Elastic rules: 1s

[metadata]
creation_date = "2024/05/31"
integration = ["endpoint"]
maturity = "production"
updated_date = "2025/12/22"

[rule]
author = ["Elastic"]
description = """
This rule monitors for at jobs being created or renamed. Linux at jobs are scheduled tasks that can be leveraged by
system administrators to set up scheduled tasks, but may be abused by malicious actors for persistence, privilege
escalation and command execution. By creating or modifying cron job configurations, attackers can execute malicious
commands or scripts at predefined intervals, ensuring their continued presence and enabling unauthorized activities.
"""
from = "now-9m"
index = ["logs-endpoint.events.file*"]
language = "eql"
license = "Elastic License v2"
name = "At Job Created or Modified"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating At Job Created or Modified

The 'at' command in Linux schedules tasks for future execution, aiding system admins in automating routine jobs. However, attackers can exploit this for persistence, privilege escalation, or executing unauthorized commands. The detection rule identifies suspicious 'at' job creations or modifications by monitoring specific file paths and excluding benign processes, helping to flag potential malicious activities.

### Possible investigation steps

- Review the file path of the created or modified 'at' job to confirm it is within the monitored directory: /var/spool/cron/atjobs/*. Determine if the file path is expected or unusual for the system's typical operations.
- Identify the process that triggered the alert by examining the process.executable field. Check if the process is known and expected in the context of the system's normal operations.
- Investigate the user account associated with the process that created or modified the 'at' job. Determine if the account has legitimate reasons to schedule tasks or if it might be compromised.
- Check the contents of the 'at' job file to understand the commands or scripts scheduled for execution. Look for any suspicious or unauthorized commands that could indicate malicious intent.
- Correlate the event with other recent alerts or logs from the same host to identify any patterns or additional indicators of compromise, such as privilege escalation attempts or unauthorized access.
- Verify if there are any known vulnerabilities or exploits associated with the processes or commands involved in the alert, which could provide further context on the potential threat.

### False positive analysis

- System package managers like dpkg, rpm, and yum can trigger false positives when they create or modify at jobs during software installations or updates. To manage this, ensure these processes are included in the exclusion list within the detection rule.
- Automated system management tools such as Puppet and Chef may also create or modify at jobs as part of their routine operations. Add these tools to the exclusion list to prevent unnecessary alerts.
- Temporary files with extensions like swp or dpkg-remove can be mistakenly flagged. Exclude these file extensions from the rule to reduce false positives.
- Processes running from directories like /nix/store or /snap can be benign and should be considered for exclusion if they are part of regular system operations.
- If the process executable is null, it might indicate a benign system process that lacks a defined executable path. Consider reviewing these cases to determine if they are legitimate and adjust the rule accordingly.

### Response and remediation

- Immediately isolate the affected system from the network to prevent further unauthorized access or execution of malicious tasks.
- Terminate any suspicious processes associated with the creation or modification of 'at' jobs that are not part of the excluded benign processes.
- Review and remove any unauthorized 'at' jobs found in the /var/spool/cron/atjobs/ directory to eliminate persistence mechanisms.
- Conduct a thorough examination of the system for additional indicators of compromise, such as unauthorized user accounts or unexpected network connections.
- Restore the system from a known good backup if malicious activity is confirmed and cannot be fully remediated.
- Escalate the incident to the security operations team for further analysis and to determine if additional systems are affected.
- Implement enhanced monitoring and logging for 'at' job activities to detect similar threats in the future, ensuring that alerts are promptly reviewed and acted upon."""
references = ["https://www.elastic.co/security-labs/primer-on-persistence-mechanisms"]
risk_score = 47
rule_id = "84755a05-78c8-4430-8681-89cd6c857d71"
setup = """## Setup

This rule requires data coming in from Elastic Defend.

### Elastic Defend Integration Setup
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.

#### Prerequisite Requirements:
- Fleet is required for Elastic Defend.
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).

#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
- Go to the Kibana home page and click "Add integrations".
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
- Click "Add Elastic Defend".
- Configure the integration name and optionally add a description.
- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
- Click "Save and Continue".
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
"""
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: Linux",
    "Use Case: Threat Detection",
    "Tactic: Persistence",
    "Tactic: Privilege Escalation",
    "Tactic: Execution",
    "Data Source: Elastic Defend",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"
query = '''
file where host.os.type == "linux" and event.action in ("rename", "creation") and
file.path like ("/var/spool/cron/atjobs/*", "/var/spool/atjobs/*") and
not (
  process.executable in (
    "/bin/dpkg", "/usr/bin/dpkg", "/bin/dockerd", "/usr/bin/dockerd", "/usr/sbin/dockerd", "/bin/microdnf",
    "/usr/bin/microdnf", "/bin/rpm", "/usr/bin/rpm", "/bin/snapd", "/usr/bin/snapd", "/bin/yum", "/usr/bin/yum",
    "/bin/dnf", "/usr/bin/dnf", "/bin/podman", "/usr/bin/podman", "/bin/dnf-automatic", "/usr/bin/dnf-automatic",
    "/bin/pacman", "/usr/bin/pacman", "/usr/bin/dpkg-divert", "/bin/dpkg-divert", "/sbin/apk", "/usr/sbin/apk",
    "/usr/local/sbin/apk", "/usr/bin/apt", "/usr/sbin/pacman", "/bin/podman", "/usr/bin/podman", "/usr/bin/puppet",
    "/bin/puppet", "/opt/puppetlabs/puppet/bin/puppet", "/usr/bin/chef-client", "/bin/chef-client",
    "/bin/autossl_check", "/usr/bin/autossl_check", "/proc/self/exe", "/dev/fd/*",  "/usr/bin/pamac-daemon",
    "/bin/pamac-daemon", "/usr/local/bin/dockerd", "./usr/bin/podman"
  ) or
  file.extension in ("swp", "swpx", "swx", "dpkg-remove") or
  file.Ext.original.extension == "dpkg-new" or
  process.executable : ("/nix/store/*", "/var/lib/dpkg/*", "/tmp/vmis.*", "/snap/*", "/dev/fd/*") or
  process.executable == null or
  (process.name == "sed" and file.name : "sed*") or
  (process.name == "perl" and file.name : "e2scrub_all.tmp*")
)
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1053"
name = "Scheduled Task/Job"
reference = "https://attack.mitre.org/techniques/T1053/"

[[rule.threat.technique.subtechnique]]
id = "T1053.002"
name = "At"
reference = "https://attack.mitre.org/techniques/T1053/002/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1053"
name = "Scheduled Task/Job"
reference = "https://attack.mitre.org/techniques/T1053/"

[[rule.threat.technique.subtechnique]]
id = "T1053.002"
name = "At"
reference = "https://attack.mitre.org/techniques/T1053/002/"

[rule.threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1053"
name = "Scheduled Task/Job"
reference = "https://attack.mitre.org/techniques/T1053/"

[[rule.threat.technique.subtechnique]]
id = "T1053.002"
name = "At"
reference = "https://attack.mitre.org/techniques/T1053/002/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[metadata]
creation_date = "2020/05/21"
integration = ["aws"]
maturity = "production"
updated_date = "2026/04/10"

[rule]
author = ["Elastic"]
description = """
Detects when an IAM group is deleted using the DeleteGroup API call. Deletion of an IAM group may represent a malicious
attempt to remove audit trails, disrupt operations, or hide adversary activity (for example after using the group
briefly for privileged access). This can be an indicator of impact or cleanup in an attack lifecycle.
"""
false_positives = [
    """
    Legitimate group deletion during decommissioning of projects, clean-up of service accounts, or identity lifecycle
    changes may trigger this alert. Verify whether the user identity, user agent, and/or hostname should be making
    changes in your environment. Resource group deletions by unfamiliar users or hosts should be investigated. If known
    behavior is causing false positives, it can be exempted from the rule.
    """,
]
from = "now-6m"
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
language = "kuery"
license = "Elastic License v2"
name = "AWS IAM Group Deletion"
note = """## Triage and analysis

### Investigating AWS IAM Group Deletion

Attackers sometimes remove groups to erase evidence, disrupt operations, or prevent users from receiving needed permissions (Impact). Deletion can also follow malicious cleanup after attaching policies and using the group briefly. This alert fires on `DeleteGroup` API call. Consider intentional disruption or covering tracks, particularly if the group was privileged or recently modified.

