Elastic rules: 2v

[rule]
description = "Detects the execution of arbitrary Python code via Nodejs."
id = "f8ec483c-dc3b-4d60-b863-65f61b4d382e"
license = "Elastic License v2"
name = "Arbitrary Python Code Execution via Nodejs"
os_list = ["macos"]
reference = ["https://jp.security.ntt/tech_blog/contagious-interview-ottercookie"]
version = "1.0.5"

query = '''
process where event.type == "start" and event.action == "exec" and process.name like~ "python*" and process.args == "-c" and 
 (process.parent.name == "node" or process.Ext.effective_parent.name == "node") and
 process.command_line : ("*os.system*", "*subprocess.run*", "*subprocess.Popen*", "*exec(*", "*eval(*")
'''

min_endpoint_version = "8.10.2"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.006"
name = "Python"
reference = "https://attack.mitre.org/techniques/T1059/006/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "8.10.2"

[metadata]
creation_date = "2021/05/05"
integration = ["aws"]
maturity = "production"
updated_date = "2026/04/10"

[rule]
author = ["Elastic", "Austin Songer"]
description = """
Detects successful creation of an Amazon EC2 Traffic Mirroring session. A session copies full packets from a source
Elastic Network Interface (ENI) to a mirror target (e.g., an ENI or NLB) using a mirror filter (ingress/egress rules).
While used for diagnostics and NDR/IDS tooling, adversaries can abuse sessions to covertly capture and exfiltrate
sensitive, potentially unencrypted, traffic from instances or subnets.
"""
false_positives = [
    """
    Traffic Mirroring may be done by a system or network administrator. Verify whether the user identity, user agent,
    and/or hostname should be making changes in your environment. Traffic Mirroring from unfamiliar users or hosts
    should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
    """,
]
from = "now-6m"
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
language = "kuery"
license = "Elastic License v2"
name = "AWS EC2 Full Network Packet Capture Detected"
note = """## Triage and analysis

### Investigating AWS EC2 Full Network Packet Capture Detected

This alert fires on a successful `CreateTrafficMirrorSession`, which enables full-packet Traffic Mirroring from a
source ENI to a mirror target under a given filter. Because sessions immediately begin sending packets once active,
treat unexpected creations as high priority.

#### Possible investigation steps

**Identify the actor and execution context**
- **Principal**: Review `aws.cloudtrail.user_identity.arn`, `aws.cloudtrail.user_identity.type`, and
  `aws.cloudtrail.user_identity.access_key_id` to determine who created the session (human IAM user vs. assumed role vs. automation).
- **Caller metadata**: Check `user_agent.original`, and `source.ip` for unusual tools, hosts, or locations.
- **Account/Region/Time**: Validate `cloud.account.id`, `cloud.region`, and `@timestamp` against change windows or tickets.

**Extract the session details from the event**
- **Request parameters**: Parse `aws.cloudtrail.request_parameters` for:
  - `NetworkInterfaceId` (mirrored source ENI)  map to the EC2 instance and its business function.
  - `TrafficMirrorTargetId` identify where packets are being sent (ENI vs. NLB).
  - `TrafficMirrorFilterId` check which directions and protocols are allowed (ingress/egress, ports).
  - `SessionNumber`, `Description`, `TagSpecifications` look for operator tags or suspicious notes.
- **Response elements**: Use `aws.cloudtrail.response_elements` to confirm the created `TrafficMirrorSessionId` and
  any resolved resource ARNs/IDs.

**Pivot for related API calls to validate scope and intent**
Look before and after this event (±30–60 minutes) by the same principal / access key / source IP for:
- **Target & Filter lifecycle**: `CreateTrafficMirrorTarget`, `CreateTrafficMirrorFilter`, `CreateTrafficMirrorFilterRule`,
  `ModifyTrafficMirrorSession|Filter|FilterRule`, and `Delete*` calls (rapid create-modify patterns can indicate staging).
- **Session management**: `DeleteTrafficMirrorSession` shortly after creation (test/probe), or repeated creations to different targets.
- **Discovery/positioning**: `DescribeNetworkInterfaces`, `DescribeInstances`, `DescribeVpcs/Subnets/RouteTables` around the same time.
- **Cross-account indicators**: creation of targets that forward to infrastructure not owned by your account (e.g., NLB in shared services).
- **Other suspicious changes**: IAM permission changes, new access keys, or S3/SNS setup that could support exfil/ops.

**Validate the mirror destination and potential data exposure**
- If the target is an ENI: identify the owning instance/application; confirm it is an approved NDR/packet capture host.
- If the target is an NLB target: determine where the NLB sends traffic (could be a collection point in another VPC or account).
- Assess whether mirrored flows include plaintext protocols (internal HTTP, databases, LDAP, etc.) increasing sensitivity.

### False positive analysis

- **Authorized monitoring**: Approved NDR/IDS tooling or troubleshooting playbooks may legitimately create sessions.
- **Ops/diagnostics**: Short-lived sessions during incident handling or performance analysis.
- **Automation**: Infrastructure pipelines that stand up temporary mirroring for validation.

### Response and remediation

**Contain**
- If unauthorized, terminate the session immediately (use the `TrafficMirrorSessionId` from `aws.cloudtrail.response_elements`)
  and block creation permissions for the offending principal.
- Quarantine or restrict egress from the target if you suspect it is forwarding captured traffic outside approved destinations.

**Investigate**
- Enumerate all active sessions in the affected account/region; verify there aren’t additional rogue sessions.
- Review related target and filter resources (and recent `Modify*` calls) to understand captured scope and recipients.
- Trace the source ENI back to the EC2 instance and validate whether sensitive workloads were mirrored.

**Recover & harden**
- Remove or lock down unapproved targets/filters; enforce least privilege on `ec2:CreateTrafficMirrorSession/Target/Filter`.
- Consider SCPs or IAM conditions limiting who/where sessions can be created (e.g., only into designated monitoring VPCs).
- Ensure monitoring targets are controlled, logged, and not internet-reachable.

**Improve**
- Add correlation logic to automatically surface CreateTrafficMirrorSession alongside Create/Modify Target/Filter calls by the same actor.
- Require tags on approved mirroring resources; alert on untagged/unticketed creations.
- Update playbooks to include a standard validation checklist (principal, source ENI, target, filter rules, destination path).

