Elastic rules: 1p

[metadata]
creation_date = "2020/07/16"
integration = ["network_traffic", "panw", "zeek", "corelight"]
maturity = "production"
updated_date = "2026/09/03"

[rule]
author = ["Elastic"]
description = """
Specially crafted DNS requests can manipulate a known overflow vulnerability in some Windows DNS servers, resulting in
Remote Code Execution (RCE) or a Denial of Service (DoS) from crashing the service.
"""
index = ["logs-network_traffic.*", "logs-panw.panos*", "logs-zeek.*", "logs-corelight.*"]
language = "kuery"
license = "Elastic License v2"
name = "Abnormally Large DNS Response"
note = """## Triage and analysis

### Investigating Abnormally Large DNS Response

Detection alerts from this rule indicate possible anomalous activity around large byte DNS responses from a Windows DNS server. This detection rule was created based on activity represented in exploitation of vulnerability (CVE-2020-1350) also known as [SigRed](https://www.elastic.co/blog/detection-rules-for-sigred-vulnerability) during July 2020.

### Possible investigation steps

- This specific rule is sourced from network log activity such as DNS or network level data. It's important to validate the source of the incoming traffic and determine if this activity has been observed previously within an environment.
- Activity can be further investigated and validated by reviewing any associated Intrusion Detection Signatures (IDS) alerts.
- Further examination can include a review of the `dns.question_type` network fieldset with a protocol analyzer, such as Zeek, Packetbeat, or Suricata, for `SIG` or `RRSIG` data.
- Validate the patch level and OS of the targeted DNS server to validate the observed activity was not large-scale internet vulnerability scanning.
- Validate that the source of the network activity was not from an authorized vulnerability scan or compromise assessment.

### False positive analysis

- Based on this rule, which looks for a threshold of 65k bytes, activity below this value is expected to be legitimate. In packet capture files received by the [SANS Internet Storm Center](https://isc.sans.edu/forums/diary/PATCH+NOW+SIGRed+CVE20201350+Microsoft+DNS+Server+Vulnerability/26356/), byte responses in observed attacks were all greater than 65k bytes.
- This activity can be triggered by compliance/vulnerability scanning or compromise assessment; it's important to determine the source of the activity and potentially allowlist the source host.
- Network security devices such as PAN-OS firewalls, Fortinet, and NetFlow exporters, as well as Zeek/Corelight connection summary records, record `destination.bytes` as the total bytes across an entire session rather than a single DNS response. Long-lived flow or connection records (`event.duration` > 60 seconds) are excluded to reduce this noise. Duration is used rather than packet count because a genuine SigRed TCP exchange completes in seconds and cannot be made to exceed 60 seconds by an attacker continuing to use the connection.

### Related rules

- Unusual Child Process of dns.exe - 8c37dc0e-e3ac-4c97-8aa0-cf6a9122de45
- Unusual File Modification by dns.exe - c7ce36c0-32ff-4f9a-bfc2-dcb242bf99f9

### Response and remediation

- Initiate the incident response process based on the outcome of the triage.
- Ensure that you have deployed the latest Microsoft [Security Update](https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1350) (Monthly Rollup or Security Only) and restarted the patched machines. If unable to patch immediately, Microsoft [released](https://support.microsoft.com/en-us/help/4569509/windows-dns-server-remote-code-execution-vulnerability) a registry-based workaround that doesn’t require a restart. This can be used as a temporary solution before the patch is applied.
- Maintain backups of your critical systems to aid in quick recovery.
- Perform routine vulnerability scans of your systems, monitor [CISA advisories](https://us-cert.cisa.gov/ncas/current-activity) and patch identified vulnerabilities.
- If you observe a true positive, implement a remediation plan and monitor host-based artifacts for additional post-exploitation behavior.
"""
references = [
    "https://research.checkpoint.com/2020/resolving-your-way-into-domain-admin-exploiting-a-17-year-old-bug-in-windows-dns-servers/",
    "https://msrc-blog.microsoft.com/2020/07/14/july-2020-security-update-cve-2020-1350-vulnerability-in-windows-domain-name-system-dns-server/",
    "https://github.com/maxpl0it/CVE-2020-1350-DoS",
    "https://www.elastic.co/security-labs/detection-rules-for-sigred-vulnerability",
]
risk_score = 47
rule_id = "11013227-0301-4a8c-b150-4db924484475"
severity = "medium"
tags = [
    "Use Case: Threat Detection",
    "Tactic: Lateral Movement",
    "Tactic: Impact",
    "Resources: Investigation Guide",
    "Use Case: Vulnerability",
    "Data Source: Corelight",
    "Data Source: PAN-OS",
    "Data Source: Network Traffic",
    "Data Source: Zeek",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
((event.category:(network or network_traffic) and destination.port:53) 
      or network.protocol:"dns" 
      or data_stream.dataset:(network_traffic.dns or zeek.dns)
      or (event.module:corelight and event.dataset:dns))
    and destination.bytes >= 65000
    and event.type:("allowed" or "end" or "protocol" or "start")
and not (
  event.duration > 60000000000
  and (
    event.action:("flow_terminated" or "network_flow")
    or data_stream.dataset:zeek.connection
    or (event.module:corelight and event.dataset:conn)
  )
)
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1210"
name = "Exploitation of Remote Services"
reference = "https://attack.mitre.org/techniques/T1210/"

[rule.threat.tactic]
id = "TA0008"
name = "Lateral Movement"
reference = "https://attack.mitre.org/tactics/TA0008/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1499"
name = "Endpoint Denial of Service"
reference = "https://attack.mitre.org/techniques/T1499/"

[[rule.threat.technique.subtechnique]]
id = "T1499.004"
name = "Application or System Exploitation"
reference = "https://attack.mitre.org/techniques/T1499/004/"

[rule.threat.tactic]
id = "TA0040"
name = "Impact"
reference = "https://attack.mitre.org/tactics/TA0040/"

[rule.alert_suppression]
group_by = ["source.ip", "destination.ip"]
missing_fields_strategy = "doNotSuppress"

[rule.alert_suppression.duration]
unit = "h"
value = 1

[rule]
description = "Identifies API calls via timeSetEvent callback function. This may indicate an attempt to proxy API call via callback."
id = "2842dbe3-4ce7-4e4d-b18b-c5eefdaf1fae"
license = "Elastic License v2"
name = "API Call via Timer Callback Event"
os_list = ["windows"]
reference = ["https://learn.microsoft.com/en-us/previous-versions/dd757634(v=vs.85)"]
version = "1.0.4"

query = '''
api where
  process.Ext.api.name in ("VirtualAlloc", "VirtualProtect", "WriteProcessMemory", "VirtualProtectEx", "VirtualAllocEx",
                             "MapViewOfFile", "MapViewOfFile2", "SetThreadContext", "SuspendThread", "ReadProcessMemory", "connect") and
  process.thread.Ext.call_stack_final_user_module.name == "winmm.dll" and
  _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info: "*winmm.dll!timeSetEvent*") and
  not _arraysearch(process.thread.Ext.call_stack, $entry,
                   $entry.symbol_info: ("*winmm.dll!mciExecute*", "*winmm.dll!timeGetTime*", "*winmm.dll!PlaySoundW*", "*winmm.dll+0x*", "*ntdll.dll!RtlInitializeExceptionChain*")) and
  not (process.executable : "C:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\bin\\WakeOnLan.exe" and
       process.parent.executable : "C:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\bin\\dcwol.exe") and
  not (process.Ext.api.name == "connect" and
       process.executable : "C:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\bin\\meaap.exe" and
       process.parent.executable : "C:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\dcconfig.exe")
'''

min_endpoint_version = "8.10.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"

