Elastic rules: 2j

[metadata]
creation_date = "2026/06/26"
integration = ["aws"]
maturity = "production"
updated_date = "2026/06/26"

[rule]
author = ["Elastic"]
description = """
Identifies deletion of an AWS Backup recovery point via DeleteRecoveryPoint. A recovery point is a stored backup of a
protected resource (EBS, RDS, DynamoDB, EFS, S3, and others). Deleting recovery points removes the ability to restore
the associated data and is a core anti-recovery technique used in ransomware and data-destruction attacks to ensure
victims cannot recover without paying or rebuilding. Routine lifecycle expirations are performed by the AWS Backup
service itself; deletion by a non-service principal is rare and should be reviewed.
"""
false_positives = [
    """
    Backup, platform, or infrastructure-as-code teams may delete recovery points during retention cleanup, migration, or
    decommissioning. Verify the principal in "aws.cloudtrail.user_identity.arn", the affected recovery point and vault
    in "aws.cloudtrail.request_parameters", and whether the deletion aligns with an approved change. Known
    administration roles can be excluded after validation.
    """,
]
from = "now-6m"
index = ["logs-aws.cloudtrail-*"]
language = "kuery"
license = "Elastic License v2"
name = "AWS Backup Recovery Point Deleted"
note = """## Triage and analysis

### Investigating AWS Backup Recovery Point Deleted

AWS Backup recovery points are the restorable copies of protected resources. "DeleteRecoveryPoint" permanently removes a recovery point from its vault, eliminating the ability to restore that backup. Adversaries delete recovery points to inhibit recovery after data destruction or encryption, maximizing the impact of ransomware or sabotage. Because scheduled expirations are carried out by the AWS Backup service itself (excluded by this rule), a deletion by a user or role principal is uncommon and high-signal, especially when several recovery points are removed in a short window.

### Possible investigation steps

- Identify the actor in "aws.cloudtrail.user_identity.arn" and "aws.cloudtrail.user_identity.type", and review "source.ip", "source.as.organization.name", and "user_agent.original" for an unexpected origin.
- Identify the affected recovery point and vault from "aws.cloudtrail.request_parameters", and determine which resource and data it protected.
- Determine whether multiple recovery points or vaults were affected in the same window, indicating a broader anti-recovery effort.
- Correlate with adjacent destructive or evasion activity by the same principal, such as DeleteBackupVault, Vault Lock removal, KMS key deletion, or resource deletions.

### False positive analysis

- Retention cleanup, migration, or decommissioning may delete recovery points. Confirm the deletion is expected and exclude known administration roles on "aws.cloudtrail.user_identity.arn" after validation.

### Response and remediation

- If the deletion is unauthorized, treat it as a potential precursor to or part of a destructive attack: preserve remaining backups, enable Vault Lock where possible, and engage incident response.
- Rotate or restrict credentials for the principal if compromise is suspected, and restrict "backup:DeleteRecoveryPoint" to a small set of trusted administrators via IAM and SCPs.

### Additional information

- [DeleteRecoveryPoint API](https://docs.aws.amazon.com/aws-backup/latest/devguide/API_DeleteRecoveryPoint.html)
- [AWS Backup Vault Lock](https://docs.aws.amazon.com/aws-backup/latest/devguide/vault-lock.html)
"""
references = [
    "https://docs.aws.amazon.com/aws-backup/latest/devguide/API_DeleteRecoveryPoint.html",
    "https://docs.aws.amazon.com/aws-backup/latest/devguide/vault-lock.html",
]
risk_score = 73
rule_id = "042b35f3-afa6-4441-92b2-ef41976b48a3"
setup = """This rule requires AWS CloudTrail management events for AWS Backup and ingestion via the Elastic AWS CloudTrail integration. See https://docs.elastic.co/integrations/aws/cloudtrail."""
severity = "high"
tags = [
    "Domain: Cloud",
    "Data Source: AWS",
    "Data Source: Amazon Web Services",
    "Data Source: AWS Backup",
    "Use Case: Threat Detection",
    "Tactic: Impact",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset: "aws.cloudtrail"
    and event.provider: "backup.amazonaws.com"
    and event.action: "DeleteRecoveryPoint"
    and event.outcome: "success"
    and not aws.cloudtrail.user_identity.type: "AWSService"
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1490"
name = "Inhibit System Recovery"
reference = "https://attack.mitre.org/techniques/T1490/"


[rule.threat.tactic]
id = "TA0040"
name = "Impact"
reference = "https://attack.mitre.org/tactics/TA0040/"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user_agent.original",
    "source.ip",
    "source.as.number",
    "source.as.organization.name",
    "aws.cloudtrail.user_identity.arn",
    "aws.cloudtrail.user_identity.type",
    "aws.cloudtrail.user_identity.access_key_id",
    "event.action",
    "event.outcome",
    "cloud.account.id",
    "cloud.region",
    "aws.cloudtrail.request_parameters",
    "aws.cloudtrail.response_elements",
]

[metadata]
creation_date = "2021/01/20"
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2026/05/04"

[rule]
author = ["Elastic"]
description = """
User Account Control (UAC) can help mitigate the impact of malware on Windows hosts. With UAC, apps and tasks always run
in the security context of a non-administrator account, unless an administrator specifically authorizes
administrator-level access to the system. This rule identifies registry value changes to bypass User Access Control
(UAC) protection.
"""
from = "now-9m"
index = [
    "winlogbeat-*",
    "logs-endpoint.events.registry-*",
    "logs-windows.sysmon_operational-*",
    "endgame-*",
    "logs-m365_defender.event-*",
    "logs-sentinel_one_cloud_funnel.*",
    "logs-crowdstrike.fdr*",
]
language = "eql"
license = "Elastic License v2"
name = "Disabling User Account Control via Registry Modification"
note = """## Triage and analysis

### Investigating Disabling User Account Control via Registry Modification

Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as low to high integrity levels) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. UAC can deny an operation under high-integrity enforcement, or allow the user to perform the action if they are in the local administrators group and enter an administrator password when prompted.

For more information about the UAC and how it works, check the [official Microsoft docs page](https://docs.microsoft.com/en-us/windows/security/identity-protection/user-account-control/how-user-account-control-works).

Attackers may disable UAC to execute code directly in high integrity. This rule identifies registry value changes to bypass the UAC protection.

#### Possible investigation steps

- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
- Investigate other alerts associated with the user/host during the past 48 hours.
- Inspect the host for suspicious or abnormal behaviors in the alert timeframe.
- Investigate abnormal behaviors observed by the subject process such as network connections, registry or file modifications, and any spawned child processes.
- Analyze non-system processes executed with high integrity after UAC was disabled for unknown or suspicious processes.
- Retrieve the suspicious processes' executables and determine if they are malicious:
  - Use a private sandboxed malware analysis system to perform analysis.
    - Observe and collect information about the following activities:
      - Attempts to contact external domains and addresses.
      - File and registry access, modification, and creation activities.
      - Service creation and launch activities.
      - Scheduled tasks creation.
  - Use the PowerShell `Get-FileHash` cmdlet to get the files' SHA-256 hash values.
    - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.

### False positive analysis

- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.

### Response and remediation

- Initiate the incident response process based on the outcome of the triage.
- Isolate the involved host to prevent further post-compromise behavior.
- If the triage identified malware, search the environment for additional compromised hosts.
  - Implement temporary network rules, procedures, and segmentation to contain the malware.
  - Stop suspicious processes.
  - Immediately block the identified indicators of compromise (IoCs).
  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
- Remove and block malicious artifacts identified during triage.
- Restore UAC settings to the desired state.
- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
"""

setup = """## Setup

This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.

