Elastic rules: 2u

[rule]
description = """
Identifies attempt to mount or copy files from a remote WebDav Share. Adversaries may abuse this method to evade
dropping malicious files to victim file system.
"""
id = "0a364281-5edc-4f75-a839-48b150cec3f2"
license = "Elastic License v2"
name = "Attempt to Mount a Remote WebDav Share"
os_list = ["windows"]
version = "1.0.10"

query = '''
process where event.action == "start" and
 (
  (process.name : "explorer.exe" and process.args : "\\\\*@*") or
  (process.name : "rundll32.exe" and process.command_line : "*\\\\*@*,*" and process.parent.name : ("explorer.exe", "cmd.exe", "powershell.exe", "mshta.exe", "msiexec.exe")) or 
  (process.name : "net.exe" and process.args : "use" and 
   ((process.args : ("http*:*", "*webdav*") and process.args : "/user*@*") or process.command_line : "*\\\\*@ssl\\*") and not process.command_line : "*//localhost*") or
  (process.name : ("expand.exe", "xcopy.exe", "cmd.exe") and process.args : ("\\\\webdav*", "*DavWWWRoot*"))
 ) and
 not (process.parent.name : "rundll32.exe" and process.parent.args : "?:\\Program Files\\Microsoft Office\\root\\Office16\\MLCFG32.CPL") and
 not process.parent.executable : ("C:\\Program Files\\Microsoft Office\\root\\Office16\\WINPROJ.EXE",
                                  "D:\\SF-Deploy\\Console\\Console.exe",
                                  "C:\\Program Files\\WindowsApps\\MyCaseInc.MyCaseFileSync_*\\app\\MyCase Desktop.exe",
                                  "C:\\Program Files\\Microsoft Office\\root\\Office16\\OUTLOOK.EXE") and
 not (process.name : "xcopy.exe" and process.args : "\\\\*.sharepoint.com\\DavWWWRoot\\sites\\*")
'''

min_endpoint_version = "7.16.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1204"
name = "User Execution"
reference = "https://attack.mitre.org/techniques/T1204/"
[[threat.technique.subtechnique]]
id = "T1204.002"
name = "Malicious File"
reference = "https://attack.mitre.org/techniques/T1204/002/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1021"
name = "Remote Services"
reference = "https://attack.mitre.org/techniques/T1021/"
[[threat.technique.subtechnique]]
id = "T1021.002"
name = "SMB/Windows Admin Shares"
reference = "https://attack.mitre.org/techniques/T1021/002/"



[threat.tactic]
id = "TA0008"
name = "Lateral Movement"
reference = "https://attack.mitre.org/tactics/TA0008/"

[internal]
min_endpoint_version = "7.16.0"

[metadata]
creation_date = "2026/04/04"
integration = ["aws"]
maturity = "production"
updated_date = "2026/04/04"

[rule]
author = ["Elastic"]
description = """
Detects successful IAM API calls that create or empower IAM users and roles, attach or embed policies, or wire roles to
instance profiles when the caller is an assumed role session associated with AWS Lambda. Serverless execution roles are
often over-permissioned; an adversary who can run or compromise function code can abuse these APIs for privilege
escalation and persistence—for example creating users or roles, issuing keys, attaching managed or inline policies, or
preparing EC2 instance profiles for lateral movement.
"""
false_positives = [
    """
    Some organizations intentionally use Lambda functions to provision IAM principals, bootstrap accounts, or run
    identity automation (including roles and instance profiles). Confirm the function name in `user_identity.arn`,
    deployment pipelines, and change records. Exclude known automation roles or specific
    `session_context.session_issuer.arn` values after validation.
    """,
]
from = "now-6m"
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
interval = "5m"
language = "kuery"
license = "Elastic License v2"
name = "AWS IAM Sensitive Operations via Lambda Execution Role"
note = """## Triage and analysis

### Investigating AWS IAM Sensitive Operations via Lambda Execution Role

Lambda functions run under an **execution role**. When that role calls sensitive IAM control-plane APIs—user and group
changes (`CreateUser`, `AddUserToGroup`, …), user or role policies (`AttachUserPolicy`, `PutUserPolicy`,
`AttachRolePolicy`, `PutRolePolicy`), role and instance-profile wiring (`CreateRole`, `CreateInstanceProfile`,
`AddRoleToInstanceProfile`), or `CreateAccessKey`—CloudTrail typically records `user_identity.type` as `AssumedRole` and
may set `user_identity.invoked_by` to `lambda.amazonaws.com`. The session issuer ARN often references the Lambda service
or the execution role.

#### Possible investigation steps

- Parse `aws.cloudtrail.user_identity.arn` for the assumed-role session (function name or request id) and map it to the
  Lambda function and deployment path in the same account.
- Review `aws.cloudtrail.request_parameters` for targets such as `userName`, `groupName`, `roleName`, `policyArn`,
  `instanceProfileName`, or access key subject.
- Compare `user_agent.original` and `source.ip` to expected Lambda service patterns; correlate with CloudWatch Logs for
  the function around `@timestamp`.
- Hunt ±30 minutes for follow-on IAM, `sts:AssumeRole`, or data-plane access using any new credentials.

### False positive analysis

- Approved infrastructure-as-code or onboarding Lambdas may perform these calls. Tune on execution role ARN or tags.

### Response and remediation

- If unauthorized: disable the function, revoke or rotate the execution role credentials, remove rogue IAM users, roles,
  instance profiles, or keys, detach or delete unintended policies, and review permission boundaries on the role.