### Possible investigation steps

- **Identify the actor and environment**  
  - Review `aws.cloudtrail.user_identity.arn`, `aws.cloudtrail.user_identity.access_key_id`.  
  - Check `source.ip`, `user_agent.original`, `cloud.account.id`, `cloud.region` for atypical activity.

- **Determine what was lost**
  - From `aws.cloudtrail.request_parameters`, capture `groupName`.  
  - Use history or logs to identify existing members and attached policies prior to deletion (ex: `GetGroup`, `ListAttachedGroupPolicies`).  
  - Determine if the group contained privileged roles/policies that could have been weaponized.

- **Correlate with related activity**
  - Look in the prior 1–24h for `DetachGroupPolicy`, `RemoveUserFromGroup`, `DeleteGroupPolicy`, which often precede deletion in adversary cleanup workflows.  
  - After deletion, monitor for creation of new similarly-named groups, or re-attachment of policies to other groups/roles.

### False positive analysis

- Projects & services that are being decommissioned often require group deletion. Confirm through internal inventory and change control.  
- Sandbox or dev accounts frequently create and delete groups; ensure the environment context is understood.

### Response and remediation

- **Containment**: If deletion was unauthorized, restrict the actor’s IAM privileges and block further configuration changes.  
- **Investigation and scoping**: Recover details of the deleted group (members, policies) from logs or AWS Config, and determine the impact of the deletion (which users lost membership, service account disruption).  
- **Recovery and hardening**: Recreate the group if necessary, restore intended policies and memberships, enforce change-control for group deletions, restrict `iam:DeleteGroup` privileges, and create alerts for destructive IAM operations.

### Additional information
[AWS Security Best Practices](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/)
"""
references = [
    "https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/delete-group.html",
    "https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteGroup.html",
]
risk_score = 21
rule_id = "867616ec-41e5-4edc-ada2-ab13ab45de8a"
severity = "low"
tags = [
    "Domain: Cloud",
    "Data Source: AWS",
    "Data Source: Amazon Web Services",
    "Data Source: AWS IAM",
    "Tactic: Impact",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset: aws.cloudtrail and 
    event.provider: iam.amazonaws.com and 
    event.action: DeleteGroup and 
    event.outcome: success
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1531"
name = "Account Access Removal"
reference = "https://attack.mitre.org/techniques/T1531/"


[rule.threat.tactic]
id = "TA0040"
name = "Impact"
reference = "https://attack.mitre.org/tactics/TA0040/"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user_agent.original",
    "source.ip",
    "aws.cloudtrail.user_identity.arn",
    "aws.cloudtrail.user_identity.type",
    "aws.cloudtrail.user_identity.access_key_id",
    "event.action",
    "event.outcome",
    "cloud.account.id",
    "cloud.region",
    "aws.cloudtrail.request_parameters",
]

[rule]
description = """
Identifies instances of the Control Panel application running with suspicious keywords or paths in the process command
line value. Adversaries may abuse Control.exe to proxy execution of malicious code.
"""
id = "a4862afb-1292-4f65-a15f-8d6a8019b5e2"
license = "Elastic License v2"
name = "Control Panel Process with Unusual Arguments"
os_list = ["windows"]
version = "1.0.31"

query = '''
process where event.action == "start" and
(

 (process.executable : ("?:\\Windows\\SysWOW64\\control.exe", "?:\\Windows\\System32\\control.exe") and
  process.command_line :
          ("*.jpg*",
           "*.png*",
           "*.gif*",
           "*.bmp*",
           "*.jpeg*",
           "*.TIFF*",
           "*.inf*",
           "*.dat*",
           "*.cpl:../*",
           "*..\\..\\*",
           "*/AppData/Local/*",
           "*:\\Users\\Public\\*",
           "*\\AppData\\Local\\*") and 
           
  /* excluding FPs where /name arg is used to specify a control by name */
  not (process.args : "/name" and process.args_count >= 2) and
  /* excluding system IL to minimize risk of killing system critical execution */
  not process.Ext.token.integrity_level_name == "system") or

  (process.name : "rundll32.exe" and process.command_line : "*shell32*#*44*" and
   not (process.parent.name : "rundll32.exe" and process.parent.command_line : "*Shell32*Control_RunDLL*")) or

  (process.name : "rundll32.exe" and process.command_line : "*shell32*#*44*" and
   not process.command_line : "*.cpl*" and process.args_count >= 3) or

  (process.name : "rundll32.exe" and process.command_line : "*shell32*#*44*" and process.args_count >= 3 and
   (process.command_line : ("*/AppData/Local/*", "*:\\Users\\Public\\*", "*\\AppData\\Local\\*", "*:\\ProgramData\\*") or
    process.working_directory : ("?:\\Users\\*\\AppData\\Local\\*", "?:\\Users\\Public\\*")))
) and
not (process.name : "rundll32.exe" and process.args : ("OpenAs_RunDLL", "ShellExec_RunDLL"))
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[[threat.technique.subtechnique]]
id = "T1218.002"
name = "Control Panel"
reference = "https://attack.mitre.org/techniques/T1218/002/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.15.0"

[rule]
description = """
Detects executable file creation or modification via SSH sessions in temporary directories. This indicates potential
malware deployment or tool staging by threat actors.
"""
id = "47205a9a-836c-4bed-b068-575eed26478d"
license = "Elastic License v2"
name = "Executable File Modification via SSH"
os_list = ["macos"]
version = "1.0.5"

query = '''
file where event.action == "modification" and file.Ext.header_bytes like~ ("cffaedfe*", "cafebabe*") and
 file.path like ("/Users/Shared/*", "/tmp/*", "/private/tmp/*", "/var/tmp/*", "/private/var/tmp/*") and 
 (process.name in ("ssh", "sshd", "sshd-session") or Effective_process.name in ("ssh", "sshd", "sshd-session")) and
 not process.code_signature.subject_name like "Software Signing"
'''

min_endpoint_version = "8.16.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "Effective_process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1105"
name = "Ingress Tool Transfer"
reference = "https://attack.mitre.org/techniques/T1105/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "8.16.0"

