Elastic rules: 33

[metadata]
creation_date = "2024/08/23"
integration = ["endpoint", "auditd_manager", "crowdstrike", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2025/12/17"

[rule]
author = ["Elastic"]
description = """
This rule detects Linux Access Control List (ACL) modification via the setfacl command. Attackers may
use the setfacl utility to modify file and directory permissions in order to evade detection and maintain
persistence on a compromised system.
"""
from = "now-9m"
index = [
    "auditbeat-*",
    "endgame-*",
    "logs-auditd_manager.auditd-*",
    "logs-crowdstrike.fdr*",
    "logs-endpoint.events.process*",
    "logs-sentinel_one_cloud_funnel.*",
]
language = "eql"
license = "Elastic License v2"
name = "Access Control List Modification via setfacl"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Access Control List Modification via setfacl

Access Control Lists (ACLs) in Linux enhance file permission management by allowing more granular access control. The `setfacl` command modifies these ACLs, potentially altering who can access or modify files. Adversaries may exploit `setfacl` to stealthily change permissions, evading detection and maintaining persistence. The detection rule identifies suspicious `setfacl` executions, excluding benign patterns, to flag potential misuse.

### Possible investigation steps

- Review the process details to confirm the execution of the setfacl command, focusing on the process.name and event.type fields to ensure the alert is valid.
- Examine the process.command_line to understand the specific ACL modifications attempted and identify any unusual or unauthorized changes.
- Investigate the user account associated with the process execution to determine if the action aligns with their typical behavior or role.
- Check the process's parent process to identify how the setfacl command was initiated and assess if it was part of a legitimate workflow or a potential compromise.
- Correlate the event with other security logs or alerts from the same host to identify any related suspicious activities or patterns that might indicate a broader attack.

### False positive analysis

- Routine system maintenance tasks may trigger the rule if they involve legitimate use of setfacl. To manage this, identify and document regular maintenance scripts or processes that use setfacl and create exceptions for these specific command lines.
- Backup operations that restore ACLs using setfacl can be mistaken for suspicious activity. Exclude these by adding exceptions for command lines that match known backup procedures, such as those using the --restore option.
- Automated log management tools might use setfacl to manage permissions on log directories like /var/log/journal/. To prevent false positives, exclude these specific directory paths from triggering the rule.
- Custom applications or services that require dynamic permission changes using setfacl could be flagged. Review these applications and, if deemed safe, add their specific command patterns to the exception list to avoid unnecessary alerts.

### Response and remediation

- Immediately isolate the affected system from the network to prevent further unauthorized access or changes.
- Review the process execution logs to identify any unauthorized users or processes that executed the `setfacl` command.
- Revert any unauthorized ACL changes by restoring the original file permissions from a known good backup or configuration.
- Conduct a thorough scan of the system for any additional signs of compromise, such as unauthorized user accounts or unexpected processes.
- Update and patch the system to address any vulnerabilities that may have been exploited to gain access.
- Implement stricter access controls and monitoring on critical systems to detect and prevent unauthorized ACL modifications in the future.
- Escalate the incident to the security operations team for further investigation and to determine if additional systems are affected."""
references = [
    "https://www.uptycs.com/blog/threat-research-report-team/evasive-techniques-used-by-malicious-linux-shell-scripts",
]
risk_score = 21
rule_id = "999565a2-fc52-4d72-91e4-ba6712c0377e"
severity = "low"
tags = [
    "Domain: Endpoint",
    "OS: Linux",
    "Use Case: Threat Detection",
    "Tactic: Defense Evasion",
    "Data Source: Elastic Defend",
    "Data Source: Elastic Endgame",
    "Data Source: Auditd Manager",
    "Data Source: Crowdstrike",
    "Data Source: SentinelOne",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"
query = '''
process where host.os.type == "linux" and event.type == "start" and
event.action in ("exec", "exec_event", "start", "ProcessRollup2", "executed", "process_started") and
process.name == "setfacl" and not (
  ?process.parent.executable in (
    "/opt/puppetlabs/puppet/bin/ruby", "/usr/libexec/dirsrv/ds_systemd_ask_password_acl", "/usr/lib/systemd/systemd-udevd",
    "/usr/bin/udevadm", "/usr/sbin/ds_systemd_ask_password_acl", "/usr/bin/su", "/bin/su"
  ) or
  process.command_line == "/bin/setfacl --restore=-" or
  process.args == "/var/log/journal/" or
  ?process.parent.name in ("stats.pl", "perl", "find") or
  ?process.parent.command_line like~ "*ansible*" or
  ?process.parent.args == "/opt/audit-log-acl.sh"
)
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1222"
name = "File and Directory Permissions Modification"
reference = "https://attack.mitre.org/techniques/T1222/"

[[rule.threat.technique.subtechnique]]
id = "T1222.002"
name = "Linux and Mac File and Directory Permissions Modification"
reference = "https://attack.mitre.org/techniques/T1222/002/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[metadata]
creation_date = "2024/08/19"
integration = ["aws"]
maturity = "production"
updated_date = "2026/07/08"

[rule]
author = ["Elastic"]
description = """
Identifies the first occurrence of an AWS Security Token Service (STS) GetFederationToken request made by a user. The GetFederationToken API call allows users to request temporary security credentials to
access AWS resources. The maximum expiration period for these tokens is 36 hours and they can be used to create a console signin token even for identities that don't already have one. Adversaries may use this API to obtain temporary credentials for persistence and to bypass IAM API call limitations by gaining console access.
"""
from = "now-6m"
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
language = "kuery"
license = "Elastic License v2"
name = "AWS First Occurrence of STS GetFederationToken Request by User"
references = [
    "https://hackingthe.cloud/aws/post_exploitation/survive_access_key_deletion_with_sts_getfederationtoken/",
    "https://www.crowdstrike.com/en-us/blog/how-adversaries-persist-with-aws-user-federation/",
    "https://medium.com/@adan.alvarez/how-attackers-persist-in-aws-using-getfederationtoken-a-simple-and-effective-technique-used-in-the-987ec1f0bdfe/"
]
risk_score = 73
rule_id = "7a5cc9a8-5ea3-11ef-beec-f661ea17fbce"
severity = "high"
tags = [
    "Domain: Cloud",
    "Data Source: Amazon Web Services",
    "Data Source: AWS",
    "Data Source: AWS STS",
    "Use Case: Threat Detection",
    "Tactic: Defense Evasion",
    "Tactic: Persistence",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "new_terms"

query = '''
data_stream.dataset: "aws.cloudtrail"
    and event.provider:sts.amazonaws.com
    and event.action:GetFederationToken
    and event.outcome:success
'''
note = """## Triage and analysis

### Investigating AWS First Occurrence of STS GetFederationToken Request by User

AWS Security Token Service (STS) enables users to request temporary credentials for accessing AWS resources. While beneficial for legitimate use, adversaries may exploit this to gain unauthorized access. These credentials will remain active for the duration specified (maximum 36 hours), even if the initial compromised identity is deleted. They can also be used to request a console signin token which allows the adversary to make sensitive IAM API calls which would otherwise be denied with the federation token alone. The detection rule identifies unusual activity by flagging the first instance of a `GetFederationToken` request by a user helping to uncover potential misuse aimed at evading defenses and gaining persistence.

### Possible investigation steps

- Review the specific user account associated with the `GetFederationToken` request to determine if the activity aligns with their typical behavior and role within the organization.
- Examine the AWS CloudTrail logs for additional context around the time of the `GetFederationToken` request, looking for any other unusual or suspicious activities by the same user or related accounts.
- Check the `source.ip` and `source.geo` fields of the request to identify if it originates from an expected or unexpected location.
- View the `aws.cloudtrail.response_elements` to find the created `federatedUser.arn`. Investigate the resources accessed by this Federated User to assess if there was any suspicious activity.
- Consult with the requesting user `aws.cloudtrail.user_identity.arn` to verify if the `GetFederationToken` request was legitimate and necessary for their work tasks.

### False positive analysis

- Routine administrative tasks by cloud administrators may trigger the rule if they are using `GetFederationToken` for legitimate purposes. To manage this, create exceptions for known administrative accounts that regularly perform these actions.
- Automated scripts or applications that use `GetFederationToken` for legitimate operations might be flagged. Identify these scripts and exclude their associated user accounts from the rule to prevent unnecessary alerts.
- Third-party services integrated with AWS that require temporary credentials might cause false positives. Review and whitelist these services if they are verified and trusted to avoid repeated alerts.
- New employees or contractors accessing AWS resources for the first time may trigger the rule. Implement a process to verify their access requirements and exclude their accounts if their actions are deemed non-threatening.

