Elastic rules: 2w

[metadata]
creation_date = "2020/05/21"
integration = ["okta"]
maturity = "production"
updated_date = "2026/04/10"

[rule]
author = ["Elastic"]
description = """
Detects attempts to modify an Okta network zone. Okta network zones can be configured to limit or restrict access to a
network based on IP addresses or geolocations. An adversary may attempt to modify, delete, or deactivate an Okta network
zone in order to remove or weaken an organization's security controls.
"""
false_positives = [
    """
    Consider adding exceptions to this rule to filter false positives if Oyour organization's Okta network zones are
    regularly modified.
    """,
]
index = ["filebeat-*", "logs-okta*"]
language = "kuery"
license = "Elastic License v2"
name = "Attempt to Modify an Okta Network Zone"
note = """## Triage and analysis

### Investigating Attempt to Modify an Okta Network Zone

The modification of an Okta network zone is a critical event as it could potentially allow an adversary to gain unrestricted access to your network. This rule detects attempts to modify, delete, or deactivate an Okta network zone, which may suggest an attempt to remove or weaken an organization's security controls.

#### Possible investigation steps:

- Identify the actor related to the alert by reviewing `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, or `okta.actor.display_name` fields in the alert.
- Review the `okta.client.user_agent.raw_user_agent` field to understand the device and software used by the actor.
- Examine the `okta.outcome.reason` field for additional context around the modification attempt.
- Check the `okta.outcome.result` field to confirm the network zone modification attempt.
- Check if there are multiple network zone modification attempts from the same actor or IP address (`okta.client.ip`).
- Check for successful logins immediately following the modification attempt.
- Verify whether the actor's activity aligns with typical behavior or if any unusual activity took place around the time of the modification attempt.

### False positive analysis:

- Check if there were issues with the Okta system at the time of the modification attempt. This could indicate a system error rather than a genuine threat activity.
- Check the geographical location (`okta.request.ip_chain.geographical_context`) and time of the modification attempt. If these match the actor's normal behavior, it might be a false positive.
- Verify the actor's administrative rights to ensure they are correctly configured.

### Response and remediation:

- If unauthorized modification is confirmed, initiate the incident response process.
- Immediately lock the affected actor account and require a password change.
- Consider resetting MFA tokens for the actor and require re-enrollment.
- Check if the compromised account was used to access or alter any sensitive data or systems.
- If a specific modification technique was used, ensure your systems are patched or configured to prevent such techniques.
- Assess the criticality of affected services and servers.
- Work with your IT team to minimize the impact on users and maintain business continuity.
- If multiple accounts are affected, consider a broader reset or audit of MFA tokens.
- Implement security best practices [outlined](https://www.okta.com/blog/2019/10/9-admin-best-practices-to-keep-your-org-secure/) by Okta.
- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).

## Setup

The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
references = [
    "https://help.okta.com/en/prod/Content/Topics/Security/network/network-zones.htm",
    "https://developer.okta.com/docs/reference/api/system-log/",
    "https://developer.okta.com/docs/reference/api/event-types/",
    "https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy",
    "https://www.elastic.co/security-labs/monitoring-okta-threats-with-elastic-security",
    "https://www.elastic.co/security-labs/starter-guide-to-understanding-okta",
]
risk_score = 47
rule_id = "e48236ca-b67a-4b4e-840c-fdc7782bc0c3"
severity = "medium"
tags = [
    "Use Case: Identity and Access Audit",
    "Data Source: Okta",
    "Use Case: Network Security Monitoring",
    "Tactic: Defense Evasion",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset:okta.system and event.action:(zone.update or network_zone.rule.disabled or zone.remove_blacklist)
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1484"
name = "Domain or Tenant Policy Modification"
reference = "https://attack.mitre.org/techniques/T1484/"

[[rule.threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"

[[rule.threat.technique.subtechnique]]
id = "T1562.007"
name = "Disable or Modify Cloud Firewall"
reference = "https://attack.mitre.org/techniques/T1562/007/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[metadata]
creation_date = "2026/04/29"
integration = ["endpoint", "auditd_manager"]
maturity = "production"
updated_date = "2026/04/29"

[rule]
author = ["Elastic"]
description = """
Detects execution of container runtime CLI tools (ctr, crictl, nerdctl) with arguments indicating container creation,
command execution inside existing containers, image manipulation, or host filesystem mounting. These tools interact
directly with the container runtime socket, bypassing the Kubernetes API server, RBAC authorization, admission webhooks,
pod security standards, and Kubernetes audit logging entirely. Attackers with host-level access may use these tools to
create privileged ghost containers, exec into other pods to steal service account tokens and secrets, pull
attacker-controlled images, and destroy evidence, all while remaining invisible to Kubernetes-level monitoring.
"""
false_positives = [
    """
    Platform automation, node bootstrap, and legitimate break-glass admin sessions may use these CLIs with overlapping
    arguments. Tune by parent process, user, or host role (worker vs bastion).
    """,
]
from = "now-9m"
index = ["auditbeat-*", "logs-auditd_manager.auditd-*", "logs-endpoint.events.process*"]
language = "eql"
license = "Elastic License v2"
name = "Container Runtime CLI Execution with Suspicious Arguments"
note = """## Triage and analysis

### Investigating Container Runtime CLI Execution with Suspicious Arguments

Review the full argv list and working directory. Confirm whether the session is interactive, whether the image or bundle
referenced is trusted, and whether bind mounts or privileged flags target host paths such as `/`, `/etc`, or Docker
sockets.

### Possible investigation steps

- Reconstruct the container ID or snapshot key passed to `tasks`, `snapshots`, or `content` subcommands.
- Correlate with file, network, and Kubernetes audit activity for pulls from unusual registries or subsequent pod
  changes.
- Check whether the parent should legitimately be kubelet, containerd, or systemd on that host class.

### Response and remediation

- If unauthorized, isolate the node, revoke credentials available to the session, and hunt for new privileged
  workloads or image imports.
"""
references = [
    "https://attack.mitre.org/techniques/T1609/",
    "https://book.hacktricks.xyz/linux-hardening/privilege-escalation/containerd-ctr-privilege-escalation",
]
risk_score = 47
rule_id = "86b3a245-03de-49a5-ab57-ae44d8f064da"
setup = """## Setup

Requires process execution telemetry with arguments from **Elastic Defend** (`logs-endpoint.events.process*`) and/or
**Auditd Manager** / Auditbeat (`logs-auditd_manager.auditd-*`, `auditbeat-*`).

