Elastic rules: 28

[metadata]
creation_date = "2024/09/09"
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender", "system", "crowdstrike"]
maturity = "production"
updated_date = "2026/05/04"

[rule]
author = ["Elastic"]
description = """
Detects the execution of the VScode portable binary with the tunnel command line option indicating an attempt to
establish a remote tunnel session to Github or a remote VScode instance.
"""
from = "now-9m"
index = [
    "endgame-*",
    "logs-crowdstrike.fdr*",
    "logs-endpoint.events.process-*",
    "logs-m365_defender.event-*",
    "logs-sentinel_one_cloud_funnel.*",
    "logs-system.security*",
    "logs-windows.sysmon_operational-*",
    "winlogbeat-*",
]
language = "eql"
license = "Elastic License v2"
name = "Attempt to Establish VScode Remote Tunnel"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Attempt to Establish VScode Remote Tunnel

Visual Studio Code (VScode) offers a remote tunnel feature enabling developers to connect to remote environments seamlessly. While beneficial for legitimate remote development, adversaries can exploit this to establish unauthorized access or control over systems. The detection rule identifies suspicious use of VScode's tunnel command, focusing on specific command-line arguments and process behaviors, to flag potential misuse indicative of command and control activities.

### Possible investigation steps

- Review the process details to confirm the presence of the "tunnel" argument in the command line, which indicates an attempt to establish a remote tunnel session.
- Check the parent process name to ensure it is not "Code.exe" when the process name is "code-tunnel.exe" with the "status" argument, as this is an exception in the rule.
- Investigate the origin of the process by examining the user account and machine from which the process was initiated to determine if it aligns with expected usage patterns.
- Analyze network logs to identify any unusual or unauthorized connections to GitHub or remote VScode instances that may suggest malicious activity.
- Correlate the event with other security alerts or logs from data sources like Elastic Endgame, Sysmon, or Microsoft Defender XDR to gather additional context on the activity.
- Assess the risk and impact by determining if the system or user account has been involved in previous suspicious activities or if there are any indicators of compromise.

### False positive analysis

- Legitimate remote development activities using VScode's tunnel feature may trigger the rule. Users can create exceptions for known developer machines or specific user accounts frequently using this feature for authorized purposes.
- Automated scripts or deployment tools that utilize VScode's remote tunnel for legitimate operations might be flagged. Consider excluding these processes by identifying their unique command-line arguments or parent processes.
- Scheduled tasks or system maintenance activities that involve VScode's remote capabilities could be misidentified as threats. Review and whitelist these tasks by their specific execution times or associated service accounts.
- Development environments that frequently update or test VScode extensions might inadvertently match the rule's criteria. Exclude these environments by setting up exceptions based on their network segments or IP addresses.
- Training or demonstration sessions using VScode's remote features for educational purposes can be mistaken for suspicious activity. Implement exclusions for these sessions by tagging them with specific event identifiers or user roles.

### Response and remediation

- Immediately isolate the affected system from the network to prevent further unauthorized access or data exfiltration.
- Terminate any suspicious VScode processes identified by the detection rule to halt potential command and control activities.
- Conduct a thorough review of system logs and process histories to identify any additional indicators of compromise or lateral movement attempts.
- Reset credentials and access tokens associated with the affected system and any connected services to mitigate unauthorized access.
- Restore the system from a known good backup if any unauthorized changes or malware are detected.
- Implement network segmentation to limit the ability of similar threats to spread across the environment.
- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if additional systems are affected."""
references = [
    "https://badoption.eu/blog/2023/01/31/code_c2.html",
    "https://code.visualstudio.com/docs/remote/tunnels",
]
risk_score = 47
rule_id = "0b96dfd8-5b8c-4485-9a1c-69ff7839786a"
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Command and Control",
    "Data Source: Elastic Endgame",
    "Data Source: Elastic Defend",
    "Data Source: Sysmon",
    "Data Source: SentinelOne",
    "Data Source: Microsoft Defender XDR",
    "Data Source: Windows Security Event Logs",
    "Data Source: Crowdstrike",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
process where host.os.type == "windows" and event.type == "start" and
  process.args : "tunnel" and
  (process.args : "--accept-server-license-terms" or
   process.name : "code*.exe" or
   ?process.code_signature.subject_name : "Microsoft Corporation" or
   process.executable : ("?:\\ProgramData\\*", "?:\\Users\\Public\\*", "?:\\windows\\debug\\*", 
                         "\\Device\\HarddiskVolume*\\Users\\Public\\*", "\\Device\\HarddiskVolume*\\ProgramData\\*",  "\\Device\\HarddiskVolume*\\windows\\debug\\*")) and
  not (process.name == "code-tunnel.exe" and process.args == "status" and process.parent.name == "Code.exe")
'''

setup = """## Setup

This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.

Setup instructions: https://ela.st/install-elastic-defend

### Additional data sources

This rule also supports the following third-party data sources. For setup instructions, refer to the links below:

- [CrowdStrike](https://ela.st/crowdstrike-integration)
- [Microsoft Defender XDR](https://ela.st/m365-defender)
- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
- [Sysmon Event ID 1 - Process Creation](https://ela.st/sysmon-event-1-setup)
- [Windows Process Creation Logs](https://ela.st/audit-process-creation)
"""


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1219"
name = "Remote Access Tools"
reference = "https://attack.mitre.org/techniques/T1219/"


[rule.threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[metadata]
creation_date = "2020/08/31"
integration = ["azure"]
maturity = "production"
updated_date = "2026/04/10"

[rule]
author = ["Elastic"]
description = """
Identifies the deletion of a Network Watcher in Azure. Network Watchers are used to monitor, diagnose, view metrics, and
enable or disable logs for resources in an Azure virtual network. An adversary may delete a Network Watcher in an
attempt to evade defenses.
"""
false_positives = [
    """
    Network Watcher deletions may be done by a system or network administrator. Verify whether the username, hostname,
    and/or resource name should be making changes in your environment. Network Watcher deletions by unfamiliar users or
    hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
    """,
]
from = "now-9m"
index = ["logs-azure.activitylogs-*", "filebeat-*"]
language = "kuery"
license = "Elastic License v2"
name = "Azure VNet Network Watcher Deleted"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Azure VNet Network Watcher Deleted

Azure Network Watcher is a vital tool for monitoring and diagnosing network issues within Azure environments. It provides insights and logging capabilities crucial for maintaining network security. Adversaries may delete Network Watchers to disable these monitoring functions, thereby evading detection. The detection rule identifies such deletions by monitoring Azure activity logs for specific delete operations, flagging successful attempts as potential security threats.

### Possible investigation steps

- Review the Azure activity logs to confirm the deletion event by checking for the operation name "MICROSOFT.NETWORK/NETWORKWATCHERS/DELETE" and ensuring the event outcome is marked as "Success" or "success".
- Identify the user or service principal responsible for the deletion by examining the associated user identity or service principal ID in the activity logs.
- Investigate the timeline of events leading up to the deletion by reviewing related activity logs for any unusual or unauthorized access patterns or changes in permissions.
- Assess the impact of the deletion by determining which resources were being monitored by the deleted Network Watcher and evaluating the potential security implications.
- Check for any other suspicious activities or alerts in the Azure environment that may indicate a broader attack or compromise, focusing on defense evasion tactics.

### False positive analysis

- Routine maintenance activities by authorized personnel may trigger the deletion alert. Verify if the deletion aligns with scheduled maintenance and consider excluding these operations from alerts.
- Automated scripts or tools used for infrastructure management might delete Network Watchers as part of their normal operation. Identify these scripts and whitelist their activity to prevent false positives.
- Changes in network architecture or resource reallocation can lead to legitimate deletions. Review change management logs to confirm if the deletion was planned and adjust the detection rule to exclude these scenarios.
- Test environments often undergo frequent changes, including the deletion of Network Watchers. If these environments are known to generate false positives, consider creating exceptions for specific resource groups or subscriptions associated with testing.

