Elastic rules: 2x

[metadata]
creation_date = "2026/05/20"
integration = ["azure"]
maturity = "production"
updated_date = "2026/07/08"

[rule]
author = ["Elastic"]
description = """
Identifies Azure AD Graph (graph.windows.net) requests originating from user-agent strings associated with offensive
tooling, scripting libraries, or generic HTTP clients. First-party Microsoft components calling AAD Graph identify with
specific user agents such as "Microsoft Azure Graph Client Library", "Microsoft ADO.NET Data Services", or
"Microsoft.OData.Client". Anything outside that recognised set is either a developer prototyping against the legacy API
or an enumeration tool walking the directory.
"""
false_positives = [
    """
    Developer activity prototyping against AAD Graph from a workstation may match. Validate via the calling
    `azure.aadgraphactivitylogs.properties.app_id` and the signed-in user; legitimate developer use is rare in
    production tenants since Microsoft has been steering callers off AAD Graph for years.
    """,
    """
    Authorized red team or penetration test activity using ROADrecon, ROADtools, AADInternalsor similar tooling can match. Add
    exceptions on the source IP, signed-in user, or app ID after validation.
    """,

]
from = "now-10m"
interval = "9m"
language = "esql"
license = "Elastic License v2"
name = "Azure AD Graph Access with Suspicious User-Agent"
note = """## Triage and analysis

### Investigating Azure AD Graph Access with Suspicious User-Agent

Azure AD Graph (graph.windows.net) is the legacy directory REST API that Microsoft has been retiring for years.
Legitimate first-party traffic against it is dominated by a small set of recognisable user agents (`Microsoft.OData.Client`,
`Microsoft Azure Graph Client Library`, `Microsoft ADO.NET Data Services`, the Azure portal with a Chrome user agent,
and an empty-UA tail from first-party AppIds). Traffic identifying as Python, aiohttp, curl, Go-http-client, or any
of the `*hound` enumeration families is almost always either a developer prototype or adversary tooling. This rule
flags any such request even at a single event, because tooling samples for AAD Graph are inherently low-volume in
normal tenants.

### Possible investigation steps

- Confirm the matching user agent.
    - `user_agent.original` (e.g., `aiohttp`, `AADInternals`, `curl`, `bav2ropc`).
- Identify the caller and the calling client.
    - `user.id` for the caller, `azure.aadgraphactivitylogs.properties.app_id` for the OAuth client.
- Review which directory object types were touched.
    - `url.path` (e.g., `/users`, `/policies`, `/servicePrincipals`).
- Check the success / failure pattern.
    - `http.response.status_code`. Many 4xx responses suggest permission probing.
- Cross-reference with the API version.
    - `azure.aadgraphactivitylogs.properties.api_version`. A non-Microsoft UA combined with `1.6-internal` or `1.61-internal` is a stronger signal of offensive tooling.
- Pivot to sign-in logs (`logs-azure.signinlogs-*`) for the same user / source IP to understand how the token was obtained.
- Confirm the activity is not attributable to authorized testing (red team engagement, penetration test, internal tooling validation) before treating as malicious.

### Response and remediation

- Revoke refresh tokens and active sessions for the calling user.
    - `POST /v1.0/users/{id}/revokeSignInSessions`.
- Temporarily disable the user if the alert is high-confidence or you need to halt further activity while investigation continues.
    - `PATCH /v1.0/users/{id}` with body `{"accountEnabled": false}`.
- Check for device registrations created by the user during or around the burst window and remove rogue devices.
    - `GET /v1.0/users/{id}/registeredDevices` and `GET /v1.0/users/{id}/ownedDevices`, then `DELETE /v1.0/devices/{deviceObjectId}`.
    - Do this BEFORE session revocation: device-bound PRTs survive `revokeSignInSessions`.
- If the calling application has no legitimate AAD Graph dependency, block further use by that app.
    - `PATCH /beta/applications/{id}` with body `{"authenticationBehaviors": {"blockAzureADGraphAccess": true}}`.
    - This property lives on the Graph beta endpoint, not v1.0.
- Apply Conditional Access targeting the AAD Graph audience for the affected user population.
"""
references = [
    "https://learn.microsoft.com/en-us/graph/migrate-azure-ad-graph-overview",
    "https://github.com/dirkjanm/ROADtools",
    "https://www.sophos.com/en-us/research/tampering-with-conditional-access-policies-using-azure-ad-graph-api",
    "https://github.com/gerenios/aadinternals",
]
risk_score = 73
rule_id = "3aec394d-ed2a-4f3e-8ed3-4a2adea39f05"
setup = """#### Azure AD Graph Activity Logs
Requires Azure AD Graph Activity Logs ingested into `logs-azure.aadgraphactivitylogs-*` via the Elastic Azure
integration (Azure Event Hub). Enable the `AzureADGraphActivityLogs` diagnostic-settings category on Entra ID.
"""
severity = "high"
tags = [
    "Domain: Cloud",
    "Data Source: Azure",
    "Data Source: Azure AD Graph",
    "Data Source: Azure AD Graph Activity Logs",
    "Use Case: Threat Detection",
    "Tactic: Discovery",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "esql"

query = '''
from logs-azure.aadgraphactivitylogs-* metadata _id, _version, _index

| where data_stream.dataset == "azure.aadgraphactivitylogs"
    and azure.aadgraphactivitylogs.properties.actor_type == "User"
    and user_agent.original is not null
| eval Esql.ua_lower = to_lower(user_agent.original)
| where Esql.ua_lower like "*fasthttp*"
    or Esql.ua_lower like "*aiohttp*"
    or Esql.ua_lower like "*hound*"
    or Esql.ua_lower like "*aadinternals*"
    or Esql.ua_lower like "*go-http-client*"
    or Esql.ua_lower like "python*"
    or Esql.ua_lower like "*curl/*"
    or Esql.ua_lower like "*okhttp*"
    or Esql.ua_lower like "*axios*"
    or Esql.ua_lower like "*node-fetch*"
    or Esql.ua_lower like "*go-resty*"
    or Esql.ua_lower like "*bav2ropc*"
    or Esql.ua_lower like "*undici*"
| keep
    _id,
    _version,
    _index,
    @timestamp,
    user.id,
    source.ip,
    source.as.organization.name,
    user_agent.original,
    azure.aadgraphactivitylogs.properties.app_id,
    azure.aadgraphactivitylogs.properties.api_version,
    url.path,
    http.response.status_code,
    azure.tenant_id,
    Esql.ua_lower
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1069"
name = "Permission Groups Discovery"
reference = "https://attack.mitre.org/techniques/T1069/"
[[rule.threat.technique.subtechnique]]
id = "T1069.003"
name = "Cloud Groups"
reference = "https://attack.mitre.org/techniques/T1069/003/"


[[rule.threat.technique]]
id = "T1087"
name = "Account Discovery"
reference = "https://attack.mitre.org/techniques/T1087/"
[[rule.threat.technique.subtechnique]]
id = "T1087.004"
name = "Cloud Account"
reference = "https://attack.mitre.org/techniques/T1087/004/"


[[rule.threat.technique]]
id = "T1526"
name = "Cloud Service Discovery"
reference = "https://attack.mitre.org/techniques/T1526/"


[rule.threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"

[rule.investigation_fields]
field_names = [
    "user.id",
    "source.ip",
    "source.as.organization.name",
    "user_agent.original",
    "azure.aadgraphactivitylogs.properties.app_id",
    "azure.aadgraphactivitylogs.properties.api_version",
    "url.path",
    "http.response.status_code",
    "azure.tenant_id",
]

