Elastic rules: 2d

[metadata]
creation_date = "2020/06/04"
integration = ["aws"]
maturity = "production"
updated_date = "2026/08/05"

[rule]
author = ["Elastic"]
description = """
Identifies the creation of an AWS EC2 network access control list (ACL) or an entry in a network ACL with a specified rule number. Adversaries may exploit ACLs to establish persistence or exfiltrate data by creating permissive rules.
"""
false_positives = [
    """
    Network ACL's may be created by a network administrator. Verify whether the user identity should be making changes in your environment. Network ACL creations by unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
    """,
]
from = "now-6m"
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
interval = "5m"
language = "kuery"
license = "Elastic License v2"
name = "AWS EC2 Network Access Control List Creation"
note = """## Triage and analysis

### Investigating AWS EC2 Network Access Control List Creation

AWS EC2 Network ACLs are stateless firewalls for controlling inbound and outbound traffic at the subnet level. Adversaries may exploit ACLs to establish persistence or exfiltrate data by creating permissive rules. The detection rule monitors successful creation events of ACLs or entries, flagging potential unauthorized modifications that align with persistence tactics, aiding in early threat identification.

### Possible investigation steps

- Review the CloudTrail logs for the specific event.dataset:aws.cloudtrail entries to identify the user or role (event.user) that initiated the CreateNetworkAcl or CreateNetworkAclEntry actions.
- Examine the event.provider:ec2.amazonaws.com logs to determine the IP addresses and locations associated with the request to assess if they are expected or suspicious.
- Check the event.action details to understand the specific rules created in the Network ACL, focusing on any overly permissive rules that could indicate a security risk.
- Investigate the event.outcome:success entries to confirm the successful creation of the ACL or ACL entry and correlate with any other suspicious activities in the AWS environment.
- Cross-reference the event with other security alerts or logs to identify any patterns or anomalies that could suggest malicious intent or unauthorized access.
- Assess the impact of the new ACL rules on the network security posture, ensuring they do not inadvertently allow unauthorized access or data exfiltration.

### False positive analysis

- Routine infrastructure updates or deployments may trigger the creation of new network ACLs or entries. To manage this, establish a baseline of expected changes during scheduled maintenance windows and exclude these from alerts.
- Automated scripts or infrastructure-as-code tools like Terraform or CloudFormation can create network ACLs as part of normal operations. Identify and whitelist these automated processes to prevent unnecessary alerts.
- Changes made by trusted administrators or security teams for legitimate purposes can be mistaken for suspicious activity. Implement a process to log and review approved changes, allowing you to exclude these from detection.
- Temporary ACLs created for troubleshooting or testing purposes can generate alerts. Document and track these activities, and use tags or naming conventions to easily identify and exclude them from monitoring.
- Third-party services or integrations that require specific network configurations might create ACLs. Review and validate these services, and if deemed safe, add them to an exception list to reduce false positives.

### Response and remediation

- Immediately review the AWS CloudTrail logs to confirm the creation of the Network ACL or entry and identify the IAM user or role responsible for the action. This helps determine if the action was authorized or potentially malicious.
- Revoke any suspicious or unauthorized IAM credentials associated with the creation of the Network ACL or entry to prevent further unauthorized access.
- Modify or delete the newly created Network ACL or entry if it is determined to be unauthorized or overly permissive, ensuring that it aligns with your organization's security policies.
- Conduct a security review of the affected AWS environment to identify any other unauthorized changes or indicators of compromise, focusing on persistence mechanisms.
- Implement additional monitoring and alerting for changes to Network ACLs and other critical AWS resources to enhance detection of similar threats in the future.
- Escalate the incident to the security operations team or incident response team for further investigation and to determine if additional containment or remediation actions are necessary.
- Review and update IAM policies and permissions to ensure the principle of least privilege is enforced, reducing the risk of unauthorized changes to network configurations.

"""
references = [
    "https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/create-network-acl.html",
    "https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateNetworkAcl.html",
    "https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/create-network-acl-entry.html",
    "https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateNetworkAclEntry.html",
]
risk_score = 21
rule_id = "39144f38-5284-4f8e-a2ae-e3fd628d90b0"
severity = "low"
tags = [
    "Domain: Cloud",
    "Platform: AWS",
    "Data Source: AWS CloudTrail",
    "Service: AWS EC2",
    "Tactic: Defense Evasion",
    "Tactic: Persistence",
    "Rule Type: Custom Query (KQL)",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset:aws.cloudtrail and event.provider:ec2.amazonaws.com and event.action:(CreateNetworkAcl or CreateNetworkAclEntry) and event.outcome:success
    and not user_agent.original: (*Terraform* or *Pulumi* or *Ansible*)
'''

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user_agent.original",
    "source.address",
    "aws.cloudtrail.user_identity.arn",
    "aws.cloudtrail.user_identity.type",
    "aws.cloudtrail.user_identity.access_key_id",
    "event.action",
    "event.outcome",
    "cloud.account.id",
    "cloud.region",
    "aws.cloudtrail.request_parameters",
    "aws.cloudtrail.response_elements"
]

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1133"
name = "External Remote Services"
reference = "https://attack.mitre.org/techniques/T1133/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"

[[rule.threat.technique.subtechnique]]
id = "T1562.007"
name = "Disable or Modify Cloud Firewall"
reference = "https://attack.mitre.org/techniques/T1562/007/"

[[rule.threat.technique]]
id = "T1578"
name = "Modify Cloud Compute Infrastructure"
reference = "https://attack.mitre.org/techniques/T1578/"

[[rule.threat.technique.subtechnique]]
id = "T1578.005"
name = "Modify Cloud Compute Configurations"
reference = "https://attack.mitre.org/techniques/T1578/005/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[metadata]
creation_date = "2024/04/16"
integration = ["aws"]
maturity = "production"
updated_date = "2026/07/08"

[rule]
author = ["Elastic"]
description = """
Identifies the first occurrence of an AWS user or role establishing a session via SSM to an EC2 instance. Adversaries may use AWS Session Manager to establish a session to an EC2 instance to execute commands on the instance. This can be used to gain access to the instance and perform actions such as privilege escalation. 
"""
false_positives = ["Legitimate use of AWS Session Manager to establish a session to an EC2 instance."]
from = "now-6m"
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
language = "kuery"
license = "Elastic License v2"
name = "AWS SSM Session Started to EC2 Instance"
note = """## Triage and analysis

### Investigating AWS SSM Session Started to EC2 Instance

This rule detects the first instance of an AWS user or role initiating an SSM session to an EC2 instance, which could be indicative of legitimate administrative activities or potential malicious actions like command execution or lateral movement.

#### Possible Investigation Steps

- **Examine the Session Start Event**: Review the AWS CloudTrail log for the event.
    - Determine the target EC2 instance using `aws.cloudtrail.request_parameters`.
- **Verify User Identity and Role**: Check the user’s ARN and access key ID (`aws.cloudtrail.user_identity.access_key_id`).
    - Determine if their role typically requires initiating SSM sessions.
- **Assess Geographic and IP Context**: Analyze the source IP (`source.ip`) and geographic location (`source.geo`) from which the session was initiated.
    - Determine if these are consistent with typical user locations or if they raise suspicions of compromise or misuse.
- **Review Session Details**: Examine details like the session ID and stream URL (`aws.cloudtrail.response_elements`) to understand the scope and nature of the session.
    - Check if any commands executed during the session were unauthorized or out of ordinary practices.
- **Correlate with Other Security Events**: Look for other related security events around the time of the session start to identify any pattern or broader attack vector that may involve this user or EC2 instance.

### False Positive Analysis

- **Legitimate Administrative Activities**: Confirm whether the SSM session was initiated for valid administrative purposes such as system maintenance, patching, or configuration updates. Verify with the respective teams or personnel.

### Response and Remediation

- **Incident Response Activation**: If malicious intent or actions are confirmed, activate the incident response protocol.
    - This includes containment of the threat, eradication of the adversary’s presence, recovery of affected systems, and a thorough investigation.
- **Validate and Reinforce Security Policies**: Ensure that policies around SSM session initiation are strict and adhere to the principle of least privilege.
    - Update IAM policies if necessary to tighten controls.
- **Enhance Monitoring and Alerts**: Improve monitoring of SSM sessions, particularly focusing on sessions that involve sensitive or critical EC2 instances.
    - Adjust alerting mechanisms to flag unusual session initiations promptly.

### Additional Information

For more in-depth understanding of managing SSM sessions and security best practices, refer to the [AWS Systems Manager documentation](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_StartSession.html). Additionally, consider the security implications and best practices outlined in [AWS SSM privilege escalation techniques](https://cloud.hacktricks.xyz/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ssm-privesc).

