Elastic rules: 1x

[metadata]
creation_date = "2020/03/18"
integration = ["endpoint", "windows"]
maturity = "production"
updated_date = "2026/05/04"

[rule]
author = ["Elastic"]
description = """
Identifies when the SYSTEM account uses an account discovery utility. This could be a sign of discovery activity after
an adversary has achieved privilege escalation.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.sysmon_operational-*"]
language = "eql"
license = "Elastic License v2"
name = "Account Discovery Command via SYSTEM Account"
note = """## Triage and analysis

### Investigating Account Discovery Command via SYSTEM Account

After successfully compromising an environment, attackers may try to gain situational awareness to plan their next steps. This can happen by running commands to enumerate network resources, users, connections, files, and installed security software.

This rule looks for the execution of account discovery utilities using the SYSTEM account, which is commonly observed after attackers successfully perform privilege escalation or exploit web applications.

#### Possible investigation steps

- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
  - If the process tree includes a web-application server process such as w3wp, httpd.exe, nginx.exe and alike, investigate any suspicious file creation or modification in the last 48 hours to assess the presence of any potential webshell backdoor.
- Investigate other alerts associated with the user/host during the past 48 hours.
- Determine how the SYSTEM account is being used. For example, users with administrator privileges can spawn a system shell using Windows services, scheduled tasks or other third party utilities.

### False positive analysis

- Discovery activities are not inherently malicious if they occur in isolation. As long as the analyst did not identify suspicious activity related to the user or host, such alerts can be dismissed.

### Response and remediation

- Initiate the incident response process based on the outcome of the triage.
- Isolate the involved hosts to prevent further post-compromise behavior.
- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
- Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
- Use the data collected through the analysis to investigate other machines affected in the environment.
"""
risk_score = 21
rule_id = "2856446a-34e6-435b-9fb5-f8f040bfa7ed"
setup = """## Setup

This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.

Setup instructions: https://ela.st/install-elastic-defend

### Additional data sources

This rule also supports the following third-party data sources. For setup instructions, refer to the links below:

- [Sysmon Event ID 1 - Process Creation](https://ela.st/sysmon-event-1-setup)
"""
severity = "low"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Discovery",
    "Tactic: Privilege Escalation",
    "Resources: Investigation Guide",
    "Data Source: Elastic Defend",
    "Data Source: Sysmon",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
process where host.os.type == "windows" and event.type == "start" and
  (?process.Ext.token.integrity_level_name : "System" or
  ?winlog.event_data.IntegrityLevel : "System") and
  (
    process.name : "whoami.exe" or
    (
      process.name : "net1.exe" and not process.parent.name : "net.exe" and not process.args : ("start", "stop", "/active:*")
    )
  ) and 
process.parent.executable != null and 
not (process.name : "net1.exe" and process.working_directory : "C:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\Downloads\\") and 
not process.parent.executable : 
                ("C:\\Program Files\\Microsoft Monitoring Agent\\Agent\\MonitoringHost.exe", 
                 "C:\\Program Files\\Dell\\SupportAssistAgent\\SRE\\SRE.exe", 
                 "C:\\Program Files\\Obkio Agent\\main.dist\\ObkioAgentSoftware.exe", 
                 "C:\\Windows\\Temp\\WinGet\\defaultState\\PostgreSQL.PostgreSQL*\\postgresql-*-windows-x64.exe", 
                 "C:\\Program Files\\Obkio Agent\\main.dist\\ObkioAgentSoftware.exe", 
                 "C:\\Program Files (x86)\\SolarWinds\\Agent\\Plugins\\JobEngine\\SWJobEngineWorker2.exe") and 
not (process.parent.executable : "C:\\Windows\\Sys?????\\WindowsPowerShell\\v1.0\\powershell.exe" and 
     process.parent.args : ("C:\\Program Files (x86)\\Microsoft Intune Management Extension\\*.ps1", 
                            "Agent\\Modules\\AdHealthConfiguration\\AdHealthConfiguration.psd1'")) and 
not (process.parent.name : "cmd.exe" and process.working_directory : "C:\\Program Files\\Infraon Corp\\SecuraAgent\\")
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1033"
name = "System Owner/User Discovery"
reference = "https://attack.mitre.org/techniques/T1033/"

[[rule.threat.technique]]
id = "T1087"
name = "Account Discovery"
reference = "https://attack.mitre.org/techniques/T1087/"

[rule.threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"

[[rule.threat.technique.subtechnique]]
id = "T1078.003"
name = "Local Accounts"
reference = "https://attack.mitre.org/techniques/T1078/003/"

[rule.threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[metadata]
creation_date = "2020/06/15"
integration = ["aws"]
maturity = "production"
updated_date = "2026/08/05"

[rule]
author = ["Elastic"]
description = """
Detects the deletion of one or more Amazon CloudWatch alarms using the "DeleteAlarms" API. CloudWatch alarms are
critical for monitoring metrics and triggering alerts when thresholds are exceeded. An adversary may delete alarms to
impair visibility, silence alerts, and evade detection following malicious activity. This behavior may occur during
post-exploitation or cleanup phases to remove traces of compromise or disable automated responses.
"""
false_positives = [
    """
    CloudWatch alarm deletions can occur legitimately during scheduled maintenance, infrastructure redeployments, or
    automation workflows that clean up temporary monitoring configurations. Verify that the user identity, role, and IP
    address are expected for the environment. If deletions are performed by CI/CD pipelines or authorized administrators
    during controlled operations, consider adding exceptions based on specific IAM roles, automation accounts, or IP
    address ranges.
    """,
]
from = "now-6m"
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
language = "kuery"
license = "Elastic License v2"
name = "AWS CloudWatch Alarm Deletion"
note = """## Triage and analysis

### Investigating AWS CloudWatch Alarm Deletion

Amazon CloudWatch is a monitoring and observability service that collects monitoring and operational data in the form of logs, metrics, and events for resources and applications. This data can be used to detect anomalous behavior in your environments, set alarms, visualize logs and metrics side by side, take automated actions, troubleshoot issues, and discover insights to keep your applications running smoothly.

Amazon CloudWatch Alarms monitor key metrics and trigger automated alerts or remediation workflows. Deleting these alarms disables monitoring of associated metrics and can delay detection of performance degradation or security incidents. Attackers may delete alarms to evade detection, suppress alerts, or disable security automation that responds to anomalies or policy violations.

This rule detects successful calls to the `DeleteAlarms` API via CloudTrail. These events should be rare and always associated with a valid change-control request or automation pipeline.

#### Possible investigation steps

- **Identify the actor**
  - Review `aws.cloudtrail.user_identity.arn` and `aws.cloudtrail.user_identity.access_key_id` to determine who initiated the deletion.
  - Check whether this actor typically performs CloudWatch management or automation tasks.

- **Review request details**
  - Inspect `aws.cloudtrail.request_parameters` for the specific alarm names deleted. 
  - Determine whether the alarms were security-related (e.g., CloudTrail log delivery, GuardDuty finding rate, or IAM API monitoring alarms).
  - Cross-reference deleted alarms with your organization's list of critical monitoring configurations.

- **Analyze source and context**
  - Review `source.ip` and `user_agent.original` for anomalies such as external IPs, unusual user agents, or custom SDKs.
  - Determine whether the activity occurred during a known maintenance window or from a trusted automation host.
  - Examine `cloud.region` to identify whether alarms were deleted from unexpected regions.

- **Correlate with surrounding events**
  - Review CloudTrail events for related activity around the same time, such as:
    - `PutMetricAlarm`, `DisableAlarmActions`, or `DeleteLogGroup`
    - Changes to CloudTrail, Config, or GuardDuty configurations
    - IAM policy or permission modifications that could facilitate evasion
  - Identify whether the same actor has previously modified logging or monitoring infrastructure.

- **Assess impact and scope**
  - Determine which systems or detection workflows relied on the deleted alarms.
  - Review whether the deletion affected automated responses, notifications, or third-party integrations (e.g., SNS, Lambda, or PagerDuty).