### Additional information

- [IAM API reference](https://docs.aws.amazon.com/IAM/latest/APIReference/)
- [Lambda execution role](https://docs.aws.amazon.com/lambda/latest/dg/lambda-intro-execution-role.html)
"""
references = [
    "https://docs.aws.amazon.com/lambda/latest/dg/lambda-intro-execution-role.html",
    "https://hackingthe.cloud/aws/exploitation/iam_privilege_escalation/",
    "https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateUser.html",
]
risk_score = 73
rule_id = "a8f3c2e1-4d5b-4e6f-8a9b-0c1d2e3f4a5b"
severity = "high"
tags = [
    "Domain: Cloud",
    "Domain: Identity",
    "Data Source: AWS",
    "Data Source: Amazon Web Services",
    "Data Source: AWS IAM",
    "Data Source: AWS Lambda",
    "Use Case: Threat Detection",
    "Tactic: Privilege Escalation",
    "Tactic: Persistence",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
event.dataset: "aws.cloudtrail"
    and event.provider: "iam.amazonaws.com"
    and event.outcome: "success"
    and aws.cloudtrail.user_identity.type: "AssumedRole"
    and (
        aws.cloudtrail.user_identity.invoked_by: "lambda.amazonaws.com"
        or user_agent.original : *AWS_Lambda*
    )
    and event.action: (
        "AddRoleToInstanceProfile" or
        "AddUserToGroup" or 
        "AttachGroupPolicy" or 
        "AttachRolePolicy" or
        "AttachUserPolicy" or
        "CreateAccessKey" or
        "CreateInstanceProfile" or
        "CreateRole" or
        "CreateUser" or
        "PutRolePolicy" or
        "PutUserPolicy"
    )
'''

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user_agent.original",
    "source.ip",
    "aws.cloudtrail.user_identity.arn",
    "aws.cloudtrail.user_identity.type",
    "aws.cloudtrail.user_identity.invoked_by",
    "aws.cloudtrail.user_identity.access_key_id",
    "aws.cloudtrail.request_parameters",
    "aws.cloudtrail.response_elements",
    "event.action",
    "event.outcome",
    "cloud.account.id",
    "cloud.region",
]

[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"
[[rule.threat.technique.subtechnique]]
id = "T1078.004"
name = "Cloud Accounts"
reference = "https://attack.mitre.org/techniques/T1078/004/"
[rule.threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"



[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1136"
name = "Create Account"
reference = "https://attack.mitre.org/techniques/T1136/"
[[rule.threat.technique.subtechnique]]
id = "T1136.003"
name = "Cloud Account"
reference = "https://attack.mitre.org/techniques/T1136/003/"
[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[rule]
description = """
Identifies when data is encrypted and archived using common compression and encryption tools. This activity can indicate
an attempt to collect sensitive data and stage it for exfiltration.
"""
id = "2454d6fc-1ff8-4a59-8bcf-d6e8c4bb2c09"
license = "Elastic License v2"
name = "Data Encrypted and Archived"
os_list = ["linux", "windows"]
reference = [
    "https://futuresearch.ai/blog/litellm-pypi-supply-chain-attack/",
    "https://www.virustotal.com/gui/file/71e35aef03099cd1f2d6446734273025a163597de93912df321ef118bf135238",
]
version = "1.0.4"

query = '''
sequence by process.parent.entity_id with maxspan=10s
  [process where event.type == "start" and event.action in ("exec", "start") and process.name : ("openssl", "openssl.exe") and
  process.args : ("enc", "pkeyutl", "cms", "smime")]
  [process where event.type == "start" and event.action in ("exec", "start") and
  process.name : (
    "tar", "zip", "gzip", "xz", "7z", "7za", "7zr", "bzip2", "zstd",
    "tar.exe", "zip.exe", "gzip.exe", "7z.exe", "7za.exe", "7zr.exe", "bzip2.exe", "zstd.exe", "zstd64.exe"
  ) and
  not (
    process.parent.args in (
      "/opt/rudder/share/commands/agent-run", "/usr/sbin/backup_orbini", "/usr/local/bin/mariadb-backup.sh",
      "/usr/local/bin/drupal-per-site-backup.sh"
    ) or
    process.parent.args like "mariabackup*db_backup*" or
    process.parent.command_line like (
      "*mysqldump*localhost*/storage/backup*", "*/etc/pve*prox_backup*", "*/home/*/.local/bin/authd*"
    ) or
    process.parent.executable == "/opt/rudder/bin/rudder" or
    process.working_directory like "/mnt/vstk/queue/*" or
    process.args like "/var/rudder/tmp/reports/*" or
    (process.name == "tar" and process.working_directory like "/u/sysdat/*") or
    (
      (process.parent.executable == "/home/backup/backup.sh" or process.parent.args == "/backup/backup_temp") and
      process.working_directory like "/storage/*"
    )
  )]
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1027"
name = "Obfuscated Files or Information"
reference = "https://attack.mitre.org/techniques/T1027/"
[[threat.technique.subtechnique]]
id = "T1027.013"
name = "Encrypted/Encoded File"
reference = "https://attack.mitre.org/techniques/T1027/013/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1074"
name = "Data Staged"
reference = "https://attack.mitre.org/techniques/T1074/"
[[threat.technique.subtechnique]]
id = "T1074.001"
name = "Local Data Staging"
reference = "https://attack.mitre.org/techniques/T1074/001/"



[threat.tactic]
id = "TA0009"
name = "Collection"
reference = "https://attack.mitre.org/tactics/TA0009/"

[internal]
min_endpoint_version = "7.15.0"

[metadata]
creation_date = "2026/05/26"
integration = ["azure"]
maturity = "production"
updated_date = "2026/05/26"

[rule]
author = ["Elastic"]
description = """
Detects Microsoft Entra ID sign-in activity where the Microsoft Authentication Broker requests the Device Registration
Service from a source autonomous system number (ASN) associated with VPN, residential proxy, or hosting egress commonly
observed in OAuth phishing and adversary-in-the-middle device registration flows. This pattern can indicate device join
or primary refresh token acquisition staged from attacker-controlled infrastructure after a user completes
authentication.
"""
false_positives = [
    """
    Users enrolling or joining devices while on corporate VPNs, consumer VPNs, or cloud egress that map to the listed
    ASNs may match. Legitimate mobile device management or bulk provisioning that uses the broker against Device
    Registration Service from the same networks can also trigger alerts. Baseline `source.as.organization.name` and
    successful broker-to-DRS sign-ins before tuning exclusions for approved ASNs or user groups.
    """,
]
from = "now-9m"
index = ["logs-azure.signinlogs-*"]
language = "kuery"
license = "Elastic License v2"
name = "Entra ID Microsoft Authentication Broker DRS Sign-In from Suspicious ASN"
note = """## Triage and analysis

### Investigating Entra ID Microsoft Authentication Broker DRS Sign-In from Suspicious ASN

Review `azure.signinlogs.properties.user_principal_name`, `azure.signinlogs.properties.app_display_name`,
`azure.signinlogs.properties.resource_display_name`, `azure.signinlogs.properties.session_id`, `source.ip`,
`source.as.number`, `source.as.organization.name`, and `user_agent.original`.