[rule]
description = """
Identifies built-in Windows programs that have been renamed and can be used for execution, downloads, and/or evasion.
Attackers may abuse this tactic to evade filename based detection of built-in tools.
"""
id = "b0207677-5041-470b-981d-13ab956cf5b4"
license = "Elastic License v2"
name = "Execution via Renamed Signed Binary Proxy"
os_list = ["windows"]
reference = [
    "https://lolbas-project.github.io",
    "https://www.elastic.co/security-labs/unmasking-financial-services-intrusion-ref0657",
]
version = "1.0.40"

query = '''
process where event.action == "start" and
 process.name != null and
     (
       (process.pe.original_file_name == "cscript.exe" and not process.name : "cscript.exe") or
       (process.pe.original_file_name == "wscript.exe" and not process.name : "wscript.exe") or
       (process.pe.original_file_name == "PowerShell.EXE" and not process.name : "PowerShell.EXE") or
       (process.pe.original_file_name == "Cmd.Exe" and not process.name : ("Cmd.Exe", "command.com")) or
       (process.pe.original_file_name == "MSHTA.EXE" and not process.name : "MSHTA.EXE") or
       (process.pe.original_file_name == "RUNDLL32.EXE" and not process.name : "RUNDLL32.EXE") or
       (process.pe.original_file_name == "REGSVR32.EXE" and not process.name : "REGSVR32.EXE") or
       (process.pe.original_file_name == "MSBuild.exe" and not process.name : "MSBuild.exe") or
       (process.pe.original_file_name == "InstallUtil.exe" and not process.name : "InstallUtil.exe") or
       (process.pe.original_file_name == "RegAsm.exe" and not process.name : "RegAsm.exe") or
       (process.pe.original_file_name == "RegSvcs.exe" and not process.name : "RegSvcs.exe") or
       (process.pe.original_file_name == "msxsl.exe" and not process.name : "msxsl.exe") or
       (process.pe.original_file_name == "Microsoft.Workflow.Compiler.exe" and
        not process.name : "Microsoft.Workflow.Compiler.exe") or
       (process.pe.original_file_name == "msiexec.exe" and not process.name : "msiexec.exe" and
        not process.executable : "?:\\Windows\\Installer\\MSI*.tmp") or
       (process.pe.original_file_name == "CMSTP.EXE" and not process.name : "CMSTP.EXE") or
       (process.pe.original_file_name == "bitsadmin.exe" and not process.name : "bitsadmin.exe") or
       (process.pe.original_file_name == "CertUtil.exe" and not process.name : "CertUtil.exe") or
       (process.pe.original_file_name == "wmic.exe" and not process.name : "wmic.exe") or
       (process.pe.original_file_name == "schtasks.exe" and not process.name : "schtasks.exe") or
       (process.pe.original_file_name == "wuauclt.exe" and not process.name : "wuauclt.exe") or
       (process.pe.original_file_name == "Bginfo.exe" and not process.name : "Bginfo*.exe") or
       (process.pe.original_file_name == "VsJITDebugger.exe" and not process.name : "VsJITDebugger.exe") or
       (process.pe.original_file_name == "xwizard.exe" and not process.name : "xwizard.exe") or
       (process.pe.original_file_name == "extexport.exe" and not process.name : "extexport.exe") or
       (process.pe.original_file_name == "CertReq.exe" and not process.name : "CertReq.exe") or
       (process.pe.original_file_name == "bsdtar" and not process.name : "tar.exe" and
        process.code_signature.subject_name == "Microsoft Windows") or 
       (process.pe.original_file_name : "GfxDownloadWrapper.exe" and not process.name : "GfxDownloadWrapper.exe") or
       (process.pe.original_file_name : "devinit.dll" and
        process.code_signature.subject_name : "Microsoft *" and not process.name : "devinit.exe") or
       (process.pe.original_file_name == "DumpMinitool.exe" and
        process.code_signature.subject_name : "Microsoft *" and not process.name : "DumpMinitool.exe") or
       (process.pe.original_file_name == "curl.exe" and
        process.code_signature.subject_name : "Microsoft *" and not process.name : "curl.exe")
     ) and
 /* some third party programs tend to include renamed binaries, still often run from trusted paths */
 not process.executable :
        (
          "?:\\Windows\\System32\\*.exe",
          "?:\\Windows\\SysWOW64\\*.exe",
          "?:\\Program Files (x86)\\*.exe",
          "?:\\Program Files\\*.exe",
          "\\Device\\HarddiskVolume*\\Windows\\System32\\*.exe",
          "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\*.exe",
          "\\Device\\HarddiskVolume*\\Windows\\Microsoft.NET\\*.exe",
          "\\Device\\HarddiskVolume*\\Program Files (x86)\\*.exe",
          "\\Device\\HarddiskVolume*\\Program Files\\*.exe"
        ) and
  not (process.executable : "?:\\Windows\\Installer\\MSI*.tmp" and process.parent.name : "msiexec.exe") and
  not (process.hash.sha256 == "505d886fff0542f600f8534d9691de02200b719f1b80487a84fa799e1b178696" and
       process.executable == "C:\\spmwin\\regasm32.exe") and
  not (process.parent.executable : "C:\\Program Files (x86)\\360\\Total Security\\safemon\\QHActiveDefense.exe" and
       process.pe.original_file_name == "RUNDLL32.EXE" and process.args : "360ExtremeBrowserURL") and
  not (process.name : "regasm.x64.exe" and process.parent.executable : "C:\\Program Files (x86)\\Common Files\\Inlite\\InliteControlCenter.exe") and
  not (process.pe.original_file_name == "cscript.exe" and process.parent.executable : "C:\\Program Files (x86)\\Net Protector *\\NPDBKWTT.EXE") and
  not (
       process.executable : (
         "?:\\ProgramData\\Package Cache\\VSTACleanupOldRegistryBundlex64\\cmd_x64.exe",
         "?:\\ProgramData\\Package Cache\\VSTACleanupOldRegistryBundlex86\\cmd_x86.exe",
         "?:\\ProgramData\\Package Cache\\CleanupOldRegistryBundlex86\\cmd_x86.exe",
         "?:\\ProgramData\\Package Cache\\CleanupOldRegistryBundlex64\\cmd_x64.exe"
       ) and
       process.parent.name : ("vsta_setup.exe", "vsta_sdk.exe")
     ) and
  not process.parent.executable : ("C:\\Program Files (x86)\\360\\Total Security\\safemon\\QHSafeTray.exe",
                                   "C:\\Program Files (x86)\\360\\Total Security\\safemon\\QHActiveDefense.exe")
'''

min_endpoint_version = "7.15.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.15.0"

[metadata]
bypass_bbr_timing = true
creation_date = "2023/10/11"
integration = ["github"]
maturity = "production"
updated_date = "2026/03/24"

[rule]
author = ["Elastic"]
building_block_type = "default"
description = "Detects a new private repo interaction for a GitHub user not seen in the last 14 days.\n"
from = "now-9m"
index = ["logs-github.audit-*"]
language = "kuery"
license = "Elastic License v2"
name = "First Occurrence of GitHub User Interaction with Private Repo"
risk_score = 21
rule_id = "01c49712-25bc-49d2-a27d-d7ce52f5dc49"
severity = "low"
tags = [
    "Domain: Cloud",
    "Use Case: Threat Detection",
    "Use Case: UEBA",
    "Tactic: Execution",
    "Rule Type: BBR",
    "Data Source: Github",
]
timestamp_override = "event.ingested"
type = "new_terms"

query = '''
event.dataset:"github.audit" and event.category:"configuration" and
github.repo:* and user.name:* and 
github.repository_public:false
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1648"
name = "Serverless Execution"
reference = "https://attack.mitre.org/techniques/T1648/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1213"
name = "Data from Information Repositories"
reference = "https://attack.mitre.org/techniques/T1213/"

