Elastic rules: 2n

[metadata]
creation_date = "2023/08/21"
integration = ["endpoint", "windows", "system"]
maturity = "production"
updated_date = "2026/03/24"

[rule]
author = ["Elastic"]
building_block_type = "default"
description = """
Identifies commands containing references to Outlook data files extensions, which can potentially indicate the search,
access, or modification of these files.
"""
from = "now-119m"
index = [
    "endgame-*",
    "logs-endpoint.events.process-*",
    "logs-system.security*",
    "logs-windows.sysmon_operational-*",
    "winlogbeat-*",
]
interval = "60m"
language = "eql"
license = "Elastic License v2"
name = "Accessing Outlook Data Files"
risk_score = 21
rule_id = "2e311539-cd88-4a85-a301-04f38795007c"
severity = "low"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Collection",
    "Data Source: Elastic Defend",
    "Rule Type: BBR",
    "Data Source: Sysmon",
    "Data Source: Elastic Endgame",
    "Data Source: Windows Security Event Logs",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
process where host.os.type == "windows" and event.type == "start" and process.args : ("*.ost", "*.pst") and
  not process.name : "outlook.exe" and
  not (
        process.name : "rundll32.exe" and
        process.args : "*davclnt.dll,DavSetCookie*"
  )
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1005"
name = "Data from Local System"
reference = "https://attack.mitre.org/techniques/T1005/"

[[rule.threat.technique]]
id = "T1114"
name = "Email Collection"
reference = "https://attack.mitre.org/techniques/T1114/"

[[rule.threat.technique.subtechnique]]
id = "T1114.001"
name = "Local Email Collection"
reference = "https://attack.mitre.org/techniques/T1114/001/"

[rule.threat.tactic]
id = "TA0009"
name = "Collection"
reference = "https://attack.mitre.org/tactics/TA0009/"

[metadata]
creation_date = "2020/06/16"
integration = ["aws"]
maturity = "production"
updated_date = "2026/04/10"

[rule]
author = ["Elastic"]
description = """
Identifies when an AWS Config configuration recorder is stopped. AWS Config recorders continuously track and record
configuration changes across supported AWS resources. Stopping the recorder immediately reduces visibility into
infrastructure changes and can be abused by adversaries to evade detection, obscure follow-on activity, or weaken
compliance and security monitoring controls.
"""
false_positives = [
    """
    Authorized administrators may temporarily stop the AWS Config recorder during planned maintenance, account
    restructuring, or controlled configuration changes. Automated infrastructure or compliance tooling may also stop and
    restart the recorder as part of setup or teardown workflows. Activity outside of documented change windows or from
    unexpected identities should be investigated.
    """,
]
from = "now-6m"
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
language = "kuery"
license = "Elastic License v2"
name = "AWS Configuration Recorder Stopped"
note = """## Triage and analysis

### Investigating AWS Configuration Recorder Stopped

AWS Config provides continuous visibility into resource configuration changes and underpins many security, compliance,
and audit workflows. Stopping the configuration recorder prevents new changes from being captured and can create blind
spots in detection and forensic timelines.

This behavior is uncommon in steady-state production environments and should be carefully reviewed, especially when
performed outside approved maintenance windows or by unexpected principals.

### Possible investigation steps

**Identify the actor**
- Review `aws.cloudtrail.user_identity.arn` and `aws.cloudtrail.user_identity.access_key_id`
  to determine who initiated the `StopConfigurationRecorder` action. Confirm whether this principal typically administers AWS Config or performs security and compliance operations.

**Examine the request context**
- Review `user_agent.original` to determine whether the request originated from the AWS Console, CLI, SDK, or automation tooling.
- Inspect `source.ip` and any available geo context to assess whether the request originated from an expected network or region.

**Determine scope and impact**
- Identify which configuration recorder was stopped and which regions or resources were affected.
- Determine how long the recorder remained disabled and whether any configuration changes occurred during that window.
- Assess whether AWS Config rules, Security Hub controls, or downstream monitoring systems were impacted.

**Correlate with related activity**
- Look for surrounding CloudTrail activity from the same principal, including:
  - Deletion or modification of Config rules, delivery channels, or conformance packs.
  - IAM changes, credential activity, or other security control modifications.
- Check for signs of follow-on activity that may have relied on reduced visibility, such as resource creation, policy changes,
  or network reconfiguration.

**Validate intent**
- Confirm with the platform, security, or compliance teams whether the recorder stoppage was intentional and approved.
- Compare the timing against change management records, infrastructure deployments, or account bootstrapping workflows.

### False positive analysis

- Planned maintenance or controlled configuration changes may require temporarily stopping the recorder.
- Automated account provisioning, teardown, or remediation tooling may stop and restart the recorder as part of normal workflows.

### Response and remediation

- Immediately restart the AWS Config recorder to restore configuration visibility.
- Review CloudTrail logs for activity that occurred while the recorder was stopped and assess potential security or compliance impact.
- If the action was unauthorized, rotate or disable credentials associated with the initiating principal and investigate for compromise.
- Review IAM permissions to ensure only a minimal set of trusted roles can stop or modify AWS Config components.
- Implement guardrails such as AWS Config rules, SCPs, or automated remediation to detect and respond to recorder stoppage.
- Update monitoring, alerting, and incident response runbooks to explicitly cover AWS Config visibility loss scenarios.

### Additional information
- **[AWS IR Playbooks](https://github.com/aws-samples/aws-incident-response-playbooks/blob/c151b0dc091755fffd4d662a8f29e2f6794da52c/playbooks/)** 
- **[AWS Customer Playbook Framework](https://github.com/aws-samples/aws-customer-playbook-framework/tree/a8c7b313636b406a375952ac00b2d68e89a991f2/docs)** 
- **[AWS Knowledge Center – Security Best Practices](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/)**
"""
references = [
    "https://awscli.amazonaws.com/v2/documentation/api/latest/reference/configservice/stop-configuration-recorder.html",
    "https://docs.aws.amazon.com/config/latest/APIReference/API_StopConfigurationRecorder.html",
]
risk_score = 73
rule_id = "fbd44836-0d69-4004-a0b4-03c20370c435"
severity = "high"
tags = [
    "Domain: Cloud",
    "Data Source: AWS",
    "Data Source: Amazon Web Services",
    "Data Source: AWS Config",
    "Tactic: Defense Evasion",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset: aws.cloudtrail 
    and event.provider: config.amazonaws.com 
    and event.action: StopConfigurationRecorder 
    and event.outcome: success
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[rule.threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"

[[rule.threat.technique.subtechnique]]
id = "T1562.008"
name = "Disable or Modify Cloud Logs"
reference = "https://attack.mitre.org/techniques/T1562/008/"



[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user_agent.original",
    "source.ip",
    "aws.cloudtrail.user_identity.arn",
    "aws.cloudtrail.user_identity.type",
    "aws.cloudtrail.user_identity.access_key_id",
    "event.action",
    "event.outcome",
    "cloud.account.id",
    "cloud.region",
    "aws.cloudtrail.request_parameters",
]

[metadata]
bypass_bbr_timing = true
creation_date = "2024/04/30"
integration = ["aws"]
maturity = "production"
updated_date = "2026/08/05"

[rule]
author = ["Elastic"]
building_block_type = "default"
description = """
Identifies when an AWS IAM login profile is added to a user. Adversaries may add a login profile to an IAM user who
typically does not have one and is used only for programmatic access. This can be used to maintain access to the account
even if the original access key is rotated or disabled. This is a building block rule and does not generate alerts on
its own. It is meant to be used for correlation with other rules to detect suspicious activity.
"""
from = "now-60m"
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
interval = "10m"
language = "kuery"
license = "Elastic License v2"
name = "AWS IAM Login Profile Added to User"
risk_score = 21
rule_id = "10445cf0-0748-11ef-ba75-f661ea17fbcc"
severity = "low"
tags = [
    "Domain: Cloud",
    "Platform: AWS",
    "Data Source: AWS CloudTrail",
    "Service: AWS IAM",
    "Tactic: Persistence",
    "Rule Type: BBR",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
event.dataset: aws.cloudtrail and event.provider: "iam.amazonaws.com"
    and event.action: "CreateLoginProfile" and event.outcome: success
    and not user_agent.original: (*Terraform* or *Pulumi*)
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"

[[rule.threat.technique.subtechnique]]
id = "T1078.004"
name = "Cloud Accounts"
reference = "https://attack.mitre.org/techniques/T1078/004/"

[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"

[[rule.threat.technique.subtechnique]]
id = "T1098.001"
name = "Additional Cloud Credentials"
reference = "https://attack.mitre.org/techniques/T1098/001/"

