Elastic rules: 22

[metadata]
creation_date = "2026/05/20"
integration = ["azure", "endpoint"]
maturity = "production"
updated_date = "2026/05/20"

[rule]
author = ["Elastic"]
description = """
Correlates successful Azure Virtual Machine Run Command operations with endpoint process execution on the same host
within minutes. Adversaries abuse Run Command to run scripts remotely as SYSTEM or root while activity logs only record the
control-plane action; Elastic Defend process telemetry reveals the on-guest payload.
"""
false_positives = [
    """
    Legitimate automation that deploys configuration via Azure Run Command and launches PowerShell with unrestricted
    policy and numbered script files (for example `script1.ps1`) may match. Baseline known deployment pipelines, VM
    names, and principal IDs before tuning.
    """,
]
from = "now-9m"
language = "esql"
license = "Elastic License v2"
name = "Azure Run Command Correlated with Process Execution"
note = """## Triage and analysis

### Investigating Azure Run Command Correlated with Process Execution

This ES|QL rule correlates Azure Activity Log `MICROSOFT.COMPUTE/VIRTUALMACHINES/RUNCOMMAND/ACTION` events with
endpoint process starts, joined on host name within a two-minute bucket and a 0–120 second delay between Run Command and process start.

Pivot into raw `logs-azure.activitylogs-*` and `logs-endpoint.events.process-*` events for full command lines and
resource identifiers.

### Possible investigation steps

- Review `user.email` and `azure.activitylogs.identity.authorization.evidence.principal_id` for who invoked Run Command.
- Inspect `Esql.process_command_line_values` for script paths and arguments beyond the matched pattern.
- Confirm `Esql.host_name` maps to the intended VM and whether Run Command timing aligns with change windows.
- Hunt for additional Run Command or PowerShell activity from the same principal or subscription.

### Response and remediation

- If unauthorized, isolate the VM, revoke credentials used for Run Command, and review role assignments on the VM and
  subscription.
- Collect endpoint artifacts and Azure activity logs for incident reporting.
"""
references = [
    "https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#virtual-machine-contributor",
    "https://posts.specterops.io/attacking-azure-azure-ad-and-introducing-powerzure-ca70b330511a",
    "https://adsecurity.org/?p=4277",
]
risk_score = 47
rule_id = "ebbc1959-3309-4abf-b6cb-2bee3dbc9a7b"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Domain: Endpoint",
    "OS: Windows",
    "OS: Linux",
    "Use Case: Threat Detection",
    "Tactic: Execution",
    "Data Source: Azure",
    "Data Source: Microsoft Azure",
    "Data Source: Azure Activity Logs",
    "Data Source: Elastic Defend",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "esql"

query = '''
FROM logs-azure.activitylogs-*, logs-endpoint.events.process-* METADATA _id, _version, _index
| WHERE 
  (
    event.category == "process" AND KQL("event.action:start")
    AND process.parent.name == "powershell.exe"
    AND process.parent.command_line LIKE "powershell  -ExecutionPolicy Unrestricted -File script?.ps1"
    AND process.name != "conhost.exe"
  ) OR
  (
    KQL("event.category:process and event.action:exec and process.parent.name:(dash or bash or sh) and process.parent.args:/var/lib/waagent/run-command/download/*/script.sh")
   ) OR 
  (
    event.module == "azure"
    AND event.action == "MICROSOFT.COMPUTE/VIRTUALMACHINES/RUNCOMMAND/ACTION"
    AND NOT KQL("event.outcome:failure")
   )

// Azure hostname comes as upper-case while Endpoint event comes as lowercase
| EVAL Esql.host_name = COALESCE(
    TO_LOWER(host.name),
    TO_LOWER(azure.resource.name)
  )
| EVAL ts_runcommand = CASE(event.module == "azure", @timestamp, null)
| EVAL ts_endpoint = CASE(event.category == "process", @timestamp, null)
| EVAL is_runcommand = CASE(event.module == "azure", 1, null)
| EVAL is_endpoint = CASE(event.category == "process", 1, null)
| EVAL Esql.time_bucket = DATE_TRUNC(2 minutes, @timestamp)
| STATS
    runcommand_count = COUNT(is_runcommand),
    endpoint_count = COUNT(is_endpoint),
    user.email = VALUES(user.email),
    azure.activitylogs.identity.authorization.evidence.principal_id = VALUES(azure.activitylogs.identity.authorization.evidence.principal_id),
    azure.activitylogs.tenant_id = VALUES(azure.activitylogs.tenant_id),
    azure.subscription_id = VALUES(azure.subscription_id),
    source.ip = VALUES(source.ip),
    source.geo.country_name = VALUES(source.geo.country_name),
    source.as.number = VALUES(source.as.number),
    Esql.process_command_line_values = VALUES(process.command_line),
    first_runcommand = MIN(ts_runcommand),
    first_ps_exec = MIN(ts_endpoint),
    outcome = VALUES(event.outcome)
  BY Esql.host_name, Esql.time_bucket
| WHERE runcommand_count >= 1 AND endpoint_count >= 1
| EVAL delta_ms = TO_LONG(first_ps_exec) - TO_LONG(first_runcommand)
| EVAL delta_sec = delta_ms / 1000
| WHERE delta_sec >= 0 AND delta_sec <= 120
| KEEP
    user.email,
    azure.activitylogs.identity.authorization.evidence.principal_id,
    source.ip,
    source.as.number,
    source.geo.country_name,
    azure.activitylogs.tenant_id,
    azure.subscription_id,
    Esql.*
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"

[[rule.threat.technique.subtechnique]]
id = "T1059.001"
name = "PowerShell"
reference = "https://attack.mitre.org/techniques/T1059/001/"

[[rule.threat.technique]]
id = "T1651"
name = "Cloud Administration Command"
reference = "https://attack.mitre.org/techniques/T1651/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[metadata]
creation_date = "2026/06/07"
integration = ["azure"]
maturity = "production"
updated_date = "2026/06/07"

[rule]
author = ["Elastic"]
description = """
Identifies a connection to the Azure Serial Console of a virtual machine (VM) by an identity and source network
combination that has not been observed recently. The Serial Console provides text-based console access to a VM through
the boot diagnostics serial port, independent of the VM's network state. Because it does not traverse the VM's network
interface, a Serial Console session bypasses Network Security Groups (NSGs), Just-in-Time (JIT) access policies, and
other network controls. An adversary with a privileged Azure RBAC role (for example Virtual Machine Contributor) and
boot diagnostics enabled on the target can use the Serial Console to obtain an interactive session as SYSTEM (Windows)
or root (Linux).
"""
false_positives = [
    """
    System or platform administrators may legitimately use the Serial Console to troubleshoot a VM that is unreachable
    over the network (boot failures, misconfigured firewall/NSG, lost SSH/RDP access). The first connection per
    identity and source ASN will alert; baseline expected break-glass principals and their corporate/VPN networks and
    exclude them if verified as authorized.
    """,
]
from = "now-9m"
index = ["logs-azure.activitylogs-*"]
language = "kuery"
license = "Elastic License v2"
name = "Azure VM Serial Console Connection with Unusual User and ASN"
note = """## Triage and analysis

### Investigating Azure VM Serial Console Connection with Unusual User and ASN

The Azure Serial Console gives text-based console access to a VM over the boot diagnostics serial port. It works even
when the VM has no inbound network connectivity, so a session bypasses NSGs, JIT, and other network controls. This rule
flags successful `MICROSOFT.SERIALCONSOLE/SERIALPORTS/CONNECT/ACTION` operations where the combination of acting
principal and source ASN has not been seen in the history window.

