Elastic rules: 3b

[metadata]
creation_date = "2024/05/31"
integration = ["aws"]
maturity = "production"
updated_date = "2026/04/10"

[rule]
author = ["Elastic"]
description = """
An adversary with access to a set of compromised credentials may attempt to persist or escalate privileges by attaching
additional permissions to compromised IAM roles. This rule looks for use of the IAM AttachRolePolicy API operation to
attach the highly permissive AdministratorAccess AWS managed policy to an existing IAM role.
"""
false_positives = [
    """
    While this can be normal behavior, it should be investigated to ensure validity. Verify whether the user identity
    should be using the IAM `AttachRolePolicy` API operation to attach the `AdministratorAccess` policy to the target
    role.
    """,
]
from = "now-6m"
index = ["logs-aws.cloudtrail-*"]
language = "eql"
license = "Elastic License v2"
name = "AWS IAM AdministratorAccess Policy Attached to Role"
note = """## Triage and analysis

### Investigating AWS IAM AdministratorAccess Policy Attached to Role

The `AdministratorAccess` managed policy grants unrestricted privileges.  
When attached to a role, it can enable privilege escalation or persistence, especially if the role is assumable by other accounts or services.  
This rule detects `AttachRolePolicy` events where the `policyName` is `AdministratorAccess`.

#### Possible investigation steps

- **Identify both identities.**  
  Determine the calling user or role (`aws.cloudtrail.user_identity.arn`) and the target role (`aws.cloudtrail.request_parameters.roleName`).  
  Validate whether this change aligns with intended administrative actions.  

- **Review the target role’s trust policy.**  
  Examine who can assume the role (`AssumeRolePolicyDocument`).  
  If the role is assumable by external accounts, this may indicate a potential persistence or lateral movement path.  

- **Review CloudTrail details.**  
  Check `source.ip`, `user_agent.original`, and `source.geo` fields for anomalies.  
  Compare with historical operations by the same principal.  

- **Correlate with adjacent IAM events.**  
  Look for `UpdateAssumeRolePolicy`, `CreateAccessKey`, or `PassRole` calls.  
  These often accompany privilege escalation activity.  

- **Inspect downstream activity.**  
  Query CloudTrail for recent `AssumeRole` calls for the target role — determine if the newly elevated permissions were used.  

### False positive analysis

- **Delegated role management.**  
  Cloud administrators may legitimately grant temporary AdministratorAccess for troubleshooting. Confirm through tickets or change logs.  
- **Automation or service-linked roles.**  
  Some services attach policies automatically for setup; verify whether the target is a service-linked role.  

### Response and remediation

**Immediate containment**
- Detach the policy. Remove the `AdministratorAccess` policy from the target role.  
- Restrict access. Temporarily revoke the caller’s IAM privileges until the legitimacy of the action is confirmed.  
- Audit trust policies. Review the role’s trust relationships to ensure only approved principals can assume it.  
- Rotate credentials for any principals who assumed the affected role during the period of elevated privileges.  

**Evidence preservation**
- Export the triggering `AttachRolePolicy` event and related CloudTrail entries ±30 minutes from the alert.  
- Preserve AWS Config snapshots and GuardDuty findings for traceability.  

**Scoping and investigation**
- Identify if the elevated role was subsequently assumed.  
  Correlate by matching `aws.cloudtrail.eventName:AssumeRole` with the target role ARN.  
- Search for other recent IAM policy attachments or modifications by the same actor or IP.  

**Recovery and hardening**
- Apply least privilege policies; limit who can attach or modify administrative policies.  
- Enforce IAM Conditions such as `aws:PrincipalArn` or `aws:ResourceTag` to limit policy attachment scope.  
- Enable CloudTrail, GuardDuty, and Security Hub across all regions.  
- Implement SCPs at the organization level to restrict direct `AdministratorAccess` attachments.  

