Elastic rules: 2t

[metadata]
creation_date = "2026/07/08"
integration = ["aws_bedrock"]
maturity = "production"
updated_date = "2026/07/08"

[rule]
author = ["Elastic"]
description = """
Identifies an Amazon Bedrock model invocation whose prompt or completion contains an AWS access key identifier
(AKIA long-term or ASIA temporary/STS, followed by 16 characters), an Amazon Bedrock API key (ABSK bearer token),
or a PEM private-key block. Credentials in the model input mean an
application or user is sending secrets to the model, exposing them to invocation logging, the model provider, and
prompt history; credentials in the model output mean the model is emitting secrets, which can result from
training-data leakage, poisoned context, or a prompt-injection-driven exfiltration attempt. Either case is a
credential-exposure event that warrants immediate rotation of the affected secret.
"""
false_positives = [
    """
    Prompts or completions that reference example or documentation keys (for example the AWS sample access key ending
    in EXAMPLE) match the access-key pattern. Review the matched value in "gen_ai.prompt" or "gen_ai.completion" and
    confirm whether it is a live credential before responding.
    """,
]
from = "now-60m"
interval = "10m"
language = "esql"
license = "Elastic License v2"
name = "AWS Bedrock Model Prompt or Completion Containing Credentials"
note = """## Triage and analysis

### Investigating AWS Bedrock Model Prompt or Completion Containing Credentials

Bedrock model invocation logging records the full request and response of each InvokeModel/Converse call. This rule scans the decoded prompt and completion for live-credential patterns: AWS access key IDs (AKIA/ASIA followed by 16 characters) and PEM private-key headers. A credential in the prompt indicates secrets are being sent to the model (and persisted in logs and, for hosted models, to the provider); a credential in the completion indicates the model returned a secret, which is a sign of training-data or context leakage or a successful prompt-injection exfiltration.

### Possible investigation steps

- Review the matched value in "gen_ai.prompt" and "gen_ai.completion" and confirm whether it is a live credential or an example/placeholder.
- Identify the caller in "user.id" and the model in "aws_bedrock.invocation.model_id", and determine which application generated the invocation.
- If the credential is in the completion, review the prompt for injection or data-exfiltration instructions and check the model's knowledge base or context sources.
- Determine the scope and privileges of the exposed credential to gauge impact.

### False positive analysis

- Example or documentation keys (such as the AWS EXAMPLE key) match the pattern. Confirm the value is a real credential before escalating.

### Response and remediation

- If the credential is live, rotate or deactivate it immediately and review CloudTrail for any use of it.
- Identify and fix the application path that placed the credential into the prompt, and add input/output filtering (such as a Bedrock guardrail with a sensitive-information policy) to prevent recurrence.
"""
references = [
    "https://www.beyondtrust.com/blog/entry/aws-bedrock-security-guide-api-keys-detection-response",
]
risk_score = 47
rule_id = "68521f99-9b4f-40ef-a4e7-4d74794852b2"
setup = "This rule requires Amazon Bedrock model invocation logs ingested via the Elastic AWS Bedrock integration, with text data delivery enabled in the Bedrock model-invocation-logging configuration."
severity = "medium"
tags = [
    "Domain: LLM",
    "Data Source: AWS Bedrock",
    "Data Source: Amazon Web Services",
    "Use Case: Threat Detection",
    "Mitre Atlas: LLM06",
    "Resources: Investigation Guide",
    "Tactic: Credential Access"
]
timestamp_override = "event.ingested"
type = "esql"

query = '''
from logs-aws_bedrock.invocation-* metadata _id, _version, _index
| where event.action in ("ConverseStream", "Converse") AND 
   ( gen_ai.prompt rlike """.*(AKIA|ASIA)[A-Z0-9]{16}.*"""
    or gen_ai.completion rlike """.*(AKIA|ASIA)[A-Z0-9]{16}.*"""
    or gen_ai.prompt rlike """.*-----BEGIN [A-Z ]*PRIVATE KEY-----.*"""
    or gen_ai.completion rlike """.*-----BEGIN [A-Z ]*PRIVATE KEY-----.*"""
    or gen_ai.prompt rlike """.*ABSK[A-Za-z0-9+/=]{20}.*"""
    or gen_ai.completion rlike """.*ABSK[A-Za-z0-9+/=]{20}.*"""
    or gen_ai.prompt rlike """.*gh[pousr]_[A-Za-z0-9]{36}.*"""
    or gen_ai.completion rlike """.*gh[pousr]_[A-Za-z0-9]{36}.*"""
    or gen_ai.prompt rlike """.*github_pat_[A-Za-z0-9_]+.*"""
    or gen_ai.completion rlike """.*github_pat_[A-Za-z0-9_]+.*"""
    or gen_ai.prompt rlike """.*glpat-[A-Za-z0-9_\\-]+.*"""
    or gen_ai.completion rlike """.*glpat-[A-Za-z0-9_\\-]+.*""")
| keep _id, _version, _index, @timestamp, gen_ai.*, aws_bedrock.*, user.*, cloud.*, event.*
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"


[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[metadata]
creation_date = "2026/04/08"
integration = ["aws"]
maturity = "production"
updated_date = "2026/08/05"

[rule]
author = ["Elastic"]
description = """
Identifies successful IAM API calls that create a new customer managed policy version or set the default version for an
existing customer managed policy. Attackers with `iam:CreatePolicyVersion` or `iam:SetDefaultPolicyVersion` on a
privileged policy can introduce a permissive policy document and activate it, escalating effective permissions without
attaching a new policy. These APIs are high impact when the target policy is attached to powerful roles or users.
"""
false_positives = [
    """
    Infrastructure-as-code, CI/CD, and IAM administrators routinely publish new policy versions or roll back defaults.
    Validate the policy ARN, change tickets, and whether the policy document broadens permissions. Exclude automation
    roles or pipelines after review.
    """,
]
from = "now-6m"
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
language = "kuery"
license = "Elastic License v2"
name = "AWS IAM Customer Managed Policy Version Created or Default Version Set"
note = """## Triage and analysis

### Investigating AWS IAM Customer Managed Policy Version Created or Default Version Set

`CreatePolicyVersion` uploads a new immutable version of a customer managed policy. `SetDefaultPolicyVersion` switches
which version principals evaluate—immediately changing effective access if the policy is already attached.

#### Possible investigation steps

- From `aws.cloudtrail.request_parameters`, extract `policyArn`, `policyDocument` (if present), and `setAsDefault`.
- Map the policy ARN to attached users, groups, and roles; prioritize policies attached to admin or break-glass roles.
- Compare the new or selected version to prior versions in IAM or version history for added `Action`/`Resource` wildcards.
- Review `aws.cloudtrail.user_identity.arn`, `source.ip`, and `user_agent.original` for interactive vs automation context.
- Correlate with `AttachUserPolicy`, `AttachRolePolicy`, or `CreatePolicyVersion` spikes from the same principal.

### False positive analysis

- Planned policy releases and rollbacks are expected in mature shops; baseline known publishers.

### Response and remediation

- If malicious: set default to a known-good version, delete bad versions where supported, detach policy if necessary, and
  revoke excess `iam:*` on the actor.

### Additional information

- [CreatePolicyVersion](https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreatePolicyVersion.html)
- [SetDefaultPolicyVersion](https://docs.aws.amazon.com/IAM/latest/APIReference/API_SetDefaultPolicyVersion.html)
"""
references = [
    "https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreatePolicyVersion.html",
    "https://docs.aws.amazon.com/IAM/latest/APIReference/API_SetDefaultPolicyVersion.html",
    "https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/",
]
risk_score = 47
rule_id = "d4e8f0a1-2b3c-4d5e-a6f7-8b9c0d1e2f3a"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Domain: Identity",
    "Platform: AWS",
    "Data Source: AWS CloudTrail",
    "Service: AWS IAM",
    "Tactic: Privilege Escalation",
    "Rule Type: Custom Query (KQL)",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
event.dataset: "aws.cloudtrail"
    and event.provider: "iam.amazonaws.com"
    and event.action: ("CreatePolicyVersion" or "SetDefaultPolicyVersion")
    and event.outcome: "success"
    and not aws.cloudtrail.user_identity.type: "AWSService" 
    and not aws.cloudtrail.user_identity.arn:arn*/terraform 
    and not source.as.organization.name:(Amazon* or AMAZON* or "Google LLC" or "MongoDB, Inc.")
    and not source.address: ( "cloudformation.amazonaws.com" or "servicecatalog.amazonaws.com")
    and not user_agent.original: (*Terraform* or *Pulumi*)
'''