[rule]
description = """
Identifies binaries that have been identically named to Windows built-in programs and being run from untrusted or
commonly abused paths. Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate
or benign.
"""
id = "35dedf0c-8db6-4d70-b2dc-a133b808211f"
license = "Elastic License v2"
name = "Binary Masquerading via Untrusted Path"
os_list = ["windows"]
reference = [
    "https://www.elastic.co/security-labs/invisible-miners-unveiling-ghostengine",
    "https://www.elastic.co/security-labs/siestagraph-new-implant-uncovered-in-asean-member-foreign-ministry",
]
version = "1.0.56"

query = '''
process where event.action == "start" and
  (
   process.name : (
    "at.exe",
    "atbroker.exe",
    "bcdedit.exe",
    "cmstp.exe",
    "conhost.exe",
    "control.exe",
    "cscript.exe",
    "csrss.exe",
    "dsget.exe",
    "dfsvc.exe",
    "dllhost.exe",
    "eventvwr.exe",
    "ieexec.exe",
    "ipconfig.exe",
    "lsass.exe",
    "Microsoft.Workflow.Compiler.exe",
    "mmc.exe",
    "msdt.exe",
    "mshta.exe",
    "msiexec.exe",
    "net1.exe",
    "netsh.exe",
    "netstat.exe",
    "odbcconf.exe",
    "ping.exe",
    "powershell.exe",
    "qprocess.exe",
    "quser.exe",
    "qwinsta.exe",
    "regsvcs.exe",
    "rundll32.exe",
    "schtasks.exe",
    "sdclt.exe",
    "services.exe",
    "spoolsv.exe",
    "svchost.exe",
    "taskhost.exe",
    "taskhostw.exe",
    "userinit.exe",
    "vaultcmd.exe",
    "vssadmin.exe",
    "wininit.exe",
    "winlogon.exe",
    "wmic.exe",
    "wevtutil.exe",
    "wscript.exe",
    "gprslt.exe",
    "nbtstat.exe",
    "systeminfo.exe",
    "VsJITDebugger.exe",
    "extexport.exe",
    "extexport.exe", 
    "fltmc.exe", 
    "stordiag.exe", 
    "manage-bde.exe") or
    (process.pe.original_file_name == "bsdtar" and process.name : "tar.exe" and process.code_signature.subject_name == "Microsoft Windows") or
    (process.pe.original_file_name : "WerFaultSecure.exe" or process.name : "WerFaultSecure.exe") or
    (process.pe.original_file_name : "WerFault.exe" or process.name : "WerFault.exe") or
    (process.pe.original_file_name : "wermgr.exe" or process.name : "wermgr.exe") or
    (process.pe.original_file_name : "IE4UINIT.EXE" or process.name : "ie4uinit.exe") or
    (process.pe.original_file_name == "curl.exe" and process.code_signature.subject_name : "Microsoft *" and process.executable : "C:\\Users\\*")
    )
    and
    
  not process.executable : (
    "?:\\Windows\\System32\\*.exe",
    "?:\\Windows\\SysWOW64\\*.exe",
    "?:\\Windows\\Microsoft.NET\\*.exe",
    "?:\\Program Files (x86)\\*.exe",
    "?:\\Program Files\\*.exe",
    "?:\\Windows\\WinSxS\\*.exe",
    "C:\\$WINDOWS.~BT\\NewOS\\Windows\\WinSxS\\wow64_microsoft-windows-*\\mmc.exe",
    "C:\\Windows\\SoftwareDistribution\\Download\\*.exe",

    /* Issue # 295 */
    "?:\\Users\\*\\AppData\\Local\\Programs\\Git\\usr\\bin\\hostname.exe",
    "?:\\*\\usr\\bin\\hostname.exe",
    "?:\\ProgramData\\West Wind Technologies\\Uninstall\\*\\regsvr32.exe",
    "?:\\ProgramData\\chocolatey\\*.exe",
    "?:\\cygwin*\\bin\\*.exe",

    /* PR #685 */
    "\\Device\\HarddiskVolume*\\Windows\\System32\\*.exe",
    "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\*.exe",
    "\\Device\\HarddiskVolume*\\Windows\\Microsoft.NET\\*.exe",
    "\\Device\\HarddiskVolume*\\Program Files (x86)\\*.exe",
    "\\Device\\HarddiskVolume*\\Program Files\\*.exe",

    /* VHD */
    "\\Device\\VhdHardDisk*\\Windows\\System32\\*.exe",
    "\\Device\\VhdHardDisk*\\Windows\\SysWOW64\\*.exe",
    "\\Device\\VhdHardDisk*\\Windows\\Microsoft.NET\\*.exe",
    "\\Device\\VhdHardDisk*\\Program Files (x86)\\*.exe",
    "\\Device\\VhdHardDisk*\\Program Files\\*.exe",
    
    "\\\\?\\Volume{*}\\Windows\\System32\\*.exe", 
    "\\\\?\\Volume{*}\\Windows\\SysWOW64\\*.exe", 
    "\\\\?\\Volume{*}\\Windows\\Microsoft.NET\\*.exe",
    "\\\\?\\Volume{*}\\Program Files (x86)\\*.exe",
    "\\\\?\\Volume{*}\\Program Files\\*.exe", 
    "\\\\?\\Volume{*}\\Windows\\WinSxS\\*.exe"
    ) and

  not (process.executable : "?:\\ProgramData\\Lenovo\\ImController\\Plugins\\*.exe" and process.code_signature.subject_name : "Lenovo") and
  not (process.pe.original_file_name == "RegAsm.exe" and
       process.executable : "?:\\ProgramData\\Lenovo\\ImController\\Plugins\\LenovoBatteryGaugePackage\\*\\RegAsm.exe") and
  not (process.name : "regsvr32.exe" and process.parent.executable : ("?:\\ERPU\\Browser\\AutoUpgrade.exe", "?:\\ERPU\\Browser\\NeoWeb.exe")) and
  not (process.executable : "?:\\Campus\\System\\DLL\\CADability\\RegAsm.exe" and process.parent.executable : "?:\\Campus\\System\\DLL\\CADability\\RegCADability.exe") and
  not (process.name : "services.exe" and process.args : "-i*" and process.parent.name : "monitor.exe") and
  not (process.name : "RegAsm.exe" and process.args : ("directdeposit.vb.tlb", "?:\\Program Files (x86)\\*.dll", "?:\\Program Files\\*.dll")) and
  not process.executable : "D:\\Reform V*\\Reform_PDC_Server_v*\\Plugins\\Monitoring\\CScript.exe" and
  not (process.name : "rundll32.exe" and process.code_signature.subject_name : ("Teramind Inc.", "STAKHANOVETS LIMITED LIABILITY COMPANY") and process.code_signature.trusted == true) and
  not (process.name : "regsvr32.exe" and
       process.args : ("?:\\Sage\\Sage300 Programs\\GL69A\\FRCOM690.DLL",
                       "?:\\Program Files (x86)\\*.dll",
                       "?:\\Program Files\\*.dll",
                       "?:\\WINDOWS\\system32\\*.dll")) and
  not process.executable : ("?:\\Microsoft Visual Studio\\*\\Msbuild.exe", "?:\\adv\\app\\RegAsm.exe", "?:\\Windows\\WinSxS\\wow64_microsoft-windows*management-console_*\\mmc.exe") and
  not (process.executable : "?:\\Engeman\\RegAsm.exe" and process.parent.executable : "?:\\Engeman\\Engeman.exe") and
  not (process.name : "regsvr32.exe" and process.code_signature.subject_name == "Tarma Software Research Ltd" and process.code_signature.trusted == true) and
  not (process.parent.executable : "?:\\Gb\\GBsoftware.exe" and process.executable : "?:\\Gb\\Lib\\regsvr32.exe") and
  not (process.executable : "?:\\OfficeMate\\REGSVR32.EXE" and process.parent.args : "?:\\OfficeMate\\~Reg*DLLs.bat" and process.parent.name : "cmd.exe") and
  not (process.name : "powershell.exe" and process.executable : "?:\\Windows\\WinSxS\\amd64_microsoft-windows-powershell-exe_*\\powershell.exe") and
  not process.executable : "?:\\ProgramData\\Lenovo\\ImController\\Plugins\\LenovoBatteryGaugePackage\\x64\\RegAsm.exe" and
  not (process.name : "regasm.exe" and process.parent.executable : "?:\\Program Files (x86)\\Common Files\\InstallShield\\Driver\\*\\IDriver.exe") and
  not process.executable : "?:\\Windows\\WinSxS\\amd64_microsoft-windows-powershell-exe_*\\powershell.exe" and
  not (process.executable : ("?:\\Gb\\Lib\\regsvr32.exe", "?:\\E20-II\\ENVIRO\\regasm.exe") and
       process.parent.executable : ("?:\\Gb\\GBsoftware.exe", "?:\\E20-II\\PCN33\\CODE\\SilentPCBEngTools128.exe")) and
  not (process.parent.executable : "?:\\apps\\sage300\\Programs\\runtime\\a4wcontainerXP.exe" and process.name : "regsvr32.exe") and
  not process.executable : "\\Device\\Mup\\*" and
  not process.executable : ("?:\\*Visual*Studio\\*\\MSBuild.exe",
                            "?:\\CAMS\\Enterprise\\CAMSServices\\ServiceBroker\\RegAsm.exe",
                            "?:\\Witron\\wms\\rt\\axl\\runtime\\bin\\system\\tools\\RegAsm.exe",
                            "?:\\SpearTrayApplication\\Tray\\regsvr32.exe",
                            "?:\\ProgramData\\Lenovo\\Vantage\\Addins\\LenovoBatteryGaugeAddin\\*\\RegAsm.exe",
                            "*\\Visual Studio\\*\\Bin\\MSBuild.exe",
                            "C:\\Sage\\Sage300\\Online\\Worker\\InstallUtil.exe",
                            "C:\\AssessPro\\Programs\\RegAsm.exe", 
                            "C:\\ProgramData\\Lenovo\\Vantage\\Addins\\LenovoBatteryGaugeAddin\\*\\RegAsm.exe") and
  not (process.name : "regsvr32.exe" and process.parent.name : "rundll32.exe" and
       process.parent.command_line : "*zzzzInvokeManagedCustomActionOutOfProc*") and
  not (process.executable : "C:\\ProgramData\\baramundi\\bma\\Downloads\\Temp\\netsh.exe" and
       process.args : "exec" and process.args : "\\\\*.txt") and
  not (process.name : "bcdedit.exe" and process.args : "/enum") and
  not (process.executable : "?:\\Windows\\LFSAgent\\services.exe" and
       process.code_signature.trusted == true and
       process.code_signature.subject_name : "LEPIDE SOFTWARE PRIVATE LIMITED") and
  not (process.name : "ping.exe" and process.executable : "?:\\Windows\\Temp\\pdk-SYSTEM-*\\ping.exe") and
  not (process.code_signature.subject_name : ("JetBrains s.r.o.", "LG Electronics Inc.", "Timothy Hugh Perry", "Code Systems Corporation", "Douyin Vision Co., Ltd.", "Hangzhou Hikvision Digital Tech.Co.,Ltd") and process.code_signature.trusted == true) and
  not process.hash.sha256 :
                  ("7c621ec91b71d14494beddaae8edb67ed26baa257d750546772aa90653ad6016",
                   "195bebdefeb704158633b7f3d943e1d792fcb9b81f36530fad5b04a1622a0c58",
                   "dc84f15625f115faa757dee79b285a5af65298074827c917f0dfcacc5b308855",
                   "3f73452d3a5c39c8abc9e2b37c5e5f6ef210a4edb17ac180f425b05f320e5720",
                   "10fe2a16356afcb0f0d3ae77dc1320acdc7244a4115e3eabff6220fdd8d1347f",
                   "77e67a63a69c545a193998e3c17f6e4b15538f40aaaec3a1d4713b05ab3a4ede",
                   "87a4a3a8fb5df2e79e512f8a5043725dde70811afb39110cd8b4904dd15046f2",
                   "637c3c0e4441998130d0166e95d0449e22d82107be8daeb234126ca6392b25b7",
                   "2425e9a2b5f19483e234eb220bd4db97cecc5dbef5fd1a19940f823c7997fc26",
                   "facb69c35c1d63aeca9d9e55525660b728445acd0df1b6a23e52acf329baf94c",
                   "879f58323b0ee3313a0e43d507373a6ac9bc5b3cfbd6eac6411c252af261b60e",
                   "c7b895a4a21b597a5a7dc3c1a2d4c5e9823649688da9b57dd0c1bcea28c739ba",
                   "186546f3a23be3069550c185363034e686e87a3eccc9f5c7f3a5a92f15a0b1cb") and
  not (process.parent.code_signature.subject_name == "Data Spotlite Inc." and process.parent.code_signature.trusted == true and
       process.executable : "C:\\CYRISMA_Agent\\App\\powershell.exe") and 
  not (process.executable : "?:\\CYRISMA_Agent\\App\\powershell.exe" and process.pe.original_file_name == "PowerShell.EXE" and 
       process.command_line == ".\\App\\powershell.exe  -NonInteractive -NoProfile -ExecutionPolicy Bypass -File -")
'''