### Additional information
- **[AWS IR Playbooks](https://github.com/aws-samples/aws-incident-response-playbooks/blob/c151b0dc091755fffd4d662a8f29e2f6794da52c/playbooks/): response steps related to IAM policy modification and unauthorized privilege escalation..  
- **[AWS Customer Playbook Framework](https://github.com/aws-samples/aws-customer-playbook-framework/): for containment, analysis, and recovery guidance.
- **AWS Documentation:** [AdministratorAccess Policy](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.html#jf_administrator).  
"""
references = [
    "https://docs.aws.amazon.com/IAM/latest/APIReference/API_AttachRolePolicy.html",
    "https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AdministratorAccess.html",
    "https://hackingthe.cloud/aws/exploitation/iam_privilege_escalation/",
]
risk_score = 47
rule_id = "dde13d58-bc39-4aa0-87fd-b4bdbf4591da"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Data Source: AWS",
    "Data Source: Amazon Web Services",
    "Data Source: AWS IAM",
    "Use Case: Identity and Access Audit",
    "Tactic: Privilege Escalation",
    "Tactic: Persistence",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
iam where data_stream.dataset == "aws.cloudtrail"
   and event.provider == "iam.amazonaws.com"
   and event.action == "AttachRolePolicy"
   and event.outcome == "success"
   and stringContains(aws.cloudtrail.request_parameters, "policyArn=arn:aws:iam::aws:policy/AdministratorAccess")
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"
[[rule.threat.technique.subtechnique]]
id = "T1098.003"
name = "Additional Cloud Roles"
reference = "https://attack.mitre.org/techniques/T1098/003/"



[rule.threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"
[[rule.threat.technique.subtechnique]]
id = "T1098.003"
name = "Additional Cloud Roles"
reference = "https://attack.mitre.org/techniques/T1098/003/"



[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user_agent.original",
    "source.ip",
    "aws.cloudtrail.user_identity.arn",
    "aws.cloudtrail.user_identity.type",
    "aws.cloudtrail.user_identity.access_key_id",
    "event.action",
    "event.outcome",
    "cloud.account.id",
    "cloud.region",
    "aws.cloudtrail.request_parameters",
]

[metadata]
creation_date = "2026/04/08"
integration = ["aws"]
maturity = "production"
updated_date = "2026/04/08"

[rule]
author = ["Elastic"]
description = """
Identifies successful calls to AWS STS GetFederationToken where request parameters reference AdministratorAccess. This API
returns temporary security credentials for a federated user with permissions bounded by the calling IAM user and any
inline session policy passed in the request. Supplying or referencing the AWS managed AdministratorAccess policy (or an
equivalent string in the policy payload) can grant broadly privileged temporary credentials and may indicate privilege
abuse or dangerous automation.
"""
false_positives = [
    """
    Highly unusual for legitimate workflows to embed or reference full administrator access in GetFederationToken session
    policies; if found, it is often legacy or misconfigured tooling. Confirm with the owning team and replace with
    least-privilege session policies. Tune only after documented approval.
    """,
]
from = "now-6m"
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
language = "kuery"
license = "Elastic License v2"
name = "AWS STS GetFederationToken with AdministratorAccess in Request"
note = """## Triage and analysis

### Investigating AWS STS GetFederationToken with AdministratorAccess in Request

`GetFederationToken` issues temporary credentials (typically up to 36 hours) for a **federated user name** you specify.
The effective permissions are the **intersection** of the IAM user’s permissions and the optional session policy in the
request. Including `AdministratorAccess` in `Policy` (or a policy ARN / JSON that names it) is almost always
over-privileged for federation use cases. For first-time `GetFederationToken` usage without this policy signal, see
**AWS First Occurrence of STS GetFederationToken Request by User**.

**Note:** AWS documents that `GetFederationToken` must be called with **long-term IAM user credentials** (not role
temporary credentials). Pivot on `aws.cloudtrail.user_identity.arn` and `access_key_id` accordingly.

#### Possible investigation steps

- Parse `aws.cloudtrail.request_parameters` for `name`, `policy`, and `durationSeconds`.
- Confirm whether the IAM user should perform federation or if the key may be compromised.
- Search CloudTrail for subsequent events using `response_elements.credentials.accessKeyId` from the same response (if
  logged).
- Correlate with IAM changes, data-plane access, or other STS calls from the same `source.ip` in a ±30 minute window.

### False positive analysis

- Typos or test accounts in non-production: still validate and narrow session policies.

