Elastic rules: 2m

[metadata]
creation_date = "2020/05/21"
integration = ["okta"]
maturity = "production"
updated_date = "2026/04/10"

[rule]
author = ["Elastic"]
description = """
Detects attempts to deactivate a rule within an Okta policy. An adversary may attempt to deactivate a rule within an
Okta policy in order to remove or weaken an organization's security controls.
"""
false_positives = [
    """
    Consider adding exceptions to this rule to filter false positives if Okta MFA rules are regularly deactivated in
    your organization.
    """,
]
index = ["filebeat-*", "logs-okta*"]
language = "kuery"
license = "Elastic License v2"
name = "Attempt to Deactivate an Okta Policy Rule"
note = """## Triage and analysis

### Investigating Attempt to Deactivate an Okta Policy Rule

Identity and Access Management (IAM) systems like Okta serve as the first line of defense for an organization's network, and are often targeted by adversaries. By disabling security rules, adversaries can circumvent multi-factor authentication, access controls, or other protective measures enforced by these policies, enabling unauthorized access, privilege escalation, or other malicious activities.

This rule detects attempts to deactivate a rule within an Okta policy, which could be indicative of an adversary's attempt to weaken an organization's security controls. A threat actor may do this to remove barriers to their activities or enable future attacks.

#### Possible investigation steps:

- Identify the actor related to the alert by reviewing `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, or `okta.actor.display_name` fields in the alert.
- Review the `okta.client.user_agent.raw_user_agent` field to understand the device and software used by the actor.
- Examine the `okta.outcome.reason` field for additional context around the deactivation attempt.
- Check the `okta.outcome.result` field to confirm the policy rule deactivation attempt.
- Check if there are multiple policy rule deactivation attempts from the same actor or IP address (`okta.client.ip`).
- Check for successful logins immediately following the policy rule deactivation attempt.
- Verify whether the actor's activity aligns with typical behavior or if any unusual activity took place around the time of the deactivation attempt.

### False positive analysis:

- Check if there were issues with the Okta system at the time of the deactivation attempt. This could indicate a system error rather than a genuine threat activity.
- Check the geographical location (`okta.request.ip_chain.geographical_context`) and time of the deactivation attempt. If these match the actor's normal behavior, it might be a false positive.
- Verify the actor's administrative rights to ensure they are correctly configured.

### Response and remediation:

- If unauthorized policy rule deactivation is confirmed, initiate the incident response process.
- Immediately lock the affected actor account and require a password change.
- Consider resetting MFA tokens for the actor and require re-enrollment.
- Check if the compromised account was used to access or alter any sensitive data or systems.
- If a specific deactivation technique was used, ensure your systems are patched or configured to prevent such techniques.
- Assess the criticality of affected services and servers.
- Work with your IT team to minimize the impact on users and maintain business continuity.
- If multiple accounts are affected, consider a broader reset or audit of MFA tokens.
- Implement security best practices [outlined](https://www.okta.com/blog/2019/10/9-admin-best-practices-to-keep-your-org-secure/) by Okta.
- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).

## Setup

The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
references = [
    "https://help.okta.com/en/prod/Content/Topics/Security/Security_Policies.htm",
    "https://developer.okta.com/docs/reference/api/system-log/",
    "https://developer.okta.com/docs/reference/api/event-types/",
    "https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy",
    "https://www.elastic.co/security-labs/monitoring-okta-threats-with-elastic-security",
    "https://www.elastic.co/security-labs/starter-guide-to-understanding-okta",
]
risk_score = 47
rule_id = "cc92c835-da92-45c9-9f29-b4992ad621a0"
severity = "medium"
tags = [
    "Use Case: Identity and Access Audit",
    "Tactic: Defense Evasion",
    "Data Source: Okta",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset:okta.system and event.action:policy.rule.deactivate
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1556"
name = "Modify Authentication Process"
reference = "https://attack.mitre.org/techniques/T1556/"

[[rule.threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"

[[rule.threat.technique.subtechnique]]
id = "T1562.007"
name = "Disable or Modify Cloud Firewall"
reference = "https://attack.mitre.org/techniques/T1562/007/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[rule]
description = """
Detects the execution of the VScode portable binary with the tunnel command line option indicating an attempt to
establish a remote tunnel session to Github or a remote VScode instance.
"""
id = "13fd98ce-f1c3-423f-9441-45c50eb462c0"
license = "Elastic License v2"
name = "Attempt to establish VScode Remote Tunnel"
os_list = ["macos", "windows"]
reference = ["https://badoption.eu/blog/2023/01/31/code_c2.html"]
version = "1.0.11"

query = '''
process where event.type == "start" and event.action in ("exec", "start") and 
 process.name : ("code", "code.exe") and process.args : "tunnel" and 
 not (process.name : "code-tunnel*.exe" and process.args  : ("status", "--log-to-file"))
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.001"
name = "PowerShell"
reference = "https://attack.mitre.org/techniques/T1059/001/"

[[threat.technique.subtechnique]]
id = "T1059.003"
name = "Windows Command Shell"
reference = "https://attack.mitre.org/techniques/T1059/003/"

[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1102"
name = "Web Service"
reference = "https://attack.mitre.org/techniques/T1102/"
[[threat.technique.subtechnique]]
id = "T1102.002"
name = "Bidirectional Communication"
reference = "https://attack.mitre.org/techniques/T1102/002/"



[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "7.15.0"

[metadata]
creation_date = "2026/03/12"
integration = ["aws"]
maturity = "production"
updated_date = "2026/07/08"

[rule]
author = ["Elastic"]
description = """
Identifies the creation of a new AWS CloudShell environment. CloudShell is a browser-based shell that provides
command-line access to AWS resources directly from the AWS Management Console. The CreateEnvironment API is called when
a user launches CloudShell for the first time or when accessing CloudShell in a new AWS region. Adversaries with console
access may use CloudShell to execute commands, install tools, or interact with AWS services without needing local CLI
credentials. Monitoring environment creation helps detect unauthorized CloudShell usage from compromised console
sessions.
"""
false_positives = [
    """
    Legitimate use of CloudShell by administrators for routine AWS management tasks. Verify whether the user has a
    legitimate need for CloudShell access and correlate with recent console login activity. Environment creation also
    occurs when users access CloudShell in a new AWS region.
    """,
]
from = "now-6m"
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
language = "kuery"
license = "Elastic License v2"
name = "AWS CloudShell Environment Created"
note = """## Triage and analysis

### Investigating AWS CloudShell Environment Created

AWS CloudShell is a browser-based shell environment that provides instant command-line access to AWS resources without requiring local CLI installation or credential configuration. While this is convenient for legitimate administrators, it also provides adversaries with a powerful tool if they gain access to a compromised AWS console session.

This rule detects when a CloudShell environment is created via the `CreateEnvironment` API. This event occurs when a user launches CloudShell for the first time or when accessing CloudShell in a new AWS region (each region maintains a separate environment). 

### Possible investigation steps

- **Identify the actor**
  - Review `aws.cloudtrail.user_identity.arn` or `user.name` to determine which IAM principal created the CloudShell environment.
  - Check `aws.cloudtrail.user_identity.type` to identify whether this is an IAM user or an assumed role session.
  - Verify if this user typically performs command-line or administrative operations.

- **Analyze the source context**
  - Review `source.ip` and `source.geo` fields to verify the request origin matches expected administrator locations.
  - Check `user_agent.original` to confirm the request came from a browser session.
  - Look for the preceding `ConsoleLogin` event to understand how the session was established.

- **Correlate with surrounding activity**
  - Look for any IAM operations (CreateAccessKey, CreateUser, AttachRolePolicy) that occurred after CloudShell was accessed.
  - Check for data exfiltration patterns or reconnaissance activity from the same session.

- **Assess the broader context**
  - Determine if this user has a legitimate need for CloudShell access based on their role.
  - Review recent access patterns for the console session that initiated CloudShell.
  - Check if MFA was used for the console login.

### False positive analysis

- Administrators routinely using CloudShell for AWS management tasks will trigger this rule. Consider tuning for known admin users if noise is a concern.
- Users accessing CloudShell in a new AWS region will generate a `CreateEnvironment` event even if they have used CloudShell before in other regions.
- Training or certification activities may involve CloudShell environment creation.

### Response and remediation

- If unauthorized, immediately terminate the console session to revoke CloudShell access.
- Review and revoke any credentials or resources created during the CloudShell session.
- Consider restricting CloudShell access via SCPs or IAM policies for sensitive accounts or users who do not require it.
- Implement session duration limits to reduce the window of opportunity for console session abuse.
- Enable MFA for all console logins to reduce the risk of session compromise.

### Additional information

- **[AWS IR Playbooks](https://github.com/aws-samples/aws-incident-response-playbooks/)**
- **[AWS Customer Playbook Framework](https://github.com/aws-samples/aws-customer-playbook-framework/tree/a8c7b313636b406a375952ac00b2d68e89a991f2/docs)** 
"""
references = [
    "https://aws-samples.github.io/threat-technique-catalog-for-aws/Techniques/T1059.009.html",
    "https://permiso.io/blog/lucr-3-scattered-spider-getting-saas-y-in-the-cloud",
]
risk_score = 73
rule_id = "b625c9ad-16e5-4f16-8d38-3e9631952554"
severity = "high"
tags = [
    "Domain: Cloud",
    "Data Source: AWS",
    "Data Source: Amazon Web Services",
    "Data Source: AWS CloudTrail",
    "Data Source: AWS CloudShell",
    "Use Case: Threat Detection",
    "Tactic: Execution",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset: "aws.cloudtrail"
    and event.provider: "cloudshell.amazonaws.com"
    and event.action: "CreateEnvironment"
    and event.outcome: "success"
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"

[[rule.threat.technique.subtechnique]]
id = "T1059.009"
name = "Cloud API"
reference = "https://attack.mitre.org/techniques/T1059/009/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"

[[rule.threat.technique.subtechnique]]
id = "T1078.004"
name = "Cloud Accounts"
reference = "https://attack.mitre.org/techniques/T1078/004/"

[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user_agent.original",
    "source.ip",
    "aws.cloudtrail.user_identity.arn",
    "aws.cloudtrail.user_identity.type",
    "aws.cloudtrail.user_identity.access_key_id",
    "event.action",
    "event.outcome",
    "cloud.account.id",
    "cloud.region",
    "aws.cloudtrail.request_parameters",
    "aws.cloudtrail.response_elements",
]

