Elastic rules: 1r

[metadata]
creation_date = "2022/02/22"
integration = ["system", "windows"]
maturity = "production"
updated_date = "2026/05/04"

[rule]
author = ["Elastic"]
description = """
Detects the creation and modification of an account with the "Don't Expire Password" option Enabled. Attackers can abuse
this misconfiguration to persist in the domain and maintain long-term access using compromised accounts with this
property.
"""
false_positives = [
    """
    User accounts can be used as service accounts and have their password set never to expire. This is a bad security
    practice that exposes the account to Credential Access attacks. For cases in which user accounts cannot be avoided,
    Microsoft provides the Group Managed Service Accounts (gMSA) feature, which ensures that the account password is
    robust and changed regularly and automatically.
    """,
]
from = "now-9m"
index = ["logs-system.security*", "logs-windows.forwarded*", "winlogbeat-*"]
language = "eql"
license = "Elastic License v2"
name = "Account Configured with Never-Expiring Password"
note = """## Triage and analysis

### Investigating Account Configured with Never-Expiring Password

Active Directory provides a setting that prevents users' passwords from expiring. Enabling this setting is bad practice and can expose environments to vulnerabilities that weaken security posture, especially when these accounts are privileged.

The setting is usually configured so a user account can act as a service account. Attackers can abuse these accounts to persist in the domain and maintain long-term access using compromised accounts with a never-expiring password set.

#### Possible investigation steps

- Identify the user account that performed the action and whether it should perform this kind of action.
- Contact the account owner and confirm whether they are aware of this activity.
- Investigate other alerts associated with the user/source host during the past 48 hours.
- Inspect the account for suspicious or abnormal behaviors in the alert timeframe.

### False positive analysis

- This activity should not happen legitimately. The security team should address any potential benign true positive (B-TP), as this configuration can put the user and the domain at risk.
- Using user accounts as service accounts is a bad security practice and should not be allowed in the domain. The security team should map and monitor potential benign true positives (B-TPs), especially if the account is privileged. For cases in which user accounts cannot be avoided, Microsoft provides the Group Managed Service Accounts (gMSA) feature, which ensures that the account password is robust and changed regularly and automatically.

### Response and remediation

- Initiate the incident response process based on the outcome of the triage.
- Review the privileges assigned to the user to ensure that the least privilege principle is being followed.
- Reset the password of the account and update its password settings.
- Search for other occurrences on the domain.
    - Using the [Active Directory PowerShell module](https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-aduser):
        - `get-aduser -filter { passwordNeverExpires -eq $true  -and enabled -eq $true } | ft`
- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
"""

setup = """## Setup

The following Windows audit policies must be enabled to generate the events used by this rule:
- [Audit User Account Management](https://ela.st/audit-user-account-management)
- [Audit Directory Service Changes](https://ela.st/audit-directory-service-changes)
"""

references = [
    "https://www.cert.ssi.gouv.fr/uploads/guide-ad.html#dont_expire",
    "http://web.archive.org/web/20230329171952/https://blog.menasec.net/2019/02/threat-hunting-26-persistent-password.html",
]
risk_score = 47
rule_id = "62a70f6f-3c37-43df-a556-f64fa475fba2"
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Persistence",
    "Data Source: Active Directory",
    "Resources: Investigation Guide",
    "Use Case: Active Directory Monitoring",
    "Data Source: Windows Security Event Logs",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
any where host.os.type == "windows" and
(
  (
    event.code == "4738" and winlog.event_data.NewUACList == "USER_DONT_EXPIRE_PASSWORD" and not user.id == "S-1-5-18"
  ) or
  (
    event.code == "5136" and winlog.event_data.AttributeLDAPDisplayName == "userAccountControl" and
    winlog.event_data.AttributeValue in ("66048", "66080") and winlog.event_data.OperationType == "%%14674" and
    not (
      winlog.event_data.SubjectUserName : "*svc*" or
      winlog.event_data.ObjectDN : "*Service*"
    )
  )
)
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"


[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[metadata]
creation_date = "2024/09/11"
integration = ["aws_bedrock"]
maturity = "production"
updated_date = "2025/07/16"

[rule]
author = ["Elastic"]
description = """
Identifies multiple validation exeception errors within AWS Bedrock. Validation errors occur when you run the
InvokeModel or InvokeModelWithResponseStream APIs on a foundation model that uses an incorrect inference parameter or
corresponding value. These errors also occur when you use an inference parameter for one model with a model that doesn't
have the same API parameter. This could indicate attempts to bypass limitations of other approved models, or to force an
impact on the environment by incurring exhorbitant costs.
"""
false_positives = ["Legitimate misunderstanding by users on accessing the bedrock models."]
from = "now-60m"
interval = "10m"
language = "esql"
license = "Elastic License v2"
name = "AWS Bedrock Detected Multiple Validation Exception Errors by a Single User"
note = """## Triage and analysis

### Investigating AWS Bedrock Detected Multiple Validation Exception Errors by a Single User

Amazon Bedrock is AWS’s managed service that enables developers to build and scale generative AI applications using large foundation models (FMs) from top providers.

Bedrock offers a variety of pretrained models from Amazon (such as the Titan series), as well as models from providers like Anthropic, Meta, Cohere, and AI21 Labs.

#### Possible investigation steps

- Identify the user account that caused validation errors in accessing the Amazon Bedrock models.
- Investigate other alerts associated with the user account during the past 48 hours.
- Consider the time of day. If the user is a human (not a program or script), did the activity take place during a normal time of day?
- Examine the account's attempts to access Amazon Bedrock models in the last 24 hours.
- If you suspect the account has been compromised, scope potentially compromised assets by tracking Amazon Bedrock model access, prompts generated, and responses to the prompts by the account in the last 24 hours.

### False positive analysis

- Verify the user account that that caused validation errors is a legitimate misunderstanding by users on accessing the bedrock models.

### Response and remediation

- Initiate the incident response process based on the outcome of the triage.
- Disable or limit the account during the investigation and response.
- Identify the possible impact of the incident and prioritize accordingly; the following actions can help you gain context:
    - Identify the account role in the cloud environment.
    - Identify if the attacker is moving laterally and compromising other Amazon Bedrock Services.
    - Identify any regulatory or legal ramifications related to this activity.
    - Identify if any implication to resource billing.
- Review the permissions assigned to the implicated user group or role behind these requests to ensure they are authorized and expected to access bedrock and ensure that the least privilege principle is being followed.
- Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
"""
references = [
    "https://atlas.mitre.org/techniques/AML.T0015",
    "https://atlas.mitre.org/techniques/AML.T0034",
    "https://atlas.mitre.org/techniques/AML.T0046",
    "https://www.elastic.co/security-labs/elastic-advances-llm-security",
]
risk_score = 73
rule_id = "725a048a-88c5-4fc7-8677-a44fc0031822"
setup = """## Setup

