Elastic rules: 2i

[metadata]
creation_date = "2026/04/03"
integration = ["aws"]
maturity = "production"
updated_date = "2026/07/15"

[rule]
author = ["Elastic"]
description = """
Flags the first time a given IAM principal invokes a narrow set of high-signal discovery APIs (credential check,
account and IAM enumeration, bucket and compute inventory, logging introspection) from a source IP whose autonomous
system number (ASN) matches a curated set commonly associated with consumer VPN brands, VPN-heavy hosting, and provider
networks referenced in public reporting on TeamPCP activity (for example 31173 Services AB AS39351 and Oy Crea Nova
Hosting Solution Ltd). Broad `List*`/`Describe*` patterns are intentionally omitted to reduce noise. Hosting ASNs are
heavily dual-use; validate `source.as.number` in your data and extend `event.action` only when your baseline allows it.
"""
false_positives = [
    """
    Administrators, developers, CI runners, and SaaS egress often exit through Datacamp, M247, Vultr, Linode, or
    brand-name VPN ASNs. Expect more noise on hosting ASNs than on VPN-only registrations. Exclude approved principals,
    accounts, CIDRs, or ASNs after review. GeoIP and ASN enrichment gaps (`source.as.number` unset) will skip events
    entirely. Maintain the ASN list with local intelligence (for example RIPE, BGPView, or peeringdb).
    """,
]
from = "now-6m"
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
language = "kuery"
license = "Elastic License v2"
name = "AWS Discovery API Calls from VPN ASN for the First Time by Identity"
note = """## Triage and analysis

### Investigating AWS Discovery API Calls from VPN ASN for the First Time by Identity

This rule applies a [New Terms](https://www.elastic.co/guide/en/security/current/rules-ui-create.html#create-new-terms-rule) condition on **`source.as.number`** and **`aws.cloudtrail.user_identity.arn`**. It fires the first time a specific principal is observed calling discovery-like APIs from an IP geolocated to one of the ASNs in the rule query (within the 10-day history window).

**High-signal `event.action` values** (explicit allowlist in the rule query): `GetCallerIdentity`; IAM `ListUsers`,
`ListRoles`, `ListAccessKeys`, `GetAccountSummary`, `ListAccountAliases`, `ListGroups`, `ListMFADevices`; S3 `ListBuckets`;
EC2 `DescribeInstances`, `DescribeRegions`, `DescribeVpcs`, `DescribeSecurityGroups`; Lambda `ListFunctions`; RDS
`DescribeDBInstances`, `DescribeDBSnapshots`; DynamoDB `ListTables`; KMS `ListKeys`, `ListAliases`; CloudTrail
`DescribeTrails`, `LookupEvents`; Bedrock `ListFoundationModels`. Clone the rule to add actions (for example ELB or Secrets Manager) if needed.

**Curated VPN-oriented ASNs (verify locally)** — examples this rule matches (subject to registry and enrichment updates):

| ASN | Commonly associated operator (reference only) |
|-----|-----------------------------------------------|
| 216025 | Mullvad VPN AB |
| 57138 | Mullvad supporting infrastructure |
| 207137 | Tefincom S.A. (NordVPN-related) |
| 212238 | Nord / Nord Security class VPN egress in many datasets |
| 199218 | ProtonVPN |
| 209103 | Proton AG (VPN; confirm in your enrichment source) |
| 209854 | Surfshark Ltd. |
| 141039, 147049 | Packet-style VPN/colocation pools often tied to large VPN footprints |
| 53314 | ExpressVPN-related registration in some registries (often small; validate) |
| 60068 | Datacamp Limited — CDN/hosting; used by several VPN brands and many legitimate workloads (**high dual-use**) |
| 9009 | M247 Ltd — colocation and connectivity; common VPN/proxy exit (**high dual-use**) |
| 20473 | Choopa / Vultr (The Constant Company) — VPS; frequent VPN exit and automation (**high dual-use**) |
| 63949 | Linode LLC (Akamai cloud) — VPS; VPN exits and dev workloads (**dual-use**) |
| 39351 | 31173 Services AB (Sweden) — colocation/hosting; cited in TeamPCP-related reporting (**dual-use**). Not the same as **AS31173** (unrelated Ukrainian ISP). |
| 51765 | Oy Crea Nova Hosting Solution Ltd (Finland) — hosting; cited in TeamPCP-related reporting (**dual-use**) |
| 204187 | Oy Crea Nova Hosting Solution Ltd — related network under the same operator (**dual-use**) |
| 208172 | Proton AG — additional VPN egress network (same Proton operator as 209103 / ProtonVPN) |
| 9002 | RETN Limited — pan-European/global transit backbone; carries VPN/proxy egress plus heavy legitimate traffic (**high dual-use**) |
| 49981 | WorldStream B.V. (Netherlands) — dedicated-server/hosting; VPN exits and many legitimate workloads (**dual-use**) |

Other ASNs sometimes seen for VPN or reseller egress (not in this rule by default) include **16276** (OVH), **14061**
(DigitalOcean), **24940** (Hetzner), **51167** (Contabo), and **49453** (Global Layer). Add them only if your baseline
shows manageable false-positive volume.

#### Possible investigation steps

- Confirm `aws.cloudtrail.user_identity.arn`, `aws.cloudtrail.user_identity.type`, and `aws.cloudtrail.user_identity.access_key_id`.
- Review `event.action` and `event.provider` in the alert; several distinct allowlisted actions from the same session suggest broader enumeration.
- Compare `source.ip`, `source.as.organization.name`, and `source.as.number` against your asset inventory and approved remote-access patterns.
- Hunt ±30 minutes for privilege changes, data access (`GetObject`, snapshot sharing), or credential operations.

### False positive analysis

- First-time legitimate VPN or hosting egress per identity produces a single alert per ASN until the term ages out of the window.
- **Datacamp (60068), M247 (9009), and Vultr (20473)** are especially noisy; consider dropping them locally if alerts exceed capacity.
- **31173 Services AB (39351)** and **Crea Nova (51765, 204187)** are legitimate hosting providers; only escalation-worthy when paired with unexpected identities or follow-on impact.

### Response and remediation

- If unexpected, rotate keys, revoke sessions, and tighten IAM; add exceptions only after documented approval.

### Additional information

- [CloudTrail userIdentity](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-user-identity.html)
- [BGP / ASN lookup](https://bgp.tools/) (third-party) for validating AS registrations
"""
references = [
    "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference.html",
    "https://attack.mitre.org/techniques/T1526/",
    "https://github.com/bountyyfi/bad-asn-list/blob/main/all.txt"
]
risk_score = 73
rule_id = "e3c7a891-4b2d-4e8c-a1f0-9d8e7c6b5a4d"
severity = "high"
tags = [
    "Domain: Cloud",
    "Domain: Identity",
    "Data Source: AWS",
    "Data Source: Amazon Web Services",
    "Data Source: AWS CloudTrail",
    "Use Case: Threat Detection",
    "Tactic: Discovery",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "new_terms"

query = '''
event.dataset: "aws.cloudtrail"
    and aws.cloudtrail.user_identity.arn:(* and not *AWSServiceRoleForConfig*)
    and not aws.cloudtrail.user_identity.type: "AWSService"
    and event.provider: (
        "sts.amazonaws.com" or
        "iam.amazonaws.com" or
        "s3.amazonaws.com" or
        "ec2.amazonaws.com" or
        "lambda.amazonaws.com" or
        "rds.amazonaws.com" or
        "dynamodb.amazonaws.com" or
        "kms.amazonaws.com" or
        "cloudtrail.amazonaws.com" or
        "bedrock.amazonaws.com"
    )
    and event.action: (
        "GetCallerIdentity" or
        "ListUsers" or
        "ListRoles" or
        "ListAccessKeys" or
        "GetAccountSummary" or
        "ListAccountAliases" or
        "ListGroups" or
        "ListMFADevices" or
        "ListBuckets" or
        "DescribeInstances" or
        "DescribeRegions" or
        "DescribeVpcs" or
        "DescribeSecurityGroups" or
        "ListFunctions" or
        "DescribeDBInstances" or
        "DescribeDBSnapshots" or
        "ListTables" or
        "ListKeys" or
        "ListAliases" or
        "DescribeTrails" or
        "LookupEvents" or
        "ListFoundationModels"
    )
    and source.as.number: (
        216025 or
        57138 or
        207137 or
        212238 or
        199218 or
        209103 or
        209854 or
        141039 or
        147049 or
        53314 or
        60068 or
        9009 or
        20473 or
        63949 or
        39351 or
        51765 or
        204187 or 
        29066 or 
        206092 or
        208172 or
        9002 or
        49981
    )
'''