Confirm whether the user intentionally registered or joined a device and whether the source ASN is expected for your
enrollment or remote-access programs.

### Possible investigation steps

- Correlate `azure.signinlogs.properties.session_id` with other sign-ins for the same user, especially multi-IP OAuth
  flows or follow-on primary refresh token usage.
- Review Entra ID audit logs for device registration activity around the same timestamp.
- Compare `source.as.organization.name` against approved VPN, MDM, and automation egress in your environment.
- Hunt for additional users signing in from the same ASN with the same application pair in a short window.

### False positive analysis

- Corporate or consumer VPN exit nodes that use ASNs in the rule list are a common source of benign matches during
  standard Windows or mobile device join.
- Cloud hosting or ISP NAT pools may intermittently map to listed ASNs without indicating compromise.

### Response and remediation

- If malicious, revoke refresh tokens for the user, disable suspicious registered devices, and reset credentials per
  policy.
- Review conditional access for the Microsoft Authentication Broker and device registration requirements.
- Escalate per incident procedures when paired with identity protection alerts or impossible travel.
"""
references = [
    "https://www.volexity.com/blog/2025/04/22/phishing-for-codes-russian-threat-actors-target-microsoft-365-oauth-workflows/",
    "https://dirkjanm.io/phishing-for-microsoft-entra-primary-refresh-tokens/",
]
risk_score = 73
rule_id = "3d086f43-5382-493d-a018-bce165c88f9f"
severity = "high"
tags = [
    "Domain: Cloud",
    "Domain: Identity",
    "Data Source: Azure",
    "Data Source: Microsoft Entra ID",
    "Data Source: Microsoft Entra ID Sign-In Logs",
    "Use Case: Threat Detection",
    "Tactic: Initial Access",
    "Tactic: Persistence",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset:"azure.signinlogs" and event.action:"Sign-in activity" and
source.as.number:(
    399629 or 14061 or 136787 or 9009 or 45102 or 215540 or 29802 or 62240 or 204957 or 395092 or 393406 or 400940 or
    59711 or 132203
) and
azure.signinlogs.properties.app_display_name:"Microsoft Authentication Broker" and
azure.signinlogs.properties.resource_display_name:"Device Registration Service"
'''

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user_agent.original",
    "source.ip",
    "source.as.number",
    "source.as.organization.name",
    "source.geo.country_name",
    "event.outcome",
    "azure.signinlogs.properties.user_principal_name",
    "azure.signinlogs.properties.session_id",
    "azure.signinlogs.properties.app_display_name",
    "azure.signinlogs.properties.app_id",
    "azure.signinlogs.properties.resource_display_name",
    "azure.signinlogs.properties.resource_id",
    "azure.signinlogs.properties.authentication_protocol",
    "azure.tenant_id",
]

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"

[[rule.threat.technique.subtechnique]]
id = "T1098.005"
name = "Device Registration"
reference = "https://attack.mitre.org/techniques/T1098/005/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"

[[rule.threat.technique.subtechnique]]
id = "T1566.002"
name = "Spearphishing Link"
reference = "https://attack.mitre.org/techniques/T1566/002/"

[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1550"
name = "Use Alternate Authentication Material"
reference = "https://attack.mitre.org/techniques/T1550/"

[[rule.threat.technique.subtechnique]]
id = "T1550.001"
name = "Application Access Token"
reference = "https://attack.mitre.org/techniques/T1550/001/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[metadata]
creation_date = "2023/09/26"
integration = ["endpoint"]
maturity = "production"
updated_date = "2026/03/24"

[rule]
author = ["Elastic"]
building_block_type = "default"
description = """
Identifies the execution of a command via Microsoft Visual Studio Pre or Post build events. Adversaries may backdoor a
trusted visual studio project to execute a malicious command during the project build process.
"""
from = "now-119m"
index = ["logs-endpoint.events.process-*"]
interval = "60m"
language = "eql"
license = "Elastic License v2"
name = "Execution via MS VisualStudio Pre/Post Build Events"
references = [
    "https://docs.microsoft.com/en-us/visualstudio/ide/reference/pre-build-event-post-build-event-command-line-dialog-box?view=vs-2022",
    "https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/threat-actor-of-in-tur-est.html",
    "https://blog.google/threat-analysis-group/new-campaign-targeting-security-researchers/",
    "https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES/blob/master/Execution/execution_evasion_visual_studio_prebuild_event.evtx",
]
risk_score = 21
rule_id = "fec7ccb7-6ed9-4f98-93ab-d6b366b063a0"
severity = "low"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Defense Evasion",
    "Tactic: Execution",
    "Rule Type: BBR",
    "Data Source: Elastic Defend",
]
type = "eql"

query = '''
sequence with maxspan=1m
  [process where host.os.type == "windows" and event.action == "start" and
   process.name : "cmd.exe" and process.parent.name : "MSBuild.exe" and
   process.args : "?:\\Users\\*\\AppData\\Local\\Temp\\tmp*.exec.cmd"] by process.entity_id
  [process where host.os.type == "windows" and event.action == "start" and
    process.name : (
      "cmd.exe", "powershell.exe",
      "MSHTA.EXE", "CertUtil.exe",
      "CertReq.exe", "rundll32.exe",
      "regsvr32.exe", "MSbuild.exe",
      "cscript.exe", "wscript.exe",
      "installutil.exe"
    ) and
    not 
    (
      process.name : ("cmd.exe", "powershell.exe") and
      process.args : (
        "*\\vcpkg\\scripts\\buildsystems\\msbuild\\applocal.ps1",
        "HKLM\\SOFTWARE\\Microsoft\\VisualStudio\\SxS\\VS?",
        "process.versions.node*",
        "?:\\Program Files\\nodejs\\node.exe",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MSBuild\\ToolsVersions\\*",
        "*Get-ChildItem*Tipasplus.css*",
        "Build\\GenerateResourceScripts.ps1",
        "Shared\\Common\\..\\..\\BuildTools\\ConfigBuilder.ps1\"",
        "?:\\Projets\\*\\PostBuild\\MediaCache.ps1"
      )
    ) and
    not process.executable : "?:\\Program Files*\\Microsoft Visual Studio\\*\\MSBuild.exe" and
    not (process.name : "cmd.exe" and
         process.command_line :
                  ("*vswhere.exe -property catalog_productSemanticVersion*",
                   "*git log --pretty=format*", "*\\.nuget\\packages\\vswhere\\*",
                   "*Common\\..\\..\\BuildTools\\*"))
  ] by process.parent.entity_id
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1127"
name = "Trusted Developer Utilities Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1127/"