This rule requires that AWS Bedrock Integration be configured. For more information, see the AWS Bedrock integration documentation:

https://www.elastic.co/docs/current/integrations/aws_bedrock
"""
severity = "high"
tags = [
    "Domain: LLM",
    "Data Source: AWS",
    "Data Source: AWS Bedrock",
    "Data Source: AWS S3",
    "Use Case: Policy Violation",
    "Mitre Atlas: T0015",
    "Mitre Atlas: T0034",
    "Mitre Atlas: T0046",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "esql"

query = '''
from logs-aws_bedrock.invocation-*

// Truncate timestamp to 1-minute window
| eval Esql.time_window_date_trunc = date_trunc(1 minutes, @timestamp)

// Filter for validation exceptions in responses
| where gen_ai.response.error_code == "ValidationException"

// keep relevant ECS and derived fields
| keep
  user.id,
  gen_ai.request.model.id,
  cloud.account.id,
  gen_ai.response.error_code,
  Esql.time_window_date_trunc

// count number of denials by user/account/time window
| stats
    Esql.ml_response_validation_error_count = count(*)
  by
    Esql.time_window_date_trunc,
    user.id,
    cloud.account.id

// Filter for excessive errors
| where Esql.ml_response_validation_error_count > 3
'''



[rule.investigation_fields]
field_names = ["target_time_window", "user.id", "cloud.account.id", "total_denials"]

[metadata]
creation_date = "2026/07/13"
integration = ["aws"]
maturity = "production"
updated_date = "2026/07/13"

[rule]
author = ["Elastic"]
description = """
Identifies AWS CloudTrail data events where an unauthenticated identity successfully retrieves temporary AWS credentials
from a Cognito Identity Pool via GetCredentialsForIdentity. Cognito Identity Pools can be configured to allow
unauthenticated (guest) access, intended for scenarios like anonymous app analytics, but a pool that grants those
anonymous identities meaningful IAM permissions becomes a public, unauthenticated path to real AWS credentials.
Adversaries who discover an identity pool ID (often embedded in mobile app binaries, web app JavaScript, or public
source repositories) can call GetId followed by GetCredentialsForIdentity with no login token at all to obtain
temporary credentials, then use them to access whatever the pool's unauthenticated role permits. This is a New Terms
rule that limits alerting to identity pools that have not been observed issuing credentials to an unauthenticated caller
before, since some applications intentionally and continuously use guest access as part of normal operation.
"""
false_positives = [
    """
    Applications that intentionally allow unauthenticated Identity Pool access for legitimate purposes (for example,
    anonymous usage analytics or unauthenticated content delivery) will trigger this rule the first time that pattern is
    observed for a given identity pool. Confirm whether the pool's unauthenticated role grants only the minimal
    permissions the application actually needs, and treat repeated alerts for the same pool as expected once validated.
    """,
]
from = "now-6m"
index = ["logs-aws.cloudtrail-*"]
language = "kuery"
license = "Elastic License v2"
name = "AWS Cognito Unauthenticated Identity Pool Credentials Issued"
note = """## Triage and analysis

### Investigating AWS Cognito Unauthenticated Identity Pool Credentials Issued

Amazon Cognito Identity Pools can be configured with `AllowUnauthenticatedIdentities`, letting a caller obtain a
guest identity via `GetId` and then temporary AWS credentials via `GetCredentialsForIdentity`, with no login token or
authentication of any kind. This is by design for use cases like anonymous app analytics, but if the pool's
unauthenticated IAM role is overpermissioned, anyone who discovers the identity pool ID gets a free, unauthenticated
path to real AWS credentials.

This rule fires the first time a given identity pool is observed issuing credentials to an unauthenticated caller
(`aws.cloudtrail.user_identity.type: "Unknown"`).

#### Possible investigation steps

- **Identify the pool**: review `aws.cloudtrail.resources.arn` to determine which identity pool issued the
  credentials, and `aws.cloudtrail.request_parameters.identityId` for the specific guest identity.
- **Confirm this is intentional guest access**: check whether the application this pool belongs to is designed for
  anonymous/unauthenticated use (for example, a public mobile app or website with anonymous analytics).
- **Review the unauthenticated role's permissions**: run
  `aws cognito-identity get-identity-pool-roles --identity-pool-id <pool id>` and inspect the attached policy for the
  unauthenticated role. Broad permissions (data store read/write, `iam:*`, cross-service access) on a role reachable
  without authentication is a critical misconfiguration regardless of whether this specific call was malicious.
- **Review source context**: check `source.ip`, `user_agent.original`, and `source.geo` for the calling identity. A
  source unrelated to the application's expected client base (for example, a generic AWS SDK/CLI user agent instead
  of a mobile/browser client) is a stronger indicator of discovery/abuse rather than normal app traffic.
- **Look for follow-on activity**: search for subsequent API calls made using credentials tied to the same
  `identityId` or the unauthenticated role's ARN, to determine what the caller actually did with the credentials.
- **Look for pool enumeration**: check for `ListIdentityPools` or repeated `GetId`/`GetCredentialsForIdentity` calls
  against multiple different identity pools from the same source in a short window, which suggests systematic
  discovery rather than a single legitimate app session.

### False positive analysis

- Many applications intentionally use unauthenticated Identity Pool access for anonymous analytics or public content
  delivery. This rule fires once per identity pool the first time this pattern is observed; if confirmed as
  intentional and properly scoped (minimal unauthenticated role permissions), no further action is needed for that
  pool.

### Response and remediation

- If the unauthenticated role is overpermissioned, scope it down immediately to the minimum required for legitimate
  anonymous use, or disable `AllowUnauthenticatedIdentities` entirely if guest access is not required.
- If credentials were abused, review all activity performed under the unauthenticated role's ARN during the
  credential's validity window and revoke/rotate as appropriate (temporary credentials cannot be revoked directly,
  but the role's trust policy or permissions can be tightened immediately).
- Treat any identity pool ID found in client-side code (mobile app binaries, web JavaScript) as public information,
  and ensure the unauthenticated role attached to it is scoped accordingly.

"""
references = [
    "https://docs.aws.amazon.com/cognito/latest/developerguide/identity-pool-roles.html",
    "https://docs.aws.amazon.com/cognito/latest/developerguide/logging-using-cloudtrail.html",
    "https://hackingthe.cloud/aws/exploitation/cognito_identity_pool_excessive_privileges/",
    "https://github.com/RhinoSecurityLabs/pacu/tree/master/pacu/modules/cognito__attack",
]
risk_score = 47
rule_id = "c61fee20-4d00-4b39-a6e6-acddcc4433e2"
setup = "Cognito Identity Pool data events must be enabled in CloudTrail to capture GetCredentialsForIdentity, GetId, GetOpenIdToken, GetOpenIdTokenForDeveloperIdentity, and UnlinkIdentity. Add an advanced event selector for eventCategory Data and resources.type AWS::Cognito::IdentityPool to the trail."
severity = "medium"
tags = [
    "Domain: Cloud",
    "Data Source: AWS",
    "Data Source: Amazon Web Services",
    "Data Source: AWS Cognito",
    "Use Case: Asset Visibility",
    "Resources: Investigation Guide",
    "Tactic: Credential Access",
    "Tactic: Initial Access",
]
timestamp_override = "event.ingested"
type = "new_terms"

query = '''
data_stream.dataset: "aws.cloudtrail"
    and event.provider: "cognito-identity.amazonaws.com"
    and event.action: "GetCredentialsForIdentity"
    and event.outcome: "success"
    and aws.cloudtrail.user_identity.type: "Unknown"
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"