### False positive analysis

- **Legitimate automation or redeployment**
  - Infrastructure as Code (IaC) frameworks such as Terraform or CloudFormation may delete and recreate alarms during updates.
  - Validate automation account roles and ensure alarm deletions are immediately followed by re-creation actions.
- **Operational maintenance**
  - Scheduled monitoring cleanup, regional deactivation, or test environment resets can trigger legitimate deletions. 
  - Verify timing and user identity against approved change management records.
- **Organizational migrations**
  - Security operations or DevOps teams may consolidate alarms during account merges or refactors. 
  - Confirm intent with relevant teams and exclude authorized administrative accounts as necessary.

### Response and remediation

- **Containment**
  - If the deletion was unauthorized, recreate the deleted alarms immediately using IaC templates or CloudFormation backups.
  - Re-enable any dependent automation or alerts that rely on those alarms.
  - Temporarily restrict CloudWatch modification privileges to designated IAM roles.

- **Investigation**
  - Review related CloudTrail logs for preceding IAM changes, STS activity, or anomalous role assumptions that might indicate compromised credentials.
  - Investigate whether any alerts were suppressed or delayed prior to the deletion.

- **Recovery and hardening**
  - Implement AWS Config rules to continuously monitor alarm existence and alert on `DeleteAlarms` API calls.
  - Restrict permissions to `cloudwatch:DeleteAlarms` and enforce MFA for users performing monitoring configuration changes.
  - Maintain IaC definitions for all critical alarms to support rapid restoration.
  - Audit IAM roles and automation accounts that manage CloudWatch configurations to ensure least privilege.
  - Integrate alarm configuration checks into your CI/CD validation workflows.

### Additional information

- **[AWS Config Rule – cloudwatch-alarm-action-check](https://docs.aws.amazon.com/config/latest/developerguide/cloudwatch-alarm-action-check.html)**
- **[AWS IR Playbooks](https://github.com/aws-samples/aws-incident-response-playbooks/blob/c151b0dc091755fffd4d662a8f29e2f6794da52c/playbooks/)** 
- **[AWS Customer Playbook Framework](https://github.com/aws-samples/aws-customer-playbook-framework/tree/a8c7b313636b406a375952ac00b2d68e89a991f2/docs)** 
- **Security Best Practices:** [AWS Knowledge Center – Security Best Practices](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/).
"""
references = [
    "https://awscli.amazonaws.com/v2/documentation/api/latest/reference/cloudwatch/delete-alarms.html",
    "https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_DeleteAlarms.html",
]
risk_score = 47
rule_id = "f772ec8a-e182-483c-91d2-72058f76a44c"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Platform: AWS",
    "Data Source: AWS CloudTrail",
    "Service: AWS CloudWatch",
    "Tactic: Defense Evasion",
    "Rule Type: Custom Query (KQL)",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset: "aws.cloudtrail" 
  and event.provider: "monitoring.amazonaws.com" 
  and event.action: "DeleteAlarms"
  and event.outcome: "success"
  and source.ip: *
  and not user_agent.original : ("AWS Internal" or "dynamodb.application-autoscaling.amazonaws.com" or "application-autoscaling.amazonaws.com" or *Terraform* or *Pulumi*)
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[rule.threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"

[[rule.threat.technique.subtechnique]]
id = "T1562.006"
name = "Indicator Blocking"
reference = "https://attack.mitre.org/techniques/T1562/006/"



[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user_agent.original",
    "source.ip",
    "aws.cloudtrail.user_identity.arn",
    "aws.cloudtrail.user_identity.type",
    "aws.cloudtrail.user_identity.access_key_id",
    "event.action",
    "event.outcome",
    "cloud.account.id",
    "cloud.region",
    "aws.cloudtrail.request_parameters",
]

[metadata]
creation_date = "2026/07/09"
integration = ["azure"]
maturity = "production"
updated_date = "2026/07/09"

[rule]
author = ["Elastic"]
description = """
Detects an identity deleting Kubernetes events on AKS (Azure Kubernetes Service), excluding known AKS control-plane and
platform identities. Adversaries delete events (individually or in bulk via deletecollection) to remove evidence of pod
creation, exec, or scheduling activity and impair incident response after operating in the cluster. Coverage includes
workload service accounts (system:serviceaccount:*), so a compromised in-cluster token wiping events is not excluded.
"""
false_positives = [
    """
    Event cleanup jobs or platform tooling may bulk-delete events. Baseline the responsible identities and exclude
    verified automation after review.
    """,
]
from = "now-9m"
index = ["logs-azure.platformlogs-*"]
language = "kuery"
license = "Elastic License v2"
name = "Azure AKS Kubernetes Events Deleted"
note = """## Triage and analysis

### Investigating Azure AKS Kubernetes Events Deleted

AKS kube-audit events are carried under the flattened `azure.platformlogs.properties.log.*` subtree and share the ARM
operation `event.action: Microsoft.ContainerService/managedClusters/diagnosticLogs/Read`. Kubernetes events record pod
scheduling, image pulls, and other cluster activity. Deleting them (individually with `delete`, or in bulk with
`deletecollection`) outside of known AKS control-plane and platform identities is a defense-evasion step to erase
evidence of prior actions.

### Possible investigation steps

- Identify the acting identity in `azure.platformlogs.properties.log.user.username` (and its groups in
  `azure.platformlogs.properties.log.user.groups`) and whether it should delete events. A username of `masterclient`
  (`system:masters`) is the AKS local cluster-admin certificate; workload service accounts
  (`system:serviceaccount:<ns>:<sa>`) deleting events are the higher-concern case.
- Determine the scale from `azure.platformlogs.properties.log.verb`: `deletecollection` is a bulk wipe (e.g.
  `kubectl delete events --all`), while `delete` removes a single event. Review the target scope in
  `azure.platformlogs.properties.log.objectRef.namespace` / `azure.platformlogs.properties.log.objectRef.name`.
- Inspect `azure.platformlogs.properties.log.userAgent` to distinguish interactive tooling (`kubectl`) from automation
  or custom clients, and pivot on `azure.platformlogs.properties.log.sourceIPs` for the activity the deletion may be
  concealing (pod creation, exec, RBAC changes).
- Reconstruct the timeline from surviving kube-audit records, which persist independently of the deleted Kubernetes
  events.

### False positive analysis

- Event cleanup jobs or platform tooling may bulk-delete events; baseline the responsible identities and exclude
  verified automation. If a platform control-plane identity (for example an event TTL/garbage-collection component)
  surfaces, add that specific identity to the exclusion rather than re-broadening to all `system:*`, which would blind
  the rule to compromised workload service accounts.

### Response and remediation

- If unauthorized, revoke the acting identity's tokens and review the RBAC that permitted event deletion.
- Use kube-audit history to reconstruct the concealed activity and scope the incident.
- Collect kube-audit and identity artifacts per incident response procedures.
"""
references = [
    "https://kubernetes.io/docs/reference/kubernetes-api/cluster-resources/event-v1/",
    "https://microsoft.github.io/Threat-Matrix-for-Kubernetes/",
    "https://learn.microsoft.com/en-us/azure/aks/monitor-aks",
    "https://kubenomicon.com/Defense_evasion/Delete_events.html"
]
risk_score = 47
rule_id = "9bc14983-fabc-4a3e-896d-3632a902f17c"
setup = """
The Azure Fleet integration collecting AKS diagnostic logs forwarded through Event Hub into the `azure.platformlogs`
data stream is required for this rule. Enable either the `kube-audit` or the `kube-audit-admin` log category (Microsoft
recommends `kube-audit-admin` alone to reduce volume, as it only drops read-only get/list events). Event deletions are
mutating operations recorded in both categories with the same `auditID`, so clusters that enable both categories may
generate two alerts per deletion.
"""
severity = "medium"
tags = [
    "Domain: Cloud",
    "Domain: Kubernetes",
    "Data Source: Azure",
    "Data Source: Azure Platform Logs",
    "Data Source: Kubernetes",
    "Use Case: Threat Detection",
    "Tactic: Defense Evasion",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset:azure.platformlogs and
  event.action:"Microsoft.ContainerService/managedClusters/diagnosticLogs/Read" and
  azure.platformlogs.category:("kube-audit" or "kube-audit-admin") and
  azure.platformlogs.properties.log.stage:"ResponseComplete" and
  azure.platformlogs.properties.log.objectRef.resource:"events" and
  azure.platformlogs.properties.log.verb:("delete" or "deletecollection") and
  not azure.platformlogs.properties.log.user.username:(
    system\:node\:* or "aksService" or "hcpService" or "readinessChecker" or
    system\:serviceaccount\:kube-system\:*
  )
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1070"
name = "Indicator Removal"
reference = "https://attack.mitre.org/techniques/T1070/"