Setup instructions: https://ela.st/install-elastic-defend

### Additional data sources

This rule also supports the following third-party data sources. For setup instructions, refer to the links below:

- [CrowdStrike](https://ela.st/crowdstrike-integration)
- [Microsoft Defender XDR](https://ela.st/m365-defender)
- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
- [Sysmon Registry Events](https://ela.st/sysmon-event-reg-setup)
"""

references = [
    "https://www.greyhathacker.net/?p=796",
    "https://docs.microsoft.com/en-us/windows/security/identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings",
    "https://docs.microsoft.com/en-us/windows/security/identity-protection/user-account-control/user-account-control-overview",
    "https://www.elastic.co/security-labs/dissecting-remcos-rat-part-four",
]
risk_score = 47
rule_id = "d31f183a-e5b1-451b-8534-ba62bca0b404"
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Privilege Escalation",
    "Resources: Investigation Guide",
    "Data Source: Elastic Endgame",
    "Data Source: Elastic Defend",
    "Data Source: Sysmon",
    "Data Source: Microsoft Defender XDR",
    "Data Source: SentinelOne",
    "Data Source: Crowdstrike",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
registry where host.os.type == "windows" and event.type == "change" and
  registry.value : ("EnableLUA", "ConsentPromptBehaviorAdmin", "PromptOnSecureDesktop") and
  registry.data.strings : ("0", "0x00000000")

  /*
    Full registry key path omitted due to data source variations:
    HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA
    HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\ConsentPromptBehaviorAdmin
    HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\PromptOnSecureDesktop
  */
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1548"
name = "Abuse Elevation Control Mechanism"
reference = "https://attack.mitre.org/techniques/T1548/"

[[rule.threat.technique.subtechnique]]
id = "T1548.002"
name = "Bypass User Account Control"
reference = "https://attack.mitre.org/techniques/T1548/002/"

[rule.threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1112"
name = "Modify Registry"
reference = "https://attack.mitre.org/techniques/T1112/"

[[rule.threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"

[[rule.threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[metadata]
creation_date = "2020/09/24"
integration = ["azure"]
maturity = "production"
updated_date = "2026/04/10"

[rule]
author = ["Elastic"]
description = """
Identifies an Azure Active Directory (AD) Global Administrator role addition to a Privileged Identity Management (PIM)
user account. PIM is a service that enables you to manage, control, and monitor access to important resources in an
organization. Users who are assigned to the Global administrator role can read and modify any administrative setting in
your Azure AD organization.
"""
false_positives = [
    """
    Global administrator additions may be done by a system or network administrator. Verify whether the username,
    hostname, and/or resource name should be making changes in your environment. Global administrator additions from
    unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted
    from the rule.
    """,
]
index = ["logs-azure.auditlogs-*", "filebeat-*"]
language = "kuery"
license = "Elastic License v2"
name = "Entra ID Global Administrator Role Assigned (PIM User)"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Entra ID Global Administrator Role Assigned (PIM User)

Azure AD's Global Administrator role grants extensive access, allowing users to modify any administrative setting. Privileged Identity Management (PIM) helps manage and monitor such access. Adversaries may exploit this by adding themselves or others to this role, gaining persistent control. The detection rule identifies suspicious role additions by monitoring specific audit logs, focusing on successful role assignments to PIM users, thus helping to flag potential unauthorized access attempts.

### Possible investigation steps

- Review the Azure audit logs to confirm the details of the role addition event, focusing on the event.dataset:azure.auditlogs and azure.auditlogs.properties.category:RoleManagement fields.
- Identify the user account that was added to the Global Administrator role by examining the azure.auditlogs.properties.target_resources.*.display_name field.
- Check the event.outcome field to ensure the role addition was successful and not a failed attempt.
- Investigate the user account's recent activities and login history to determine if there are any anomalies or signs of compromise.
- Verify if the role addition aligns with any recent administrative changes or requests within the organization to rule out legitimate actions.
- Assess the potential impact of the role addition by reviewing the permissions and access levels granted to the user.
- If suspicious activity is confirmed, initiate a response plan to remove unauthorized access and secure the affected accounts.

### False positive analysis

- Routine administrative tasks may trigger alerts when legitimate IT staff are assigned the Global Administrator role for maintenance or updates. To manage this, create exceptions for known IT personnel or scheduled maintenance windows.
- Automated scripts or tools used for role assignments can cause false positives if they frequently add users to the Global Administrator role. Consider excluding these automated processes from monitoring or adjusting the detection rule to account for their activity.
- Temporary project-based role assignments might be flagged as suspicious. Implement a process to document and pre-approve such assignments, allowing for their exclusion from alerts.
- Training or onboarding sessions where new administrators are temporarily granted elevated access can result in false positives. Establish a protocol to notify the monitoring team of these events in advance, so they can be excluded from the detection rule.

### Response and remediation

- Immediately revoke the Global Administrator role from any unauthorized PIM user identified in the alert to prevent further unauthorized access.
- Conduct a thorough review of recent changes made by the affected account to identify any unauthorized modifications or suspicious activities.
- Reset the credentials of the compromised account and enforce multi-factor authentication (MFA) to secure the account against further unauthorized access.
- Notify the security team and relevant stakeholders about the incident for awareness and further investigation.
- Implement additional monitoring on the affected account and related systems to detect any further suspicious activities.
- Review and update access policies and role assignments in Azure AD to ensure that only necessary personnel have elevated privileges.
- Document the incident and response actions taken for future reference and to improve incident response procedures.

## Setup

The Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
references = [
    "https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/directory-assign-admin-roles",
]
risk_score = 73
rule_id = "ed9ecd27-e3e6-4fd9-8586-7754803f7fc8"
severity = "high"
tags = ["Domain: Cloud", "Data Source: Azure", "Use Case: Identity and Access Audit", "Tactic: Persistence", "Resources: Investigation Guide"]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset:azure.auditlogs and azure.auditlogs.properties.category:RoleManagement and
    azure.auditlogs.operation_name:("Add eligible member to role in PIM completed (permanent)" or
                                    "Add member to role in PIM completed (timebound)") and
    azure.auditlogs.properties.target_resources.*.display_name:"Global Administrator" and
    event.outcome:(Success or success)
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"

[[rule.threat.technique.subtechnique]]
id = "T1098.003"
name = "Additional Cloud Roles"
reference = "https://attack.mitre.org/techniques/T1098/003/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"

[[rule.threat.technique.subtechnique]]
id = "T1098.003"
name = "Additional Cloud Roles"
reference = "https://attack.mitre.org/techniques/T1098/003/"

[rule.threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[rule]
description = """
Identifies execution of a Windows script that was downloaded from the internet, extracted via explorer and followed by
spawning a child process or performing an outgoing network connection to the internet.
"""
id = "d8e8168f-3f1f-4e03-a069-a36879bde0f9"
license = "Elastic License v2"
name = "Execution of a Downloaded Windows Script via Explorer"
os_list = ["windows"]
version = "1.0.2"

query = '''
sequence with maxspan=5m
 [file where event.action == "creation" and process.name : "explorer.exe" and
  file.Ext.windows.zone_identifier == 3 and file.name : "*:Zone.Identifier" and file.path : "?:\\Users\\*" and
  file.extension in~ ("js", "jse", "vbs", "vbe", "wsh", "hta", "chm", "msc")] as event0
 [process where event.action == "start" and
  process.name in~ ("wscript.exe", "mshta.exe", "hh.exe", "mmc.exe") and process.parent.name : "explorer.exe" and
   (
    /* substring used to remove Zone.Identifier from file.name */
    stringcontains~(process.command_line, substring(event0.file.name, 0, length(event0.file.name) - 16)) or

    stringcontains~(process.command_line, event0.file.name) or

    startswith~(event0.file.path, process.working_directory)
   )] as event1
  [any where

   /* script utility spawn a child process */
   (event.category == "process" and event.action == "start" and
    process.parent.name in~ ("wscript.exe", "mshta.exe", "hh.exe", "mmc.exe") and process.parent.entity_id == event1.process.entity_id) or

    /* script utility perform an egress conn to the internet */
   (event.category == "network" and event.action in ("disconnect_received", "connection_attempted") and
    process.name in~ ("wscript.exe", "mshta.exe", "hh.exe", "mmc.exe") and
    process.entity_id == event1.process.entity_id and
    not cidrmatch(destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24",
       "192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32",
       "192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24", "192.88.99.0/24", "224.0.0.0/4",
       "100.64.0.0/10", "192.168.0.0/16", "192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24",
       "240.0.0.0/4", "::1", "FE80::/10", "FF00::/8"))]
'''

min_endpoint_version = "8.10.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 2
tree = true

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.005"
name = "Visual Basic"
reference = "https://attack.mitre.org/techniques/T1059/005/"

[[threat.technique.subtechnique]]
id = "T1059.007"
name = "JavaScript"
reference = "https://attack.mitre.org/techniques/T1059/007/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[[threat.technique.subtechnique]]
id = "T1218.001"
name = "Compiled HTML File"
reference = "https://attack.mitre.org/techniques/T1218/001/"

[[threat.technique.subtechnique]]
id = "T1218.005"
name = "Mshta"
reference = "https://attack.mitre.org/techniques/T1218/005/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"

[metadata]
creation_date = "2026/03/17"
integration = ["ibm_qradar"]
maturity = "production"
promotion = true
updated_date = "2026/03/17"

[rule]
author = ["Elastic"]
description = """
Generates a detection alert for each IBM QRadar offense written to the configured indices. Enabling this rule allows you
to immediately begin investigating IBM QRadar offense alerts in the app.
"""
from = "now-2m"
index = ["logs-ibm_qradar.offense-*"]
interval = "1m"
language = "kuery"
license = "Elastic License v2"
max_signals = 1000
name = "IBM QRadar External Alerts"
note = """## Triage and analysis

### Investigating IBM QRadar External Alerts

IBM QRadar is a Security Intelligence Platform that provides SIEM, log management, anomaly detection, and incident forensics. The rule promotes QRadar offense records as Elastic detection alerts, enabling analysts to investigate potential threats with full offense context including rule names, severity, and status.