[[rule.threat.technique.subtechnique]]
id = "T1098.003"
name = "Additional Cloud Roles"
reference = "https://attack.mitre.org/techniques/T1098/003/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[rule]
description = """
Identifies the call of commonly abused Windows APIs to perform code injection and where the call stack not starting with
Windows NT syscall DLLs such as ntdll and win32u. This may indicate the use of direct system calls to evade endpoint
security solutions hooking Windows APIs.
"""
id = "fe44381a-435c-4e19-ad89-40ac3750f514"
license = "Elastic License v2"
name = "Direct Syscall from Unsigned Module"
os_list = ["windows"]
reference = [
    "https://www.elastic.co/security-labs/doubling-down-etw-callstacks",
    "https://www.ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs",
]
version = "1.0.26"

query = '''
api where process.Ext.api.behaviors == "direct_syscall" and
    process.Ext.api.name in ("VirtualAlloc", "VirtualProtect", "MapViewOfFile", "MapViewOfFile2") and
    not _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.status like ("trusted", "errorCode_endpoint*")) and
    startswith(process.thread.Ext.call_stack_summary, process.thread.Ext.call_stack_final_user_module.name) and
    not process.thread.Ext.call_stack_final_user_module.path like "?:\\windows\\assembly\\nativeimages_*" and
    process.thread.Ext.call_stack_final_user_module.hash.sha256 != null and
    process.thread.Ext.call_stack_final_user_module.protection_provenance != "Kernel" and
    not process.thread.Ext.call_stack_final_user_module.hash.sha256 in
                                 ("f0d37ab8636685fdf3c81f2f1df5fb0a2cdba6e6daf10200c250a31a822f0f10",
                                  "8f7b60cb0dc32277e6e99ebfee047d5a587050a1fcd5c2f98be7204898d7b25d",
                                  "dc1abae9fce7e192232a5be12c6096338529b327ad749e310e7375106e013579",
                                  "f0d37ab8636685fdf3c81f2f1df5fb0a2cdba6e6daf10200c250a31a822f0f10",
                                  "8f7b60cb0dc32277e6e99ebfee047d5a587050a1fcd5c2f98be7204898d7b25d",
                                  "f1f2ab4ee6f0350d6db84a9983f5c734ef32958c848a472931f03ff733b5a5e7",
                                  "99d836285aa612c98765ac6a538aa3ed74bf435b157311c65577949d794eac8b",
                                  "f7fc4fbdd1706f443868047def63c1e9a746a0be2fac0577ce197e84c8b0a3ce",
                                  "2e6febc71362a72e7bed50c8ffbbaef70f3b8ea542a309b9bf32b337b534e0b4",
                                  "ca1b969a9ba62164ddb7fc5d315b0b82d8506238b15bbd7dd88857ef6acd367a",
                                  "2a44a8af200c4ee36de4b0f91471ffca82ce25e0fe90401d64a9d4c01b9f9525",
                                  "a14fd3fd3bd83ac7789295978bc2bfeed80657cc0298b8314dbb02ee19ca73fd",
                                  "6dbf510f4f0ced77341146b24a9b0c320b516ade2248defa09931ea413f8b20e",
                                  "abfa585a5358e658bd92d159e9f846b2950c7e300c47392283443a1bcb70fd52",
                                  "a62ceea27ff8a0dcc0432fd171f8549d38f69e7233415cfe446305aa9e553970",
                                  "d2a55e2d77369b71f90f8840c6b7d0a2739981283e6d77a3350a80de21125b3f",
                                  "dc55eebfbddaee583a29f17610ef15397b97d37d7d4027d2060d6e88c4eb1182",
                                  "bee2f0a5e13b857d749232273e7c45d597fb858bf0f0a72c793e1c37237675aa",
                                  "6cfc98d1ffcdb983e64beac75ccde7d873e3c41fffde2f4d87dd0757eb5a620d",
                                  "155954174a6fa52ec64ca44e4d77f387e7c9f363541c81a4a7812d9c783af3ca",
                                  "8e619459168a1edc8de86d29cb557388d89cdebefae1d001ba394079a7622511",
                                  "5f51051b50e1d9bb9c47089d5774ff3e491be45eeaf40cba7fd86c5d4fa8635d",
                                  "d5693df142632f807bd5707cb5ee58e9edaaa3a40e84cd5c070ec63412820af9",
                                  "f06bc48095cd11e51714d08b8889c32a058282fdb90487ada823a6550089df96",
                                  "aad7e7ac9d74ac18892801950c9728e9c4eacd3b676cbb5d6f63382da2ce0559",
                                  "79364f3e140abd46d8d1bedd21db9646ab55cf35783ef7926a235fa7e1fe6797",
                                  "c56440ab3d623249aabaec871a5da8eccb61dc6a0b3166c972d8c86e7d646ef4",
                                  "ea71387e40682bcc23f676df2b856dca15853aeb854b94168c85bc0479ef1aed",
                                  "ae8a5d43dfc2e8bac34a415449fa67b300cdf9e2995b0e8ec38cd8d0694da7ae",
                                  "3034311292fade8a24ab8e7312cfb7132153c14b9383439b527e8296fe06a492",
                                  "51855557b6215ae93482598f5de7e4875a8612d1a2645893905f0c35d321fd73",
                                  "19b7261bb6162e32eaaf7727d2f77b4647d95ff7554300726e2649ffa99b6eec",
                                  "79b62fd3ed24ca4778dc0261c7570e71f3d0c83913c38f58ab1660dc7a670aee",
                                  "ce0f4cd9d9af178aead83df4f46146f1c66cc2c3e600c8aafa0a392fc5ad9637",
                                  "c572cbc2269ef4adca064f23edd04bbd360fb0e8de40abe90c2be35265fffd3f",
                                  "9a2678818bdc614eab85cddb993daa4c783cd36d8c3eda95c2506a7e6e24698b",
                                  "d0fe1eecad868460c162fd40cacf2ac954008b2de1234b2d1cd3b1e361f5e6c0",
                                  "5c55fe4218757fea3012295b8284e967852f4df0c622b173dbdb51012edeeee0",
                                  "4ae78c687615e7dc4c268d3eee519a19aa581e701b7e46e4bc7ee79501e83ad5",
                                  "ecce95f1b2383a852c1b2226970453494c5bf315c2e0b2adda7e3142e028791e",
                                  "545a3aec876c49c56693f48f5fde740487330ca097775d9a434157aabf25db10",
                                  "a543689f34083f810e0184ec77d8ee9e57d44ebd6212af444853a3a89a3c82c0",
                                  "5a8ae397c178fe9397a41b71b2046ded55feb409fadc30f4053194802f5c2dcd",
                                  "60feb037f14dcc3d1f9adfc35647633cab48a652221b8e2e3c5d68b4313d7d0a",
                                  "03c77f2408290a5b734a86d6a1bfc97739e2f54f165ae333c4eddb380e0adef7",
                                  "d01b8dc8fbf8139a8b0c59a038c7ca755a87630ed242c306fb2b53985e545685",
                                  "ea5f2055397fc76db031de944b10a27a6a7975713f2902df3a3970b65e271b4f",
                                  "d01b8dc8fbf8139a8b0c59a038c7ca755a87630ed242c306fb2b53985e545685",
                                  "ec5e3f367dc8663405dd3f3549e8b8d65d772b148e1e6d7d17ea4fdf5a95195c",
                                  "7024db838ba2d2abb1ff1f96a91b0359cbc7f56d4acfc6c8d851d70fa8b49a1c",
                                  "1bb34f11b79fad256ca2e72ea7bcc618815632d585538e1e601c7fc5512ba72d",
                                  "b72a06025452c94223100a34efacddf3d81cf57f3941fa1f2a6dce66b9b54d5b",
                                  "9c1b56c021a7fdf1d1aa008834499046227ace6f6c7d976ef89d27a84858fdb0",
                                  "0743c51969f7d6eb123a60a8ae9e2451bbd0859b89a57c93cbf9c6e904d6defc",
                                  "bc0715826ce01c4782065a28eaef6547dc60cd60b6069ef76e5a26635e510256",
                                  "6e0f6c689e9b80c69445b574e705f79044c5fd148b9912c79f1381e96fe6edcb",
                                  "c717ae53f81fbb66d2554e3c65c295cb2c98e9c817df9c0cdd378d92b5471d5c",
                                  "50e219e52377465a403da3e1275c10579b3042bfbd03ae383648a81b53b4586e",
                                  "58ac11fdd8de211df2a12d1dc8dafcab56ffdbcec0d0f41b4125de191b4f2180",
                                  "1ba0f1f7aef9c790ad3e431b0850a51da6348e3a65c8620997f737b43215547b",
                                  "94e333beccbc0d7199d0a9bf13922ef8f388e1d7f7e055ad8ec8ca6160b50067",
                                  "3613fc46eab116864d28b7a3af1b7301fc0309bf3ba99c661a8c36ad5c848d02",
                                  "98a27a37c5dbe1e115a0f43d2f0cc8afd332e3e5fb5e4c37e09e83e35dc8efb3",
                                  "56b848c3c125a2a666b13e22ba75df2b3609632d5989bc57a8d5566924829373",
                                  "dfc43850daabf4fec146d04a4c62b3a8679639d2cfa399d005e9fdd5387c2fac",
                                  "2a373bf09a7f1d8abf1dafc50df8dadc073b9a9ec1283efcfc42fd5d66f2c57d",
                                  "72c9da48314a77642d5505d019f454fd32f0933ed8a056fb9c9a18818eb4a6f5",
                                  "e540127862940234446ef7a919f7295a52e751e14f184e779a8b4b2dffb78978",
                                  "f9674626d17346629508557918209728fc2a571aeed62201887281aa992758e8",
                                  "f80c57719e52bbbd9d10aaabf9e30db7b76fabd5d0cb73f2a78b96d5613befc4",
                                  "4706af5ee53476bc4701b81aff0f5f655aea433f1de39365bef271b24a29cd85",
                                  "6fd1551bc0b7b588dabe1865a7a333a4987c552f4aa05b30cb92fbb33c03603e",
                                  "a32c3fbbf74699a10e7642bf4901191f29c88c5aec93ae7ba28c79ab28462a69",
                                  "30a7ee75311049b34c6240646cc01235fd9860b98c73c267ae7ffc4350aa0825",
                                  "7e562fc41c9e36fbe0b06339e57cb842354a61b6c21bd975eb56ad550615a5f6",
                                  "7a96d50d91310903f591478e7d1513be5689f1ecf59fe752fbaa6cb4ba8820ce",
                                  "ae885757debdc97de2498d84cfb0b7f05e6af00ec14030b1fe678276518f56b0",
                                  "1b5d9cec668335295c8e575bcedf4afcedbc445d8ccf8374c9380188965e78e3",
                                  "f6391baaf220428eab56c30d45d53fc76e651c1b2e66f2908a312526a1e45331",
                                  "79b73fa504fdc7c41be70f74c6ded66e12f271d3bb8afb5c1c94a6eb4514f0cf",
                                  "1c2cf78885c0487e28fdcd201dca52a6dbded5eeb108e4638ddc867fac473e37",
                                  "b1ce6d1ccf9f48f3ff3f45d94e088fc2fc964e55ee8f97c08c1c1adfb9c9328e",
                                  "e4edc03903a3463425bf570ca35f66f2acbb8ba8b9c1757adb4a9e6f0a070f45",
                                  "701d795207cfc31e2ace3823d9793edf3f8a5d1521acb64bb26f7e25c2871599",
                                  "e825c36285a43e15aa5bbf270ff12a3323bb444d173621ab8158d05808bdaaf0",
                                  "a6d3a9ae1527b586691d2d3b678279385e434beea0afa114b0a06e64a7f2148d",
                                  "26234e9692dc1a048d143518306f83a4192a260b5b884aeef28478e40d209239",
                                  "669ee31e18f1901098d0b296e0ebbe38b5602bf4c17000dda9409aa5bd64133a",
                                  "499b68eb465d06a2b23c2da325786e15d721c3a0d7a32ce6f57305886cfb09d8",
                                  "22121600323bc22f24944a97e0ea4b8b2250b9541f0505c1f1569ac8e585659f",
                                  "5b4f622cb9b451a6427fc9caebecd7662ec14af325697c4619ec61b7117d6273",
                                  "da7dfd4b7df4f2813428306649b10d1f2d6d71c1d43c5cfffe880101d62d7b08",
                                  "7920398ba4c6a03a55c394145444fc5d475301fb5393e96a2b1667a9bbda1ac5",
                                  "17a410b194cecfc6b771c14679944fc58911d528c2a7946a480e2ce3bc6e8bcf",
                                  "549d3a52cd9b25d24fc547f25a9e6615501a18142baa362199f4f82577a48edf",
                                  "018de92d5333ec58cc4620f1a7e0212b8883fe61b1af06af5d741b665d65b6ff",
                                  "25db6d97dcec8e306149c19b9dd7e3f4818a58b57b6a9f192bd7529123bc4f24",
                                  "76fcb15956144d5477d4636ee09ce3db64597c7ccdf840163862fa837534bdd1",
                                  "2898c1471434df740f2ac0d561c5f4c17d1b8fc5ec17cd1e267afed6eadb9ff7") and
    not (process.Ext.api.name == "VirtualProtect" and process.Ext.api.metadata.target_address_name == "terminal64.exe" and
         process.thread.Ext.call_stack_final_user_module.name == "terminal64.exe") and
    not (process.Ext.api.name == "VirtualProtect" and process.thread.Ext.call_stack_summary == "Unbacked") and
    not (process.thread.Ext.call_stack_final_user_module.name == "Unbacked" and
         (process.thread.Ext.call_stack_final_user_module.protection_provenance_path like "c:\\windows\\assembly\\nativeimages_*.ni.dll" or
          process.thread.Ext.call_stack_final_user_module.protection_provenance == "system.transactions.ni.dll"))
'''