[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"
[[rule.threat.technique.subtechnique]]
id = "T1078.004"
name = "Cloud Accounts"
reference = "https://attack.mitre.org/techniques/T1078/004/"



[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user_agent.original",
    "source.ip",
    "aws.cloudtrail.resources.arn",
    "aws.cloudtrail.resources.type",
    "aws.cloudtrail.user_identity.type",
    "aws.cloudtrail.request_parameters",
    "event.action",
    "event.outcome",
    "cloud.account.id",
    "cloud.region",
]

[rule.new_terms]
field = "new_terms_fields"
value = ["aws.cloudtrail.resources.arn"]
[[rule.new_terms.history_window_start]]
field = "history_window_start"
value = "now-7d"

[rule]
description = """
Identifies DNS queries to common web services by an unsigned program. Adversaries may implement command and control
communications that use common web services in order to hide their activity.
"""
id = "2c3efa34-fecd-4b3b-bdb6-30d547f2a1a4"
license = "Elastic License v2"
name = "Connection to WebService by an Unsigned Binary"
os_list = ["windows"]
reference = ["https://www.elastic.co/security-labs/globally-distributed-stealers"]
version = "1.0.54"

query = '''
sequence by process.entity_id with maxspan=5m
 /* execution of an unsigned PE file followed by dns lookup to commonly abused trusted webservices */

  [process where event.action == "start" and
   not process.code_signature.trusted == true and
   (process.Ext.relative_file_creation_time <= 300 or process.Ext.relative_file_name_modify_time <= 300) and
   not process.hash.sha256 : ("7ce7b2c97b242169333c0920497299e070a5d19900f1751ccf691424e3572c0b",
                              "21f061b2c1a9d86b25355ed5a4a52302e9797bd83c19b7ff7bffb6312e4b20ae",
                              "13b83cc30cafdf1158c5916ed147baeccd974a5998268d331454e839684136dd",
                              "eef030ce340a68e7f9370146b5ae770c2545dd7e66359dae8b82222f7e7868e1",
                              "5c714275f327385f539a95dd86385c16db79891d7818fd15fcb32f51441a6c8c",
                              "d8b2ba96f2b18a89942c53651c15d477d94495e6c70645e8e72266b87f6b7eb5",
                              "652f26a69f928aa7800a2df3345d770cd290a7ea46ba8e97fe7b284fecbd9b56",
                              "53cec05a7fe060e26a3d84be15c91eac2269e6c6ed9570e2315bad26dd92d230",
                              "b40b9456b3816a2b2710bb6b4860bcca74dd55eef6a9f9c1119e51c1b58dd17b",
                              "ac3bc762543ae3875b1d55d61b7b6740faff186edc959c1490ebc6d176b0f092",
                              "b3dce1fda6820e5e3df33fa2e1bd9c87fe5ed6b2f44f6e6c47a32a870f0e0935",
                              "d7b0cc901f7d427d17df5a59c0261e415da2f4f6c44c2429c1514a0b3327f6f3",
                              "73ee5886a3d7ea73cd5ba31d943f1067f622eafe0f701ab23d2d9d3c1c0aafa5",
                              "438e750547cca4c4aaf49a5cafcfa9bbe8b9cc51772dba2791e966a9f92cad5a",
                              "b3dce1fda6820e5e3df33fa2e1bd9c87fe5ed6b2f44f6e6c47a32a870f0e0935",
                              "d49609714d5b5031f2f08470485220323ee056bde2079fb5faf763a77cd53ddb",
                              "6f92b27bb0387b2b49ac2ed9eb7b3632e72507de64c691eb084202e9429786e3",
                              "3c7f2519b3eb76408e8acc4016da9d710f0d528b2b6b5291102d8d79ffeeb8c1",
                              "464637413f656379e8e7b131c57ad7a5eed95d54714a8e0d130da35ba04fca69",
                              "f3785c74dd0bd8b629f1f8480134a7d9ef94ae9a3d28a72cde8b6f9debdb829c",
                              "432631e2a7195a94c2a02103031b4f213b66cfcce40f1dffcbbec46b0d3c254b",
                              "d3d47bd13b9d18619d541f553d0d06174f9daae26d83f7136361b07aca378c86",
                              "58139bcb2e48d341bd74557d52cf074ccd0f74142da254b47d4e1dfcc4fdffd4",
                              "0165fe4269fe548c64de31e559bd0f5186316008d797739b39bb10021b356baf") and
   not process.parent.executable like "C:\\Program Files\\Microsoft Visual Studio\\*.exe" and
   not process.executable : "C:\\Program Files\\Kairos\\Periscope\\PeriscopeDesktop.exe"]
  [dns where
    dns.question.name :
    (
        "pastebin.*",
        "paste.ee",
        "ghostbin.com",
        "drive.google.com",
        "d.docs.live.net",
        "api.dropboxapi.*",
        "content.dropboxapi.*",
        "dl.dropboxusercontent.*",
        "api.onedrive.com",
        "*.onedrive.org",
        "onedrive.live.com",
        "filebin.net",
        "gofile.io",
        "*.ngrok.io",
        "file.io",
        "ngrok.com",
        "*.ngrok-free.app",
        "*.portmap.*",
        "*serveo.net",
        "*infinityfreeapp.com",
        "*localtunnel.me",
        "*pagekite.me",
        "*localxpose.io",
        "*notabug.org",
        "rawcdn.githack.*",
        "paste.nrecom.net",
        "zerobin.net",
        "controlc.com",
        "requestbin.net",
        "slack.com",
        "api.slack.com",
        "slack-redir.net",
        "slack-files.com",
        "cdn.discordapp.com",
        "discordapp.com",
        "discord.com",
        "discord.gg",
        "cdn.sql.gg",
        "cdn.discordapp.com",
        "www.uplooder.net",
        "*.cdnmegafiles.com",
        "transfer.sh",
        "updates.peer2profit.com",
        "api.telegram.org",
        "t.me",
        "bing.com",
        "yahoo.com",
        "meacz.gq",
        "rwrd.org", 
        "*.publicvm.com",
        "paste4btc.com",
        "api.notion.com",
        "*.sharepoint.com",
        "note.youdao.com",
        "mbasic.facebook.com",
        "api.gofile.io",
        "api.anonfiles.com",
        "api.gofile.io",
        "api.anonfiles.com",
        "api.trello.com",
        "api.notion.com",
        "gist.githubusercontent.com",
        "*.zulipchat.com",
        "filecloud.me",
        "i.ibb.co",
        "files.pythonhosted.org",
        "ip-api.com",
        "demo.ip-api.com",
          "checkip.dyndns.org",
          "api.ipify.org",
          "whatismyip.akamai.com",
          "bot.whatismyipaddress.com",
          "ifcfg.me",
          "ident.me",
          "ipof.in",
          "ip.tyk.nu",
          "icanhazip.com",
          "curlmyip.com",
          "wgetip.com",
          "eth0.me",
          "ipecho.net",
          "ip.appspot.com",
          "api.myip.com",
          "geoiptool.com",
          "api.2ip.ua",
          "api.ip.sb",
          "ipinfo.io",
          "checkip.amazonaws.com",
          "wtfismyip.com",
          "iplogger.*",
          "freegeoip.net",
          "freegeoip.app",
          "ipinfo.io",
          "geoplugin.net",
          "myip.dnsomatic.com",
          "www.geoplugin.net",
          "api64.ipify.org",
          "ip4.seeip.org",
          "*.geojs.io",
          "*portmap.io",
          "api.2ip.ua",
          "api.db-ip.com",
          "geolocation-db.com",
          "httpbin.org",
          "myip.opendns.com",
          "free.keep.sh",
          "tinyurl.com",
          "ftpupload.net",
          "cld.pt",
          "yandex.ru",
          "*.yandex.ru",
          "*.aternos.me",
          "geo.netsupportsoftware.com",
          "*.ngrok-free.app",
          "www.myexternalip.com",
          "cdn??.space",
          "steamcommunity.com",
          "*.netlify.app"
    ) and
  not (process.executable : ("C:\\Program Files\\*.exe", "C:\\Program Files (x86)\\*.exe") and dns.question.name == "pastebin.com")
  ]
'''

