Elastic rules: 26

[metadata]
creation_date = "2026/08/24"
integration = ["aws"]
maturity = "production"
updated_date = "2026/08/24"

[rule]
author = ["Elastic"]
description = """
Detects when account-level email sending is explicitly enabled in Amazon SES, via the v1
UpdateAccountSendingEnabled API with Enabled: true or the v2 PutAccountSendingAttributes API with
SendingEnabled: true. Account-level sending is commonly paused by an administrator, or by automation
wired to CloudWatch reputation alarms when bounce or complaint rates rise. An attacker who
compromises an AWS account may re-enable sending to restore a paused capability as part of phishing
infrastructure setup, allowing bulk email under the victim organization's trusted sending domain.
Neither API can resume sending that AWS itself has paused.
"""
false_positives = [
    """
    SES account sending may be legitimately re-enabled by an administrator after a sending pause
    for bounce/complaint rate investigation or maintenance. Validate against a change management
    record or scheduled maintenance window. This API is rarely called in normal operations.
    """,
]
from = "now-6m"
index = ["logs-aws.cloudtrail-*"]
language = "kuery"
license = "Elastic License v2"
name = "AWS SES Account Email Sending Enabled"
note = """## Triage and analysis

### Investigating AWS SES Account Email Sending Enabled

ses:UpdateAccountSendingEnabled (v1) and ses:PutAccountSendingAttributes (v2) both control whether the entire AWS account can send email in the current region, and both log under event.provider ses.amazonaws.com, so a caller can reach the same outcome through either API version. Enabling account-level sending is a one-step action that lifts a pause set by an administrator or by CloudWatch-driven automation. Per the v2 documentation neither API can resume sending that AWS has paused, so this is not a path out of an AWS enforcement action. In normal operations these APIs are rarely called. An attacker with SES permissions may call either one to restore paused sending capability, or to enable sending in a region where it was not previously active.

### Possible investigation steps

- Identify the caller in aws.cloudtrail.user_identity.arn and user.name. Determine whether this is a known SES administrator or an anomalous identity.
- Verify whether account-level sending was previously disabled (ses:GetAccountSendingEnabled in v1, or ses:GetAccount returning SendingEnabled false in v2) and cross-reference prior CloudTrail events for both APIs.
- Query CloudTrail for co-occurring events from the same identity: IAM privilege escalation (AttachUserPolicy, AttachRolePolicy), SES identity creation (VerifyEmailIdentity, CreateEmailIdentity), or SES template/suppression-list manipulation.
- Check the account's SES sending statistics for any unusual spike in sent email volume following this event.
- Determine whether this corresponds to a legitimate remediation of a bounce/complaint rate issue with a change management ticket.

### False positive analysis

- Legitimate SES operations teams re-enabling sending after a planned suspension will trigger this rule. These events are rare; validate against change records.

### Response and remediation

- If unauthorized, disable account-level sending immediately via ses:UpdateAccountSendingEnabled with Enabled: false, or ses:PutAccountSendingAttributes with SendingEnabled: false.
- Revoke active sessions for the calling identity.
- Review SES send statistics for unauthorized email activity during the enabled window.
- Check all SES email identities and sending authorization policies for unauthorized entries.
"""
references = [
    "https://docs.aws.amazon.com/ses/latest/APIReference/API_UpdateAccountSendingEnabled.html",
    "https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_PutAccountSendingAttributes.html",
    "https://permiso.io/blog/s/aws-ses-pionage-detecting-ses-abuse/",
    "https://www.rapid7.com/blog/post/dr-threat-actors-aws-workmail-phishing-campaigns/",
]
risk_score = 47
rule_id = "e3f4a5b6-c7d8-9012-cdef-34567890abcd"
setup = "The AWS integration must be ingesting management events into `logs-aws.cloudtrail-*`. No additional data event selectors are required — `ses:UpdateAccountSendingEnabled` and `ses:PutAccountSendingAttributes` are management-plane APIs logged by default."
severity = "medium"
tags = [
    "Domain: Cloud",
    "Platform: AWS",
    "Data Source: AWS CloudTrail",
    "Service: AWS SES",
    "Rule Type: Custom Query (KQL)",
    "Tactic: Resource Development",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset: "aws.cloudtrail"
    and event.provider: "ses.amazonaws.com"
    and event.action: ("UpdateAccountSendingEnabled" or "PutAccountSendingAttributes")
    and event.outcome: "success"
    and aws.cloudtrail.request_parameters: (*enabled=true* or *Enabled=true*)
    and not user_agent.original: (*Terraform* or *terraform* or *Pulumi* or *pulumi* or *Ansible* or "batch.amazonaws.com" or "cloudformation.amazonaws.com")
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1608"
name = "Stage Capabilities"
reference = "https://attack.mitre.org/techniques/T1608/"


[rule.threat.tactic]
id = "TA0042"
name = "Resource Development"
reference = "https://attack.mitre.org/tactics/TA0042/"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "aws.cloudtrail.user_identity.arn",
    "aws.cloudtrail.user_identity.type",
    "aws.cloudtrail.user_identity.access_key_id",
    "user.name",
    "event.action",
    "event.outcome",
    "aws.cloudtrail.request_parameters",
    "source.ip",
    "cloud.region",
    "cloud.account.id",
]

[metadata]
creation_date = "2026/02/20"
integration = ["endpoint", "auditd_manager", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2026/03/24"

[rule]
author = ["Elastic"]
description = """
Detects execution of bpftool commands used to load, attach, run, or pin eBPF programs, as well as create or update
eBPF maps and links. These operations interact directly with the Linux eBPF subsystem and can modify kernel-level
behavior. While commonly used by legitimate networking or observability tooling, unexpected or interactive usage
may indicate eBPF-based rootkit activity, policy tampering, or unauthorized kernel instrumentation.
"""
from = "now-9m"
index = [
    "auditbeat-*",
    "endgame-*",
    "logs-auditd_manager.auditd-*",
    "logs-endpoint.events.process*",
    "logs-sentinel_one_cloud_funnel.*",
    "logs-crowdstrike.fdr*",
]
language = "eql"
license = "Elastic License v2"
name = "BPF Program or Map Load via bpftool"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating BPF Program or Map Load via bpftool

This rule flags bpftool executions that load, attach, run, or pin eBPF programs and that create or pin maps/links, actions that can change kernel behavior without traditional user-space artifacts. Adversaries can use bpftool to load a malicious eBPF object, attach it to a tracepoint or traffic control hook, and pin the program and maps in bpffs so it persists and hides or filters activity across reboots.

### Possible investigation steps

- Capture full command line, parent process, user context, TTY/session, and current working directory to determine whether execution was interactive administration or automated tooling.  
- Enumerate loaded and pinned eBPF artifacts and their attachment points using `bpftool prog show`, `bpftool map show`, `bpftool link show`, and a filesystem review of `/sys/fs/bpf` to identify unexpected persistence.  
- Identify the eBPF object/source used for the load (path, inode, hash, package origin) and retrieve a copy for analysis, including checking for recent writes or downloads in the same directory tree.  
- Correlate the event time with system logs and other telemetry for follow-on activity such as privilege escalation, module loads, network filtering changes, or suspicious process hiding indicators.  
- Hunt for persistence mechanisms that would reload the same eBPF program after reboot (systemd units/timers, cron, init scripts, container entrypoints) and validate against known legitimate observability/network stacks in the environment.

### False positive analysis

- A system administrator or SRE may run `bpftool prog load/attach/pin` or `bpftool map create/pin` during planned troubleshooting or performance investigation to temporarily instrument kernel events and persist objects under `/sys/fs/bpf` for multi-step validation.  
- A legitimate system service or boot-time automation may invoke `bpftool` to load and pin eBPF programs/maps as part of expected networking, security policy enforcement, or observability initialization, especially after upgrades or configuration changes that trigger reloading.