### Response and remediation

- Immediately isolate the affected Azure resources to prevent further unauthorized actions. This can be done by restricting network access or applying stricter security group rules.
- Review Azure activity logs to identify the user or service principal responsible for the deletion. Verify if the action was authorized and investigate any suspicious accounts.
- Restore the deleted Network Watcher by redeploying it in the affected regions to resume monitoring and logging capabilities.
- Conduct a security review of the affected Azure environment to identify any other potential misconfigurations or unauthorized changes.
- Implement stricter access controls and auditing for Azure resources, ensuring that only authorized personnel have the ability to delete critical monitoring tools like Network Watchers.
- Escalate the incident to the security operations team for further investigation and to determine if additional security measures are necessary.
- Enhance detection capabilities by ensuring that alerts for similar deletion activities are configured to notify the security team immediately.

## Setup

The Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
references = ["https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-monitoring-overview"]
risk_score = 47
rule_id = "323cb487-279d-4218-bcbd-a568efe930c6"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Data Source: Azure",
    "Use Case: Network Security Monitoring",
    "Tactic: Defense Evasion",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset:azure.activitylogs and azure.activitylogs.operation_name:"MICROSOFT.NETWORK/NETWORKWATCHERS/DELETE" and event.outcome:(Success or success)
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"

[[rule.threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"

[[rule.threat.technique.subtechnique]]
id = "T1562.008"
name = "Disable or Modify Cloud Logs"
reference = "https://attack.mitre.org/techniques/T1562/008/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[metadata]
creation_date = "2026/05/15"
integration = ["azure"]
maturity = "production"
updated_date = "2026/06/20"

[rule]
author = ["Elastic"]
description = """
Detects successful Microsoft Entra ID sign-ins that use the OAuth device code authentication protocol with the
Microsoft Authentication Broker client requesting first-party Office API resources (Exchange Online, Microsoft Graph,
or SharePoint) while flagged as interactive. This pattern is associated with adversary-in-the-middle (AiTM) phishing kits
such as Tycoon 2FA, where victims complete device code flows that ultimately broker tokens for mail and collaboration
APIs.
"""
false_positives = [
    """
    Rare legitimate interactive device code flows that use the Microsoft Authentication Broker against Exchange, Graph,
    or Yammer may match, for example during troubleshooting or specialized kiosk setups. Document approved scenarios and
    exclude known principals or networks.
    """,
]
from = "now-9m"
index = ["logs-azure.signinlogs-*"]
language = "kuery"
license = "Elastic License v2"
name = "Entra ID OAuth Device Code Phishing via AiTM"
note = """## Triage and analysis

### Investigating Entra ID OAuth Device Code Phishing via AiTM

Review `azure.signinlogs.properties.user_principal_name`, `azure.signinlogs.properties.session_id`, `source.ip`,
`user_agent.original`, and `azure.signinlogs.properties.resource_display_name` for context around the device code
completion.

Confirm whether the user knowingly entered a device code (for example on a shared or headless device) and whether
broker-mediated access to Exchange, Graph, or Yammer is expected for that account.

### Possible investigation steps

- Interview the user about recent links, QR codes, or prompts to approve a device code.
- Correlate with `azure.signinlogs` and Microsoft 365 audit logs for mailbox, Teams, or file access from the same
  session or IP shortly after the event.
- Review conditional access and MFA satisfaction details for the same `session_id`.

### Response and remediation

- If malicious, revoke refresh tokens for the user, reset credentials per policy, and review application consent.
- Block or monitor the source IP and escalate per incident procedures.
"""
references = [
    "https://any.run/malware-trends/tycoon/",
    "https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-authentication-flows",
    "https://www.microsoft.com/en-us/security/blog/2025/02/13/storm-2372-conducts-device-code-phishing-campaign/",
]
risk_score = 73
rule_id = "e5420ced-bc42-4783-a8df-99320567e090"
severity = "high"
tags = [
    "Domain: Cloud",
    "Domain: Identity",
    "Data Source: Azure",
    "Data Source: Microsoft Entra ID",
    "Data Source: Microsoft Entra ID Sign-in Logs",
    "Use Case: Threat Detection",
    "Threat: Tycoon2FA",
    "Tactic: Initial Access",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"
query = '''
data_stream.dataset:"azure.signinlogs" and event.category:"authentication" and event.action:"Sign-in activity" and
event.outcome:success and azure.signinlogs.properties.app_id:"29d9ed98-a469-4536-ade2-f981bc1d605e" and
azure.signinlogs.properties.authentication_protocol:deviceCode and
azure.signinlogs.properties.resource_id:(
    "00000002-0000-0ff1-ce00-000000000000" or
    "00000003-0000-0ff1-ce00-000000000000" or
    "00000003-0000-0000-c000-000000000000"
) and azure.signinlogs.properties.is_interactive:true
'''

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user_agent.original",
    "source.ip",
    "source.geo.country_name",
    "event.outcome",
    "azure.signinlogs.properties.user_principal_name",
    "azure.signinlogs.properties.session_id",
    "azure.signinlogs.properties.app_id",
    "azure.signinlogs.properties.app_display_name",
    "azure.signinlogs.properties.resource_id",
    "azure.signinlogs.properties.resource_display_name",
    "azure.signinlogs.properties.authentication_protocol",
    "azure.signinlogs.properties.is_interactive",
    "azure.tenant_id",
]

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"
[[rule.threat.technique.subtechnique]]
id = "T1566.002"
name = "Spearphishing Link"
reference = "https://attack.mitre.org/techniques/T1566/002/"

[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"
[[rule.threat.technique.subtechnique]]
id = "T1078.004"
name = "Cloud Accounts"
reference = "https://attack.mitre.org/techniques/T1078/004/"

[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1550"
name = "Use Alternate Authentication Material"
reference = "https://attack.mitre.org/techniques/T1550/"

[[rule.threat.technique.subtechnique]]
id = "T1550.001"
name = "Application Access Token"
reference = "https://attack.mitre.org/techniques/T1550/001/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[metadata]
creation_date = "2026/09/07"
integration = ["endpoint"]
maturity = "production"
min_stack_version = "9.3.0"
min_stack_comments = "The file.Ext.* fields for file events were introduced in 9.3.0, and are required for this rule to function."
updated_date = "2026/09/07"

[rule]
author = ["Elastic"]
description = """
This rule detects when a web server process creates a file with high entropy, where the file
extension is a web extension. This is a common indicator of an encrypted or encoded payload
being uploaded.
"""
from = "now-9m"
index = ["logs-endpoint.events.file*"]
language = "eql"
license = "Elastic License v2"
name = "File with High Entropy Created by Web Server"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating File with High Entropy Created by Web Server

This detection identifies a Linux web server process writing a high-entropy file with a web-executable extension, which can signal an encoded or encrypted payload planted through an exposed application. After exploiting a vulnerable upload endpoint, an attacker may save an obfuscated PHP web shell as a .phtml file under the document root, then invoke it over HTTP to establish persistent remote access.

### Possible investigation steps

- Determine the file’s full path, owner, permissions, timestamps, hash, and proximity to document roots, upload directories, temporary locations, or recent authorized deployments.
- Preserve a copy and inspect its true file type, strings, structure, obfuscation, embedded payloads, and known-malware reputation in a controlled environment without executing it.
- Correlate the creation time with process ancestry, command lines, service account activity, child processes, and network connections to identify the originating request or exploited application component.
- Review reverse-proxy, web access, WAF, and application logs for upload attempts, exploit patterns, source addresses, authentication context, and subsequent requests to the created file.
- Hunt for the same hash, filename, path, source address, or related execution across hosts, and isolate the server while removing the artifact and remediating the vulnerable entry point if malicious activity is confirmed.

### False positive analysis

- An authorized application deployment may cause a web server process to write minified JavaScript or packaged application files with naturally high entropy; verify the creation time, path, hash, and deployment records against the approved release.
- A Python web application may legitimately generate high-entropy bytecode cache files with a .pyc extension during startup or module import; confirm the files reside in expected cache directories and correlate with a sanctioned restart or code update.

### Response and remediation

- Isolate the affected web server from untrusted networks while preserving the high-entropy file, web logs, process artifacts, and memory for incident-response analysis.
- Quarantine the malicious file and remove related web shells, unauthorized accounts, scheduled tasks, service changes, startup scripts, SSH keys, and altered application components identified across the environment.
- Rebuild the server from a known-good image, restore validated application content and configuration, patch the exploited component, and rotate web service, application, database, API, and administrative credentials.
- Open an incident-response case and escalate to major-incident handling immediately if the file was executed, attacker commands or outbound connections are found, privileged credentials were exposed, or related artifacts appear on other hosts.
- Block confirmed malicious hashes, source addresses, domains, and request patterns, then hunt for matching files, exploitation attempts, and post-compromise activity across web servers and dependent systems.
- Prevent recurrence by restricting upload locations from executing code, enforcing extension and content validation, applying least-privilege permissions to web service accounts, and strengthening WAF rules and file-integrity monitoring.
"""
risk_score = 73
rule_id = "f2738cad-28ab-4c9e-b7f0-66f3b2775e5f"
setup = """## Setup

This rule requires data coming in from Elastic Defend.