### Response and remediation

- If compromise is verified, attach a policy that denies all actions, effectively preventing any further activity, even from temporary credentials. You can use the AWS-managed policy [AWSDenyAll](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSDenyAll.html). This ensures that any temporary credentials generated by the compromised user are also blocked, stopping the attacker’s activities.
- Notify the security team and relevant stakeholders about the incident for awareness and further investigation.
- Conduct a root cause analysis to determine how the `GetFederationToken` request was initiated and identify any potential security gaps or misconfigurations.
- Implement additional monitoring and alerting for `GetFederationToken` requests to detect and respond to similar activities promptly in the future.
- Review and update IAM policies and permissions to ensure that only authorized users have the ability to request temporary credentials, reducing the risk of misuse."""

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user_agent.original",
    "source.ip",
    "aws.cloudtrail.user_identity.arn",
    "aws.cloudtrail.user_identity.type",
    "aws.cloudtrail.user_identity.access_key_id",
    "event.action",
    "event.outcome",
    "cloud.account.id",
    "cloud.region",
    "aws.cloudtrail.request_parameters",
    "aws.cloudtrail.response_elements"
]

[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1550"
name = "Use Alternate Authentication Material"
reference = "https://attack.mitre.org/techniques/T1550/"
[[rule.threat.technique.subtechnique]]
id = "T1550.001"
name = "Application Access Token"
reference = "https://attack.mitre.org/techniques/T1550/001/"


[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"
[[rule.threat.technique.subtechnique]]
id = "T1098.001"
name = "Additional Cloud Credentials"
reference = "https://attack.mitre.org/techniques/T1098/001/"


[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[rule.new_terms]
field = "new_terms_fields"
value = ["aws.cloudtrail.user_identity.arn"]
[[rule.new_terms.history_window_start]]
field = "history_window_start"
value = "now-10d"

[metadata]
creation_date = "2026/07/09"
integration = ["azure"]
maturity = "production"
updated_date = "2026/07/09"

[rule]
author = ["Elastic"]
description = """
Detects an identity creating or modifying the CoreDNS or kube-dns ConfigMap in the kube-system namespace on AKS (Azure
Kubernetes Service), excluding known AKS control-plane and platform identities. Rewriting cluster DNS (by editing
coredns/kube-dns or creating and editing coredns-custom) enables cluster-wide adversary-in-the-middle by redirecting
internal service resolution to attacker-controlled IPs, allowing credential capture and traffic interception. Coverage
includes workload service accounts (system:serviceaccount:*), so a compromised in-cluster token is not excluded.
"""
false_positives = [
    """
    Approved automation, platform controllers, or GitOps may update the CoreDNS ConfigMap (for example custom forward
    rules). Validate the identity and change window, and add exclusions for verified service accounts.
    """,
]
from = "now-9m"
index = ["logs-azure.platformlogs-*"]
language = "kuery"
license = "Elastic License v2"
name = "Azure AKS CoreDNS or Kube-DNS Configuration Modified"
note = """## Triage and analysis

### Investigating Azure AKS CoreDNS or Kube-DNS Configuration Modified

AKS kube-audit events are carried under the flattened `azure.platformlogs.properties.log.*` subtree and share the ARM
operation `event.action: Microsoft.ContainerService/managedClusters/diagnosticLogs/Read`. CoreDNS resolves in-cluster
service names; an attacker who edits `coredns`/`kube-dns` or creates/edits the user-managed `coredns-custom` ConfigMap
can inject forward or rewrite rules that redirect service resolution to attacker-controlled endpoints, enabling
cluster-wide interception of credentials and traffic. `coredns-custom` is the supported customization surface, so
legitimate DNS tuning also lands here; the acting identity is excluded when it is an AKS platform reconciler
(`aksService`), leaving non-platform changes as the signal.

### Possible investigation steps

- Review the submitted ConfigMap body in `azure.platformlogs.properties.log.requestObject.data` for added forward,
  rewrite, or hosts entries pointing at unexpected IPs or domains. This content, not the act of editing, is what
  distinguishes malicious DNS redirection from routine customization.
- Identify the acting identity in `azure.platformlogs.properties.log.user.username` (and its groups in
  `azure.platformlogs.properties.log.user.groups`) and confirm it should manage the CoreDNS configuration; a workload
  service account (`system:serviceaccount:<ns>:<sa>`) editing cluster DNS is the higher-concern case.
- Confirm the operation and object via `azure.platformlogs.properties.log.verb` (a `create` of `coredns-custom` where it
  did not previously exist is notable) and `azure.platformlogs.properties.log.objectRef.name` (`coredns`,
  `coredns-custom`, or `kube-dns`), and inspect `azure.platformlogs.properties.log.userAgent`.
- Evaluate the source in `azure.platformlogs.properties.log.sourceIPs` and pivot on it for related RBAC changes, secret
  reads, or exec sessions.

### False positive analysis

- `coredns-custom` is the AKS-supported way to add custom forward/stub rules, so approved automation, GitOps, or
  administrators editing it are expected. The AKS reconciler (`aksService`) that continuously (re)creates
  `coredns-custom` is excluded by identity. Validate the change content and window, then exclude the specific verified
  service account rather than re-broadening to all `system:*`.

### Response and remediation

- If unauthorized, restore the CoreDNS ConfigMap from a known-good source, revoke the acting identity's tokens, and
  review the RBAC that permitted the change.
- Hunt for credential capture or redirected traffic during the window the malicious configuration was active.
- Collect kube-audit and identity artifacts per incident response procedures.
"""
references = [
    "https://kubernetes.io/docs/tasks/administer-cluster/dns-custom-nameservers/",
    "https://microsoft.github.io/Threat-Matrix-for-Kubernetes/",
    "https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/CoreDNS%20poisoning/",
    "https://learn.microsoft.com/en-us/azure/aks/coredns-custom",
    "https://www.aquasec.com/blog/dns-spoofing-kubernetes-clusters/",
    "https://hub.armosec.io/docs/c-0037",
]
risk_score = 47
rule_id = "1291513f-02f2-48d6-9f9c-06e5c8f23ecb"
setup = """
The Azure Fleet integration collecting AKS diagnostic logs forwarded through Event Hub into the `azure.platformlogs`
data stream is required for this rule. Enable either the `kube-audit` or the `kube-audit-admin` log category (Microsoft
recommends `kube-audit-admin` alone to reduce volume, as it only drops read-only get/list events). ConfigMap writes are
mutating operations recorded in both categories with the same `auditID`, so clusters that enable both categories may
generate two alerts per change.
"""
severity = "medium"
tags = [
    "Domain: Cloud",
    "Domain: Kubernetes",
    "Data Source: Azure",
    "Data Source: Azure Platform Logs",
    "Data Source: Kubernetes",
    "Use Case: Threat Detection",
    "Tactic: Credential Access",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset:azure.platformlogs and
  event.action:"Microsoft.ContainerService/managedClusters/diagnosticLogs/Read" and
  azure.platformlogs.category:("kube-audit" or "kube-audit-admin") and
  azure.platformlogs.properties.log.stage:"ResponseComplete" and
  azure.platformlogs.properties.log.objectRef.resource:"configmaps" and
  azure.platformlogs.properties.log.objectRef.namespace:"kube-system" and
  azure.platformlogs.properties.log.objectRef.name:("coredns" or "kube-dns" or "coredns-custom") and
  azure.platformlogs.properties.log.verb:("create" or "update" or "patch" or "delete") and
  not azure.platformlogs.properties.log.user.username:(
    system\:node\:* or "aksService" or "hcpService" or "readinessChecker" or
    system\:serviceaccount\:kube-system\:*
  )
'''

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "event.action",
    "azure.platformlogs.category",
    "azure.platformlogs.properties.log.verb",
    "azure.platformlogs.properties.log.user.username",
    "azure.platformlogs.properties.log.user.groups",
    "azure.platformlogs.properties.log.userAgent",
    "azure.platformlogs.properties.log.sourceIPs",
    "azure.platformlogs.properties.log.objectRef.namespace",
    "azure.platformlogs.properties.log.objectRef.name",
    "azure.platformlogs.properties.log.responseStatus.code",
]

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1557"
name = "Adversary-in-the-Middle"
reference = "https://attack.mitre.org/techniques/T1557/"