### Possible investigation steps

- Review the offense details including rule name, description, and categories to understand the nature of the alert.
- Examine the offense severity and status (OPEN, HIDDEN, etc.) to prioritize investigation.
- Cross-reference the offense with QRadar console for additional context including contributing events and log sources.
- Investigate source and destination networks, device count, and event count associated with the offense.
- Consult the IBM QRadar investigation guide and resources tagged in the alert for specific guidance on handling similar threats.

### False positive analysis

- Offenses triggered by routine administrative activities or known maintenance can be false positives. Review the offense context and create exceptions for scheduled activities.
- Legitimate security testing or penetration testing may generate offenses. Coordinate with security teams to whitelist these during scheduled tests.
- Low-severity offenses from specific rules that are known to produce noise can be excluded by creating rule exceptions.
- Offenses from development or test environments may not require investigation. Consider excluding these environments if appropriate.

### Response and remediation

- Isolate affected systems if malicious activity is confirmed to prevent lateral movement.
- Review the offense details to identify compromised accounts, credentials, or systems and take appropriate remediation steps.
- Apply relevant security patches or updates to address any exploited vulnerabilities.
- Escalate to the security operations center (SOC) or incident response team for further analysis if the threat appears significant.
- Document the incident and update detection logic or exceptions based on findings.
"""
references = ["https://docs.elastic.co/en/integrations/ibm_qradar"]
risk_score = 47
rule_id = "d6702168-2be6-4d7d-a549-9bff67733df3"
rule_name_override = "rule.name"
setup = """## Setup

### IBM QRadar Offense Integration
This rule is designed to capture offense events generated by the IBM QRadar integration and promote them as Elastic detection alerts.

To capture IBM QRadar offenses, install and configure the IBM QRadar integration to ingest offense records into the `logs-ibm_qradar.offense-*` index pattern.

If this rule is enabled alongside the External Alerts promotion rule (UUID: eb079c62-4481-4d6e-9643-3ca499df7aaa), you may receive duplicate alerts for the same QRadar events. Consider adding a rule exception for the External Alert rule to exclude data_stream.dataset:ibm_qradar.offense to avoid receiving duplicate alerts.

### Additional notes

For information on troubleshooting the maximum alerts warning please refer to this [guide](https://www.elastic.co/guide/en/security/current/alerts-ui-monitor.html#troubleshoot-max-alerts).
"""
severity = "medium"
tags = [
    "Data Source: IBM QRadar",
    "Use Case: Threat Detection",
    "Resources: Investigation Guide",
    "Promotion: External Alerts",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
event.kind: alert and data_stream.dataset: ibm_qradar.offense
'''


[[rule.risk_score_mapping]]
field = "ibm_qradar.offense.magnitude"
operator = "equals"
value = ""

[[rule.severity_mapping]]
field = "event.severity"
operator = "equals"
severity = "low"
value = "21"

[[rule.severity_mapping]]
field = "event.severity"
operator = "equals"
severity = "medium"
value = "47"

[[rule.severity_mapping]]
field = "event.severity"
operator = "equals"
severity = "high"
value = "73"

[[rule.severity_mapping]]
field = "event.severity"
operator = "equals"
severity = "critical"
value = "99"

[metadata]
creation_date = "2025/05/10"
integration = ["o365"]
maturity = "production"
updated_date = "2026/09/10"

[rule]
author = ["Elastic"]
description = """
Detects a burst of Microsoft 365 user account lockouts within a short 5-minute window. A high number of IdsLocked login
errors across multiple user accounts may indicate brute-force attempts for the same users resulting in lockouts.
"""
from = "now-9m"
interval = "8m"
language = "esql"
license = "Elastic License v2"
name = "M365 Identity User Account Lockouts"
note = """## Triage and Analysis

### Investigating M365 Identity User Account Lockouts

Detects a burst of Microsoft 365 user account lockouts within a short 5-minute window. A high number of IdsLocked login errors across multiple user accounts may indicate brute-force attempts for the same users resulting in lockouts.

This rule uses ESQL aggregations and thus has dynamically generated fields. Correlation of the values in the alert document may need to be performed to the original sign-in and Graph events for further context.

### Investigation Steps

- Review the `user_id_list`: Are specific naming patterns targeted (e.g., admin, helpdesk)?
- Examine `ip_list` and `source_orgs`: Look for suspicious ISPs or hosting providers.
- Check `duration_seconds`: A very short window with a high lockout rate often indicates automation.
- Confirm lockout policy thresholds with IAM or Entra ID admins. Did the policy trigger correctly?
- Use the `first_seen` and `last_seen` values to pivot into related authentication or audit logs.
- Correlate with any recent detection of password spraying or credential stuffing activity.
- Review the `request_type` field to identify which authentication methods were used (e.g., OAuth, SAML, etc.).
- Check for any successful logins from the same IP or ASN after the lockouts.

### False Positive Analysis

- Automated systems with stale credentials may cause repeated failed logins.
- Legitimate bulk provisioning or scripted tests could unintentionally cause account lockouts.
- Red team exercises or penetration tests may resemble the same lockout pattern.
- Some organizations may have a high volume of lockouts due to user behavior or legacy systems.

### Response Recommendations

- Notify affected users and confirm whether activity was expected or suspicious.
- Lock or reset credentials for impacted accounts.
- Block the source IP(s) or ASN temporarily using conditional access or firewall rules.
- Strengthen lockout and retry delay policies if necessary.
- Review the originating application(s) involved via `request_types`.
"""
references = [
    "https://learn.microsoft.com/en-us/security/operations/incident-response-playbook-password-spray",
    "https://learn.microsoft.com/en-us/purview/audit-log-detailed-properties",
    "https://securityscorecard.com/research/massive-botnet-targets-m365-with-stealthy-password-spraying-attacks/",
    "https://github.com/0xZDH/Omnispray",
    "https://github.com/0xZDH/o365spray",
]
risk_score = 47
rule_id = "de67f85e-2d43-11f0-b8c9-f661ea17fbcc"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Domain: SaaS",
    "Data Source: Microsoft 365",
    "Data Source: Microsoft 365 Audit Logs",
    "Use Case: Threat Detection",
    "Use Case: Identity and Access Audit",
    "Tactic: Credential Access",
    "Resources: Investigation Guide",

