of-the-Web Removal by an Unusual Process"
references = [
    "https://www.forcepoint.com/blog/x-labs/screenconnect-attack",
    "https://www.sonicwall.com/blog/living-off-legit-tools-stealthy-installation-of-remote-monitoring-agents-using-smartscreen-bypass",
    "https://any.run/cybersecurity-blog/rmm-blind-spot-for-cisos/",
    "https://www.cyfirma.com/research/apt36-multi-vector-execution-malware-campaign-targeting-indian-government-entities/"
]
risk_score = 21
rule_id = "757371cd-5e9e-4adb-bc4e-d81f0ad0ec4d"
setup = """## Setup

This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.

Setup instructions: https://ela.st/install-elastic-defend
"""
severity = "low"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Defense Evasion",
    "Resources: Investigation Guide",
    "Data Source: Elastic Defend",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
file where host.os.type == "windows" and event.type == "deletion" and
  file.path : (
    "*.exe:Zone.Identifier",
    "*.exe:Zone.Identifier:$DATA",
    "*.msi:Zone.Identifier",
    "*.msi:Zone.Identifier:$DATA"
  ) and

  /* Explorer may remove MOTW after SmartScreen */
  not (
    process.executable : "?:\\Windows\\explorer.exe" and
    process.code_signature.trusted == true and
    process.code_signature.subject_name : "Microsoft Windows"
  )
'''

note = """## Triage and analysis

### Investigating Mark-of-the-Web Removal by an Unusual Process

#### Possible investigation steps

- Which process and account removed Mark-of-the-Web from which artifact?
  - Focus: Review `file.path`, `process.executable`, `process.name`, `user.name`, and `host.name`.
  - Implication: The alert establishes an attributed ADS deletion, not execution or intent. Treat a download, security, or deployment workflow as a benign candidate only when the exact remover, account, artifact, and an independent workflow record align.

- Does the deleting-process context fit an expected unblocking workflow?
  - Focus: From related process events, review `process.command_line`, `process.parent.executable`, `process.code_signature.subject_name`, and `process.code_signature.trusted`.
  - Hint: When `process.entity_id` is populated, review events for the same process entity on the alert host $investigate_0
  - Implication: PowerShell unblocking or deployment activity needs an expected parent, operator or task, command, and target artifact; a trusted signer alone is insufficient. If `process.entity_id` is absent, use `host.id`, `process.pid`, and a tight alert-time window; missing related process telemetry remains unresolved.

- What provenance does the base executable or MSI have?
  - Focus: Strip the terminal `:Zone.Identifier` or `:Zone.Identifier:$DATA` suffix, then search same-host file events for the base path and inspect `file.Ext.original.path`, `file.origin_url`, `file.origin_referrer_url`, `file.Ext.windows.zone_identifier`, and `file.hash.sha256` when populated.
  - Hint: Start with the 24 hours before the deletion and widen to available retention when necessary.
  - Implication: Missing download or file-origin telemetry is unresolved. Consistent source, hash, target directory, and a matching download or deployment record support the claimed workflow.

- Was the base artifact executed or used in an installation attempt after deletion?
  - Focus: For an EXE, match the base path to `process.executable`; for an MSI, find `msiexec.exe` with the exact base path in `process.args`.
  - Hint: Search the same host for five minutes after the deletion, then widen when evidence warrants; review lineage and follow-on file or process activity.
  - Implication: A match establishes observed execution or an installation attempt, not maliciousness or installation success. Inconsistent provenance, lineage, or follow-on behavior supports escalation; no match only limits observed impact.

- Is the removal isolated or repeated on the host?
  - Focus: Review deletions for the same ADS path $investigate_1
  - Hint: When `user.id` is populated, review file deletions by the same user and process name, then retain only EXE or MSI `Zone.Identifier` paths $investigate_2
  - Implication: If `user.id` is absent, use the exact-path results and a manual same-host search around the alert time. The broader transform returns all file deletions, not only MOTW removal; multiple unrelated matching artifacts support escalation, while a stable release set with the same expected workflow can support benign disposition.