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user_agent.original",
    "source.ip",
    "aws.cloudtrail.user_identity.arn",
    "aws.cloudtrail.user_identity.type",
    "aws.cloudtrail.user_identity.access_key_id",
    "aws.cloudtrail.resources.arn",
    "aws.cloudtrail.resources.type",
    "event.action",
    "event.outcome",
    "cloud.account.id",
    "cloud.region",
    "aws.cloudtrail.request_parameters",
    "aws.cloudtrail.response_elements",
]

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"

[[rule.threat.technique]]
id = "T1548"
name = "Abuse Elevation Control Mechanism"
reference = "https://attack.mitre.org/techniques/T1548/"

[[rule.threat.technique.subtechnique]]
id = "T1548.005"
name = "Temporary Elevated Cloud Access"
reference = "https://attack.mitre.org/techniques/T1548/005/"

[rule.threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[rule]
description = """
Identifies the execution of a Chromium-based browser with the debugging process argument, which may indicate an attempt
to steal authentication cookies. An adversary may steal web application or service session cookies and use them to
access web applications or Internet services as an authenticated user without credentials.
"""
id = "09931e34-fe6b-4155-91ec-490d64fb72a2"
license = "Elastic License v2"
name = "Browser Debugging from Unusual Parent"
os_list = ["windows"]
reference = [
    "https://github.com/defaultnamehere/cookie_crimes",
    "https://embracethered.com/blog/posts/2020/cookie-crimes-on-mirosoft-edge/",
    "https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/post/multi/gather/chrome_cookies.md",
    "https://posts.specterops.io/hands-in-the-cookie-jar-dumping-cookies-with-chromiums-remote-debugger-port-34c4f468844e",
    "https://github.com/BishopFox/sliver/wiki/Cursed",
]
version = "1.0.24"

query = '''
process where event.type == "start" and
   process.name : ("chrome.exe", "msedge.exe") and not user.id : "S-1-5-18" and
   process.code_signature.trusted == true and
   process.parent.executable != null and
   process.args : ("--remote-debugging-port=*",
                   "--remote-debugging-targets=*",
                   "--remote-debugging-pipe=*") and
   process.args : "--user-data-dir=*" and not process.args:"--remote-debugging-port=0" and
   not (process.parent.name == "chrome.exe" and process.parent.args == "--remote-debugging-host=127.0.0.1") and
   not process.parent.executable : ("?:\\Program Files\\Microsoft VS Code\\Code.exe",
                                    "?:\\Program Files (x86)\\PRTG Network Monitor\\Sensor System\\reporter.exe",
                                    "?:\\Program Files\\nodejs\\node.exe",
                                    "?:\\Windows\\System32\\inetsrv\\w3wp.exe",
                                    "?:\\Program Files\\Google\\Chrome\\Application\\chrome.exe",
                                    "?:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe",
                                    "?:\\Program Files (x86)\\Brackets\\Brackets.exe",
                                    "?:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
                                    "?:\\Program Files\\Microsoft\\Edge\\Application\\msedge.exe",
                                    "?:\\Program Files\\OutSystems\\Development Environment*\\Service Studio\\ServiceStudio.exe",
                                    "?:\\Program Files (x86)\\CyberArk\\PSM\\Components\\chromedriver.exe",
                                    "?:\\Program Files\\Microsoft Visual Studio\\*\\node.exe",
                                    "?:\\Program Files (x86)\\Microsoft Visual Studio\\*\\node.exe",
                                    "?:\\Program Files (x86)\\Price Pro\\PricePro.exe",
                                    "?:\\Users\\*\\Versioning_SPCRepository\\SPCProcessor\\SPCEngine\\app.exe",
                                    "E:\\PRTG\\Sensor System\\reporter.exe" ,
                                    "E:\\eclipse\\chromedriver.exe",
                                    "c:\\ibi\\AppStudio82\\bin\\chromedriver.exe",
                                    "C:\\Windows\\chromedriver.exe",
                                    "?:\\Program Files\\Google\\Chrome Dev\\Application\\chrome.exe",
                                    "?:\\ibi\\AppStudio90\\bin\\chromedriver.exe",
                                    "?:\\Users\\*\\AppData\\Roaming\\nvm\\v*\\node.exe",
                                    "?:\\*\\bin\\cache\\dart-sdk\\bin\\dart.exe",
                                    "C:\\Users\\*\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe",
                                    "C:\\Program Files\\Python3??\\python.exe") and
   not (process.parent.executable : "?:\\Windows\\explorer.exe" and process.command_line : "*VisualStudio*") and
   not (process.parent.name : "chromedriver.exe" and process.parent.command_line : "*chromedriver.exe --port=*") and
   not (process.parent.executable : "?:\\Users\\*\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe" and
        process.parent.command_line : "*--ms-enable-electron-run-as-node*") and
   not (process.parent.name : "node.exe" and process.parent.args : "--code-coverage") and
   not process.args :
             ("--user-data-dir=?:\\Users\\*\\AppData\\Local\\JetBrains\\WebStorm*\\chrome-user-data-*",
              "--user-data-dir=?:\\Users\\*\\AppData\\Local\\Temp\\1\\flutter_tools.*\\flutter_tools_chrome_device.*") and
   not process.parent.args : "?:\\Program Files\\nodejs\\node.exe" and
   not (process.parent.code_signature.subject_name == "Google LLC" and process.parent.code_signature.trusted == true)
'''

min_endpoint_version = "8.14.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1539"
name = "Steal Web Session Cookie"
reference = "https://attack.mitre.org/techniques/T1539/"


[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "8.14.0"

[metadata]
creation_date = "2023/08/22"
integration = ["endpoint", "m365_defender", "sentinel_one_cloud_funnel", "windows"]
maturity = "production"
updated_date = "2026/05/04"

[rule]
author = ["Elastic"]
description = """
Identifies the install of browser extensions. Malicious browser extensions can be installed via app store downloads
masquerading as legitimate extensions, social engineering, or by an adversary that has already compromised a system.
"""
from = "now-9m"
index = [
    "logs-endpoint.events.file-*",
    "logs-m365_defender.event-*",
    "logs-sentinel_one_cloud_funnel.*",
    "logs-windows.sysmon_operational-*",
    "winlogbeat-*",
    "endgame-*",
]
language = "eql"
license = "Elastic License v2"
name = "Browser Extension Install"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Browser Extension Install
Browser extensions enhance functionality in web browsers but can be exploited by adversaries to gain persistence or execute malicious activities. Attackers may disguise harmful extensions as legitimate or use compromised systems to install them. The detection rule identifies suspicious extension installations by monitoring file creation events in typical extension directories, filtering out known safe processes, and focusing on Windows environments.

### Possible investigation steps

- Review the file creation event details to identify the specific browser extension file (e.g., .xpi or .crx) and its path to determine if it aligns with known malicious patterns or locations.
- Check the process that initiated the file creation event, especially if it is not a known safe process like firefox.exe, to assess if it is a legitimate application or potentially malicious.
- Investigate the user account associated with the file creation event to determine if the activity is expected or if the account may have been compromised.
- Examine recent system activity and logs for any signs of social engineering attempts or unauthorized access that could have led to the installation of the extension.
- Cross-reference the extension file name and path with threat intelligence sources to identify if it is associated with known malicious browser extensions.
- If applicable, review the browser's extension management interface to verify the presence and legitimacy of the installed extension.

### False positive analysis

- Language pack installations for Firefox can trigger false positives. Exclude files named "langpack-*@firefox.mozilla.org.xpi" from detection to prevent unnecessary alerts.
- Dictionary add-ons for Firefox may also be flagged. Add exceptions for files named "*@dictionaries.addons.mozilla.org.xpi" to reduce false positives.
- Regular updates or installations of legitimate browser extensions from trusted sources can be mistaken for malicious activity. Maintain a list of trusted processes and paths to exclude from monitoring.
- User-initiated installations from official browser stores might be flagged. Educate users on safe installation practices and consider excluding known safe processes like "firefox.exe" when associated with legitimate extension paths.
- Frequent installations in enterprise environments due to software deployment tools can cause alerts. Coordinate with IT to identify and exclude these routine activities from detection.