]
timestamp_override = "event.ingested"
type = "esql"

query = '''
from logs-o365.audit-*
| mv_expand event.category
| eval
    Esql.time_window_date_trunc = date_trunc(5 minutes, @timestamp)
| where
    data_stream.dataset == "o365.audit" and
    event.category == "authentication" and
    event.provider in ("AzureActiveDirectory", "Exchange") and
    event.action in ("UserLoginFailed", "PasswordLogonInitialAuthUsingPassword") and
    to_lower(o365.audit.ExtendedProperties.RequestType) rlike "(oauth.*|.*login.*)" and
    o365.audit.LogonError == "IdsLocked" and
    to_lower(o365.audit.UserId) != "not available" and
    o365.audit.Target.Type in ("0", "2", "6", "10") and
    source.`as`.organization.name != "MICROSOFT-CORP-MSN-as-BLOCK"
| stats
    Esql_priv.o365_audit_UserId_count_distinct = count_distinct(to_lower(o365.audit.UserId)),
    Esql_priv.o365_audit_UserId_values = values(to_lower(o365.audit.UserId)),
    Esql.source_ip_values = values(source.ip),
    Esql.source_ip_count_distinct = count_distinct(source.ip),
    Esql.source_as_organization_name_values = values(source.`as`.organization.name),
    Esql.source_as_organization_name_count_distinct = count_distinct(source.`as`.organization.name),
    Esql.source_geo_country_name_values = values(source.geo.country_name),
    Esql.source_geo_country_name_count_distinct = count_distinct(source.geo.country_name),
    Esql.o365_audit_ExtendedProperties_RequestType_values = values(to_lower(o365.audit.ExtendedProperties.RequestType)),
    Esql.timestamp_first_seen = min(@timestamp),
    Esql.timestamp_last_seen = max(@timestamp),
    Esql.event_count = count(*)
  by Esql.time_window_date_trunc
| eval
    Esql.event_duration_seconds = date_diff("seconds", Esql.timestamp_first_seen, Esql.timestamp_last_seen)
| keep
    Esql.time_window_date_trunc,
    Esql_priv.o365_audit_UserId_count_distinct,
    Esql_priv.o365_audit_UserId_values,
    Esql.source_ip_values,
    Esql.source_ip_count_distinct,
    Esql.source_as_organization_name_values,
    Esql.source_as_organization_name_count_distinct,
    Esql.source_geo_country_name_values,
    Esql.source_geo_country_name_count_distinct,
    Esql.o365_audit_ExtendedProperties_RequestType_values,
    Esql.timestamp_first_seen,
    Esql.timestamp_last_seen,
    Esql.event_count,
    Esql.event_duration_seconds
| where
    Esql_priv.o365_audit_UserId_count_distinct >= 10 and
    Esql.event_count >= 10 and
    Esql.event_duration_seconds <= 300
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1110"
name = "Brute Force"
reference = "https://attack.mitre.org/techniques/T1110/"
[[rule.threat.technique.subtechnique]]
id = "T1110.001"
name = "Password Guessing"
reference = "https://attack.mitre.org/techniques/T1110/001/"

[[rule.threat.technique.subtechnique]]
id = "T1110.003"
name = "Password Spraying"
reference = "https://attack.mitre.org/techniques/T1110/003/"

[[rule.threat.technique.subtechnique]]
id = "T1110.004"
name = "Credential Stuffing"
reference = "https://attack.mitre.org/techniques/T1110/004/"



[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"

[[rule.threat.technique.subtechnique]]
id = "T1078.004"
name = "Cloud Accounts"
reference = "https://attack.mitre.org/techniques/T1078/004/"

[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"

[metadata]
creation_date = "2026/05/14"
integration = ["o365"]
maturity = "production"
updated_date = "2026/05/14"

[rule]
author = ["Elastic"]
description = """
Detects Microsoft 365 audit "UserLoggedIn" events consistent with Tycoon 2FA phishing-as-a-service (PhaaS)
adversary-in-the-middle (AiTM) activity: the Microsoft Authentication Broker requesting access where the object
identifier matches Microsoft Graph or Exchange Online, or the Office web client application authenticating to itself,
combined with Node.js-style user agents (node, axios, undici). Tycoon 2FA bypasses MFA by relaying authentication and
capturing session material, often targeting Microsoft 365 and Gmail. Baseline legitimate automation and developer
tooling before tuning.
"""
false_positives = [
    """
    Legitimate Node.js or undici-based automation, health checks, or internal services that use the Microsoft
    Authentication Broker or the same first-party application IDs against Graph or Exchange may match. Developers using
    axios or undici with delegated flows can also resemble this pattern.
    """,
]
from = "now-9m"
index = ["logs-o365.audit-*"]
language = "kuery"
license = "Elastic License v2"
name = "M365 Potential AiTM UserLoggedIn via Office App (Tycoon2FA)"
note = """## Triage and analysis

### Investigating M365 Potential AiTM UserLoggedIn via Office App (Tycoon2FA)

Review `o365.audit.UserId`, `user_agent.original`, `source.ip` or `o365.audit.ActorIpAddress`, and related Entra ID
sign-in logs (`azure.signinlogs`) for the same session or time window.

Confirm whether the account owner intentionally authenticated and whether Node.js-style user agents (node, axios, undici)
are expected for Microsoft Authentication Broker or Office web client flows in your environment.

### Possible investigation steps

- Correlate with `azure.signinlogs` for matching user principal name, IP, and session identifiers.
- Review Microsoft Graph or Exchange audit activity following the login for mailbox or data access anomalies.
- Hunt for other `UserLoggedIn` events from the same source with unusual user agents or rapid OAuth patterns.

### Response and remediation

- If malicious, revoke refresh tokens for the user, reset credentials per policy, and review conditional access outcomes.
- Block or monitor the source IP and escalate per incident procedures.
"""
references = ["https://any.run/malware-trends/tycoon/"]
risk_score = 73
rule_id = "275b972d-2fed-44fc-9214-08603b3318e3"
severity = "high"
tags = [
    "Domain: Cloud",
    "Domain: Identity",
    "Domain: SaaS",
    "Data Source: Microsoft 365",
    "Data Source: Microsoft 365 Audit Logs",
    "Use Case: Threat Detection",
    "Threat: Tycoon2FA",
    "Tactic: Initial Access",
    "Tactic: Credential Access",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"
query = '''
data_stream.dataset:"o365.audit" and event.category:"authentication" and event.action:"UserLoggedIn" and
(
    (
        o365.audit.ApplicationId:"29d9ed98-a469-4536-ade2-f981bc1d605e" and
        o365.audit.ObjectId:(
            "00000002-0000-0ff1-ce00-000000000000" or "00000003-0000-0000-c000-000000000000"
        )
    ) or
    (
        o365.audit.ApplicationId:"4765445b-32c6-49b0-83e6-1d93765276ca" and
        o365.audit.ObjectId:"4765445b-32c6-49b0-83e6-1d93765276ca"
    )
) and user_agent.original:(node or axios* or undici)
'''

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "o365.audit.UserId",
    "user_agent.original",
    "source.ip",
    "o365.audit.ActorIpAddress",
    "source.geo.country_name",
    "event.outcome",
    "o365.audit.ApplicationId",
    "o365.audit.ObjectId",
    "o365.audit.ExtendedProperties.RequestType",
    "event.provider",
]

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"

[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1539"
name = "Steal Web Session Cookie"
reference = "https://attack.mitre.org/techniques/T1539/"

[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[metadata]
creation_date = "2026/06/22"
integration = ["windows"]
maturity = "production"
updated_date = "2026/06/22"

[rule]
author = ["Elastic"]
description = """
Identifies PowerShell script block content associated with an Antimalware Scan Interface (AMSI) bypass that hooks the
RPC runtime marshaling stub NdrClientCall3 (or NdrClientCall2) in rpcrt4.dll. Unlike bypasses that patch AmsiScanBuffer
or set amsiInitFailed, this technique operates at the RPC layer used by AMSI to delegate scan requests to the
antivirus provider, tampering with the request before it reaches the engine and leaving AMSI itself unmodified. The
loader allocates an executable trampoline and marshals a delegate to the native stub; these primitives appear in
PowerShell Script Block Logging before the hook takes effect.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-windows.powershell*"]
language = "kuery"
license = "Elastic License v2"
name = "Potential AMSI Bypass via RPC Runtime Hooking"
note = """## Triage and analysis

### Investigating Potential AMSI Bypass via RPC Runtime Hooking

The Antimalware Scan Interface (AMSI) delegates scan requests to the registered antivirus provider over RPC. By hooking
the RPC runtime marshaling stub `NdrClientCall3`/`NdrClientCall2` in `rpcrt4.dll`, an adversary can tamper with these
requests so that malicious content is reported as clean, without modifying `amsi.dll` or patching `AmsiScanBuffer`.
This makes the bypass harder to catch via AMSI buffer or memory-write telemetry; the most reliable host artifact is the
loader's own PowerShell script content, captured by Script Block Logging.