This rule uses a new terms approach keyed on the acting principal and source ASN, so it surfaces a
known identity connecting from an unusual network as well as any new identity using the Serial Console.

### Triage checklist

- Identify the caller via `azure.activitylogs.identity.authorization.evidence.principal_id` and
  `azure.activitylogs.identity.authorization.evidence.principal_type` (User vs ServicePrincipal). Service principal
  Serial Console access is unusual and warrants scrutiny.
- Review `source.as.organization.name`, `source.as.number`, and `source.geo.country_name` - is the network a known
  corporate/VPN ASN or an unexpected hosting/residential provider?
- Was the connect preceded by reconnaissance, role assignment changes, or Run Command / extension activity on the same VM?
- Were there preceding failed Serial Console connect attempts (`event.outcome:failure`) suggesting access probing?
- Does the target VM normally require Serial Console access, or is it a production system that should be reachable over
  the network?

### Possible investigation steps

- Review `azure.resource.id` to identify the VM and confirm boot diagnostics is enabled.
- Correlate with Entra ID sign-in logs for the caller and review MFA / conditional access posture.
- Pivot on the VM for endpoint telemetry around the connect timestamp (interactive shell, new local accounts, credential
  access) since Serial Console sessions execute as SYSTEM/root.
- Review the principal's RBAC role assignments on the subscription, resource group, and VM.

### Response and remediation

- If unauthorized, terminate the session, rotate credentials reachable from the VM, and review RBAC on the affected scope.
- Consider disabling the subscription-level Serial Console where it is not operationally required.
- Isolate the VM and collect endpoint and activity log artifacts per incident procedures.
"""
references = [
    "https://learn.microsoft.com/en-us/troubleshoot/azure/virtual-machines/serial-console-overview",
    "https://blog.pwnedlabs.io/diving-deep-into-azure-vm-attack-vectors",
    "https://www.netspi.com/blog/technical-blog/adversary-simulation/7-ways-to-execute-command-on-azure-virtual-machine-virtual-machine-scale-sets/",
]
risk_score = 47
rule_id = "97266eb4-b8c3-4e3e-9417-7d0ace6b3dfe"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Data Source: Azure",
    "Data Source: Azure Activity Logs",
    "Use Case: Threat Detection",
    "Tactic: Lateral Movement",
    "Tactic: Defense Evasion",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "new_terms"
query = '''
data_stream.dataset:azure.activitylogs and
  azure.activitylogs.operation_name:"MICROSOFT.SERIALCONSOLE/SERIALPORTS/CONNECT/ACTION" and
  event.outcome:("success" or "Success") and
  azure.activitylogs.identity.authorization.evidence.principal_id:* and
  source.as.number:*
'''

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "event.outcome",
    "azure.activitylogs.operation_name",
    "azure.activitylogs.identity.authorization.evidence.principal_id",
    "azure.activitylogs.identity.authorization.evidence.principal_type",
    "azure.activitylogs.identity.claims_initiated_by_user.name",
    "azure.resource.id",
    "azure.resource.name",
    "source.ip",
    "source.as.number",
    "source.as.organization.name",
    "source.geo.country_name",
    "azure.subscription_id",
    "azure.activitylogs.tenant_id",
]

[rule.new_terms]
field = "new_terms_fields"
value = [
    "azure.activitylogs.identity.authorization.evidence.principal_id",
    "source.as.number",
]

[[rule.new_terms.history_window_start]]
field = "history_window_start"
value = "now-7d"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1021"
name = "Remote Services"
reference = "https://attack.mitre.org/techniques/T1021/"

[[rule.threat.technique.subtechnique]]
id = "T1021.008"
name = "Direct Cloud VM Connections"
reference = "https://attack.mitre.org/techniques/T1021/008/"

[rule.threat.tactic]
id = "TA0008"
name = "Lateral Movement"
reference = "https://attack.mitre.org/tactics/TA0008/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"

[[rule.threat.technique.subtechnique]]
id = "T1078.004"
name = "Cloud Accounts"
reference = "https://attack.mitre.org/techniques/T1078/004/"

[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"

[rule]
description = """
Identifies the execution of a binary via the Windows RunExeHelper utility. Adversaries may bypass process and
signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries.
"""
id = "8b1ae402-a41b-485f-8eb6-00ae6144cf8a"
license = "Elastic License v2"
name = "Binary Proxy Execution via Runexehelper"
os_list = ["windows"]
reference = ["https://lolbas-project.github.io/lolbas/Binaries/Runexehelper/"]
version = "1.0.7"

query = '''
process where event.action == "start" and process.parent.name : "runexehelper.exe" and 
 not process.executable :
              ("?:\\Windows\\System32\\conhost.exe",
               "?:\\Windows\\System32\\powercfg.exe",
               "?:\\WINDOWS\\system32\\wevtutil.exe",
               "?:\\Windows\\System32\\WSCollect.exe",
               "?:\\Windows\\System32\\TpmTool.exe",
               "?:\\Windows\\System32\\MdmDiagnosticsTool.exe",
               "?:\\Windows\\System32\\dsregcmd.exe",
               "?:\\Windows\\System32\\stordiag.exe",
               "?:\\Windows\\System32\\dxdiag.exe",
               "?:\\Windows\\System32\\logman.exe",
               "?:\\Windows\\System32\\licensingdiag.exe",
               "?:\\Windows\\System32\\dispdiag.exe",
               "?:\\Windows\\System32\\pnputil.exe",
               "?:\\Windows\\System32\\hcsdiag.exe",
               "?:\\Windows\\System32\\ddodiag.exe")
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.15.0"

[metadata]
creation_date = "2020/02/18"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2026/05/04"

[rule]
author = ["Elastic"]
description = """
Identifies use of the fsutil.exe to delete the volume USNJRNL. This technique is used by attackers to eliminate evidence
of files created during post-exploitation activities.
"""
from = "now-9m"
index = [
    "endgame-*",
    "logs-crowdstrike.fdr*",
    "logs-endpoint.events.process-*",
    "logs-m365_defender.event-*",
    "logs-sentinel_one_cloud_funnel.*",
    "logs-system.security*",
    "logs-windows.forwarded*",
    "logs-windows.sysmon_operational-*",
    "winlogbeat-*",
]
language = "eql"
license = "Elastic License v2"
name = "Delete Volume USN Journal with Fsutil"
note = """## Triage and analysis

### Investigating Delete Volume USN Journal with Fsutil

The Update Sequence Number (USN) Journal is a feature in the NTFS file system used by Microsoft Windows operating systems to keep track of changes made to files and directories on a disk volume. The journal records metadata for changes such as file creation, deletion, modification, and permission changes. It is used by the operating system for various purposes, including backup and recovery, file indexing, and file replication.