"""
references = [
    "https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_TrafficMirrorSession.html",
    "https://rhinosecuritylabs.com/aws/abusing-vpc-traffic-mirroring-in-aws/",
]
risk_score = 47
rule_id = "c1812764-0788-470f-8e74-eb4a14d47573"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Data Source: AWS",
    "Data Source: Amazon Web Services",
    "Data Source: AWS EC2",
    "Use Case: Network Security Monitoring",
    "Tactic: Exfiltration",
    "Tactic: Collection",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset: "aws.cloudtrail" and 
    event.provider: "ec2.amazonaws.com" and
    event.action: "CreateTrafficMirrorSession" and
    event.outcome: "success"
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1020"
name = "Automated Exfiltration"
reference = "https://attack.mitre.org/techniques/T1020/"

[[rule.threat.technique]]
id = "T1537"
name = "Transfer Data to Cloud Account"
reference = "https://attack.mitre.org/techniques/T1537/"

[rule.threat.tactic]
id = "TA0010"
name = "Exfiltration"
reference = "https://attack.mitre.org/tactics/TA0010/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1074"
name = "Data Staged"
reference = "https://attack.mitre.org/techniques/T1074/"

[rule.threat.tactic]
id = "TA0009"
name = "Collection"
reference = "https://attack.mitre.org/tactics/TA0009/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1040"
name = "Network Sniffing"
reference = "https://attack.mitre.org/techniques/T1040/"

[rule.threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1040"
name = "Network Sniffing"
reference = "https://attack.mitre.org/techniques/T1040/"

[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user_agent.original",
    "source.ip",
    "aws.cloudtrail.user_identity.arn",
    "aws.cloudtrail.user_identity.type",
    "aws.cloudtrail.user_identity.access_key_id",
    "event.action",
    "event.outcome",
    "cloud.account.id",
    "cloud.region",
    "aws.cloudtrail.request_parameters",
    "aws.cloudtrail.response_elements",
]

[rule]
description = """
Detects when a binary located in a suspicious location gets executed by a shell interpreter and put in the background
via the & operator. Malwares may execute their payloads in the background in an effort to remain hidden.
"""
id = "603ac59e-9cca-4c48-9750-e38399079043"
license = "Elastic License v2"
name = "Background Process Execution via Shell"
os_list = ["macos"]
version = "1.0.19"

query = '''
process where event.type == "start" and event.action == "exec" and 
    process.name like~ ("bash", "sh", "zsh", "tclsh*") and
    process.args == "-c" and process.args like~ ("/* &", "/*&") and
    process.args_count == 3 and 
    process.parent.executable like~ 
                                ("/private/tmp/*", 
                                 "/var/tmp/*", 
                                 "/tmp/*", 
                                 "/var/folders/*", 
                                 "/Library/Containers/*", 
                                 "/Library/Graphics/*",
                                 "/Users/Shared/*", 
                                 "/Users/*/Library/Preferences/*", 
                                 "/var/root/*", 
                                 "/Library/WebServer/*", 
                                 "/Library/Preferences/*", 
                                 "/Library/Services/*", 
                                 "/Library/Fonts/*", 
                                 "/usr/local/bin/*")
'''

min_endpoint_version = "8.10.2"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "8.10.2"

[rule]
description = """
This rule detects the execution of the "chattr" command from an unusual parent process. The "chattr" command is used to
change file attributes, and is often used by attackers to hide files or directories or mark them as immutable and/or
undeletable.
"""
id = "3f3e9299-1a05-4922-aef2-6d855a07f8ef"
license = "Elastic License v2"
name = "Chattr Execution from Unusual Parent"
os_list = ["linux"]
reference = [
    "https://www.trendmicro.com/en_nl/research/22/i/how-malicious-actors-abuse-native-linux-tools-in-their-attacks.html",
]
version = "1.0.10"

query = '''
process where event.type == "start" and event.action == "exec" and process.name == "chattr" and 
process.executable like ("/bin/chattr", "/usr/bin/chattr", "/usr/local/bin/chattr") and
(process.parent.executable like ("/tmp/*", "/var/tmp/*", "/dev/shm/*", "./*") or process.parent.name like ".*") and
process.args like~ ("-*i*", "+*i*", "+*u*", "-*u*") and not (
  process.parent.name == "." or
  process.parent.executable like (
    "./scannerYaraALFA*", "/tmp/newroot/lib/systemd/systemd", "./ldap2sshkeys", "/tmp/newroot/var/lib/docker/rootfs/overlayfs/*/entrypoint.sh",
    "/tmp/newroot/opt/omnissa/*/bin/ws1HubUtil"
  ) or
  process.parent.executable in ("/tmp/newroot/usr/bin/sudo", "/tmp/newroot/usr/bin/zsh") or
  process.parent.args like "/root/.ansible/tmp/ansible-tmp-*/AnsiballZ_file.py"
)
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
tree = true

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1222"
name = "File and Directory Permissions Modification"
reference = "https://attack.mitre.org/techniques/T1222/"
[[threat.technique.subtechnique]]
id = "T1222.002"
name = "Linux and Mac File and Directory Permissions Modification"
reference = "https://attack.mitre.org/techniques/T1222/002/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.15.0"

[metadata]
creation_date = "2024/07/09"
integration = ["endpoint"]
maturity = "production"
updated_date = "2026/03/24"

[rule]
author = ["Elastic"]
description = """
This rule detects the installation of a Debian package (dpkg) by an unusual parent process. The dpkg command is used to
install, remove, and manage Debian packages on a Linux system. Attackers can abuse the dpkg command to install malicious
packages on a system.
"""
from = "now-9m"
index = ["logs-endpoint.events.*"]
language = "kuery"
license = "Elastic License v2"
name = "DPKG Package Installed by Unusual Parent Process"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating DPKG Package Installed by Unusual Parent Process

DPKG is a core utility for managing Debian packages on Linux systems, crucial for software installation and maintenance. Adversaries may exploit DPKG to install malicious packages, leveraging unusual parent processes to evade detection. The detection rule identifies such anomalies by monitoring DPKG executions initiated by atypical parent processes, signaling potential unauthorized package installations.

### Possible investigation steps

- Review the process tree to identify the parent process of the dpkg execution. Determine if the parent process is legitimate or unusual for package installations.
- Examine the command-line arguments used with the dpkg command, specifically looking for the "-i" or "--install" flags, to understand what package was being installed.
- Check the source and integrity of the package being installed to ensure it is from a trusted repository or source.
- Investigate the user account under which the dpkg command was executed to determine if it has the necessary permissions and if the activity aligns with the user's typical behavior.
- Correlate the event with other logs or alerts around the same timeframe to identify any related suspicious activities or patterns.
- Assess the system for any signs of compromise or unauthorized changes following the package installation.

### False positive analysis

- System updates or maintenance scripts may trigger the rule when legitimate administrative tools or scripts use dpkg to install updates. To handle this, identify and whitelist known maintenance scripts or processes that regularly perform package installations.
- Automated deployment tools like Ansible or Puppet might use dpkg for software deployment, leading to false positives. Exclude these tools by adding their process names to an exception list if they are part of your standard operations.
- Custom internal applications or scripts that manage software installations could also cause alerts. Review these applications and, if verified as safe, configure exceptions for their parent processes.
- Developers or system administrators using dpkg for testing or development purposes might inadvertently trigger the rule. Establish a policy for such activities and exclude known development environments or user accounts from triggering alerts.
- Backup or recovery operations that reinstall packages as part of their process can be mistaken for malicious activity. Identify these operations and exclude their associated processes from the rule.

