Elastic rules: 1n

[metadata]
creation_date = "2022/11/09"
integration = ["system", "windows"]
maturity = "production"
updated_date = "2026/05/04"

[rule]
author = ["Elastic"]
description = """
Identify access to sensitive Active Directory object attributes that contains credentials and decryption keys such as
unixUserPassword, ms-PKI-AccountCredentials and msPKI-CredentialRoamingTokens.
"""
from = "now-9m"
index = ["logs-system.security*", "logs-windows.forwarded*", "winlogbeat-*"]
language = "eql"
license = "Elastic License v2"
name = "Access to a Sensitive LDAP Attribute"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Access to a Sensitive LDAP Attribute

LDAP (Lightweight Directory Access Protocol) is crucial for accessing and managing directory information in Active Directory environments. Adversaries may exploit LDAP to access sensitive attributes like passwords and decryption keys, facilitating credential theft or privilege escalation. The detection rule identifies unauthorized access attempts by monitoring specific event codes and attribute identifiers, excluding benign activities to reduce noise, thus highlighting potential security threats.

### Possible investigation steps

- Review the event logs for event code 4662 to identify the specific user or process attempting to access the sensitive LDAP attributes.
- Check the winlog.event_data.SubjectUserSid to determine the identity of the user or service account involved in the access attempt, excluding the well-known SID S-1-5-18 (Local System).
- Analyze the winlog.event_data.Properties field to confirm which sensitive attribute was accessed, such as unixUserPassword, ms-PKI-AccountCredentials, or msPKI-CredentialRoamingTokens.
- Investigate the context of the access attempt by correlating the event with other logs or alerts around the same timestamp to identify any suspicious patterns or activities.
- Verify the legitimacy of the access by checking if the user or process has a valid reason or permission to access the sensitive attributes, considering the organization's access control policies.
- Assess the potential impact of the access attempt on the organization's security posture, focusing on credential theft or privilege escalation risks.
- Document findings and, if necessary, escalate the incident to the appropriate security team for further action or remediation.

### False positive analysis

- Access by legitimate administrative accounts: Regular access by system administrators to sensitive LDAP attributes can trigger alerts. To manage this, create exceptions for known administrative accounts by excluding their SIDs from the detection rule.
- Scheduled system processes: Automated tasks or system processes that require access to certain LDAP attributes may cause false positives. Identify these processes and exclude their specific event codes or AccessMasks if they are consistently benign.
- Service accounts: Service accounts that perform routine directory operations might access sensitive attributes as part of their normal function. Exclude these accounts by adding their SIDs to the exception list to prevent unnecessary alerts.
- Monitoring tools: Security or monitoring tools that scan directory attributes for compliance or auditing purposes can generate false positives. Whitelist these tools by excluding their event sources or specific actions from the detection criteria.

### Response and remediation

- Immediately isolate the affected system from the network to prevent further unauthorized access or data exfiltration.
- Conduct a thorough review of the access logs to identify any unauthorized users or systems that accessed the sensitive LDAP attributes.
- Reset passwords and revoke any potentially compromised credentials associated with the affected accounts, focusing on those with access to sensitive attributes.
- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine the scope of the breach.
- Implement additional monitoring on the affected systems and accounts to detect any further suspicious activities or attempts to access sensitive LDAP attributes.
- Review and update access controls and permissions for sensitive LDAP attributes to ensure they are restricted to only necessary personnel.
- Conduct a post-incident analysis to identify any gaps in security controls and update policies or procedures to prevent similar incidents in the future."""
references = [
    "https://www.mandiant.com/resources/blog/apt29-windows-credential-roaming",
    "https://social.technet.microsoft.com/wiki/contents/articles/11483.windows-credential-roaming.aspx",
    "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4662",
]
risk_score = 47
rule_id = "764c9fcd-4c4c-41e6-a0c7-d6c46c2eff66"
setup = """## Setup

Audit Directory Service Access must be enabled to generate the events used by this rule.
Setup instructions: https://ela.st/audit-directory-service-access
"""
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Credential Access",
    "Tactic: Privilege Escalation",
    "Use Case: Active Directory Monitoring",
    "Data Source: Active Directory",
    "Data Source: Windows Security Event Logs",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
any where host.os.type == "windows" and event.code == "4662" and

  not winlog.event_data.SubjectUserSid : "S-1-5-18" and

  winlog.event_data.Properties : (
   /* unixUserPassword */
  "*612cb747-c0e8-4f92-9221-fdd5f15b550d*",

  /* ms-PKI-AccountCredentials */
  "*b8dfa744-31dc-4ef1-ac7c-84baf7ef9da7*",

  /*  ms-PKI-DPAPIMasterKeys */
  "*b3f93023-9239-4f7c-b99c-6745d87adbc2*",

  /* msPKI-CredentialRoamingTokens */
  "*b7ff5a38-0818-42b0-8110-d3d154c97f24*"
  ) and

  /*
   Excluding noisy AccessMasks
   0x0 undefined and 0x100 Control Access
   https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4662
   */
  not winlog.event_data.AccessMask in ("0x0", "0x100")
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1003"
name = "OS Credential Dumping"
reference = "https://attack.mitre.org/techniques/T1003/"

[[rule.threat.technique]]
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"

[[rule.threat.technique.subtechnique]]
id = "T1552.004"
name = "Private Keys"
reference = "https://attack.mitre.org/techniques/T1552/004/"

[[rule.threat.technique]]
id = "T1649"
name = "Steal or Forge Authentication Certificates"
reference = "https://attack.mitre.org/techniques/T1649/"

[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"

[[rule.threat.technique.subtechnique]]
id = "T1078.002"
name = "Domain Accounts"
reference = "https://attack.mitre.org/techniques/T1078/002/"

[rule.threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1213"
name = "Data from Information Repositories"
reference = "https://attack.mitre.org/techniques/T1213/"

[rule.threat.tactic]
id = "TA0009"
name = "Collection"
reference = "https://attack.mitre.org/tactics/TA0009/"

[metadata]
creation_date = "2020/11/06"
integration = ["okta"]
maturity = "production"
updated_date = "2026/04/10"

[rule]
author = ["Elastic"]
description = """
Detects attempts to delete an Okta network zone. Okta network zones can be configured to limit or restrict access to a
network based on IP addresses or geolocations. An adversary may attempt to modify, delete, or deactivate an Okta network
zone in order to remove or weaken an organization's security controls.
"""
false_positives = [
    """
    Consider adding exceptions to this rule to filter false positives if Oyour organization's Okta network zones are
    regularly deleted.
    """,
]
index = ["filebeat-*", "logs-okta*"]
language = "kuery"
license = "Elastic License v2"
name = "Attempt to Delete an Okta Network Zone"
note = """## Triage and analysis

### Investigating Attempt to Delete an Okta Network Zone

Okta network zones can be configured to limit or restrict access to a network based on IP addresses or geolocations. Deleting a network zone in Okta might remove or weaken the security controls of an organization, which might be an indicator of an adversary's attempt to evade defenses.

#### Possible investigation steps:

- Identify the actor associated with the alert by examining the `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, or `okta.actor.display_name` fields.
- Examine the `event.action` field to confirm the deletion of a network zone.
- Investigate the `okta.target.id`, `okta.target.type`, `okta.target.alternate_id`, or `okta.target.display_name` fields to identify the network zone that was deleted.
- Review the `event.time` field to understand when the event happened.
- Check the actor's activities before and after the event to understand the context of this event.

### False positive analysis:

- Verify the `okta.client.user_agent.raw_user_agent` field to understand the device and software used by the actor. If these match the actor's typical behavior, it might be a false positive.
- Check if the actor is a known administrator or a member of the IT team who might have a legitimate reason to delete a network zone.
- Cross-verify the actor's actions with any known planned changes or maintenance activities.

### Response and remediation:

- If unauthorized access or actions are confirmed, immediately lock the affected actor's account and require a password change.
- If a network zone was deleted without authorization, create a new network zone with similar settings as the deleted one.
- Review and update the privileges of the actor who initiated the deletion.
- Identify any gaps in the security policies and procedures and update them as necessary.
- Implement additional monitoring and logging of Okta events to improve visibility of user actions.
- Communicate and train the employees about the importance of following proper procedures for modifying network zone settings.