[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[rule]
description = """
Identifies Bun scripting interpreter establishing a network connection to the link-local instance metadata service
address (169.254.169.254). Adversaries and cloud malware often query the instance metadata API to harvest IAM
credentials, tokens, and other secrets from cloud-hosted workloads.
"""
id = "04a04478-10b8-4b3f-a4e1-fe0c49c0f65b"
license = "Elastic License v2"
name = "Bun Script Attempted to Access IMDS Metadata"
os_list = ["macos"]
reference = [
    "https://attack.mitre.org/techniques/T1552/005/",
    "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html",
    "https://www.elastic.co/security-labs/shai-hulud-chaindrop-npm-supply-chain",
]
version = "1.0.0"

query = '''
sequence by process.entity_id with maxspan=1m
  [process where event.type == "start" and event.action in ("start", "exec") and process.name : ("bun", "bun.exe") and 
   not process.command_line like ("bun --watch src/app.ts", 
                                  "bun test src/integrations/__tests__/*", 
                                  "bun run scripts/ingest-resilience-retrospectives.ts --ingest", 
                                  "bun packages/product-config/codegen/api-codegen.ts", 
                                  "bun run apps/backend/probe-pagination.ts")]
  [network where event.action == "connection_attempted" and destination.address == "169.254.169.254" and destination.port == 80]
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"
[[threat.technique.subtechnique]]
id = "T1552.005"
name = "Cloud Instance Metadata API"
reference = "https://attack.mitre.org/techniques/T1552/005/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "7.15.0"

[rule]
description = """
Detects the manual loading of a Chromium extension from an unusual parent process. This activity is suspicious and could
be indicative of a malware loading a malicious extension to persist or collect browsing secrets such as cookies,
browsing history.
"""
id = "d7fda3d7-fe77-49c2-8b50-d28a6da206c4"
license = "Elastic License v2"
name = "Chromium Extension Loaded from Unusual Parent"
os_list = ["windows"]
reference = [
    "https://redcanary.com/blog/chromeloader/",
    "https://blogs.vmware.com/security/2022/09/the-evolution-of-the-chromeloader-malware.html",
]
version = "1.0.27"

query = '''
sequence with maxspan=5m
 [process where event.action == "start" and process.parent.executable != null and
  (
   (process.Ext.relative_file_creation_time <= 600 or process.Ext.relative_file_name_modify_time <= 600) or
   process.executable : ("?:\\Users\\*\\AppData\\*", "?:\\Users\\Public\\*", "?:\\ProgramData\\*", "?:\\Windows\\Microsoft.Net\\*") or
   process.name in~ ("wscript.exe", "cscript.exe", "mshta.exe", "powershell.exe", "regsvr32.exe", "rundll32.exe", "cmd.exe")
  ) and
  not (process.code_signature.subject_name :
               ("Cypress.io, Inc.", "PortSwigger Ltd", "Scalehat Technologies Ltd", "Azul Systems, Inc.", "JetBrains s.r.o.",
                "Katalon Inc.", "Shenzhen Love Sense Technology Co., Ltd.") and
       process.code_signature.trusted == true) and

  not process.hash.sha256 :
              ("a064743886dc4068db7e4143a2eba14d1cdf80f5dd28d8057c6087a30ca7f3b4",
               "7d95b4e26859620738a31dbbafbf019da42f2378821e2bb49b748956ef50b3e3",
               "fcc098d6a5df5a302c4fc635203bf28868a92d2469465551f6cf7e5c93a1719a",
               "e4244190024bdd0ffed267b47f897cca054a4762c76b93cb34ae2d7925589956",
               "e309416c7ec1606899e646b54ff8ac15a42925e2cfb8b0cd5d455b208846671f",
               "02901bc79c262a6e0c9f8c62682c9165e50ed0027ff54011de949c3a510bbd60",
               "e309416c7ec1606899e646b54ff8ac15a42925e2cfb8b0cd5d455b208846671f",
               "ffa8aee6d8b251b21d7744980196fb556ca7e4247aa7017d5e7ee7d498d50c4d",
               "02901bc79c262a6e0c9f8c62682c9165e50ed0027ff54011de949c3a510bbd60",
               "976373ee09d6cb298ac802b46002c9dfbd30f1bf0988f840a74285ee409c6d5d",
               "023f1d06be341eb26c365706a9113f9f23087aaf4df6cc17d12ec935a7a1a0cc",
               "839ef38f0ed23a9dcca4f0a807e205f95e26370f35ec9ea9915721c06eda04f2",
               "88e697f93ea94d74a1979af662339e826d784337e0abdb74f27e9293d94e9fed",
               "f7c7a89503959800005bfe6767f189e49c9c76aeea38d6f304f7be2d8663d204",
               "55c5203db4d44d96f4124c60e69ae0823f4372efa4b5416675d9564a83d6ad2c",
               "afb45186ad4f4217c2fc1dfc2239ff5ab016ef0ba5fc329bc6aa8fd10c7ecc88") and

  not (process.name : "cmd.exe" and
       process.parent.executable : ("?:\\Users\\*\\AppData\\Local\\Programs\\GoLogin\\GoLogin.exe",
                                    "C:\\Users\\*\\AppData\\Local\\PDFProSuite\\pdfprosuite.exe")) and

  not (process.executable : "?:\\Windows\\SysWOW64\\cmd.exe" and process.parent.name : "node.exe" and
       process.parent.args : ("--check-update", "update.js"))
  ] by process.entity_id
 [process where event.action == "start" and process.command_line : "*--load-extension*"] by process.parent.entity_id
'''

min_endpoint_version = "8.4.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1176"
name = "Software Extensions"
reference = "https://attack.mitre.org/techniques/T1176/"
[[threat.technique.subtechnique]]
id = "T1176.001"
name = "Browser Extensions"
reference = "https://attack.mitre.org/techniques/T1176/001/"



[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[internal]
min_endpoint_version = "8.4.0"

[metadata]
creation_date = "2026/04/27"
integration = ["endpoint", "auditd_manager"]
maturity = "production"
updated_date = "2026/07/17"

[rule]
author = ["Elastic"]
description = """
Detects chroot execution on Linux when the process appears to run in a container-oriented context: the process title
matches runc init, the entry leader is a container workload, or the parent process is runc. Chroot from inside a
container can pivot to an alternate root filesystem and is a common step in container breakout attempts when combined
with sensitive host mounts.
"""
false_positives = [
    """
    Build and packaging images sometimes run chroot against a staged root filesystem inside CI or init containers;
    correlate with approved pipelines and image build jobs before escalating.
    """,
]
from = "now-9m"
index = ["auditbeat-*", "logs-auditd_manager.auditd-*", "logs-endpoint.events.process*"]
language = "kuery"
license = "Elastic License v2"
name = "Chroot Execution in Container Context on Linux"
note = """## Triage and analysis

### Investigating Chroot Execution in Container Context on Linux

This alert is the host-process analogue to Defend for Containers chroot coverage: it keys on chroot binaries or
arguments plus signals that the execution is tied to a container runtime (runc parent, runc init title, or Elastic
Defend container session metadata). Review the command line for the target root path, especially host-linked mounts such
as `/host`, `/proc/1/root`, or unexpected node paths.

### Possible investigation steps

- Confirm whether the workload was expected to use chroot and whether the target directory is an internal build root
  versus a host filesystem mount.
- For Elastic Defend events, use session and entry leader context to map the pod or container image; for Auditd
  Manager events, pivot on `process.parent` and nearby syscall activity on the same host.
- Hunt for follow-on shell execution, access to the container runtime socket, or kubelet credential paths.

### False positive analysis

- Legitimate image builds and package installs may chroot into a prepared rootfs; tune by parent process, user, or CI
  agent identity when noise is high.

### Response and remediation

- If unauthorized, isolate the workload and node, preserve artifacts, and rotate credentials exposed to the container.
"""
references = [
    "https://some-natalie.dev/container-escapes-chroot/",
    "https://attack.mitre.org/techniques/T1611/",
]
risk_score = 73
rule_id = "9056d577-4da5-47bf-8c94-6c0b1bb3f8a5"
setup = """## Setup

This rule requires process execution telemetry from Elastic Defend and/or Auditd Manager on Linux.

### Elastic Defend Integration Setup
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows
the Elastic Agent to monitor events on your host and send data to the Elastic Security app.

#### Prerequisite Requirements:
- Fleet is required for Elastic Defend.
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).

#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
- Go to the Kibana home page and click "Add integrations".
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
- Click "Add Elastic Defend".
- Configure the integration name and optionally add a description.
- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
- Click "Save and Continue".
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).

### Auditd Manager Integration Setup
The Auditd Manager Integration receives audit events from the Linux Audit Framework which is a part of the Linux kernel.
Auditd Manager provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system.

#### The following steps should be executed in order to add the Elastic Agent System integration "auditd_manager" on a Linux System:
- Go to the Kibana home page and click "Add integrations".
- In the query bar, search for "Auditd Manager" and select the integration to see more details about it.
- Click "Add Auditd Manager".
- Configure the integration name and optionally add a description.
- Review optional and advanced settings accordingly.
- Add the newly installed "auditd manager" to an existing or a new agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.
- Click "Save and Continue".
- For more details on the integration refer to the [helper guide](https://docs.elastic.co/integrations/auditd_manager).