min_endpoint_version = "8.14.2"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.14.2"

[metadata]
creation_date = "2020/03/25"
integration = ["endpoint", "network_traffic"]
maturity = "production"
min_stack_version = "9.5.0"
min_stack_comments = "Migrate packetbeat job to security network module"
updated_date = "2026/07/27"

[rule]
anomaly_threshold = 50
author = ["Elastic"]
description = """
A machine learning job detected unusually large numbers of DNS queries for a single top-level DNS domain, which is often
used for DNS tunneling. DNS tunneling can be used for command-and-control, persistence, or data exfiltration activity.
For example, dnscat tends to generate many DNS questions for a top-level domain as it uses the DNS protocol to tunnel
data.
"""
false_positives = [
    """
    DNS domains that use large numbers of child domains, such as software or content distribution networks, can trigger
    this alert and such parent domains can be excluded.
    """,
]
from = "now-45m"
interval = "15m"
license = "Elastic License v2"
machine_learning_job_id = "dns_tunneling_ea"
name = "DNS Tunneling"
setup = """## Setup

This rule requires the installation of associated Machine Learning jobs, as well as data coming in from one of the following integrations:
- Elastic Defend
- Network Packet Capture

### Anomaly Detection Setup

Once the rule is enabled, the associated Machine Learning job will start automatically. You can view the Machine Learning job linked under the "Definition" panel of the detection rule. If the job does not start due to an error, the issue must be resolved for the job to commence successfully. For more details on setting up anomaly detection jobs, refer to the [helper guide](https://www.elastic.co/guide/en/kibana/current/xpack-ml-anomalies.html).

### Elastic Defend Integration Setup
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.

#### Prerequisite Requirements:
- Fleet is required for Elastic Defend.
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).

#### The following steps should be executed in order to add the Elastic Defend integration to your system:
- Go to the Kibana home page and click "Add integrations".
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
- Click "Add Elastic Defend".
- Configure the integration name and optionally add a description.
- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
- Click "Save and Continue".
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).

### Network Packet Capture Integration Setup
The Network Packet Capture integration sniffs network packets on a host and dissects known protocols. Monitoring the network traffic is critical to gaining observability and securing your environment — ensuring high levels of performance and security. The Network Packet Capture integration captures the network traffic between your application servers, decodes common application layer protocols and records the interesting fields for each transaction.

#### The following steps should be executed in order to add the Elastic Agent System integration "network_traffic" to your system:
- Go to the Kibana home page and click “Add integrations”.
- In the query bar, search for “Network Packet Capture” and select the integration to see more details about it.
- Click “Add Network Packet Capture”.
- Configure the integration name and optionally add a description.
- Review optional and advanced settings accordingly.
- Add the newly installed “network_traffic” to an existing or a new agent policy, and deploy the agent on your system from which network log files are desirable.
- Click “Save and Continue”.
- For more details on the integration refer to the [helper guide](https://docs.elastic.co/integrations/network_traffic).
"""
references = ["https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html"]
risk_score = 21
rule_id = "91f02f01-969f-4167-8f66-07827ac3bdd9"
severity = "low"
tags = [
    "Data Source: Elastic Defend",
    "Data Source: Network Packet Capture",
    "Use Case: Threat Detection",
    "Rule Type: ML",
    "Rule Type: Machine Learning",
    "Tactic: Command and Control",
    "Resources: Investigation Guide",
]
type = "machine_learning"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating DNS Tunneling

DNS tunneling exploits the DNS protocol to covertly transmit data between a compromised system and an attacker-controlled server. Adversaries use it for stealthy command-and-control, persistence, or data exfiltration by embedding data within DNS queries. The detection rule leverages machine learning to identify anomalies, such as an unusually high volume of DNS queries to a single domain, indicating potential tunneling activity.

### Possible investigation steps

- Review the DNS query logs to identify the specific top-level domain generating the unusually high volume of queries. This can help pinpoint the potential source of tunneling activity.
- Analyze the source IP addresses associated with the DNS queries to determine if they originate from known or suspicious hosts within the network.
- Check for any recent changes or anomalies in the network traffic patterns related to the identified domain, which might indicate tunneling or exfiltration attempts.
- Investigate the history of the identified domain to assess its reputation and any known associations with malicious activities or threat actors.
- Correlate the DNS query activity with other security events or alerts in the network to identify any related suspicious behavior or indicators of compromise.

### False positive analysis

- High volume of DNS queries from legitimate software updates or patch management systems can trigger false positives. Users should identify and whitelist domains associated with trusted update services.
- Content delivery networks (CDNs) often generate numerous DNS queries due to their distributed nature. Exclude known CDN domains from the analysis to reduce false positives.
- Internal network monitoring tools that rely on DNS for service discovery may cause an increase in DNS queries. Consider excluding these internal domains if they are verified as non-threatening.
- Some cloud services use DNS for load balancing and may result in high query volumes. Users should review and whitelist these domains if they are confirmed to be safe.
- Automated scripts or applications that frequently query DNS for legitimate purposes can be excluded by identifying their specific patterns and adding them to an exception list.

### Response and remediation

- Isolate the affected system from the network to prevent further data exfiltration or command-and-control communication.
- Conduct a thorough analysis of DNS logs to identify the specific domain involved in the tunneling activity and block it at the network perimeter.
- Review and terminate any suspicious processes or services running on the compromised system that may be associated with the tunneling activity.
- Reset credentials and review access permissions for accounts that were active on the compromised system to prevent unauthorized access.
- Escalate the incident to the security operations center (SOC) for further investigation and to determine if additional systems are affected.
- Implement enhanced monitoring for DNS traffic to detect similar tunneling activities in the future, focusing on high-frequency queries to single domains.
- Coordinate with IT and security teams to apply necessary patches and updates to the affected system to close any vulnerabilities exploited by the attacker."""
[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"

[[rule.threat.technique.subtechnique]]
id = "T1071.004"
name = "DNS"
reference = "https://attack.mitre.org/techniques/T1071/004/"

[[rule.threat.technique]]
id = "T1572"
name = "Protocol Tunneling"
reference = "https://attack.mitre.org/techniques/T1572/"

[rule.threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1041"
name = "Exfiltration Over C2 Channel"
reference = "https://attack.mitre.org/techniques/T1041/"

[rule.threat.tactic]
id = "TA0010"
name = "Exfiltration"
reference = "https://attack.mitre.org/tactics/TA0010/"

[metadata]
creation_date = "2021/10/18"
integration = ["azure"]
maturity = "production"
updated_date = "2026/04/10"

[rule]
author = ["Austin Songer"]
description = """
Identifies high risk Azure Active Directory (AD) sign-ins by leveraging Microsoft Identity Protection machine learning
and heuristics.
"""
from = "now-9m"
index = ["logs-azure.signinlogs-*", "filebeat-*"]
language = "kuery"
license = "Elastic License v2"
name = "Entra ID High Risk User Sign-in Heuristic"
note = """## Triage and analysis

### Investigating Entra ID High Risk User Sign-in Heuristic

Microsoft Identity Protection is an Azure AD security tool that detects various types of identity risks and attacks.