### Response and remediation

- Immediately isolate the host or container from the network and stop the initiating service/session, then detach any active hooks by removing pinned artifacts under `/sys/fs/bpf` and verifying with `bpftool prog show` and `bpftool link show` that the suspicious program/link is no longer attached.  
- Preserve evidence by collecting the full `bpftool` command line and parent chain, a recursive copy of `/sys/fs/bpf`, and the exact eBPF object file used for the load (path, hash, permissions, timestamps) before deleting or modifying artifacts.  
- Eradicate persistence by removing malicious eBPF pins, deleting or quarantining the associated `.o`/loader binaries, and disabling the boot-time mechanism that reloads them (systemd unit/timer, cron, init scripts, container entrypoint) followed by a controlled reboot to clear any remaining in-kernel state.  
- Recover by restoring the system to a known-good configuration, validating expected networking/observability behavior, and monitoring that no new pinned programs/maps/links reappear under `/sys/fs/bpf` after reboot or service restarts.  
- Escalate to incident response and kernel/rootkit specialists if the program attaches to security-relevant hooks (e.g., tracepoints/kprobes/LSM/tc) or if pinned objects reappear after removal, indicating an active persistence mechanism or compromised privileged runtime.  
- Harden by restricting `bpftool` availability and access to bpffs, enforcing least-privilege for CAP_BPF/CAP_SYS_ADMIN, requiring signed/managed eBPF loaders, and enabling controls that limit eBPF usage to approved components in production images and hosts."""
references = [
    "https://manpages.ubuntu.com/manpages/jammy/man8/bpftool-prog.8.html",
    "https://manpages.ubuntu.com/manpages/noble/man8/bpftool-map.8.html",
    "https://man.archlinux.org/man/bpftool-link.8.en",
]
risk_score = 47
rule_id = "2d05fefd-40ba-43ae-af0c-3c25e86b54f1"
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: Linux",
    "Use Case: Threat Detection",
    "Tactic: Persistence",
    "Tactic: Defense Evasion",
    "Threat: Rootkit",
    "Data Source: Elastic Endgame",
    "Data Source: Elastic Defend",
    "Data Source: Auditd Manager",
    "Data Source: SentinelOne",
    "Data Source: Crowdstrike",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"
query = '''
process where host.os.type == "linux" and event.type == "start" and
event.action in ("exec", "exec_event", "start", "ProcessRollup2", "executed", "process_started") and
process.name == "bpftool" and (
  (process.args == "prog" and process.args in ("load", "loadall", "attach", "run", "pin")) or
  (process.args == "map" and process.args in ("create", "pin")) or
  (process.args == "link" and process.args == "pin")
)
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1547"
name = "Boot or Logon Autostart Execution"
reference = "https://attack.mitre.org/techniques/T1547/"

[[rule.threat.technique.subtechnique]]
id = "T1547.006"
name = "Kernel Modules and Extensions"
reference = "https://attack.mitre.org/techniques/T1547/006/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1014"
name = "Rootkit"
reference = "https://attack.mitre.org/techniques/T1014/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1547"
name = "Boot or Logon Autostart Execution"
reference = "https://attack.mitre.org/techniques/T1547/"

[[rule.threat.technique.subtechnique]]
id = "T1547.006"
name = "Kernel Modules and Extensions"
reference = "https://attack.mitre.org/techniques/T1547/006/"

[rule.threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[metadata]
creation_date = "2025/09/01"
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2026/04/21"

[rule]
author = ["Elastic"]
description = """
Identifies DNS queries to known Large Language Model domains by unsigned binaries or common Windows scripting utilities.
Malwares may leverage the capabilities of LLM to perform actions in the affected system in a dynamic way.
"""
from = "now-9m"
index = [
    "endgame-*",
    "logs-endpoint.events.network-*",
    "logs-sentinel_one_cloud_funnel.*",
    "logs-windows.sysmon_operational-*",
    "winlogbeat-*",
]
language = "eql"
license = "Elastic License v2"
name = "Connection to Common Large Language Model Endpoints"
note = """## Triage and analysis

### Investigating Connection to Common Large Language Model Endpoints

#### Possible investigation steps

- Investigate the process execution chain (parent process tree) for unknown processes or malicious scripts.
- Verify if the executed process is persistent on the host like common mechanisms Startup folder, task or Run key.
- Review any unusual network, files or registry events by the same process.
- Investigate other alerts associated with the user/host during the past 48 hours.
- Extract this communication's indicators of compromise (IoCs) and use traffic logs to search for other potentially compromised hosts.

### False positive analysis

- Trusted applications from an expected process running in the environment.

### Response and remediation

- Initiate the incident response process based on the outcome of the triage.
- Isolate the involved host to prevent further post-compromise behavior.
- Immediately block the identified indicators of compromise (IoCs).
- Implement any temporary network rules, procedures, and segmentation required to contain the attack.
- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
- Update firewall rules to be more restrictive.
- Reimage the host operating system or restore the compromised files to clean versions.
- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
"""
references = ["https://malpedia.caad.fkie.fraunhofer.de/details/py.lamehug"]
risk_score = 47
rule_id = "4ae94fc1-f08f-419f-b692-053d28219380"
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "OS: macOS",
    "Use Case: Threat Detection",
    "Tactic: Command and Control",
    "Resources: Investigation Guide",
    "Data Source: Elastic Endgame",
    "Data Source: Elastic Defend",
    "Data Source: SentinelOne",
    "Data Source: Sysmon",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
network where host.os.type in ("macos", "windows") and dns.question.name != null and
(
  process.name : ("MSBuild.exe", "mshta.exe", "wscript.exe", "powershell.exe", "pwsh.exe", "msiexec.exe", "rundll32.exe",
  "bitsadmin.exe", "InstallUtil.exe", "RegAsm.exe", "vbc.exe", "RegSvcs.exe", "regsvr32.exe", "dllhost.exe",
  "node.exe", "javaw.exe", "java.exe", "*.pif", "*.com", "python*", "osascript", "Script Editor", "curl", "curl.exe", "deno", 
  "deno.exe", "node", "bun", "bun.exe") or

  ?process.code_signature.subject_name : ("AutoIt Consulting Ltd", "OpenJS Foundation", "Python Software Foundation") or

  (
    process.executable : ("?:\\Users\\*.exe", "?:\\ProgramData\\*.exe", "/Users/Shared/*", "/Library/WebServer/*", 
                          "/Users/*/Library/WebServer/*", "/Library/Graphics/*", "/Users/*/Library/Graphics/*", "/Library/Fonts/*", 
                          "/Users/*/Library/Fonts/*", "/private/var/root/Library/HTTPStorages/*", "/tmp/*", "/var/tmp/*", "/private/tmp/*") and
    (?process.code_signature.trusted == false or ?process.code_signature.exists == false)
  )
 ) and
    dns.question.name : (
    // Major LLM APIs
    "api.openai.com",
    "*.openai.azure.com",
    "api.anthropic.com",
    "api.mistral.ai",
    "api.cohere.ai",
    "api.ai21.com",
    "api.groq.com",
    "api.perplexity.ai",
    "api.x.ai",
    "api.deepseek.com",
    "api.gemini.google.com",
    "generativelanguage.googleapis.com",
    "api.azure.com",
    "api.bedrock.aws",
    "bedrock-runtime.*.amazonaws.com",

    // Hugging Face & other ML infra
    "api-inference.huggingface.co",
    "inference-endpoint.huggingface.cloud",
    "router.huggingface.co",
    "*.hf.space",
    "*.replicate.com",
    "api.replicate.com",
    "api.runpod.ai",
    "*.runpod.io",
    "api.modal.com",
    "*.forefront.ai",