[[rule.threat.technique.subtechnique]]
id = "T1213.003"
name = "Code Repositories"
reference = "https://attack.mitre.org/techniques/T1213/003/"

[rule.threat.tactic]
id = "TA0009"
name = "Collection"
reference = "https://attack.mitre.org/tactics/TA0009/"
[rule.new_terms]
field = "new_terms_fields"
value = ["user.name", "github.repo"]
[[rule.new_terms.history_window_start]]
field = "history_window_start"
value = "now-5d"

[metadata]
creation_date = "2026/07/17"
integration = ["gcp"]
maturity = "production"
updated_date = "2026/08/25"

[rule]
author = ["Elastic"]
description = """
Detects when the same GKE identity creates or modifies a Role or ClusterRole with high-risk permissions
(wildcard access, RBAC escalation verbs, or access to secrets / privileged APIs) and also creates or patches
a DaemonSet, Deployment, or CronJob within five minutes. This correlation is consistent with RBAC-based
privilege escalation followed by payload deployment.
"""
false_positives = [
    """
    GitOps or platform controllers that sync sensitive Roles and immediately reconcile DaemonSets, Deployments,
    or CronJobs can match. Baseline approved automation after confirming the Role content is intentional.
    """,
    """
    Coordinated maintenance that expands RBAC and rolls workloads in the same change window may alert; validate
    against change tickets and the actor's expected client fingerprint.
    """,
]
from = "now-11m"
interval = "5m"
language = "esql"
license = "Elastic License v2"
name = "GKE Sensitive RBAC Change Followed by Workload Modification"
note = """## Triage and analysis

### Investigating GKE Sensitive RBAC Change Followed by Workload Modification

This ES|QL rule correlates two successful GKE audit behaviors from the same `client.user.email` within five
minutes:

1. Role or ClusterRole create/update/patch that grants high-risk permissions (wildcards, `escalate` /
   `bind` / `impersonate`, secret read, or privileged API resources such as `pods/exec` and
   `serviceaccounts/token`)
2. DaemonSet, Deployment, or CronJob create or patch after the sensitive RBAC change

`Esql.rbac_to_workload_minutes` is the gap from the latest sensitive RBAC event to the earliest workload
modification in the lookback window.

### Possible investigation steps

- Review `Esql.event_action_values` and `Esql.gcp_audit_resource_name_values` for the Role/ClusterRole and
  workload objects touched.
- Inspect `Esql.user_agent_original_values` and `Esql.source_ip_values` for unexpected clients or networks.
- Check for RoleBinding or ClusterRoleBinding activity around the same identity and time window.
- Correlate with secret access, pod exec, or token creation from the same actor.

### False positive analysis

- GitOps pipelines that manage both RBAC manifests and workloads in one sync cycle.
- Platform bootstrap that patches built-in roles and reconciles addon workloads.

### Response and remediation

- Roll back unauthorized Role/ClusterRole and workload changes, revoke the actor's credentials, and
  tighten who can mutate RBAC and sensitive workloads.
"""
setup = """
The GCP Fleet integration with GKE audit logs enabled is required. Request body capture on RBAC
resources is required so Role and ClusterRole rule verbs and resources are present in
`gcp.audit.request`.
"""
references = [
    "https://heilancoos.github.io/research/2025/12/16/kubernetes.html#overly-permissive-role-based-access-control",
    "https://kubernetes.io/docs/reference/access-authn-authz/rbac/",
]
risk_score = 47
rule_id = "3ec2175d-8f34-4be9-b3be-c5821538760e"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Domain: Kubernetes",
    "Domain: Containers",
    "Data Source: GCP",
    "Data Source: Google Cloud Platform",
    "Data Source: GCP Audit Logs",
    "Platform: GCP",
    "Platform: Kubernetes",
    "Use Case: Threat Detection",
    "Tactic: Privilege Escalation",
    "Tactic: Persistence",
    "Resources: Investigation Guide",
    "Rule Type: ESQL",
]
timestamp_override = "event.ingested"
type = "esql"

query = '''
from logs-gcp.audit-* metadata _id, _index, _version
| where data_stream.dataset == "gcp.audit"
    and service.name == "k8s.io"
    and event.outcome == "success"
    and client.user.email is not null
    and source.ip is not null
    and not to_string(source.ip) in ("127.0.0.1", "::1")
    and not client.user.email in (
      "system:addon-manager",
      "system:apiserver",
      "system:kube-controller-manager",
      "system:serviceaccount:flux-system:kustomize-controller",
      "system:serviceaccount:flux-system:helm-controller",
      "system:serviceaccount:flux-system:source-controller",
      "system:serviceaccount:flux-system:flux-operator",
      "system:serviceaccount:flux-operator:flux-operator"
    )
    and (
      (
        event.action in (
          "io.k8s.authorization.rbac.v1.roles.create",
          "io.k8s.authorization.rbac.v1.roles.update",
          "io.k8s.authorization.rbac.v1.roles.patch",
          "io.k8s.authorization.rbac.v1.clusterroles.create",
          "io.k8s.authorization.rbac.v1.clusterroles.update",
          "io.k8s.authorization.rbac.v1.clusterroles.patch"
        )
        and not (
          client.user.email == "system:serviceaccount:kube-system:clusterrole-aggregation-controller"
          and event.action == "io.k8s.authorization.rbac.v1.clusterroles.patch"
        )
        and (
          KQL("""gcp.audit.request.rules.verbs:("*" or "escalate" or "bind" or "impersonate")""")
          or KQL("""gcp.audit.request.rules.verbs:("*" or "create" or "patch" or "update") and gcp.audit.request.rules.resources:("*" or "clusterroles" or "clusterrolebindings" or "roles" or "rolebindings" or "pods/exec" or "serviceaccounts/token" or "nodes/proxy" or "daemonsets")""")
          or KQL("""gcp.audit.request.rules.verbs:("*" or "get" or "list") and gcp.audit.request.rules.resources:("*" or "secrets")""")
        )
      )
      or event.action in (
        "io.k8s.apps.v1.daemonsets.create",
        "io.k8s.apps.v1.daemonsets.patch",
        "io.k8s.apps.v1.deployments.create",
        "io.k8s.apps.v1.deployments.patch",
        "io.k8s.batch.v1.cronjobs.create",
        "io.k8s.batch.v1.cronjobs.patch"
      )
    )
| eval Esql.is_sensitive_rbac = case(event.action like "io.k8s.authorization.rbac.*", 1, 0),
    Esql.is_workload_modification = case(event.action like "io.k8s.apps.*" or event.action like "io.k8s.batch.*", 1, 0),
    Esql.sensitive_rbac_timestamp = case(event.action like "io.k8s.authorization.rbac.*", @timestamp, null),
    Esql.workload_modification_timestamp = case(event.action like "io.k8s.apps.*" or event.action like "io.k8s.batch.*", @timestamp, null)
| stats
    Esql.sensitive_rbac_count = sum(Esql.is_sensitive_rbac),
    Esql.workload_modification_count = sum(Esql.is_workload_modification),
    Esql.latest_sensitive_rbac_timestamp = max(Esql.sensitive_rbac_timestamp),
    Esql.earliest_workload_modification_timestamp = min(Esql.workload_modification_timestamp),
    Esql.event_action_values = values(event.action),
    Esql.gcp_audit_resource_name_values = values(gcp.audit.resource_name),
    Esql.user_agent_original_values = values(user_agent.original),
    Esql.source_ip_values = values(source.ip)
  by client.user.email
| where Esql.sensitive_rbac_count > 0
    and Esql.workload_modification_count > 0
    and Esql.latest_sensitive_rbac_timestamp <= Esql.earliest_workload_modification_timestamp
| eval Esql.rbac_to_workload_minutes = date_diff(
    "minute",
    Esql.latest_sensitive_rbac_timestamp,
    Esql.earliest_workload_modification_timestamp
  )
| where Esql.rbac_to_workload_minutes <= 5
| keep
    client.user.email,
    Esql.*
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"