#### Possible investigation steps

- Review `powershell.file.script_block_text` for references to `NdrClientCall3`/`NdrClientCall2`, resolution of
  functions in `rpcrt4.dll`, allocation of executable (`PAGE_EXECUTE_READWRITE`) memory, and delegate marshaling via
  `GetDelegateForFunctionPointer`.
- PowerShell logs each statement as a separate event; pivot on `host.id` and the PowerShell process id to reconstruct
  the full loader sequence and confirm intent.
- Identify how PowerShell was launched (interactive, encoded command, remote session) and review the parent process
  tree for download or staging activity.
- Correlate with Elastic Defend endpoint telemetry on the same host around the same time. Note that this RPC-layer hook
  may not surface as a memory modification of `rpcrt4.dll`, which is expected for this technique.
- Hunt for the same script content, user, or host pattern across the environment.

### False positive analysis

- Security research, detection engineering, and red-team development that legitimately references the RPC runtime
  marshaling functions or allocates executable memory from PowerShell can match. Validate the user, host, parent
  process, and surrounding script blocks against authorized testing before closing as benign, and add exceptions for
  known testing identities or hosts.

### Response and remediation

- Isolate the host if the activity is confirmed malicious and review for follow-on payload execution that the bypass
  was intended to conceal.
- Terminate the offending PowerShell session and preserve the Script Block Logging events for analysis.
- Restrict PowerShell usage outside of IT and engineering business units using GPOs, AppLocker, or WDAC.
- Reset credentials for accounts active on the host during the session if follow-on activity is observed.

### Limitations

This rule detects the technique only when it is delivered as logged PowerShell script-block text. In-memory delivery, a
PowerShell v2 downgrade, or implementing the hook outside PowerShell (compiled binary) can evade Script Block Logging
and therefore this rule. For customers running Elastic Defend, prefer the companion Endpoint Rule which detects the
VirtualProtect call targeting rpcrt4.dll!NdrClientCall* directly via API telemetry and is not dependent on Script
Block Logging."""
references = [
    "https://github.com/andreisss/Ghosting-AMSI",
]
risk_score = 73
rule_id = "4027f24e-b02f-4605-872f-7bafd8fe1b33"
setup = """## Setup

PowerShell Script Block Logging must be enabled to generate the events used by this rule (event ID 4104). The
`Microsoft-Windows-PowerShell/Operational` channel must be collected by the Windows integration or Winlogbeat.

Setup instructions: https://ela.st/powershell-logging-setup"""
severity = "high"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Defense Evasion",
    "Tactic: Execution",
    "Data Source: PowerShell Logs",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
event.code: "4104" and host.os.type: "windows" and
  powershell.file.script_block_text : (
    "NdrClientCall" or
    "NdrClientCall2" or
    "NdrClientCall3"
  ) and
  powershell.file.script_block_text : (
    "GetProcAddress" or
    "GetDelegateForFunctionPointer" or
    "VirtualProtect"
  )
'''

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "host.id",
    "host.name",
    "user.id",
    "user.name",
    "user.domain",
    "process.pid",
    "powershell.file.script_block_text",
    "powershell.file.script_block_id",
    "powershell.sequence",
    "powershell.total",
    "file.path",
]

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"

[[rule.threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"

[[rule.threat.technique.subtechnique]]
id = "T1059.001"
name = "PowerShell"
reference = "https://attack.mitre.org/techniques/T1059/001/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[rule]
description = """
Detects a ClickFix-style attack where a base64 encoded payload is decoded and piped to a shell interpreter for
execution, resulting in a curl download. This technique is commonly used in social engineering attacks where victims are
tricked into copying and pasting malicious commands from fake error dialogs or verification prompts.
"""
id = "9dfe40e2-3f4c-47d6-af48-f3459b53d49e"
license = "Elastic License v2"
name = "Potential ClickFix Attack via Base64 Decoded Payload"
os_list = ["macos"]
reference = ["https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/"]
version = "1.0.5"

query = '''
sequence by process.Ext.effective_parent.entity_id with maxspan=10s
[process where event.type == "start" and event.action == "exec" and process.name == "base64" and process.args in ("-d", "-D", "--decode") and
  process.Ext.effective_parent.name like~ ("Terminal", "iTerm2", "iTerm", "ghostty",
                                           "alacritty", "wezterm-gui", "Hyper", "kitty",
                                           "WarpTerminal", "stable", "rio", "tabby") and 
 not process.parent.command_line like ("*/.claude/shell-snapshots/snapshot-bash*", "*__CURSOR_SANDBOX_ENV_RESTORE*")]
[process where event.type == "start" and event.action == "exec" and process.name in ("bash", "sh", "zsh", "Terminal") and process.args_count <= 1]
[process where event.type == "start" and event.action == "exec" and process.name in ("curl", "nscurl") and process.parent.name in ("bash", "sh", "zsh", "Terminal") and
  process.parent.command_line in ("bash", "sh", "zsh", "Terminal", "/sbin/launchd") and
  not process.command_line like "/usr/bin/curl --version"]
'''

min_endpoint_version = "8.16.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 2

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"
[[threat.technique.subtechnique]]
id = "T1566.002"
name = "Spearphishing Link"
reference = "https://attack.mitre.org/techniques/T1566/002/"



[threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1204"
name = "User Execution"
reference = "https://attack.mitre.org/techniques/T1204/"
[[threat.technique.subtechnique]]
id = "T1204.001"
name = "Malicious Link"
reference = "https://attack.mitre.org/techniques/T1204/001/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "8.16.0"

[rule]
description = """
This rule detects the execution of a coin miner through potential mining commandline arguments. Adversaries may leverage
the resources of compromised systems to mine cryptocurrency, to generate revenue. This activity may impact system
performance and availability.
"""
id = "0259c937-877f-4140-a67b-dc51298f3f86"
license = "Elastic License v2"
name = "Potential Coin Miner Execution"
os_list = ["linux"]
reference = ["https://xmrig.com/docs/algorithms"]
version = "1.0.7"

query = '''
process where event.type == "start" and event.action == "exec" and (
  process.name like (
    "telnet.netkit", "ping", "telnet", "xmrig", "dash", "bash", "sh", "zsh", "ash", "fish", "ksh", "tcsh",
    "csh", "nohup", "pgrep", "python*", "perl*", "ruby*", "php*", "lua*", "sed", "pkill", "docker", "dig",
    "nslookup", "inetutils-telnet", "nc", "ncat", "netcat", "netcat.openbsd", "netcat.traditional",
    "nc.openbsd", "nc.traditional", "curl", "wget", "sudo", "grep", ".*"
  ) or
  process.executable like (
    "/tmp/*", "/var/tmp/*", "/dev/shm/*", "/boot/*", "./*", "/sys/*", "/lost+found/*", "/media/*", "/proc/*",
    "/var/backups/*", "/var/log/*", "/var/mail/*", "/var/spool/*"
  )
) and
(
  (
    (
      (
        process.args in ("-a", "--algo") and process.args in (
          "gr", "rx/graft", "cn/upx2", "argon2/chukwav2", "cn/ccx", "kawpow", "rx/keva", "cn-pico/tlo", "rx/sfx", "rx/arq",
          "rx/0", "argon2/chukwa", "argon2/ninja", "rx/wow", "cn/fast", "cn/rwz", "cn/zls", "cn/double", "cn/r", "cn-pico",
          "cn/half", "cn/2", "cn/xao", "cn/rto", "cn-heavy/tube", "cn-heavy/xhv", "cn-heavy/0", "cn/1", "cn-lite/1",
          "cn-lite/0", "cn/0"
        )
      ) or
      process.args in ("--nicehash", "--hash", "--seed") or
      (
        process.args == "--coin" and process.args in ("monero", "arqma", "dero")
      )
    ) and process.args in ("-o", "--url")
  ) or
  process.command_line like ("*stratum+tcp://*", "*stratum2+tcp://*")
) and not (
  process.parent.executable like "/var/cache/sensu/sensu-agent/*" or
  process.name in ("grep", "xargs")
)
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1496"
name = "Resource Hijacking"
reference = "https://attack.mitre.org/techniques/T1496/"


[threat.tactic]
id = "TA0040"
name = "Impact"
reference = "https://attack.mitre.org/tactics/TA0040/"

[internal]
min_endpoint_version = "7.15.0"

[metadata]
creation_date = "2020/12/07"
integration = ["windows"]
maturity = "production"
updated_date = "2026/04/24"