    "api.arcee.ai",
    "api.sambanova.ai",
    "chatapi.akash.network",
    "api.reka.ai",
    "api.cerebras.ai",
    "api.morphllm.com",
    "openrouter.ai",
    "api.moonshot.cn",
    "api.moonshot.ai",
    "api.z.ai",
    "api.inference.wandb.ai",
    "trace.wandb.ai",
    "api.bfl.ai",
    "api.eu.bfl.ai",
    "api.us.bfl.ai",
    "api.ionstream.ai",
    "api.minimax.io",
    "api.minimaxi.com",
    "api.stepfun.ai",
    "api.stepfun.com",
    "api.featherless.ai",
    "api.intelligence.io.solutions",
    "api.fireworks.ai",
    "inference.baseten.co",
    "api.baseten.co",
    "api.gmi-serving.com",
    "api.ncompass.tech",
    "api.nextbit256.com",
    "api.hyperbolic.xyz",
    "neuro.mancer.tech",
    "managed-inference-api-proxy.crusoecloud.com",
    "api.crusoe.ai",
    "api.avian.io",
    "api.siliconflow.cn",
    "api.totalgpt.ai",
    "switchpoint.dev",
    "api.novita.ai",
    "api.inflection.ai",
    "api.wavespeed.ai",
    "api.cloud.mara.com",
    "api.inference.net",
    "api.deepinfra.com",
    "api.xiaomimimo.com",
    "dashscope.aliyuncs.com",
    "dashscope-intl.aliyuncs.com",
    "dashscope-us.aliyuncs.com",
    "integrate.api.nvidia.com",
    "api.inceptionlabs.ai",
    "api.friendli.ai",
    "external.api.recraft.ai",
    "api.cloudflare.com",
    "gateway.ai.cloudflare.com",
    "api.studio.nebius.ai",
    "api.tokenfactory.nebius.com",
    "api.aionlabs.ai",
    "api.relace.run",
    "instantapply.endpoint.relace.run",
    "ranker.endpoint.relace.run",
    "embeddings.endpoint.relace.run",
    "console-api.inference.ai",
    "api.parasail.io",
    "api.redpill.ai",
    "api.modular.com",
    "ark.cn-beijing.volces.com",
    "ark.ap-southeast.bytepluses.com",
    "ai2endpoints.cirrascale.ai",
    "aisuite.cirrascale.com",
    "api.clarifai.com",
    "api.venice.ai",
    "api.atlascloud.ai",
    "wanqing.streamlakeapi.com",
    "api.ambient.xyz",
    "api.upstage.ai",
    "api.together.xyz",
    "api.inceptron.io",
    "chutes.ai",
    "aiplatform.googleapis.com",
    "portal.nousresearch.com",
    "inference-api.nousresearch.com",
    "api.githubcopilot.com",
    "ai-gateway.vercel.sh",
    "opencode.ai",
    "api.kilo.ai",
    "qianfan.baidubce.com",
    "hunyuan.tencentcloudapi.com",
    "open.bigmodel.cn",
    "spark-api-open.xf-yun.com",
    "api.sensenova.cn",
    "api.baichuan-ai.com",
    "api-inference.modelscope.cn",
    "api.lingyiwanwu.com",
    "api.360.cn",

    // Consumer-facing AI chat portals
    "chat.openai.com",
    "chatgpt.com",
    "copilot.microsoft.com",
    "bard.google.com",
    "gemini.google.com",
    "claude.ai",
    "perplexity.ai",
    "poe.com",
    "chat.forefront.ai",
    "chat.deepseek.com",

    // OpenClaw
    "openclaw.ai"
  ) and

  not process.executable : (
          "?:\\Program Files\\*.exe",
          "?:\\Program Files (x86)\\*.exe",
          "?:\\Windows\\System32\\svchost.exe",
          "?:\\Windows\\SystemApps\\Microsoft.LockApp_*\\LockApp.exe",
          "?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe",
          "?:\\Users\\*\\AppData\\Local\\BraveSoftware\\*\\Application\\brave.exe",
          "?:\\Users\\*\\AppData\\Local\\Vivaldi\\Application\\vivaldi.exe",
          "?:\\Users\\*\\AppData\\Local\\Programs\\Opera*\\opera.exe",
          "?:\\Users\\*\\AppData\\Local\\Programs\\Fiddler\\Fiddler.exe"
        ) and
    not (?process.code_signature.trusted == true and
         ?process.code_signature.subject_name : ("Anthropic, PBC", "Google LLC", "Mozilla Corporation", "Brave Software, Inc.", "Island Technology Inc.", "Opera Norway AS",
                                                  "OpenJS Foundation", "Developer ID Application: Node.js Foundation (HX7739G8FX)"))
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1102"
name = "Web Service"
reference = "https://attack.mitre.org/techniques/T1102/"
[[rule.threat.technique.subtechnique]]
id = "T1102.002"
name = "Bidirectional Communication"
reference = "https://attack.mitre.org/techniques/T1102/002/"



[rule.threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[metadata]
creation_date = "2023/04/05"
integration = ["cloud_defend"]
maturity = "production"
min_stack_comments = "Defend for Containers integration was re-introduced in 9.3.0"
min_stack_version = "9.3.0"
updated_date = "2026/01/15"

[rule]
author = ["Elastic"]
description = """
Generates a detection alert each time a 'Container Workload Protection' alert is received. Enabling this rule allows you
to immediately begin triaging and investigating these alerts.
"""
enabled = true
from = "now-10m"
index = ["logs-cloud_defend.alerts-*"]
language = "kuery"
license = "Elastic License v2"
max_signals = 1000
name = "Container Workload Protection"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Container Workload Protection

Container Workload Protection is crucial for securing containerized environments by monitoring and defending against threats. Adversaries may exploit vulnerabilities in container orchestration or escape isolation to access host systems. The detection rule leverages alerts from cloud defense modules, focusing on suspicious activities within container domains, enabling timely triage and investigation of potential security incidents.

### Possible investigation steps

- Review the alert details to confirm it matches the query criteria, specifically checking for event.kind:alert and event.module:cloud_defend.
- Examine the context of the alert to identify any suspicious activities or anomalies within the container environment.
- Investigate the source and destination of the alert to determine if there are any unauthorized access attempts or lateral movement within the container infrastructure.
- Check for any recent changes or updates in the container orchestration system that might have introduced vulnerabilities.
- Correlate the alert with other security events or logs to identify patterns or repeated attempts that could indicate a larger attack campaign.
- Assess the impact of the alert on the containerized environment and determine if any immediate remediation actions are necessary to protect the host systems.

### False positive analysis

- Alerts triggered by routine maintenance tasks in container environments can be false positives. Users can create exceptions for known maintenance activities to reduce unnecessary alerts.
- Automated deployment processes might generate alerts due to rapid changes in container states. Exclude these processes by identifying and whitelisting their specific event patterns.
- Frequent updates to container images can cause alerts. Implement rules to recognize and exclude these updates if they match expected patterns and sources.
- Legitimate administrative actions within container orchestration platforms may be flagged. Document and exclude these actions by correlating them with authorized user activities.
- Network scanning tools used for security assessments might trigger alerts. Ensure these tools are recognized and excluded by defining their IP ranges and expected behaviors.

### Response and remediation

- Isolate the affected container to prevent lateral movement and further exploitation. This can be done by stopping the container or disconnecting it from the network.
- Analyze the container's logs and configurations to identify any unauthorized changes or suspicious activities that align with the alert.
- Patch any identified vulnerabilities in the container image or orchestration platform to prevent similar exploits.
- Restore the container from a known good backup or rebuild it using a secure and updated image to ensure no residual threats remain.
- Implement network segmentation and access controls to limit the exposure of containerized environments to potential threats.
- Escalate the incident to the security operations team if the threat appears to have impacted the host system or other critical infrastructure.
- Enhance monitoring and alerting rules to detect similar suspicious activities in the future, ensuring timely response to potential threats."""
risk_score = 47
rule_id = "4b4e9c99-27ea-4621-95c8-82341bc6e512"
rule_name_override = "message"
setup = """## Setup
This rule is configured to generate a maximum of 1000 alerts per run. This is to ensure that it captures as many alerts as possible.

For information on troubleshooting the maximum alerts warning please refer to this [guide](https://www.elastic.co/guide/en/security/current/alerts-ui-monitor.html#troubleshoot-max-alerts)."""
severity = "medium"
tags = [
    "Data Source: Elastic Defend for Containers",
    "Domain: Container",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"
query = '''
event.kind:alert and event.module:cloud_defend
'''

[rule]
description = "Detects when Curl makes an outbound network connection to an FTP server (port 21) via a raw ip address."
id = "a702353c-bf41-4548-bb77-b6447384d3b8"
license = "Elastic License v2"
name = "Curl to FTP Server via Raw IP"
os_list = ["macos"]
version = "1.0.3"

query = '''
sequence by process.entity_id with maxspan=30s
[process where event.type == "start" and event.action == "exec" and process.name in ("curl", "nscurl")]
[network where event.type == "start" and destination.port == 21 and process.name in ("curl", "nscurl") and destination.domain == null]
'''

min_endpoint_version = "8.16.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "Effective_process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1105"
name = "Ingress Tool Transfer"
reference = "https://attack.mitre.org/techniques/T1105/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "8.16.0"

[metadata]
creation_date = "2026/01/26"
maturity = "production"
updated_date = "2026/03/09"

[rule]
author = ["Elastic"]
description = """
This rule correlates security alerts with processes exhibiting unusually high CPU utilization on the same host and process
ID within a short time window. This behavior may indicate malicious activity such as malware execution, cryptomining, exploit
payload execution, or abuse of system resources following initial compromise.
"""
from = "now-9m"
interval = "5m"
language = "esql"
license = "Elastic License v2"
name = "Detection Alert on a Process Exhibiting CPU Spike"
setup = """## Setup

This rule requires host CPU metrics collected via the Elastic Agent **System** integration.

