Elastic rules: 20

[metadata]
creation_date = "2026/08/24"
integration = ["aws"]
maturity = "production"
updated_date = "2026/08/24"

[rule]
author = ["Elastic"]
description = """
Detects enumeration of AWS Backup resources using long-term IAM access keys (AKIA* prefix).
AWS Backup protects EC2 instances, EBS volumes, RDS databases, DynamoDB tables, EFS file
systems, and S3 buckets. An adversary who obtains long-term access keys may enumerate backup
vaults, backup plans, and protected resources as a precursor to ransomware. Identifying which
resources have recent backups (indicating high-value data) and what vault access policies can
be modified to delete or corrupt the backups before encrypting the primary data.
"""
false_positives = [
    """
    Automated monitoring tools or compliance audit scripts using long-term IAM keys to
    inventory backup coverage will trigger this rule. Migrate automation to IAM roles with
    short-lived credentials. Long-term key usage for backup management is a security anti-pattern.
    """,
]
from = "now-6m"
index = ["logs-aws.cloudtrail-*"]
language = "kuery"
license = "Elastic License v2"
name = "AWS Backup Resource Enumeration via Long-Term Access Key"
note = """## Triage and analysis

### Investigating AWS Backup Resource Enumeration via Long-Term Access Key

AWS Backup vaults and plans are the last line of recovery for ransomware victims. Adversaries performing ransomware preparation systematically enumerate backup vaults to locate recovery points, assess vault lock configuration, and identify which vaults can be deleted or which backup plans can be disabled before encrypting the primary data stores.

Long-term access keys (AKIA* prefix) are the most commonly exfiltrated credential type, appearing in source code, .env files, and CI/CD configurations. Their use for backup enumeration is particularly suspicious because backup management is almost never performed by individual IAM users with static keys in modern environments.

### Possible investigation steps

- Identify the IAM user from aws.cloudtrail.user_identity.arn and confirm whether this user should have backup management access.
- Review source.ip and source.as.organization.name against known infrastructure. Backup enumeration from an unexpected IP with a long-term key is a high-risk indicator.
- Query for subsequent backup write operations by this key: DeleteBackupVault, DeleteRecoveryPoint, DeleteBackupPlan, UpdateRegionSettings.
- Correlate with other enumeration activity from the same access key: EC2 Describe calls, S3 ListBuckets, RDS DescribeDBInstances — broad enumeration suggests ransomware reconnaissance.
- Determine whether Vault Lock is enabled on critical backup vaults (GetBackupVaultLockConfiguration).

### Response and remediation

- Immediately deactivate the long-term access key.
- Enable Vault Lock (WORM) on critical backup vaults to prevent deletion for a compliance period.
- Review all backup vault access policies for unauthorized modifications.
- Enable AWS Backup audit manager reports to detect future unauthorized backup modifications.
"""
references = [
    "https://docs.aws.amazon.com/aws-backup/latest/devguide/API_ListBackupVaults.html",
    "https://hackingthe.cloud/aws/enumeration/enumerate_services_via_aws_backup/",
]
risk_score = 21
rule_id = "e71ae602-bf44-4834-a4ea-b5c87047d426"
setup = "The AWS integration must be ingesting management events into `logs-aws.cloudtrail-*`. AWS Backup management events are logged by default."
severity = "low"
tags = [
    "Domain: Cloud",
    "Platform: AWS",
    "Data Source: AWS CloudTrail",
    "Service: AWS Backup",
    "Rule Type: Custom Query (KQL)",
    "Tactic: Discovery",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset: "aws.cloudtrail"
    and event.provider: "backup.amazonaws.com"
    and event.action: (
        "ListBackupVaults" or
        "ListBackupJobs" or
        "ListBackupPlans" or
        "ListProtectedResources" or
        "ListRecoveryPointsByBackupVault" or
        "GetBackupPlan" or
        "GetBackupVaultAccessPolicy" or
        "DescribeBackupJob" or
        "DescribeRecoveryPoint"
    )
    and event.outcome: "success"
    and aws.cloudtrail.user_identity.access_key_id: AKIA*
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1526"
name = "Cloud Service Discovery"
reference = "https://attack.mitre.org/techniques/T1526/"


[rule.threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "aws.cloudtrail.user_identity.arn",
    "aws.cloudtrail.user_identity.type",
    "aws.cloudtrail.user_identity.access_key_id",
    "user.name",
    "event.action",
    "event.outcome",
    "source.ip",
    "source.as.organization.name",
    "cloud.region",
    "cloud.account.id",
]

[metadata]
creation_date = "2026/02/05"
integration = ["aws"]
maturity = "production"
updated_date = "2026/07/08"

[rule]
author = ["Elastic"]
description = """
Detects attempts to disassociate or manipulate Amazon GuardDuty member accounts within an AWS organization. In
multi-account GuardDuty deployments, a delegated administrator account aggregates findings from member accounts.
Adversaries may attempt to disassociate member accounts, delete member relationships, stop monitoring members, or delete
pending invitations to break this centralized visibility. These actions can be precursors to or alternatives for
deleting GuardDuty detectors entirely, allowing attackers to operate undetected in member accounts while the
administrator account loses visibility. This rule identifies successful API calls that manipulate GuardDuty member
relationships, which are rare in normal operations and warrant immediate investigation.
"""
false_positives = [
    """
    GuardDuty member relationships may be modified during legitimate organizational changes such as account migrations,
    security architecture restructuring, or delegated administrator transitions. Verify whether the user identity and
    timing align with approved change management processes. If this is expected administrative activity, it can be
    exempted from the rule.
    """,
]
from = "now-6m"
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
language = "kuery"
license = "Elastic License v2"
name = "AWS GuardDuty Member Account Manipulation"
note = """## Triage and analysis

### Investigating AWS GuardDuty Member Account Manipulation

In AWS Organizations with GuardDuty enabled, a delegated administrator account receives and aggregates security findings from all member accounts. This centralized visibility is critical for detecting threats across the organization. Adversaries who compromise a member account may attempt to break this relationship to operate without triggering alerts visible to the security team.

This rule detects several API actions that manipulate GuardDuty member relationships:
- `DisassociateFromMasterAccount` / `DisassociateFromAdministratorAccount`: Member account breaks its connection to the administrator
- `DeleteMembers`: Administrator removes member accounts from GuardDuty
- `StopMonitoringMembers`: Administrator stops monitoring specific member accounts without fully removing them
- `DeleteInvitations`: Member account deletes pending invitations, preventing association

These actions are extremely rare in normal operations and can indicate either a compromised account or an attacker preparing to disable GuardDuty entirely.

### Possible investigation steps

- **Identify the actor**
  - Review `aws.cloudtrail.user_identity.arn` and `aws.cloudtrail.user_identity.type` to determine who performed the action.
  - Determine whether the action originated from a member account (disassociation) or the administrator account (deletion/stop monitoring).

- **Review request context**
  - Check `aws.cloudtrail.request_parameters` to identify which member accounts were affected.
  - Determine the scope: single account or multiple accounts targeted.

- **Analyze source and access patterns**
  - Review `source.ip` and `user_agent.original` for anomalous access patterns.
  - Check if the action occurred outside normal business hours or maintenance windows.

- **Correlate with related activity**
  - Search for subsequent `DeleteDetector` API calls in the affected member accounts.
  - Look for other defense evasion indicators: CloudTrail modifications, Config rule deletions, Security Hub changes.
  - Check for privilege escalation or credential access events preceding this action.