[[rule.threat.technique.subtechnique]]
id = "T1098.006"
name = "Additional Container Cluster Roles"
reference = "https://attack.mitre.org/techniques/T1098/006/"

[rule.threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"

[[rule.threat.technique.subtechnique]]
id = "T1098.006"
name = "Additional Container Cluster Roles"
reference = "https://attack.mitre.org/techniques/T1098/006/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[metadata]
creation_date = "2025/07/31"
integration = ["google_secops"]
maturity = "production"
promotion = true
updated_date = "2025/10/17"

[rule]
author = ["Elastic"]
description = """
Generates a detection alert for each Google SecOps alert written to the configured indices. Enabling this rule allows
you to immediately begin investigating Google SecOps alerts in the app.
"""
from = "now-2m"
index = ["logs-google_secops.alert-*"]
interval = "1m"
language = "kuery"
license = "Elastic License v2"
max_signals = 1000
name = "Google SecOps External Alerts"
note = """Triage and analysis

### Investigating Google SecOps External Alerts

Google SecOps provides a robust framework for monitoring and managing security operations within cloud environments. The rule leverages specific event identifiers to flag suspicious alerts, enabling analysts to swiftly investigate potential threats and mitigate risks.

### Possible investigation steps

- Examine the timeline of events leading up to and following the alert to identify any unusual patterns or activities that may indicate malicious behavior.
- Cross-reference the alert with other security logs and alerts to determine if it is part of a broader attack pattern or isolated incident.
- Investigate the source and destination IP addresses involved in the alert to assess their legitimacy and check for any known malicious activity associated with them.
- Analyze user activity associated with the alert to identify any unauthorized access or privilege escalation attempts.
- Consult the Google SecOps investigation guide and resources tagged in the alert for specific guidance on handling similar threats.

### False positive analysis

- Alerts triggered by routine administrative actions can be false positives. Review the context of the alert to determine if it aligns with known maintenance activities.
- Automated scripts or tools that interact with Google SecOps may generate alerts. Identify these scripts and consider creating exceptions for their expected behavior.
- Frequent alerts from specific IP addresses or user accounts that are known to be secure can be excluded by adding them to an allowlist.
- Alerts resulting from testing or development environments should be reviewed and, if deemed non-threatening, excluded from triggering further alerts.
- Regularly update and review exception lists to ensure they reflect current non-threatening behaviors and do not inadvertently exclude genuine threats.

### Response and remediation

- Immediately isolate affected systems or accounts identified in the Google SecOps alert to prevent further unauthorized access or data exfiltration.
- Conduct a thorough review of the alert details to identify any compromised credentials or access tokens and reset them promptly.
- Implement network segmentation or access control measures to limit the spread of potential threats within the environment.
- Review and update firewall rules and security group settings to block any suspicious IP addresses or domains associated with the alert.
- Escalate the incident to the security operations center (SOC) or incident response team for further analysis and to determine if additional resources are needed.
- Document the incident, including all actions taken, and update incident response plans to incorporate lessons learned from this event.
- Enhance monitoring and detection capabilities by tuning existing alerts and deploying additional rules to detect similar activities in the future.
"""
references = ["https://docs.elastic.co/en/integrations/google_secops"]
risk_score = 47
rule_id = "70558fd5-6448-4c65-804a-8567ce02c3a2"
rule_name_override = "google_secops.alert.detection.ruleName"
setup = """## Setup

### Google SecOps Alert Integration
This rule is designed to capture alert events generated by the Google SecOps integration and promote them as Elastic detection alerts.

To capture Google SecOps alerts, install and configure the Google SecOps integration to ingest alert events into the `logs-google_secops.alert-*` index pattern.

If this rule is enabled alongside the External Alerts promotion rule (UUID: eb079c62-4481-4d6e-9643-3ca499df7aaa), you may receive duplicate alerts for the same SecOps events. Consider adding a rule exception for the External Alert rule to exclude data_stream.dataset:google_secops.alert to avoid receiving duplicate alerts.

### Additional notes

For information on troubleshooting the maximum alerts warning please refer to this [guide](https://www.elastic.co/guide/en/security/current/alerts-ui-monitor.html#troubleshoot-max-alerts).
"""
severity = "medium"
tags = [
    "Data Source: Google SecOps",
    "Use Case: Threat Detection",
    "Resources: Investigation Guide",
    "Promotion: External Alerts",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
event.kind: alert and data_stream.dataset: google_secops.alert
'''


[[rule.risk_score_mapping]]
field = "event.risk_score"
operator = "equals"
value = ""

[[rule.severity_mapping]]
field = "event.severity"
operator = "equals"
severity = "low"
value = "21"

[[rule.severity_mapping]]
field = "event.severity"
operator = "equals"
severity = "medium"
value = "47"

[[rule.severity_mapping]]
field = "event.severity"
operator = "equals"
severity = "high"
value = "73"

[[rule.severity_mapping]]
field = "event.severity"
operator = "equals"
severity = "critical"
value = "99"

[metadata]
creation_date = "2020/11/30"
integration = ["o365"]
maturity = "production"
updated_date = "2026/04/10"

[rule]
author = ["Elastic"]
description = """
Identifies when custom applications are allowed in Microsoft Teams. If an organization requires applications other than
those available in the Teams app store, custom applications can be developed as packages and uploaded. An adversary may
abuse this behavior to establish persistence in an environment.
"""
false_positives = [
    """
    Custom applications may be allowed by a system or network administrator. Verify that the configuration change was
    expected. Exceptions can be added to this rule to filter expected behavior.
    """,
]
from = "now-9m"
index = ["logs-o365.audit-*", "filebeat-*"]
language = "kuery"
license = "Elastic License v2"
name = "M365 Teams Custom Application Interaction Enabled"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating M365 Teams Custom Application Interaction Enabled

Microsoft Teams allows organizations to enhance functionality by integrating custom applications, which can be developed and uploaded beyond the standard app store offerings. While beneficial for tailored solutions, this capability can be exploited by adversaries to maintain unauthorized access. The detection rule monitors changes in tenant settings that permit custom app interactions, flagging successful modifications as potential persistence threats.

### Possible investigation steps

- Review the audit logs for the specific event.action: TeamsTenantSettingChanged to identify when the change was made and by whom.
- Verify the identity of the user or account associated with the event to determine if the change was authorized or if the account may have been compromised.
- Check the o365.audit.Name field for "Allow sideloading and interaction of custom apps" to confirm that the alert corresponds to enabling custom app interactions.
- Investigate the o365.audit.NewValue field to ensure it is set to True, indicating that the setting was indeed changed to allow custom apps.
- Assess the event.outcome field to confirm the change was successful and not a failed attempt, which could indicate a different type of issue.
- Examine any recent custom applications uploaded to Microsoft Teams to ensure they are legitimate and not potentially malicious.
- Cross-reference with other security alerts or logs to identify any unusual activity around the time of the setting change that might suggest malicious intent.