## Setup

The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
references = [
    "https://help.okta.com/en/prod/Content/Topics/Security/network/network-zones.htm",
    "https://developer.okta.com/docs/reference/api/system-log/",
    "https://developer.okta.com/docs/reference/api/event-types/",
    "https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy",
    "https://www.elastic.co/security-labs/monitoring-okta-threats-with-elastic-security",
    "https://www.elastic.co/security-labs/starter-guide-to-understanding-okta",
]
risk_score = 47
rule_id = "c749e367-a069-4a73-b1f2-43a3798153ad"
severity = "medium"
tags = [
    "Use Case: Identity and Access Audit",
    "Data Source: Okta",
    "Use Case: Network Security Monitoring",
    "Tactic: Defense Evasion",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset:okta.system and event.action:zone.delete
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[rule.threat.technique.subtechnique]]
id = "T1562.007"
name = "Disable or Modify Cloud Firewall"
reference = "https://attack.mitre.org/techniques/T1562/007/"



[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[metadata]
creation_date = "2024/11/04"
integration = ["aws"]
maturity = "production"
updated_date = "2026/07/08"

[rule]
author = ["Elastic"]
description = """
Detects the creation of an AWS Identity and Access Management (IAM) user initiated by an assumed role on an EC2
instance. Assumed roles allow users or services to temporarily adopt different AWS permissions, but the creation of IAM
users through these roles, particularly from within EC2 instances, may indicate a compromised instance. Adversaries might
exploit such permissions to establish persistence by creating new IAM users under unauthorized conditions.
"""
false_positives = [
    """
    Assumed roles may be used by legitimate automated systems to create IAM users for specific workflows. Verify if this
    event aligns with known automation activities. If the action is routine for specific roles or user agents (e.g.,
    `aws-cli`, `boto3`), consider adding those roles or user agents to a monitored exception list for streamlined
    review.
    """,
]
from = "now-6m"
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
language = "kuery"
license = "Elastic License v2"
name = "AWS IAM Create User via Assumed Role on EC2 Instance"
note = """## Triage and analysis

### Investigating AWS IAM Create User via Assumed Role on EC2 Instance

This rule detects when an AWS Identity and Access Management (IAM) user is created through an assumed role on an EC2 instance. This action may indicate a potentially compromised instance where an adversary could be using the instance’s permissions to create a new IAM user, enabling persistent unauthorized access.

#### Possible Investigation Steps

- **Identify the Assumed Role and Initiating Instance**:
  - **Role and Instance**: Examine the `aws.cloudtrail.user_identity.arn` field to determine the specific EC2 instance and role used for this action (e.g., `arn:aws:sts::[account-id]:assumed-role/[role-name]/[instance-id]`). Verify if this behavior aligns with expected usage or represents an anomaly.

- **Analyze the Target IAM User**:
  - **New User Details**: Inspect `aws.cloudtrail.request_parameters` to see the username that was created. Validate if the user is expected or authorized.
  - **Review Creation Time and Context**: Compare the creation time (`@timestamp`) of the user with other activities from the same instance and role to assess if this creation was part of a larger chain of actions.

- **Check User Agent and Tooling**:
  - **User Agent Analysis**: Review `user_agent.original` to see if AWS CLI, SDK, or other tooling was used for this request. Identifiers such as `aws-cli`, `boto3`, or similar SDK names can indicate the method used, which may differentiate automation from interactive actions.
  - **Source IP and Location**: Use the `source.ip` and `source.geo` fields to identify the IP address and geographic location of the event. Verify if this aligns with expected access patterns for your environment.

- **Evaluate for Persistence Indicators**:
  - **Role Permissions**: Check the permissions associated with the assumed role (`arn:aws:iam::[account-id]:role/[role-name]`) to determine if creating IAM users is a legitimate activity for this role.
  - **Automated Role Patterns**: If the assumed role or instance typically creates IAM users for automation purposes, validate this action against historical records to confirm if the event is consistent with normal patterns.

- **Review Related CloudTrail Events**:
  - **Additional IAM Actions**: Investigate for other recent IAM or CloudTrail events tied to this role or instance, especially `CreateAccessKey` or `AttachUserPolicy` actions. These could signal further attempts to empower or utilize the newly created user.
  - **Correlate with Other Suspicious Activities**: Determine if other roles or instances recently initiated similar unusual actions, such as privilege escalations or data access.

### False Positive Analysis

- **Expected Automation**: Assumed roles may be used by legitimate automated systems that create users for specific workflows. Confirm if this event aligns with known automation activities.
- **Role Exceptions**: If this action is routine for specific roles, consider adding those roles to a monitored exception list for streamlined review.

### Response and Remediation

- **Immediate Access Review**: If user creation was unauthorized, restrict the assumed role’s permissions to prevent further user creation.
- **Delete Unauthorized Users**: Confirm and remove any unauthorized IAM users, adjusting IAM policies to reduce similar risks.
- **Enhance Monitoring and Alerts**: Enable enhanced logging or real-time alerts for this role or instance to detect further unauthorized access attempts.
- **Policy Update**: Consider updating IAM policies associated with roles on EC2 instances to limit sensitive actions like IAM user creation.

### Additional Information

For further guidance on managing IAM roles and permissions within AWS environments, refer to the [AWS IAM documentation](https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateUser.html) and AWS best practices for security.
"""
references = [
    "https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateUser.html",
    "https://www.dionach.com/en-us/breaking-into-the-cloud-red-team-tactics-for-aws-compromise/",
]
risk_score = 73
rule_id = "f7a1c536-9ac0-11ef-9911-f661ea17fbcd"
severity = "high"
tags = [
    "Domain: Cloud",
    "Data Source: AWS",
    "Data Source: Amazon Web Services",
    "Data Source: AWS IAM",
    "Use Case: Identity and Access Audit",
    "Tactic: Persistence",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "new_terms"

query = '''
data_stream.dataset: "aws.cloudtrail"
    and event.provider: "iam.amazonaws.com"
    and event.action: "CreateUser"
    and event.outcome: "success"
    and aws.cloudtrail.user_identity.type: "AssumedRole"
    and user.id: *\:i-*
'''

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user_agent.original",
    "source.ip",
    "aws.cloudtrail.user_identity.arn",
    "aws.cloudtrail.user_identity.type",
    "aws.cloudtrail.user_identity.access_key_id",
    "event.action",
    "event.outcome",
    "cloud.account.id",
    "cloud.region",
    "aws.cloudtrail.request_parameters",
    "aws.cloudtrail.response_elements"
]


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1136"
name = "Create Account"
reference = "https://attack.mitre.org/techniques/T1136/"
[[rule.threat.technique.subtechnique]]
id = "T1136.003"
name = "Cloud Account"
reference = "https://attack.mitre.org/techniques/T1136/003/"



[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[rule.new_terms]
field = "new_terms_fields"
value = ["aws.cloudtrail.user_identity.arn"]
[[rule.new_terms.history_window_start]]
field = "history_window_start"
value = "now-10d"

[metadata]
creation_date = "2026/07/09"
integration = ["azure"]
maturity = "production"
updated_date = "2026/07/09"

[rule]
author = ["Elastic"]
description = """
Detects a non-system identity using the AKS (Azure Kubernetes Service) API server nodes/proxy subresource to reach a
node's Kubelet. Proxying through the API server reaches the Kubelet API to enumerate pods or run commands on nodes, a
lateral-movement and privilege-escalation vector (kubeletctl, Peirates). Node, control-plane, and kube-system service
account identities that routinely proxy for monitoring are excluded, so remaining matches, including compromised
workload service accounts, are surfaced for review.
"""
false_positives = [
    """
    Monitoring and log-collection agents that run outside kube-system (for example a metrics agent in its own namespace)
    proxy to the Kubelet on every scrape and will match repeatedly. Add targeted exclusions for verified monitoring
    service accounts and namespaces after review.
    """,
]
from = "now-9m"
index = ["logs-azure.platformlogs-*"]
language = "kuery"
license = "Elastic License v2"
name = "Azure AKS API Server Proxying Request to Kubelet"
note = """## Triage and analysis

### Investigating Azure AKS API Server Proxying Request to Kubelet

AKS kube-audit events are carried under the flattened `azure.platformlogs.properties.log.*` subtree and share the ARM
operation `event.action: Microsoft.ContainerService/managedClusters/diagnosticLogs/Read`. The `nodes/proxy` subresource
tunnels a request through the API server to a node's Kubelet. An identity with this permission can enumerate pods
(`/proxy/pods`, `/proxy/runningpods`) or run commands (`/proxy/run`, `/proxy/exec`) on nodes without direct network
access to the Kubelet port. This rule excludes the node, control-plane, and kube-system service-account identities that
routinely proxy for monitoring, so remaining matches are workload identities or users that should rarely, if ever, reach
the Kubelet.