[rule]
author = ["Elastic"]
description = """
Identifies PowerShell script block content containing Invoke-Mimikatz or Mimikatz commands used to dump credentials,
extract password stores, export certificates, or use alternate authentication material. These patterns can indicate
in-memory credential access and require reconstructed script context and follow-on telemetry to assess impact.
"""
from = "now-9m"
index = ["logs-windows.powershell*", "winlogbeat-*"]
language = "kuery"
license = "Elastic License v2"
name = "Potential Invoke-Mimikatz PowerShell Script"
references = [
    "https://attack.mitre.org/software/S0002/",
    "https://raw.githubusercontent.com/EmpireProject/Empire/master/data/module_source/credentials/Invoke-Mimikatz.ps1",
    "https://www.elastic.co/security-labs/detect-credential-access",
]
risk_score = 99
rule_id = "ac96ceb8-4399-4191-af1d-4feeac1f1f46"
severity = "critical"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Credential Access",
    "Resources: Investigation Guide",
    "Data Source: PowerShell Logs",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
event.category:process and host.os.type:windows and
powershell.file.script_block_text:(
  (DumpCreds and DumpCerts) or
  "sekurlsa::logonpasswords" or
  "sekurlsa::ekeys" or
  "sekurlsa::tickets" or
  "sekurlsa::pth" or
  "sekurlsa::minidump" or
  "lsadump::sam" or
  "lsadump::secrets" or
  "lsadump::cache" or
  "lsadump::dcsync" or
  "vault::cred" or
  "dpapi::cred" or
  ("crypto::certificates" and
  "CERT_SYSTEM_STORE_LOCAL_MACHINE")
)
'''

note = """## Triage and analysis

### Investigating Potential Invoke-Mimikatz PowerShell Script

#### Possible investigation steps

- What Mimikatz behavior does the reconstructed script block show?
  - Why: Invoke-Mimikatz can run in memory and split or rename command logic; reconstruction separates live credential access from inert matched text.
  - Focus: read reconstructed `powershell.file.script_block_text`, `file.path`, `host.id`, `user.id`, and `@timestamp`. $investigate_0
  - Hint: reconstruct first with `powershell.file.script_block_id + powershell.sequence + powershell.total`: collect fragments sharing `powershell.file.script_block_id` on the same `host.id`, order by `powershell.sequence`, and treat sequence gaps as unresolved because they can hide targets, outputs, or cleanup.
  - Hint: runtime string construction, encoding, or command fragmentation can avoid literal command matches in this rule; rely on companion PowerShell obfuscation, AMSI bypass, and loader/injection detections when this exact-content rule does not fire.
  - Implication: escalate when the rebuilt code performs LSASS, SAM, LSA secrets, cached-credential, DCSync, DPAPI/vault, certificate/private-key, ticket, hash, or renamed/custom Mimikatz activity; lower concern only when reconstruction shows inert sample or training content and no supported recovery shows live targets, output paths, or follow-on use.

- Does the full script declare remote targets or export destinations that change scope?
  - Focus: reconstructed `powershell.file.script_block_text`, `file.path`, `host.id`, and `user.id` for remote "ComputerName" values, domain targets, export paths, certificate-store, DPAPI/vault, ticket/hash references, or cleanup commands.
  - Implication: broaden scope when remote targets, private-key export paths, or cleanup logic appear, because the affected hosts or exported material may differ from the alert host; keep scope local when the reconstructed script contains only local test content with no target or output path.

- Can endpoint process recovery explain how PowerShell was launched?
  - Focus: If endpoint process telemetry is available for this host, recover the matching process via `host.id + process.pid` before using `process.*` or `process.parent.*` for interpretation; then read `process.command_line`, `process.parent.command_line`, and `process.entity_id`. $investigate_1
  - Hint: start near `@timestamp` and expand backward if PowerShell started earlier; use `process.parent.executable` for parent identity and keep `process.Ext.authentication_id` only for the authentication bridge. If no process event is available, keep later pivots scoped to `host.id`, `user.id`, and alert time.
  - Implication: escalate when PowerShell is inline, encoded, remotely invoked, or launched by Office, browser, script-host, scheduled-task, or remote-management ancestry outside the recovered user-host context; lower concern when the launch chain, command line, and session anchor match the same recognized assessment or lab workflow.

- Does the source path show fileless execution or staged module use?
  - Focus: `file.path`, `file.directory`, `file.name`, and the reconstructed `powershell.file.script_block_text`.
  - Implication: escalate when no source file is present for active Mimikatz commands, or when the source path points to temp, profile, share, archive, or renamed script locations; lower concern when the path and script content are both confined to a controlled assessment repository or lab image.

- Did the activity create credential dumps, archives, exported certificates, tickets, hashes, or private-key material?
  - Focus: file activity on `host.id` after `@timestamp`, bounded to the PowerShell `process.pid`, with `file.path`, `file.name`, and `file.directory` for dump, archive, ".pfx", ".pvk", ".p12", ".key", ticket, hash, DPAPI, vault, or cleanup artifacts. $investigate_2
  - Implication: escalate when files appear in writable, external, or collection paths, especially certificate exports or archives matching the reconstructed command. Missing file telemetry is unresolved, not benign.

- Do authentication records show post-alert credential use?
  - Focus: Windows Security events after `@timestamp`, separating `event.code` 4624/4648/4625 and reading `winlog.event_data.TargetUserName`, `source.ip`, and `winlog.event_data.TargetServerName`. $investigate_3
  - Hint: If endpoint process telemetry is available for this host, recover the matching process via `host.id + process.pid` before using `process.*` or `process.parent.*` for interpretation; bridge recovered `process.Ext.authentication_id` to `winlog.event_data.TargetLogonId`, and search `winlog.event_data.SubjectLogonId` separately for 4648 explicit-credential events.
  - Implication: escalate when new privileged logons, explicit-credential use, remote source IPs, or unusual authentication-package patterns follow the script. Missing authentication telemetry is unresolved, not benign.

- If local evidence remains suspicious or incomplete, do related alerts widen account or host scope?
  - Focus: related alerts for `user.id` showing credential access, execution, defense evasion, or lateral movement. $investigate_4
  - Hint: compare `host.id` alerts for precursor access, other credential tools, or follow-on compromise. $investigate_5
  - Implication: broaden when either view shows connected credential-access or lateral-movement activity outside the same recognized assessment; keep the case local when surrounding alerts are absent or confined to the same bounded test.

- What disposition is supported by the evidence set?
  - Focus: credential-dump intent, password-store or DPAPI scope, certificate/private-key export, ticket/hash use, remote targets, launch context, source path, artifacts, authentication, and related alerts.
  - Implication: escalate when the evidence shows live dumping, password-store extraction, certificate export, alternate-authentication use, remote targeting, or follow-on credential use; close only when reconstruction shows inert content or telemetry plus external exercise confirmation bind the exact activity with no contradictory artifacts or authentication; preserve and escalate if evidence is mixed, partial, or telemetry is missing.

### False positive analysis

- Authorized red-team, credential-assessment, malware-analysis, training, or lab validation can legitimately trigger this rule. Confirm by verifying that reconstructed Mimikatz behavior, `user.id`, `host.id`, source `file.path`, recovered launch chain when available, authentication results, and exercise evidence all align to the same bounded test. If exercise evidence is unavailable, close only when telemetry itself proves inert content with no target, output, artifact, or follow-on authentication evidence.
- Build exceptions from the minimum confirmed pattern: stable `user.id`, `host.id`, source `file.path`, assessment repository or lab image, and recovered launcher context only when endpoint process recovery supports it. Avoid exceptions on `powershell.file.script_block_text`, Mimikatz strings, `user.name`, or `host.id` alone; do not create an exception for a single unconfirmed event.