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user_agent.original",
    "source.ip",
    "source.as.number",
    "source.as.organization.name",
    "aws.cloudtrail.user_identity.arn",
    "aws.cloudtrail.user_identity.type",
    "aws.cloudtrail.user_identity.access_key_id",
    "event.provider",
    "event.action",
    "event.outcome",
    "cloud.account.id",
    "cloud.region",
]

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1526"
name = "Cloud Service Discovery"
reference = "https://attack.mitre.org/techniques/T1526/"

[[rule.threat.technique]]
id = "T1580"
name = "Cloud Infrastructure Discovery"
reference = "https://attack.mitre.org/techniques/T1580/"

[rule.threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"

[rule.new_terms]
field = "new_terms_fields"
value = ["source.as.number", "user.name", "cloud.account.id"]
[[rule.new_terms.history_window_start]]
field = "history_window_start"
value = "now-10d"

[metadata]
creation_date = "2024/06/29"
integration = ["aws"]
maturity = "production"
updated_date = "2026/08/05"

[rule]
author = ["Elastic"]
description = """
Identifies the creation or modification of an Amazon RDS DB instance or cluster where the "publiclyAccessible" attribute
is set to "true". Publicly accessible RDS instances expose a network endpoint on the public internet, which may allow
unauthorized access if combined with overly permissive security groups, weak authentication, or misconfigured IAM
policies. Adversaries may enable public access on an existing instance, or create a new publicly accessible instance, to
establish persistence, move data outside of controlled network boundaries, or bypass internal access controls.
"""
false_positives = [
    """
    Public access is a common configuration used to enable access from outside a private VPC. Ensure that the instance
    should not be modified in this way before taking action.
    """,
]
from = "now-6m"
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
language = "eql"
license = "Elastic License v2"
name = "AWS RDS DB Instance Made Public"
note = """## Triage and analysis

### Investigating AWS RDS DB Instance Made Public

This rule detects when an Amazon RDS DB instance or cluster is created or modified with
`publiclyAccessible=true`. While some environments operate publicly accessible RDS instances,
unexpected exposure of a database to the internet is a meaningful security risk. Adversaries who
gain access to AWS credentials may modify a DB instance’s public accessibility to exfiltrate data,
establish persistence, or bypass internal network restrictions. 

#### Possible Investigation Steps

- **Identify the actor**
  - Review `aws.cloudtrail.user_identity.arn`, `aws.cloudtrail.user_identity.type`, and `access_key_id` to determine which IAM principal made the change.
  - Determine whether the user, role, or automation service typically manages RDS configurations.

- **Examine the request parameters**
  - Review `aws.cloudtrail.request_parameters` for:
    - `publiclyAccessible=true`
    - DBInstanceIdentifier / DBClusterIdentifier
    - Additional changes included in the same modification request (e.g., master user changes, security group updates)

- **Validate the target resource**
  - Determine the sensitivity of the instance:
    - What data does it store?
    - Is it production, staging, dev, or ephemeral?
  - Confirm whether the instance was previously private.

- **Assess network exposure**
  - Check associated security groups for:
    - `0.0.0.0/0` (unrestricted ingress)
    - Unexpected IP ranges  
  - Review VPC/subnet placement to determine if the instance is reachable externally.

- **Correlate with other recent CloudTrail activity**
  - Look for related events performed by the same actor:
    - `AuthorizeSecurityGroupIngress`
    - `ModifyDBInstance`
    - IAM policy modifications enabling broader DB access
  - Look for indicators of credential misuse:
    - unusual `source.ip`
    - unusual `user_agent.original`
    - MFA not used (`session_context.mfa_authenticated=false`)

- **Validate intent with owners**
  - Contact the service or database owner to confirm whether the change was an approved part of a deployment or migration.

### False Positive Analysis

- **Expected public-access configuration**
  - Some workloads intentionally require public access (e.g., internet-facing reporting tools).
  - Validate against change management tickets, deployment pipelines, or Terraform/IaC automation logs.

### Response and Remediation

- **Containment**
  - If exposure is unauthorized:
    - Modify the instance to disable public access (`publiclyAccessible=false`).
    - Restrict the security group inbound rules immediately.
    - Snapshot the instance to preserve state if compromise is suspected.

- **Investigation**
  - Review all recent actions from the same IAM principal.
  - Check for data access patterns (CloudWatch, RDS Enhanced Monitoring, VPC Flow Logs).
  - Identify whether this exposure correlates with suspicious outbound network activity.

- **Hardening**
  - Require private-only RDS instances unless explicitly documented.
  - Enforce security group least privilege and block public DB access via:
    - AWS Config rules (`rds-instance-public-access-check`)
    - Service Control Policies (SCPs) preventing public RDS settings
  - Implement continuous monitoring for network or configuration drift.

- **Recovery**
  - Restore the database to a private subnet if necessary.
  - Rotate credentials used by the DB instance and associated applications.
  - Document the incident and update policies or IaC templates to prevent recurrence.

### Additional Information:

- **[AWS IR Playbooks](https://github.com/aws-samples/aws-incident-response-playbooks/blob/c151b0dc091755fffd4d662a8f29e2f6794da52c/playbooks/)** 
- **[AWS Customer Playbook Framework](https://github.com/aws-samples/aws-customer-playbook-framework/tree/a8c7b313636b406a375952ac00b2d68e89a991f2/docs)** 
- **Security Best Practices:** [AWS Knowledge Center – Security Best Practices](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/).
"""
references = [
    "https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ModifyDBInstance.html",
    "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.DBInstance.Modifying.html",
    "https://cloud.hacktricks.xyz/pentesting-cloud/aws-security/aws-persistence/aws-rds-persistence#make-instance-publicly-accessible-rds-modifydbinstance",
    "https://cloud.hacktricks.xyz/pentesting-cloud/aws-security/aws-privilege-escalation/aws-rds-privesc#rds-createdbinstance",
]
risk_score = 47
rule_id = "9efb3f79-b77b-466a-9fa0-3645d22d1e7f"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Platform: AWS",
    "Data Source: AWS CloudTrail",
    "Service: AWS RDS",
    "Tactic: Defense Evasion",
    "Tactic: Persistence",
    "Rule Type: Event Correlation (EQL)",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
any where data_stream.dataset == "aws.cloudtrail"
    and event.provider == "rds.amazonaws.com"
    and event.outcome == "success"
    and (
        (event.action == "ModifyDBInstance" and stringContains(aws.cloudtrail.request_parameters, "publiclyAccessible=true"))
        or
        (event.action in ("CreateDBInstance", "CreateDBCluster") and stringContains(aws.cloudtrail.request_parameters, "publiclyAccessible=true"))
    )
    and not user_agent.original like~ ("*Terraform*",  "*Pulumi*")
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1133"
name = "External Remote Services"
reference = "https://attack.mitre.org/techniques/T1133/"