### System Metrics Integration Setup
The System integration collects host-level metrics such as CPU usage, load, memory, and process statistics and sends them to Elasticsearch using Elastic Agent.

#### Prerequisite Requirements:
- Elastic Agent managed by Fleet
- A Fleet Server configured and reachable
  Refer to the Fleet Server setup guide:
  https://www.elastic.co/guide/en/fleet/current/fleet-server.html

#### The following steps should be executed in order to enable CPU metrics collection:
- Go to the Kibana home page and click **Add integrations**.
- In the search bar, enter **System** and select the **System** integration.
- Click **Add System**.
- Configure an integration name and optionally add a description.
- Under **Metrics**, ensure the following datasets are enabled:
  - `system.cpu`
  - `system.load` (optional but recommended)
  - `system.process` (optional, if process-level CPU is required)
- Review optional and advanced settings as needed.
- Add the integration to an existing agent policy or create a new agent policy.
- Deploy the Elastic Agent to the hosts from which CPU metrics should be collected.
- Click **Save and Continue** to finalize the setup.

#### Validation
After deployment, verify CPU metrics ingestion by confirming the presence of documents in:
- `metrics-system.cpu-*`
- `metrics-system.load-*` (if enabled)

For more details on the System integration and available metrics, refer to the documentation:
https://docs.elastic.co/integrations/system
"""
risk_score = 73
rule_id = "df9c0e92-5dee-4f1d-a760-3a5c039e4382"
severity = "high"
tags = [
    "Use Case: Threat Detection",
    "Rule Type: Higher-Order Rule",
    "Resources: Investigation Guide",
    "Domain: Endpoint", 
    "Tactic: Impact"
]
timestamp_override = "event.ingested"
type = "esql"

query = '''
FROM metrics-*, .alerts-security.* METADATA _index
| where not KQL("""kibana.alert.rule.tags : "Rule Type: Higher-Order Rule" """)
| eval
       // processes with more than 70% total CPU use
       cpu_metrics_pids = CASE(_index like ".ds-metrics-system.process-*" and system.process.cpu.total.norm.pct >= 0.7, process.pid, null),
       // any security alert with process.name and ID populated excluding low severity ones
       alerts_pids = CASE(_index like ".internal.alerts-security.*" and kibana.alert.rule.name is not null and process.name is not null and process.pid is not null and host.id is not null and kibana.alert.risk_score > 21, process.pid, null)
| stats pid_with_cpu_spike = COUNT_DISTINCT(cpu_metrics_pids), pid_with_alerts = COUNT_DISTINCT(alerts_pids),
        Esql.max_cpu_pct = MAX(system.process.cpu.total.norm.pct),
        Esql.alerts = VALUES(kibana.alert.rule.name),
        Esql.process_hash_sha256 = VALUES(process.hash.sha256),
        process_path = VALUES(process.executable),
        parent_process_path = VALUES(process.parent.executable),
        user_name = VALUES(user.name),
        host_name = VALUES(host.name),
        cmdline = VALUES(process.command_line) by process.pid, process.name, host.id
| where pid_with_cpu_spike > 0 and pid_with_alerts > 0
// populate fields to use in rule exceptions
| eval process.hash.sha256 = MV_FIRST(Esql.process_hash_sha256),
       process.executable = MV_FIRST(process_path),
       process.parent.executable = MV_FIRST(parent_process_path),
       process.command_line = MV_FIRST(cmdline),
       user.name = MV_FIRST(user_name),
       host.name = MV_FIRST(host_name)
| KEEP user.name, host.id, host.name, process.*, Esql.*
| where `process.executable` != "C:\\Program Files\\ESET\\ESET Security\\ekrn.exe" and
        `process.executable` != "C:\\Windows\\System32\\CompatTelRunner.exe" and
        `process.executable` != "C:\\Program Files\\UiPath\\Studio\\UiPath.ActivityCompiler.CommandLine.exe"
'''
note = """## Triage and analysis

### Investigating Detection Alert on a Process Exhibiting CPU Spike

This rule identifies processes that both triggered a security alert and exhibited unusually high CPU utilization on the
same host and process ID within a short time window. This combination may indicate malicious execution, resource abuse, or
post-compromise activity.

### Possible investigation steps
- Review the correlated alert(s) to understand why the process was flagged by Elastic Defend.
- Examine the process name, command line, and SHA-256 hash to determine whether the process is expected or known to be malicious.
- Validate the observed CPU usage and duration to determine whether the spike is abnormal for this process and host.
- Check for related process activity such as parent/child processes, suspicious process spawning, or privilege escalation attempts.
- Review additional host telemetry including:
  - Network connections initiated by the process
  - File creation or modification events
  - Persistence mechanisms (services, scheduled tasks, registry keys)
- Determine whether similar activity is observed on other hosts, which may indicate a broader compromise.

### False positive analysis
- Legitimate high-CPU processes such as software updates, backup agents, security scans, or system maintenance tasks.
- Resource-intensive but benign applications (e.g., compilers, video encoding, data processing jobs).
- Security tools or monitoring agents temporarily consuming high CPU.

### Response and remediation
- If malicious activity is confirmed, isolate the affected host to prevent further impact.
- Terminate the offending process if safe to do so.
- Remove any identified malicious binaries or artifacts and eliminate persistence mechanisms.
- Apply relevant patches or configuration changes to remediate the root cause.
- Monitor the environment for recurrence of similar high-CPU processes combined with security alerts.
- Escalate the incident if multiple hosts or indicators suggest coordinated or widespread activity."""

[[rule.threat]]
framework = "MITRE ATT&CK"

[rule.threat.tactic]
id = "TA0040"
name = "Impact"
reference = "https://attack.mitre.org/tactics/TA0040/"

[rule]
description = """
Identifies the execution of macOS built-in commands used to dump user account hashes. Adversaries may attempt to dump
credentials to obtain account login information in the form of a hash. These hashes can be cracked or leveraged for
lateral movement.
"""
id = "2ed766db-e0b0-4a07-8ec1-4e41dd406b64"
license = "Elastic License v2"
name = "Dumping Account Hashes via Built-In Commands"
os_list = ["macos"]
reference = [
    "https://apple.stackexchange.com/questions/186893/os-x-10-9-where-are-password-hashes-stored",
    "https://www.unix.com/man-page/osx/8/mkpassdb/",
]
version = "1.0.30"

query = '''
process where event.type == "start" and
 process.name in ("defaults", "mkpassdb") and process.args like~ ("ShadowHashData", "-dump")
'''

min_endpoint_version = "8.10.2"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1003"
name = "OS Credential Dumping"
reference = "https://attack.mitre.org/techniques/T1003/"


[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "8.10.2"

[rule]
description = """
Identifies instances where a dynamic library (dylib) is loaded by a process running from a suspicious or non-standard
path on macOS. Threat actors may abuse this technique by using compromised or malicious processes originating from
unusual locations to load dylibs for code injection, persistence, or privilege escalation. A dylib loaded from a
suspicious process path can indicate that the process itself is malicious, has been tampered with, or is attempting to
evade detection by operating from a non-standard location.
"""
id = "b97ecb91-b4bb-480e-a855-47f2a9ec107c"
license = "Elastic License v2"
name = "Dylib Loaded by Process in Suspicious Location"
os_list = ["macos"]
version = "1.0.24"

query = '''
sequence by process.entity_id with maxspan=10s
[process where event.type == "start" and event.action == "exec" and 
  process.executable like~ ("/var/tmp/*", 
                            "/var/lib/*", 
                            "/tmp/*", 
                            "/var/folders/*",
                            "/Library/Graphics/*",
                            "/Library/Containers/*", 
                            "/Library/Services/*",
                            "/var/root/*", 
                            "/private/var/root/*",
                            "/Library/WebServer/*", 
                            "/Library/Fonts/*")]
[library where event.action == "load" and 
  not dll.code_signature.trusted == true and not
  dll.path like ("/Library/Apple/*", "/private/var/db/oah/*", "/System/Library/*", "/private/var/root/Library/Developer/CoreSimulator/*", 
              "/private/var/root/Library/Caches/ms-playwright/*", "/Library/Developer/*", 
              "/usr/lib/libobjc-trampolines.dylib")]
'''

min_endpoint_version = "8.11.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1574"
name = "Hijack Execution Flow"
reference = "https://attack.mitre.org/techniques/T1574/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.11.0"