[metadata]
creation_date = "2026/02/05"
integration = ["aws"]
maturity = "production"
updated_date = "2026/04/10"

[rule]
author = ["Elastic"]
description = """
Detects when EC2 Serial Console Access is enabled for an AWS account. The EC2 Serial Console provides direct, text-based
access to an instance's serial port, bypassing the network layer entirely. While useful for troubleshooting boot issues
or network misconfigurations, enabling serial console access in production environments is rare and potentially
dangerous. Adversaries may enable this feature to establish an out-of-band communication channel that evades
network-based security monitoring, firewalls, and VPC controls. This access method can be used for persistent backdoor
access or to interact with compromised instances without triggering network-based detection mechanisms.
"""
false_positives = [
    """
    Administrators may legitimately enable serial console access during troubleshooting of instances with boot issues,
    network misconfigurations, or SSH access problems. Verify whether the user identity, user agent, and/or source IP
    should be making changes in your environment. Serial console access enablement by unfamiliar users or from
    unexpected locations should be investigated. If this is expected behavior for troubleshooting, it can be exempted
    from the rule, but ensure serial console access is disabled after troubleshooting is complete.
    """,
]
from = "now-6m"
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
language = "kuery"
license = "Elastic License v2"
name = "AWS EC2 Serial Console Access Enabled"
note = """## Triage and analysis

### Investigating AWS EC2 Serial Console Access Enabled

The EC2 Serial Console provides a direct connection to an instance's serial port, allowing access even when network connectivity is unavailable. This feature operates completely outside the network layer, meaning traffic does not traverse VPCs, security groups, NACLs, or any network-based monitoring tools. Enabling serial console access at the account level is a prerequisite for using this feature on individual instances.

This rule detects successful `EnableSerialConsoleAccess` API calls, which may indicate an adversary attempting to establish an out-of-band access channel. In most production environments, serial console access should remain disabled unless actively troubleshooting specific issues.

### Possible investigation steps

- **Identify the actor**
  - Review `aws.cloudtrail.user_identity.arn` and `aws.cloudtrail.user_identity.type` to determine who enabled serial console access.
  - Verify whether this principal has a legitimate need for troubleshooting access.

- **Review request context**
  - Check `source.ip`, `source.geo`, and `user_agent.original` for anomalous access patterns.
  - Determine whether this action occurred during normal business hours or maintenance windows.

- **Check for follow-on activity**
  - Search for `SendSerialConsoleSSHPublicKey` API calls, which indicate actual usage of the serial console.
  - Review whether any EC2 instances show serial console sessions after this enablement.

- **Correlate with other suspicious activity**
  - Look for preceding credential theft indicators (e.g., `GetSecretValue`, `CreateAccessKey`).
  - Check for other defense evasion actions such as GuardDuty modifications, CloudTrail changes, or security group modifications.

- **Verify business justification**
  - Confirm with the identified user or team whether there was a legitimate troubleshooting need.
  - Check for related incident tickets or change requests.

### False positive analysis

- **Legitimate troubleshooting**
  - Serial console may be enabled temporarily to troubleshoot instances with SSH access issues or boot failures.
  - Verify this corresponds to known incidents and ensure it was disabled afterward.

- **Automated infrastructure provisioning**
  - Some IaC tools may enable serial console access during instance setup. Validate against CI/CD logs.

### Response and remediation

- **Immediate containment**
  - If unauthorized, immediately disable serial console access using `DisableSerialConsoleAccess`.
  - Review any instances that may have been accessed via serial console.

- **Investigation**
  - Audit CloudTrail for all serial console-related API calls (`EnableSerialConsoleAccess`, `DisableSerialConsoleAccess`, `SendSerialConsoleSSHPublicKey`, `GetSerialConsoleAccessStatus`).
  - Check for any data exfiltration or lateral movement that occurred during the enabled period.

- **Hardening**
  - Restrict `ec2:EnableSerialConsoleAccess` permissions to a limited set of administrative roles.
  - Implement AWS Config rules or Security Hub controls to alert on serial console access state changes.
  - Consider using SCPs to prevent serial console enablement in production accounts.

### Additional information
- **[AWS Documentation: EC2 Serial Console](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-serial-console.html)**
- **[AWS IR Playbooks](https://github.com/aws-samples/aws-incident-response-playbooks/blob/c151b0dc091755fffd4d662a8f29e2f6794da52c/playbooks/)**
- **[AWS Customer Playbook Framework](https://github.com/aws-samples/aws-customer-playbook-framework/tree/a8c7b313636b406a375952ac00b2d68e89a991f2/docs)**
"""
references = [
    "https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_EnableSerialConsoleAccess.html",
    "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-serial-console.html",
    "https://permiso.io/blog/lucr-3-scattered-spider-getting-saas-y-in-the-cloud",
]
risk_score = 73
rule_id = "e9fe3645-f588-43d6-99f5-437b3ef56f25"
severity = "high"
tags = [
    "Domain: Cloud",
    "Data Source: AWS",
    "Data Source: Amazon Web Services",
    "Data Source: AWS EC2",
    "Tactic: Defense Evasion",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset: "aws.cloudtrail"
    and event.provider: "ec2.amazonaws.com"
    and event.action: "EnableSerialConsoleAccess"
    and event.outcome: "success"
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"

[[rule.threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"

[[rule.threat.technique]]
id = "T1578"
name = "Modify Cloud Compute Infrastructure"
reference = "https://attack.mitre.org/techniques/T1578/"

[[rule.threat.technique.subtechnique]]
id = "T1578.005"
name = "Modify Cloud Compute Configurations"
reference = "https://attack.mitre.org/techniques/T1578/005/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user_agent.original",
    "source.ip",
    "aws.cloudtrail.user_identity.arn",
    "aws.cloudtrail.user_identity.type",
    "aws.cloudtrail.user_identity.access_key_id",
    "event.action",
    "event.outcome",
    "cloud.account.id",
    "cloud.region",
    "aws.cloudtrail.response_elements",
]

[metadata]
creation_date = "2026/07/09"
integration = ["azure"]
maturity = "production"
updated_date = "2026/07/09"

[rule]
author = ["Elastic"]
description = """
Detects a single Kubernetes identity in AKS (Azure Kubernetes Service) that is denied (HTTP 403 Forbidden) across
multiple distinct API resource types within a short window. Broad authorization failures spanning many resources are a
strong signal of API enumeration (reconnaissance with a stolen service account token), as an actor
probes what its credentials can reach before privilege escalation. Detection is based on the breadth of denied resources
rather than the raw failure count, so single-resource controller retry loops do not trigger it.
"""
false_positives = [
    """
    A workload or observability agent with partial RBAC can be denied across several resource types and resemble
    enumeration (for example a monitoring agent that watches resources it lacks permission for). Baseline such
    identities and raise the cardinality threshold, or exclude the specific validated service account, after review.
    Single-resource retry loops (one resource denied repeatedly) do not trigger this rule because detection is based on
    the number of distinct resources denied, not the raw failure count.
    """,
]
from = "now-9m"
index = ["logs-azure.platformlogs-*"]
interval = "5m"
language = "kuery"
license = "Elastic License v2"
name = "Azure AKS Potential API Enumeration by User"
note = """## Triage and analysis

### Investigating Azure AKS Potential API Enumeration by User

AKS kube-audit events are carried under the flattened `azure.platformlogs.properties.log.*` subtree and share the ARM
operation `event.action: Microsoft.ContainerService/managedClusters/diagnosticLogs/Read`. This rule groups forbidden
(HTTP 403) Kubernetes API calls by `azure.platformlogs.properties.log.user.username` and alerts when one identity is
denied across several distinct `objectRef.resource` types within the interval. Breadth of denied resources (rather than
raw failure volume) is the signal: an identity probing many resource types it cannot reach is characteristic of API
enumeration with a stolen service account token, whereas a controller stuck retrying one forbidden resource stays on a
single resource and does not trigger.

### Possible investigation steps

- Enumerate the distinct `azure.platformlogs.properties.log.objectRef.resource` and
  `azure.platformlogs.properties.log.verb` values denied for the identity, and read the human-readable denial in
  `azure.platformlogs.properties.log.responseStatus.message` (for example "secrets is forbidden: User ... cannot list
  resource"), to see what the actor was mapping out.
- Identify the acting identity in `azure.platformlogs.properties.log.user.username` and its groups in
  `azure.platformlogs.properties.log.user.groups`. Service account tokens (`system:serviceaccount:<ns>:<sa>`) probing
  broadly are the primary concern; confirm whether that identity should be issuing these calls at all.
- Inspect `azure.platformlogs.properties.log.userAgent` to distinguish interactive tooling (`kubectl`) or a known
  controller from custom recon tooling (for example `kubectl-recon`, `curl`, or other enumeration clients).
- Validate the source in `azure.platformlogs.properties.log.sourceIPs`. In-cluster agents use loopback
  (`127.0.0.1`/`::1`) or pod-network addresses (e.g. `10.244.0.0/16`); an external caller wielding a service account
  token is more suspicious.
- Hunt for later successful calls (`responseStatus.code:2xx`) from the same identity or source that indicate the actor
  found a permitted action or escalated, and correlate with recent Entra ID sign-ins or role assignments.

### False positive analysis

- A workload or observability agent with partial RBAC can be denied across several resource types and resemble
  enumeration. Baseline such identities, raise the cardinality threshold, or exclude the specific validated service
  account after review.
- Single-resource retry loops (one resource denied repeatedly, such as a controller watching a resource it lacks
  permission for) do not trigger this rule, since detection is based on the count of distinct resources denied.