This artifact can provide valuable information in forensic analysis, such as programs executed (prefetch file operations), file modification events in suspicious directories, deleted files, etc. Attackers may delete this artifact in an attempt to cover their tracks, and this rule identifies the usage of the `fsutil.exe` utility to accomplish it.

Consider using the Elastic Defend integration instead of USN Journal, as the Elastic Defend integration provides more visibility and context in the file operations it records.

#### Possible investigation steps

- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
- Identify the user account that performed the action and whether it should perform this kind of action.
- Contact the account owner and confirm whether they are aware of this activity.
- Investigate other alerts associated with the user/host during the past 48 hours.
  - Verify if any other anti-forensics behaviors were observed.
- Review file operation logs from Elastic Defend for suspicious activity the attacker tried to hide.

### False positive analysis

- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.

### Response and remediation

- Initiate the incident response process based on the outcome of the triage.
- Isolate the involved host to prevent further post-compromise behavior.
- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
"""

setup = """## Setup

This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.

Setup instructions: https://ela.st/install-elastic-defend

### Additional data sources

This rule also supports the following third-party data sources. For setup instructions, refer to the links below:

- [CrowdStrike](https://ela.st/crowdstrike-integration)
- [Microsoft Defender XDR](https://ela.st/m365-defender)
- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
- [Sysmon Event ID 1 - Process Creation](https://ela.st/sysmon-event-1-setup)
- [Windows Process Creation Logs](https://ela.st/audit-process-creation)
"""

risk_score = 21
rule_id = "f675872f-6d85-40a3-b502-c0d2ef101e92"
severity = "low"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Defense Evasion",
    "Data Source: Elastic Endgame",
    "Resources: Investigation Guide",
    "Data Source: Elastic Defend",
    "Data Source: Windows Security Event Logs",
    "Data Source: Microsoft Defender XDR",
    "Data Source: Sysmon",
    "Data Source: SentinelOne",
    "Data Source: Crowdstrike",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
process where host.os.type == "windows" and event.type == "start" and
  (process.name : "fsutil.exe" or ?process.pe.original_file_name == "fsutil.exe") and
  process.args : "deletejournal" and process.args : "usn"
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1070"
name = "Indicator Removal"
reference = "https://attack.mitre.org/techniques/T1070/"
[[rule.threat.technique.subtechnique]]
id = "T1070.004"
name = "File Deletion"
reference = "https://attack.mitre.org/techniques/T1070/004/"



[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[rule]
description = """
Identifies attempts to proxy execution using Microsoft Program Compatibility Assistant binary. Adversaries may use
pcalua.exe to evade suspicious parent child process relationships.
"""
id = "812a9a02-aac3-43b9-873a-70c2882fe19b"
license = "Elastic License v2"
name = "Execution via Program Compatibility Assistant"
os_list = ["windows"]
reference = ["https://lolbas-project.github.io/lolbas/Binaries/Pcalua/"]
version = "1.0.8"

query = '''
process where event.action == "start" and
 (
  (process.parent.name : "pcalua.exe" and process.parent.args : "-a" and not process.parent.args : "-d") or
  (process.name : "pcalua.exe" and process.args : "-a" and not process.args : "-d")
 ) and
 not process.args : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*") and

 /* excluding signed and non Microsoft binaries */
 not (process.code_signature.trusted == true and not process.code_signature.subject_name : "Microsoft*")
'''

min_endpoint_version = "7.16.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[[threat.technique.subtechnique]]
id = "T1218.011"
name = "Rundll32"
reference = "https://attack.mitre.org/techniques/T1218/011/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.16.0"

[metadata]
creation_date = "2026/06/30"
integration = ["gcp"]
maturity = "production"
updated_date = "2026/06/30"

[rule]
author = ["Elastic"]
description = """
Detects creation or modification of GKE mutating or validating admission webhook configurations by non-system identities.
Malicious webhooks can inject workloads, block security tooling, or intercept API traffic for persistence and defense
evasion.
"""
false_positives = [
    """
    GitOps and platform controllers (cert-manager, Gatekeeper, Kyverno, service mesh) legitimately manage webhooks.
    Validate change tickets and controller identities before tuning.
    """,
]
from = "now-9m"
index = ["logs-gcp.audit-*"]
language = "kuery"
license = "Elastic License v2"
name = "GKE Admission Webhook Created or Modified"
note = """## Triage and analysis

### Investigating GKE Admission Webhook Created or Modified

Review webhook name, actor, and clientConfig destination in `gcp.audit.request`.

### Investigation steps

- Confirm `user.email`, `event.action`, and webhook resource name.
- Inspect webhook URL or in-cluster service target for external endpoints.
- Hunt for pod mutations or blocked security deployments after the change.

### False positives

- Approved controller upgrades during change windows.

## Setup

The GCP Fleet integration with GKE audit logs enabled is required to be compatible with this rule."""
references = [
    "https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/",
]
risk_score = 47
rule_id = "4886ce11-fca5-433f-bbb9-e33e410ef9ae"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Domain: Kubernetes",
    "Data Source: GCP",
    "Data Source: Google Cloud Platform",
    "Use Case: Threat Detection",
    "Tactic: Persistence",
    "Tactic: Defense Evasion",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset:gcp.audit and event.outcome:success and event.action:(
  "io.k8s.admissionregistration.v1.mutatingwebhookconfigurations.create" or
  "io.k8s.admissionregistration.v1.mutatingwebhookconfigurations.update" or
  "io.k8s.admissionregistration.v1.mutatingwebhookconfigurations.patch" or
  "io.k8s.admissionregistration.v1.validatingwebhookconfigurations.create" or
  "io.k8s.admissionregistration.v1.validatingwebhookconfigurations.update" or
  "io.k8s.admissionregistration.v1.validatingwebhookconfigurations.patch"
) and not user.email:(
  "system:kube-controller-manager" or "system:kube-scheduler" or system\:serviceaccount\:kube-system\:* or
  system\:serviceaccount\:gke-managed-system\:* or system\:serviceaccount\:cert-manager\:* or
  system\:serviceaccount\:gatekeeper-system\:* or system\:serviceaccount\:kyverno\:* or "system:addon-manager" or
  *-operator or *-cainjector or *-webhook or *argocd* or "system:gke-common-webhooks"
)
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1546"
name = "Event Triggered Execution"
reference = "https://attack.mitre.org/techniques/T1546/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[metadata]
creation_date = "2025/06/17"
integration = ["o365"]
maturity = "production"
updated_date = "2026/04/10"

