Elastic rules: 1k

[metadata]
creation_date = "2026/06/18"
integration = ["aws"]
maturity = "production"
updated_date = "2026/06/18"

[rule]
author = ["Elastic"]
description = """
Identifies a single principal directly invoking AWS Lambda functions at a high volume within a one-hour window.
Adversaries may drive excessive invocations to abuse functions for resource hijacking or cryptomining, to inflate costs
in a denial-of-wallet attack, or to enumerate function behavior. This is a volumetric heuristic: the threshold is
environment-dependent and high-throughput applications can exceed it, so tune it to the deployment. This rule relies on
AWS Lambda data event logging, which is not enabled by default.
"""
false_positives = [
    """
    Legitimate high-throughput applications, batch jobs, load tests, and automation can invoke functions at high volume
    and will exceed any fixed threshold. Validate the principal in `aws.cloudtrail.user_identity.arn` and the workload
    context, and tune the threshold to the environment.
    """,
]
from = "now-61m"
interval = "60m"
language = "esql"
license = "Elastic License v2"
name = "AWS Lambda Function High-Frequency Invocation by a Single Principal"
note = """## Triage and analysis

### Investigating AWS Lambda Function High-Frequency Invocation by a Single Principal

A principal issuing a high volume of direct Lambda invocations in a short window can indicate function abuse for resource hijacking or cryptomining, a denial-of-wallet cost attack, or behavioral enumeration. Because Lambda data events record only the invocation metadata (caller, function, source) and not the function's internal behavior, this rule is purely volumetric and should be treated as corroborating signal.

### Possible investigation steps

- Identify the principal in `aws.cloudtrail.user_identity.arn` and determine whether the volume exceeds its historical baseline.
- Determine whether the principal is a known high-throughput application or automation identity, or an unexpected user.
- Review `source.ip` / `user_agent.original` and recent credential activity for signs of compromise.
- Correlate with billing/concurrency metrics and with other Lambda or IAM activity by the same principal.

### False positive analysis

- High-throughput apps, batch processing, and load tests routinely exceed fixed thresholds. Tune the threshold and exclude known high-volume identities after validation.

### Response and remediation

- If abuse is confirmed, throttle or disable the affected functions (reserved concurrency), rotate or restrict the principal's credentials, and review function code and execution-role permissions.
- Apply per-function reserved concurrency and account-level guardrails to bound cost and blast radius.

### Additional information

- [Logging Lambda data events with CloudTrail](https://docs.aws.amazon.com/lambda/latest/dg/logging-using-cloudtrail.html)
- [Lambda function scaling and concurrency](https://docs.aws.amazon.com/lambda/latest/dg/lambda-concurrency.html)
"""
references = [
    "https://docs.aws.amazon.com/lambda/latest/dg/logging-using-cloudtrail.html",
    "https://docs.aws.amazon.com/lambda/latest/dg/lambda-concurrency.html",
]
risk_score = 47
rule_id = "55260656-76d6-427b-bd02-7acdde131b64"
setup = """## Setup

This rule requires AWS Lambda data events to be logged in CloudTrail and ingested via the AWS integration. Lambda
invocation (`Invoke`) is a data-plane event and is NOT logged by default; enable data event logging for Lambda functions
in the trail (optionally scoped to sensitive functions to manage volume). Tune the invocation-count threshold in the
query to the environment before enabling.
"""
severity = "medium"
tags = [
    "Domain: Cloud",
    "Data Source: AWS",
    "Data Source: Amazon Web Services",
    "Data Source: AWS CloudTrail",
    "Data Source: AWS Lambda",
    "Use Case: Threat Detection",
    "Tactic: Impact",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "esql"

query = '''
from logs-aws.cloudtrail-*

// Lambda invocation data events (data-plane; requires data event logging enabled)
| where
    event.provider == "lambda.amazonaws.com"
    and event.action like "Invoke*"
    and event.outcome == "success"
    and aws.cloudtrail.user_identity.arn IS NOT NULL

| stats
    Esql.invocation_count = count(*),
    Esql.source_ips = values(source.ip)
  by
    aws.cloudtrail.user_identity.arn

// Threshold is environment-dependent — tune to the deployment
| where Esql.invocation_count >= 1000

| keep
    aws.cloudtrail.user_identity.arn,
    Esql.invocation_count,
    Esql.source_ips

| sort Esql.invocation_count desc
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1496"
name = "Resource Hijacking"
reference = "https://attack.mitre.org/techniques/T1496/"


[rule.threat.tactic]
id = "TA0040"
name = "Impact"
reference = "https://attack.mitre.org/tactics/TA0040/"

[rule.investigation_fields]
field_names = ["aws.cloudtrail.user_identity.arn", "cloud.account.id", "Esql.invocation_count", "Esql.source_ips"]

[metadata]
creation_date = "2020/07/06"
integration = ["network_traffic", "panw", "fortinet_fortigate"]
maturity = "production"
updated_date = "2026/08/26"

[rule]
author = ["Elastic"]
description = """
Cobalt Strike is a threat emulation platform commonly modified and used by adversaries to conduct network attack and
exploitation campaigns. This rule detects a network activity algorithm leveraged by Cobalt Strike implant beacons for
command and control.
"""
false_positives = [
    """
    This rule should be tailored to either exclude systems, as sources or destinations, in which this behavior is
    expected.
    """,
]
from = "now-9m"
language = "esql"
license = "Elastic License v2"
name = "Cobalt Strike Command and Control Beacon"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Cobalt Strike Command and Control Beacon

Cobalt Strike is a penetration testing tool often repurposed by attackers for malicious activities, particularly for establishing command and control (C2) channels. Adversaries exploit its beaconing feature to communicate with compromised systems using common protocols like HTTP or TLS. The detection rule identifies suspicious network patterns, such as specific domain naming conventions, indicative of Cobalt Strike's C2 activity, helping analysts pinpoint potential threats.

### Possible investigation steps

- Review the alert details to identify the specific domain that triggered the rule, focusing on the pattern [a-z]{3}.stage.[0-9]{8}\\..* to determine if it matches known malicious domains.
- Analyze the network traffic logs associated with the alert, specifically looking at events categorized under network or network_traffic with types tls or http, to gather more context about the communication.
- Investigate the source IP address and destination domain involved in the alert to determine if they have been associated with previous malicious activities or are listed in threat intelligence databases.
- Examine the timeline of the network activity to identify any patterns or anomalies that could indicate a larger campaign or coordinated attack.
- Check for any related alerts or incidents in the security information and event management (SIEM) system that might provide additional context or indicate a broader compromise.
- Assess the affected endpoint for any signs of compromise, such as unusual processes or connections, to determine if further containment or remediation actions are necessary.

### False positive analysis

- Legitimate software updates or patch management systems may use similar domain naming conventions. Review and whitelist known update servers to prevent false alerts.
- Internal development or testing environments might mimic Cobalt Strike's domain patterns for legitimate purposes. Identify and exclude these environments from the rule.
- Automated scripts or tools that generate network traffic with similar domain structures can trigger false positives. Monitor and document these tools, then create exceptions for their activity.
- Some content delivery networks (CDNs) might use domain patterns that match the rule's criteria. Verify and exclude trusted CDNs to reduce unnecessary alerts.
- Regularly review and update the list of exceptions to ensure that only verified non-threatening behaviors are excluded, maintaining the rule's effectiveness.