### Response and remediation

- If unauthorized, revoke the identity's tokens and kubeconfig and review the RBAC bindings assigned to it.
- Determine whether any request from the identity succeeded and scope the impact accordingly.
- Collect kube-audit and identity artifacts per incident response procedures.
"""
references = [
    "https://learn.microsoft.com/en-us/azure/aks/monitor-aks",
    "https://microsoft.github.io/Threat-Matrix-for-Kubernetes/",
    "https://github.com/inguardians/peirates",
]
risk_score = 47
rule_id = "13a3cc0e-1f69-4cc9-8f2f-892d7c7032dc"
setup = """
The Azure Fleet integration collecting AKS diagnostic logs forwarded through Event Hub into the `azure.platformlogs`
data stream is required for this rule. The `kube-audit` log category is required specifically: authorization denials
during enumeration are predominantly get/list/watch (read) operations, which the `kube-audit-admin` category excludes.
A cluster that ships only `kube-audit-admin` is effectively blind to this rule, since only write-verb denials remain
visible.
"""
severity = "medium"
tags = [
    "Domain: Cloud",
    "Domain: Kubernetes",
    "Data Source: Azure",
    "Data Source: Azure Platform Logs",
    "Data Source: Kubernetes",
    "Use Case: Threat Detection",
    "Tactic: Discovery",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "threshold"

query = '''
data_stream.dataset:azure.platformlogs and
  event.action:"Microsoft.ContainerService/managedClusters/diagnosticLogs/Read" and
  azure.platformlogs.category:"kube-audit" and
  azure.platformlogs.properties.log.stage:"ResponseComplete" and
  azure.platformlogs.properties.log.responseStatus.code:"403" and
  azure.platformlogs.properties.log.responseStatus.reason:"Forbidden" and
  not azure.platformlogs.properties.log.user.username:(
    system\:node\:* or "aksService" or "hcpService" or "readinessChecker" or
    system\:serviceaccount\:kube-system\:*
  )
'''

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "event.action",
    "azure.platformlogs.category",
    "azure.platformlogs.properties.log.verb",
    "azure.platformlogs.properties.log.user.username",
    "azure.platformlogs.properties.log.user.groups",
    "azure.platformlogs.properties.log.userAgent",
    "azure.platformlogs.properties.log.sourceIPs",
    "azure.platformlogs.properties.log.objectRef.resource",
    "azure.platformlogs.properties.log.objectRef.namespace",
    "azure.platformlogs.properties.log.requestURI",
    "azure.platformlogs.properties.log.responseStatus.code",
    "azure.platformlogs.properties.log.responseStatus.reason",
    "azure.platformlogs.properties.log.responseStatus.message",
]

[rule.threshold]
field = [
  "azure.resource.id",
  "azure.platformlogs.properties.log.user.username"
]
value = 1

[[rule.threshold.cardinality]]
field = "azure.platformlogs.properties.log.objectRef.resource"
value = 4

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1613"
name = "Container and Resource Discovery"
reference = "https://attack.mitre.org/techniques/T1613/"

[rule.threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"

[metadata]
creation_date = "2021/07/15"
integration = ["o365"]
maturity = "production"
updated_date = "2026/04/10"

[rule]
author = ["Austin Songer"]
description = """
Identifies when a user has been restricted from sending email due to exceeding sending limits of the service policies
per the Security Compliance Center.
"""
false_positives = ["A user sending emails using personal distribution folders may trigger the event."]
from = "now-9m"
index = ["logs-o365.audit-*", "filebeat-*"]
language = "kuery"
license = "Elastic License v2"
name = "Deprecated - M365 Security Compliance User Restricted from Sending Email"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Deprecated - M365 Security Compliance User Restricted from Sending Email

Microsoft 365 enforces email sending limits to prevent abuse and ensure service integrity. Adversaries may exploit compromised accounts to send spam or phishing emails, triggering these limits. The detection rule monitors audit logs for successful restrictions by the Security Compliance Center, indicating potential misuse of valid accounts, aligning with MITRE ATT&CK's Initial Access tactic.

### Possible investigation steps

- Review the audit logs in Microsoft 365 to confirm the event details, focusing on entries with event.dataset:o365.audit and event.provider:SecurityComplianceCenter to ensure the restriction was logged correctly.
- Identify the user account that was restricted by examining the event.action:"User restricted from sending email" and event.outcome:success fields to understand which account triggered the alert.
- Investigate the recent email activity of the restricted user account to determine if there was any unusual or suspicious behavior, such as a high volume of outbound emails or patterns consistent with spam or phishing.
- Check for any recent changes in account permissions or configurations that might indicate unauthorized access or compromise, aligning with the MITRE ATT&CK technique T1078 for Valid Accounts.
- Assess whether there are any other related alerts or incidents involving the same user or similar patterns, which could indicate a broader security issue or coordinated attack.

### False positive analysis

- High-volume legitimate email campaigns by marketing or communication teams can trigger sending limits. Coordinate with these teams to understand their schedules and create exceptions for known campaigns.
- Automated systems or applications using Microsoft 365 accounts for sending notifications or alerts may exceed limits. Identify these accounts and consider using service accounts with appropriate permissions and limits.
- Users with delegated access to multiple mailboxes might inadvertently trigger restrictions. Review and adjust permissions or create exceptions for these users if their activity is verified as legitimate.
- Temporary spikes in email activity due to business needs, such as end-of-quarter communications, can cause false positives. Monitor these periods and adjust thresholds or create temporary exceptions as needed.
- Misconfigured email clients or scripts that repeatedly attempt to send emails can appear as suspicious activity. Ensure proper configuration and monitor for any unusual patterns that may need exceptions.

### Response and remediation

- Immediately disable the compromised user account to prevent further unauthorized email activity and potential spread of phishing or spam.
- Conduct a password reset for the affected account and enforce multi-factor authentication (MFA) to enhance security and prevent future unauthorized access.
- Review the audit logs for any additional suspicious activities associated with the compromised account, such as unusual login locations or times, and investigate any anomalies.
- Notify the affected user and relevant stakeholders about the incident, providing guidance on recognizing phishing attempts and securing their accounts.
- Escalate the incident to the security operations team for further analysis and to determine if other accounts or systems have been compromised.
- Implement additional email filtering rules to block similar phishing or spam patterns identified in the incident to prevent recurrence.
- Update and enhance detection rules and monitoring to quickly identify and respond to similar threats in the future, leveraging insights from the current incident.

## Setup

The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
"""
references = [
    "https://docs.microsoft.com/en-us/cloud-app-security/anomaly-detection-policy",
    "https://docs.microsoft.com/en-us/cloud-app-security/policy-template-reference",
]
risk_score = 47
rule_id = "0136b315-b566-482f-866c-1d8e2477ba16"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Data Source: Microsoft 365",
    "Use Case: Configuration Audit",
    "Tactic: Impact",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset:o365.audit and event.provider:SecurityComplianceCenter and event.category:web and event.action:"User restricted from sending email" and event.outcome:success
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[rule.threat.tactic]
id = "TA0040"
name = "Impact"
reference = "https://attack.mitre.org/tactics/TA0040/"

[metadata]
creation_date = "2025/04/25"
integration = ["endpoint"]
maturity = "production"
updated_date = "2026/03/24"

[rule]
author = ["Elastic"]
description = """
This rule detects the creation of files named release_agent or notify_on_release, which are
commonly associated with the abuse of Linux cgroup release mechanisms. In Docker or containerized
environments, this behavior may indicate an attempt to exploit privilege escalation vulnerabilities
such as CVE-2022-0492, where attackers use the release_agent feature to execute code on the host
from within a container.
"""
from = "now-9m"
index = ["logs-endpoint.events.file*"]
language = "eql"
license = "Elastic License v2"
name = "Docker Release File Creation"
note = """ ## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Docker Release File Creation

In Linux, cgroups manage resources for processes, and the release_agent file can execute scripts when a cgroup is released. In containerized environments like Docker, adversaries may exploit this to escalate privileges, executing code on the host. The detection rule identifies the creation of files like release_agent, signaling potential misuse of cgroup release mechanisms for privilege escalation.

### Possible investigation steps

- Review the alert details to confirm the file creation event occurred on a Linux host, as specified by the query field host.os.type == "linux".
- Identify the specific file name created, either release_agent or notify_on_release, to understand the potential method of exploitation.
- Investigate the process that created the file by examining process logs or using process monitoring tools to determine if it was initiated by a legitimate application or a suspicious process.
- Check for any recent container activity on the host, such as new container deployments or changes, to identify potential sources of the file creation.
- Analyze user activity logs to determine if any unauthorized or unusual user actions correlate with the file creation event.
- Look for any additional indicators of compromise or related alerts on the host that might suggest a broader attack or exploitation attempt.
- Assess the system for any signs of privilege escalation or unauthorized access to determine if the release_agent or notify_on_release file creation was part of a successful attack.

### False positive analysis

- System administrators or automated scripts may create release_agent or notify_on_release files for legitimate resource management tasks in containerized environments.
- Regularly scheduled maintenance scripts might trigger the rule if they involve creating or modifying cgroup release files as part of their operations.
- Developers testing container features might inadvertently create these files during the development process.
- To handle these false positives, users can create exceptions for known scripts or processes that routinely create these files by whitelisting their specific paths or process names.
- Implement monitoring to differentiate between expected and unexpected file creation events, focusing on unusual patterns or contexts that deviate from normal operations.

### Response and remediation

- Immediately isolate the affected container to prevent further exploitation or lateral movement. This can be done by stopping the container or disconnecting it from the network.
- Investigate the container's logs and processes to identify any unauthorized or suspicious activity that may have occurred as a result of the release_agent or notify_on_release file creation.
- Remove any unauthorized files or scripts that were executed as a result of the cgroup release mechanism exploitation. Ensure that the release_agent and notify_on_release files are deleted if they were created maliciously.
- Patch the host system and all containers to address known vulnerabilities such as CVE-2022-0492. Ensure that all security updates are applied to prevent similar exploits.
- Review and tighten the security configurations of Docker and the host system, including setting appropriate cgroup permissions and limiting container capabilities to the minimum necessary.
- Monitor for any further attempts to exploit cgroup release mechanisms by setting up alerts for the creation of release_agent and notify_on_release files.
- Escalate the incident to the security operations team for further analysis and to determine if additional systems may have been affected or if there is a broader security incident underway.
"""
references = ["https://sysdig.com/blog/detecting-mitigating-cve-2022-0492-sysdig/"]
risk_score = 21
rule_id = "4d4cda2b-9aad-4702-a0a2-75952bd6a77c"
severity = "low"
tags = [
    "Domain: Endpoint",
    "Domain: Container",
    "OS: Linux",
    "Use Case: Threat Detection",
    "Tactic: Privilege Escalation",
    "Data Source: Elastic Defend",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"
query = '''
file where host.os.type == "linux" and event.type == "creation" and file.name in ("release_agent", "notify_on_release") and
not process.executable in ("/usr/bin/podman", "/sbin/sos", "/sbin/sosreport", "/usr/bin/git")
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1546"
name = "Event Triggered Execution"
reference = "https://attack.mitre.org/techniques/T1546/"