[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "event.action",
    "azure.platformlogs.category",
    "azure.platformlogs.properties.log.verb",
    "azure.platformlogs.properties.log.user.username",
    "azure.platformlogs.properties.log.user.groups",
    "azure.platformlogs.properties.log.userAgent",
    "azure.platformlogs.properties.log.sourceIPs",
    "azure.platformlogs.properties.log.objectRef.namespace",
    "azure.platformlogs.properties.log.objectRef.name",
    "azure.platformlogs.properties.log.requestURI",
    "azure.platformlogs.properties.log.responseStatus.code",
]

[metadata]
creation_date = "2026/08/17"
integration = ["endpoint"]
maturity = "production"
updated_date = "2026/09/10"

[rule]
author = ["Elastic"]
description = """
Identifies shells, LOLBins, GTFOBins, and scripting runtimes connecting to the Azure WireServer / HostGAPlugin address
168.63.129.16 on ports 80 or 32526. The guest agent uses this fabric endpoint for GoalState, certificates, and
vmSettings. Adversaries with code execution on an Azure VM (including via Run Command) use curl, PowerShell, openssl,
bun, or similar tools to enumerate versions, pull transport certificates, and read HostGAPlugin /vmSettings. Azure
guest-agent binaries and system python used by waagent are excluded. Descendants of the guest agent are not excluded:
Run Command payloads execute in that tree.
"""
false_positives = [
    """
    Custom inventory or health scripts that call WireServer with curl or PowerShell. Validate the command line and
    exclude the specific signed binary or scheduled task after review.
    """,
    """
    Break-glass troubleshooting by administrators using curl against 168.63.129.16. Confirm the change window and
    exclude the admin host or user if the activity is authorized.
    """,
]
from = "now-9m"
index = ["logs-endpoint.events.network-*"]
language = "kuery"
license = "Elastic License v2"
name = "Azure WireServer Unusual Process Connection"
note = """## Triage and analysis

### Investigating Azure WireServer Unusual Process Connection

`168.63.129.16` is the Azure host-only WireServer (TCP 80) and HostGAPlugin (TCP 32526) address. Elastic Defend
network events record the destination IP, port, and initiating process. They do not include the HTTP path; pair this
alert with Network Packet Capture HTTP events when available (`comp=certificates`, `/vmSettings`, `/versions`).

Do not treat "child of waagent / WindowsAzureGuestAgent" as benign. Azure Run Command and Custom Script Extension
launch attacker scripts as descendants of those agents. Exclude only the agent binaries themselves, which this query
already omits by matching curl, PowerShell, and similar tools.

`process.Ext.ancestry` is often empty on these network events, so EQL `descendant of` is not reliable here.

### Possible investigation steps

- Review `process.name`, `process.executable`, and `process.command_line` on nearby process start events. Look for
  `comp=certificates`, `32526`, `vmSettings`, `LinuxTransport`, or `openssl cms -decrypt`.
- Note `destination.port`: 32526 from curl or PowerShell is uncommon for legitimate guest-agent traffic (agents use
  `WaAppAgent.exe`, `WindowsAzureGuestAgent.exe`, `CollectGuestLogs.exe`, or `/usr/bin/python3.10` / waagent).
- Correlate with `169.254.169.254` IMDS access from the same process, especially `/metadata/v1/instanceinfo` (no
  Metadata header) or `/metadata/identity/oauth2/token`.
- Check Azure Activity Logs for `runCommand/action` or extensions/write against this VM.
- Search StorageRead platform logs for subsequent SAS GetBlob of vmsettings or cse objects.

### False positive analysis

- In-house monitoring that wraps curl to WireServer. Exclude by `process.executable` or a signed parent after
  validating the script contents.
- Do not exclude all children of the guest agent; that hides Run Command abuse.

### Response and remediation

- Isolate the VM, rotate its managed identity and any SAS recovered from vmSettings, and review extension
  protectedSettings for injected configuration.
- Remove unauthorized Run Command resources and Custom Script extensions.
- Consider Azure Metadata Security Protocol (audit/enforce) to restrict which processes may call WireServer.
"""
references = [
    "https://www.netspi.com/blog/technical-blog/cloud-pentesting/decrypting-vm-extension-settings-with-azure-wireserver/",
    "https://cybercx.com.au/blog/azure-ssrf-metadata/",
    "https://cloud.google.com/blog/topics/threat-intelligence/escalating-privileges-azure-kubernetes-services",
    "https://learn.microsoft.com/en-us/azure/virtual-network/what-is-ip-address-168-63-129-16",
]
risk_score = 47
rule_id = "2dba3edf-1e23-4ead-a76f-458ef2060d24"
severity = "medium"
tags = [
    "Domain: Endpoint",
    "Domain: Cloud",
    "OS: Linux",
    "OS: Windows",
    "Platform: Azure",
    "Platform: Windows",
    "Use Case: Threat Detection",
    "Tactic: Credential Access",
    "Tactic: Discovery",
    "Data Source: Elastic Defend",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "new_terms"

query = '''
event.category: network and host.os.type: (linux or windows) and
 destination.ip: "168.63.129.16" and destination.port: (80 or 32526) and
 (
   process.name: (
     bash or dash or sh or tcsh or csh or zsh or ksh or fish or mksh or busybox or
     bun or bun.exe or node or node.exe or nodejs or deno or deno.exe or
     java or java.exe or javaw or javaw.exe or
     curl or curl.exe or wget or wget.exe or
     powershell.exe or pwsh.exe or pwsh or cmd.exe or
     certutil.exe or bitsadmin.exe or mshta.exe or rundll32.exe or
     wscript.exe or cscript.exe or regsvr32.exe or
     openssl or openssl.exe or nc or ncat or netcat or socat or
     python.exe or pythonw.exe or perl or perl.exe or ruby or ruby.exe or
     php or php.exe or lua or lua.exe
   ) or
   process.executable: (
     ./* or /tmp/* or /var/tmp/* or /dev/shm/* or /run/* or /var/run/* or
     /home/*/* or /root/* or *\:\\Users\\* or *\:\\ProgramData\\*
   )
 ) and
 not process.executable: (
   /usr/sbin/waagent or /usr/bin/waagent or /usr/bin/python3* or
   /usr/lib/systemd/systemd-resolved or /lib/systemd/systemd-resolved or
   *\:\\WindowsAzure\\Packages\\* or *\:\\WindowsAzure\\GuestAgent*\\* or
   *\:\\WindowsAzure\\SecAgent\\*
 )
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"
[[rule.threat.technique.subtechnique]]
id = "T1552.005"
name = "Cloud Instance Metadata API"
reference = "https://attack.mitre.org/techniques/T1552/005/"



[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1082"
name = "System Information Discovery"
reference = "https://attack.mitre.org/techniques/T1082/"

[[rule.threat.technique]]
id = "T1580"
name = "Cloud Infrastructure Discovery"
reference = "https://attack.mitre.org/techniques/T1580/"


[rule.threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"

[rule.new_terms]
field = "new_terms_fields"
value = ["host.id", "process.executable"]
[[rule.new_terms.history_window_start]]
field = "history_window_start"
value = "now-7d"

[metadata]
creation_date = "2020/11/18"
integration = ["endpoint"]
maturity = "production"
updated_date = "2026/08/03"

[rule]
author = ["Elastic"]
description = """
Identifies Component Object Model (COM) hijacking via registry modification. Adversaries may establish persistence by
executing malicious content triggered by hijacked references to COM objects.
"""
from = "now-9m"
index = ["logs-endpoint.events.registry-*"]
language = "eql"
license = "Elastic License v2"
name = "Component Object Model Hijacking"
note = """## Triage and analysis

### Investigating Component Object Model Hijacking

Adversaries can insert malicious code that can be executed in place of legitimate software through hijacking the COM references and relationships as a means of persistence.