"""
references = [
    "https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_StartSession.html",
    "https://hackingthe.cloud/aws/post_exploitation/intercept_ssm_communications/",
    "https://cloud.hacktricks.xyz/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ssm-privesc",
    "https://unit42.paloaltonetworks.com/cloud-lateral-movement-techniques",
]
risk_score = 73
rule_id = "804a7ac8-fc00-11ee-924b-f661ea17fbce"
severity = "high"
tags = [
    "Domain: Cloud",
    "Data Source: AWS",
    "Data Source: Amazon Web Services",
    "Data Source: AWS SSM",
    "Data Source: AWS EC2",
    "Use Case: Threat Detection",
    "Tactic: Lateral Movement",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "new_terms"

query = '''
data_stream.dataset:"aws.cloudtrail" and event.provider:"ssm.amazonaws.com"
    and event.action:"StartSession" and event.outcome:"success"
'''

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user_agent.original",
    "source.ip",
    "aws.cloudtrail.user_identity.arn",
    "aws.cloudtrail.user_identity.type",
    "aws.cloudtrail.user_identity.access_key_id",
    "event.action",
    "event.outcome",
    "cloud.account.id",
    "cloud.region",
    "aws.cloudtrail.request_parameters",
    "aws.cloudtrail.response_elements"
]

[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1021"
name = "Remote Services"
reference = "https://attack.mitre.org/techniques/T1021/"
[[rule.threat.technique.subtechnique]]
id = "T1021.007"
name = "Cloud Services"
reference = "https://attack.mitre.org/techniques/T1021/007/"



[rule.threat.tactic]
id = "TA0008"
name = "Lateral Movement"
reference = "https://attack.mitre.org/tactics/TA0008/"

[rule.new_terms]
field = "new_terms_fields"
value = ["cloud.account.id", "user.name"]
[[rule.new_terms.history_window_start]]
field = "history_window_start"
value = "now-10d"

[metadata]
creation_date = "2020/06/15"
integration = ["aws"]
maturity = "production"
updated_date = "2026/08/05"

[rule]
author = ["Elastic"]
description = """
Identifies the deletion of one or more flow logs in AWS Elastic Compute Cloud (EC2). An adversary may delete flow logs in an attempt to evade defenses.
"""
false_positives = [
    """
    Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Flow log
    deletions by unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can
    be exempted from the rule.
    """,
]
from = "now-6m"
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
interval = "5m"
language = "kuery"
license = "Elastic License v2"
name = "AWS VPC Flow Logs Deletion"
note = """## Triage and analysis

### Investigating AWS VPC Flow Logs Deletion

VPC Flow Logs is an AWS feature that enables you to capture information about the IP traffic going to and from network interfaces in your virtual private cloud (VPC). Flow log data can be published to Amazon CloudWatch Logs or Amazon S3.

This rule identifies the deletion of VPC flow logs using the API `DeleteFlowLogs` action. Attackers can do this to cover their tracks and impact security monitoring that relies on this source.

#### Possible investigation steps

- Identify the user account that performed the action and whether it should perform this kind of action.
- Investigate other alerts associated with the user account during the past 48 hours.
- Contact the account and resource owners and confirm whether they are aware of this activity.
- Check if this operation was approved and performed according to the organization's change management policy.
- Considering the source IP address and geolocation of the user who issued the command:
    - Do they look normal for the user?
    - If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts or is the source IP from an EC2 instance that's not under your control?
    - If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles? Are there any other alerts or signs of suspicious activity involving this instance?
- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.

### False positive analysis

- If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination of user and IP address conditions.
- Administrators may rotate these logs after a certain period as part of their retention policy or after importing them to a SIEM.

### Response and remediation

- Initiate the incident response process based on the outcome of the triage.
- Disable or limit the account during the investigation and response.
- Identify the possible impact of the incident and prioritize accordingly; the following actions can help you gain context:
    - Identify the account role in the cloud environment.
    - Assess the criticality of affected services and servers.
    - Work with your IT team to identify and minimize the impact on users.
    - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
    - Identify any regulatory or legal ramifications related to this activity.
- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
- Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.
- Consider enabling multi-factor authentication for users.
- Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
- Implement security best practices [outlined](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/) by AWS.
- Take the actions needed to return affected systems, data, or services to their normal operational levels.
- Identify the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).

## Setup

The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
references = [
    "https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/delete-flow-logs.html",
    "https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteFlowLogs.html",
]
risk_score = 73
rule_id = "9395fd2c-9947-4472-86ef-4aceb2f7e872"
severity = "high"
tags = [
    "Domain: Cloud",
    "Platform: AWS",
    "Data Source: AWS CloudTrail",
    "Service: AWS EC2",
    "Tactic: Defense Evasion",
    "Rule Type: Custom Query (KQL)",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset:aws.cloudtrail and event.provider:ec2.amazonaws.com and event.action:DeleteFlowLogs and event.outcome:success
    and not user_agent.original: (*Terraform* or *Pulumi*)
'''

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user_agent.original",
    "source.address",
    "aws.cloudtrail.user_identity.arn",
    "aws.cloudtrail.user_identity.type",
    "aws.cloudtrail.user_identity.access_key_id",
    "event.action",
    "event.outcome",
    "cloud.account.id",
    "cloud.region",
    "aws.cloudtrail.request_parameters",
    "aws.cloudtrail.response_elements"
]

[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[rule.threat.technique.subtechnique]]
id = "T1562.008"
name = "Disable or Modify Cloud Logs"
reference = "https://attack.mitre.org/techniques/T1562/008/"



[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[metadata]
creation_date = "2026/03/10"
integration = ["azure"]
maturity = "production"
updated_date = "2026/04/10"

[rule]
author = ["Elastic"]
description = """
Detects when a service principal or user performs an Azure Arc cluster credential listing operation from a source IP not
previously associated with that identity. The `listClusterUserCredential` action retrieves credentials for the Arc
Cluster Connect proxy, enabling kubectl access through the Azure ARM API. An adversary using stolen service principal
credentials will typically call this operation from infrastructure not previously seen for that SP. By tracking the
combination of caller identity and source IP, this rule avoids false positives from backend services and CI/CD pipelines
that rotate IPs but maintain consistent identity-to-IP patterns over time.
"""
false_positives = [
    """
    A service principal used by a CI/CD pipeline may trigger this rule when the pipeline runs from a new IP range for
    the first time (e.g., migrating to a new runner pool). The 7-day history window will learn the new IPs after the
    first occurrence.
    """,
    """
    Administrators accessing Arc clusters from a new VPN endpoint or travel location. Validate the caller identity
    matches an expected user and correlate with known travel or access patterns.
    """,
]
from = "now-9m"
index = ["logs-azure.activitylogs-*"]
language = "kuery"
license = "Elastic License v2"
name = "Azure Arc Cluster Credential Access by Identity from Unusual Source"
note = """## Triage and analysis

### Investigating Azure Arc Cluster Credential Access by Identity from Unusual Source

The `listClusterUserCredential` operation on an Azure Arc-connected cluster returns credentials that allow the caller
to establish a proxy tunnel via `az connectedk8s proxy`. This proxy routes kubectl commands through the Azure ARM API,
enabling Kubernetes access without direct network connectivity to the cluster API server.

### Possible investigation steps

- Identify the caller service principal using `azure.activitylogs.identity.claims.appid` and cross-reference with
  Azure AD to determine if this is a known application.
- Check the source IP and geolocation — is this from a country or ASN where your organization operates?
- Correlate with Azure Sign-In Logs around the same time to see the full authentication chain (SP login followed by
  credential listing).
- Verify the Azure role used — the `Azure Arc Enabled Kubernetes Cluster User Role` is required for this operation.
  Was this role recently assigned?
- Check if subsequent Arc-proxied operations (secret/configmap CRUD) occurred after the credential access.
- Review the service principal creation date in Azure AD — recently created SPs are more suspicious.

### Response and remediation

- If the source IP is from an unexpected country or the service principal is not recognized, treat as potential
  credential compromise.
- Revoke the service principal credentials and remove Arc RBAC role assignments.
- Review Kubernetes audit logs for any operations performed through the Arc proxy after credential access.
- Rotate any Kubernetes secrets that may have been accessed.
"""
references = [
    "https://learn.microsoft.com/en-us/azure/azure-arc/kubernetes/cluster-connect",
    "https://learn.microsoft.com/en-us/cli/azure/connectedk8s#az-connectedk8s-proxy",
    "https://www.ibm.com/think/x-force/identifying-abusing-azure-arc-for-hybrid-escalation-persistence",
    "https://nvd.nist.gov/vuln/detail/cve-2022-37968",
]
risk_score = 47
rule_id = "022c37cd-5a4f-422b-8227-b136b7a23180"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Data Source: Azure",
    "Data Source: Azure Arc",
    "Data Source: Azure Activity Logs",
    "Use Case: Threat Detection",
    "Tactic: Initial Access",
    "Tactic: Credential Access",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "new_terms"

query = '''
data_stream.dataset: "azure.activitylogs"
    and azure.activitylogs.operation_name: "MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/LISTCLUSTERUSERCREDENTIAL/ACTION"
    and event.outcome: (Success or success)
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"

[[rule.threat.technique.subtechnique]]
id = "T1078.004"
name = "Cloud Accounts"
reference = "https://attack.mitre.org/techniques/T1078/004/"

[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"

[[rule.threat.technique.subtechnique]]
id = "T1552.007"
name = "Container API"
reference = "https://attack.mitre.org/techniques/T1552/007/"

[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"

[[rule.threat.technique.subtechnique]]
id = "T1078.004"
name = "Cloud Accounts"
reference = "https://attack.mitre.org/techniques/T1078/004/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[rule.investigation_fields]
field_names = [
    "@timestamp",
    "azure.activitylogs.operation_name",
    "azure.activitylogs.identity.claims.appid",
    "azure.activitylogs.identity.authorization.evidence.role",
    "azure.activitylogs.identity.authorization.evidence.principalType",
    "azure.resource.id",
    "source.ip",
    "source.geo.country_name",
    "source.geo.city_name",
    "source.as.organization.name",
]

[rule.new_terms]
field = "new_terms_fields"
value = ["azure.activitylogs.identity.claims.appid", "source.ip"]
[[rule.new_terms.history_window_start]]
field = "history_window_start"
value = "now-7d"

[metadata]
creation_date = "2026/08/25"
integration = ["endpoint"]
maturity = "production"
updated_date = "2026/08/31"

[rule]
author = ["Elastic"]
description = """
This rule detects the creation of a binfmt configuration file. Binfmt is a utility that is used to
configure the behavior of the Linux kernel when executing binary files. By creating a malicious
binfmt configuration file, threat actors can execute a backdoor script or command on the target system.
"""
from = "now-9m"
index = ["logs-endpoint.events.file*"]
language = "eql"
license = "Elastic License v2"
name = "Binfmt Configuration File Creation"
note = """ ## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Binfmt Configuration File Creation

This rule detects creation of Linux binfmt configuration files or registrations that alter how the kernel handles executable formats, which may establish persistent command execution. An attacker can register a crafted binary signature and interpreter so that launching a matching executable automatically invokes a backdoor script under the initiating user’s privileges.