### Response and remediation

- Isolate the affected system from the network to prevent further spread or communication with potential command and control servers.
- Terminate any suspicious processes associated with the unauthorized browser extension installation, such as unknown or unexpected instances of browser processes.
- Remove the malicious browser extension by deleting the associated files from the extension directories identified in the alert.
- Conduct a full antivirus and anti-malware scan on the affected system to identify and remove any additional threats or remnants of the malicious extension.
- Review and reset browser settings to default to ensure no residual configurations or settings are left by the malicious extension.
- Escalate the incident to the security operations team for further investigation and to determine if additional systems are affected.
- Implement application whitelisting to prevent unauthorized browser extensions from being installed in the future, focusing on the directories and file types identified in the detection query."""
risk_score = 21
rule_id = "f97504ac-1053-498f-aeaa-c6d01e76b379"
severity = "low"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Persistence",
    "Data Source: Elastic Defend",
    "Data Source: Elastic Endgame",
    "Data Source: SentinelOne",
    "Data Source: Sysmon",
    "Data Source: Microsoft Defender XDR",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
file where host.os.type == "windows" and event.type : "creation" and
(
  /* Firefox-Based Browsers */
  (
    file.name : "*.xpi" and
    file.path : "?:\\Users\\*\\AppData\\Roaming\\*\\Profiles\\*\\Extensions\\*.xpi" and
    not
    (
      process.name : "firefox.exe" and
      file.name : (
        "langpack-*@firefox.mozilla.org.xpi",
        "*@dictionaries.addons.mozilla.org.xpi",
        "newtab@mozilla.org.xpi",
        "uBlock0@raymondhill.net.xpi",
        /* AdBlockPlus */
        "{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi",
        /* Bitwarden */
        "{446900e4-71c2-419f-a6a7-df9c091e268b}.xpi",
        "addon@darkreader.org.xpi",
        /* 1Password */
        "{d634138d-c276-4fc8-924b-40a0ea21d284}.xpi",
        "support@lastpass.com.xpi",
        /* Grammarly */
        "87677a2c52b84ad3a151a4a72f5bd3c4@jetpack.xpi",
        "sentinelone_visibility@sentinelone.com.xpi",
        "keepassxc-browser@keepassxc.org.xpi"
      )
    )
  ) or
  /* Chromium-Based Browsers */
  (
    file.name : "*.crx" and
    file.path : "?:\\Users\\*\\AppData\\Local\\*\\*\\User Data\\Webstore Downloads\\*"
  )
)
'''

setup = """## Setup

This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.

Setup instructions: https://ela.st/install-elastic-defend

### Additional data sources

This rule also supports the following third-party data sources. For setup instructions, refer to the links below:

- [Microsoft Defender XDR](https://ela.st/m365-defender)
- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
- [Sysmon Event ID 11 - File Create](https://ela.st/sysmon-event-11-setup)
"""


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1176"
name = "Software Extensions"
reference = "https://attack.mitre.org/techniques/T1176/"

[[rule.threat.technique.subtechnique]]
id = "T1176.001"
name = "Browser Extensions"
reference = "https://attack.mitre.org/techniques/T1176/001/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[metadata]
creation_date = "2024/02/01"
integration = ["endpoint", "crowdstrike", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2026/03/24"

[rule]
author = ["Elastic"]
description = """
Monitors for kernel processes with associated process executable fields that are not empty. Unix kernel processes such
as kthreadd and kworker typically do not have process.executable fields associated to them. Attackers may attempt to
hide their malicious programs by masquerading as legitimate kernel processes.
"""
from = "now-9m"
index = [
    "endgame-*",
    "logs-crowdstrike.fdr*",
    "logs-endpoint.events.process*",
    "logs-sentinel_one_cloud_funnel.*",
]
language = "eql"
license = "Elastic License v2"
name = "Executable Masquerading as Kernel Process"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Executable Masquerading as Kernel Process

In Linux environments, kernel processes like `kthreadd` and `kworker` typically run without associated executable paths. Adversaries exploit this by naming malicious executables after these processes to evade detection. The detection rule identifies anomalies by flagging kernel-named processes with non-empty executable fields, indicating potential masquerading attempts. This helps in uncovering stealthy threats that mimic legitimate system activities.

### Possible investigation steps

- Review the process details for the flagged process, focusing on the process.executable field to identify the path and name of the executable. This can provide initial insights into whether the executable is legitimate or potentially malicious.
- Check the process's parent process (process.parent) to understand the context in which the process was started. This can help determine if the process was spawned by a legitimate system process or a suspicious one.
- Investigate the file at the path specified in the process.executable field. Verify its legitimacy by checking its hash against known malware databases or using a file reputation service.
- Examine the process's command line arguments (process.command_line) for any unusual or suspicious parameters that might indicate malicious activity.
- Review recent system logs and events around the time the process was started to identify any related activities or anomalies that could provide additional context or evidence of compromise.
- If available, use threat intelligence sources to check for any known indicators of compromise (IOCs) related to the process name or executable path.

### False positive analysis

- Custom scripts or administrative tools may be named similarly to kernel processes for convenience or organizational standards. Review these scripts and tools to ensure they are legitimate and consider adding them to an exception list if verified.
- Some legitimate software or monitoring tools might use kernel-like names for their processes to integrate closely with system operations. Verify the source and purpose of these processes and exclude them if they are confirmed to be non-malicious.
- System updates or patches might temporarily create processes with kernel-like names that have executable paths. Monitor these occurrences and exclude them if they are part of a verified update process.
- Development or testing environments may intentionally use kernel-like names for process simulation. Ensure these environments are isolated and add exceptions for these processes if they are part of controlled testing scenarios.

### Response and remediation

- Isolate the affected system from the network to prevent further spread of the potential threat and to contain any malicious activity.
- Terminate the suspicious process immediately to stop any ongoing malicious actions. Use process management tools to kill the process identified by the alert.
- Conduct a forensic analysis of the affected system to identify any additional indicators of compromise (IOCs) and assess the extent of the intrusion.
- Remove any malicious executables or files associated with the masquerading process from the system to ensure complete remediation.
- Restore the system from a known good backup if the integrity of the system is compromised, ensuring that the backup is free from any malicious artifacts.
- Update and patch the system to close any vulnerabilities that may have been exploited by the attacker, ensuring all software and security tools are up to date.
- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if additional systems are affected."""
references = ["https://sandflysecurity.com/blog/linux-stealth-rootkit-malware-with-edr-evasion-analyzed/"]
risk_score = 73
rule_id = "202829f6-0271-4e88-b882-11a655c590d4"
setup = """## Setup


This rule requires data coming in from Elastic Defend.

### Elastic Defend Integration Setup
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.

#### Prerequisite Requirements:
- Fleet is required for Elastic Defend.
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).

#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
- Go to the Kibana home page and click "Add integrations".
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
- Click "Add Elastic Defend".
- Configure the integration name and optionally add a description.
- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
- Click "Save and Continue".
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
"""
severity = "high"
tags = [
    "Domain: Endpoint",
    "OS: Linux",
    "Use Case: Threat Detection",
    "Tactic: Defense Evasion",
    "Data Source: Elastic Defend",
    "Data Source: Elastic Endgame",
    "Data Source: Crowdstrike",
    "Data Source: SentinelOne",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"
query = '''
process where host.os.type == "linux" and event.type == "start" and event.action in ("exec", "exec_event", "start", "ProcessRollup2") and
process.name : ("kworker*", "kthread*") and process.executable != null
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1036"
name = "Masquerading"
reference = "https://attack.mitre.org/techniques/T1036/"

[[rule.threat.technique.subtechnique]]
id = "T1036.004"
name = "Masquerade Task or Service"
reference = "https://attack.mitre.org/techniques/T1036/004/"

[[rule.threat.technique.subtechnique]]
id = "T1036.005"
name = "Match Legitimate Resource Name or Location"
reference = "https://attack.mitre.org/techniques/T1036/005/"

[[rule.threat.technique]]
id = "T1564"
name = "Hide Artifacts"
reference = "https://attack.mitre.org/techniques/T1564/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[metadata]
creation_date = "2020/09/02"
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2026/08/31"

[rule]
author = ["Elastic"]
description = """
Identifies the installation of custom Application Compatibility Shim databases. This Windows functionality has been
abused by attackers to stealthily gain persistence and arbitrary code execution in legitimate Windows processes.
"""
from = "now-9m"
index = [
    "logs-endpoint.events.registry-*",
    "winlogbeat-*",
    "logs-windows.sysmon_operational-*",
    "logs-m365_defender.event-*",
    "logs-sentinel_one_cloud_funnel.*",
    "endgame-*",
    "logs-crowdstrike.fdr*",
]
language = "eql"
license = "Elastic License v2"
name = "Installation of Custom Shim Databases"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Installation of Custom Shim Databases

Application Compatibility Shim databases are used in Windows to ensure older applications run smoothly on newer OS versions by applying compatibility fixes. However, attackers can exploit this feature to maintain persistence and execute arbitrary code by installing malicious shim databases. The detection rule identifies changes in specific registry paths associated with these databases, excluding known legitimate processes, to flag potential abuse.