#### Possible investigation steps

- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
- Identify the user account that performed the action and whether it should perform this kind of action.
- Investigate other alerts associated with the user/host during the past 48 hours.
- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
- Retrieve the file referenced in the registry and determine if it is malicious:
  - Use a private sandboxed malware analysis system to perform analysis.
    - Observe and collect information about the following activities:
      - Attempts to contact external domains and addresses.
      - File and registry access, modification, and creation activities.
      - Service creation and launch activities.
      - Scheduled task creation.
  - Use the PowerShell Get-FileHash cmdlet to get the files' SHA-256 hash values.
    - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.

### False positive analysis

- Some Microsoft executables will reference the LocalServer32 registry key value for the location of external COM objects.

### Response and remediation

- Initiate the incident response process based on the outcome of the triage.
- Isolate the involved host to prevent further post-compromise behavior.
- If the triage identified malware, search the environment for additional compromised hosts.
  - Implement temporary network rules, procedures, and segmentation to contain the malware.
  - Stop suspicious processes.
  - Immediately block the identified indicators of compromise (IoCs).
  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
- Remove and block malicious artifacts identified during triage.
- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
"""

setup = """## Setup

This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.

Setup instructions: https://ela.st/install-elastic-defend
"""

references = [
    "https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/",
]
risk_score = 21
rule_id = "16a52c14-7883-47af-8745-9357803f0d4c"
severity = "low"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Persistence",
    "Tactic: Defense Evasion",
    "Tactic: Privilege Escalation",
    "Resources: Investigation Guide",
    "Data Source: Elastic Defend",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
registry where host.os.type == "windows" and event.type == "change" and
  /* not necessary but good for filtering privileged installations */
  user.domain != "NT AUTHORITY" and process.executable != null and 
  (
    (
      registry.path : "HK*\\InprocServer32\\" and
      registry.data.strings: ("scrobj.dll", "?:\\*\\scrobj.dll") and
      not registry.path : "*\\{06290BD*-48AA-11D2-8432-006008C3FBFC}\\*"
    ) or

    (
      registry.path : "HKLM\\*\\InProcServer32\\*" and
        registry.data.strings : ("*\\Users\\*", "*\\ProgramData\\*")
    ) or

    /* in general COM Registry changes on Users Hive is less noisy and worth alerting */
    (
      registry.path : (
        "HKEY_USERS\\*\\InprocServer32\\",
        "HKEY_USERS\\*\\LocalServer32\\",
        "HKEY_USERS\\*\\DelegateExecute",
        "HKEY_USERS\\*\\TreatAs\\",
        "HKEY_USERS\\*\\ScriptletURL*", 
        "HKEY_USERS\\*\\TypeLib*\\Win*"
      ) and
      not registry.data.strings : (
            /* COM related to Windows Spotlight feature */
            "{4813071a-41ad-44a2-9835-886d2f63ca30}",

            /* AppX/MSIX DelegateExecute handlers: execute, protocol, file */
            "{A56A841F-E974-45C1-8001-7E3F8A085917}",
            "{4ED3A719-CEA8-4BD9-910D-E252F997AFC2}",
            "{BFEC0C93-0B7D-4F2C-B09C-AFFFC4BDAE78}"
      )
    )
  ) and 
  
  not (
    process.code_signature.trusted == true and
    process.code_signature.subject_name in (
        "Island Technology Inc.", "Google LLC", "Grammarly, Inc.", "Dropbox, Inc", "REFINITIV US LLC", "HP Inc.", "Adobe Inc.",
        "Citrix Systems, Inc.", "Veeam Software Group GmbH", "Zhuhai Kingsoft Office Software Co., Ltd.", "Oracle America, Inc.",
        "Brave Software, Inc.", "DeepL SE", "Opera Norway AS", "Thomas Braun", "Slack Technologies, LLC", "Spotify AB",
        "Vivaldi Technologies AS"
    )
  ) and 

  /* excludes trusted applications registering their own COM components */
  not (
    process.code_signature.trusted == true and
    (
      (
        process.name : "OneDrive.Sync.Service.exe" and
        process.code_signature.subject_name == "Microsoft Corporation" and
        registry.data.strings : (
          "*\\Microsoft\\OneDrive\\*\\OneDrive.Sync.Service.exe*",
          "*\\Microsoft\\OneDrive\\*\\OneDrive.Sync.Service.dll*"
        )
      ) or
      (
        process.executable : "?:\\Users\\*\\AppData\\Local\\Kingsoft\\WPS Office\\*\\office6\\ksomisc.exe" and
        process.code_signature.subject_name == "WPS SOFTWARE PTE. LTD." and
        registry.data.strings : "*\\Kingsoft\\WPS Office\\*"
      ) or
      (
        process.name : "claude.exe" and
        process.code_signature.subject_name == "Anthropic, PBC" and
        registry.data.strings : (
          "*\\Users\\*\\AppData\\Local\\AnthropicClaude\\app-*\\claude.exe*",
          "*\\ProgramData\\*\\AnthropicClaude\\app-*\\claude.exe*"
        )
      )
    )
  ) and

  /* excludes Microsoft signed noisy processes */
  not
  (
    process.name : (
      "OneDrive.exe", "OneDriveSetup.exe", "FileSyncConfig.exe", "Teams.exe", "MicrosoftEdgeUpdate.exe", "msrdcw.exe",
      "MicrosoftEdgeUpdateComRegisterShell64.exe", "setup.exe", "PowerToys.PowerLauncher.exe"
    ) and
    process.code_signature.trusted == true and process.code_signature.subject_name in ("Microsoft Windows", "Microsoft Corporation")
  ) and
  
  not process.executable : (
        "?:\\$WINDOWS.~BT\\Sources\\SetupHost.exe",
        "?:\\Program Files (x86)\\*.exe",
        "?:\\Program Files\\*.exe",
        "?:\\ProgramData\\4Team\\4Team-Updater\\4Team-Updater-Helper.exe",
        "?:\\ProgramData\\Lenovo\\Udc\\Hosts\\x64\\MessagingPlugin.exe",
        "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe",
        "?:\\Users\\*\\AppData\\Local\\Wondershare\\Wondershare NativePush\\WsToastNotification.exe",
        "?:\\Windows\\System32\\DriverStore\\FileRepository\\*.exe",
        "?:\\Windows\\System32\\FMToastNotification.exe",
        "?:\\Windows\\System32\\msiexec.exe",
        "?:\\Windows\\System32\\svchost.exe",
        "?:\\Windows\\SysWOW64\\regsvr32.exe",
        "?:\\Windows\\System32\\regsvr32.exe",
        "\\Device\\Mup\\*\\Kufer\\KuferSQL\\BasysSQL.exe"
  )
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1546"
name = "Event Triggered Execution"
reference = "https://attack.mitre.org/techniques/T1546/"
[[rule.threat.technique.subtechnique]]
id = "T1546.015"
name = "Component Object Model Hijacking"
reference = "https://attack.mitre.org/techniques/T1546/015/"



[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1546"
name = "Event Triggered Execution"
reference = "https://attack.mitre.org/techniques/T1546/"
[[rule.threat.technique.subtechnique]]
id = "T1546.015"
name = "Component Object Model Hijacking"
reference = "https://attack.mitre.org/techniques/T1546/015/"



[rule.threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1112"
name = "Modify Registry"
reference = "https://attack.mitre.org/techniques/T1112/"