- Escalate when remover context, provenance, follow-on behavior, or repeated unrelated targets conflict with an expected workflow. Close only when alert telemetry and an independent download, deployment, or security-tool record align for the exact actor and artifact. Preserve evidence and escalate mixed or incomplete cases.

### False positive analysis

- Browser, download-handler, security-product, administrative, and deployment workflows can remove Mark-of-the-Web legitimately. Confirm that the process identity and lineage, account and host, exact artifact, provenance, and an independent product or deployment record describe the same workflow before closing the alert.
- Add an exception only after recurring benign examples establish stable fields. Constrain it to alert fields such as the exact remover executable and signer, target path or package family, and expected account or host class; do not exclude PowerShell or all trusted processes globally.

### Response and remediation

- For unresolved activity, preserve the alert and source events, then recover the deleting-process and artifact context. Do not isolate a host solely on this low-severity signal.
- If malicious activity or suspicious follow-on behavior is confirmed, contain affected hosts or accounts with reversible controls. Preserve volatile evidence when active or memory-resident behavior warrants it, then terminate malicious processes and quarantine artifacts or persistence after evidence review.
- For confirmed benign activity, close the alert and consider a narrow exception only after recurring examples establish stable fields. Document affected paths, scope, observed workflow evidence, and telemetry gaps.
"""

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "event.type",
    "file.extension",
    "file.name",
    "file.path",
    "host.id",
    "host.name",
    "process.code_signature.subject_name",
    "process.code_signature.trusted",
    "process.entity_id",
    "process.executable",
    "process.name",
    "process.pid",
    "user.domain",
    "user.id",
    "user.name",
]


[[transform.investigate]]
label = "Events for the deleting process on this host"
description = ""
providers = [
  [
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" }
  ]
]
relativeFrom = "now-24h"
relativeTo = "now"

[[transform.investigate]]
label = "File deletions for the same ADS path"
description = ""
providers = [
  [
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "event.category", queryType = "phrase", value = "file", valueType = "string" },
    { excluded = false, field = "file.path", queryType = "phrase", value = "{{file.path}}", valueType = "string" },
    { excluded = false, field = "event.type", queryType = "phrase", value = "deletion", valueType = "string" }
  ]
]
relativeFrom = "now-24h"
relativeTo = "now"

[[transform.investigate]]
label = "File deletions by the same user and process name"
description = ""
providers = [
  [
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "event.category", queryType = "phrase", value = "file", valueType = "string" },
    { excluded = false, field = "user.id", queryType = "phrase", value = "{{user.id}}", valueType = "string" },
    { excluded = false, field = "process.name", queryType = "phrase", value = "{{process.name}}", valueType = "string" },
    { excluded = false, field = "event.type", queryType = "phrase", value = "deletion", valueType = "string" }
  ]
]
relativeFrom = "now-24h"
relativeTo = "now"

[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1553"
name = "Subvert Trust Controls"
reference = "https://attack.mitre.org/techniques/T1553/"
[[rule.threat.technique.subtechnique]]
id = "T1553.005"
name = "Mark-of-the-Web Bypass"
reference = "https://attack.mitre.org/techniques/T1553/005/"



[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[metadata]
creation_date = "2023/08/29"
integration = ["endpoint", "m365_defender", "sentinel_one_cloud_funnel", "windows", "crowdstrike"]
maturity = "production"
updated_date = "2026/05/04"

[rule]
author = ["Elastic"]
description = """
Identifies the addition of a Netsh Helper DLL, netsh.exe supports the addition of these DLLs to extend its
functionality. Attackers may abuse this mechanism to execute malicious payloads every time the utility is executed,
which can be done by administrators or a scheduled task.
"""
from = "now-9m"
index = [
    "logs-endpoint.events.registry-*",
    "endgame-*",
    "logs-m365_defender.event-*",
    "logs-sentinel_one_cloud_funnel.*",
    "logs-windows.sysmon_operational-*",
    "logs-crowdstrike.fdr*",
]
language = "eql"
license = "Elastic License v2"
name = "Netsh Helper DLL"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Netsh Helper DLL

Netsh, a command-line utility in Windows, allows for network configuration and diagnostics. It supports extensibility through Helper DLLs, which can be added to enhance its capabilities. However, attackers can exploit this by adding malicious DLLs, ensuring their code runs whenever netsh is executed. The detection rule monitors registry changes related to netsh DLLs, flagging unauthorized modifications that may indicate persistence tactics.