[[rule.threat.technique]]
id = "T1556"
name = "Modify Authentication Process"
reference = "https://attack.mitre.org/techniques/T1556/"

[[rule.threat.technique.subtechnique]]
id = "T1556.009"
name = "Conditional Access Policies"
reference = "https://attack.mitre.org/techniques/T1556/009/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user_agent.original",
    "source.ip",
    "aws.cloudtrail.user_identity.arn",
    "aws.cloudtrail.user_identity.type",
    "aws.cloudtrail.user_identity.access_key_id",
    "event.action",
    "event.outcome",
    "cloud.account.id",
    "cloud.region",
    "aws.cloudtrail.request_parameters",
    "aws.cloudtrail.response_elements",
]

[metadata]
creation_date = "2024/06/25"
integration = ["aws"]
maturity = "production"
updated_date = "2026/04/10"

[rule]
author = ["Elastic"]
description = """
Identifies when an AWS RDS DB snapshot is shared with another AWS account or made public. DB snapshots contain complete
backups of database instances, including schemas, table data, and sensitive application content. When shared externally,
snapshots can be restored in another AWS environment, enabling unauthorized access, offline analysis, or data
exfiltration. Adversaries who obtain valid credentials or exploit misconfigurations may modify snapshot attributes to
grant access to accounts they control, bypassing network, IAM, and monitoring controls.
"""
event_category_override = "event.type"
false_positives = [
    """
    Cross-account DB snapshot sharing is common in multi-account AWS Organizations, particularly for backup workflows,
    migrations, analytics pipelines, and disaster recovery. Ensure the added account is expected, previously approved,
    and aligns with operational change plans before taking action.
    """,
]
from = "now-6m"
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
language = "eql"
license = "Elastic License v2"
name = "AWS RDS DB Snapshot Shared with Another Account"
note = """## Triage and analysis

### Investigating AWS RDS DB Snapshot Shared with Another Account

Amazon RDS DB snapshots capture full backups of database instances and clusters. Modifying a snapshot’s restore
attributes to include external AWS accounts allows those accounts to restore and fully access the underlying data.
While cross-account snapshot sharing is widely used for migrations and disaster-recovery workflows, adversaries may
abuse this mechanism for stealthy data exfiltration, restoring the snapshot in infrastructure they control, outside of your monitoring boundary.

This rule detects successful modifications to snapshot attributes where one or more additional AWS accounts are added to the snapshot’s restore permissions.

#### Possible investigation steps

- **Identify the actor and context**
  - Review `aws.cloudtrail.user_identity.arn` and `aws.cloudtrail.user_identity.access_key_id`.
  - Determine whether the caller is an automation role, interactive user, CI/CD pipeline, or previously unseen principal.
  - Check `source.ip` and `user_agent.original` for signs of unauthorized access or atypical tooling.

- **Understand what snapshot was shared**
  - From `aws.cloudtrail.request_parameters`, extract:
    - The snapshot or cluster snapshot identifier.
    - The list of `valuesToAdd` accounts added to `attributeName=restore`.
  - Identify the associated database instance or cluster and evaluate:
    - Data classification level (PII, customer data, secrets, credentials, financials, etc.)
    - Application ownership and business impact.

- **Validate the external account**
  - Determine whether the recipient account:
    - Belongs to your AWS Organization.
    - Has previously been authorized for snapshot restore operations.
    - Represents a new or unexpected dependency.
  - Cross-reference with known partner accounts or migration plans.

- **Correlate with related activity**
  - Pivot in CloudTrail on the same user identity or account to identify:
    - Prior reconnaissance actions (`DescribeDBSnapshots`, `DescribeDBInstances`).
    - Snapshot copying or creation of manual snapshots just before sharing.
    - IAM privilege escalation (`AttachRolePolicy`, `PutUserPolicy`, `AssumeRole` patterns).
    - Unusual RDS configuration changes (backup retention decrease, deletion protection toggles).

- **Assess for exfiltration indicators**
  - Look for:
    - Subsequent `CopyDBSnapshot` or `StartExportTask` events.
    - Snapshot downloads, exports, or restoration from the external account.
    - Snapshot attributes set to `all` (public sharing), which is extremely dangerous.

- **Validate operational intent**
  - Contact application owners, DBAs, or platform teams to confirm:
    - Whether migration, replication, or DR workflows explain the share.
    - Whether new accounts were intentionally onboarded.
    - Whether the timing aligns with approved change windows.

### False positive analysis

- **Legitimate migration or DR workflows**
  - Many organizations routinely share snapshots with other accounts for staging, analytics, or DR replication.

- **Automation roles**
  - Infrastructure-as-code pipelines and backup automation tools may modify snapshot permissions as part of normal behavior.

If behavior is expected and consistently performed by a known principal, tune the rule using exceptional user identities, service roles, or controlled organizational accounts.

### Response and remediation

- **Revoke unauthorized sharing**
  - Immediately remove unauthorized accounts from snapshot restore attributes.
  - Ensure the snapshot is not publicly shared.

- **Contain potential compromise**
  - Rotate access keys or credentials for the principal that performed the modification.
  - Review IAM permissions to ensure only approved roles can share snapshots.

- **Assess impact**
  - Determine whether the external account restored the snapshot and accessed data.
  - If data exposure is likely, notify compliance, legal, and incident response teams.

- **Hardening and preventive controls**
  - Restrict snapshot sharing via IAM condition keys (`kms:ViaService`, `rds:dbSnapshotArn`, `aws:PrincipalArn`).
  - Use AWS Organizations SCPs to block cross-account snapshot sharing in production accounts.
  - Enable Config rules and Security Hub controls for public or cross-account snapshot access.

### Additional information
- **[AWS IR Playbooks](https://github.com/aws-samples/aws-incident-response-playbooks/blob/c151b0dc091755fffd4d662a8f29e2f6794da52c/playbooks/)** 
- **[AWS Customer Playbook Framework](https://github.com/aws-samples/aws-customer-playbook-framework/tree/a8c7b313636b406a375952ac00b2d68e89a991f2/docs)** 
- **Security Best Practices:** [AWS Knowledge Center – Security Best Practices](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/).
"""
references = [
    "https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ModifyDBSnapshotAttribute.html",
    "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_ShareSnapshot.html",
    "https://cloud.hacktricks.xyz/pentesting-cloud/aws-security/aws-post-exploitation/aws-rds-post-exploitation#rds-modifydbsnapshotattribute-rds-createdbsnapshot",
]
risk_score = 47
rule_id = "4577ef08-61d1-4458-909f-25a4b10c87fe"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Data Source: AWS",
    "Data Source: Amazon Web Services",
    "Data Source: AWS RDS",
    "Resources: Investigation Guide",
    "Use Case: Threat Detection",
    "Tactic: Exfiltration",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
info where data_stream.dataset == "aws.cloudtrail"
    and event.provider == "rds.amazonaws.com"
    and event.outcome == "success"
    and event.action in ("ModifyDBSnapshotAttribute", "ModifyDBClusterSnapshotAttribute")
    and stringContains(aws.cloudtrail.request_parameters, "attributeName=restore")
    and stringContains(aws.cloudtrail.request_parameters, "valuesToAdd=[*]")
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1537"
name = "Transfer Data to Cloud Account"
reference = "https://attack.mitre.org/techniques/T1537/"


[rule.threat.tactic]
id = "TA0010"
name = "Exfiltration"
reference = "https://attack.mitre.org/tactics/TA0010/"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user_agent.original",
    "source.ip",
    "aws.cloudtrail.user_identity.arn",
    "aws.cloudtrail.user_identity.type",
    "aws.cloudtrail.user_identity.access_key_id",
    "event.action",
    "event.outcome",
    "cloud.account.id",
    "cloud.region",
    "aws.cloudtrail.request_parameters",
    "aws.cloudtrail.response_elements",
]