[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[rule]
description = """
Detects possible Python based malware that stage their files in a hidden directory or file that sits within the tmp
directory. This rule looks for Python executions where the process arguments include references to hidden folders or
files in the tmp directory.
"""
id = "7f165456-b724-4a83-b006-002c902ccee7"
license = "Elastic License v2"
name = "Hidden Folder or File Access in Tmp via Python"
os_list = ["macos"]
reference = ["https://github.com/rapid7/metasploit-framework"]
version = "1.0.13"

query = '''
process where event.type == "start" and 
 (process.parent.name like~ "python*" or process.Ext.effective_parent.name like~ "python*") and 
 (process.name in ("mkdir", "osascript", "sh", "bash", "zsh", "dash", "csh", "tcsh", "ksh", "tclsh", "fish") or process.name like "tclsh*") and
 process.args like ("/tmp/.*", "/private/tmp/.*") and
 process.args_count == 2
'''

min_endpoint_version = "8.5.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"

[[threat.technique.subtechnique]]
id = "T1059.006"
name = "Python"
reference = "https://attack.mitre.org/techniques/T1059/006/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "8.5.0"

[rule]
description = "Identifies attempts to bypass the Microsoft Anti Malware Scan Interface via threat context manipulation."
id = "2f7630e4-a125-4ba6-a8a7-3d4f17ece8d5"
license = "Elastic License v2"
name = "Potential AMSI Bypass via SetThreadContext"
os_list = ["windows"]
reference = [
    "https://aidenpearce369.github.io/offsec/AMSI-Memory-Bypass/",
    "https://modexp.wordpress.com/2019/06/03/disable-amsi-wldp-dotnet/",
]
version = "1.0.6"

query = '''
sequence by process.entity_id with maxspan=3s
[library where (dll.name : "amsi.dll" or dll.pe.original_file_name == "amsi.dll") and
  process.thread.Ext.call_stack_summary like "ntdll.dll*" and
  not process.thread.Ext.call_stack_summary like
                                             ("*rpcrt4.dll|combase.dll|*", "*|clr.dll*", "*|jscript.dll*", "*|jscript9.dll*",
                                               "*|vbscript.dll*", "*|mscorlib.ni.dll*", "*|mscoreei.dll*", "*|coreclr.dll*",
                                               "*|vbe?.dll|*", "*fastprox.dll|combase.dll|*", "*|vssvc.exe|sechost.dll*",
                                               "*kernelbase.dll|swprv.dll|svchost.exe*") and
  _arraysearch(process.thread.Ext.call_stack, $entry,
               $entry.symbol_info like ("C:\\Windows\\Sys?????\\ntdll.dll!LdrLoadDll*",
                                        "C:\\Windows\\Sys?????\\KernelBase.dll!LoadLibrary*"))]
[api where event.provider == "Microsoft-Windows-Kernel-Audit-API-Calls" and
 process.Ext.api.name == "SetThreadContext" and process.Ext.api.behaviors != "cross-process" and
 not process.thread.Ext.call_stack_final_user_module.name in ("clr.dll", "coreclr.dll", "Unknown", "Undetermined") and
 process.thread.Ext.call_stack_final_user_module.hash.sha256 != null and
 not process.thread.Ext.call_stack_final_user_module.hash.sha256 in
                         ("0799a4a76a1af52b3ca214c54b60dd5cea0c68111d02354eb240a45d165ffdd3",
                          "1ce43599e89c84d16b4a7044de1245e313c6d64d1d0b761b615af17a03b39dd9",
                          "9e2509ea716edf0464687553ae9740f4e28a748d5587061ec1441a996a7371cc",
                          "baeded008c8bd259685527543807ff3f6f05d7e43b60a5814656fd6912672277",
                          "e84abf700715ba9dff463985f3648910bcec730df60792a9866be57ce6028636",
                          "aa95131a1bd9d71de05031f41ac4930e9c9afe630fa4eef9b0a82e07e69799ed",
                          "4622e028bf88c47cc46ea4351e281ec032a7cdf2c00d3172d24b6daef68e156e",
                          "7f8e0d6e650cc61a5277c6bca2325c096735122dd46df1d410e2e5da3daa8aaf",
                          "b980fe2c06d57e913cba14f67faf49b1f337f889bbf52bbccbec1c4383ffb4db") and
 not (process.executable : "C:\\Program Files\\AzureConnectedMachineAgent\\azcmagent.exe" and
      process.thread.Ext.call_stack_final_user_module.path == "c:\\windows\\system32\\windows.devices.sensors.dll") and
 not (process.thread.Ext.call_stack_final_user_module.path like ("c:\\program files\\*", "c:\\program files (x86)\\*") and
      _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.trusted == true)) and
 process.thread.Ext.call_stack_final_user_module.name != null and process.thread.Ext.call_stack_final_user_module.name != "Kernel" and
 not _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.trusted == true and
                   $entry.subject_name in ("Rapid7 LLC", "VELOCIDEX ENTERPRISES PTY LTD", "CyberCX Pty Ltd", "Microsoft Windows Hardware Compatibility Publisher", "Exafunction, Inc.", "Proton AG", ".NET"))]
'''

min_endpoint_version = "8.10.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"

[rule]
description = """
This rule detects the execution of gsocket binaries or scripts that may be used to establish a reverse shell or
exfiltrate data from a compromised system. Gsocket is a tool that can be used to create a reverse shell, transfer files,
or mount remote directories over a network connection. This activity may indicate an attacker is attempting to establish
persistence or move laterally within a network.
"""
id = "9015e5ec-a68d-4539-923d-a96d2c6227d3"
license = "Elastic License v2"
name = "Potential Gsocket Activity"
os_list = ["linux"]
reference = ["https://github.com/hackerschoice/gsocket", "https://www.gsocket.io/", "https://www.thc.org/ssh-it/"]
version = "1.0.9"

query = '''
process where event.type == "start" and event.action == "exec" and
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and
process.command_line like~ (
  "*GS_ARGS=*", "*gs-netcat*", "*gs-sftp*", "*gs-mount*", "*gs-full-pipe*", "*GS_NOINST=*", "*GSOCKET_ARGS=*",
  "*GS_DSTDIR=*", "*GS_URL_BASE=*", "*GS_OSARCH=*", "*GS_HIDDEN_NAME=*", "*GS_HOST=*",
  "* GS_PORT=*", "*GS_TG_TOKEN=*", "*GS_TG_CHATID=*", "*GS_DISCORD_KEY=*", "*GS_WEBHOOK_KEY=*"
) and not (
  process.parent.name in ("make", "ninja", "qmake", "gmake") or
  process.parent.executable like ("/tmp/newroot/nix/store/*/generator/generator", "/usr/share/cursor/cursor") or
  process.command_line like "*/bin/qmake*"
)
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
tree = true

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "7.15.0"

[metadata]
creation_date = "2024/11/04"
integration = ["endpoint", "crowdstrike", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2026/03/24"

[rule]
author = ["Elastic"]
description = """
This rule detects potential hex payload execution on Linux systems. Adversaries may use hex encoding to obfuscate
payloads and evade detection mechanisms.
"""
from = "now-9m"
index = [
    "logs-endpoint.events.process*",
    "logs-crowdstrike.fdr*",
    "logs-sentinel_one_cloud_funnel.*",
    "endgame-*",
]
language = "eql"
license = "Elastic License v2"
name = "Potential Hex Payload Execution via Common Utility"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Potential Hex Payload Execution via Common Utility

Hex encoding is often used in Linux environments to obfuscate data, making it harder for security tools to detect malicious payloads. Adversaries exploit this by encoding their payloads in hex to bypass security measures. The detection rule identifies suspicious processes like `xxd`, `python`, `php`, and others that use hex-related functions, signaling potential obfuscation attempts. By monitoring these patterns, the rule helps uncover hidden threats.

### Possible investigation steps

- Review the process details, including the process name and command line arguments, to confirm if the execution aligns with typical hex decoding or encoding activities.
- Check the parent process of the suspicious process to understand the context of how the process was initiated and whether it was expected or part of a legitimate workflow.
- Investigate the user account associated with the process execution to determine if the activity is consistent with the user's normal behavior or if the account may have been compromised.
- Examine the network activity associated with the process to identify any potential data exfiltration or communication with known malicious IP addresses.
- Look for any related file modifications or creations around the time of the process execution to identify if the decoded payload was written to disk or executed further.
- Cross-reference the alert with other security tools or logs, such as Crowdstrike or SentinelOne, to gather additional context or corroborating evidence of malicious activity.