[rule]
description = """
Identifies the creation of a hidden shared object (.so) file. Users can mark specific files as hidden simply by putting
a "." as the first character in the file or folder name. Adversaries can use this to their advantage to hide files and
folders on the system for persistence and defense evasion.
"""
id = "61b20f0f-d342-4b32-bc77-195037b0dc82"
license = "Elastic License v2"
name = "Creation of Hidden Shared Object File"
os_list = ["linux"]
version = "1.0.5"

query = '''
file where event.type == "creation" and file.name like~ ".*.so" and (
  process.name in (
    "sudo", "link", "find", "xargs", "install", "coreutils", "gzip", "bzip2", "mv", "ln", "busybox",
    "bash", "zsh", "sh", "tcsh", "csh", "ksh", "fish", "mksh", "touch", "curl", "wget"
  ) or
  process.name like ".*" or
  process.executable like (
    "./*", "/dev/shm/*", "/tmp/*", "/var/tmp/*", "/run/*", "/var/run/*", "/boot/*", "/sys/*",
    "/lost+found/*", "/proc/*", "/var/mail/*", "/var/www/*", "/root/*", "/home/*"
  )
) and
not (
  process.executable like (
    "/home/*/.opencode/bin/opencode", "/home/*/.nvm/*/bin/kilo", "/home/*/.vscode-server/*/server/node",
    "/home/*/.local/share/containers/storage/overlay/*/opencode", "./usr/bin/podman",
    "/usr/local/share/npm-global/lib/node_modules/opencode-ai/bin/.opencode", "/home/*/.aimee-code/bin/opencode",
    "/root/.opencode/bin/opencode", "/home/*/.opencode/bin/.nfs*",
    "/home/*/.vscode/extensions/kilocode.kilo-code-*/bin/kilo",
    "/home/*/.vscode-server/extensions/kilocode.kilo-code-*/bin/kilo",
    "/root/.vscode-server/extensions/kilocode.kilo-code-*/bin/kilo"
  ) or
  file.name like ("._*", ".*-00000000.so") or
  file.path like ("/home/*/.local/share/containers/storage/overlay/*", "/scratch/user/*/ZEBULON/CODE/.files-libLocal.so") or
  process.executable like (
    "*/node_modules/opencode-ai/bin/opencode*",
    "*/.opencode/bin/opencode*",
    "*/node_modules/@kilocode/cli/bin/.kilo"
  )
)
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1129"
name = "Shared Modules"
reference = "https://attack.mitre.org/techniques/T1129/"


[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1564"
name = "Hide Artifacts"
reference = "https://attack.mitre.org/techniques/T1564/"
[[threat.technique.subtechnique]]
id = "T1564.001"
name = "Hidden Files and Directories"
reference = "https://attack.mitre.org/techniques/T1564/001/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.15.0"

[rule]
description = "Identifies a list of suspicious LDAP queries often used by reconnaissance tools to enumerate domain computers."
id = "0380d8b9-e643-40b9-a763-67ab52021bb4"
license = "Elastic License v2"
name = "Domain Computers Enumeration via LDAP Search"
os_list = ["windows"]
reference = ["https://attack.mitre.org/techniques/T1087/002/"]
version = "1.0.4"

query = '''
api where process.Ext.api.name == "ldap_search" and user.id != "S-1-5-18" and
 not process.executable :
             ("?:\\Program Files\\Azure Advanced Threat Protection Sensor\\*\\Microsoft.Tri.Sensor.exe",
              "?:\\Windows\\ADFS\\Microsoft.IdentityServer.ServiceHost.exe") and
 process.Ext.api.parameters.search_filter : (
  "(&(objectCategory=computer)(operatingSystem=?server?))",
  "(&(sAMAccountType=805306369)(dnshostname=?))",
  "(&(objectCategory=computer)(lastLogon>=*)(operatingSystem=*windows*))",
  "(&(objectCategory=computer)(lastLogonTimestamp<=133000000000000000))",
  "(&(objectCategory=computer)(userAccountControl:1.2.840.113556.1.4.803:=524288))",
  "(&(objectCategory=Computer)(userAccountControl:1.2.840.113556.1.4.803:=8192))",
  "*(&(objectclass=computer)(userAccountControl:1.2.840.113556.1.4.803:=8192))*",
  "(objectCategory=computer)(userAccountControl:1.2.840.113556.1.4.803:=8192)",
  "(&(objectclass=computer)(userAccountControl&8192))",
  "(&(&(&(&(samAccountType=805306369)(!(primaryGroupId=516)))(objectCategory=computer)(operatingSystem=Windows Server?))))",
  "(&(objectCategory=computer)(operatingSystem=?server?)(!(userAccountControl:1.2.840.113556.1.4.803:=8192)))"
 ) and 
 not (process.code_signature.subject_name in ("Specops Software Inc.", "Azul Systems, Inc.") and process.code_signature.trusted == true)
'''

min_endpoint_version = "9.1.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1082"
name = "System Information Discovery"
reference = "https://attack.mitre.org/techniques/T1082/"

[[threat.technique]]
id = "T1087"
name = "Account Discovery"
reference = "https://attack.mitre.org/techniques/T1087/"
[[threat.technique.subtechnique]]
id = "T1087.002"
name = "Domain Account"
reference = "https://attack.mitre.org/techniques/T1087/002/"



[threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"

[internal]
min_endpoint_version = "9.1.0"

[metadata]
creation_date = "2026/05/20"
integration = ["azure"]
maturity = "production"
updated_date = "2026/06/05"

[rule]
author = ["Elastic", "descambiado"]
description = """
Identifies the creation of a Temporary Access Pass (TAP) for an Entra ID user account. A TAP
is a time-limited passcode that allows passwordless authentication and bypasses existing MFA
requirements, including phishing-resistant methods. An attacker with User Administrator or
Authentication Administrator privileges can issue a TAP for a target account, sign in without
the current password, and register new persistent authentication methods before the TAP expires.
"""
false_positives = [
    """
    Help desk teams issuing TAPs for locked-out users or new employee onboarding workflows. Automated
    identity lifecycle systems that provision TAPs during device enrollment.
    """,
]
from = "now-9m"
index = ["logs-azure.auditlogs-*"]
language = "kuery"
license = "Elastic License v2"
name = "Entra ID Temporary Access Pass Created for User"
note = """## Triage and analysis

### Investigating Entra ID Temporary Access Pass Created for User

A Temporary Access Pass is a time-limited credential that bypasses all existing MFA factors for the
target account. In a steady-state tenant, TAP creation is rare and should be correlated against help
desk records or onboarding workflows.

#### Possible investigation steps

- Identify the administrator who created the TAP (`azure.auditlogs.properties.initiated_by`) and verify
  whether the action was authorized by a help desk ticket or change management record.
- Identify the target account and assess its privilege level -- TAPs issued for Global Administrators,
  Application Administrators, or accounts with high-value data access are highest risk.
- Check for sign-ins by the target account using the TAP credential: look for sign-ins where
  `azure.signinlogs.properties.authentication_details` contains "Temporary Access Pass" shortly after
  the TAP creation event.
- If the TAP was used to sign in, review what authentication methods were registered during or after
  the session -- an attacker will use the TAP window to add a persistent authenticator.
- Check whether the creating administrator's account shows anomalous activity in the preceding 24 hours.

### False positive analysis

- TAP creation by your identity team for locked-out users is a legitimate workflow. Confirm via help
  desk ticket correlation.
- New employee onboarding that provisions TAPs as part of passwordless enrollment is expected behavior.

### Response and remediation

- Revoke the TAP immediately if unauthorized: Entra ID > Users > Authentication methods.
- Audit all authentication methods registered by the target account after TAP creation and remove any
  that were not previously present.
- Reset the target account's password and revoke all active sessions.
- Review the creating administrator's recent actions for signs of compromise.
"""
references = [
    "https://learn.microsoft.com/en-us/entra/identity/authentication/howto-authentication-temporary-access-pass",
    "https://dirkjanm.io/lateral-movement-and-hash-dumping-with-temporary-access-passes-microsoft-entra/",
    "https://specterops.io/blog/2023/03/29/id-tap-that-pass/",
]
risk_score = 73
rule_id = "d0088204-675b-4175-bf07-1665da2d4810"
severity = "high"
tags = [
    "Domain: Cloud",
    "Domain: Identity",
    "Data Source: Azure",
    "Data Source: Microsoft Entra ID",
    "Data Source: Microsoft Entra ID Audit Logs",
    "Use Case: Identity and Access Audit",
    "Tactic: Initial Access",
    "Tactic: Lateral Movement",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset: "azure.auditlogs" and
(
    (
        azure.auditlogs.operation_name: "User registered security info" and
        azure.auditlogs.properties.result_reason: "User registered temporary access pass method"
    ) or (
        azure.auditlogs.operation_name: "Create Temporary Access Pass method for user"
    ) or (
        azure.auditlogs.operation_name: "Admin registered security info" and
        azure.auditlogs.properties.target_resources.*.modified_properties.*.display_name: *TemporaryAccessPass*
    )
) and
event.outcome: ("Success" or "success")
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"

[[rule.threat.technique.subtechnique]]
id = "T1078.004"
name = "Cloud Accounts"
reference = "https://attack.mitre.org/techniques/T1078/004/"

[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1550"
name = "Use Alternate Authentication Material"
reference = "https://attack.mitre.org/techniques/T1550/"

[rule.threat.tactic]
id = "TA0008"
name = "Lateral Movement"
reference = "https://attack.mitre.org/tactics/TA0008/"