[[rule.threat.technique]]
id = "T1611"
name = "Escape to Host"
reference = "https://attack.mitre.org/techniques/T1611/"

[rule.threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1546"
name = "Event Triggered Execution"
reference = "https://attack.mitre.org/techniques/T1546/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[metadata]
creation_date = "2020/09/21"
integration = ["gcp"]
maturity = "production"
updated_date = "2026/04/10"

[rule]
author = ["Elastic"]
description = """
Identifies a Logging bucket deletion in Google Cloud Platform (GCP). Log buckets are containers that store and organize
log data. A deleted bucket stays in a pending state for 7 days, and Logging continues to route logs to the bucket during
that time. To stop routing logs to a deleted bucket, you can delete the log sinks that have the bucket as their
destination, or modify the filter for the sinks to stop it from routing logs to the deleted bucket. An adversary may
delete a log bucket to evade detection.
"""
false_positives = [
    """
    Logging bucket deletions may be done by a system or network administrator. Verify whether the user email, resource
    name, and/or hostname should be making changes in your environment. Logging bucket deletions by unfamiliar users or
    hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
    """,
]
index = ["filebeat-*", "logs-gcp*"]
language = "kuery"
license = "Elastic License v2"
name = "GCP Logging Bucket Deletion"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating GCP Logging Bucket Deletion

In GCP, log buckets are essential for storing and organizing log data, crucial for monitoring and auditing activities. Adversaries may delete these buckets to obscure their tracks and evade detection. The detection rule identifies successful deletion events by monitoring specific audit logs, focusing on actions that indicate bucket removal. This helps security analysts quickly spot and respond to potential defense evasion tactics.

### Possible investigation steps

- Review the audit logs for the specific event.action: google.logging.v*.ConfigServiceV*.DeleteBucket to confirm the deletion event and gather details such as the timestamp, user identity, and source IP address.
- Investigate the user account associated with the event to determine if the action was authorized or if there are any signs of compromise, such as unusual login locations or times.
- Check for any recent changes to log sinks that might indicate an attempt to stop log routing to the deleted bucket, which could suggest intentional evasion.
- Assess the impact of the bucket deletion by identifying which logs were being routed to the bucket and determining if any critical log data might be lost or compromised.
- Look for any correlated events or alerts around the same timeframe that might indicate a broader attack or unauthorized activity within the GCP environment.

### False positive analysis

- Routine maintenance activities by administrators may trigger bucket deletion events. To manage this, create exceptions for known maintenance periods or specific user accounts responsible for these tasks.
- Automated scripts or tools used for log management might delete buckets as part of their normal operation. Identify these scripts and exclude their actions from triggering alerts by filtering based on their service accounts or specific identifiers.
- Testing environments often involve the creation and deletion of resources, including log buckets. Exclude events from these environments by using labels or project identifiers to differentiate them from production environments.
- Scheduled cleanup jobs that remove old or unused buckets can generate false positives. Document these jobs and adjust the detection rule to ignore deletions occurring within their scheduled time frames.
- Misconfigured log sinks that inadvertently delete buckets should be reviewed. Regularly audit and adjust sink configurations to ensure they align with intended log routing and retention policies.

### Response and remediation

- Immediately halt any ongoing log routing to the deleted bucket by deleting or modifying the log sinks associated with it to prevent further data loss.
- Restore the deleted log bucket from its pending deletion state within the 7-day window to recover any logs that may still be routed to it.
- Conduct a thorough review of IAM permissions and roles to ensure that only authorized personnel have the ability to delete log buckets, reducing the risk of unauthorized deletions.
- Implement additional logging and monitoring for any changes to log sinks and bucket configurations to detect and respond to similar activities promptly.
- Escalate the incident to the security operations team for further investigation and to determine if the deletion was part of a broader attack strategy.
- Review and update incident response plans to include specific procedures for handling log bucket deletions and similar defense evasion tactics.
- Consider enabling alerts for any future attempts to delete log buckets, ensuring rapid detection and response to potential threats.

## Setup

The GCP Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
references = ["https://cloud.google.com/logging/docs/buckets", "https://cloud.google.com/logging/docs/storage"]
risk_score = 47
rule_id = "5663b693-0dea-4f2e-8275-f1ae5ff2de8e"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Data Source: GCP",
    "Data Source: Google Cloud Platform",
    "Use Case: Log Auditing",
    "Tactic: Defense Evasion",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset:gcp.audit and event.action:google.logging.v*.ConfigServiceV*.DeleteBucket and event.outcome:success
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"

[[rule.threat.technique.subtechnique]]
id = "T1562.008"
name = "Disable or Modify Cloud Logs"
reference = "https://attack.mitre.org/techniques/T1562/008/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[metadata]
creation_date = "2020/09/18"
integration = ["gcp"]
maturity = "production"
updated_date = "2026/04/10"

[rule]
author = ["Elastic"]
description = """
Identifies the deletion of a topic in Google Cloud Platform (GCP). In GCP, the publisher-subscriber relationship
(Pub/Sub) is an asynchronous messaging service that decouples event-producing and event-processing services. A publisher
application creates and sends messages to a topic. Deleting a topic can interrupt message flow in the Pub/Sub pipeline.
"""
false_positives = [
    """
    Topic deletions may be done by a system or network administrator. Verify whether the user email, resource name,
    and/or hostname should be making changes in your environment. Topic deletions by unfamiliar users or hosts should be
    investigated. If known behavior is causing false positives, it can be exempted from the rule.
    """,
]
index = ["filebeat-*", "logs-gcp*"]
language = "kuery"
license = "Elastic License v2"
name = "GCP Pub/Sub Topic Deletion"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating GCP Pub/Sub Topic Deletion

Google Cloud Platform's Pub/Sub service facilitates asynchronous messaging, allowing applications to communicate by publishing messages to topics. Deleting a topic can disrupt this communication, potentially as a tactic for defense evasion. Adversaries might exploit this by deleting topics to impair defenses or hide their tracks. The detection rule monitors audit logs for successful topic deletions, flagging potential misuse for further investigation.

### Possible investigation steps

- Review the audit logs for the specific event.action: google.pubsub.v*.Publisher.DeleteTopic to identify the exact time and user or service account responsible for the deletion.
- Investigate the event.dataset:gcp.audit logs around the same timeframe to identify any related activities or anomalies that might indicate malicious intent or unauthorized access.
- Check the event.outcome:success to confirm the deletion was completed successfully and correlate it with any reported service disruptions or issues in the affected applications.
- Assess the permissions and roles of the user or service account involved in the deletion to determine if they had legitimate access and reasons for performing this action.
- Contact the user or team responsible for the deletion to verify if the action was intentional and authorized, and gather any additional context or justification for the deletion.
- Review any recent changes in IAM policies or configurations that might have inadvertently allowed unauthorized topic deletions.

### False positive analysis

- Routine maintenance or updates by administrators can lead to legitimate topic deletions. To manage this, create exceptions for known maintenance periods or specific admin accounts.
- Automated scripts or tools that manage Pub/Sub topics might delete topics as part of their normal operation. Identify these scripts and exclude their actions from triggering alerts by using service account identifiers.
- Development and testing environments often involve frequent topic creation and deletion. Exclude these environments from monitoring by filtering based on project IDs or environment tags.
- Scheduled clean-up jobs that remove unused or temporary topics can trigger false positives. Document these jobs and adjust the detection rule to ignore deletions occurring during their execution times.
- Changes in project requirements or architecture might necessitate topic deletions. Ensure that such changes are communicated and documented, allowing for temporary exceptions during the transition period.

### Response and remediation

- Immediately assess the impact of the topic deletion by identifying affected services and applications that rely on the deleted topic for message flow.
- Restore the deleted topic from backup if available, or recreate the topic with the same configuration to resume normal operations.
- Notify relevant stakeholders, including application owners and security teams, about the incident and potential service disruptions.
- Review access logs and permissions to identify unauthorized access or privilege escalation that may have led to the topic deletion.
- Implement stricter access controls and permissions for Pub/Sub topics to prevent unauthorized deletions in the future.
- Escalate the incident to the security operations center (SOC) for further investigation and to determine if the deletion is part of a larger attack pattern.
- Enhance monitoring and alerting for Pub/Sub topic deletions to ensure rapid detection and response to similar incidents in the future.

## Setup

The GCP Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
references = ["https://cloud.google.com/pubsub/docs/overview"]
risk_score = 21
rule_id = "3202e172-01b1-4738-a932-d024c514ba72"
severity = "low"
tags = [
    "Domain: Cloud",
    "Data Source: GCP",
    "Data Source: Google Cloud Platform",
    "Use Case: Log Auditing",
    "Tactic: Defense Evasion",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset:gcp.audit and event.action:google.pubsub.v*.Publisher.DeleteTopic and event.outcome:success
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1489"
name = "Service Stop"
reference = "https://attack.mitre.org/techniques/T1489/"

[rule.threat.tactic]
id = "TA0040"
name = "Impact"
reference = "https://attack.mitre.org/tactics/TA0040/"

[metadata]
creation_date = "2026/06/21"
integration = ["endpoint"]
maturity = "production"
updated_date = "2026/06/21"

[rule]
author = ["Elastic"]
description = """
Identifies a recently dropped or modified javaw.exe process started from a user-writable path to run a JAR or Java
classpath application, followed by a DNS lookup. Adversaries may drop Java payloads into user directories and execute
them immediately to establish command and control while evading application control focused on native Windows
binaries.
"""
from = "now-9m"
index = ["logs-endpoint.events.process-*", "logs-endpoint.events.network-*"]
language = "eql"
license = "Elastic License v2"
name = "Java Dropped and Executed With DNS Lookup"
note = """## Triage and analysis

### Investigating Java Dropped and Executed With DNS Lookup

This rule correlates a recently created or modified `javaw.exe` launch from `Users`, `ProgramData`, or `Windows\\Temp` with an immediate
DNS lookup from the same process. Attackers often drop JAR-based payloads to user-writable locations and invoke them
with `-jar` or `-cp`/`-classpath` to blend in with legitimate Java usage while reaching out to command and control
infrastructure.