### Response and remediation

- Isolate the affected systems immediately to prevent further communication with the Cobalt Strike C2 server. This can be done by disconnecting the network or using network segmentation techniques.
- Conduct a thorough forensic analysis of the compromised systems to identify the extent of the breach and any additional payloads or backdoors that may have been installed.
- Remove any identified Cobalt Strike beacons or related malware from the affected systems using updated antivirus or endpoint detection and response (EDR) tools.
- Change all credentials and access tokens that may have been exposed or used on the compromised systems to prevent unauthorized access.
- Monitor network traffic for any signs of re-infection or communication attempts with known Cobalt Strike C2 domains, using updated threat intelligence feeds.
- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if additional systems or data have been compromised.
- Implement network-level controls, such as blocking known malicious domains and IP addresses associated with Cobalt Strike, to prevent future attacks.

## Threat intel

This activity has been observed in FIN7 campaigns."""
references = [
    "https://blog.morphisec.com/fin7-attacks-restaurant-industry",
    "https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html",
    "https://www.elastic.co/security-labs/collecting-cobalt-strike-beacons-with-the-elastic-stack",
]
risk_score = 73
rule_id = "cf53f532-9cc9-445a-9ae7-fced307ec53c"
severity = "high"
tags = [
    "Use Case: Threat Detection",
    "Tactic: Command and Control",
    "Domain: Endpoint",
    "Rule Type: ESQL",
    "Data Source: Fortinet",
    "Data Source: PAN-OS",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "esql"

query = '''
from packetbeat-*, filebeat-*, logs-network_traffic.*, logs-panw.panos*, logs-fortinet_fortigate.log-* metadata _id, _version, _index
| where (
    (event.category in ("network", "network_traffic") and network.protocol in ("tls", "http")) or
    (data_stream.dataset == "panw.panos" and network.application in ("ssl", "web-browsing")) or
    data_stream.dataset in ("network_traffic.tls", "network_traffic.http", "fortinet_fortigate.log")
  )
| where destination.domain RLIKE "[a-z]{3}\\.stage\\.[0-9]{8}\\..*"
| keep @timestamp, destination.domain, source.ip, destination.ip, network.protocol, data_stream.dataset, _id, _version, _index
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"
[[rule.threat.technique.subtechnique]]
id = "T1071.001"
name = "Web Protocols"
reference = "https://attack.mitre.org/techniques/T1071/001/"


[[rule.threat.technique]]
id = "T1568"
name = "Dynamic Resolution"
reference = "https://attack.mitre.org/techniques/T1568/"
[[rule.threat.technique.subtechnique]]
id = "T1568.002"
name = "Domain Generation Algorithms"
reference = "https://attack.mitre.org/techniques/T1568/002/"



[rule.threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[rule]
description = """
Detects when a code editor (VSCode, Cursor, or IntelliJ IDEA) spawns a shell to execute a self-signed and untrusted
binary. This activity is indicative of a malicious 3rd party plugin or extension.
"""
id = "9b9776bb-6bf3-4c06-94ff-64159b52a2f3"
license = "Elastic License v2"
name = "Code Editor Untrusted or Unsigned Child Process Execution"
os_list = ["macos"]
version = "1.0.19"

query = '''
process where event.type == "start" and event.action == "exec" and
 process.Ext.effective_parent.executable in ("/Applications/IntelliJ IDEA.app/Contents/MacOS/idea",
                                             "/Applications/Visual Studio Code.app/Contents/MacOS/Electron",
                                             "/Applications/Cursor.app/Contents/MacOS/Cursor") and 
 process.parent.name in ("bash", "sh", "zsh") and
 (process.code_signature.trusted == false or process.code_signature.exists == false) and 
 process.code_signature.signing_id regex~ """[A-Za-z0-9\_\s]{2,}\-[a-z0-9]{40}""" and 
 process.args_count <= 4 and
 not process.executable like~
                          ("/opt/homebrew/*",
                           "/Users/*/.homebrew/Cellar/*",
                           "/nix/store/*",
                           "/usr/local/microsoft/powershell/7/pwsh", 
                           "/usr/local/Cellar/*",
                           "/opt/nordic/ncs/toolchains/*/Cellar/*",
                           "/Users/*/homebrew/Cellar/*") and 
 not process.command_line like~ ("bento completion zsh --silent", "*http://localhost*") and
 not process.code_signature.signing_id like~ ("python3-*", 
                                              "ruby-*", 
                                              "python-*", 
                                              "node-*", 
                                              "rg-*")
'''

min_endpoint_version = "8.7.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "8.7.0"

[rule]
description = """
Identifies the execution of known Windows utilities often abused to dump LSASS memory or the Active Directory database
(NTDS.dit) in preparation for credential access.
"""
id = "3c44fc50-2672-48b3-af77-ff43b895ac70"
license = "Elastic License v2"
name = "Credential Access via Known Utilities"
os_list = ["windows"]
reference = [
    "https://lolbas-project.github.io/",
    "https://www.elastic.co/security-labs/bits-and-bytes-analyzing-bitsloth",
]
version = "1.0.47"

query = '''
process where event.action == "start" and
 process.parent.name != null and 
 (
  (process.pe.original_file_name == "procdump" and process.args : "-ma" and process.command_line : "*lsass*") or
  (process.name : "ProcessDump.exe" and not process.parent.executable : "?:\\Program Files*\\Cisco Systems\\*.exe") or
  (process.pe.original_file_name == "WriteMiniDump.exe" and not process.parent.executable : "?:\\Program Files*\\Steam\\*.exe") or
  /* Issue #623 - added coverage for evasion via renamed comsvcs DLL */
  (process.pe.original_file_name == "RUNDLL32.EXE" and process.command_line : ("*comsvcs*24*", "*MiniDump*", "*#*24* full*")) or
  (process.pe.original_file_name == "RdrLeakDiag.exe" and process.args : "/fullmemdmp") or
  (process.pe.original_file_name == "SqlDumper.exe" and process.args : "0x01100*") or
  (process.pe.original_file_name == "TTTracer.exe" and process.args : "-dumpFull" and process.args : "-attach") or
  (process.pe.original_file_name == "ntdsutil.exe" and process.command_line : "*create*") or
  (process.pe.original_file_name == "diskshadow.exe" and process.args : "/s") or
  ((process.pe.original_file_name : "wbadmin.exe" or process.name : "wbadmin.exe") and
    process.args : "recovery" and process.command_line : "*ntds.dit*") or
  (process.pe.original_file_name == "esentutl.exe" and process.args : "/vss" and process.command_line : ("*ntds.dit*", "*\\SAM*", "*//SAM*")) or
  (process.pe.original_file_name == "esentutl.exe" and process.args : "/y" and process.command_line : ("*\\Cookies*", "*\\Login Data*")) or
  (process.pe.original_file_name == "reg.exe" and process.args : ("save", "export") and
   process.command_line : ("*HKLM*\\SAM *", "*hkey_local_machine*\\SAM *", "*HKLM\\security*",
                          "*hkey_local_machine\\security*", "*HKLM\\system *", "*hkey_local_machine\\system *")) or
  /* generic original filename and variable number of hashes */
  (process.name : "createdump.exe" and process.args : "-u") or 
  (process.pe.original_file_name == "FX_VER_INTERNALNAME_STR" and process.args : "-u" and process.args : "-f" and process.args_count >= 3) or
  /* Avast Home Security signed binary */
  (process.pe.original_file_name == "avDump.exe" and process.args : "–dump_file") or
  (process.pe.original_file_name == "DumpMinitool.exe" and process.args : "--dumpType")
  ) and not