### False positive analysis

- Routine administrative changes to Microsoft Teams settings can trigger this rule. If a known and authorized administrator frequently updates tenant settings to allow custom apps, consider creating an exception for their user account to reduce noise.
- Organizations that regularly develop and deploy custom applications for internal use may see frequent alerts. In such cases, establish a process to document and approve these changes, and use this documentation to create exceptions for specific application deployment activities.
- Scheduled updates or maintenance activities that involve enabling custom app interactions might be misidentified as threats. Coordinate with IT teams to schedule these activities and temporarily adjust monitoring rules to prevent false positives during these periods.
- If a third-party service provider is authorized to manage Teams settings, their actions might trigger alerts. Verify their activities and, if consistent and legitimate, add their actions to an exception list to prevent unnecessary alerts.
- Changes made during a known testing or development phase can be mistaken for unauthorized access. Clearly define and communicate these phases to the security team, and consider temporary rule adjustments to accommodate expected changes.

### Response and remediation

- Immediately disable the custom application interaction setting in Microsoft Teams to prevent further unauthorized access or persistence by adversaries.
- Conduct a thorough review of all custom applications currently uploaded to Microsoft Teams to identify any unauthorized or suspicious applications. Remove any that are not recognized or approved by the organization.
- Analyze the audit logs for any recent changes to the Teams settings and identify the user account responsible for enabling custom application interactions. Investigate the account for signs of compromise or misuse.
- Reset the credentials and enforce multi-factor authentication for the account(s) involved in the unauthorized change to prevent further unauthorized access.
- Notify the security team and relevant stakeholders about the incident and the actions taken. Escalate to higher management if the breach is suspected to have wider implications.
- Implement additional monitoring and alerting for changes to Microsoft Teams settings to quickly detect and respond to similar threats in the future.
- Review and update the organization's security policies and procedures regarding the use of custom applications in Microsoft Teams to ensure they align with best practices and mitigate the risk of similar incidents.

## Setup

The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
references = ["https://docs.microsoft.com/en-us/microsoftteams/platform/concepts/deploy-and-publish/apps-upload"]
risk_score = 47
rule_id = "bbd1a775-8267-41fa-9232-20e5582596ac"
severity = "medium"
tags = ["Domain: Cloud", "Data Source: Microsoft 365", "Use Case: Configuration Audit", "Tactic: Defense Evasion", "Resources: Investigation Guide"]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset:o365.audit and event.provider:MicrosoftTeams and
event.category:web and event.action:TeamsTenantSettingChanged and
o365.audit.Name:"Allow sideloading and interaction of custom apps" and
o365.audit.NewValue:True and event.outcome:success
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1484"
name = "Domain or Tenant Policy Modification"
reference = "https://attack.mitre.org/techniques/T1484/"

[[rule.threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[metadata]
bypass_bbr_timing = true
creation_date = "2023/10/11"
integration = ["github"]
maturity = "production"
updated_date = "2025/03/20"

[rule]
author = ["Elastic"]
building_block_type = "default"
description = "A member was removed or their invitation to join was removed from a GitHub Organization.\n"
from = "now-9m"
index = ["logs-github.audit-*"]
language = "eql"
license = "Elastic License v2"
name = "Member Removed From GitHub Organization"
risk_score = 21
rule_id = "095b6a58-8f88-4b59-827c-ab584ad4e759"
severity = "low"
tags = [
    "Domain: Cloud",
    "Use Case: Threat Detection",
    "Use Case: UEBA",
    "Tactic: Impact",
    "Rule Type: BBR",
    "Data Source: Github",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
configuration where event.dataset == "github.audit" and event.action == "org.remove_member"
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1531"
name = "Account Access Removal"
reference = "https://attack.mitre.org/techniques/T1531/"


[rule.threat.tactic]
id = "TA0040"
name = "Impact"
reference = "https://attack.mitre.org/tactics/TA0040/"

[rule]
description = """
This rule detects when a child process is executed from a memory file descriptor (memfd). Attackers may use memfd to
create and execute code directly in memory, bypassing traditional file-based detection mechanisms. The use of memfd for
child process execution is uncommon and may indicate an attempt to evade security controls.
"""
id = "edc713a8-f352-4b12-ba50-b24944dfbd2d"
license = "Elastic License v2"
name = "Memory File Descriptor Child Process Execution"
os_list = ["linux"]
reference = ["https://man7.org/linux/man-pages/man2/memfd_create.2.html"]
version = "1.0.6"

query = '''
process where event.type == "start" and event.action == "exec" and process.parent.executable like "?memfd:*" and
not (
  process.executable in ("/usr/bin/fusermount", "/usr/bin/fusermount3", "/usr/sbin/logrotate") or
  (
    process.working_directory == "/run/nordlayer" and
    process.parent.command_line in (
      "/proc/self/fd/4 -config /etc/nordlayer/config.hcl",
      "/dev/fd/4 -config /etc/nordlayer/config.hcl"
    )
  )
)
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1106"
name = "Native API"
reference = "https://attack.mitre.org/techniques/T1106/"


[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"
[[threat.technique.subtechnique]]
id = "T1055.009"
name = "Proc Memory"
reference = "https://attack.mitre.org/techniques/T1055/009/"


[[threat.technique]]
id = "T1620"
name = "Reflective Code Loading"
reference = "https://attack.mitre.org/techniques/T1620/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.15.0"

[metadata]
creation_date = "2023/11/10"
integration = ["okta"]
maturity = "production"
updated_date = "2026/04/10"

[rule]
author = ["Elastic"]
description = """
Detects when Okta user authentication events are reported for multiple users with the same device token hash behind a
proxy.
"""
false_positives = [
    "An Okta admnistrator may be logged into multiple accounts from the same host for legitimate reasons.",
    "Users may share an endpoint related to work or personal use in which separate Okta accounts are used.",
    "Shared systems such as Kiosks and conference room computers may be used by multiple users.",
]
from = "now-9m"
index = ["logs-okta*"]
language = "kuery"
license = "Elastic License v2"
name = "Multiple Okta User Auth Events with Same Device Token Hash Behind a Proxy"
note = """## Triage and analysis

### Investigating Multiple Okta User Auth Events with Same Device Token Hash Behind a Proxy

This rule detects when Okta user authentication events are reported for multiple users with the same device token hash behind a proxy. This may indicate that a shared device between users, or that a user is using a proxy to access multiple accounts for password spraying.