[rule]
description = """
Adversaries may abuse a double extension or unicode right-to-left override (RTLO or RLO) character (U+202E) or multiple
spaces in the filename as a means of masquerading the true file type. A file name may include a secondary file type
extension that may cause only the first extension to be displayed which maximize user execution likelihood.
"""
id = "ccfca0c7-c975-4735-82bd-954ffbafd00b"
license = "Elastic License v2"
name = "Evasion via File Name Masquerading"
os_list = ["windows"]
reference = ["https://www.pcmag.com/encyclopedia/term/double-extension"]
version = "1.0.31"

query = '''
process where event.action == "start" and
 (
  /* double extension in process.name */
  process.name regex~ """.+(\.|\,|\_|\-)(pdf|doc|docx|xls|xlsx|png|jpg|html|txt|rar|ppt|pptx|htm|GIF)\.(scr|exe|com|pif)""" or

  process.name : ("*   pdf.exe", "*_pdf.exe", "*_PO_N.*PDF.exe") or

  /* multiple spaces */
  process.name regex """.+\s{10,}\.(exe|pif|com|scr)""" or
  process.name : "*                    .exe" or 

  /* fake extension via Unicode Right-To-Left-Override technique */
  process.name : "*\u{202E}*"
 ) and

 /* False Positives */
 not process.hash.sha256 : 
             ("1211cb4a560586d4ffb4b1bfd268a8146318af09587a9d5e33703575d5178e77", 
              "582ae3540ba32e7100fe20c0b01d14d1d85167cdb7ee512f596544d7351a2d5e", 
              "b59ac9390d9026ec3b552ebd6f3438c05aab2880d5e17616c13c5d42b6b34c65",
              "a781c337575da892e6c1b2ac26a6272085a127c554dfd68729deb146eca6b837",
              "96234bb98b3266e49ef74ac7accd4644b709355057d5a34b2966e9fa56aadcf3",
              "38473e19af02cb5e6f386f41238da862df72bbc1d7a1e94d838c4b93d6f56e72",
              "5d62d79f6555d7a7edaf3b175312b326df779f9ae8c893e2182e4159f44c9d34",
              "8d0434610280c8f94a0e9c29e4c33b97804fab4ab6fc29531ba76acebd2f5518",
              "7e59dec861a2a9ad68bd2758407c256dedb233cab225683db677ab2d2fbec258",
              "fbd43f9a3567a19427894e61052d1b46f70b7474357ef50de9dc8749fc950509",
              "96234bb98b3266e49ef74ac7accd4644b709355057d5a34b2966e9fa56aadcf3",
              "0ec0ebc7c71ee139ee29fca1e2447b5cc5ec79cb797deb8b560cb05fee3ca3a6",
              "f4e3e2798fe830eac6990d83f568f6cfbba3a194a7787fe224aa1ba90976eaa7",
              "3abbe0ab12a1baa4c0492c5dba9901f3176f23d35998e8f9a1f753880617523c",
              "13fda552b026d0ecba34fbb488a57dbd29187ebef012874eda115ba5c876dade",
              "3e562ff6f8616c623c82b25a6ab2fff7b2832ec2c53ce5c242d047a525f563ff",
              "d0d177839db17d9f30aebe61594dde7e9e8ab82473f3947892cc88ad58939669") and
 not (process.executable : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe") and process.code_signature.trusted == true) and
 not (process.code_signature.subject_name : ("AVANQUEST SOFTWARE S.A.S", "Jernej Simončič") and process.code_signature.trusted == true) and 
 not process.executable :
             ("?:\\Program Files (x86)\\PlotSoft\\PDFill_PDF_Tools\\PlotSoft_PDF.exe",
              "?:\\Program Files\\Ab Initio\\Ab Initio GDE 4.1.4.0\\Program Files\\ab_zip.exe",
              "C:\\Program Files\\GIMP 3\\lib\\gimp\\3.0\\plug-ins\\file-png\\file-png.exe",
              "C:\\Users\\*\\AppData\\Local\\Programs\\GIMP 3\\lib\\gimp\\3.0\\plug-ins\\file-png\\file-png.exe",
              "\\Device\\Mup\\*\\file-png.exe") and
 not process.parent.executable : ("C:\\Program Files (x86)\\Visionet Systems Inc\\Visionet.DocVu.KofaxExtractionService\\Visionet.DocVu.KofaxExtractionService.exe",
                                  "C:\\Program Files (x86)\\Visionet System Inc\\DocVuOcrService-NPF\\Visionet.DocVu.OCRService.exe")
'''

min_endpoint_version = "7.15.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1204"
name = "User Execution"
reference = "https://attack.mitre.org/techniques/T1204/"
[[threat.technique.subtechnique]]
id = "T1204.002"
name = "Malicious File"
reference = "https://attack.mitre.org/techniques/T1204/002/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1036"
name = "Masquerading"
reference = "https://attack.mitre.org/techniques/T1036/"
[[threat.technique.subtechnique]]
id = "T1036.002"
name = "Right-to-Left Override"
reference = "https://attack.mitre.org/techniques/T1036/002/"

[[threat.technique.subtechnique]]
id = "T1036.007"
name = "Double File Extension"
reference = "https://attack.mitre.org/techniques/T1036/007/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.15.0"

[metadata]
creation_date = "2020/07/06"
integration = ["aws"]
maturity = "production"
updated_date = "2026/08/05"

[rule]
author = ["Nick Jones", "Elastic"]
description = """
An adversary with access to a compromised AWS service such as an EC2 instance, Lambda function, or other service may
attempt to leverage the compromised service to access secrets in AWS Secrets Manager. This rule looks for the first time
a specific user identity has programmatically retrieved a secret value from Secrets Manager using the GetSecretValue
action. This rule assumes that AWS services such as Lambda functions and EC2 instances are setup with IAM role's
assigned that have the necessary permissions to access the secrets in Secrets Manager. An adversary with access to a
compromised AWS service would rely on its' attached role to access the secrets in Secrets Manager.
"""
false_positives = [
    """
    Verify whether the user identity, user agent, and/or hostname should be using GetSecretString API for the specified
    SecretId. If known behavior is causing false positives, it can be exempted from the rule.
    """,
]
from = "now-6m"
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
language = "kuery"
license = "Elastic License v2"
name = "First Time Seen AWS Secret Value Accessed in Secrets Manager"
note = """## Triage and analysis

### Investigating First Time Seen AWS Secret Value Accessed in Secrets Manager

AWS Secrets Manager is a service that enables the replacement of hardcoded credentials in code, including passwords, with an API call to Secrets Manager to retrieve the secret programmatically.

This rule looks for the retrieval of credentials from Secrets Manager using `GetSecretValue` API calls. This is a [New Terms](https://www.elastic.co/guide/en/security/current/rules-ui-create.html#create-new-terms-rule) rule indicating this is the first time a specific user identity has successfuly retrieved a secret value from Secrets Manager.

#### Possible investigation steps

- Identify the account and its role in the environment, and inspect the related policy.
- Identify the applications that should use this account.
- Investigate other alerts associated with the user account during the past 48 hours.
- Investigate abnormal values in the `user_agent.original` field by comparing them with the intended and authorized usage and historical data. Suspicious user agent values include non-SDK, AWS CLI, custom user agents, etc.
- Assess whether this behavior is prevalent in the environment by looking for similar occurrences involving other users.
- Contact the account owner and confirm whether they are aware of this activity.
- Considering the source IP address and geolocation of the user who issued the command:
    - Do they look normal for the calling user?
    - If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts or is the source IP from an EC2 instance that's not under your control?
    - If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles? Are there any other alerts or signs of suspicious activity involving this instance?
- Review IAM permission policies for the user identity and specific secrets accessed.
- Examine the request parameters. These might indicate the source of the program or the nature of its tasks.
- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.

### False positive analysis

- Review `entity.id` values for expected combinations of identity and secret value access. If this is an expected behavior, consider adding exceptions to the rule.
- False positives may occur due to the intended usage of the service. Tuning is needed in order to have higher confidence. Consider adding exceptions — preferably with a combination of user agent and IP address conditions.