### Possible investigation steps

- Inspect the new configuration or registration content for unusual magic bytes, masks, flags, extensions, and interpreter paths that reference scripts, writable directories, temporary locations, or network-mounted files.
- Review the creating process’s user, command line, parent chain, working directory, package provenance, and nearby shell or privilege-escalation activity to determine whether the change was authorized.
- Correlate the event with systemd-binfmt restarts, writes to the binfmt_misc register interface, and subsequent execution of the configured interpreter or matching binaries.
- Search across the environment for the same configuration content, interpreter path, file hash, or responsible account to identify additional affected hosts and determine campaign scope.
- If unauthorized, preserve the configuration and relevant telemetry, disable or unregister the handler, remove persistence artifacts, and investigate the originating account and process for further compromise.

### False positive analysis

- An administrator or approved automation may create a binfmt configuration to support a legitimate binary format, which analysts can verify by reviewing the change record, responsible account, configuration contents, and interpreter path.
- An authorized package installation or system update may register or replace a binfmt handler, which analysts can confirm by correlating the event with package activity and validating the creating process and file against expected system changes.

### Response and remediation

- Isolate the affected Linux host from untrusted networks while preserving approved management access, volatile evidence, and copies of the malicious binfmt configuration and interpreter.
- Unregister the malicious handler under `/proc/sys/fs/binfmt_misc`, remove its files from binfmt configuration directories, delete associated backdoor scripts or binaries, and restart `systemd-binfmt` only after validating remaining entries.
- Escalate immediately to incident response if the configured interpreter executed, root privileges were involved, credentials may have been exposed, or matching artifacts appear on additional hosts.
- Revoke attacker-controlled sessions, rotate credentials used on the host, and search for related scheduled tasks, services, startup files, modified SSH keys, and payloads created by the responsible process.
- Reimage the system from a known-good baseline when integrity cannot be established; otherwise restore trusted configuration files and packages, verify kernel and system binaries, and confirm only approved binfmt handlers remain.
- Restrict write access to binfmt configuration paths and registration interfaces, enforce least privilege for administrative automation, and monitor future handler creation, registration, and interpreter execution.
"""
references = ["https://dfir.ch/posts/today_i_learned_binfmt_misc/"]
risk_score = 21
rule_id = "a3b47d21-20d6-45b0-8b75-fc27073bdef2"
setup = """## Setup

This rule requires data coming in from Elastic Defend.

### Elastic Defend Integration Setup
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.

#### Prerequisite Requirements:
- Fleet is required for Elastic Defend.
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).

#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
- Go to the Kibana home page and click "Add integrations".
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
- Click "Add Elastic Defend".
- Configure the integration name and optionally add a description.
- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
- Click "Save and Continue".
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
"""
severity = "low"
tags = [
    "Domain: Endpoint",
    "OS: Linux",
    "Platform: Linux",
    "Use Case: Threat Detection",
    "Tactic: Persistence",
    "Data Source: Elastic Defend",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"
query = '''
file where host.os.type == "linux" and event.action != "deletion" and process.executable != null and
file.path like (
  "/etc/binfmt.d/*.conf", "/run/binfmt.d/*.conf", "/usr/local/lib/binfmt.d/*.conf", "/usr/lib/binfmt.d/*.conf",
  "/proc/sys/fs/binfmt_misc/register", "/proc/sys/fs/binfmt_misc/*"
) and
not (
  file.path like (
    "/usr/lib/binfmt.d/python3.*.conf", "/usr/lib/binfmt.d/qemu-*-static.conf",
    "/proc/sys/fs/binfmt_misc/status"
  ) or
  process.executable == "/usr/lib/systemd/systemd-binfmt"
)
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1546"
name = "Event Triggered Execution"
reference = "https://attack.mitre.org/techniques/T1546/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[metadata]
creation_date = "2026/03/26"
integration = ["endpoint", "sentinel_one_cloud_funnel", "crowdstrike", "auditd_manager", "windows", "system"]
maturity = "production"
updated_date = "2026/04/06"

[rule]
author = ["Elastic"]
description = """
Identifies the execution of the OpenSSL utility to encrypt data. Adversaries may use OpenSSL to encrypt data to
disrupt the availability of their target's data and may attempt to hold the organization's data to ransom for the
purposes of extortion.
"""
from = "now-9m"
index = [
    "endgame-*",
    "logs-crowdstrike.fdr*",
    "logs-endpoint.events.process-*",
    "logs-sentinel_one_cloud_funnel.*",
    "auditbeat-*",
    "logs-auditd_manager.auditd-*", 
    "logs-system.security*",
    "logs-windows.forwarded*",
    "logs-windows.sysmon_operational-*",
    "winlogbeat-*"
]
language = "eql"
license = "Elastic License v2"
name = "Data Encrypted via OpenSSL Utility"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Data Encrypted via OpenSSL Utility

This rule flags the OpenSSL command-line tool when it starts encrypting a file with explicit input and output paths, a pattern that can indicate an attempt to hide or lock data. An attacker on Linux or macOS might run `openssl enc -aes-256-cbc -in /home/shared/payroll.csv -out /tmp/payroll.csv.enc` to encrypt collected documents before staging them for exfiltration or to prepare data for a ransomware-style extortion event.

### Possible investigation steps

- Review the full OpenSSL invocation to identify the cipher used, the source and destination file paths, whether a password or key was supplied inline or via script, and whether the targeted data is business-critical or user-owned.
- Trace the parent and ancestor execution chain to determine whether the activity originated from an approved administrative workflow or from unusual launch points such as interactive shells, remote access tools, scheduled tasks, temporary folders, or user download locations.
- Scope adjacent file activity on the host to see whether this was a single expected encryption task or part of a wider pattern of mass file reads, encrypted output creation, original file deletion, or access to shared drives and sensitive repositories.
- Investigate the initiating account and system for precursor signs of compromise, including recent suspicious logons, privilege escalation, script execution, tool transfer, or other activity that is inconsistent with the user’s normal administrative behavior.
- Search for follow-on actions that would raise ransomware or exfiltration concern, such as archive creation, outbound network transfers, ransom note drops, service stoppage, shadow copy removal, or attempts to disable security controls.

### False positive analysis

- Administrators may use `openssl enc -in ... -out ...` in backup or file-transfer scripts to protect exports, archives, or configuration bundles; verify the parent script or scheduled task, the service account, and the source and destination paths align with a documented maintenance workflow.
- Developers or support personnel may encrypt test data sets or collected logs before sharing them internally for troubleshooting; verify the initiating user’s role, confirm the files are expected non-production artifacts, and check for a related change or support activity during the same time window.

### Response and remediation

- Isolate the affected endpoint from the network and disconnect mapped drives or mounted shares to stop further encryption while preserving the OpenSSL binary, shell history, encrypted output files, and any wrapper scripts as evidence.
- Remove attacker persistence by deleting malicious Scheduled Tasks, cron jobs, systemd services, launch agents, startup items, and scripts that invoked `openssl enc`, and quarantine any copied tools or payloads found in temporary or user-writable directories.
- Reset passwords, revoke active sessions and tokens, and rotate SSH keys or service-account secrets associated with the compromised host or user if the encryption activity was launched from an interactive shell, remote access session, or automation account.
- Restore impacted files from known-good offline or immutable backups and rebuild or reimage the system if core binaries, startup locations, or security tools were modified, validating restored data before returning the host to production.
- Escalate immediately to incident response if encrypted files were written to shared storage, similar OpenSSL commands appear on multiple hosts, ransom notes or extortion messages are present, or backup repositories and domain-admin accounts may be affected.
- Harden the environment by restricting OpenSSL execution to approved admins and paths, enforcing application allowlisting, limiting write access to sensitive shares, disabling unused remote administration tools, and adding detections for mass file encryption and shadow-copy or backup tampering.

"""
risk_score = 21
rule_id = "feba48f6-40ca-4d04-b41f-5dfa327de865"
severity = "low"
tags = [
    "Domain: Endpoint",
    "OS: Linux",
    "OS: Windows",
    "OS: macOS",
    "Use Case: Threat Detection",
    "Tactic: Defense Evasion",
    "Tactic: Collection",
    "Data Source: Elastic Defend",
    "Data Source: Elastic Endgame",
    "Data Source: Crowdstrike",
    "Data Source: SentinelOne",
    "Data Source: Auditd Manager",
    "Data Source: Windows Security Event Logs",
    "Data Source: Sysmon",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"
query = '''
process where event.type == "start" and event.action in ("start", "exec", "executed", "exec_event", "ProcessRollup2") and
process.name : "openssl*" and process.args : "enc" and process.args : "-in" and process.args : "-out"
'''

[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1027"
name = "Obfuscated Files or Information"
reference = "https://attack.mitre.org/techniques/T1027/"
[[rule.threat.technique.subtechnique]]
id = "T1027.013"
name = "Encrypted/Encoded File"
reference = "https://attack.mitre.org/techniques/T1027/013/"


[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"


[[rule.threat]]
framework = "MITRE ATT&CK"

  [rule.threat.tactic]
  name = "Collection"
  id = "TA0009"
  reference = "https://attack.mitre.org/tactics/TA0009/"

  [[rule.threat.technique]]
  name = "Data Staged"
  id = "T1074"
  reference = "https://attack.mitre.org/techniques/T1074/"