### Elastic Defend Integration Setup
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.

#### Prerequisite Requirements:
- Fleet is required for Elastic Defend.
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).

#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
- Go to the Kibana home page and click "Add integrations".
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
- Click "Add Elastic Defend".
- Configure the integration name and optionally add a description.
- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
- Click "Save and Continue".
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).

Elastic Defend integration does not collect advanced file information (such as the different file.Ext.* fields) by default.
In order to capture this behavior, this rule requires a specific configuration option set within the advanced settings of the Elastic Defend integration.
 #### To set up advanced file information capture for an Elastic Agent policy:
- Go to “Security → Manage → Policies”.
- Select an “Elastic Agent policy”.
- Click “Show advanced settings”.
- Scroll down or search for “linux.advanced.events.populate_file_data”.
- For this rule the linux.advanced.events.populate_file_data variable should be set to "true".
- Click “Save”.
After saving the integration change, the Elastic Agents running this policy will be updated and the rule will function properly.
"""
severity = "high"
tags = [
    "Domain: Endpoint",
    "OS: Linux",
    "Use Case: Threat Detection",
    "Use Case: Vulnerability",
    "Tactic: Persistence",
    "Tactic: Initial Access",
    "Tactic: Lateral Movement",
    "Data Source: Elastic Defend",
    "Rule Type: Event Correlation (EQL)",
    "Resources: Investigation Guide"
]
timestamp_override = "event.ingested"
type = "eql"
query = '''
file where host.os.type == "linux" and event.action != "deletion" and

/* Entropy threshold chosen to flag likely encoded/encrypted payload uploads while limiting false positives. */
file.Ext.entropy >= 6.0 and

(
  process.name in (
    "nginx", "apache2", "httpd", "caddy", "lighttpd", "httpd.worker", "httpd-worker", "httpd-prefork",
    "php-cgi", "php-fcgi", "php-cgi.cagefs", "frankenphp", "lshttpd", "litespeed", "openlitespeed",
    "fcgiwrap", "uwsgi", "daphne", "uvicorn", "hypercorn", "granian", "waitress-serve", "flask", "puma",
    "unicorn", "unicorn_rails", "thin", "rackup", "mongrel_rails", "starman", "plackup", "twiggy",
    "hypnotoad", "starlet", "unitd", "unitd-debug"
  ) or
  process.name like ("php-fpm*", "lsphp*", "gunicorn*", "*.cgi", "*.fcgi")
) and
file.extension in~ (
  "php", "phtml", "pht", "php3", "php4", "php5", "php7", "phar",
  "asp", "aspx", "ashx", "asmx", "ascx", "cshtml", "razor",
  "jsp", "jspx", "jsx", "jspf", "tag", "tagx", "war", "ear",
  "js", "mjs", "cjs", "ts", "mts", "cts", "tsx",
  "py", "wsgi", "cgi", "fcgi", "pyc",
  "erb", "ru",
  "psgi",
  "lua", "luac",
  "sh", "elf", "bin"
)
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

  [rule.threat.tactic]
  name = "Persistence"
  id = "TA0003"
  reference = "https://attack.mitre.org/tactics/TA0003/"

  [[rule.threat.technique]]
  id = "T1505"
  name = "Server Software Component"
  reference = "https://attack.mitre.org/techniques/T1505/"

    [[rule.threat.technique.subtechnique]]
    id = "T1505.003"
    name = "Web Shell"
    reference = "https://attack.mitre.org/techniques/T1505/003/"

[[rule.threat]]
framework = "MITRE ATT&CK"

  [rule.threat.tactic]
  name = "Initial Access"
  id = "TA0001"
  reference = "https://attack.mitre.org/tactics/TA0001/"

  [[rule.threat.technique]]
  name = "Exploit Public-Facing Application"
  id = "T1190"
  reference = "https://attack.mitre.org/techniques/T1190/"

[[rule.threat]]
framework = "MITRE ATT&CK"

  [[rule.threat.technique]]
  id = "T1210"
  name = "Exploitation of Remote Services"
  reference = "https://attack.mitre.org/techniques/T1210/"

  [rule.threat.tactic]
  id = "TA0008"
  name = "Lateral Movement"
  reference = "https://attack.mitre.org/tactics/TA0008/"

[metadata]
creation_date = "2020/08/14"
integration = ["endpoint"]
maturity = "production"
updated_date = "2025/04/21"

[rule]
author = ["Elastic"]
description = """
Adversaries may collect the keychain storage data from a system to acquire credentials. Keychains are the built-in way
for macOS to keep track of users' passwords and credentials for many services and features such as WiFi passwords,
websites, secure notes and certificates.
"""
from = "now-9m"
index = ["logs-endpoint.events.process*"]
language = "eql"
license = "Elastic License v2"
name = "Keychain CommandLine Interaction via Unsigned or Untrusted Process"
references = [
    "https://objective-see.com/blog/blog_0x25.html",
    "https://securelist.com/calisto-trojan-for-macos/86543/",
]
risk_score = 73
rule_id = "96e90768-c3b7-4df6-b5d9-6237f8bc36a8"
setup = """## Setup

This rule requires data coming in from Elastic Defend.

### Elastic Defend Integration Setup
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.

#### Prerequisite Requirements:
- Fleet is required for Elastic Defend.
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).

#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
- Go to the Kibana home page and click "Add integrations".
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
- Click "Add Elastic Defend".
- Configure the integration name and optionally add a description.
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
- Click "Save and Continue".
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
"""
severity = "high"
tags = [
    "Domain: Endpoint",
    "OS: macOS",
    "Use Case: Threat Detection",
    "Tactic: Credential Access",
    "Data Source: Elastic Defend",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
process where host.os.type == "macos" and event.type in ("start", "process_started") and event.action == "exec" and
  process.args like ("/Users/*/Library/Keychains/*", "/Library/Keychains/*", "login.keychain-db", "login.keychain") and 
  ((process.code_signature.trusted == false or process.code_signature.exists == false) or 
   (process.name in ("bash", "sh", "zsh", "osascript", "cat", "echo", "cp") and 
   (process.parent.code_signature.trusted == false or process.parent.code_signature.exists == false)))
'''
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Keychain CommandLine Interaction via Unsigned or Untrusted Process

macOS keychains securely store user credentials, such as passwords and certificates, essential for system and application authentication. Adversaries may target these directories to extract sensitive information, potentially compromising user accounts and system integrity. The detection rule identifies suspicious access attempts by monitoring process activities related to keychain directories, excluding known legitimate processes and actions, thus highlighting potential unauthorized access attempts.

### Possible investigation steps

- Review the process details that triggered the alert, focusing on the process.args field to identify the specific keychain directory accessed and the nature of the access attempt.
- Examine the process.parent.executable and process.executable fields to determine the origin of the process and assess whether it is a known or potentially malicious application.
- Investigate the process.Ext.effective_parent.executable field to trace the parent process chain and identify any unusual or unauthorized parent processes that may have initiated the access.
- Check for any recent changes or installations on the system that could explain the access attempt, such as new software or updates that might interact with keychain directories.
- Correlate the alert with other security events or logs from the same host to identify any patterns or additional suspicious activities that could indicate a broader compromise.

### False positive analysis

- Processes related to legitimate security applications like Microsoft Defender, JumpCloud Agent, and Rapid7 IR Agent may trigger false positives. Users can mitigate this by ensuring these applications are included in the exclusion list for process executables and effective parent executables.
- Routine administrative tasks involving keychain management, such as setting keychain settings or importing certificates, might be flagged. To handle this, users should add these specific actions to the exclusion list for process arguments.
- Applications like OpenVPN Connect and JAMF management tools that interact with keychain directories for legitimate purposes can cause false alerts. Users should verify these applications are part of the exclusion list for parent executables to prevent unnecessary alerts.
- Regular system maintenance or updates that involve keychain access might be misinterpreted as suspicious. Users should monitor these activities and adjust the exclusion criteria as needed to accommodate known maintenance processes.