[[rule.threat.technique.subtechnique]]
id = "T1127.001"
name = "MSBuild"
reference = "https://attack.mitre.org/techniques/T1127/001/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"

[[rule.threat.technique.subtechnique]]
id = "T1059.003"
name = "Windows Command Shell"
reference = "https://attack.mitre.org/techniques/T1059/003/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[metadata]
creation_date = "2023/03/16"
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2026/05/04"

[rule]
author = ["Elastic"]
description = """
Identifies newly seen removable devices by device friendly name using registry modification events. While this activity
is not inherently malicious, analysts can use those events to aid monitoring for data exfiltration over those devices.
"""
from = "now-9m"
index = [
    "logs-endpoint.events.registry-*",
    "winlogbeat-*",
    "logs-windows.sysmon_operational-*",
    "endgame-*",
    "logs-m365_defender.event-*",
    "logs-sentinel_one_cloud_funnel.*",
]
language = "kuery"
license = "Elastic License v2"
name = "First Time Seen Removable Device"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating First Time Seen Removable Device

Removable devices, like USB drives, are common in Windows environments for data transfer. Adversaries exploit these to introduce malware or exfiltrate data, leveraging their plug-and-play nature. The detection rule monitors registry changes for new device names, signaling potential unauthorized access. By focusing on first-time-seen devices, it helps identify suspicious activities linked to data exfiltration or initial access attempts.

### Possible investigation steps

- Review the registry event details to confirm the presence of a new device by checking the registry.value for "FriendlyName" and registry.path for USBSTOR.
- Correlate the timestamp of the registry event with user activity logs to identify which user was logged in at the time of the device connection.
- Check for any subsequent file access or transfer events involving the new device to assess potential data exfiltration.
- Investigate the device's history by searching for any previous connections to other systems within the network to determine if it has been used elsewhere.
- Analyze any related alerts or logs from data sources like Elastic Endgame, Sysmon, or Microsoft Defender XDR for additional context or suspicious activities linked to the device.

### False positive analysis

- Frequent use of company-issued USB drives for legitimate data transfer can trigger alerts. Maintain a list of approved devices and create exceptions for these in the monitoring system.
- Software updates or installations via USB drives may be flagged. Identify and whitelist known update devices or processes to prevent unnecessary alerts.
- IT department activities involving USB devices for maintenance or troubleshooting can appear suspicious. Coordinate with IT to log and exclude these routine operations from triggering alerts.
- Devices used for regular backups might be detected as new. Ensure backup devices are registered and excluded from the rule to avoid false positives.
- Personal USB devices used by employees for non-work-related purposes can cause alerts. Implement a policy for registering personal devices and exclude them if deemed non-threatening.

### Response and remediation

- Immediately isolate the affected host from the network to prevent potential data exfiltration or further spread of malware.
- Conduct a thorough scan of the isolated host using updated antivirus and anti-malware tools to identify and remove any malicious software introduced via the removable device.
- Review and analyze the registry changes logged by the detection rule to confirm the legitimacy of the device and assess any unauthorized access attempts.
- If malicious activity is confirmed, collect and preserve relevant logs and evidence for further forensic analysis and potential legal action.
- Notify the security team and relevant stakeholders about the incident, providing details of the device and any identified threats.
- Implement a temporary block on the use of removable devices across the network until the threat is fully contained and remediated.
- Enhance monitoring and detection capabilities by updating security tools and rules to better identify similar threats in the future, focusing on registry changes and device connections."""
references = [
    "https://winreg-kb.readthedocs.io/en/latest/sources/system-keys/USB-storage.html",
    "https://learn.microsoft.com/en-us/windows-hardware/drivers/usbcon/usb-device-specific-registry-settings",
]
risk_score = 21
rule_id = "0859355c-0f08-4b43-8ff5-7d2a4789fc08"
severity = "low"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Initial Access",
    "Tactic: Exfiltration",
    "Data Source: Elastic Endgame",
    "Data Source: Elastic Defend",
    "Data Source: Sysmon",
    "Data Source: Microsoft Defender XDR",
    "Data Source: SentinelOne",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "new_terms"

query = '''
event.category:"registry" and host.os.type:"windows" and registry.value:"FriendlyName" and registry.path:*USBSTOR*
'''

setup = """## Setup

This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.

Setup instructions: https://ela.st/install-elastic-defend

### Additional data sources

This rule also supports the following third-party data sources. For setup instructions, refer to the links below:

- [Microsoft Defender XDR](https://ela.st/m365-defender)
- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
- [Sysmon Registry Events](https://ela.st/sysmon-event-reg-setup)
"""


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1091"
name = "Replication Through Removable Media"
reference = "https://attack.mitre.org/techniques/T1091/"


[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1052"
name = "Exfiltration Over Physical Medium"
reference = "https://attack.mitre.org/techniques/T1052/"
[[rule.threat.technique.subtechnique]]
id = "T1052.001"
name = "Exfiltration over USB"
reference = "https://attack.mitre.org/techniques/T1052/001/"



[rule.threat.tactic]
id = "TA0010"
name = "Exfiltration"
reference = "https://attack.mitre.org/tactics/TA0010/"

[rule.new_terms]
field = "new_terms_fields"
value = ["registry.path"]
[[rule.new_terms.history_window_start]]
field = "history_window_start"
value = "now-7d"