min_endpoint_version = "8.10.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1036"
name = "Masquerading"
reference = "https://attack.mitre.org/techniques/T1036/"
[[threat.technique.subtechnique]]
id = "T1036.004"
name = "Masquerade Task or Service"
reference = "https://attack.mitre.org/techniques/T1036/004/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"

[metadata]
creation_date = "2020/08/13"
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2026/05/04"

[rule]
author = ["Elastic"]
description = """
Detects the creation or modification of a new Group Policy based scheduled task or service. These methods are used for
legitimate system administration, but can also be abused by an attacker with domain admin permissions to execute a
malicious payload remotely on all or a subset of the domain joined machines.
"""
from = "now-9m"
index = [
    "winlogbeat-*",
    "logs-endpoint.events.file-*",
    "logs-windows.sysmon_operational-*",
    "endgame-*",
    "logs-m365_defender.event-*",
    "logs-sentinel_one_cloud_funnel.*",
]
language = "eql"
license = "Elastic License v2"
name = "Creation or Modification of a new GPO Scheduled Task or Service"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Creation or Modification of a new GPO Scheduled Task or Service

Group Policy Objects (GPOs) are crucial for centralized management in Windows environments, allowing administrators to configure settings across domain-joined machines. Adversaries with domain admin rights can exploit GPOs to create or modify scheduled tasks or services, deploying malicious payloads network-wide. The detection rule identifies such activities by monitoring specific file changes in GPO paths, excluding legitimate system processes, thus highlighting potential abuse for privilege escalation or persistence.

### Possible investigation steps

- Review the file path and name to confirm if the changes were made to "ScheduledTasks.xml" or "Services.xml" within the specified GPO paths, as these are indicative of potential unauthorized modifications.
- Check the process that initiated the file change, ensuring it is not "C:\\\\Windows\\\\System32\\\\dfsrs.exe", which is excluded as a legitimate system process.
- Investigate the user account associated with the file modification event to determine if it has domain admin rights and assess if the activity aligns with their typical behavior or role.
- Examine recent changes in the GPO settings to identify any new or altered scheduled tasks or services that could be used for malicious purposes.
- Correlate the event with other security logs or alerts from data sources like Elastic Endgame, Sysmon, or Microsoft Defender XDR to identify any related suspicious activities or patterns.
- Assess the impact by identifying which domain-joined machines are affected by the GPO changes and determine if any unauthorized tasks or services have been executed.

### False positive analysis

- Legitimate administrative changes to GPOs can trigger alerts. Regularly review and document scheduled administrative tasks to differentiate between expected and unexpected changes.
- Automated system management tools may modify GPO scheduled tasks or services as part of routine operations. Identify these tools and create exceptions for their processes to reduce noise.
- Updates or patches from Microsoft or other trusted vendors might alter GPO settings. Monitor update schedules and correlate changes with known update activities to verify legitimacy.
- Internal IT scripts or processes that manage GPOs for configuration consistency can cause false positives. Ensure these scripts are well-documented and consider excluding their specific actions from monitoring.
- Temporary changes made by IT staff for troubleshooting or testing purposes can be mistaken for malicious activity. Implement a change management process to log and approve such activities, allowing for easy exclusion from alerts.

### Response and remediation

- Immediately isolate affected systems from the network to prevent further spread of any malicious payloads deployed via the modified GPO scheduled tasks or services.
- Revoke domain admin privileges from any accounts that are suspected of being compromised to prevent further unauthorized modifications to GPOs.
- Conduct a thorough review of the modified ScheduledTasks.xml and Services.xml files to identify any unauthorized or malicious entries, and revert them to their previous legitimate state.
- Utilize endpoint detection and response (EDR) tools to scan for and remove any malicious payloads that may have been executed on domain-joined machines as a result of the GPO modifications.
- Notify the security operations center (SOC) and escalate the incident to the incident response team for further investigation and to determine the scope of the compromise.
- Implement additional monitoring on GPO paths and domain admin activities to detect any further unauthorized changes or suspicious behavior.
- Review and strengthen access controls and auditing policies for GPO management to prevent unauthorized modifications in the future."""
risk_score = 21
rule_id = "c0429aa8-9974-42da-bfb6-53a0a515a145"
severity = "low"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Privilege Escalation",
    "Tactic: Persistence",
    "Data Source: Elastic Endgame",
    "Data Source: Elastic Defend",
    "Data Source: Sysmon",
    "Data Source: Microsoft Defender XDR",
    "Data Source: SentinelOne",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
file where host.os.type == "windows" and event.type != "deletion" and event.action != "open" and
 file.name : ("ScheduledTasks.xml", "Services.xml") and
  file.path : (
    "?:\\Windows\\SYSVOL\\domain\\Policies\\*\\MACHINE\\Preferences\\ScheduledTasks\\ScheduledTasks.xml",
    "?:\\Windows\\SYSVOL\\domain\\Policies\\*\\MACHINE\\Preferences\\Services\\Services.xml"
  ) and
  not process.executable : "C:\\Windows\\System32\\dfsrs.exe"
'''

setup = """## Setup

This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.