[metadata]
creation_date = "2025/12/17"
integration = ["azure"]
maturity = "production"
updated_date = "2026/04/10"

[rule]
author = ["Elastic"]
description = """
Identifies the first occurrence of an OAuth 2.0 authorization code grant flow for a specific combination of client
application, target resource, and user principal in Microsoft Entra ID. Developer tools like Azure CLI, Visual Studio
Code, and Azure PowerShell accessing Microsoft Graph or legacy Azure AD are flagged for infrequent or first time usage by a user.
Additionally, any FOCI (Family of Client IDs) application accessing the deprecated Windows Azure Active Directory for
the first time is flagged since this resource is rarely accessed legitimately. This pattern is indicative of OAuth
phishing attacks like ConsentFix, where attackers steal authorization codes and exchange them for tokens from attacker
controlled infrastructure.
"""
from = "now-9m"
index = ["filebeat-*", "logs-azure.signinlogs-*"]
language = "kuery"
license = "Elastic License v2"
name = "Entra ID OAuth Authorization Code Grant for Unusual User, App, and Resource"
note = """## Triage and analysis

### Investigating Entra ID OAuth Authorization Code Grant for Unusual User, App, and Resource

This New Terms rule detects the first occurrence of an OAuth 2.0 authorization code grant flow for a specific combination of client application ID, target resource ID, and user principal within the last 14 days. When a user has never used a particular app+resource combination and it involves FOCI applications or legacy Azure AD, this may indicate OAuth phishing attacks like ConsentFix.

The rule is particularly effective at catching attacks where adversaries use stolen OAuth codes with first-party apps to access resources the victim has never accessed before. For example, if a non-developer suddenly uses Azure CLI to access legacy AAD for the first time, this is highly suspicious regardless of other factors.

### Possible investigation steps

- Review `azure.signinlogs.properties.user_principal_name` to identify the affected user and determine if they are a developer who would legitimately use these tools.
- Check `azure.signinlogs.properties.app_display_name` to confirm which application was used. Azure CLI or PowerShell access by non-technical users is suspicious.
- Examine `azure.signinlogs.properties.resource_id` to identify the target resource. Legacy AAD (`00000002-0000-0000-c000-000000000000`) access is unusual for most users.
- Analyze `source.ip` and `source.geo.*` for geographic anomalies. ConsentFix attackers exchange codes from different IPs than the victim.
- Review `azure.signinlogs.properties.is_interactive` - if this is a non-interactive sign-in shortly after an interactive one from a different IP, it indicates token replay.
- Correlate with other sign-in events using `azure.signinlogs.properties.session_id` to identify the full OAuth flow sequence.
- Pivot to `azure.graphactivitylogs` to search for subsequent Graph API or AAD API activity from unusual locations.
- Check `azure.auditlogs` for device registration events around the same timeframe.

### False positive analysis

- Developers or IT administrators legitimately using Azure CLI, PowerShell, or VS Code for the first time to access specific resources.
- Users onboarding to new development environments or receiving new tooling.
- Automation scripts that run with user-delegated permissions for the first time.
- Consider the user's role and typical activity patterns when evaluating alerts.

### Response and remediation

- Contact the user to confirm if they initiated the OAuth flow and used the detected application.
- If unauthorized, immediately revoke all refresh tokens for the user via Microsoft Entra ID.
- Review recent activity from the same `session_id` for signs of data access or enumeration.
- Block the source IP if confirmed malicious.
- Implement Conditional Access policies to restrict OAuth flows for these applications to compliant devices.
- Educate users about OAuth phishing and the risks of pasting authorization codes.
"""
references = [
    "https://pushsecurity.com/blog/consentfix",
    "https://www.volexity.com/blog/2025/04/22/phishing-for-codes-russian-threat-actors-target-microsoft-365-oauth-workflows/",
    "https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-auth-code-flow",
    "https://github.com/secureworks/family-of-client-ids-research",
]
risk_score = 47
rule_id = "c8e5f6a2-1234-4d5e-9f8a-b7c6d5e4f3a2"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Domain: Identity",
    "Data Source: Azure",
    "Data Source: Microsoft Entra ID",
    "Data Source: Microsoft Entra ID Sign-in Logs",
    "Use Case: Identity and Access Audit",
    "Use Case: Threat Detection",
    "Tactic: Initial Access",
    "Tactic: Credential Access",
    "Resources: Investigation Guide",

]
timestamp_override = "event.ingested"
type = "new_terms"

query = '''
data_stream.dataset: "azure.signinlogs" and
    event.outcome: "success" and
    azure.signinlogs.properties.user_type: "Member" and
    (
        (
            azure.signinlogs.properties.app_id: (
                "04b07795-8ddb-461a-bbee-02f9e1bf7b46" or
                "aebc6443-996d-45c2-90f0-388ff96faa56" or
                "1950a258-227b-4e31-a9cf-717495945fc2"
            ) and
            azure.signinlogs.properties.resource_id: (
                "00000002-0000-0000-c000-000000000000" or
                "00000003-0000-0000-c000-000000000000"
            )
        ) or
        (
            azure.signinlogs.properties.app_id: (
                "00b41c95-dab0-4487-9791-b9d2c32c80f2" or
                "1fec8e78-bce4-4aaf-ab1b-5451cc387264" or
                "26a7ee05-5602-4d76-a7ba-eae8b7b67941" or
                "27922004-5251-4030-b22d-91ecd9a37ea4" or
                "4813382a-8fa7-425e-ab75-3b753aab3abb" or
                "ab9b8c07-8f02-4f72-87fa-80105867a763" or
                "872cd9fa-d31f-45e0-9eab-6e460a02d1f1" or
                "af124e86-4e96-495a-b70a-90f90ab96707" or
                "2d7f3606-b07d-41d1-b9d2-0d0c9296a6e8" or
                "844cca35-0656-46ce-b636-13f48b0eecbd" or
                "87749df4-7ccf-48f8-aa87-704bad0e0e16" or
                "cf36b471-5b44-428c-9ce7-313bf84528de" or
                "0ec893e0-5785-4de6-99da-4ed124e5296c" or
                "22098786-6e16-43cc-a27d-191a01a1e3b5" or
                "4e291c71-d680-4d0e-9640-0a3358e31177" or
                "57336123-6e14-4acc-8dcf-287b6088aa28" or
                "57fcbcfa-7cee-4eb1-8b25-12d2030b4ee0" or
                "66375f6b-983f-4c2c-9701-d680650f588f" or
                "a40d7d7d-59aa-447e-a655-679a4107e548" or
                "a569458c-7f2b-45cb-bab9-b7dee514d112" or
                "b26aadf8-566f-4478-926f-589f601d9c74" or
                "c0d2a505-13b8-4ae0-aa9e-cddd5eab0b12" or
                "d326c1ce-6cc6-4de2-bebc-4591e5e13ef0" or
                "e9c51622-460d-4d3d-952d-966a5b1da34c" or
                "eb539595-3fe1-474e-9c1d-feb3625d1be5" or
                "ecd6b820-32c2-49b6-98a6-444530e5a77a" or
                "f05ff7c9-f75a-4acd-a3b5-f4b6a870245d" or
                "f44b1140-bc5e-48c6-8dc0-5cf5a53c0e34" or
                "be1918be-3fe3-4be9-b32b-b542fc27f02e" or
                "cab96880-db5b-4e15-90a7-f3f1d62ffe39" or
                "d7b530a4-7680-4c23-a8bf-c52c121d2e87" or
                "dd47d17a-3194-4d86-bfd5-c6ae6f5651e3" or
                "e9b154d0-7658-433b-bb25-6b8e0a8a7c59"
            ) and
            azure.signinlogs.properties.resource_id: "00000002-0000-0000-c000-000000000000"
        )
    )
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"

[[rule.threat.technique.subtechnique]]
id = "T1078.004"
name = "Cloud Accounts"
reference = "https://attack.mitre.org/techniques/T1078/004/"

[[rule.threat.technique]]
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"

[[rule.threat.technique.subtechnique]]
id = "T1566.002"
name = "Spearphishing Link"
reference = "https://attack.mitre.org/techniques/T1566/002/"

[[rule.threat.technique]]
id = "T1199"
name = "Trusted Relationship"
reference = "https://attack.mitre.org/techniques/T1199/"