[rule]
author = ["Elastic"]
description = """
Identifies an excessive number of Microsoft 365 mailbox items accessed by a user either via aggregated counts or
throttling. Microsoft audits mailbox access via the MailItemsAccessed event, which is triggered when a user accesses
mailbox items. If more than 1000 mailbox items are accessed within a 24-hour period, it is then throttled. Excessive
mailbox access may indicate an adversary attempting to exfiltrate sensitive information or perform reconnaissance on a
target's mailbox. This rule detects both the throttled and unthrottled events with a high threshold.
"""
false_positives = [
    """
    Legitimate users may access a large number of mailbox items in a short period, especially in environments with high
    email volume or during data migrations. If this is expected behavior, consider adjusting the rule or adding
    exceptions for specific users or groups.
    """,
]
from = "now-9m"
index = ["filebeat-*", "logs-o365.audit-*"]
language = "kuery"
license = "Elastic License v2"
name = "M365 Exchange Mailbox Items Accessed Excessively"
note = """## Triage and analysis

### Investigating M365 Exchange Mailbox Items Accessed Excessively

Identifies an excessive number of Microsoft 365 mailbox items accessed by a user either via aggregated counts or throttling. Microsoft audits mailbox access via the MailItemsAccessed event, which is triggered when a user accesses mailbox items. If more than 1000 mailbox items are accessed within a 24-hour period, it is then throttled. Excessive mailbox access may indicate an adversary attempting to exfiltrate sensitive information or perform reconnaissance on a target's mailbox. This rule detects both the throttled and unthrottled events with a high threshold.

### Possible investigation steps
- Review `host.name` to identify the tenant where the mailbox access occurred.
- Review `o365.audit.UserId` or `o365.audit.MailboxOwnerUPN` to identify the user associated with the mailbox access.
- Examine `o365.audit.ExternalAccess` to determine if the mailbox access was performed by an external user or application.
- Check the geolocation data to identify the location from which the mailbox access occurred. Is this an expected location for the user?
- Check `o365.audit.ClientAppId` to identify the application used for mailbox access. Look for any unusual or unexpected applications but be aware that some legitimate applications may also trigger this rule if OAuth phishing was used.
- Review `o365.audit.Folders.Path` and `o365.audit.Folders.FolderItems.Id` to identify the specific folders and items accessed within the mailbox. Look for any sensitive or high-value folders that may indicate targeted access.
- For specific items accessed, examine `o365.audit.Folders.FolderItems.Id` to gather more context on the accessed mailbox items.
- User types can be identified by checking `o365.audit.UserType`. Review if the mailbox of the user is a member, admin or delegate.
- If Entra ID logs are available, checking the risk status via `azure.signinlogs.properties.risk_state` and `azure.signinlogs.properties.risk_level` can provide additional context on the user's risk status during the mailbox access.

### False positive analysis
- Legitimate users may access a large number of mailbox items in a short period, especially in environments with high email volume or during data migrations. If this is expected behavior, consider adjusting the rule or adding exceptions for specific users or groups.
- Automated processes or scripts that access mailbox items may also trigger this rule. If these processes are legitimate and necessary, consider adding exceptions for the specific applications or users involved.
- Users with high email activity, such as helpdesk or support roles, may trigger this rule due to their job responsibilities. If this is expected behavior, consider adjusting the rule or adding exceptions for specific users or groups.

### Response and remediation
- Investigate the user account associated with the excessive mailbox access to determine if it has been compromised or if the activity is expected behavior.
- If the mailbox access is confirmed to be suspicious or unauthorized, take immediate action to revoke the access token and prevent further access.
- Disable the user account temporarily to prevent any potential compromise or unauthorized access.
- Review the user's recent sign-in activity and access patterns to identify any potential compromise or unauthorized access.
- If the user account is compromised, initiate a password reset and enforce multi-factor authentication (MFA) for the user.
- Review the conditional access policies in place to ensure they are sufficient to prevent unauthorized access to sensitive resources.
- Examine how the mailbox access was performed. If it was done via a third-party application, review the permissions granted to that application and consider revoking them if they are not necessary.
"""
references = [
    "https://learn.microsoft.com/en-us/purview/audit-log-investigate-accounts#use-mailitemsaccessed-audit-records-for-forensic-investigations",
    "https://www.microsoft.com/en-us/security/blog/2025/05/27/new-russia-affiliated-actor-void-blizzard-targets-critical-sectors-for-espionage/",
]
risk_score = 47
rule_id = "7fc95782-4bd1-11f0-9838-f661ea17fbcd"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Domain: Email",
    "Data Source: Microsoft 365",
    "Data Source: Microsoft 365 Audit Logs",
    "Use Case: Threat Detection",
    "Tactic: Collection",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset: "o365.audit" and
    event.provider: "Exchange" and
    event.action: "MailItemsAccessed" and
    event.code: "ExchangeItemAggregated" and
    (
        (
            o365.audit.OperationProperties.Name: "IsThrottled" and
            o365.audit.OperationProperties.Value: "True"
        ) or o365.audit.OperationCount >= 100
    )
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1114"
name = "Email Collection"
reference = "https://attack.mitre.org/techniques/T1114/"
[[rule.threat.technique.subtechnique]]
id = "T1114.002"
name = "Remote Email Collection"
reference = "https://attack.mitre.org/techniques/T1114/002/"



[rule.threat.tactic]
id = "TA0009"
name = "Collection"
reference = "https://attack.mitre.org/tactics/TA0009/"

[rule.investigation_fields]
field_names = [
    "user.id",
    "user.name",
    "user.email",
    "user.domain",
    "event.id",
    "event.action",
    "event.outcome",
    "event.provider",
    "source.ip",
    "related.ip",
    "related.user",
    "o365.audit.ClientAppId",
    "o365.audit.AppId",
    "o365.audit.AppAccessContext.UniqueTokenId",
    "o365.audit.OperationCount",
    "o365.audit.MailboxOwnerUPN",
    "o365.audit.MailboxOwnerSid",
    "o365.audit.MailboxGuid",
    "o365.audit.UserKey",
    "o365.audit.LogonUserSid",
    "o365.audit.TokenTenantId",
    "o365.audit.OriginatingServer",
    "o365.audit.ClientInfoString",
    "o365.audit.CreationTime",
    "o365.audit.ResultStatus",
    "source.geo.country_iso_code",
    "source.geo.country_name",
    "source.geo.continent_name",
    "source.geo.location",
    "cloud.account.id",
    "cloud.provider",
    "cloud.region",
    "cloud.service.name",
]

[metadata]
creation_date = "2025/01/16"
integration = ["endpoint", "crowdstrike", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2026/03/24"

[rule]
author = ["Elastic"]
description = """
This rule detects manual execution of the "dracut" command on Linux systems. Dracut is a tool used to generate an
initramfs image that is used to boot the system. Attackers may use "dracut" to create a custom initramfs image that
includes malicious code or backdoors, allowing them to maintain persistence on the system.
"""
from = "now-9m"
index = [
    "endgame-*",
    "logs-crowdstrike.fdr*",
    "logs-endpoint.events.process*",
    "logs-sentinel_one_cloud_funnel.*",
]
language = "eql"
license = "Elastic License v2"
name = "Manual Dracut Execution"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Manual Dracut Execution

Dracut is a utility in Linux systems used to create initramfs images, essential for booting. Adversaries might exploit Dracut to craft malicious initramfs, embedding backdoors for persistence. The detection rule identifies unusual Dracut executions by scrutinizing process origins and excluding legitimate parent processes, flagging potential unauthorized use.