  /* Issue #528 */
  (process.pe.original_file_name == "reg.exe" and
   process.parent.executable : ("?:\\Program Files\\Rapid7\\Insight Agent\\components\\insight_agent\\*\\ir_agent.exe",
                                "?:\\Program Files (x86)\\Rapid7\\Insight Agent\\components\\insight_agent\\*\\ir_agent.exe")) and not
  (process.pe.original_file_name == "diskshadow.exe" and process.parent.name : "powershell.exe" and process.parent.args : "?:\\OmniStackBackups\\backup*") and
  not (process.name : "rundll32.exe" and
       process.command_line : "*davclnt.dll,DavSetCookie*http*MiniDump*" and
       process.parent.executable : "?:\\WINDOWS\\system32\\svchost.exe" and process.parent.args : "WebClient") and
  not (process.pe.original_file_name == "reg.exe" and process.args : "?:\\ProgramData\\Bitdefender\\ForensicArtefacts\\System\\Config\\*" and
       process.parent.name : "cmd.exe") and
  not (process.executable : "C:\\Program Files (x86)\\Dental Intel\\PMSSyncService\\procdump.exe" and process.args : "office.exe") and 
  not (process.name : "diskshadow.exe" and process.parent.executable : "?:\\Windows\\Temp\\RackWare-winutil\\bin\\bash.exe" and 
       process.args : "?:\\windows\\Temp\\RackWare-winutil\\*") and
  not (process.name : "reg.exe" and process.parent.executable : "C:\\Program Files\\SF\\EDR\\agent\\bin\\sfavtray.exe") and
  not (process.name : "diskshadow.exe" and process.command_line : "*\\Program Files\\ARCServe\\*") and
  not (process.name : "reg.exe" and process.args : "save" and
       process.args : "?:\\Program Files\\Rapid7\\Insight Agent\\components\\insight_agent\\common\\ir_agent_tmp\\*" and
       process.working_directory : "?:\\Program Files\\Rapid7\\Insight Agent\\components\\insight_agent\\common\\") and
  not (process.name : "diskshadow.exe" and process.parent.executable : "C:\\Program Files\\Barracuda\\Barracuda Backup Agent\\win\\x86_64\\BackupService.exe")
'''

min_endpoint_version = "7.15.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1003"
name = "OS Credential Dumping"
reference = "https://attack.mitre.org/techniques/T1003/"
[[threat.technique.subtechnique]]
id = "T1003.001"
name = "LSASS Memory"
reference = "https://attack.mitre.org/techniques/T1003/001/"

[[threat.technique.subtechnique]]
id = "T1003.003"
name = "NTDS"
reference = "https://attack.mitre.org/techniques/T1003/003/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "7.15.0"

[metadata]
creation_date = "2020/02/18"
maturity = "production"
promotion = true
updated_date = "2025/03/21"

[rule]
author = ["Elastic"]
description = """
Elastic Endgame detected Credential Dumping. Click the Elastic Endgame icon in the event.module column or the link in
the rule.reference column for additional information.
"""
from = "now-2m"
index = ["endgame-*"]
interval = "1m"
language = "kuery"
license = "Elastic License v2"
max_signals = 1000
name = "Credential Dumping - Detected - Elastic Endgame"
risk_score = 73
rule_id = "571afc56-5ed9-465d-a2a9-045f099f6e7e"
setup = """## Setup

### Additional notes

For information on troubleshooting the maximum alerts warning please refer to this [guide](https://www.elastic.co/guide/en/security/current/alerts-ui-monitor.html#troubleshoot-max-alerts).
"""
severity = "high"
tags = ["Data Source: Elastic Endgame", "Use Case: Threat Detection", "Tactic: Credential Access", "Resources: Investigation Guide"]
timestamp_override = "event.ingested"
type = "query"

query = '''
event.kind:alert and event.module:endgame and endgame.metadata.type:detection and (event.action:cred_theft_event or endgame.event_subtype_full:cred_theft_event)
'''
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Credential Dumping - Detected - Elastic Endgame

Elastic Endgame is a security solution that monitors and detects suspicious activities, such as credential dumping, which is a technique used by adversaries to extract sensitive authentication data. Attackers exploit this to gain unauthorized access to systems. The detection rule identifies such threats by analyzing alerts and specific event actions related to credential theft, ensuring timely threat detection and response.

### Possible investigation steps

- Review the alert details to confirm the presence of event.kind:alert and event.module:endgame, ensuring the alert is related to the Elastic Endgame detection.
- Examine the event.action and endgame.event_subtype_full fields for the value cred_theft_event to understand the specific credential theft activity detected.
- Check the associated host and user information to identify the potentially compromised system and user accounts.
- Investigate the timeline of events leading up to and following the alert to identify any suspicious activities or patterns that may indicate further compromise.
- Correlate the alert with other security events or logs to determine if this is part of a larger attack or isolated incident.
- Assess the risk score and severity to prioritize the response and determine if immediate action is required to contain the threat.
- Consult the MITRE ATT&CK framework for additional context on the T1003 technique to understand potential attacker methods and improve defensive measures.

### False positive analysis

- Routine administrative tasks that involve legitimate credential access tools may trigger alerts. Users can create exceptions for known administrative accounts or tools that are frequently used in these tasks.
- Security software updates or scans that access credential stores might be flagged. Exclude these processes by identifying their specific event actions and adding them to the exception list.
- Automated scripts for system maintenance that require credential access could be misidentified. Review and whitelist these scripts by their unique identifiers or execution paths.
- Legitimate software installations that require elevated privileges may cause alerts. Monitor and exclude these installation processes by verifying their source and purpose.
- Regularly scheduled backups that access credential data might be detected. Ensure these backup processes are recognized and excluded by specifying their event actions in the rule configuration.

### Response and remediation

- Isolate the affected system immediately to prevent further unauthorized access and lateral movement within the network.
- Terminate any suspicious processes identified as part of the credential dumping activity to halt ongoing malicious actions.
- Change all potentially compromised credentials, prioritizing those with elevated privileges, to mitigate unauthorized access risks.
- Conduct a thorough review of access logs and system events to identify any additional compromised accounts or systems.
- Restore affected systems from a known good backup to ensure the integrity of the system and data.
- Implement enhanced monitoring on the affected systems and accounts to detect any signs of recurring or related malicious activity.
- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if additional containment or remediation actions are necessary."""


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1003"
name = "OS Credential Dumping"
reference = "https://attack.mitre.org/techniques/T1003/"
[[rule.threat.technique.subtechnique]]
id = "T1003.001"
name = "LSASS Memory"
reference = "https://attack.mitre.org/techniques/T1003/001/"



[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[metadata]
creation_date = "2024/09/27"
integration = ["endpoint", "crowdstrike", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2026/03/24"

[rule]
author = ["Elastic"]
description = """
This detection rule addresses multiple vulnerabilities in the CUPS printing system, including CVE-2024-47176,
CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177. Specifically, this rule detects shell executions from the
foomatic-rip parent process. These flaws impact components like cups-browsed, libcupsfilters, libppd, and foomatic-rip,
allowing remote unauthenticated attackers to manipulate IPP URLs or inject malicious data through crafted UDP packets or
network spoofing. This can result in arbitrary command execution when a print job is initiated.
"""
from = "now-9m"
index = [
    "endgame-*",
    "logs-crowdstrike.fdr*",
    "logs-endpoint.events.process*",
    "logs-sentinel_one_cloud_funnel.*",
]
language = "eql"
license = "Elastic License v2"
name = "Cupsd or Foomatic-rip Shell Execution"
note = """## Triage and analysis

### Investigating Cupsd or Foomatic-rip Shell Execution

This rule identifies potential exploitation attempts of several vulnerabilities in the CUPS printing system (CVE-2024-47176, CVE-2024-47076, CVE-2024-47175, CVE-2024-47177). These vulnerabilities allow attackers to send crafted IPP requests or manipulate UDP packets to execute arbitrary commands or modify printer configurations. Attackers can exploit these flaws to inject malicious data, leading to Remote Code Execution (RCE) on affected systems.