### Response and remediation

- If confirmed benign, document the reconstructed script, source path, host-user scope, recovered launcher context if available, authentication evidence, and exercise evidence that confirmed the bounded test before reversing temporary containment. Create an exception only when that stable evidence set is confirmed, not from one unconfirmed event.
- If suspicious but unconfirmed, preserve the reconstructed script-block events, source script path, recovered process record if available, dump, password-store, ticket/hash, or certificate-export artifacts, and relevant Windows Security records before containment. Then apply reversible controls tied to the evidence, such as temporary session restriction, heightened monitoring, or limiting access for the affected `user.id` on `host.id`.
- If confirmed malicious, record evidence before destructive action, then isolate the endpoint or restrict the account based on the artifact and authentication findings. Terminate PowerShell only after evidence capture, then block or quarantine confirmed malicious scripts, artifact hashes, domains, or destinations only when those indicators were recovered during scoping.
- If credential dumping is confirmed, treat the involved `user.id` and any additional `winlog.event_data.TargetUserName` accounts as exposed only when reconstruction, artifacts, or authentication records support that exposure. Prioritize resets for privileged, service, and lateral-movement-relevant accounts, and review related hosts and users for the same authentication or alert pattern before artifact removal.
- If certificate, DPAPI, vault, ticket, or hash material is confirmed, preserve the affected `file.path` locations and references in `powershell.file.script_block_text`, then coordinate revocation, re-issuance, reset, or downstream trust updates for the confirmed material.
- After containment and credential, certificate, or alternate-authentication actions, remove staged scripts, dumps, archives, or exported key material only after scoping related hosts and users for the same source path, account, and authentication evidence.
"""

setup = """## Setup

PowerShell Script Block Logging must be enabled to generate the events used by this rule (e.g., 4104).
Setup instructions: https://ela.st/powershell-logging-setup
"""

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user.id",
    "user.domain",
    "powershell.file.script_block_text",
    "powershell.file.script_block_id",
    "powershell.sequence",
    "powershell.total",
    "file.path",
    "file.directory",
    "file.name",
    "process.pid",
    "host.name",
    "host.id",
    "powershell.file.script_block_length"
]

[[transform.investigate]]
label = "Script block fragments for the same script"
description = ""
providers = [
  [
    { excluded = false, field = "powershell.file.script_block_id", queryType = "phrase", value = "{{powershell.file.script_block_id}}", valueType = "string" },
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" }
  ]
]
relativeFrom = "now-1h"
relativeTo = "now"

[[transform.investigate]]
label = "Process events for the PowerShell instance"
description = ""
providers = [
  [
    { excluded = false, field = "process.pid", queryType = "phrase", value = "{{process.pid}}", valueType = "string" },
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" }
  ]
]
relativeFrom = "now-1h"
relativeTo = "now"

[[transform.investigate]]
label = "File events for the PowerShell process"
description = ""
providers = [
  [
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "process.pid", queryType = "phrase", value = "{{process.pid}}", valueType = "string" },
    { excluded = false, field = "event.category", queryType = "phrase", value = "file", valueType = "string" }
  ]
]
relativeFrom = "now-1h"
relativeTo = "now"

[[transform.investigate]]
label = "Windows Security authentication events on the host"
description = ""
providers = [
  [
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "event.code", queryType = "phrase", value = "4624", valueType = "string" }
  ],
  [
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "event.code", queryType = "phrase", value = "4648", valueType = "string" }
  ],
  [
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "event.code", queryType = "phrase", value = "4625", valueType = "string" }
  ]
]
relativeFrom = "now-24h"
relativeTo = "now"

[[transform.investigate]]
label = "Alerts associated with the user"
description = ""
providers = [
  [
    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
    { excluded = false, field = "user.id", queryType = "phrase", value = "{{user.id}}", valueType = "string" }
  ]
]
relativeFrom = "now-48h/h"
relativeTo = "now"

[[transform.investigate]]
label = "Alerts associated with the host"
description = ""
providers = [
  [
    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" }
  ]
]
relativeFrom = "now-48h/h"
relativeTo = "now"

[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1003"
name = "OS Credential Dumping"
reference = "https://attack.mitre.org/techniques/T1003/"
[[rule.threat.technique.subtechnique]]
id = "T1003.001"
name = "LSASS Memory"
reference = "https://attack.mitre.org/techniques/T1003/001/"
[[rule.threat.technique.subtechnique]]
id = "T1003.002"
name = "Security Account Manager"
reference = "https://attack.mitre.org/techniques/T1003/002/"
[[rule.threat.technique.subtechnique]]
id = "T1003.004"
name = "LSA Secrets"
reference = "https://attack.mitre.org/techniques/T1003/004/"
[[rule.threat.technique.subtechnique]]
id = "T1003.005"
name = "Cached Domain Credentials"
reference = "https://attack.mitre.org/techniques/T1003/005/"
[[rule.threat.technique.subtechnique]]
id = "T1003.006"
name = "DCSync"
reference = "https://attack.mitre.org/techniques/T1003/006/"
[[rule.threat.technique]]
id = "T1555"
name = "Credentials from Password Stores"
reference = "https://attack.mitre.org/techniques/T1555/"
[[rule.threat.technique.subtechnique]]
id = "T1555.004"
name = "Windows Credential Manager"
reference = "https://attack.mitre.org/techniques/T1555/004/"
[[rule.threat.technique]]
id = "T1649"
name = "Steal or Forge Authentication Certificates"
reference = "https://attack.mitre.org/techniques/T1649/"
[[rule.threat.technique]]
id = "T1558"
name = "Steal or Forge Kerberos Tickets"
reference = "https://attack.mitre.org/techniques/T1558/"

[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1550"
name = "Use Alternate Authentication Material"
reference = "https://attack.mitre.org/techniques/T1550/"
[[rule.threat.technique.subtechnique]]
id = "T1550.002"
name = "Pass the Hash"
reference = "https://attack.mitre.org/techniques/T1550/002/"
[[rule.threat.technique.subtechnique]]
id = "T1550.003"
name = "Pass the Ticket"
reference = "https://attack.mitre.org/techniques/T1550/003/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1550"
name = "Use Alternate Authentication Material"
reference = "https://attack.mitre.org/techniques/T1550/"
[[rule.threat.technique.subtechnique]]
id = "T1550.002"
name = "Pass the Hash"
reference = "https://attack.mitre.org/techniques/T1550/002/"
[[rule.threat.technique.subtechnique]]
id = "T1550.003"
name = "Pass the Ticket"
reference = "https://attack.mitre.org/techniques/T1550/003/"

[rule.threat.tactic]
id = "TA0008"
name = "Lateral Movement"
reference = "https://attack.mitre.org/tactics/TA0008/"

[rule]
description = """
This rule monitors for the use of SSH to potentially tunnel network traffic. Attackers can leverage SSH to establish
hidden communication channels and gain unauthorized access to internal resources, facilitating data exfiltration,
lateral movement, and remote control.
"""
id = "260c06cf-5ad8-4809-bca3-94828796e241"
license = "Elastic License v2"
name = "Potential Linux Tunneling or Port Forwarding via SSH"
os_list = ["linux"]
reference = ["https://book.hacktricks.xyz/generic-methodologies-and-resources/tunneling-and-port-forwarding"]
version = "1.0.8"