This rule identifies events produced by the Microsoft Identity Protection with a risk state equal to `confirmedCompromised` or `atRisk`.

#### Possible investigation steps

- Identify the Risk Detection that triggered the event. A list with descriptions can be found [here](https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks#risk-types-and-detection).
- Identify the user account involved and validate whether the suspicious activity is normal for that user.
  - Consider the source IP address and geolocation for the involved user account. Do they look normal?
  - Consider the device used to sign in. Is it registered and compliant?
- Investigate other alerts associated with the user account during the past 48 hours.
- Contact the account owner and confirm whether they are aware of this activity.
- Check if this operation was approved and performed according to the organization's change management policy.
- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.

### False positive analysis

If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination of user and device conditions.

### Response and remediation

- Initiate the incident response process based on the outcome of the triage.
- Disable or limit the account during the investigation and response.
- Identify the possible impact of the incident and prioritize accordingly; the following actions can help you gain context:
    - Identify the account role in the cloud environment.
    - Assess the criticality of affected services and servers.
    - Work with your IT team to identify and minimize the impact on users.
    - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
    - Identify any regulatory or legal ramifications related to this activity.
- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
- Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.
- Consider enabling multi-factor authentication for users.
- Follow security best practices [outlined](https://docs.microsoft.com/en-us/azure/security/fundamentals/identity-management-best-practices) by Microsoft.
- Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).

## Setup

The Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
references = [
    "https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/reference-azure-monitor-sign-ins-log-schema",
    "https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection",
    "https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-investigate-risk",
    "https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-investigate-risk#investigation-framework",
]
risk_score = 47
rule_id = "26edba02-6979-4bce-920a-70b080a7be81"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Data Source: Azure",
    "Use Case: Identity and Access Audit",
    "Resources: Investigation Guide",
    "Tactic: Initial Access",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset:azure.signinlogs and
  azure.signinlogs.properties.risk_state:("confirmedCompromised" or "atRisk") and event.outcome:(success or Success)
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"
[[rule.threat.technique.subtechnique]]
id = "T1078.004"
name = "Cloud Accounts"
reference = "https://attack.mitre.org/techniques/T1078/004/"


[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"

[metadata]
creation_date = "2026/06/30"
integration = ["gcp"]
maturity = "production"
updated_date = "2026/06/30"

[rule]
author = ["Elastic"]
description = """
Detects GKE pod create, update, or patch events that enable host network namespace sharing. HostNetwork grants access to
the node network stack and can bypass namespace network policies. System identities and controller-owned workloads are
excluded.
"""
false_positives = [
    """
    Monitoring agents and CNI components may require hostNetwork. Exclude known platform identities after review.
    """,
]
index = ["logs-gcp.audit-*"]
language = "kuery"
license = "Elastic License v2"
name = "GKE Pod Created With HostNetwork"
note = """## Triage and analysis

### Investigating GKE Pod Created With HostNetwork

HostNetwork pods can observe or interact with node-local services. Validate the actor and workload purpose.

### Investigation steps

- Review `user.email`, pod name, namespace, and container images in `gcp.audit.request`.
- Hunt for secret access or exec from the same identity after the change.

### False positives

- Platform DaemonSets often use hostNetwork; controller ownerReferences exclusion reduces noise.

## Setup

The GCP Fleet integration with GKE audit logs enabled is required to be compatible with this rule."""
references = [
    "https://kubernetes.io/docs/concepts/security/pod-security-standards/",
    "https://bishopfox.com/blog/kubernetes-pod-privilege-escalation",
]
risk_score = 47
rule_id = "0030f681-0142-4231-b728-49bb9fc12066"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Domain: Kubernetes",
    "Data Source: GCP",
    "Data Source: Google Cloud Platform",
    "Use Case: Threat Detection",
    "Tactic: Privilege Escalation",
    "Tactic: Execution",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset:gcp.audit and
event.action:("io.k8s.core.v1.pods.create" or "io.k8s.core.v1.pods.update" or "io.k8s.core.v1.pods.patch") and
gcp.audit.request.spec.hostNetwork:true and
not gcp.audit.request.metadata.ownerReferences.kind:("ReplicaSet" or "DaemonSet" or "StatefulSet") and
not user.email:system\:*
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1611"
name = "Escape to Host"
reference = "https://attack.mitre.org/techniques/T1611/"

[rule.threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1610"
name = "Deploy Container"
reference = "https://attack.mitre.org/techniques/T1610/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[metadata]
creation_date = "2026/07/10"
integration = ["gcp"]
maturity = "production"
updated_date = "2026/07/10"

[rule]
author = ["Elastic"]
description = """
Detects write operations performed by GKE service accounts against RBAC resources (Roles, ClusterRoles, RoleBindings,
ClusterRoleBindings). Service accounts typically do not manage RBAC directly; this activity may indicate token abuse or
unauthorized privilege escalation.
"""
false_positives = [
    """
    In-cluster controllers, operators, and CI jobs may legitimately reconcile RBAC manifests. Baseline known automation
    service accounts before tuning.
    """,
]
from = "now-6m"
index = ["logs-gcp.audit-*"]
language = "kuery"
license = "Elastic License v2"
name = "GKE Service Account Modified RBAC Objects"
note = """## Triage and analysis

### Investigating GKE Service Account Modified RBAC Objects

This rule detects service accounts performing allowed write actions on RBAC resources. Stolen or over-privileged service
account tokens can silently alter authorization to gain or retain elevated access.

### Possible investigation steps

- Review `client.user.email`, `event.action`, and `gcp.audit.resource_name`.
- Trace the acting service account to its owning workload and inspect recent image changes or exec activity.
- Correlate with change tickets or GitOps commits for the same RBAC object.

### False positive analysis

- Platform operators and GitOps controllers running in-cluster commonly create or patch RBAC objects.

### Response and remediation

- Revert unauthorized RBAC changes, rotate the service account credentials, and tighten RBAC for the workload.

"""
setup = "The GCP Fleet integration with GKE audit logs enabled is required to be compatible with this rule."
references = [
    "https://kubernetes.io/docs/reference/access-authn-authz/rbac/",
    "https://heilancoos.github.io/research/2025/12/16/kubernetes.html#overly-permissive-role-based-access-control",
]
risk_score = 47
rule_id = "c41e9854-3df3-465a-8234-4d625084ff86"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Domain: Kubernetes",
    "Data Source: GCP",
    "Data Source: Google Cloud Platform",
    "Use Case: Threat Detection",
    "Tactic: Privilege Escalation",
    "Tactic: Persistence",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset:gcp.audit and service.name:"k8s.io" and event.outcome:success and
client.user.email:(system\:serviceaccount\:* and not (
  "system:serviceaccount:kube-system:clusterrole-aggregation-controller" or
  "system:serviceaccount:kube-system:generic-garbage-collector"
)) and event.action:(
  "io.k8s.authorization.rbac.v1.clusterrolebindings.create" or
  "io.k8s.authorization.rbac.v1.clusterrolebindings.delete" or
  "io.k8s.authorization.rbac.v1.clusterrolebindings.patch" or
  "io.k8s.authorization.rbac.v1.clusterrolebindings.update" or
  "io.k8s.authorization.rbac.v1.clusterroles.create" or
  "io.k8s.authorization.rbac.v1.clusterroles.delete" or
  "io.k8s.authorization.rbac.v1.clusterroles.patch" or
  "io.k8s.authorization.rbac.v1.clusterroles.update" or
  "io.k8s.authorization.rbac.v1.rolebindings.create" or
  "io.k8s.authorization.rbac.v1.rolebindings.delete" or
  "io.k8s.authorization.rbac.v1.rolebindings.patch" or
  "io.k8s.authorization.rbac.v1.rolebindings.update" or
  "io.k8s.authorization.rbac.v1.roles.create" or
  "io.k8s.authorization.rbac.v1.roles.delete" or
  "io.k8s.authorization.rbac.v1.roles.patch" or
  "io.k8s.authorization.rbac.v1.roles.update"
)
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"

[[rule.threat.technique.subtechnique]]
id = "T1098.006"
name = "Additional Container Cluster Roles"
reference = "https://attack.mitre.org/techniques/T1098/006/"

[rule.threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"

[[rule.threat.technique.subtechnique]]
id = "T1098.006"
name = "Additional Container Cluster Roles"
reference = "https://attack.mitre.org/techniques/T1098/006/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "client.user.email",
    "source.ip",
    "user_agent.original",
    "event.action",
    "event.outcome",
    "gcp.audit.resource_name",
    "gcp.audit.request.kind",
    "data_stream.namespace",
]