#### Possible Investigation Steps

- Investigate the incoming IPP requests or UDP packets targeting port 631.
- Examine the printer configurations on the system to determine if any unauthorized printers or URLs have been added.
- Investigate the process tree to check if any unexpected processes were triggered as a result of IPP activity. Review the executable files for legitimacy.
- Check for additional alerts related to the compromised system or user within the last 48 hours.
- Investigate network traffic logs for suspicious outbound connections to unrecognized domains or IP addresses.
- Check if any of the contacted domains or addresses are newly registered or have a suspicious reputation.
- Retrieve any scripts or executables dropped by the attack for further analysis in a private sandbox environment:
- Analyze potential malicious activity, including:
  - Attempts to communicate with external servers.
  - File access or creation of unauthorized executables.
  - Cron jobs, services, or other persistence mechanisms.

### Related Rules
- Printer User (lp) Shell Execution - f86cd31c-5c7e-4481-99d7-6875a3e31309
- Network Connection by Cups or Foomatic-rip Child - e80ee207-9505-49ab-8ca8-bc57d80e2cab
- File Creation by Cups or Foomatic-rip Child - b9b14be7-b7f4-4367-9934-81f07d2f63c4
- Suspicious Execution from Foomatic-rip or Cupsd Parent - 986361cd-3dac-47fe-afa1-5c5dd89f2fb4

### False Positive Analysis

- This activity is rarely legitimate. However, verify the context to rule out non-malicious printer configuration changes or legitimate IPP requests.

### Response and Remediation

- Initiate the incident response process based on the triage outcome.
- Isolate the compromised host to prevent further exploitation.
- If the investigation confirms malicious activity, search the environment for additional compromised hosts.
- Implement network segmentation or restrictions to contain the attack.
- Stop suspicious processes or services tied to CUPS exploitation.
- Block identified Indicators of Compromise (IoCs), including IP addresses, domains, or hashes of involved files.
- Review compromised systems for backdoors, such as reverse shells or persistence mechanisms like cron jobs.
- Investigate potential credential exposure on compromised systems and reset passwords for any affected accounts.
- Restore the original printer configurations or uninstall unauthorized printer entries.
- Perform a thorough antimalware scan to identify any lingering threats or artifacts from the attack.
- Investigate how the attacker gained initial access and address any weaknesses to prevent future exploitation.
- Use insights from the incident to improve detection and response times in future incidents (MTTD and MTTR).
"""
references = [
    "https://www.elastic.co/security-labs/cups-overflow",
    "https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/",
    "https://gist.github.com/stong/c8847ef27910ae344a7b5408d9840ee1",
    "https://github.com/RickdeJager/cupshax/blob/main/cupshax.py",
]
risk_score = 73
rule_id = "476267ff-e44f-476e-99c1-04c78cb3769d"
setup = """## Setup

This rule requires data coming in from Elastic Defend.

### Elastic Defend Integration Setup
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.

#### Prerequisite Requirements:
- Fleet is required for Elastic Defend.
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).

#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
- Go to the Kibana home page and click "Add integrations".
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
- Click "Add Elastic Defend".
- Configure the integration name and optionally add a description.
- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
- Click "Save and Continue".
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
"""
severity = "high"
tags = [
    "Domain: Endpoint",
    "OS: Linux",
    "Use Case: Threat Detection",
    "Use Case: Vulnerability",
    "Tactic: Execution",
    "Data Source: Elastic Defend",
    "Data Source: Crowdstrike",
    "Data Source: SentinelOne",
    "Data Source: Elastic Endgame",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
process where host.os.type == "linux" and event.type == "start" and
  event.action in ("exec", "exec_event", "start", "ProcessRollup2") and process.parent.name == "foomatic-rip" and
  process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and not (
    process.command_line like (
      "*/tmp/foomatic-*", "*-sDEVICE=ps2write*", "*printf*", "/bin/sh -e -c cat", "/bin/bash -c cat",
      "/bin/bash -e -c cat"
    ) or
    process.args like "gs*"
  )
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"

[[rule.threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"

[[rule.threat.technique]]
id = "T1203"
name = "Exploitation for Client Execution"
reference = "https://attack.mitre.org/techniques/T1203/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[rule]
description = """
Detects the abnormal invocation of a system application located in /System/Applications via the open binary. This
abnormal activity may indicate the use of "default application hijacking" to persist and/or execute a malicious payload
utilizing a bug that currently exists in the way macOS handles default apps and filetypes.
"""
id = "5d2c3833-a36a-483a-acea-5bf8cf363a81"
license = "Elastic License v2"
name = "Default Application Hijacking"
os_list = ["macos"]
reference = [
    "https://medium.com/@marcusthebrody/a-new-macos-persistence-and-deception-technique-default-application-hijacking-52de66955a16",
]
version = "1.0.26"

query = '''
process where event.type == "start" and event.action == "exec" and 
 process.name == "open" and process.args == "-a" and process.args like "/System/Applications/*" and
 (process.parent.code_signature.trusted == false or process.parent.code_signature.exists == false)
'''

min_endpoint_version = "8.11.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1574"
name = "Hijack Execution Flow"
reference = "https://attack.mitre.org/techniques/T1574/"


[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[internal]
min_endpoint_version = "8.11.0"

[rule]
description = """
Detects when an executable file is modified in a temporary directory and immediately executed. We have observed several
samples that bring additional payloads within their application structure or that embed another payload within their
applications main binary dropping these payloads in the temporary directory and immediately executing them.
"""
id = "ec3abfa9-499a-40d7-a23d-413ce878db10"
license = "Elastic License v2"
name = "Embedded Payload Dropped and Executed"
os_list = ["macos"]
version = "1.0.7"

query = '''
sequence with maxspan=10s
[file where event.action == "modification" and file.Ext.header_bytes like~ ("cffaedfe*", "cafebabe*") and
  file.path like~ ("/tmp/*", "/private/tmp/*", "/Users/Shared/*") and
  not process.executable like~ "/Library/Developer/*"] by Effective_process.entity_id
[process where event.type == "start" and event.action == "exec" and process.executable like~ ("/tmp/*", "/private/tmp/*", "/Users/Shared/*") and process.args_count == 1] by process.parent.entity_id
'''

min_endpoint_version = "8.11.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1027"
name = "Obfuscated Files or Information"
reference = "https://attack.mitre.org/techniques/T1027/"
[[threat.technique.subtechnique]]
id = "T1027.009"
name = "Embedded Payloads"
reference = "https://attack.mitre.org/techniques/T1027/009/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.11.0"

