Elastic rules: 37

[metadata]
creation_date = "2024/04/17"
integration = ["aws"]
maturity = "production"
updated_date = "2026/08/05"

[rule]
author = ["Elastic"]
description = """
Detects when an Amazon S3 bucket policy is modified to share access with an external AWS account. This rule analyzes
PutBucketPolicy events and compares the S3 bucket’s account ID to any account IDs referenced in the policy’s
Effect=Allow statements. If the policy includes principals from accounts other than the bucket owner’s, the rule
triggers an alert. This behavior may indicate an adversary backdooring a bucket for data exfiltration or cross-account
persistence. For example, an attacker who compromises credentials could attach a policy allowing access from an external
AWS account they control, enabling continued access even after credentials are rotated. Note: This rule will not alert
if the account ID is part of the bucket’s name or appears in the resource ARN. Such cases are common in standardized
naming conventions (e.g., “mybucket-123456789012”). To ensure full coverage, use complementary rules to monitor for
suspicious PutBucketPolicy API requests targeting buckets with account IDs embedded in their names or resources.
"""
event_category_override = "event.type"
false_positives = [
    """
    Legitimate changes to share an S3 bucket with an external account may be identified as false positives.
    """,
]
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
language = "eql"
license = "Elastic License v2"
name = "AWS S3 Bucket Policy Added to Share with External Account"
note = """## Triage and analysis

### Investigating AWS S3 Bucket Policy Added to Share with External Account

This rule detects when an S3 bucket policy is modified using the `PutBucketPolicy` API call to include an external AWS account ID.
It compares the bucket’s `recipient_account_id` to any account IDs included in the policy’s `Effect=Allow` statement, triggering
an alert if the two do not match.  

Adversaries may exploit this to backdoor a bucket and exfiltrate sensitive data by granting permissions to another AWS account
they control, enabling ongoing access to the bucket’s contents even if IAM credentials are rotated or revoked.

This detection specifically focuses on policy-based sharing and does not alert when:
- The account ID appears within the bucket or object name being shared.
- The account owner explicitly matches the policy’s condition keys on something other than an ARN or account id (i.e. IP address).
  
To fully monitor for suspicious sharing behavior, use this rule in combination with detections for:
- Unusual PutBucketPolicy requests
- Cross-account object access (e.g., `GetObject`, `PutObject`)
- Changes to bucket ACLs or access points

#### Possible investigation steps

- **Identify the Actor and Context**
  - Review `aws.cloudtrail.user_identity.arn` and `aws.cloudtrail.user_identity.access_key_id` to identify who made the change.
  - Determine if the identity typically manages S3 bucket policies.  
  - Examine `aws.cloudtrail.resources.arn` to determine which bucket is being shared.

- **Analyze the Policy Change**
  - Review `aws.cloudtrail.request_parameters` to extract the policy JSON and identify the external AWS account ID(s) referenced.  
  - Check for `Effect=Allow` statements granting broad permissions such as `"Action": "s3:*"` or `"Resource": "*"`.  
  - Verify if the added principals correspond to known partners or external vendors.
  - If AWS account ID(s) were only part of `Effect=Deny` statements, then this rule can be closed as a false positive. 

- **Review Context and Source**
  - Check `source.ip`, `source.geo`, and `user_agent.original` for anomalies — such as new IP ranges, access from unfamiliar geographies, or use of programmatic clients (`boto3`, `aws-cli`).

- **Correlate with Related Activity**
  - Search CloudTrail for subsequent activity by the external AWS account ID(s):
    - `GetObject`, `ListBucket`, or `PutObject` events that indicate data access or exfiltration.
  - Look for additional configuration changes by the same actor, such as:
    - `PutBucketAcl`, `PutBucketVersioning`, or `PutBucketReplication` — often part of a larger bucket compromise chain.
  - Determine if multiple buckets were modified in quick succession.

- **Validate Intent**
  - Review internal change requests or documentation to confirm whether this external sharing was approved.  
  - If no approval exists, escalate immediately for potential compromise.

### False positive analysis

- **Authorized Cross-Account Access**
  - Some organizations legitimately share S3 buckets across accounts within a trusted AWS Organization or partner accounts.  
  - Validate whether the external account ID belongs to a known entity or service provider and is documented in your allowlist.
- **Automation or Deployment Pipelines**
  - Continuous integration/deployment pipelines may temporarily attach cross-account policies for replication or staging.  
  - Verify the `user_agent.original` or role name — automation often includes identifiable strings.
- **Naming and Rule Logic Limitations**
  - This rule excludes detections where the account ID appears in the bucket resource ARN (e.g., `mybucket-123456789012`).  
  - Such patterns are common in automated provisioning. For those scenarios, rely on complementary rules that directly monitor `PutBucketPolicy` events against those buckets.

### Response and remediation

- **Immediate Review and Containment**
  - If unauthorized sharing is confirmed, use the AWS CLI or Console to delete or revert the modified policy (`aws s3api delete-bucket-policy` or restore from version control).  
  - Remove external principals and reapply the correct bucket policy.  
  - Rotate access keys for the actor involved, especially if API access came from unexpected locations or tools.

- **Investigation and Scoping**
  - Identify whether data was accessed by the external account via `GetObject` or `ListBucket` operations.  
  - Search CloudTrail logs for other buckets modified by the same actor or IP within the same timeframe.
  - Use AWS Config to review version history of affected bucket policies and detect similar cross-account permissions.

- **Recovery and Hardening**
  - Restrict `s3:PutBucketPolicy` to a limited set of administrative roles using least privilege.
  - Enable AWS Config rule `s3-bucket-policy-grantee-check` to monitor for unauthorized policy additions.
  - Use AWS GuardDuty or Security Hub findings to correlate policy changes with data exfiltration or credential compromise events.
  - Apply service control policies (SCPs) to block cross-account sharing unless explicitly approved.

### Additional information
  - **[AWS IR Playbooks](https://github.com/aws-samples/aws-incident-response-playbooks/blob/c151b0dc091755fffd4d662a8f29e2f6794da52c/playbooks/)** 
  - **[AWS Customer Playbook Framework](https://github.com/aws-samples/aws-customer-playbook-framework/tree/a8c7b313636b406a375952ac00b2d68e89a991f2/docs)** 
  - **Security Best Practices:** [AWS Knowledge Center – Security Best Practices](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/).
"""
references = [
    "https://stratus-red-team.cloud/attack-techniques/AWS/aws.exfiltration.s3-backdoor-bucket-policy/",
    "https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketPolicy.html",
]
risk_score = 47
rule_id = "e8c9ff14-fd1e-11ee-a0df-f661ea17fbce"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Platform: AWS",
    "Data Source: AWS CloudTrail",
    "Service: AWS S3",
    "Tactic: Collection",
    "Tactic: Exfiltration",
    "Rule Type: Event Correlation (EQL)",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
info where data_stream.dataset == "aws.cloudtrail"
    and event.provider == "s3.amazonaws.com"
    and event.action == "PutBucketPolicy" 
    and event.outcome == "success"
    and stringContains(aws.cloudtrail.request_parameters, "Effect=Allow")
    and (
        stringContains(aws.cloudtrail.request_parameters, "AWS=") or 
        stringContains(aws.cloudtrail.request_parameters, "aws:PrincipalAccount=") or
        stringContains(aws.cloudtrail.request_parameters, "aws:SourceAccount=")
        )
and not stringContains(aws.cloudtrail.request_parameters, "arn:aws:cloudfront::")  
and not stringContains(aws.cloudtrail.request_parameters, "arn:aws:iam::cloudfront:user")
and not stringContains(aws.cloudtrail.request_parameters, aws.cloudtrail.recipient_account_id)
    and not user_agent.original like~ ("*Terraform*", "*Pulumi*")
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1537"
name = "Transfer Data to Cloud Account"
reference = "https://attack.mitre.org/techniques/T1537/"

[rule.threat.tactic]
id = "TA0010"
name = "Exfiltration"
reference = "https://attack.mitre.org/tactics/TA0010/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1530"
name = "Data from Cloud Storage"
reference = "https://attack.mitre.org/techniques/T1530/"