min_endpoint_version = "8.10.0"
reputation = true
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"
[[threat.technique.subtechnique]]
id = "T1071.004"
name = "DNS"
reference = "https://attack.mitre.org/techniques/T1071/004/"


[[threat.technique]]
id = "T1102"
name = "Web Service"
reference = "https://attack.mitre.org/techniques/T1102/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "8.10.0"

[rule]
description = """
This rule detects when a process creates an in-memory file descriptor (memfd_create) followed by an egress network
connection from an unusual executable. This activity indicates an active attempt to execute a fileless payload and
should be considered highly abnormal or suspicious. This activity can occur when the memfd syscall is used to create a
memory-resident file, such as a payload, and then execute it, after which it establishes outbound network connections
for command-and-control (C2).
"""
id = "3e499558-b79d-4cbb-afa0-dc24a0b59ab2"
license = "Elastic License v2"
name = "Egress Network Connection from Memory File Descriptor"
os_list = ["linux"]
reference = ["https://man7.org/linux/man-pages/man2/memfd_create.2.html"]
version = "1.0.11"

query = '''
sequence by process.entity_id with maxspan=10s
  [process where event.type == "start" and event.action == "memfd_create" and (
    process.executable like (
      "memfd:*", "?memfd:*", "/tmp/*", "/var/tmp/*", "/dev/shm/*", "./*", "/run/user/*", "/var/run/user/*",
      "/boot/*", "/sys/*", "/lost+found/*", "/proc/*", "/var/mail/*", "/var/www/*", "/home/*/*", "/root/*"
    ) or
    (process.name like "python*" and process.args == "-c") or
    (process.name like ("perl*", "ruby*", "lua*", "node", "nodejs") and process.args like "-e*") or
    (process.name like "php*" and process.args like "-r*") or
    process.name like (".*", "*.py", "*.pyc", "*.lua", "*.pl", "*.rb", "*.bin", "*.php", "*.js", "*.mjs") or
    (
      process.name like ("python*", "perl*", "php*", "ruby*", "lua*", "node", "java", "javaw") and
      (
        process.args like (
          "/tmp/*", "/var/tmp/*", "/dev/shm/*", "./*", "/run/user/*", "/var/run/user/*",
          "/boot/*", "/sys/*", "/lost+found/*", "/proc/*", "/var/mail/*", "/var/www/*",
          "/home/*/*", "/root/*"
        ) and process.args_count <= 2
      ) 
    )
  ) and
  process.parent.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "mksh", "busybox") and
  not (
    process.executable like (
      "/tmp/.mount_*", "/nix/store/*/bin/.qemu-system-x86_64-wrapped", "/root/.local/share/claude/versions/*", "/home/*/*/*",
      "/usr/bin/qgis.bin", "/app/bin/evolution.bin", "/opt/cpanel/ea-php*/root/usr/bin/php-cgi", "/nix/store/*/bin/.obs-wrapped"
    ) or
    process.command_line == "/usr/bin/php /var/www/glpi/front/cron.php" or
    (
      process.executable == "/home/runner/bin/Runner.Listener" and
      process.Ext.memfd.name == "memfd:doublemapper"
    ) or
    (
      process.name like "php*" and
      process.Ext.memfd.name in ("opcache_lock", "anon_hugepage")
    ) or
    (
      process.executable == "/app/bin/evolution.bin" and
      process.Ext.memfd.name == "memfd:WebKitSharedMemory"
    ) or
    (
      process.name like "python*" and
      process.Ext.memfd.name == "wayland-shm"
    ) or
    (
      process.executable like "/home/*/.local/share/claude/versions/*" and
      process.Ext.memfd.name in ("memfd:spawn_stdio_stdin", "spawn_stdio_stdin")
    ) or
    (
     process.executable like "/home/*/.elixir-install/installs/otp/*/bin/beam.smp" and
     process.Ext.memfd.name == "memfd:vmem"
    ) or
    (
      process.name == "dotnet" and
      process.Ext.memfd.name == "memfd:doublemapper"
    ) or
    (
      process.executable == "/usr/bin/php" and
      process.args like "/var/www/html/*"
    ) or
    (
      process.executable like "/usr/bin/php*" and
      process.working_directory like "/var/www/vhosts/*"
    ) or
    (
      process.executable like "*/.opencode/bin/opencode*" and
      process.Ext.memfd.name == "memfd:spawn_stdio_stdin"
    )
  )]
  [network where event.type == "start" and event.action == "connection_attempted" and 
  not (
    destination.ip == null or destination.ip == "0.0.0.0" or cidrmatch(
    destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.0.0/29",
    "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
    "192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10",
    "192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1", "FE80::/10",
    "FF00::/8"
    )
  )]
'''

min_endpoint_version = "9.1.4"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1106"
name = "Native API"
reference = "https://attack.mitre.org/techniques/T1106/"


[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"
[[threat.technique.subtechnique]]
id = "T1055.009"
name = "Proc Memory"
reference = "https://attack.mitre.org/techniques/T1055/009/"


[[threat.technique]]
id = "T1620"
name = "Reflective Code Loading"
reference = "https://attack.mitre.org/techniques/T1620/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[[threat]]
framework = "MITRE ATT&CK"

[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "9.1.4"

[metadata]
creation_date = "2021/01/11"
integration = ["endpoint"]
maturity = "production"
updated_date = "2026/07/30"

[rule]
author = ["Elastic", "Massimo Bertocchi"]
description = """
Identifies the creation or modification of the Event Monitor Daemon (emond) rules. Adversaries may abuse this service by
writing a rule to execute commands when a defined event occurs, such as system start up or user authentication.
"""
from = "now-9m"
index = ["logs-endpoint.events.file*"]
language = "eql"
license = "Elastic License v2"
name = "Emond Rules Creation or Modification"
references = [
    "https://www.xorrior.com/emond-persistence/",
    "https://www.sentinelone.com/blog/how-malware-persists-on-macos/",
]
risk_score = 47
rule_id = "a6bf4dd4-743e-4da8-8c03-3ebd753a6c90"
setup = """## Setup

This rule requires data coming in from Elastic Defend.