[rule]
description = """
Detects attempts to load a networking module from a potentially altered call stack in order to conceal the true source
of the call.
"""
id = "d8c57cb7-bab6-41fa-9063-dcc8793c3955"
license = "Elastic License v2"
name = "Image Load via Synthetic Stack Spoofing"
os_list = ["windows"]
reference = ["https://www.elastic.co/security-labs/doubling-down-etw-callstacks"]
version = "1.0.27"

query = '''
library where
dll.name : ("wininet.dll", "ws2_32.dll", "dnsapi.dll", "winhttp.dll", "clr.dll", "netapi32.dll",
                "mscorwks.dll", "System.*.dll", "mscorlib*.dll", "Microsoft.PowerShell.Security*.dll",
                "Microsoft.PowerShell.ConsoleHost*.dll", "wmiutils.dll", "fastprox.dll", "wbemprox.dll",
                "vaultcli.dll", "taskschd.dll", "dsquery.dll", "mstscax.dll", "ntdll.dll", "wldap32.dll",
                "wtsapi32.dll", "psapi.dll") and
process.thread.Ext.call_stack_summary like "ntdll.dll|kernel32.dll*" and
 
  /* JMP gadget in kernel32 */
  _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info regex~ """.*system32\\kernel32.dll!(A|[C-Z]).+""") and
  _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info : "?:\\Windows\\System32\\ntdll.dll!LdrLoadDll*") and
   not process.thread.Ext.call_stack_summary like "ntdll.dll|kernel32.dll|mso40uiwin32client.dll|mso98win32client.dll|mso.dll|*" and
   not  _arraysearch(process.thread.Ext.call_stack, $entry, 
                   $entry.symbol_info : ("*kernel32.dll!CreateProcess*", "*kernel32.dll!GetDateFormatWWorker*", 
                                         "*kernel32.dll!WerpLaunchAeDebug*", "*kernel32.dll!BaseDllReadWriteIniFile*", 
                                         "*kernel32.dll!GlobalReAlloc*", "*kernel32.dll!CreateToolhelp32Snapshot*", 
                                         "*kernel32.dll!Wow64SetThreadContext*", "*kernel32.dll!ExitProcess*", "*kernel32.dll!WinExec*",
                                         "*kernel32.dll!CallbackMayRunLong*", "*kernel32.dll!BaseGenerateAppCompatData*", 
                                         "*mpclient.dll!MpUpdateServicePingRpc*", "*chrome.exe!IsSandboxedProcess*",
                                         "*kernel32.dll!CreateActCtxWWorker*", "*kernel32.dll!Sleep*",
                                         "*kernel32.dll!BasepCheckAppCompat*", "*kernel32.dll!AddAtomW*",
                                         "*\\kernel32.dll!lstrlenW*", "*\\kernel32.dll!FindActCtxSectionGuidWorker*",
                                         "*\\kernel32.dll!OpenPrivateNamespaceW*", "*\\kernel32.dll!DeactivateActCtxWorke*",
                                         "c:\\windows\\system32\\kernel32.dll!QuirkIsEnabled3Worker*",
                                         "C:\\Windows\\System32\\kernel32.dll!GetQueuedCompletionStatus*",
                                         "*\\ntdll.dll!RtlFormatMessageEx*", "*kernel32.dll!GetQueuedCompletionStatus*"))
'''

min_endpoint_version = "8.10.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1036"
name = "Masquerading"
reference = "https://attack.mitre.org/techniques/T1036/"

[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"

[metadata]
creation_date = "2026/05/07"
integration = ["kubernetes"]
maturity = "production"
updated_date = "2026/05/07"

[rule]
author = ["Elastic"]
description = """
Detects allowed updates to the pods/ephemeralcontainers subresource by a non-system identity. Ephemeral containers are
commonly used for debugging (kubectl debug) but can also be abused to inject tooling into a running pod, access mounted
secrets, and execute commands in the target pod context. Attackers with sufficient RBAC may use ephemeral containers to
escalate privileges, move laterally, or establish persistence without deploying a new workload.
"""
false_positives = [
    """
    Cluster operators or SREs may legitimately use ephemeral containers for debugging production workloads. Baseline
    approved admin identities and tune exclusions for known automation.
    """,
]
from = "now-9m"
index = ["logs-kubernetes.audit_logs-*"]
language = "kuery"
license = "Elastic License v2"
name = "Kubernetes Ephemeral Container Added to Pod"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Kubernetes Ephemeral Container Added to Pod

Ephemeral containers allow adding a container to an existing pod for troubleshooting. When abused, they can be used to
gain interactive access to a workload, read sensitive files, and run tools that were not present in the original image.

### Possible investigation steps

- Review the actor (user.name, groups), source.ip, and user_agent.original and confirm the identity is authorized to use ephemeral containers.
- Inspect kubernetes.audit.objectRef (namespace, name) to identify the targeted pod and workload owner.
- If request bodies are captured, review the ephemeral container image, command, and securityContext for privilege indicators.
- Correlate with follow-on audit activity such as pod exec, secret reads, TokenRequest, or RBAC modifications.

### Response and remediation

- If unauthorized, remove excessive RBAC that grants update/patch on pods/ephemeralcontainers and rotate exposed credentials.
- Quarantine or redeploy impacted workloads and hunt for additional compromised pods or identities.
"""
references = [
    "https://kubernetes.io/docs/concepts/workloads/pods/ephemeral-containers/",
]
risk_score = 47
rule_id = "c62733ff-9373-4fdf-9733-3d992e148c93"
severity = "medium"
tags = [
    "Data Source: Kubernetes",
    "Domain: Kubernetes",
    "Use Case: Threat Detection",
    "Tactic: Privilege Escalation",
    "Tactic: Execution",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"
query = '''
data_stream.dataset:"kubernetes.audit_logs" and 
kubernetes.audit.objectRef.resource:"pods" and
kubernetes.audit.objectRef.subresource:"ephemeralcontainers" and
kubernetes.audit.verb:("update" or "patch") and
kubernetes.audit.annotations.authorization_k8s_io/decision:"allow" and
not user.name:(
  system\:node\:* or
  system\:serviceaccount\:kube-system\:*
)
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1611"
name = "Escape to Host"
reference = "https://attack.mitre.org/techniques/T1611/"

[rule.threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1609"
name = "Container Administration Command"
reference = "https://attack.mitre.org/techniques/T1609/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[metadata]
creation_date = "2026/04/22"
integration = ["kubernetes"]
maturity = "production"
updated_date = "2026/08/24"

[rule]
author = ["Elastic"]
description = """
Detects list operations on Kubernetes Secrets from a non-loopback client when the request URI targets cluster-wide
secrets or list operations under kube-system or default. Useful for spotting broad secret enumeration from remote
clients.
"""
from = "now-6m"
index = ["logs-kubernetes.audit_logs-*"]
language = "kuery"
license = "Elastic License v2"
name = "Kubernetes Secrets List Across Cluster or Sensitive Namespaces"
note = """## Triage and analysis

### Investigating Kubernetes Secrets List Across Cluster or Sensitive Namespaces

Audit events for `list` on the `secrets` resource against `/api/v1/secrets`, paginated cluster lists, or namespace-scoped
lists under `kube-system` or `default`, from a source IP that is not localhost.

### Investigation steps

- Confirm the actor (`user.name`, groups) and whether the client is expected (CI, admin bastion, controller).
- Review `kubernetes.audit.requestURI`, `user_agent.original`, and follow-on API activity from the same source.
- Assess exposure: cluster-wide secret listing can surface many credentials.