### Response and remediation

- Immediately isolate the affected macOS system from the network to prevent further unauthorized access or data exfiltration.
- Terminate any suspicious processes identified by the detection rule that are attempting to access keychain directories without legitimate reasons.
- Conduct a thorough review of the system's keychain access logs to identify any unauthorized access or modifications to keychain files.
- Change all passwords and credentials stored in the keychain on the affected system to prevent potential misuse of compromised credentials.
- Restore the system from a known good backup if unauthorized access has led to system integrity issues or data corruption.
- Implement additional monitoring on the affected system to detect any further unauthorized access attempts, focusing on the keychain directories and related processes.
- Escalate the incident to the security operations team for further investigation and to determine if the threat is part of a larger attack campaign."""


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1555"
name = "Credentials from Password Stores"
reference = "https://attack.mitre.org/techniques/T1555/"
[[rule.threat.technique.subtechnique]]
id = "T1555.001"
name = "Keychain"
reference = "https://attack.mitre.org/techniques/T1555/001/"



[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[rule]
description = """
Identifies Ldap search followed by a network connections to the standard Kerberos port from an unusual process. On
Windows, the only native system process that normally performs Kerberos traffic from a domain joined host is lsass.exe.
"""
id = "53e680ea-89b7-474a-ac10-089adcd02f13"
license = "Elastic License v2"
name = "LDAP Search followed by Kerberos Connection"
os_list = ["windows"]
version = "1.0.1"

query = '''
sequence by process.entity_id with maxspan=1m
 [api where process.Ext.api.name == "ldap_search" and
  not (user.id == "S-1-5-18" and process.executable : "?:\\Windows\\System32\\lsass.exe") and
  not (process.executable : "C:\\Program Files\\*\\Server\\bin\\ws_TomcatService.exe" and
       process.code_signature.subject_name in ("VMware, Inc.", "Omnissa, LLC") and process.code_signature.trusted == true) and
  not (process.executable : "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" and
       process.parent.executable : "C:\\Windows\\System32\\svchost.exe" and process.Ext.api.parameters.search_filter in ("(cn=rid manager$)", "(cn=krbtgt)")) and 
  not (process.executable : "C:\\Program Files\\Microsoft Office\\root\\Office16\\WINWORD.EXE" and process.Ext.api.parameters.search_filter like "(|(mail=*)(proxyAddresses=smtp:*))")
  ]
 [network where destination.port == 88 and source.port >= 49152 and network.direction == "egress" and
  network.transport == "tcp" and not destination.address : ("127.*", "::1")]
'''

min_endpoint_version = "9.1.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1558"
name = "Steal or Forge Kerberos Tickets"
reference = "https://attack.mitre.org/techniques/T1558/"


[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "9.1.0"

[metadata]
creation_date = "2022/01/12"
integration = ["windows", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2026/05/04"

[rule]
author = ["Elastic"]
description = """
Microsoft Office Products offer options for users and developers to control the security settings for running and using
Macros. Adversaries may abuse these security settings to modify the default behavior of the Office Application to trust
future macros and/or disable security warnings, which could increase their chances of establishing persistence.
"""
from = "now-9m"
index = [
    "winlogbeat-*",
    "logs-windows.sysmon_operational-*",
    "endgame-*",
    "logs-m365_defender.event-*",
    "logs-sentinel_one_cloud_funnel.*",
    "logs-crowdstrike.fdr*",
]
language = "eql"
license = "Elastic License v2"
name = "MS Office Macro Security Registry Modifications"
note = """## Triage and analysis

### Investigating MS Office Macro Security Registry Modifications

Macros are small programs that are used to automate repetitive tasks in Microsoft Office applications. Historically, macros have been used for a variety of reasons -- from automating part of a job, to building entire processes and data flows. Macros are written in Visual Basic for Applications (VBA) and are saved as part of Microsoft Office files.

Macros are often created for legitimate reasons, but they can also be written by attackers to gain access, harm a system, or bypass other security controls such as application allow listing. In fact, exploitation from malicious macros is one of the top ways that organizations are compromised today. These attacks are often conducted through phishing or spear phishing campaigns.

Attackers can convince victims to modify Microsoft Office security settings, so their macros are trusted by default and no warnings are displayed when they are executed. These settings include:

- *Trust access to the VBA project object model* - When enabled, Microsoft Office will trust all macros and run any code without showing a security warning or requiring user permission.
- *VbaWarnings* - When set to 1, Microsoft Office will trust all macros and run any code without showing a security warning or requiring user permission.

This rule looks for registry changes affecting the conditions above.

#### Possible investigation steps

- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
- Identify the user account that performed the action and whether it should perform this kind of action.
- Contact the user and check if the change was done manually.
- Verify whether malicious macros were executed after the registry change.
- Investigate other alerts associated with the user/host during the past 48 hours.
- Retrieve recently executed Office documents and determine if they are malicious:
  - Use a private sandboxed malware analysis system to perform analysis.
    - Observe and collect information about the following activities:
      - Attempts to contact external domains and addresses.
      - File and registry access, modification, and creation activities.
      - Service creation and launch activities.
      - Scheduled task creation.
  - Use the PowerShell Get-FileHash cmdlet to get the files' SHA-256 hash values.
    - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.

### False positive analysis

- This activity should not happen legitimately. The security team should address any potential benign true positive (B-TP), as this configuration can put the user and the domain at risk.

### Response and remediation

- Initiate the incident response process based on the outcome of the triage.
- Reset the registry key value.
- Isolate the involved host to prevent further post-compromise behavior.
- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
- Explore using GPOs to manage security settings for Microsoft Office macros.
- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
"""

setup = """## Setup

This rule requires telemetry from one of the configured source integrations to be enabled and ingested.

### Supported data sources

This rule can use the following data sources. For setup instructions, refer to the links below:

- [CrowdStrike](https://ela.st/crowdstrike-integration)
- [Microsoft Defender XDR](https://ela.st/m365-defender)
- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
- [Sysmon Registry Events](https://ela.st/sysmon-event-reg-setup)
"""

risk_score = 47
rule_id = "feeed87c-5e95-4339-aef1-47fd79bcfbe3"
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Defense Evasion",
    "Resources: Investigation Guide",
    "Data Source: Elastic Endgame",
    "Data Source: Sysmon",
    "Data Source: Microsoft Defender XDR",
    "Data Source: SentinelOne",
    "Data Source: Crowdstrike",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
registry where host.os.type == "windows" and event.type == "change" and
    registry.value : ("AccessVBOM", "VbaWarnings") and
    registry.data.strings : ("0x00000001", "1")

/*
    Full registry key paths omitted due to data source variations:
    "HKCU\\S-1-*\\SOFTWARE\\Microsoft\\Office\\*\\Security\\AccessVBOM"
    "HKCU\\S-1-*\\SOFTWARE\\Microsoft\\Office\\*\\Security\\VbaWarnings"
*/
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1112"
name = "Modify Registry"
reference = "https://attack.mitre.org/techniques/T1112/"


[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1204"
name = "User Execution"
reference = "https://attack.mitre.org/techniques/T1204/"
[[rule.threat.technique.subtechnique]]
id = "T1204.002"
name = "Malicious File"
reference = "https://attack.mitre.org/techniques/T1204/002/"



[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[metadata]
creation_date = "2025/08/20"
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender", "system", "crowdstrike"]
maturity = "production"
updated_date = "2026/04/07"