### False positive analysis

- Development and testing environments may frequently use hex encoding functions for legitimate purposes. To reduce noise, consider excluding processes running on known development servers from the rule.
- System administrators might use hex encoding tools like `xxd` for data conversion tasks. Identify and whitelist these routine administrative scripts to prevent false alerts.
- Automated scripts or applications that process data in hex format for encoding or decoding purposes can trigger this rule. Review and exclude these scripts if they are verified as non-malicious.
- Security tools or monitoring solutions themselves might use hex encoding for data analysis. Ensure these tools are recognized and excluded from triggering the rule.
- Regularly review and update the exclusion list to adapt to changes in the environment and ensure that only verified non-threatening behaviors are excluded.

### Response and remediation

- Isolate the affected system from the network to prevent further spread of potentially malicious payloads.
- Terminate any suspicious processes identified by the detection rule, such as those involving `xxd`, `python`, `php`, `ruby`, `perl`, or `lua` with hex-related functions.
- Conduct a thorough scan of the isolated system using updated antivirus and anti-malware tools to identify and remove any malicious payloads or remnants.
- Review and analyze system logs and process execution history to determine the scope of the compromise and identify any additional affected systems.
- Restore the system from a known good backup if malicious activity is confirmed and cannot be fully remediated.
- Implement additional monitoring on the affected system and network to detect any recurrence of similar obfuscation attempts.
- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to assess the need for broader organizational response measures."""
risk_score = 21
rule_id = "0c1e8fda-4f09-451e-bc77-a192b6cbfc32"
setup = """## Setup

This rule requires data coming in from Elastic Defend.

### Elastic Defend Integration Setup
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.

#### Prerequisite Requirements:
- Fleet is required for Elastic Defend.
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).

#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
- Go to the Kibana home page and click "Add integrations".
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
- Click "Add Elastic Defend".
- Configure the integration name and optionally add a description.
- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
- Click "Save and Continue".
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
"""
severity = "low"
tags = [
    "Domain: Endpoint",
    "OS: Linux",
    "Use Case: Threat Detection",
    "Tactic: Defense Evasion",
    "Tactic: Execution",
    "Data Source: Elastic Defend",
    "Data Source: Crowdstrike",
    "Data Source: SentinelOne",
    "Data Source: Elastic Endgame",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"
query = '''
process where host.os.type == "linux" and event.type == "start" and
event.action in ("exec", "exec_event", "start", "ProcessRollup2") and
(
  (process.name == "xxd" and process.args like ("-r*", "-p*")) or
  (process.name like "python*" and process.command_line like "*fromhex*" and process.command_line like ("*decode*", "*encode*")) or
  (process.name like "php*" and process.command_line like "*hex2bin*") or
  (process.name like "ruby*" and process.command_line like "*].pack(\"H*\")*") or
  (process.name like "perl*" and process.command_line like "*pack(\"H*\",*") or
  (process.name like "lua*" and process.command_line like "*tonumber(cc, 16)*")
) and
not (
  // Vulnerability scanning tools scanning for xz-backdoor
  process.command_line like ("*liblzma*", "*xz*") or
  ?process.parent.args like (
    "/srv/acme/acme.sh", "/home/*/.acme.sh/acme.sh", "/opt/custom-nagios-plugins/check_rad_eap",
    "/usr/bin/testssl", "./testssl.sh", "/root/.acme.sh/acme.sh"
  ) or
  ?process.parent.args like "printf*" or
  ?process.working_directory in (
    "/home/prtg-ssh",
    "/home/svc-acas-lnx",
    "/tmp/newroot/home/svc-acas-lnx",
    "/var/prtg/scriptsxml"
  )
)
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1027"
name = "Obfuscated Files or Information"
reference = "https://attack.mitre.org/techniques/T1027/"

[[rule.threat.technique]]
id = "T1140"
name = "Deobfuscate/Decode Files or Information"
reference = "https://attack.mitre.org/techniques/T1140/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"

[[rule.threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"

[[rule.threat.technique.subtechnique]]
id = "T1059.006"
name = "Python"
reference = "https://attack.mitre.org/techniques/T1059/006/"

[[rule.threat.technique.subtechnique]]
id = "T1059.011"
name = "Lua"
reference = "https://attack.mitre.org/techniques/T1059/011/"

[[rule.threat.technique]]
id = "T1204"
name = "User Execution"
reference = "https://attack.mitre.org/techniques/T1204/"

[[rule.threat.technique.subtechnique]]
id = "T1204.002"
name = "Malicious File"
reference = "https://attack.mitre.org/techniques/T1204/002/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[rule]
description = """
Identifies modifications to the root crontab file. Adversaries may overwrite this file to gain code execution with root
privileges by exploiting privileged file write or move related vulnerabilities.
"""
id = "31151602-1de1-4301-9b75-215ac8902b75"
license = "Elastic License v2"
name = "Potential Privilege Escalation via Root Crontab File Modification"
os_list = ["macos"]
reference = [
    "https://phoenhex.re/2017-06-09/pwn2own-diskarbitrationd-privesc",
    "https://www.exploit-db.com/exploits/42146",
]
version = "1.0.28"

query = '''
file where event.type != "deletion" and
 file.path == "/private/var/at/tabs/root" and not process.executable == "/usr/bin/crontab"
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1053"
name = "Scheduled Task/Job"
reference = "https://attack.mitre.org/techniques/T1053/"
[[threat.technique.subtechnique]]
id = "T1053.003"
name = "Cron"
reference = "https://attack.mitre.org/techniques/T1053/003/"



[threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[internal]
min_endpoint_version = "7.15.0"

[metadata]
creation_date = "2021/10/15"
integration = ["windows"]
maturity = "production"
updated_date = "2026/05/03"

[rule]
author = ["Elastic"]
description = """
Detects PowerShell script block content containing PSReflect-style helper indicators, such as Add-Win32Type,
New-InMemoryModule, or DllImport patterns, that may support dynamic Win32 API invocation from PowerShell.
"""
false_positives = [
    "Legitimate PSReflect use when reconstructed content, imported API set, script origin, launcher, user/host scope, and same-host effects align with an approved workflow"
]
from = "now-9m"
index = ["logs-windows.powershell*", "winlogbeat-*"]
language = "kuery"
license = "Elastic License v2"
name = "PowerShell PSReflect Script"
references = [
    "https://github.com/mattifestation/PSReflect/blob/master/PSReflect.psm1",
    "https://github.com/atc-project/atc-data/blob/master/docs/Logging_Policies/LP_0109_windows_powershell_script_block_log.md",
]
risk_score = 73
rule_id = "56f2e9b5-4803-4e44-a0a4-a52dc79d57fe"
severity = "high"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Execution",
    "Resources: Investigation Guide",
    "Data Source: PowerShell Logs",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
event.category:process and host.os.type:windows and
  powershell.file.script_block_text:(
    "New-InMemoryModule" or
    "Add-Win32Type" or
    psenum or
    DefineDynamicAssembly or
    DefineDynamicModule or
    "Reflection.TypeAttributes" or
    "Reflection.Emit.OpCodes" or
    "Reflection.Emit.CustomAttributeBuilder" or
    "Runtime.InteropServices.DllImportAttribute"
  ) and
  not user.id : "S-1-5-18"
'''

note = """## Triage and analysis

### Investigating PowerShell PSReflect Script
#### Possible investigation steps

- Does the reconstructed script block show active PSReflect native-API wiring?
  - Why: script block logging can split one script; PSReflect is meaningful only after imports and follow-on logic are visible.
  - Focus: reconstruct with `powershell.file.script_block_id`, `powershell.sequence`, and `powershell.total`, then read `powershell.file.script_block_text` in `host.id` / `user.id` scope. $investigate_0
  - Implication: escalate when the full script defines New-InMemoryModule, Add-Win32Type, psenum, Reflection.Emit, DefineDynamicAssembly, DefineDynamicModule, or DllImportAttribute and calls wrapped APIs; lower suspicion when it is inert reference text, repository content, or a bounded lab example.