Ensure exec-related auditing captures full argv for `ctr`, `crictl`, and `nerdctl`. See
https://docs.elastic.co/integrations/auditd_manager
"""
severity = "medium"
tags = [
    "Data Source: Auditd Manager",
    "Data Source: Elastic Defend",
    "Domain: Container",
    "Domain: Endpoint",
    "OS: Linux",
    "Use Case: Threat Detection",
    "Tactic: Execution",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"
query = '''
process where host.os.type == "linux" and event.type == "start" and event.action in ("exec", "executed") and
(
  (
    process.name in ("ctr", "crictl", "nerdctl") and
    (
      (process.args == "tasks" and process.args == "exec") or
      (process.args == "run" and process.args in ("--privileged", "--rm", "--mount", "--net-host", "--pid-host")) or
      (process.args == "snapshots" and process.args == "mount")
    )
  ) or
  (
    (process.executable like ("/dev/shm/*", "/tmp/*", "/var/tmp/*") or process.name : ".*") and
    process.args like ("*containerd.sock*", "k8s.io")
  )
) and
not process.parent.executable in (
  "/usr/bin/kubelet", "/usr/local/bin/kubelet",
  "/usr/bin/containerd", "/usr/sbin/containerd",
  "/lib/systemd/systemd", "/usr/lib/systemd/systemd", "/sbin/init"
)
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1609"
name = "Container Administration Command"
reference = "https://attack.mitre.org/techniques/T1609/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1611"
name = "Escape to Host"
reference = "https://attack.mitre.org/techniques/T1611/"

[rule.threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[metadata]
creation_date = "2026/01/21"
integration = ["cloud_defend", "kubernetes"]
maturity = "production"
min_stack_comments = "Defend for Containers integration was re-introduced in 9.3.0"
min_stack_version = "9.3.0"
updated_date = "2026/04/10"

[rule]
author = ["Elastic"]
description = """
This rule leverages a combination of Defend for Containers and Kubernetes audit logs to detect the execution of direct
interactive Kubernetes API requests via unusual utilities. An adversary may need to execute direct interactive Kubernetes
API requests to gain access to the Kubernetes API server or other resources within the cluster. These requests are often
used to enumerate the Kubernetes API server or other resources within the cluster, and may indicate an attempt to move
laterally within the cluster.
"""
false_positives = [
    """
    There is a potential for false positives if the direct interactive Kubernetes API requests are used for legitimate purposes,
    such as debugging or troubleshooting. It is important to investigate any alerts generated by this rule to determine
    if they are indicative of malicious activity or part of legitimate container activity.
    """,
    """
    There is a risk of false positives if there are several containers named the same, as the rule may correlate the request
    to the wrong container.
    """,
]
from = "now-6m"
index = ["logs-cloud_defend.process*", "logs-kubernetes.audit_logs-*"]
interval = "5m"
language = "eql"
license = "Elastic License v2"
name = "Direct Interactive Kubernetes API Request by Unusual Utilities"
note = """ ## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Direct Interactive Kubernetes API Request by Unusual Utilities

This rule detects interactive commands executed inside containers that use atypical utilities to hit the Kubernetes API, paired with near-simultaneous API activity on pods, secrets, service accounts, roles/bindings, or pod exec/attach/log/portforward. It surfaces hands-on-keyboard discovery and lateral movement using custom scripts that evade common tool allowlists; for example, an intruder opens a shell in a pod, uses Python to query the in-cluster API to list secrets, then triggers pods/exec to pivot into another workload.

### Possible investigation steps

- Identify the implicated pod, container image, and executing service account, then quickly review its RBAC bindings and effective permissions to determine blast radius.
- Inspect the container’s interactive session context by pulling recent command lines, shell history, environment variables, and mounted service account tokens, and look for custom scripts or binaries issuing HTTP requests.
- Correlate nearby Kubernetes audit entries tied to the same principal and pod to map accessed resources and verbs, noting any exec/attach/portforward or sensitive object interactions across namespaces.
- Review network activity from the pod to the API server and any in-pod proxies, including DNS lookups and outbound connections, to spot nonstandard clients or tunneling behavior.
- If suspicious, isolate the pod or node, capture runtime artifacts (e.g., process memory or HTTP client traffic), revoke and rotate the service account credentials, and verify image provenance and integrity.

### False positive analysis

- An operator interactively attaches to a pod and uses a Python REPL or bash with /dev/tcp to call the in-cluster API for routine troubleshooting (e.g., list pods, read ConfigMaps, or run selfsubjectaccessreviews), producing normal audit entries that match the rule signature.
- A correlation artifact arises when two namespaces have pods with the same name: one pod starts an interactive shell while another independently performs get/list/watch calls, and the 1-second sequence keyed only on pod-name links the unrelated events.