[rule.threat.tactic]
id = "TA0009"
name = "Collection"
reference = "https://attack.mitre.org/tactics/TA0009/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user_agent.original",
    "source.ip",
    "aws.cloudtrail.user_identity.arn",
    "aws.cloudtrail.user_identity.type",
    "aws.cloudtrail.user_identity.access_key_id",
    "aws.cloudtrail.resources.arn",
    "aws.cloudtrail.resources.type",
    "event.action",
    "event.outcome",
    "cloud.account.id",
    "cloud.region",
    "aws.cloudtrail.request_parameters",
    "aws.cloudtrail.response_elements",
]

[metadata]
creation_date = "2026/05/22"
integration = ["azure"]
maturity = "production"
updated_date = "2026/05/22"

[rule]
author = ["Elastic"]
description = """
Identifies Azure AD Graph (graph.windows.net) requests where the combination of calling OAuth client
("azure.aadgraphactivitylogs.properties.app_id") and signed-in user ("user.id") has not been observed in the tenant in
a historical window. A user appearing against AAD Graph under an OAuth client that has not previously authenticated
that user is a sign of a FOCI swap, a phished refresh token being redeemed for a new client, or an adversary running
tooling under a client identity the user does not normally use.
"""
false_positives = [
    """
    First-time use of a legitimate first-party or sanctioned client by the user (newly installed app, first sign-in to a
    workload, fresh PowerShell module install). Validate by `azure.aadgraphactivitylogs.properties.app_id` and the
    user's history.
    """,
    """
    Authorized red team or audit activity. Add exceptions on the calling user after review.
    """,
]
from = "now-9m"
index = ["logs-azure.aadgraphactivitylogs-*"]
language = "kuery"
license = "Elastic License v2"
name = "Azure AD Graph Access with Unusual Client and User"
note = """## Triage and analysis

### Investigating Azure AD Graph Access with Unusual Client and User

A (client, user) pair appearing on AAD Graph for the first time in 14 days is a high-signal indicator. Legacy
AAD Graph traffic is dominated by a small set of recognised first-party callers per user; new combinations
suggest one of:

- A FOCI refresh-token swap landed under a new client identity.
- The user newly consented to (or was phished into consenting to) an OAuth application.
- An adversary is using stolen tokens / credentials under a client identity the user does not normally use.

### Possible investigation steps

- Identify the calling client and confirm whether the app is sanctioned.
    - `azure.aadgraphactivitylogs.properties.app_id`. Pivot to Azure portal → Enterprise Applications to check whether it is first-party, sanctioned third-party, or unfamiliar.
- Identify the user and check the surrounding auth context.
    - `user.id`, then pivot to sign-in logs (`logs-azure.signinlogs-*`) for the same user around the same time. Look for unusual sign-in geography, MFA bypass, or risky session signals.
- Review source posture.
    - `user_agent.original`, `source.ip`, `source.as.organization.name`. Residential / VPS / anonymising-network egress raises priority.
- Review what was queried.
    - `url.path`. Bulk recon or User-collection access via internal API versions raises triage priority.
- Check tenant-wide blast radius for the client.
    - Is the same client ID hitting AAD Graph for many other users? That pattern points to large-scale consent abuse rather than a single account compromise.
- Confirm the activity is not attributable to authorized testing (red team engagement, penetration test, internal tooling validation) before treating as malicious.

### Response and remediation

- Revoke refresh tokens and active sessions for the calling user.
    - `POST /v1.0/users/{id}/revokeSignInSessions`.
- Temporarily disable the user if the alert is high-confidence or you need to halt further activity while investigation continues.
    - `PATCH /v1.0/users/{id}` with body `{"accountEnabled": false}`.
- If the client is not a sanctioned application, revoke its OAuth consent.
    - `GET /v1.0/oauth2PermissionGrants?$filter=clientId eq '{servicePrincipalId}'`, then `DELETE /v1.0/oauth2PermissionGrants/{grantId}`.
- Check for device registrations created by the user during or around the burst window and remove rogue devices.
    - `GET /v1.0/users/{id}/registeredDevices` and `GET /v1.0/users/{id}/ownedDevices`, then `DELETE /v1.0/devices/{deviceObjectId}`.
    - Do this BEFORE session revocation: device-bound PRTs survive `revokeSignInSessions`.
- If the calling application has no legitimate AAD Graph dependency, block further use by that app.
    - `PATCH /beta/applications/{id}` with body `{"authenticationBehaviors": {"blockAzureADGraphAccess": true}}`.
    - This property lives on the Graph beta endpoint, not v1.0.
"""
references = [
    "https://github.com/secureworks/family-of-client-ids-research",
    "https://learn.microsoft.com/en-us/graph/migrate-azure-ad-graph-overview",
    "https://dirkjanm.io/phishing-for-microsoft-entra-primary-refresh-tokens/",
]
risk_score = 47
rule_id = "fd9d2933-f0f9-4aac-810c-a31f6a4a7890"
setup = """#### Azure AD Graph Activity Logs
Requires Azure AD Graph Activity Logs ingested into `logs-azure.aadgraphactivitylogs-*` via the Elastic Azure
integration. Enable the `AzureADGraphActivityLogs` diagnostic-settings category on Entra ID.
"""
severity = "medium"
tags = [
    "Domain: Cloud",
    "Data Source: Azure",
    "Data Source: Azure AD Graph",
    "Data Source: Azure AD Graph Activity Logs",
    "Use Case: Threat Detection",
    "Tactic: Defense Evasion",
    "Tactic: Discovery",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "new_terms"

query = '''
data_stream.dataset:"azure.aadgraphactivitylogs" and
    azure.aadgraphactivitylogs.properties.actor_type : "User" and
    azure.aadgraphactivitylogs.properties.app_id: (* and not (
        "74658136-14ec-4630-ad9b-26e160ff0fc6" or
        "bb8f18b0-9c38-48c9-a847-e1ef3af0602d" or
        "00000006-0000-0ff1-ce00-000000000000" or
        "18ed3507-a475-4ccb-b669-d66bc9f2a36e")
    ) and user.id:*
'''

[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1087"
name = "Account Discovery"
reference = "https://attack.mitre.org/techniques/T1087/"
[[rule.threat.technique.subtechnique]]
id = "T1087.004"
name = "Cloud Account"
reference = "https://attack.mitre.org/techniques/T1087/004/"

[rule.threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"

[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1550"
name = "Use Alternate Authentication Material"
reference = "https://attack.mitre.org/techniques/T1550/"
[[rule.threat.technique.subtechnique]]
id = "T1550.001"
name = "Application Access Token"
reference = "https://attack.mitre.org/techniques/T1550/001/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"


[rule.investigation_fields]
field_names = [
    "user.id",
    "source.ip",
    "source.as.organization.name",
    "user_agent.original",
    "azure.aadgraphactivitylogs.properties.app_id",
    "azure.aadgraphactivitylogs.properties.api_version",
    "url.path",
    "azure.tenant_id",
]

[rule.new_terms]
field = "new_terms_fields"
value = ["azure.aadgraphactivitylogs.properties.app_id", "user.id"]
[[rule.new_terms.history_window_start]]
field = "history_window_start"
value = "now-7d"

[rule]
description = """
Identifies attempts to execute programs via the Windows OpenSSH client. This may indicate an attempt to bypass
application control via trusted windows binaries.
"""
id = "a9b41132-04c7-421e-9aaf-b2c8718a66d0"
license = "Elastic License v2"
name = "Binary Proxy Execution via Windows OpenSSH"
os_list = ["windows"]
reference = ["https://lolbas-project.github.io/lolbas/Binaries/Ssh/"]
version = "1.0.7"

query = '''
process where event.action == "start" and
(
 (process.parent.executable : ("?:\\windows\\system32\\OpenSSH\\ssh.exe", "C:\\Windows\\System32\\OpenSSH\\sftp.exe") and
 process.parent.args == "-o" and process.parent.command_line : ("*ProxyCommand=*", "*LocalCommand=*") and
 not process.executable : ("?:\\Windows\\system32\\conhost.exe", "?:\\Program Files\\Amazon\\AWSCLIV2\\aws.exe", "C:\\Windows\\System32\\OpenSSH\\ssh.exe")) or