[rule]
author = ["Elastic"]
description = """
Identifies execution of the NetSupport remote access software from non-default paths. Adversaries may abuse NetSupport
Manager to control a victim machine.
"""
from = "now-9m"
index = [
    "endgame-*",
    "logs-crowdstrike.fdr*",
    "logs-endpoint.events.process-*",
    "logs-m365_defender.event-*",
    "logs-sentinel_one_cloud_funnel.*",
    "logs-system.security*",
    "logs-windows.sysmon_operational-*",
    "winlogbeat-*",
]
language = "eql"
license = "Elastic License v2"
name = "NetSupport Manager Execution from an Unusual Path"
references = [
    "https://www.netsupportsoftware.com/",
]
risk_score = 73
rule_id = "5f73aef2-7abc-4fd9-ac0d-ab8ec3e13891"
severity = "high"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Command and Control",
    "Resources: Investigation Guide",
    "Data Source: Elastic Endgame",
    "Data Source: Elastic Defend",
    "Data Source: Sysmon",
    "Data Source: SentinelOne",
    "Data Source: Microsoft Defender XDR",
    "Data Source: Windows Security Event Logs",
    "Data Source: Crowdstrike",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
process where host.os.type == "windows" and event.type == "start" and
 (process.name : "client32.exe" or ?process.pe.original_file_name == "client32.exe" or process.parent.name : "client32.exe") and
 (
  process.executable :
               ("?:\\Users\\*.exe",
                "?:\\ProgramData\\*.exe",
                "\\Device\\HarddiskVolume*\\Users\\*.exe",
                "\\Device\\HarddiskVolume*\\ProgramData\\*.exe") or
  ?process.parent.executable : ("?:\\Users\\*\\client32.exe", "?:\\ProgramData\\*\\client32.exe")
  )
'''

note = """## Triage and analysis

### Investigating NetSupport Manager Execution from an Unusual Path

#### Possible investigation steps

- What is the alerting process and how did NetSupport reach this host from a non-default path?
  - Focus: `process.executable`, `process.pe.original_file_name`, `process.code_signature.subject_name`, `process.code_signature.trusted`, `process.parent.executable`, and `process.parent.command_line`.
  - Implication: escalate when the client is unsigned, portable, or mismatched to its original file name, or when the parent chain starts from a script host, archive utility, browser, or Office process; lower suspicion when signer, path, and parent chain resolve to a recognized deployment. Identity alone does not clear the behavior.

- Does the client or child command line show recognized deployment behavior or covert control intent?
  - Focus: `process.command_line`, `process.working_directory`, and `process.parent.command_line`, with attention to connection targets, relay parameters, and hidden or scripted launch behavior.
  - Hint: if the alert fired on a child process and the parent command line is absent or truncated, recover the NetSupport client start event on the same `host.id` before judging deployment or relay intent.
  - Implication: escalate when the command line reveals external control targets, stealthy launch parameters, or deployment behavior that does not fit expected support tooling; lower suspicion when the arguments match a recognized support or managed rollout workflow.

- Do network events show expected support infrastructure or suspicious relay traffic?
  - Focus: process-scoped DNS and connection events for `process.entity_id`, checking `dns.question.name`, `dns.resolved_ip`, `destination.ip`, `destination.port`, and `destination.as.organization.name`. $investigate_2
  - Implication: escalate when the process reaches rare public destinations or unexpected relay infrastructure; lower suspicion when destinations align with known internal support infrastructure. Missing network telemetry is unresolved, not benign.

- Do file events show staged components, renamed NetSupport files, or persistence artifacts?
  - Focus: file events scoped to `process.entity_id`: `file.path`, `file.origin_url`, `file.Ext.windows.zone_identifier`, `file.Ext.header_bytes`, and adjacent NetSupport files ("client32u.ini", "NSM.lic", "NSM.ini", "CKSINI.EXE").
  - Implication: escalate when the process writes portable components, renamed files, or bundled config/license files, or when artifacts later appear in persistence or execution telemetry; lower suspicion when file activity stays in a recognized installation path with no suspicious reuse.

- Do child processes launched from NetSupport show interactive abuse beyond normal support?
  - Focus: child process events from `process.entity_id`, checking `process.executable` and `process.command_line`. $investigate_3
  - Implication: escalate when NetSupport spawns shells, scripting engines, archivers, credential tools, or other hands-on-keyboard tooling; lower suspicion when child activity stays limited to expected helper processes or no secondary execution follows.

- If the local evidence stays suspicious, does this host or user show related alerts or a recurring deployment pattern?
  - Focus: related alerts for `host.id` and `user.id` in the last 48 hours, checking for delivery, persistence, remote-access, or credential activity, and whether the same client path, signer, and destination pattern recur across prior alerts.
    - $investigate_0
    - $investigate_1
  - Hint: if workflow documentation is unavailable, recurrence of the same client path, signer, and destination pattern across prior alerts is the strongest telemetry-based benign signal.
  - Implication: broaden when the host or user shows suspicious precursor, follow-on, or cross-host activity; lower suspicion when the same deployment pattern recurs with no contradictory alerts.

- Escalate when binary identity, launch chain, network destinations, staged artifacts, or child-process behavior point to unauthorized NetSupport deployment or interactive abuse; close only when all evidence aligns with a recognized support deployment; if mixed or incomplete, preserve and escalate.

### False positive analysis

- Legitimate IT support or managed deployment can stage NetSupport in non-default paths. Confirm it when the client is signed by NetSupport Ltd, the parent is an IT deployment tool (SCCM, GPO, management agent), bundled config files (client32u.ini, NSM.lic) sit alongside the client in the same directory, and network destinations resolve to internal support infrastructure.
- Before creating an exception, build on `process.executable`, `process.code_signature.subject_name`, `process.parent.executable`, `user.id`, and `host.id`. Avoid exceptions on `process.name` alone, the user alone, or the host alone.

### Response and remediation

- If confirmed benign, reverse any temporary containment and document `process.executable`, `process.code_signature.subject_name`, `process.parent.executable`, the destination pattern, and the `user.id`/`host.id` pairing. Create an exception using the fields from the FP guidance above.
- If suspicious but unconfirmed, preserve the alert's `process.entity_id`, client path, signer, `process.command_line`, related `file.path` values, child-process lineage, and any linked `destination.ip`, `dns.question.name`, or `dns.resolved_ip` values. Apply reversible containment such as temporary blocking of confirmed destinations. Escalate to host isolation only when live remote control or lateral movement is still plausible and the asset can tolerate it.
- If confirmed malicious, use endpoint response to contain the host after recording the alert's `process.entity_id`, client path, signer, command line, child-process details, written artifact paths, and confirmed destinations. If direct endpoint response is unavailable, escalate with that evidence set to the team that can terminate the process, isolate the host, and block the malicious destinations and dropped artifact hashes identified during the investigation.
- Before deleting files or removing access, review the same client path family, destinations, bundled config or license files, and dropped artifact names across other hosts and users so portable staging or shared controller infrastructure does not stay localized by mistake. Then eradicate the unauthorized NetSupport client, persistence mechanism, installer artifacts, and follow-on tooling uncovered during the file and child-process review.
- Post-incident hardening: restrict remote-access tool installs to approved signed packages and approved paths, review software-allowlisting or deployment controls that allowed the portable client to run, and retain endpoint process, file, and network telemetry.
"""

setup = """## Setup

This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.

Setup instructions: https://ela.st/install-elastic-defend

### Additional data sources

This rule also supports the following third-party data sources. For setup instructions, refer to the links below:

- [CrowdStrike](https://ela.st/crowdstrike-integration)
- [Microsoft Defender XDR](https://ela.st/m365-defender)
- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
- [Sysmon Event ID 1 - Process Creation](https://ela.st/sysmon-event-1-setup)
- [Windows Process Creation Logs](https://ela.st/audit-process-creation)
"""

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "host.name",
    "host.id",
    "user.name",
    "user.id",
    "user.domain",
    "process.entity_id",
    "process.executable",
    "process.command_line",
    "process.working_directory",
    "process.pe.original_file_name",
    "process.parent.executable",
    "process.parent.command_line",
    "process.code_signature.subject_name",
    "process.code_signature.trusted",
]

[[transform.investigate]]
label = "Alerts associated with the user"
description = ""
providers = [
  [
    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
    { excluded = false, field = "user.id", queryType = "phrase", value = "{{user.id}}", valueType = "string" }
  ]
]
relativeFrom = "now-48h/h"
relativeTo = "now"

[[transform.investigate]]
label = "Alerts associated with the host"
description = ""
providers = [
  [
    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" }
  ]
]
relativeFrom = "now-48h/h"
relativeTo = "now"

[[transform.investigate]]
label = "Network activity for the NetSupport process"
description = ""
providers = [
  [
    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" },
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "event.category", queryType = "phrase", value = "network", valueType = "string" }
  ]
]
relativeFrom = "now-1h"
relativeTo = "now"

[[transform.investigate]]
label = "Child processes launched by the NetSupport client"
description = ""
providers = [
  [
    { excluded = false, field = "process.parent.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" },
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" }
  ]
]
relativeFrom = "now-1h"
relativeTo = "now"