    [[rule.threat.technique.subtechnique]]
    name = "Local Data Staging"
    id = "T1074.001"
    reference = "https://attack.mitre.org/techniques/T1074/001/"

[rule]
description = """
Identifies the execution of a process from a downloaded ISO file. Attacker may abuse ISO files to deliver malicious
programs.
"""
id = "df9cc41e-4686-4aa0-8f79-60055dd01812"
license = "Elastic License v2"
name = "Execution from a Downloaded ISO File"
os_list = ["windows"]
version = "1.0.28"

query = '''
sequence with maxspan=5m
 [file where event.action != "deletion" and file.extension : ("ISO", "IMG") and
  (
    file.path : ("?:\\Users\\*\\Downloads\\*",
                 "?:\\Users\\*\\Content.Outlook\\*",
                 "?:\\Users\\*\\AppData\\Local\\Temp\\Temp?_*") or
    file.name : "*:Zone.Identifier" or
    file.Ext.windows.zone_identifier > 1
   ) and
   not process.executable : "?:\\Windows\\System32\\dllhost.exe"
  ]
 [process where event.action == "start" and
  process.parent.name : ("explorer.exe", "cmd.exe", "powershell.exe") and 
  process.working_directory : "?:\\" and 

  /* execution from mounted ISO file */
  (process.executable : "\\Device\\CdRom*" or (process.executable : "?:\\*" and not process.executable : "?:\\*\\*")) and

  not (process.pe.original_file_name : ("setup.exe", "SqlSetupBootstrapper.exe") and process.code_signature.trusted == true)
  ]
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"
[[threat.technique.subtechnique]]
id = "T1566.001"
name = "Spearphishing Attachment"
reference = "https://attack.mitre.org/techniques/T1566/001/"



[threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"

[internal]
min_endpoint_version = "7.15.0"

[rule]
description = """
Identifies when the native Osascript binary spawns itself to execute a Javascript payload. An adversary may use this
technique to execute their malicious payload and obtain initial access to an endpoint.
"""
id = "207f36d5-1aa0-4827-9055-bec5747de03b"
license = "Elastic License v2"
name = "Execution of Javascript Payload via Osascript"
os_list = ["macos"]
reference = ["https://github.com/MythicAgents/apfell"]
version = "1.0.9"

query = '''
process where event.action == "exec" and process.name == "osascript" and
 process.parent.name == "osascript" and
 process.args == "-l" and process.args : "JavaScript*" and
 not process.Ext.effective_parent.executable in ("/usr/local/jamf/bin/jamf",
                                                 "/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfDaemon.app/Contents/MacOS/JamfDaemon", 
                                                 "/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfManagementService.app/Contents/MacOS/JamfManagementService")
'''

min_endpoint_version = "8.5.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.007"
name = "JavaScript"
reference = "https://attack.mitre.org/techniques/T1059/007/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "8.5.0"

[metadata]
creation_date = "2024/04/16"
integration = ["aws"]
maturity = "production"
updated_date = "2026/08/05"

[rule]
author = ["Elastic"]
description = """
Identifies when a specified inbound (ingress) rule is added or adjusted for a VPC security group in AWS EC2. This rule detects when a security group rule is added that allows traffic from any IP address or from a specific IP address to common remote access ports, such as 22 (SSH) or 3389 (RDP). Adversaries may add these rules to allow remote access to VPC instances from any location, increasing the attack surface and potentially exposing the instances to unauthorized access.
"""
false_positives = [
    """
    Administrators may legitimately add security group rules to allow traffic from any IP address or from specific IP addresses to common remote access ports.
    """,
]
from = "now-6m"
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
interval = "5m"
language = "kuery"
license = "Elastic License v2"
name = "Insecure AWS EC2 VPC Security Group Ingress Rule Added"
note = """## Triage and analysis

### Investigating Insecure AWS EC2 VPC Security Group Ingress Rule Added

This rule detects the addition of ingress rules to a VPC security group that allow traffic from any IP address (`0.0.0.0/0` or `::/0`) to sensitive ports commonly used for remote access, such as SSH (port 22) and RDP (port 3389). This configuration change can significantly increase the exposure of EC2 instances to potential threats, making it crucial to understand the context and legitimacy of such changes.

#### Possible Investigation Steps:

- **Identify the Actor**: Review the `aws.cloudtrail.user_identity.arn` and `aws.cloudtrail.user_identity.access_key_id` fields to identify who made the change. Investigate whether this actor has the necessary permissions and typically performs these actions.
- **Review the Request Details**: Examine the `aws.cloudtrail.request_parameters` to understand exactly what changes were made to the security group. Check for any unusual parameters that could suggest a misconfiguration or malicious intent.
- **Analyze the Source of the Request**: Look at the `source.ip` and `source.geo` fields to determine the geographical origin of the request. An external or unusual location could indicate compromised credentials.
- **Contextualize with Timestamp**: Use the `@timestamp` field to check when the change occurred. Modifications outside of typical business hours might warrant additional scrutiny.
- **Correlate with Other Activities**: Search for related CloudTrail events before and after this change to see if the same actor engaged in other potentially suspicious activities.

### False Positive Analysis:

- **Legitimate Administrative Actions**: Verify if the ingress rule change aligns with scheduled updates, maintenance activities, or legitimate administrative tasks documented in change management tickets or systems.
- **Consistency Check**: Compare the action against historical data of similar actions performed by the user or within the organization. Consistency with past legitimate actions might indicate a false alarm.
- **Verify through Outcomes**: Check the `aws.cloudtrail.response_elements` and the `event.outcome` to confirm if the change was successful and intended as per policy.

### Response and Remediation:

- **Immediate Review and Reversal if Necessary**: If the change was unauthorized, revert the security group rules to their previous state to close any unintended access.
- **Enhance Monitoring and Alerts**: Adjust monitoring systems to alert on similar security group changes, especially those that open access to well-known ports from any IP address.
- **Educate and Train**: Provide additional training to users with administrative rights on the importance of security best practices concerning security group management.
- **Audit Security Groups and Policies**: Conduct a comprehensive audit of all security groups and associated policies to ensure they adhere to the principle of least privilege.
- **Incident Response**: If there's an indication of malicious intent or a security breach, initiate the incident response protocol to mitigate any damage and prevent future occurrences.

### Additional Information:

For further guidance on managing security group rules and securing AWS environments, refer to the [Amazon VPC Security Groups documentation](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html) and AWS best practices for security.

"""
references = [
    "https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AuthorizeSecurityGroupEgress.html",
    "https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AuthorizeSecurityGroupIngress.html",
    "https://www.linkedin.com/pulse/my-backdoors-your-aws-infrastructure-part-3-network-micha%C5%82-brygidyn/",
]
risk_score = 47
rule_id = "25e7fee6-fc25-11ee-ba0f-f661ea17fbce"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Platform: AWS",
    "Data Source: AWS CloudTrail",
    "Service: AWS EC2",
    "Tactic: Defense Evasion",
    "Rule Type: Custom Query (KQL)",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset: "aws.cloudtrail"
    and event.provider: ec2.amazonaws.com
    and event.action: AuthorizeSecurityGroupIngress
    and event.outcome: success
    and aws.cloudtrail.flattened.request_parameters.ipPermissions.items.ipRanges.items.cidrIp: ("0.0.0.0/0" or "::/0")
    and aws.cloudtrail.flattened.request_parameters.ipPermissions.items.fromPort: (
        21 or 22 or 23 or 445 or 3389 or 5985 or 5986)
    and not user_agent.original: (*packer-plugin-amazon* or *Terraform* or *Pulumi*)
'''
[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user_agent.original",
    "source.ip",
    "aws.cloudtrail.user_identity.arn",
    "aws.cloudtrail.user_identity.type",
    "aws.cloudtrail.user_identity.access_key_id",
    "event.action",
    "event.outcome",
    "cloud.account.id",
    "cloud.region",
    "aws.cloudtrail.request_parameters"
]

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"

[[rule.threat.technique.subtechnique]]
id = "T1562.007"
name = "Disable or Modify Cloud Firewall"
reference = "https://attack.mitre.org/techniques/T1562/007/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1133"
name = "External Remote Services"
reference = "https://attack.mitre.org/techniques/T1133/"

[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"

[metadata]
creation_date = "2021/03/04"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2026/05/04"

[rule]
author = ["Elastic", "Austin Songer"]
description = """
Identifies suspicious processes being spawned by the Microsoft Exchange Server Unified Messaging (UM) service. This
activity has been observed exploiting CVE-2021-26857.
"""
false_positives = [
    """
    Legitimate processes may be spawned from the Microsoft Exchange Server Unified Messaging (UM) service. If known
    processes are causing false positives, they can be exempted from the rule.
    """,
]
from = "now-9m"
index = [
    "endgame-*",
    "logs-crowdstrike.fdr*",
    "logs-endpoint.events.process-*",
    "logs-m365_defender.event-*",
    "logs-sentinel_one_cloud_funnel.*",
    "logs-system.security*",
    "logs-windows.forwarded*",
    "logs-windows.sysmon_operational-*",
    "winlogbeat-*",
]
language = "eql"
license = "Elastic License v2"
name = "Microsoft Exchange Server UM Spawning Suspicious Processes"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Microsoft Exchange Server UM Spawning Suspicious Processes

Microsoft Exchange Server's Unified Messaging (UM) integrates voice messaging with email, allowing users to access voicemails via their inbox. Adversaries exploit vulnerabilities like CVE-2021-26857 to execute unauthorized processes, potentially leading to system compromise. The detection rule identifies unusual processes initiated by UM services, excluding known legitimate executables, to flag potential exploitation attempts.