[metadata]
creation_date = "2021/06/24"
integration = ["azure"]
maturity = "production"
updated_date = "2026/04/10"

[rule]
author = ["Austin Songer"]
description = """
Identifies when events are deleted in Azure Kubernetes. Kubernetes events are objects that log any state changes.
Example events are a container creation, an image pull, or a pod scheduling on a node. An adversary may delete events in
Azure Kubernetes in an attempt to evade detection.
"""
false_positives = [
    """
    Events deletions may be done by a system or network administrator. Verify whether the username, hostname, and/or
    resource name should be making changes in your environment. Events deletions by unfamiliar users or hosts should be
    investigated. If known behavior is causing false positives, it can be exempted from the rule.
    """,
]
from = "now-9m"
index = ["logs-azure.activitylogs-*", "filebeat-*"]
language = "kuery"
license = "Elastic License v2"
name = "Azure Kubernetes Services (AKS) Kubernetes Events Deleted"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Azure Kubernetes Services (AKS) Kubernetes Events Deleted

Azure Kubernetes Service (AKS) manages containerized applications using Kubernetes, which logs events like state changes. These logs are crucial for monitoring and troubleshooting. Adversaries may delete these logs to hide their tracks, impairing defenses. The detection rule identifies such deletions by monitoring specific Azure activity logs, flagging successful deletion operations to alert security teams of potential evasion tactics.

### Possible investigation steps

- Review the Azure activity logs to confirm the deletion event by checking for the operation name "MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/EVENTS.K8S.IO/EVENTS/DELETE" and ensure the event outcome is marked as "Success".
- Identify the user or service principal responsible for the deletion by examining the associated identity information in the activity logs.
- Investigate the timeline of events leading up to and following the deletion to identify any suspicious activities or patterns, such as unauthorized access attempts or configuration changes.
- Check for any other related alerts or anomalies in the Azure environment that might indicate a broader attack or compromise.
- Assess the impact of the deleted events by determining which Kubernetes resources or operations were affected and if any critical logs were lost.
- Review access controls and permissions for the user or service principal involved to ensure they align with the principle of least privilege and adjust if necessary.
- Consider implementing additional monitoring or alerting for similar deletion activities to enhance detection and response capabilities.

### False positive analysis

- Routine maintenance activities by authorized personnel may trigger deletion events. To manage this, create exceptions for known maintenance windows or specific user accounts responsible for these tasks.
- Automated scripts or tools used for log rotation or cleanup might delete events as part of their normal operation. Identify these scripts and exclude their activity from triggering alerts by whitelisting their associated service accounts or IP addresses.
- Misconfigured applications or services that inadvertently delete logs can cause false positives. Review application configurations and adjust them to prevent unnecessary deletions, and exclude these applications from alerts if they are verified as non-threatening.
- Test environments often generate log deletions during setup or teardown processes. Exclude these environments from monitoring or create specific rules that differentiate between production and test environments to avoid unnecessary alerts.

### Response and remediation

- Immediately isolate the affected Azure Kubernetes cluster to prevent further unauthorized access or tampering with logs.
- Conduct a thorough review of recent activity logs and access permissions for the affected cluster to identify any unauthorized access or privilege escalation.
- Restore deleted Kubernetes events from backups or snapshots if available, to ensure continuity in monitoring and auditing.
- Implement stricter access controls and audit logging for Kubernetes event deletion operations to prevent unauthorized deletions in the future.
- Notify the security operations team and relevant stakeholders about the incident for awareness and further investigation.
- Escalate the incident to the incident response team if there is evidence of broader compromise or if the deletion is part of a larger attack campaign.
- Review and update incident response plans to incorporate lessons learned from this event, ensuring quicker detection and response to similar threats in the future.

## Setup

The Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
references = [
    "https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes",
]
risk_score = 47
rule_id = "8b64d36a-1307-4b2e-a77b-a0027e4d27c8"
severity = "medium"
tags = ["Domain: Cloud", "Data Source: Azure", "Use Case: Log Auditing", "Tactic: Defense Evasion", "Resources: Investigation Guide"]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset:azure.activitylogs and azure.activitylogs.operation_name:"MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/EVENTS.K8S.IO/EVENTS/DELETE" and
event.outcome:(Success or success)
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"

[[rule.threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"

[[rule.threat.technique.subtechnique]]
id = "T1562.008"
name = "Disable or Modify Cloud Logs"
reference = "https://attack.mitre.org/techniques/T1562/008/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[rule]
description = "Identifies command shell activity started via RunDLL32, which is commonly abused by attackers to host malicious code."
id = "b8a0a3aa-0345-4035-b41d-f758a6c59a78"
license = "Elastic License v2"
name = "Command Shell Activity Started via RunDLL32"
os_list = ["windows"]
reference = ["https://www.elastic.co/security-labs/spring-cleaning-with-latrodectus"]
version = "1.0.34"

query = '''
process where event.type == "start" and
  process.name : ("cmd.exe", "powershell.exe") and
    process.parent.name : "rundll32.exe" and process.parent.command_line != null and
    not process.parent.command_line :
                    ("*:\\Windows\\System32\\SHELL32.dll,RunAsNewUser_RunDLL*",
                     "*zzzzInvokeManagedCustomActionOutOfProc*", 
                     "\"C:\\WINDOWS\\system32\\rundll32.exe\" C:\\WINDOWS\\system32\\PcaSvc.dll,PcaPatchSdbTask") and
    not (process.parent.args : "aepdu.dll,AePduRunUpdate" and process.args : "osloader" and process.args : "%windir%\\system32\\bcdedit") and
    not (process.parent.args : ("?:\\Windows\\System32\\LogiLDA.dll,LogiFetch", "?:\\WINDOWS\\system32\\PcaSvc.dll,PcaPatchSdbTask") and
         process.name : "powershell.exe" and process.command_line : "*install*") and
    not process.parent.args : "C:\\Program Files\\NVIDIA Corporation\\*\\NVI2.DLL,ResumeAsync" and
    not (process.args : "dellpointstick://Mainpage/*" and process.parent.args : "Vxd_launch_UI") and
    not (process.parent.args : "?:\\Windows\\system32\\davclnt.dll,DavSetCookie" and process.name : "powershell.exe") and
    not process.parent.args : "AppXDeploymentExtensions.OneCore.dll,ShellRefresh" and
    not (process.args : ("launchalpsdelltouchpad://Mainpage/path2?param=start", "alpsdelltouchpadsettings://Mainpage/path2?param=start") and
         process.parent.args : "?:\\WINDOWS\\System32\\main.cpl") and
    not (process.command_line : "*REG QUERY HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography*" and
         process.parent.args : "?:\\WINDOWS\\system32\\PcaSvc.dll,PcaPatchSdbTask") and
    not (process.args : "launchalpsdelltouchpad://Mainpage/path2?param=start" and process.parent.args : "Vxd_launch_UI") and 
    not (process.working_directory : "C:\\Program Files (x86)\\Windows Kits\\*\\Assessment and Deployment Kit\\Windows Assessment Toolkit\\Energy\\" and 
         process.args : "axecore.dll,RunJob_RunDll") and
    not process.parent.command_line :  "rundll32.exe \"C:\\Program Files (x86)\\Windows Shell\\fx_ws_main.dll\",ProcessDll s=hidedialog" and
    not (process.parent.command_line : "C:\\Windows\\system32\\rundll32.exe iernonce.dll,RunOnceExProcess" and
         process.working_directory : "C:\\Windows\\system32\\") and
    not (process.parent.command_line : "\"C:\\WINDOWS\\System32\\rundll32.exe\" C:\\WINDOWS\\Lvgic10u.dll,Execute" and
         process.command_line : "cmd /c C:\\WINDOWS\\System32\\rundll32.exe C:\\WINDOWS\\Lvgic10u.dll,ExecuteQuick")
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.001"
name = "PowerShell"
reference = "https://attack.mitre.org/techniques/T1059/001/"