### Elastic Defend Integration Setup
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.

#### Prerequisite Requirements:
- Fleet is required for Elastic Defend.
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).

#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
- Go to the Kibana home page and click "Add integrations".
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
- Click "Add Elastic Defend".
- Configure the integration name and optionally add a description.
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
- Click "Save and Continue".
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
"""
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: macOS",
    "Use Case: Threat Detection",
    "Tactic: Persistence",
    "Data Source: Elastic Defend",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
file where host.os.type == "macos" and event.action == "modification" and
 file.path like ("/private/etc/emond.d/rules/*.plist", "/etc/emond.d/rules/*.plist", "/private/var/db/emondClients/*")
'''
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Emond Rules Creation or Modification

The Event Monitor Daemon (emond) on macOS is a service that executes commands based on specific system events. Adversaries can exploit this by crafting rules to trigger malicious actions during events like startup or login. The detection rule monitors for new or altered emond rule files, signaling potential unauthorized modifications that could indicate persistence tactics.

### Possible investigation steps

- Review the file path of the modified or newly created emond rule to determine if it matches known legitimate configurations or if it appears suspicious, focusing on paths like "/private/etc/emond.d/rules/*.plist" and "/private/var/db/emondClients/*".
- Check the timestamp of the file creation or modification to correlate with any known user activity or scheduled tasks that could explain the change.
- Analyze the contents of the modified or newly created plist file to identify any commands or scripts that are set to execute, looking for signs of malicious intent or unauthorized actions.
- Investigate the user account associated with the file modification event to determine if the activity aligns with their typical behavior or if it suggests potential compromise.
- Cross-reference the event with other security alerts or logs from the same timeframe to identify any related suspicious activities or patterns that could indicate a broader attack.

### False positive analysis

- System or application updates may modify emond rule files as part of legitimate maintenance activities. Users can create exceptions for known update processes by identifying the associated process names or hashes and excluding them from alerts.
- Administrative tasks performed by IT personnel, such as configuring new system policies or settings, might involve legitimate changes to emond rules. To handle these, maintain a list of authorized personnel and their activities, and exclude these from triggering alerts.
- Security software or management tools that automate system configurations could also modify emond rules. Identify these tools and their expected behaviors, and configure exceptions based on their typical file paths or process identifiers.
- Scheduled maintenance scripts that interact with emond rules for system health checks or optimizations should be documented. Exclude these scripts by verifying their signatures or paths to prevent unnecessary alerts.

### Response and remediation

- Immediately isolate the affected macOS system from the network to prevent potential lateral movement or further execution of malicious rules.
- Review and back up the current emond rule files located in the specified directories to understand the scope of modifications and preserve evidence for further analysis.
- Remove or revert any unauthorized or suspicious emond rule files to their original state to stop any malicious actions triggered by these rules.
- Conduct a thorough scan of the system using updated antivirus or endpoint detection tools to identify and remove any additional malware or persistence mechanisms.
- Restore the system from a known good backup if the integrity of the system is in question and unauthorized changes cannot be fully reversed.
- Escalate the incident to the security operations team for further investigation and to determine if other systems may be affected by similar unauthorized emond rule modifications.
- Implement enhanced monitoring and alerting for changes to emond rule files to quickly detect and respond to future unauthorized modifications."""


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1546"
name = "Event Triggered Execution"
reference = "https://attack.mitre.org/techniques/T1546/"

[[rule.threat.technique.subtechnique]]
id = "T1546.014"
name = "Emond"
reference = "https://attack.mitre.org/techniques/T1546/014/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1546"
name = "Event Triggered Execution"
reference = "https://attack.mitre.org/techniques/T1546/"

[[rule.threat.technique.subtechnique]]
id = "T1546.014"
name = "Emond"
reference = "https://attack.mitre.org/techniques/T1546/014/"

[rule.threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[metadata]
creation_date = "2020/10/15"
integration = ["system", "windows"]
maturity = "production"
updated_date = "2026/05/04"

[transform]
[[transform.osquery]]
label = "Osquery - Retrieve DNS Cache"
query = "SELECT * FROM dns_cache"

[[transform.osquery]]
label = "Osquery - Retrieve All Services"
query = "SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"

[[transform.osquery]]
label = "Osquery - Retrieve Services Running on User Accounts"
query = """
SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE
NOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR
user_account == null)
"""

[[transform.osquery]]
label = "Osquery - Retrieve Service Unsigned Executables with Virustotal Link"
query = """
SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,
services.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =
authenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'
"""


[rule]
author = ["Elastic"]
description = """
Identifies instances of an unusual process enumerating built-in Windows privileged local groups membership like
Administrators or Remote Desktop users.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-system.security*", "logs-windows.forwarded*"]
language = "kuery"
license = "Elastic License v2"
name = "Enumeration of Privileged Local Groups Membership"
note = """## Triage and analysis

### Investigating Enumeration of Privileged Local Groups Membership

After successfully compromising an environment, attackers may try to gain situational awareness to plan their next steps. This can happen by running commands to enumerate network resources, users, connections, files, and installed security software.

This rule looks for the enumeration of privileged local groups' membership by suspicious processes, and excludes known legitimate utilities and programs installed. Attackers can use this information to decide the next steps of the attack, such as mapping targets for credential compromise and other post-exploitation activities.

> **Note**:
> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/current/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.

#### Possible investigation steps

- Identify the process, host and user involved on the event.
- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
- Investigate other alerts associated with the user/host during the past 48 hours.
- Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network connections.
- Examine the host for derived artifacts that indicate suspicious activities:
  - Analyze the process executable using a private sandboxed analysis system.
  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
    - Attempts to contact external domains and addresses.
      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
      - Examine the DNS cache for suspicious or anomalous entries.
        - $osquery_0
    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
    - Examine the host services for suspicious or anomalous entries.
      - $osquery_1
      - $osquery_2
      - $osquery_3
  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.

### False positive analysis

- Discovery activities are not inherently malicious if they occur in isolation. As long as the analyst did not identify suspicious activity related to the user or host, such alerts can be dismissed.
- If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination of user and command line conditions.