### Possible investigation steps

- Review the registry path changes identified in the alert to confirm the presence of any unexpected or unauthorized .sdb files in the specified registry paths.
- Investigate the process that made the registry change by examining the process executable path and comparing it against the list of known legitimate processes excluded in the query.
- Check the historical activity of the process responsible for the change to identify any patterns or anomalies that might indicate malicious behavior.
- Analyze the context around the time of the registry change, including other system events or alerts, to identify any related suspicious activities.
- If a suspicious .sdb file is found, conduct a file analysis to determine its purpose and whether it contains any malicious code or configurations.
- Consult threat intelligence sources to see if there are any known threats or campaigns associated with the identified process or .sdb file.

### False positive analysis

- Known legitimate processes such as SAP and Kaspersky applications may trigger false positives due to their use of shim databases. These processes are already excluded in the detection rule to minimize unnecessary alerts.
- If additional legitimate applications are identified as causing false positives, users can update the exclusion list by adding the specific process executable paths to the rule.
- Regularly review and update the exclusion list to ensure it reflects the current environment and any new legitimate applications that may use shim databases.
- Monitor the frequency and context of alerts to distinguish between benign and potentially malicious activities, adjusting the rule as necessary to reduce noise.
- Engage with application owners to verify the legitimacy of processes that frequently trigger alerts, ensuring that only trusted applications are excluded.

### Response and remediation

- Immediately isolate the affected system from the network to prevent further propagation or communication with potential command and control servers.
- Terminate any suspicious processes identified as responsible for the installation of the custom shim database, ensuring they are not legitimate processes mistakenly flagged.
- Remove the malicious shim database entries from the registry paths specified in the detection query to eliminate persistence mechanisms.
- Conduct a thorough scan of the affected system using updated antivirus and endpoint detection tools to identify and remove any additional malware or unauthorized changes.
- Review and restore any altered system configurations or files to their original state to ensure system integrity.
- Escalate the incident to the security operations center (SOC) or incident response team for further analysis and to determine if additional systems are affected.
- Implement enhanced monitoring and logging for the specified registry paths and associated processes to detect and respond to similar threats in the future."""
risk_score = 47
rule_id = "c5ce48a6-7f57-4ee8-9313-3d0024caee10"
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Persistence",
    "Data Source: Elastic Defend",
    "Data Source: Sysmon",
    "Data Source: Microsoft Defender XDR",
    "Data Source: SentinelOne",
    "Data Source: Elastic Endgame",
    "Data Source: Crowdstrike",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
registry where host.os.type == "windows" and event.type == "change" and
  registry.path : "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\Custom\\*.sdb" and
  not process.executable : (
        "?:\\Program Files (x86)\\DesktopCentral_Agent\\*\\Setup\\NwSapSetup.exe",
        "?:\\$WINDOWS.~BT\\Sources\\SetupPlatform.exe",
        "?:\\Program Files (x86)\\SAP\\SAPsetup\\setup\\NwSapSetup.exe",
        "?:\\Program Files (x86)\\SAP\\SapSetup\\OnRebootSvc\\NWSAPSetupOnRebootInstSvc.exe",
        "?:\\Program Files (x86)\\Kaspersky Lab\\Kaspersky Security for Windows Server\\kavfs.exe",

        /* Crowdstrike specific exclusion as it uses NT Object paths */
        "\\Device\\HarddiskVolume*\\Program Files (x86)\\DesktopCentral_Agent\\*\\Setup\\NwSapSetup.exe",
        "\\Device\\HarddiskVolume*\\$WINDOWS.~BT\\Sources\\SetupPlatform.exe",
        "\\Device\\HarddiskVolume*\\Program Files (x86)\\SAP\\SAPsetup\\setup\\NwSapSetup.exe",
        "\\Device\\HarddiskVolume*\\Program Files (x86)\\SAP\\SapSetup\\OnRebootSvc\\NWSAPSetupOnRebootInstSvc.exe",
        "\\Device\\HarddiskVolume*\\Program Files (x86)\\Kaspersky Lab\\Kaspersky Security for Windows Server\\kavfs.exe"
  ) and
  /* Microsoft Cloud AppCompat SDB test registrations */
  not registry.path : "*\\AppCompatFlags\\Custom\\*\\{22221111-1111-1111-1111-111111111111}.sdb"
'''

setup = """## Setup

This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.

Setup instructions: https://ela.st/install-elastic-defend

### Additional data sources

This rule also supports the following third-party data sources. For setup instructions, refer to the links below:

- [CrowdStrike](https://ela.st/crowdstrike-integration)
- [Microsoft Defender XDR](https://ela.st/m365-defender)
- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
- [Sysmon Registry Events](https://ela.st/sysmon-event-reg-setup)
"""


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1546"
name = "Event Triggered Execution"
reference = "https://attack.mitre.org/techniques/T1546/"
[[rule.threat.technique.subtechnique]]
id = "T1546.011"
name = "Application Shimming"
reference = "https://attack.mitre.org/techniques/T1546/011/"



[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[rule]
description = """
Identifies the execution of a Java JAR application with an unusual file extension. Malicious files may masquerade as non
executable file extensions to evade defenses.
"""
id = "13615fd4-b220-4033-ab4f-8b16b9beae57"
license = "Elastic License v2"
name = "JAVA Application with Unusual File Extension"
os_list = ["windows"]
version = "1.0.7"

query = '''
sequence by process.entity_id with maxspan=5s
[process where event.action == "start" and
 (process.name : "javaw.exe" or process.pe.original_file_name == "javaw.exe") and not process.command_line : "*.jar*" and 
  (
   (process.args_count == 3 and process.args : "-jar") or 
   (process.args_count == 4 and process.args : ("-cp", "-classpath") and process.command_line : " *.* ")
   ) and
  not process.executable : ("?:\\Program Files\\7edit.com\\7Edit *\\bin\\javaw.exe",
                            "?:\\Program Files\\Angry IP Scanner\\jre\\bin\\javaw.exe",
                            "?:\\Program Files\\Eclipse Adoptium\\jdk-*-hotspot\\bin\\javaw.exe",
                            "C:\\Program Files\\Java\\jdk-11\\bin\\javaw.exe",
                            "C:\\Program Files\\Zulu\\zulu-8\\bin\\javaw.exe",
                            "C:\\Program Files\\AdoptOpenJDK\\jre*-hotspot\\bin\\javaw.exe") and
  not process.parent.executable :
                     ("?:\\Program Files (x86)\\AssoSoftware\\AssoInvoice\\AssoInvoice.exe",
                      "C:\\Program Files (x86)\\ImprimeTickets\\ImprimeTickets.exe") and
  not (process.code_signature.subject_name : ("BELLSOFT", "Eclipse.org Foundation, Inc.", "Insurity LLC") and process.code_signature.trusted == true) and
  not process.command_line : "\"C:\\Program Files\\Java\\jre1.8.0_51\\bin\\javaw.exe\" -jar \"C:\\Users\\*\\AppData\\Roaming\\.minecraft\\TLauncher.exe\""
  ]
[network where event.action in ("connection_accepted", "connection_attempted") and
 not cidrmatch(destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24",
       "192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32",
       "192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24", "192.88.99.0/24", "224.0.0.0/4",
       "100.64.0.0/10", "192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1",
       "FE80::/10", "FF00::/8")]
'''

min_endpoint_version = "7.16.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"


[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "7.16.0"

[metadata]
creation_date = "2026/05/05"
integration = ["kubernetes"]
maturity = "production"
updated_date = "2026/05/05"

[rule]
author = ["Elastic"]
description = """
Detects the creation of a Kubernetes service account token through the TokenRequest API by a non-system identity. The
TokenRequest API allows users and workloads to programmatically generate short-lived tokens for any service account
they have create permissions on, without accessing the filesystem or the mounted projected token. Attackers who have
gained initial access to a cluster can abuse this API to mint tokens for more privileged service accounts, pivot to
cloud provider resources via IRSA/workload identity, or generate long-lived tokens that persist beyond pod
termination. Unlike mounted service account tokens which are detectable through file access monitoring, tokens created
via the TokenRequest API leave no filesystem footprint, they are only visible in Kubernetes audit logs as a create
verb on the serviceaccounts/token subresource. This rule excludes legitimate system components such as the kubelet,
kube-controller-manager, and cloud provider managed identities (EKS, AKS, GKE) that routinely create tokens for pod
lifecycle management.
"""
false_positives = [
    """
    New automation, admission webhooks, or platform agents that legitimately call the TokenRequest API under a
    non-standard user string may require narrow exclusions by user.name or source IP.
    """,
]
from = "now-6m"
index = ["logs-kubernetes.audit_logs-*"]
language = "kuery"
license = "Elastic License v2"
name = "Kubernetes Service Account Token Created via TokenRequest API"
note = """## Triage and analysis

### Investigating Kubernetes Service Account Token Created via TokenRequest API

This alert indicates a successful `create` against the `serviceaccounts/token` subresource (TokenRequest API), which
issues a new service account token without a filesystem read. In EKS and other managed clusters, this can be abused to
mint tokens for more privileged service accounts (including IRSA-linked ones) and pivot to cloud APIs.