### Response and remediation

- Revoke or rotate the IAM user access keys involved; enforce least privilege on the user and replace broad session
  policies.
- [GetFederationToken](https://docs.aws.amazon.com/STS/latest/APIReference/API_GetFederationToken.html)

### Additional information

- [AWS STS temporary security credentials](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp.html)
"""
references = [
    "https://docs.aws.amazon.com/STS/latest/APIReference/API_GetFederationToken.html",
    "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html",
]
risk_score = 73
rule_id = "f2a3b4c5-d6e7-4f89-a012-b3c4d5e6f789"
severity = "high"
tags = [
    "Domain: Cloud",
    "Domain: Identity",
    "Data Source: AWS",
    "Data Source: Amazon Web Services",
    "Data Source: AWS STS",
    "Use Case: Threat Detection",
    "Tactic: Privilege Escalation",
    "Tactic: Lateral Movement",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
event.dataset: "aws.cloudtrail"
    and event.provider: "sts.amazonaws.com"
    and event.action: "GetFederationToken"
    and event.outcome: "success"
    and aws.cloudtrail.request_parameters: *AdministratorAccess*
'''

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user_agent.original",
    "source.ip",
    "aws.cloudtrail.user_identity.arn",
    "aws.cloudtrail.user_identity.type",
    "aws.cloudtrail.user_identity.access_key_id",
    "event.action",
    "event.outcome",
    "cloud.account.id",
    "cloud.region",
    "aws.cloudtrail.request_parameters",
    "aws.cloudtrail.response_elements",
]

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1548"
name = "Abuse Elevation Control Mechanism"
reference = "https://attack.mitre.org/techniques/T1548/"

[[rule.threat.technique.subtechnique]]
id = "T1548.005"
name = "Temporary Elevated Cloud Access"
reference = "https://attack.mitre.org/techniques/T1548/005/"

[rule.threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1550"
name = "Use Alternate Authentication Material"
reference = "https://attack.mitre.org/techniques/T1550/"

[[rule.threat.technique.subtechnique]]
id = "T1550.001"
name = "Application Access Token"
reference = "https://attack.mitre.org/techniques/T1550/001/"

[rule.threat.tactic]
id = "TA0008"
name = "Lateral Movement"
reference = "https://attack.mitre.org/tactics/TA0008/"

[metadata]
creation_date = "2026/05/20"
integration = ["azure"]
maturity = "production"
updated_date = "2026/05/20"

[rule]
author = ["Elastic"]
description = """
Identifies the successful deployment of a high-risk Azure Virtual Machine extension by an interactive user principal.
Attackers with privileged Azure RBAC roles can abuse VM extensions such as VMAccess, CustomScriptExtension, and
RunCommand to execute arbitrary code, create backdoor accounts, harvest credentials, and establish persistence on
Azure-hosted virtual machines without requiring direct network access to the VM.
"""
false_positives = [
    """
    Legitimate administrators and automation may deploy Custom Script, Run Command, DSC, or monitoring extensions during
    provisioning, patching, or guest configuration. Baseline expected principals, VMs, and extension types before
    tuning exclusions.
    """,
]
from = "now-9m"
index = ["logs-azure.activitylogs-*"]
language = "kuery"
license = "Elastic License v2"
name = "Azure VM Extension Deployment by User"
note = """## Triage and analysis

### Investigating Azure VM Extension Deployment by User

This rule flags successful `MICROSOFT.COMPUTE/VIRTUALMACHINES/EXTENSIONS/WRITE` operations performed by a user principal
where the extension resource ID matches high-risk extension families (VMAccess, Custom Script, Run Command, DSC,
Microsoft Monitoring Agent).

### Triage checklist

- Is the caller UPN a known admin or automation account?
- Is the source IP or ASN consistent with corporate infrastructure or a known VPN?
- Was this extension deployment preceded by a Run Command invocation on the same VM?
- Did the extension deployment coincide with new local account creation on the endpoint?
- Check `azure.activitylogs.identity.claims.authnmethodsreferences` — was MFA present?
- Correlate with endpoint telemetry: process events parented by `WaAppAgent.exe` or `walinuxagent` within 120 seconds of
  the extension write timestamp on the same host.

### Possible investigation steps

- Review `azure.activitylogs.identity.authorization.evidence.principal_id` and Entra sign-in logs for the caller.
- Examine `azure.resource.id` and `azure.resource.name` to identify the VM and extension type deployed.
- Pivot on the VM for `MICROSOFT.COMPUTE/VIRTUALMACHINES/RUNCOMMAND/ACTION` and endpoint Run Command or `waagent` activity.
- Review role assignments for the principal on the subscription or resource group.