 (process.executable : ("?:\\windows\\system32\\OpenSSH\\ssh.exe", "C:\\Windows\\System32\\OpenSSH\\sftp.exe") and
  process.parent.name : ("explorer.exe", "python.exe", "conhost.exe") and
  process.command_line : ("*Command=*powershell*", "*schtasks*create*", "*LocalCommand=@echo off &&*",
                          "*Command=cmd /c*", "*ProxyCommand=*cmd.exe *", "*Command=\"cmd /c*", "*LocalCommand=scp*&&*", "*LocalCommand=?scp*&&*") )
)
'''

min_endpoint_version = "7.16.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.16.0"

[metadata]
creation_date = "2023/04/26"
integration = ["cloud_defend"]
maturity = "production"
min_stack_comments = "Defend for Containers integration was re-introduced in 9.3.0"
min_stack_version = "9.3.0"
updated_date = "2026/07/29"

[rule]
author = ["Elastic"]
description = """
This rule detects when a container management binary is run from inside a container. These binaries are critical
components of many containerized environments, and their presence and execution in unauthorized containers could
indicate compromise or a misconfiguration.
"""
false_positives = [
    """
    There is a potential for false positives if the container is used for legitimate administrative tasks that require
    the use of container management utilities, such as deploying, scaling, or updating containerized applications. It is
    important to investigate any alerts generated by this rule to determine if they are indicative of malicious activity
    or part of legitimate container activity.
    """,
]
from = "now-6m"
index = ["logs-cloud_defend.process*"]
interval = "5m"
language = "eql"
license = "Elastic Licence v2"
name = "Container Management Utility Execution Detected via Defend for Containers"
note = """## Setup

## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Container Management Utility Execution Detected via Defend for Containers

Container management utilities like Docker and Kubernetes are essential for orchestrating and managing containerized applications. They facilitate tasks such as deployment, scaling, and networking. However, adversaries can exploit these tools to execute unauthorized commands within containers, potentially leading to system compromise. The detection rule identifies suspicious execution of these utilities within containers, signaling possible misuse or misconfiguration, by monitoring specific process activities and event types.

### Possible investigation steps

- Review the specific container ID where the suspicious process was executed to determine its purpose and origin.
- Examine the process name and command line arguments to understand the context of the execution and identify any anomalies or unauthorized commands.
- Check the user and permissions associated with the process to assess if it aligns with expected roles and access levels for container management tasks.
- Investigate the container's creation and deployment history to identify any recent changes or deployments that could explain the presence of the management utility.
- Analyze network activity associated with the container to detect any unusual connections or data transfers that might indicate malicious activity.
- Correlate the event with other security alerts or logs to identify patterns or related incidents that could provide additional context or evidence of compromise.

### False positive analysis

- Routine maintenance tasks within containers can trigger the rule. Exclude known maintenance scripts or processes by adding them to an allowlist if they frequently execute container management utilities.
- Development and testing environments often run container management commands for legitimate purposes. Consider excluding these environments from monitoring or adjust the rule to focus on production environments only.
- Automated deployment tools may execute container management commands as part of their workflow. Identify these tools and create exceptions for their activities to prevent false positives.
- System updates or patches might involve running container management utilities. Monitor update schedules and temporarily adjust the rule to avoid unnecessary alerts during these periods.
- Legitimate administrative actions by authorized personnel can trigger the rule. Implement user-based exceptions for known administrators to reduce false positives while maintaining security oversight.

### Response and remediation

- Immediately isolate the affected container to prevent further unauthorized access or execution of commands. This can be done by stopping the container or disconnecting it from the network.
- Review the container's configuration and access controls to identify any misconfigurations or unauthorized access permissions that may have allowed the execution of container management utilities.
- Conduct a thorough analysis of the container's logs and process activities to determine the extent of the compromise and identify any additional malicious activities or lateral movement attempts.
- Remove any unauthorized or suspicious binaries and scripts from the container to prevent further exploitation.
- Patch and update the container image and underlying host system to address any known vulnerabilities that may have been exploited.
- Implement stricter access controls and monitoring on container management utilities to ensure they are only accessible by authorized users and processes.
- Escalate the incident to the security operations team for further investigation and to assess the need for broader security measures across the container environment."""
risk_score = 21
rule_id = "6c6bb7ea-0636-44ca-b541-201478ef6b50"
severity = "low"
tags = [
    "Data Source: Elastic Defend for Containers",
    "Domain: Container",
    "OS: Linux",
    "Use Case: Threat Detection",
    "Tactic: Execution",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"
query = '''
process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and (
  process.name in ("dockerd", "kubelet", "kube-proxy", "kubectl", "containerd", "systemd", "crictl") or
  (
    /* Account for tools that execute utilities as a subprocess, in this case the target utility name will appear as a process arg */
    process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "busybox") and
    process.args in (
      "dockerd", "/bin/dockerd", "/usr/bin/dockerd", "/usr/local/bin/dockerd",
      "kubelet", "/bin/kubelet", "/usr/bin/kubelet", "/usr/local/bin/kubelet",
      "kube-proxy", "/bin/kube-proxy", "/usr/bin/kube-proxy", "/usr/local/bin/kube-proxy",
      "kubectl", "/bin/kubectl", "/usr/bin/kubectl", "/usr/local/bin/kubectl",
      "containerd", "/bin/containerd", "/usr/bin/containerd", "/usr/local/bin/containerd",
      "systemd", "/bin/systemd", "/usr/bin/systemd", "/usr/local/bin/systemd",
      "crictl", "/bin/crictl", "/usr/bin/crictl", "/usr/local/bin/crictl"
    ) and 
    /* default exclusion list to not FP on default multi-process commands */
    not process.args in (
      "which", "/bin/which", "/usr/bin/which", "/usr/local/bin/which",
      "man", "/bin/man", "/usr/bin/man", "/usr/local/bin/man",
      "chmod", "/bin/chmod", "/usr/bin/chmod", "/usr/local/bin/chmod",
      "chown", "/bin/chown", "/usr/bin/chown", "/usr/local/bin/chown"
    )
  )
) and
container.id like "*" and
not (
  process.parent.executable in ("/sbin/init", "/usr/bin/dockerd", "/usr/bin/runc", "/usr/bin/containerd-shim-runc-v2") or
  process.working_directory == "/aws" or
  (process.parent.args == "init" and process.parent.args == "runc") or
  (process.parent.name == "busybox" and process.name == "kubectl")
)
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1609"
name = "Container Administration Command"
reference = "https://attack.mitre.org/techniques/T1609/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1613"
name = "Container and Resource Discovery"
reference = "https://attack.mitre.org/techniques/T1613/"

[rule.threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"