#### Rule Specific Setup Note
Ensure execve (or equivalent process) auditing is enabled so `event.category:process` and process fields populate for
chroot invocations. Container-context clauses that rely on `process.entry_leader` or `process.title` are primarily
populated on Elastic Defend; Auditd Manager match when `process.title` matches on container runc.
"""
severity = "high"
tags = [
    "Data Source: Auditd Manager",
    "Data Source: Elastic Defend",
    "Domain: Container",
    "Domain: Endpoint",
    "OS: Linux",
    "Use Case: Threat Detection",
    "Tactic: Privilege Escalation",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"
query = '''
host.os.type:linux and event.category:process and 
event.type:start and event.action:(executed or exec) and 
(process.name:"chroot" or process.args:("chroot" or "/bin/chroot" or "/usr/bin/chroot" or "/usr/local/bin/chroot")) and 
(process.title:"runc init" or process.entry_leader.entry_meta.type:"container" or process.parent.name:("runc" or "containerd-shim-runc-v2")) and
not process.args:(apt-get or add-apt-repository or apt-cache* or */var/lib/rancher/agent/tmp* or dpkg)
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1611"
name = "Escape to Host"
reference = "https://attack.mitre.org/techniques/T1611/"

[rule.threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[rule]
description = """
This rule identifies when a decoded payload is piped to an interpreter. Malware authors may attempt to evade detection
by encoding and obfuscating their payload.
"""
id = "452d6452-a8ec-4cae-9720-567fb44d93b7"
license = "Elastic License v2"
name = "Decoded Payload Piped to Interpreter"
os_list = ["linux"]
version = "1.0.10"

query = '''
sequence by process.parent.entity_id, process.working_directory with maxspan=1s
  [process where event.type == "start" and event.action == "exec" and (
    (
      process.name in ("base64", "basez", "base64plain", "base64url", "base64mime", "base64pem", "basenc", "base32", "base16") and
      process.command_line like~ ("* -d*", "* --decode*")
    ) or
    (
      process.name == "openssl" and
      process.args == "enc" and process.args in ("-d", "-base64", "-a", "-A")
    ) or
    (
      process.name like "python*" and (
        (process.args == "base64" and process.args in ("-d", "-u", "-t")) or
        (process.args == "-c" and process.args like "*base64*" and process.command_line like~ "*b64decode*")
      )
    ) or
    (
      process.name like "perl*" and
      process.command_line like~ "*decode_base64*"
    ) or
    (
      process.name like "ruby*" and
      process.args == "-e" and
      process.command_line like~ "*Base64.decode64*"
    ) or
    (
      process.name like~ "java*" and
      process.command_line like~ "*base64*decode(*"
    ) or
    (
      process.name like~ "lua*" and
      process.command_line like~ ("*mime.decode(*base64*", "*mime.unb64(*")
    ) or
    (
      process.name in ("node", "deno") and
      (
        process.command_line like~ ("*atob(*", "*eval(*") or
        (
          process.command_line like~ "*buffer.from*" and
          process.command_line like~ "*base64*"
        )
      )
    ) or
    (
      process.name == "pwsh" and
      process.command_line like~ (
        "* -e *", "* -en *", "* -enc *", "* -enco *", "* -encod *", "* -encode *", "* -encoded *",
        "* -encodedcommand *", "*frombase64string*"
      )
    ) or
    (
      process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "busybox") and
      process.command_line like~ ("*base64 -d*", "*base64 --decode*")
    )
  ) and
  not (
    process.parent.command_line like "*DAAAAAtAAAAOQAAAF0AAAArAAAAJAAAACAAAABdAAAAXQAAACAAAAAmAAAAJgAAACAAAABbAAAAIAAAACIAAAAkAAAAcwAAAGkAAABnAAAAbgAAAGEAAAB0AAAAdQAAAHIAAABlAAAAIgAAACAAAAAtAAAAZQAAAHEAAAAgAAAAMgAAADAAAAAwAAAAMgAAADAAAAA5AAAAIAAAAF0AAAA7AAAAIAAAAHQAAABoAAAAZQAAAG4AAAA*" or
    process.command_line like "/bin/bash -c base64 -d <<< IwAAAC*" or
    (
      process.parent.executable like "/var/lib/amazon/ssm/i-*/document/orchestration/*_script.sh" and
      process.working_directory == "/usr/bin" and
      process.command_line == "base64 --decode"
    ) or
    (
      process.working_directory like "/var/snap/amazon-ssm-agent/*" and
      process.parent.args like "/var/lib/amazon/ssm/*/document/orchestration/*/_script.sh" and
      process.name == "base64"
    ) or
    process.working_directory in ("/opt/SolarWinds/Agent/bin/Plugins/ADMProbe", "/root/control-center-packaging") or
    process.parent.executable in ("/usr/share/windsurf/windsurf", "/usr/share/cursor/cursor", "/usr/share/devin-desktop/devin-desktop") or
    process.parent.command_line like ("claude", "*__CURSOR_SANDBOX_ENV_RESTORE*") or
    (
      process.command_line like~ ("*eval*1337*SendConductor*", "*eval*KITTY_SSH_KITTEN_DATA_DIR*") and
      process.parent.name in ("sshd", "sshd-session")
    ) or
    process.command_line like "/bin/bash -c base64 -d <<< IwAAACAAAABHAAAAZQAAAHQAAAAgAAAAdAAAAGg*" or
    (
      process.parent.command_line like (
        "/bin/bash -c base64 -d <<< IwAAACAAAABHAAAAZQAAAHQAAAAgAAAAdAAAAGg*",
        "/bin/bash -c base64 -d <<< IwAAACEAAAAvAAAAYgAAAGkAAABuAAAAL*"
      ) and
      process.command_line == "base64 -d"
    ) or
    (process.working_directory like "/home/u.*" and process.parent.command_line like "bash -lc printf %s*") or 
    (process.working_directory == "/opt/Elastic/Endpoint/state/response_actions" and process.command_line == "base64 -d") or
    (process.working_directory == "/home/deploy" and user.name == "deploy" and process.parent.args == "bash") or
    process.entry_leader.executable == "/usr/sbin/qemu-ga"
  )]
  [process where event.type == "start" and event.action == "exec" and process.name like (
    "bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish",
    "python*", "perl*", "ruby*", "lua*", "php*", "node", "pwsh", "deno"
  ) and process.args_count == 1 and
  process.args like (
    "-bash", "-dash", "-sh", "-tcsh", "-csh", "-zsh", "-ksh", "-fish",
    "bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish",
    "/bin/bash", "/bin/dash", "/bin/sh", "/bin/tcsh", "/bin/csh",
    "/bin/zsh", "/bin/ksh", "/bin/fish",
    "/usr/bin/bash", "/usr/bin/dash", "/usr/bin/sh", "/usr/bin/tcsh",
    "/usr/bin/csh", "/usr/bin/zsh", "/usr/bin/ksh", "/usr/bin/fish",
    "python*", "/bin/python*", "/usr/bin/python*", "/usr/local/bin/python*",
    "perl*", "/bin/perl*", "/usr/bin/perl*", "/usr/local/bin/perl*",
    "ruby*", "/bin/ruby*", "/usr/bin/ruby*", "/usr/local/bin/ruby*",
    "lua*", "/bin/lua*", "/usr/bin/lua*", "/usr/local/bin/lua*",
    "php*", "/bin/php*", "/usr/bin/php*", "/usr/local/bin/php*",
    "node", "/bin/node", "/usr/bin/node", "/usr/local/bin/node",
    "pwsh", "/bin/pwsh", "/usr/bin/pwsh", "/usr/local/bin/pwsh",
    "deno", "/bin/deno", "/usr/bin/deno", "/usr/local/bin/deno",
    "/dev/fd/*"
  ) and
  not (
    process.parent.command_line in ("bash ./run_tests.sh unit-integration", "/bin/sh /var/lib/dpkg/info/nmap-common.postinst configure") or
    process.command_line == "/usr/bin/perl /usr/bin/shasum -a 256" or
    process.working_directory like (
      "/usr/local/zeek", "/opt/zeek", "/var/lib/docker/overlay2/*/opt/zeek", "/usr/local/zeek_old_install",
      "/var/lib/docker/overlay2/*/usr/local/zeek", "/proc/self/fd/*/usr/local/zeek"
    ) or
    (process.parent.name == "zsh" and process.parent.command_line like "*extendedglob*") or
    (process.name like "python*" and process.parent.name like "python*")
  )]
'''

min_endpoint_version = "8.3.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"


[[threat.technique]]
id = "T1204"
name = "User Execution"
reference = "https://attack.mitre.org/techniques/T1204/"
[[threat.technique.subtechnique]]
id = "T1204.002"
name = "Malicious File"
reference = "https://attack.mitre.org/techniques/T1204/002/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1027"
name = "Obfuscated Files or Information"
reference = "https://attack.mitre.org/techniques/T1027/"