### Possible investigation steps

- Identify the acting identity in `azure.platformlogs.properties.log.user.username` and whether a workload service
  account or user should reach the Kubelet at all. Compromised pod service accounts (`system:serviceaccount:<ns>:<name>`)
  are the primary vehicle for this technique.
- Inspect the proxied Kubelet endpoint in `azure.platformlogs.properties.log.requestURI`. `/metrics` and `/stats` are
  monitoring; `/pods` and `/runningpods` are reconnaissance; `/run`, `/exec`, `/attach`, and `/portforward` are command
  execution and warrant immediate escalation.
- Evaluate `azure.platformlogs.properties.log.sourceIPs`. This is an array; for an externally operated attack the first
  element is the operator's real client IP, while the trailing entry is the internal API-server/konnectivity hop
  (`172.31.x`). A first entry that is not the cluster's own egress is a strong signal. In-cluster pivots show only
  internal addresses, so absence of an external IP does not clear the event.
- Review the target node in `azure.platformlogs.properties.log.objectRef.name` and correlate with subsequent activity on
  that node's workloads (secret reads, RBAC changes, new pods).

### False positive analysis

- Monitoring and log-collection agents outside kube-system proxy to the Kubelet on every scrape and will match
  repeatedly; add targeted exclusions for verified monitoring service accounts and namespaces.

### Response and remediation

- If unauthorized, revoke the acting identity's tokens and review the RBAC that granted `nodes/proxy`.
- Inspect the target node for command execution, dropped tooling, or credential theft, and rotate credentials reachable
  from affected pods.
- Note that direct Kubelet access on port 10250 bypasses the API server and does not appear in kube-audit; treat a
  confirmed proxy abuse as possible evidence of broader Kubelet access.
- Collect kube-audit and identity artifacts per incident response procedures.
"""
references = [
    "https://kubernetes.io/docs/reference/access-authn-authz/kubelet-authn-authz/",
    "https://stratus-red-team.cloud/attack-techniques/kubernetes/k8s.privilege-escalation.nodes-proxy/",
    "https://horizon3.ai/attack-research/when-read-only-isnt-k8s-nodes-proxy-get-to-rce/",
    "https://microsoft.github.io/Threat-Matrix-for-Kubernetes/",
    "https://github.com/inguardians/peirates",
]
risk_score = 47
rule_id = "dd43c618-6a5b-465b-8ae4-ce69e34ddac0"
setup = "The Azure Fleet integration collecting AKS diagnostic logs with the `kube-audit` category forwarded through Event Hub into the `azure.platformlogs` data stream is required for this rule."
severity = "medium"
tags = [
    "Domain: Cloud",
    "Domain: Kubernetes",
    "Data Source: Azure",
    "Data Source: Azure Platform Logs",
    "Data Source: Kubernetes",
    "Use Case: Threat Detection",
    "Tactic: Lateral Movement",
    "Tactic: Execution",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset:azure.platformlogs and
  event.action:"Microsoft.ContainerService/managedClusters/diagnosticLogs/Read" and
  azure.platformlogs.category:"kube-audit" and
  azure.platformlogs.properties.log.objectRef.resource:"nodes" and
  azure.platformlogs.properties.log.objectRef.subresource:"proxy" and
  not azure.platformlogs.properties.log.user.username:(
    system\:node\:* or "aksService" or "hcpService" or "readinessChecker" or
    system\:serviceaccount\:kube-system\:*
  )
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1210"
name = "Exploitation of Remote Services"
reference = "https://attack.mitre.org/techniques/T1210/"


[rule.threat.tactic]
id = "TA0008"
name = "Lateral Movement"
reference = "https://attack.mitre.org/tactics/TA0008/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1609"
name = "Container Administration Command"
reference = "https://attack.mitre.org/techniques/T1609/"


[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "event.action",
    "azure.platformlogs.category",
    "azure.platformlogs.properties.log.verb",
    "azure.platformlogs.properties.log.user.username",
    "azure.platformlogs.properties.log.sourceIPs",
    "azure.platformlogs.properties.log.requestURI",
    "azure.platformlogs.properties.log.objectRef.resource",
    "azure.platformlogs.properties.log.objectRef.subresource",
    "azure.platformlogs.properties.log.objectRef.name",
]

[metadata]
creation_date = "2026/07/09"
integration = ["azure"]
maturity = "production"
updated_date = "2026/07/09"

[rule]
author = ["Elastic"]
description = """
Detects successful AKS (Azure Kubernetes Service) secret get or list operations where the user agent matches scripting
runtimes (python, ruby, perl), command-line HTTP clients (curl, wget, HTTPie), or generic HTTP libraries (Go-http-client,
okhttp, Apache-HttpClient, Guzzle, axios, undici) rather than typical kubectl or named controller traffic. Reading
Kubernetes secrets with a generic client is a common credential-access step after a token or kubeconfig is stolen, and
offensive tooling (for example peirates and kdigger) frequently reaches the API with a default Go HTTP client.
"""
false_positives = [
    """
    Approved scripts, CI jobs, or penetration tests may use generic HTTP clients. Validate change tickets and identity
    scope before treating as compromise. Internal automation using generic libraries can be excluded by stable service
    account after review.
    """,
]
from = "now-9m"
index = ["logs-azure.platformlogs-*"]
language = "kuery"
license = "Elastic License v2"
name = "Azure AKS Secret get or list with Suspicious User Agent"
note = """## Triage and analysis

### Investigating Azure AKS Secret get or list with Suspicious User Agent

AKS kube-audit events are carried under the flattened `azure.platformlogs.properties.log.*` subtree and share the ARM
operation `event.action: Microsoft.ContainerService/managedClusters/diagnosticLogs/Read`. This rule fires when a
successful `get` or `list` against Kubernetes `secrets` is issued with a user agent that matches scripting runtimes
(python, ruby, perl), command-line HTTP clients (curl, wget, HTTPie), or generic HTTP libraries (Go-http-client, okhttp,
Apache-HttpClient, Guzzle, axios, undici) rather than typical `kubectl` or named controller traffic. The user agent is
trivially spoofable (the telemetry shows offensive tooling masquerading as `kubectl`), so this is a corroborating
indicator, not proof.

### Possible investigation steps

- Identify the acting identity in `azure.platformlogs.properties.log.user.username` and its group memberships in
  `azure.platformlogs.properties.log.user.groups`. Control-plane and node identities (`system:apiserver`, `aksService`,
  `system:node:*`, `system:serviceaccount:kube-system:*`) are expected; a human or service-principal identity reading
  secrets with a scripted client is not.
- Confirm the request was authorized by checking
  `azure.platformlogs.properties.log.annotations.authorization.k8s.io/decision` (`allow` vs `forbid`) and the
  `azure.platformlogs.properties.log.responseStatus.code`.
- Review the targeted secret via `azure.platformlogs.properties.log.objectRef.namespace` and
  `azure.platformlogs.properties.log.objectRef.name`, and the exact API path in
  `azure.platformlogs.properties.log.requestURI`.
- Evaluate the source in `azure.platformlogs.properties.log.sourceIPs`. In-cluster control-plane traffic uses loopback
  (`::1`) or node subnet addresses; a public or pod-network source for a secret read is more suspicious. Pivot on the
  source for other API bursts, exec sessions, or RBAC changes.
- Correlate with recent Entra ID sign-ins or role assignments for the identity to determine whether the token was
  recently issued or scoped unusually.

### False positive analysis

- Approved scripts, CI jobs, or penetration tests may use generic HTTP clients. Validate identity scope before treating
  as compromise.
- Internal automation using generic libraries can be excluded by stable service account after review.
- The kubelet and controllers built on client-go can default to a `Go-http-client/2.0` user agent when no custom agent
  is set (see kubernetes/kubernetes#108726), so an operator or platform component reading secrets may match `Go-http*`.
  Exclude the specific benign identity (for example `system:serviceaccount:kube-system:*` or a validated operator
  service account) rather than removing the `Go-http*` pattern, which also catches default-user-agent offensive tooling.