[[threat.technique.subtechnique]]
id = "T1059.003"
name = "Windows Command Shell"
reference = "https://attack.mitre.org/techniques/T1059/003/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[[threat.technique.subtechnique]]
id = "T1218.011"
name = "Rundll32"
reference = "https://attack.mitre.org/techniques/T1218/011/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.15.0"

[rule]
description = """
Detects the creation or modification of cron tabs by a suspicious or malicious process. Cron is one of the most well
known persistence mechanisms for macOS. It is a scheduler that allows a user to create a scheduled execution. Threat
actors have abused this tool to persist their malware on macOS systems.
"""
id = "e5fc1285-d312-4b45-9e6b-e6c037276c17"
license = "Elastic License v2"
name = "Cron Tab Creation or Modification via Shell Command"
os_list = ["macos"]
reference = ["https://theevilbit.github.io/beyond/beyond_0004/"]
version = "1.0.24"

query = '''
sequence by process.entity_id with maxspan=5s
[process where event.type == "start" and (process.name in ("bash", "sh", "zsh", "dash", "csh", "tcsh", "ksh", "tclsh", "fish") or process.name like "tclsh*") and process.args == "-c" and
  not process.command_line : ("*/.claude/shell-snapshots/*", "*/.codex/shell_snapshots/*", "*/.cursor/shell-snapshots/*")]
[file where event.action != "deletion" and 
  file.path like "/private/var/at/tabs/*" and
  process.executable == "/usr/bin/crontab" and not
  file.path == "/private/var/at/tabs/root"]
'''

min_endpoint_version = "8.11.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1053"
name = "Scheduled Task/Job"
reference = "https://attack.mitre.org/techniques/T1053/"
[[threat.technique.subtechnique]]
id = "T1053.003"
name = "Cron"
reference = "https://attack.mitre.org/techniques/T1053/003/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1053"
name = "Scheduled Task/Job"
reference = "https://attack.mitre.org/techniques/T1053/"
[[threat.technique.subtechnique]]
id = "T1053.003"
name = "Cron"
reference = "https://attack.mitre.org/techniques/T1053/003/"



[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[internal]
min_endpoint_version = "8.11.0"

[metadata]
creation_date = "2021/07/22"
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2026/05/04"

[rule]
author = ["Austin Songer"]
description = """
Identifies when a user enables DNS-over-HTTPS. This can be used to hide internet activity or the process of exfiltrating
data. With this enabled, an organization will lose visibility into data such as query type, response, and originating
IP, which are used to determine bad actors.
"""
from = "now-9m"
index = [
    "winlogbeat-*",
    "logs-endpoint.events.registry-*",
    "logs-windows.sysmon_operational-*",
    "endgame-*",
    "logs-m365_defender.event-*",
    "logs-sentinel_one_cloud_funnel.*",
    "logs-crowdstrike.fdr*",
]
language = "eql"
license = "Elastic License v2"
name = "DNS-over-HTTPS Enabled via Registry"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating DNS-over-HTTPS Enabled via Registry

DNS-over-HTTPS (DoH) encrypts DNS queries to enhance privacy and security, preventing eavesdropping and manipulation. However, adversaries can exploit DoH to conceal malicious activities, such as data exfiltration, by bypassing traditional DNS monitoring. The detection rule identifies registry changes enabling DoH in browsers like Edge, Chrome, and Firefox, signaling potential misuse for defense evasion.

### Possible investigation steps

- Review the registry path and data values from the alert to determine which browser and setting were modified. Check if the change aligns with known user activity or policy.
- Investigate the user account associated with the registry change to assess if the activity is expected or if the account has a history of suspicious behavior.
- Examine recent network traffic from the host to identify any unusual or unauthorized DNS queries that could indicate data exfiltration or other malicious activities.
- Check for any other recent registry changes or system modifications on the host that might suggest further attempts at defense evasion or persistence.
- Correlate the alert with other security events or logs from the same host or user to identify patterns or additional indicators of compromise.

### False positive analysis

- Legitimate software updates or installations may enable DNS-over-HTTPS settings in browsers. Monitor software update schedules and correlate registry changes with known update events to identify benign changes.
- Organizational policies might require DNS-over-HTTPS for privacy compliance. Document these policies and create exceptions in the detection rule for systems where this is a known requirement.
- User-initiated privacy settings changes can trigger the rule. Educate users on the implications of enabling DNS-over-HTTPS and establish a process for them to report intentional changes, allowing for exclusion of these events.
- Security tools or privacy-focused applications may enable DNS-over-HTTPS as part of their functionality. Identify these tools within the organization and adjust the detection rule to exclude registry changes associated with their operation.

### Response and remediation

- Immediately isolate the affected system from the network to prevent potential data exfiltration or further malicious activity.
- Review and revert any unauthorized registry changes related to DNS-over-HTTPS settings in Edge, Chrome, and Firefox to restore standard DNS monitoring capabilities.
- Conduct a thorough scan of the affected system using updated antivirus and endpoint detection tools to identify and remove any malicious software or scripts.
- Analyze network traffic logs to identify any unusual or unauthorized DNS queries or data transfers that may have occurred during the period of DoH activation.
- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if additional systems are affected.
- Implement enhanced monitoring for registry changes related to DNS settings across the organization to detect similar threats in the future.
- Review and update security policies to ensure that DNS-over-HTTPS is only enabled through approved channels and for legitimate purposes, reducing the risk of misuse."""
references = [
    "https://www.tenforums.com/tutorials/151318-how-enable-disable-dns-over-https-doh-microsoft-edge.html",
    "https://chromeenterprise.google/policies/?policy=DnsOverHttpsMode",
]
risk_score = 21
rule_id = "a22a09c2-2162-4df0-a356-9aacbeb56a04"
severity = "low"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Defense Evasion",
    "Data Source: Elastic Endgame",
    "Data Source: Elastic Defend",
    "Data Source: Sysmon",
    "Data Source: Microsoft Defender XDR",
    "Data Source: SentinelOne",
    "Resources: Investigation Guide",
    "Data Source: Crowdstrike",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
registry where host.os.type == "windows" and event.type == "change" and
  (registry.path : "*\\SOFTWARE\\Policies\\Microsoft\\Edge\\BuiltInDnsClientEnabled" and
  registry.data.strings : ("1", "0x00000001")) or
  (registry.path : "*\\SOFTWARE\\Google\\Chrome\\DnsOverHttpsMode" and
  registry.data.strings : "secure") or
  (registry.path : "*\\SOFTWARE\\Policies\\Mozilla\\Firefox\\DNSOverHTTPS" and
  registry.data.strings : ("1", "0x00000001"))
'''

setup = """## Setup

This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.