[metadata]
creation_date = "2026/04/22"
integration = ["kubernetes"]
maturity = "production"
updated_date = "2026/05/15"

[rule]
author = ["Elastic"]
description = """
Adversaries who land credentials in a cluster—or abuse an over-privileged token—often map the environment before
exfiltration or privilege escalation. A practical first pass is to learn where workloads run, how the cluster is
partitioned, and what RBAC exists at namespace vs cluster scope. Rapid `get`/`list` traffic across distinct
API resource kinds that answer those questions (namespaces, workloads, roles, cluster-wide roles) is a common
setup and orientation pattern for both interactive attackers and automated recon scripts. It is less typical for
steady-state controllers, which usually touch a narrow set of resources repeatedly. This rule highlights that
cross-resource burst from a single client fingerprint within a one-minute bucket so analysts can separate routine
automation from potential discovery and permission reconnaissance ahead of follow-on actions.
"""
from = "now-11m"
interval = "5m"
language = "esql"
license = "Elastic License v2"
name = "Kubernetes Multi-Resource Discovery"
note = """## Triage and analysis

### Investigating Kubernetes Multi-Resource Discovery

The rule groups Kubernetes audit `get`/`list` events on namespaces, pods, roles, and clusterroles into one-minute windows 
per `user.name`, `source.ip`, `user_agent.original`, and flags windows where three or more distinct resource types appear. 
That combination is consistent with someone sketching cluster layout and privilege structure rather than touching a single 
resource type. **Allowed and denied** authorizations are both included: failures still signal probing and validate which 
object types the caller attempted to reach.

### Possible investigation steps

- Pivot on `Esql.time_interval` and the same identity or IP in raw audit logs to see ordering (e.g. namespaces first,
  then roles, then pods) and whether calls succeeded.
- Review `Esql.decisions` and namespaces touched; correlate with RBAC for that identity to see if scope matches a
  known job or breaks least-privilege expectations.
- Hunt for follow-on activity: secret/configmap reads, rolebinding changes, pod exec, anonymous or unusual user agents.
- Baseline automation: CI, GitOps, and some monitoring agents can read several resource types during sync; exclude
  known service accounts or source networks if noisy.

### False positive analysis

- Platform operators or runbooks that reconcile RBAC and workload state may legitimately span these resource types in
  a short window; tune by user, IP allowlist, or user agent when documented.
- Some installers briefly query namespaces, pods, and roles during upgrades—correlate with change windows.

### Response and remediation

- If malicious, revoke or rotate the implicated credentials, review and tighten RBAC, and inspect for data access or
  persistence established after the burst.
"""
references = [
    "https://attack.mitre.org/techniques/T1613/",
    "https://microsoft.github.io/Threat-Matrix-for-Kubernetes/",
]
risk_score = 47
rule_id = "c2a91e88-4f4b-4e1d-9c7b-8fde112a9403"
severity = "medium"
tags = [
    "Data Source: Kubernetes",
    "Domain: Kubernetes",
    "Use Case: Threat Detection",
    "Tactic: Discovery",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "esql"
query = '''
from logs-kubernetes.audit_logs-* metadata _id, _index, _version
| eval Esql.time_interval = date_trunc(1 minute, @timestamp)
| where event.dataset == "kubernetes.audit_logs"
    and event.action in ("get", "list")
    and kubernetes.audit.objectRef.resource in ("namespaces", "nodes", "pods", "roles", "configmaps", "serviceaccounts", "clusterroles", "clusterrolebindings", "rolebindings")
    and source.ip is not null and user.name IS NOT NULL
    and not to_string(source.ip) in ("127.0.0.1", "::1")
    and not user.name rlike """(system:serviceaccount:kube-system:|eks:|system:kube-|arn:aws:sts::.*:assumed-role/AWSServiceRoleForAmazonEKS/|system:serviceaccount:kube-system:azure|system:node:aks-default|aksService).*""" 
    and not kubernetes.audit.user.username in ("system:serviceaccount:flux-system:kustomize-controller", "system:serviceaccount:flux-system:helm-controller", "system:serviceaccount:flux-system:source-controller", "system:serviceaccount:security:trivy-operator")
| stats
    Esql.unique_resources = count_distinct(kubernetes.audit.objectRef.resource),
    Esql.enumerated_resources = values(kubernetes.audit.objectRef.resource),
    Esql.enumerated_namespaces = values(kubernetes.audit.objectRef.namespace),
    Esql.decisions = values(`kubernetes.audit.annotations.authorization_k8s_io/decision`)
  by user.name, kubernetes.audit.user.username, source.ip, user_agent.original, Esql.time_interval
| where Esql.unique_resources >= 3
| keep Esql.*, kubernetes.audit.user.username, user.name, source.ip, user_agent.original
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1613"
name = "Container and Resource Discovery"
reference = "https://attack.mitre.org/techniques/T1613/"

[rule.threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"

[metadata]
bypass_bbr_timing = true
creation_date = "2026/05/04"
integration = ["kubernetes"]
maturity = "production"
updated_date = "2026/05/04"

[rule]
author = ["Elastic"]
building_block_type = "default"
description = """
Detects successful Kubernetes pod creation requests using commonly abused base and debugging container
images such as BusyBox, Alpine, Ubuntu, Netshoot, and network multitool variants. These images are
frequently used by attackers to deploy short-lived or interactive "throwaway" containers for
reconnaissance, payload staging, or command execution due to their small footprint or built-in tooling.
"""
index = ["logs-kubernetes.audit_logs-*"]
language = "kuery"
license = "Elastic License v2"
name = "Kubernetes Pod Creation Using Common Debug or Base Images"
risk_score = 21
rule_id = "93120a05-caf5-47f6-a305-e8abee463fb9"
severity = "low"
tags = [
    "Data Source: Kubernetes",
    "Domain: Kubernetes",
    "Use Case: Threat Detection",
    "Tactic: Execution",
    "Tactic: Defense Evasion",
    "Rule Type: BBR",
    ]
timestamp_override = "event.ingested"
type = "new_terms"
query = '''
event.dataset:"kubernetes.audit_logs" and
kubernetes.audit.stage:"ResponseComplete" and
kubernetes.audit.annotations.authorization_k8s_io/decision:"allow" and
kubernetes.audit.objectRef.resource:"pods" and
kubernetes.audit.verb:"create" and
kubernetes.audit.requestObject.spec.containers.image:(alpine* or busybox* or ubuntu\:* or debian\:* or *netshoot\:* or *network-multitool\:* or *curl\:*)
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[[rule.threat.technique]]
id = "T1610"
name = "Deploy Container"
reference = "https://attack.mitre.org/techniques/T1610/"

[[rule.threat.technique]]
id = "T1609"
name = "Container Administration Command"
reference = "https://attack.mitre.org/techniques/T1609/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[[rule.threat.technique]]
id = "T1610"
name = "Deploy Container"
reference = "https://attack.mitre.org/techniques/T1610/"

[rule.new_terms]
field = "new_terms_fields"
value = ["source.ip", "user_agent.original", "user.name"]

[[rule.new_terms.history_window_start]]
field = "history_window_start"
value = "now-5d"

[metadata]
creation_date = "2025/08/20"
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2026/09/10"

[rule]
author = ["Elastic"]
description = """
Identifies DNS queries to commonly abused Top Level Domains by common LOLBINs or executables running from world writable
directories or unsigned binaries. This behavior matches on common malware C2 abusing less formal domain names.
"""
from = "now-9m"
index = [
    "endgame-*",
    "logs-endpoint.events.network-*",
    "logs-sentinel_one_cloud_funnel.*",
    "logs-crowdstrike.fdr*",
    "logs-windows.sysmon_operational-*",
    "winlogbeat-*"
]
language = "eql"
license = "Elastic License v2"
name = "Network Activity to a Suspicious Top Level Domain"
references = ["https://www.cybercrimeinfocenter.org/top-20-tlds-by-malicious-phishing-domains"]
risk_score = 73
rule_id = "e516bf56-d51b-43e8-91ec-9e276331f433"
severity = "high"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Command and Control",
    "Resources: Investigation Guide",
    "Data Source: Elastic Endgame",
    "Data Source: Elastic Defend",
    "Data Source: SentinelOne",
    "Data Source: Crowdstrike",
    "Data Source: Sysmon",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
network where host.os.type == "windows" and dns.question.name != null and
 (
  process.name : ("MSBuild.exe", "mshta.exe", "wscript.exe", "powershell.exe", "pwsh.exe", "msiexec.exe", "rundll32.exe",
                  "bitsadmin.exe", "InstallUtil.exe", "python.exe", "regsvr32.exe", "dllhost.exe", "node.exe", "curl.exe",
                  "java.exe", "javaw.exe", "*.pif", "*.com", "*.scr") or
  (?process.code_signature.trusted == false or ?process.code_signature.exists == false) or
  ?process.code_signature.subject_name : ("AutoIt Consulting Ltd", "OpenJS Foundation", "Python Software Foundation") or
  ?process.executable : (
    "?:\\Users\\Public\\*.exe", "?:\\ProgramData\\*.exe", "?:\\Users\\*\\Downloads\\*.exe",
    "\\Device\\HarddiskVolume*\\Users\\Public\\*.exe", "\\Device\\HarddiskVolume*\\ProgramData\\*.exe", "\\Device\\HarddiskVolume*\\Users\\*\\Downloads\\*.exe"
  )
 ) and
dns.question.name regex """.*\.(top|buzz|xyz|rest|ml|cf|gq|ga|onion|monster|cyou|quest|cc|bar|cfd|click|cam|surf|tk|shop|club|icu|pw|ws|online|fun|life|boats|store|hair|skin|motorcycles|christmas|lol|makeup|mom|bond|beauty|biz|live|work|zip|country|accountant|date|party|science|loan|win|men|faith|review|racing|download|host|zone)""" and

not process.executable : (
    "?:\\ProgramData\\Microsoft\\Windows Defender\\platform\\*\\*.exe",
    "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\platform\\*\\*.exe",
    "?:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\Platform\\Versions\\*\\*.exe",
    "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\Platform\\Versions\\*\\*.exe"
)
'''

note = """## Triage and analysis

### Investigating Network Activity to a Suspicious Top Level Domain

#### Possible investigation steps

- Does the alert-local DNS result and domain shape fit the process role?
  - Focus: the alert's `event.action`, `dns.question.name`, `dns.Ext.status`, and `dns.resolved_ip`; use "lookup_result" for resolved IPs and "lookup_requested" for failed or request-only lookups.
  - Implication: concern rises when the name is algorithmic, newly introduced for that tool, or resolves to unrelated external infrastructure; weaker when the lookup fails immediately or the domain matches a known vendor pattern for that process, but a failed lookup alone does not clear the process. `.onion` lookups signal Tor hidden-service resolution -- treat these as elevated concern and look for Tor binaries or proxy configuration.