### Response and remediation

- Isolate the affected system from the network to prevent further unauthorized package installations or lateral movement by the adversary.
- Terminate the dpkg process if it is still running to stop any ongoing malicious package installation.
- Identify and remove any suspicious or unauthorized packages installed by the dpkg command using the package management tools available on the system.
- Conduct a thorough review of the system's package installation logs and history to identify any other potentially malicious packages or unusual installation activities.
- Restore the system from a known good backup if malicious packages have altered critical system components or configurations.
- Implement stricter access controls and monitoring on systems to prevent unauthorized use of package management utilities by non-administrative users or processes.
- Escalate the incident to the security operations team for further investigation and to determine if additional systems are affected, ensuring a coordinated response to the threat."""
references = ["https://www.makeuseof.com/how-deb-packages-are-backdoored-how-to-detect-it/"]
risk_score = 21
rule_id = "f4d1c0ac-aedb-4063-9fa6-cc651eb5e6ee"
setup = """## Setup

This rule requires data coming in from Elastic Defend.

### Elastic Defend Integration Setup
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.

#### Prerequisite Requirements:
- Fleet is required for Elastic Defend.
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).

#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
- Go to the Kibana home page and click "Add integrations".
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
- Click "Add Elastic Defend".
- Configure the integration name and optionally add a description.
- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
- Click "Save and Continue".
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
"""
severity = "low"
tags = [
    "Domain: Endpoint",
    "OS: Linux",
    "Use Case: Threat Detection",
    "Tactic: Persistence",
    "Data Source: Elastic Defend",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "new_terms"
query = '''
host.os.type:linux and event.category:process and event.type:start and event.action:exec and process.name:dpkg and
process.args:("-i" or "--install")
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1543"
name = "Create or Modify System Process"
reference = "https://attack.mitre.org/techniques/T1543/"

[[rule.threat.technique]]
id = "T1546"
name = "Event Triggered Execution"
reference = "https://attack.mitre.org/techniques/T1546/"

[[rule.threat.technique.subtechnique]]
id = "T1546.016"
name = "Installer Packages"
reference = "https://attack.mitre.org/techniques/T1546/016/"

[[rule.threat.technique]]
id = "T1574"
name = "Hijack Execution Flow"
reference = "https://attack.mitre.org/techniques/T1574/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1195"
name = "Supply Chain Compromise"
reference = "https://attack.mitre.org/techniques/T1195/"

[[rule.threat.technique.subtechnique]]
id = "T1195.002"
name = "Compromise Software Supply Chain"
reference = "https://attack.mitre.org/techniques/T1195/002/"

[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1546"
name = "Event Triggered Execution"
reference = "https://attack.mitre.org/techniques/T1546/"

[[rule.threat.technique.subtechnique]]
id = "T1546.016"
name = "Installer Packages"
reference = "https://attack.mitre.org/techniques/T1546/016/"

[rule.threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"
[rule.new_terms]
field = "new_terms_fields"
value = ["process.parent.executable"]

[[rule.new_terms.history_window_start]]
field = "history_window_start"
value = "now-5d"

[rule]
description = """
Identifies process execution from a ZIP file when handled via Explorer. Adversaries often leverage ZIP file to deliver
malicious executables and scripts for initial access and execution.
"""
id = "6631e7e4-ecca-4f34-88e1-b86a4ab711b1"
license = "Elastic License v2"
name = "Execution from ZIP File via Explorer"
os_list = ["windows"]
version = "1.0.11"

query = '''
process where event.action == "start" and
 process.parent.name : "explorer.exe" and process.parent.thread.Ext.call_stack_summary : "*zipfldr.dll*" and
  process.name : ("wscript.exe",
                  "cscript.exe",
                  "rundll32.exe",
                  "regsvr32.exe",
                  "cmstp.exe",
                  "RegAsm.exe",
                  "installutil.exe",
                  "mshta.exe",
                  "RegSvcs.exe",
                  "msbuild.exe",
                  "msxsl.exe",
                  "xwizard.exe",
                  "powershell.exe",
                  "AddInProcess.exe",
                  "AddInProcess32.exe",
                  "AddInUtil.exe",
                  "AppLaunch.exe",
                  "aspnet_compiler.exe") and
 not (process.parent.name : "explorer.exe" and process.executable : "C:\\Windows\\SysWOW64\\mshta.exe") and
 not (process.name : "rundll32.exe" and
          process.args : ("cryptext.dll,CryptExt*",
                          "ImageView_Fullscreen",
                          "?:\\Windows\\System32\\dfshim.dll,ShOpenVerbApplication",
                          "C:\\ProgramData\\FastTrack Software\\Admin By Request\\ShellHelper32.dll,#1"))
'''

min_endpoint_version = "8.7.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.005"
name = "Visual Basic"
reference = "https://attack.mitre.org/techniques/T1059/005/"

[[threat.technique.subtechnique]]
id = "T1059.007"
name = "JavaScript"
reference = "https://attack.mitre.org/techniques/T1059/007/"


[[threat.technique]]
id = "T1204"
name = "User Execution"
reference = "https://attack.mitre.org/techniques/T1204/"
[[threat.technique.subtechnique]]
id = "T1204.002"
name = "Malicious File"
reference = "https://attack.mitre.org/techniques/T1204/002/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.7.0"

[rule]
description = """
Identifies the execution of commonly abused utilities to run DLLs or scripts via a separate Windows Explorer trampoline.
Explorer can be abused to launch malicious scripts or executables from a trusted parent process.
"""
id = "5e8498bb-8cc0-412f-9017-793d94ab76a5"
license = "Elastic License v2"
name = "Execution of Commonly Abused Utilities via Explorer Trampoline"
os_list = ["windows"]
reference = ["https://lolbas-project.github.io/lolbas/Binaries/Explorer/"]
version = "1.0.36"