[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1219"
name = "Remote Access Tools"
reference = "https://attack.mitre.org/techniques/T1219/"

[rule.threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[rule]
description = """
Identifies the execution of a Windows script with file size more than 30MB. Adversaries may use large files to bypass
online malware sandbox file upload size limitation.
"""
id = "e8dded92-4ef5-4322-8098-98e7cb33994f"
license = "Elastic License v2"
name = "Oversized Windows Script Execution"
os_list = ["windows"]
reference = ["https://www.elastic.co/security-labs/spring-cleaning-with-latrodectus"]
version = "1.0.7"

query = '''
sequence with maxspan=1m
 [file where event.action != "deletion" and

  /* windows script file size is more than 30MB */
  file.extension : ("js", "jse", "vbs", "vbe", "wsh", "hta") and file.size >= 30000000] as event0
 [process where event.action == "start" and
  (process.name : ("wscript.exe", "cscript.exe", "mshta.exe") or process.pe.original_file_name : ("cscript.exe", "wscript.exe", "mshta.exe")) and
   (
    stringcontains~(process.command_line, event0.file.name) or
    startswith~(event0.file.path, process.working_directory)
   )]
'''

min_endpoint_version = "8.4.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.005"
name = "Visual Basic"
reference = "https://attack.mitre.org/techniques/T1059/005/"

[[threat.technique.subtechnique]]
id = "T1059.007"
name = "JavaScript"
reference = "https://attack.mitre.org/techniques/T1059/007/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[[threat.technique.subtechnique]]
id = "T1218.005"
name = "Mshta"
reference = "https://attack.mitre.org/techniques/T1218/005/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.4.0"

[metadata]
creation_date = "2020/11/23"
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2026/05/04"

[rule]
author = ["Elastic"]
description = "Detects attempts to establish persistence on an endpoint by installing a rogue Microsoft Outlook VBA Template."
false_positives = ["A legitimate VBA for Outlook is usually configured interactively via OUTLOOK.EXE."]
from = "now-9m"
index = [
    "logs-endpoint.events.file-*",
    "winlogbeat-*",
    "logs-windows.sysmon_operational-*",
    "endgame-*",
    "logs-m365_defender.event-*",
    "logs-sentinel_one_cloud_funnel.*",
    "logs-crowdstrike.fdr*",
]
language = "eql"
license = "Elastic License v2"
name = "Persistence via Microsoft Outlook VBA"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Persistence via Microsoft Outlook VBA

Microsoft Outlook supports VBA scripting to automate tasks, which can be exploited by adversaries to maintain persistence. Attackers may install malicious VBA templates in the Outlook environment, triggering scripts upon application startup. The detection rule identifies suspicious activity by monitoring for unauthorized modifications to the VBAProject.OTM file, a common target for such persistence techniques, leveraging various data sources to flag potential threats.

### Possible investigation steps

- Review the alert details to confirm the file path matches the pattern "C:\\\\Users\\\\*\\\\AppData\\\\Roaming\\\\Microsoft\\\\Outlook\\\\VbaProject.OTM" and ensure the event type is not "deletion".
- Check the modification timestamp of the VbaProject.OTM file to determine when the unauthorized change occurred.
- Identify the user account associated with the file path to understand which user profile was potentially compromised.
- Investigate recent login activities and processes executed by the identified user to detect any anomalies or unauthorized access.
- Examine the contents of the VbaProject.OTM file for any suspicious or unfamiliar VBA scripts that could indicate malicious intent.
- Correlate the findings with other data sources such as Sysmon, Microsoft Defender XDR, or SentinelOne to gather additional context or related events.
- Assess the risk and impact of the detected activity and determine if further containment or remediation actions are necessary.

### False positive analysis

- Routine updates or legitimate changes to the Outlook environment can trigger alerts. Users should verify if recent software updates or administrative changes align with the detected activity.
- Custom scripts or macros developed by IT departments for legitimate automation tasks may be flagged. Establish a whitelist of known and approved VBA scripts to prevent unnecessary alerts.
- User-initiated actions such as importing or exporting Outlook settings might modify the VbaProject.OTM file. Educate users on the implications of these actions and consider excluding these specific user actions from triggering alerts.
- Security software or backup solutions that interact with Outlook files could cause false positives. Identify and exclude these processes if they are known to be safe and necessary for operations.
- Regularly review and update the exclusion list to ensure it reflects current organizational needs and does not inadvertently allow malicious activity.

### Response and remediation

- Isolate the affected endpoint from the network to prevent further spread of the malicious VBA script and to contain the threat.
- Terminate any suspicious Outlook processes on the affected machine to stop the execution of potentially harmful scripts.
- Remove the unauthorized or malicious VbaProject.OTM file from the affected user's Outlook directory to eliminate the persistence mechanism.
- Restore the VbaProject.OTM file from a known good backup if available, ensuring that it is free from any unauthorized modifications.
- Conduct a full antivirus and antimalware scan on the affected endpoint using tools like Microsoft Defender XDR to identify and remove any additional threats.
- Review and update endpoint security policies to restrict unauthorized modifications to Outlook VBA files, leveraging application whitelisting or similar controls.
- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to assess the potential impact on other systems within the network."""
references = [
    "https://www.mdsec.co.uk/2020/11/a-fresh-outlook-on-mail-based-persistence/",
    "https://www.linkedin.com/pulse/outlook-backdoor-using-vba-samir-b-/",
]
risk_score = 47
rule_id = "397945f3-d39a-4e6f-8bcb-9656c2031438"
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Persistence",
    "Data Source: Elastic Endgame",
    "Data Source: Elastic Defend",
    "Data Source: Sysmon",
    "Data Source: Microsoft Defender XDR",
    "Data Source: SentinelOne",
    "Data Source: Crowdstrike",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
file where host.os.type == "windows" and event.type != "deletion" and
  file.name : "VbaProject.OTM" and
  file.path : ("?:\\Users\\*\\AppData\\Roaming\\Microsoft\\Outlook\\VbaProject.OTM", "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\Roaming\\Microsoft\\Outlook\\VbaProject.OTM")
'''

setup = """## Setup

This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.

Setup instructions: https://ela.st/install-elastic-defend

### Additional data sources

This rule also supports the following third-party data sources. For setup instructions, refer to the links below:

- [CrowdStrike](https://ela.st/crowdstrike-integration)
- [Microsoft Defender XDR](https://ela.st/m365-defender)
- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
- [Sysmon Event ID 11 - File Create](https://ela.st/sysmon-event-11-setup)
"""


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1137"
name = "Office Application Startup"
reference = "https://attack.mitre.org/techniques/T1137/"

[[rule.threat.technique.subtechnique]]
id = "T1137.001"
name = "Office Template Macros"
reference = "https://attack.mitre.org/techniques/T1137/001/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[rule]
description = """
Identifies a suspicious Diagnostics Utility for Internet Explorer child process. This may indicate the successful
exploitation of the vulnerability CVE-2025-33053.
"""
id = "023ef149-c929-4f34-8384-20c0c0b9c2f7"
license = "Elastic License v2"
name = "Potential CVE-2025-33053 Exploitation"
os_list = ["windows"]
reference = [
    "https://research.checkpoint.com/2025/stealth-falcon-zero-day/",
    "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-33053",
]
version = "1.0.2"

query = '''
process where event.action == "start" and
(
 (process.name : "iediagcmd.exe" and process.working_directory : "\\\\*") or
 (process.parent.executable : "C:\\Program Files\\Internet Explorer\\iediagcmd.exe" and
  process.name : ("route.exe", "netsh.exe", "ipconfig.exe", "dxdiag.exe", "conhost.exe", "makecab.exe") and
  process.executable != null and
  not process.executable : ("?:\\Windows\\System32\\route.exe",
                           "?:\\Windows\\System32\\netsh.exe",
                           "?:\\Windows\\System32\\ipconfig.exe",
                           "?:\\Windows\\System32\\dxdiag.exe",
                           "?:\\Windows\\System32\\conhost.exe",
                           "?:\\Windows\\System32\\makecab.exe"))
)
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"
[[threat.technique.subtechnique]]
id = "T1566.001"
name = "Spearphishing Attachment"
reference = "https://attack.mitre.org/techniques/T1566/001/"



[threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1203"
name = "Exploitation for Client Execution"
reference = "https://attack.mitre.org/techniques/T1203/"


[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.15.0"

[rule]
description = """
Identifies a suspicious sequence of file modifications where the entropy of the file is set to zero and its original
size is still shown as unmodified. This may indicate a data wiping attack behavior.
"""
id = "c8776070-eca6-4370-8438-f2b6282615ef"
license = "Elastic License v2"
name = "Potential Data wiping Attack Behavior"
os_list = ["windows"]
version = "1.0.34"

query = '''
sequence by process.entity_id with maxspan=1s

  /* a sequence of file mod by same process */

 [file where event.action == "modification" and process.pid != 4 and process.executable != null and 
  file.Ext.entropy == 0 and file.Ext.header_bytes : "0000000*" and
  file.extension : ("exe", "dll", "html", "doc", "docx", "xls", "xlsx", "ppt", "pptx", "pdf", "txt", "png") and file.size > 10 and
  not process.executable :
            ("?:\\Program Files\\*.exe",
             "?:\\Program Files (x86)\\*.exe",
             "?:\\Windows\\System32\\spoolsv.exe",
             "?:\\Windows\\System32\\svchost.exe",
             "?:\\Windows\\Explorer.exe",
             "?:\\Program Files (x86)\\Steam\\steamapps\\*.exe",
             "\\Device\\HarddiskVolume?\\Steam\\steam.exe") and
  not (process.name : "steam.exe" and file.path : "?:\\Users\\*\\steamapps\\downloading\\*.txt") and
  not (process.code_signature.subject_name : "Valve Corp." and process.code_signature.trusted == true) and
  not file.path : "?:\\Program Files (x86)\\Steam\\steamapps\\downloading\\*" and
  not (file.extension : ("dll", "exe", "txt") and process.executable : "C:\\Windows\\System32\\msiexec.exe") and
  not (process.executable : "C:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe" and
       process.code_signature.subject_name == "Microsoft Corporation" and process.code_signature.trusted == true)
  ]
 [file where event.action == "modification" and
  file.Ext.entropy == 0 and file.Ext.header_bytes : "0000000*" and
  file.extension : ("exe", "dll", "html", "doc", "docx", "xls", "xlsx", "ppt", "pptx", "pdf", "txt", "png") and file.size > 10]
 [file where event.action == "modification" and
  file.Ext.entropy == 0 and file.Ext.header_bytes : "0000000*" and
  file.extension : ("exe", "dll", "html", "doc", "docx", "xls", "xlsx", "ppt", "pptx", "pdf", "txt", "png") and file.size > 10]
 [file where event.action == "modification" and
  file.Ext.entropy == 0 and file.Ext.header_bytes : "0000000*" and
  file.extension : ("exe", "dll", "html", "doc", "docx", "xls", "xlsx", "ppt", "pptx", "pdf", "txt", "png") and file.size > 10]
'''

min_endpoint_version = "8.0.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1485"
name = "Data Destruction"
reference = "https://attack.mitre.org/techniques/T1485/"


[threat.tactic]
id = "TA0040"
name = "Impact"
reference = "https://attack.mitre.org/tactics/TA0040/"

[internal]
min_endpoint_version = "8.0.0"

[rule]
description = """
Identifies the load of NTDLL for the second time and followed by another activity from a call stack with a modified
NTDLL memory section. This may indicate an attempt to patch or modify the NTDLL memory region to evade endpoint security
solutions hooking Windows APIs.
"""
id = "d7bc9652-fe82-4fb3-8a48-4a9289c840f8"
license = "Elastic License v2"
name = "Potential NTDLL Memory Unhooking"
os_list = ["windows"]
reference = [
    "https://www.elastic.co/security-labs/upping-the-ante-detecting-in-memory-threats-with-kernel-call-stacks",
    "https://www.ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs",
]
version = "1.0.30"

query = '''
sequence by process.entity_id with maxspan=1m
 [library where dll.name : "ntdll.dll" and

  /* ondisk copy  of NTDLL mapped in memory */
  dll.Ext.load_index >= 2 and
  _arraysearch(process.thread.Ext.call_stack, $entry,
               $entry.symbol_info: ("?:\\Windows\\Sys*\\KernelBase.dll!MapViewOfFile*", "?:\\Windows\\Sys*\\ntdll.dll!*MapViewOfSection*")) and

  /* no private bytes in ntdll memory allocation */
  not _arraysearch(process.thread.Ext.call_stack, $entry, $entry.allocation_private_bytes > 0 and $entry.symbol_info: "?:\\windows\\sys*\\ntdll.dll*") and

  /* FACEIT Anti-Cheat Launcher */
  not (process.code_signature.subject_name : 
           ("FACE IT LIMITED", "Kaspersky Lab JSC", "Check Point Software Technologies Ltd.", "COGNOSPHERE PTE. LTD.", 
            "Bright Star Engineering Inc.", "Carlson Software", "Electronic Arts, Inc.", "ESL Gaming GmbH", "FunPlus International AG",
            "KURO TECHNOLOGY (HONG KONG) CO., LIMITED", "Exbo North LLC", "PROXIMA BETA PTE. LIMITED", "DVDFab Software Inc.",
            "Asseco South Eastern Europe SA", "Palo Alto Networks (Netherlands) B.V.", "Alfa Bravo Inc.",
            "UBISOFT ENTERTAINMENT INC.", "Vidus Technology Limited", "FingerTas Solutions Co.,Ltd", "KRAFTON, Inc.",
            "CyCraft Technology Corporation, TAIWAN BRANCH (CAYMAN)", "Bytedance Pte. Ltd.", "Ubisoft Entertainment Sweden AB",
            "unlocktool.net", "Qinhuangdao Yizhishu Software Development Co., Ltd.", "Sony Interactive Entertainment LLC",
            "NetEase (Hangzhou) Network Co., Ltd", "ETH Zürich", "Wilcom International Pty Limited",
            "miHoYo Co.,Ltd.", "Azul Systems, Inc.", "Shanghai Feilai Information Technology Co., Ltd.", "BattlEye Innovations e.K.",
            "NCSOFT Corporation", "Tenorshare (Hongkong) Limited", "CAPCOM CO., LTD.", "Micromine Australia Pty Ltd",
            "Zhuhai Kingsoft Office Software Co., Ltd.") and
       process.code_signature.trusted == true) and

  not process.executable : ("?:\\Program Files (x86)\\FunPlus\\Stormshot\\nGame\\3.16.100\\Stormshot.exe",
                            "?:\\Program Files (x86)\\TurboServiceMobile\\TurboServiceMobile.exe",
                            "?:\\Program Files (x86)\\Zhizhen\\Zhizhen\\zhizhen.exe") and

  not (process.executable : "?:\\Windows\\System32\\taskhostw.exe" and user.id == "S-1-5-18" and
       _arraysearch(process.thread.Ext.call_stack, $entry,
                    $entry.symbol_info : ("?:\\Windows\\System32\\sysmain.dll!AgTwLoad*",
                                          "?:\\ProgramData\\Symantec\\Symantec Endpoint Protection\\*\\sysfer.dll*"))) and
  not (user.id == "S-1-5-18" and process.executable : "?:\\Program Files (x86)\\Acunetix\\*\\wvsc.exe") and
  not _arraysearch(process.thread.Ext.call_stack, $entry,
                   $entry.symbol_info: ("?:\\program files*\\avg\\antivirus\\aswhook.dll*",
                                        "?:\\ProgramData\\Symantec\\Symantec Endpoint Protection\\*\\Data\\Sysfer\\*\\sysfer.dll*",
                                        "?:\\Program Files\\ESET\\ESET Security\\ebehmoni.dll*",
                                        "?:\\Program Files\\ESET\\ESET Endpoint Antivirus\\ebehmoni.dll*",
                                        "?:\\Program Files\\Avokado\\Viruskerajs\\ebehmoni.dll*",
                                        "?:\\Windows\\System32\\sxwmon64.dll*",
                                        "?:\\Program Files\\Palo Alto Networks\\Traps\\cysvc.dll*")) and
  not process.executable :
                   ("C:\\Program Files\\Microsoft\\jdk-*-hotspot\\bin\\javaw.exe",
                    "C:\\Program Files (x86)\\FunPlus\\Stormshot\\nGame\\4.15.0\\Stormshot.exe",
                    "C:\\Program Files (x86)\\Supertone Shift\\Supertone Shift.exe",
                    "C:\\Program Files\\Synthesizer V Studio Pro\\synthv-studio.exe",
                    "C:\\Program Files (x86)\\Octoplus\\Octoplus_Samsung\\OctoplusSamsungNew.exe") and
  not process.thread.Ext.call_stack_summary in ("ntdll.dll|ace-drv64.dll")
  ]
 [any where