[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1528"
name = "Steal Application Access Token"
reference = "https://attack.mitre.org/techniques/T1528/"

[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1550"
name = "Use Alternate Authentication Material"
reference = "https://attack.mitre.org/techniques/T1550/"

[[rule.threat.technique.subtechnique]]
id = "T1550.001"
name = "Application Access Token"
reference = "https://attack.mitre.org/techniques/T1550/001/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[rule.investigation_fields]
field_names = [
    "@timestamp",
    "azure.signinlogs.properties.user_principal_name",
    "azure.signinlogs.properties.app_id",
    "azure.signinlogs.properties.app_display_name",
    "azure.signinlogs.properties.resource_id",
    "azure.signinlogs.properties.resource_display_name",
    "azure.signinlogs.properties.is_interactive",
    "azure.signinlogs.properties.session_id",
    "azure.signinlogs.properties.incoming_token_type",
    "source.ip",
    "source.geo.country_name",
    "source.geo.city_name",
    "user_agent.original",
]

[rule.new_terms]
field = "new_terms_fields"
value = [
    "azure.signinlogs.properties.user_principal_name",
    "azure.signinlogs.properties.app_id",
    "azure.signinlogs.properties.resource_id",
]
[[rule.new_terms.history_window_start]]
field = "history_window_start"
value = "now-7d"

[metadata]
creation_date = "2025/04/30"
integration = ["azure"]
maturity = "production"
updated_date = "2026/04/10"

[rule]
author = ["Elastic"]
description = """
Identifies separate OAuth authorization flows in Microsoft Entra ID where the same user principal and session ID are
observed across multiple IP addresses within a 5-minute window. These flows involve the Microsoft Authentication Broker
(MAB) as the client application and the Device Registration Service (DRS) as the target resource. This pattern is highly
indicative of OAuth phishing activity, where an adversary crafts a legitimate Microsoft login URL to trick a user into
completing authentication and sharing the resulting authorization code, which is then exchanged for an access and
refresh token by the attacker.
"""
false_positives = [
    """
    Legitimate device registrations using Microsoft Authentication Broker may occur during corporate enrollment
    scenarios or bulk provisioning, but it is uncommon for multiple source IPs to register the same identity across
    Microsoft Graph, Device Registration Service (DRS), and Azure Active Directory (AAD) in a short time span.
    """,
]
from = "now-61m"
interval = "60m"
language = "esql"
license = "Elastic License v2"
name = "Entra ID OAuth Flow by Microsoft Authentication Broker to Device Registration Service (DRS)"
note = """## Triage and analysis

### Investigating Entra ID OAuth Flow by Microsoft Authentication Broker to Device Registration Service (DRS)

This rule identifies potential OAuth phishing behavior in Microsoft Entra ID where two OAuth authorization flows are observed in quick succession, sharing the same user principal and session ID but originating from different IP addresses. The client application is the Microsoft Authentication Broker, and the target resource is the Device Registration Service (DRS). This pattern is indicative of adversaries attempting to phish targets for OAuth sessions by tricking users into authenticating through a crafted URL, which then allows the attacker to obtain an authorization code and exchange it for access and refresh tokens.

### Possible Investigation Steps:

- `target`: The user principal name targeted by the authentication broker. Investigate whether this user has recently registered a device, signed in from new IPs, or had password resets or MFA changes.
- `session_id`: Used to correlate all events in the OAuth flow. All sign-ins in the alert share the same session, suggesting shared or hijacked state.
- `unique_token_id`: Lists tokens generated in the flow. If multiple IDs exist in the same session, this indicates token issuance from different locations.
- `source_ip`, `city_name`, `country_name`, `region_name`: Review the IPs and geolocations involved. A mismatch in geographic origin within minutes can signal adversary involvement.
- `user_agent`: Conflicting user agents (e.g., `python-requests` and `Chrome`) suggest one leg of the session was scripted or automated.
- `os`: If multiple operating systems are observed in the same short session (e.g., macOS and Windows), this may suggest activity from different environments.
- `incoming_token_type`: Look for values like `"none"` or `"refreshToken"` that can indicate abnormal or re-authenticated activity.
- `token_session_status`: A value of `"unbound"` means the issued token is not tied to a device or CAE session, making it reusable from another IP.
- `conditional_access_status`: If this is `"notApplied"`, it may indicate that expected access policies were not enforced.
- `auth_count`: Number of events in the session. More than one indicates the session was reused within the time window.
- `target_time_window`: Use this to pivot into raw sign-in logs to review the exact sequence and timing of the activity.
- Search `azure.auditlogs` for any device join or registration activity around the `target_time_window`.
- Review `azure.identityprotection` logs for anonymized IPs, impossible travel, or token replay alerts.
- Search for other activity from the same IPs across all users to identify horizontal movement.

### False Positive Analysis

- A legitimate device join from a user switching networks (e.g., mobile hotspot to Wi-Fi) could explain multi-IP usage.
- Some identity management agents or EDR tools may use MAB for background device registration flows.
- Developers or IT administrators may access DRS across environments when testing.

### Response and Remediation

- If confirmed unauthorized, revoke all refresh tokens for the user and disable any suspicious registered devices.
- Notify the user and verify if the authentication or device join was expected.
- Review Conditional Access policies for the Microsoft Authentication Broker (`29d9ed98-a469-4536-ade2-f981bc1d605e`) to ensure enforcement of MFA and device trust.
- Consider restricting token-based reauthentication from anonymized infrastructure or unusual user agents.
- Continue monitoring for follow-on activity, such as privilege escalation, token misuse, or lateral movement.
"""
references = [
    "https://www.volexity.com/blog/2025/04/22/phishing-for-codes-russian-threat-actors-target-microsoft-365-oauth-workflows/",
    "https://github.com/dirkjanm/ROADtools",
    "https://dirkjanm.io/phishing-for-microsoft-entra-primary-refresh-tokens/",
]
risk_score = 73
rule_id = "375132c6-25d5-11f0-8745-f661ea17fbcd"
setup = """#### Required Microsoft Entra ID Sign-In Logs
This rule requires the Microsoft Entra ID Sign-In Logs integration be enabled and configured to collect sign-in logs. In Entra ID, sign-in logs must be enabled and streaming to the Event Hub used for the Azure integration.
"""
severity = "high"
tags = [
    "Domain: Cloud",
    "Domain: Identity",
    "Data Source: Azure",
    "Data Source: Entra ID",
    "Data Source: Entra ID Sign-in Logs",
    "Use Case: Identity and Access Audit",
    "Use Case: Threat Detection",
    "Resources: Investigation Guide",
    "Tactic: Initial Access",
]
timestamp_override = "event.ingested"
type = "esql"

query = '''
from logs-azure.signinlogs-* metadata _id, _version, _index
| where
    data_stream.dataset == "azure.signinlogs" and
    event.outcome == "success" and
    azure.signinlogs.properties.user_type == "Member" and
    azure.signinlogs.identity is not null and
    azure.signinlogs.properties.user_principal_name is not null and
    source.address is not null and
    azure.signinlogs.properties.app_id == "29d9ed98-a469-4536-ade2-f981bc1d605e" and  // MAB
    azure.signinlogs.properties.resource_id == "01cb2876-7ebd-4aa4-9cc9-d28bd4d359a9"  // DRS

| eval
    Esql.time_window_date_trunc = date_trunc(30 minutes, @timestamp),
    Esql.azure_signinlogs_properties_session_id = azure.signinlogs.properties.session_id,
    Esql.is_browser_case = case(
        to_lower(azure.signinlogs.properties.device_detail.browser) rlike "(chrome|firefox|edge|safari).*", 1, 0
    )

| stats
    Esql_priv.azure_signinlogs_properties_user_display_name_values = values(azure.signinlogs.properties.user_display_name),
    Esql_priv.azure_signinlogs_properties_user_principal_name_values = values(azure.signinlogs.properties.user_principal_name),
    Esql.azure_signinlogs_properties_session_id_values = values(azure.signinlogs.properties.session_id),
    Esql.azure_signinlogs_properties_unique_token_identifier_values = values(azure.signinlogs.properties.unique_token_identifier),

    Esql.source_geo_city_name_values = values(source.geo.city_name),
    Esql.source_geo_country_name_values = values(source.geo.country_name),
    Esql.source_geo_region_name_values = values(source.geo.region_name),
    Esql.source_address_values = values(source.address),
    Esql.source_address_count_distinct = count_distinct(source.address),
    Esql.source_as_organization_name_values = values(source.`as`.organization.name),