- **Verify business justification**
  - Confirm with the identified user or team whether there was a legitimate organizational change.
  - Check for related change tickets or migration documentation.

### False positive analysis

- **Organizational restructuring**
  - Member relationships may change during account migrations or delegated administrator transitions.
  - Validate against documented organizational changes.

- **Account decommissioning**
  - Accounts being retired may be removed from GuardDuty before closure.
  - Confirm this aligns with account lifecycle management processes.

### Response and remediation

- **Immediate containment**
  - If unauthorized, immediately re-associate the affected member accounts with the administrator.
  - For `StopMonitoringMembers`, use `StartMonitoringMembers` to restore visibility.

- **Investigation**
  - Audit the affected member accounts for suspicious activity during the visibility gap.
  - Review CloudTrail for any actions taken while GuardDuty monitoring was disrupted.

- **Hardening**
  - Restrict `guardduty:DisassociateFromAdministratorAccount`, `guardduty:DeleteMembers`, and related permissions.
  - Use SCPs to prevent member accounts from disassociating from GuardDuty administrators.
  - Implement Security Hub controls to detect changes to GuardDuty organization configuration.

### Additional information
- **[AWS GuardDuty Multi-Account Documentation](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_accounts.html)**
- **[AWS IR Playbooks](https://github.com/aws-samples/aws-incident-response-playbooks/blob/c151b0dc091755fffd4d662a8f29e2f6794da52c/playbooks/)**
- **[AWS Customer Playbook Framework](https://github.com/aws-samples/aws-customer-playbook-framework/tree/a8c7b313636b406a375952ac00b2d68e89a991f2/docs)**
"""
references = [
    "https://docs.aws.amazon.com/guardduty/latest/APIReference/API_DisassociateFromAdministratorAccount.html",
    "https://docs.aws.amazon.com/guardduty/latest/APIReference/API_DeleteMembers.html",
    "https://docs.aws.amazon.com/guardduty/latest/APIReference/API_StopMonitoringMembers.html",
    "https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_accounts.html",
    "https://permiso.io/blog/lucr-3-scattered-spider-getting-saas-y-in-the-cloud",
]
risk_score = 73
rule_id = "3c59d2e1-8ca1-4f13-b2ac-f4bb99ff69d7"
severity = "high"
tags = [
    "Domain: Cloud",
    "Data Source: AWS",
    "Data Source: Amazon Web Services",
    "Data Source: AWS GuardDuty",
    "Tactic: Defense Evasion",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset: "aws.cloudtrail"
    and event.provider: "guardduty.amazonaws.com"
    and event.action: (
        "DisassociateFromAdministratorAccount" or
        "DeleteMembers" or
        "StopMonitoringMembers" or
        "DeleteInvitations" or
        "DisassociateMembers"
    )
    and event.outcome: "success"
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[rule.threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"



[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user_agent.original",
    "source.ip",
    "aws.cloudtrail.user_identity.arn",
    "aws.cloudtrail.user_identity.type",
    "aws.cloudtrail.user_identity.access_key_id",
    "event.action",
    "event.outcome",
    "cloud.account.id",
    "cloud.region",
    "aws.cloudtrail.request_parameters",
    "aws.cloudtrail.response_elements",
]

[metadata]
creation_date = "2024/12/02"
integration = ["aws"]
maturity = "production"
updated_date = "2026/04/10"

[rule]
author = ["Elastic"]
description = """
Identifies creation of a console login profile for the AWS account root user. While CreateLoginProfile normally applies to IAM users, when performed from a temporary root session (e.g., via AssumeRoot) and the userName parameter is omitted, the profile is created for the root principal (self-assigned). Adversaries with temporary root access may add or reset the root login profile to establish persistent console access even if original access keys are rotated or disabled. Correlate with recent AssumeRoot/STS activity and validate intent with the account owner.

"""
from = "now-6m"
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
language = "eql"
license = "Elastic License v2"
name = "AWS IAM Login Profile Added for Root"
note = """## Triage and analysis

### Investigating AWS IAM Login Profile Added for Root

This rule detects when a console login profile is created for the AWS root account.  
A login profile enables password-based console access, and because the root user has unrestricted privileges, creating one is an extremely high-impact event. Adversaries who temporarily gain root-level credentials (for example, through an STS session or credential compromise) may use `CreateLoginProfile` without specifying a `userName` to add a password to the root account. This grants persistent access even if the attacker’s API keys are later rotated or disabled.

### Possible investigation steps

**Assess the timing and context of the event**
- Review the `@timestamp` to determine when the `CreateLoginProfile` call occurred.  
  - Correlate this time window with other root or IAM activity such as `AssumeRoot`, `GetSessionToken`, `ConsoleLogin`, or `CreateAccessKey`.  
  - Check for follow-on activity, especially `ConsoleLogin` events or `UpdateLoginProfile`, which may indicate that the root password was used immediately after creation.

**Investigate event origin and session details**
- Review `source.ip` and `user_agent.original`:
  - Determine if the request originated from an expected network range, VPN endpoint, or geolocation.
  - Identify whether the access was interactive (for example, browser or AWS console) or automated (`aws-cli`, SDK, or API client).
- Examine `aws.cloudtrail.user_identity.access_key_id` and associated STS session context to see if temporary credentials were used.
- Compare this event’s IP and access key to any other recent CloudTrail activity to identify potential lateral movement or multi-account access attempts.

**Analyze the login profile creation**
- Review `aws.cloudtrail.request_parameters` and `aws.cloudtrail.response_elements`:
  - Check whether `passwordResetRequired` was set to `true` or omitted, absence may imply that the attacker created a password they intend to reuse.
- Cross-reference this action with previous failed login attempts, password recovery requests, or `AssumeRoot` behavior.

**Correlate related identity and access behavior**
- Search for additional IAM management activity:
  - `AttachUserPolicy`, `AttachRolePolicy`, or `PutUserPolicy` granting elevated permissions.
  - New `AccessKey` creation or `UpdateAccessKey` events tied to the same session.
- Review GuardDuty findings or any other detections referencing this account or IP around the same time period.
- If available, correlate with CloudTrail to detect if other resource creation or configuration changes followed the login profile addition.

**Validate with account owner or authorized personnel**
- Contact the designated account or root credential owner to confirm whether this action was intentional (for example, during an account recovery).
- Review any internal change-management or service ticketing systems for an approved request matching this activity.

### False positive analysis

Although rare, legitimate scenarios include:
- **Authorized account recovery** : An administrator or AWS Support might temporarily add a root login profile to regain access. Validate against documented recovery workflows.  
- **Controlled testing or sandbox environments** : Certain sandbox accounts may reuse root credentials for automation or demonstration purposes. Tag and exclude these accounts from this rule where appropriate.  
- **Automated provisioning** : Review any account bootstrap or recovery automation scripts that may invoke `CreateLoginProfile` on root credentials.

For any potential false positive, verify that:
- The `source.ip` and `user_agent.original` values align with expected administrative locations and tools.  
- The change was recorded during a maintenance window or known security operation.

### Response and remediation

> Any unapproved creation of a login profile for the root account is a critical security incident requiring immediate containment and credential rotation.

**Containment**
- Delete the newly created root login profile if it was not authorized.  
- Rotate the root account password using AWS’s official password-reset workflow.  
- Revoke any active sessions, temporary credentials, or tokens associated with this event.  
- Verify that multi-factor authentication (MFA) is enabled and functioning on the root account.  
- Check that no root access keys exist — if present, remove them immediately.