[[threat.technique]]
id = "T1140"
name = "Deobfuscate/Decode Files or Information"
reference = "https://attack.mitre.org/techniques/T1140/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.3.0"

[rule]
description = """
Detects the deletion of shell history files through suspicious or commonly available tooling via a file deletion event.
Shell history files are used to store the command history of a user. Adversaries may attempt to delete these files to
remove evidence of their activity.
"""
id = "e2e24fba-2852-4e3c-be8d-fda553653522"
license = "Elastic License v2"
name = "Deletion of Shell History File"
os_list = ["linux"]
version = "1.0.2"

query = '''
file where event.type == "deletion" and file.name in (
  ".bash_history", ".zsh_history", ".sh_history", ".ksh_history",
  ".history", ".csh_history", ".tcsh_history", "fish_history", ".ash_history"
) and
/* Enforce non-backup home & root directories to prevent false positives */
(
  file.path like ("/home/*/*", "/root/*", "/etc/*") and
  not file.path like ("/home/*/*/*", "/root/*/*")
) and
(
  process.name in (
    "rm", "sudo", "truncate", "unlink", "find", "xargs", "install", "shred", "vi", "vim",
    "vim.basic", "coreutils", "tar", "gzip", "bzip2", "rmdir", "mv", "cp", "ln", "busybox",
    "bash", "zsh", "sh", "tcsh", "csh", "ksh", "fish"
  ) or
  process.name like ".*" or
  process.executable like (
    "./*", "/dev/shm/*", "/tmp/*", "/var/tmp/*", "/run/*", "/var/run/*", "/boot/*", "/sys/*",
    "/lost+found/*", "/proc/*", "/var/mail/*", "/var/www/*", "/root/*", "/home/*"
  )
)
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1070"
name = "Indicator Removal"
reference = "https://attack.mitre.org/techniques/T1070/"
[[threat.technique.subtechnique]]
id = "T1070.003"
name = "Clear Command History"
reference = "https://attack.mitre.org/techniques/T1070/003/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.15.0"

[rule]
description = """
Identifies when a Microsoft Office process loads a DLL and from a call stack pointing to Microsoft Office Visual Basic
for Applications modules. This may indicate an attempt to get initial access using malicious macro enabled documents.
"""
id = "9ebda43a-16dd-4d9e-ab7c-c1056e7d959a"
license = "Elastic License v2"
name = "DLL Loaded from a Macro Enabled Document"
os_list = ["windows"]
reference = [
    "https://www.elastic.co/security-labs/upping-the-ante-detecting-in-memory-threats-with-kernel-call-stacks",
]
version = "1.0.24"

query = '''
library where
   process.name : ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "mspub.exe", "fltldr.exe", "visio.exe") and
   (
    /* VBA */
    process.thread.Ext.call_stack_summary : "*|vbe?.dll*" or

    /* Shellcode RWX  */
    (_arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info : "Unbacked*" and $entry.protection : "RWX") and
     not process.thread.Ext.call_stack_summary : ("*|clr.dll|*", "*mscorwks.dll*", "*mscoreei.dll|mscoree.dll*", "*system.management.ni.dll*"))
   ) and

   /* Suspicious DLLs */
   (
    dll.name : "taskschd.dll" or
    dll.Ext.relative_file_creation_time <= 300 or
    ((dll.code_signature.trusted == false or dll.code_signature.exists == false) and not dll.path : ("?:\\Windows\\System32\\*", "?:\\Windows\\SysWOW64\\*"))
    ) and

    not dll.path :
           ("?:\\Windows\\assembly\\NativeImages_*.dll",
            "?:\\Windows\\System32\\spool\\drivers\\x64\\3\\*",
            "?:\\Program Files\\*",
            "?:\\Program Files (x86)\\*",
            "?:\\Windows\\Microsoft.NET\\Framework*", 
            "?:\\Windows\\system32\\scrrun.dll",
            "?:\\Windows\\syswow64\\scrrun.dll",
            "?:\\Windows\\SysWOW64\\THREED32.OCX",
            "C:\\blp\\*",
            "?:\\Windows\\System32\\DriverStore\\FileRepository\\*") and
    not dll.hash.sha256 :
                 ("a33c6d203ffa6941b1e498f52f6ef565c5d731c2deecbae067c0039208a8db25",
                  "4579447a18f557ef95cad8df77634370dbe7ddeaed8d319ea6e7a26ac1e79db6",
                  "f1c4e834f96abc5d787bd3d4efea008537eb44fd3e3b6560f8cef4eace525a62",
                  "902553c9ffdc9e9751c6045b50590613183d4a7cc730365f7d629729a43fedcd",
                  "b80eca5b58d276be4d66bda65599e609efde2811de252172eeccea803826d41f",
                  "a33c6d203ffa6941b1e498f52f6ef565c5d731c2deecbae067c0039208a8db25",
                  "f110d49ca78d0fe8ee0fa1824f7bb714359159e824a65a13f2fd5bb7d91b692a",
                  "90b3278ba2df87e4d61817adacf60f467359e0ff54dc793c0d5fdbc5fb087e59",
                  "2e531fdebdc3468c03922545ce169804400e3ebb577e08ec88a6561901d2c595",
                  "97c8afd6038b37729933ea0895760abe0a15b48258c46a04a0d010ed1ffa4e07",
                  "81fc25734e3876b34e287a1df17cb94483029534392fed50f0c629e40485660c",
                  "bd92610dd9504c6eef269b4c7b1bcaf9ebf28081bb81a82fc053035701182383",
                  "1e38e061ee5fcd4a76c591c24a39da005dc5fd58062ef8fadfe1ade95bfdbd4c",
                  "96c0caf8a7e7c087028c0793eb9a0ab21f7a4a7a5ca5c85a95ad1f4419a8186c",
                  "079cff190d73f4d1074844bf188588542cf3b52c22f775019fad113e0b63b14d",
                  "d661f1a025d99a98ebc6e42b3e69ae89379773821b2471ae138c4e55a5b63aa7",
                  "75e06078dd24506ffea81cf1615f5f9d9057abe2caf0067c396f20f3bea8b817",
                  "44185134b1f8c503c78e9dbc36891ba3fa109237c3dc79399955bf29e75921d4",
                  "9c2f359207114f5de82f080b08cbcfe723153b3f9c002c3f672a60e88c0d71b6")
'''

min_endpoint_version = "8.10.0"
reputation = true
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"
[[threat.technique.subtechnique]]
id = "T1566.001"
name = "Spearphishing Attachment"
reference = "https://attack.mitre.org/techniques/T1566/001/"



[threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"

[internal]
min_endpoint_version = "8.10.0"

[metadata]
creation_date = "2020/12/14"
integration = ["azure"]
maturity = "production"
updated_date = "2026/04/10"

[rule]
author = ["Elastic"]
description = """
Identifies when a new service principal is added in Microsoft Entra ID. An application, hosted service, or automated
tool that accesses or modifies resources needs an identity created. This identity is known as a service principal. For
security reasons, it's always recommended to use service principals with automated tools rather than allowing them to
log in with a user identity.
"""
false_positives = [
    """
    A service principal may be created by a system or network administrator. Verify whether the username, hostname,
    and/or resource name should be making changes in your environment. Service principal additions from unfamiliar users
    or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
    """,
]
from = "now-9m"
index = ["filebeat-*", "logs-azure.auditlogs-*"]
language = "kuery"
license = "Elastic License v2"
name = "Entra ID Service Principal Created"
note = """## Triage and analysis

### Investigating Entra ID Service Principal Created

Service Principals are identities used by applications, services, and automation tools to access specific resources. They grant specific access based on the assigned API permissions. Most organizations that work a lot with Azure AD make use of service principals. Whenever an application is registered, it automatically creates an application object and a service principal in an Azure AD tenant.

This rule looks for the addition of service principals. This behavior may enable attackers to impersonate legitimate service principals to camouflage their activities among noisy automations/apps.

#### Possible investigation steps

- Identify the user account that performed the action and whether it should perform this kind of action.
- Investigate other alerts associated with the user account during the past 48 hours.
- Consider the source IP address and geolocation for the user who issued the command. Do they look normal for the user?
- Consider the time of day. If the user is a human, not a program or script, did the activity take place during a normal time of day?
- Check if this operation was approved and performed according to the organization's change management policy.
- Contact the account owner and confirm whether they are aware of this activity.
- Examine the account's commands, API calls, and data management actions in the last 24 hours.
- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.

### False positive analysis

If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination of user and device conditions.