- Is the alerting binary the expected tool in the expected install context?
  - Focus: `process.executable`, `process.code_signature.subject_name`, `process.code_signature.trusted`, and `process.pe.original_file_name`.
  - Implication: more concerning when the binary is unsigned, renamed, user-writable, or inconsistent with its usual signer. Identity alone does not clear the DNS behavior.

- Does the command line and launch chain fit a legitimate workflow?
  - Focus: `process.command_line`, `process.parent.executable`, and `process.parent.command_line`.
  - Implication: more concerning if a document, script, or unexpected launcher started the process, or if the arguments look staged or evasive.

- Does the same process resolve the domain and then communicate with the returned infrastructure?
  - Why: a suspicious DNS lookup carries more weight when the same process reuses the returned IPs for follow-on connections or transfer behavior in the same window.
  - Focus: process-scoped "lookup_result" and connection events on the same `host.id`, using `dns.resolved_ip` to bridge `dns.question.name` to `destination.ip`; treat `destination.as.organization.name` as ownership context rather than a verdict. $investigate_2
  - Hint: if the transform returns no results, broaden to host-scoped network events around the alert time.
  - Implication: escalate when the same process repeatedly resolves the domain, connects to the returned IPs, or shows suspicious transfer patterns; lower suspicion when activity is limited to a one-off lookup with no matching connection behavior. Missing follow-on network telemetry is unresolved, not benign.

- Do file events or child processes from the same process chain show download-and-execute or artifact staging?
  - Focus: same-host file and process activity around the alert time, scoped to the alert's `process.entity_id`, with attention to `file.path`, `file.origin_url`, `file.Ext.windows.zone_identifier`, and later `process.executable` reuse of a written path.
  - Hint: if file coverage is missing, keep the artifact review bounded to the same host, lineage, and alert window rather than treating the lookup as harmless.
  - Implication: staging risk rises when the chain writes scripts, archives, or executables to user-writable paths and later runs them.

- Does the same process chain pivot to direct-IP traffic, lookalike domains, or TLD rotation that this rule would miss?
  - Why: attackers often keep the same process chain but swap to a nearby domain, a different abusive TLD, or direct-IP egress after the first lookup.
  - Focus: reuse the process-scoped network results from the prior step to look for direct `destination.ip` connections with no preceding DNS, sibling `dns.question.name` values under different TLDs, or repeated reuse of the same `dns.resolved_ip` across multiple domains. $investigate_2
  - Implication: escalate when the process shifts from the flagged lookup to direct-IP traffic, nearby domain variants, or fast domain and TLD rotation on the same infrastructure; lower suspicion when surrounding DNS stays limited to one recognized vendor domain family with no adjacent variant traffic.

- If the local DNS, process, or artifact evidence stays suspicious or unresolved, does related alert history show this DNS pattern is isolated or part of broader compromise?
  - Focus: related alerts for the same `host.id` and `user.id` in the last 48 hours to test whether the same lineage, domain family, or follow-on activity recurs on the asset or follows the user across hosts.
    - $investigate_0
    - $investigate_1
  - Implication: broaden scope when the host or user view shows repeated suspicious lineage, related delivery or persistence alerts, or reuse of the same infrastructure on other assets; keep scope narrow when the pattern stays confined to one recognized workflow with no contradictory evidence.

- Escalate when DNS fit, process context, follow-on communication, artifacts, or variant traffic point to unauthorized C2 or delivery; close only when all evidence aligns with a recognized benign workflow; if mixed or incomplete, preserve and escalate.

### False positive analysis

- Software distribution, developer tooling, or security-testing workflows can legitimately query less common TLDs. Confirm by matching the same `process.executable`, `process.code_signature.subject_name`, `dns.question.name` family, and `host.id` across prior alerts or against workflow records.
- Before creating an exception, build on `process.executable`, `process.code_signature.subject_name`, the `dns.question.name` family, and `host.id` or `user.id`. Avoid exceptions on the TLD alone, `process.name` alone, or `host.id` alone.

### Response and remediation

- If confirmed benign, reverse any temporary containment and document the `process.executable`, `process.code_signature.subject_name`, `process.parent.command_line`, `dns.question.name` family, and bounded `host.id` or `user.id` scope that proved the workflow. Create an exception only if that same pattern recurs consistently across prior alerts from this rule.
- If suspicious but unconfirmed, first preserve `dns.question.name`, `dns.resolved_ip`, connected `destination.ip` values, the alert's `process.entity_id`, `process.command_line`, `process.parent.command_line`, and any staged `file.path` values. Then apply reversible containment such as temporary DNS or egress blocks for the observed infrastructure or heightened monitoring on `host.id`. Escalate to host isolation only if the preserved evidence shows likely follow-on communication or staging and the asset role can tolerate stronger containment.
- If confirmed malicious, document the alert's `process.entity_id`, `process.command_line`, `process.parent.command_line`, written `file.path` artifacts, and connected `dns.question.name` or `destination.ip` infrastructure before initiating response actions. Prefer endpoint isolation as the first containment step; if direct endpoint response is unavailable, escalate with the preserved artifact set to the team that can isolate the host. Block the confirmed malicious domains and direct-IP destinations before terminating processes or deleting files.
- After containment, review other `host.id` and `user.id` alerts for the same `dns.question.name`, `destination.ip`, or `process.executable` pattern before deleting artifacts or restoring access. Then eradicate staged binaries, scripts, and any persistence or proxy changes identified during the file or variant review, and remediate the entry path that allowed the suspicious process to run. If the same suspicious window includes credential, admin-tool, or remote-session alerts, review those sessions for follow-on misuse and reset exposed credentials when the evidence supports compromise.
"""

setup = """## Setup

This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.

Setup instructions: https://ela.st/install-elastic-defend

### Additional data sources

This rule also supports the following third-party data sources. For setup instructions, refer to the links below:

- [CrowdStrike](https://ela.st/crowdstrike-integration)
- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
- [Sysmon Event ID 3 - Network Connection](https://ela.st/sysmon-event-3-setup)
"""

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "host.name",
    "host.id",
    "user.name",
    "user.id",
    "process.name",
    "process.executable",
    "process.entity_id",
    "process.pid",
    "process.code_signature.subject_name",
    "process.code_signature.trusted",
    "dns.question.name",
    "dns.resolved_ip",
    "event.action",
]

[[transform.investigate]]
label = "Alerts associated with the user"
description = ""
providers = [
  [
    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
    { excluded = false, field = "user.id", queryType = "phrase", value = "{{user.id}}", valueType = "string" }
  ]
]
relativeFrom = "now-48h/h"
relativeTo = "now"

[[transform.investigate]]
label = "Alerts associated with the host"
description = ""
providers = [
  [
    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" }
  ]
]
relativeFrom = "now-48h/h"
relativeTo = "now"

[[transform.investigate]]
label = "Network activity for the alerting process"
description = ""
providers = [
  [
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" },
    { excluded = false, field = "event.category", queryType = "phrase", value = "network", valueType = "string" }
  ]
]
relativeFrom = "now-1h"
relativeTo = "now"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"

[[rule.threat.technique.subtechnique]]
id = "T1071.004"
name = "DNS"
reference = "https://attack.mitre.org/techniques/T1071/004/"

[rule.threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1127"
name = "Trusted Developer Utilities Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1127/"

[[rule.threat.technique.subtechnique]]
id = "T1127.001"
name = "MSBuild"
reference = "https://attack.mitre.org/techniques/T1127/001/"

[[rule.threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[metadata]
creation_date = "2023/08/29"
integration = ["github"]
maturity = "production"
updated_date = "2026/04/10"

[rule]
author = ["Elastic"]
description = """
This rule detects when a new GitHub App has been installed in your organization account. GitHub Apps extend GitHub's
functionality both within and outside of GitHub. When an app is installed it is granted permissions to read or modify
your repository and organization data. Only trusted apps should be installed and any newly installed apps should be
investigated to verify their legitimacy. Unauthorized app installation could lower your organization's security posture
and leave you exposed for future attacks.
"""
from = "now-9m"
index = ["logs-github.audit-*"]
language = "eql"
license = "Elastic License v2"
name = "New GitHub App Installed"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating New GitHub App Installed

GitHub Apps enhance functionality by integrating with repositories and organization data, requiring careful scrutiny upon installation. Adversaries may exploit these apps to gain unauthorized access or manipulate data. The detection rule monitors audit logs for new app installations, flagging potential threats by identifying unauthorized or suspicious integrations, thus safeguarding organizational security.