### Response and remediation

- Immediately isolate the implicated pod that issued direct API calls using a nonstandard utility by applying a deny-all egress NetworkPolicy in its namespace (including to kubernetes.default.svc:443), terminating the interactive session, and scaling its owning Deployment/Job/StatefulSet to zero replicas.
- Before teardown, capture a runtime snapshot of the container and node including the binary or script used to query the API (e.g., files under /tmp or /dev/tcp usage), shell history, environment, and the mounted service account token and CA bundle at /var/run/secrets/kubernetes.io/serviceaccount/.
- Revoke access by removing the service account’s RoleBindings/ClusterRoleBindings, deleting all pods that mount that service account to force token rotation, rotating any Secrets and ConfigMaps that were read or created during the window, and deleting any unauthorized Jobs, CronJobs, or Deployments created by the same principal.
- Restore workloads from a known-good image digest, re-enable the Deployment only after image scan and integrity checks pass, and monitor subsequent Kubernetes audit logs for pods/exec, portforward, and access to secrets across the affected namespaces.
- Escalate to incident response leadership and consider cluster-wide containment if audit logs show create/patch of ClusterRoleBindings, access to secrets outside the workload’s namespace, or use of pods/exec to pivot into other nodes or system namespaces such as kube-system.
- Harden access by enforcing least-privilege RBAC that denies pods/exec and attach for application service accounts, setting automountServiceAccountToken: false on workloads that do not need it, restricting egress to the API server with NetworkPolicies, and requiring just-in-time break-glass roles for interactive access.
"""
risk_score = 21
rule_id = "02275e05-57a1-46ab-a443-7fb444da6b28"
severity = "low"
tags = [
    "Data Source: Elastic Defend for Containers",
    "Data Source: Kubernetes",
    "Domain: Container",
    "Domain: Kubernetes",
    "OS: Linux",
    "Use Case: Threat Detection",
    "Tactic: Execution",
    "Tactic: Discovery",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"
query = '''
sequence with maxspan=1s
  [process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and process.interactive == true and
  container.id like "*" and
  /* Covered by the rule "Direct Interactive Kubernetes API Request by Common Utilities" */
  not (
     process.name in ("wget", "curl", "openssl", "socat", "ncat", "kubectl") or
     (
       /* Account for tools that execute utilities as a subprocess, in this case the target utility name will appear as a process arg */
       process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "busybox") and
       process.args in (
         "wget", "/bin/wget", "/usr/bin/wget", "/usr/local/bin/wget",
         "ssl_client", "/bin/ssl_client", "/usr/bin/ssl_client", "/usr/local/bin/ssl_client",
         "curl", "/bin/curl", "/usr/bin/curl", "/usr/local/bin/curl",
         "openssl", "/bin/openssl", "/usr/bin/openssl", "/usr/local/bin/openssl",
         "socat", "/bin/socat", "/usr/bin/socat", "/usr/local/bin/socat",
         "ncat", "/bin/ncat", "/usr/bin/ncat", "/usr/local/bin/ncat",
         "kubectl", "/bin/kubectl", "/usr/bin/kubectl", "/usr/local/bin/kubectl"
       ) and
       /* default exclusion list to not FP on default multi-process commands */
       not process.args in (
         "which", "/bin/which", "/usr/bin/which", "/usr/local/bin/which",
         "man", "/bin/man", "/usr/bin/man", "/usr/local/bin/man",
         "chmod", "/bin/chmod", "/usr/bin/chmod", "/usr/local/bin/chmod",
         "chown", "/bin/chown", "/usr/bin/chown", "/usr/local/bin/chown"
       )
     ) or
     /* General exclusions for utilities that are not typically used for Kubernetes API requests */
     process.name in (
       "sleep", "head", "tail", "apk", "apt", "apt-get", "dnf", "microdnf", "yum", "zypper", "tdnf",
       "pacman", "rpm", "dpkg"
     )
   )] by orchestrator.resource.name
  [any where
     data_stream.dataset == "kubernetes.audit_logs" and
     kubernetes.audit.stage in ("ResponseStarted","ResponseComplete") and
     kubernetes.audit.verb in ("get", "list", "watch", "create", "patch", "update") and
     (
       kubernetes.audit.objectRef.resource in (
         "pods", "secrets", "serviceaccounts", "configmaps",
         "roles", "rolebindings", "clusterroles", "clusterrolebindings",
         "deployments", "daemonsets", "statefulsets", "jobs", "cronjobs",
         "nodes", "namespaces",
         "selfsubjectaccessreviews", "selfsubjectrulesreviews", "subjectaccessreviews"
       )
       or (
         kubernetes.audit.objectRef.resource == "pods" and
         kubernetes.audit.objectRef.subresource in ("exec", "attach", "portforward", "log")
       )
     )
  ] by `kubernetes.audit.user.extra.authentication.kubernetes.io/pod-name`
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"

[[rule.threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"

[[rule.threat.technique]]
id = "T1609"
name = "Container Administration Command"
reference = "https://attack.mitre.org/techniques/T1609/"

[[rule.threat.technique]]
id = "T1610"
name = "Deploy Container"
reference = "https://attack.mitre.org/techniques/T1610/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1069"
name = "Permission Groups Discovery"
reference = "https://attack.mitre.org/techniques/T1069/"

[[rule.threat.technique]]
id = "T1087"
name = "Account Discovery"
reference = "https://attack.mitre.org/techniques/T1087/"

[[rule.threat.technique]]
id = "T1613"
name = "Container and Resource Discovery"
reference = "https://attack.mitre.org/techniques/T1613/"

[rule.threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"

[rule]
description = """
Identifies attempts to enumerate Distributed File System Shares using LDAP queries. Adversaries often query DFS links to
learn about every central file share across the org without scanning the network. DFS shares might contain sensitive
data (backups, GPO scripts, credentials, installer packages) or access controlled areas if permissions are
misconfigured.
"""
id = "559c64c5-47f9-44b1-9261-4295eff8491f"
license = "Elastic License v2"
name = "Distributed File System Shares Enumeration via LDAP"
os_list = ["windows"]
reference = ["https://attack.mitre.org/techniques/T1087/002/"]
version = "1.0.3"

query = '''
api where process.Ext.api.name == "ldap_search" and
 process.Ext.api.parameters.search_filter : ("(&(objectClass=msDFS-Linkv2))", "(objectClass=msDFS-Linkv2)", "objectClass=msDFS-Linkv2") and
 process.Ext.api.parameters.attribute_list : "msdfs-linkpathv2" and process.Ext.api.parameters.attribute_list : "msDFS-TargetListv2"
'''

min_endpoint_version = "9.1.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1135"
name = "Network Share Discovery"
reference = "https://attack.mitre.org/techniques/T1135/"


[threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"

[internal]
min_endpoint_version = "9.1.0"

[rule]
description = """
Identifies attempts to load a DLL indirectly using thread pool callback functions. This may be the result of an evasion
attempt to obscure the call origin.
"""
id = "716a3414-52cc-4165-97af-ec713dfac674"
license = "Elastic License v2"
name = "DLL Loaded via a CallBack Function"
os_list = ["windows"]
reference = ["https://www.elastic.co/security-labs/doubling-down-etw-callstacks"]
version = "1.0.1"

query = '''
library where
   process.thread.Ext.call_stack_summary == "ntdll.dll|kernel32.dll|ntdll.dll" and
   _arraysearch(process.thread.Ext.call_stack, $entry,
                $entry.symbol_info : ("?:\\Windows\\Sys*\\ntdll.dll!TpReleaseCleanupGroupMembers*",
                                      "?:\\Windows\\Sys*\\ntdll.dll!RtlDeregisterWaitEx*",
                                      "?:\\Windows\\Sys*\\ntdll.dll!TppWorkpExecuteCallback*",
                                      "?:\\Windows\\Sys*\\ntdll.dll!TppWorkerThread*")) and
   _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info : "?:\\Windows\\Sys*\\ntdll.dll!LdrLoadDll*")
'''

min_endpoint_version = "8.10.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"

[rule]
description = """
Identifies the execution of a process via Windows Management Instrumentation (WMI) and with an unusual effective parent.
Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads.
"""
id = "b0a0d293-f85e-4994-97e6-95541c0bc181"
license = "Elastic License v2"
name = "Execution via a Suspicious WMI Client"
os_list = ["windows"]
reference = ["https://www.elastic.co/security-labs/spring-cleaning-with-latrodectus"]
version = "1.0.33"