**Investigation and scoping**
- Examine CloudTrail logs from 30 minutes before and after this event to identify correlated actions.  
- Capture and securely store these logs in an isolated S3 bucket with Object Lock enabled to preserve forensic integrity.  
- Investigate for additional IAM or STS operations by the same `access_key_id` or IP address that may indicate privilege escalation or persistence attempts.  
- Review whether any new IAM roles, users, or policies were created in proximity to this event.

**Recovery and hardening**
- Reset the root password and distribute the new credentials securely to authorized custodians only.  
- Ensure MFA is enforced for all administrative and root-level access.  
- Audit all IAM policies for least-privilege adherence, focusing on `iam:CreateLoginProfile`, `iam:UpdateLoginProfile`, and `iam:CreateAccessKey` permissions.  
- Enable Cloudtrail, GuardDuty, AWS Config, and Security Hub across all regions for continuous monitoring of root and IAM activity.  
- Review your organization’s playbooks and detection coverage for root-level persistence techniques, and update procedures as needed.

**Post-incident actions**
- Notify AWS account owners and your security operations center of the incident.  
- Conduct a post-mortem to determine the initial vector of compromise (e.g., stolen credentials, misconfigured role chaining, or insufficient MFA).  
- Update alerting thresholds and detection logic to minimize mean time to detect (MTTD) and respond (MTTR).

### Additional information

- **AWS Incident Response Playbooks**  
  - [IRP-CredCompromise](https://github.com/aws-samples/aws-incident-response-playbooks/blob/c151b0dc091755fffd4d662a8f29e2f6794da52c/playbooks/IRP-CredCompromise.md) – Containment and recovery for suspected credential abuse.  
- **AWS Customer Playbook Framework**  
  - [Compromised_IAM_Credentials.md](https://github.com/aws-samples/aws-customer-playbook-framework/blob/a8c7b313636b406a375952ac00b2d68e89a991f2/docs/Compromised_IAM_Credentials.md) – Steps to contain, investigate, and recover from credential compromise.  
- **AWS Documentation**  
  - [CreateLoginProfile API Reference](https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateLoginProfile.html)  
  - [Root User Best Practices](https://docs.aws.amazon.com/IAM/latest/UserGuide/root-user-best-practices.html)
"""
risk_score = 73
rule_id = "c04be7e0-b0fc-11ef-a826-f661ea17fbce"
severity = "high"
tags = [
    "Domain: Cloud",
    "Data Source: AWS",
    "Data Source: Amazon Web Services",
    "Data Source: AWS IAM",
    "Use Case: Identity and Access Audit",
    "Tactic: Persistence",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
any where data_stream.dataset == "aws.cloudtrail"
   and event.provider == "iam.amazonaws.com"
   and event.action == "CreateLoginProfile"
   and aws.cloudtrail.user_identity.type == "Root"
   and event.outcome == "success"
   and not stringContains(aws.cloudtrail.request_parameters, "userName=")
'''
[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user_agent.original",
    "source.ip",
    "aws.cloudtrail.user_identity.arn",
    "aws.cloudtrail.user_identity.type",
    "aws.cloudtrail.user_identity.access_key_id",
    "event.action",
    "event.outcome",
    "cloud.account.id",
    "cloud.region",
    "aws.cloudtrail.request_parameters",
    "aws.cloudtrail.response_elements"
]

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"

[[rule.threat.technique.subtechnique]]
id = "T1078.004"
name = "Cloud Accounts"
reference = "https://attack.mitre.org/techniques/T1078/004/"

[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"

[[rule.threat.technique.subtechnique]]
id = "T1098.001"
name = "Additional Cloud Credentials"
reference = "https://attack.mitre.org/techniques/T1098/001/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[metadata]
creation_date = "2026/07/23"
integration = ["azure"]
maturity = "production"
updated_date = "2026/07/23"

[rule]
author = ["Elastic"]
description = """
Detects an identity minting a service account token via the AKS (Azure Kubernetes Service) TokenRequest API
(serviceaccounts/token), excluding known AKS control-plane and platform identities. Adversaries request service account
tokens from a compromised identity to impersonate a workload, move laterally, or escalate privileges within the cluster.
Coverage includes workload service accounts (system:serviceaccount:*), so a compromised in-cluster token minting a token
for another service account is not excluded.
"""
false_positives = [
    """
    Controllers, CI/CD systems, and platform components legitimately request service account tokens. Baseline the
    requesting identities and exclude verified automation after review.
    """,
]
from = "now-9m"
index = ["logs-azure.platformlogs-*"]
language = "kuery"
license = "Elastic License v2"
name = "Azure AKS Service Account Token Created via TokenRequest API"
note = """## Triage and analysis

### Investigating Azure AKS Service Account Token Created via TokenRequest API

AKS kube-audit events are carried under the flattened `azure.platformlogs.properties.log.*` subtree and share the ARM
operation `event.action: Microsoft.ContainerService/managedClusters/diagnosticLogs/Read`. The TokenRequest API
(`serviceaccounts/token`) mints a bound service account token. The kubelet (`system:node:*`) and the
kube-controller-manager (`aksService`) mint these tokens continuously for normal pod operation and are excluded; the
signal is a non-platform identity minting one. An attacker with rights over a service account can request a token to act
as that workload identity, reaching resources the compromised principal cannot.

### Possible investigation steps

- Identify the requesting identity in `azure.platformlogs.properties.log.user.username` (and its groups in
  `azure.platformlogs.properties.log.user.groups`) and whether it should mint tokens. A workload service account
  (`system:serviceaccount:<ns>:<sa>`) minting a token, or `masterclient` (the local cluster-admin cert), is the
  higher-concern case.
- Inspect `azure.platformlogs.properties.log.userAgent` to distinguish interactive/expected tooling (`kubectl create
  token`) from custom clients (for example `curl`), which is a stronger indicator of scripted abuse.
- Identify the target service account in `azure.platformlogs.properties.log.objectRef.name` /
  `azure.platformlogs.properties.log.objectRef.namespace` and what RBAC that account holds; minting a token for a
  higher-privileged service account is privilege escalation.
- Evaluate the source in `azure.platformlogs.properties.log.sourceIPs` and pivot on it for follow-on API calls made with
  the minted token, and correlate with recent RBAC changes, secret reads, or exec sessions from the same identity.

### False positive analysis

- Controllers, CI/CD systems, and platform components legitimately request service account tokens (for example the
  kube-controller-manager as `aksService`, which is excluded). Additional automation such as GitOps operators or CI
  running `kubectl create token` may surface; baseline those identities and exclude the specific validated account
  rather than re-broadening to all `system:*`, which would blind the rule to compromised workload service accounts.