#### What to review first

- Actor and origin:
  - `user.name` / `kubernetes.audit.user.username`
  - `source.ip` / `kubernetes.audit.sourceIPs`
  - `user_agent.original` / `kubernetes.audit.userAgent`
  - For cloud identity, review `kubernetes.audit.user.extra.*` (e.g., `arn`, `principalId`).
- Targeted service account:
  - `kubernetes.audit.objectRef.namespace` and `kubernetes.audit.objectRef.name`
  - `kubernetes.audit.requestURI` (should resemble `/api/v1/namespaces/<ns>/serviceaccounts/<sa>/token`)
- Token issuance hints:
  - `kubernetes.audit.annotations.authentication_kubernetes_io/issued-credential-id` (token JTI/issued credential id)

#### Scoping

- Identify which Role/ClusterRoleBindings grant the actor `create` on `serviceaccounts/token` in the affected namespace.
- Pivot on the same `user.name` and `source.ip` for follow-on secret reads, pod exec, RBAC changes, or cloud API calls.

### Response and remediation

- If unauthorized, remove/revert the RBAC permission that allows TokenRequest (`serviceaccounts/token`) and rotate the
  affected service account credentials where applicable.
- For IRSA/workload identity cases, rotate/revoke the cloud role session pathways and review cloud audit logs for API
  activity from the time window of the token mint.
"""
references = [
    "https://kubernetes.io/docs/reference/kubernetes-api/authentication-resources/token-v1/",
    "https://attack.mitre.org/techniques/T1552/007/",
]
risk_score = 47
rule_id = "4df91789-7859-4bc4-9c5a-6b56bfa81a8b"
severity = "medium"
tags = [
    "Data Source: Kubernetes",
    "Domain: Kubernetes",
    "Use Case: Threat Detection",
    "Tactic: Credential Access",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"
query = '''
data_stream.dataset:"kubernetes.audit_logs" and 
kubernetes.audit.verb:"create" and
kubernetes.audit.objectRef.resource:"serviceaccounts" and
kubernetes.audit.objectRef.subresource:"token" and
user.name:(* and not 
 (system\:kube-controller-manager or
  system\:kube-scheduler or
  system\:node\:* or
  system\:serviceaccount\:kube-system\:* or
  eks\:* or
  aksService or
  aks-service or
  masterclient or
  nodeclient or
  system\:serviceaccount\:gke-managed-system\:* or
  system\:serviceaccount\:gke-connect\:* or
  system\:serviceaccount\:anthos-identity-service\:* or
  system\:gke-controller-manager or
  system\:serviceaccount\:tigera-operator\:* or
  system\:serviceaccount\:calico-system\:*))
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"

[[rule.threat.technique.subtechnique]]
id = "T1552.007"
name = "Container API"
reference = "https://attack.mitre.org/techniques/T1552/007/"

[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[metadata]
creation_date = "2026/01/14"
maturity = "production"
updated_date = "2026/02/16"


[rule]
author = ["Elastic"]
description = """
This rule detects source IPs that triggered their first lateral movement alert within the last 10 minutes (i.e., newly observed), while also triggering at least 2 distinct lateral movement detection rules. This surfaces new potentially malicious IPs exhibiting immediate lateral movement behavior.
"""
from = "now-7200m"
interval = "10m"
language = "esql"
license = "Elastic License v2"
name = "Lateral Movement Alerts from a Newly Observed Source Address"
risk_score = 73
rule_id = "0e67f4f1-f683-43c0-8d45-c3293cf31e5d"
setup = """## Setup

This rule requires the `host.ip` field to be populated.
For **Elastic Defend** events on versions **8.18 and above**, this field is **disabled by default**.

If you are using **Elastic Defend**, ensure host IP collection is enabled by following the configuration steps in the
[helper guide](https://www.elastic.co/docs/solutions/security/configure-elastic-defend/configure-data-volume-for-elastic-endpoint#host-fields).
"""
severity = "high"
tags = ["Use Case: Threat Detection", "Rule Type: Higher-Order Rule", "Tactic: Lateral Movement", "Resources: Investigation Guide"]
timestamp_override = "event.ingested"
type = "esql"

query = '''
FROM .alerts-security.* METADATA _index

// Lateral Movement related rules with fields of interest
| where kibana.alert.rule.threat.tactic.name is not null and
        source.ip IS NOT NULL and destination.ip is not null and
        host.id is not null and KQL("""kibana.alert.rule.threat.tactic.name : "Lateral Movement" and not kibana.alert.rule.tags : "Rule Type: Higher-Order Rule" """)

// aggregate stats by source.ip
| stats  Esql.first_time_seen = MIN(@timestamp),
         Esql.alerts_count = count(*),
         Esql.unique_rules_count = COUNT_DISTINCT(kibana.alert.rule.name),
         Esql.unique_count_host_id = COUNT_DISTINCT(host.id),
         Esql.rule_name_values = VALUES(kibana.alert.rule.name),
         Esql.user_name_values = VALUES(user.name),
         Esql.host_id_values = VALUES(host.id),
         Esql.host_ip_values = VALUES(host.ip),
         Esql.tactic_name_values = VALUES(kibana.alert.rule.threat.tactic.name) by source.ip

// values we will need for next filter
| eval isLocal = locate(MV_CONCAT(to_string(Esql.host_ip_values), ","), to_string(source.ip)),
       Esql.date_diff = DATE_DIFF("minute", Esql.first_time_seen, now())

// at least 2 unique rules from same source.ip and that was first seen in last 5 days
| where Esql.unique_rules_count >= 2 and
        // matches are within 10m of the rule execution time to avoid alert duplicates
        Esql.date_diff <= 10 and
        // make sure source.ip is not equal to host.ip
        not isLocal > 0 and
        // reduce noise from SCCM, Nessus and alike
        Esql.unique_count_host_id <= 3 and Esql.alerts_count <= 20
| eval host.id = MV_FIRST(Esql.host_id_values), user.name = MV_FIRST(Esql.user_name_values)
| KEEP Esql.*, source.ip, host.id, user.name
'''
note = """## Triage and analysis

### Investigating Lateral Movement Alerts from a Newly Observed Source Address

This rule surfaces newly observed, low-frequency source address triggering multiple lateral movement alerts.

Because the alert has not been seen previously for this rule and host, it should be prioritized for validation to determine
whether it represents a true compromise or rare benign activity.

### Investigation Steps

- Identify the source address, affected host, user and review the associated rule name to understand the behavior that triggered the alert.
- Validate the source address and user context under which the activity occurred and assess whether it aligns with normal behavior for that address.
- Refer to the specific rule investigation guide for further actions.

### False Positive Considerations

- Administrative scripts or automation tools can trigger behavior-based detections when first introduced.
- Security tooling, IT management agents, or EDR integrations may generate new behavior alerts during updates or configuration changes.
- Development or testing environments may produce one-off behaviors that resemble malicious techniques.

### Response and Remediation

- If the activity is confirmed malicious, isolate the affected host to prevent further execution or lateral movement.
- Terminate malicious processes and remove any dropped files or persistence mechanisms.
- Collect forensic artifacts to understand initial access and execution flow.
- Patch or remediate any vulnerabilities or misconfigurations that enabled the behavior.
- If benign, document the finding and consider tuning or exception handling to reduce future noise.
- Continue monitoring the host and environment for recurrence of the behavior or related alerts."""
references = ["https://www.elastic.co/docs/solutions/security/detect-and-alert/about-detection-rules"]

[[rule.threat]]
framework = "MITRE ATT&CK"
[rule.threat.tactic]
id = "TA0008"
name = "Lateral Movement"
reference = "https://attack.mitre.org/tactics/TA0008/"

[metadata]
creation_date = "2023/10/16"
integration = ["problemchild", "endpoint"]
maturity = "production"
updated_date = "2025/12/17"

[rule]
author = ["Elastic"]
description = """
A supervised machine learning model (ProblemChild) has identified a suspicious Windows process event with low
probability of it being malicious activity. Alternatively, the model's blocklist identified the event as being
malicious.
"""
from = "now-10m"
index = ["logs-endpoint.events.process-*"]
language = "eql"
license = "Elastic License v2"
name = "Machine Learning Detected a Suspicious Windows Event with a Low Malicious Probability Score"
references = [
    "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html",
    "https://docs.elastic.co/en/integrations/problemchild",
    "https://www.elastic.co/security-labs/detecting-living-off-the-land-attacks-with-new-elastic-integration",
]
risk_score = 21
rule_id = "13e908b9-7bf0-4235-abc9-b5deb500d0ad"
setup = """## Setup

The rule requires the Living off the Land (LotL) Attack Detection integration assets to be installed, as well as Windows process events collected by integrations such as Elastic Defend or Winlogbeat.