[rule]
description = """
Identifies registry modifications to disable Hypervisor-protected Code Integrity. HVCI enforces code integrity in the
kernel and allows only signed code to be executed.
"""
id = "6bda13bc-f952-4353-9a97-2c7a38b21010"
license = "Elastic License v2"
name = "Disabling Hypervisor-protected Code Integrity via Registry"
os_list = ["windows"]
reference = [
    "https://www.welivesecurity.com/2023/03/01/blacklotus-uefi-bootkit-myth-confirmed/",
    "https://learn.microsoft.com/en-us/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity",
]
version = "1.0.22"

query = '''
registry where event.action == "modification" and 
 process.executable != null and 
 registry.path :
       ("HKLM\\SYSTEM\\*ControlSet*\\DeviceGuard\\Scenarios\\HypervisorEnforcedCodeIntegrity\\Enabled",
        "HKLM\\SYSTEM\\*ControlSet*\\DeviceGuard\\HypervisorEnforcedCodeIntegrity") and 
 registry.data.strings : "0" and 
 not process.executable :
           ("?:\\Windows\\System32\\DeviceEnroller.exe",
            "?:\\Windows\\System32\\omadmclient.exe",
            "?:\\Windows\\System32\\svchost.exe",
            "?:\\Windows\\System32\\SecurityHealthService.exe",
            "?:\\Program Files\\HONOR\\PCManager\\MBAMessageCenter.exe",
            "?:\\Program Files (x86)\\ASUS\\AI Suite III\\AISuite3.exe",
            "C:\\Program Files\\Tenable\\Nessus Agent\\nessusd.exe",
            "C:\\Program Files (x86)\\Faronics\\Deep Freeze\\Install C-0\\DFServ.exe",
            "C:\\Program Files (x86)\\Common Files\\InstallShield\\engine\\?\\Intel 32\\IKernel.exe",
            "?:\\Windows\\regedit.exe",
            "C:\\Windows\\System32\\provtool.exe",
            "C:\\Windows\\System32\\backgroundTaskHost.exe",
            "C:\\Windows\\UUS\\Packages\\Preview\\amd64\\MoUsoCoreWorker.exe",
            "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\*\\Installer\\setup.exe",
            "C:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\*\\msedgewebview2.exe",
            "C:\\Windows\\UUS\\amd64\\MoUsoCoreWorker.exe",
            "C:\\Program Files\\Omnilert\\Omnilert.exe") and
 not process.thread.Ext.call_stack_summary in
             ("sysfer.dll|kernelbase.dll|dggpext.dll|policymanagerprecheck.dll|policymanager.dll|deviceenroller.exe|kernel32.dll|ntdll.dll",
              "sysfer.dll|kernelbase.dll|dggpext.dll|enterprisecsps.dll|configmanager2.dll|enterprisecsps.dll|configmanager2.dll|coredpus.dll|omadmclient.exe|kernel32.dll|ntdll.dll")
'''

min_endpoint_version = "8.7.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1112"
name = "Modify Registry"
reference = "https://attack.mitre.org/techniques/T1112/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.7.0"

[rule]
description = """
Detects when an Application's Dock Tile Plugin gets mapped into memory by the macOS XPC external dock service process.
Threat actors can add Dock Tile Plugins to their applications (APP_NAME.app/Contents/PlugIns/DockTile). The plugin will
be recognized by launch services, registered, and the plugin will be loaded. These plugins are not visible to the user,
can react to various system events, and will be loaded at each login, so persists across reboots, and runs inside a
legitimate system process which is not sandboxed.
"""
id = "6fc9c19f-0315-482c-b056-e20a8d0f1b2e"
license = "Elastic License v2"
name = "Dock Tile Plug-In Load"
os_list = ["macos"]
reference = ["https://theevilbit.github.io/beyond/beyond_0032/"]
version = "1.0.5"

query = '''
library where event.action == "load" and process.name == "com.apple.dock.external.extra.arm64"
'''

min_endpoint_version = "8.7.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "Effective_process.executable"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1547"
name = "Boot or Logon Autostart Execution"
reference = "https://attack.mitre.org/techniques/T1547/"


[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[internal]
min_endpoint_version = "8.7.0"

[rule]
description = """
Identifies attempts to allocate remote memory into a target process early before the start of its initial thread, this
behavior is often associated with remote process injection preparation.
"""
id = "d0ffac28-7e18-416e-b9f6-d16cc8cdeeb4"
license = "Elastic License v2"
name = "Early Remote Memory Allocation"
os_list = ["windows"]
reference = ["https://www.elastic.co/security-labs/doubling-down-etw-callstacks"]
version = "1.0.2"

query = '''
sequence with maxspan=1m
 [api where process.Ext.api.behaviors == "cross-process" and process.Ext.api.behaviors =="parent-child" and
  process.Ext.api.name in ("VirtualAllocEx", "MapViewOfFile", "MapViewOfFile2") and
  Target.process.Ext.token.integrity_level_name != "low" and process.thread.Ext.call_stack_summary != null and
  not _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.trusted == true) and
  not process.thread.Ext.call_stack_final_user_module.name in ("Kernel", "Unknown", "Undetermined") and
  not process.thread.Ext.call_stack_final_user_module.path like ("?:\\program files\\*", "?:\\program files (x86)\\*") and
  process.thread.Ext.call_stack_final_user_module.protection_provenance != "Kernel" and
  process.thread.Ext.call_stack_final_user_module.hash.sha256 != "0ebf9d054ab20f8ce5ac2cd5f66244af4289faaac743bd616809d08cec78d6c2"] by process.entity_id, Target.process.entity_id
 [process where event.action == "start"] by process.parent.entity_id, process.entity_id
'''

min_endpoint_version = "8.12.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "Target.process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.12.0"

[metadata]
creation_date = "2026/03/31"
maturity = "production"
min_stack_comments = "ES|QL inline stats became generally available in 9.3.0 and MV_INTERSECTION is in preview since 9.3."
min_stack_version = "9.3.0"
updated_date = "2026/04/10"

[rule]
author = ["Elastic"]
description = """
Detects Elastic Defend alerts (behavior, malicious file, memory signature, shellcode) where the alerted process has a
package-manager install context in its ancestry: npm (Node.js), PyPI (pip / Python / uv), or Rust (cargo). Install-time
spawn chains are a common path for supply-chain and postinstall abuse; this Higher-Order rule surfaces Defend alerts
whose process tree includes such activity for prioritization.
"""
from = "now-9m"
language = "esql"
license = "Elastic License v2"
name = "Elastic Defend Alert from Package Manager Install Ancestry"
note = """## Triage and analysis

### Investigating Elastic Defend Alert from Package Manager Install Ancestry

Elastic Defend raised an alert on a process whose ancestry includes a parent that was involved in a package install
(npm, pip/PyPI, or cargo/crates.io). That can indicate malicious postinstall scripts, dependency confusion, or
compromised packages.

### Possible investigation steps

- Identify the install context by finding a process whose `entity_id` appears in `Esql.pkg_ancestor_ids` (intersection
  with `process.Ext.ancestry`).
- Review `process.command_line` and `process.parent.command_line` for the install command and any script hooks
  (e.g. `preinstall`, `postinstall`, `setup.py`, build scripts).
- Correlate package name, registry, and lockfile or manifest on the host if available.
- Pivot on host, user, and network for additional alerts or outbound connections from the same tree.

### False positive analysis

- Normal `npm install`, `pip install`, and `cargo build` / `cargo install` during development or CI can produce alerts
  on descendant processes. Tune by excluding known-safe Defend rule names, paths, or command-line patterns.

### Response and remediation

- If abuse is confirmed: remove the suspect package, rotate secrets exposed to that environment, and block related IOCs.
"""
references = [
    "https://attack.mitre.org/techniques/T1195/",
    "https://attack.mitre.org/techniques/T1195/002/",
]
risk_score = 99
rule_id = "344e6c7d-ceb0-4f20-ba04-7c75569a7e38"
severity = "critical"
tags = [
    "Domain: Endpoint",
    "Use Case: Threat Detection",
    "Tactic: Initial Access",
    "Rule Type: Higher-Order Rule",
    "Resources: Investigation Guide",
    "Data Source: Elastic Defend",
]
timestamp_override = "event.ingested"
type = "esql"

query = '''
FROM logs-endpoint.alerts-*, logs-endpoint.events.process-* METADATA _id, _version, _index

| EVAL is_pkg_install = CASE(
    // npm  npx  yarn  pnpm (Node.js ecosystem)
    process.parent.name IN ("node", "node.exe") AND (
      process.parent.command_line LIKE "*npm install*" OR
      process.parent.command_line LIKE "*npm i *" OR
      ends_with(process.parent.command_line, "npm i") OR
      process.parent.command_line LIKE "*npx *" OR
      process.parent.command_line LIKE "*yarn install*" OR
      process.parent.command_line LIKE "*yarn add*" OR
      process.parent.command_line LIKE "*pnpm install*" OR
      process.parent.command_line LIKE "*pnpm add*" OR
      process.parent.command_line LIKE "*npm-cli.js*install*" OR
      process.parent.command_line LIKE "*setup.js*"
    ), true,