### Response and remediation

- If unauthorized, revoke the minted token and the requesting identity's credentials, and review the RBAC that permitted
  token creation.
- Audit actions performed with the target service account's identity after the request.
- Collect kube-audit and identity artifacts per incident response procedures.
"""
references = [
    "https://kubernetes.io/docs/reference/kubernetes-api/authentication-resources/token-request-v1/",
    "https://microsoft.github.io/Threat-Matrix-for-Kubernetes/",
    "https://github.com/inguardians/peirates",
]
risk_score = 47
rule_id = "95db6791-8e88-47d0-81c9-531ff79c0e60"
setup = """
The Azure Fleet integration collecting AKS diagnostic logs forwarded through Event Hub into the `azure.platformlogs`
data stream is required for this rule. Enable either the `kube-audit` or the `kube-audit-admin` log category (Microsoft
recommends `kube-audit-admin` alone to reduce volume, as it only drops read-only get/list events). TokenRequest is a
mutating create recorded in both categories with the same `auditID`, so clusters that enable both categories may
generate two alerts per request.
"""
severity = "medium"
tags = [
    "Domain: Cloud",
    "Domain: Kubernetes",
    "Data Source: Azure",
    "Data Source: Azure Platform Logs",
    "Data Source: Kubernetes",
    "Use Case: Threat Detection",
    "Tactic: Credential Access",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset:azure.platformlogs and
    event.action:"Microsoft.ContainerService/managedClusters/diagnosticLogs/Read" and
    azure.platformlogs.category:("kube-audit" or "kube-audit-admin") and
    azure.platformlogs.properties.log.stage:"ResponseComplete" and
    azure.platformlogs.properties.log.objectRef.resource:"serviceaccounts" and
    azure.platformlogs.properties.log.objectRef.subresource:"token" and
    azure.platformlogs.properties.log.verb:"create" and
    azure.platformlogs.properties.log.responseStatus.code:("200" or "201") and
    not azure.platformlogs.properties.log.user.username:(
        system\:node\:* or "aksService" or "hcpService" or "readinessChecker" or
        system\:serviceaccount\:kube-system\:*
    )
'''

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "event.action",
    "azure.platformlogs.category",
    "azure.platformlogs.properties.log.verb",
    "azure.platformlogs.properties.log.user.username",
    "azure.platformlogs.properties.log.user.groups",
    "azure.platformlogs.properties.log.userAgent",
    "azure.platformlogs.properties.log.sourceIPs",
    "azure.platformlogs.properties.log.objectRef.namespace",
    "azure.platformlogs.properties.log.objectRef.name",
    "azure.platformlogs.properties.log.objectRef.subresource",
    "azure.platformlogs.properties.log.requestURI",
    "azure.platformlogs.properties.log.responseStatus.code",
]

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1528"
name = "Steal Application Access Token"
reference = "https://attack.mitre.org/techniques/T1528/"

[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[metadata]
creation_date = "2020/02/18"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2026/05/04"

[rule]
author = ["Elastic"]
description = """
Identifies attempts to clear or disable Windows event log stores using Windows wevetutil command. This is often done by
attackers in an attempt to evade detection or destroy forensic evidence on a system.
"""
from = "now-9m"
index = [
    "endgame-*",
    "logs-crowdstrike.fdr*",
    "logs-endpoint.events.process-*",
    "logs-m365_defender.event-*",
    "logs-sentinel_one_cloud_funnel.*",
    "logs-system.security*",
    "logs-windows.forwarded*",
    "logs-windows.sysmon_operational-*",
    "winlogbeat-*",
]
language = "eql"
license = "Elastic License v2"
name = "Clearing Windows Event Logs"
note = """## Triage and analysis

### Investigating Clearing Windows Event Logs

Windows event logs are a fundamental data source for security monitoring, forensics, and incident response. Adversaries can tamper, clear, and delete this data to break SIEM detections, cover their tracks, and slow down incident response.

This rule looks for the execution of the `wevtutil.exe` utility or the `Clear-EventLog` cmdlet to clear event logs.

#### Possible investigation steps

- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
- Identify the user account that performed the action and whether it should perform this kind of action.
- Contact the account owner and confirm whether they are aware of this activity.
- Investigate other alerts associated with the user/host during the past 48 hours.
  - Verify if any other anti-forensics behaviors were observed.
- Investigate the event logs prior to the action for suspicious behaviors that an attacker may be trying to cover up.

### False positive analysis

- This mechanism can be used legitimately. Analysts can dismiss the alert if the administrator is aware of the activity and there are justifications for this action.
- Analyze whether the cleared event log is pertinent to security and general monitoring. Administrators can clear non-relevant event logs using this mechanism. If this activity is expected and noisy in your environment, consider adding exceptions — preferably with a combination of user and command line conditions.

### Response and remediation

- Initiate the incident response process based on the outcome of the triage.
  - This activity is potentially done after the adversary achieves its objectives on the host. Ensure that previous actions, if any, are investigated accordingly with their response playbooks.
- Isolate the involved host to prevent further post-compromise behavior.
- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
"""

setup = """## Setup

This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.

Setup instructions: https://ela.st/install-elastic-defend

### Additional data sources

This rule also supports the following third-party data sources. For setup instructions, refer to the links below:

- [CrowdStrike](https://ela.st/crowdstrike-integration)
- [Microsoft Defender XDR](https://ela.st/m365-defender)
- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
- [Sysmon Event ID 1 - Process Creation](https://ela.st/sysmon-event-1-setup)
- [Windows Process Creation Logs](https://ela.st/audit-process-creation)
"""

references = ["https://www.elastic.co/security-labs/invisible-miners-unveiling-ghostengine"]
risk_score = 21
rule_id = "d331bbe2-6db4-4941-80a5-8270db72eb61"
severity = "low"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Defense Evasion",
    "Resources: Investigation Guide",
    "Data Source: Elastic Endgame",
    "Data Source: Elastic Defend",
    "Data Source: Windows Security Event Logs",
    "Data Source: Microsoft Defender XDR",
    "Data Source: Sysmon",
    "Data Source: SentinelOne",
    "Data Source: Crowdstrike",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
process where host.os.type == "windows" and event.type == "start" and
(
  (
    (process.name : "wevtutil.exe" or ?process.pe.original_file_name == "wevtutil.exe") and
    process.args : ("/e:false", "cl", "clear-log")
  ) or
  (
    (
      process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe") or
      ?process.pe.original_file_name in ("PowerShell.EXE", "pwsh.dll", "powershell_ise.EXE")
    ) and
    process.args : "Clear-EventLog"
  )
)
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1070"
name = "Indicator Removal"
reference = "https://attack.mitre.org/techniques/T1070/"

[[rule.threat.technique.subtechnique]]
id = "T1070.001"
name = "Clear Windows Event Logs"
reference = "https://attack.mitre.org/techniques/T1070/001/"

[[rule.threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"

[[rule.threat.technique.subtechnique]]
id = "T1562.002"
name = "Disable Windows Event Logging"
reference = "https://attack.mitre.org/techniques/T1562/002/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[rule]
description = """
This rule detects DNS queries to crypto/DHT services via living-off-the-land executables or executables in
world/user-writable directories. Malware authors may use these services to communicate with command and control
infrastructure or to exfiltrate data from the target system.
"""
id = "fd00d51f-9a22-45e2-9247-69dd34187815"
license = "Elastic License v2"
name = "DNS Request to Crypto/DHT Services"
os_list = ["linux"]
reference = ["https://www.aikido.dev/blog/glassworm-chrome-extension-rat"]
version = "1.0.4"