### Possible investigation steps

- Review the process details to confirm the execution of the dracut command, focusing on the process.name and process.parent.executable fields to identify any unusual parent processes.
- Examine the command line arguments used with the dracut process by checking the process.parent.command_line field to understand the context of its execution.
- Investigate the user account associated with the dracut execution to determine if it aligns with expected administrative activity or if it indicates potential unauthorized access.
- Check the system logs and any related security alerts around the time of the dracut execution to identify any correlated suspicious activities or anomalies.
- Assess the system for any changes to the initramfs image or other boot-related files that could indicate tampering or the presence of backdoors.

### False positive analysis

- Legitimate system updates or kernel installations may trigger the rule. To handle this, users can create exceptions for processes originating from known update paths like /usr/lib/kernel/* or /etc/kernel/install.d/*.
- Automated scripts or maintenance tasks that use dracut for legitimate purposes might be flagged. Users should identify these scripts and add their parent process names, such as dracut-install or run-parts, to the exclusion list.
- Custom administrative scripts executed by trusted users could be mistaken for suspicious activity. Users can exclude specific command lines or arguments associated with these scripts, such as /usr/bin/dracut-rebuild, to prevent false positives.
- Temporary or testing environments where dracut is used for non-malicious testing purposes might trigger alerts. Users can exclude these environments by specifying unique parent process paths or names that are characteristic of the testing setup.

### Response and remediation

- Immediately isolate the affected system from the network to prevent potential lateral movement or data exfiltration by the adversary.
- Terminate any suspicious or unauthorized dracut processes identified on the system to halt any ongoing malicious activity.
- Conduct a thorough review of the initramfs images on the affected system to identify and remove any unauthorized or malicious modifications.
- Restore the system's initramfs from a known good backup to ensure the integrity of the boot process.
- Implement monitoring for any future unauthorized dracut executions by setting up alerts for similar process activities, ensuring quick detection and response.
- Escalate the incident to the security operations team for further investigation and to determine if additional systems are affected.
- Review and update access controls and permissions to limit the ability to execute dracut to only authorized personnel, reducing the risk of future exploitation."""
risk_score = 21
rule_id = "834ee026-f9f9-4ec7-b5e0-7fbfe84765f4"
setup = """## Setup

This rule requires data coming in from Elastic Defend.

### Elastic Defend Integration Setup
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.

#### Prerequisite Requirements:
- Fleet is required for Elastic Defend.
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).

#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
- Go to the Kibana home page and click "Add integrations".
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
- Click "Add Elastic Defend".
- Configure the integration name and optionally add a description.
- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
- Click "Save and Continue".
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
"""
severity = "low"
tags = [
    "Domain: Endpoint",
    "OS: Linux",
    "Use Case: Threat Detection",
    "Tactic: Persistence",
    "Tactic: Execution",
    "Data Source: Elastic Endgame",
    "Data Source: Elastic Defend",
    "Data Source: Crowdstrike",
    "Data Source: SentinelOne",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"
query = '''
process where host.os.type == "linux" and event.type == "start" and
event.action in ("exec", "exec_event", "start", "ProcessRollup2") and
process.name == "dracut" and process.parent.executable != null and not (
  process.parent.executable like (
    "/usr/lib/kernel/*", "/etc/kernel/install.d/*", "/var/lib/dpkg/info/dracut.postinst",
    "/tmp/newroot/*", "/usr/lib/module-init-tools/*", "/usr/bin/xargs", "/sbin/dkms",
    "/sbin/mkinitrd", "/usr/bin/timeout", "/usr/sbin/dkms", "/usr/bin/systemd-inhibit"
  ) or
  process.parent.name in (
    "dracut-install", "dracut", "run-parts", "weak-modules", "mkdumprd", "new-kernel-pkg", "sudo"
  ) or
  process.parent.args like~ ("/usr/bin/dracut-rebuild", "/var/tmp/rpm-tmp.*") or
  process.parent.command_line like~ "/bin/sh -c if command -v mkinitcpio*"
)
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1542"
name = "Pre-OS Boot"
reference = "https://attack.mitre.org/techniques/T1542/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"

[[rule.threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1542"
name = "Pre-OS Boot"
reference = "https://attack.mitre.org/techniques/T1542/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[metadata]
creation_date = "2023/11/08"
integration = ["okta"]
maturity = "production"
updated_date = "2026/04/13"

[rule]
author = ["Elastic"]
description = """
This rule detects when a specific Okta actor has multiple device token hashes and multiple source IPs for a single Okta
session. This may indicate an authenticated session has been hijacked or replayed from a different device and network.
Adversaries may steal session cookies or tokens to gain unauthorized access to Okta admin console, applications,
tenants, or other resources.
"""
from = "now-9m"
interval = "8m"
language = "esql"
license = "Elastic License v2"
name = "Multiple Device Token Hashes for Single Okta Session"
note = """## Triage and analysis

### Investigating Multiple Device Token Hashes for Single Okta Session

This rule detects when a specific Okta actor has multiple device token hashes and multiple source IPs for a single Okta session. This may indicate an authenticated session has been hijacked or replayed from a different device and network. Adversaries may steal session cookies or tokens to gain unauthorized access to Okta admin console, applications, tenants, or other resources.

> **Note**: This is an ES|QL aggregation-based rule. Exceptions can be added on the original ECS or integration-related fields. We recommend using the indicators from the alert document to pivot into the raw events for analysis.

#### Possible investigation steps:
- Use `okta.actor.alternate_id` and `okta.authentication_context.external_session_id` from the alert to pivot into the raw Okta system log events for the affected session.
- Review the source IPs (`okta.client.ip`) and ASN information (`source.as.organization.name`) to determine if the session was used from multiple distinct networks.
    - Multiple ASNs or geolocations (`client.geo.country_name`, `client.geo.city_name`) within the same session strongly suggest session hijacking.
- Compare the `okta.debug_context.debug_data.dt_hash` values to identify the device token hashes associated with the session.
    - A legitimate session should have a consistent device token hash. Multiple distinct hashes indicate the session cookie may have been replayed from a different device.
- Examine `okta.client.user_agent.raw_user_agent` and `okta.client.device` for inconsistencies that suggest different devices or browsers using the same session.
- Review `event.action` to understand what actions were performed during the session.
    - Look for suspicious post-authentication activity such as admin console access, policy changes, or application assignment modifications.
- Check `okta.debug_context.debug_data.risk_level`, `okta.debug_context.debug_data.risk_reasons`, and `okta.debug_context.debug_data.behaviors` for Okta's own risk assessment of the session activity.
- Review the past activities of the actor(s) involved by checking their previous sessions and login patterns.