### Possible investigation steps

- Review the audit logs for the specific event.dataset "github.audit" and event.action "integration_installation.create" to identify the newly installed GitHub App.
- Verify the identity of the user or service account that performed the installation to ensure it aligns with expected behavior and authorized personnel.
- Check the permissions requested by the newly installed app to assess the level of access it has to your repositories and organization data.
- Cross-reference the app with a list of approved or trusted applications within your organization to determine if it is authorized.
- Investigate the app's developer or vendor to ensure they are reputable and have a history of secure and reliable applications.
- Communicate with the team or individual responsible for the installation to confirm the app's purpose and necessity within the organization.

### False positive analysis

- Frequent installations of trusted internal apps may trigger alerts. To manage this, maintain a list of approved internal apps and create exceptions for these in the detection rule.
- Automated deployment tools that integrate with GitHub might cause false positives. Identify these tools and exclude their installation events from triggering alerts.
- Regular updates or re-installations of existing apps can be mistaken for new installations. Track app version updates separately and adjust the rule to differentiate between updates and new installations.
- Development or testing environments often install and remove apps frequently. Consider excluding these environments from the rule or setting up a separate monitoring process for them.

### Response and remediation

- Immediately revoke the permissions of the newly installed GitHub App to prevent any unauthorized access or data manipulation.
- Notify the security team and relevant stakeholders about the unauthorized app installation for awareness and further investigation.
- Conduct a review of recent repository and organization changes to identify any unauthorized modifications or data access that may have occurred.
- If malicious activity is detected, initiate a rollback of affected repositories to a secure state prior to the app installation.
- Escalate the incident to higher-level security management if the app installation is linked to a broader security breach or if sensitive data has been compromised.
- Implement stricter access controls and approval processes for future GitHub App installations to prevent unauthorized installations.
- Update detection mechanisms to include additional indicators of compromise related to GitHub App installations, enhancing future threat detection capabilities."""
risk_score = 47
rule_id = "1ca62f14-4787-4913-b7af-df11745a49da"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Use Case: Threat Detection",
    "Tactic: Execution",
    "Data Source: Github",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
configuration where data_stream.dataset == "github.audit" and event.action == "integration_installation.create"
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1072"
name = "Software Deployment Tools"
reference = "https://attack.mitre.org/techniques/T1072/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1199"
name = "Trusted Relationship"
reference = "https://attack.mitre.org/techniques/T1199/"

[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[rule]
description = """
Identifies attempt to abuse a thread debug registers along with malicious exception handlers to hijack the normal
execution flow of a thread. This provides an adversary an advantage to inject commands to perform unexpected, unwanted,
or malicious operations.
"""
id = "a10e7b14-4b7b-4a34-b3f6-64791c1114b3"
license = "Elastic License v2"
name = "Potential Evasion with Hardware Breakpoints"
os_list = ["windows"]
reference = ["https://github.com/rad9800/hwbp4mw"]
version = "1.0.20"

query = '''
library where process.thread.Ext.hardware_breakpoint_set == true and process.executable != null and
   dll.name : ("wininet.dll", "ws2_32.dll", "dnsapi.dll", "winhttp.dll", "clr.dll", "netapi32.dll",
                "mscorwks.dll", "System.*.dll", "mscorlib*.dll", "Microsoft.PowerShell.Security*.dll", 
                "Microsoft.PowerShell.ConsoleHost*.dll", "wmiutils.dll", "fastprox.dll", "wbemprox.dll", 
                "vaultcli.dll", "taskschd.dll", "dsquery.dll", "mstscax.dll", "ntdll.dll", "wldap32.dll", 
                "wtsapi32.dll", "psapi.dll") and
 not (process.code_signature.trusted == true and 
      process.code_signature.subject_name : 
                ("Riot Games, Inc.", "Roblox Corporation", "ROBLOX CORPORATION", "Intelligent Security Systems Corporation", 
                 "Famatech Corp.", "Nuance Communications, Inc.", "Blizzard Entertainment, Inc.", "Kofax, Inc.", "KRAFTON, Inc.",
                 "Guidance Software, Inc.", "Open Text Corporation", "CUMMINS INC.", "Cockos Incorporated", "ByteSphere Technologies LLC",
                 "PROMICRA, s.r.o.", "Avid Technology, Inc.", "Avid Technology, Inc", "Krzysztof Kowalczyk",
                 "Yummy Interactive Inc", "Caliper Corporation", "Tencent Technology (Shenzhen) Company Limited",
                 "Big Fish Games, Inc.", "Big Fish Games", "GdP Software", "Tonec Inc.", "Active Database Software LLC",
                 "URSoft, Inc.", "Respondus, Inc.", "Meta Enterprises LLC", "Epic Games Inc.", "Valve Corp.",
                 "Medical Information Technology, Inc.")) and
 not _arraysearch(process.thread.Ext.call_stack, $entry,
                  $entry.symbol_info : ("?:\\Windows\\apppatch\\AppPatch64\\exploitblocker.dll!*",
                                        "?:\\Windows\\apppatch\\exploitblocker.dll*",
                                        "?:\\Windows\\AppPatch\\emet.dll!*",
                                        "?:\\Windows\\AppPatch\\apppatch64\\emet.dll!*",
                                        "?:\\Windows\\AppPatch\\emet64.dll!*",
                                        "?:\\Windows\\AppPatch\\apppatch64\\emet64.dll!*")) and
 not process.executable : ("C:\\Program Files (x86)\\Cambridge\\CEPD - 17th Edition\\cepd17.exe",
                           "C:\\Program Files (x86)\\SCRABBLE\\GHScrabble.exe",
                           "C:\\Program Files (x86)\\Kofax\\Power PDF 31\\NPDFLM.exe",
                           "C:\\Program Files (x86)\\Common Files\\ExpertGPS\\ExpertGPS.exe",
                           "C:\\Program Files (x86)\\IBH softec GmbH\\S57W\\S57W.exe",
                           "C:\\Program Files (x86)\\Microsoft Games\\Age of Empires III\\age3y.exe",
                           "C:\\Program Files (x86)\\TheLearningPit\\LogixPro\\LPovl.exe",
                           "C:\\Program Files (x86)\\iLok License Manager\\iLok License Manager.exe",
                           "C:\\Program Files (x86)\\Common Files\\PACE\\Services\\LicenseServices\\LDSvc.exe",
                           "C:\\Program Files (x86)\\NWPS\\SwitchPortMapper\\spmap.exe",
                           "C:\\Program Files (x86)\\Steam\\steamapps\\common\\Call of Duty Black Ops II\\t6zm.exe",
                           "C:\\Program Files (x86)\\Microsoft Office\\Office16\\MSACCESS.EXE",
                           "C:\\Program Files (x86)\\Boardmaker with SD Pro\\BM_SDP.exe",
                           "C:\\Program Files (x86)\\Nuance\\Power PDF 20\\NPDFLM.exe",
                           "C:\\ProgramData\\Big Fish\\Game Manager\\Addons\\gmActivator.exe",
                           "C:\\Program Files (x86)\\Boardmaker with SD Pro\\BM_SDP.exe",
                           "C:\\Program Files (x86)\\Nuance\\PDF Professional 6\\PdfPro6Hook.exe",
                           "C:\\Program Files (x86)\\FormTool 7\\Program\\FormTool.exe",
                           "D:\\DesktopAPP\\SteamDesktop\\steamapps\\common\\VRChat\\VRChat.exe",
                           "C:\\Program Files (x86)\\Christmas Wonderland 15 Collectors Edition\\kcfjhdd.exe",
                           "C:\\Program Files (x86)\\Sea Life Explorer Collectors Edition\\fqlkpjx.exe",
                           "C:\\Program Files (x86)\\Hidden Differences - World Tour\\cgrtmwc.exe",
                           "\\Device\\HarddiskVolume4\\Program Files (x86)\\WeGame\\tenprotect\\TASLogin.exe",
                           "C:\\Program Files (x86)\\Hunter\\Aligner\\Execute\\aligner.exe",
                           "D:\\Program Files (x86)\\NWPS\\SwitchPortMapper\\spmap.exe",
                           "C:\\Program Files (x86)\\Ultra Screen Saver Maker\\ussm.exe") and
 not (process.executable : "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" and dll.name == "ws2_32.dll" and
      process.thread.Ext.call_stack_summary == "Unbacked" and
      _arraysearch(process.thread.Ext.call_stack, $entry,
       $entry.callsite_trailing_bytes == "c3cd2ec30f1f84000000000000000000000000000000000000000000000000000000000000000000000000004c8bd1b82a000000f604250803fe7f0175030f05")) and
 not (endswith~(process.thread.Ext.call_stack_summary, concat("ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|", process.name)) and
      _arraysearch(process.thread.Ext.call_stack, $entry, $entry.protection : "RWX" and $entry.allocation_private_bytes >= 100000 and stringcontains~($entry.symbol_info, process.name))) and
 not (dll.name : "wininet.dll" and process.thread.Ext.call_stack_summary == "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|sscprot.dll|ntdll.dll|kernelbase.dll|combase.dll|shellhelper32.dll|calipermtxf.dll")
'''

min_endpoint_version = "8.11.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"

[[threat.technique]]
id = "T1574"
name = "Hijack Execution Flow"
reference = "https://attack.mitre.org/techniques/T1574/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.11.0"