#### Possible investigation steps:
- Identify the users involved in this action by examining the `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, and `okta.actor.display_name` fields.
- Determine the device client used for these actions by analyzing `okta.client.ip`, `okta.client.user_agent.raw_user_agent`, `okta.client.zone`, `okta.client.device`, and `okta.client.id` fields.
    - Since the device is behind a proxy, the `okta.client.ip` field will not be useful for determining the actual device IP address.
- Review the `okta.request.ip_chain` field for more information about the geographic location of the proxy.
- With Okta end users identified, review the `okta.debug_context.debug_data.dt_hash` field.
    - Historical analysis should indicate if this device token hash is commonly associated with the user.
- Review the `okta.event_type` field to determine the type of authentication event that occurred.
    - If the event type is `user.authentication.sso`, the user may have legitimately started a session via a proxy for security or privacy reasons.
    - If the event type is `user.authentication.password`, the user may be using a proxy to access multiple accounts for password spraying.
- Examine the `okta.outcome.result` field to determine if the authentication was successful.
- Review the past activities of the actor(s) involved in this action by checking their previous actions.
- Evaluate the actions that happened just before and after this event in the `okta.event_type` field to help understand the full context of the activity.
    - This may help determine the authentication and authorization actions that occurred between the user, Okta and application.

### False positive analysis:
- A user may have legitimately started a session via a proxy for security or privacy reasons.
- Users may share an endpoint related to work or personal use in which separate Okta accounts are used.
    - Architecturally, this shared endpoint may leverage a proxy for security or privacy reasons.
    - Shared systems such as Kiosks and conference room computers may be used by multiple users.
    - Shared working spaces may have a single endpoint that is used by multiple users.

### Response and remediation:
- Review the profile of the users involved in this action to determine if proxy usage may be expected.
- If the user is legitimate and the authentication behavior is not suspicious based on device analysis, no action is required.
- If the user is legitimate but the authentication behavior is suspicious, consider resetting passwords for the users involves and enabling multi-factor authentication (MFA).
    - If MFA is already enabled, consider resetting MFA for the users.
- If any of the users are not legitimate, consider deactivating the user's account.
- Conduct a review of Okta policies and ensure they are in accordance with security best practices.
- Check with internal IT teams to determine if the accounts involved recently had MFA reset at the request of the user.
    - If so, confirm with the user this was a legitimate request.
    - If so and this was not a legitimate request, consider deactivating the user's account temporarily.
        - Reset passwords and reset MFA for the user.
- If this is a false positive, consider adding the `okta.debug_context.debug_data.dt_hash` field to the `exceptions` list in the rule.
    - This will prevent future occurrences of this event for this device from triggering the rule.
"""
references = [
    "https://developer.okta.com/docs/reference/api/system-log/",
    "https://developer.okta.com/docs/reference/api/event-types/",
    "https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy",
    "https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection",
    "https://www.elastic.co/security-labs/monitoring-okta-threats-with-elastic-security",
    "https://www.elastic.co/security-labs/starter-guide-to-understanding-okta",
]
risk_score = 47
rule_id = "50887ba8-7ff7-11ee-a038-f661ea17fbcd"
setup = "The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."
severity = "medium"
tags = [
    "Use Case: Identity and Access Audit",
    "Data Source: Okta",
    "Tactic: Credential Access",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "threshold"

query = '''
data_stream.dataset:okta.system
    and not okta.actor.id:okta* and okta.debug_context.debug_data.dt_hash:*
    and okta.event_type:user.authentication* and okta.security_context.is_proxy:true
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1110"
name = "Brute Force"
reference = "https://attack.mitre.org/techniques/T1110/"

[[rule.threat.technique.subtechnique]]
id = "T1110.003"
name = "Password Spraying"
reference = "https://attack.mitre.org/techniques/T1110/003/"

[[rule.threat.technique.subtechnique]]
id = "T1110.004"
name = "Credential Stuffing"
reference = "https://attack.mitre.org/techniques/T1110/004/"

[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"

[[rule.threat.technique.subtechnique]]
id = "T1078.004"
name = "Cloud Accounts"
reference = "https://attack.mitre.org/techniques/T1078/004/"

[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[rule.threshold]
field = ["okta.debug_context.debug_data.dt_hash"]
value = 1
[[rule.threshold.cardinality]]
field = "okta.actor.id"
value = 3

[rule]
description = """
Identifies the modification of the Extensible Firmware Interface (EFI) files. Advanced adversaries may abuse Pre-OS Boot
mechanisms as a way to establish persistence in a system.
"""
id = "22fbd47a-8c72-4117-9355-f07fdcd9c0f4"
license = "Elastic License v2"
name = "Persistence via Extensible Firmware Modification"
os_list = ["windows"]
reference = [
    "https://github.com/Cr4sh/s6_pcie_microblaze/blob/master/python/payloads/DmaBackdoorHv/bootkit_installer.ps1",
    "https://securelist.com/finspy-unseen-findings/104322/",
]
version = "1.0.32"

query = '''
sequence by process.entity_id
 [process where event.action == "start" and
  not (process.pe.original_file_name :
         ("SetupHost.exe", "wbengine.exe", "BitLockerWizardElev.exe", "BitLockerDeviceEncryption.exe",
          "omadmclient.exe", "TSManager.exe", "SETUPPLATFORM.EXE", "RECOVERYDRIVE.EXE") and process.code_signature.subject_name like "Microsoft *" and
          process.code_signature.trusted == true) and

  not process.hash.sha256 : 
             ("07abbd7cd2693bc7b99c030ca86767d14e89a4c834cf9b5ae40ccf322ca81280", 
              "eee7c0e92277ada0e4d57a0a2ef30f102bf6b311ba0a891f3db28fa0d5ee8f56", 
              "ffac39846b01ad8d9b1074108ace1e148b8d1805b7790e15fe8975f1a4dac5df", 
              "e9373fdb8824e4431aba0c1df68ccc6ae098dab635f3504f7ee6efdfd97462da",
              "c4207f4d040a7588a45e76aef8e1cc9d8499e35f199a31c838ee4867a6d25870",
              "4ab2db239193ff9578bcc781779b0d43a3aa5262bb217699009f4190cab216a7",
              "0d0f9f92a8117090d710f28bd26753d4127a1b241b42fb0cc3688bc70a073965",
              "7519024820f8575d20cf2c14e573ba48049dc5766e3d5714c5f7a6c790c505a3",
              "4ab2db239193ff9578bcc781779b0d43a3aa5262bb217699009f4190cab216a7",
              "4342faa5ba84fd6a2142f7d3797cf301b6d73894ab49138eb83497498c06910c",
              "8c128cfd25a5d3c5b1f47da3f4d4964144af22b9fc76ffe7c67c1f5d0817b5ee",
              "a6f0f7ceae685165ac142231215d8c1ee196d61723e26597b3eed65931f2296d", 
              "ee2317208b909c46b7c73b74f07f5be68717dc704398ec3434e8ba353e2cdd04", 
              "a62316c113c92f88a042cf84ed589f8eab1ec9de99e3e2da65ad982a9653103e", 
              "0def9f7030a3f2b8a3e13cc755df45179237353018f2742b91193a3b0a488656", 
              "dadf1bfc7471d3c51a9a8f57f791b44785947324496711f54ba42257559b6fdb",
              "4ab2db239193ff9578bcc781779b0d43a3aa5262bb217699009f4190cab216a7",
              "dadf1bfc7471d3c51a9a8f57f791b44785947324496711f54ba42257559b6fdb",
              "8d39e6e50c2ef7aa7a62c3b57ee30a6a3e751ec1e288415f7a9b729126e10bc7") and

  not (process.executable : "?:\\Windows\\System32\\bcdedit.exe" and process.args : "/export") and 
  