query = '''
process where event.action == "start" and
  (
   process.name : ("cscript.exe", "wscript.exe", "rundll32.exe", "mshta.exe", "regsvr32.exe") or
   process.pe.original_file_name :
               ("cscript.exe",
                "wscript.exe",
                "rundll32.exe",
                "mshta.exe",
                "regsvr32.exe")
  ) and
  /* Explorer started via DCOM */
  process.parent.name : "explorer.exe" and process.parent.command_line : "*/factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b}*" and
  not
     (
      process.name : "rundll32.exe" and
      process.args : ("rundll32.exe*\\Users\\*\\AppData\\Local\\Cognitas\\CrossLink6\\csathl32.dll*",
                      /* Issue #340 */
                      "*dfshim.dll*ShOpenVerbApplication*",
                      "dfshim.dll,",
                      "?:\\WINDOWS\\system32\\hotplug.dll,HotPlugSafeRemovalDriveNotification",
                      "cryptext.dll,CryptExtOpen*",
                      "cryptext.dll,CryptExtAddCER",
                      "ndfapi.dll,NdfRunDllDiagnoseWithAnswerFile",
                      "shwebsvc.dll,AddNetPlaceRunDll",
                      "?:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll*",
                      "?:\\Windows\\system32\\hotplug.dll,HotPlugSafeRemovalDriveNotification",
                      "devmgr.dll,DeviceProperties_RunDLL",
                      "printui.dll,PrintUIEntryDPIAware",
                      "?:\\windows\\System32\\srchadmin.dll",
                      "fdprint,InvokeTask",
                      "cryptext.dll,CryptExtAddPFX",
                      "shell32.dll,SHCreateLocalServerRunDll",
                      "?:\\WINDOWS\\System32\\SHELL32.dll,RunAsNewUser_RunDLL", 
                      "?:\\WINDOWS\\system32\\spool\\DRIVERS\\x64\\3\\*",
                      "C:\\Program Files (x86)\\Stardock\\Fences\\FencesMenu64.dll,StartFences",
                      "C:\\Windows\\System32\\*.cpl")
      ) and
  not (process.name : ("wscript.exe", "cscript.exe") and
       process.args : ("\\\\*.vbs", "C:\\Robocopy\\robocopy_Mail_Config_Veeam.vbs", "C:\\Users\\*\\Documents\\*.vbs", "X:\\*.vbs", "W:\\*.vbs"))
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"
[[threat.technique.subtechnique]]
id = "T1566.001"
name = "Spearphishing Attachment"
reference = "https://attack.mitre.org/techniques/T1566/001/"



[threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.001"
name = "PowerShell"
reference = "https://attack.mitre.org/techniques/T1059/001/"

[[threat.technique.subtechnique]]
id = "T1059.007"
name = "JavaScript"
reference = "https://attack.mitre.org/techniques/T1059/007/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[[threat.technique.subtechnique]]
id = "T1218.005"
name = "Mshta"
reference = "https://attack.mitre.org/techniques/T1218/005/"

[[threat.technique.subtechnique]]
id = "T1218.010"
name = "Regsvr32"
reference = "https://attack.mitre.org/techniques/T1218/010/"

[[threat.technique.subtechnique]]
id = "T1218.011"
name = "Rundll32"
reference = "https://attack.mitre.org/techniques/T1218/011/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.15.0"

[rule]
description = """
Detects when a file in a suspicious file path is made executable via the chmod binary immediately after an installer pkg
is executed via the postinstall script. This is not a common occurrence and indicates the installation of a malicious
binary.
"""
id = "75f5d51a-218f-4d5b-80e5-eb74e498fde4"
license = "Elastic License v2"
name = "File Made Executable via Package Install Script"
os_list = ["macos"]
version = "1.0.27"

query = '''
sequence by process.parent.pid with maxspan=30s
[process where event.type == "start" and event.action == "fork" and 
    process.name like~ ("bash", "zsh", "sh", "python*", "tclsh*", "dash", "csh", "tcsh", "ksh", "fish") and
    process.args like~ "/tmp/PKInstallSandbox.*/Scripts/*/postinstall" and 
    process.args like ("/Users/*", "/Volumes/*") and 
    not process.args like "/Applications/Adobe Acrobat DC"]
[process where event.type == "start" and event.action == "exec" and 
    process.name == "chmod" and 
    process.args in ("+x", "a+x", "0777", "777") and
    process.args like~ ("/private/tmp/*", 
                        "/var/tmp/*", 
                        "/var/lib/*",
                        "/tmp/*", 
                        "/var/folders/*", 
                        "/Users/Shared/*", 
                        "/Library/Containers/*", 
                        "/Users/*/Library/*",
                        "/Users/*/Applications/*",
                        "/var/root/*", 
                        "/Library/WebServer/*",
                        "/Library/Fonts/*",
                        "/usr/local/bin/*") and
    process.parent.name like~ ("bash", "zsh", "sh", "python*", "tclsh*", "osascript", "dash", "csh", "tcsh", "ksh", "fish") and not
    process.command_line == "chmod +x decompress"]
'''

min_endpoint_version = "8.11.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1222"
name = "File and Directory Permissions Modification"
reference = "https://attack.mitre.org/techniques/T1222/"
[[threat.technique.subtechnique]]
id = "T1222.002"
name = "Linux and Mac File and Directory Permissions Modification"
reference = "https://attack.mitre.org/techniques/T1222/002/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.11.0"

[metadata]
creation_date = "2026/07/16"
integration = ["gcp"]
maturity = "production"
updated_date = "2026/07/16"

[rule]
author = ["Elastic"]
description = """
Detects successful GKE API requests from unauthenticated anonymous identities using an unusual user agent.
Attackers may rely on anonymous access for initial cluster access or to avoid attribution. Matches
"system:anonymous" / "system:unauthenticated" and GKE audit rows where the principal is missing (common for
unauthenticated clients). Common kube-probe health checks (readyz/livez/healthz/version) are excluded.
"""
false_positives = [
    """
    Anonymous API access is a dangerous default. Health probes are excluded; investigate all other authorized
    anonymous requests and disable anonymous authentication where possible.
    """,
]
from = "now-6m"
index = ["logs-gcp.audit-*"]
language = "kuery"
license = "Elastic License v2"
name = "GKE Anonymous Request Authorized by Unusual User Agent"
note = """## Triage and analysis

### Investigating GKE Anonymous Request Authorized by Unusual User Agent

Anonymous success outside health endpoints can indicate a publicly reachable API server or overly permissive RBAC for
`system:anonymous` / `system:unauthenticated`. On GKE via GCP audit, some unauthenticated clients omit
`client.user.email`; those successes are included when the user agent is unusual.

### Investigation steps

- Review `client.user.email`, `event.action`, `gcp.audit.resource_name`, `source.ip`, and `user_agent.original`.
- Confirm whether the API server is Internet-exposed and whether anonymous auth is intentionally enabled.
- Hunt for follow-on anonymous pod mutations, secret reads, or RBAC changes from the same source.

### False positives

- Custom health or readiness endpoints not covered by the built-in exclusions; add environment-specific exceptions after review.