    // pip  pip3 pipx poetry  uv (Python ecosystem)
    ((process.parent.name like "python*" or process.parent.name like "pip*" or process.parent.name IN ("uv", "uv.exe") ) AND (
      process.parent.command_line LIKE "*pip install*" OR
      process.parent.command_line LIKE "*pip3 install*" OR
      process.parent.command_line LIKE "*-m pip install*" OR
      process.parent.command_line LIKE "*setup.py install*" OR
      process.parent.command_line LIKE "*setup.py develop*" OR
      process.parent.command_line LIKE "*pipx install*" OR
      process.parent.command_line LIKE "*poetry install*" OR
      process.parent.command_line LIKE "*poetry add*" OR
      process.parent.command_line LIKE "*uv pip install*" OR
      process.parent.command_line LIKE "*uv add*")), true,

    // cargo (Rust / crates.io ecosystem)
    process.parent.name IN ("cargo", "cargo.exe", "rustc", "rustc.exe") AND (
      process.parent.command_line LIKE "*cargo install*" OR
      process.parent.command_line LIKE "*cargo build*" OR
      process.parent.command_line LIKE "*cargo run*" OR
      process.parent.command_line LIKE "*cargo fetch*"), true,

    false
  )

| WHERE process.Ext.ancestry IS NOT NULL AND (data_stream.dataset == "endpoint.alerts" OR is_pkg_install)

// Capture entity_ids for package install parent processes
| EVAL all_entity_id = CASE(is_pkg_install, process.parent.entity_id, "null")

// Collect all package install entity_ids globally
| INLINE STATS all_pkg_entity_ids = VALUES(all_entity_id) WHERE all_entity_id != "null"

// Find which package install entity_ids appear in this process's ancestry
| EVAL Esql.pkg_ancestor_ids = MV_INTERSECTION(all_pkg_entity_ids, process.Ext.ancestry)

// Elastic Defend alerts descended from a package install process
| WHERE Esql.pkg_ancestor_ids IS NOT NULL AND data_stream.dataset == "endpoint.alerts"

| KEEP *
'''

[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1195"
name = "Supply Chain Compromise"
reference = "https://attack.mitre.org/techniques/T1195/"
[[rule.threat.technique.subtechnique]]
id = "T1195.002"
name = "Compromise Software Supply Chain"
reference = "https://attack.mitre.org/techniques/T1195/002/"

[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"

[metadata]
creation_date = "2026/05/20"
integration = ["azure"]
maturity = "production"
updated_date = "2026/07/08"

[rule]
author = ["Elastic", "descambiado"]
description = """
Identifies modifications to OAuth application redirect URIs (ReplyUrls) in Entra ID. Adding an
attacker-controlled redirect URI to an existing trusted application allows interception of OAuth
authorization codes when users authenticate through that application's normal login flow, enabling
token theft without requiring a new application registration or consent event.
"""
false_positives = [
    """
    Developers adding localhost redirect URIs for local development environments.
    CI/CD pipelines updating production redirect URIs during deployment.
    Application owners adding redirect URIs for new platform support.
    """,
]
from = "now-9m"
index = ["logs-azure.auditlogs-*"]
language = "kuery"
license = "Elastic License v2"
name = "Entra ID OAuth Application Redirect URI Modified"
note = """## Triage and analysis

### Investigating Entra ID OAuth Application Redirect URI Modified

A redirect URI addition to an existing trusted application does not generate a consent event and does
not require registering a new application -- both of which are commonly monitored. The modified
application retains all existing user consents.

#### Possible investigation steps

- Identify the actor who modified the application (`azure.auditlogs.properties.initiated_by`) and
  verify whether the change was authorized by the application owner or a change management ticket.
- Review the specific URIs added by comparing `modifiedProperties.oldValue` and `newValue` for the
  `ReplyUrls` field in the audit event's `target_resources`.
- Geolocate and WHOIS the domain of any newly added URI -- hosting providers, recently registered
  domains, or URL shorteners are strong indicators of compromise.
- Check whether the actor recently became an owner of this application: look for
  "Add owner to application" events in AuditLogs for the same application object ID.
- Review the application's Graph API permissions -- applications with Mail, Files, or directory
  scopes are the highest-value targets for redirect URI hijacking.

### False positive analysis

- Localhost and loopback URIs (`http://localhost:*`, `http://127.0.0.1:*`) added by developers are
  expected in non-production applications. Verify the application's sensitivity before closing.
- CI/CD-driven URI updates typically originate from service principal actors, not human users.

### Response and remediation

- Remove the unauthorized redirect URI via Entra ID > App registrations > Authentication.
- Revoke all tokens issued to the application since the modification timestamp.
- Review sign-in logs for the application for any sign-ins from unexpected sources after the change.
- If the URI was externally controlled, treat as a full OAuth token compromise for all users of
  the application and initiate token revocation and user notification.
"""
references = [
    "https://learn.microsoft.com/en-us/entra/identity-platform/reply-url",
    "https://www.microsoft.com/en-us/security/blog/2026/03/02/oauth-redirection-abuse-enables-phishing-malware-delivery/",
]
risk_score = 73
rule_id = "8efcd3da-103b-4a65-8ab2-6a3a9df7ba8b"
severity = "high"
tags = [
    "Domain: Cloud",
    "Domain: Identity",
    "Data Source: Azure",
    "Data Source: Microsoft Entra ID",
    "Data Source: Microsoft Entra ID Audit Logs",
    "Use Case: Identity and Access Audit",
    "Tactic: Persistence",
    "Tactic: Credential Access",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset: "azure.auditlogs" and
azure.auditlogs.operation_name: "Update application" and
event.outcome: ("Success" or "success") and
azure.auditlogs.properties.target_resources.*.modified_properties.*.display_name: "AppAddress"
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1556"
name = "Modify Authentication Process"
reference = "https://attack.mitre.org/techniques/T1556/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1528"
name = "Steal Application Access Token"
reference = "https://attack.mitre.org/techniques/T1528/"

[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[metadata]
creation_date = "2023/02/16"
integration = ["google_workspace"]
maturity = "production"
updated_date = "2026/05/22"

[rule]
author = ["Elastic"]
description = """
Detects an external Google Workspace user account being added to an existing group. Adversaries may add external user
accounts as a means to intercept shared files or emails with that specific group.
"""
false_positives = [
    """
    Administrators may add external users to groups to share files and communication with them via the intended
    recipient be the group they are added to. It is unlikely an external user account would be added to an
    organization's group where administrators should create a new user account.
    """,
]
from = "now-130m"
index = ["filebeat-*", "logs-google_workspace.admin-*"]
interval = "10m"
language = "eql"
license = "Elastic License v2"
name = "External User Added to Google Workspace Group"
note = """## Triage and analysis

### Investigating External User Added to Google Workspace Group

Google Workspace groups allow organizations to assign specific users to a group that can share resources. Application specific roles can be manually set for each group, but if not inherit permissions from the top-level organizational unit.

Threat actors may use phishing techniques and container-bound scripts to add external Google accounts to an organization's groups with editorial privileges. As a result, the user account is unable to manually access the organization's resources, settings and files, but will receive anything shared to the group. As a result, confidential information could be leaked or perhaps documents shared with editorial privileges be weaponized for further intrusion.

This rule identifies when an external user account is added to an organization's groups where the domain name of the target does not match the Google Workspace domain.