query = '''
process where event.action == "start" and
  process.parent.name :"WmiPrvSE.exe" and
   (
    process.Ext.effective_parent.name : ("excel.exe", "powerpnt.exe", "winword.exe", "mshta.exe",
                                         "wscript.exe", "rundll32.exe", "regsvr32.exe",
                                         "msbuild.exe", "InstallUtil.exe") or
    process.Ext.effective_parent.executable : ("?:\\Users\\Public\\*", "?:\\ProgramData\\*", "?:\\Users\\*\\AppData\\*", "?:\\Windows\\Microsoft.NET\\*")
    ) and 
  not (user.id : "S-1-5-18" and process.name : "powershell.exe") and
  not process.hash.sha256 : 
             ("0e692d9d3342fdcab1ce3d61aed0520989a94371e5898edb266c92f1fe11c97f", 
              "8ee339af3ce1287066881147557dc3b57d1835cbba56b2457663068ed25b7840", 
              "f27cb78f44fc8f70606be883bbed705bd1dd2c2f8a84a596e5f4924e19068f22") and
  not (process.name : "powershell.exe" and process.args : "C:\\Windows\\TEMP\\RestartHealthService.ps1" and
       process.args : "60" and process.args : "1" and
       not process.Ext.effective_parent.name : ("excel.exe", "powerpnt.exe", "winword.exe")) and

  not (process.code_signature.subject_name : ("Immense Networks LLC", "Synology Inc.", "Xerox Corporation", "Beijing Qihu Technology Co., Ltd.") and
       process.code_signature.trusted == true) and

  not (process.args : "?:\\Windows\\TEMP\\RestartHealthService.js" and process.args : "60" and user.id : "S-1-5-18" and
       process.Ext.effective_parent.name : "cscript.exe") and

  /* ansible */
  not (process.name : "powershell.exe" and
       process.command_line : "*CgAgACAAIAAgAHQAcgBhAHAAIAB7AAoAIAAgACAAIAAgACAAIAAgACQAdwByAGEAcABwAGUAcgBfAHAAYQB0AGgAIAA9ACAAIgAkACgAJABlAG4AdgA6AFQARQBNAFAAKQBcAGEAbgBzAGkAYgBsAGUALQBhAHMAeQBuAGMALQB3AHIAYQBwAHAAZQByAC0AZ*") and

  not (process.name : "powershell.exe" and
       process.command_line : ("powershell.exe -WindowStyle \"Hidden\" -Command \"Enable-PSRemoting -Force\"",
                               "powershell.exe -WindowStyle \"Hidden\" -Command \"Set-WSManQuickConfig -Force\"",
                               "powershell.exe -WindowStyle \"Hidden\" -Command \"WinRM QuickConfig -Quiet -Force\"")) and
  not process.executable :
             ("?:\\Windows\\System32\\WerFault.exe",
              "?:\\Windows\\SysWOW64\\WerFault.exe",
              "?:\\Windows\\System32\\typeperf.exe",
              "?:\\Program Files*\\Adobe\\Acrobat DC\\Acrobat\\AcroTray.exe",
              "?:\\Program Files*\\Google\\Chrome\\Application\\chrome.exe",
              "?:\\Program Files*\\Mozilla Firefox\\firefox.exe",
              "\\Device\\Mup\\*.exe") and
  not (process.name : "cmd.exe" and
       process.args : ("\\\\*\\netlogon\\logon.cmd",
                       "?:\\ProgramData\\Package Cache\" %a in (cybereasonsensor.exe)*",
                       "(x86)\\EOG\\iFileMenu\\iFileMenu.bat"))
'''

min_endpoint_version = "8.4.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"
[[threat.technique.subtechnique]]
id = "T1566.001"
name = "Spearphishing Attachment"
reference = "https://attack.mitre.org/techniques/T1566/001/"



[threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1047"
name = "Windows Management Instrumentation"
reference = "https://attack.mitre.org/techniques/T1047/"


[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[[threat.technique.subtechnique]]
id = "T1218.004"
name = "InstallUtil"
reference = "https://attack.mitre.org/techniques/T1218/004/"

[[threat.technique.subtechnique]]
id = "T1218.005"
name = "Mshta"
reference = "https://attack.mitre.org/techniques/T1218/005/"

[[threat.technique.subtechnique]]
id = "T1218.009"
name = "Regsvcs/Regasm"
reference = "https://attack.mitre.org/techniques/T1218/009/"

[[threat.technique.subtechnique]]
id = "T1218.010"
name = "Regsvr32"
reference = "https://attack.mitre.org/techniques/T1218/010/"

[[threat.technique.subtechnique]]
id = "T1218.011"
name = "Rundll32"
reference = "https://attack.mitre.org/techniques/T1218/011/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.4.0"

[metadata]
bypass_bbr_timing = true
creation_date = "2023/10/11"
integration = ["github"]
maturity = "production"
updated_date = "2026/03/24"

[rule]
author = ["Elastic"]
building_block_type = "default"
description = "Detects a first occurrence event for a personal access token (PAT) not seen in the last 14 days.\n"
from = "now-9m"
index = ["logs-github.audit-*"]
language = "kuery"
license = "Elastic License v2"
name = "First Occurrence GitHub Event for a Personal Access Token (PAT)"
risk_score = 21
rule_id = "ce08b55a-f67d-4804-92b5-617b0fe5a5b5"
severity = "low"
tags = [
    "Domain: Cloud",
    "Use Case: Threat Detection",
    "Use Case: UEBA",
    "Tactic: Execution",
    "Rule Type: BBR",
    "Data Source: Github",
]
timestamp_override = "event.ingested"
type = "new_terms"

query = '''
event.dataset:"github.audit" and event.category:"configuration" and
event.action:* and github.hashed_token:* and 
github.programmatic_access_type:("OAuth access token" or "Fine-grained personal access token")
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1648"
name = "Serverless Execution"
reference = "https://attack.mitre.org/techniques/T1648/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1550"
name = "Use Alternate Authentication Material"
reference = "https://attack.mitre.org/techniques/T1550/"

[[rule.threat.technique.subtechnique]]
id = "T1550.001"
name = "Application Access Token"
reference = "https://attack.mitre.org/techniques/T1550/001/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"

[[rule.threat.technique.subtechnique]]
id = "T1098.001"
name = "Additional Cloud Credentials"
reference = "https://attack.mitre.org/techniques/T1098/001/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
[rule.new_terms]
field = "new_terms_fields"
value = ["github.hashed_token", "event.action"]
[[rule.new_terms.history_window_start]]
field = "history_window_start"
value = "now-5d"

[metadata]
creation_date = "2026/07/17"
integration = ["gcp"]
maturity = "production"
updated_date = "2026/07/17"

[rule]
author = ["Elastic"]
description = """
Detects GKE Secrets API activity that should not occur in normal cluster operation: a node identity
(system:node:*) performing secrets get or list, or a pod service account failing a secrets get.
Kubelet and node credentials are not expected to call the Secrets API for enumeration or direct reads,
and a denied service-account secret get could indicate stolen-token probing or over-privileged tooling
reaching beyond its RBAC.
"""
false_positives = [
    """
    Rare node maintenance or diagnostic tooling may touch the Secrets API; validate against change windows
    and approved node management paths.
    """,
    """
    Misconfigured workloads can generate repeated denied secret gets during startup; confirm RBAC intent
    before treating as compromise.
    """,
]
from = "now-6m"
index = ["logs-gcp.audit-*"]
language = "kuery"
license = "Elastic License v2"
name = "GKE Secret Access from Node or Denied Service Account"
note = """## Triage and analysis

### Investigating GKE Secret Access from Node or Denied Service Account

This rule fires on two high-confidence patterns in GKE audit logs:

- `system:node:*` successfully or unsuccessfully calling `secrets.get` or `secrets.list`
- `system:serviceaccount:*` receiving `event.outcome:failure` on `secrets.get`

Treat node-originated Secrets API calls as priority. For denied service-account gets, determine whether
the identity is probing secrets outside its Role/ClusterRole or using an unexpected client from a
compromised token.