#### Possible investigation steps

- Review `process.executable`, `process.command_line`, and `process.args` to identify the JAR or classpath target and
  whether the path is user-writable or unexpected for the host role.
- Inspect `process.Ext.relative_file_creation_time` and `process.Ext.relative_file_name_modify_time` to confirm the
  binary or payload was staged immediately before execution.
- Examine the parent process tree for download, archive extraction, or script activity that may have dropped the JAR
  or `javaw.exe`.
- Pivot on the DNS event for `dns.question.name`, `dns.resolved_ip`, and any follow-on connection attempts from the
  same `process.entity_id`.
- Check code signature details for `javaw.exe` and any referenced JAR files when file telemetry is available.
- Hunt for the same JAR hash, command line, or queried domain on other hosts.

### False positive analysis

- Developer workflows, local Java applications, and enterprise tools may run freshly updated JARs from user profiles or
  `ProgramData`. Validate the JAR path, signer, parent process, and queried domain against known software before
  closing as benign.
- Some installers or updaters drop a private JRE under `ProgramData` and launch JAR utilities during setup. Confirm the
  activity aligns with a known deployment or update window.

### Response and remediation

- Isolate the host if the JAR, domain, or parent activity appears malicious.
- Quarantine the dropped JAR, related Java runtime files, and any staging artifacts identified in the process tree.
- Block malicious domains or IPs at DNS and network enforcement points.
- Reset credentials for accounts active on the host during the suspicious session if follow-on activity is observed."""
risk_score = 47
rule_id = "80d7f4ef-c3b6-4466-80f4-805bdd10507d"
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Execution",
    "Tactic: Command and Control",
    "Data Source: Elastic Defend",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
sequence by process.entity_id with maxspan=1m
 [process where host.os.type == "windows" and event.action == "start" and
  (process.Ext.relative_file_creation_time <= 500 or process.Ext.relative_file_name_modify_time <= 500) and
  (process.name : "javaw.exe" or process.pe.original_file_name == "javaw.exe") and process.executable : ("?:\\Users\\*", "?:\\ProgramData\\*", "?:\\Windows\\Temp\\*") and user.id != "S-1-5-18" and
  (
   (process.args_count == 3 and process.args : "-jar") or
   (process.args_count == 4 and process.args : ("-cp", "-classpath") and process.command_line : " *.* ")
  )]
 [network where host.os.type == "windows" and event.action: "lookup_requested"]
'''


[rule.investigation_fields]
field_names = [
    "@timestamp",
    "host.id",
    "user.id",
    "process.entity_id",
    "process.executable",
    "process.parent.executable"
]

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1204"
name = "User Execution"
reference = "https://attack.mitre.org/techniques/T1204/"

[[rule.threat.technique.subtechnique]]
id = "T1204.002"
name = "Malicious File"
reference = "https://attack.mitre.org/techniques/T1204/002/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1105"
name = "Ingress Tool Transfer"
reference = "https://attack.mitre.org/techniques/T1105/"

[[rule.threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"

[rule.threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[rule]
description = """
Detects the compilation of a binary file in a suspicious directory. Attackers may compile kernel exploits or other
software on the target system, to ensure the architecture of the payload matches the target's architecture. Compilation
to one of these directories can be an indication of malicious activity.
"""
id = "52001df2-a3bf-411d-a09c-5f36a9f976b8"
license = "Elastic License v2"
name = "Linux Compilation in Suspicious Directory"
os_list = ["linux"]
version = "1.0.12"

query = '''
sequence with maxspan=10s
  [process where event.action == "exec" and event.type == "start" and
   process.name like ("*gcc*", "*g++*", "c++", "cc", "c99", "c89", "cc1*", "clang*", "musl-clang", "tcc", "zig", "ccache", "distcc") and
   not process.parent.name in ("go", "cgo")] as event0
  [file where event.action == "creation" and file.path like "/dev/shm/*" and
   process.name like ("ld", "ld.*", "lld", "ld.lld", "mold", "collect2", "*-linux-gnu-ld*", "*-pc-linux-gnu-ld*") and
   stringcontains~(event0.process.command_line, file.name)]
'''

min_endpoint_version = "8.5.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1
tree = true

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
tree = true

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 1
tree = true

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1027"
name = "Obfuscated Files or Information"
reference = "https://attack.mitre.org/techniques/T1027/"
[[threat.technique.subtechnique]]
id = "T1027.004"
name = "Compile After Delivery"
reference = "https://attack.mitre.org/techniques/T1027/004/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.5.0"

[rule]
description = """
Identifies attempts to access the Local Security Authority Subsystem Service (LSASS) running as a Protected Process and
from a non Protected Process. Adversaries may exploit vulnerabilities or leverage vulnerable drivers to bypass LSA
protection.
"""
id = "75483a4a-9ce6-4dcb-9ceb-fe9244ce0d34"
license = "Elastic License v2"
name = "LSASS Memory Read via PPL Bypass"
os_list = ["windows"]
reference = [
    "https://itm4n.github.io/lsass-runasppl/",
    "https://www.elastic.co/security-labs/bits-and-bytes-analyzing-bitsloth",
]
version = "1.0.12"

query = '''
api where process.Ext.api.name == "ReadProcessMemory" and Target.process.name == "lsass.exe" and
 Target.process.Ext.protection == "PsProtectedSignerLsa-Light" and process.executable != null and
  process.pid != 4 and not process.Ext.protection like "PsProtectedSigner*" and
  process.thread.Ext.call_stack_final_user_module.hash.sha256 != null and
  not process.thread.Ext.call_stack_final_user_module.name in ("Unknown", "Undetermined") and
  not (process.executable : "?:\\Program Files\\Sophos\\Sophos File Scanner\\SophosFileScanner.exe" and
       process.code_signature.subject_name : "Sophos Ltd" and process.code_signature.trusted == true and 
       (process.thread.Ext.call_stack_final_user_module.path : "?:\\program files\\sophos\\sophos standalone engine\\*\\savi.dll" or
        process.thread.Ext.call_stack_final_user_module.name : ("Unknown", "Undetermined"))) and
  not process.thread.Ext.call_stack_final_user_module.hash.sha256 : "7db3c6b0aab47ccd44a2b0600808c94978e20bf10dcb5c5829b2eb1d66631f00" and
  not _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature,
                   $entry, $entry.subject_name : ("Sophos Ltd", "Microsoft Windows Hardware Compatibility Publisher", "Microsoft Windows Software Compatibility Publisher", "Trend Micro, Inc.") and $entry.status : "trusted") and
  not (process.executable : "C:\\Windows\\System32\\WerFault.exe" and
       process.thread.Ext.call_stack_final_user_module.path in ("c:\\windows\\system32\\dbghelp.dll", "c:\\windows\\system32\\faultrep.dll", "c:\\windows\\system32\\wer.dll", "c:\\windows\\system32\\werfault.exe")) and
  not process.thread.Ext.call_stack_final_user_module.path like ("c:\\windows\\assembly\\nativeimages_*.ni.dll") and
  not _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $caller, $caller.status == "trusted") and
  not process.thread.Ext.call_stack_final_user_module.hash.sha256 in
                                          ("7dcaaa094cc504fbb1dbfc9e4c6a0727370c0cb2c7a3ba5d830a6a2f57ccb483",
                                           "1d6a20444b2dfb3719dbdd4fab61c94f3a799c0a91bb7a02ab527cbbae2dfb98",
                                           "ed4d6fdb6248bcff64e5652cd0c9d79c483bace94c1120dc3128645f00a5e5c4", 
                                           "f51b2842cd6263b5dbef652ac578628bf7706ae5e19853262e75dea212bac257")
'''

min_endpoint_version = "8.14.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1211"
name = "Exploitation for Defense Evasion"
reference = "https://attack.mitre.org/techniques/T1211/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1003"
name = "OS Credential Dumping"
reference = "https://attack.mitre.org/techniques/T1003/"
[[threat.technique.subtechnique]]
id = "T1003.001"
name = "LSASS Memory"
reference = "https://attack.mitre.org/techniques/T1003/001/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "8.14.0"

[rule]
description = """
Identifies the creation of process clone via the Windows API RtlCreateProcessReflection followed by network activity.
This may indicate an attempt to create a process as a target for process injection.
"""
id = "80294c8d-0ef5-4708-a6ef-45d30064b149"
license = "Elastic License v2"
name = "Network Activity from a Reflected Process"
os_list = ["windows"]
reference = ["https://www.deepinstinct.com/blog/dirty-vanity-a-new-approach-to-code-injection-edr-bypass"]
version = "1.0.7"

query = '''
sequence by process.entity_id with maxspan=1m
 [process where event.action == "start" and
  _arraysearch(process.parent.thread.Ext.call_stack, $entry, $entry.symbol_info: ("*ntdll.dll!RtlCreateProcessReflection*", "*ntdll.dll!RtlCloneUserProcess*")) and
  not process.hash.sha256 : ("a2f3e8a8486d23662da129cd8c8fa9eb0ac0e2471ade3924aaac5c20d153fabb",
                             "8c78b7a71ac20369a5bcd4fb462aee1d514f10afe87408bed3c2d786dd479b4d")]
 [any where
  (event.category : ("network", "dns") or (event.category == "library" and dll.name : ("ws2_32.dll", "winhttp.dll", "wininet.dll")))]
'''

min_endpoint_version = "8.7.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.7.0"