Setup instructions: https://ela.st/install-elastic-defend

### Additional data sources

This rule also supports the following third-party data sources. For setup instructions, refer to the links below:

- [Microsoft Defender XDR](https://ela.st/m365-defender)
- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
- [Sysmon Event ID 11 - File Create](https://ela.st/sysmon-event-11-setup)
"""


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1484"
name = "Domain or Tenant Policy Modification"
reference = "https://attack.mitre.org/techniques/T1484/"

[[rule.threat.technique.subtechnique]]
id = "T1484.001"
name = "Group Policy Modification"
reference = "https://attack.mitre.org/techniques/T1484/001/"

[rule.threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1053"
name = "Scheduled Task/Job"
reference = "https://attack.mitre.org/techniques/T1053/"

[[rule.threat.technique.subtechnique]]
id = "T1053.005"
name = "Scheduled Task"
reference = "https://attack.mitre.org/techniques/T1053/005/"

[[rule.threat.technique]]
id = "T1543"
name = "Create or Modify System Process"
reference = "https://attack.mitre.org/techniques/T1543/"

[[rule.threat.technique.subtechnique]]
id = "T1543.003"
name = "Windows Service"
reference = "https://attack.mitre.org/techniques/T1543/003/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[rule]
description = """
Detects when Curl is executed via Osascript and reads or writes to a local file. Threat actors will often use Curl to
download or upload files to a local file path on the system. The use of Curl via Osascript elevates the suspiciousness
of the activity as osascript is a scripting language that can be used to execute AppleScript commands. The combination
of these two activities is indicative of a threat actor attempting to download or upload a file on the system.
"""
id = "9abe2b65-10a9-4d7e-908b-d841d6c4b360"
license = "Elastic License v2"
name = "Curl Local File Read or Write via Osascript"
os_list = ["macos"]
reference = ["https://x.com/MsftSecIntel/status/1891410993265123662"]
version = "1.0.3"

query = '''
process where event.type == "start" and event.action == "exec" and process.name in ("curl", "nscurl") and 
 process.command_line : "*file://*" and process.parent.name == "osascript"
'''

min_endpoint_version = "8.16.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1105"
name = "Ingress Tool Transfer"
reference = "https://attack.mitre.org/techniques/T1105/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "8.16.0"

[metadata]
creation_date = "2020/08/20"
integration = ["azure"]
maturity = "production"
updated_date = "2026/04/10"

[rule]
author = ["Elastic"]
description = """
Identifies when multi-factor authentication (MFA) is disabled for an Entra ID user account. An adversary may disable MFA
for a user account in order to weaken the authentication requirements for the account.
"""
from = "now-9m"
index = ["logs-azure.auditlogs-*"]
language = "kuery"
license = "Elastic License v2"
name = "Entra ID MFA Disabled for User"
note = """## Triage and analysis

### Investigating Entra ID MFA Disabled for User

Multi-factor authentication is a process in which users are prompted during the sign-in process for an additional form of identification, such as a code on their cellphone or a fingerprint scan.

If you only use a password to authenticate a user, it leaves an insecure vector for attack. If the password is weak or has been exposed elsewhere, an attacker could be using it to gain access. When you require a second form of authentication, security is increased because this additional factor isn't something that's easy for an attacker to obtain or duplicate.

For more information about using MFA in Microsoft Entra ID, access the [official documentation](https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks#how-to-enable-and-use-azure-ad-multi-factor-authentication).

This rule identifies the deactivation of MFA for an Entra ID user account. This modification weakens account security and can lead to the compromise of accounts and other assets.

#### Possible investigation steps

- Identify the user account that performed the action and whether it should perform this kind of action.
- Investigate other alerts associated with the user account during the past 48 hours.
- Contact the account and resource owners and confirm whether they are aware of this activity.
- Correlate with Entra ID Sign-In Logs to identify anomalous sign-in attempts following MFA disablement.
- This rule does not identify if the user was removed from a conditional access policy (CAP) with MFA requirements.
    - Instead the rule identifies both legacy and modern MFA disablement through user settings.
- Check if this operation was approved and performed according to the organization's change management policy.
- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.

### False positive analysis

- While this activity can be done by administrators, all users must use MFA. The security team should address any potential benign true positive (B-TP), as this configuration can risk the user and domain.

### Response and remediation

- Initiate the incident response process based on the outcome of the triage.
- Disable or limit the account during the investigation and response.
- Identify the possible impact of the incident and prioritize accordingly; the following actions can help you gain context:
    - Identify the account role in the cloud environment.
    - Assess the criticality of affected services and servers.
    - Work with your IT team to identify and minimize the impact on users.
    - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
    - Identify any regulatory or legal ramifications related to this activity.
- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
- Reactivate multi-factor authentication for the user.
- Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
- Implement security defaults [provided by Microsoft](https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/concept-fundamentals-security-defaults).
- Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
"""
risk_score = 47
rule_id = "dafa3235-76dc-40e2-9f71-1773b96d24cf"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Domain: Identity",
    "Data Source: Azure",
    "Data Source: Microsoft Entra ID",
    "Data Source: Microsoft Entra ID Audit Logs",
    "Use Case: Identity and Access Audit",
    "Resources: Investigation Guide",
    "Tactic: Persistence",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset: "azure.auditlogs" and
    (azure.auditlogs.operation_name: "Disable Strong Authentication" or
    (
        azure.auditlogs.operation_name: "User deleted security info" and
        azure.auditlogs.properties.additional_details.key: "AuthenticationMethod"
    )) and event.outcome: (Success or success)
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1556"
name = "Modify Authentication Process"
reference = "https://attack.mitre.org/techniques/T1556/"

[[rule.threat.technique.subtechnique]]
id = "T1556.006"
name = "Multi-Factor Authentication"
reference = "https://attack.mitre.org/techniques/T1556/006/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1556"
name = "Modify Authentication Process"
reference = "https://attack.mitre.org/techniques/T1556/"

[[rule.threat.technique.subtechnique]]
id = "T1556.006"
name = "Multi-Factor Authentication"
reference = "https://attack.mitre.org/techniques/T1556/006/"

[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1556"
name = "Modify Authentication Process"
reference = "https://attack.mitre.org/techniques/T1556/"

[[rule.threat.technique.subtechnique]]
id = "T1556.006"
name = "Multi-Factor Authentication"
reference = "https://attack.mitre.org/techniques/T1556/006/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[metadata]
creation_date = "2025/01/15"
integration = ["aws"]
maturity = "production"
updated_date = "2026/07/14"

[rule]
author = ["Elastic"]
description = """
Identifies a high-volume of AWS S3 objects stored in a bucket using using Server-Side Encryption with Customer-Provided Keys (SSE-C). Adversaries with compromised AWS credentials can encrypt objects in an S3 bucket using their own encryption keys, rendering the objects unreadable or recoverable without the key. This can be used as a form of ransomware to extort the bucket owner for the decryption key. This is a Threshold rule that triggers when this behavior is observed multiple times for a specific bucket in a short time-window.
"""
false_positives = [
    """
    Legitimate use of Server-Side Encryption with Customer-Provided Keys (SSE-C) to encrypt objects in an S3 bucket.
    """,
]
from = "now-6m"
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
language = "kuery"
license = "Elastic License v2"
name = "Excessive AWS S3 Object Encryption with SSE-C"
note = """## Triage and analysis

### Investigating Excessive AWS S3 Object Encryption with SSE-C
This rule identifies a high volume of objects being encrypted using Server-Side Encryption with Customer-Provided Keys (SSE-C) in AWS S3. This could indicate malicious activity, such as ransomware encrypting objects, rendering them inaccessible without the corresponding encryption keys.

### Possible investigation steps

**Identify the user and source**:
   - Review the `aws.cloudtrail.user_identity.arn` to identify the IAM user or role performing the operation.
   - Cross-check the `source.ip` and `user_agent.original` fields for unusual IPs or user agents that could indicate unauthorized access.
   - Review the `aws.cloudtrail.user_identity.access_key_id` to identify the access key used. This could be a compromised key.

**Examine the targeted resources**:
   - Check `aws.cloudtrail.request_parameters` to identify the bucket involved.
   - Analyze the object key from `aws.cloudtrail.request_parameters`.