- What native API objective does the script express?
  - Focus: Imported DLL/function pairs and call sites in reconstructed `powershell.file.script_block_text`.
  - Hint: renamed wrappers or helper-free variants can show the same behavior when DllImportAttribute, Reflection.Emit, VirtualAlloc, WriteProcessMemory, CreateRemoteThread, OpenProcessToken, or AdjustTokenPrivileges reveal native-API invocation.
  - Implication: escalate when call sites map to memory manipulation, token or privilege changes, service tampering, registry changes, or network control; lower urgency when imports stay limited to bounded diagnostics or application interop and later evidence does not contradict that use.

- If endpoint process telemetry exists, how was PowerShell launched?
  - Why: script block events preserve deobfuscated content, not the command line or parent.
  - Focus: Recover the matching process via `host.id + process.pid` before interpreting `process.*` or `process.parent.*`; read `process.entity_id`, `process.command_line`, `process.parent.executable`, and `process.parent.command_line`. $investigate_1
  - Hint: expand the window if no process start appears; without process telemetry, keep later review scoped to `host.id`, `user.id`, `process.pid`, and alert time.
  - Implication: escalate when a document, browser, chat client, remote session, scheduled task, or user-writable script path launched the helper; lower suspicion when launcher and command fit the same recognized build, admin, interop, or assessment workflow as the script.

- Does script origin fit the recovered workflow?
  - Focus: `file.path`, `file.directory`, `file.name`, missing file-origin fields, and recovered launch context.
  - Implication: escalate when fileless on a workstation or sourced from temp, download, mounted-share, or user-writable paths that do not fit the user; lower suspicion when it resolves to a stable repository, deployment path, or test harness matching the same workflow.

- Do same-host effects prove the wrapped APIs were used?
  - Why: PSReflect is a helper pattern; the decisive follow-up is whether host activity matches the imported API family.
  - Focus: API-matched effects: child execution for process APIs, staged payloads for write/load APIs, persistence or configuration changes for service/registry APIs, and outbound activity for network APIs. Use same-PID events around `@timestamp` to reduce PID-reuse ambiguity.
    - $investigate_4
    - $investigate_5
    - $investigate_6
  - Implication: escalate when effects appear in recovered process scope or the `host.id`, `user.id`, `process.pid`, and time fallback scope; lower suspicion only when they align with the same bounded workflow. Missing network or endpoint effect telemetry is unresolved, not benign.

- Does related alert scope change urgency?
  - Focus: 48-hour alerts for the same `user.id` showing repeated PowerShell, execution, defense-evasion, privilege-escalation, or credential-access activity; use same-`host.id` alerts only to confirm repeated script substrings or the same imported API set.
    - $investigate_2
    - $investigate_3
  - Implication: broaden the case when related activity shows repeated native-API abuse, follow-on execution, or spread outside the original host; keep scope local when repetition stays confined to one exact benign workflow already supported by local evidence.

- What disposition is supported?
  - Implication: escalate when content, origin, launch, effects, or scope align on injection, privilege manipulation, persistence, remote activity, or egress that does not fit the user; close only when same-host telemetry proves one exact benign workflow and no contradictory findings remain. Outside confirmation may corroborate but not replace telemetry; if mixed or incomplete, preserve artifacts and escalate.

### False positive analysis

- Internal build, admin, interop, diagnostics, compatibility, or security-testing helpers can use PSReflect-style code. Confirm only when reconstructed `powershell.file.script_block_text`, imported API set, `file.path` or fileless delivery, launcher, `user.id`, `host.id`, and same-host effects all fit one bounded workflow without injection, persistence, egress, or privilege abuse. Change records, repository history, test schedules, or recurrence can support closure but not replace telemetry.
- Before an exception, validate recurrence of the same `user.id`, `host.id`, stable `file.path` when file-backed, recovered launcher, and distinctive `powershell.file.script_block_text` substrings. Avoid exceptions on PSReflect helper strings, `user.name`, or host alone.

### Response and remediation

- If confirmed benign, document reconstructed script text, imported DLL/function set, origin, `user.id`, `host.id`, launch context, and same-host effect review before reversing containment. Create exceptions only for recurring workflows.
- If suspicious but unconfirmed, preserve script block IDs/sequences, reconstructed text, API list, origin, process-start evidence, and same-host effect artifacts before response. Apply reversible containment such as destination restrictions or session limits; isolate only when corroboration shows likely injection, persistence, lateral movement, or credential misuse and the host role permits. Avoid destructive cleanup until scope is clearer.
- If confirmed malicious, preserve the same artifacts plus related child-process, file-system, persistence, credential, and destination evidence before containment. Isolate the host and terminate PowerShell or child payloads after evidence capture; if direct response is unavailable, escalate with preserved artifacts. Block malicious scripts, payload hashes, and destinations, then review related users/hosts for the same script substrings, API set, or launch chain before eradication.
- After containment, remove only scripts or payloads identified during investigation, undo persistence or configuration changes tied to the API objective, and remediate the delivery path or automation that launched the helper. If imports or same-host effects suggest credential theft, token abuse, or remote execution, reset affected credentials and review related auth/admin sessions before cleanup.
- Post-incident hardening: restrict PowerShell interop and unsigned script distribution to controlled build, admin, or test systems; retain script block logging and endpoint process telemetry for `host.id + process.pid` recovery; document renamed-wrapper or helper-free reflection variants.
"""

setup = """## Setup

PowerShell Script Block Logging must be enabled to generate the events used by this rule (e.g., 4104).
Setup instructions: https://ela.st/powershell-logging-setup
"""

[[rule.filters]]

[rule.filters.meta]
negate = true
[rule.filters.query.wildcard."file.path"]
case_insensitive = true
value = "?:\\\\ProgramData\\\\MaaS360\\\\Cloud Extender\\\\AR\\\\Scripts\\\\ASModuleCommon.ps1"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user.id",
    "user.domain",
    "powershell.file.script_block_text",
    "powershell.file.script_block_id",
    "powershell.sequence",
    "powershell.total",
    "file.path",
    "file.directory",
    "file.name",
    "process.pid",
    "host.name",
    "host.id",
    "powershell.file.script_block_length"
]

[transform]

[[transform.investigate]]
label = "Script block fragments for the same script"
description = ""
providers = [
  [
    { excluded = false, field = "powershell.file.script_block_id", queryType = "phrase", value = "{{powershell.file.script_block_id}}", valueType = "string" },
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" }
  ]
]
relativeFrom = "now-1h"
relativeTo = "now"

[[transform.investigate]]
label = "Process events for the PowerShell instance"
description = ""
providers = [
  [
    { excluded = false, field = "process.pid", queryType = "phrase", value = "{{process.pid}}", valueType = "string" },
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" }
  ]
]
relativeFrom = "now-1h"
relativeTo = "now"

[[transform.investigate]]
label = "Alerts associated with the user"
description = ""
providers = [
  [
    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
    { excluded = false, field = "user.id", queryType = "phrase", value = "{{user.id}}", valueType = "string" }
  ]
]
relativeFrom = "now-48h/h"
relativeTo = "now"

[[transform.investigate]]
label = "Alerts associated with the host"
description = ""
providers = [
  [
    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" }
  ]
]
relativeFrom = "now-48h/h"
relativeTo = "now"

[[transform.investigate]]
label = "Child process events for the PowerShell PID"
description = ""
providers = [
  [
    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" },
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "process.parent.pid", queryType = "phrase", value = "{{process.pid}}", valueType = "string" }
  ]
]
relativeFrom = "now-1h"
relativeTo = "now"