### LotL Attack Detection Setup
The LotL Attack Detection integration detects living-off-the-land activity in Windows process events.

#### Prerequisite Requirements:
- Fleet is required for LotL Attack Detection.
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
- Windows process events collected by the [Elastic Defend](https://docs.elastic.co/en/integrations/endpoint) integration or Winlogbeat(https://www.elastic.co/guide/en/beats/winlogbeat/current/_winlogbeat_overview.html).
- To install Elastic Defend, refer to the [documentation](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
- To set up and run Winlogbeat, follow [this](https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-installation-configuration.html) guide.

#### The following steps should be executed to install assets associated with the LotL Attack Detection integration:
- Go to the Kibana homepage. Under Management, click Integrations.
- In the query bar, search for Living off the Land Attack Detection and select the integration to see more details about it.
- Follow the instructions under the **Installation** section.
- For this rule to work, complete the instructions through **Configure the ingest pipeline**.
"""
severity = "low"
tags = [
    "OS: Windows",
    "Data Source: Elastic Endgame",
    "Use Case: Living off the Land Attack Detection",
    "Rule Type: ML",
    "Rule Type: Machine Learning",
    "Tactic: Defense Evasion",
    "Data Source: Elastic Defend",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
process where ((problemchild.prediction == 1 and problemchild.prediction_probability <= 0.98) or
blocklist_label == 1) and not process.args : ("*C:\\WINDOWS\\temp\\nessus_*.txt*", "*C:\\WINDOWS\\temp\\nessus_*.tmp*") and
process.parent.executable != null and not user.id in ("S-1-5-18", "S-1-5-19", "S-1-5-20") and
not process.parent.name : ("cmd.exe", "powershell.exe") and
not (process.name == "net1.exe" and process.parent.name == "net.exe") and
not (process.parent.executable : "C:\\Windows\\System32\\svchost.exe" and
     process.name : ("UCPDMgr.exe", "sdbinst.exe", "gpupdate.exe", "rundll32.exe", "taskhostw.exe", "taskeng.exe")) and
not (process.name: ("powershell.exe", "cmd.exe", "cscript.exe") and
     process.parent.executable : ("C:\\Program Files\\*.exe",
                                  "C:\\Program Files (x86)\\*.exe",
                                  "C:\\Users\\*\\Documents\\scripts\\nssm-2.24\\win64\\nssm.exe",
                                  "C:\\Windows\\System32\\cmd.exe",
                                  "C:\\Windows\\SysWOW64\\cmd.exe",
                                  "C:\\Windows\\CCM\\CcmExec.exe",
                                  "C:\\Windows\\System32\\svchost.exe",
                                  "C:\\Windows\\System32\\gpscript.exe",
                                  "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe",
                                  "C:\\appian\\java\\bin\\java.exe")) and
not (process.executable : "C:\\Windows\\System32\\cscript.exe" and process.parent.name : ("node.exe", "MicroStrategy Services.exe")) and
not (process.name : "MpCmdRun.exe" and process.parent.name : ("MsMpEng.exe", "MpCmdRun.exe", "svchost.exe")) and
not process.executable : ("C:\\Program Files\\*.exe", "C:\\Program Files (x86)\\*.exe")
'''
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Machine Learning Detected a Suspicious Windows Event with a Low Malicious Probability Score

The detection leverages a machine learning model to identify potentially suspicious Windows processes with a low likelihood of being malicious, focusing on defense evasion tactics like masquerading. Adversaries may exploit legitimate processes to bypass security measures. This rule flags such events, excluding known benign patterns, to highlight potential threats for further analysis.

### Possible investigation steps

- Review the process details where the problemchild.prediction is 1 and the prediction_probability is less than or equal to 0.98 to understand why the process was flagged as suspicious.
- Check if the process is listed in the blocklist_label as 1, indicating it has been identified as malicious by the model's blocklist.
- Investigate the command-line arguments of the process to identify any unusual or unexpected patterns, excluding known benign patterns such as those involving "C:\\WINDOWS\\temp\\nessus_*.txt" or "C:\\WINDOWS\\temp\\nessus_*.tmp".
- Correlate the flagged process with other system events or logs to determine if it is part of a larger pattern of suspicious activity, focusing on defense evasion tactics like masquerading.
- Assess the parent process and any child processes spawned by the suspicious process to identify potential lateral movement or further malicious activity.
- Consult threat intelligence sources to see if the process or its associated indicators have been reported in recent threat reports or advisories.

### False positive analysis

- Nessus scan files in the Windows temp directory may trigger false positives. Exclude paths like C:\\WINDOWS\\temp\\nessus_*.txt and C:\\WINDOWS\\temp\\nessus_*.tmp to prevent these benign events from being flagged.
- Legitimate software updates or installations might mimic suspicious behavior. Monitor and document regular update schedules to differentiate between expected and unexpected activities.
- System administration scripts that automate tasks can appear suspicious. Identify and whitelist these scripts if they are part of routine operations to avoid unnecessary alerts.
- Custom in-house applications may not be recognized by the model. Work with IT to catalog these applications and create exceptions where necessary to reduce false positives.
- Regularly review and update the blocklist and exception rules to ensure they reflect the current environment and known benign activities.

### Response and remediation

- Isolate the affected system from the network to prevent potential lateral movement by the adversary exploiting the masquerading technique.
- Terminate the suspicious process identified by the machine learning model to halt any ongoing malicious activity.
- Conduct a thorough review of the process's parent and child processes to identify any additional suspicious activities or related processes that may require termination.
- Restore the system from a known good backup if any malicious activity is confirmed, ensuring that the backup is free from compromise.
- Update and patch the system to the latest security standards to close any vulnerabilities that may have been exploited.
- Implement enhanced monitoring for similar masquerading attempts by adjusting alert thresholds or adding specific indicators of compromise (IOCs) related to the detected event.
- Escalate the incident to the security operations center (SOC) or relevant security team for further analysis and to determine if additional systems are affected."""


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1036"
name = "Masquerading"
reference = "https://attack.mitre.org/techniques/T1036/"
[[rule.threat.technique.subtechnique]]
id = "T1036.004"
name = "Masquerade Task or Service"
reference = "https://attack.mitre.org/techniques/T1036/004/"



[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[metadata]
creation_date = "2026/01/30"
integration = ["endpoint"]
maturity = "production"
updated_date = "2026/06/25"

[rule]
author = ["Elastic"]
description = """
Identifies the creation of a launch agent or daemon property list file containing abnormal or suspicious 
values. An adversary may establish persistence by installing a new launch agent or daemon which executes 
at login. This rule looks for plist files created in LaunchAgents/LaunchDaemons directories with paths 
commonly used by malware.
"""
from = "now-9m"
index = ["logs-endpoint.events.file-*"]
language = "eql"
license = "Elastic License v2"
name = "Persistence via Suspicious Launch Agent or Launch Daemon"
references = [
    "https://medium.com/red-teaming-with-a-blue-team-mentality/a-brief-look-at-macos-detections-and-post-infection-analysis-b0ede7ecfeb9",
    "https://objective-see.org/blog",
    "https://www.elastic.co/security-labs/DPRK-strikes-using-a-new-variant-of-rustbucket"
]
risk_score = 73
rule_id = "62ba8542-1246-4647-9b84-98aa1bc0760a"
severity = "high"
tags = [
    "Domain: Endpoint",
    "OS: macOS",
    "Use Case: Threat Detection",
    "Tactic: Persistence",
    "Data Source: Elastic Defend",
    "Resources: Investigation Guide"
]
timestamp_override = "event.ingested"
type = "eql"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Persistence via Suspicious Launch Agent or Launch Daemon

LaunchAgents and LaunchDaemons are the standard macOS mechanisms for starting programs automatically at user login or system boot. While essential for legitimate software, these persistence mechanisms are heavily abused by malware including RustBucket (DPRK), Shlayer, and CloudMensis. This detection rule identifies plist file creation in LaunchAgent/LaunchDaemon directories when performed by suspicious processes including scripts executing from temporary directories, unsigned binaries, or scripting interpreters like Python and osascript.