### Response and remediation

- Initiate the incident response process based on the outcome of the triage.
- Disable or limit the account during the investigation and response.
- Identify the possible impact of the incident and prioritize accordingly; the following actions can help you gain context:
    - Identify the account role in the cloud environment.
    - Assess the criticality of affected services and servers.
    - Work with your IT team to identify and minimize the impact on users.
    - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
    - Identify any regulatory or legal ramifications related to this activity.
- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Rotate secrets or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
- Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.
- Consider enabling multi-factor authentication for users.
- Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
- Implement security best practices [outlined](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/) by AWS.
- Take the actions needed to return affected systems, data, or services to their normal operational levels.
- Identify the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
"""
references = [
    "https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_GetSecretValue.html",
    "https://detectioninthe.cloud/ttps/credential_access/access_secret_in_secrets_manager/",
    "https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_BatchGetSecretValue.html",
    "https://cloud.hacktricks.xyz/pentesting-cloud/aws-security/aws-services/aws-secrets-manager-enum",
]
risk_score = 47
rule_id = "a00681e3-9ed6-447c-ab2c-be648821c622"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Platform: AWS",
    "Data Source: AWS CloudTrail",
    "Service: AWS Secrets Manager",
    "Tactic: Credential Access",
    "Rule Type: New Terms",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "new_terms"

query = '''
data_stream.dataset: aws.cloudtrail 
    and event.provider: secretsmanager.amazonaws.com 
    and event.action: GetSecretValue 
    and event.outcome: success
    and not user_agent.original: *Fargate*
    and not user.id: AWSServiceRole*
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1555"
name = "Credentials from Password Stores"
reference = "https://attack.mitre.org/techniques/T1555/"
[[rule.threat.technique.subtechnique]]
id = "T1555.006"
name = "Cloud Secrets Management Stores"
reference = "https://attack.mitre.org/techniques/T1555/006/"



[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user_agent.original",
    "source.ip",
    "aws.cloudtrail.user_identity.arn",
    "aws.cloudtrail.user_identity.type",
    "aws.cloudtrail.user_identity.access_key_id",
    "event.action",
    "event.outcome",
    "cloud.account.id",
    "cloud.region",
    "aws.cloudtrail.request_parameters",
]

[rule.new_terms]
field = "new_terms_fields"
value = ["cloud.account.id", "user.name"]
[[rule.new_terms.history_window_start]]
field = "history_window_start"
value = "now-5d"

[metadata]
creation_date = "2025/12/05"
integration = ["github"]
maturity = "production"
updated_date = "2026/03/24"

[rule]
author = ["Elastic"]
description = """
Detects when a GitHub Actions workflow attempts to create or modify workflow files in a protected branch but is blocked
due to insufficient permissions. This behavior is indicative of a supply chain attack where a malicious package or
compromised CI/CD pipeline attempts to inject persistent backdoor workflows into a repository.
"""
false_positives = [
    """
    Legitimate CI/CD automation that requires workflow file modifications may trigger this alert if not properly
    configured with the necessary permissions. Review the workflow configuration and ensure the GITHUB_TOKEN or PAT has
    the required 'workflows' permission if the modification is intentional.
    """,
]
from = "now-9m"
interval = "8m"
language = "esql"
license = "Elastic License v2"
name = "GitHub Actions Workflow Modification Blocked"
note = """## Triage and analysis

### Investigating GitHub Actions Workflow Modification Blocked

This rule detects attempts to push workflow files to a GitHub repository from within a GitHub Actions workflow that are blocked by GitHub's security controls. This is a key indicator of supply chain attacks where malicious code attempts to establish persistence by injecting backdoor workflows.

### Possible investigation steps

- Review the `github.repo` field to identify which repository was targeted.
- Examine the `github.actor_id` to determine if the action was triggered by a bot (`github-actions[bot]`) or a user account (PAT-based).
- Check recent workflow runs in the repository for suspicious activity, especially in jobs that run `npm install` or other package manager commands.
- Review the repository's dependencies for recently added or updated packages that may contain malicious preinstall/postinstall hooks.
- Examine the `github.reasons.message` field for details on which workflow file was being created or modified.
- Search for other repositories in the organization that may have the same malicious dependency.
- Review GitHub audit logs for successful workflow file modifications that may have occurred before protections were enabled.

### False positive analysis

- Legitimate automation tools that manage workflow files may trigger this alert. Verify if the repository uses tools like Dependabot, Renovate, or custom automation that modifies workflows.
- CI/CD pipelines that intentionally update workflow files should use a PAT with the 'workflows' scope and be documented.

### Response and remediation

- If this is a confirmed attack attempt, immediately audit all dependencies in the affected repository.
- Remove any suspicious packages and regenerate lock files.
- Rotate any secrets that may have been exposed during the CI run.
- Review and revoke any PATs that may have been compromised.
- Enable branch protection rules requiring pull request reviews for workflow file changes.
- Consider implementing CODEOWNERS for `.github/workflows/` directory.
- Search for indicators of compromise such as unexpected workflow files (e.g., `discussion_*.yaml`, `formatter_*.yml`).
"""
references = ["https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack"]
risk_score = 47
rule_id = "e8b37f18-4804-4819-8602-4aba1169c9f4"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Use Case: Threat Detection",
    "Tactic: Initial Access",
    "Tactic: Persistence",
    "Tactic: Execution",
    "Data Source: Github",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "esql"

query = '''
from logs-github.audit-* metadata _id, _index, _version
| where
    data_stream.dataset == "github.audit" and
    event.action == "protected_branch.rejected_ref_update" and
    github.category == "protected_branch" and
    github.reasons.code == "workflow_updates" and
    match(github.reasons.message::STRING, "refusing to allow a GitHub App to create or update workflow")
| keep *
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1195"
name = "Supply Chain Compromise"
reference = "https://attack.mitre.org/techniques/T1195/"

[[rule.threat.technique.subtechnique]]
id = "T1195.001"
name = "Compromise Software Dependencies and Development Tools"
reference = "https://attack.mitre.org/techniques/T1195/001/"

[[rule.threat.technique.subtechnique]]
id = "T1195.002"
name = "Compromise Software Supply Chain"
reference = "https://attack.mitre.org/techniques/T1195/002/"

[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1546"
name = "Event Triggered Execution"
reference = "https://attack.mitre.org/techniques/T1546/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[metadata]
creation_date = "2020/11/17"
integration = ["google_workspace"]
maturity = "production"
updated_date = "2026/07/08"

[rule]
author = ["Elastic"]
description = """
Detects when a previously suspended user's account is renewed in Google Workspace. An adversary may renew a suspended
user account to maintain access to the Google Workspace organization with a valid account.
"""
false_positives = [
    """
    Google Workspace administrators may renew a suspended user account if the user is expected to continue employment at
    the organization after temporary leave. Suspended user accounts are typically used by administrators to remove
    access to the user while actions is taken to transfer important documents and roles to other users, prior to
    deleting the user account and removing the license.
    """,
]
from = "now-130m"
index = ["filebeat-*", "logs-google_workspace.admin-*"]
interval = "10m"
language = "kuery"
license = "Elastic License v2"
name = "Google Workspace Suspended User Account Renewed"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Google Workspace Suspended User Account Renewed

Google Workspace manages user identities and access, crucial for organizational security. Adversaries may exploit the renewal of suspended accounts to regain unauthorized access, bypassing security measures. The detection rule identifies such events by monitoring specific administrative actions, helping analysts spot potential misuse and maintain secure access controls.

### Possible investigation steps

- Review the event logs for the specific action `UNSUSPEND_USER` to identify the user account that was renewed and gather details about the timing and context of the action.
- Check the identity of the administrator or service account that performed the `UNSUSPEND_USER` action to determine if the action was authorized or if there are signs of account compromise.
- Investigate the history of the suspended user account to understand why it was initially suspended and assess any potential risks associated with its renewal.
- Examine recent activity logs for the renewed user account to identify any suspicious behavior or unauthorized access attempts following the account's reactivation.
- Cross-reference the event with other security alerts or incidents to determine if the renewal is part of a broader pattern of suspicious activity within the organization.

### False positive analysis

- Routine administrative actions may trigger the rule when IT staff unsuspend accounts for legitimate reasons, such as resolving a temporary issue. To manage this, create exceptions for known IT personnel or specific administrative actions that are part of regular account maintenance.
- Automated processes or scripts that unsuspend accounts as part of a workflow can also lead to false positives. Identify and document these processes, then exclude them from triggering alerts by using specific identifiers or tags associated with the automation.
- User accounts that are temporarily suspended due to policy violations or inactivity and later reinstated can cause false positives. Implement a review process to verify the legitimacy of these reinstatements and adjust the rule to exclude such cases when they are part of a documented policy.

### Response and remediation

- Immediately review the user account activity logs to determine if any unauthorized actions were taken after the account was unsuspended. Focus on sensitive data access and changes to security settings.
- Temporarily suspend the user account again to prevent further unauthorized access while the investigation is ongoing.
- Notify the security team and relevant stakeholders about the potential security incident to ensure coordinated response efforts.
- Conduct a thorough review of the account's permissions and access levels to ensure they align with the user's current role and responsibilities. Adjust as necessary to follow the principle of least privilege.
- If malicious activity is confirmed, initiate a password reset for the affected account and any other accounts that may have been compromised.
- Implement additional monitoring on the affected account and similar accounts to detect any further suspicious activity.
- Review and update security policies and procedures related to account suspension and reactivation to prevent similar incidents in the future.

## Setup

The Google Workspace Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.