query = '''
sequence by process.entity_id with maxspan=1m
  [process where event.type == "start" and event.action == "exec" and (
    process.name in (
      "curl", "wget", "bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "busybox",
      "timeout", "env", "node", "deno", "nodejs"
    ) or
    process.name like ".*" or
    process.executable like (
      "./*", "/tmp/*", "/var/tmp/*", "/dev/shm/*", "/run/*", "/var/run/*", "/boot/*", "/sys/*",
      "/lost+found/*", "/proc/*", "/var/mail/*", "/var/www/*", "/home/*/*", "/root/*",
      /* Enforce Python, Perl, PHP, Ruby, Lua, Node.js paths */
      "/bin/python*", "/usr/bin/python*", "/usr/local/bin/python*",
      "/bin/perl*", "/usr/bin/perl*", "/usr/local/bin/perl*",
      "/bin/php*", "/usr/bin/php*", "/usr/local/bin/php*",
      "/bin/ruby*", "/usr/bin/ruby*", "/usr/local/bin/ruby*",
      "/bin/lua*", "/usr/bin/lua*", "/usr/local/bin/lua*",
      "/bin/node", "/usr/bin/node", "/usr/local/bin/node"
    )
  ) and
  not (
    process.parent.command_line like "*home/*/.claude/shell-snapshots/*" or
    (process.executable like "/usr/bin/python3*" and process.args == "replenisher.py") or
    (process.parent.command_line == "s6-supervise svc-qbittorrent" and process.args == "svc-qbittorrent") or
    process.executable like ("/home/*/Games/WarThunder/launcher", "/home/*/.rbenv/versions/*/bin/ruby", "/home/*/.pyenv/versions/*/bin/python3*") or
    process.parent.executable like ("/usr/lib/systemd/systemd", "/home/*/.local/bin/rtk", "/usr/bin/gnome-shell", "/package/admin/s6-*/command/s6-supervise") or
    (process.name == "curl" and process.parent.args like "read -r RPC;*") or
    (process.executable like "/usr/bin/php*" and process.args in ("/var/tools/koalaping/bin/ping.php", "/var/tools/lean/bin/Lean.php")) or
    (process.executable like "/home/*/.local/share/uv/python/*/bin/python3*" and process.working_directory like "/home/*/shard_campaign_data_collection") or
    (process.executable == "/usr/bin/dash" and process.args == "/usr/bin/firefox")
  )]
  [dns where event.action == "lookup_result" and dns.question.name like~ (
    /* Solana */
    "api.mainnet-beta.solana.com", "solana-mainnet.gateway.tatum.io", "go.getblock.us", "solana-rpc.publicnode.com",
    "api.blockeden.xyz", "solana.drpc.org", "solana.leorpc.com", "solana.api.onfinality.io", "solana.api.pocket.network",

    /* Ethereum */
    "*ethereum.org", "*infura.io", "*alchemy.com", "*alchemyapi.io", "*ankr.com", "*quiknode.pro", "*tatum.io",
    "*thirdweb.com", "*tenderly.co", "*flashbots.net", "*mevblocker.io", "*drpc.org", "*blockpi.network",
    "*llamarpc.com", "*1rpc.io", "*0xrpc.io", "*nodies.app", "*blastapi.io", "*nownodes.io", "*pokt.network",
    "*merkle.io", "*blinklabs.xyz", "*leorpc.com", "*publicnode.com", "*cloudflare-eth.com", "*payload.de",
    "*etherscan.io", "*ethplorer.io", "*blockchair.com", "*pokt.io", "*getblock.io", "*chainstack.com",
    "*moralis.io", "*quicknode.com", "*quiknode.com", "*figment.io", "*nodesmith.io", "*blockdaemon.com",
    "*onfinality.io", "*ankr-rpc.com", "*hardhat.org", "*foundry.paradigm.xyz", "*paradigm.xyz",
    "*ethrpc.com", "*web3api.com", "*.icp0.io",

    /* BNB Smart Chain (UNC5342 (DPRK) reads JADESNOW payloads via Binplorer); */
    "*binplorer.com", "*bscscan.com", "*bnbchain.org",

    /* Polygon (DeadLock ransomware proxy address storage (Group-IB, Jan 2026) */
    "polygon-rpc.com", "*polygonscan.com",

    /* Bitcoin (Glupteba OP_RETURN dead-drop, Akamai cryptominer botnet C2 backup) */
    "*blockchain.info", "*blockchain.com", "*blockstream.info", "*mempool.space", "*blockcypher.com",

    /* Tron (heavy abuse for laundering, dusting attacks, emerging C2) */
    "*trongrid.io", "*tronscan.org",

    /* Crypto */
    "*binance.org", "*ninicoin.io", "*defibit.io",

    /* DHT lookup domains */
    "dht.libtorrent.org", "router.bittorrent.com", "router.utorrent.com"
  ) and
  not dns.question.name == "www.alchemy.com"]
'''

min_endpoint_version = "9.3.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"
[[threat.technique.subtechnique]]
id = "T1071.004"
name = "DNS"
reference = "https://attack.mitre.org/techniques/T1071/004/"


[[threat.technique]]
id = "T1102"
name = "Web Service"
reference = "https://attack.mitre.org/techniques/T1102/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "9.3.0"

[rule]
description = """
Identifies the execution of a file written or modified by Microsoft Equation Editor, which is frequently targeted by
attackers using weaponized Microsoft Office documents. These files are often written or modified during the exploitation
of Office applications via known vulnerabilities CVE-2017-1182 or CVE-2018-0798.
"""
id = "8bc4f22c-9bb1-4c76-a7b6-195bee3579db"
license = "Elastic License v2"
name = "Execution of File Written or Modified by Microsoft Equation Editor"
os_list = ["windows"]
reference = [
    "https://www.anomali.com/blog/multiple-chinese-threat-groups-exploiting-cve-2018-0798-equation-editor-vulnerability-since-late-2018",
    "https://nvd.nist.gov/vuln/detail/CVE-2017-11882",
    "https://nvd.nist.gov/vuln/detail/CVE-2018-0798",
]
version = "1.0.31"

query = '''
sequence with maxspan=5m
  [file where event.action != "deletion" and process.name : "eqnedt32.exe" and
   (file.extension : ("exe", "com") or file.Ext.header_bytes : "4d5a*")] by file.path
  [process where event.action == "start"] by process.executable
'''

min_endpoint_version = "7.15.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"
[[threat.technique.subtechnique]]
id = "T1566.001"
name = "Spearphishing Attachment"
reference = "https://attack.mitre.org/techniques/T1566/001/"



[threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1203"
name = "Exploitation for Client Execution"
reference = "https://attack.mitre.org/techniques/T1203/"


[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "7.15.0"

[rule]
description = """
Identifies the side load of an untrusted DLL by a persistent trusted binary and that was dropped by commonly abused
ingress tool transfer binaries. This behavior may indicate an attempt to sideloading a malicious DLL.
"""
id = "7543f65d-5a1a-4f88-a2d7-ddbc18672217"
license = "Elastic License v2"
name = "Ingress DLL Transfer followed by DLL SideLoading"
os_list = ["windows"]
version = "1.0.5"

query = '''
sequence with maxspan=1m
 [file where event.action != "deletion" and
   file.Ext.header_bytes : "4d5a*" and
   (
    process.name : ("MSHTA.EXE", "CertUtil.exe", "CertReq.exe", "PrintBrm.exe", "curl.exe") or
    process.executable : "?:\\Windows\\sys*\\OpenSSH\\sftp.exe"
   )] by file.name
 [library where
   (dll.Ext.relative_file_creation_time < 5000 or dll.Ext.relative_file_name_modify_time < 5000 ) and dll.name : "*.dll" and
   process.code_signature.status :"trusted" and not dll.code_signature.status : ("trusted", "errorExpired", "errorCode_endpoint*") and
   dll.hash.sha256 != null and