[[transform.investigate]]
label = "File and registry events for the PowerShell PID"
description = ""
providers = [
  [
    { excluded = false, field = "event.category", queryType = "phrase", value = "file", valueType = "string" },
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "process.pid", queryType = "phrase", value = "{{process.pid}}", valueType = "string" }
  ],
  [
    { excluded = false, field = "event.category", queryType = "phrase", value = "registry", valueType = "string" },
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "process.pid", queryType = "phrase", value = "{{process.pid}}", valueType = "string" }
  ]
]
relativeFrom = "now-1h"
relativeTo = "now"

[[transform.investigate]]
label = "Network events for the PowerShell PID"
description = ""
providers = [
  [
    { excluded = false, field = "event.category", queryType = "phrase", value = "network", valueType = "string" },
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "process.pid", queryType = "phrase", value = "{{process.pid}}", valueType = "string" }
  ]
]
relativeFrom = "now-1h"
relativeTo = "now"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"

[[rule.threat.technique.subtechnique]]
id = "T1059.001"
name = "PowerShell"
reference = "https://attack.mitre.org/techniques/T1059/001/"

[[rule.threat.technique]]
id = "T1106"
name = "Native API"
reference = "https://attack.mitre.org/techniques/T1106/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[metadata]
creation_date = "2023/07/18"
integration = ["windows"]
maturity = "production"
updated_date = "2026/01/26"

[rule]
author = ["Elastic"]
description = """
Detects PowerShell script block content that references webcam capture APIs or video capture device objects.
Attackers use webcam recording to surveil victims or collect sensitive footage for extortion.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-windows.powershell*"]
language = "kuery"
license = "Elastic License v2"
name = "PowerShell Script with Webcam Video Capture Capabilities"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating PowerShell Script with Webcam Video Capture Capabilities

This alert indicates PowerShell script block content on a Windows host that references webcam or video capture components. The matched content may represent device enumeration, frame handling, or capture routines used to record from an attached camera. Because webcam collection has privacy and regulatory impact, prioritize confirming intent, scope, and whether any recordings were produced or transferred.

#### Key alert fields to review

- `user.name`, `user.domain`, `user.id`: Account execution context for correlation, prioritization, and scoping.
- `host.name`, `host.id`: Host execution context for correlation, prioritization, and scoping.
- `powershell.file.script_block_text`: Script block content that matched the detection logic.
- `powershell.file.script_block_id`, `powershell.sequence`, `powershell.total`: Script block metadata to pivot to other fragments or reconstruct full script content when split across multiple events.
- `file.path`, `file.directory`, `file.name`: File-origin context when the script block is sourced from an on-disk file.
- `powershell.file.script_block_length`: Script block length (size) context.

#### Possible investigation steps

- Analyze the script content in `powershell.file.script_block_text` to understand its functionality:
  - Identify references to webcam or video capture APIs, classes, or methods (for example, `VideoCaptureDevice`, `NewFrameEventHandler`, `DirectX.Capture.Filters`, `VideoCompressors`, or calls to `avicap32.dll` functions).
  - Look for logic that initializes the camera, configures capture settings, handles frame events, and starts/stops recording.
  - Note any output handling, such as saving recordings to disk or preparing data for transmission.
- Reconstruct the complete script when content is split across multiple events:
  - Group by `powershell.file.script_block_id` and order by `powershell.sequence` through `powershell.total`.
  - Preserve the reconstructed content as an investigation artifact and note `powershell.file.script_block_length` for context (very large blocks may contain additional functionality beyond capture).
- Identify likely collection intent and potential artifacts by inspecting the script content:
  - Look for device enumeration and selection logic (for example, listing available devices, choosing a specific camera, or referencing device indices).
  - Look for capture start/stop logic, timers, or loops that control duration and frequency.
  - Look for references to output locations, file names, or post-processing steps (encoding, compression, or transformation of captured frames).
  - Look for indications of onward handling of recordings (archiving, encryption, or transfer).
- Determine script origin and reuse:
  - If `file.path` and `file.name` are present, treat the script as file-backed content and assess whether the location in `file.directory` is expected for the user and host.
  - Pivot on `file.path` or `file.name` to identify additional script block events that reference the same file, and whether the same content appears on other hosts.
- Establish user and host context:
  - Validate whether `user.name` and `user.domain` align with expected webcam usage on `host.name` (for example, support, QA, or multimedia testing roles) and whether the timing is consistent with normal activity.
  - Pivot on `host.id` and `user.id` in a narrow time window around `@timestamp` to identify related PowerShell script blocks that suggest staging, repeated attempts, or follow-on activity.
- Correlate with adjacent telemetry in your environment to confirm execution and impact:
  - Process telemetry: determine how PowerShell was launched (interactive use vs. launched by another program) and whether the activity was isolated or part of a broader execution chain.
  - File telemetry: identify creation or modification of video artifacts and any additional scripts written or fetched around the alert time.
  - Network telemetry: identify outbound connections that could support remote tasking or transfer of captured content.
  - Authentication telemetry: verify whether the user context was local, remote, or recently authenticated in an unusual way during the alert window.

### False positive analysis

- Benign camera diagnostics or hardware validation scripts may reference capture devices, frame handlers, and compressor lists without performing unauthorized recording.
- Development and testing environments may include sample or proof-of-concept code that imports or references capture libraries during troubleshooting or application development.
- Enterprise imaging, kiosk build, or A/V workstation provisioning workflows may temporarily stage scripts that validate camera availability and driver functionality.

### Response and remediation

- If activity is unexpected or violates policy, treat as a potential privacy-impacting collection incident:
  - Escalate according to your incident response and privacy handling procedures.
  - Preserve the full script content (reconstructed if needed) and record key identifiers: `@timestamp`, `host.name`, `host.id`, `user.name`, `user.id`, and any `file.path`/`file.name` present.
- Contain potential ongoing collection:
  - Isolate the affected host using standard endpoint response controls.
  - Restrict the suspected user account and investigate for additional malicious activity associated with `user.id` and `host.id` during the same period.
  - If appropriate for your environment, temporarily restrict access to the camera device on the affected host until legitimacy is confirmed.
- Eradicate and recover:
  - Remove or quarantine unauthorized scripts referenced by `file.path`/`file.name` and any related artifacts identified during triage.
  - If recordings were created, locate and secure them as evidence, and assess whether any transfer occurred.
  - Reset credentials for impacted accounts if compromise is suspected and review for additional access paths.
- Post-incident actions:
  - Increase monitoring for similar PowerShell script block content on the scoped hosts and accounts to detect recurrence.
  - Review endpoint hardening and least-privilege controls for camera access and script execution where feasible.
"""
references = [
    "https://github.com/EmpireProject/Empire/blob/master/lib/modules/powershell/collection/WebcamRecorder.py",
]
risk_score = 47
rule_id = "eb44611f-62a8-4036-a5ef-587098be6c43"
setup = """## Setup

PowerShell Script Block Logging must be enabled to generate the events used by this rule (e.g., 4104).
Setup instructions: https://ela.st/powershell-logging-setup
"""
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Collection",
    "Data Source: PowerShell Logs",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
event.category:process and host.os.type:windows and
  powershell.file.script_block_text : (
    "NewFrameEventHandler" or
    "VideoCaptureDevice" or
    "DirectX.Capture.Filters" or
    "VideoCompressors" or
    "Start-WebcamRecorder" or
    (
      ("capCreateCaptureWindowA" or
       "capCreateCaptureWindow" or
       "capGetDriverDescription") and
      ("avicap32.dll" or "avicap32")
    )
  )
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1125"
name = "Video Capture"
reference = "https://attack.mitre.org/techniques/T1125/"


[rule.threat.tactic]
id = "TA0009"
name = "Collection"
reference = "https://attack.mitre.org/tactics/TA0009/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[rule.threat.technique.subtechnique]]
id = "T1059.001"
name = "PowerShell"
reference = "https://attack.mitre.org/techniques/T1059/001/"



[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user.id",
    "user.domain",
    "powershell.file.script_block_text",
    "powershell.file.script_block_id",
    "powershell.sequence",
    "powershell.total",
    "file.path",
    "file.directory",
    "file.name",
    "process.pid",
    "host.name",
    "host.id",
    "powershell.file.script_block_length"
]