Setup instructions: https://ela.st/install-elastic-defend

### Additional data sources

This rule also supports the following third-party data sources. For setup instructions, refer to the links below:

- [CrowdStrike](https://ela.st/crowdstrike-integration)
- [Microsoft Defender XDR](https://ela.st/m365-defender)
- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
- [Sysmon Registry Events](https://ela.st/sysmon-event-reg-setup)
"""


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1112"
name = "Modify Registry"
reference = "https://attack.mitre.org/techniques/T1112/"

[[rule.threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"


[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[rule]
description = """
Identifies when a Microsoft Office process creates a portable executable (PE) file and the file is subsequently
executed. An adversary may deliver a weaponized Office document to their target that writes and executes a malicious PE
file.
"""
id = "901f0c30-a7c5-40c5-80e3-a50c6744632f"
license = "Elastic License v2"
name = "Execution of File Written or Modified by Microsoft Office"
os_list = ["windows"]
version = "1.0.31"

query = '''
sequence with maxspan=2m
  [ file where event.action != "deletion" and
      process.name : ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "MSACCESS.EXE") and
      // Match Windows PE files by header data (MZ)
      file.Ext.header_bytes : "4d5a*" and
      not file.extension : ("exe", "com") ] by file.path
  [ process where event.action == "start" ] by process.executable
'''

min_endpoint_version = "7.15.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"
[[threat.technique.subtechnique]]
id = "T1566.001"
name = "Spearphishing Attachment"
reference = "https://attack.mitre.org/techniques/T1566/001/"

[[threat.technique.subtechnique]]
id = "T1566.002"
name = "Spearphishing Link"
reference = "https://attack.mitre.org/techniques/T1566/002/"



[threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"

[internal]
min_endpoint_version = "7.15.0"

[rule]
description = """
Identifies attempt to execute and load an unsigned Microsoft Excel XLL Addin. This may indicate an attempt to get
initial access via a malicious phishing Microsoft Office Excel Add-In.
"""
id = "9efd977a-6d4a-4cc8-8ab3-355587b0ef69"
license = "Elastic License v2"
name = "Execution via Microsoft Excel XLL Add-In"
os_list = ["windows"]
reference = [
    "https://github.com/Octoberfest7/XLL_Phishing",
    "https://labs.f-secure.com/archive/add-in-opportunities-for-office-persistence/",
]
version = "1.0.25"

query = '''
sequence by process.entity_id with maxspan=2m
 [process where event.action == "start" and
  process.name : "EXCEL.EXE" and process.args : "-xlls"]
 [library where
  process.name : "EXCEL.EXE" and dll.name : "*.xll" and
  not dll.code_signature.status : ("trusted", "errorExpired", "errorCode_endpoint*")]
'''

min_endpoint_version = "8.4.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"
[[threat.technique.subtechnique]]
id = "T1566.001"
name = "Spearphishing Attachment"
reference = "https://attack.mitre.org/techniques/T1566/001/"



[threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1137"
name = "Office Application Startup"
reference = "https://attack.mitre.org/techniques/T1137/"
[[threat.technique.subtechnique]]
id = "T1137.006"
name = "Add-ins"
reference = "https://attack.mitre.org/techniques/T1137/006/"



[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[internal]
min_endpoint_version = "8.4.0"

[rule]
description = """
This rule detects the execution of a binary, followed by a UID change event to 0 (root), and then the execution of a
command that is used to check the current user's privileges. This sequence is often used by exploits to escalate
privileges to root, and check if the escalation was successful.
"""
id = "d8194360-9d84-43fb-bd8a-51db153d6632"
license = "Elastic License v2"
name = "General Privilege Escalation Sequence Detected"
os_list = ["linux"]
version = "1.0.6"

query = '''
sequence with maxspan=10s
  [process where event.type == "start" and event.action == "exec" and user.id != 0 and
   process.executable like ("/tmp/*", "/dev/shm/*", "/var/tmp/*", "/home/*", "/run/user/*", "/var/run/user/*") and
   not process.parent.executable in ("/usr/bin/sw-engine", "/usr/sbin/sshd", "/usr/sbin/sw-engine-fpm", "/usr/lib/systemd/systemd")] by process.entity_id
  [process where event.type == "change" and event.action == "uid_change" and user.id == 0] by process.entity_id
  [process where event.type == "start" and event.action == "exec" and process.name in ("whoami", "id", "logname") and user.id == 0] by process.parent.entity_id
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 2

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 1

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 2

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1068"
name = "Exploitation for Privilege Escalation"
reference = "https://attack.mitre.org/techniques/T1068/"


[threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[internal]
min_endpoint_version = "7.15.0"

[metadata]
creation_date = "2026/07/16"
integration = ["gcp"]
maturity = "production"
updated_date = "2026/07/16"

[rule]
author = ["Elastic"]
description = """
Detects bursts of GKE API requests from an anonymous identity that probe many distinct actions and resources with
mostly failed outcomes. This pattern is consistent with unauthenticated permission enumeration against an exposed API
server. On GKE GCP audit logs, unauthenticated probes often omit "client.user.email" (null principal) with
Unauthorized failures; those events are included alongside "system:anonymous" / "system:unauthenticated".
"""
from = "now-6m"
interval = "5m"
language = "esql"
license = "Elastic License v2"
name = "GKE Anonymous Endpoint Permission Enumeration"
note = """## Triage and analysis

### Investigating GKE Anonymous Endpoint Permission Enumeration

Anonymous multi-endpoint failure bursts map which APIs are reachable before credential theft or exploitation.
Treat missing `client.user.email` with Unauthorized/failure bursts as anonymous on GKE.

### Investigation steps

- Review `Esql.event_action_values` and `Esql.resource_name_values` for targeted APIs (secrets, RBAC, CRDs).
- Confirm whether `source.ip` is Internet-routable and whether the API endpoint is publicly exposed.
- Hunt for later successful anonymous or authenticated activity from the same source or user agent.

### False positives

- Misconfigured auth proxies that strip credentials can make legitimate clients appear anonymous during outages.

"""
references = [
    "https://heilancoos.github.io/research/2025/12/16/kubernetes.html#unauthenticated-api-access",
    "https://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging",
]
risk_score = 47
rule_id = "bd7345e5-c822-41de-a393-7573fec07ef4"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Domain: Kubernetes",
    "Data Source: GCP",
    "Data Source: Google Cloud Platform",
    "Use Case: Threat Detection",
    "Tactic: Discovery",
    "Tactic: Reconnaissance",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "esql"
setup = "The GCP Fleet integration with GKE audit logs enabled is required to be compatible with this rule."

query = '''
from logs-gcp.audit-* metadata _id, _index, _version
| where data_stream.dataset == "gcp.audit"
    and service.name == "k8s.io"
    and (
      client.user.email in ("system:anonymous", "system:unauthenticated")
      or client.user.email is null
    )
    and not gcp.audit.resource_name in ("readyz", "livez", "healthz", "version")
| stats
    Esql.document_count = count(),
    Esql.failure_count = sum(case(event.outcome == "failure", 1, 0)),
    Esql.event_action_count_distinct = count_distinct(event.action),
    Esql.resource_name_count_distinct = count_distinct(gcp.audit.resource_name),
    Esql.event_action_values = values(event.action),
    Esql.resource_name_values = values(gcp.audit.resource_name),
    Esql.event_outcome_values = values(event.outcome),
    Esql.client_user_email_values = values(client.user.email),
    Esql.timestamp = VALUES(@timestamp),
    Esql.data_stream_namespace = VALUES(data_stream.namespace),
    Esql.user_agent_original_values = VALUES(user_agent.original)
  by source.ip
| where Esql.event_action_count_distinct > 5
    and Esql.resource_name_count_distinct > 3
    and Esql.document_count < 50
    and Esql.failure_count >= 1
| keep Esql.*, source.ip
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1613"
name = "Container and Resource Discovery"
reference = "https://attack.mitre.org/techniques/T1613/"

[rule.threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1595"
name = "Active Scanning"
reference = "https://attack.mitre.org/techniques/T1595/"

[[rule.threat.technique.subtechnique]]
id = "T1595.003"
name = "Wordlist Scanning"
reference = "https://attack.mitre.org/techniques/T1595/003/"

[rule.threat.tactic]
id = "TA0043"
name = "Reconnaissance"
reference = "https://attack.mitre.org/tactics/TA0043/"