### False positives

- Legitimate controllers or operators listing secrets in `kube-system` / `default` from cluster nodes may match; tune by
  source IP, user agent, or service account as needed.
"""
references = [
    "https://attack.mitre.org/techniques/T1552/007/",
]
risk_score = 73
rule_id = "7e3f9a2b-1c4d-5e6f-8a0b-9c8d7e6f5a4b"
severity = "high"
tags = [
    "Data Source: Kubernetes",
    "Domain: Kubernetes",
    "Use Case: Threat Detection",
    "Tactic: Credential Access",
    "Tactic: Discovery",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"
query = '''
event.dataset:"kubernetes.audit_logs" and event.action:list and 
kubernetes.audit.objectRef.resource:secrets and 
kubernetes.audit.requestURI :(/api/v1/secrets or /api/v1/secrets?limit* or /api/v1/namespaces/kube-system/secrets or /api/v1/namespaces/kube-system/secrets?limit* or /api/v1/namespaces/default/secrets or /api/v1/namespaces/default/secrets?limit*) and 
source.ip:(* and not ("::1" or "127.0.0.1")) and 
not user.name: (system\:kube-controller-manager or eks\:cloud-controller-manager or eks\:kms-storage-migrator or "system:serviceaccount:argocd:argocd-application-controller" or "system:serviceaccount:elastic:kube-state-metrics" or "system:serviceaccount:cert-manager:cert-manager-cainjector" or "system:serviceaccount:elastic-system:elastic-agent" or "system:serviceaccount:longhorn-system:longhorn-service-account") and 
not kubernetes.audit.user.groups:("system:serviceaccounts:ibm-csi" or "system:serviceaccounts:argocd" or "system:serviceaccounts:elastic")
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"

[[rule.threat.technique.subtechnique]]
id = "T1552.007"
name = "Container API"
reference = "https://attack.mitre.org/techniques/T1552/007/"

[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1613"
name = "Container and Resource Discovery"
reference = "https://attack.mitre.org/techniques/T1613/"

[rule.threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"

[metadata]
creation_date = "2026/01/08"
integration = ["system"]
maturity = "production"
updated_date = "2026/03/24"

[rule]
author = ["Elastic"]
description = """
This rule detects the deletion of user or group accounts on Linux systems. Adversaries may use these
commands to remove accounts to cover their tracks or disrupt operations.
"""
from = "now-9m"
index = ["filebeat-*", "logs-system.auth-*"]
language = "eql"
license = "Elastic License v2"
name = "Linux User or Group Deletion"
note = """ ## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Linux User or Group Deletion

This rule surfaces successful deletions of Linux users or groups—activity that can erase evidence, hide persistence, or disrupt access control. A common pattern is an attacker with root rights running userdel -r to remove a temporary privileged account they used for access, deleting its home directory and mail spool to strip artifacts. Correlate with recent privilege escalation and changes to sudoers/wheel to identify whether this was malicious cleanup versus routine deprovisioning.

### Possible investigation steps

- Correlate with auth and sudo logs to identify the actor, session (TTY/SSH), and source IP that executed the deletion and confirm whether root was obtained via sudo or another escalation path.
- Inspect the process tree and command line to see if userdel/groupdel used -r to remove the home/mail spool and whether it was launched from an interactive shell, SSH session, or automation tooling.
- Validate expected deprovisioning by checking HR/ticketing/IdM and configuration-management activity around the time, and escalate if the deleted identity was privileged or part of sudo/wheel.
- Build a timeline around the event to find adjacent actions such as account creation, password or key changes, group membership edits, and modifications to /etc/passwd, /etc/group, /etc/shadow, or sudoers.
- Assess impact and persistence by locating services, cron/systemd units, files, ACLs, or running processes still referencing the deleted UID/GID, attempt recovery of the home/mail from backups, and look for wtmp/btmp/lastlog tampering.

### False positive analysis

- Scheduled deprovisioning or baseline enforcement where administrators intentionally remove stale local users or groups associated with retired projects, decommissioned systems, or role changes during maintenance.
- Package uninstall or system maintenance scripts that add a service account during setup and later remove it during cleanup, causing legitimate user/group deletion events.

### Response and remediation

- If the deletion is unauthorized, immediately isolate the host and restrict interactive access by setting PermitRootLogin no and tightening AllowUsers/AllowGroups in /etc/ssh/sshd_config, then systemctl restart sshd to apply.
- Review and clean authorization and persistence by inspecting /etc/sudoers and /etc/sudoers.d for unauthorized rules, checking wheel/sudo memberships in /etc/group, and purging cron or systemd units that reference the deleted UID/GID.
- Recover the identity if legitimate by recreating the user/group with the original UID/GID from /var/backups/{passwd,group,shadow}, restoring the corresponding /home directory and /var/spool/mail from backups, and reassigning orphaned files using find -nouser -nogroup to a valid account.
- Rotate credentials associated with the deleted identity by replacing SSH keys and secrets found in ~/.ssh/authorized_keys and application configs, and invalidate cached tokens and service account credentials that may have been shared.
- Escalate to incident response if the deleted account was privileged (present in wheel/sudo groups), userdel/groupdel used -r to remove the home/mail spool, or evidence of log tampering exists such as truncated /var/log/auth.log or altered wtmp/btmp/lastlog.
- Harden by centralizing local account lifecycle in IdM/LDAP, enforcing visudo-managed sudo changes, enabling auditd watches on /usr/sbin/userdel,/usr/sbin/groupdel and writes to /etc/passwd,/etc/group,/etc/shadow, and deploying AIDE to monitor integrity of /etc.
"""
risk_score = 21
rule_id = "8f8004e1-0783-485f-a3da-aca4362f74a7"
setup = """## Setup

This rule requires data coming in from Filebeat.

### Filebeat Setup
Filebeat is a lightweight shipper for forwarding and centralizing log data. Installed as an agent on your servers, Filebeat monitors the log files or locations that you specify, collects log events, and forwards them either to Elasticsearch or Logstash for indexing.

#### The following steps should be executed in order to add the Filebeat on a Linux System:
- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/setup-repositories.html).
- To run Filebeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/running-on-docker.html).
- To run Filebeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/running-on-kubernetes.html).
- For quick start information for Filebeat refer to the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/8.11/filebeat-installation-configuration.html).
- For complete “Setup and Run Filebeat” information refer to the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/setting-up-and-running.html).

#### Rule Specific Setup Note
- This rule requires the “Filebeat System Module” to be enabled.
- The system module collects and parses logs created by the system logging service of common Unix/Linux based distributions.
- To run the system module of Filebeat on Linux follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-system.html).
"""
severity = "low"
tags = [
    "Domain: Endpoint",
    "OS: Linux",
    "Use Case: Threat Detection",
    "Tactic: Defense Evasion",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"
query = '''
iam where host.os.type == "linux" and event.type in ("group", "user") and event.type == "deletion" and event.outcome == "success"
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1070"
name = "Indicator Removal"
reference = "https://attack.mitre.org/techniques/T1070/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1531"
name = "Account Access Removal"
reference = "https://attack.mitre.org/techniques/T1531/"

[rule.threat.tactic]
id = "TA0040"
name = "Impact"
reference = "https://attack.mitre.org/tactics/TA0040/"