"""
references = [
    "https://media.defense.gov/2022/Aug/29/2003066362/-1/-1/0/CTR_KUBERNETES_HARDENING_GUIDANCE_1.2_20220829.PDF",
    "https://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging",
]
risk_score = 47
rule_id = "189f0f31-8f31-48eb-bb3e-c0db8c8b8c4c"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Domain: Kubernetes",
    "Data Source: GCP",
    "Data Source: Google Cloud Platform",
    "Use Case: Threat Detection",
    "Tactic: Initial Access",
    "Tactic: Defense Evasion",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "new_terms"
setup = "The GCP Fleet integration with GKE audit logs enabled is required to be compatible with this rule."

query = '''
data_stream.dataset:gcp.audit and service.name:k8s.io and event.outcome:success and client.user.email:("system:anonymous" or "system:unauthenticated" or not *) and user_agent.original:(* and not (*kubernetes/$Format or kube-probe*)) and not gcp.audit.resource_name:(healthz or livez or readyz or version or .well-known*)
'''

[rule.new_terms]
field = "new_terms_fields"
value = ["user_agent.original"]

[[rule.new_terms.history_window_start]]
field = "history_window_start"
value = "now-7d"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"

[[rule.threat.technique.subtechnique]]
id = "T1078.001"
name = "Default Accounts"
reference = "https://attack.mitre.org/techniques/T1078/001/"

[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "client.user.email",
    "source.ip",
    "user_agent.original",
    "event.action",
    "event.outcome",
    "gcp.audit.resource_name",
    "orchestrator.resource.name",
    "orchestrator.namespace",
]

[metadata]
creation_date = "2023/08/24"
integration = ["endpoint", "windows", "system"]
maturity = "production"
updated_date = "2025/03/20"

[rule]
author = ["Elastic"]
building_block_type = "default"
description = """
InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific
installer components specified in .NET binaries. Adversaries may use InstallUtil to proxy the execution of code through
a trusted Windows utility.
"""
from = "now-119m"
index = [
    "endgame-*",
    "logs-endpoint.events.process-*",
    "logs-system.security*",
    "logs-windows.*",
    "winlogbeat-*",
]
interval = "60m"
language = "eql"
license = "Elastic License v2"
name = "InstallUtil Activity"
risk_score = 21
rule_id = "90babaa8-5216-4568-992d-d4a01a105d98"
severity = "low"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Defense Evasion",
    "Data Source: Elastic Defend",
    "Rule Type: BBR",
    "Data Source: Elastic Endgame",
    "Data Source: Windows Security Event Logs",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
process where host.os.type == "windows" and event.type == "start" and
  process.name : "installutil.exe" and not user.id : "S-1-5-18"
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[[rule.threat.technique.subtechnique]]
id = "T1218.004"
name = "InstallUtil"
reference = "https://attack.mitre.org/techniques/T1218/004/"



[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[metadata]
creation_date = "2025/11/19"
maturity = "production"
updated_date = "2025/11/19"

[rule]
author = ["Elastic"]
description = """
This rule uses alert data to determine when multiple alerts from Elastic Defend involving the same host are triggered.
Analysts can use this to prioritize triage and response, as these hosts are more likely to be compromised.
"""
from = "now-60m"
interval = "30m"
language = "esql"
license = "Elastic License v2"
name = "Multiple Elastic Defend Alerts by Agent"
risk_score = 73
rule_id = "ab25369e-ea5e-46f1-9cd5-478a0a4a131a"
severity = "high"
tags = ["Use Case: Threat Detection", "Rule Type: Higher-Order Rule", "Resources: Investigation Guide", "Data Source: Elastic Defend"]
timestamp_override = "event.ingested"
type = "esql"

query = '''
from logs-endpoint.alerts-* metadata _id
| eval target_time_window = DATE_TRUNC(24 hours, @timestamp)
| where event.code in ("malicious_file", "memory_signature", "shellcode_thread", "behavior") and
        agent.id is not null and not rule.name in ("Multi.EICAR.Not-a-virus")
| stats Esql.alerts_count = COUNT(*),
        Esql.event_code_distinct_count = count_distinct(event.code),
        Esql.rule_name_distinct_count = COUNT_DISTINCT(rule.name),
        Esql.file_hash_distinct_count = COUNT_DISTINCT(file.hash.sha256),
        Esql.process_name_distinct_count = COUNT_DISTINCT(process.entity_id),
        Esql.event_code_values = VALUES(event.code),
        Esql.rule_name_values = VALUES(rule.name),
        Esql.message_values = VALUES(message),
        Esql.file_path_values = VALUES(file.path),
        Esql.dll_path_values = VALUES(dll.path),
        Esql.process_executable_values = VALUES(process.executable),
        Esql.process_parent_executable_values = VALUES(process.parent.executable),
        Esql.process_command_line_values = VALUES(process.command_line),
        Esql.process_hash_sha256_values = VALUES(process.hash.sha256),
        Esql.file_hash_sha256_values = VALUES(file.hash.sha256),
        Esql.dll_hash_sha256_values = VALUES(dll.hash.sha256) by agent.id
| where (Esql.event_code_distinct_count >= 2 or Esql.rule_name_distinct_count >= 3 or Esql.file_hash_distinct_count >= 2)
| keep agent.id,
       Esql.alerts_count,
       Esql.event_code_distinct_count,
       Esql.rule_name_distinct_count,
       Esql.message_values,
       Esql.event_code_values,
       Esql.rule_name_values,
       Esql.process_executable_values,
       Esql.process_parent_executable_values,
       Esql.process_command_line_values,
       Esql.file_path_values,
       Esql.dll_path_values,
       Esql.process_hash_sha256_values,
       Esql.file_hash_sha256_values,
       Esql.dll_hash_sha256_values
'''
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Multiple Elastic Defend Alerts by Agent

Endpoint security technologies monitor and analyze activities on devices to detect malicious behavior. Adversaries exploit these systems by deploying malware that triggers specific signatures across multiple hosts, indicating a coordinated attack. The detection rule identifies such threats by analyzing alert data for specific malware signatures across several hosts, flagging potential widespread infections for prioritized investigation.

### Possible investigation steps

- Review the alert details to identify the specific host involved and the different ATT&CK tactics that triggered the alerts.
- Examine the timeline of the alerts to understand the sequence of events and determine if there is a pattern or progression in the tactics used.
- Correlate the alert data with other logs and telemetry from the host, such as process creation, network connections, and file modifications, to gather additional context.
- Investigate any known vulnerabilities or misconfigurations on the host that could have been exploited by the adversary.
- Check for any indicators of compromise (IOCs) associated with the alerts, such as suspicious IP addresses, domains, or file hashes, and search for these across the network.
- Assess the impact and scope of the potential compromise by determining if other hosts or systems have similar alerts or related activity.

### False positive analysis

- Alerts from routine administrative tasks may trigger multiple tactics. Review and exclude known benign activities such as scheduled software updates or system maintenance.
- Security tools running on the host might generate alerts across different tactics. Identify and exclude alerts from trusted security applications to reduce noise.
- Automated scripts or batch processes can mimic adversarial behavior. Analyze and whitelist these processes if they are verified as non-threatening.
- Frequent alerts from development or testing environments can be misleading. Consider excluding these environments from the rule or applying a different risk score.
- User behavior anomalies, such as accessing multiple systems or applications, might trigger alerts. Implement user behavior baselines to differentiate between normal and suspicious activities.