### Possible investigation steps

- Review the alert details to confirm the process parent name is either "UMService.exe" or "UMWorkerProcess.exe" and verify the process executable path is not among the known legitimate paths listed in the exclusion criteria.
- Gather additional context by checking the process command line arguments and the user account under which the suspicious process was executed to identify any anomalies or unauthorized access.
- Investigate the historical activity of the host by reviewing recent logs for any other unusual or unauthorized processes, especially those related to the Microsoft Exchange Server.
- Check for any recent patches or updates applied to the Microsoft Exchange Server to ensure that vulnerabilities like CVE-2021-26857 have been addressed.
- Correlate the alert with other security tools and data sources such as Microsoft Defender XDR or Sysmon to identify any related suspicious activities or indicators of compromise.
- Assess the network activity from the host to detect any potential lateral movement or data exfiltration attempts that might be associated with the suspicious process.

### False positive analysis

- Legitimate UM service updates or patches may trigger the rule. Regularly update the list of known legitimate executables to include new or updated UM service files.
- Custom scripts or monitoring tools that interact with UM services might be flagged. Identify these scripts and add their executables to the exclusion list if they are verified as safe.
- Non-standard installation paths for Exchange Server can cause false positives. Ensure that all legitimate installation paths are included in the exclusion list to prevent unnecessary alerts.
- Administrative tasks performed by IT staff using command-line tools may be misidentified. Document these tasks and consider excluding the associated executables if they are part of routine maintenance.
- Third-party integrations with Exchange Server that spawn processes could be flagged. Verify these integrations and exclude their executables if they are deemed secure and necessary for business operations.

### Response and remediation

- Isolate the affected Microsoft Exchange Server from the network to prevent further unauthorized access or lateral movement by the adversary.
- Terminate any suspicious processes identified as being spawned by the UM service that are not part of the known legitimate executables list.
- Apply the latest security patches and updates to the Microsoft Exchange Server to address CVE-2021-26857 and any other known vulnerabilities.
- Conduct a thorough review of the server's security logs and network traffic to identify any additional indicators of compromise or unauthorized access attempts.
- Restore the server from a known good backup taken before the suspicious activity was detected, ensuring that the backup is free from compromise.
- Implement enhanced monitoring and alerting for any future suspicious processes spawned by the UM service, using the detection rule as a baseline.
- Escalate the incident to the organization's security operations center (SOC) or incident response team for further investigation and to determine if additional systems may be affected."""
references = [
    "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers",
    "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities",
]
risk_score = 47
rule_id = "483c4daf-b0c6-49e0-adf3-0bfa93231d6b"
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Initial Access",
    "Tactic: Lateral Movement",
    "Data Source: Elastic Endgame",
    "Use Case: Vulnerability",
    "Data Source: Elastic Defend",
    "Data Source: Windows Security Event Logs",
    "Data Source: Microsoft Defender XDR",
    "Data Source: Sysmon",
    "Data Source: SentinelOne",
    "Data Source: Crowdstrike",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
process where host.os.type == "windows" and event.type == "start" and
  process.parent.name : ("UMService.exe", "UMWorkerProcess.exe") and
    not process.executable : (
          "?:\\Windows\\System32\\werfault.exe",
          "?:\\Windows\\System32\\wermgr.exe",
          "?:\\Program Files\\Microsoft\\Exchange Server\\V??\\Bin\\UMWorkerProcess.exe",
          "?:\\Program Files\\Microsoft\\Exchange Server\\Bin\\UMWorkerProcess.exe",
          "D:\\Exchange 2016\\Bin\\UMWorkerProcess.exe",
          "E:\\ExchangeServer\\Bin\\UMWorkerProcess.exe",
          "D:\\Exchange\\Bin\\UMWorkerProcess.exe",
          "D:\\Exchange Server\\Bin\\UMWorkerProcess.exe",
          "E:\\Exchange Server\\V15\\Bin\\UMWorkerProcess.exe",

          /* Crowdstrike specific exclusion as it uses NT Object paths */
          "\\Device\\HarddiskVolume*\\Windows\\System32\\werfault.exe",
          "\\Device\\HarddiskVolume*\\Windows\\System32\\wermgr.exe",
          "\\Device\\HarddiskVolume*\\Program Files\\Microsoft\\Exchange Server\\V??\\Bin\\UMWorkerProcess.exe",
          "\\Device\\HarddiskVolume*\\Program Files\\Microsoft\\Exchange Server\\Bin\\UMWorkerProcess.exe",
          "\\Device\\HarddiskVolume*\\Exchange 2016\\Bin\\UMWorkerProcess.exe",
          "\\Device\\HarddiskVolume*\\ExchangeServer\\Bin\\UMWorkerProcess.exe",
          "\\Device\\HarddiskVolume*\\Exchange\\Bin\\UMWorkerProcess.exe",
          "\\Device\\HarddiskVolume*\\Exchange Server\\Bin\\UMWorkerProcess.exe",
          "\\Device\\HarddiskVolume*\\Exchange Server\\V15\\Bin\\UMWorkerProcess.exe"
    )
'''

setup = """## Setup

This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.

Setup instructions: https://ela.st/install-elastic-defend

### Additional data sources

This rule also supports the following third-party data sources. For setup instructions, refer to the links below:

- [CrowdStrike](https://ela.st/crowdstrike-integration)
- [Microsoft Defender XDR](https://ela.st/m365-defender)
- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
- [Sysmon Event ID 1 - Process Creation](https://ela.st/sysmon-event-1-setup)
- [Windows Process Creation Logs](https://ela.st/audit-process-creation)
"""


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1190"
name = "Exploit Public-Facing Application"
reference = "https://attack.mitre.org/techniques/T1190/"


[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1210"
name = "Exploitation of Remote Services"
reference = "https://attack.mitre.org/techniques/T1210/"


[rule.threat.tactic]
id = "TA0008"
name = "Lateral Movement"
reference = "https://attack.mitre.org/tactics/TA0008/"

[rule]
description = """
This rule detects the execution of a coin miner via a shell command through potential mining commandline arguments.
Adversaries may leverage the resources of compromised systems to mine cryptocurrency, to generate revenue. This activity
may impact system performance and availability.
"""
id = "e5149069-189b-4b1a-ad24-9fed16f5a15b"
license = "Elastic License v2"
name = "Potential Coin Miner Execution via Shell"
os_list = ["linux"]
reference = ["https://xmrig.com/docs/algorithms"]
version = "1.0.12"

query = '''
process where event.type == "start" and event.action == "exec" and process.parent.executable != null and
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and process.args == "-c" and (
  (
    process.command_line like ("*-a*", "*--algo*", "*--coin*") and process.command_line like (
      "*monero*", "*arqma*", "* dero *", "*rx/graft*", "*cn/upx2*", "*cn/1*", "*cn-lite/1*", "*cn-lite/0*", "*cn/0*",
      "*argon2/chukwav2*", "*cn/ccx*", "*kawpow*", "*rx/keva*", "*cn-pico/tlo*", "*rx/sfx*", "*rx/arq*", "*rx/0*",
      "*argon2/chukwa*", "*argon2/ninja*", "*rx/wow*", "*cn/fast*", "*cn/rwz*", "*cn/zls*", "*cn/double*", "*cn/r*",
      "*cn-pico*", "*cn/half*", "*cn/2*", "*cn/xao*", "*cn/rto*", "*cn-heavy/tube*", "*cn-heavy/xhv*", "*cn-heavy/0*"
    )
  ) or process.command_line like ("*stratum+tcp://*", "*stratum2+tcp://*", "*--nicehash*") 
) and not (
  process.parent.name like (
    "find", "python3", "httpd", "sshd", "php*", "sudo", "ruby", "nvim", "vim", "make", "schroot", "vimdiff", "sbuild", "ninja"
  ) or
  process.parent.executable in (
    "/opt/cron/registry-sync/ru/syncRegistryByReport.pl",  "/usr/bin/gvimdiff", "/usr/bin/ninja-reference",
    "/usr/bin/sw-engine", "/usr/local/bin/teleport", "/usr/share/dotnet/dotnet", "/usr/libexec/openssh/sshd-session"
  ) or
  process.parent.executable like ("/tmp/baum/easybuild/*", "/home/*/.vscode-server/extensions/*/resources/native-binary/claude") or
  process.command_line like ("*openssl*", "*--display-charset*", "sh -c aws s3 cp*") or
  process.parent.args in ("/usr/bin/crun", "/usr/local/bin/claude") or
  (
    process.parent.executable like "/home/*/.local/share/claude/versions/*" and
    process.command_line like "/bin/bash -c source /home/*/.claude/shell-snapshots/snapshot-*"
  )
)
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1496"
name = "Resource Hijacking"
reference = "https://attack.mitre.org/techniques/T1496/"


[threat.tactic]
id = "TA0040"
name = "Impact"
reference = "https://attack.mitre.org/tactics/TA0040/"

[internal]
min_endpoint_version = "7.15.0"