[rule]
description = """
Detects when a file descriptor in the proc (temporary) file system is executed and immediately makes an outbound network
connection. This activity can occur when the memfd syscall is utilized to create a memory resident file, like a payload,
and then execute it after which is establishes outbound network connections (C2).
"""
id = "4c8b9c6f-4d85-4fa9-9104-16f7a99aded6"
license = "Elastic License v2"
name = "Network Activity from Memory File Descriptor"
os_list = ["linux"]
reference = [
    "https://github.com/MythicAgents/merlin/blob/main/Payload_Type/merlin/container/commands/memfd.go",
    "https://x-c3ll.github.io/posts/fileless-memfd_create/",
]
version = "1.0.18"

query = '''
sequence by process.entity_id with maxspan=10s
  [process where event.type == "start" and event.action == "exec" and
  process.executable regex """/proc/(self|[0-9]{1,7})/fd/[0-9]{1,7}""" and
  not (
    process.args like ("/usr/lib/systemd/systemd-executor", "/nix/store/*/systemd-executor*") or
    process.parent.executable like (
      "/usr/sbin/runc", "/usr/bin/dockerd", "/lib/systemd/systemd", "/usr/lib/systemd/systemd", "/nix/store/*/systemd",
      "/opt/sentinelone/bin/addon-host", "/opt/gitlab/embedded/bin/gitlab-kas", "/usr/sbin/nordlayerd", "/sbin/init",
      "/proc/self/fd/*/*"
    ) or
    process.command_line == "runc init"
  )]
  [network where event.type == "start" and event.action == "connection_attempted" and
  not (
    cidrmatch(destination.ip, "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24",
      "192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32",
      "192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4",
      "100.64.0.0/10", "192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1",
      "FE80::/10", "FF00::/8"
    ) or
    process.name == "check-new-release-gtk"
  )]
'''

min_endpoint_version = "8.3.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
tree = true

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1106"
name = "Native API"
reference = "https://attack.mitre.org/techniques/T1106/"


[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1620"
name = "Reflective Code Loading"
reference = "https://attack.mitre.org/techniques/T1620/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.3.0"

[metadata]
creation_date = "2026/08/13"
integration = ["system", "windows"]
maturity = "production"
updated_date = "2026/08/13"

[rule]
author = ["Elastic"]
description = """
Identifies a successful PKINIT ticket-granting ticket request followed within five seconds on the same domain controller
and source address by a successful user-to-user service-ticket request whose service SID matches the PKINIT principal
SID. This sequence is consistent with the KDC-visible ticket requests used in an UnPAC-the-Hash attack, before
client-side PAC credential decryption and NT hash recovery. The certificate used for PKINIT may have been obtained
through CertiGhost or another certificate-abuse path.
"""
from = "now-9m"
index = ["logs-system.security*", "logs-windows.forwarded*", "winlogbeat-*"]
language = "eql"
license = "Elastic License v2"
name = "PKINIT Followed by Same-Principal U2U Service Ticket"
references = [
    "https://specterops.io/blog/2026/06/09/user-to-user-authentication-down-the-rabbit-hole-part-1/",
    "https://dirkjanm.io/ntlm-relaying-to-ad-certificate-services/#obtaining-the-nt-hash-of-the-impersonated-computer-account",
    "https://github.com/FalconForceTeam/FalconFriday/blob/c662a6a0dc5d973beb3abb673d4e8cdc193bf469/0xFF-0299-UnPAC_the_hash-Win.md",
    "https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26",
    "https://github.com/dirkjanm/PKINITtools/blob/0f0cfa542b0348609ad494713e84744234b2d3b0/getnthash.py",
]
risk_score = 47
rule_id = "04443c0e-9f23-4b61-996b-d8d6b0263bd2"
setup = """## Setup

Audit Kerberos Authentication Service and Audit Kerberos Service Ticket Operations must be enabled to generate the
events used by this rule.

Setup instructions:

- [Audit Kerberos Authentication Service](https://ela.st/audit-kerberos-authentication-service)
- [Audit Kerberos Service Ticket Operations](https://ela.st/audit-kerberos-service-ticket-operations)
"""
severity = "medium"
tags = [
    "Domain: Identity",
    "Platform: Windows",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Credential Access",
    "Rule Type: Event Correlation (EQL)",
    "Use Case: Active Directory Monitoring",
    "Data Source: Active Directory",
    "Data Source: Windows Security Event Logs",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
sequence by winlog.computer_name, source.ip with maxspan=5s
  [authentication where host.os.type == "windows" and
    event.code == "4768" and winlog.event_data.PreAuthType == "16" and
    winlog.event_data.Status == "0x0"
  ] by winlog.event_data.TargetSid
  [authentication where host.os.type == "windows" and
    event.code == "4769" and winlog.event_data.Status == "0x0" and
    winlog.event_data.TicketOptions in ("0x40810008", "0x40810018")
  ] by winlog.event_data.ServiceSid
'''


note = """## Triage and analysis

### Investigating PKINIT Followed by Same-Principal U2U Service Ticket

The query uses `winlog.event_data.PreAuthType` value `16` for `PA-PK-AS-REQ`, the PKINIT pre-authentication request
type. Both accepted `winlog.event_data.TicketOptions` masks include `FORWARDABLE`, `RENEWABLE`, `CANONICALIZE`, and
`ENC-TKT-IN-SKEY`; `ENC-TKT-IN-SKEY` is the option that identifies a user-to-user service-ticket request.
`0x40810018` also includes `RENEWABLE-OK`, while `0x40810008` does not.
Controlled request profiles produced both masks, so `RENEWABLE-OK` is not required. Neither mask is suspicious by
itself; the signal is the five-second same-domain-controller and source sequence with the 4768 `TargetSid` matching
the 4769 `ServiceSid`.

#### Possible investigation steps

- Did the 4769 requester match the PKINIT principal?
  - Focus: `event.code`, `winlog.event_data.TargetUserName`, `winlog.event_data.TargetDomainName`, `winlog.event_data.TargetSid`, `winlog.event_data.ServiceSid`.
  - Hint: Use Investigate in Timeline to review the matched 4768 and 4769 source events. Compare their `winlog.event_data.TargetUserName` values case-insensitively after removing any `@REALM` suffix, and compare `winlog.event_data.TargetDomainName`. Event 4769 exposes the requester name and domain, but not its SID; resolve ambiguous names through the directory before disposition.
  - Implication: A resolved requester matching the 4768 principal supports the same-principal interpretation. Confirmed authorized UnPAC-the-Hash or PKINIT/U2U testing is a benign true positive. Keep a raw-name mismatch unresolved; if identity resolution and client or application evidence establish a different requester and unrelated events, close the alert as a false correlation.
- Does the rule-shaped pattern recur for the same domain controller and source address?
  - Focus: `winlog.computer_name`, `source.ip`, `@timestamp`, `winlog.event_data.TargetSid`, `winlog.event_data.ServiceSid`.
  - Hint: Reconstruct each sequence manually by checking order, the five-second interval, and the stage-local SID values. The following Timeline investigation returns 24 hours of matching PKINIT and U2U candidates for the shared domain controller and source address, not principal-specific history. $investigate_0
  - Implication: Repeated valid pairs or different principals from the same source increase confidence in credential-recovery tooling. Recurrence does not prove client-side PAC decryption or NT hash recovery.
- What related activity corroborates or expands the scope?
  - Focus: `winlog.computer_name`, `source.ip`, `winlog.event_data.TargetUserName`, `winlog.event_data.TargetSid`, `winlog.event_data.ServiceSid`.
  - Hint: After reviewing the matched source events, search available identity, endpoint, certificate, and alert telemetry for the source address, principal, and domain controller. Look for upstream certificate abuse, client tooling, repeated PKINIT/U2U activity, or follow-on authentication. Missing telemetry is unresolved, not benign.
  - Implication: Upstream certificate abuse, relevant client execution, or follow-on credential use supports escalation and broader scoping. Their absence does not clear the matched sequence.

Escalate unexplained or corroborated sequences with the matched source events and source/principal scope. Close as a benign true positive only for confirmed authorized UnPAC-the-Hash or PKINIT/U2U testing, or as a false positive when identity resolution and client or application evidence prove an unrelated cross-principal correlation. Preserve available evidence and escalate mixed or incomplete cases.