### Response and remediation

- If unauthorized, revoke the identity's tokens and kubeconfig, rotate the exposed secrets, and review RBAC that permits
  secret reads.
- Hunt for downstream use of the retrieved secrets, such as new sign-ins, workload deployments, or outbound connections.
- Collect kube-audit and identity artifacts per incident response procedures.
"""
references = [
    "https://kubernetes.io/docs/concepts/configuration/secret/",
    "https://microsoft.github.io/Threat-Matrix-for-Kubernetes/",
    "https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/",
    "https://unit42.paloaltonetworks.com/modern-kubernetes-threats/",
    "https://www.sysdig.com/blog/teamtnt-kubelet-credentials",
    "https://github.com/kubernetes/kubernetes/issues/108726",
]
risk_score = 73
rule_id = "4eaf5dd4-c511-4d0e-b66d-e218e6e3da76"
setup = """
The Azure Fleet integration collecting AKS diagnostic logs forwarded through Event Hub into the `azure.platformlogs`
data stream is required for this rule. The `kube-audit` log category is required specifically: secret get/list are
read operations, which the `kube-audit-admin` category excludes, so a cluster shipping only `kube-audit-admin` is blind
to this rule.
"""
severity = "high"
tags = [
    "Domain: Cloud",
    "Domain: Kubernetes",
    "Data Source: Azure",
    "Data Source: Azure Platform Logs",
    "Data Source: Kubernetes",
    "Use Case: Threat Detection",
    "Tactic: Credential Access",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset:azure.platformlogs and
  event.action:"Microsoft.ContainerService/managedClusters/diagnosticLogs/Read" and
  azure.platformlogs.category:"kube-audit" and
  azure.platformlogs.properties.log.responseStatus.code:("200" or "201") and
  azure.platformlogs.properties.log.verb:("get" or "list") and
  azure.platformlogs.properties.log.objectRef.resource:"secrets" and
  azure.platformlogs.properties.log.userAgent:(
    curl* or python* or Python* or wget* or Wget* or Go-http* or perl* or libwww-perl* or
    java* or Java* or node* or php* or Guzzle* or Bun* or axios* or undici* or okhttp* or
    Apache-HttpClient* or HTTPie* or Ruby* or PostmanRuntime* or RestSharp* or *distrib#kali* or *kali-amd64* or *kali-arm64*
  )
'''

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "event.action",
    "azure.platformlogs.category",
    "azure.platformlogs.properties.log.verb",
    "azure.platformlogs.properties.log.user.username",
    "azure.platformlogs.properties.log.userAgent",
    "azure.platformlogs.properties.log.sourceIPs",
    "azure.platformlogs.properties.log.objectRef.resource",
    "azure.platformlogs.properties.log.objectRef.namespace",
    "azure.platformlogs.properties.log.objectRef.name",
    "azure.platformlogs.properties.log.responseStatus.code",
]

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"

[[rule.threat.technique.subtechnique]]
id = "T1552.007"
name = "Container API"
reference = "https://attack.mitre.org/techniques/T1552/007/"

[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[rule]
description = """
This rule detects the execution of a background task via a hidden process. Attackers may use hidden processes to evade
detection and establish persistence or execute post-exploitation commands on a target system.
"""
id = "2dc02903-9487-4152-87ac-f1c6c7f3a7d3"
license = "Elastic License v2"
name = "Background Task Execution via a Hidden Process"
os_list = ["linux"]
version = "1.0.10"

query = '''
process where event.type == "start" and event.action == "exec" and
(process.parent.name like ".*" or process.name like ".*") and
(process.parent.args like "*&" or process.args like "*&") and
not (
  process.parent.command_line in ("runc init", "/usr/bin/runc init", "claude") or
  process.parent.executable like (
    ".", "/usr/bin/podman", "./.runc-wrapped", "/nix/store/*", "/dev/.buildkit_qemu_emulator",
    "*/node_modules/opencode-ai/bin/.opencode", "/usr/local/bin/runc", "*/node_modules/@kilocode/cli/bin/.kilo",
    "*/node_modules/@anthropic-ai/claude-code/bin/*", "/home/*/.local/share/fnm/node-versions/*/installation/lib/node_modules/opencode-ai/bin/.opencode",
    "/usr/local/share/npm-global/lib/node_modules/opencode-ai/bin/.opencode", "/usr/local/bin/runc", "/.init",
    "/tmp/newroot/var/lib/docker/overlay2/*/rootfs/dev/.buildkit_qemu_emulator"
  ) or
  process.executable like "/var/lib/containers/storage/overlay/nix/store/*/bin/.claude-wrapped" or
  process.parent.args in ("/usr/bin/crun", "lxc-attach") or
  process.args == "lxc-attach" or
  (process.args == "datadog-ipc-helper" and process.args == "ddog_daemon_entry_point") or
  (
    process.parent.executable in ("/usr/local/bin/runc", "/.init") and
    process.command_line like ("/.init bash -lc set -euo pipefail*DAGGER_STEP=*", "bash -lc set -euo pipefail*pipefail*DAGGER_STEP=*")
  )
)
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
tree = true

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1564"
name = "Hide Artifacts"
reference = "https://attack.mitre.org/techniques/T1564/"
[[threat.technique.subtechnique]]
id = "T1564.001"
name = "Hidden Files and Directories"
reference = "https://attack.mitre.org/techniques/T1564/001/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "7.15.0"

[rule]
description = """
Identifies the execution of a malicious application via rundll32.exe. Adversaries may abuse rundll32.exe to proxy
execution of malicious code and bypass application whitelisting configuration.
"""
id = "f60455df-5054-49ff-9ff7-1dc4e37b6ea7"
license = "Elastic License v2"
name = "Binary Proxy Execution via Rundll32"
os_list = ["windows"]
reference = [
    "https://lolbas-project.github.io/lolbas/Libraries/Shell32/",
    "https://lolbas-project.github.io/lolbas/Libraries/Zipfldr/",
    "https://lolbas-project.github.io/lolbas/Libraries/Pcwutl/",
    "https://lolbas-project.github.io/lolbas/Libraries/Advpack/",
    "https://lolbas-project.github.io/lolbas/Libraries/Ieadvpack/",
    "https://lolbas-project.github.io/lolbas/Libraries/Url/",
    "https://lolbas-project.github.io/lolbas/Libraries/Desk/",
]
version = "1.0.35"

query = '''
sequence with maxspan=1m
  [process where event.action == "start" and
   process.pe.original_file_name == "RUNDLL32.EXE" and
   process.command_line :
          ("*advpack*RegisterOCX*",
           "*advpack*#12*",
           "*zipfldr*RouteTheCall*",
           "*pcwutl*LaunchApplication*",
           "*pcwutl*#1*",
           "*url.dll*FileProtocolHandler*file://*",
           "*url.dll*FileProtocolHandler*.exe*",
           "*shell32.dll*ShellExec_RunDLL*",
           "*advpack*LaunchINFSection*",
           "*desk*InstallScreenSaver*",
           "*shell32*WaitForExplorerRestart*") and
   /* Issue #265 */
   not (process.command_line : "*url.dll*FileProtocolHandler*" and
        process.command_line : ("*http://*", "*zoommtg://*", "*://*&*&*")) and

   /* Legit LaunchApplication instances via msdt */
   not (process.command_line : "*pcwutl.dll,LaunchApplication*" and
        process.parent.name :  "msdt.exe" and
        process.working_directory : "?:\\Windows\\system32\\") and

   not (process.command_line :  "*shell32*WaitForExplorerRestart*" and process.args : "?:\\Windows\\*explorer.exe") and
   not (process.parent.executable : "C:\\Program Files\\Microsoft OneDrive\\OneDrive.exe" and process.args : "ShellExec_RunDLL")
   ] by process.entity_id
  [process where event.action == "start" and
   not process.executable :
                ("?:\\Program Files\\*",
                 "?:\\Program Files (x86)\\*",
                 "C:\\Windows\\System32\\shutdown.exe",
                 "C:\\Windows\\System32\\WerFault.exe") and
   not (process.executable : "?:\\Windows\\*.scr" and process.parent.args : "desk.cpl,InstallScreenSaver") and
   not (process.name : "wscript.exe" and process.args : "Cathexis Archive Viewer.vbs") and
   not process.args : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*") and
   not process.Ext.token.integrity_level_name == "system" and
   not process.executable : "?:\\Windows\\System32\\grpconv.exe" and
   not (process.code_signature.subject_name : "Adobe Inc." and process.code_signature.trusted == true) and
   not process.hash.sha256 :
                  ("f6bef3f879e082d115c2ad199a986da1660514699f5e752c7b628d9438d7cb49",
                   "c2831f5b010f099cd1733a0183adfa16cb834a9169fc55c6f7e6dc3267488c3f",
                   "70ebedc5aba37140682a0535eac9f1cfb77cc9916955e36f19ba1da893068a83",
                   "e6caed88fa115a412c744d0ec91f34cd3b5f329d7acdc1cb14e35364d492d095",
                   "af31ac74a9072e4bbc24ff17ee70681539e660d4fa885fcb45e752b5ec21d2ef") and
   not (process.executable : "?:\\Windows\\System32\\msiexec.exe" and process.parent.args : "?:\\WINDOWS\\system32\\pcwutl.dll,LaunchApplication") and 
   not (process.executable : "?:\\Windows\\System32\\verclsid.exe" and process.args : "{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}" and process.parent.command_line : "*ShellExec_RunDLL*") and 
   not (process.executable : ("?:\\Windows\\System32\\notepad.exe", "?:\\Windows\\System32\\mspaint.exe") and process.parent.command_line : "*ShellExec_RunDLL*")
   ] by process.parent.entity_id
'''

min_endpoint_version = "7.15.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[[threat.technique.subtechnique]]
id = "T1218.011"
name = "Rundll32"
reference = "https://attack.mitre.org/techniques/T1218/011/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.15.0"