[rule]
description = """
This rule detects when a hidden process executes a command that includes an IP address as an argument and initiates an
egress network connection. This may indicate command and control behavior.
"""
id = "c14705f7-ebd3-4cf7-88b3-6bff2d832f1b"
license = "Elastic License v2"
name = "Hidden Executable Initiated Egress Network Connection"
os_list = ["linux"]
version = "1.0.7"

query = '''
sequence by process.entity_id with maxspan=10s
  [process where event.type == "start" and event.action == "exec" and process.name like ".*" and
   process.command_line regex ".*[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}.*" and
   not (
     process.executable like (
       "/home/*/.npm/_npx/*/node_modules/opencode-ai/bin/.opencode",
       "/home/*/.local/share/fnm/node-versions/*/installation/lib/node_modules/opencode-ai/bin/.opencode"
     ) or
     process.parent.executable == "/usr/bin/buildah"
  )]
  [network where event.type == "start" and event.action == "connection_attempted" and not (
     destination.ip == null or destination.ip == "0.0.0.0" or cidrmatch(
       destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.0.0/29",
       "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
       "192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10",
       "192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1", "FE80::/10",
       "FF00::/8"
     )
   )
  ]
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1564"
name = "Hide Artifacts"
reference = "https://attack.mitre.org/techniques/T1564/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[[threat]]
framework = "MITRE ATT&CK"

[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "7.15.0"

[rule]
description = """
Identifies attempt to access the Local Security Authority Subsystem Service (LSASS) and from a call stack containing
unbacked code. Adversaries may attempt to access credential material stored in the process memory of LSASS.
"""
id = "03efdaab-72af-4714-83ce-3abc10cab8d5"
license = "Elastic License v2"
name = "LSASS Access Attempt from Unbacked Memory"
os_list = ["windows"]
version = "1.0.17"

query = '''
sequence by process.entity_id with maxspan=3m
[process where event.action == "start" and
  process.parent.name != null and
 (
   process.executable : ("?:\\Windows\\system32\\*", "?:\\Windows\\SysWOW64\\*") or
   process.parent.executable : "?:\\Windows\\system32\\wsmprovhost.exe" or
   process.executable regex~ """c:\\windows\\[a-z0-9\-\_\.]+\.exe"""
  ) and
  not (process.executable : "?:\\Windows\\system32\\svchost.exe" and process.parent.name : "services.exe") and
  not (process.executable : "?:\\Windows\\System32\\MRT.exe" and process.parent.executable : "?:\\Windows\\SoftwareDistribution\\*.exe") and
  process.Ext.protection != "PsProtectedSignerAntimalware-Light" and
  not (process.executable : "?:\\Windows\\System32\\msiexec.exe" and process.args : "/V") and
  not (process.parent.executable : "?:\\Windows\\System32\\msiexec.exe" and process.parent.args : "/V") and
  not (process.executable : ("?:\\Windows\\System32\\wbem\\WmiPrvSE.exe", "?:\\Windows\\SysWOW64\\wbem\\WmiPrvSE.exe") and
       process.args : "-Embedding" and process.parent.name : "svchost.exe") and
  not (process.executable : "?:\\Windows\\system32\\netstat.exe" and user.id == "S-1-5-18" and process.args : ("-a", "/a")) and
  not (process.executable : "?:\\Windows\\system32\\tasklist.exe" and process.args : "/M") and
  not (process.name : "powershell.exe" and process.args : "'C:\\ProgramData\\CentraStage\\AEMAgent\\Temp\\*.ps1'" and
   process.parent.executable : "C:\\ProgramData\\CentraStage\\AEMAgent\\AEMAgent.exe") and
  not (user.id == "S-1-5-18" and process.executable : "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" and
       process.parent.command_line : ("cmd /c \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -NonInteractive -NoProfile -ExecutionPolicy Bypass -File -\"",
                                      "cmd /d /c \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -NonInteractive -NoProfile -ExecutionPolicy Bypass -File -\"") and
       process.working_directory : ("C:\\Program Files (x86)\\Tanium\\Tanium Client\\extensions\\comply\\data\\results\\*", "c:\\Program Files\\Nodeware\\"))
]
[credential_access where
  Target.process.name : "lsass.exe" and
  process.thread.Ext.call_stack_contains_unbacked == true and
  not _arraysearch(process.thread.Ext.call_stack, $entry,
                   $entry.module_path : ("?:\\Program Files\\*",
                                         "?:\\Program Files (x86)\\*",
                                         "?:\\Windows\\assembly\\NativeImages*",
                                         "?:\\Windows\\System32\\DriverStore*"))]
'''

min_endpoint_version = "8.7.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1003"
name = "OS Credential Dumping"
reference = "https://attack.mitre.org/techniques/T1003/"
[[threat.technique.subtechnique]]
id = "T1003.001"
name = "LSASS Memory"
reference = "https://attack.mitre.org/techniques/T1003/001/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "8.7.0"

[metadata]
creation_date = "2026/01/21"
integration = ["fortinet_fortigate"]
maturity = "production"
updated_date = "2026/02/18"

[rule]
author = ["Elastic"]
description = """
This rule detects FortiGate alerts that are observed for the first time in the previous 5 days of alert history.
Analysts can use this to prioritize triage and response.
"""
from = "now-7205m"
interval = "5m"
language = "esql"
license = "Elastic License v2"
name = "Newly Observed FortiGate Alert"
risk_score = 99
rule_id = "2c40dfe2-c13e-48a8-8eff-fb9bfb2a7854"
severity = "critical"
tags = ["Use Case: Threat Detection", "Rule Type: Higher-Order Rule", "Resources: Investigation Guide", "Domain: Network", "Data Source: Fortinet"]
timestamp_override = "event.ingested"
type = "esql"

query = '''
FROM logs-fortinet_fortigate.*, filebeat-* metadata _id

| WHERE event.module == "fortinet_fortigate" and event.action in ("signature", "ssl-anomaly") and
  message is not null and event.category != "authentication" and
  message != "Connection Failed" and not message like "Web.Client: *" and
  not message like "Network.Service: *" and not message like "General.Interest*" and not message like "Update: *" and
  not message like "tcp_reassembler*" and not message like "a-ipdf*" and not message like "Video*" and not message like "nbss_decode*" and
  not message like "name_server*" and not message like "misc*" and not message like "Collaboration*" and not message like "Business*" and
  not message like "Cloud.IT*" and not message like "Mobile*"

| STATS Esql.alerts_count = count(*),
        Esql.first_time_seen = MIN(@timestamp),
        Esql.distinct_count_src_ip = COUNT_DISTINCT(source.ip),
        Esql.distinct_count_dst_ip = COUNT_DISTINCT(destination.ip),
        src_ip = VALUES(source.ip),
        dst_ip = VALUES(destination.ip),
        url_domain = VALUES(url.domain),
        url_path = VALUES(url.path) by message, event.category, event.outcome