### False positive analysis:
- OAuth application integrations (e.g., backend services exchanging authorization codes for tokens) can generate multiple device token hashes per session due to the multi-step token grant flow. These typically involve `Okta-Integrations` user agents and known infrastructure IPs.
- Users switching between networks (e.g., VPN reconnects, WiFi to cellular transitions) may produce multiple source IPs for the same session, though the device token hash should remain consistent.
- Automated tools or scripts that interact with Okta APIs on behalf of a user may generate additional device token hashes.

### Response and remediation:
- If the alert shows multiple distinct ASNs or geolocations for the same session, immediately revoke all active sessions for the affected user via the Okta admin console.
- Reset the user's password and all active MFA factors.
    - If MFA is not enabled, enforce MFA enrollment before allowing re-authentication.
- Review Okta system logs for any administrative or sensitive actions performed during the suspicious session window.
- If the session was used to access downstream applications, review those application logs for unauthorized activity.
- Check with the user to confirm whether they were actively using Okta during the alert time window.
- For recurring false positives from known integrations, add exceptions on `okta.actor.alternate_id` for the specific service account or application client ID.
"""
references = [
    "https://developer.okta.com/docs/reference/api/system-log/",
    "https://developer.okta.com/docs/reference/api/event-types/",
    "https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy",
    "https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection",
    "https://support.okta.com/help/s/article/session-hijacking-attack-definition-damage-defense?language=en_US",
    "https://www.elastic.co/security-labs/monitoring-okta-threats-with-elastic-security",
    "https://www.elastic.co/security-labs/starter-guide-to-understanding-okta",
]
risk_score = 47
rule_id = "cc382a2e-7e52-11ee-9aac-f661ea17fbcd"
severity = "medium"
tags = [
    "Domain: Identity",
    "Domain: SaaS",
    "Data Source: Okta",
    "Data Source: Okta System Logs",
    "Tactic: Credential Access",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "esql"

query = '''
from logs-okta.system-*
| where
    data_stream.dataset == "okta.system" and
    not event.action in (
        "policy.evaluate_sign_on",
        "user.session.start",
        "user.authentication.sso"
    ) and
    okta.actor.alternate_id != "system@okta.com" and
    okta.actor.alternate_id rlike "[^@\\s]+\\@[^@\\s]+" and
    okta.authentication_context.external_session_id != "unknown" and
    (
        okta.authentication_context.external_session_id IS NOT NULL and
        okta.debug_context.debug_data.dt_hash IS NOT NULL and
        okta.client.ip IS NOT NULL and
        okta.client.user_agent.raw_user_agent IS NOT NULL
    ) and
    (
        okta.authentication_context.external_session_id != "-" and
        okta.debug_context.debug_data.dt_hash != "-" and
        okta.client.user_agent.raw_user_agent != "-"
    )
| stats
    Esql.dt_hash_count_distinct = count_distinct(okta.debug_context.debug_data.dt_hash),
    Esql.client_ip_count_distinct = count_distinct(okta.client.ip),
    Esql.event_count = count(*),
    Esql.first_event_time = min(@timestamp),
    Esql.last_event_time = max(@timestamp),
    Esql.dt_hash_values = values(okta.debug_context.debug_data.dt_hash),
    Esql.event_action_values = values(event.action),
    Esql.client_ip_values = values(okta.client.ip),
    Esql.user_agent_values = values(okta.client.user_agent.raw_user_agent),
    Esql.device_values = values(okta.client.device),
    Esql.is_proxy_values = values(okta.security_context.is_proxy),
    Esql.geo_country_name_values = values(client.geo.country_name),
    Esql.geo_city_name_values = values(client.geo.city_name),
    Esql.source_asn_number_values = values(source.`as`.number),
    Esql.source_asn_org_name_values = values(source.`as`.organization.name),
    Esql.threat_suspected_values = values(okta.debug_context.debug_data.threat_suspected),
    Esql.risk_level_values = values(okta.debug_context.debug_data.risk_level),
    Esql.risk_reasons_values = values(okta.debug_context.debug_data.risk_reasons),
    Esql.behaviors_values = values(okta.debug_context.debug_data.behaviors),
    Esql.device_fingerprint_values = values(okta.debug_context.debug_data.device_fingerprint),
    Esql.risk_behaviors_values = values(okta.debug_context.debug_data.risk_behaviors),
    Esql.request_uri_values = values(okta.debug_context.debug_data.request_uri)
  by
    okta.actor.alternate_id,
    okta.authentication_context.external_session_id
| where
    Esql.dt_hash_count_distinct >= 4 and
    Esql.client_ip_count_distinct >= 2
| keep Esql.*, okta.*
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1539"
name = "Steal Web Session Cookie"
reference = "https://attack.mitre.org/techniques/T1539/"

[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1550"
name = "Use Alternate Authentication Material"
reference = "https://attack.mitre.org/techniques/T1550/"

[[rule.threat.technique.subtechnique]]
id = "T1550.004"
name = "Web Session Cookie"
reference = "https://attack.mitre.org/techniques/T1550/004/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[metadata]
creation_date = "2020/03/18"
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2026/05/04"

[rule]
author = ["Elastic"]
description = """
Identifies msxsl.exe making a network connection. This may indicate adversarial activity as msxsl.exe is often leveraged
by adversaries to execute malicious scripts and evade detection.
"""
from = "now-9m"
index = [
    "winlogbeat-*",
    "logs-endpoint.events.process-*",
    "logs-endpoint.events.network-*",
    "logs-windows.sysmon_operational-*",
    "logs-sentinel_one_cloud_funnel.*",
]
language = "eql"
license = "Elastic License v2"
name = "Network Connection via MsXsl"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Network Connection via MsXsl

MsXsl.exe is a legitimate Windows utility used to transform XML data using XSLT stylesheets. Adversaries exploit it to execute malicious scripts, bypassing security measures. The detection rule identifies suspicious network activity by MsXsl.exe, focusing on connections to non-local IPs, which may indicate unauthorized data exfiltration or command-and-control communication.

### Possible investigation steps

- Review the process execution details for msxsl.exe, focusing on the process.entity_id and event.type fields to confirm the process start event and gather initial context.
- Analyze the network connection details, particularly the destination.ip field, to identify the external IP address msxsl.exe attempted to connect to and assess its reputation or any known associations with malicious activity.
- Check for any related alerts or logs involving the same process.entity_id to determine if msxsl.exe has been involved in other suspicious activities or if there are patterns of behavior indicating a broader attack.
- Investigate the parent process of msxsl.exe to understand how it was launched and whether it was initiated by a legitimate application or a potentially malicious script.
- Examine the system for any additional indicators of compromise, such as unusual file modifications or other processes making unexpected network connections, to assess the scope of potential adversarial activity.