    Esql.azure_signinlogs_properties_authentication_protocol_values = values(azure.signinlogs.properties.authentication_protocol),
    Esql.azure_signinlogs_properties_authentication_requirement_values = values(azure.signinlogs.properties.authentication_requirement),
    Esql.azure_signinlogs_properties_is_interactive_values = values(azure.signinlogs.properties.is_interactive),

    Esql.azure_signinlogs_properties_incoming_token_type_values = values(azure.signinlogs.properties.incoming_token_type),
    Esql.azure_signinlogs_properties_token_protection_status_details_sign_in_session_status_values = values(azure.signinlogs.properties.token_protection_status_details.sign_in_session_status),
    Esql.azure_signinlogs_properties_session_id_count_distinct = count_distinct(azure.signinlogs.properties.session_id),
    Esql.azure_signinlogs_properties_app_display_name_values = values(azure.signinlogs.properties.app_display_name),
    Esql.azure_signinlogs_properties_app_id_values = values(azure.signinlogs.properties.app_id),
    Esql.azure_signinlogs_properties_resource_id_values = values(azure.signinlogs.properties.resource_id),
    Esql.azure_signinlogs_properties_resource_display_name_values = values(azure.signinlogs.properties.resource_display_name),

    Esql.azure_signinlogs_properties_app_owner_tenant_id_values = values(azure.signinlogs.properties.app_owner_tenant_id),
    Esql.azure_signinlogs_properties_resource_owner_tenant_id_values = values(azure.signinlogs.properties.resource_owner_tenant_id),

    Esql.azure_signinlogs_properties_conditional_access_status_values = values(azure.signinlogs.properties.conditional_access_status),
    Esql.azure_signinlogs_properties_risk_state_values = values(azure.signinlogs.properties.risk_state),
    Esql.azure_signinlogs_properties_risk_level_aggregated_values = values(azure.signinlogs.properties.risk_level_aggregated),

    Esql.azure_signinlogs_properties_device_detail_browser_values = values(azure.signinlogs.properties.device_detail.browser),
    Esql.azure_signinlogs_properties_device_detail_operating_system_values = values(azure.signinlogs.properties.device_detail.operating_system),
    Esql.user_agent_original_values = values(user_agent.original),
    Esql.is_browser_case_max = max(Esql.is_browser_case),

    Esql.event_count = count(*)
  by
    Esql.time_window_date_trunc,
    azure.signinlogs.properties.user_principal_name,
    azure.signinlogs.properties.session_id

| keep
    Esql.time_window_date_trunc,
    Esql_priv.azure_signinlogs_properties_user_display_name_values,
    Esql_priv.azure_signinlogs_properties_user_principal_name_values,
    Esql.azure_signinlogs_properties_session_id_values,
    Esql.azure_signinlogs_properties_unique_token_identifier_values,
    Esql.source_geo_city_name_values,
    Esql.source_geo_country_name_values,
    Esql.source_geo_region_name_values,
    Esql.source_address_values,
    Esql.source_address_count_distinct,
    Esql.source_as_organization_name_values,
    Esql.azure_signinlogs_properties_authentication_protocol_values,
    Esql.azure_signinlogs_properties_authentication_requirement_values,
    Esql.azure_signinlogs_properties_is_interactive_values,
    Esql.azure_signinlogs_properties_incoming_token_type_values,
    Esql.azure_signinlogs_properties_token_protection_status_details_sign_in_session_status_values,
    Esql.azure_signinlogs_properties_session_id_count_distinct,
    Esql.azure_signinlogs_properties_app_display_name_values,
    Esql.azure_signinlogs_properties_app_id_values,
    Esql.azure_signinlogs_properties_resource_id_values,
    Esql.azure_signinlogs_properties_resource_display_name_values,
    Esql.azure_signinlogs_properties_app_owner_tenant_id_values,
    Esql.azure_signinlogs_properties_resource_owner_tenant_id_values,
    Esql.azure_signinlogs_properties_conditional_access_status_values,
    Esql.azure_signinlogs_properties_risk_state_values,
    Esql.azure_signinlogs_properties_risk_level_aggregated_values,
    Esql.azure_signinlogs_properties_device_detail_browser_values,
    Esql.azure_signinlogs_properties_device_detail_operating_system_values,
    Esql.user_agent_original_values,
    Esql.is_browser_case_max,
    Esql.event_count

| where
    Esql.source_address_count_distinct >= 2 and
    Esql.azure_signinlogs_properties_session_id_count_distinct == 1 and
    Esql.is_browser_case_max >= 1 and
    Esql.event_count >= 2
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"

[[rule.threat.technique.subtechnique]]
id = "T1078.004"
name = "Cloud Accounts"
reference = "https://attack.mitre.org/techniques/T1078/004/"

[[rule.threat.technique]]
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"

[[rule.threat.technique.subtechnique]]
id = "T1566.002"
name = "Spearphishing Link"
reference = "https://attack.mitre.org/techniques/T1566/002/"

[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1528"
name = "Steal Application Access Token"
reference = "https://attack.mitre.org/techniques/T1528/"

[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1550"
name = "Use Alternate Authentication Material"
reference = "https://attack.mitre.org/techniques/T1550/"

[[rule.threat.technique.subtechnique]]
id = "T1550.001"
name = "Application Access Token"
reference = "https://attack.mitre.org/techniques/T1550/001/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[metadata]
creation_date = "2023/01/11"
integration = ["windows"]
maturity = "production"
updated_date = "2026/03/30"

[rule]
author = ["Elastic"]
description = """
Detects PowerShell script block content that creates Exchange mailbox export requests via New-MailboxExportRequest,
commonly writing PST files. Adversaries can abuse export requests to collect and stage email content for exfiltration.
"""
false_positives = ["Legitimate exchange system administration activity."]
from = "now-9m"
index = ["winlogbeat-*", "logs-windows.powershell*"]
language = "kuery"
license = "Elastic License v2"
name = "Exchange Mailbox Export via PowerShell"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Exchange Mailbox Export via PowerShell

This alert indicates PowerShell script block content associated with creation of an Exchange mailbox export request. Mailbox exports can produce PST files and may represent sensitive email collection and staging for later access or exfiltration. Prioritize understanding who initiated the activity, which mailbox(es) were targeted, where the output was intended to be written, and whether the activity aligns with approved administrative workflows.

#### Key alert fields to review

- `user.name`, `user.domain`, `user.id`: Account execution context for correlation, prioritization, and scoping.
- `host.name`, `host.id`: Host execution context for correlation, prioritization, and scoping.
- `powershell.file.script_block_text`: Script block content that matched the detection logic.
- `powershell.file.script_block_id`, `powershell.sequence`, `powershell.total`: Script block metadata to pivot to other fragments or reconstruct full script content when split across multiple events.
- `file.path`, `file.directory`, `file.name`: File-origin context when the script block is sourced from an on-disk file.
- `powershell.file.script_block_length`: Script block length (size) context.