[rule]
description = """
Identifies when an unsigned executable or commonly abused Microsoft signed binaries are connecting to a crypto mining
pool domain. Adversaries may leverage the resources of compromised systems to complete resource-intensive tasks, which
may impact system service availability.
"""
id = "fe082539-a528-4453-ac19-34d57f2f7730"
license = "Elastic License v2"
name = "Potential Crypto Mining Activity"
os_list = ["windows"]
version = "1.0.3"

query = '''
sequence by process.entity_id with maxspan=1m
  [process where event.action == "start" and
   (
   process.name : ("rundll32.exe", "powershell.exe") or
   process.executable : "?:\\Windows\\Microsoft.NET\\*.exe" or
   (process.Ext.device.product_id : ("Virtual DVD-ROM", "Virtual Disk") and not process.executable : "C:\\*") or
   (process.Ext.relative_file_creation_time <= 500 and
    (process.code_signature.trusted == false or process.code_signature.exists == false))
    )
   ]
  [dns where
   dns.question.name : ("alimabi.cn", "ap.luckpool.net", "bcn.pool.minergate.com", "bcn.vip.pool.minergate.com",
   "bohemianpool.com", "ca-aipg.miningocean.org", "ca-dynex.miningocean.org", "ca-neurai.miningocean.org",
   "ca-qrl.miningocean.org", "ca-upx.miningocean.org", "ca-zephyr.miningocean.org", "ca.minexmr.com", "ca.monero.herominers.com",
   "cbd.monerpool.org", "cbdv2.monerpool.org", "cryptmonero.com", "crypto-pool.fr", "crypto-pool.info",
   "cryptonight-hub.miningpoolhub.com", "d1pool.ddns.net", "d5pool.us", "daili01.monerpool.org", "de-aipg.miningocean.org",
   "de-dynex.miningocean.org", "de-zephyr.miningocean.org", "de.minexmr.com", "dl.nbminer.com", "donate.graef.in",
   "donate.ssl.xmrig.com", "donate.v2.xmrig.com", "donate.xmrig.com", "donate2.graef.in", "drill.moneroworld.com",
   "dwarfpool.com", "emercoin.com", "emercoin.net", "emergate.net", "ethereumpool.co", "eu.luckpool.net", "eu.minerpool.pw",
   "fcn-xmr.pool.minergate.com", "fee.xmrig.com", "fr-aipg.miningocean.org", "fr-dynex.miningocean.org", "fr-neurai.miningocean.org",
   "fr-qrl.miningocean.org", "fr-upx.miningocean.org", "fr-zephyr.miningocean.org", "fr.minexmr.com", "hellominer.com",
   "herominers.com", "hk-aipg.miningocean.org", "hk-dynex.miningocean.org", "hk-neurai.miningocean.org", "hk-qrl.miningocean.org",
   "hk-upx.miningocean.org", "hk-zephyr.miningocean.org", "huadong1-aeon.ppxxmr.com", "iwanttoearn.money", "jw-js1.ppxxmr.com",
   "koto-pool.work", "lhr.nbminer.com", "lhr3.nbminer.com", "linux.monerpool.org", "lokiturtle.herominers.com", "luckpool.net",
   "masari.miner.rocks", "mine.c3pool.com", "mine.moneropool.com", "mine.ppxxmr.com", "mine.zpool.ca", "mine1.ppxxmr.com",
   "minemonero.gq", "miner.ppxxmr.com", "miner.rocks", "minercircle.com", "minergate.com", "minerpool.pw", "minerrocks.com",
   "miners.pro", "minerxmr.ru", "minexmr.cn", "minexmr.com", "mining-help.ru", "miningpoolhub.com", "mixpools.org",
   "moner.monerpool.org", "moner1min.monerpool.org", "monero-master.crypto-pool.fr", "monero.crypto-pool.fr",
   "monero.hashvault.pro", "monero.herominers.com", "monero.lindon-pool.win", "monero.miners.pro", "monero.riefly.id",
   "monero.us.to", "monerocean.stream", "monerogb.com", "monerohash.com", "moneroocean.stream", "moneropool.com", "moneropool.nl",
   "monerorx.com", "monerpool.org", "moriaxmr.com", "mro.pool.minergate.com", "multipool.us", "myxmr.pw", "na.luckpool.net",
   "nanopool.org", "nbminer.com", "node3.luckpool.net", "noobxmr.com", "pangolinminer.comgandalph3000.com", "pool.4i7i.com",
   "pool.armornetwork.org", "pool.cortins.tk", "pool.gntl.co.uk", "pool.hashvault.pro", "pool.minergate.com", "pool.minexmr.com",
   "pool.monero.hashvault.pro", "pool.ppxxmr.com", "pool.somec.cc", "pool.support", "pool.supportxmr.com", "pool.usa-138.com",
   "pool.xmr.pt", "pool.xmrfast.com", "pool2.armornetwork.org", "poolchange.ppxxmr.com", "pooldd.com", "poolmining.org",
   "poolto.be", "ppxvip1.ppxxmr.com", "ppxxmr.com", "prohash.net", "r.twotouchauthentication.online", "randomx.xmrig.com",
   "ratchetmining.com", "seed.emercoin.com", "seed.emercoin.net", "seed.emergate.net", "seed1.joulecoin.org", "seed2.joulecoin.org",
   "seed3.joulecoin.org", "seed4.joulecoin.org", "seed5.joulecoin.org", "seed6.joulecoin.org", "seed7.joulecoin.org",
   "seed8.joulecoin.org", "sg-aipg.miningocean.org", "sg-dynex.miningocean.org", "sg-neurai.miningocean.org", "sg-qrl.miningocean.org",
   "sg-upx.miningocean.org", "sg-zephyr.miningocean.org", "sg.minexmr.com", "sheepman.mine.bz", "siamining.com", "sumokoin.minerrocks.com",
   "supportxmr.com", "suprnova.cc", "teracycle.net", "trtl.cnpool.cc", "trtl.pool.mine2gether.com", "turtle.miner.rocks", "us-aipg.miningocean.org",
   "us-dynex.miningocean.org", "us-neurai.miningocean.org", "us-west.minexmr.com", "us-zephyr.miningocean.org", "usxmrpool.com", "viaxmr.com",
   "webservicepag.webhop.net", "xiazai.monerpool.org", "xiazai1.monerpool.org", "xmc.pool.minergate.com", "xmo.pool.minergate.com",
   "xmr-asia1.nanopool.org", "xmr-au1.nanopool.org", "xmr-eu1.nanopool.org", "xmr-eu2.nanopool.org", "xmr-jp1.nanopool.org", "xmr-us-east1.nanopool.org",
   "xmr-us-west1.nanopool.org", "xmr-us.suprnova.cc", "xmr-usa.dwarfpool.com", "xmr.2miners.com", "xmr.5b6b7b.ru", "xmr.alimabi.cn", "xmr.bohemianpool.com",
   "xmr.crypto-pool.fr", "xmr.crypto-pool.info", "xmr.f2pool.com", "xmr.hashcity.org", "xmr.hex7e4.ru", "xmr.ip28.net", "xmr.monerpool.org", "xmr.mypool.online",
   "xmr.nanopool.org", "xmr.pool.gntl.co.uk", "xmr.pool.minergate.com", "xmr.poolto.be", "xmr.ppxxmr.com", "xmr.prohash.net", "xmr.simka.pw", "xmr.somec.cc",
   "xmr.suprnova.cc", "xmr.usa-138.com", "xmr.vip.pool.minergate.com", "xmr1min.monerpool.org", "xmrf.520fjh.org", "xmrf.fjhan.club", "xmrfast.com",
   "xmrigcc.graef.in", "xmrminer.cc", "xmrpool.de", "xmrpool.eu", "xmrpool.me", "xmrpool.net", "xmrpool.xyz", "xx11m.monerpool.org",
   "xx11mv2.monerpool.org", "xxx.hex7e4.ru", "zarabotaibitok.ru", "zer0day.ru")]
'''

min_endpoint_version = "8.4.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1496"
name = "Resource Hijacking"
reference = "https://attack.mitre.org/techniques/T1496/"


[threat.tactic]
id = "TA0040"
name = "Impact"
reference = "https://attack.mitre.org/tactics/TA0040/"

[internal]
min_endpoint_version = "8.4.0"

[rule]
description = """
Identifies attempts to plant a rogue wermgr.exe binary that overwrites the legitimate Windows Error Reporting Manager by
exploiting a race condition in Windows Defender custom scanning. The planted file is a ZIP archive (PK header)
masquerading as a PE executable. Successful exploitation can result in arbitrary code execution as SYSTEM.
"""
id = "15a93e0a-92f8-4c79-9e51-b55ce5e7aede"
license = "Elastic License v2"
name = "Potential Privilege Escalation via RoguePlanet Windows Defender Exploit"
os_list = ["windows"]
reference = ["https://github.com/MSNightmare/RoguePlanet"]
version = "1.0.0"

query = '''
any where (
  (event.category == "file" and event.action == "creation" and file.name : "wermgr.exe" and
   file.Ext.header_bytes like "504b*" and file.path : ("?:\\Users\\*.exe", "?:\\Windows\\Temp\\*.exe")) or

  (event.category == "process" and event.action == "start" and process.executable : "?:\\Windows\\System32\\wermgr.exe" and
   user.id == "S-1-5-18" and process.args == "-upload" and
   process.parent.executable : "?:\\Windows\\System32\\svchost.exe" and 
   (process.Ext.relative_file_creation_time <= 10000 or process.Ext.relative_file_name_modify_time <= 10000) and 
   not (process.code_signature.status in ("trusted", "errorExpired") and 
        process.code_signature.subject_name : ("Microsoft Windows", "Microsoft Corporation", "Microsoft Windows Publisher")))
  )
'''

min_endpoint_version = "8.4.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1068"
name = "Exploitation for Privilege Escalation"
reference = "https://attack.mitre.org/techniques/T1068/"


[threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1036"
name = "Masquerading"
reference = "https://attack.mitre.org/techniques/T1036/"

[[threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.4.0"

[metadata]
creation_date = "2025/10/30"
integration = ["endpoint"]
maturity = "production"
updated_date = "2026/07/17"

[rule]
author = ["Elastic"]
description = """
Detects potential privilege escalation via SUID/SGID proxy execution on Linux systems. Attackers may exploit binaries with the
SUID/SGID bit set to execute commands with elevated privileges. This rule identifies instances where a process is executed with
root privileges (user ID 0 or group ID 0) while the real user or group ID is non-root, indicating potential misuse of SUID/SGID
binaries. 
"""
from = "now-9m"
index = ["logs-endpoint.events.process*"]
language = "eql"
license = "Elastic License v2"
name = "Potential Privilege Escalation via SUID/SGID Proxy Execution"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Potential Privilege Escalation via SUID/SGID Proxy Execution

This rule surfaces executions of well-known SUID/SGID helpers on Linux that run with root privileges while the launching user remains non‑root, signaling an attempt to proxy elevated rights. It matters because a non‑privileged process invoking pkexec can spawn /bin/sh as root via environment manipulation, turning a low-privilege foothold into full system control.