[rule]
description = """
Adversaries can modify default Microsoft Office templates in order to establish persistence using malicious Macro
templates.
"""
id = "608eae71-6797-4ded-bfaa-41bcb17a8498"
license = "Elastic License v2"
name = "Office Application Startup via Template File Modification"
os_list = ["windows"]
reference = ["https://attack.mitre.org/techniques/T1137/001/"]
version = "1.0.30"

query = '''
file where event.action in ("creation", "overwrite") and process.pid != 4 and
  process.name != null and user.name != null and
  file.path :
    ("C:\\Users\\*\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm",
     "C:\\Users\\*\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\PERSONAL.XLSB") and file.size > 0 and
  not process.thread.Ext.call_stack_summary in
                        ("sysfer.dll|apphelp.dll|kernelbase.dll|migcore.dll|loadstate.exe|kernel32.dll|ntdll.dll",
                         "ntdll.dll|apphelp.dll|kernelbase.dll|migcore.dll|loadstate.exe|kernel32.dll|ntdll.dll") and
  not process.executable : ("?:\\Windows\\System32\\svchost.exe",
                            "?:\\Windows\\explorer.exe",
                            "?:\\Program Files\\Citrix\\User Profile Manager\\UserProfileManager.exe",
                            "?:\\Program Files (x86)\\Citrix\\User Profile Manager\\UserProfileManager.exe",
                            "?:\\Program Files (x86)\\Ivanti\\Workspace Control\\pfwsmgr.exe",
                            "?:\\ProgramData\\ForensiT\\Transwiz\\Deployment Files\\Transwiz.exe",
                            "C:\\Program Files (x86)\\Windows Kits\\10\\Assessment and Deployment Kit\\User State Migration Tool\\amd64\\loadstate.exe",
                            "?:\\Windows\\Sys*\\xcopy.exe",
                            "?:\\Windows\\Sys*\\Robocopy.exe",
                            "?:\\Program Files\\Veeam\\Endpoint Backup\\*.exe",
                            "?:\\Program Files (x86)\\Laplink PCmover\\PCmoverHost.exe",
                            "?:\\Windows\\System32\\dllhost.exe",
                            "C:\\Windows\\System32\\cmd.exe",
                            "D:\\SuperGrate*.exe",
                            "\\Device\\Mup\\*.exe") and
  not user.id in ("S-1-5-18", "S-1-5-19", "S-1-5-20")
'''

min_endpoint_version = "8.10.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1137"
name = "Office Application Startup"
reference = "https://attack.mitre.org/techniques/T1137/"
[[threat.technique.subtechnique]]
id = "T1137.001"
name = "Office Template Macros"
reference = "https://attack.mitre.org/techniques/T1137/001/"



[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[internal]
min_endpoint_version = "8.10.0"

[metadata]
creation_date = "2023/09/22"
integration = ["ded", "endpoint", "network_traffic"]
maturity = "production"
updated_date = "2026/07/27"
min_stack_version = "9.4.0"
min_stack_comments = "Use EA (Entity Analytics) fields"

[rule]
anomaly_threshold = 75
author = ["Elastic"]
description = """
A machine learning job has detected data exfiltration to a particular geo-location (by IP address). Data transfers to
geo-locations that are outside the normal traffic patterns of an organization could indicate exfiltration over command
and control channels.
"""
from = "now-6h"
interval = "15m"
license = "Elastic License v2"
machine_learning_job_id = "ded_high_sent_bytes_destination_ip_ea"
name = "Potential Data Exfiltration Activity to an Unusual IP Address"
references = [
    "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html",
    "https://docs.elastic.co/en/integrations/ded",
    "https://www.elastic.co/blog/detect-data-exfiltration-activity-with-kibanas-new-integration",
]
risk_score = 21
rule_id = "cc653d77-ddd2-45b1-9197-c75ad19df66c"
setup = """## Setup

The rule requires the Data Exfiltration Detection integration assets to be installed, as well as network and file events collected by integrations such as Elastic Defend and Network Packet Capture (for network events only).

### Data Exfiltration Detection Setup
The Data Exfiltration Detection integration detects data exfiltration activity by identifying abnormalities in network and file events. Anomalies are detected using Elastic's Anomaly Detection feature.

#### Prerequisite Requirements:
- Fleet is required for Data Exfiltration Detection.
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
- Network events collected by the [Elastic Defend](https://docs.elastic.co/en/integrations/endpoint) or [Network Packet Capture](https://docs.elastic.co/integrations/network_traffic) integration.
- To install Elastic Defend, refer to the [documentation](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
- To add the Network Packet Capture integration to an Elastic Agent policy, refer to [this](https://www.elastic.co/guide/en/fleet/current/add-integration-to-policy.html) guide.

#### The following steps should be executed to install assets associated with the Data Exfiltration Detection integration:
- Go to the Kibana homepage. Under Management, click Integrations.
- In the query bar, search for Data Exfiltration Detection and select the integration to see more details about it.
- Follow the instructions under the **Installation** section.
- For this rule to work, complete the instructions through **Add preconfigured anomaly detection jobs**.
"""
severity = "low"
tags = [
    "Data Source: Elastic Defend",
    "Data Source: Network Packet Capture",
    "Use Case: Data Exfiltration Detection",
    "Rule Type: ML",
    "Rule Type: Machine Learning",
    "Tactic: Exfiltration",
    "Resources: Investigation Guide",
]
type = "machine_learning"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Potential Data Exfiltration Activity to an Unusual IP Address

Machine learning models analyze network traffic patterns to identify anomalies, such as data transfers to atypical geo-locations. Adversaries exploit command and control channels to exfiltrate data to these unusual IP addresses. This detection rule leverages ML to flag deviations from normal traffic, indicating potential exfiltration activities, thus aiding in early threat identification.

### Possible investigation steps

- Review the alert details to identify the unusual IP address and geo-location involved in the potential exfiltration activity.
- Cross-reference the identified IP address with threat intelligence databases to determine if it is associated with known malicious activities or threat actors.
- Analyze historical network traffic logs to determine if there have been previous connections to the same IP address or geo-location, and assess the volume and frequency of these connections.
- Investigate the source device or user account associated with the alert to identify any unauthorized access or suspicious behavior leading up to the alert.
- Check for any recent changes in network configurations or security policies that might have inadvertently allowed the data transfer to the unusual IP address.
- Collaborate with the IT team to isolate the affected systems, if necessary, and prevent further data exfiltration while the investigation is ongoing.

### False positive analysis

- Legitimate business operations involving data transfers to new or infrequent geo-locations may trigger false positives. Users should review these activities and, if deemed non-threatening, add exceptions for these IP addresses.
- Regularly scheduled data backups or transfers to cloud services located in different regions can be misidentified as exfiltration. Users can whitelist these services to prevent unnecessary alerts.
- Remote work scenarios where employees connect from various locations might cause false positives. Implementing a policy to recognize and exclude known employee IP addresses can mitigate this issue.
- Partner or vendor data exchanges that occur outside typical patterns should be evaluated. If these are routine and secure, users can create exceptions for these specific IP addresses to reduce false alerts.