### Important Information Regarding Google Workspace Event Lag Times
- As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs.
- This rule is configured to run every 10 minutes with a lookback time of 130 minutes.
- To reduce the risk of false negatives, consider reducing the interval that the Google Workspace (formerly G Suite) Filebeat module polls Google's reporting API for new events.
- By default, `var.interval` is set to 2 hours (2h). Consider changing this interval to a lower value, such as 10 minutes (10m).
- See the following references for further information:
  - https://support.google.com/a/answer/7061566
  - https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-google_workspace.html"""
references = [
    "https://support.google.com/a/answer/1110339",
    "https://www.elastic.co/security-labs/google-workspace-attack-surface-part-one",
    "https://www.elastic.co/security-labs/google-workspace-attack-surface-part-two",
]
risk_score = 73
rule_id = "00678712-b2df-11ed-afe9-f661ea17fbcc"
severity = "high"
tags = [
    "Domain: Cloud",
    "Data Source: Google Workspace",
    "Use Case: Identity and Access Audit",
    "Tactic: Initial Access",
    "Tactic: Persistence",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset: google_workspace.admin and google_workspace.event.type: "USER_SETTINGS" and event.action: "UNSUSPEND_USER"
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"
[[rule.threat.technique.subtechnique]]
id = "T1078.004"
name = "Cloud Accounts"
reference = "https://attack.mitre.org/techniques/T1078/004/"



[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"
[[rule.threat.technique.subtechnique]]
id = "T1078.004"
name = "Cloud Accounts"
reference = "https://attack.mitre.org/techniques/T1078/004/"


[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"


[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user.email",
    "source.ip",
    "google_workspace.actor.type",
    "user.target.email",
    "event.action",
    "cloud.account.id",
]

[metadata]
creation_date = "2020/04/15"
integration = ["endpoint", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2026/03/24"

[rule]
author = ["Elastic"]
description = """
Identifies when a terminal (tty) is spawned via Python. Attackers may upgrade a simple reverse shell to a fully
interactive tty after obtaining initial access to a host.
"""
from = "now-9m"
index = [
    "endgame-*",
    "logs-endpoint.events.process*",
    "logs-sentinel_one_cloud_funnel.*"
]
language = "eql"
license = "Elastic License v2"
name = "Interactive Terminal Spawned via Python"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Interactive Terminal Spawned via Python

Python's ability to spawn interactive terminals is a powerful feature often used for legitimate administrative tasks. However, adversaries can exploit this to escalate a basic reverse shell into a fully interactive terminal, enhancing their control over a compromised system. The detection rule identifies such abuse by monitoring processes where Python spawns a shell, focusing on specific patterns in process arguments and parent-child process relationships, indicating potential malicious activity.

### Possible investigation steps

- Review the process tree to understand the parent-child relationship, focusing on the parent process named "python*" and the child process that is a shell (e.g., bash, sh, zsh).
- Examine the command-line arguments of the parent Python process to identify the use of "pty.spawn" and the presence of the "-c" flag, which may indicate an attempt to spawn an interactive terminal.
- Check the process start event details, including the timestamp and user context, to determine if the activity aligns with expected administrative tasks or if it appears suspicious.
- Investigate the source IP address and user account associated with the process to assess if they are known and authorized entities within the network.
- Look for any related alerts or logs that might indicate prior suspicious activity, such as initial access vectors or other execution attempts, to build a timeline of events.
- Correlate this activity with any recent changes or incidents reported on the host to determine if this is part of a larger attack or an isolated event.

### False positive analysis

- Administrative scripts or automation tools that use Python to manage system processes may trigger this rule. To handle this, identify and whitelist specific scripts or tools that are known to perform legitimate tasks.
- Developers or system administrators using Python for interactive debugging or system management might inadvertently match the rule's criteria. Consider excluding processes initiated by trusted user accounts or within specific directories associated with development or administration.
- Scheduled tasks or cron jobs that utilize Python to execute shell commands could be mistaken for malicious activity. Review and exclude these tasks by specifying their unique process arguments or parent-child process relationships.
- Security tools or monitoring solutions that leverage Python for executing shell commands as part of their normal operation may also trigger this rule. Identify these tools and create exceptions based on their process signatures or execution context.

### Response and remediation

- Immediately isolate the affected host from the network to prevent further unauthorized access or lateral movement.
- Terminate any suspicious Python processes identified in the alert, especially those spawning shell processes, to disrupt the attacker's control.
- Conduct a thorough review of the affected system for any additional signs of compromise, such as unauthorized user accounts, scheduled tasks, or modified system files.
- Reset credentials for any accounts accessed from the compromised host to prevent further unauthorized access.
- Apply security patches and updates to the affected system to address any vulnerabilities that may have been exploited.
- Enhance monitoring and logging on the affected host and network to detect any similar activities in the future, focusing on process creation and network connections.
- Escalate the incident to the security operations team for further investigation and to determine if additional systems are affected."""
risk_score = 73
rule_id = "d76b02ef-fc95-4001-9297-01cb7412232f"
setup = """## Setup

This rule requires data coming in from Elastic Defend.

### Elastic Defend Integration Setup
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.

#### Prerequisite Requirements:
- Fleet is required for Elastic Defend.
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).

#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
- Go to the Kibana home page and click "Add integrations".
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
- Click "Add Elastic Defend".
- Configure the integration name and optionally add a description.
- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
- Click "Save and Continue".
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
"""
severity = "high"
tags = [
    "Domain: Endpoint",
    "OS: Linux",
    "Use Case: Threat Detection",
    "Tactic: Execution",
    "Data Source: Elastic Endgame",
    "Data Source: Elastic Defend",
    "Data Source: SentinelOne",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"
query = '''
process where host.os.type == "linux" and event.type == "start" and event.action in ("exec", "exec_event", "start") and
(
  (process.parent.name : "python*" and process.name in ("bash", "dash", "ash", "sh", "tcsh", "csh", "zsh", "ksh",
   "fish") and process.parent.args_count >= 3 and process.parent.args : "*pty.spawn*" and process.parent.args : "-c") or
  (process.parent.name : "python*" and process.name in ("bash", "dash", "ash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and
   process.args in (
     "sh", "dash", "bash", "zsh",
     "/bin/sh", "/bin/dash", "/bin/bash", "/bin/zsh",
     "/usr/bin/sh", "/usr/bin/dash", "/usr/bin/bash", "/usr/bin/zsh",
     "/usr/local/bin/sh", "/usr/local/bin/dash", "/usr/local/bin/bash", "/usr/local/bin/zsh"
   ) and process.args_count == 1 and process.parent.args_count == 1
  )
)
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"

[[rule.threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"

[[rule.threat.technique.subtechnique]]
id = "T1059.006"
name = "Python"
reference = "https://attack.mitre.org/techniques/T1059/006/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[metadata]
creation_date = "2026/04/28"
integration = ["endpoint", "auditd_manager"]
maturity = "production"
updated_date = "2026/04/28"

[rule]
author = ["Elastic"]
description = """
Detects network connection attempts to the Kubernetes Kubelet API port (10250/10255) on internal IP ranges from Linux hosts.
This rule focuses on common request and scripting utilities (curl, wget, python, node, etc.) and executions from
world-writable or ephemeral paths (/tmp, /var/tmp, /dev/shm, /var/run), which are frequently abused during container and
cluster lateral movement.
"""
false_positives = [
    """
    Legitimate node health checks, diagnostics, or in-cluster agents may access the Kubelet API on port 10250. Validate
    the calling process, command line, and whether the destination is the local node or another node.
    """,
]
from = "now-9m"
index = ["auditbeat-*", "logs-auditd_manager.auditd-*", "logs-endpoint.events.network*"]
language = "eql"
license = "Elastic License v2"
name = "Kubelet API Connection Attempt to Internal IP"
note = """## Triage and analysis

### Investigating Kubelet API Connection Attempt to Internal IP

This alert indicates a process on a Linux host attempted to connect to port 10250 (Kubelet API) on an internal or
loopback IP address, including IPv4 private ranges and IPv6 localhost. Kubelet access is commonly abused to enumerate
pods, retrieve logs, or execute commands on nodes when authentication or network controls are weak.

### Possible investigation steps

- Review the initiating process (`process.*`) and its executable path; prioritize processes running from `/tmp`,
  `/var/tmp`, `/dev/shm`, or `/var/run`, and suspicious interpreters or downloaders.
- Determine whether the destination IP is the local node, another node, or a management host, and whether connectivity to
  10250 is expected for this workload/user.
- Correlate with process argument telemetry for HTTP URLs, kubelet endpoints (e.g., `/pods`, `/runningpods`, `/exec`), and
  subsequent Kubernetes API audit activity or credential access.

### False positive analysis

- Approved troubleshooting (SRE/cluster operator) sessions that validate Kubelet reachability on the node.
- In-cluster agents that legitimately scrape or query the Kubelet (confirm vendor, image, and deployment).