### False positive analysis

- Legitimate use of msxsl.exe for XML transformations in enterprise applications may trigger alerts. Users should identify and whitelist known applications or processes that use msxsl.exe for legitimate purposes.
- Automated scripts or scheduled tasks that utilize msxsl.exe for data processing can cause false positives. Review and document these tasks, then create exceptions for their network activity.
- Development or testing environments where msxsl.exe is used for debugging or testing XML transformations might be flagged. Ensure these environments are recognized and excluded from monitoring if they are verified as non-threatening.
- Internal network tools or monitoring solutions that leverage msxsl.exe for legitimate network communications should be identified. Add these tools to an exception list to prevent unnecessary alerts.
- Regularly review and update the list of excluded IP addresses to ensure that only trusted and verified internal IPs are exempt from triggering the rule.

### Response and remediation

- Immediately isolate the affected system from the network to prevent further unauthorized data exfiltration or command-and-control communication.
- Terminate the msxsl.exe process if it is still running to stop any ongoing malicious activity.
- Conduct a thorough scan of the affected system using updated antivirus and anti-malware tools to identify and remove any malicious scripts or files associated with msxsl.exe.
- Review and analyze the network logs to identify any other systems that may have been targeted or compromised by similar activity.
- Restore the affected system from a known good backup if any critical system files or configurations have been altered.
- Implement network segmentation to limit the ability of msxsl.exe or similar utilities to make unauthorized external connections in the future.
- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if additional systems or data have been impacted."""
references = ["https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml"]
risk_score = 21
rule_id = "b86afe07-0d98-4738-b15d-8d7465f95ff5"
severity = "low"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Defense Evasion",
    "Data Source: Elastic Defend",
    "Data Source: SentinelOne",
    "Data Source: Sysmon",
    "Resources: Investigation Guide",
]
type = "eql"

query = '''
sequence by process.entity_id
  [process where host.os.type == "windows" and process.name : "msxsl.exe" and event.type == "start"]
  [network where host.os.type == "windows" and process.name : "msxsl.exe" and
     not cidrmatch(destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24",
       "192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32",
       "192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4",
       "100.64.0.0/10", "192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1",
       "FE80::/10", "FF00::/8")]
'''

setup = """## Setup

This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.

Setup instructions: https://ela.st/install-elastic-defend

### Additional data sources

This rule also supports the following third-party data sources. For setup instructions, refer to the links below:

- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
- [Sysmon Event ID 1 - Process Creation](https://ela.st/sysmon-event-1-setup)
- [Sysmon Event ID 3 - Network Connection](https://ela.st/sysmon-event-3-setup)
"""


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1220"
name = "XSL Script Processing"
reference = "https://attack.mitre.org/techniques/T1220/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1105"
name = "Ingress Tool Transfer"
reference = "https://attack.mitre.org/techniques/T1105/"

[rule.threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[rule]
description = """
Detects attempts to hijack the execution of the MSDTC Windows service via the OracleOciLib registry key modification
forcing to load a random library.
"""
id = "aa2a4cd9-0b08-4783-b94e-f65fca46566a"
license = "Elastic License v2"
name = "Persistence via MSDTC Service Hijack"
os_list = ["windows"]
reference = [
    "https://www.trendmicro.com/en_sg/research/19/l/waterbear-is-back-uses-api-hooking-to-evade-security-product-detection.html",
]
version = "1.0.3"

query = '''
library where process.executable : "?:\\Windows\\System32\\msdtc.exe" and
 not dll.code_signature.status : "trusted" and user.id : "S-1-5-20" and
 (dll.Ext.relative_file_creation_time < 5000 or dll.Ext.relative_file_name_modify_time < 5000) and
 process.thread.Ext.call_stack_summary : "ntdll.dll|kernelbase.dll|mtxoci.dll*"
'''

min_endpoint_version = "8.7.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1574"
name = "Hijack Execution Flow"
reference = "https://attack.mitre.org/techniques/T1574/"


[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[internal]
min_endpoint_version = "8.7.0"

[rule]
description = """
Identifies the execution of a shell process from a Java JAR application post an incoming network connection. This
behavior may indicate a reverse shell activity via malicious Java application.
"""
id = "41dcfe9e-9170-4ffe-b620-351736366ced"
license = "Elastic License v2"
name = "Possible JAVA Reverse Shell"
os_list = ["macos"]
version = "1.0.10"

query = '''
sequence with maxspan=5s
[network where event.action in ("connection_accepted", "connection_attempted") and 
 process.name in ("java", "javaw")] by process.entity_id
[process where event.action == "start" and process.parent.name like "java" and
 process.parent.args like~ "-jar" and
 process.name in ("bash", "sh", "zsh")] by process.parent.entity_id
'''

min_endpoint_version = "8.16.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"


[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "8.16.0"

[rule]
description = """
Detects a ClickFix-style attack where a user pastes a malicious PowerShell command into Windows Terminal after being
tricked by a fake human verification, reCAPTCHA, CAPTCHA, or Turnstile confirmation prompt. Adversaries increasingly
abuse Windows Terminal as an alternative to the Windows Run dialog to evade registry-based detections, often spoofing
Cloudflare or Google verification pages and using Terminal customization to make the lure appear legitimate.
"""
id = "c3884320-f423-4d44-aa55-08bd99237ce4"
license = "Elastic License v2"
name = "Potential ClickFix Attack via Windows Terminal"
os_list = ["windows"]
reference = [
    "https://www.microsoft.com/en-us/security/blog/2025/08/21/think-before-you-clickfix-analyzing-the-clickfix-social-engineering-technique/",
    "https://detect.fyi/hunting-clickfix-win-x-variants-ff06e4c62bd9",
    "https://www.securityweek.com/clickfix-attack-uses-windows-terminal-to-evade-detection/",
]
version = "1.0.1"

query = '''
api where process.Ext.api.name == "AmsiScanBuffer" and
  process.name == "powershell.exe" and
  process.parent.executable : "?:\\Program Files\\WindowsApps\\Microsoft.WindowsTerminal_*\\WindowsTerminal.exe" and
  process.Ext.api.parameters.buffer : (
    "*not a robot*",
    "*<#Verification ID*",
    "*<#Verification UID*",
    "*<#Verification Code*",
    "*Verify*Human*",
    "*Microsoft Defender Services Secure Access*",
    "*Enter to verify*",
    "*challenge.cloudflare.com*",
    "*confirmChallenge*",
    "*Human verif*",
    "*Checking your browser*",
    "*Just a moment*"
  )
'''

min_endpoint_version = "8.16.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"
[[threat.technique.subtechnique]]
id = "T1566.002"
name = "Spearphishing Link"
reference = "https://attack.mitre.org/techniques/T1566/002/"



[threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.001"
name = "PowerShell"
reference = "https://attack.mitre.org/techniques/T1059/001/"


[[threat.technique]]
id = "T1204"
name = "User Execution"
reference = "https://attack.mitre.org/techniques/T1204/"
[[threat.technique.subtechnique]]
id = "T1204.001"
name = "Malicious Link"
reference = "https://attack.mitre.org/techniques/T1204/001/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "8.16.0"