### Possible investigation steps

- Resolve `client.user.email` to the node or workload and review RBAC bindings for secret `get`/`list` scope.
- Inspect `gcp.audit.resource_name`, `source.ip`, and `user_agent.original` for anomalous clients or
  cross-namespace targets.
- Correlate with successful secret reads, pod exec, token creation, or RoleBinding changes in the same window.
- For node events, confirm whether kubelet, CSI, or maintenance tooling on that node should ever call the
  Secrets API.

### False positive analysis

- Node diagnostics or custom CSI helpers may rarely issue Secrets API calls; allowlist only after confirming
  the path is approved.
- Broken RBAC on a newly deployed workload can produce repeated denied gets until permissions are fixed.

### Response and remediation

- If malicious, revoke the node or service-account credentials, isolate the host or workload, rotate exposed
  secrets, and tighten RBAC to least privilege for the affected identity.
"""
setup = "The GCP Fleet integration with GKE audit logs enabled is required to be compatible with this rule."
references = [
    "https://kubernetes.io/docs/reference/access-authn-authz/authentication/#service-account-tokens",
]
risk_score = 47
rule_id = "bedab6b4-f195-45d1-8f97-7d300eb79671"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Domain: Kubernetes",
    "Data Source: GCP",
    "Data Source: Google Cloud Platform",
    "Use Case: Threat Detection",
    "Tactic: Credential Access",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset:gcp.audit and service.name:k8s.io and
source.ip:(* and not (127.0.0.1 or "::1")) and
(
  (
    client.user.email:system\:node\:* and
    event.action:(io.k8s.core.v1.secrets.get or io.k8s.core.v1.secrets.list)
  ) or (
    client.user.email:system\:serviceaccount\:* and
    event.action:io.k8s.core.v1.secrets.get and
    event.outcome:failure
  )
)
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"

[[rule.threat.technique.subtechnique]]
id = "T1552.007"
name = "Container API"
reference = "https://attack.mitre.org/techniques/T1552/007/"

[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "client.user.email",
    "source.ip",
    "user_agent.original",
    "event.action",
    "event.outcome",
    "gcp.audit.resource_name",
    "data_stream.namespace",
]

[metadata]
creation_date = "2026/05/05"
integration = ["kubernetes"]
maturity = "production"
updated_date = "2026/05/26"

[rule]
author = ["Elastic"]
description = """
Detects creation, modification, or deletion of Kubernetes MutatingWebhookConfigurations or ValidatingWebhookConfigurations 
by non-system identities. Admission webhooks intercept every API request matching their rules before persistence, giving an 
attacker powerful capabilities: injecting malicious sidecars into every new pod via a mutating webhook, blocking security 
tooling deployments via a validating webhook, or silently exfiltrating pod specifications to an external server. 
Webhook manipulation is a stealthy persistence and defense evasion technique because the webhook configuration itself looks 
benign in kubectl output while actively modifying or intercepting all matching Kubernetes API traffic.
"""
false_positives = [
  """
  Cluster operators and GitOps automation may legitimately install or upgrade admission controllers (e.g. cert-manager,
  Gatekeeper, Kyverno, service mesh components). Validate change tickets and approved controllers before tuning.
  """,
]
from = "now-9m"
index = ["logs-kubernetes.audit_logs-*"]
language = "kuery"
license = "Elastic License v2"
name = "Kubernetes Admission Webhook Created or Modified"
note = """## Triage and analysis

### Investigating Kubernetes Admission Webhook Created or Modified

Admission webhooks can mutate or validate resources before they are persisted. A malicious webhook can inject sidecars,
alter securityContext, block defensive workloads, or exfiltrate pod specs. This rule alerts on allowed changes to
MutatingWebhookConfiguration and ValidatingWebhookConfiguration objects by identities outside common system patterns.

### Possible investigation steps

- Confirm the webhook resource and operation:
  - kubernetes.audit.objectRef.resource and kubernetes.audit.verb
  - kubernetes.audit.objectRef.name (the webhook configuration name)
- Attribute the actor and access path:
  - user.name (human vs service account vs node identity)
  - source.ip and user_agent.original
  - In cloud-managed clusters, map the identity to IAM/Entra principal data present in kubernetes.audit.user.extra.*.
- Extract the webhook destination and review for external exfiltration:
  - kubernetes.audit.requestObject.webhooks.clientConfig.url (suspicious when pointing to the public internet)
  - kubernetes.audit.requestObject.webhooks.clientConfig.service.* (in-cluster service; still validate namespace/name)
- Review impact-driving webhook settings:
  - failurePolicy (e.g., Ignore can make malicious webhooks stealthier by avoiding obvious outages)
  - namespaceSelector / objectSelector targeting (e.g., excluding kube-system while targeting everything else)
  - rules.operations and rules.resources (e.g., CREATE pods is consistent with broad sidecar injection)
  - sideEffects, timeoutSeconds, matchPolicy, reinvocationPolicy
- Scope blast radius and follow-on activity:
  - Hunt for pods created/updated after the webhook change that include unexpected containers, initContainers, env vars,
    volume mounts, or securityContext changes.
  - Check for concurrent RBAC changes, token creation, or secret access from the same identity and source IP.