### Response and remediation

- Initiate the incident response process based on the outcome of the triage.
- Isolate the involved hosts to prevent further post-compromise behavior.
- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
"""
risk_score = 47
rule_id = "291a0de9-937a-4189-94c0-3e847c8b13e4"
setup = """## Setup

Audit Security Group Management must be enabled to generate the events used by this rule.
Setup instructions: https://ela.st/audit-security-group-management
"""
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Discovery",
    "Resources: Investigation Guide",
    "Data Source: Windows Security Event Logs",
]
timestamp_override = "event.ingested"
type = "new_terms"

query = '''
host.os.type:windows and event.category:iam and event.action:user-member-enumerated and 
  (
    group.name:(*Admin* or "RemoteDesktopUsers") or
    winlog.event_data.TargetSid:("S-1-5-32-544" or "S-1-5-32-555")
  ) and 
  not (
    winlog.event_data.SubjectUserName: *$ or
    winlog.event_data.SubjectUserSid: ("S-1-5-19" or "S-1-5-20") or 
    winlog.event_data.CallerProcessName:("-" or 
                                       C\:\\Windows\\System32\\VSSVC.exe or 
                                       C\:\\Windows\\System32\\SearchIndexer.exe or 
                                       C\:\\Windows\\System32\\CompatTelRunner.exe or 
                                       C\:\\Windows\\System32\\oobe\\msoobe.exe or
                                       C\:\\Windows\\System32\\net1.exe or 
                                       C\:\\Windows\\System32\\svchost.exe or 
                                       C\:\\Windows\\System32\\Netplwiz.exe or 
                                       C\:\\Windows\\System32\\msiexec.exe or
                                       C\:\\Windows\\System32\\CloudExperienceHostBroker.exe or
                                       C\:\\Windows\\System32\\RuntimeBroker.exe or
                                       C\:\\Windows\\System32\\wbem\\WmiPrvSE.exe or
                                       C\:\\Windows\\System32\\SrTasks.exe or
                                       C\:\\Windows\\System32\\diskshadow.exe or
                                       C\:\\Windows\\System32\\dfsrs.exe or
                                       C\:\\Windows\\System32\\vssadmin.exe or
                                       C\:\\Windows\\System32\\dllhost.exe or
                                       C\:\\Windows\\System32\\mmc.exe or
                                       C\:\\Windows\\System32\\SettingSyncHost.exe or
                                       C\:\\Windows\\System32\\inetsrv\\w3wp.exe or
                                       C\:\\Windows\\System32\\wsmprovhost.exe or
                                       C\:\\Windows\\System32\\mstsc.exe or
                                       C\:\\Windows\\System32\\esentutl.exe or
                                       C\:\\Windows\\System32\\RecoveryDrive.exe or
                                       C\:\\Windows\\System32\\SystemPropertiesComputerName.exe or
                                       C\:\\Windows\\SysWOW64\\msiexec.exe or
                                       C\:\\Windows\\System32\\taskhostw.exe or
                                       C\:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe or
                                       C\:\\Windows\\Temp\\rubrik_vmware*\\snaptool.exe or
                                       C\:\\Windows\\VeeamVssSupport\\VeeamGuestHelper.exe or
                                       C\:\\WindowsAzure\\*WaAppAgent.exe or
                                       C\:\\$WINDOWS.~BT\\Sources\\*.exe
                                      )
  )
'''


[[rule.filters]]

[rule.filters.meta]
negate = true
[rule.filters.query.wildcard."winlog.event_data.CallerProcessName"]
case_insensitive = true
value = "C:\\\\Program Files (x86)\\\\*.exe"
[[rule.filters]]

[rule.filters.meta]
negate = true
[rule.filters.query.wildcard."winlog.event_data.CallerProcessName"]
case_insensitive = true
value = "C:\\\\Program Files\\\\*.exe"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1069"
name = "Permission Groups Discovery"
reference = "https://attack.mitre.org/techniques/T1069/"
[[rule.threat.technique.subtechnique]]
id = "T1069.001"
name = "Local Groups"
reference = "https://attack.mitre.org/techniques/T1069/001/"



[rule.threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"

[rule.new_terms]
field = "new_terms_fields"
value = ["winlog.event_data.CallerProcessName"]
[[rule.new_terms.history_window_start]]
field = "history_window_start"
value = "now-5d"

[metadata]
creation_date = "2026/06/24"
integration = ["endpoint"]
maturity = "production"
updated_date = "2026/07/06"

[rule]
author = ["Elastic"]
description = """
Identifies GenAI agent CLIs started with permission-bypass or auto-approval flags that disable human-in-the-loop
guardrails. These modes are intended for isolated sandboxes but are frequently misused on internet-connected developer
workstations, allowing prompt injection, compromised dependencies, or malicious skills to execute commands, modify
files, or reach sensitive paths without confirmation.
"""
from = "now-9m"
index = ["logs-endpoint.events.process-*"]
language = "eql"
license = "Elastic License v2"
name = "GenAI CLI Started with Unsafe Permission Bypass"
note = """## Triage and analysis

### Investigating GenAI CLI Started with Unsafe Permission Bypass

GenAI coding agents normally prompt before running shell commands or editing files. Vendor-supplied bypass flags remove
those controls entirely or auto-approve all tool calls. On a networked host this materially increases blast radius from
prompt injection, poisoned MCP servers, malicious project configs, and autonomous agent workflows.

### Possible investigation steps

- Identify which GenAI tool and bypass flag were used from `process.command_line` and `process.executable`.
- Determine whether the session was intentional (CI/CD, isolated lab VM) or an interactive developer workstation.
- Review child processes spawned after startup for credential access, network exfiltration, or persistence.
- Check for recent GenAI config changes (MCP servers, skills, `.claude/settings.json`, `~/.codex/config.toml`).
- Correlate with other GenAI-related alerts on the same host and user.

### False positive analysis

- Deliberate use in approved sandbox/CI images with no outbound network access.
- Internal automation scripts that wrap GenAI CLIs with bypass flags; scope exceptions by host or user group.
- Each matching process start produces one alert; habitual bypass use in CI or developer workflows may need host or user exceptions.