[rule]
description = """
Identifies the use of a browser to download a file from a remote URL and from a suspicious parent process. Adversaries
may use browsers to avoid ingress tool transfer restrictions.
"""
id = "e35465eb-2a6b-4b6a-abbf-0bc3d9a068d0"
license = "Elastic License v2"
name = "Download Activity via a Headless Browser"
os_list = ["windows"]
reference = ["https://lolbas-project.github.io/lolbas/Binaries/Msedge/"]
version = "1.0.5"

query = '''
process where event.action in ("start", "already_running") and
 process.name : ("chrome.exe", "msedge.exe", "brave.exe", "browser.exe", "dragon.exe", "vivaldi.exe") and
 (
  (process.args : "--headless*" and process.args : ("http*", "data:text/html;base64,*")) or
  process.command_line : ("*mh0dHBzOi8vd2ViaG9vay5zaXRl*", "*93ZWJob29rLnNpdGU*") or
  (process.args_count == 2 and process.args : "data:text/html;base64,*")
  ) and
  process.parent.name :
     ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "conhost.exe", "msiexec.exe",
      "explorer.exe", "rundll32.exe", "winword.exe", "excel.exe", "onenote.exe", "hh.exe", "powerpnt.exe", "forfiles.exe",
      "pcalua.exe", "wmiprvse.exe") and
  not process.args : ("http://localhost/Allure#graph",  "--print-to-pdf=*")
'''

min_endpoint_version = "7.16.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1105"
name = "Ingress Tool Transfer"
reference = "https://attack.mitre.org/techniques/T1105/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "7.16.0"

[metadata]
creation_date = "2021/01/25"
integration = ["endpoint"]
maturity = "production"
updated_date = "2026/08/25"

[rule]
author = ["Elastic", "Massimo Bertocchi"]
description = """
Identifies the execution of macOS built-in commands used to dump user account hashes. Adversaries may attempt to dump
credentials to obtain account login information in the form of a hash. These hashes can be cracked or leveraged for
lateral movement.
"""
from = "now-9m"
index = ["logs-endpoint.events.*"]
language = "eql"
license = "Elastic License v2"
name = "Dumping Account Hashes via Built-In Commands"
references = [
    "https://apple.stackexchange.com/questions/186893/os-x-10-9-where-are-password-hashes-stored",
    "https://www.unix.com/man-page/osx/8/mkpassdb/",
]
risk_score = 73
rule_id = "02ea4563-ec10-4974-b7de-12e65aa4f9b3"
setup = """## Setup

This rule requires data coming in from Elastic Defend.

### Elastic Defend Integration Setup
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.

#### Prerequisite Requirements:
- Fleet is required for Elastic Defend.
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).

#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
- Go to the Kibana home page and click "Add integrations".
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
- Click "Add Elastic Defend".
- Configure the integration name and optionally add a description.
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
- Click "Save and Continue".
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
"""
severity = "high"
tags = [
    "Domain: Endpoint",
    "OS: macOS",
    "Use Case: Threat Detection",
    "Tactic: Credential Access",
    "Data Source: Elastic Defend",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
process where host.os.type == "macos" and event.type in ("start","process_started") and (
  (process.name == "defaults" and process.args like~ "ShadowHashData") or
  (process.name == "mkpassdb" and process.args == "-dump") or
  (process.name == "dscl" and process.args like~ "ShadowHashData") or
  (
    process.name in ("plutil","cat","strings","xxd","head") and
    process.args like "/var/db/dslocal/nodes/Default/users/*.plist"
  )
)
'''
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Dumping Account Hashes via Built-In Commands

In macOS environments, built-in commands like `defaults` and `mkpassdb` can be exploited by adversaries to extract user account hashes, which are crucial for credential access. These hashes, once obtained, can be cracked to reveal passwords or used for lateral movement within a network. The detection rule identifies suspicious process executions involving these commands and specific arguments, signaling potential credential dumping activities.

### Possible investigation steps

- Review the process execution details to confirm the presence of the `defaults` or `mkpassdb` commands with arguments like `ShadowHashData` or `-dump`, as these are indicative of credential dumping attempts.
- Identify the user account associated with the process execution to determine if the activity aligns with expected behavior for that user or if it appears suspicious.
- Check the historical activity of the involved user account and the host to identify any patterns or anomalies that could suggest unauthorized access or lateral movement.
- Investigate any network connections or subsequent processes initiated by the suspicious process to assess potential data exfiltration or further malicious actions.
- Correlate the event with other security alerts or logs from the same host or user account to build a comprehensive timeline of the activity and assess the scope of the potential compromise.

### False positive analysis

- System administrators or security tools may legitimately use the `defaults` or `mkpassdb` commands for system maintenance or auditing purposes. To manage these, create exceptions for known administrative accounts or tools that regularly execute these commands.
- Automated scripts or management software might invoke these commands as part of routine operations. Identify and whitelist these scripts or software to prevent unnecessary alerts.
- Developers or IT personnel might use these commands during testing or development phases. Establish a process to temporarily exclude these activities by setting up time-bound exceptions for specific user accounts or devices.
- Security assessments or penetration tests could trigger this rule. Coordinate with security teams to schedule and document these activities, allowing for temporary rule adjustments during the testing period.

### Response and remediation

- Immediately isolate the affected macOS system from the network to prevent further lateral movement or data exfiltration.
- Terminate any suspicious processes identified as using the `defaults` or `mkpassdb` commands with the specified arguments to halt ongoing credential dumping activities.
- Conduct a thorough review of user accounts on the affected system to identify any unauthorized access or changes, focusing on accounts with elevated privileges.
- Reset passwords for all potentially compromised accounts, especially those with administrative access, and enforce strong password policies.
- Analyze system logs and network traffic to identify any additional systems that may have been accessed using the compromised credentials, and apply similar containment measures.
- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine the full scope of the breach.
- Implement enhanced monitoring and alerting for similar suspicious activities across the network to detect and respond to future attempts promptly."""


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1003"
name = "OS Credential Dumping"
reference = "https://attack.mitre.org/techniques/T1003/"

[[rule.threat.technique.subtechnique]]
id = "T1003.008"
name = "/etc/passwd and /etc/shadow"
reference = "https://attack.mitre.org/techniques/T1003/008/"

[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[metadata]
creation_date = "2021/01/19"
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2026/05/04"

[rule]
author = ["Elastic"]
description = """
Masquerading can allow an adversary to evade defenses and better blend in with the environment. One way it occurs is
when the name or location of a file is manipulated as a means of tricking a user into executing what they think is a
benign file type but is actually executable code.
"""
from = "now-9m"
index = [
    "winlogbeat-*",
    "logs-endpoint.events.file-*",
    "logs-windows.sysmon_operational-*",
    "endgame-*",
    "logs-m365_defender.event-*",
    "logs-sentinel_one_cloud_funnel.*",
    "logs-crowdstrike.fdr*",
]
language = "eql"
license = "Elastic License v2"
name = "Executable File Creation with Multiple Extensions"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Executable File Creation with Multiple Extensions

In Windows environments, adversaries may exploit file extensions to disguise malicious executables as benign files, such as documents or images, by appending multiple extensions. This tactic, known as masquerading, aims to deceive users and evade security measures. The detection rule identifies suspicious file creations by monitoring for executables with misleading extensions, excluding known legitimate processes, thus highlighting potential threats.

### Possible investigation steps

- Review the file creation event details to identify the full file path and name, focusing on the extensions used to determine if they match the suspicious pattern outlined in the query.
- Investigate the process that created the file by examining the process.executable field to determine if it is a known legitimate process or potentially malicious.
- Check the file's origin by analyzing the user account and network activity associated with the file creation event to identify any unusual or unauthorized access patterns.
- Utilize threat intelligence sources to assess if the file hash or any related indicators of compromise (IOCs) are known to be associated with malicious activity.
- Examine the file's metadata and properties to verify its authenticity and check for any signs of tampering or unusual characteristics.
- Conduct a behavioral analysis of the file in a controlled environment to observe any malicious actions or network communications it may attempt.