### Response and remediation

- Isolate the affected host from the network immediately to prevent further lateral movement by the adversary.
- Conduct a thorough forensic analysis of the host to identify the specific vulnerabilities exploited and gather evidence of the attack phases involved.
- Remove any identified malicious software or unauthorized access tools from the host, ensuring all persistence mechanisms are eradicated.
- Apply security patches and updates to the host to address any exploited vulnerabilities and prevent similar attacks.
- Restore the host from a known good backup if necessary, ensuring that the backup is free from compromise.
- Monitor the host and network for any signs of re-infection or further suspicious activity, using enhanced logging and alerting based on the identified attack patterns.
- Escalate the incident to the appropriate internal or external cybersecurity teams for further investigation and potential legal action if the attack is part of a larger campaign."""
references = ["https://github.com/elastic/protections-artifacts/tree/main/yara/rules"]

[metadata]
creation_date = "2025/04/16"
integration = ["windows"]
maturity = "production"
updated_date = "2026/03/24"

[rule]
author = ["Elastic"]
description = """
Detects PowerShell scripts that reconstructs IEX (Invoke-Expression) by indexing environment variable strings (for example, $env:VAR[1,2,3]) or related `.name[...]` slices and joining characters at runtime.
Attackers use environment-variable slicing to hide dynamic execution and evade keyword-based detections and AMSI.
"""
from = "now-9m"
language = "esql"
license = "Elastic License v2"
name = "Potential Dynamic IEX Reconstruction via Environment Variables"
note = """## Triage and analysis

> **Disclaimer**:
> This guide was created by humans with the assistance of generative AI. While its contents have been manually curated to include the most valuable information, always validate assumptions and adjust procedures to match your internal runbooks and incident triage and response policies.

### Investigating Potential Dynamic IEX Reconstruction via Environment Variables

This alert indicates PowerShell Script Block Logging captured a script that builds "IEX" (Invoke-Expression) at runtime by indexing characters from environment variable strings or related name properties and combining them. This technique is commonly used to obscure dynamic execution and can indicate an attempt to execute attacker-controlled content.

#### Key alert fields to review

- `user.name`, `user.domain`, `user.id`: Account execution context for correlation, prioritization, and scoping.
- `host.name`, `host.id`: Host execution context for correlation, prioritization, and scoping.
- `file.path`, `file.directory`, `file.name`: File-origin context when the script block is sourced from an on-disk file.
- `powershell.file.script_block_text`: Script block content that matched the detection logic.
- `powershell.file.script_block_id`, `powershell.sequence`, `powershell.total`: Script block metadata to pivot to other fragments or reconstruct full script content when split across multiple events.
- `Esql.script_block_tmp`: Transformed script block where detection patterns replace original content with a marker to support scoring/counting and quickly spot match locations.
- `Esql.script_block_pattern_count`: Count of matches for the detection pattern(s) observed in the script block content.
- `powershell.file.script_block_entropy_bits`: Shannon entropy of the script block. Higher values may indicate obfuscation.
- `powershell.file.script_block_surprisal_stdev`: Standard deviation of surprisal across the script block. Low values indicate uniform randomness. High values indicate mixed patterns and variability.
- `powershell.file.script_block_unique_symbols`: Count of distinct characters present in the script block.
- `powershell.file.script_block_length`: Script block length (size) context.

#### Possible investigation steps

- Confirm scope and execution context:
  - Review `host.name` and `host.id` to identify the impacted endpoint and determine whether it is a typical user workstation, server, or a special-purpose system in your environment.
  - Review `user.name`, `user.domain`, and `user.id` to understand who executed the script and whether the account is expected to run PowerShell on this host (interactive user, service account, or administrative context).
  - Use `agent.id` (if available) to identify the reporting agent and to support correlation with other telemetry collected from the same endpoint.
  - Use the alert timestamp as the anchor to correlate activity immediately before and after the script block ran.

- Analyze the obfuscation and intended execution:
  - Examine `powershell.file.script_block_text` to locate environment-variable slicing patterns (for example, `$env:<var>[<idx>]`, `$env:<var>[<idx1>,<idx2>,<idx3>]`, or `.name[<idx1>,<idx2>,<idx3>]`) and identify the variable names and indices being used.
  - Use `Esql.script_block_tmp` to quickly find the match locations, then review the surrounding context in `powershell.file.script_block_text` to determine how the reconstructed string is used (assignment, concatenation/join, or immediate invocation).
  - Determine whether the reconstructed output is used as a dynamic execution primitive (for example, passed to `Invoke-Expression` / `IEX`, used with the call operator, or invoked via a method). Focus on what content is ultimately evaluated or executed.

- Reconstruct full script content:
  - If the script appears incomplete or staged across multiple events, use `powershell.file.script_block_id` with `powershell.sequence` and `powershell.total` to collect all fragments and rebuild the full script in order.
  - After reconstruction, identify where string construction occurs versus where execution occurs to understand the end-to-end flow.

- Assess obfuscation level and intent using available enrichments:
  - Review `Esql.script_block_pattern_count` to understand how frequently the reconstruction pattern appears within the script block; repeated occurrences can indicate systematic obfuscation rather than an isolated string operation.
  - Review `powershell.file.script_block_length` for size context and compare it with typical script sizes seen for the same host or user.
  - Review `powershell.file.script_block_entropy_bits`, `powershell.file.script_block_surprisal_stdev`, and `powershell.file.script_block_unique_symbols` to gauge whether the script contains encoded or highly obfuscated content (for example, large high-entropy blocks that may indicate packed or encoded data).

- Identify script origin and potential spread:
  - If `file.path` is populated, review `file.name` and `file.directory` to determine where the script was sourced from and whether the location aligns with approved administrative tooling or software distribution paths.
  - If `file.path` is not populated, treat the activity as potentially inline or dynamically generated and prioritize identifying the initiating process or source using adjacent telemetry.
  - Scope for other alerts or script blocks on the same `host.id` or associated with the same `user.id` that show similar reconstruction patterns, especially within the same time window.

- Correlate with adjacent telemetry (as available in your environment):
  - Using `host.id` / `host.name`, `user.id`, and the alert time, correlate with process execution data to identify the PowerShell host process and the initiating parent process or source (for example, interactive session, script runner, scheduled task, service, or another application).
  - Correlate with network, file, registry, and authentication telemetry on the same host around the alert time to identify follow-on activity that supports malicious intent (download or retrieval of content, creation or modification of files, persistence-related changes, or suspicious logons).

### False positive analysis

- Legitimate automation or administration scripts may construct command strings dynamically, including deriving short tokens from environment variables for compatibility or to reduce hard-coded strings.
- Security testing and purple-team or red-team activity may intentionally use environment-variable slicing to emulate evasive tradecraft.
- Developer tooling, obfuscation research, or PowerShell training content may include this technique. Benign usage is typically tied to known owners, consistent hosts, predictable execution windows, and the absence of suspicious downstream activity.