### Possible investigation steps

- Determine if the invocation is interactive and expected (e.g., admin using su/sudo) by correlating with a TTY/SSH session, recent successful authentication logs, and sudo/polkit policy outcomes in journald.
- For pkexec events, inspect the environment for exploit indicators (e.g., unset argv or suspicious GCONV_PATH, PATH, LD_PRELOAD, LC_* values) and look for attacker-created files in /tmp or the user's home that match gconv or loader artifacts.
- Review the child/descendant process tree of the SUID/SGID helper to see if it spawned a root shell or arbitrary interpreter, and pivot to concurrent network connections or file writes by those children.
- Validate whether the executable’s SUID/SGID file on disk has been tampered with by checking its hash, permissions, ownership, and recent mtime against package manager metadata and known-good baselines.
- If the binary is mount/umount/fusermount or newuidmap/newgidmap, correlate with container or FUSE activity to confirm a legitimate workflow and inspect mounts or namespace changes for risky options (e.g., suid, exec) or unusual target directories.

### False positive analysis

- An authorized pkexec or polkit-agent-helper invocation by a user to perform a permitted administrative task may run as root while the real user is non‑root, often with a single‑argument parent, and should align with an interactive prompt and expected policy.
- Normal unprivileged workflows using fusermount3 or newuidmap/newgidmap legitimately leverage SUID/SGID helpers, typically launched by a simple shell with one argument, and should correlate with expected mount or user‑namespace activity.

### Response and remediation

- Immediately isolate the host, kill the offending SUID/SGID child processes (e.g., pkexec spawning /bin/sh), and temporarily remove the setuid/setgid bit from the abused binary (chmod u-s /usr/bin/pkexec or chmod g-s /usr/bin/newgrp) to halt further elevation.
- Reinstall and verify integrity of abused packages and SUID helpers (e.g., polkit to replace /usr/bin/pkexec, dbus-daemon-launch-helper, fusermount3) and delete attacker artifacts such as gconv modules or LD_PRELOAD payloads from /tmp, /var/tmp, and user homes.
- Undo attacker changes by restoring /etc/sudoers, /etc/passwd and /etc/shadow, and polkit rules under /usr/share/polkit-1 or /etc/polkit-1, unmount suspicious FUSE or bind mounts created by fusermount3/mount, and rotate credentials and keys.
- Escalate to incident command if you observe a SUID helper launching an interactive root shell (/bin/sh -p or bash -p), root-owned droppers in /tmp or /usr/local/bin, or similar events on more than one host or account.
- Permanently reduce the SUID/SGID attack surface by auditing and removing setuid bits from rarely used binaries (e.g., chfn, chsh, newgrp, ssh-keysign), restricting pkexec via polkit rules to specific callers, and mounting /tmp, /var/tmp, and home directories with nosuid,nodev,noexec.
- Strengthen monitoring and policy by enabling AppArmor/SELinux confinement for pkexec and mount helpers, adding auditd rules for exec of setuid binaries and writes to /tmp by root, and enforcing least-privilege sudoers by removing broad NOPASSWD entries and requiring MFA for privileged tasks.
"""
references = [
    "https://dfir.ch/posts/today_i_learned_binfmt_misc/",
    "https://gtfobins.github.io/#+suid",
    "https://www.elastic.co/security-labs/primer-on-persistence-mechanisms",
]
risk_score = 47
rule_id = "341c6e18-9ef1-437e-bf18-b513f3ae2130"
setup = """## Setup

This rule requires data coming in from Elastic Defend.

### Elastic Defend Integration Setup
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.

#### Prerequisite Requirements:
- Fleet is required for Elastic Defend.
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).

#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
- Go to the Kibana home page and click "Add integrations".
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
- Click "Add Elastic Defend".
- Configure the integration name and optionally add a description.
- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
- Click "Save and Continue".
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
"""
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: Linux",
    "Use Case: Threat Detection",
    "Tactic: Privilege Escalation",
    "Tactic: Persistence",
    "Tactic: Defense Evasion",
    "Data Source: Elastic Defend",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"
query = '''
process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and (
  (process.user.id == "0" and process.real_user.id != "0") or
  (process.group.id == "0" and process.real_group.id != "0")
) and process.args in (
  "/bin/su", "/usr/bin/su",
  "/usr/bin/sudo",
  "/bin/mount", "/usr/bin/mount",
  "/bin/umount", "/usr/bin/umount",
  "/usr/bin/fusermount3",
  "/bin/passwd", "/usr/bin/passwd",
  "/bin/chfn", "/usr/bin/chfn",
  "/bin/chsh", "/usr/bin/chsh",
  "/bin/gpasswd", "/usr/bin/gpasswd",
  "/bin/newgrp", "/usr/bin/newgrp",
  "/sbin/unix_chkpwd", "/usr/sbin/unix_chkpwd",
  "/usr/bin/newuidmap", "/usr/bin/newgidmap",
  "/usr/lib/dbus-1.0/dbus-daemon-launch-helper", "/usr/libexec/dbus-daemon-launch-helper",
  "/usr/lib/openssh/ssh-keysign", "/usr/libexec/openssh/ssh-keysign",
  "/usr/bin/pkexec", "/usr/libexec/pkexec", "/usr/lib/polkit-1/pkexec",
  "/usr/lib/polkit-1/polkit-agent-helper-1", "/usr/libexec/polkit-agent-helper-1",
  "/usr/lib/snapd/snap-confine"
) and process.parent.args_count == 1 and
not process.parent.executable like (
  "/usr/libexec/oracle-cloud-agent/plugins/unifiedmonitoring/unifiedmonitoring", "/usr/libexec/oracle-cloud-agent/agent",
  "/usr/lib/x86_64-linux-gnu/libexec/polkit-kde-authentication-agent-1", "/usr/libexec/xfce-polkit", "/usr/bin/dolphin",
  "/usr/libexec/kf6/polkit-kde-authentication-agent-1", "/usr/bin/gnome-shell",
  "/snap/oracle-cloud-agent/*/plugins/unifiedmonitoring/unifiedmonitoring", "/data/oem_agent/agent_*/sbin/nmo",
  "/usr/bin/plasma-discover", "/usr/bin/cosmic-osd", "/usr/bin/update-notifier"
)
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1068"
name = "Exploitation for Privilege Escalation"
reference = "https://attack.mitre.org/techniques/T1068/"

[[rule.threat.technique]]
id = "T1548"
name = "Abuse Elevation Control Mechanism"
reference = "https://attack.mitre.org/techniques/T1548/"

[[rule.threat.technique.subtechnique]]
id = "T1548.001"
name = "Setuid and Setgid"
reference = "https://attack.mitre.org/techniques/T1548/001/"

[rule.threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"

[[rule.threat.technique]]
id = "T1548"
name = "Abuse Elevation Control Mechanism"
reference = "https://attack.mitre.org/techniques/T1548/"

[[rule.threat.technique.subtechnique]]
id = "T1548.001"
name = "Setuid and Setgid"
reference = "https://attack.mitre.org/techniques/T1548/001/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[metadata]
bypass_bbr_timing = true
creation_date = "2023/07/06"
integration = ["windows"]
maturity = "production"
updated_date = "2026/03/24"

[rule]
author = ["Elastic"]
building_block_type = "default"
description = """
Identifies PowerShell script block content that uses archive compression cmdlets or .NET compression classes (for
example, Compress-Archive, ZipFile, GZipStream, DeflateStream) to build compressed artifacts. Attackers compress or
package data to stage it for collection or exfiltration.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-windows.powershell*"]
language = "kuery"
license = "Elastic License v2"
name = "PowerShell Script with Archive Compression Capabilities"
note = """## Triage and analysis

> **Disclaimer**:
> This guide was created by humans with the assistance of generative AI. While its contents have been manually curated to include the most valuable information, always validate assumptions and adjust procedures to match your internal runbooks and incident triage and response policies.

### Investigating PowerShell Script with Archive Compression Capabilities

This alert identifies PowerShell script block content that references archive compression functionality. Matches can be driven by the `Compress-Archive` cmdlet or by .NET compression classes (for example, `IO.Compression.ZipFile`, `IO.Compression.ZipArchive`, `GZipStream`, `DeflateStream`, `BrotliStream`, `ZLibStream`) paired with compression configuration terms (for example, `CompressionLevel`, `CompressionMode`, `ZipArchiveMode`). Compression is common in legitimate automation, but it can also be used to package collected data for staging and potential exfiltration.

Prioritize understanding (1) who ran the script and where, (2) what data was targeted for compression, (3) where the resulting archive or compressed data was staged, and (4) whether there is follow-on activity consistent with collection or transfer.

#### Key alert fields to review

- `user.name`, `user.domain`, `user.id`: Account execution context for correlation, prioritization, and scoping.
- `host.name`, `host.id`: Host execution context for correlation, prioritization, and scoping.
- `file.path`, `file.directory`, `file.name`: File-origin context when the script block is sourced from an on-disk file.
- `powershell.file.script_block_text`: Script block content that matched the detection logic.
- `powershell.file.script_block_id`, `powershell.sequence`, `powershell.total`: Script block metadata to pivot to other fragments or reconstruct full script content when split across multiple events.
- `Esql.script_block_tmp`: Transformed script block where detection patterns replace original content with a marker to support scoring/counting and quickly spot match locations.
- `Esql.script_block_pattern_count`: Count of matches for the detection pattern(s) observed in the script block content.
- `powershell.file.script_block_entropy_bits`: Shannon entropy of the script block. Higher values may indicate obfuscation.
- `powershell.file.script_block_surprisal_stdev`: Standard deviation of surprisal across the script block. Low values indicate uniform randomness. High values indicate mixed patterns and variability.
- `powershell.file.script_block_unique_symbols`: Count of distinct characters present in the script block.
- `powershell.file.script_block_length`: Script block length (size) context.