// first time seen is within 10m of the rule execution time
| eval Esql.recent = DATE_DIFF("minute", Esql.first_time_seen, now())
| where Esql.recent <= 10 and Esql.alerts_count <= 5 and Esql.distinct_count_src_ip <= 2 and Esql.distinct_count_dst_ip <= 2

// move dynamic fields to ECS equivalent for rule exceptions
| eval source.ip = MV_FIRST(src_ip),
       destination.ip = MV_FIRST(dst_ip),
       url.domain = MV_FIRST(url_domain),
       url.path = MV_FIRST(url_path)

| keep message, event.category, event.outcome, Esql.*, source.ip, destination.ip, url.domain, url.path
'''
note = """## Triage and analysis

### Investigating Newly Observed Fortigate Alert

This rule surfaces newly observed, low-frequency high severity FortiGate alerts within the last 5 days.

Because the alert has not been seen previously, it should be prioritized for validation to determine whether it represents a true compromise or rare benign activity.

### Investigation Steps

- Identify the source address, affected host and review the associated message to understand the alert.
- Validate the source address under which the activity occurred and assess whether it aligns with normal behavior.
- Refer to the specific alert details like event.original to get more context.

### False Positive Considerations

- Vulnerability scanners and pentesting.
- Administrative scripts or automation tools can trigger detections when first introduced.
- Development or testing environments may produce one-off behaviors that resemble malicious techniques.

### Response and Remediation

- If the activity is confirmed malicious, isolate the affected host to prevent further execution or lateral movement.
- Terminate malicious processes and remove any dropped files or persistence mechanisms.
- Collect forensic artifacts to understand initial access and execution flow.
- Patch or remediate any vulnerabilities or misconfigurations that enabled the behavior.
- If benign, document the finding and consider tuning or exception handling to reduce future noise.
- Continue monitoring the host and environment for recurrence of the behavior or related alerts."""
references = ["https://www.elastic.co/docs/reference/integrations/fortinet_fortigate"]

[metadata]
creation_date = "2024/06/05"
integration = ["windows", "endpoint", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2026/05/04"

[rule]
author = ["Elastic"]
description = """
Identifies the execution of wbadmin to access the NTDS.dit file in a domain controller. Attackers with privileges from
groups like Backup Operators can abuse the utility to perform credential access and compromise the domain.
"""
from = "now-9m"
index = [
    "endgame-*",
    "logs-crowdstrike.fdr*",
    "logs-endpoint.events.process-*",
    "logs-m365_defender.event-*",
    "logs-sentinel_one_cloud_funnel.*",
    "logs-system.security*",
    "logs-windows.forwarded*",
    "logs-windows.sysmon_operational-*",
    "winlogbeat-*",
]
language = "eql"
license = "Elastic License v2"
name = "NTDS Dump via Wbadmin"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating NTDS Dump via Wbadmin

Wbadmin is a Windows utility for backup and recovery, often used by administrators to safeguard critical data. However, adversaries with sufficient privileges, such as those in the Backup Operators group, can exploit it to access the NTDS.dit file on domain controllers, which contains sensitive credential information. The detection rule identifies suspicious use of wbadmin by monitoring for its execution with specific arguments related to NTDS.dit, helping to flag potential credential dumping activities.

### Possible investigation steps

- Review the process execution details to confirm the presence of wbadmin.exe with the specific arguments related to NTDS.dit, as indicated by the process.command_line field.
- Check the user account associated with the process execution to determine if it belongs to a privileged group such as Backup Operators, which could indicate potential misuse of privileges.
- Investigate the source host identified by host.os.type to determine if it is a domain controller, as this would be a critical factor in assessing the risk of the activity.
- Correlate the event with other security logs or alerts from data sources like Microsoft Defender XDR or Sysmon to identify any related suspicious activities or patterns.
- Examine recent changes or access attempts to the NTDS.dit file on the domain controller to identify any unauthorized access or modifications.
- Assess the risk score and severity level to prioritize the investigation and determine if immediate response actions are necessary.

### False positive analysis

- Scheduled backups by legitimate IT staff can trigger the rule. Verify the identity and role of the user executing wbadmin and consider excluding known backup schedules from detection.
- Automated recovery processes in disaster recovery plans might use wbadmin with similar arguments. Review and whitelist these processes if they are part of approved recovery procedures.
- Security audits or compliance checks may involve accessing NTDS.dit for validation purposes. Confirm the legitimacy of these activities and exclude them if they are part of regular audits.
- Test environments that mimic production setups might execute similar commands. Ensure these environments are properly documented and excluded from detection if they are used for testing purposes.

### Response and remediation

- Immediately isolate the affected domain controller from the network to prevent further unauthorized access or data exfiltration.
- Revoke any suspicious or unauthorized accounts from the Backup Operators group and review all accounts with elevated privileges for legitimacy.
- Conduct a thorough review of recent backup and recovery operations on the affected domain controller to identify any unauthorized access or data manipulation.
- Change all domain administrator and service account passwords to mitigate potential credential compromise.
- Restore the NTDS.dit file from a known good backup if any unauthorized modifications are detected.
- Implement enhanced monitoring and logging for wbadmin.exe usage across all domain controllers to detect future unauthorized access attempts.
- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to assess the potential impact on the broader network."""
references = ["https://medium.com/r3d-buck3t/windows-privesc-with-sebackupprivilege-65d2cd1eb960"]
risk_score = 47
rule_id = "d93e61db-82d6-4095-99aa-714988118064"
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Credential Access",
    "Data Source: Elastic Endgame",
    "Data Source: Elastic Defend",
    "Data Source: Windows Security Event Logs",
    "Data Source: Microsoft Defender XDR",
    "Data Source: Sysmon",
    "Data Source: SentinelOne",
    "Data Source: Crowdstrike",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
process where host.os.type == "windows" and event.type == "start" and
    (process.name : "wbadmin.exe" or ?process.pe.original_file_name : "wbadmin.exe") and
     process.args : "recovery" and process.command_line : "*ntds.dit*"
'''

setup = """## Setup

This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.