[rule]
description = """
Identifies the load of a Windows network module by a process where the creating thread's stack contains frames pointing
outside any known executable image. This may indicate evasion via process injection.
"""
id = "aa265fbd-4c57-46ff-9e89-0635101cc50d"
license = "Elastic License v2"
name = "Network Module Loaded from Suspicious Unbacked Memory"
os_list = ["windows"]
reference = [
    "https://www.elastic.co/security-labs/pikabot-i-choose-you",
    "https://www.elastic.co/security-labs/spring-cleaning-with-latrodectus",
    "https://www.elastic.co/security-labs/upping-the-ante-detecting-in-memory-threats-with-kernel-call-stacks",
]
version = "1.0.62"

query = '''
sequence by process.entity_id
 [process where event.action == "start" and process.parent.executable != null and

  not process.Ext.token.integrity_level_name == "low" and

  not user.id in ("S-1-5-19", "S-1-5-20") and

  not (process.executable : ("?:\\Program Files (x86)\\*", "?:\\Program Files\\*", "?:\\ProgramData\\*", "?:\\Users\\*\\AppData\\*") and
       process.code_signature.trusted == true) and
       
  not (process.executable : ("?:\\Program Files (x86)\\*", "?:\\Program Files\\*") and process.Ext.relative_file_creation_time >= 80000) and 
  
  not process.executable : ("?:\\Windows\\Microsoft.NET\\Framework*\\NGenTask.exe", "?:\\Windows\\Microsoft.NET\\Framework*\\ngen.exe") and

  not (process.executable : "?:\\Windows\\Microsoft.NET\\Framework*\\mscorsvw.exe" and
       process.parent.executable : "?:\\Windows\\Microsoft.NET\\Framework*\\ngen.exe") and 

  not (process.executable : "?:\\WINDOWS\\SysWOW64\\DWRCS.EXE" and
       process.parent.executable : "?:\\WINDOWS\\SysWOW64\\DWRCS.EXE" and process.parent.args : "-service") and 

  not (process.executable : "?:\\Windows\\System32\\LogonUI.exe" and 
       process.parent.executable : "?:\\Windows\\System32\\winlogon.exe") and 

  not (process.executable : "?:\\Windows\\SysWOW64\\icacls.exe" and 
       process.args : "?:\\Program Files\\Tenable\\Nessus Agent\\*" and 
       process.parent.executable : "?:\\Windows\\SysWOW64\\msiexec.exe") and 

  not (process.name : "rundll32.exe" and
       process.command_line : "*zzzzInvokeManagedCustomActionOutOfProc*" and
       process.parent.executable : "?:\\Windows\\sys*\\msiexec.exe") and

  not (process.name : "rundll32.exe" and process.command_line : "*PcaSvc.dll,PcaPatchSdbTask*" and
       user.id == "S-1-5-18" and process.parent.executable : "?:\\Windows\\System32\\svchost.exe") and

  not (process.code_signature.subject_name :
                    ("Mozilla Corporation", "Commvault Systems, Inc.", "Google LLC", "YANDEX LLC", "ConnectWise, Inc.",
                     "Brave Software, Inc.", "Opera Norway AS", "GitHub, Inc.", "Stefan Ries", "JetBrains s.r.o.",
                     "Intel(R) Rapid Storage Technology", "Waves Inc", "Dell Inc", "Lenovo", "DameWare Development, LLC.",
                     "Essential Objects, Inc*", "HP Inc.", "Aina Maximit Oy", "Logitech Inc", "N-ABLE TECHNOLOGIES LTD", 
                     "Cognizant TriZetto Software Group, Inc.", "win.acme.simple@gmail.com", "Crownalytics, LLC", 
                     "Kodak Alaris Inc.", "JAM Software GmbH", "UBISOFT ENTERTAINMENT INC.", "DASSAULT SYSTEMES SE", 
                     "Link Data Security A/S", "Western Digital Technologies, Inc.", "Rockstar Games, Inc.",
                     "SEMPERIS INC.", "Micro-Star International CO., LTD.", "Kaseya Holdings Inc", "KASEYA US LLC",
                     "Intel(R) Software Development Products", "AAC Infotray AG",
                     "CORE.AI SCIENTIFIC TECHNOLOGIES PRIVATE LIMITED", "ClaimMaster Software LLC", "Cellebrite DI LTD",
                     "Riot Games, Inc.", "Autodesk, Inc.", "ACCA software S.p.A.", "Tempus Technologies, Inc.",
                     "NextgenId, Inc.", "Cloud Software Group, Inc.",
                     "Bloomberg LP", "GEO NETWORK SRL", "Geo Network - S.R.L.",
                     "FARO Technologies Inc", "Axis Communications AB", "EWA Technologies, Inc.") and
       process.code_signature.trusted == true) and

  not (process.pe.original_file_name in~ ("msedge.exe", "msedgewebview2.exe") and
       process.code_signature.subject_name like "Microsoft *" and process.code_signature.trusted == true) and

  not (process.executable : "?:\\Windows\\System32\\Essentials\\SharedServiceHost.exe" and
       process.parent.executable : "?:\\Windows\\System32\\services.exe") and

  not (process.name : "powershell.exe" and
       process.parent.executable : "?:\\Program Files (x86)\\Lenovo\\VantageService\\*\\LenovoVantage-(LenovoSystemUpdateAddin).exe") and
  not process.pe.imphash in ("d41d8cd98f00b204e9800998ecf8427e", "45e4653ae633e067079dd72666b0158b") and
  not process.hash.sha256 in
                   ("35542bc04fbfa2e3ef68837640e0459c6f99729c0c73578c08ab351cdf030696",
                    "1005dcfddfbde91cc967ecc6d778c81cb4f7bede03121a3e6e0d9bae12a033e0",
                    "53cec44e4fc9a3477d264c5edc9e376af8fcca20853faa289387f5bd7eaae05f",
                    "49113f4cd7bbf3343a43b13edd745008c4f41da1d80c9f89dc90a4b0bb39b8f8",
                    "0ab8a14e7fd42818608cc0916fc26a12b2ae6b976c97310dc86011713e455d2d",
                    "afa3dc1ecd4e15a869dc57a280aee930fc0bab1cd49e17afd3944ae4ad1fc91f",
                    "18b177280b0e0e05aa0e26807f34634c3384ae4f5901f41ff5bb0a720ea5c106",
                    "4f1528318085f6117734a27f34a317a83b096d55532000f81ed67b1bb10632fa",
                    "35f210c1f941f917b81c2516bee9de8f0495baca42095685e9b0b76f67250dc9",
                    "edef301528767963f460bf7fe497ca3b5c648627a2d13abe74d5544578b56bd4",
                    "f856a3c582ca689bdea3e784ef6a0db37011bd5ebb31d7c79d0328ebfcf6d8a4",
                    "fe62ba0a61191a9b54aab7ba3221479c451b042fa30a08957cacff84ddfe094b",
                    "183cd12fbdd93aa785d3793a8872c4a9730dd154f6482c39f94552e556a7b4e9",
                    "ed6c844c72fccd7e7799d448f5e74df368cafd2631858573e6e29110c213ac79",
                    "43a84e01b5ddecf0b6297277d53c72025a73b00b9f0073933a700695a240b5e8",
                    "f4cb2a001dcee0577046c56df5adfe989bc875c29ecfe27c9569849a9a6f0671",
                    "ed3730a3436454022e8cf1a27569babef8c9c348ea875f1df80cba9b743365c9",
                    "51346e95656164783ae4de9d6b202f28be87358eb0e056d2d7cdd12b502d30e7",
                    "889cb8827a400984bea2e0561a1efbf9d18044e879974da8baa750a0c63748c6",
                    "96dcdb449ab48b21b6efd33afc59ae163dea5fc597ffaf5dd7030b20d2624467", 
                    "43714f0fc5cea25a6ee936fd36a83f86a45f61447c16c8e9255ef317089ce39c", 
                    "52a5036d1578a6b899fb5d14fd3ab12af463e94ac791d1dddb22b7e8cc1f4bd7", 
                    "f5f15ab19171dbcb58e757cd6446be41e04adf00797d712b07e544066ecd3c67", 
                    "49b95a804337ee7e12092cc7a13c2eb6c3acb33f9bbaac8e820b9184063642f2", 
                    "4c974212f5fc3720d58a8df6c2b9587b85949edc676f9f82921c04f067c261f1", 
                    "ed3730a3436454022e8cf1a27569babef8c9c348ea875f1df80cba9b743365c9",
                    "121a4e78abe13c92a7ff91d2e91bc98173724072cc891ecbbc10765e8d5bd024", 
                    "54e55d6da825d709cf495eb18be10d8cbb92ac1904c1359999d53d3fa42161e2",
                    "07e79814fde31ff5968d5c0448014d931cd3a2e59b2ac841bc53a155c333a1b9",
                    "afcee50eace500b9b2c3dc4faab371fd040d769ba3a5197ef3a8762fe5457337",
                    "e7883c7d57f5cfe7d1649ab138f62f5042f7acda8ed3c8664c9335c3ddba85c4",
                    "8982729121fa3b3e6c283437f5832916a5a3611374ac848368c6edaae5086257",
                    "63f2a4be0dfbaf2b9740aa5c2320d0290451d6d5581cc6f8e183ced9ea796d95",
                    "30534b04d137543932bc0e66fc778d772ca5d90c0b5faec74a842cad8d50ade8",
                    "fc0ea005db332feec00e6c34e36de85469d24074c8af23cea84b72eb0fa7fb85",
                    "cffea8d18419170baded53d75a8d1b8d20170c21ef2d4bebddfb2efcb89a641c",
                    "ca52dce8cc2aecc23138a524683ad608b4a5eaed9a7a10336e4cf6c7b9d6e5e0",
                    "b4aa6923bd807af4433c968aa1ded17a3bf8e36f1053fe24dc31dd5a8eb9f4ce",
                    "4acdfb075f5a801b976819cd22bc3a930ad5f8ee92de2d5ad36b0a4f1e5a8b24",
                    "1c237e9015c81487aa67d56f8aa4788fbb6bfb3039e455485376712cfc978e62",
                    "47585eb41299f97c88028c3dae3ba6049355b8e0a8074abeae9f4f9381832c20",
                    "a26dfec1922d751c710a2f2ab16a33facb6fef8997d21784681f1be637a78b5d",
                    "be92c45eeb7ffb4b3bf62b76b3218a0c4cdcfa52c8ddb5a47b9abc407dda282e") and

  not (process.executable : "?:\\Windows\\SysWOW64\\dllhost.exe" and process.parent.name : "svchost.exe" and
       process.Ext.effective_parent.executable : "?:\\Program Files (x86)\\Skillbrains\\lightshot\\*\\Lightshot.exe") and

  not (process.executable : ("?:\\Windows\\SysWOW64\\DWRCST.EXE", "?:\\Windows\\SysWOW64\\DWRCS.EXE") and
       process.parent.executable : ("?:\\WINDOWS\\SysWOW64\\runonce.exe", "?:\\Windows\\SysWOW64\\DWRCST.EXE", "?:\\Windows\\SysWOW64\\DWRCS.EXE")) and

  not (process.executable : "?:\\Windows\\system32\\winsat.exe" and
       process.parent.executable : "?:\\Windows\\system32\\rundll32.exe" and
       process.parent.args : "sysmain.dll,PfSvWsSwapAssessmentTask") and

  not (process.executable :  "?:\\Windows\\System32\\inetsrv\\w3wp.exe" and
       process.parent.executable : ("?:\\Windows\\System32\\inetsrv\\w3wp.exe", "?:\\Windows\\System32\\svchost.exe")) and