### Response and remediation

- If the activity is suspected or confirmed malicious:
  - Contain the affected host to prevent additional execution and reduce lateral movement risk.
  - Preserve evidence by collecting the complete script content using `powershell.file.script_block_id`, `powershell.sequence`, and `powershell.total`, and retain the original `powershell.file.script_block_text` for analysis.
  - Extract and track indicators from the script content (for example, URLs, domains, IP addresses, file names, or unique strings) and scope for additional occurrences across the environment using `host.id`, `host.name`, `user.id`, and `file.path` when present.
  - Identify and remediate the initial execution source (parent process or launching mechanism) and remove or quarantine any associated script files referenced by `file.path`.
  - If account compromise is suspected, reset affected credentials and review for additional suspicious PowerShell activity associated with the same `user.id`.

- If the activity is determined to be benign:
  - Document the business justification, owning team, expected hosts, and expected script location (`file.path` when present).
  - Monitor for deviations in execution context (new hosts, new users, or materially different script content) and consider targeted tuning based on stable attributes such as `file.path` and known `user.id` values.
"""
risk_score = 47
rule_id = "b0c98cfb-0745-4513-b6f9-08dddb033490"
setup = """## Setup

PowerShell Script Block Logging must be enabled to generate the events used by this rule (e.g., 4104).
Setup instructions: https://ela.st/powershell-logging-setup
"""
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Defense Evasion",
    "Data Source: PowerShell Logs",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "esql"

query = '''
from logs-windows.powershell_operational* metadata _id, _version, _index
| where event.code == "4104"

// Filter out smaller scripts that are unlikely to implement obfuscation using the patterns we are looking for
| eval Esql.script_block_length = length(powershell.file.script_block_text)
| where Esql.script_block_length > 500

// replace the patterns we are looking for with the 🔥 emoji to enable counting them
// The emoji is used because it's unlikely to appear in scripts and has a consistent character length of 1
| eval Esql.script_block_tmp = replace(
    powershell.file.script_block_text,
    """(?i)(\$(?:\w+|\w+\:\w+)\[\d++\]\+\$(?:\w+|\w+\:\w+)\[\d++\]\+['"]x['"]|\$(?:\w+\:\w+)\[\d++,\d++,\d++\]|\.name\[\d++,\d++,\d++\])""",
    "🔥"
)

// count how many patterns were detected by calculating the number of 🔥 characters inserted
| eval Esql.script_block_pattern_count = length(Esql.script_block_tmp) - length(replace(Esql.script_block_tmp, "🔥", ""))

// keep the fields relevant to the query, although this is not needed as the alert is populated using _id
| keep
    Esql.script_block_pattern_count,
    Esql.script_block_length,
    Esql.script_block_tmp,
    powershell.file.*,
    file.path,
    powershell.sequence,
    powershell.total,
    _id,
    _version,
    _index,
    host.name,
    host.id,
    agent.id,
    user.id

// Filter for scripts that match the pattern at least once
| where Esql.script_block_pattern_count >= 1
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1027"
name = "Obfuscated Files or Information"
reference = "https://attack.mitre.org/techniques/T1027/"

[[rule.threat.technique.subtechnique]]
id = "T1027.010"
name = "Command Obfuscation"
reference = "https://attack.mitre.org/techniques/T1027/010/"

[[rule.threat.technique]]
id = "T1140"
name = "Deobfuscate/Decode Files or Information"
reference = "https://attack.mitre.org/techniques/T1140/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"

[[rule.threat.technique.subtechnique]]
id = "T1059.001"
name = "PowerShell"
reference = "https://attack.mitre.org/techniques/T1059/001/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user.id",
    "user.domain",
    "powershell.file.script_block_text",
    "powershell.file.script_block_id",
    "powershell.sequence",
    "powershell.total",
    "file.path",
    "file.directory",
    "file.name",
    "process.pid",
    "host.name",
    "host.id",
    "powershell.file.script_block_length"
]

[metadata]
creation_date = "2021/12/10"
integration = ["endpoint"]
maturity = "production"
updated_date = "2026/08/26"

[rule]
author = ["Elastic"]
description = """
Identifies a Java process that accepts an inbound network connection and then spawns a suspicious child process. This
may indicate exploitation of a Java service that runs attacker-controlled code, such as one that deserializes untrusted
objects.
"""
from = "now-9m"
index = ["auditbeat-*", "logs-endpoint.events.*"]
language = "eql"
license = "Elastic License v2"
name = "Potential Java Service Exploitation via Suspicious Child Process"
references = [
    "https://www.lunasec.io/docs/blog/log4j-zero-day/",
    "https://github.com/christophetd/log4shell-vulnerable-app",
    "https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE.pdf",
    "https://www.elastic.co/security-labs/detecting-log4j2-with-elastic-security",
    "https://www.elastic.co/security-labs/analysis-of-log4shell-cve-2021-45046",
    "https://archive.ph/Xowgn",
]
risk_score = 73
rule_id = "c3f5e1d8-910e-43b4-8d44-d748e498ca86"
severity = "high"
tags = [
    "Domain: Endpoint",
    "OS: Linux",
    "OS: macOS",
    "Use Case: Threat Detection",
    "Tactic: Execution",
    "Use Case: Vulnerability",
    "Data Source: Elastic Defend",
    "Resources: Investigation Guide",
]
type = "eql"

query = '''
sequence by host.id with maxspan=5s
 [network where event.action == "connection_accepted" and network.direction == "ingress" and

  process.name : "java" and
  destination.port < 49152  and source.port >= 32768] by process.pid
 [process where event.type == "start" and

  /* Suspicious JAVA child process */
  process.parent.name : "java" and
  process.name : (
    "sh", "bash", "dash", "ksh", "tcsh", "zsh", "ash",  "mksh", "busybox",
    "curl", "wget", "perl*", "python*", "ruby*", "php*", "lua*", "socat",
    "nc", "ncat", "netcat", "netcat.openbsd", "netcat.traditional", "nc.openbsd",
    "nc.traditional", "nohup", "setsid", "disown", "hostname", "whoami", "id"
  ) and
    not process.command_line like~ (
      "bash -c ulimit -u",
      "bash /opt/flutter/bin/flutter*",
      "bash -c echo $$",
      "/bin/bash /opt/python3/bin/jira*",
      "/bin/sh -c env LC_ALL=C /usr/sbin/lpc status*"
    )] by process.parent.pid
'''
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Potential Java Service Exploitation via Suspicious Child Process

Some Java services accept inbound connections and deserialize untrusted objects, such as a leftover Log4j socket or collector that rebuilds serialized `LogEvent` objects through `FilteredObjectInputStream`. If that path can be reached, an attacker can send a crafted payload to the listening port and get the JVM to run attacker-controlled code. This rule looks for a Java process that accepts an inbound connection on a service port from an ephemeral source port, then quickly starts a suspicious child process (shell, interpreter, curl, or wget) whose working directory is under `/opt`. That sequence is consistent with remote code execution against a Java listener rather than a normal outbound application callback.