Setup instructions: https://ela.st/install-elastic-defend

### Additional data sources

This rule also supports the following third-party data sources. For setup instructions, refer to the links below:

- [CrowdStrike](https://ela.st/crowdstrike-integration)
- [Microsoft Defender XDR](https://ela.st/m365-defender)
- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
- [Sysmon Event ID 1 - Process Creation](https://ela.st/sysmon-event-1-setup)
- [Windows Process Creation Logs](https://ela.st/audit-process-creation)
"""


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1003"
name = "OS Credential Dumping"
reference = "https://attack.mitre.org/techniques/T1003/"
[[rule.threat.technique.subtechnique]]
id = "T1003.002"
name = "Security Account Manager"
reference = "https://attack.mitre.org/techniques/T1003/002/"

[[rule.threat.technique.subtechnique]]
id = "T1003.003"
name = "NTDS"
reference = "https://attack.mitre.org/techniques/T1003/003/"



[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1006"
name = "Direct Volume Access"
reference = "https://attack.mitre.org/techniques/T1006/"


[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[metadata]
creation_date = "2024/12/16"
integration = ["endpoint", "crowdstrike", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2026/06/17"

[rule]
author = ["Elastic"]
description = """
This rule detects PAM version discovery activity on Linux systems. PAM version discovery can be an indication of an
attacker attempting to backdoor the authentication process through malicious PAM modules.
"""
from = "now-9m"
index = [
    "endgame-*",
    "logs-crowdstrike.fdr*",
    "logs-endpoint.events.process*",
    "logs-sentinel_one_cloud_funnel.*",
]
language = "eql"
license = "Elastic License v2"
name = "Pluggable Authentication Module (PAM) Version Discovery"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Pluggable Authentication Module (PAM) Version Discovery

Pluggable Authentication Modules (PAM) provide a flexible mechanism for authenticating users on Linux systems. Adversaries may exploit PAM by discovering its version to identify vulnerabilities or backdoor the authentication process with malicious modules. The detection rule identifies suspicious processes querying PAM-related packages, indicating potential reconnaissance or tampering attempts, thus alerting security teams to possible threats.

### Possible investigation steps

- Review the process details to confirm the presence of suspicious activity, focusing on processes with names "dpkg", "dpkg-query", or "rpm" and their arguments "libpam-modules" or "pam".
- Check the user account associated with the process to determine if it is a legitimate user or potentially compromised.
- Investigate the parent process to understand the origin of the command execution and assess if it aligns with normal user behavior.
- Analyze recent login attempts and authentication logs to identify any unusual patterns or failed attempts that may indicate unauthorized access attempts.
- Correlate this activity with other alerts or logs from the same host to identify if there are additional indicators of compromise or related suspicious activities.

### False positive analysis

- Routine system updates or package management activities may trigger the rule when legitimate processes like dpkg or rpm query PAM-related packages. To manage this, consider creating exceptions for known maintenance windows or trusted administrative scripts.
- Automated configuration management tools, such as Ansible or Puppet, might execute commands that match the rule's criteria. Identify these tools and exclude their processes from triggering alerts by specifying their execution context.
- Security compliance checks or vulnerability assessments often involve querying system packages, including PAM. If these are regularly scheduled and verified, whitelist the associated processes to prevent unnecessary alerts.
- Developers or system administrators testing PAM configurations might inadvertently trigger the rule. Establish a protocol for notifying the security team of such activities in advance, allowing for temporary exceptions during testing periods.
- Custom scripts used for system monitoring or auditing may include commands that match the rule. Review these scripts and, if deemed safe, add them to an exclusion list to reduce false positives.

### Response and remediation

- Isolate the affected system from the network to prevent further unauthorized access or lateral movement by the adversary.
- Terminate any suspicious processes identified by the detection rule, specifically those involving 'dpkg', 'dpkg-query', or 'rpm' with arguments related to PAM.
- Conduct a thorough review of PAM configuration files and modules on the affected system to identify and remove any unauthorized or malicious modifications.
- Restore any compromised PAM modules from a known good backup to ensure the integrity of the authentication process.
- Monitor for any additional suspicious activity on the affected system and related systems, focusing on unusual authentication attempts or process executions.
- Escalate the incident to the security operations team for further investigation and to determine if additional systems are affected.
- Implement enhanced monitoring and logging for PAM-related activities across the network to detect similar threats in the future."""
references = [
    "https://www.group-ib.com/blog/pluggable-authentication-module/",
    "https://embracethered.com/blog/posts/2022/post-exploit-pam-ssh-password-grabbing/",
]
risk_score = 21
rule_id = "135abb91-dcf4-48aa-b81a-5ad036b67c68"
setup = """## Setup

This rule requires data coming in from Elastic Defend.

### Elastic Defend Integration Setup
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.

#### Prerequisite Requirements:
- Fleet is required for Elastic Defend.
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).