### Possible investigation steps

- Examine the file.path to identify the specific plist file created and its location (user vs system LaunchAgent/LaunchDaemon directory).
- Read the plist contents using plutil or defaults to identify the Program or ProgramArguments configured for execution.
- Analyze the process.executable to understand what created the plist file and assess whether execution from that location (temp directory, hidden folder) is suspicious.
- Check the process.name and process.code_signature fields to determine if the creating process was a scripting interpreter or unsigned binary.
- Locate the binary or script referenced in the plist and calculate its hash for threat intelligence lookups.
- Review the parent process chain to trace back to the initial execution vector that led to plist creation.
- Correlate with other file and process events to identify additional malware components that may have been deployed simultaneously.

### False positive analysis

- Legitimate software installers may create LaunchAgents/LaunchDaemons during setup, but typically from signed installer processes rather than scripts in temp directories.
- Development and testing environments may use scripting languages to create launch items. Verify with development teams if such activities are expected.
- Several legitimate signing IDs are already excluded including vim, JetBrains Toolbox, and Sublime Text.
- System utilities like cfprefsd may modify plist files during normal operations and are excluded.
- Enterprise deployment tools may use scripts to configure launch items. Document and exclude approved deployment processes.

### Response and remediation

- Immediately unload the suspicious LaunchAgent or LaunchDaemon using launchctl unload with the plist path.
- Remove the malicious plist file from the LaunchAgent or LaunchDaemon directory.
- Locate and remove the executable or script referenced in the plist's Program or ProgramArguments keys.
- Check for other persistence mechanisms that may have been deployed by the same threat actor.
- Review system logs for evidence of the persistence mechanism executing and what actions it performed.
- If the detection matches patterns of known malware families (RustBucket, Shlayer), perform comprehensive IOC searches and threat hunting.
- Reset any credentials that may have been accessed while the malicious process was running.
- Monitor for recreation of similar plist files to detect persistent access or ongoing compromise.
"""
query = '''
file where host.os.type == "macos" and event.type != "deletion" and 
  file.extension == "plist" and
  file.path like ("/Library/LaunchAgents/*", "/Library/LaunchDaemons/*", 
                  "/Users/*/Library/LaunchAgents/*", "/System/Library/LaunchAgents/*",
                  "/System/Library/LaunchDaemons/*") and
  (process.executable like ("/private/tmp/*", "/private/var/root/Library/*", "/var/tmp/*", 
                            "/tmp/*", "/var/folders/*", "/Users/Shared/*", "/var/root/*",
                            "/Library/WebServer/*", "/Library/Graphics/*", "/Library/Fonts/*") or
   process.name like~ ("python*", "osascript", "bash", "zsh", "sh", "curl", "nscurl", "wget", "java")) and
  not process.executable like ("/System/*", "/Library/PrivilegedHelperTools/*") and
  not (process.code_signature.signing_id in ("com.apple.vim", "com.apple.cat", "com.apple.cfprefsd",
                                            "com.jetbrains.toolbox", "com.apple.pico", "com.apple.shove",
                                            "com.sublimetext.4", "com.apple.ditto") and process.code_signature.trusted == true) and
  not (file.path like ("/Library/LaunchDaemons/com.jumpcloud.*",
                       "/Library/LaunchAgents/com.jumpcloud.*",
                       "/Library/LaunchDaemons/com.wazuh.*",
                       "/Library/LaunchDaemons/com.zscaler.service.plist") and
       process.executable == "/bin/bash")
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

  [rule.threat.tactic]
  name = "Persistence"
  id = "TA0003"
  reference = "https://attack.mitre.org/tactics/TA0003/"

  [[rule.threat.technique]]
  name = "Boot or Logon Autostart Execution"
  id = "T1547"
  reference = "https://attack.mitre.org/techniques/T1547/"

    [[rule.threat.technique.subtechnique]]
    name = "Plist Modification"
    id = "T1547.011"
    reference = "https://attack.mitre.org/techniques/T1547/011/"

  [[rule.threat.technique]]
  name = "Create or Modify System Process"
  id = "T1543"
  reference = "https://attack.mitre.org/techniques/T1543/"

    [[rule.threat.technique.subtechnique]]
    name = "Launch Agent"
    id = "T1543.001"
    reference = "https://attack.mitre.org/techniques/T1543/001/"

    [[rule.threat.technique.subtechnique]]
    name = "Launch Daemon"
    id = "T1543.004"
    reference = "https://attack.mitre.org/techniques/T1543/004/"

[metadata]
creation_date = "2024/05/04"
integration = ["aws_bedrock"]
maturity = "production"
updated_date = "2025/09/25"

[rule]
author = ["Elastic"]
description = """
Detects potential resource exhaustion or data breach attempts by monitoring for users who consistently generate high
input token counts, submit numerous requests, and receive large responses. This behavior could indicate an attempt to
overload the system or extract an unusually large amount of data, possibly revealing sensitive information or causing
service disruptions.
"""
false_positives = ["Authorized heavy usage of the system that is business justified and monitored."]
from = "now-60m"
interval = "10m"
language = "esql"
license = "Elastic License v2"
name = "Potential Abuse of Resources by High Token Count and Large Response Sizes"
note = """## Triage and analysis

### Investigating Potential Abuse of Resources by High Token Count and Large Response Sizes

Amazon Bedrock is AWS’s managed service that enables developers to build and scale generative AI applications using large foundation models (FMs) from top providers.

Bedrock offers a variety of pretrained models from Amazon (such as the Titan series), as well as models from providers like Anthropic, Meta, Cohere, and AI21 Labs.

#### Possible investigation steps

- Identify the user account that used high prompt token counts and whether it should perform this kind of action.
- Investigate large response sizes and the number of requests made by the user account.
- Investigate other alerts associated with the user account during the past 48 hours.
- Consider the time of day. If the user is a human (not a program or script), did the activity take place during a normal time of day?
- Examine the account's prompts and responses in the last 24 hours.
- If you suspect the account has been compromised, scope potentially compromised assets by tracking Amazon Bedrock model access, prompts generated, and responses to the prompts by the account in the last 24 hours.

### False positive analysis

- Verify the user account that used high prompt and large response sizes, has a business justification for the heavy usage of the system.

### Response and remediation

- Initiate the incident response process based on the outcome of the triage.
- Disable or limit the account during the investigation and response.
- Identify the possible impact of the incident and prioritize accordingly; the following actions can help you gain context:
    - Identify the account role in the cloud environment.
    - Identify if the attacker is moving laterally and compromising other Amazon Bedrock Services.
    - Identify any regulatory or legal ramifications related to this activity.
    - Identify potential resource exhaustion and impact on billing.
- Review the permissions assigned to the implicated user group or role behind these requests to ensure they are authorized and expected to access bedrock and ensure that the least privilege principle is being followed.
- Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
"""
references = [
    "https://atlas.mitre.org/techniques/AML.T0051",
    "https://owasp.org/www-project-top-10-for-large-language-model-applications/",
    "https://www.elastic.co/security-labs/elastic-advances-llm-security",
]
risk_score = 47
rule_id = "b1773d05-f349-45fb-9850-287b8f92f02d"
setup = """## Setup

This rule requires that guardrails are configured in AWS Bedrock. For more information, see the AWS Bedrock documentation:

https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-create.html
"""
severity = "medium"
tags = [
    "Domain: LLM",
    "Data Source: AWS Bedrock",
    "Data Source: Amazon Web Services",
    "Data Source: AWS S3",
    "Use Case: Potential Overload",
    "Use Case: Resource Exhaustion",
    "Mitre Atlas: LLM04",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "esql"

query = '''
from logs-aws_bedrock.invocation-*

// keep token usage data
| keep
  user.id,
  gen_ai.usage.prompt_tokens,
  gen_ai.usage.completion_tokens

// Aggregate usage metrics
| stats
    Esql.ml_usage_prompt_tokens_max = max(gen_ai.usage.prompt_tokens),
    Esql.ml_invocations_total_count = count(*),
    Esql.ml_usage_completion_tokens_avg = avg(gen_ai.usage.completion_tokens)
  by
    user.id

// Filter for suspicious usage patterns
| where
  Esql.ml_usage_prompt_tokens_max > 5000
  and Esql.ml_invocations_total_count > 10
  and Esql.ml_usage_completion_tokens_avg > 500