### False positive analysis

- GitOps upgrades or controller installs can legitimately change admission webhooks. Validate the change against:
  - approved Helm/Git commits, change tickets, and expected controller namespaces
  - known controller identities (cert-manager, Gatekeeper, Kyverno, service mesh controllers)

### Response and remediation

- If unauthorized, revert or delete the webhook configuration from a known-good source (GitOps/Helm), then block the
  actor identity and rotate any credentials it used.
- If the webhook targeted pod creation, assume workload impact: identify affected namespaces/workloads, redeploy from
  trusted manifests/images, and validate that new pods are no longer being mutated.
- If an external clientConfig.url was used, treat it as potential data exfiltration and review egress/DNS logs for the
  destination around the alert window.
"""
risk_score = 47
rule_id = "4f8f7c08-ffb5-443f-86c6-0884c964df7b"
severity = "medium"
tags = [
  "Data Source: Kubernetes",
  "Domain: Kubernetes",
  "Use Case: Threat Detection",
  "Tactic: Persistence",
  "Tactic: Defense Evasion",
  "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"
query = '''
kubernetes.audit.objectRef.resource:("mutatingwebhookconfigurations" or "validatingwebhookconfigurations") and
kubernetes.audit.verb:("create" or "update" or "patch" or "delete") and
kubernetes.audit.annotations.authorization_k8s_io/decision:"allow" and 
user.name:(* and not 
  (system\:kube-controller-manager or
  system\:kube-scheduler or
  system\:serviceaccount\:kube-system\:* or
  eks\:* or aksService or masterclient or nodeclient or
  system\:serviceaccount\:gke-managed-system\:* or
  system\:serviceaccount\:cert-manager\:* or
  system\:serviceaccount\:gatekeeper-system\:* or
  system\:serviceaccount\:kyverno\:* or
  system\:serviceaccount\:*\:*-operator)
) and
kubernetes.audit.objectRef.name:(* and not (pod-identity-webhook or vpc-resource-mutating-webhook or eks-* or gke-*)) and 
not (kubernetes.audit.user.groups:"system:serviceaccounts:flux-system" and kubernetes.audit.objectRef.name:"k8tz")
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1546"
name = "Event Triggered Execution"
reference = "https://attack.mitre.org/techniques/T1546/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[metadata]
creation_date = "2022/07/11"
integration = ["kubernetes"]
maturity = "production"
updated_date = "2026/04/10"

[rule]
author = ["Elastic"]
description = """
This rule detects when a pod is created with a sensitive volume of type hostPath. A hostPath volume type mounts a
sensitive file or folder from the node to the container. If the container gets compromised, the attacker can use this
mount for gaining access to the node. There are many ways a container with unrestricted access to the host filesystem
can escalate privileges, including reading data from other containers, and accessing tokens of more privileged pods.
"""
false_positives = [
    """
    An administrator may need to attach a hostPath volume for a legitimate reason. This alert should be investigated for
    legitimacy by determining if the kuberenetes.audit.requestObject.spec.volumes.hostPath.path triggered is one needed
    by its target container/pod. For example, when the fleet managed elastic agent is deployed as a daemonset it creates
    several hostPath volume mounts, some of which are sensitive host directories like /proc, /etc/kubernetes, and
    /var/log. Add exceptions for trusted container images using the query field
    "kubernetes.audit.requestObject.spec.container.image"
    """,
]
index = ["logs-kubernetes.audit_logs-*"]
language = "kuery"
license = "Elastic License v2"
name = "Kubernetes Pod Created with a Sensitive hostPath Volume"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Kubernetes Pod Created with a Sensitive hostPath Volume

Kubernetes allows containers to access host filesystems via hostPath volumes, which can be crucial for certain applications. However, if a container is compromised, adversaries can exploit these mounts to access sensitive host data or escalate privileges. The detection rule identifies when pods are created or modified with hostPath volumes pointing to critical directories, signaling potential misuse or security risks.

### Possible investigation steps

- Review the Kubernetes audit logs to identify the specific pod creation or modification event that triggered the alert, focusing on the event.dataset field with the value "kubernetes.audit_logs".
- Examine the kubernetes.audit.requestObject.spec.volumes.hostPath.path field to determine which sensitive hostPath was mounted and assess the potential risk associated with that specific path.
- Check the kubernetes.audit.annotations.authorization_k8s_io/decision field to confirm that the action was allowed, and verify the legitimacy of the authorization decision.
- Investigate the kubernetes.audit.requestObject.spec.containers.image field to identify the container image used, ensuring it is not a known or suspected malicious image, and cross-reference with any known vulnerabilities or security advisories.
- Analyze the context of the pod creation or modification by reviewing the kubernetes.audit.verb field to understand whether the action was a create, update, or patch operation, and correlate this with recent changes or deployments in the environment.
- Assess the potential impact on the cluster by identifying other pods or services that might be affected by the compromised pod, especially those with elevated privileges or access to sensitive data.

### False positive analysis

- Development environments often use hostPath volumes for testing purposes, which can trigger this rule. To manage this, create exceptions for specific namespaces or labels associated with development workloads.
- Monitoring tools or agents may require access to certain host paths for legitimate reasons. Identify these tools and exclude their specific container images from the rule, similar to the exclusion of the elastic-agent image.
- Backup or logging applications might need access to host directories to perform their functions. Review these applications and consider excluding their specific hostPath configurations if they are deemed non-threatening.
- Some system maintenance tasks might temporarily use hostPath volumes. Document these tasks and schedule them during known maintenance windows, then create temporary exceptions during these periods.
- Custom scripts or automation tools that interact with Kubernetes may inadvertently trigger this rule. Audit these scripts and tools, and if they are safe, exclude their specific actions or paths from the rule.

### Response and remediation

- Immediately isolate the affected pod to prevent further access to sensitive host data. This can be done by cordoning the node or deleting the pod if necessary.
- Review and revoke any credentials or tokens that may have been exposed through the compromised pod to prevent unauthorized access to other resources.
- Conduct a thorough analysis of the container image and application code to identify any vulnerabilities or malicious code that may have led to the compromise.
- Patch or update the container image and application code to address any identified vulnerabilities, and redeploy the application with the updated image.
- Implement network policies to restrict pod-to-pod and pod-to-node communication, limiting the potential impact of a compromised pod.
- Enhance monitoring and logging for Kubernetes audit logs to ensure timely detection of similar threats in the future, focusing on unauthorized access attempts and privilege escalation activities.
- Escalate the incident to the security operations team for further investigation and to assess the need for additional security measures or incident response actions.