#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
- Go to the Kibana home page and click "Add integrations".
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
- Click "Add Elastic Defend".
- Configure the integration name and optionally add a description.
- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
- Click "Save and Continue".
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
"""
severity = "low"
tags = [
    "Domain: Endpoint",
    "OS: Linux",
    "Use Case: Threat Detection",
    "Tactic: Discovery",
    "Tactic: Persistence",
    "Tactic: Credential Access",
    "Data Source: Elastic Defend",
    "Data Source: Elastic Endgame",
    "Data Source: Crowdstrike",
    "Data Source: SentinelOne",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"
query = '''
process where host.os.type == "linux" and event.type == "start" and
  event.action in ("exec", "exec_event", "start", "ProcessRollup2") and ?process.parent.name != null and
  (
    (process.name in ("dpkg", "dpkg-query") and process.args == "libpam-modules") or
    (process.name == "rpm" and process.args == "pam")
  ) and
not (
  ?process.parent.name in ("dcservice", "inspectorssmplugin") or
  ?process.working_directory in ("/var/ossec", "/opt/msp-agent") or
  ?process.entry_leader.executable in("/usr/local/qualys/cloud-agent/bin/qualys-cloud-agent", "/usr/sbin/ScanAssistant") or
  ?process.parent.executable in (
    "/opt/CyberCNSAgent/cybercnsagent_linux", "/usr/local/manageengine/uems_agent/bin/dcpatchscan",
    "/usr/local/manageengine/uems_agent/bin/dcconfig", "/usr/share/vicarius/topiad",
    "/etc/rc.d/init.d/sshd-chroot", "/var/ossec/bin/wazuh-modulesd",
    "/usr/lib/venv-salt-minion/bin/python.original"
  ) or
  (
    process.executable == "/usr/bin/rpm" and
    ?process.parent.name == "systemd" and
    ?process.env_vars == "LD_LIBRARY_PATH=/usr/lib/venv-salt-minion/lib"
  )
)
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1082"
name = "System Information Discovery"
reference = "https://attack.mitre.org/techniques/T1082/"

[[rule.threat.technique]]
id = "T1518"
name = "Software Discovery"
reference = "https://attack.mitre.org/techniques/T1518/"

[rule.threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1543"
name = "Create or Modify System Process"
reference = "https://attack.mitre.org/techniques/T1543/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1556"
name = "Modify Authentication Process"
reference = "https://attack.mitre.org/techniques/T1556/"

[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[rule]
description = """
Identifies registry modification to modify the system internet proxy settings by an unusual process. This may indicate
an attempt to hijack user internet traffic to certain websites.
"""
id = "6dd16a01-b779-4a39-b436-deed75f2c355"
license = "Elastic License v2"
name = "Potential AutoConfigURL Settings Hijack"
os_list = ["windows"]
version = "1.0.9"

query = '''
registry where
 registry.path : "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\AutoConfigURL" and
 registry.data.strings : "*http*" and not registry.data.strings : "*127.0.0.1*" and process.executable != null and
 (
  process.code_signature.trusted == false or
  process.code_signature.exists == false or
  process.name : ("powershell.exe", "wscript.exe", "cscript.exe")
  ) and
  not process.executable : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*", "C:\\LexisNexis\\Shared\\RwEasyMAPI64.exe")
'''

min_endpoint_version = "8.4.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1112"
name = "Modify Registry"
reference = "https://attack.mitre.org/techniques/T1112/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.4.0"

[metadata]
creation_date = "2023/08/29"
integration = ["endpoint"]
maturity = "production"
updated_date = "2024/09/01"

[rule]
author = ["Elastic"]
building_block_type = "default"
description = """
Adversaries may attempt to connect to a remote system over Windows Remote Desktop Protocol (RDP) to achieve lateral
movement. Adversaries may avoid using the Microsoft Terminal Services Client (mstsc.exe) binary to establish an RDP
connection to evade detection.
"""
from = "now-119m"
index = ["logs-endpoint.events.network-*"]
interval = "60m"
language = "eql"
license = "Elastic License v2"
name = "Potential Outgoing RDP Connection by Unusual Process"
risk_score = 21
rule_id = "8e39f54e-910b-4adb-a87e-494fbba5fb65"
severity = "low"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Lateral Movement",
    "Data Source: Elastic Defend",
    "Rule Type: BBR"
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
network where host.os.type == "windows" and
  event.action == "connection_attempted" and destination.port == 3389 and
  destination.ip != "::1" and destination.ip != "127.0.0.1" and
  not (
    process.executable : (
      "?:\\Windows\\System32\\mstsc.exe",
      "?:\\Program Files (x86)\\mRemoteNG\\mRemoteNG.exe",
      "?:\\Program Files (x86)\\PRTG Network Monitor\\PRTG Probe.exe",
      "?:\\Program Files\\Azure Advanced Threat Protection Sensor\\*\\Microsoft.Tri.Sensor.exe",
      "?:\\Program Files (x86)\\Microsoft\\Remote Desktop Connection Manager\\RDCMan.exe",
      "?:\\Program Files\\SentinelOne\\Sentinel Agent*\\Ranger\\SentinelRanger.exe",
      "?:\\Program Files\\Devolutions\\Remote Desktop Manager\\RemoteDesktopManager.exe",
      "?:\\Program Files (x86)\\Devolutions\\Remote Desktop Manager\\RemoteDesktopManager.exe"
    ) and process.code_signature.trusted == true
  )
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1021"
name = "Remote Services"
reference = "https://attack.mitre.org/techniques/T1021/"
[[rule.threat.technique.subtechnique]]
id = "T1021.001"
name = "Remote Desktop Protocol"
reference = "https://attack.mitre.org/techniques/T1021/001/"



[rule.threat.tactic]
id = "TA0008"
name = "Lateral Movement"
reference = "https://attack.mitre.org/tactics/TA0008/"

[rule]
description = """
This rule detects the creation of a reverse shell through the use of named pipes. Attackers may leverage named pipes to
evade detection and establish persistence onto a target system.
"""
id = "40bec6eb-e93b-4d09-8265-66bba186e332"
license = "Elastic License v2"
name = "Potential Reverse Shell via Named Pipe"
os_list = ["linux"]
version = "1.0.17"

query = '''
process where event.type == "start" and event.action == "exec" and
process.parent.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and (
  (process.name == "mknod" and process.args like ("/tmp/*", "/var/tmp/*", "/dev/shm/*") and process.args_count <= 5) or
  (
    process.name == "mkfifo" and
    process.parent.args == "-c" and
    process.parent.command_line like "*rm*" and
    process.parent.command_line like "*|*" and
    process.parent.command_line regex ".*[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}.*"
  )
) and
not (
  (process.name == "mknod" and process.args like ("/var/tmp/dracut*", "/tmp/dracut.*", "/var/tmp/portage/*", "/tmp/dib_build*", "/tmp/bootstrap-salt.logpipe")) or
  (process.executable == "/usr/lib/cargo/bin/coreutils/mknod" and process.args like "/tmp/tmp.*/test-dev-null")
)
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"


[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "7.15.0"