### Response and remediation

- Initiate the incident response process based on the outcome of the triage.
- Disable or limit the account during the investigation and response.
- Identify the possible impact of the incident and prioritize accordingly; the following actions can help you gain context:
    - Identify the account role in the cloud environment.
    - Assess the criticality of affected services and servers.
    - Work with your IT team to identify and minimize the impact on users.
    - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
    - Identify any regulatory or legal ramifications related to this activity.
- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
- Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.
- Consider enabling multi-factor authentication for users.
- Follow security best practices [outlined](https://docs.microsoft.com/en-us/azure/security/fundamentals/identity-management-best-practices) by Microsoft.
- Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
"""
references = [
    "https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/",
    "https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-create-service-principal-portal",
]
risk_score = 21
rule_id = "60b6b72f-0fbc-47e7-9895-9ba7627a8b50"
setup = """### Microsft Entra ID Audit Logs
This rule requires the Azure integration with Microsoft Entra ID Audit Logs data stream ingesting in your Elastic Stack deployment. For more information, refer to the [Microsoft Entra ID Audit Logs integration documentation](https://www.elastic.co/docs/reference/integrations/azure/adlogs).
"""
severity = "low"
tags = [
    "Domain: Cloud",
    "Data Source: Azure",
    "Data Source: Microsoft Entra ID",
    "Data Source: Microsoft Entra ID Audit Logs",
    "Use Case: Identity and Access Audit",
    "Resources: Investigation Guide",
    "Tactic: Persistence",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset:azure.auditlogs
    and azure.auditlogs.operation_name:"Add service principal"
    and event.outcome:(success or Success)
    and not azure.auditlogs.identity: (
        "Managed Service Identity" or
        "Windows Azure Service Management API" or
        "Microsoft Azure AD Internal - Jit Provisioning" or
        "AAD App Management" or
        "Power Virtual Agents Service"
        )
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1136"
name = "Create Account"
reference = "https://attack.mitre.org/techniques/T1136/"
[[rule.threat.technique.subtechnique]]
id = "T1136.003"
name = "Cloud Account"
reference = "https://attack.mitre.org/techniques/T1136/003/"



[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[metadata]
creation_date = "2026/01/28"
integration = ["fortinet_fortigate"]
maturity = "production"
updated_date = "2026/04/10"

[rule]
author = ["Elastic"]
description = """
This rule detects the first successful FortiCloud SSO login from a previously unseen source IP address to a FortiGate
device within the last 5 days. FortiCloud SSO logins from new source IPs may indicate exploitation of SAML-based
authentication bypass vulnerabilities such as CVE-2026-24858, where crafted SAML assertions allow unauthorized access to
FortiGate devices registered to other accounts. Environments that regularly use FortiCloud SSO will only alert on new
source IPs not seen in the lookback window.
"""
from = "now-7205m"
interval = "5m"
language = "esql"
license = "Elastic License v2"
name = "FortiGate FortiCloud SSO Login from Unusual Source"
note = """## Triage and analysis

### Investigating FortiGate FortiCloud SSO Login from Unusual Source

This alert indicates that a FortiCloud SSO login was observed from a source IP address not previously seen authenticating via SSO in the last 5 days. This is a high-value signal because it filters out routine SSO access from known management IPs and only fires on novel source addresses.

CVE-2026-24858 (FG-IR-26-060) allows attackers with a FortiCloud account and a registered device to craft SAML assertions that authenticate them as administrators on other FortiGate devices when FortiCloud SSO is enabled. This vulnerability has been actively exploited in the wild.

### Possible investigation steps

- Check `source.ip` against known corporate management networks, VPN egress points, and jump hosts. Investigate the IP's ASN and geolocation, as attacker IPs have been observed from The Constant Company LLC, BL Networks, Kaopu Cloud HK Limited, and Cloudflare-protected ranges.
- Determine whether this IP has been seen in any other authentication context across the environment.
- Check `Esql.user_values` for the SSO account name (typically an email address) and verify the account belongs to the organization. Compare against known attacker email IOCs: cloud-noc@mail.io, cloud-init@mail.io, heltaylor.12@tutamail.com, support@openmail.pro.
- Check `Esql.observer_name_values` to identify which FortiGate device was accessed and confirm whether FortiCloud SSO is intentionally enabled on the device.
- Look for local administrator account creation, configuration exports, firewall policy changes, or VPN user/group creation immediately following the SSO login. The observed attack pattern involves rogue admin creation within seconds of login.

### False positive analysis

- Administrators connecting from a new office location, hotel, or home network for the first time may trigger this alert.
- FortiCloud SSO access after IP address changes such as ISP rotation or VPN egress changes can appear as a new source IP.
- First login after FortiCloud SSO is initially enabled on a device will fire since no historical SSO logins exist.

### Response and remediation

- If the activity is unauthorized, disable FortiCloud SSO immediately using `config system global` > `set admin-forticloud-sso-login disable`.
- Audit all administrator accounts for unauthorized additions and review and restore configuration from a known-clean backup.
- Rotate all credentials including any LDAP/AD accounts connected to the device.
- Upgrade FortiOS to a patched version.
- If the activity is expected, document the new source IP and consider adding an exception if it represents a new management location."""
references = [
    "https://www.fortiguard.com/psirt/FG-IR-26-060",
    "https://www.fortinet.com/blog/psirt-blogs/analysis-of-sso-abuse-on-fortios",
    "https://www.elastic.co/docs/reference/integrations/fortinet_fortigate",
    "https://www.cisa.gov/news-events/alerts/2026/01/28/fortinet-releases-guidance-address-ongoing-exploitation-authentication-bypass-vulnerability-cve-2026",
]
risk_score = 47
rule_id = "618a219d-a363-4ab1-ba30-870d7c22facd"
severity = "medium"
tags = [
    "Use Case: Threat Detection",
    "Tactic: Initial Access",
    "Tactic: Credential Access",
    "Resources: Investigation Guide",
    "Domain: Network",
    "Domain: Identity",
    "Data Source: Fortinet",
    "Data Source: Fortinet FortiGate",
]
timestamp_override = "event.ingested"
type = "esql"

query = '''
FROM logs-fortinet_fortigate.* metadata _id, _version, _index

| WHERE data_stream.dataset == "fortinet_fortigate.log" and
        event.category == "authentication" and event.action == "login" and
        event.outcome == "success" and
        (fortinet.firewall.method == "sso" or fortinet.firewall.ui like "sso*") and
        source.ip is not null
| STATS Esql.logon_count = COUNT(*),
        Esql.first_time_seen = MIN(@timestamp),
        Esql.user_values = VALUES(source.user.name),
        Esql.observer_name_values = VALUES(observer.name),
        Esql.message_values = VALUES(message) BY source.ip

// first time seen is within 6m of the rule execution time and for the last 5d of events history
| EVAL Esql.recent = DATE_DIFF("minute", Esql.first_time_seen, now())
| WHERE Esql.recent <= 6 AND Esql.logon_count == 1

// move dynamic fields to ECS equivalent for rule exceptions
| EVAL source.user.name = MV_FIRST(Esql.user_values)

| KEEP source.ip, source.user.name, Esql.*
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"

[[rule.threat.technique.subtechnique]]
id = "T1078.004"
name = "Cloud Accounts"
reference = "https://attack.mitre.org/techniques/T1078/004/"

[[rule.threat.technique]]
id = "T1190"
name = "Exploit Public-Facing Application"
reference = "https://attack.mitre.org/techniques/T1190/"

[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1606"
name = "Forge Web Credentials"
reference = "https://attack.mitre.org/techniques/T1606/"

[[rule.threat.technique.subtechnique]]
id = "T1606.002"
name = "SAML Tokens"
reference = "https://attack.mitre.org/techniques/T1606/002/"

[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[metadata]
creation_date = "2020/11/17"
integration = ["google_workspace"]
maturity = "production"
updated_date = "2026/06/01"

[rule]
author = ["Elastic"]
description = """
Detects when a Google Workspace administrator modifies organization password policy settings. Adversaries with
administrative access may weaken password requirements, such as disabling strong password enforcement, allowing password
reuse, or reducing minimum length, to increase the success of password spraying and credential stuffing against tenant
accounts and to sustain access after initial compromise.
"""
false_positives = [
    """
    Password policies may be modified by system administrators. Verify that the configuration change was expected.
    Exceptions can be added to this rule to filter expected behavior.
    """,
]
from = "now-130m"
index = ["filebeat-*", "logs-google_workspace.admin-*"]
interval = "10m"
language = "kuery"
license = "Elastic License v2"
name = "Google Workspace Password Policy Modified"
note = """## Triage and analysis

### Investigating Google Workspace Password Policy Modified

Threat actors with Google Workspace administrative access may modify tenant password policies to weaken authentication
controls across an organizational unit or domain. Relaxing password complexity, reuse, or rotation requirements increases
the likelihood of successful password spraying, credential stuffing, and reuse of passwords exposed in third-party
breaches. Because policy changes apply to all users in scope, a single modification can materially expand the attack
surface for the entire unit.