    /* DLL loaded from the process.executable current directory */
   endswith~(substring(dll.path, 0, length(dll.path) - (length(dll.name) + 1)), substring(process.executable, 0, length(process.executable) - (length(process.name) + 1))) and

   not process.executable :
             ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe", "?:\\Windows\\Explorer.exe", "?:\\Windows\\assembly\\*",
              "?:\\Windows\\SysWOW64\\*", "?:\\Windows\\System32\\*", "?:\\Windows\\splwow64.exe", "?:\\Windows\\Microsoft.NET\\*",
              "?:\\Windows\\Installer\\*")] by dll.name
'''

min_endpoint_version = "8.6.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1574"
name = "Hijack Execution Flow"
reference = "https://attack.mitre.org/techniques/T1574/"
[[threat.technique.subtechnique]]
id = "T1574.001"
name = "DLL"
reference = "https://attack.mitre.org/techniques/T1574/001/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1105"
name = "Ingress Tool Transfer"
reference = "https://attack.mitre.org/techniques/T1105/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "8.6.0"

[rule]
description = """
Identifies when a macOS installer package is executed followed by the execution of a utility that's commonly used by
attackers when downloading a payload, establishing persistence, profiling an endpoint, or decompressing/decoding a file
before execution. An attacker may configure an installer package to download an additional payload or malware for
execution to gain initial access or establish persistence on an endpoint.
"""
id = "d40ffcba-b83e-4d0a-8d6d-84385def8e18"
license = "Elastic License v2"
name = "Initial Access via macOS Installer Package"
os_list = ["macos"]
reference = ["https://redcanary.com/blog/clipping-silver-sparrows-wings/", "https://youtu.be/Eow5uNHtmIg"]
version = "1.0.48"

query = '''
sequence with maxspan=1m
  [process where event.action == "exec" and process.name in ("installer", "package_script_service") and not
    process.args like~
                   ("/Library/Application Support/JAMF/Downloads/*",
                    "/tmp/KSInstallAction.*",
                    "/tmp/FLEXnet", 
                    "./Epson Scanner Monitor.pkg",
                    "./Epson Event Manager.pkg",
                    "./Epson Scanner ICA Driver.pkg",
                    "/tmp/PKInstallSandbox.*/Scripts/com.epson.pkg.eventmanager.*/Epson Scanner Monitor.pkg",
                    "/Library/Addigy/ansible/packages/TeamViewer Host */TeamViewer_Host.pkg") and not
    process.parent.executable like~ ("/usr/local/ltechagent/ltupdate",
                                     "/sbin/launchd", 
                                     "/Users/*/Library/Caches/*",
                                     "/Library/PrivilegedHelperTools/*",
                                     "/Applications/Epson Software/EPSON Software Updater.app/Contents/MacOS/EPSON Software Updater",
                                     "/private/var/folders/*/download/ARMDCHammer") and not
    process.Ext.effective_parent.executable in ("/usr/local/jamf/bin/jamf",
                                                "/Library/Intune/Microsoft Intune Agent.app/Contents/MacOS/IntuneMdmDaemon",
                                                "/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfDaemon.app/Contents/MacOS/JamfDaemon",
                                                "/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfManagementService.app/Contents/MacOS/JamfManagementService",
                                                "/Volumes/Fiery Software Manager/Fiery Software Manager.app/Contents/MacOS/Fiery Software Manager")]
  [process where event.action in ("exec", "fork") and

    // Descendant of macOS installer process
    descendant of [
        process where event.action == "exec" and
        process.name in ("Installer", "package_script_service") and not
        process.args like~
                       ("/Library/Application Support/JAMF/Downloads/*",
                        "/tmp/KSInstallAction.*",
                        "/tmp/PKInstallSandbox.*/Scripts/com.epson.pkg.eventmanager.*/Epson Scanner Monitor.pkg",
                        "./Epson Scanner Monitor.pkg",
                        "/tmp/FLEXnet",
                        "/Library/Preferences/com.epson.Epson Scan OCR Component Pro.XmlType.UnInstallList.plist",
                        "./Epson Event Manager.pkg",
                        "./Epson Scanner ICA Driver.pkg",
                        "/Library/Addigy/ansible/packages/TeamViewer Host */TeamViewer_Host.pkg") and not
        process.parent.executable like~
                                    ("/usr/local/ltechagent/ltupdate",
                                     "/sbin/launchd", 
                                     "/Users/*/Library/Caches/*",
                                     "/Applications/Epson Software/EPSON Software Updater.app/Contents/MacOS/EPSON Software Updater",
                                     "/Library/PrivilegedHelperTools/*",
                                     "/private/var/folders/*/download/ARMDCHammer") and not
        process.Ext.effective_parent.executable in ("/usr/local/jamf/bin/jamf",
                                                    "/Library/Intune/Microsoft Intune Agent.app/Contents/MacOS/IntuneMdmDaemon",
                                                    "/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfDaemon.app/Contents/MacOS/JamfDaemon", 
                                                    "/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfManagementService.app/Contents/MacOS/JamfManagementService",
                                                    "/Volumes/Mac_User_SW/Fiery Master Installer.app/Contents/MacOS/Fiery Master Installer",
                                                    "/Volumes/Fiery Software Manager/Fiery Software Manager.app/Contents/MacOS/Fiery Software Manager")
        ] and

    (
      // curl scope limited to silver-sparrows to reduce noise
      (process.name in ("curl", "nscurl") and process.command_line : ("*.amazonaws.com*",
                                                         "*.cloudfront.net*", 
                                                         "*raw.githubusercontent.com*")) or
      // No hang up executed with a bash command
      (process.name == "nohup" and process.command_line : "* &") or
      // Open SSL used to encrypt or encode/decode data
      (process.name == "openssl" and process.args : ("-base64", "-enc")) or
      // Base64 used to decode data
      (process.name == "base64" and process.args : "-d") or
      // chmod used to make files readable, writable and executable by all users
      (process.name == "chmod" and process.args : ("+x", "a+x", "0777", "755", "777") and process.args : "/tmp/*" and
	   not process.args : ("/tmp/com.adobe.acrobat.DC", "/tmp/FLEXnet")) or
      // xattr used to change extended attributes for a file
      (process.name == "xattr" and ((process.args : "com.apple.quarantine" and 
        process.args : ("-d", "-w", "-?d", "-?w")) or
        (process.args == "-c")) and process.args : "/tmp/*") or
      (process.name == "touch" and process.args : "/tmp/*") or
      (process.name in ("bash", "sh", "zsh") and process.args == "-c" and process.args : ("*/bin/curl*.amazonaws.com*",
                                                                                        "*/bin/curl*.cloudfront.net*",
                                                                                        "*/bin/curl*raw.githubusercontent.com*",
                                                                                        "*/bin/osascript*",
                                                                                        "*/bin/wget*", 
                                                                                        "*/bin/chmod +x*", 
                                                                                        "*/bin/plutil*-convert*", 
                                                                                        "*/bin/openssl*-enc*",
                                                                                        "*/bin/openssl*-base64*",  
                                                                                        "*/bin/base64*-d*", 
                                                                                        "*/bin/xattr*com.apple.quarantine*",
                                                                                        "*/bin/touch /tmp/*"))
    ) and
    not process.parent.executable : ("/sbin/launchd", 
                                     "/Users/*/Library/Caches/*",
                                     "/Library/PrivilegedHelperTools/*",
                                     "/private/var/folders/*/download/ARMDCHammer") and not
    process.Ext.effective_parent.executable in ("/Applications/Epson Software/EPSON Software Updater.app/Contents/MacOS/EPSON Software Updater",
                                               "/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfDaemon.app/Contents/MacOS/JamfDaemon",
                                               "/Volumes/Mac_User_SW/Fiery Master Installer.app/Contents/MacOS/Fiery Master Installer",
                                               "/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfManagementService.app/Contents/MacOS/JamfManagementService",
                                               "/Volumes/Fiery Software Manager/Fiery Software Manager.app/Contents/MacOS/Fiery Software Manager",
                                               "/usr/local/jamf/bin/jamf")]
'''

min_endpoint_version = "8.7.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"
[[threat.technique.subtechnique]]
id = "T1566.001"
name = "Spearphishing Attachment"
reference = "https://attack.mitre.org/techniques/T1566/001/"



[threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"


[[threat.technique]]
id = "T1204"
name = "User Execution"
reference = "https://attack.mitre.org/techniques/T1204/"
[[threat.technique.subtechnique]]
id = "T1204.002"
name = "Malicious File"
reference = "https://attack.mitre.org/techniques/T1204/002/"


[[threat.technique]]
id = "T1569"
name = "System Services"
reference = "https://attack.mitre.org/techniques/T1569/"
[[threat.technique.subtechnique]]
id = "T1569.001"
name = "Launchctl"
reference = "https://attack.mitre.org/techniques/T1569/001/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1543"
name = "Create or Modify System Process"
reference = "https://attack.mitre.org/techniques/T1543/"
[[threat.technique.subtechnique]]
id = "T1543.001"
name = "Launch Agent"
reference = "https://attack.mitre.org/techniques/T1543/001/"


[[threat.technique]]
id = "T1547"
name = "Boot or Logon Autostart Execution"
reference = "https://attack.mitre.org/techniques/T1547/"


[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1647"
name = "Plist File Modification"
reference = "https://attack.mitre.org/techniques/T1647/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1082"
name = "System Information Discovery"
reference = "https://attack.mitre.org/techniques/T1082/"


[threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1105"
name = "Ingress Tool Transfer"
reference = "https://attack.mitre.org/techniques/T1105/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "8.7.0"

[rule]
description = """
This rule detects the creation of a Javascript reverse shell through Node.js. Attackers may spawn reverse shells to
establish persistence onto a target system. By using Node.js, attackers may attempt to evade detection and leverage the
platform's capabilities for various malicious purposes, such as downloading and executing payloads, establishing
persistence, or exfiltrating data.
"""
id = "88c1728e-2d2e-48ff-9c77-a084efdd4498"
license = "Elastic License v2"
name = "Javascript Reverse Shell via Node.js"
os_list = ["linux"]
version = "1.0.5"

query = '''
sequence by process.entity_id with maxspan=10s
  [process where event.type == "start" and event.action == "exec" and process.name == "node" and 
   process.args == "node" and process.args_count == 2 and process.args : (
     "/tmp/*.js", "/var/tmp/*.js", "/dev/shm/*.js", "/tmp/*.mjs", "/var/tmp/*.mjs", "/dev/shm/*.mjs"
   )]
  [network where event.type == "start" and event.action == "connection_attempted" and not (
    destination.port == 53 or
    cidrmatch(
     destination.ip, "240.0.0.0/4", "233.252.0.0/24", "224.0.0.0/4", "198.19.0.0/16", "192.18.0.0/15", 
      "192.0.0.0/24", "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.2.0/24",
      "192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24",  "100.64.0.0/10",
      "192.175.48.0/24", "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "::1", "FE80::/10",
      "FF00::/8"
    )
   )
  ]
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "7.15.0"

[metadata]
creation_date = "2022/02/16"
integration = ["system", "windows"]
maturity = "production"
updated_date = "2026/05/12"

[transform]
[[transform.osquery]]
label = "Osquery - Retrieve DNS Cache"
query = "SELECT * FROM dns_cache"

[[transform.osquery]]
label = "Osquery - Retrieve All Services"
query = "SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"

[[transform.osquery]]
label = "Osquery - Retrieve Services Running on User Accounts"
query = """
SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE
NOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR
user_account == null)
"""

[[transform.osquery]]
label = "Osquery - Retrieve Service Unsigned Executables with Virustotal Link"
query = """
SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,
services.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =
authenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'
"""


[rule]
author = ["Elastic"]
description = """
Identifies handle requests for the Local Security Authority Subsystem Service (LSASS) object access with specific access
masks that many tools with a capability to dump memory to disk use (0x1fffff, 0x1010, 0x120089). This rule is tool
agnostic as it has been validated against a host of various LSASS dump tools such as SharpDump, Procdump, Mimikatz,
Comsvcs etc. It detects this behavior at a low level and does not depend on a specific tool or dump file name.
"""
from = "now-9m"
index = ["logs-system.security*", "logs-windows.forwarded*", "winlogbeat-*"]
language = "kuery"
license = "Elastic License v2"
name = "LSASS Memory Dump Handle Access"
note = """## Triage and analysis

### Investigating LSASS Memory Dump Handle Access

Local Security Authority Server Service (LSASS) is a process in Microsoft Windows operating systems that is responsible for enforcing security policy on the system. It verifies users logging on to a Windows computer or server, handles password changes, and creates access tokens.

Adversaries may attempt to access credential material stored in LSASS process memory. After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory. This is meant to facilitate single sign-on (SSO) ensuring a user isn’t prompted each time resource access is requested. These credential materials can be harvested by an adversary using administrative user or SYSTEM privileges to conduct lateral movement using [alternate authentication material](https://attack.mitre.org/techniques/T1550/).

> **Note**:
> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/current/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.

#### Possible investigation steps

- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
- Investigate other alerts associated with the user/host during the past 48 hours.
- Examine the host for derived artifacts that indicate suspicious activities:
  - Analyze the process executable using a private sandboxed analysis system.
  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
    - Attempts to contact external domains and addresses.
      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
      - Examine the DNS cache for suspicious or anomalous entries.
        - $osquery_0
    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
    - Examine the host services for suspicious or anomalous entries.
      - $osquery_1
      - $osquery_2
      - $osquery_3
  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.


### False positive analysis

- There should be very few or no false positives for this rule. If this activity is expected or noisy in your environment, consider adding exceptions — preferably with a combination of user and command line conditions.
- If the process is related to antivirus or endpoint detection and response solutions, validate that it is installed on the correct path and signed with the company's valid digital signature.