  not process.parent.executable :
           ("?:\\Program Files (x86)\\Microsoft Intune Management Extension\\AgentExecutor.exe",
            "?:\\Program Files (x86)\\ISO to USB\\isotousb.exe", 
            "?:\\Program Files (x86)\\baramundi\\BMA\\BDSRun.exe", 
            "?:\\Program Files (x86)\\Dell\\UpdateService\\ServiceShell.exe", 
            "?:\\Program Files (x86)\\OmniBack\\bin\\vbda.exe") and
  
  not (process.executable : "?:\\Windows\\HP\\Installer.exe" and process.args : "-bestsize" and process.args : "-uefisupport") and 

  not (process.code_signature.subject_name :
           ("Akeo Consulting", "HP Inc.", "Dell Inc", "Dell Technologies Inc.", "Veritas Technologies LLC", "Insyde Software Corp.", "Huawei Technologies Co., Ltd.", "FUJITSU CLIENT COMPUTING LIMITED", "Micro Focus Group Limited", "ESET, spol. s r.o.") and
       process.code_signature.trusted == true) and

  not (process.executable : "?:\\WINDOWS\\System32\\svchost.exe" and process.args : "BDESVC" and process.parent.name : "services.exe") and

  not (process.executable : "?:\\Windows\\System32\\bcdboot.exe" and process.args : "/sysrepair" and process.parent.name : "svchost.exe") and

  not (process.executable : "?:\\Windows\\System32\\bcdboot.exe" and process.args : "/f" and process.args : "?:\\Windows") and

  not (process.executable : ("?:\\Windows\\System32\\taskhostw.exe", "?:\\Windows\\System32\\AggregatorHost.exe", "?:\\Windows\\UUS\\amd64\\wuaucltcore.exe") and process.parent.executable : "?:\\Windows\\System32\\svchost.exe")
  ]
 [file where event.action != "deletion" and file.path :"\\Device\\HarddiskVolume*\\EFI\\*" and

  file.size > 0 and 

  not (process.name : ("powershell.exe", "wsmprovhost.exe") and file.path : ("\\Device\\HarddiskVolume*\\EFI\\HP\\DEVFW\\*", "\\Device\\HarddiskVolume*\\EFI\\Microsoft\\Boot\\SecConfig.efi")) and

  not (process.executable : "?:\\Windows\\System32\\wbem\\WmiPrvSE.exe" and file.path : "\\Device\\HarddiskVolume*\\EFI\\*.log")]
 until [process where event.action == "end"]
'''

min_endpoint_version = "8.4.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1542"
name = "Pre-OS Boot"
reference = "https://attack.mitre.org/techniques/T1542/"


[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1495"
name = "Firmware Corruption"
reference = "https://attack.mitre.org/techniques/T1495/"


[threat.tactic]
id = "TA0040"
name = "Impact"
reference = "https://attack.mitre.org/tactics/TA0040/"

[internal]
min_endpoint_version = "8.4.0"

[metadata]
creation_date = "2023/03/29"
integration = ["windows", "system"]
maturity = "production"
updated_date = "2026/05/04"

[rule]
author = ["Elastic"]
description = """
Adversaries may pass the hash using stolen password hashes to move laterally within an environment, bypassing normal
system access controls. Pass the hash (PtH) is a method of authenticating as a user without having access to the user's
cleartext password.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-windows.forwarded*", "logs-system.security*"]
language = "kuery"
license = "Elastic License v2"
name = "Potential Pass-the-Hash (PtH) Attempt"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Potential Pass-the-Hash (PtH) Attempt

Pass-the-Hash (PtH) is a technique where attackers use stolen password hashes to authenticate and move laterally across systems without needing plaintext passwords. This method exploits the authentication process in Windows environments. The detection rule identifies suspicious logins using specific logon types and processes, indicating potential PtH activity, by monitoring successful authentications with certain user IDs and logon processes.

### Possible investigation steps

- Review the event logs for the specific user IDs (S-1-5-21-* or S-1-12-1-*) to identify any unusual or unauthorized access patterns, focusing on the time and source of the logon events.
- Examine the winlog.event_data.LogonProcessName field for "seclogo" to determine if this process is commonly used in your environment or if it appears suspicious or unexpected.
- Correlate the successful authentication events with other security logs to identify any lateral movement or access to sensitive systems that occurred after the initial logon.
- Investigate the source IP addresses and hostnames associated with the logon events to determine if they are known and trusted within the network or if they originate from unusual or external locations.
- Check for any recent changes or anomalies in the accounts associated with the suspicious user IDs, such as password resets, privilege escalations, or unusual account activity.
- Consult threat intelligence sources to see if there are any known campaigns or threat actors using similar techniques or targeting similar environments.

### False positive analysis

- Legitimate administrative tools or scripts that use the "NewCredentials" logon type for automation or scheduled tasks can trigger false positives. Review and whitelist known benign processes or scripts that are part of regular operations.
- Security software or monitoring tools that perform regular checks using the "seclogo" logon process may be misidentified. Identify and exclude these tools from the detection rule to prevent unnecessary alerts.
- Service accounts with user IDs matching the specified patterns (S-1-5-21-* or S-1-12-1-*) might be flagged during routine operations. Ensure these accounts are documented and create exceptions for their expected activities.
- Regularly scheduled tasks or maintenance activities that involve authentication processes similar to PtH can cause false positives. Document these activities and adjust the detection rule to account for their occurrence.
- User behavior analytics might incorrectly flag normal user activities as suspicious. Implement user behavior baselining to differentiate between typical and atypical logon patterns, refining the detection criteria accordingly.

### Response and remediation

- Immediately isolate the affected system from the network to prevent further lateral movement by the attacker.
- Revoke any active sessions associated with the compromised user IDs (S-1-5-21-* or S-1-12-1-*) to disrupt the attacker's access.
- Conduct a password reset for the affected accounts and any other accounts that may have been accessed using the compromised hashes.
- Review and update access controls and permissions for the affected accounts to ensure they adhere to the principle of least privilege.
- Deploy endpoint detection and response (EDR) tools to monitor for any further suspicious activity or attempts to use stolen hashes.
- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine the scope of the breach.
- Implement additional logging and monitoring for the "seclogo" logon process to enhance detection of future pass-the-hash attempts."""
references = ["https://attack.mitre.org/techniques/T1550/002/"]
risk_score = 47
rule_id = "daafdf96-e7b1-4f14-b494-27e0d24b11f6"
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Lateral Movement",
    "Data Source: Windows Security Event Logs",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "new_terms"

query = '''
host.os.type:"windows" and
event.category : "authentication" and event.action : "logged-in" and
winlog.logon.type : "NewCredentials" and event.outcome : "success" and
user.id : (S-1-5-21-* or S-1-12-1-*) and winlog.event_data.LogonProcessName : "seclogo"
'''

setup = """## Setup

Audit Logon must be enabled to generate the events used by this rule.
Setup instructions: https://ela.st/audit-logon
"""


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1550"
name = "Use Alternate Authentication Material"
reference = "https://attack.mitre.org/techniques/T1550/"
[[rule.threat.technique.subtechnique]]
id = "T1550.002"
name = "Pass the Hash"
reference = "https://attack.mitre.org/techniques/T1550/002/"



[rule.threat.tactic]
id = "TA0008"
name = "Lateral Movement"
reference = "https://attack.mitre.org/tactics/TA0008/"

[rule.new_terms]
field = "new_terms_fields"
value = ["user.id"]
[[rule.new_terms.history_window_start]]
field = "history_window_start"
value = "now-10d"