### False positive analysis

- Legitimate software installations may create executables with multiple extensions during setup processes. Users can exclude these by adding exceptions for known installer paths, such as "C:\\Users\\*\\QGIS_SCCM\\Files\\QGIS-OSGeo4W-*-Setup-x86_64.exe".
- System updates or patches might temporarily create files with multiple extensions. Monitor and verify these activities, and if confirmed as legitimate, add exceptions for the specific update processes.
- Development environments or script-based applications may generate files with multiple extensions for testing purposes. Identify these environments and exclude their specific file paths or processes to prevent false positives.
- Security tools or administrative scripts might use multiple extensions for legitimate purposes. Review and whitelist these tools by their executable paths or process names to avoid unnecessary alerts.

### Response and remediation

- Isolate the affected system from the network to prevent further spread of the potential threat and to contain any malicious activity.
- Terminate any suspicious processes associated with the masquerading executable files to halt any ongoing malicious actions.
- Quarantine the identified files with multiple extensions to prevent execution and further analysis.
- Conduct a thorough scan of the affected system using updated antivirus or endpoint detection and response (EDR) tools to identify and remove any additional threats.
- Review and restore any altered system configurations or files to their original state to ensure system integrity.
- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if additional systems are affected.
- Implement enhanced monitoring and logging for similar file creation activities to improve detection and response capabilities for future incidents."""
risk_score = 47
rule_id = "8b2b3a62-a598-4293-bc14-3d5fa22bb98f"
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Defense Evasion",
    "Data Source: Elastic Endgame",
    "Data Source: Elastic Defend",
    "Data Source: Sysmon",
    "Data Source: Microsoft Defender XDR",
    "Data Source: SentinelOne",
    "Resources: Investigation Guide",
    "Data Source: Crowdstrike",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
file where host.os.type == "windows" and event.type == "creation" and file.extension : "exe" and
  file.name regex~ """.*\.(vbs|vbe|bat|js|cmd|wsh|ps1|pdf|docx?|xlsx?|pptx?|txt|rtf|gif|jpg|png|bmp|hta|txt|img|iso)\.exe""" and
  not (
      process.executable : (
          "?:\\Windows\\System32\\msiexec.exe",
          "\\Device\\HarddiskVolume*\\Windows\\System32\\msiexec.exe",
          "*\\Users\\*\\QGIS_SCCM\\Files\\QGIS-OSGeo4W-*-Setup-x86_64.exe"
      ) and
      file.path : ("?:\\Program Files\\QGIS *\\apps\\grass\\*.exe", "\\Device\\HarddiskVolume*\\Program Files\\QGIS *\\apps\\grass\\*.exe")
  ) and 
  not process.executable : 
                             ("C:\\Program Files\\dotnet\\dotnet.exe", 
                              "C:\\Program Files\\Microsoft Visual Studio\\*.exe",
                              "\\Device\\HarddiskVolume*\\Program Files\\dotnet\\dotnet.exe", 
                              "\\Device\\HarddiskVolume*\\Program Files\\Microsoft Visual Studio\\*.exe")
'''

setup = """## Setup

This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.

Setup instructions: https://ela.st/install-elastic-defend

### Additional data sources

This rule also supports the following third-party data sources. For setup instructions, refer to the links below:

- [CrowdStrike](https://ela.st/crowdstrike-integration)
- [Microsoft Defender XDR](https://ela.st/m365-defender)
- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
- [Sysmon Event ID 11 - File Create](https://ela.st/sysmon-event-11-setup)
"""


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1036"
name = "Masquerading"
reference = "https://attack.mitre.org/techniques/T1036/"
[[rule.threat.technique.subtechnique]]
id = "T1036.007"
name = "Double File Extension"
reference = "https://attack.mitre.org/techniques/T1036/007/"



[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1204"
name = "User Execution"
reference = "https://attack.mitre.org/techniques/T1204/"
[[rule.threat.technique.subtechnique]]
id = "T1204.002"
name = "Malicious File"
reference = "https://attack.mitre.org/techniques/T1204/002/"



[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[metadata]
creation_date = "2020/09/23"
integration = ["gcp"]
maturity = "production"
updated_date = "2026/04/10"

[rule]
author = ["Elastic"]
description = """
Identifies the creation of a topic in Google Cloud Platform (GCP). In GCP, the publisher-subscriber relationship
(Pub/Sub) is an asynchronous messaging service that decouples event-producing and event-processing services. A topic is
used to forward messages from publishers to subscribers.
"""
false_positives = [
    """
    Topic creations may be done by a system or network administrator. Verify whether the user email, resource name,
    and/or hostname should be making changes in your environment. Topic creations by unfamiliar users or hosts should be
    investigated. If known behavior is causing false positives, it can be exempted from the rule.
    """,
]
index = ["filebeat-*", "logs-gcp*"]
language = "kuery"
license = "Elastic License v2"
name = "GCP Pub/Sub Topic Creation"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating GCP Pub/Sub Topic Creation

Google Cloud Pub/Sub is a messaging service that enables asynchronous communication between independent applications. It uses topics to route messages from publishers to subscribers. Adversaries might exploit this by creating unauthorized topics to exfiltrate data or disrupt services. The detection rule monitors successful topic creation events, helping identify potential misuse by flagging unexpected or suspicious activity.

### Possible investigation steps

- Review the event details to confirm the presence of the event.action field with the value google.pubsub.v*.Publisher.CreateTopic and ensure the event.outcome is success.
- Identify the user or service account associated with the topic creation by examining the actor information in the event logs.
- Check the project and resource details to determine the context and environment where the topic was created, including the project ID and resource name.
- Investigate the purpose and necessity of the newly created topic by consulting with relevant stakeholders or reviewing documentation related to the project.
- Analyze historical logs to identify any unusual patterns or anomalies in topic creation activities by the same user or within the same project.
- Assess the permissions and roles assigned to the user or service account to ensure they align with the principle of least privilege.
- If suspicious activity is confirmed, consider implementing additional monitoring or access controls to prevent unauthorized topic creation in the future.

### False positive analysis

- Routine topic creation by automated processes or scripts can trigger false positives. Identify and document these processes to create exceptions in the monitoring system.
- Development and testing environments often involve frequent topic creation. Exclude these environments from alerts by using environment-specific tags or labels.
- Scheduled maintenance or updates by cloud administrators may result in legitimate topic creation. Coordinate with the operations team to whitelist these activities during known maintenance windows.
- Third-party integrations or services that rely on Pub/Sub for communication might create topics as part of their normal operation. Review and approve these integrations to prevent unnecessary alerts.
- Internal applications with dynamic topic creation as part of their workflow should be assessed and, if deemed non-threatening, added to an exception list to reduce noise.

### Response and remediation

- Immediately review the audit logs to confirm the unauthorized creation of the Pub/Sub topic and identify the user or service account responsible for the action.
- Revoke or limit permissions for the identified user or service account to prevent further unauthorized actions, ensuring that only necessary permissions are granted.
- Delete the unauthorized Pub/Sub topic to prevent any potential data exfiltration or disruption of services.
- Conduct a thorough review of other Pub/Sub topics and related resources to ensure no additional unauthorized topics have been created.
- Notify the security team and relevant stakeholders about the incident for further investigation and to assess potential impacts on the organization.
- Implement additional monitoring and alerting for Pub/Sub topic creation events to detect and respond to similar threats more quickly in the future.
- Consider enabling organization-wide policies that restrict who can create Pub/Sub topics to reduce the risk of unauthorized actions.

## Setup

The GCP Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
references = ["https://cloud.google.com/pubsub/docs/admin"]
risk_score = 21
rule_id = "a10d3d9d-0f65-48f1-8b25-af175e2594f5"
severity = "low"
tags = [
    "Domain: Cloud",
    "Data Source: GCP",
    "Data Source: Google Cloud Platform",
    "Use Case: Log Auditing",
    "Tactic: Collection",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset:gcp.audit and event.action:google.pubsub.v*.Publisher.CreateTopic and event.outcome:success
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1530"
name = "Data from Cloud Storage"
reference = "https://attack.mitre.org/techniques/T1530/"