### Possible investigation steps

- Confirm the inbound `connection_accepted` event: Java was the accepting process, `network.direction` is ingress, the destination port is a service port (below 49152), and the source port is ephemeral (32768 or higher on Linux; 49152 or higher is typical on macOS).
- Identify the source IP and determine whether it is expected to talk to this Java service. Internal sources still matter; a collector or socket server exposed only on a private network can still be used for lateral movement.
- Review the child process that started within a few seconds of the accepted connection. Check `process.name`, `process.command_line`, `process.working_directory`, and the parent/child PID relationship to Java.
- Inspect the Java process command line and working directory to see which application accepted the connection (for example a service under `/opt`) and whether it is a known listener that deserializes input.
- Look for follow-on activity on the same host after the child process: additional shells, file writes under `/tmp` or `/opt`, new outbound connections, or persistence changes.
- Correlate with other alerts on the same host or user around the same time to see whether this is isolated or part of a broader intrusion.

### False positive analysis

- Java services installed may spawn shells or interpreters during install, upgrade, health checks, or administrative scripts. Confirm whether the child command line matches a known maintenance pattern before treating the alert as malicious.
- Some already-excluded patterns include Flutter tooling, Jira helper scripts, and trivial `bash -c` probes such as `ulimit` or `echo $$`. Add similar exceptions for other trusted `/opt` applications when the parent Java process and command line are stable.
- Development or lab collectors that intentionally accept serialized Java objects will match this rule if they also start a shell. Restrict those hosts or exclude the specific service path if that activity is expected.
- Containerized or non-`/opt` Java applications are outside this rule's working-directory constraint and should not be tuned here; investigate those with a broader hunt if needed.

### Response and remediation

- Isolate the affected host from the network to stop further inbound exploitation and limit lateral movement.
- Stop the suspicious child processes and, if exploitation is confirmed, stop the Java listener that accepted the connection until it can be patched or removed.
- Capture the Java process command line, listening port, child process command line, and inbound source IP for scoping.
- Hunt for the same source IP, the same Java service path, and similar child processes on other hosts.
- Remove or disable unused Java socket servers, collectors, or sample bridges that deserialize untrusted input. Patch remaining Java applications and apply a JVM-wide serialization filter where deserialization cannot be avoided.
- Restore from a known-good backup if unauthorized files, persistence, or additional malware are found.
- Escalate to the security operations center or incident response team if the inbound source, child process, or follow-on activity indicates a successful compromise."""


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"

[[rule.threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"

[[rule.threat.technique.subtechnique]]
id = "T1059.006"
name = "Python"
reference = "https://attack.mitre.org/techniques/T1059/006/"

[[rule.threat.technique.subtechnique]]
id = "T1059.007"
name = "JavaScript"
reference = "https://attack.mitre.org/techniques/T1059/007/"

[[rule.threat.technique]]
id = "T1203"
name = "Exploitation for Client Execution"
reference = "https://attack.mitre.org/techniques/T1203/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1190"
name = "Exploit Public-Facing Application"
reference = "https://attack.mitre.org/techniques/T1190/"

[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"

[rule]
description = """
Identifies the execution of a Linux shell process from a Java parent application before an incoming network connection.
This behavior may indicate reverse shell activity via a Java application.
"""
id = "41424b6d-8875-409f-a3ab-96792e7c8cd6"
license = "Elastic License v2"
name = "Potential Linux Reverse Shell via Java Shell Execution"
os_list = ["linux"]
version = "1.0.1"

query = '''
sequence by process.entity_id with maxspan=5s
  [process where event.type == "start" and event.action == "exec" and
   process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and
   process.parent.name == "java"
  ]
  [network where event.type == "start" and event.action == "connection_attempted" and
   process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and 
   not (destination.ip == null or destination.ip == "0.0.0.0" or cidrmatch(
     destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.0.0/29",
     "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
     "192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10",
     "192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1", "FE80::/10",
     "FF00::/8"
     )
   )]
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"


[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "7.15.0"

[metadata]
creation_date = "2023/08/29"
integration = ["endpoint", "windows", "system"]
maturity = "production"
updated_date = "2025/03/20"

[rule]
author = ["Elastic"]
building_block_type = "default"
description = """
Identifies attempts to modify a service path setting using sc.exe. Attackers may attempt to modify existing services for
persistence or privilege escalation.
"""
from = "now-119m"
index = [
    "endgame-*",
    "logs-endpoint.events.process-*",
    "logs-system.security*",
    "logs-windows.sysmon_operational-*",
    "winlogbeat-*",
]
interval = "60m"
language = "eql"
license = "Elastic License v2"
name = "Service Path Modification via sc.exe"
risk_score = 21
rule_id = "c5677997-f75b-4cda-b830-a75920514096"
severity = "low"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Defense Evasion",
    "Data Source: Elastic Endgame",
    "Data Source: Elastic Defend",
    "Rule Type: BBR",
    "Data Source: Sysmon",
    "Data Source: Windows Security Event Logs",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
process where event.type == "start" and process.name : "sc.exe" and
  process.args : "*config*" and process.args : "*binPath*"
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1112"
name = "Modify Registry"
reference = "https://attack.mitre.org/techniques/T1112/"


[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1543"
name = "Create or Modify System Process"
reference = "https://attack.mitre.org/techniques/T1543/"
[[rule.threat.technique.subtechnique]]
id = "T1543.003"
name = "Windows Service"
reference = "https://attack.mitre.org/techniques/T1543/003/"



[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1543"
name = "Create or Modify System Process"
reference = "https://attack.mitre.org/techniques/T1543/"
[[rule.threat.technique.subtechnique]]
id = "T1543.003"
name = "Windows Service"
reference = "https://attack.mitre.org/techniques/T1543/003/"



[rule.threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[rule]
description = """
Detects when an executable file is copied from a hidden directory on a volume mounted disk to the applications
directory. Geacon samples have been observed utilizing this technique as a method for setting up persistence with the
second stage payload prior to establishing persistence via the .zshrc file.
"""
id = "0facb446-7d95-4b27-bd40-490bbec5a95b"
license = "Elastic License v2"
name = "Suspicious Executable Copied from Volume Mount"
os_list = ["macos"]
reference = ["https://github.com/darkr4y/geacon"]
version = "1.0.6"

query = '''
sequence by process.entity_id with maxspan=3s
  [process where event.type == "start" and event.action == "exec" and process.name == "cp" and 
    process.args_count == 3 and process.args in ("cp", "/bin/cp", "/usr/bin/cp") and 
    process.args like~ "/Volumes/*/.*" and process.args like "/Applications/*"] as event0
  [file where event.action == "modification" and process.name == "cp" and file.path like "/Applications/*" and 
    file.Ext.header_bytes like~ ("cffaedfe*", "cafebabe*") and
    stringcontains~(event0.process.command_line, file.name)]
'''

min_endpoint_version = "8.11.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "Effective_process.entity_id"
state = 1

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1036"
name = "Masquerading"
reference = "https://attack.mitre.org/techniques/T1036/"
[[threat.technique.subtechnique]]
id = "T1036.005"
name = "Match Legitimate Resource Name or Location"
reference = "https://attack.mitre.org/techniques/T1036/005/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.11.0"