// Calculate a custom risk factor
| eval Esql.ml_risk_score =
    (Esql.ml_usage_prompt_tokens_max / 1000) *
    Esql.ml_invocations_total_count *
    (Esql.ml_usage_completion_tokens_avg / 500)

// Filter on risk score
| where Esql.ml_risk_score > 10

// sort high risk users to top
| sort Esql.ml_risk_score desc
'''

[rule]
description = """
Identifies the load of a library with a modified file creation time. Adversaries may modify file time attributes to
blend malicious content with existing files. Timestomping is a technique that modifies the timestamps of a file often to
mimic files that are in trusted directories.
"""
id = "69b2dd59-13ba-4bda-8d0d-cf0e28eb1323"
license = "Elastic License v2"
name = "Potential Image Load with a Spoofed Creation Time"
os_list = ["windows"]
reference = [
    "https://attack.mitre.org/techniques/T1070/006/",
    "https://posts.specterops.io/revisiting-ttps-timestomper-622d4c28a655",
    "https://www.elastic.co/security-labs/Hunting-for-Suspicious-Windows-Libraries-for-Execution-and-Evasion",
]
version = "1.0.32"

query = '''
sequence with maxspan=5m
 [file where event.action == "creation" and file.Ext.header_bytes : "4d5a*" and

  not user.id : "S-1-5-18" and

  file.path : ("?:\\Windows\\system32\\*", "?:\\Windows\\SysWOW64\\*", "?:\\Program Files\\Microsoft\\*",
               "?:\\Program Files (x86)\\Microsoft\\*", "?:\\Users\\Public\\*", "?:\\ProgramData\\*",
               "?:\\Program Files\\Google\\Chrome\\*.dll", "?:\\Program Files\\Internet Explorer\\*.dll",
               "?:\\Program Files\\Mozilla Firefox\\*.dll") and

  not process.executable :
             ("?:\\Windows\\system32\\msiexec.exe",
              "?:\\Windows\\SysWOW64\\msiexec.exe",
              "?:\\windows\\system32\\drvinst.exe",
              "?:\\windows\\SysWOW64\\drvinst.exe",
              "C:\\Windows\\System32\\Robocopy.exe",
              "?:\\Program Files (x86)\\*.exe",
              "?:\\Program Files\\*.exe",
              "?:\\Windows\\System32\\DriverStore\\FileRepository\\*.exe") and

  not (process.code_signature.subject_name : ("Mozilla Corporation", "Google LLC", "JACK HENRY & ASSOCIATES, INC.") and 
       process.code_signature.trusted == true) and
  not file.path : ("?:\\ProgramData\\chocolatey\\tools\\detector\\*.dll",
                    "?:\\ProgramData\\chocolatey\\tools\\*.dll",
                    "?:\\ProgramData\\chocolatey\\lib\\*") and
  not (process.name : "xcopy.exe" and file.extension == "pyd")
  ] by file.path as event0
 [library where

  /* set to 6months, malwares often spoof creation times to at least 1 years */
  dll.Ext.relative_file_creation_time >= 15778476 and

  /* 5m */
  dll.Ext.relative_file_name_modify_time <= 300 and

  not dll.code_signature.status : ("trusted", "errorExpired", "errorCode_endpoint*") and

  dll.path : ("?:\\Windows\\system32\\*", "?:\\Windows\\SysWOW64\\*", "?:\\Program Files\\Microsoft\\*",
               "?:\\Program Files (x86)\\Microsoft\\*", "?:\\Users\\Public\\*", "?:\\ProgramData\\*",
               "?:\\Program Files\\Google\\Chrome\\*.dll", "?:\\Program Files\\Internet Explorer\\*.dll",
               "?:\\Program Files\\Mozilla Firefox\\*.dll") and

  not startswith~(dll.name, process.name) and

  event0.process.executable != process.executable and

  not (process.executable : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*") and
       not process.executable : ("?:\\Program Files*\\Microsoft\\*.exe", "?:\\Program Files*\\Google\\Chrome\\*.exe",
                                 "?:\\Program Files*\\Internet Explorer\\*.exe", "?:\\Program Files*\\Mozilla Firefox\\*.exe")) and

  not dll.hash.sha256 :
             ("9ac63dcf5a2437ed43cb143479ec4a810915017d8eb138a7fede88867e2a8121",
              "8bbe5898caa826ac1cb99d6c01c8a5ee9bb660493d2a48c9294d837390f7bae2",
              "42a0d4dca77d4ce7077c18e08b1d49715d6b1038e147611106388aec3e422c82",
              "6e12069312e286307a12ba71228e720e890d242191eb07d0e769630b600098b3",
              "0ae555e24450606fe86938be0450310e8d0da7cd8b661ed79c6f4dc6747cfd95",
              "8180f736781f2af47059a83c73c2c8b9f4423fc764c8897ac7c4f6dd8837a804",
              "c3823447efb2fe8690861541f23890bf5b7a36f40a9c282f4cb33cc3bb3d4689",
              "6324bf7d034935c2781fcef00a9c7b414ffdba4578f5368e09dc892cd49e3ecd",
              "6948e30a0d0eac9584071430d93f4e49645cbaf73ef821d723de6bc00ff13f79",
              "a11c83a10cdcfec7eea0a81ebbcb057513549897c1bdf559dcfb108ace06277f",
              "cd125611cdb5f3a74ee952951a692ee598daa5a7491e87676a4f68930117bb2a",
              "f9032348386637e55788348dc8ed5879daee978be8ab77cd42b0316427d6fbc8",
              "1a45f5985273d2372a352c07db6a15382780d6fce47d36195c6d1c5822c169b7",
              "53b7f8c0e4cb7bc41535985b114a04e7ad95c272a89e193119606e6160974ad5",
              "81c3bfbac5b40c20b4f6408de6b4afc5559517f100d8cb01f9a8f6805026ecf0",
              "e0d2c341e9c16d31e60ffdcbb5f84d49212f5fe695b41c9982eee3e9be5d07d8",
              "19112c6eef7ffc162245d7e19c8601fa49ccd239076ac32d3fe0ad9d0afb3e0b",
              "3430b3680415b494ba7eb41f7bc83933da68d364a94287b9c07384b2fe3dcb54",
              "aa106076e82a3acc62184d51817ae6619da0772cc964530fd843302d29ffb97d",
              "3016d572ea5e695b52b1759432dd30b7a9cbc2b53ac42e8c7735854b464e7d34",
              "b49f071ff276262190c6cc86dceab4936a4786428a834151a17b6845911748e8",
              "4a8fac0d6b09cc3fb57fd063af8b1a332080df5b0e2ff3710a82c109a4eee07c",
              "1ec927f25e4fcd1b5863fe3a0a60c2e8800467d5ed5148a917503b9cb6e9acf8",
              "9a75fd5816a220ab15248f0f337dfe5385fd053617c17742005cb63f126a11b0",
              "51075af59f6696d5dc5446ba39fabfd0022628cdcfa41c80e7cb66e3bf4ee55d",
              "585e2e465bf77e3daa25de7dcba5fac0606ae4a0e029903158d85ae0b1805f34",
              "a575175338706d1473e2bebe1cd811283c63c697a17c0865de85ede345898af6",
              "8dd93adc6e06cb7a404d259e59b644ad49b69a5d4215de607baf659fabfb2c4c") and
  not (process.code_signature.subject_name : ("Epicor Software Corporation", "KONICA MINOLTA, INC.", "3CX Ltd",
                                              "WZT", "Tendyron Corporation", "INTUIT INC.",
                                              "MEDENT (Community Computer Service Inc.)", "Pitney Bowes Inc.",
                                              "Bedford, Freeman & Worth Publishing Group, LLC",
                                              "PFU Limited",
                                              "Watchdata Technologies Pte. Ltd.",
                                              "WINMAN SOFTWARE INDIA LLP",
                                              "Voicebrook Inc",
                                              "CHENGDU YIWO Tech Development Co., Ltd.",
                                              "Benner Sistemas S/A",
                                              "Daybreak Game Company LLC",
                                              "CANON INC.",
                                              "Halliburton Company",
                                              "Mozilla Corporation") and
       process.code_signature.trusted == true) and
  not (dll.code_signature.subject_name : ("Mozilla Corporation", "Google LLC") and dll.code_signature.trusted == true) and
  not process.executable : "?:\\Windows\\SysWOW64\\regsvr32.exe"
  ] by dll.path
'''

min_endpoint_version = "8.4.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1070"
name = "Indicator Removal"
reference = "https://attack.mitre.org/techniques/T1070/"
[[threat.technique.subtechnique]]
id = "T1070.006"
name = "Timestomp"
reference = "https://attack.mitre.org/techniques/T1070/006/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.4.0"