### Possible investigation steps
- Identify user account(s) associated by reviewing `user.name` or `user.email` in the alert
  - The `user.target.email` field contains the user added to the groups
  - The `group.name` field contains the group the target user was added to
- Identify specific application settings given to the group which may indicate motive for the external user joining a particular group
- With the user identified, verify administrative privileges are scoped properly to add external users to the group
  - Unauthorized actions may indicate the `user.email` account has been compromised or leveraged to add an external user
- To identify other users in this group, search for `event.action: "ADD_GROUP_MEMBER"`
  - It is important to understand if external users with `@gmail.com` are expected to be added to this group based on historical references
- Review Gmail logs where emails were sent to and from the `group.name` value
  - This may indicate potential internal spearphishing

### False positive analysis
- With the user account whom added the new user, verify this action was intentional
- Verify that the target whom was added to the group is expected to have access to the organization's resources and data
- If other members have been added to groups that are external, this may indicate historically that this action is expected

### Response and remediation
- Initiate the incident response process based on the outcome of the triage.
- Disable or limit the account during the investigation and response.
- Identify the possible impact of the incident and prioritize accordingly; the following actions can help you gain context:
    - Identify the account role in the cloud environment.
    - Assess the criticality of affected services and servers.
    - Work with your IT team to identify and minimize the impact on users.
    - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
    - Identify any regulatory or legal ramifications related to this activity.
- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
- Reactivate multi-factor authentication for the user.
- Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
- Implement security defaults [provided by Google](https://cloud.google.com/security-command-center/docs/how-to-investigate-threats).
- Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).

## Setup

The Google Workspace Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.

### Important Information Regarding Google Workspace Event Lag Times
- As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs.
- This rule is configured to run every 10 minutes with a lookback time of 130 minutes.
- To reduce the risk of false negatives, consider reducing the interval that the Google Workspace (formerly G Suite) Filebeat module polls Google's reporting API for new events.
- By default, `var.interval` is set to 2 hours (2h). Consider changing this interval to a lower value, such as 10 minutes (10m).
- See the following references for further information:
  - https://support.google.com/a/answer/7061566
  - https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-google_workspace.html"""
references = [
    "https://support.google.com/a/answer/33329",
    "https://www.elastic.co/security-labs/google-workspace-attack-surface-part-one",
    "https://www.elastic.co/security-labs/google-workspace-attack-surface-part-two",
]
risk_score = 47
rule_id = "38f384e0-aef8-11ed-9a38-f661ea17fbcc"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Data Source: Google Workspace",
    "Use Case: Identity and Access Audit",
    "Tactic: Initial Access",
    "Tactic: Persistence",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
iam where data_stream.dataset == "google_workspace.admin" and event.action == "ADD_GROUP_MEMBER" and
  not endsWith(user.target.domain, user.target.group.domain)
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"
[[rule.threat.technique.subtechnique]]
id = "T1078.004"
name = "Cloud Accounts"
reference = "https://attack.mitre.org/techniques/T1078/004/"



[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"


[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user.email",
    "source.ip",
    "google_workspace.actor.type",
    "user.target.email",
    "google_workspace.admin.group.email",
    "event.action",
    "cloud.account.id",
]

[metadata]
creation_date = "2026/06/30"
integration = ["gcp"]
maturity = "production"
updated_date = "2026/06/30"

[rule]
author = ["Elastic"]
description = """
Detects bursts of failed GKE API requests from a single user identity within a five-minute window. Repeated authorization
failures across multiple actions can indicate credential stuffing, RBAC probing, or reconnaissance with stolen tokens.
"""
from = "now-11m"
interval = "5m"
language = "esql"
license = "Elastic License v2"
name = "GKE API Request Failure Burst by User"
note = """## Triage and analysis

### Investigating GKE API Request Failure Burst by User

The rule aggregates failed Kubernetes API calls per `user.email`, source IP, and user agent in five-minute buckets and
alerts when failures reach ten or more.

### Investigation steps

- Review `Esql.actions` and `Esql.resources` for targeted API operations.
- Validate whether the identity should exist and whether the source IP is expected.
- Hunt for later successful calls indicating privilege escalation.

### False positives

- Misconfigured automation or CI jobs with stale credentials may generate bursts; exclude known service accounts.

## Setup

The GCP Fleet integration with GKE audit logs enabled is required to be compatible with this rule."""
references = [
    "https://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging",
    "https://attack.mitre.org/techniques/T1613/",
]
risk_score = 47
rule_id = "94556bc7-e057-4759-9e49-fa79ee366101"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Domain: Kubernetes",
    "Data Source: GCP",
    "Data Source: Google Cloud Platform",
    "Use Case: Threat Detection",
    "Tactic: Discovery",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "esql"

query = '''
from logs-gcp.audit-* metadata _id, _index, _version
| eval Esql.time_interval = date_trunc(5 minutes, @timestamp)
| where data_stream.dataset == "gcp.audit"
    and service.name == "k8s.io"
    and event.outcome == "failure"
    and event.type != "allowed"
    and user.email is not null
    and not to_string(user.email) rlike "(system:serviceaccount:|system:gke-spiffe-controller|system:kube-scheduler|system:node:).*"
| stats
    Esql.unique_actions = count_distinct(event.action),
    Esql.failures_count = count(*),
    Esql.actions = values(event.action),
    Esql.resources = values(orchestrator.resource.name)
  by user.email, source.ip, user_agent.original, data_stream.namespace, Esql.time_interval
| where Esql.failures_count >= 10
| keep Esql.*, user.email, source.ip, user_agent.original, data_stream.namespace
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1613"
name = "Container and Resource Discovery"
reference = "https://attack.mitre.org/techniques/T1613/"

[rule.threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"

[rule]
description = """
Detects when an audio plug-in is manually loaded by the auval or auvaltool process followed by an immediate outbound
network connection. Applications such as GarageBand 10, Logic Pro X, Audacity, etc., use audio unit plug-ins to create
sound effects and virtual instruments. Software developers and sound engineers can create either audio components or
virtual studio technology (VST) plug-ins. Threat actors can also create audio components or plug-ins and load them to
execute unsigned code via the native auval or auvaltool binaries.
"""
id = "5faec4a7-c62b-492e-83db-dc7b8eec0878"
license = "Elastic License v2"
name = "Initial Access via Audio Unit Plug-in"
os_list = ["macos"]
reference = ["https://posts.specterops.io/audio-unit-plug-ins-896d3434a882"]
version = "1.0.10"

query = '''
sequence by process.entity_id with maxspan=1m
[process where event.type == "start" and event.action == "exec" and 
  process.name in ("auvaltool", "auval") and
  process.args in ("-a", "-v") and 
  not process.parent.executable in ("/Applications/Logic Pro X.app/Contents/MacOS/Logic Pro X",
                                    "/Applications/Logic Pro.app/Contents/MacOS/Logic Pro", 
                                    "/sbin/launchd")]
[network where event.type == "start" and event.action == "connection_attempted" and
   not cidrmatch(destination.ip, 
       "240.0.0.0/4", "233.252.0.0/24", "224.0.0.0/4", "198.19.0.0/16", "192.18.0.0/15", 
       "192.0.0.0/24", "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", 
       "192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", 
       "100.64.0.0/10", "192.175.48.0/24", "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24",
       "::1", "FE80::/10", "FF00::/8")]
'''

min_endpoint_version = "8.16.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "8.16.0"