### Response and remediation

- Initiate the incident response process based on the outcome of the triage.
- Isolate the involved host to prevent further post-compromise behavior.
- Scope compromised credentials and disable the accounts.
- If the triage identified malware, search the environment for additional compromised hosts.
  - Implement temporary network rules, procedures, and segmentation to contain the malware.
  - Stop suspicious processes.
  - Immediately block the identified indicators of compromise (IoCs).
  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
- Remove and block malicious artifacts identified during triage.
- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
"""
references = [
    "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4656",
    "https://twitter.com/jsecurity101/status/1227987828534956033?s=20",
    "https://attack.mitre.org/techniques/T1003/001/",
    "https://threathunterplaybook.com/notebooks/windows/06_credential_access/WIN-170105221010.html",
    "http://findingbad.blogspot.com/2017/",
    "https://www.elastic.co/security-labs/detect-credential-access",
]
risk_score = 47
rule_id = "208dbe77-01ed-4954-8d44-1e5751cb20de"
setup = """## Setup

Audit Handle Manipulation must be enabled to generate the events used by this rule.
Setup instructions: https://ela.st/audit-handle-manipulation
"""
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Credential Access",
    "Resources: Investigation Guide",
    "Data Source: Windows Security Event Logs",
]
timestamp_override = "event.ingested"
type = "new_terms"

query = '''
host.os.type:"windows" and event.code:"4656" and
  (
    winlog.event_data.AccessMask : ("0x1fffff" or "0x1010" or "0x120089" or "0x1F3FFF") or
    winlog.event_data.AccessMaskDescription : ("READ_CONTROL" or "Read from process memory")
  ) and
  winlog.event_data.ObjectType : "Process" and 
  winlog.event_data.ObjectName : *\\Windows\\System32\\lsass.exe and
  not winlog.event_data.ProcessName : (
      "C:\Windows\System32\wbem\WmiPrvSE.exe" or
      "C:\Windows\SysWOW64\wbem\WmiPrvSE.exe" or
      "C:\Windows\System32\dllhost.exe" or
      "C:\Windows\System32\svchost.exe" or
      "C:\Windows\System32\msiexec.exe" or
      "C:\Windows\explorer.exe" or 
      "C:\\Windows\\Sysmon64.exe" or 
      "C:\\Windows\\BTPass\\x64\\BTPassSvc.exe" or 
      "C:\\Windows\\Sysmon.exe" or 
      "C:\\Windows\\System32\\RtkAudUService64.exe" or 
      "C:\\Windows\\System32\\RtkAudUService64.exe" or 
       C\:\\Windows\\System32\\DriverStore\\FileRepository\\fn.inf_amd64_*\\driver\\tphkload.exe
  )
'''

[[rule.filters]]
[rule.filters.meta]
negate = true
[rule.filters.query.wildcard."winlog.event_data.ProcessName"]
case_insensitive = true
value = "C:\\\\Program Files (x86)\\\\*.exe"

[[rule.filters]]
[rule.filters.meta]
negate = true
[rule.filters.query.wildcard."winlog.event_data.ProcessName"]
case_insensitive = true
value = "C:\\\\Program Files\\\\*.exe"

[[rule.filters]]
[rule.filters.meta]
negate = true
[rule.filters.query.wildcard."winlog.event_data.ProcessName"]
case_insensitive = true
value = "?:\\\\ProgramData\\\\Microsoft\\\\Windows Defender\\\\*.exe"

[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1003"
name = "OS Credential Dumping"
reference = "https://attack.mitre.org/techniques/T1003/"
[[rule.threat.technique.subtechnique]]
id = "T1003.001"
name = "LSASS Memory"
reference = "https://attack.mitre.org/techniques/T1003/001/"



[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"


[rule.new_terms]
field = "new_terms_fields"
value = ["winlog.event_data.ProcessName", "winlog.event_data.SubjectUserName"]
[[rule.new_terms.history_window_start]]
field = "history_window_start"
value = "now-1d"

[metadata]
bypass_bbr_timing = true
creation_date = "2026/02/20"
integration = ["o365"]
maturity = "production"
updated_date = "2026/02/20"

[rule]
author = ["Elastic"]
building_block_type = "default"
description = """
Identifies Microsoft 365 Automated Investigation and Response (AIR) events including automated investigations,
manual investigations, and admin-initiated actions. These events track Microsoft's automated threat response
activities and can indicate active threats being remediated. This building block rule generates security events
for correlation, threat hunting, and telemetry collection to provide visibility into automated response actions.
"""
from = "now-9m"
index = ["logs-o365.audit-*", "filebeat-*"]
language = "kuery"
license = "Elastic License v2"
name = "M365 AIR Investigation Signal"
references = [
    "https://learn.microsoft.com/en-us/defender-office-365/air-about",
    "https://learn.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema#enum-auditlogrecordtype---type-edmint32",
]
risk_score = 21
rule_id = "7ab5b02c-0026-4c71-b523-dd1e97e15477"
setup = """### Additional notes

For information on troubleshooting the maximum alerts warning please refer to this [guide](https://www.elastic.co/guide/en/security/current/alerts-ui-monitor.html#troubleshoot-max-alerts).
"""
severity = "low"
tags = [
    "Domain: Cloud",
    "Domain: SaaS",
    "Data Source: Microsoft 365",
    "Data Source: Microsoft 365 Audit Logs",
    "Data Source: Microsoft Defender for Office 365",
    "Use Case: Threat Detection",
    "Use Case: Automated Response Tracking",
    "Tactic: Initial Access",
    "Tactic: Execution",
    "Rule Type: BBR",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
event.dataset:o365.audit and
    event.code:(AirInvestigation or AirManualInvestigation or AirAdminActionInvestigation)
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"


[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1204"
name = "User Execution"
reference = "https://attack.mitre.org/techniques/T1204/"


[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[rule]
description = """
Detects the use of the cp or mv binaries to add a kext file in the System extensions directory and then immediately load
it via the kextload utility. Threat actors have created malicious kernel extensions and attempted to load them on
compromised systems in order to bypass defences and manipulate their presence on the machine.
"""
id = "de869aa1-c63a-451e-a953-7069ec39ba60"
license = "Elastic License v2"
name = "New System Kext File and Immediate Load via KextLoad"
os_list = ["macos"]
version = "1.0.19"

query = '''
sequence by process.parent.pid with maxspan=20s
[process where event.type == "start" and event.action == "exec" and 
    process.name in ("mv", "cp") and
    process.args like "/System/Library/Extensions/*.kext"]
[process where event.type == "start" and event.action == "exec" and 
    process.name == "kextload"]
'''

min_endpoint_version = "8.10.2"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1547"
name = "Boot or Logon Autostart Execution"
reference = "https://attack.mitre.org/techniques/T1547/"
[[threat.technique.subtechnique]]
id = "T1547.006"
name = "Kernel Modules and Extensions"
reference = "https://attack.mitre.org/techniques/T1547/006/"



[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[internal]
min_endpoint_version = "8.10.2"

[rule]
description = """
Identifies attempts to map the whole content of a file in a memory region with RWX permissions. This may indicate an
attempt to perform module hollowing.
"""
id = "5cb45f1b-9061-4bdd-8e45-3cbef2dbf465"
license = "Elastic License v2"
name = "Potential Image Hollowing via Mapping"
os_list = ["windows"]
reference = [
    "https://learn.microsoft.com/en-us/windows/win32/api/memoryapi/nf-memoryapi-mapviewoffile2",
    "https://www.elastic.co/security-labs/dissecting-remcos-rat-part-four",
    "https://www.elastic.co/security-labs/doubling-down-etw-callstacks",
]
version = "1.0.3"

query = '''
api where process.Ext.api.name in ("MapViewOfFile", "MapViewOfFile2") and
 /* map the whole file to an executable memory region */
 process.Ext.api.parameters.size == 0 and process.Ext.api.parameters.protection == "RWX" and
 process.Ext.api.metadata.target_address_path like ("c:\\*.dll", "c:\\*.exe") and
 _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.trusted == false or $entry.exists == false) and
 not process.thread.Ext.call_stack_final_user_module.name in ("Kernel", "Unknown")
'''

min_endpoint_version = "8.10.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"