   /* potentially ntdll was modified in memory to unhook or patch a function */
  _arraysearch(process.thread.Ext.call_stack, $entry, $entry.allocation_private_bytes > 8000 and $entry.symbol_info: "?:\\windows\\sys*\\ntdll.dll*") and

  not _arraysearch(process.thread.Ext.call_stack, $entry,
                   $entry.symbol_info: ("?:\\program files*\\avg\\antivirus\\aswhook.dll+*",
                                        "?:\\ProgramData\\Symantec\\Symantec Endpoint Protection\\*\\Data\\Sysfer\\*\\sysfer.dll*",
                                        "?:\\Program Files\\ESET\\ESET Security\\ebehmoni.dll*",
                                        "?:\\Windows\\System32\\sxwmon64.dll*")) and

  not (event.category == "api" and process.Ext.api.parameters.size <= 4096 and
       ((process.code_signature.subject_name == "unlocktool.net" and process.code_signature.status =="errorUntrustedRoot") or
        process.thread.Ext.call_stack_final_user_module.hash.sha256 in ("2be89bd37bab3d9d7c08360cc062790450bee504ac689d1d0aa61da1ca2a7b64",
                                                                        "c4fcf0187e7fbf6939b08e929e10eb9eb5c1e4a45849cae6a677451249db066e",
                                                                        "5eed55767870ff871513789d8bbdc3343dfe3e0aff2c28faccdfe4c2c881da07",
                                                                        "f239e80bd672e0b33e9a8a9bf8a379b8b2df799e6462d2231b4ee5aa9d66f52a",
                                                                        "492664b28b0880fafe8dcb6fff020e185f08d3615b2fbf10828f85e95c68f8a1")))
  ]
'''

min_endpoint_version = "8.10.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"

[metadata]
creation_date = "2026/02/19"
integration = ["okta"]
maturity = "production"
updated_date = "2026/04/10"

[rule]
author = ["Elastic"]
description = """
Detects potential brute force attacks against a single Okta user account from multiple source IPs, indicating
attackers rotating through proxy infrastructure to evade IP-based detection.
"""
false_positives = [
    "Users with legitimate multi-location access (mobile + home + office) experiencing concurrent login issues.",
    "Shared service accounts accessed from multiple legitimate infrastructure IPs.",
]
from = "now-30m"
language = "esql"
license = "Elastic License v2"
name = "Potential Okta Brute Force (Multi-Source)"
note = """## Triage and analysis

### Investigating Potential Okta Brute Force (Multi-Source)

This rule identifies a single user account receiving failed authentication attempts from multiple unique source IPs. This pattern indicates attackers rotating through proxy infrastructure to evade IP-based detection while targeting a specific account.

#### Possible investigation steps
- Identify the targeted user account and determine if it has elevated privileges or sensitive access.
- Review the geographic distribution of source IPs for anomalies such as multiple countries or unusual locations.
- Examine the ASN ownership of source IPs for signs of proxy, VPN, or cloud infrastructure.
- Check if Okta flagged any of the sources as known threats or proxies.
- Determine if any authentication attempts succeeded following the failed attempts.
- Review the user's recent activity for signs of account compromise.

### False positive analysis
- Users traveling internationally with mobile devices may generate failed attempts from multiple locations.
- Service accounts accessed from distributed legitimate infrastructure may trigger this rule.
- Corporate VPN exit nodes spread across regions could appear as multiple IPs for a single user.

### Response and remediation
- If attack is confirmed, reset the user's password immediately.
- Review and potentially reset MFA for the targeted account.
- Block attacking IP addresses at the network perimeter.
- Consider implementing geo-restrictions for the targeted account if dispersed access is not expected.
- Monitor for any successful authentication that may indicate compromise.
"""
references = [
    "https://support.okta.com/help/s/article/Troubleshooting-Distributed-Brute-Force-andor-Password-Spray-attacks-in-Okta",
    "https://www.okta.com/identity-101/brute-force/",
    "https://developer.okta.com/docs/reference/api/event-types/",
    "https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy",
    "https://www.elastic.co/security-labs/monitoring-okta-threats-with-elastic-security",
    "https://www.elastic.co/security-labs/starter-guide-to-understanding-okta",
]
risk_score = 47
rule_id = "5889760c-9858-4b4b-879c-e299df493295"
setup = "The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."
severity = "medium"
tags = [
    "Domain: Identity",
    "Use Case: Identity and Access Audit",
    "Use Case: Threat Detection",
    "Data Source: Okta",
    "Data Source: Okta System Logs",
    "Tactic: Credential Access",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "esql"

query = '''
FROM logs-okta.system-* METADATA _id, _version, _index
| WHERE data_stream.dataset == "okta.system"
    AND (event.action LIKE "user.authentication.*" OR event.action == "user.session.start")
    AND okta.outcome.reason IN ("INVALID_CREDENTIALS", "LOCKED_OUT")
    AND okta.actor.alternate_id IS NOT NULL

// Create source mapping for analyst context
| EVAL Esql.source_info = CONCAT(
    "{\"ip\":\"", COALESCE(okta.client.ip::STRING, "unknown"),
    "\",\"country\":\"", COALESCE(client.geo.country_name, "unknown"),
    "\",\"asn\":\"", COALESCE(source.as.organization.name, "unknown"),
    "\",\"user_agent\":\"", COALESCE(okta.client.user_agent.raw_user_agent, "unknown"), "\"}"
  )

| STATS
    Esql.unique_source_ips = COUNT_DISTINCT(okta.client.ip),
    Esql.total_attempts = COUNT(*),
    Esql.unique_user_agents = COUNT_DISTINCT(okta.client.user_agent.raw_user_agent),
    Esql.unique_dt_hashes = COUNT_DISTINCT(okta.debug_context.debug_data.dt_hash),
    Esql.unique_asns = COUNT_DISTINCT(source.as.number),
    Esql.unique_countries = COUNT_DISTINCT(client.geo.country_name),
    Esql.first_seen = MIN(@timestamp),
    Esql.last_seen = MAX(@timestamp),
    Esql.source_ip_values = VALUES(okta.client.ip),
    Esql.source_mapping = VALUES(Esql.source_info),
    Esql.event_action_values = VALUES(event.action),
    Esql.user_agent_values = VALUES(okta.client.user_agent.raw_user_agent),
    Esql.device_values = VALUES(okta.client.device),
    Esql.is_proxy_values = VALUES(okta.security_context.is_proxy),
    Esql.geo_country_values = VALUES(client.geo.country_name),
    Esql.geo_city_values = VALUES(client.geo.city_name),
    Esql.source_asn_values = VALUES(source.as.number),
    Esql.source_asn_org_values = VALUES(source.as.organization.name),
    Esql.threat_suspected_values = VALUES(okta.debug_context.debug_data.threat_suspected),
    Esql.risk_level_values = VALUES(okta.debug_context.debug_data.risk_level),
    Esql.risk_reasons_values = VALUES(okta.debug_context.debug_data.risk_reasons)
  BY okta.actor.alternate_id

| EVAL
    Esql.attempts_per_ip = Esql.total_attempts * 1.0 / Esql.unique_source_ips,
    Esql.duration_seconds = DATE_DIFF("seconds", Esql.first_seen, Esql.last_seen)

| WHERE
    Esql.unique_source_ips >= 5
    AND Esql.total_attempts >= 10
    AND (
        Esql.unique_countries >= 2 OR
        Esql.unique_asns >= 3 OR
        Esql.unique_source_ips >= 8 OR
        Esql.unique_user_agents >= 3
    )

| SORT Esql.unique_source_ips DESC
| KEEP Esql.*, okta.actor.alternate_id
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1110"
name = "Brute Force"
reference = "https://attack.mitre.org/techniques/T1110/"
[[rule.threat.technique.subtechnique]]
id = "T1110.001"
name = "Password Guessing"
reference = "https://attack.mitre.org/techniques/T1110/001/"


[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"