### Response and remediation

- Restrict pod-to-node access to 10250 using network policies/security groups where possible.
- Rotate and revoke any exposed Kubernetes credentials and investigate for follow-on cluster discovery or execution.
"""
references = [
    "https://attack.mitre.org/techniques/T1021/",
    "https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/",
]
risk_score = 47
rule_id = "9f420cca-cb27-44db-a13d-c43c7b48e04a"
setup = """## Setup

### Auditd Manager: emitting network connection telemetry

This rule is written against `event.category:network` events. Elastic Defend provides this natively. For Auditd Manager,
you typically need to audit network-related syscalls (for example `connect`) and rely on the integration/pipeline to map
those syscall events into ECS-like network events.

If you are not seeing `event.category:network` for Auditd Manager data, add syscall audit rules for network connections.
The example below is a starting point and may need to be adjusted for your environment and noise tolerance:

```
# 64-bit
-a always,exit -F arch=b64 -S connect -S accept -S accept4 -S sendto -S recvfrom -k netconn

# 32-bit (if applicable)
-a always,exit -F arch=b32 -S connect -S accept -S accept4 -S sendto -S recvfrom -k netconn
```

After enabling, validate that events include `destination.ip`, `destination.port`, and a populated `process.*` context.
"""
severity = "medium"
tags = [
    "Domain: Endpoint",
    "Domain: Container",
    "Domain: Kubernetes",
    "OS: Linux",
    "Use Case: Threat Detection",
    "Tactic: Lateral Movement",
    "Tactic: Discovery",
    "Data Source: Elastic Defend",
    "Data Source: Auditd Manager",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"
query = '''
network where host.os.type == "linux" and event.type == "start" and event.category == "network" and network.direction == "egress" and 
  event.action in ("connected-to", "connection_attempted") and (destination.port == 10250 or destination.port == 10255) and
  cidrmatch(
    destination.ip,
    "127.0.0.0/8",
    "10.0.0.0/8",
    "172.16.0.0/12",
    "192.168.0.0/16",
    "169.254.0.0/16",
    "100.64.0.0/10",
    "::1/128",
    "fc00::/7",
    "fe80::/10"
  ) and
  (
    process.name in ("curl", "wget", "nc", "ncat", "netcat", "socat", "openssl", "perl", "busybox") or 
    process.name like ".*" or process.executable like "/*/.*" or 
    process.name like ("python*", "ruby*", "node*", "java*", "lua*", "apache*", "php*", "nginx", "httpd*", "lighttpd", "caddy", "mongrel_rails", "gunicorn", 
                       "uwsgi", "openresty", "cherokee", "h2o", "resin", "puma", "unicorn", "traefik", "tornado", "hypercorn", 
                       "daphne", "twistd", "yaws", "webfsd", "flask", "rails", "mongrel", "catalina.sh", "hiawatha", "lswsctrl") or
    process.executable like ("/tmp/*", "/var/tmp/*", "/dev/shm/*", "/var/run/*", "/home/*", "/run/user/*", "/busybox/*")
  )
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1021"
name = "Remote Services"
reference = "https://attack.mitre.org/techniques/T1021/"

[rule.threat.tactic]
id = "TA0008"
name = "Lateral Movement"
reference = "https://attack.mitre.org/tactics/TA0008/"


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1613"
name = "Container and Resource Discovery"
reference = "https://attack.mitre.org/techniques/T1613/"

[rule.threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"

[metadata]
creation_date = "2026/06/02"
integration = ["o365"]
maturity = "production"
updated_date = "2026/06/02"

[rule]
author = ["Elastic"]
description = """
Identifies a Microsoft 365 user completing an OAuth device code grant ("Cmsi:Cmsi") from a non-compliant device for the
first time within the rule's historical window, regardless of the requesting application or target resource. Device code
phishing kits complete the full login (password and MFA) at the genuine Microsoft endpoint and harvest the resulting
token by polling, so MFA does not stop them. Because the victim authorizes the flow in their own browser, the grant is
frequently completed on a personal or attacker-controlled device that is not enrolled or compliant with the
organization's device policies. A user appearing with this device code flow on a non-compliant device for the first time
in the lookback window is a strong early indicator of device code phishing, and removing the application and target
constraints catches grants against any first-party application, not just the Microsoft Authentication Broker.
"""
false_positives = [
    """
    A user legitimately using the device code flow for the first time on a personal or otherwise non-compliant device,
    such as a smart TV, kiosk, IoT device, conference room device, or a personal laptop for a CLI or headless developer
    workflow. Review the source ASN, geolocation, application, and the user's device posture to confirm whether the
    activity is expected before escalating.
    """,
]
from = "now-9m"
index = ["logs-o365.audit-*"]
language = "kuery"
license = "Elastic License v2"
name = "M365 Identity Device Code Grant by an Unusual User (Non-Compliant Device)"
note = """## Triage and analysis

### Investigating M365 Identity Device Code Grant by an Unusual User (Non-Compliant Device)

This rule detects a user completing an OAuth device code grant (`Cmsi:Cmsi`) from a device reported as non-compliant in the Microsoft 365 unified audit log for the first time within the rule's historical window (defined by the new terms history setting), independent of the requesting application or target resource. A match means the user has not been seen in this flow during the lookback window, not necessarily that it has never happened. Device code phishing kits (for example Kali365, Storm-2372 tradecraft) drive the device code flow against the genuine Microsoft endpoint and poll the token endpoint in the background, so the victim satisfies MFA while the attacker harvests a fully MFA-satisfied token, typically completed from a personal or attacker-controlled device that is not enrolled or compliant.

### Possible investigation steps

- Review `o365.audit.UserId` to identify the impacted account and confirm whether the user expected to perform a device code sign-in.
- Examine `o365.audit.DeviceProperties` to understand the device posture (compliance, management state, OS, browser) and whether the device is recognized for this user.
- Confirm `o365.audit.ApplicationId` and `o365.audit.Target.ID` to identify the application and resource the grant was for. Authentication Broker (`29d9ed98-a469-4536-ade2-f981bc1d605e`) and developer tooling (Azure CLI, PowerShell) are commonly abused.
- Inspect `source.as.number`, `source.as.organization.name`, `source.ip`, and `source.geo.*` and compare with the user's normal sign-in origins. Hosting, VPN, or datacenter providers are unusual for interactive user authentication.
- Examine `user_agent.original` for automation or headless-browser patterns.
- Pivot to `azure.signinlogs` for the corresponding `deviceCode` sign-in, conditional access decisions, and any concurrent non-interactive token-issuance legs from a different ASN (the kit's polling backend).
- Pivot to `azure.graphactivitylogs` for follow-up Graph activity (`/me` recon, mailbox or file enumeration).
- Check `azure.auditlogs` for subsequent device registration events on the user, which device code phishing kits use to establish Primary Refresh Token persistence.

### False positive analysis

- A legitimate first-time device code sign-in on a personal or non-compliant device.
- Provisioning of input-constrained devices (smart TVs, kiosks, IoT, conference room devices).
- CLI or headless developer workflows using the device code flow on an unmanaged device.
- If a user or device combination is confirmed benign and recurring, suppress it via a rule exception rather than broadening the query.

### Response and remediation

- Contact the user to confirm whether they initiated the device code sign-in or may have entered a code presented on a phishing page.
- If unauthorized, revoke all refresh tokens for the user and reset credentials to invalidate the harvested token.
- Review and remove any unauthorized device registrations to cut off Primary Refresh Token persistence.
- Review recent Microsoft Graph, Exchange, SharePoint, and Teams activity for the user for signs of recon or exfiltration.
- Restrict device code authentication to only the users and applications that require it, and require compliant or hybrid-joined devices, via Conditional Access policies.
- Educate users on device code phishing and the risk of entering codes presented by unsolicited documents or messages.
"""
references = [
    "https://arcticwolf.com/resources/blog/token-bingo-dont-let-your-code-be-the-winner/",
    "https://arcticwolf.com/resources/blog/kali365-expands-into-aws-microsoft-okta-xerox-max-messenger/",
    "https://www.ic3.gov/PSA/2026/PSA260521",
    "https://www.volexity.com/blog/2025/02/13/multiple-russian-threat-actors-targeting-microsoft-device-code-authentication/",
    "https://www.microsoft.com/en-us/security/blog/2025/02/13/storm-2372-conducts-device-code-phishing-campaign/",
]
risk_score = 47
rule_id = "7e2abdb3-c7b0-4e11-ba2f-6657602800a1"
setup = """#### Required Microsoft 365 Audit Logs
This rule requires the Microsoft 365 integration with unified audit logs (Azure AD / Entra sign-in events surfaced in the Microsoft 365 audit log) enabled and shipping to Elastic.
"""
severity = "medium"
tags = [
    "Domain: Cloud",
    "Domain: SaaS",
    "Domain: Identity",
    "Data Source: Microsoft 365",
    "Data Source: Microsoft 365 Audit Logs",
    "Use Case: Identity and Access Audit",
    "Use Case: Threat Detection",
    "Resources: Investigation Guide",
    "Tactic: Initial Access",
]
timestamp_override = "event.ingested"
type = "new_terms"

query = '''
event.dataset: "o365.audit"
    and o365.audit.ExtendedProperties.RequestType: "Cmsi:Cmsi"
    and o365.audit.Actor.Type: (0 or 2 or 3 or 5 or 10)
    and o365.audit.DeviceProperties.Value: "False"
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"
[[rule.threat.technique.subtechnique]]
id = "T1078.004"
name = "Cloud Accounts"
reference = "https://attack.mitre.org/techniques/T1078/004/"