[rule]
description = """
Identifies attempts to load an unsigned DLL from a mounted virtual disk (.iso, .vhd) and by a signed Microsoft binary.
This may indicate an attempt to sideload a malicious DLL to stealthily execute code.
"""
id = "ba802fb2-f183-420e-947b-da5ce0c74dd3"
license = "Elastic License v2"
name = "Potential DLL SideLoad via a Microsoft Signed Binary"
os_list = ["windows"]
reference = [
    "https://www.elastic.co/security-labs/Hunting-for-Suspicious-Windows-Libraries-for-Execution-and-Evasion",
]
version = "1.0.27"

query = '''
/* MS bin used as DLL sideloading target from an ISO/DMG/VHD archive */
library where
  (dll.Ext.device.product_id : ("Virtual DVD-ROM", "Virtual Disk") and not dll.path : "C:\\*") and
  process.code_signature.subject_name : "Microsoft*" and
  not dll.code_signature.status : ("trusted", "errorCode_endpoint*") and
  not process.executable : "C:\\*" and
  not startswith~(dll.name, process.name) and
  not dll.hash.sha256 :
              ("94555c70cf6376c645c6f7277d0cf61f8b50add7fe0b8b17b6d5f222589689b6",
               "9b594093385a5f3f23e8bb2112d0ee5df93b4cf6f95515909d4fbea22e4283aa",
               "d668366c74f476d73fc0e00b00433ce3e2ccff7b18a525cf41758b7c3c495ea3",
               "0924c7a3f02eee3b0b6f1b4d9c22cd3c7e914d57fcd07a707d56e0cb04d66e7a",
               "6ee2c087b7c55b7fea604515fd47eb20a7a531854da8a7c010744743cb937f6a",
               "c048df2f3928f57f27951e5d917f90b788b1881948d98379c8772423d91fc4fb",
               "3c30e83ae1150ae8efd52d652af227948cc8d8107c99d313084a3f4c3a0545c7",
               "0b8094f76dbe2621cef9f6340bf4225d49ac847b8fd5c7b3456256fdb31141de",
               "69326fd2322db837d680d3fd0d61ca4de77eac3ba96306bad8c12b64c922880f",
               "6a6299dc667bedfa449f374931d1990cd19c3b23e2e603562b7f9d2c42e37f62")
'''

min_endpoint_version = "8.10.0"
optional_actions = []
reputation = true
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1574"
name = "Hijack Execution Flow"
reference = "https://attack.mitre.org/techniques/T1574/"
[[threat.technique.subtechnique]]
id = "T1574.001"
name = "DLL"
reference = "https://attack.mitre.org/techniques/T1574/001/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"

[rule]
description = """
This rule detects potential privilege escalation under the root effective user when the real user and parent user are
not root, indicative of the execution of binaries with SUID or SGID bits set. Attackers may abuse SUID/SGID binaries to
escalate their privileges to root, using exploits or misconfigurations.
"""
id = "6ac2717b-a63d-4697-b01e-918388bdc762"
license = "Elastic License v2"
name = "Potential Privilege Escalation via a SUID/SGID Binary"
os_list = ["linux"]
version = "1.0.5"

query = '''
process where event.type == "start" and event.action == "exec" and (
  (process.user.id == 0 and process.real_user.id != 0 and process.parent.user.id != 0) or
  (process.group.id == 0 and process.real_group.id != 0 and process.parent.group.id != 0)
) and
(
  stringcontains(process.executable, process.command_line) or
  stringcontains(process.name, process.command_line)
) and
(
  process.parent.name like (".*", "python*", "perl*", "ruby*", "lua*", "php*", "node", "deno", "bun", "java") or
  process.parent.executable like ("./*", "/tmp/*", "/var/tmp/*", "/dev/shm/*", "/run/user/*", "/var/run/user/*", "/home/*/*") or
  (
    process.parent.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "mksh") and
    process.parent.args in ("-c", "-cl", "-lc", "--command", "-ic", "-ci", "-bash", "-sh", "-zsh", "-dash", "-fish", "-ksh", "-mksh") and
    process.parent.args_count <= 4
  )
) and
not (
  /* Covered by b1d415dc-796a-48f1-944f-4bb6037b2450 */
  process.name in (
    "unix_chkpwd", "fusermount", "fusermount3", "umount", "newgrp", "chsh", "sudoedit", "gpasswd", "chfn", "polkit-agent-helper-1",
    "dbus-daemon-launch-helper", "ssh-keysign", "pam_extrausers_chkpwd", "expiry", "chage", "wall", "bsd-write", "ssh-agent",
    "ping6", "traceroute", "mtr", "ntfs-3g", "Xorg.wrap", "chrome-sandbox", "bwrap", "hostname", "sudo"
  ) or
  (
    /* Covered by 83b0e48b-f42e-4323-b8cd-386619a96d35 */
    (process.name == "su" and process.args_count <= 2) or
    (process.name == "pkexec" and process.args_count == 1) or
    (process.name == "passwd" and process.args_count <= 2)
  ) or
  (process.name == "mount" and process.args_count <= 2) or
  process.parent.executable like "/u0*/*" or
  process.name like "python*" or
  process.executable like (
    "/opt/psa/admin/bin/*", "/usr/lib/landscape/apt-update", "/usr/sbin/login_duo", "/usr/bin/nvidia-modprobe", "/usr/bin/proxmox-mail-forward",
    "/opt/andrisoft/bin/WANmaintenance", "/ora/SW/em_agent/*", "/opt/OracleHomes/agent_home/*", "/opt/rsa/am/utils/lib/linux-x86_64/*",
    "/usr/libexec/spice-client-glib-usb-acl-helper", "/tmp/newroot/usr/bin/vmware-user-suid-wrapper",
    "/tmp/newroot/usr/lib/landscape/apt-update", "/home/*/sqllib/adm/db2start",
    "/home/*/sqllib/adm/db2stop", "/*/app/oracle/product/*/sbin/nmo", "/opt/data/db2inst1/sqllib/adm/db2stop", "/opt/data/db2inst1/sqllib/adm/db2start",
    "/usr/local/sbin/uid_gid_mapping", "/usr/bin/crontab", "/home/db2inst1/sqllib/adm/db2chparm", "/vz/root/*/opt/psa/admin/bin/osdetect",
    "/data/app/oracle/agent/*", "/usr/lib/plesk-*/msmtp-pwdeval", "/usr/sbin/mount.nfs"
  ) or
  process.command_line in ("/usr/bin/nvidia-modprobe", "/usr/sbin/login_duo")
)
'''

min_endpoint_version = "8.2.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1068"
name = "Exploitation for Privilege Escalation"
reference = "https://attack.mitre.org/techniques/T1068/"

[[threat.technique]]
id = "T1548"
name = "Abuse Elevation Control Mechanism"
reference = "https://attack.mitre.org/techniques/T1548/"
[[threat.technique.subtechnique]]
id = "T1548.001"
name = "Setuid and Setgid"
reference = "https://attack.mitre.org/techniques/T1548/001/"

[[threat.technique.subtechnique]]
id = "T1548.003"
name = "Sudo and Sudo Caching"
reference = "https://attack.mitre.org/techniques/T1548/003/"



[threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[internal]
min_endpoint_version = "8.2.0"