#### Possible investigation steps

- Establish initial context and priority:
  - Identify the affected host and user (`host.name`, `host.id`, `user.name`, `user.domain`, `user.id`).
  - Assess whether the user is expected to run PowerShell that creates archives on this host. Unexpected host-user pairings or rare activity on sensitive systems should be prioritized.
  - Review the alert time in relation to known operational activity (for example, maintenance windows, support cases, backup or migration tasks).

- Quickly understand what matched:
  - Review `Esql.script_block_tmp` to locate the matched compression indicators within the script block.
  - Use `Esql.script_block_pattern_count` to understand whether the script contains repeated compression indicators (often seen in loops or multi-step staging).
  - Review `powershell.file.script_block_text` to determine whether the activity is `Compress-Archive` usage, .NET compression usage, or both.

- Assess script complexity and likelihood of obfuscation:
  - Review `powershell.file.script_block_length` to understand whether the script block is small and targeted or large and multi-purpose.
  - Use `powershell.file.script_block_entropy_bits`, `powershell.file.script_block_surprisal_stdev`, and `powershell.file.script_block_unique_symbols` to triage for suspicious encoding/obfuscation:
    - High entropy with low variability can indicate embedded encoded content.
    - High variability can indicate a mix of readable logic and opaque data blobs.
  - If metrics suggest obfuscation, prioritize deeper review and broader scoping for related script blocks from the same host and user.

- Reconstruct full script block content when fragmented:
  - Pivot on `powershell.file.script_block_id` and collect all fragments for that ID.
  - Order fragments by `powershell.sequence` and validate completeness using `powershell.total` when present.
  - Re-review the reconstructed script to understand inputs, outputs, and any follow-on behavior.

- Identify what data is being compressed and where it is staged:
  - In `powershell.file.script_block_text`, identify source paths, file selection logic (for example, recursion, wildcards, extension filters), and loops that suggest bulk collection vs a single archive operation.
  - Identify the output archive name and destination directory (if specified). Focus on archives staged in user-writable or temporary directories, newly created staging folders, or remote locations.
  - Determine whether compression produces an on-disk archive, in-memory compressed data, or both (for example, stream-based compression used with output streams or byte arrays).

- Determine script origin and delivery path:
  - If `file.path`, `file.directory`, or `file.name` are present, assess whether the script origin aligns with expected administrative tooling for the host role.
  - Review whether the script file appears newly introduced or recently modified relative to the alert time and whether similar scripts exist on other expected hosts.
  - If file origin fields are absent, treat the activity as potentially interactive or remotely delivered and prioritize identifying the initiating process/source using adjacent endpoint telemetry.

- Correlate with adjacent host activity to validate intent and impact (as available):
  - Process context:
    - Identify the PowerShell host process associated with the script block and determine the parent process or initiation source near the alert time.
    - Increase suspicion for unusual launch chains, unexpected automation context, or repeated executions by the same user across multiple hosts.
  - File activity:
    - Look for archive creation or modification events consistent with the output identified in the script block.
    - Review whether the archive is renamed, moved, copied to shared locations, or deleted shortly after creation.
  - Network activity:
    - Review outbound connections from the same host following the suspected archive creation window, especially new or rare destinations, large transfers, or repeated connections shortly after staging.
  - Authentication activity:
    - Review nearby logon activity for the same user, including new logons to other hosts around the same time, which may indicate coordinated collection and staging.

- Assess prevalence and scope:
  - Search for the same `file.path`/`file.name` or distinctive substrings from `powershell.file.script_block_text` across hosts to determine whether the behavior is isolated or widespread.
  - Identify whether similar compression activity occurs across multiple hosts under the same user context or within a short time window.

### False positive analysis

- This activity can be benign when compression is used for routine operations such as packaging logs, diagnostics, backups, software deployment artifacts, or data migration.
- Benign activity is more likely when:
  - The script origin (`file.path`/`file.directory`/`file.name`) aligns with approved administrative workflows and expected host roles.
  - The compressed inputs are narrow and operationally relevant rather than broad user or shared data sets.
  - Execution is consistent over time (repeatable cadence, consistent hosts, consistent users) and is not followed by suspicious file movement or unusual outbound network activity.
- Escalate for further review when:
  - Script block characteristics suggest obfuscation or embedded opaque content (entropy and symbol distribution inconsistent with typical administrative scripts).
  - Compression targets broad directories, multiple paths, or patterns suggestive of data harvesting.
  - Archives are staged in unusual locations or closely followed by movement off-host, deletion, or network activity indicative of transfer.

### Response and remediation

- If malicious or suspicious activity is confirmed:
  - Contain the affected host to prevent additional staging or transfer.
  - Preserve evidence:
    - Full `powershell.file.script_block_text` (reconstructed using `powershell.file.script_block_id`, `powershell.sequence`, and `powershell.total` when needed).
    - `file.path`/`file.name` for any on-disk script source and the archive output path and filename identified in the script content.
    - Host and user identifiers (`host.id`, `host.name`, `user.id`, `user.name`, `user.domain`).
  - Identify potential data exposure:
    - Determine what directories and file patterns were included and whether the archive was copied or transmitted externally.
  - Expand scoping:
    - Hunt for similar script block content and archive staging behavior across endpoints, especially under the same user context.
  - Remediate root cause:
    - Remove unauthorized scripts and staged archives.
    - If credential misuse is suspected, reset impacted credentials and review recent account activity for additional misuse.

- If the activity is verified benign:
  - Document the legitimate owner, purpose, and expected host/user scope for future triage.
  - Consider adding operational context (for example, asset criticality, expected administrative accounts, or known script repositories) to reduce repeated investigation while preserving coverage for unexpected archive staging behavior.
"""
risk_score = 21
rule_id = "27071ea3-e806-4697-8abc-e22c92aa4293"
setup = """## Setup

PowerShell Script Block Logging must be enabled to generate the events used by this rule (e.g., 4104).
Setup instructions: https://ela.st/powershell-logging-setup
"""
severity = "low"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Collection",
    "Data Source: PowerShell Logs",
    "Rule Type: BBR",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
event.category:process and host.os.type:windows and
(
  powershell.file.script_block_text : (
    "IO.Compression.ZipFile" or
    "IO.Compression.ZipArchive" or
    "ZipFile.CreateFromDirectory" or
    "IO.Compression.BrotliStream" or
    "IO.Compression.DeflateStream" or
    "IO.Compression.GZipStream" or
    "IO.Compression.ZLibStream"
  ) and 
  powershell.file.script_block_text : (
    "CompressionLevel" or
    "CompressionMode" or
    "ZipArchiveMode"
  ) or
  powershell.file.script_block_text : "Compress-Archive"
) and
not powershell.file.script_block_text : (
  "Compress-Archive -Path 'C:\ProgramData\Lenovo\Udc\diagnostics\latest" or
  ("Copyright: (c) 2017, Ansible Project" and "Ansible.ModuleUtils.Backup")
) and
not file.directory : (
  "C:\Program Files\Microsoft Dependency Agent\plugins\lib" or
  "C:\Program Files\WindowsPowerShell\Modules\icinga-powershell-framework\cache" or
  "C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Downloads"
) and
not user.id : "S-1-5-18"
'''


[[rule.filters]]
[rule.filters.meta]
negate = true
[rule.filters.query.wildcard."file.path"]
case_insensitive = true
value = "?:\\\\ProgramData\\\\Microsoft\\\\Windows Defender Advanced Threat Protection\\\\Downloads\\\\*"

[[rule.filters]]
[rule.filters.meta]
negate = true
[rule.filters.query.wildcard."file.path"]
case_insensitive = true
value = "?:\\\\ProgramData\\\\Microsoft\\\\Windows Defender Advanced Threat Protection\\\\DataCollection\\\\*"

[[rule.filters]]
[rule.filters.meta]
negate = true
[rule.filters.query.wildcard."file.path"]
case_insensitive = true
value = "?:\\\\Program Files\\\\WindowsPowerShell\\\\Modules\\\\*"

[[rule.filters]]
[rule.filters.meta]
negate = true
[rule.filters.query.wildcard."file.path"]
case_insensitive = true
value = "?:\\\\Program Files\\\\Azure\\\\StorageSyncAgent\\\\AFSDiag.ps1"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1560"
name = "Archive Collected Data"
reference = "https://attack.mitre.org/techniques/T1560/"

[[rule.threat.technique.subtechnique]]
id = "T1560.001"
name = "Archive via Utility"
reference = "https://attack.mitre.org/techniques/T1560/001/"

[[rule.threat.technique.subtechnique]]
id = "T1560.002"
name = "Archive via Library"
reference = "https://attack.mitre.org/techniques/T1560/002/"

[rule.threat.tactic]
id = "TA0009"
name = "Collection"
reference = "https://attack.mitre.org/tactics/TA0009/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"

[[rule.threat.technique.subtechnique]]
id = "T1059.001"
name = "PowerShell"
reference = "https://attack.mitre.org/techniques/T1059/001/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user.id",
    "user.domain",
    "powershell.file.script_block_text",
    "powershell.file.script_block_id",
    "powershell.sequence",
    "powershell.total",
    "file.path",
    "file.directory",
    "file.name",
    "process.pid",
    "host.name",
    "host.id",
    "powershell.file.script_block_length"
]