### Response and remediation

- Remove bypass flags from scripts, shell profiles, and CI job definitions; use default or plan-only permission modes.
- Rotate API keys and cloud credentials accessible to the user account that ran the agent.
- Audit GenAI tool configs and MCP servers loaded during the session.
- Restrict GenAI agent usage policies to disallow permission bypass on production endpoints.
"""
references = [
    "https://code.claude.com/docs/en/permission-modes",
    "https://developers.openai.com/codex/cli/reference",
    "https://developers.openai.com/codex/agent-approvals-security",
    "https://google-gemini.github.io/gemini-cli/docs/get-started/configuration.html",
    "https://specterops.io/blog/2025/11/21/an-evening-with-claude-code/",
]
risk_score = 47
rule_id = "c1326e45-6d3c-4a2d-9882-606a0c310299"
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: Linux",
    "OS: macOS",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Defense Evasion",
    "Data Source: Elastic Defend",
    "Resources: Investigation Guide",
    "Domain: LLM",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
process where event.type == "start" and event.action in ("exec", "start") and
(
  (
    process.args in (
      "--dangerously-skip-permissions",
      "--allow-dangerously-skip-permissions",
      "--permission-mode=bypassPermissions"
    ) or
    (process.args == "--permission-mode" and process.args == "bypassPermissions")
  ) and
  (
    process.name in ("claude", "claude.exe") or
    process.executable : (
      "*/.local/share/claude/versions/*",
      "*/.claude/downloads/*",
      "*Caskroom/claude-code/*",
      "*\\Claude\\versions\\*"
    ) or
    (process.name in ("node", "node.exe") and process.args : "*@anthropic-ai/claude-code*")
  )
) or
(
  (
    process.args in ("--dangerously-bypass-approvals-and-sandbox", "--full-auto", "--yolo") or
    process.command_line : (
      "* -s danger-full-access*",
      "*--sandbox danger-full-access*",
      "*--sandbox=danger-full-access*",
      "*--ask-for-approval never*",
      "*--ask-for-approval=never*"
    )
  ) and
  (
    process.name in (
      "codex", "codex.exe", "codex-exec",
      "codex-aarch64-apple-darwin", "codex-x86_64-apple-darwin",
      "codex-linux-arm64", "codex-linux-x64"
    ) or
    (process.name in ("node", "node.exe") and process.args : ("*@openai/codex*", "*/codex", "*\\codex*"))
  )
) or
(
  (
    process.args in ("--yolo", "-y") or
    (process.args == "--approval-mode" and process.args == "yolo") or
    process.args == "--approval-mode=yolo"
  ) and
  (
    process.name in ("gemini", "gemini-cli", "gemini.exe", "gemini-cli.exe") or
    (process.name in ("node", "node.exe") and process.args : ("*@google/gemini-cli*", "*/gemini", "*\\gemini*"))
  )
) or
(
  (
    process.args in (
      "--yolo",
      "--autopilot",
      "--allow-all",
      "--allow-all-tools",
      "--allow-all-paths",
      "--allow-all-urls"
    )
  ) and
  (
    process.name in ("copilot", "copilot.exe") or
    (process.name in ("node", "node.exe") and process.args : ("*@github/copilot*", "*/copilot", "*\\copilot*"))
  )
) or
(
  process.args == "--dangerously-skip-permissions" and
  (
    process.name in ("opencode", "opencode.exe", ".opencode") or
    process.executable : ("*opencode-ai*", "*\\.opencode*") or
    (process.name in ("node", "node.exe") and process.args : ("*opencode-ai*", "*/opencode", "*\\opencode*"))
  )
)
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[rule.threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"



[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[rule]
description = """
Identifies the execution of Windows utilities to tamper with Data Backup related services. Adversaries may delete or
remove built-in operating system data and turn off services designed to aid in the recovery of a corrupted system and
prevent recovery.
"""
id = "220ab556-e008-44d4-9c50-44d455225eee"
license = "Elastic License v2"
name = "Inhibit System Recovery via Stopping Backup Services"
os_list = ["windows"]
version = "1.0.26"

query = '''
sequence with maxspan=1m
 [process where event.action == "start" and
  (
  (process.executable : ("?:\\ProgramData\\*", "?:\\Users\\*", "?:\\Python*") and
   not process.code_signature.trusted == true) or
   process.name : ("rundll32.exe", "regsvr32.exe", "cscript.exe", "wscript.exe", "java*.exe", "powershell.exe", "cmd.exe")
   ) and

   not process.parent.command_line: ("*:\\Program Files\\*", "*:\\Program Files (x86)\\*") and
   not process.parent.executable :
                ("?:\\Windows\\System32\\svchost.exe",
                 "?:\\Windows\\VeeamVssSupport\\VeeamGuestHelper.exe",
                 "?:\\Windows\\Microsoft.NET\\Framework\\*\\InstallUtil.exe",
                 "?:\\Windows\\System32\\taskeng.exe",
                 "?:\\Program Files\\Symantec\\Backup Exec\\RAWS\\VSS Provider\\bevssrequestor.exe",
                 "?:\\Program Files\\Veritas\\Backup Exec\\RAWS\\VSS Provider\\bevssrequestor.exe",
                 "?:\\Program Files\\Veritas\\Veritas VSS Provider\\bevssrequestor.exe",
                 "?:\\Program Files\\VMware\\VMware Tools\\vmtoolsd.exe",
                 "?:\\Program Files\\Rubrik\\Rubrik Backup Service\\rba.exe") and
   process.parent.executable != null and
   not (process.name : "cmd.exe" and
        process.args : ("?:\\Users\\*\\AppData\\Local\\Temp\\rubrik_vmware*\\uninstall-provider.cmd",
                        "Master\\DC\\bin\\x64\\*-EaseUSprovider.cmd",
                        "Files\\QNAP\\VSS")) and
   not (process.parent.name : "powershell.exe" and process.parent.args : "Start-Process .\\Stores\\Files\\restartSqlServer.bat -Verb RunAs")
 ] by process.entity_id
 [process where event.action == "start" and
  process.pe.original_file_name : ("net.exe", "sc.exe", "cmd.exe") and
  process.args : ("stop", "disabled") and
  process.args :
     ("SamSss", "VSS", "SDRSVC", "wbengine", "GoogleVssAgent", "SstpSvc", "sacsvr", "vmicvss", "SQLWriter", "SQLTELEMETRY*", 
      "VeeamNFSSvc*", "VeeamTransportSvc*", "acronis*", "*backup*", "iisadmin", "veeamtransportsvc", "MSSQL*", "SQLSERVER*",
      "dosvc", "MongoDB", "Oracle*", "NFSysService", "SentinelKeysServer", "DellDRLogSvc", "TPlusStd*", "TurboCRM70", "U8*Service") and

  not (process.args : "vss" and process.parent.args : ("?:\\Windows\\TEMP\\rubrik_vmware*", "Agent\\InMageVSSProvider_Install.cmd"))
 ] by process.parent.entity_id
 [process where event.action == "start" and
  process.pe.original_file_name : ("net.exe", "sc.exe", "cmd.exe") and
  process.args : ("stop", "disabled") and
  process.args :
     ("SamSss", "VSS", "SDRSVC", "wbengine", "GoogleVssAgent", "SstpSvc", "sacsvr", "vmicvss", "SQLWriter", "SQLTELEMETRY*",
      "VeeamNFSSvc*", "VeeamTransportSvc*", "acronis*", "*backup*", "iisadmin", "veeamtransportsvc", "MSSQL*", "SQLSERVER*",
      "dosvc", "MongoDB", "Oracle*", "NFSysService", "SentinelKeysServer", "DellDRLogSvc", "TPlusStd*", "TurboCRM70", "U8*Service") and

  not (process.args : "vss" and process.parent.args : ("?:\\Windows\\TEMP\\rubrik_vmware*", "Agent\\InMageVSSProvider_Install.cmd"))
 ] by process.parent.entity_id
'''

min_endpoint_version = "7.15.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 1