[rule.threat.tactic]
id = "TA0009"
name = "Collection"
reference = "https://attack.mitre.org/tactics/TA0009/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1651"
name = "Cloud Administration Command"
reference = "https://attack.mitre.org/techniques/T1651/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[rule]
description = """
Identifies the execution of Windows utilities to tamper with system recovery settings. Adversaries may delete or remove
built-in operating system data and turn off services designed to aid in the recovery of a corrupted system and prevent
recovery.
"""
id = "d3588fad-43ae-4f2d-badd-15a27df72133"
license = "Elastic License v2"
name = "Inhibit System Recovery via Windows Command Shell"
os_list = ["windows"]
version = "1.0.34"

query = '''
sequence with maxspan=1m
  [process where event.action == "start" and process.name : "cmd.exe" and
    not process.parent.executable : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe") and
    not (process.args : "\\\\*\\SysVol\\*\\Policies\\{*}\\*" and process.parent.executable : "?:\\Windows\\System32\\gpscript.exe") and
    not process.command_line : ("*\\\\*\\*.cmd*", "*\\\\*\\*.bat*") and 
    not descendant of [process where event.action == "start" and process.executable : "?:\\Windows\\System32\\gpscript.exe"] and
    not (process.parent.executable : "?:\\Windows\\System32\\wbem\\WmiPrvSE.exe" and
         user.id == "S-1-5-18" and process.args : "BOOTSTATUSPOLICY") and
    not (user.id == "S-1-5-18" and process.parent.executable : ("C:\\$VcmsTemp$\\VcmsPush.exe", "C:\\windows\\ctsrsvc.exe"))
  ] by process.entity_id
  [process where event.action == "start" and
    (
     (process.pe.original_file_name : "wmic.exe" and process.command_line : "*shadowcopy*" and process.command_line : "*delete*") or
     (process.pe.original_file_name : "vssadmin.exe" and process.command_line : "*shadows*" and process.command_line : ("*delete*", "*resize*401*")) or
     (process.pe.original_file_name : "bcdedit.exe" and process.command_line : ("*bootstatuspolicy*", "*recoveryenabled*")) or
     (process.pe.original_file_name : "wbadmin.exe" and process.command_line : ("*catalog*", "*systemstatebackup*") and process.command_line : "*delete*")
    ) and
    /* noisy FP patterns */
    not (process.name : "bcdedit.exe" and process.args : "DisplayAllFailures") and
    not (process.name : "wbadmin.exe" and process.args : "-keepVersions*") and
    not (process.name : "bcdedit.exe" and process.command_line: "*recoveryenabled*yes*") and
    /* granular deletion of a shadowcopy by unique ID often seen in legit deletion */
    not (process.name : "vssadmin.exe" and process.command_line : "*/shadow=*")
  ] by process.parent.entity_id
'''

min_endpoint_version = "7.15.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1047"
name = "Windows Management Instrumentation"
reference = "https://attack.mitre.org/techniques/T1047/"

[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.003"
name = "Windows Command Shell"
reference = "https://attack.mitre.org/techniques/T1059/003/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1490"
name = "Inhibit System Recovery"
reference = "https://attack.mitre.org/techniques/T1490/"


[threat.tactic]
id = "TA0040"
name = "Impact"
reference = "https://attack.mitre.org/tactics/TA0040/"

[internal]
min_endpoint_version = "7.15.0"

[metadata]
creation_date = "2023/03/02"
integration = ["endpoint", "m365_defender"]
maturity = "production"
updated_date = "2026/05/12"

[transform]
[[transform.osquery]]
label = "Osquery - Retrieve DNS Cache"
query = "SELECT * FROM dns_cache"

[[transform.osquery]]
label = "Osquery - Retrieve All Services"
query = "SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"

[[transform.osquery]]
label = "Osquery - Retrieve Services Running on User Accounts"
query = """
SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE
NOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR
user_account == null)
"""

[[transform.osquery]]
label = "Osquery - Retrieve Service Unsigned Executables with Virustotal Link"
query = """
SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,
services.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =
authenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'
"""


[rule]
author = ["Elastic"]
description = "Identifies access attempts to the LSASS handle, which may indicate an attempt to dump credentials from LSASS memory."
from = "now-30m"
interval = "15m"
language = "esql"
license = "Elastic License v2"
name = "LSASS Process Access via Windows API"
note = """## Triage and analysis

### Investigating LSASS Process Access via Windows API

The Local Security Authority Subsystem Service (LSASS) is a critical Windows component responsible for managing user authentication and security policies. Adversaries may attempt to access the LSASS handle to dump credentials from its memory, which can be used for lateral movement and privilege escalation.

This rule identifies attempts to access LSASS by monitoring for specific API calls (OpenProcess, OpenThread) targeting the "lsass.exe" process.

> **Note**:
> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/current/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.

### Possible investigation steps

- Investigate other alerts associated with the user/host during the past 48 hours.
- Investigate the process execution chain (parent process tree) of the process that accessed the LSASS handle.
  - Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
  - Determine the first time the process executable was seen in the environment and if this behavior happened in the past.
  - Validate the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.
  - Investigate any abnormal behavior by the subject process, such as network connections, DLLs loaded, registry or file modifications, and any spawned child processes.
- Assess the access rights (`process.Ext.api.parameters.desired_access`field) requested by the process. This [Microsoft documentation](https://learn.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights) may be useful to help the interpretation.
- If there are traces of LSASS memory being successfully dumped, investigate potentially compromised accounts. Analysts can do this by searching for login events (e.g., 4624) to the target host.
- Examine the host for derived artifacts that indicate suspicious activities:
  - Analyze the executables of the processes using a private sandboxed analysis system.
  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
    - Attempts to contact external domains and addresses.
      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process's `process.entity_id`.
      - Examine the DNS cache for suspicious or anomalous entries.
        - $osquery_0
    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
    - Examine the host services for suspicious or anomalous entries.
      - $osquery_1
      - $osquery_2
      - $osquery_3
  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.


### False positive analysis

- If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination of `process.executable`, `process.code_signature.subject_name` and `process.Ext.api.parameters.desired_access_numeric` conditions.

### Related Rules

- Suspicious Lsass Process Access - 128468bf-cab1-4637-99ea-fdf3780a4609
- Potential Credential Access via DuplicateHandle in LSASS - 02a4576a-7480-4284-9327-548a806b5e48
- LSASS Memory Dump Handle Access - 208dbe77-01ed-4954-8d44-1e5751cb20de

### Response and Remediation

- Initiate the incident response process based on the outcome of the triage.
  - If malicious activity is confirmed, perform a broader investigation to identify the scope of the compromise and determine the appropriate remediation steps.
- Isolate the involved host to prevent further post-compromise behavior.
- If the triage identified malware, search the environment for additional compromised hosts.
  - Implement temporary network rules, procedures, and segmentation to contain the malware.
  - Stop suspicious processes.
  - Immediately block the identified indicators of compromise (IoCs).
  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
- Remove and block malicious artifacts identified during triage.
- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
- Reimage the host operating system or restore the compromised files to clean versions.
- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
"""

setup = """## Setup

This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.

Setup instructions: https://ela.st/install-elastic-defend

### Additional data sources

This rule also supports the following third-party data sources. For setup instructions, refer to the links below:

- [Microsoft Defender XDR](https://ela.st/m365-defender)
"""

references = ["https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md"]
risk_score = 47
rule_id = "ff4599cb-409f-4910-a239-52e4e6f532ff"
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Credential Access",
    "Tactic: Execution",
    "Data Source: Elastic Defend",
    "Data Source: Microsoft Defender XDR",
    "Resources: Investigation Guide"
]
timestamp_override = "event.ingested"
type = "esql"

query = '''
from logs-endpoint.events.api-*, logs-m365_defender.event-* metadata _id, _version, _index

| where event.category == "api" and host.os.family == "windows" and
   process.Ext.api.name in ("OpenProcess", "OpenThread", "ReadProcessMemory") and
   Target.process.name == "lsass.exe" and process.executable is not null and

   // Noisy patterns
   not to_lower(process.executable) like """c:\\program files\\*.exe""" and
   not to_lower(process.executable) like """c:\\program files (x86)\\*.exe""" and
   not to_lower(process.executable) like """c:\\programdata\\microsoft\\windows defender\\platform\\msmpeng.exe""" and
   not to_lower(process.executable) like """c:\\programdata\\microsoft\\windows defender\\platform\\*\\msmpeng.exe"""

 /* normalize process paths to reduce known random patterns in process.executable */
| eval Esql.process_path = replace(process.executable, """([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}|ns[a-z][A-Z0-9]{3,4}\.tmp|DX[A-Z0-9]{3,4}\.tmp|7z[A-Z0-9]{3,5}\.tmp|[0-9\.\-\_]{3,})""", "")

// Group by process path
| stats Esql.access_count = count(*),
        Esql.count_distinct_hosts = count_distinct(host.id),
        Esql.host_id_values = VALUES(host.id),
        Esql.host_name_values = VALUES(host.name),
        Esql.user_name_values = VALUES(user.name),
        Esql.process_pid_values = VALUES(process.entity_id),
        Esql.process_executable_values = VALUES(process.executable),
        Esql.data_stream_namespace.values = VALUES(data_stream.namespace),
        Esql.user_name_values = VALUES(user.name) by Esql.process_path