## Setup

The Kubernetes Fleet integration with Audit Logs enabled or similarly structured data is required to be compatible with this rule."""
references = [
    "https://blog.appsecco.com/kubernetes-namespace-breakout-using-insecure-host-path-volume-part-1-b382f2a6e216",
    "https://kubernetes.io/docs/concepts/storage/volumes/#hostpath",
]
risk_score = 47
rule_id = "2abda169-416b-4bb3-9a6b-f8d239fd78ba"
severity = "medium"
tags = [
    "Data Source: Kubernetes",
    "Domain: Kubernetes",
    "Use Case: Threat Detection",
    "Tactic: Execution",
    "Tactic: Privilege Escalation",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"
query = '''
data_stream.dataset : "kubernetes.audit_logs" and kubernetes.audit.annotations.authorization_k8s_io/decision:"allow" and
kubernetes.audit.objectRef.resource:"pods" and kubernetes.audit.verb:("create" or "update" or "patch") and
kubernetes.audit.requestObject.spec.volumes.hostPath.path: (
  "/" or "/proc" or "/root" or "/var" or "/var/run" or "/var/run/docker.sock" or "/var/run/crio/crio.sock" or
  "/var/run/cri-dockerd.sock" or "/var/lib/kubelet" or "/var/lib/kubelet/pki" or "/var/lib/docker/overlay2" or
  "/etc" or "/etc/kubernetes" or "/etc/kubernetes/manifests" or "/etc/kubernetes/pki" or "/home/admin"
) and
not kubernetes.audit.requestObject.spec.containers.image: (
  docker.elastic.co/beats/elastic-agent* or *elastic/elastic-agent* or docker.elastic.co/elastic-agent/elastic-agent* or
  *elastic-agent\:dev* or *cloudops-azure-devops-agent* or rancher/mirrored-longhornio-longhorn-instance-manager* or
  quay.io/calico* or ghcr.io/aquasecurity* or rancher/system-agent* or rancher/mirrored-longhornio-csi-node-driver-registrar* or
  rancher/mirrored-longhornio-livenessprobe* or quay.io/prometheus/node-exporter* or *eks/observability/cloudwatch-agent* or
  amazon/aws-efs-csi-driver* or public.ecr.aws/eks-distro/kubernetes-csi* or quay.io/cilium/cilium* or openebs/node-disk-manager* or
  openebs/cstor-csi-driver* or registry.k8s.io/sig-storage/csi-node-driver-registrar* or *.amazonaws.com/eks/csi-node-driver-registrar* or
  *.amazonaws.com/eks/livenessprobe* or *.amazonaws.com/eks/aws-efs-csi-driver* or mcr.microsoft.com/oss/v2/kubernetes-csi* or
  rancher/mirrored-cilium-cilium* or jenkins/inbound-agent* or gcr.io/datadoghq/agent* or rancher/mirrored-longhornio-longhorn-share-manager* or
  */sysdig/*
)
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1611"
name = "Escape to Host"
reference = "https://attack.mitre.org/techniques/T1611/"

[rule.threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1610"
name = "Deploy Container"
reference = "https://attack.mitre.org/techniques/T1610/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[rule]
description = """
This rule monitors for the loading of kernel modules by unusual parent processes. Loadable kernel modules (LKMs) are
pieces of code that can be loaded into the kernel at runtime to extend its functionality. These are commonly abused by
rootkits or other malicious software to hide their presence or to gain elevated privileges. These LKMs are commonly
loaded through expected parent processes.
"""
id = "7365ad8d-5aad-4720-a262-16367be025c0"
license = "Elastic License v2"
name = "Loadable Kernel Module Loaded via Unusual Parent"
os_list = ["linux"]
reference = ["https://www.elastic.co/security-labs/continuation-on-persistence-mechanisms"]
version = "1.0.10"

query = '''
process where event.type == "start" and event.action == "load_module" and (
  process.parent.executable like (
    "/tmp/*", "/var/tmp/*", "/dev/shm/*", "./*", "/run/*", "/var/run/*", "/boot/*", "/sys/*", "/lost+found/*",
    "/proc/*", "/var/mail/*", "/var/www/*", "/home/*", "/root/*" 
  ) or
  process.parent.name like~ (
    // Hidden processes
    ".*",
    // Suspicious file formats
    "*.elf", "*.sh", "*.py", "*.rb", "*.pl", "*.lua*", "*.php*", "*.js",
    // Scheduled tasks
    "cron", "crond"
  ) or
  (
    process.parent.name like ("python*", "perl*", "ruby*", "lua*", "php*", "node", "java") and
    not (
      (
        process.executable == "/usr/bin/kmod" and
        process.args in ("/sbin/modprobe", "modprobe", "/usr/bin/modprobe", "/usr/sbin/modprobe") and
        process.args_count <= 2
      ) or
      process.executable == "/sbin/iscsiadm"
    )
  )
) and
not (
  process.parent.command_line in (
    "/usr/bin/python3 -m kcarectl.__main__ --smart-update",
    "/usr/bin/python3 -m kcarectl.__main__ -q --auto-update",
    "/usr/bin/perl /usr/sbin/csf -r",
    "pvestatd",
    "/usr/bin/python3 -sP /usr/bin/firewalld --nofork --nopid",
    "/usr/bin/python3 -s /usr/sbin/firewalld --nofork --nopid",
    "/usr/bin/python3 -sP /usr/sbin/firewalld --nofork --nopid",
    "/usr/bin/python3 -m kcarectl.__main__ --unload",
    "python2 /usr/bin/kcarectl -q --auto-update"
  ) or
  process.parent.args in ("/usr/share/ksplice/ksplice-apply", "/usr/bin/waydroid", "/usr/sbin/blksnap-loader") or
  process.parent.args like "/home/*/.ansible/tmp/ansible-tmp-*/AnsiballZ_command.py" or
  process.args == "ip6_tables" or
  (process.name == "systemd" and process.parent.name == "runc" and process.parent.command_line == "runc init") or
  (
    process.parent.executable like "/usr/bin/python*" and
    process.command_line in ("/usr/sbin/modprobe br_netfilter", "/usr/sbin/modprobe overlay")
  ) or
  process.parent.executable like (
    "/run/containerd/io.containerd.runtime.v2.task/k8s.io/*", "./runc", "/opt/puppetlabs/puppet/bin/ruby",
    "/home/*/work/check-hardware/coco-detect/target/debug/coco-detect"
  )
)
'''

min_endpoint_version = "9.1.4"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1547"
name = "Boot or Logon Autostart Execution"
reference = "https://attack.mitre.org/techniques/T1547/"
[[threat.technique.subtechnique]]
id = "T1547.006"
name = "Kernel Modules and Extensions"
reference = "https://attack.mitre.org/techniques/T1547/006/"



[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1014"
name = "Rootkit"
reference = "https://attack.mitre.org/techniques/T1014/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "9.1.4"

[rule]
description = """
Identifies the execution of the find command with a multi-value search pattern to collect sensitive information. This is
a common technique used by attackers to collect sensitive information from the system.
"""
id = "18405ccf-5443-4577-8b25-629aac642002"
license = "Elastic License v2"
name = "Multi-Value Secret Searching via Find"
os_list = ["linux"]
reference = [
    "https://socket.dev/blog/10-npm-typosquatted-packages-deploy-credential-harvester",
    "https://futuresearch.ai/blog/litellm-pypi-supply-chain-attack/",
    "https://www.virustotal.com/gui/file/71e35aef03099cd1f2d6446734273025a163597de93912df321ef118bf135238",
]
version = "1.0.2"