[rule]
description = """
This rule monitors for the loading of kernel modules via an unusual process, indicating the use of a loader. Loadable
kernel modules (LKMs) are pieces of code that can be loaded into the kernel at runtime to extend its functionality.
These are commonly abused by rootkits or other malicious software to hide their presence or to gain elevated privileges.
These LKMs are normally loaded via a pre-installed utility such as insmod, kmod, or modprobe.
"""
id = "ce304037-0b55-47bd-aa14-140c658ee48a"
license = "Elastic License v2"
name = "Loadable Kernel Module Loaded via Loader"
os_list = ["linux"]
reference = ["https://www.elastic.co/security-labs/continuation-on-persistence-mechanisms"]
version = "1.0.4"

query = '''
process where event.type == "start" and event.action == "load_module" and (
  process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "mksh", "busybox", "node", "deno", "nodejs", "java") or
  process.name like ("memfd:*", ".*", "python*", "perl*", "php*", "ruby*", "lua*") or
  process.executable like (
    "./*", "/tmp/*", "/var/tmp/*", "/dev/shm/*", "/run/*", "/var/run/*", "/boot/*", "/sys/*",
    "/lost+found/*", "/proc/*", "/var/mail/*", "/var/www/*", "/home/*/*", "/root/*", "/mnt/*",
    "/srv/*", "/etc/*"
  )
) and
not (
  process.executable like ("/tmp/newroot/*", "/run/systemd/mount-rootfs/sbin/*", "/opt/puppetlabs/puppet/bin/ruby") or
  (
    process.parent.command_line == "bash /var/lib/guardicore/bin/gc-enforcement-wrapper start-agent" and
    process.command_line == "bash /var/lib/guardicore/bin/gc-enforcement-wrapper start-agent" and
    process.working_directory == "/var/lib/guardicore"
  ) or
  (
    process.command_line == "/bin/bash /bin/mst start" and
    process.parent.command_line == "/bin/bash /bin/mst start"
  ) or
  process.command_line in ("sh -c mst start >> /dev/null", "/bin/sh /usr/local/bin/facter -p -j")
)
'''

min_endpoint_version = "9.1.4"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1547"
name = "Boot or Logon Autostart Execution"
reference = "https://attack.mitre.org/techniques/T1547/"
[[threat.technique.subtechnique]]
id = "T1547.006"
name = "Kernel Modules and Extensions"
reference = "https://attack.mitre.org/techniques/T1547/006/"



[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1014"
name = "Rootkit"
reference = "https://attack.mitre.org/techniques/T1014/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "9.1.4"

[rule]
description = """
Detects the decompression of a file into a specified folder directly from a network download using unzip via an unsigned
or untrusted binary.
"""
id = "28611239-08e6-47d5-a88b-76136670788c"
license = "Elastic License v2"
name = "Network File Unzipped via Unsigned or Untrusted Binary"
os_list = ["macos"]
version = "1.0.6"

query = '''
process where event.type == "start" and event.action == "exec" and process.name == "unzip" and 
 process.args: "/*/CFNetworkDownload*" and process.args == "-d" and 
 (process.parent.code_signature.trusted == false or process.parent.code_signature.exists == false) and
 not process.parent.name == "figma_agent"
'''

min_endpoint_version = "8.12.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1027"
name = "Obfuscated Files or Information"
reference = "https://attack.mitre.org/techniques/T1027/"

[[threat.technique]]
id = "T1140"
name = "Deobfuscate/Decode Files or Information"
reference = "https://attack.mitre.org/techniques/T1140/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.12.0"

[metadata]
creation_date = "2021/04/05"
integration = ["endpoint", "network_traffic"]
maturity = "production"
updated_date = "2026/07/27"

[rule]
anomaly_threshold = 75
author = ["Elastic"]
description = """
A machine learning job detected a rare destination country name in the network logs. This can be due to initial access,
persistence, command-and-control, or exfiltration activity. For example, when a user clicks on a link in a phishing
email or opens a malicious document, a request may be sent to download and run a payload from a server in a country
which does not normally appear in network traffic or business work-flows. Malware instances and persistence mechanisms
may communicate with command-and-control (C2) infrastructure in their country of origin, which may be an unusual
destination country for the source network.
"""
false_positives = [
    """
    Business workflows that occur very occasionally, and involve a business relationship with an organization in a
    country that does not routinely appear in network events, can trigger this alert. A new business workflow with an
    organization in a country with which no workflows previously existed may trigger this alert - although the model
    will learn that the new destination country is no longer anomalous as the activity becomes ongoing. Business
    travelers who roam to many countries for brief periods may trigger this alert.
    """,
]
from = "now-30m"
interval = "15m"
license = "Elastic License v2"
machine_learning_job_id = "rare_destination_country"
name = "Network Traffic to Rare Destination Country"
setup = """## Setup

This rule requires the installation of associated Machine Learning jobs, as well as data coming in from one of the following integrations:
- Elastic Defend
- Network Packet Capture

### Anomaly Detection Setup

Once the rule is enabled, the associated Machine Learning job will start automatically. You can view the Machine Learning job linked under the "Definition" panel of the detection rule. If the job does not start due to an error, the issue must be resolved for the job to commence successfully. For more details on setting up anomaly detection jobs, refer to the [helper guide](https://www.elastic.co/guide/en/kibana/current/xpack-ml-anomalies.html).

### Elastic Defend Integration Setup
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.

#### Prerequisite Requirements:
- Fleet is required for Elastic Defend.
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).

#### The following steps should be executed in order to add the Elastic Defend integration to your system:
- Go to the Kibana home page and click "Add integrations".
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
- Click "Add Elastic Defend".
- Configure the integration name and optionally add a description.
- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
- Click "Save and Continue".
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).

### Network Packet Capture Integration Setup
The Network Packet Capture integration sniffs network packets on a host and dissects known protocols. Monitoring the network traffic is critical to gaining observability and securing your environment — ensuring high levels of performance and security. The Network Packet Capture integration captures the network traffic between your application servers, decodes common application layer protocols and records the interesting fields for each transaction.

#### The following steps should be executed in order to add the Elastic Agent System integration "network_traffic" to your system:
- Go to the Kibana home page and click “Add integrations”.
- In the query bar, search for “Network Packet Capture” and select the integration to see more details about it.
- Click “Add Network Packet Capture”.
- Configure the integration name and optionally add a description.
- Review optional and advanced settings accordingly.
- Add the newly installed “network_traffic” to an existing or a new agent policy, and deploy the agent on your system from which network log files are desirable.
- Click “Save and Continue”.
- For more details on the integration refer to the [helper guide](https://docs.elastic.co/integrations/network_traffic).
"""
references = ["https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html"]
risk_score = 21
rule_id = "35f86980-1fb1-4dff-b311-3be941549c8d"
severity = "low"
tags = [
    "Data Source: Elastic Defend",
    "Data Source: Network Packet Capture",
    "Use Case: Threat Detection",
    "Rule Type: ML",
    "Rule Type: Machine Learning",
    "Resources: Investigation Guide",
]
type = "machine_learning"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Network Traffic to Rare Destination Country

Machine learning models analyze network logs to identify traffic to uncommon destination countries, which may indicate malicious activities like unauthorized access or data exfiltration. Adversaries exploit this by directing traffic to servers in atypical locations, often linked to command-and-control operations. The detection rule flags such anomalies, aiding in early threat identification and response.

### Possible investigation steps

- Review the network logs to identify the specific destination country flagged as rare and assess its historical presence in the network traffic.
- Analyze the source IP addresses and user accounts associated with the flagged traffic to determine if they are legitimate or potentially compromised.
- Investigate the nature of the traffic, such as the protocols and ports used, to identify any unusual patterns or connections to known malicious infrastructure.
- Check for any recent phishing attempts or suspicious emails that may have led to the initiation of this traffic, focusing on links or attachments that could have been used to download malicious payloads.
- Correlate the flagged traffic with any other security alerts or incidents to identify potential patterns or coordinated attacks involving the rare destination country.
- Consult threat intelligence sources to determine if the destination country or specific IP addresses are associated with known threat actors or command-and-control servers.

### False positive analysis

- Legitimate business communications with partners or clients in rare destination countries may trigger alerts. Users should review and whitelist these known entities to prevent future false positives.
- Routine software updates or patches from international vendors might be flagged. Identify and exclude these update servers from the detection rule to avoid unnecessary alerts.
- Employees traveling abroad and accessing company resources can generate alerts. Implement a process to temporarily whitelist these destinations based on travel schedules.
- Cloud services with global data centers may route traffic through uncommon countries. Verify the service's IP ranges and exclude them if they are part of normal operations.
- Research or market expansion activities targeting new regions might cause alerts. Document and exclude these activities if they align with business objectives.

### Response and remediation

- Isolate the affected system from the network to prevent further unauthorized access or data exfiltration.
- Conduct a thorough scan of the isolated system for malware or unauthorized software, focusing on identifying any command-and-control (C2) communication channels.
- Block network traffic to and from the identified rare destination country at the firewall or proxy level to prevent further communication with potential malicious servers.
- Review and analyze logs from the affected system and network devices to identify any additional indicators of compromise or related suspicious activities.
- If malware is detected, remove it using appropriate tools and techniques, ensuring that all persistence mechanisms are eradicated.
- Restore the affected system from a clean backup if necessary, ensuring that all security patches and updates are applied.
- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if additional systems are affected."""