[[rule.threat.technique]]
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"
[[rule.threat.technique.subtechnique]]
id = "T1566.002"
name = "Spearphishing Link"
reference = "https://attack.mitre.org/techniques/T1566/002/"



[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1550"
name = "Use Alternate Authentication Material"
reference = "https://attack.mitre.org/techniques/T1550/"
[[rule.threat.technique.subtechnique]]
id = "T1550.001"
name = "Application Access Token"
reference = "https://attack.mitre.org/techniques/T1550/001/"



[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[rule.new_terms]
field = "new_terms_fields"
value = ["o365.audit.UserId"]
[[rule.new_terms.history_window_start]]
field = "history_window_start"
value = "now-7d"

[metadata]
creation_date = "2021/05/17"
integration = ["o365"]
maturity = "production"
updated_date = "2026/04/10"

[rule]
author = ["Elastic", "Austin Songer"]
description = """
Identifies the first occurrence of SSO, SAML, or federated authentication errors for a user. These errors may indicate
token manipulation, SAML assertion tampering, or OAuth phishing attempts. Modern adversaries often target SSO mechanisms
through token theft, SAML response manipulation, or exploiting federated authentication weaknesses rather than
traditional brute force attacks.
"""
false_positives = [
    """
    Initial SSO configuration issues or first-time federation setup errors for legitimate users may trigger this
    detection. Temporary federation service outages affecting multiple users simultaneously.
    """,
]
from = "now-9m"
index = ["logs-o365.audit-*", "filebeat-*"]
language = "kuery"
license = "Elastic License v2"
name = "M365 Identity Unusual SSO Authentication Errors for User"
note = """## Triage and analysis

### Investigating M365 Identity Unusual SSO Authentication Errors for User

SSO, SAML, and federated authentication mechanisms are critical infrastructure for modern identity access. Adversaries increasingly
target these systems through token manipulation, SAML response tampering, OAuth phishing, and exploitation of federated trust
relationships rather than traditional credential brute forcing. This detection identifies when a user experiences SSO-related
authentication errors that are unusual for their typical behavior, which may indicate an attacker attempting to abuse stolen tokens or manipulate
authentication flows.

### Possible investigation steps

- Review the specific error code(s) in the `o365.audit.ErrorNumber` field to understand the nature of the authentication failure
  (e.g., token signature failure, SAML assertion tampering, cross-tenant token misuse). Reference Microsoft's AADSTS error codes
  at https://login.microsoftonline.com/error?code=<ErrorNumber> for detailed descriptions.
- Examine the source IP address and geolocation of the authentication attempt - compare against the user's typical login patterns.
- Check for concurrent authentication activity from the same user - multiple SSO errors alongside successful logins may indicate
  token replay or session hijacking attempts.
- Investigate recent OAuth application consent activity for this user - OAuth phishing campaigns often precede SSO manipulation attempts.
- Review the target application or service principal being accessed during the failed authentication to identify potential attacker objectives.
- Analyze the user's recent mailbox activity, particularly for phishing emails with OAuth consent links or suspicious authentication requests.
- Check for any recent changes to the user's federation settings, registered devices, or authentication methods.
- Correlate with Entra ID risky sign-in detections and risky user alerts for the same account.

### False positive analysis

- First-time SSO setup: Users configuring SSO access to a new federated application may encounter initial authentication errors.
  Validate whether the errors occurred during expected onboarding windows.
- Federation service outages: Widespread SSO errors affecting multiple users simultaneously often indicate infrastructure issues
  rather than targeted attacks. Check for service health incidents in the same timeframe.
- Certificate rotation: Federated authentication certificate renewals can temporarily cause signature validation errors. Verify
  if the errors align with planned certificate maintenance.
- Legitimate cross-tenant access: Users with business relationships across multiple tenants may encounter cross-tenant policy
  errors during authorized access attempts.

### Response and remediation

- If token manipulation or SAML tampering is suspected, immediately revoke all active sessions and refresh tokens for the affected user.
- Review and audit all OAuth application consents granted by the user - remove any suspicious or unrecognized applications.
- Enable Conditional Access policies requiring compliant devices and MFA for SSO authentication if not already enforced.
- If cross-tenant token misuse is detected, review and restrict external collaboration settings and cross-tenant access policies.
- For SAML assertion or signature errors, validate the integrity of federation trust certificates and metadata.
- Investigate whether the user's credentials have been compromised - enforce password reset if credential theft is suspected.
- Review Entra ID audit logs for unusual application registrations, service principal modifications, or federation setting changes.
- Escalate to the security operations team if evidence suggests active token theft, SAML Golden Ticket techniques, or OAuth phishing campaigns."""
references = [
    "https://techcommunity.microsoft.com/blog/microsoft-entra-blog/understanding-and-mitigating-golden-saml-attacks/4418864",
    "https://www.semperis.com/blog/meet-silver-saml/"
]
risk_score = 47
rule_id = "2de10e77-c144-4e69-afb7-344e7127abd0"
severity = "medium"
tags = [
    "Domain: Identity",
    "Data Source: Microsoft 365",
    "Data Source: Microsoft 365 Audit Logs",
    "Use Case: Identity and Access Audit",
    "Use Case: Threat Detection",
    "Tactic: Initial Access",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "new_terms"

query = '''
data_stream.dataset:o365.audit
    and event.provider:AzureActiveDirectory
    and event.category:authentication
    and o365.audit.ErrorNumber:(
        20001 or 20012 or 20033 or 40008 or 40009 or 40015 or
        50006 or 50008 or 50012 or 50013 or 50027 or 50048 or
        50099 or 50132 or 75005 or 75008 or 75011 or 75016 or
        81004 or 81009 or 81010 or 399284 or 500212 or 500213 or
        700005 or 5000819
    )
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"

[[rule.threat.technique.subtechnique]]
id = "T1078.004"
name = "Cloud Accounts"
reference = "https://attack.mitre.org/techniques/T1078/004/"

[[rule.threat.technique]]
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"

[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1528"
name = "Steal Application Access Token"
reference = "https://attack.mitre.org/techniques/T1528/"

[[rule.threat.technique]]
id = "T1606"
name = "Forge Web Credentials"
reference = "https://attack.mitre.org/techniques/T1606/"

[[rule.threat.technique.subtechnique]]
id = "T1606.002"
name = "SAML Tokens"
reference = "https://attack.mitre.org/techniques/T1606/002/"

[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[rule.new_terms]
field = "new_terms_fields"
value = ["o365.audit.UserId", "o365.audit.ErrorNumber"]
[[rule.new_terms.history_window_start]]
field = "history_window_start"
value = "now-10d"

[rule]
description = """
Detects attempts to create or modify a file in known Microsoft Office add-ins directories. Adversaries may leverage
Microsoft Office Addins for persistence.
"""
id = "4a99e412-ca98-468e-8730-d62009af23f7"
license = "Elastic License v2"
name = "Microsoft Office AddIn Creation"
os_list = ["windows"]
reference = ["https://docs.microsoft.com/en-us/previous-versions/technet-magazine/ee851671(v=msdn.10)"]
version = "1.0.18"

query = '''
file where event.action != "deletion" and

  file.Ext.header_bytes : "4d5a*" and

  file.path :
    ("?:\\Users\\*\\AppData\\Roaming\\Microsoft\\Word\\Startup\\*",
     "?:\\Users\\*\\AppData\\Roaming\\Microsoft\\AddIns\\*",
     "?:\\Users\\*\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\*") and

  not (process.executable : "?:\\Windows\\sys*\\msiexec.exe" and file.path : "?:\\Users\\*\\AppData\\Roaming\\Microsoft\\AddIns\\*") and 
  not process.executable : "?:\\Windows\\explorer.exe" and 
  not (process.code_signature.subject_name : "Lars Schenk" and process.code_signature.trusted == true)
'''

min_endpoint_version = "8.1.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1137"
name = "Office Application Startup"
reference = "https://attack.mitre.org/techniques/T1137/"