  not (process.name : "rundll32.exe" and process.args : "--no-sandbox" and
        _arraysearch(process.parent.thread.Ext.call_stack, $entry,
                     $entry.symbol_info : "?:\\Windows\\assembly\\NativeImages_*\\EO.Base\\*\\EO.Base.ni.dll*")) and

  not process.parent.executable : ("?:\\Program Files (x86)\\Advanced Monitoring Agent\\featureres\\PMESetup.exe",
                                    "?:\\PROGRA~2\\ADVANC~1\\featureres\\PMESetup.exe",
                                    "?:\\PROGRA~2\\ADVANC~1\\downloads\\NetworkManagementInstall.exe",
                                    "?:\\PROGRA~2\\ADVANC~1\\staging\\_new_setup.exe",
                                    "?:\\PROGRA~2\\ADVANC~1\\downloads\\MAV-Installer.exe",
                                    "?:\\Program Files (x86)\\LiongardInc\\*\\node.exe",
                                    "C:\\WINDOWS\\_ScriptingFramework\\Modul\\Engine.exe",
                                    "C:\\Program Files\\IperiusRemote\\GlantzSupportClient.exe",
                                    "C:\\Program Files (x86)\\ReluxDesktop\\converter\\Raster2Vector.exe",
                                    "C:\\Program Files (x86)\\Assinador Serpro\\uninstall.exe") and
  not (process.executable : "C:\\Windows\\Microsoft.NET\\Framework\\*\\RegAsm.exe" and
       process.args : "C:\\Program Files (x86)\\Common Files\\PortsRanch\\WenuMeta\\Micriuuft_Inroles.dll" and
       process.parent.executable : "C:\\WINDOWS\\system32\\svchost.exe") and

  not process.executable :
                  ("C:\\Program Files (x86)\\MultiExtractor\\MultiExtractor.exe",
                   "C:\\Program Files (x86)\\Naverisk\\Agent\\Packages\\SoftwareScanPackage\\SoftwareScanner\\Naverisk.Agent.SoftwareScanner.exe") and

  not (process.executable : "?:\\APP\\d3\\nats\\NatsCtl.exe" and process.parent.executable : "?:\\APP\\d3\\procmgr\\dserver.exe" and
       process.code_signature.trusted == true and process.code_signature.subject_name : "d.velop AG") and

  not (process.executable : "*\\PeaxactLicenseServerMonitor.exe" and
       process.code_signature.subject_name == "S-PACT GmbH" and
       process.code_signature.trusted == true)
 ]
 [library where
  dll.name in~ ("ws2_32.dll", "wininet.dll", "winhttp.dll") and
  process.thread.Ext.call_stack_contains_unbacked == true and
  (
   process.thread.Ext.call_stack_summary in
                  ("ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked",
                   "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked|kernel32.dll|ntdll.dll",
                   "ntdll.dll|kernelbase.dll|Unbacked",
                   "ntdll.dll|iphlpapi.dll|Unbacked",
                   "ntdll.dll|winhttp.dll|Unbacked",
                   "ntdll.dll|kernelbase.dll|wininet.dll|Unbacked",
                   "ntdll.dll|kernelbase.dll|Unbacked|kernel32.dll|ntdll.dll",
                   "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|Unbacked",
                   "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|wininet.dll|Unbacked|ntdll.dll",
                   "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|Unbacked|kernel32.dll|ntdll.dll",
                   "ntdll.dll|kernelbase.dll|Unbacked|kernelbase.dll|ntdll.dll|kernel32.dll|ntdll.dll") or
  