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"

[[rule.threat.technique.subtechnique]]
id = "T1566.001"
name = "Spearphishing Attachment"
reference = "https://attack.mitre.org/techniques/T1566/001/"

[[rule.threat.technique.subtechnique]]
id = "T1566.002"
name = "Spearphishing Link"
reference = "https://attack.mitre.org/techniques/T1566/002/"

[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"

[[rule.threat.technique]]
id = "T1105"
name = "Ingress Tool Transfer"
reference = "https://attack.mitre.org/techniques/T1105/"

[rule.threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1041"
name = "Exfiltration Over C2 Channel"
reference = "https://attack.mitre.org/techniques/T1041/"

[[rule.threat.technique]]
id = "T1048"
name = "Exfiltration Over Alternative Protocol"
reference = "https://attack.mitre.org/techniques/T1048/"

[rule.threat.tactic]
id = "TA0010"
name = "Exfiltration"
reference = "https://attack.mitre.org/tactics/TA0010/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1204"
name = "User Execution"
reference = "https://attack.mitre.org/techniques/T1204/"

[[rule.threat.technique.subtechnique]]
id = "T1204.001"
name = "Malicious Link"
reference = "https://attack.mitre.org/techniques/T1204/001/"

[[rule.threat.technique.subtechnique]]
id = "T1204.002"
name = "Malicious File"
reference = "https://attack.mitre.org/techniques/T1204/002/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[metadata]
creation_date = "2026/01/30"
integration = ["endpoint"]
maturity = "production"
updated_date = "2026/03/24"

[rule]
author = ["Elastic"]
description = """
Detects when Perl makes an outbound network connection to a non-private IP address. Perl is a scripting 
language that comes pre-installed on macOS and offers extensive capabilities for adversaries. Its use for 
network connections on macOS systems is uncommon and potentially suspicious.
"""
from = "now-9m"
index = ["logs-endpoint.events.network-*", "logs-endpoint.events.process-*"]
language = "eql"
license = "Elastic License v2"
name = "Perl Outbound Network Connection"
note = """ ## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Perl Outbound Network Connection

This rule detects Perl starting on macOS and then initiating an outbound connection to a public (non-private) IP, a pattern that stands out because Perl rarely performs direct network reach-outs in normal macOS workflows. Attackers often abuse Perl as a built-in “living off the land” runtime to beacon to external command-and-control over HTTP/S or to fetch and execute a second-stage payload from an internet host.

### Possible investigation steps

- Review the full command line, parent/child process tree, execution context (user, TTY, working directory), and referenced script/module paths to determine whether the run was expected or suspicious.  
- Pivot on the external destination (IP, port, and any resolved domain from DNS telemetry) to assess reputation, hosting characteristics, and whether other endpoints have recently contacted the same infrastructure.  
- Examine connection characteristics (protocol, TLS SNI/certificate, HTTP headers/user-agent, data volume, and timing) to identify staged downloads or beacon-like periodicity.  
- Correlate nearby file activity for newly created or modified scripts, temp artifacts, or downloaded payloads, and validate them via hashes, signatures, and known-good baselines.  
- Check for follow-on behavior consistent with persistence or lateral movement, such as new launchd/cron items, suspicious login items, or additional interpreters and shells spawned from the same lineage.

### False positive analysis

- A legitimate Perl script run by an administrator or scheduled maintenance task (e.g., log rotation, health checks, or API polling) may connect to a public service endpoint over HTTP/S, matching the Perl exec followed by a non-private destination IP pattern.  
- A developer workflow that uses Perl one-liners or project scripts to fetch dependencies, query internet-hosted resources, or validate external URLs can generate outbound connections to public IPs that appear unusual on endpoints without an established baseline for Perl network use.

### Response and remediation

- Isolate the affected macOS host from the network (or block the specific destination IP/port at the egress firewall) and terminate the suspicious `perl` process to stop any active command-and-control or payload download.  
- Collect and preserve the Perl command line, referenced script paths, current working directory, any newly written files (especially in `/tmp`, `/var/tmp`, and the user’s `~/Library`), and the full process tree for forensic review before cleanup.  
- Remove or quarantine the identified Perl script and any downloaded payloads, then eradicate persistence by deleting malicious `launchd` agents/daemons, cron entries, and suspicious Login Items created around the time of the outbound connection.  
- Reimage or restore the endpoint from a known-good source if integrity cannot be confidently validated, rotate credentials used on the device, and invalidate active sessions/tokens that may have been exposed to the Perl process.  
- Escalate to IR/forensics immediately if the destination infrastructure is contacted by multiple hosts, the Perl process runs under a privileged context, or you observe repeated beacon-like connections or evidence of persistence beyond a single script execution.  
- Harden by restricting interpreter execution (Perl, Python, Ruby) via endpoint controls, enforcing outbound allowlisting/proxying for user endpoints, and adding detections for Perl launching network tools or writing executable content into user-writable directories.
"""
risk_score = 47
rule_id = "aba3bc11-e02f-4a03-8889-d86ea1a44f76"
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: macOS",
    "Use Case: Threat Detection",
    "Tactic: Command and Control",
    "Tactic: Execution",
    "Data Source: Elastic Defend",
    "Resources: Investigation Guide",
]
type = "eql"
query = '''
sequence by process.entity_id with maxspan=30s
  [process where host.os.type == "macos" and event.type == "start" and event.action == "exec" and
    process.name == "perl" and not process.args like "/usr/bin/xpath"]
  [network where host.os.type == "macos" and event.type == "start" and process.name == "perl" and
    not cidrmatch(destination.ip, 
        "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", 
        "192.0.0.0/24", "192.0.2.0/24", "192.168.0.0/16", "192.88.99.0/24",
        "224.0.0.0/4", "240.0.0.0/4", "::1", "FE80::/10", "FF00::/8")]
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"

[[rule.threat.technique.subtechnique]]
id = "T1071.001"
name = "Web Protocols"
reference = "https://attack.mitre.org/techniques/T1071/001/"

[rule.threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"

[[rule.threat.technique.subtechnique]]
id = "T1059.006"
name = "Python"
reference = "https://attack.mitre.org/techniques/T1059/006/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[rule]
description = """
Identifies use of sudo with -k (invalidate cached credentials) and -S (read password from stdin) to run a lightweight
command such as pwd, whoami, or true. Malware and social-engineering chains often use this pattern to verify a password
collected from a fake authentication dialog before proceeding with privileged actions. Parent processes such as
osascript, node, or bun, or unsigned binaries from user-writable paths, are uncommon legitimate sources for this
behavior.
"""
id = "3a58bc7d-bc64-4ae1-8b09-16e48e35d968"
license = "Elastic License v2"
name = "Potential Credential Validation via Sudo from Unusual Parent"
os_list = ["linux", "macos"]
reference = ["https://www.wiz.io/blog/threat-actors-target-crypto-orgs"]
version = "1.0.1"

query = '''
process where event.type == "start" and event.action == "exec" and process.args_count <= 8 and
  (
    (process.name == "sudo" and process.args == "-k" and process.args == "-S") or 
    (process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and process.command_line like "*sudo -k -S *")
   ) and
  (
    (process.parent.name in ("osascript", "node", "bun") or process.parent.name like "python*") or
    
    process.parent.executable like (
      "/Users/*", "/private/tmp/*", "/tmp/*", "/var/tmp/*", "/home/*/*", "/run/user/*",
      "/var/run/user/*", "/dev/shm/*"
    )
   )
'''

min_endpoint_version = "8.10.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1056"
name = "Input Capture"
reference = "https://attack.mitre.org/techniques/T1056/"
[[threat.technique.subtechnique]]
id = "T1056.002"
name = "GUI Input Capture"
reference = "https://attack.mitre.org/techniques/T1056/002/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "8.10.0"