#### Possible investigation steps

- Validate what the script block is attempting to do using `powershell.file.script_block_text`:
  - Identify the mailbox target(s). Look for explicit `-Mailbox` values, mailbox identifiers, or mailbox enumeration logic (for example, use of `Get-Mailbox` as an input source).
  - Identify the intended export destination from `-FilePath`. Note whether the path appears to be a local path or a network location, and whether the naming pattern suggests a single mailbox export or bulk export activity.
  - Note whether the content suggests automation (loops, iteration over multiple mailboxes, variable-driven file paths) versus a single interactive export request.
- Reconstruct full script block content when fragmented:
  - If `powershell.file.script_block_text` appears truncated or incomplete, group related events by `powershell.file.script_block_id` and order by `powershell.sequence` up to `powershell.total` to rebuild the full script before assessing intent.
  - Pivot to other script blocks from the same `user.id` and `host.id` near `@timestamp` to capture supporting context (variable definitions, functions, or preceding logic that populates mailbox or file path parameters).
- Establish execution context and initiating source:
  - Use `host.name` and `host.id` to determine whether the activity originated from an expected Exchange management host (for example, an Exchange server or approved administrative workstation) or from an unexpected endpoint.
  - Use `user.domain`, `user.name`, and `user.id` to determine whether the initiating account is expected to perform mailbox export operations (administrator or approved automation account) and whether the timing aligns with known operational windows.
  - Use `process.pid` and `host.id` to correlate with process execution telemetry and determine how PowerShell was launched (interactive session vs automated execution) and whether there is an unusual parent process lineage for administrative activity.
  - If `file.path` or `file.name` is present, treat the referenced script as a key artifact:
    - Determine whether the path and file name match known administrative tooling or expected automation locations.
    - If the script is not recognized, preserve it for analysis and assess whether it contains additional collection, staging, or cleanup logic beyond the export request.
- Scope the activity across users, hosts, and time:
  - Identify other `powershell.file.script_block_id` values associated with the same `user.id` or `host.id` to determine whether the export activity is part of a larger PowerShell workflow.
  - Review whether multiple distinct `process.pid` values are associated with similar export activity for the same user, which may indicate multiple sessions or parallel execution.
- Assess potential impact and staging indicators:
  - If an export destination path is identifiable in `powershell.file.script_block_text`, correlate with file activity on the relevant host(s) to determine whether a PST file was created, modified, accessed, moved, or archived after `@timestamp`.
  - Correlate with network telemetry for `host.id` around `@timestamp` to identify access to the export destination location and any subsequent outbound transfers that could indicate staging or exfiltration.
  - Review authentication activity associated with `user.id` and the involved `host.id` around `@timestamp` for anomalies such as unusual logon sources, new sessions, or activity outside normal administrative patterns.
- Preserve evidence for follow-on analysis:
  - Record the reconstructed script content, `powershell.file.script_block_id`, and the full `powershell.sequence`/`powershell.total` range used for reconstruction.
  - Capture the specific mailbox identifiers and destination paths observed in `powershell.file.script_block_text` to support scoping and data exposure assessment.

### False positive analysis

- Legitimate mailbox exports may occur for compliance, eDiscovery, user support, migrations, or incident response. Validate the presence of an authorized business request, ticket, or approved workflow that matches the timing and the scope of the export.
- Benign activity is more likely when:
  - The initiating `user.name` is a known Exchange administrator or authorized automation account in `user.domain`.
  - The `host.name` is an expected administrative host for Exchange management tasks.
  - The destination path referenced in `powershell.file.script_block_text` aligns with approved export storage locations and expected naming conventions.
- Activity is higher risk when it originates from an unexpected `host.name`, uses an unusual `user.name`, targets many mailboxes, or writes to atypical destinations.

### Response and remediation

- If the activity is unauthorized or cannot be validated:
  - Contain the initiating account (`user.id`/`user.name`) by disabling the account or removing access to mailbox export capabilities, and rotate credentials as appropriate.
  - Contain affected systems (`host.id`/`host.name`) based on scope and confidence. Isolate endpoints used for unexpected Exchange administrative actions to prevent further collection or staging.
  - Identify and secure any exported PST output referenced in `powershell.file.script_block_text`. Treat recovered PST files and scripts as sensitive evidence; restrict access and preserve copies for investigation.
  - Use approved administrative procedures to cancel or remove unauthorized export requests and prevent completion of in-progress exports.
- Conduct follow-on threat hunting and scoping:
  - Search for additional mailbox export activity by the same `user.id` and `host.id`, including repeated or bulk export patterns.
  - Review additional PowerShell script block activity for the same `powershell.file.script_block_id` and adjacent script blocks around `@timestamp` to identify related collection, staging, or cleanup actions.
- Reduce recurrence risk:
  - Apply least-privilege controls for accounts that can initiate mailbox exports and restrict where exports can be written.
  - Limit Exchange administrative actions to approved management hosts and monitored administrative workflows.
  - Enhance monitoring for repeated mailbox export requests, unusual export destinations, and suspicious PowerShell activity associated with the same users and hosts.
"""
references = [
    "https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/",
    "https://docs.microsoft.com/en-us/powershell/module/exchange/new-mailboxexportrequest?view=exchange-ps",
    "https://www.elastic.co/security-labs/siestagraph-new-implant-uncovered-in-asean-member-foreign-ministry",
]
risk_score = 47
rule_id = "54a81f68-5f2a-421e-8eed-f888278bb712"
setup = """## Setup

PowerShell Script Block Logging must be enabled to generate the events used by this rule (e.g., 4104).
Setup instructions: https://ela.st/powershell-logging-setup
"""
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Collection",
    "Resources: Investigation Guide",
    "Data Source: PowerShell Logs",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
event.category:process and host.os.type:windows and
powershell.file.script_block_text : "New-MailboxExportRequest" and
(
  powershell.file.script_block_text : ("-FilePath" or ".pst") and
  powershell.file.script_block_text : ("-Mailbox" or "Get-Mailbox" or "ExportToPSTFile" or "-Identity")
)
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1005"
name = "Data from Local System"
reference = "https://attack.mitre.org/techniques/T1005/"

[[rule.threat.technique]]
id = "T1074"
name = "Data Staged"
reference = "https://attack.mitre.org/techniques/T1074/"

[[rule.threat.technique.subtechnique]]
id = "T1074.001"
name = "Local Data Staging"
reference = "https://attack.mitre.org/techniques/T1074/001/"

[[rule.threat.technique]]
id = "T1114"
name = "Email Collection"
reference = "https://attack.mitre.org/techniques/T1114/"

[[rule.threat.technique.subtechnique]]
id = "T1114.001"
name = "Local Email Collection"
reference = "https://attack.mitre.org/techniques/T1114/001/"

[[rule.threat.technique.subtechnique]]
id = "T1114.002"
name = "Remote Email Collection"
reference = "https://attack.mitre.org/techniques/T1114/002/"

[rule.threat.tactic]
id = "TA0009"
name = "Collection"
reference = "https://attack.mitre.org/tactics/TA0009/"
[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user.id",
    "user.domain",
    "powershell.file.script_block_text",
    "powershell.file.script_block_id",
    "powershell.sequence",
    "powershell.total",
    "file.path",
    "file.directory",
    "file.name",
    "process.pid",
    "host.name",
    "host.id",
    "powershell.file.script_block_length"
]

[rule]
description = "Identifies the execution of a file written or modified by Microsoft Windows Script Host processes (cscript or wscript)."
id = "49e47c2a-307f-4591-939a-dfdae6e5156c"
license = "Elastic License v2"
name = "Execution of a File Written by Windows Script Host"
os_list = ["windows"]
version = "1.0.38"

query = '''
sequence with maxspan=5m
  [file where event.action != "deletion" and
   process.name : ("cscript.exe", "wscript.exe") and
   not file.path : ("?:\\Program Files (x86)\\*.exe", "?:\\Program Files\\*.exe")] by file.path
  [process where event.action == "start" and
   not process.Ext.token.integrity_level_name == "system" and
   not process.parent.executable : "?:\\Windows\\System32\\drvinst.exe" and
   not (process.code_signature.trusted == true and
        process.code_signature.subject_name :
                ("Microsoft *",
                 "ESET, spol. s r.o.",
                 "VORTECH SOLUTIONS PTY LTD",
                 "Western Union Holdings Inc.",
                 "KOBIL Systems GmbH")) and
   not (process.pe.original_file_name : "Packman.exe" and process.args : "checkCompileErrors=true") and
   not process.pe.original_file_name : ("CCCLauncher.exe", "Bginfo.exe") and
   not process.executable : ("?:\\Program Files (x86)\\*", "?:\\Program Files\\*") and
   not (process.pe.original_file_name == "cognosrcp.exe" and
        process.code_signature.subject_name == "IBM Canada Ltd." and process.code_signature.trusted == true) and
   not (process.code_signature.subject_name : ("The Qt Company Oy", "ci solution GmbH", "Spotify AB", "Nextech Systems, LLC") and 
        process.code_signature.trusted == true) and
   not process.hash.sha256 :
                   ("9c3b9f4d38e6c7a9614d99260078c8f05f8e187eb25a23f03ea53f0120179494",
                    "6c6c55cc9411700ad806ca9b2894fd339bfef23e1f836611c1d617485c13d91f",
                    "dd05bbbbb72b847b7e404a9011404ca058b9144b3a1648ce9cd4edd4868052dc",
                    "ebdef325ca2c3c6ded43b1e85263746719c609a9f8a0f43927764d80e92a865a")
   ] by process.executable
'''

min_endpoint_version = "7.15.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1
tree = true

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.005"
name = "Visual Basic"
reference = "https://attack.mitre.org/techniques/T1059/005/"

[[threat.technique.subtechnique]]
id = "T1059.007"
name = "JavaScript"
reference = "https://attack.mitre.org/techniques/T1059/007/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "7.15.0"