Saving changes in the Admin console can update multiple password settings at once. Google logs each setting change as a
separate `CHANGE_APPLICATION_SETTING` or `CREATE_APPLICATION_SETTING` event (for example, minimum length, maximum
length, reset frequency, strong password enforcement, and password reuse). Alert suppression groups by `user.email`,
`google_workspace.admin.org_unit.name`, and `source.ip` within the rule lookback so analysts receive one alert per
password policy modification session instead of one alert per setting.

### Possible investigation steps

- Identify the initiating (actor) administrator by reviewing `user.email` or `user.name`, and note the `source.ip` and `event.ingested` timestamps.
- Identify the setting changed in the alert by reviewing `google_workspace.admin.setting.name`.
- Review `google_workspace.admin.old_value` and `google_workspace.admin.new_value` to determine whether the change weakened policy. Examples of high-risk changes include:
  - `Password Management - Enforce strong password` set to disabled
  - `Password Management - Enable password reuse` set to enabled
  - `Password Management - Minimum password length` reduced
  - `Password Management - Password reset frequency` increased (less frequent rotation)
- Identify the scope of impact by reviewing `google_workspace.admin.org_unit.name` and determining which users inherit the updated policy.
- Determine whether the modification is expected and authorized:
  - If the actor account or `source.ip` is unusual, treat the alert as higher priority until proven benign.
- Search Kibana for all password settings changed in the session:
  - In Discover (or the alert investigation workflow), search Google Workspace admin logs with a time range centered on the alert timestamp (±5 minutes).
  - Use the following KQL example, replacing `<ACTOR_EMAIL>` and `<ORG_UNIT>` as needed:
    ```
    data_stream.dataset: "google_workspace.admin" and event.action: ("CHANGE_APPLICATION_SETTING" or "CREATE_APPLICATION_SETTING") and user.email: "<ACTOR_EMAIL>" and google_workspace.admin.setting.name: Password Management - *
    ```
  - Optionally filter on `google_workspace.admin.org_unit.name: "<ORG_UNIT>"` to isolate changes for the same organizational unit.
  - Review all `google_workspace.admin.setting.name`, `google_workspace.admin.old_value`, and `google_workspace.admin.new_value` fields returned to understand the full scope of the modification.
- Scope for related activity by searching for the same `user.email` performing other security-weakening admin actions within the last 48 hours, such as MFA enforcement changes, SSO/SAML modifications, or role assignments.

### False positive analysis

- Verify the password policy change aligns with an approved change window, compliance exception, or migration activity.
- Policy hardening can also generate alerts for this rule — use `old_value` and `new_value` to distinguish benign hardening from weakening changes.

### Response and remediation

- Initiate the incident response process based on triage findings.
- If the modification is not clearly authorized, restore password policy settings to their prior values for the affected organizational unit while the investigation proceeds.
- If the initiating admin account is suspected compromised, reset credentials, revoke active sessions, and review delegated admin roles assigned to that account.
- Identify the possible impact of the incident and prioritize accordingly; the following actions can help you gain context:
    - Identify the account role in the cloud environment.
    - Assess the criticality of affected services and servers.
    - Work with your IT team to identify and minimize the impact on users.
    - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
    - Identify any regulatory or legal ramifications related to this activity.
- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified.
- Review the permissions assigned to the implicated administrator to ensure that the least privilege principle is being followed.
- Implement security best practices [outlined](https://support.google.com/a/answer/7587183) by Google.
- Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).

## Setup

The Google Workspace Fleet integration, the Filebeat module, or data that's similarly structured is required for this rule.

### Important Information Regarding Google Workspace Event Lag Times
- As per Google's documentation, Google Workspace administrators might observe lag times ranging from several minutes to 3 days between the event occurrence time and the event being visible in the Google Workspace admin/audit logs.
- This rule is configured to run every 10 minutes with a lookback time of 130 minutes.
- To reduce the risk of false negatives, consider reducing the interval that the Google Workspace (formerly G Suite) Filebeat module polls Google's reporting API for new events.
- By default, `var.interval` is set to 2 hours (2h). Consider changing this interval to a lower value, such as 10 minutes (10m).
- See the following references for further information:
  - https://support.google.com/a/answer/7061566
  - https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-google_workspace.html"""
references = [
    "https://support.google.com/a/answer/7061566",
    "https://www.elastic.co/security-labs/google-workspace-attack-surface-part-one",
    "https://www.elastic.co/security-labs/google-workspace-attack-surface-part-two"
]
risk_score = 47
rule_id = "a99f82f5-8e77-4f8b-b3ce-10c0f6afbc73"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Data Source: Google Workspace",
    "Use Case: Identity and Access Audit",
    "Tactic: Persistence",
    "Tactic: Defense Evasion",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset:google_workspace.admin and
  event.action:(CHANGE_APPLICATION_SETTING or CREATE_APPLICATION_SETTING) and
  google_workspace.admin.setting.name:(
    "Password Management - Enforce strong password" or
    "Password Management - Password reset frequency" or
    "Password Management - Enable password reuse" or
    "Password Management - Enforce password policy at next login" or
    "Password Management - Minimum password length" or
    "Password Management - Maximum password length"
  )
'''

[rule.alert_suppression]
group_by = ["user.email", "google_workspace.admin.org_unit.name", "source.ip"]
duration = {value = 130, unit = "m"}
missing_fields_strategy = "suppress"

[rule.investigation_fields]
field_names = [
    "user.name",
    "user.email",
    "source.ip",
    "event.action",
    "google_workspace.admin.setting.name",
    "google_workspace.admin.org_unit.name",
    "google_workspace.admin.old_value",
    "google_workspace.admin.new_value",
]

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1484"
name = "Domain or Tenant Policy Modification"
reference = "https://attack.mitre.org/techniques/T1484/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[metadata]
creation_date = "2020/08/18"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2026/04/24"

[rule]
author = ["Elastic"]
description = """
Identifies use of aspnet_regiis to decrypt Microsoft IIS connection strings. An attacker with Microsoft IIS web server
access via a webshell or similar access can decrypt and dump any hardcoded connection strings, such as the MSSQL service
account password using the aspnet_regiis command.
"""
from = "now-9m"
index = [
    "endgame-*",
    "logs-crowdstrike.fdr*",
    "logs-endpoint.events.process-*",
    "logs-m365_defender.event-*",
    "logs-sentinel_one_cloud_funnel.*",
    "logs-system.security*",
    "logs-windows.forwarded*",
    "logs-windows.sysmon_operational-*",
    "winlogbeat-*",
]
language = "eql"
license = "Elastic License v2"
max_signals = 33
name = "Microsoft IIS Connection Strings Decryption"
references = [
    "https://www.netspi.com/blog/technical-blog/network-pentesting/decrypting-iis-passwords-to-break-out-of-the-dmz-part-1/",
    "https://symantec-enterprise-blogs.security.com/blog-post/greenbug-espionage-telco-south-asia",
]
risk_score = 73
rule_id = "c25e9c87-95e1-4368-bfab-9fd34cf867ec"
severity = "high"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Credential Access",
    "Data Source: Elastic Endgame",
    "Data Source: Elastic Defend",
    "Data Source: Windows Security Event Logs",
    "Data Source: Microsoft Defender XDR",
    "Data Source: Sysmon",
    "Data Source: SentinelOne",
    "Data Source: Crowdstrike",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
process where host.os.type == "windows" and event.type == "start" and
  (process.name : "aspnet_regiis.exe" or ?process.pe.original_file_name == "aspnet_regiis.exe") and
  process.args : "connectionStrings" and process.args : ("-pdf", "-pd")
'''

note = """## Triage and analysis

### Investigating Microsoft IIS Connection Strings Decryption

#### Possible investigation steps

- Which protected IIS configuration section and application path did the command expose?
  - Focus: `process.command_line` and `process.working_directory` for the protected-section decrypt operation ("connectionStrings" with "-pdf" or "-pd") and the target application path.
  - Implication: escalate faster when the target is a production web root, shared IIS configuration path, copied temp tree, or folder unrelated to the named IIS site; lower concern at this step only for a staging or development target path. Path context alone never closes the alert.

- Is the aspnet_regiis instance the expected signed .NET utility in the expected launch context?
  - Focus: `process.executable`, `process.code_signature.subject_name`, `process.code_signature.trusted`, and `process.parent.command_line`.
  - Implication: escalate when the binary is renamed, unsigned, user-writable, or launched from a shell, script host, IIS worker lineage, or remote-admin chain that does not fit the workflow. Expected Microsoft identity reduces masquerade concern, but never clears the decrypt action by itself.

- Do the user, parent chain, and session type fit IIS administration on this host?
  - Focus: `user.id`, `process.parent.command_line`, and `process.Ext.session_info.logon_type`.
  - Hint: If parent lineage remains unclear, expand ancestry before accepting an IIS administration explanation.
  - Implication: escalate when an unusual user, web-content lineage, remote-interactive session, service context, or unusual admin context performs the decrypt; lower concern when the same user/host pair and parent workflow recur for IIS administration on this server.