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1490"
name = "Inhibit System Recovery"
reference = "https://attack.mitre.org/techniques/T1490/"


[threat.tactic]
id = "TA0040"
name = "Impact"
reference = "https://attack.mitre.org/tactics/TA0040/"

[internal]
min_endpoint_version = "7.15.0"

[rule]
description = """
Detects when the ssh-keygen binary is executed with the -D argument which can be used to load a malicious shared object
into memory.
"""
id = "cc29bf55-8d7f-45df-b8fe-212968c8951c"
license = "Elastic License v2"
name = "Linux Shared Object Load via SSH-Keygen"
os_list = ["linux"]
reference = [
    "https://medium.com/@D00MFist/generate-keys-or-generate-dylib-loads-c99ed48f323d",
    "https://gtfobins.github.io/gtfobins/ssh-keygen/",
]
version = "1.0.5"

query = '''
process where event.action == "exec" and event.type == "start" and process.name == "ssh-keygen" and
process.args == "-D" and process.args_count >= 3 and not process.args : (
  "/lib/*", "/usr/lib/*", "/usr/local/lib/*",
  "/lib64/*", "/usr/lib64/*", "/usr/local/lib64/*"
)
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1574"
name = "Hijack Execution Flow"
reference = "https://attack.mitre.org/techniques/T1574/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.15.0"

[metadata]
creation_date = "2023/08/23"
integration = ["endpoint", "crowdstrike", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2026/03/24"

[transform]
[[transform.osquery]]
label = "Osquery - Retrieve Listening Ports"
query = "SELECT pid, address, port, socket, protocol, path FROM listening_ports"

[[transform.osquery]]
label = "Osquery - Retrieve Open Sockets"
query = "SELECT pid, family, remote_address, remote_port, socket, state FROM process_open_sockets"

[[transform.osquery]]
label = "Osquery - Retrieve Information for a Specific User"
query = "SELECT * FROM users WHERE username = {{user.name}}"

[[transform.osquery]]
label = "Osquery - Investigate the Account Authentication Status"
query = "SELECT * FROM logged_in_users WHERE user = {{user.name}}"

[[transform.osquery]]
label = "Osquery - Retrieve Running Processes by User"
query = "SELECT pid, username, name FROM processes p JOIN users u ON u.uid = p.uid ORDER BY username"

[[transform.osquery]]
label = "Osquery - Retrieve Process Info"
query = "SELECT name, cmdline, parent, path, uid FROM processes"


[rule]
author = ["Elastic"]
description = """
This rule monitors for X11 forwarding via SSH. X11 forwarding is a feature that allows users to run graphical
applications on a remote server and display the application's graphical user interface on their local machine. Attackers
can abuse X11 forwarding for tunneling their GUI-based tools, pivot through compromised systems, and create covert
communication channels, enabling lateral movement and facilitating remote control of systems within a network.
"""
from = "now-9m"
index = [
    "endgame-*",
    "logs-crowdstrike.fdr*",
    "logs-endpoint.events.process*",
    "logs-sentinel_one_cloud_funnel.*",
]
language = "eql"
license = "Elastic License v2"
name = "Linux SSH X11 Forwarding"
note = """## Triage and analysis

### Investigating Linux SSH X11 Forwarding

Attackers can leverage SSH X11 forwarding to capture a user's graphical desktop session and potentially execute unauthorized GUI applications remotely.

This rule looks for the execution of SSH in conjunction with command line arguments that are capable of setting up X11 forwarding.

> **Note**:
> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/current/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.

#### Possible investigation steps

- Identify any signs of suspicious network activity or anomalies that may indicate network forwarding activity. This could include unexpected traffic patterns or unusual network behavior.
  - Investigate listening ports and open sockets to look for potential protocol tunneling, reverse shells, or data exfiltration.
    - $osquery_0
    - $osquery_1
- Identify the user account that performed the action, analyze it, and check whether it should perform this kind of action.
  - $osquery_2
- Investigate whether the user is currently logged in and active.
  - $osquery_3
- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence and whether they are located in expected locations.
  - $osquery_4
  - $osquery_5
- Investigate other alerts associated with the user/host during the past 48 hours.
  - If scripts or executables were dropped, retrieve the files and determine if they are malicious:
    - Use a private sandboxed malware analysis system to perform analysis.
      - Observe and collect information about the following activities:
        - Attempts to contact external domains and addresses.
          - Check if the domain is newly registered or unexpected.
          - Check the reputation of the domain or IP address.
        - File access, modification, and creation activities.

### Related rules

- Potential Linux Tunneling and/or Port Forwarding - 6ee947e9-de7e-4281-a55d-09289bdf947e

### False positive analysis

- If this activity is related to new benign software installation activity, consider adding exceptions — preferably with a combination of user and command line conditions.
- If this activity is related to a system administrator or developer who uses port tunneling/forwarding for benign purposes, consider adding exceptions for specific user accounts or hosts.
- Try to understand the context of the execution by thinking about the user, machine, or business purpose. A small number of endpoints, such as servers with unique software, might appear unusual but satisfy a specific business need.

### Response and remediation

- Initiate the incident response process based on the outcome of the triage.
- Isolate the involved host to prevent further post-compromise behavior.
- If the triage identified malware, search the environment for additional compromised hosts.
  - Implement temporary network rules, procedures, and segmentation to contain the malware.
  - Stop suspicious processes.
  - Immediately block the identified indicators of compromise (IoCs).
  - Inspect the affected systems for additional malware backdoors, such as reverse shells, reverse proxies, or droppers, that attackers could use to reinfect the system.
- Remove and block malicious artifacts identified during triage.
- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
- Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
"""
references = ["https://book.hacktricks.xyz/generic-methodologies-and-resources/tunneling-and-port-forwarding"]
risk_score = 21
rule_id = "29f0cf93-d17c-4b12-b4f3-a433800539fa"
severity = "low"
tags = [
    "Domain: Endpoint",
    "OS: Linux",
    "Use Case: Threat Detection",
    "Tactic: Command and Control",
    "Data Source: Elastic Defend",
    "Data Source: Elastic Endgame",
    "Data Source: Crowdstrike",
    "Data Source: SentinelOne",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
process where host.os.type == "linux" and event.type == "start" and event.action in ("exec", "exec_event", "start", "ProcessRollup2") and
process.name in ("ssh", "sshd") and process.args in ("-X", "-Y") and process.args_count >= 3 and
process.parent.name in ("bash", "dash", "ash", "sh", "tcsh", "csh", "zsh", "ksh", "fish")
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1572"
name = "Protocol Tunneling"
reference = "https://attack.mitre.org/techniques/T1572/"

[rule.threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1021"
name = "Remote Services"
reference = "https://attack.mitre.org/techniques/T1021/"

[[rule.threat.technique.subtechnique]]
id = "T1021.004"
name = "SSH"
reference = "https://attack.mitre.org/techniques/T1021/004/"

[rule.threat.tactic]
id = "TA0008"
name = "Lateral Movement"
reference = "https://attack.mitre.org/tactics/TA0008/"