query = '''
process where event.type == "start" and event.action == "exec" and
process.parent.executable like ("/tmp/*", "/var/tmp/*", "/dev/shm/*", "/run/user/*", "/var/run/user/*", "/home/*/*", "/root/*", "/boot/*", "./*") and
(
  (
    process.name == "sshuttle" and
    process.args in ("-r", "--remote", "-l", "--listen")
  ) or
  (
    (
      process.name == "ssh" or
      (
        process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "mksh", "busybox") and
        process.args like "ssh*"
      )
    ) and
    (
      (
        process.args == "-J" or
        (
          (
            process.args in ("-R", "-L", "-D", "-w") or
            process.args regex """\-[A-NP-Za-np-z][A-Za-z]*[RLDwW][A-Za-z]*"""
          ) and
          process.args_count >= 4
        )
      ) or
      (
        process.args like "-o*" and
        process.command_line like~ (
          "*ProxyCommand*", "*LocalForward*", "*RemoteForward*", "*DynamicForward*", "*Tunnel*", "*GatewayPorts*",
          "*ExitOnForwardFailure*", "*ProxyJump*"
        )
      )
    )
  )
) and
not (
  process.parent.executable like (
    "/home/*/.local/bin/ansible-playbook", "/tmp/newroot/*", "/home/*/.local/share/JetBrains/Toolbox/bin/jetbrains-toolbox",
    "/home/*/sp/bin/forwards", "/home/*globusconnectpersonal*/bin/relaytool", "/home/*/bin/minikube/minikube-linux-amd64",
    "/home/*/google-cloud-sdk/platform/bundledpythonunix/bin/python3", "/home/*/.local/share/uv/python/cpython-*-linux-x86_64-gnu/bin/python3.*",
    "/home/*/.ssh/evolutixtunnelaws.sh", "/home/*/core3/dh/plz-out/bin/security/woodhouse/authenticator/authenticator",
    "/home/*/.local/vscode-insiders/usr/share/code-insiders/code-insiders", "/tmp/*/globusconnectpersonal-*/gt_amd64/bin/relaytool",
    "/home/*/.local/share/antigravity-ide/antigravity-ide", "/home/*/bin/minikube/minikube", "/home/*/.local/bin/codex",
    "/home/linuxbrew/.linuxbrew/Caskroom/codex/*/codex-x86_64-unknown-linux-musl"
  ) or
  process.parent.command_line like (
    "/home/*/repositories/synthetic-datasets/.venv/bin/python3 -c from multiprocessing.spawn import spawn_main; spawn_main(*) --multiprocessing-fork",
    "SkyPilot:executor:*"
  ) or
  (process.parent.args == "./deployment.sh" and process.working_directory like "/tmp/builds/*/metis/minerva/minerva-api") or
  (process.parent.executable like "/home/*/.pyenv/versions/*/bin/python*" and process.working_directory like "/home/*/Projects/backport/ansible-*") or
  (
    process.parent.executable like ("/home/*/software/crux/bin/reverse_tunnel.sh", "/home/*/software/crux/bin/ssh") and
    process.executable like ("/home/*/software/crux/bin/ssh", "/usr/bin/ssh")
  ) or
  (
    process.parent.command_line like "/home/*/bin/python /home/*/bin/ansible-playbook *" and
    process.command_line like "ssh -C -o ControlMaster=auto -o ControlPersist=60s *"
  ) or
  process.parent.executable like (
    "/home/*/.local/share/JetBrains/Daemon/*/jetbrainsd",
    "*/node_modules/@openai/codex/node_modules/@openai/codex-linux-x64/vendor/x86_64-unknown-linux-musl/bin/codex",
    "/home/*/.codex/packages/standalone/releases/*/bin/codex"
  )
)
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1572"
name = "Protocol Tunneling"
reference = "https://attack.mitre.org/techniques/T1572/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "7.15.0"

[rule]
description = """
Identifies any event with a call stack not starting with Windows NT syscall DLLs such as ntdll and win32u. This may
indicate the use of direct system calls to evade endpoint security solutions hooking Windows APIs.
"""
id = "30106950-2383-49cd-b462-ed55be29b10b"
license = "Elastic License v2"
name = "Potential Operation via Direct Syscall"
os_list = ["windows"]
reference = [
    "https://www.elastic.co/security-labs/revisiting-blister-new-developments-of-the-blister-loader",
    "https://www.elastic.co/security-labs/upping-the-ante-detecting-in-memory-threats-with-kernel-call-stacks",
    "https://www.ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs",
]
version = "1.0.32"

query = '''
any where process.pid != 4 and process.executable != null and process.name : "?*" and
 (
  /* call_stack_summary looks like process.name|etc */
  (event.category in ("file", "registry", "library") and
    startswith~(process.thread.Ext.call_stack_summary, process.name)) or
   
   /* call_stack_summary looks like process.parent.name|etc. */
  (event.category == "process" and event.action == "start" and
   startswith~(process.parent.thread.Ext.call_stack_summary, process.parent.name) and process.parent.executable : "?:\\*") or

  /* call_stack_summary looks like ntdll.dll|process.parent.name|etc */
  (event.category == "process" and event.action == "start" and
   endswith~(substring(process.parent.thread.Ext.call_stack_summary, 0, 10 + length(process.parent.name)), process.parent.name) and
   not process.parent.executable : "?:\\Windows\\System32\\services.exe" and process.parent.executable : "?:\\*")
  ) and 
  not ((process.executable : "?:\\Windows\\system32\\smss.exe" or process.parent.executable : "?:\\Windows\\system32\\smss.exe") and 
       (process.parent.thread.Ext.call_stack_summary : "ntdll.dll|smss.exe|*" or process.thread.Ext.call_stack_summary like "ntdll.dll|smss.exe|*")) and 
  not (event.category == "library" and 
       process.code_signature.status like ("trusted", "errorExpired", "errorCode_endpoint*", "errorTimeStamp") and 
       process.code_signature.subject_name : ("Oracle Corporation", "NVIDIA Corporation")) and 
  not (process.code_signature.subject_name : "Rocscience Inc." and process.code_signature.status == "trusted") and 
  not (event.category == "process" and 
       process.executable : "?:\\Windows\\System32\\vmsp.exe" and 
       process.code_signature.subject_name like "Microsoft*" and process.code_signature.status == "trusted" and 
       process.parent.thread.Ext.call_stack_summary : "ntdll.dll|vmwp.exe|ntdll.dll*") and
  not (event.category == "library" and dll.code_signature.status == "trusted" and not dll.code_signature.subject_name like "Microsoft*") and
  not (process.executable : "?:\\Windows\\System32\\WUDFCompanionHost.exe" and process.parent.executable : "?:\\Windows\\System32\\services.exe") and
  not process.executable : 
               ("?:\\Program Files\\Oracle\\VirtualBox\\VirtualBoxVM.exe",
                "?:\\Program Files (x86)\\Oracle\\VirtualBox\\VirtualBoxVM.exe",
                "?:\\Program Files\\Oracle\\VirtualBox\\VBoxNetDHCP.exe",
                "C:\\Program Files\\Oracle\\VirtualBox\\VBoxNetNAT.exe",
                "?:\\Program Files (x86)\\Oracle\\VirtualBox\\VBoxNetDHCP.exe",
                "?:\\Program Files\\Oracle\\VirtualBox\\VBoxHeadless.exe",
                "?:\\Program Files\\TxGameAssistant\\ui\\aow_exe.exe",
                "?:\\Program Files\\Rockstar Games\\Launcher\\Launcher.exe",
                "C:\\Program Files (x86)\\Steam\\steamapps\\common\\*.exe",
                "C:\\Program Files\\EA\\AC\\EAAntiCheat.GameService.dll",
                "F:\\SteamLibrary\\steamapps\\common\\BeamNG.drive\\Bin64\\BeamNG.drive.x64.exe") and
  not (event.category == "process" and process.executable : "C:\\Windows\\System32\\csrss.exe" and
       process.parent.executable : "C:\\Program Files\\GraphOn\\GO-Global\\Programs\\aps.exe") and
  not (process.executable : "C:\\Windows\\System32\\WUDFCompanionHost.exe" and
       process.parent.executable : "C:\\Windows\\System32\\services.exe") and
  not process.parent.executable :
                   ("C:\\Program Files\\Rocscience\\Slide2\\slide.exe",
                    "?:\\Program Files\\Anatomage\\Invivo\\InVivoDental.exe",
                    "?:\\Program Files\\Anatomage\\Invivo\\Invivo.exe",
                    "?:\\Program Files\\Anatomage\\InvivoDental\\InVivoDental.exe",
                    "C:\\Program Files\\Rocscience\\Settle3\\Settle3.exe",
                    "C:\\PC SOFT\\WINDEV Suite 2026\\Programs\\wx64.exe",
                    "C:\\Program Files (x86)\\PC SOFT\\WINDEV Suite 2026\\Programs\\wx64.exe") and
  not process.thread.Ext.call_stack_summary like "ntdll.dll|wow64.dll|wow64cpu.dll*" and
  not process.parent.thread.Ext.call_stack_summary : "ntdll.dll|wow64.dll|wow64cpu.dll|*" and
  not (process.name : "WerFault.exe" and
       process.parent.thread.Ext.call_stack_summary : "ntdll.dll|kernelbase.dll|faultrep.dll|wersvc.dll|ntdll.dll|kernel32.dll|ntdll.dll") and
  not process.hash.sha256 : "920d49c27f0b42dab747bdf48edfc6b668f3ae4d192a2a4c9b5a6cec14bec77f" and
  not (event.category == "process" and _arraysearch(process.parent.thread.Ext.call_stack, $entry, $entry.symbol_info: "*kernel32.dll!CreateProcessW*")) and
  not (event.category == "library" and dll.path : "C:\\Windows\\System32\\umppc*.dll") and
  not (event.category == "library" and dll.code_signature.subject_name == "Microsoft Windows Hardware Compatibility Publisher" and
       dll.code_signature.trusted == true) and
  not (event.category == "library" and process.code_signature.subject_name == "BeamNG GmbH" and process.code_signature.trusted == true)
'''

min_endpoint_version = "8.7.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.7.0"