// Limit to rare instances limited to 1 unique host
| where Esql.count_distinct_hosts == 1 and Esql.access_count <= 3

// Extract the single host ID and process into their corresponding ECS fields for alerts exclusion
| eval host.id = mv_min(Esql.host_id_values),
       host.name = mv_min(Esql.host_name_values),
       process.executable = mv_min(Esql.process_executable_values), 
       user.name = mv_min(Esql.user_name_values)

// Add the new field to the keep statement
| keep Esql.*, host.id, host.name, user.name, process.executable
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1003"
name = "OS Credential Dumping"
reference = "https://attack.mitre.org/techniques/T1003/"
[[rule.threat.technique.subtechnique]]
id = "T1003.001"
name = "LSASS Memory"
reference = "https://attack.mitre.org/techniques/T1003/001/"



[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1106"
name = "Native API"
reference = "https://attack.mitre.org/techniques/T1106/"


[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[metadata]
creation_date = "2025/02/19"
integration = ["o365"]
maturity = "production"
updated_date = "2026/09/09"

[rule]
author = ["Elastic"]
description = """
Identifies when an excessive number of files are downloaded from OneDrive or SharePoint by an authorized user or application in a short period of time. This may indicate a potential data exfiltration event, especially if the downloads are performed using OAuth authentication which could suggest an OAuth phishing attack such as Device Code Authentication phishing.
"""
false_positives = [
    """
    Legitimate users may download files from OneDrive using OAuth authentication. Ensure that the downloads are
    authorized and the user is known before taking action.
    """,
]
from = "now-9m"
interval = "8m"
language = "esql"
license = "Elastic License v2"
name = "M365 OneDrive/SharePoint Excessive File Downloads"
note = """## Triage and Analysis

### Investigating M365 OneDrive/SharePoint Excessive File Downloads

This rule detects an excessive number of files downloaded from OneDrive using OAuth authentication. Threat actors may use OAuth phishing attacks, such as **Device Code Authentication phishing**, to obtain valid access tokens and perform unauthorized data exfiltration. This method allows adversaries to bypass traditional authentication mechanisms, making it a stealthy and effective technique.

This rule leverages ESQL aggregations which limit the field values available in the alert document. To investigate further, it is recommended to identify the original documents ingested.

#### Possible Investigation Steps

- Review the user ID field to identify the user who performed the downloads. Check if this user typically downloads large amounts of data from OneDrive.
- Correlate user ID with Entra Sign-In logs to verify the authentication method used and determine if it was expected for this user.
- Review the authentication method used. If OAuth authentication was used, investigate whether it was expected for this user.
- Identify the client application used for authentication. Determine if it is a legitimate enterprise-approved app or an unauthorized third-party application.
- Check the number of unique files downloaded. If a user downloads a high volume of unique files in a short period, it may indicate data exfiltration.
- Analyze the file types and directories accessed to determine if sensitive or confidential data was involved.
- Investigate the source IP address and geolocation of the download activity. If it originates from an unusual or anonymized location, further scrutiny is needed.
- Review other recent activities from the same user, such as file access, sharing, or permission changes, that may indicate further compromise.
- Check for signs of session persistence using OAuth. If Azure sign-in logs are correlated where `authentication_protocol` or `originalTransferMethod` field shows `deviceCode`, the session was established through device code authentication.
- Look for multiple authentication attempts from different devices or locations within a short timeframe, which could indicate unauthorized access.
- Investigate if other OAuth-related anomalies exist, such as consent grants for unfamiliar applications or unexpected refresh token activity.
- Review the `file.directory` value from the original documents to identify the specific folders or paths where the files were downloaded.
- Examine if the downloaded files are from Sharepoint or OneDrive by checking the `event.code` field.
- Review the incoming token type to determine how authentication occurred. If the `token.id` field is populated, it indicates that OAuth authentication was used, which may suggest an OAuth phishing attack.

### False Positive Analysis

- Verify if the user regularly downloads large batches of files as part of their job function.
- Determine if the downloads were triggered by an authorized automated process, such as a data backup or synchronization tool.
- Confirm if the detected OAuth application is approved for enterprise use and aligns with expected usage patterns.

### Response and Remediation

- If unauthorized activity is confirmed, revoke the OAuth token used and terminate active OneDrive sessions.
- Reset the affected user's password and require reauthentication to prevent continued unauthorized access.
- Restrict OAuth app permissions and enforce conditional access policies to limit authentication to trusted devices and applications.
- Monitor for additional signs of compromise, such as unusual email forwarding rules, external sharing of OneDrive files, or privilege escalation attempts.
- Educate users on OAuth phishing risks and encourage the use of **Microsoft Defender for Office 365 Safe Links** to mitigate credential-based attacks.
- Enable continuous monitoring for OAuth authentication anomalies using **Microsoft Entra ID sign-in logs** and security tools.
"""
references = [
    "https://www.volexity.com/blog/2025/02/13/multiple-russian-threat-actors-targeting-microsoft-device-code-authentication/",
    "https://cloud.google.com/blog/topics/threat-intelligence/expansion-shinyhunters-saas-data-theft",
]
risk_score = 47
rule_id = "0e524fa6-eed3-11ef-82b4-f661ea17fbce"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Domain: SaaS",
    "Domain: Storage",
    "Data Source: Microsoft 365",
    "Data Source: Microsoft 365 Audit Logs",
    "Data Source: SharePoint",
    "Data Source: OneDrive",
    "Use Case: Threat Detection",
    "Tactic: Collection",
    "Tactic: Exfiltration",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "esql"

query = '''
from logs-o365.audit-* metadata _id, _version, _index
| where
    data_stream.dataset == "o365.audit" and
    event.provider == "OneDrive" and
    event.action == "FileDownloaded" and
    event.outcome == "success"
    and (user.id is not null and o365.audit.ApplicationId is not null)
    and o365.audit.ApplicationId not in (
        "08e18876-6177-487e-b8b5-cf950c1e598c", // SharePoint Online Web Client Extensibility
        "fb8d773d-7ef8-4ec0-a117-179f88add510", // Enterprise Copilot Platform
        "d3590ed6-52b3-4102-aeff-aad2292ab01c", // Microsoft Office
        "7ab7862c-4c57-491e-8a45-d52a7e023983" // App Service
    )
| eval session.id = coalesce(o365.audit.AppAccessContext.AADSessionId, session.id, null)
| where session.id is not null
| eval Esql.time_window_date_trunc = date_trunc(3 minutes, @timestamp)
// file.size is dynamically mapped in o365.audit and can be keyword or long across backing indices
| eval Esql.file_size_bytes = to_long(file.size)
| stats
    Esql.file_directory_values = values(file.directory),
    Esql.file_extension_values = values(file.extension),
    Esql.application_name_values = values(application.name),
    Esql.file_name_count_distinct = count_distinct(file.name),
    Esql.total_file_size_mb = round((mv_sum(values(Esql.file_size_bytes))) / 1048576.0, 2),
    Esql.o365_audit_Site_values = values(o365.audit.Site),
    Esql.o365_audit_SiteUrl_values = values(o365.audit.SiteUrl),
    Esql.user_domain_values = values(user.domain),
    Esql.token_id_values = values(token.id),
    Esql.event_code_values = values(event.code),
    Esql.event_provider_values = values(event.provider),
    Esql.auth_type_values = values(o365.audit.AuthenticationType),
    Esql.is_managed_device_values = values(o365.audit.IsManagedDevice),
    Esql.platform_values = values(o365.audit.Platform),
    Esql.user_agent_values = values(user_agent.name),
    Esql.source_asn_org_values = values(source.as.organization.name),
    Esql.geo_country_values = values(source.geo.country_name),
    Esql.event_count = count(*)
    by
    Esql.time_window_date_trunc,
    user.id,
    session.id,
    source.ip,
    o365.audit.ApplicationId
| where Esql.file_name_count_distinct >= 25
| keep
    Esql.*,
    user.id,
    source.ip,
    o365.audit.ApplicationId,
    session.id
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1530"
name = "Data from Cloud Storage"
reference = "https://attack.mitre.org/techniques/T1530/"

[rule.threat.tactic]
id = "TA0009"
name = "Collection"
reference = "https://attack.mitre.org/tactics/TA0009/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1020"
name = "Automated Exfiltration"
reference = "https://attack.mitre.org/techniques/T1020/"

[[rule.threat.technique]]
id = "T1567"
name = "Exfiltration Over Web Service"
reference = "https://attack.mitre.org/techniques/T1567/"

[rule.threat.tactic]
id = "TA0010"
name = "Exfiltration"
reference = "https://attack.mitre.org/tactics/TA0010/"