**Evaluate encryption behavior**:
   - Confirm the encryption details in `aws.cloudtrail.request_parameters` and `aws.cloudtrail.additional_eventdata`.
   - Note if `SSEApplied` is `SSE-C`, which confirms encryption using a customer-provided key.

**Correlate with recent events**:
   - Look for any suspicious activity in proximity to the encryption event, such as new access key creation, policy changes, or unusual access patterns from the same user or IP.
   - Identify `ListBucket` or `GetObject` operations on the same bucket to determine all affected objects.
   - For `PutObject` events, identify any other unusual objects uploaded such as a ransom note.
   - For `CopyObject` events, the adversary may be performing in-place re-encryption by copying objects to themselves using SSE-C keys they control, rendering the originals unrecoverable without the key.

**Validate access permissions**:
   - Check the IAM policies and roles associated with the user to verify if they had legitimate access to encrypt objects.

**Assess impact**:
   - Identify the number of encrypted objects in the bucket by examining other similar events.
   - Determine if this encryption aligns with standard business practices or constitutes a deviation.

### False positive analysis

- Confirm if SSE-C encryption is part of regular operations for compliance or data protection.
- Cross-reference known processes or users authorized for SSE-C encryption in the affected bucket.

### Response and remediation

**Immediate actions**:
   - Disable access keys or permissions for the user if unauthorized behavior is confirmed.
   - Rotate the bucket's encryption configuration to mitigate further misuse.

**Data recovery**:
   - Attempt to identify and contact the party holding the SSE-C encryption keys if recovery is necessary.

**Enhance monitoring**:
   - Enable alerts for future SSE-C encryption attempts in critical buckets.
   - Review and tighten IAM policies for roles and users accessing S3.

**Post-Incident review**:
   - Audit logs for additional activities by the same user or IP.
   - Document findings and apply lessons learned to improve preventive measures.
"""
references = [
    "https://www.halcyon.ai/blog/abusing-aws-native-services-ransomware-encrypting-s3-buckets-with-sse-c",
    "https://docs.aws.amazon.com/AmazonS3/latest/userguide/ServerSideEncryptionCustomerKeys.html",
]
risk_score = 73
rule_id = "909bf7c8-d371-11ef-bcc3-f661ea17fbcd"
setup = "AWS S3 data event types need to be enabled in the CloudTrail trail configuration."
severity = "high"
tags = [
    "Domain: Cloud",
    "Data Source: AWS",
    "Data Source: Amazon Web Services",
    "Data Source: AWS S3",
    "Resources: Investigation Guide",
    "Use Case: Threat Detection",
    "Tactic: Impact",
]
timestamp_override = "event.ingested"
type = "threshold"

query = '''
data_stream.dataset: "aws.cloudtrail"
    and event.provider: "s3.amazonaws.com"
    and event.action: ("PutObject" or "CopyObject")
    and event.outcome: "success"
    and aws.cloudtrail.flattened.request_parameters.x-amz-server-side-encryption-customer-algorithm: "AES256"
'''

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user_agent.original",
    "source.ip",
    "aws.cloudtrail.user_identity.arn",
    "aws.cloudtrail.user_identity.type",
    "aws.cloudtrail.user_identity.access_key_id",
    "event.action",
    "event.outcome",
    "tls.client.server_name",
    "cloud.account.id",
    "cloud.region",
    "aws.cloudtrail.request_parameters"
]

[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1486"
name = "Data Encrypted for Impact"
reference = "https://attack.mitre.org/techniques/T1486/"


[rule.threat.tactic]
id = "TA0040"
name = "Impact"
reference = "https://attack.mitre.org/tactics/TA0040/"

[rule.threshold]
field = ["tls.client.server_name"]
value = 20

[metadata]
creation_date = "2020/10/28"
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2026/05/04"

[rule]
author = ["Elastic"]
description = """
Identifies the creation, change, or deletion of a DLL module within a Windows SxS local folder. Adversaries may abuse
shared modules to execute malicious payloads by instructing the Windows module loader to load DLLs from arbitrary local
paths.
"""
from = "now-9m"
index = [
    "winlogbeat-*",
    "logs-endpoint.events.file-*",
    "logs-windows.sysmon_operational-*",
    "endgame-*",
    "logs-m365_defender.event-*",
    "logs-sentinel_one_cloud_funnel.*",
    "logs-crowdstrike.fdr*",
]
language = "eql"
license = "Elastic License v2"
name = "Execution via local SxS Shared Module"
note = """## Triage and analysis

The SxS DotLocal folder is a legitimate feature that can be abused to hijack standard modules loading order by forcing an executable on the same application.exe.local folder to load a malicious DLL module from the same directory.
"""

setup = """## Setup

This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.

Setup instructions: https://ela.st/install-elastic-defend

### Additional data sources

This rule also supports the following third-party data sources. For setup instructions, refer to the links below:

- [CrowdStrike](https://ela.st/crowdstrike-integration)
- [Microsoft Defender XDR](https://ela.st/m365-defender)
- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
- [Sysmon Event ID 11 - File Create](https://ela.st/sysmon-event-11-setup)
"""

references = ["https://docs.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-redirection"]
risk_score = 47
rule_id = "a3ea12f3-0d4e-4667-8b44-4230c63f3c75"
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Execution",
    "Data Source: Elastic Endgame",
    "Data Source: Elastic Defend",
    "Data Source: Sysmon",
    "Data Source: Microsoft Defender XDR",
    "Data Source: SentinelOne",
    "Data Source: Crowdstrike",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
file where host.os.type == "windows" and file.extension : "dll" and
  file.path : (
    "C:\\*\\*.exe.local\\*.dll",
    /* Crowdstrike specific condition as it uses NT Object paths */
    "\\Device\\HarddiskVolume*\\*\\*.exe.local\\*.dll"
  )
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1129"
name = "Shared Modules"
reference = "https://attack.mitre.org/techniques/T1129/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1574"
name = "Hijack Execution Flow"
reference = "https://attack.mitre.org/techniques/T1574/"

[[rule.threat.technique.subtechnique]]
id = "T1574.001"
name = "DLL"
reference = "https://attack.mitre.org/techniques/T1574/001/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[metadata]
creation_date = "2024/07/24"
integration = ["endpoint", "windows", "system", "sentinel_one_cloud_funnel", "m365_defender", "crowdstrike"]
maturity = "production"
updated_date = "2026/05/04"

[rule]
author = ["Elastic"]
description = """
An adversary can use the Windows command line debugging utility cdb.exe to execute commands or shellcode. This rule
looks for those instances and where the cdb.exe binary is outside of the normal WindowsKit installation paths.
"""
from = "now-9m"
index = [
    "endgame-*",
    "logs-crowdstrike.fdr*",
    "logs-endpoint.events.process-*",
    "logs-m365_defender.event-*",
    "logs-sentinel_one_cloud_funnel.*",
    "logs-system.security*",
    "logs-windows.sysmon_operational-*",
]
language = "eql"
license = "Elastic License v2"
name = "Execution via Windows Command Debugging Utility"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Execution via Windows Command Debugging Utility

The Windows command line debugging utility, cdb.exe, is a legitimate tool used for debugging applications. However, adversaries can exploit it to execute unauthorized commands or shellcode, bypassing security measures. The detection rule identifies suspicious use of cdb.exe by monitoring its execution outside standard installation paths and specific command-line arguments, indicating potential misuse for defense evasion.

### Possible investigation steps

- Review the process execution details to confirm the presence of cdb.exe running from non-standard paths, as specified in the query.
- Examine the command-line arguments used with cdb.exe, particularly looking for "-cf", "-c", or "-pd", to understand the potential actions or scripts being executed.
- Investigate the parent process of cdb.exe to determine how it was launched and identify any associated suspicious activity or processes.
- Check the user account associated with the cdb.exe execution to assess if it aligns with expected behavior or if it indicates potential compromise.
- Analyze recent system logs and security alerts for any related or preceding suspicious activities that might correlate with the execution of cdb.exe.
- Review network activity from the host to identify any unusual outbound connections that could suggest data exfiltration or command-and-control communication.

### False positive analysis

- Legitimate debugging activities by developers or IT staff using cdb.exe outside standard paths can trigger alerts. To manage this, create exceptions for known user accounts or specific machines frequently used for development.
- Automated testing environments may execute cdb.exe with command-line arguments for legitimate purposes. Identify these environments and exclude their processes from triggering alerts.
- Software installations or updates might temporarily use cdb.exe in non-standard paths. Monitor installation logs and exclude these specific instances if they are verified as part of legitimate software deployment.
- Security tools or scripts that leverage cdb.exe for monitoring or analysis can be mistaken for malicious activity. Document these tools and add them to the exclusion list to prevent false positives.