[metadata]
creation_date = "2025/04/16"
maturity = "production"
updated_date = "2026/05/01"

[rule]
author = ["Elastic"]
description = """
Identifies PowerShell script blocks linked to multiple distinct PowerShell detections via the same ScriptBlock ID,
indicating compound suspicious behavior. Attackers often chain obfuscation, decoding, and execution within a single
script block.
"""
from = "now-9m"
language = "esql"
license = "Elastic License v2"
name = "Potential Malicious PowerShell Based on Alert Correlation"
risk_score = 73
rule_id = "f770ce79-05fd-4d74-9866-1c5d66c9b34b"
severity = "high"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Execution",
    "Rule Type: Higher-Order Rule",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "esql"

query = '''
from .alerts-security.* metadata _id

// Filter for PowerShell related alerts
| where kibana.alert.rule.name like "*PowerShell*"

// as alerts don't have non-ECS fields, parse the script block ID using grok
| grok message "ScriptBlock ID: (?<Esql.script_block_id>.+)"
| where Esql.script_block_id is not null

// keep relevant fields for further processing
| keep kibana.alert.rule.name, Esql.script_block_id, _id, user.id, process.pid, host.id

// count distinct alerts and filter for matches above the threshold
| stats
    Esql.kibana_alert_rule_name_count_distinct = count_distinct(kibana.alert.rule.name),
    Esql.kibana_alert_rule_name_values = values(kibana.alert.rule.name),
    Esql._id_values = values(_id),
    Esql.user_id_values = values(user.id),
    Esql.process_pid_values = values(process.pid),
    Esql.host_id_values = values(host.id)
  by Esql.script_block_id

// Apply detection threshold
| where Esql.kibana_alert_rule_name_count_distinct >= 5
| eval user.id = MV_MIN(Esql.user_id_values),
       process.pid = MV_MIN(Esql.process_pid_values),
       host.id = MV_MIN(Esql.host_id_values)
| keep host.id, user.id, process.pid, Esql.*
'''

note = """## Triage and analysis

### Investigating Potential Malicious PowerShell Based on Alert Correlation

#### Possible investigation steps

- What does the ES|QL grouped alert preserve about the suspicious PowerShell mix?
  - Focus: treat `Esql.script_block_id`, `Esql.kibana_alert_rule_name_values`, `Esql._id_values`, preserved `host.id` / `user.id`, and `Esql.kibana_alert_rule_name_count_distinct` as search clues, not evidence.
  - Implication: escalate if rule names span obfuscation, download, execution, persistence, credential access, or defense evasion for one host/user; lower suspicion only when recovered source alerts/events show one recognized detection-validation script or controlled encoded-content automation pattern.

- Do the contributing alerts bind the summary to one script execution?
  - Focus: recover contributing alerts around grouped-alert time using preserved host/user, `Esql.kibana_alert_rule_name_values`, and script-block ID; use `Esql._id_values` only when alert search supports those IDs.
  - Hint: recover contributing alerts before interpreting grouped behavior; ES|QL grouped alerts lack member-event Timeline pivots and reliable source-event time, PID, or entity anchors.
  - Implication: treat as one execution chain only when source alerts and events align to one host, one user, one source-event window, and one script-block ID; keep unresolved if timestamps, script evidence, PID reuse risk, or entity scope conflict.

- Can you reconstruct and interpret the source PowerShell script block?
  - Focus: using recovered source-event host, process, and time, query PowerShell 4104 or source events; match `powershell.file.script_block_id`, order `powershell.sequence` / `powershell.total`, and read script-block text.
  - Implication: escalate when reconstructed text shows encoded/decoded stages, download cradles, reflection, hosted System.Management.Automation execution, credential access, persistence, or defense evasion; missing fragments or source PowerShell telemetry are unresolved, not benign.

- Which process and launch chain executed the script block?
  - Focus: use recovered time, `host.id`, and process identifiers to find the process start; collect `process.entity_id`, `process.command_line`, `process.parent.command_line`, and `process.Ext.authentication_id`.
  - Hint: if no process start appears, expand time first; if still missing, scope later file, registry, and network review to recovered source-event host/user/process/time.
  - Implication: escalate when the launcher is a document, browser, remote-management tool, scheduled task, unexpected script or .NET host, or command line with encoded, hidden, bypass, download, or dynamic evaluation; lower suspicion only when the same parent, command, user, and host bind to the exact recovered benign workflow.

- Did the process stage payloads, persistence, or security-impacting changes?
  - Focus: scope file and registry events to recovered `process.entity_id` or fallback source-event host/PID/time context; review `file.path`, `file.origin_url`, `registry.path`, `registry.value`, and `registry.data.strings`.
  - Implication: escalate when the script writes executable or scriptable content to user-writable or startup paths, leaves internet provenance, modifies persistence or security keys, or later executes staged content; lower suspicion only when artifacts stay inside the exact recovered benign workflow. Missing file or registry telemetry does not clear the alert.

- Did network or session evidence fit offensive PowerShell use?
  - Focus: scope DNS/connections to recovered `process.entity_id` or source-event host/PID/time context; read `dns.question.name`, `destination.ip`, and `destination.port`; when origin matters, bridge `process.Ext.authentication_id` to `winlog.event_data.TargetLogonId`.
  - Implication: escalate when the script reaches rare or public destinations, pulls content, contacts infrastructure unrelated to the recovered workflow, or runs from an unexpected remote session; missing network or Windows Security telemetry is unresolved, not benign.

- If local evidence is suspicious or unresolved, does the same pattern recur elsewhere enough to change scope?
  - Focus: related alerts for preserved `user.id` over 48 hours, looking for the same `Esql.kibana_alert_rule_name_values`, reconstructed script fragment, launch context, or extracted indicators. $investigate_0
  - Hint: if user-scoped alerts are quiet or ambiguous, compare related alerts for preserved `host.id` over 48 hours. $investigate_1
  - Implication: broaden response when the same script body, rule-name mix, or indicators appear on unrelated hosts or users; keep scope local when recurrence stays on the host under review, but do not close from recurrence alone.

- Weigh contributing-alert alignment, reconstructed script, launch chain, artifacts, destinations, and host/user scope; escalate for offensive tooling, unauthorized execution, staged payloads, persistence, or suspicious destinations; close only when source evidence binds to one exact benign workflow, using outside confirmation only for facts telemetry cannot prove; preserve artifacts and escalate on conflicts or missing telemetry.

### False positive analysis

- Authorized red-team, lab, or detection-validation can trigger several PowerShell rules on one script. Confirm alert mix, reconstructed script, launch chain, `user.id`, and `host.id` match exact test scope; if records are unavailable, recurrence can support scoping but cannot close the alert.
- Endpoint management or deployment automation can trigger multiple detections through encoded content, dynamic script generation, or controlled downloads. Confirm `powershell.file.script_block_text`, parent/child command lines, artifacts, and destinations align with one managed workflow. If script body, destinations, or follow-on artifacts diverge, do not close as benign.
- Before an exception, validate stable benign anchors: `user.id`, `host.id`, parent/child command lines, script fragment, and destination or artifact pattern. Avoid exceptions on ES|QL summary fields or `Esql.script_block_id`; they are alert-local or execution-specific.

### Response and remediation

- If confirmed benign, document the alert mix, reconstructed script, launch chain, and recovered host/user context before reversing containment. Build exceptions from stable recovered workflow anchors, not ES|QL summary fields alone.
- If suspicious but unconfirmed, preserve contributing alerts, `Esql._id_values`, `Esql.script_block_id`, rule-name values, reconstructed script text, recovered parent/child command lines, file/registry paths, and DNS/destination indicators before cleanup. Apply reversible containment first, such as temporary destination restrictions or heightened monitoring on recovered `host.id` and `user.id`; isolate or strengthen account action only if the script is still executing, staging payloads, or reaching suspicious destinations and host role allows.
- If confirmed malicious, record entity IDs, command lines, and indicators, then isolate the host when lateral-movement or active-payload risk is present. Stop the PowerShell process or descendants only after preserving evidence; if direct response is unavailable, escalate with the evidence set. Block confirmed malicious destinations, URLs, hashes, and script paths; eradicate only tied files, registry changes, tasks, services, and payloads; remediate the launch path; and review related hosts/users before destructive cleanup.
- Post-incident hardening: preserve or expand PowerShell 4104 logging, source-alert retention, endpoint process telemetry, and Windows Security logs when gaps limited recovery; where operations allow, restrict high-risk PowerShell through signed scripts, Constrained Language Mode, JEA, or WinRM controls. Document the rule-name mix, observables, and adjacent variants such as indirect System.Management.Automation execution.
"""

[rule.investigation_fields]
field_names = [
    "host.id",
    "user.id",
    "process.pid",
    "Esql.script_block_id",
    "Esql._id_values",
    "Esql.kibana_alert_rule_name_values",
    "Esql.kibana_alert_rule_name_count_distinct",
]

[transform]

[[transform.investigate]]
label = "Alerts associated with the user"
description = ""
providers = [
  [
    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
    { excluded = false, field = "user.id", queryType = "phrase", value = "{{user.id}}", valueType = "string" }
  ]
]
relativeFrom = "now-48h/h"
relativeTo = "now"

[[transform.investigate]]
label = "Alerts associated with the host"
description = ""
providers = [
  [
    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" }
  ]
]
relativeFrom = "now-48h/h"
relativeTo = "now"

[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[rule.threat.technique.subtechnique]]
id = "T1059.001"
name = "PowerShell"
reference = "https://attack.mitre.org/techniques/T1059/001/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"