- Did follow-on process activity expose, stage, or reuse the recovered secrets?
  - Focus: child and same-parent process starts, reading `process.executable` and `process.command_line` for shells, PowerShell, archive utilities, SQL clients, config copies, or output commands. $investigate_2
  - Hint: use sibling command lines to look for "aspnet_regiis -pdf appSettings", "aspnet_regiis -px", or direct IIS config-copy commands; if `process.entity_id` is absent, use the `host.id` + `process.parent.pid` or `process.pid` fallback branches in a tight alert-time window.
  - Implication: escalate when decryption is followed by shell output, copied configs, archive creation, SQL tooling such as sqlcmd/osql/isql, PowerShell database testing, or additional protected-section access.

- If available, do process-scoped file records corroborate config staging?
  - Focus: file activity scoped by `host.id` and `process.entity_id`, or direct children through `process.parent.entity_id`, for config copies, temp staging, and archives. $investigate_3
  - Implication: escalate when available records show copied "web.config", "applicationHost.config", or "machine.config" material, temp staging, or archive output. If `process.entity_id` is absent, use `host.id` + `process.pid` in a tight alert window; missing endpoint file telemetry is unresolved, not benign.

- If available, do process-scoped network records corroborate SQL access or transfer?
  - Focus: network activity scoped by `host.id` and `process.entity_id`, or direct children through `process.parent.entity_id`, for database, proxy, external, or share destinations. $investigate_4
  - Implication: escalate when available records show database connectivity, proxy use, external egress, or remote staging after the decrypt. If `process.entity_id` is absent, use `host.id` + `process.pid` in a tight alert window. Missing network telemetry is unresolved, not benign.

- If local findings remain suspicious or incomplete, do related alerts show broader credential-access activity?
  - Focus: related alerts for `user.id`, especially webshell execution, privilege escalation, lateral movement, SQL testing, archive/exfiltration, or repeated credential access. $investigate_0
  - Hint: compare `host.id` alerts for webshell, staging, exfiltration, persistence, or repeated aspnet_regiis activity on the IIS asset. $investigate_1
  - Implication: broaden response when either scope shows complementary webshell, staging, SQL access, or credential-access activity. No related alerts only limits scope; it does not close the decrypt activity.

- Based on the evidence gathered, what disposition is supported?
  - Focus: `process.command_line`, `process.executable`, `process.code_signature.subject_name`, `process.parent.command_line`, `process.Ext.session_info.logon_type`, optional file/network corroboration, and related-alert scope.
  - Implication: escalate when those categories show unrecognized decryption, config staging, SQL testing, or secret reuse; close only when telemetry from the same categories aligns with one exact IIS maintenance, deployment, migration, or recovery workflow, using outside confirmation only to corroborate that exact activity; preserve and escalate if evidence is mixed or incomplete.

### False positive analysis

- Recognized IIS maintenance, deployment, or migration can legitimately run aspnet_regiis against connection strings. Confirm only when telemetry shows the utility path and signer, parent workflow, command target, `user.id`, `host.id`, and follow-on process activity all align with the same change.
- IR/recovery can also be legitimate when responders decrypt a known application path to restore service or rotate secrets. Confirm that config copies, SQL testing, transfer evidence, and credential rotation stay inside the recovery scope; if external records are unavailable, close only when this alert's telemetry is complete and non-contradictory.
- Build exceptions from the minimum confirmed workflow: `process.executable`, `process.code_signature.subject_name`, parent workflow, exact target path, `user.id`, and `host.id`. Avoid exceptions on aspnet_regiis alone, "connectionStrings" alone, or host alone.

### Response and remediation

- If confirmed benign, document the recognized utility path, target path, operator, session type, parent lineage, and follow-on activity before reversing temporary containment. Create an exception only if that same pattern recurs across prior alerts from this rule.
- If suspicious but unconfirmed, preserve the recovered `process.entity_id`, `process.command_line`, target application path, child-process lineage, copied config material, archive names, and any confirmed destinations before destructive changes. Apply reversible containment first, such as temporarily restricting outbound connectivity or share access for the affected `host.id`; escalate to host isolation or account action only if follow-on commands, copied configs, or related alerts show broader compromise and the IIS host can tolerate it.
- If confirmed malicious, preserve the same artifacts, then use endpoint response to isolate the host or terminate the responsible process. If direct response is unavailable, escalate with the preserved artifact set to the team that can act.
- Rotate the credentials exposed by the targeted connection strings, including database passwords, service-account secrets, and any downstream application credentials discovered during the investigation. Prioritize credentials tied to production databases or shared service accounts.
- Before deleting or restoring anything, review related `host.id` and `user.id` activity for the same aspnet_regiis arguments, targeted config paths, copied config filenames, database destinations, and adjacent protected-section abuse such as "aspnet_regiis -pdf appSettings" or "aspnet_regiis -px". Then eradicate the webshells, scripts, copied configuration files, archives, and persistence mechanisms uncovered during the investigation, and remediate the initial access or privilege path that allowed the decrypt action.
- After containment, scope other hosts for the same aspnet_regiis arguments, targeted config paths, follow-on database or archive activity, and adjacent protected-section abuse ("aspnet_regiis -pdf appSettings", "aspnet_regiis -px", or direct IIS config copies).
- Post-incident hardening: restrict aspnet_regiis use against production IIS paths to recognized administration workflows and document the recognized target-path and destination patterns that justified any exception.
"""

setup = """## Setup

This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.

Setup instructions: https://ela.st/install-elastic-defend

### Additional data sources

This rule also supports the following third-party data sources. For setup instructions, refer to the links below:

- [CrowdStrike](https://ela.st/crowdstrike-integration)
- [Microsoft Defender XDR](https://ela.st/m365-defender)
- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
- [Sysmon Event ID 1 - Process Creation](https://ela.st/sysmon-event-1-setup)
- [Windows Process Creation Logs](https://ela.st/audit-process-creation)
"""

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "host.id",
    "user.name",
    "user.id",
    "process.entity_id",
    "process.pid",
    "process.executable",
    "process.command_line",
    "process.working_directory",
    "process.pe.original_file_name",
    "process.parent.entity_id",
    "process.parent.executable",
    "process.parent.command_line",
    "process.code_signature.subject_name",
    "process.Ext.session_info.logon_type",
]

[[transform.investigate]]
label = "Alerts associated with the user"
description = ""
providers = [
  [
    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
    { excluded = false, field = "user.id", queryType = "phrase", value = "{{user.id}}", valueType = "string" }
  ]
]
relativeFrom = "now-48h/h"
relativeTo = "now"

[[transform.investigate]]
label = "Alerts associated with the host"
description = ""
providers = [
  [
    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" }
  ]
]
relativeFrom = "now-48h/h"
relativeTo = "now"

[[transform.investigate]]
label = "Child and sibling processes near aspnet_regiis"
description = ""
providers = [
  [
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "process.parent.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" },
    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" }
  ],
  [
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "process.parent.pid", queryType = "phrase", value = "{{process.pid}}", valueType = "string" },
    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" }
  ],
  [
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "process.parent.entity_id", queryType = "phrase", value = "{{process.parent.entity_id}}", valueType = "string" },
    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" }
  ],
  [
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "process.parent.pid", queryType = "phrase", value = "{{process.parent.pid}}", valueType = "string" },
    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" }
  ]
]
relativeFrom = "now-1h"
relativeTo = "now"

[[transform.investigate]]
label = "File activity for aspnet_regiis and children"
description = ""
providers = [
  [
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" },
    { excluded = false, field = "event.category", queryType = "phrase", value = "file", valueType = "string" }
  ],
  [
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "process.parent.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" },
    { excluded = false, field = "event.category", queryType = "phrase", value = "file", valueType = "string" }
  ]
]
relativeFrom = "now-1h"
relativeTo = "now"

[[transform.investigate]]
label = "Network activity for aspnet_regiis and children"
description = ""
providers = [
  [
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" },
    { excluded = false, field = "event.category", queryType = "phrase", value = "network", valueType = "string" }
  ],
  [
    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
    { excluded = false, field = "process.parent.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" },
    { excluded = false, field = "event.category", queryType = "phrase", value = "network", valueType = "string" }
  ]
]
relativeFrom = "now-1h"
relativeTo = "now"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1003"
name = "OS Credential Dumping"
reference = "https://attack.mitre.org/techniques/T1003/"

[[rule.threat.technique]]
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"

[[rule.threat.technique.subtechnique]]
id = "T1552.001"
name = "Credentials In Files"
reference = "https://attack.mitre.org/techniques/T1552/001/"

[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"