[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[internal]
min_endpoint_version = "8.1.0"

[metadata]
creation_date = "2025/10/14"
integration = ["endpoint"]
maturity = "production"
updated_date = "2026/05/03"

[rule]
author = ["Elastic"]
description = """
Identifies potential attempt to execute via a reverse shell using the netcat utility to execute Windows commands using
the default interpreters like Cmd.exe and Powershell.
"""
from = "now-9m"
index = ["logs-endpoint.events.process-*"]
language = "eql"
license = "Elastic License v2"
name = "Potential Command Shell via NetCat"
risk_score = 73
rule_id = "9c0f61fa-abf4-4b11-8d9d-5978c09182dd"
severity = "high"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Execution",
    "Resources: Investigation Guide",
    "Data Source: Elastic Defend"
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
process where host.os.type == "windows" and event.type == "start" and
process.name : ("cmd.exe", "powershell.exe") and process.parent.args : "-e" and
 (
  (process.parent.args_count == 5 and process.parent.command_line regex~ """.*[0-9]{1,3}(\.[0-9]{1,3}){3}.*""") or
  (process.parent.args : "-*l*" and process.parent.args : "-*p*" and process.parent.args : ("cmd.exe", "powershell.exe"))
  )
'''

note = """## Triage and analysis

### Investigating Potential Command Shell via NetCat

#### Possible investigation steps

- Which remote-shell mode does the alert-local process evidence show?
  - Focus: `process.parent.command_line`, `process.parent.args_count`, and `process.name`.
  - Implication: escalate when "-e" wires "cmd.exe" or "powershell.exe" to an explicit IP, unusual port, or "-l"/"-p" listener; lower concern only when shell mode, port or destination, and child shell match a known lab, red-team, or break-glass workflow.

- Does the parent binary identity fit a recognized NetCat-family tool instead of a renamed payload?
  - Focus: `process.parent.executable`, `process.parent.name`, and code signature.
  - Implication: escalate when the parent is unsigned, renamed, or runs from temp, downloads, archives, shares, or another user-writable path; identity lowers concern only when path and signer fit the same controlled tool, and never clears the `-e` shell behavior by itself.

- Do recovered parent network events confirm a connect-back destination or exposed listener?
  - Focus: network events on `host.id` for `process.parent.entity_id`; separate DNS `dns.question.name` from `destination.ip`, `destination.port`, and `network.direction`. $investigate_0
  - Hint: network fields come from endpoint network events, not the process alert; compare any command-line IP or port with recovered connections.
  - Implication: escalate when recovered connections confirm a public or unexpected destination, or a listener is exposed on an unexpected asset; missing network telemetry is unresolved, not benign.

- Did the spawned shell launch operator commands after start?
  - Focus: child process starts where `process.parent.entity_id` matches the spawned shell `process.entity_id`; review `process.name`, `process.executable`, and `process.command_line`. $investigate_1
  - Implication: escalate when descendants show reconnaissance, credential, download, persistence, staging, lateral movement, or cleanup; no descendants weakens operator-control evidence but does not make the remote-shell pattern benign.

- Does the user and host context support the shell exposure?
  - Focus: `user.id`, `user.name`, `host.id`, `host.name`, and `process.parent.command_line`.
  - Implication: escalate when user-host pairing or account identity conflicts with expected testing or emergency use; lower concern only when the same user, host, and parent command fit one bounded authorized activity.

- If local evidence is suspicious or unresolved, do surrounding alerts expand the scope?
  - Focus: alerts for the same `user.id`, especially execution, defense-evasion, persistence, credential-access, lateral-movement, or command-and-control tied to the same parent command or recovered destination. $investigate_2
  - Hint: also check the same `host.id` to decide whether this remains one process on one asset or part of a broader compromise. $investigate_3
  - Implication: expand response scope when surrounding alerts share the user, host, parent command, or recovered destination pattern; keep triage local when no corroborating alerts appear after the parent, network, and descendant checks.

- What disposition is supported by shell mode, parent identity, descendant commands, network recovery, user-host context, and alert scope?
  - Focus: synthesize shell mode, parent identity, descendants, network recovery, user-host context, and alert scope.
  - Implication: escalate on alert-local "-e" behavior plus any corroborator: unrecognized parent, external or exposed network evidence, operator descendants, user-host conflict, or related alerts. Close only when all categories bind to one authorized security-testing or break-glass activity with no contradictions; if telemetry cannot prove legitimacy, require outside confirmation. Preserve artifacts and escalate when evidence is mixed or visibility is incomplete.

### False positive analysis

- NetCat "-e" shells are an operational anti-pattern outside confirmed security testing or break-glass support. Confirm benign use only when parent path and signer, exact parent command, shell mode, child shell, recovered destination or listen-port evidence, `user.id`, and `host.id` all align to the same bounded workflow. Use schedules, tickets, or owner confirmation only to corroborate that telemetry-matched activity; without them, require telemetry-only confirmation that the same user, host, parent command, and destination or port pattern recur for this rule. Any mismatch keeps the alert suspicious.
- Before creating an exception, validate stability across prior alerts for the same `user.id` and `host.id`. Anchor the exception on `process.parent.executable`, `process.parent.command_line`, child `process.command_line`, user/host scope, and recovered destination or listen-port pattern. Avoid exceptions on `process.name`, parent basename, or shell name alone.

### Response and remediation

- If confirmed benign, reverse any temporary containment and document the parent identity, exact command, shell mode, child shell, user/host scope, and recovered destination or listen-port evidence that proved the workflow. Create an exception only if that same workflow is stable across prior alerts from this rule.
- If suspicious but unconfirmed, preserve volatile state and case exports first: parent and child process entity IDs, command lines, descendant commands, parent binary path and signer, and recovered network indicators. Apply reversible containment tied to the findings, such as temporary destination blocks, firewall control of the exposed listener, or host isolation when interactive control or broader scope is likely and the host can tolerate it. Avoid process termination or deletion until evidence capture is complete.
- If confirmed malicious, first record `process.parent.entity_id`, `process.entity_id`, parent and child command lines, descendant commands, and recovered network indicators. Then isolate the host as appropriate, block recovered destination, domain, IP, or port indicators, and terminate the NetCat parent, spawned shell, and malicious descendants after evidence capture. Reset credentials only when descendant commands, user-host context, or related alerts show credential or administrator-command exposure.
- Eradicate only artifacts found during the investigation: the NetCat binary or script wrapper, staged payloads, persistence, service or listener configuration, tunnels, and cleanup scripts. Then remediate the delivery path that placed the tool on the host.
- Post-incident hardening: restrict unauthorized NetCat-family binaries and "-e" shell usage, retain process and network telemetry, and document adjacent variants such as renamed utilities, relay mode without "-e", or delayed shell handoff in the case record for future response.
"""

setup = """## Setup

This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.

Setup instructions: https://ela.st/install-elastic-defend
"""

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "host.id",
    "user.id",
    "process.entity_id",
    "process.executable",
    "process.command_line",
    "process.parent.entity_id",
    "process.parent.executable",
    "process.parent.command_line",
    "process.parent.args",
    "process.parent.args_count",
    "process.parent.code_signature.subject_name",
    "process.parent.code_signature.trusted",
]

[transform]

[[transform.investigate]]
label = "Network events for the netcat parent process"
description = ""
providers = [
  [
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.parent.entity_id}}", valueType = "string" },
    { excluded = false, field = "event.category", queryType = "phrase", value = "network", valueType = "string" }
  ]
]
relativeFrom = "now-1h"
relativeTo = "now"

[[transform.investigate]]
label = "Descendant processes from the spawned shell"
description = ""
providers = [
  [
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "process.parent.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" },
    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" }
  ]
]
relativeFrom = "now-1h"
relativeTo = "now"

[[transform.investigate]]
label = "Alerts associated with the user"
description = ""
providers = [
  [
    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
    { excluded = false, field = "user.id", queryType = "phrase", value = "{{user.id}}", valueType = "string" }
  ]
]
relativeFrom = "now-48h/h"
relativeTo = "now"

[[transform.investigate]]
label = "Alerts associated with the host"
description = ""
providers = [
  [
    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" }
  ]
]
relativeFrom = "now-48h/h"
relativeTo = "now"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"

[[rule.threat.technique.subtechnique]]
id = "T1059.001"
name = "PowerShell"
reference = "https://attack.mitre.org/techniques/T1059/001/"

[[rule.threat.technique.subtechnique]]
id = "T1059.003"
name = "Windows Command Shell"
reference = "https://attack.mitre.org/techniques/T1059/003/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1095"
name = "Non-Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1095/"

[rule.threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"