query = '''
sequence by process.parent.entity_id with maxspan=10s
  [process where event.type == "start" and event.action == "exec" and process.name == "find" and 
  process.args == "-type" and process.args == "f" and process.command_line like~ (
    "*password*", "*passwd*", "*pwd*", "*secret*", "*token*", "*apikey*", "*api.key*", "*access_key*",
    "*private_key*", "*client_secret*", "*credential*", "*auth*", "*bearer*",
    "*begin private*", "*begin openssh private*", "*begin rsa private*", "*begin dsa private*", "*begin ec private*",
    "*id_rsa*", "*id_dsa*", "*id_ecdsa*", "*id_ed25519*", "*ssh-rsa*", "*ghp_*", "*github_pat*", "*xoxb-*",
    "*hooks.slack.com*", "*discord.com/api/webhooks*", "*/.aws/*", "*/.env *", "*/.azure/*",
    "*azure_client_id*", "*azure_tenant_id*", "*azure_client_secret*", "*azure_federated_token_file*",
    "*identity_endpoint*", "*identity_header*", "*msi_endpoint*", "*msi_secret*", "*/var/run/secrets/azure/*",
    "*/.config/gcloud/*", "*application_default_credentials.json*", "*type: service_account*", "*client_email*",
    "*/var/run/secrets/google/*", "*google_application_credentials*", "*/run/secrets/kubernetes.io/serviceaccount/*"
  ) and process.parent.executable != null and
  not (
    (process.args == "-L" and process.args == "-xdev") or
    process.parent.args like (
      "/etc/cron.daily/plesk-rrd-cleaner", "/war-deployment/ops.servers/backup.sh", "/home/*/tools/unyo/mulpay_deletelog.sh",
      "/usr/local/psa/admin/sbin/spamtrain", "plz-out/bin/pipeline/authn/authn.bin.sh", "/usr/bin/makepkg"
    ) or
    process.command_line in (
      "find /etc/zerum-stacks/lynx/wdr_proxy/.htpasswd -type f",
      "find /run/credentials/getty@tty4.service -xdev -type f ( -perm -0002 -a ! -perm -1000 )",
      "find /run/credentials/getty@tty3.service -xdev -type f ( -perm -0002 -a ! -perm -1000 )",
      "find /run/snapd/ns/authd-msentraid.mnt -xdev -type f -perm -002 -exec chmod o-w {} ;"
    ) or
    process.command_line like "find /var/tmp/portage/*" or
    process.parent.executable in ("/usr/bin/make", "/usr/bin/sw-engine", "/usr/local/bin/build_rpm", "/opt/puppetlabs/puppet/bin/ruby") or
    process.working_directory like (
      "/opt/rapid7/ir_agent/components/endpoint_broker/common", "/__w/Modular-Teepee/Modular-Teepee",
      "/build*", "/opt/netconfs/home/*", "/tmp/plz_sandbox"
    ) or
    process.args like (
      "/run/credentials/systemd-*.service", "/var/lib/sannav/docker/containers/*/mounts/secrets", "/snap/authd-msentraid/*",
      "/home/*/.cache/yay/1password/pkg/1password/*", "/var/tmp/dracut.*/initramfs"
    ) or
    (process.parent.name == "bash" and process.parent.command_line like "*XDG_CONFIG_HOME*" and process.working_directory == "/tmp/plz_sandbox") or
    (
      process.parent.executable == "/usr/bin/xargs" and
      process.parent.command_line == "xargs -I {} find {} -xdev -type f ( -perm -0002 -a ! -perm -1000 )"
    )
  )] as event0
  [process where event.type == "start" and event.action == "exec" and process.name == "find" and 
  not startswith~(process.command_line, event0.process.command_line) and
  process.args == "-type" and process.args == "f" and process.command_line like~ (
    "*password*", "*passwd*", "*pwd*", "*secret*", "*token*", "*apikey*", "*api.key*", "*access_key*",
    "*private_key*", "*client_secret*", "*credential*", "*auth*", "*bearer*",
    "*begin private*", "*begin openssh private*", "*begin rsa private*", "*begin dsa private*", "*begin ec private*",
    "*id_rsa*", "*id_dsa*", "*id_ecdsa*", "*id_ed25519*", "*ssh-rsa*", "*ghp_*", "*github_pat*", "*xoxb-*",
    "*hooks.slack.com*", "*discord.com/api/webhooks*", "*/.aws/*", "*/.env *", "*/.azure/*",
    "*azure_client_id*", "*azure_tenant_id*", "*azure_client_secret*", "*azure_federated_token_file*",
    "*identity_endpoint*", "*identity_header*", "*msi_endpoint*", "*msi_secret*", "*/var/run/secrets/azure/*",
    "*/.config/gcloud/*", "*application_default_credentials.json*", "*type: service_account*", "*client_email*",
    "*/var/run/secrets/google/*", "*google_application_credentials*", "*/run/secrets/kubernetes.io/serviceaccount/*"
  )] as event1
  [process where event.type == "start" and event.action == "exec" and process.name == "find" and
  not startswith~(process.command_line, event1.process.command_line) and
  process.args == "-type" and process.args == "f" and process.command_line like~ (
    "*password*", "*passwd*", "*pwd*", "*secret*", "*token*", "*apikey*", "*api.key*", "*access_key*",
    "*private_key*", "*client_secret*", "*credential*", "*auth*", "*bearer*",
    "*begin private*", "*begin openssh private*", "*begin rsa private*", "*begin dsa private*", "*begin ec private*",
    "*id_rsa*", "*id_dsa*", "*id_ecdsa*", "*id_ed25519*", "*ssh-rsa*", "*ghp_*", "*github_pat*", "*xoxb-*",
    "*hooks.slack.com*", "*discord.com/api/webhooks*", "*/.aws/*", "*/.env *", "*/.azure/*",
    "*azure_client_id*", "*azure_tenant_id*", "*azure_client_secret*", "*azure_federated_token_file*",
    "*identity_endpoint*", "*identity_header*", "*msi_endpoint*", "*msi_secret*", "*/var/run/secrets/azure/*",
    "*/.config/gcloud/*", "*application_default_credentials.json*", "*type: service_account*", "*client_email*",
    "*/var/run/secrets/google/*", "*google_application_credentials*", "*/run/secrets/kubernetes.io/serviceaccount/*"
  )]
'''

min_endpoint_version = "8.4.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 2

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 1

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 2

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1082"
name = "System Information Discovery"
reference = "https://attack.mitre.org/techniques/T1082/"

[[threat.technique]]
id = "T1083"
name = "File and Directory Discovery"
reference = "https://attack.mitre.org/techniques/T1083/"


[threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1074"
name = "Data Staged"
reference = "https://attack.mitre.org/techniques/T1074/"
[[threat.technique.subtechnique]]
id = "T1074.001"
name = "Local Data Staging"
reference = "https://attack.mitre.org/techniques/T1074/001/"


[[threat.technique]]
id = "T1119"
name = "Automated Collection"
reference = "https://attack.mitre.org/techniques/T1119/"


[threat.tactic]
id = "TA0009"
name = "Collection"
reference = "https://attack.mitre.org/tactics/TA0009/"

[internal]
min_endpoint_version = "8.4.0"