### Response and remediation

- Isolate the affected system from the network to prevent further unauthorized access or execution of malicious commands.
- Terminate any suspicious instances of cdb.exe running outside the standard installation paths to halt potential malicious activity.
- Conduct a forensic analysis of the affected system to identify any unauthorized changes or additional malicious payloads that may have been executed.
- Restore the system from a known good backup if any unauthorized changes or malware are detected, ensuring that the backup is clean and uncompromised.
- Update and patch the system to the latest security standards to close any vulnerabilities that may have been exploited.
- Implement application whitelisting to prevent unauthorized execution of cdb.exe from non-standard paths.
- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if the threat is part of a larger attack campaign."""
references = ["https://lolbas-project.github.io/lolbas/OtherMSBinaries/Cdb/"]
risk_score = 47
rule_id = "bdfaddc4-4438-48b4-bc43-9f5cf8151c46"
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Defense Evasion",
    "Data Source: Elastic Endgame",
    "Data Source: Elastic Defend",
    "Data Source: Sysmon",
    "Data Source: SentinelOne",
    "Data Source: Microsoft Defender XDR",
    "Data Source: Crowdstrike",
    "Data Source: Windows Security Event Logs",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
process where host.os.type == "windows" and event.type == "start" and
 (?process.pe.original_file_name == "CDB.Exe" or process.name : "cdb.exe") and
  process.args : ("-cf", "-c", "-pd") and
  not process.executable : (
        "?:\\Program Files (x86)\\*\\cdb.exe",
        "?:\\Program Files\\*\\cdb.exe",

        /* Crowdstrike specific exclusion as it uses NT Object paths */
        "\\Device\\HarddiskVolume*\\Program Files (x86)\\*\\cdb.exe",
        "\\Device\\HarddiskVolume*\\Program Files\\*\\cdb.exe"
  )
'''

setup = """## Setup

This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.

Setup instructions: https://ela.st/install-elastic-defend

### Additional data sources

This rule also supports the following third-party data sources. For setup instructions, refer to the links below:

- [CrowdStrike](https://ela.st/crowdstrike-integration)
- [Microsoft Defender XDR](https://ela.st/m365-defender)
- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
- [Sysmon Event ID 1 - Process Creation](https://ela.st/sysmon-event-1-setup)
- [Windows Process Creation Logs](https://ela.st/audit-process-creation)
"""


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1036"
name = "Masquerading"
reference = "https://attack.mitre.org/techniques/T1036/"

[[rule.threat.technique.subtechnique]]
id = "T1036.005"
name = "Match Legitimate Resource Name or Location"
reference = "https://attack.mitre.org/techniques/T1036/005/"

[[rule.threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[rule]
description = """
Detects when curl or wget is utilized to download a payload and pipe it to a script interpreter for immediate execution.
This activity occurs when a file is downloaded and passed to a interpreter via a shell.
"""
id = "2b616880-0a1b-42ef-a916-dea5864cd9b9"
license = "Elastic License v2"
name = "File Download Piped to Script Interpreter"
os_list = ["macos"]
version = "1.0.19"

query = '''
sequence with maxspan=2m
[process where event.type == "start" and event.action == "exec" and 
  process.name in ("curl", "nscurl") and
  process.args in ("-o", "--output", "-O", "-o-", "O", "-dl", "--download", "-ld", "--large-download") and
  process.command_line : ("/Users/Shared/*", "/tmp/*", "/private/tmp/*", "/var/tmp/*", "/private/var/tmp/*")] by process.Ext.effective_parent.entity_id
[file where event.action == "modification" and process.name in ("curl", "nscurl") and file.extension in ("sh", "scpt")] by Effective_process.entity_id
[process where event.type == "start" and event.action == "exec" and
 process.name like~ ("python*", "perl*", "ruby*", "sh", "bash", "zsh", "osascript") and
 process.parent.name in ("sh", "bash", "zsh", "osascript") and 
 ((process.args like~ ("python*", "perl*", "ruby*", "bash", "sh", "zsh", "osascript") and process.args_count == 1) or
  (process.args in ("bash", "sh", "zsh") and process.args == "-s" and process.args_count <= 2))] by process.Ext.effective_parent.entity_id
'''

min_endpoint_version = "8.16.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 2

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 2

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"


[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"

[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "8.16.0"

[metadata]
creation_date = "2025/09/18"
integration = ["endpoint", "crowdstrike"]
maturity = "production"
updated_date = "2026/03/24"

[rule]
author = ["Elastic"]
description = """
This rule detects when the Node.js runtime spawns a shell to execute the GitHub CLI (gh) command to retrieve
a GitHub authentication token. The GitHub CLI is a command-line tool that allows users to interact with
GitHub from the terminal. The "gh auth token" command is used to retrieve an authentication token for
GitHub, which can be used to authenticate API requests and perform actions on behalf of the user. Adversaries
may use this technique to access GitHub repositories and potentially exfiltrate sensitive information or
perform malicious actions. This activity was observed in the wild as part of the Shai-Hulud worm.
"""
from = "now-9m"
index = ["logs-endpoint.events.process*", "logs-crowdstrike.fdr*", "endgame-*"]
language = "eql"
license = "Elastic License v2"
name = "GitHub Authentication Token Access via Node.js"
references = ["https://www.elastic.co/blog/shai-hulud-worm-npm-supply-chain-compromise"]
risk_score = 47
rule_id = "e5d69377-f8cf-4e8f-8328-690822cd012a"
setup = """## Setup

This rule requires data coming in from Elastic Defend.

### Elastic Defend Integration Setup
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.

#### Prerequisite Requirements:
- Fleet is required for Elastic Defend.
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).

#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
- Go to the Kibana home page and click "Add integrations".
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
- Click "Add Elastic Defend".
- Configure the integration name and optionally add a description.
- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
- Click "Save and Continue".
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
"""
severity = "medium"
tags = [
  "Domain: Endpoint",
  "OS: Linux",
  "Use Case: Threat Detection",
  "Tactic: Credential Access",
  "Tactic: Discovery",
  "Data Source: Elastic Defend",
  "Data Source: Elastic Endgame",
  "Data Source: Crowdstrike",
  "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"
query = '''
process where host.os.type == "linux" and event.type == "start" and event.action in ("exec", "ProcessRollup2", "exec_event") and process.parent.name == "node" and
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and process.args == "gh auth token"
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1528"
name = "Steal Application Access Token"
reference = "https://attack.mitre.org/techniques/T1528/"

[[rule.threat.technique]]
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"

[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1613"
name = "Container and Resource Discovery"
reference = "https://attack.mitre.org/techniques/T1613/"

[rule.threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"

[[rule.threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[metadata]
creation_date = "2020/11/17"
integration = ["google_workspace"]
maturity = "production"
updated_date = "2026/07/08"

[rule]
author = ["Elastic"]
description = """
Detects when a custom admin role or its privileges are modified in Google Workspace. Adversaries may add or expand
privileges on an existing role to elevate access for assigned users or groups without creating a new role or directly
assigning a well-known admin role. Because privilege changes take effect for all principals assigned the role, modifying
role permissions can silently expand access across multiple accounts.
"""
false_positives = [
    """
    Google Workspace admin roles may be modified by system administrators. Verify that the configuration change was
    expected. Exceptions can be added to this rule to filter expected behavior.
    """,
]
from = "now-130m"
index = ["filebeat-*", "logs-google_workspace*"]
interval = "10m"
language = "kuery"
license = "Elastic License v2"
name = "Google Workspace Role Modified"
note = """## Triage and analysis

### Investigating Google Workspace Role Modified

Google Workspace allows administrators to modify custom admin roles by adding, removing, or updating privileges across
services such as Users, Groups, Gmail, Drive, and Security. Threat actors may expand privileges on an existing role to
establish persistence or escalate access for accounts already assigned that role, without triggering role assignment
alerts. Selecting a privilege category in the Admin console (for example, Organization Units) can add multiple related
privilege groups in a single action, each logged as a separate `ADD_PRIVILEGE` event.

This rule identifies when a Google Workspace role is modified via `ADD_PRIVILEGE` or `UPDATE_ROLE` events. Alert
suppression groups alerts by `user.email`, `google_workspace.admin.role.name`, and `source.ip` within a 130-minute window
(matching the rule lookback) so analysts receive one alert per role modification session instead of one alert per privilege.