### Possible investigation steps

- Review the registry path specified in the alert to confirm the presence of any unauthorized or suspicious DLLs under "HKLM\\Software\\Microsoft\\netsh\\".
- Check the timestamp of the registry change event to determine when the modification occurred and correlate it with any other suspicious activities or events on the system.
- Investigate the origin of the DLL file by examining its properties, such as the file path, creation date, and digital signature, to assess its legitimacy.
- Analyze recent user activity and scheduled tasks to identify any potential execution of netsh.exe that could have triggered the malicious DLL.
- Cross-reference the alert with other security logs and alerts from data sources like Microsoft Defender XDR or Sysmon to gather additional context and identify any related threats or indicators of compromise.

### False positive analysis

- Legitimate software installations or updates may add or modify Netsh Helper DLLs, triggering the detection rule. Users should verify if recent installations or updates coincide with the registry changes.
- Network management tools or scripts used by IT departments might legitimately extend netsh functionality. Identify and document these tools to create exceptions in the detection rule.
- Scheduled tasks or administrative scripts that configure network settings could cause expected changes. Review scheduled tasks and scripts to ensure they are authorized and adjust the rule to exclude these known activities.
- Security software or network monitoring solutions may interact with netsh for legitimate purposes. Confirm with the software vendor if their product modifies netsh settings and consider excluding these changes from the rule.

### Response and remediation

- Immediately isolate the affected system from the network to prevent further execution of the malicious DLL and potential lateral movement.
- Terminate any suspicious processes associated with netsh.exe to halt the execution of the malicious payload.
- Remove the unauthorized Netsh Helper DLL entry from the registry path identified in the alert to eliminate the persistence mechanism.
- Conduct a thorough scan of the affected system using an updated antivirus or endpoint detection and response (EDR) tool to identify and remove any additional malicious files or artifacts.
- Review and restore any altered system configurations to their original state to ensure system integrity.
- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if additional systems are affected.
- Implement enhanced monitoring and logging for registry changes related to Netsh Helper DLLs to detect similar threats in the future."""
risk_score = 21
rule_id = "b0638186-4f12-48ac-83d2-47e686d08e82"
severity = "low"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Persistence",
    "Data Source: Elastic Endgame",
    "Data Source: Elastic Defend",
    "Data Source: Microsoft Defender XDR",
    "Data Source: SentinelOne",
    "Data Source: Sysmon",
    "Data Source: Crowdstrike",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
registry where host.os.type == "windows" and event.type == "change" and
  registry.path : (
    "HKLM\\Software\\Microsoft\\netsh\\*",
    "\\REGISTRY\\MACHINE\\Software\\Microsoft\\netsh\\*",
    "MACHINE\\Software\\Microsoft\\netsh\\*"
  )
'''

setup = """## Setup

This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.

Setup instructions: https://ela.st/install-elastic-defend

### Additional data sources

This rule also supports the following third-party data sources. For setup instructions, refer to the links below:

- [CrowdStrike](https://ela.st/crowdstrike-integration)
- [Microsoft Defender XDR](https://ela.st/m365-defender)
- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
- [Sysmon Registry Events](https://ela.st/sysmon-event-reg-setup)
"""


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1546"
name = "Event Triggered Execution"
reference = "https://attack.mitre.org/techniques/T1546/"
[[rule.threat.technique.subtechnique]]
id = "T1546.007"
name = "Netsh Helper DLL"
reference = "https://attack.mitre.org/techniques/T1546/007/"



[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1112"
name = "Modify Registry"
reference = "https://attack.mitre.org/techniques/T1112/"


[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"