### False positive analysis

No known false positives have been identified. Validate the 4769 requester against the matched 4768 principal because event 4769 does not expose the requester SID.

Avoid exceptions based only on a domain controller or source address. EQL exceptions evaluate each sequence member independently and cannot express the cross-stage SID relationship.

### Response and remediation

- Preserve the alert, matched 4768/4769 source events, timestamps, identities, domain controller, and source address before disruptive action.
- If the client endpoint is identified, collect relevant volatile process or memory evidence before isolation or process termination.
- For confirmed malicious activity, contain the identified client and affected account with reversible controls where possible. Revoke a certificate only when evidence binds it to the activity, and rotate affected credentials when recovery or subsequent use is confirmed or the exposure assessment warrants it.
- Document confirmed indicators, matched source-event values, and any logging gaps for the responsible detection or logging owners after scoping and containment.
"""

[rule.investigation_fields]
field_names = [
  "winlog.computer_name",
  "source.ip",
]


[[transform.investigate]]
label = "Kerberos history for the same DC and source"
providers = [
    [
        { excluded = false, field = "winlog.computer_name", queryType = "phrase", value = "{{winlog.computer_name}}", valueType = "string" },
        { excluded = false, field = "source.ip", queryType = "phrase", value = "{{source.ip}}", valueType = "string" },
        { excluded = false, field = "event.code", queryType = "phrase", value = "4768", valueType = "string" },
        { excluded = false, field = "winlog.event_data.PreAuthType", queryType = "phrase", value = "16", valueType = "string" },
        { excluded = false, field = "winlog.event_data.Status", queryType = "phrase", value = "0x0", valueType = "string" },
    ],
    [
        { excluded = false, field = "winlog.computer_name", queryType = "phrase", value = "{{winlog.computer_name}}", valueType = "string" },
        { excluded = false, field = "source.ip", queryType = "phrase", value = "{{source.ip}}", valueType = "string" },
        { excluded = false, field = "event.code", queryType = "phrase", value = "4769", valueType = "string" },
        { excluded = false, field = "winlog.event_data.Status", queryType = "phrase", value = "0x0", valueType = "string" },
        { excluded = false, field = "winlog.event_data.TicketOptions", queryType = "phrase", value = "0x40810008", valueType = "string" },
    ],
    [
        { excluded = false, field = "winlog.computer_name", queryType = "phrase", value = "{{winlog.computer_name}}", valueType = "string" },
        { excluded = false, field = "source.ip", queryType = "phrase", value = "{{source.ip}}", valueType = "string" },
        { excluded = false, field = "event.code", queryType = "phrase", value = "4769", valueType = "string" },
        { excluded = false, field = "winlog.event_data.Status", queryType = "phrase", value = "0x0", valueType = "string" },
        { excluded = false, field = "winlog.event_data.TicketOptions", queryType = "phrase", value = "0x40810018", valueType = "string" },
    ],
]
relativeFrom = "now-24h/h"
relativeTo = "now"

[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1558"
name = "Steal or Forge Kerberos Tickets"
reference = "https://attack.mitre.org/techniques/T1558/"


[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[rule]
description = """
Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This can be done
without affecting the functionality or behavior of a binary, but can increase the size of the binary beyond what some
security tools are capable of handling due to file size limitations
"""
id = "65a402ff-904b-4d14-b7aa-fa0c5ae575f8"
license = "Elastic License v2"
name = "Potential Evasion via Oversized Image Load"
os_list = ["windows"]
reference = [
    "https://attack.mitre.org/techniques/T1027/001/",
    "https://www.elastic.co/security-labs/Hunting-for-Suspicious-Windows-Libraries-for-Execution-and-Evasion",
]
version = "1.0.27"

query = '''
sequence with maxspan=1m
 [file where event.action != "deletion" and
   /* over 100MB in size */
   file.size >= 100000000 and file.Ext.header_bytes : "4d5a*" and not file.extension : "exe" and
   not user.id : "S-1-5-18" and
  not (process.code_signature.subject_name in ("Trend Micro, Inc.",  "Azul Systems, Inc.", "Wargaming Group Limited",
      "Avigilon Corporation", "Duck Duck Go, Inc.", "Wargaming Group Limited", "Griff Gate Pte. Ltd.", "Corsair Memory, Inc.",
      "Anaconda, Inc.") and
       process.code_signature.status == "trusted") and
  not process.executable : ("C:\\ProgramData\\slicer.org\\Slicer *\\bin\\python-real.exe", "C:\\Program Files\\burpsuite_enterprise\\jres\\*\\bin\\java.exe") and
  not file.path : "C:\\ProgramData\\*\\PyQt5\\Qt5\\bin\\Qt5WebEngineCore.dll"
  ] by file.path
 [library where
    (
     process.name : ("rundll32.exe", "regsvr32.exe", "svchost.exe") or
     process.executable :
               ("?:\\Users\\Public\\*",
                "?:\\ProgramData\\*",
                "?:\\Windows\\Temp\\*",
                "?:\\Users\\*\\AppData\\Local\\Temp\\Temp?_*",
                "?:\\Users\\*\\AppData\\Local\\Temp\\7z*",
                "?:\\Users\\*\\AppData\\Local\\Temp\\Rar*",
                "?:\\Users\\*\\AppData\\Local\\Temp\\BNZ.*")
     )
    and not dll.code_signature.trusted == true and
    not dll.code_signature.status : "errorExpired" and
    not user.id : "S-1-5-18" and
    not (process.name : "regsvr32.exe" and dll.path : "C:\\Oracle\\*.dll") and
    not (dll.name : "Qt5WebEngineCore.dll" and process.code_signature.subject_name == "Pitney Bowes Inc.")] by dll.path
'''

min_endpoint_version = "8.4.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1027"
name = "Obfuscated Files or Information"
reference = "https://attack.mitre.org/techniques/T1027/"
[[threat.technique.subtechnique]]
id = "T1027.001"
name = "Binary Padding"
reference = "https://attack.mitre.org/techniques/T1027/001/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.4.0"

[rule]
description = "Identifies attempt to perform code injection using shellcode and from an unsigned PyInstaller executable."
id = "deb48ee3-8ce0-4ff7-a30b-041c5db024bb"
license = "Elastic License v2"
name = "Potential Injection via PyInstaller Executable"
os_list = ["windows"]
version = "1.0.5"

query = '''
api where not process.code_signature.status : "trusted" and
 (
 (process.Ext.api.behaviors : ("shellcode", "allocate_shellcode", "execute_shellcode") and
  process.thread.Ext.call_stack_summary :
                      ("ntdll.dll|kernelbase.dll|Unbacked",
                       "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked",
                       "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked|kernel32.dll|ntdll.dll",
                       "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked|libffi-?.dll|_ctypes.pyd|*") and
  process.thread.Ext.call_stack_final_user_module.protection_provenance : "libffi*.dll" and
  process.thread.Ext.call_stack_final_user_module.name : "Unbacked" and
  _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info : "Unbacked*" and $entry.callsite_trailing_bytes : "?*")) or

  (process.Ext.api.name : ("VirtualAlloc*", "MapViewOfFile*") and process.Ext.api.parameters.protection : "RWX" and
   process.thread.Ext.call_stack_final_user_module.name : "libffi*.dll" and
   process.thread.Ext.call_stack_summary : ("ntdll.dll|kernelbase.dll|libffi-?.dll|_ctypes.pyd|*",
                                            "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|libffi-?.dll|_ctypes.pyd|*"))
 ) and
 not process.Ext.api.summary == "VirtualAlloc( NULL, 0x1c, COMMIT|RESERVE, RWX )"
'''

min_endpoint_version = "8.10.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"