### Possible investigation steps

- Identify the initiating (actor) account that modified the role by reviewing `user.email` or `user.name`, and note the `source.ip` and `event.ingested` timestamps.
- Identify the role modified by reviewing `google_workspace.admin.role.name`.
- Identify the privilege changed by reviewing `google_workspace.admin.privilege.name`. Because suppression may group multiple events, search for all related changes in the same session (see Kibana steps below).
- Determine whether the modification is expected and authorized:
  - Validate there is an approved change request/ticket and that the actor account is authorized to modify admin roles.
  - If the actor account or source IP is unusual, treat the alert as higher priority until proven benign.
- Review role permissions in the Google Admin console:
  - Navigate to Account > Admin roles.
  - Locate the role name from `google_workspace.admin.role.name` and select it to open the role details.
  - Review the Privileges tab to confirm which permissions were added or removed and whether they align with the organization's delegation model.
  - Review the Admins tab to identify which users or groups currently hold the role and will inherit the modified privileges.
- Search Kibana for all privileges changed in the session:
  - In Discover (or the alert investigation workflow), search Google Workspace admin logs with a time range centered on the alert timestamp (±5 minutes).
  - Use the following KQL example, replacing `<ROLE_NAME>` with the value from `google_workspace.admin.role.name`:
    ```
    data_stream.dataset: "google_workspace.admin" and event.action: ("ADD_PRIVILEGE" or "UPDATE_ROLE") and google_workspace.admin.role.name: "<ROLE_NAME>"
    ```
  - Optionally filter on the actor with `user.email` to isolate changes from the same administrator.
  - Review all `google_workspace.admin.privilege.name` values returned to understand the full scope of the modification.
- Search Kibana for principals recently assigned the role to determine blast radius:
  - Use the following KQL example:
    ```
    data_stream.dataset: "google_workspace.admin" and event.action: "ASSIGN_ROLE" and google_workspace.admin.role.name: "<ROLE_NAME>"
    ```
  - Review `user.target.email` and `user.target.name` for user/group assignments.
- Scope for related activity by searching for the same `user.email` (actor) performing other IAM or security actions such as `ASSIGN_ROLE`, `CREATE_ROLE`, `CREATE_USER`, or security policy changes within the last 48 hours.
- Evaluate whether principals assigned the modified role performed suspicious activity after the change:
  - Review admin/audit events for security control changes, user or group changes, and Gmail configuration changes.

### False positive analysis

- Verify the role modification aligns with approved administrative duties, an authorized change window, and the organization's access governance process.
- Confirm the initiating admin account is legitimate and not modifying roles from unusual IPs, devices, or locations.
- Selecting a privilege category in the Admin console can add multiple related privileges in one action; alert suppression should consolidate these into a single alert.
- Compare the modified role's privileges against the stated business need; overly broad privileges warrant closer review even if the change was authorized.

### Response and remediation

- Initiate the incident response process based on triage findings.
- If the modification is not clearly authorized, revert the role privileges to their prior state and/or remove the role assignment from affected users or groups while the investigation proceeds.
- For suspected compromise of the initiating admin account:
  - Reset credentials, revoke active sessions, enforce MFA re-enrollment, and review delegation/OAuth grants for persistence.
  - Validate recovery email/phone settings and account security posture.
- Review whether principals assigned the modified role require the new privileges, and replace broad custom roles with narrower delegated roles where feasible.
- Implement security best practices [outlined](https://support.google.com/a/answer/7587183) by Google.
- Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).

## Setup

The Google Workspace Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.

### Important Information Regarding Google Workspace Event Lag Times
- As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs.
- This rule is configured to run every 10 minutes with a lookback time of 130 minutes.
- To reduce the risk of false negatives, consider reducing the interval that the Google Workspace (formerly G Suite) Filebeat module polls Google's reporting API for new events.
- By default, `var.interval` is set to 2 hours (2h). Consider changing this interval to a lower value, such as 10 minutes (10m).
- See the following references for further information:
  - https://support.google.com/a/answer/7061566
  - https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-google_workspace.html"""
references = [
    "https://support.google.com/a/answer/2406043?hl=en",
    "https://www.elastic.co/security-labs/google-workspace-attack-surface-part-one",
    "https://www.elastic.co/security-labs/google-workspace-attack-surface-part-two"
]
risk_score = 73
rule_id = "6f435062-b7fc-4af9-acea-5b1ead65c5a5"
severity = "high"
tags = [
    "Domain: Cloud",
    "Data Source: Google Workspace",
    "Use Case: Identity and Access Audit",
    "Resources: Investigation Guide",
    "Tactic: Persistence",
    "Tactic: Privilege Escalation",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset:google_workspace.admin and event.provider:admin and event.category:iam and event.action:(ADD_PRIVILEGE or UPDATE_ROLE)
'''

[rule.alert_suppression]
group_by = ["user.email", "google_workspace.admin.role.name", "source.ip"]
duration = {value = 130, unit = "m"} # match lookback window
missing_fields_strategy = "suppress"

[rule.investigation_fields]
field_names = [
    "source.ip",
    "user.name",
    "user.email",
    "event.action",
    "google_workspace.admin.role.name",
    "google_workspace.admin.privilege.name",
]

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"

[rule.threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[rule]
description = """
Identifies attempts to load a transacted file. This is a technique that exploits Transactional NTFS to execute arbitrary
code in the address space of a running process, without committing the code to disk.
"""
id = "eb40ab54-8642-488a-8e7b-ee00599079fc"
license = "Elastic License v2"
name = "Image Load via Transactional NTFS"
os_list = ["windows"]
version = "1.0.2"

query = '''
sequence with maxspan=1m
[file where event.action == "overwrite" and
 _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info: "*!CreateFileTransacted*")] by file.name
[library where event.action == "load" and process.pid != 4 and dll.Ext.defense_evasions : "Process Tampering*"] by dll.name
'''

min_endpoint_version = "8.10.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"

[metadata]
creation_date = "2023/12/04"
integration = ["system", "windows"]
maturity = "production"
updated_date = "2026/05/03"

[rule]
author = ["Elastic"]
description = """
Identifies interactive logon attempt with alternate credentials and by an unusual process. Adversaries may create a new
token to escalate privileges and bypass access controls.
"""
from = "now-9m"
index = ["logs-system.security*", "logs-windows.forwarded*", "winlogbeat-*"]
language = "eql"
license = "Elastic License v2"
name = "Interactive Logon by an Unusual Process"
references = ["https://attack.mitre.org/techniques/T1134/002/"]
risk_score = 73
rule_id = "61766ef9-48a5-4247-ad74-3349de7eb2ad"
severity = "high"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Privilege Escalation",
    "Data Source: Windows Security Event Logs",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
authentication where
 host.os.type : "windows" and winlog.event_data.LogonProcessName : "Advapi*" and
 winlog.logon.type == "Interactive" and winlog.event_data.SubjectUserSid : ("S-1-5-21*", "S-1-12-*") and
 winlog.event_data.TargetUserSid : ("S-1-5-21*", "S-1-12-*")  and process.executable : "C:\\*" and
 not startswith~(winlog.event_data.SubjectUserSid, winlog.event_data.TargetUserSid) and
 not process.executable :
            ("?:\\Windows\\System32\\winlogon.exe",
             "?:\\Windows\\System32\\wininit.exe",
             "?:\\Program Files\\*.exe",
             "?:\\Program Files (x86)\\*.exe",
             "?:\\Windows\\SysWOW64\\inetsrv\\w3wp.exe",
             "?:\\Windows\\System32\\inetsrv\\w3wp.exe",
             "?:\\Windows\\SysWOW64\\msiexec.exe")
'''