### Response and remediation

- Isolate the affected systems immediately to prevent further data exfiltration. Disconnect them from the network to stop any ongoing communication with the unusual IP address.
- Conduct a thorough analysis of the affected systems to identify any malicious software or unauthorized access points. Remove any identified threats and patch vulnerabilities.
- Change all credentials and access keys that may have been compromised during the exfiltration activity. Ensure that new credentials follow best practices for security.
- Review and update firewall rules and network access controls to block the identified unusual IP address and similar suspicious IP ranges.
- Monitor network traffic closely for any signs of continued exfiltration attempts or communication with command and control channels. Use enhanced logging and alerting to detect any anomalies.
- Escalate the incident to the organization's cybersecurity response team and, if necessary, report the breach to relevant authorities or regulatory bodies as per compliance requirements.
- Conduct a post-incident review to identify gaps in the current security posture and implement measures to prevent recurrence, such as improving network segmentation and enhancing threat detection capabilities."""
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1041"
name = "Exfiltration Over C2 Channel"
reference = "https://attack.mitre.org/techniques/T1041/"


[rule.threat.tactic]
id = "TA0010"
name = "Exfiltration"
reference = "https://attack.mitre.org/tactics/TA0010/"

[rule]
description = """
Identifies a browser process navigates to the Microsoft Help page followed by spawning an elevated process. This may
indicate a successful exploitation for privilege escalation abusing a vulnerable Windows Installer repair setup.
"""
id = "e02f4cc7-ca8a-4b5b-83a9-479f83aa74b3"
license = "Elastic License v2"
name = "Potential Privilege Escalation via MSI Repair"
os_list = ["windows"]
reference = ["https://sec-consult.com/blog/detail/msi-installer-repair-to-system-a-detailed-journey/"]
version = "1.0.5"

query = '''
process where event.action == "start" and process.Ext.token.integrity_level_name == "system" and
 process.parent.name in~ ("chrome.exe", "msedge.exe", "brave.exe", "whale.exe", "browser.exe", "dragon.exe", "vivaldi.exe",
                          "opera.exe", "iexplore", "firefox.exe", "waterfox.exe", "iexplore.exe", "tor.exe", "safari.exe") and
 process.parent.command_line like "*go.microsoft.com*" and
 not process.executable :
            ("?:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
             "?:\\Program Files\\Google\\Chrome\\Application\\chrome.exe",
             "?:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe",
             "?:\\Program Files\\Mozilla Firefox\\firefox.exe",
             "?:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe",
             "?:\\Program Files (x86)\\Google\\Chrome\\Application\\*\\Installer\\chrmstp.exe")
'''

min_endpoint_version = "7.15.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1068"
name = "Exploitation for Privilege Escalation"
reference = "https://attack.mitre.org/techniques/T1068/"


[threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[internal]
min_endpoint_version = "7.15.0"

[rule]
description = """
Identifies instances where a process is executed with user/group ID 0 (root), and a real user/group ID that is not 0.
This is indicative of a process that has been granted SUID/SGID permissions, allowing it to run with elevated
privileges. Attackers may leverage a misconfiguration for exploitation in order to escalate their privileges to root, or
establish a backdoor for persistence.
"""
id = "8863c926-4811-4a5f-bdc3-58186bf7c5bb"
license = "Elastic License v2"
name = "Potential Privilege Escalation via SUID Binary"
os_list = ["linux"]
reference = ["https://gtfobins.github.io/#+suid"]
version = "1.0.10"

query = '''
process where event.type == "start" and event.action == "exec" and (
  (process.user.id == 0 and process.real_user.id != 0) or
  (process.group.id == 0 and process.real_group.id != 0)
) and process.parent.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and (
  process.name in (
    "aa-exec", "ab", "agetty", "alpine", "ar", "arj", "arp", "as", "ascii-xfr", "ash", "aspell",
    "atobm", "base32", "base64", "basenc", "basez", "bc", "bridge", "busctl",
    "busybox", "bzip2", "cabal", "capsh", "choom", "chroot", "clamscan", "cmp",
    "column", "comm", "cpio", "cpulimit", "csh", "csplit", "csvtool", "cupsfilter",
    "dd", "debugfs", "dialog", "diff", "dig", "distcc",
    "dosbox", "ed", "efax", "elvish", "emacs", "eqn", "espeak", "expand", "expect",
    "fish", "fmt", "fold", "gcore", "gdb", "genie", "genisoimage", "gimp",
    "gtester", "hd", "hexdump", "highlight", "hping3", "iconv", "install",
    "ionice", "ispell", "jjs", "join", "jrunscript", "julia", "ksshell",
    "ld.so", "less", "links", "logsave", "look", "lua", "make",
    "mosquitto", "msgattrib", "msgcat", "msgconv", "msgfilter", "msgmerge", "msguniq", "multitime",
    "nasm", "ncftp", "nft", "nl", "nm", "nmap", "nohup", "ntpdate",
    "od", "openssl", "openvpn", "pandoc", "paste", "perf", "pexec", "pg", "pidstat",
    "pr", "ptx", "python", "rc", "readelf", "restic", "rlwrap", "rsync", "rtorrent",
    "rview", "sash", "scanmem", "setarch", "setlock",
    "soelim", "softlimit", "sqlite3", "ss", "ssh-agent", "ssh-keygen", "ssh-keyscan",
    "sshpass", "start-stop-daemon", "stdbuf", "strace", "sysctl", "tac",
    "taskset", "tbl", "tclsh", "tee", "tftp", "tic", "time", "troff",
    "ul", "unexpand", "unshare", "unsquashfs", "unzip", "update-alternatives", "uudecode",
    "uuencode", "vagrant", "varnishncsa", "view", "vigr", "vipw", "w3m", "watch",
    "whiptail", "xdotool", "xmodmap", "xmore", "xxd", "xz", "yash", "zsh",
    "zsoelim"
  ) or
  process.name == "ip" and (
    (
      process.args == "-force" and process.args in ("-batch", "-b")) or (process.args == "exec")
    ) or
  (process.name in ("bash", "sh", "dash", "ksh") and process.args == "-p") or
  (process.name == "php" and process.args == "-r") or
  (process.name in ("rvim", "vim", "vimdiff") and process.args == "-c") or
  (process.name == "perl" and process.args == "-e") or
  (process.name == "minicom" and process.args == "-D") or
  (process.name == "dmsetup" and process.args == "--exec") or
  (process.name == "xargs" and process.args == "-a") or
  (process.name == "wget" and process.args like "--use-askpass=*") or
  (process.name == "docker" and process.args == "run" and process.args == "chroot") or
  (process.name in ("nawk", "gawk", "mawk") and process.command_line like "*system*")
) and not (
  process.parent.name in ("spine", "sudo", "gcc") or
  process.parent.executable like~ (
    "/usr/sbin/sshd", "/usr/lib/systemd/systemd", "/etc/aide/aide.conf.d/*", "/usr/lib/apt/apt.systemd.daily",
    "/usr/libexec/gdm-wayland-session", "/usr/bin/setup-policy-routes", "/usr/libexec/gnome-terminal-server",
    "/opt/microsoft/omsagent/plugin/omsbaseline", "/usr/bin/rkhunter", "/snap/microk8s/*"
  ) or
  process.args == "/usr/local/zeek/bin/zeekctl cron" or
  process.parent.args == "/usr/bin/supervisord" or
  process.working_directory == "/usr/local/spine/bin" or
  (process.name == "sort" and process.parent.args == "/usr/lib/grub/grub-multi-install") or
  (process.name == "minicom" and process.command_line == "minicom")
)
'''

min_endpoint_version = "8.2.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"

[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1068"
name = "Exploitation for Privilege Escalation"
reference = "https://attack.mitre.org/techniques/T1068/"

[[threat.technique]]
id = "T1548"
name = "Abuse Elevation Control Mechanism"
reference = "https://attack.mitre.org/techniques/T1548/"
[[threat.technique.subtechnique]]
id = "T1548.001"
name = "Setuid and Setgid"
reference = "https://attack.mitre.org/techniques/T1548/001/"



[threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[internal]
min_endpoint_version = "8.2.0"