  startswith~(process.thread.Ext.call_stack_summary, concat(concat("ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked|", process.name), "|kernel32.dll|ntdll.dll"))
  ) and
  /* DynTrace, HP Sure Click Hook Dll */
  not _arraysearch(process.thread.Ext.call_stack, $entry,
                   $entry.callsite_leading_bytes :
                         ("*6764a118008b40243b835b080000753033c089835b0800008d835f080000508d8353000000506a006a00ff936b080000*",
                          "45fc33c08945f88bf28dbd82fcffffb9dc000000f3a566a568008000006a0052ff55b86803800000ff55bc8bf080bd82fcffff0074188d8592fdffff50ff55c4",
                          "*d74533db4c8b4d504c894d284c8d0d0f0000004c894d404c8b4d6041c6410c00ffd0*",
                          "83ec28488b4c2430ff15b40f00004883c428c3cccccccccccccc4c894424188954241048894c24084883ec38837c244801755f488d0d701f0000ff15720f0000",
                          "55c0488d55c0488b4d10e8886dadff488bc8488975b8488b55b0488b5220488b02488bd64533db4c8b45b04c8945804c8d050a0000004c894598c6470c00ffd0", 
                          "488bcd48894da8488d8d78ffffff48894b10488975c0488b4db8488b4920488b01488bcf488bd64c8b45b84c8945884c8d050a0000004c8945a0c6430c00ffd0",
                          "80000000c7858c00000001000000488b4d50488b4920488b01488b8d800000004533db488b555048895528488d150e00000048895540488b5560c6420c00ffd0")) and
  /* Managed Code, Cynet MemScanner, xSecuritas */
  not _arraysearch(process.thread.Ext.call_stack, $entry,
                   $entry.callsite_trailing_bytes :
                         ("*8945b4488bcce82c000000908b45b4488b55a8c6420c01488b55a8488b*",
                          "c6430c01833d*5f007406ff1*",
                          "48898424e80300004883bc24e803000000750eff94247e030000898424f0030000eb30488d8c2430010000ff94248e03000048898424e80300004883bc24e803",
                          "8bd885db751eff55c88945f8eb168d8592fdffff50ff55d08bd885db7506ff55c88945f856ff55bc85db0f847601000080bd82fcffff0074508b45fc05a00000",
                          "488b55a8c6420c01833d8bbeb25f007406ff1593c7b25f8945b4488bcce82c000000908b45b4488b55a8c6420c01488b55a8488b8d70ffffff48894a10488d65",
                          "**45a848894590eb00488b4590488b5588c6420c01488b5588",
                          "*488b5560c6420c01488b5560488b4d2048894a",
                          "c6470c01833d6cf1b45f007406ff15f40cb45f8bf0e8b5e76f5f85f6400f95c6400fb6f64883bdc0000000007423488b8dc0000000e825ebe25e448bc0488b95",
                          "488b5560c6420c01833db339f55f007406ff153b43f55f898584000000488b4d00e845000000908b8584000000488b5560c6420c01488b5560488b4d2048894a",
                          "898383080000c7837f080000010000006a0056ff9397080000ff938b*",
                          "41c64?0c01833d*",
                          "c6430c0148ba*f87f0000833a00740c*",
                          "488b8d70ffffffc6410*",
                          "c6470c01833d*",
                          "a3b8eb*",
                          "a314a2e40585c*",
                          "488b9570ffffffc6420*",
                          "49bb60c0*",
                          "488b8d?0ffffffc6410401833d*",
                          "488b8d?0ffffffc6410401833d*",
                          "488b5590c6420c01833d*",
                          "8bf08b45d8c6400801833d801*45e88945dc8b45dc8b55",
                          "c6470401833de8eee*84883c4785b5e5f415c415d415e415f5dc31910090010e20c300b",
                          "49bb80b681f6fc7f000048*7f0000ba0c0000004c8d4c2450448d423441ffd3*",
                          "488b4d88c6410c01*488945a0488b45a0488945a8909090*",
                          "ebfecc0000*",
                          "*ba0c0000004c8d4c2450448d423441ffd3*",
                          "*ca85c0b8000000000fb6d60f95c0898424f40200000ac22b742458d0d80fb6c0*",
                          "*898424300300008d14922b9c24d0010000f7d28bc3034424600fbbc20facc2183b44240892",
                          "41c6460c0148ba*7f0000833a00740c*",
                          "8be55d558bec83ec08c745f800000000*",
                          "48898424b80000004883bc24b8000000000f848d000000488b442440480510130000488bd0488b8c24b8000000ff94249000000048898424d80000004883bc24", 
                          "898383080000c7837f080000010000006a0056ff9397080000ff938b08000050ff9393080000cc8b1c24c3ce0000087c00960046003a005c00500072006f0067", 
                          "488944242048837c24200075*", 
                          "c6430c01833d*",
                          "c22800ccccff7424248b0d5c93*",
                          "a36c3e*985c00f84f9000000568b35*",
                          "a3b022*985c00f84f9000000568b354c81*",
                          "48898424b80000004883bc24b8000000000f8498000000488b442440480510130000488bd0488b8c24b8000000ff94249000000048898424d80000004883bc24",                          "*0000ba0c0000004c8d4c2450448d423441ffd3*",
                          "41c6470c0148ba*7f0000833a00740c48b9*",
                          "41c6470c0148ba*4c8b6d8849897508498bc5488b9548ffffff498957104881",
                          "c6460c01833db6e5e75f007406ff15eae8e65f488bd8e8aa38b25f488bc3488b4d8048894e104883c4785b5e5f415c415d415e415f5dc367611910090010e20c",
                          "49bb60c05eb7ff7f000048b9*",
                          "488945984885c07507bac4020000eb2d6685db750*",
                          "*488b5588498956104883c4785b5e5f415c415d415e",
                          "c6460c01833d*",
                          "898383080000c7837f080000010000006a0056ff9397080000*",
                          "8be55d558bec83ec08c745f800000000c745fc02000000*",
                          "898383080000c7837f080000010000006a0056ff*",
                          "49bbb014*f0000ba0c0000004c8d4c2450448d423441ffd349bb403*",
                          "*00ba0c0000004c8d4c2450448d423441ffd349bb*",
                          "*48bf7063107ef67f0000488b064889074883c6084883c708488b06488907415f415e415d415c41*",
                          "1bd1a3300a*f9bc00fa3cab8000000000f98c28d14400f95c00fca0fca8984242403*",
                          "84c07507e8b8836effeb498b45f88b55c089108b45e48945f4c70518c*",
                          "488b8d70ffffffc6410c01833df07bca5e007406ff15a47fc95e488b8d70ffffff488b9528ffffff48895110488945b0ff15804ce6fe8945c4488bcce8780000",
                          "498bd7488bcf4c8be8e819bbffff4533ff4d85ed0f84520200004c8b9760020000488d95e0000000440fb74424744533c9498bcd41ffd24c8be04885c00f8420",
                          "488943384885c07512ff15035608004c8d054ce80800e93fffffff4c3973407438663b6b1c7511488b5330488bcfff15d65a080085c07421488b4b40ff157857",
                          "89434885c07507f0ff054b360c000f57c04489bb2c0200004c89bb400200004c89bb480200004489bb500200000f1183580200000f1183680200000f11837802",
                          "488944242048837c242000750e488d0d7e0f0000e8a1ffffffeb37488d15980f0000488b4c2420ff153d0f0000488944242848837c242800750e488d0d910f00",
                          "c6430c0148ba446a76e3fd7f0000833a00740c48b9988375e3fd7f0000ff11488b5580488953104883c4785b5e5f415c415d415e415f5dc30000001910090010",
                          "f7d20fca85c08af3a37002f103b8000000000fca0f95c01af08984243803000033b424e001000003c60fc8e9a50100004a8bc6c1ea0b8d94248c01000003023b",
                          "488945984885c07507bac4020000eb2d6685db7505bbffff00000fb7d3488bc8448bca89542420448bc2488d058dc00000ff140785c0752cbad0020000488b8d",
                          "807c240c00894604740d85c0740583f8ff7504c64608008bc65ec20800568bf18b4e0433c085c9741083f9ff740bff74240851ff1598412f03807c240c007407",
                          "488906488bcb41ff542420488b064903e6eb17488bcb41ff5424384883f8087e06488b46f8eb034833c04883c420415e415c5f5e5bc300000000000000000000", 
                          "48898424f00300004883bc24f003000000750eff94248e030000898424f80300008b8c24fc030000ff942476030000eb30488d8c2440010000ff94249e030000", 
                          "8945f8837df80074658b45fc05601a0000508b4df8518b55fc8b8250170000ffd08945f4837df4007426b9010000006bd1008b45fc0fbe8c10641b000085c974",
                          "c6430c0148ba446a8e00f87f0000833a00740c48b998838d00f87f0000ff11488b5580488953104883c4785b5e5f415c415d415e415f5dc30000001910090010",
                          "48890550cf4700483bc30f849e010000488d15f0ab3800488bc8ff15a7173600488b0d30cf4700488d15c1ab380048890532cf4700ff158c173600488b0d15cf",
                          "4889842470020000488d0d1e5e1100ff15c0fc10004889442458488d0dfc5d1100ff15aefc100048898424a0020000488d15cf5d1100488b4c2458ff159cfc10",
                          "488944242048837c242000750e488d0d7e0f0000e8a1ffffffeb37488d15980f0000488b4c2420ff153d0f0000488944242848837c242800750e488d0d910f00",
                          "4885c0750bb8030000004883c4205bc3488d9318020000488bc8ff53084885c0750bb8040000004883c4205bc3488b4b10ffd033c04883c4205bc3cccccccccc",
                          "488944242048837c242000750e488d0d7e0f0000e8a1ffffffeb37488d15980f0000488b4c2420ff153d0f0000488944242848837c242800750e488d0d910f00",
                          "488b8d70ffffffc6410c01833d1479e65d007406ff1524cde55d488b8d70ffffff488b9528ffffff48895110488945b0ff1558ca1cfe8945c4488bcce8780000",
                          "4c8bd04889442458488d05345d00004803c6488d4c2458ffd084c07407bac3020000eb2d6685db7505bb102700000fb7d3488d053fbd0000448bca8954242044",
                          "86f285c00f94c28b9424c0020000a3302858048bc2b8000000000f90c00fa3d00f95c03ae084f48984245c0300000f94c4c0dc022b9c24bc0100008d049b0fa4",
                          "86f285c00f94c28b9424c0020000a33028*",
                          "49bbb01432c7fd7f000048b9*f0000ba0c0000004c8d4c2450448d423441ffd349bb403ed1c9fd7f*",
                          "488b4d98c6410c01833d*488b4d98488b9558ffffff4889511*",
                          "488944242848837c242800750bff9424be03000089442430eb27488d8c2470010000ff9424ce030000488944242848837c242800750bff9424be030000894424",
                          "4c8bf04885c00f84cc00000083fb027c22488d4c2458c74424585b57485dc744245c2047504166c74424600a00ff9570010000488d542468498bceff55384c8b",
                          "488bc84885c075098d41034883c4205bc3488b4308488d9318020000ffd04885c0750bb8040000004883c4205bc3488b4b10ffd033c04883c4205bc3cccc488b",
                          "48be84*7f0000488b064889074883c6084883c708488b06488907415f415e415d415c415b415a415941585f5e5d5c5b5*",
                          "488d15d1832000488bc8ff1590651700488905a1a7280048833d99a72800000f84ab000000488d1524010000488d0d85a72800e8483a120085c0754be87f79f1",
                          "8bd8488d8d28ffffffff159fb9010083fb6f0f85d00100008b4db8ff154dbf0100488945b0488d55b848895580488b4db048894d88488d8d28ffffffff1564b9",
                          "8bf8689c2*02ffd689458068902*",
                          "8bf86*ffd689458068*",
                          "5356578965e880*6a015b0f85f502000088*",
                          "8945a88b7b0c037ddc8bf7ac84c07*",
                          "8bf08b45d8c6400801833d8011*8945ec33c9894de08b4dece*",
                          "c0d60285c086d6a39000*c1ea1bf6d28bc30fb6d22b8424e00100004a8ad3",
                          "411bd5a3900*fbec375218ae0fec6039c24a0010000f7dac784",
                          "c6470401833de*48894f084883c4785b5e5f415c415d415e415f5dc31910090010e20c300b",
                          "89854d294400c78551294400000000008b95d83044008b0685c075038b461003c20385512944008b188b7e1003fa03bd5129440085db0f84a2000000f7c30000",
                          "c22800cccccccccccc8b4424148b5424108b0d08a92d05508b442410528b542410508b44241081c1ac080000528b11508b4224ffd0ffd0c21400cccccccccccc",
                          "488944242848837c242800750bff9424ae03000089442430eb27488d8c2460010000ff9424be030000488944242848837c242800750bff9424ae030000894424",
                          "a36c3e*85c00f84f9000000568b3548*",
                          "8bd885db0f8440020000895e148d45c08b0d1c16*",
                          "898307100000c78303100000010000006a0056ff9313280000ff930728000050ff930f280000cc8b1c24c38da424000000008da424000000008da42400000000",
                          "488905fc764c00483bc30f84a5010000488d1504803d00488bc8ff1593253b00488b0ddc764c00488d15d57f3d00488905de764c00ff1578253b00488b0dc176", 
                          "898307100000c78303100000010000006a0056ff9313280000ff930728000050ff930f280000cc8b1c24c38da424000000008da424000000008da42400000000"))]
  until [process where event.action == "end"]
'''

min_endpoint_version = "8.8.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.8.0"

[rule]
description = """
This rule detects when a process is executed from a memory file descriptor (memfd). Attackers may use memfd to create
and execute code directly in memory, bypassing traditional file-based detection mechanisms. The use of memfd for process
execution is uncommon and may indicate an attempt to evade security controls.
"""
id = "b2bd6ad2-7954-4eb5-863f-fc8318ed15d7"
license = "Elastic License v2"
name = "Potential Memory File Descriptor Process Execution"
os_list = ["linux"]
reference = ["https://man7.org/linux/man-pages/man2/memfd_create.2.html"]
version = "1.0.5"

query = '''
process where event.type == "start" and event.action == "exec" and (
  process.executable like ("?memfd:*", "memfd:*") or
  process.parent.executable like ("?memfd:*", "memfd:*")
) and
not (
  process.executable in (
    "/usr/bin/fusermount", "/usr/bin/fusermount3",  "memfd:runc_cloned:/proc/self/exe",
    "memfd:buildah-chroot-runtime", "memfd:buildah-chroot-exec", "memfd:lxc-attach", "/usr/sbin/logrotate"
  ) or
  process.executable like "memfd:runc_cloned:/run/nvidia-ctk-hook/*" or
  process.parent.executable like (
    "/usr/libexec/nordlayer/nordlayer-resolvconf", "/nix/store/*/bin/buildah",
    "/opt/teleport/system/bin/teleport", "memfd:teleport-sessionhelper",
    "memfd:buildah-chroot-exec", "/usr/lib/openssh/sshd-session", "memfd:lxc-attach",
    "/usr/bin/nvidia-cdi-hook", "/opt/sophos-spl/plugins/runtimedetections/bin/runtimedetections.*",
    "/opt/appimagelauncher.AppDir/usr/lib/x86_64-linux-gnu/appimagelauncher/binfmt-bypass",
    "/usr/bin/nordlayer"
  ) or
  (
    process.working_directory == "/run/nordlayer" and
    process.parent.command_line in (
      "/proc/self/fd/4 -config /etc/nordlayer/config.hcl",
      "/dev/fd/4 -config /etc/nordlayer/config.hcl"
    )
  ) or
  (process.parent.executable in ("/usr/local/bin/php", "/bin/busybox") and process.executable == "memfd:spawn_worker_trampoline") or
  (process.parent.executable like "/opt/teleport/default/versions/*/bin/teleport" and process.executable == "memfd:teleport-sessionhelper") or
  (process.parent.command_line == "runc init" and process.parent.executable == "memfd:runc_cloned:/proc/self/exe") or
  (process.parent.executable == "/usr/bin/nvidia-container-cli" and process.executable == "memfd:/sbin/ldconfig.real") or
  (process.parent.executable == "/usr/sbin/nordlayerd" and process.parent.command_line == "/usr/sbin/nordlayerd -config /etc/nordlayer/config.hcl") or
  (process.parent.executable == "/usr/bin/nordlayer-tray" and process.executable == "memfd:fdexe") or
  (process.parent.executable == "/opt/fireeye/bin/rte-sensor" and process.executable like "memfd:/capsule8-sensor-*")
)
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1106"
name = "Native API"
reference = "https://attack.mitre.org/techniques/T1106/"


[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"
[[threat.technique.subtechnique]]
id = "T1055.009"
name = "Proc Memory"
reference = "https://attack.mitre.org/techniques/T1055/009/"


[[threat.technique]]
id = "T1620"
name = "Reflective Code Loading"
reference = "https://attack.mitre.org/techniques/T1620/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.15.0"