note = """## Triage and analysis

### Investigating Interactive Logon by an Unusual Process
#### Possible investigation steps

- Did Advapi create an interactive logon for a different target identity?
  - Focus: `winlog.logon.type`, `winlog.event_data.LogonProcessName`, `winlog.event_data.SubjectUserSid`, `winlog.event_data.TargetUserSid`, and `host.id`.
  - Implication: escalate when Advapi creates a different Target session without recognized credential-switch use; lower suspicion only for bounded runas or helper use on this host. Subject initiated the action; Target received the session or token.
- Which process requested the alternate-credential session?
  - Focus: `process.executable`, `process.name`, `process.pid`, `winlog.event_data.SubjectUserName`, and `winlog.event_data.SubjectDomainName`.
  - Implication: escalate when the requester is user-writable, temporary, renamed, or unrelated to credential switching; lower suspicion only for System32 runas.exe or a recognized helper tied to the same Subject. Process identity alone does not clear token creation.
- Did the Target session create privileged or linked-token access?
  - Focus: `winlog.event_data.TargetUserSid`, `winlog.event_data.TargetLogonId`, `winlog.event_data.TargetLinkedLogonId`, `winlog.event_data.ElevatedToken`, and `winlog.event_data.ImpersonationLevel`.
  - Implication: escalate on a privileged or unusual Target account, elevated token, linked session, or impersonation-capable token. Keep unresolved when the Target cannot be tied to the requesting Subject and process; a recognized requester does not clear elevated Target token state.
- Did explicit-credential records show who supplied Target credentials?
  - Focus: same-host 4648 records using `winlog.event_data.SubjectLogonId`; read `winlog.event_data.TargetUserName`, `winlog.event_data.TargetDomainName`, `winlog.event_data.TargetServerName`, and `source.ip`.
  - Hint: make-token tooling may leave only Advapi, different Subject/Target SIDs, and Target session fields; do not require endpoint command-line evidence before escalation. $investigate_0
  - Implication: escalate when 4648 shows the same Subject session presenting Target credentials to an unexpected server or non-local origin. Local or absent `source.ip` can occur in make-token cases and must be weighed with requester, identity pair, and token state; missing Security telemetry is unresolved, not benign.
- Did the created Target session show follow-on success or authentication-method signals?
  - Focus: same-host 4624 and 4634 records using `winlog.event_data.TargetLogonId`; read `winlog.event_data.TargetUserSid`, `winlog.event_data.AuthenticationPackageName`, and `source.ip`.
  - Implication: escalate on unexpected authentication package use, repeated successful session activity, or a non-local origin that contradicts local workflow; absent or local source details should be weighed with Target-token evidence. Missing 4624/4634 telemetry is unresolved, not benign.
    - $investigate_1
    - $investigate_2
- What activity is tied to the created Target logon session?
  - Focus: same-host events carrying `winlog.event_data.TargetLogonId`, especially process, privilege, or authentication records tied to the Target identity. $investigate_3
  - Implication: escalate when the Target session performs privileged operations, starts unexpected processes, or chains authentication; no follow-on telemetry narrows activity only when the requester, identity pair, and token state are otherwise explained.
- If local evidence remains suspicious or unresolved, do related alerts change scope?
  - Focus: recent alerts for the same `host.id`, Subject SID, and Target SID.
    - $investigate_4
    - $investigate_5
    - $investigate_6
  - Implication: broaden scope when related alerts show credential access, privilege escalation, persistence, or lateral movement tied to the host or either identity; quiet alert history cannot close unresolved token/session evidence.
- Escalate on unauthorized Subject-to-Target token creation; close only when the identity pair, requester, Target token, and Security records all bind to one recognized workflow; if mixed, preserve records and use related alerts plus recent session activity to scope the case.

### False positive analysis

- Recognized runas, enterprise PAM or credential-broker helpers, and authorized assessment can trigger this rule from monitored admin hosts. Confirm `process.executable`, Subject and Target identities, `host.id`, and explicit-credential or session records bind to the same workflow or validation scope; contradictory Target token details block benign closure.
- Build exceptions only from the minimum confirmed pattern, such as `process.executable` plus `winlog.event_data.SubjectUserSid`, `winlog.event_data.TargetUserSid`, and a bounded `host.id` or host group. Avoid exceptions on `process.name`, `user.name`, or the Target account alone.

### Response and remediation

- If confirmed benign, document the evidence categories, reverse temporary containment, and create only the narrow exception described above.
- If suspicious but unconfirmed, export the alert and surrounding Windows Security records, preserve the requesting process image and Subject-to-Target session context, and collect the referenced executable before containment.
- Apply reversible containment first: restrict the affected account or host session, increase monitoring on the involved `host.id` and identities, and weigh host criticality before isolation.
- If confirmed malicious, preserve the executable referenced by `process.executable`, session records, and Subject/Target identifiers, then contain involved hosts or accounts and invalidate active sessions.
- Reset or rotate Target credentials only when compromise or unauthorized use is supported; treat Subject as the operator or requesting context before disabling it.
- Eradicate only confirmed token-abuse tooling or credential material, review local privilege assignments that allowed the session, and retain Windows Security events needed to reconstruct Subject-to-Target token creation."""

setup = """## Setup

Audit Logon must be enabled to generate the events used by this rule.
Setup instructions: https://ela.st/audit-logon
"""

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "host.id",
    "process.name",
    "process.executable",
    "process.pid",
    "winlog.logon.type",
    "winlog.event_data.LogonProcessName",
    "winlog.event_data.ImpersonationLevel",
    "winlog.event_data.ElevatedToken",
    "winlog.event_data.SubjectUserSid",
    "winlog.event_data.SubjectUserName",
    "winlog.event_data.SubjectLogonId",
    "winlog.event_data.TargetUserSid",
    "winlog.event_data.TargetLogonId",
    "winlog.event_data.TargetLinkedLogonId",
]

[transform]

[[transform.investigate]]
label = "Explicit-credential events from the subject session"
description = ""
providers = [
  [
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "event.code", queryType = "phrase", value = "4648", valueType = "string" },
    { excluded = false, field = "winlog.event_data.SubjectLogonId", queryType = "phrase", value = "{{winlog.event_data.SubjectLogonId}}", valueType = "string" }
  ]
]
relativeFrom = "now-1h"
relativeTo = "now"

[[transform.investigate]]
label = "Target logon records for the created session"
description = ""
providers = [
  [
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "event.code", queryType = "phrase", value = "4624", valueType = "string" },
    { excluded = false, field = "winlog.event_data.TargetLogonId", queryType = "phrase", value = "{{winlog.event_data.TargetLogonId}}", valueType = "string" }
  ]
]
relativeFrom = "now-1h"
relativeTo = "now"

[[transform.investigate]]
label = "Target logoff records for the created session"
description = ""
providers = [
  [
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "event.code", queryType = "phrase", value = "4634", valueType = "string" },
    { excluded = false, field = "winlog.event_data.TargetLogonId", queryType = "phrase", value = "{{winlog.event_data.TargetLogonId}}", valueType = "string" }
  ]
]
relativeFrom = "now-1h"
relativeTo = "now"

[[transform.investigate]]
label = "Events for the created target logon session"
description = ""
providers = [
  [
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "winlog.event_data.TargetLogonId", queryType = "phrase", value = "{{winlog.event_data.TargetLogonId}}", valueType = "string" }
  ],
  [
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "winlog.logon.id", queryType = "phrase", value = "{{winlog.event_data.TargetLogonId}}", valueType = "string" }
  ]
]
relativeFrom = "now-1h"
relativeTo = "now"

[[transform.investigate]]
label = "Alerts associated with the host"
description = ""
providers = [
  [
    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" }
  ]
]
relativeFrom = "now-48h/h"
relativeTo = "now"

[[transform.investigate]]
label = "Alerts associated with the subject identity"
description = ""
providers = [
  [
    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
    { excluded = false, field = "winlog.event_data.SubjectUserSid", queryType = "phrase", value = "{{winlog.event_data.SubjectUserSid}}", valueType = "string" }
  ],
  [
    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
    { excluded = false, field = "user.id", queryType = "phrase", value = "{{winlog.event_data.SubjectUserSid}}", valueType = "string" }
  ]
]
relativeFrom = "now-48h/h"
relativeTo = "now"

[[transform.investigate]]
label = "Alerts associated with the target identity"
description = ""
providers = [
  [
    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
    { excluded = false, field = "winlog.event_data.TargetUserSid", queryType = "phrase", value = "{{winlog.event_data.TargetUserSid}}", valueType = "string" }
  ],
  [
    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
    { excluded = false, field = "user.id", queryType = "phrase", value = "{{winlog.event_data.TargetUserSid}}", valueType = "string" }
  ]
]
relativeFrom = "now-48h/h"
relativeTo = "now"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1134"
name = "Access Token Manipulation"
reference = "https://attack.mitre.org/techniques/T1134/"

[[rule.threat.technique.subtechnique]]
id = "T1134.002"
name = "Create Process with Token"
reference = "https://attack.mitre.org/techniques/T1134/002/"

[[rule.threat.technique.subtechnique]]
id = "T1134.003"
name = "Make and Impersonate Token"
reference = "https://attack.mitre.org/techniques/T1134/003/"

[rule.threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"