### Response and remediation

- If unauthorized, remove the extension, rotate credentials, and review RBAC on the affected VM and scope.
- Isolate the VM and collect endpoint and activity log artifacts per incident procedures.
"""
references = ["https://docs.microsoft.com/en-us/azure/virtual-machines/extensions/overview"]
risk_score = 47
rule_id = "e842d39d-ead1-48c6-97f1-6b055476c2f3"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Domain: Endpoint",
    "Data Source: Azure",
    "Data Source: Azure Activity Logs",
    "Use Case: Threat Detection",
    "Tactic: Persistence",
    "Tactic: Defense Evasion",
    "Tactic: Execution",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"
query = '''
data_stream.dataset:azure.activitylogs and
azure.activitylogs.operation_name:"MICROSOFT.COMPUTE/VIRTUALMACHINES/EXTENSIONS/WRITE" and
azure.activitylogs.identity.authorization.evidence.principal_type:User and
event.outcome:(success or Success) and
azure.resource.id:(
    *VMACCESSAGENT* or
    *CUSTOMSCRIPTEXTENSION* or
    *RUNCOMMANDWINDOWS* or
    *RUNCOMMANDLINUX* or
    */DSC/* or
    *MICROSOFTMONITORINGAGENT*
)
'''

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "event.outcome",
    "azure.activitylogs.operation_name",
    "azure.activitylogs.identity.authorization.evidence.principal_id",
    "azure.activitylogs.identity.authorization.evidence.principal_type",
    "azure.activitylogs.identity.claims_initiated_by_user.name",
    "azure.resource.id",
    "azure.resource.name",
    "source.ip",
    "source.geo.country_name",
    "source.as.organization.name",
    "azure.subscription_id",
    "azure.activitylogs.tenant_id",
]

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1651"
name = "Cloud Administration Command"
reference = "https://attack.mitre.org/techniques/T1651/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1578"
name = "Modify Cloud Compute Infrastructure"
reference = "https://attack.mitre.org/techniques/T1578/"

[[rule.threat.technique.subtechnique]]
id = "T1578.002"
name = "Create Cloud Instance"
reference = "https://attack.mitre.org/techniques/T1578/002/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[rule]
description = """
Detects the execution of the Dscl binary via Osascript in order to collect user information. The AMOS malware utilizes
this technique in its AppleScripts in order to determine the current user.
"""
id = "7a7b94ce-be0f-4e2b-8af8-606199b5256e"
license = "Elastic License v2"
name = "Dscl Execution via Osascript"
os_list = ["macos"]
version = "1.0.3"

query = '''
process where event.type == "start" and event.action == "exec" and process.name == "dscl" and process.parent.name == "osascript"
'''

min_endpoint_version = "8.7.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.002"
name = "AppleScript"
reference = "https://attack.mitre.org/techniques/T1059/002/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1033"
name = "System Owner/User Discovery"
reference = "https://attack.mitre.org/techniques/T1033/"


[threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"

[internal]
min_endpoint_version = "8.7.0"

[rule]
description = """
Identifies process execution from directories that are often abused by malware such as roaming, public and programdata
folders followed by a DNS lookup request.
"""
id = "9ba39516-651e-489f-8b6a-f5501e0c492d"
license = "Elastic License v2"
name = "Execution from Suspicious Directory"
os_list = ["windows"]
version = "1.0.31"

query = '''
sequence by process.entity_id with maxspan=1m
 [process where event.action == "start" and
  process.Ext.relative_file_name_modify_time < 500 and
  (
   process.executable :
         ("?:\\Users\\Public\\*",
          "?:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\*",
          "?:\\Windows\\System32\\Tasks\\*",
          "?:\\Windows\\Tasks\\*",
          "?:\\PerfLogs\\*",
          "?:\\Windows\\Logs\\*",
          "?:\\windows\\Help\\*",
          "?:\\Windows\\INF\\*",
          "?:\\$Recycle.Bin\\*",
          "?:\\Windows\\System32\\spool\\drivers\\color\\*",
          "?:\\aaAntiRansomElastic-DO-NOT-TOUCH-*") or

   (process.executable : "?:\\Users\\*\\AppData\\Roaming\\*" and not process.executable : "?:\\Users\\*\\AppData\\Roaming\\*\\*") or

   (process.executable : "?:\\Users\\*\\AppData\\Local\\Temp\\RarSFX*" and process.code_signature.exists == false) or

   /* process name minus extension composed of numbers only */
   (process.executable : ("?:\\Users\\*\\AppData\\*", "?:\\Windows\\Temp\\*", "?:\\ProgramData\\*") and process.name regex~ """[0-9\.]+\.(exe|pif)""") or 

   (process.executable : "?:\\ProgramData\\*" and not process.executable : "?:\\ProgramData\\*\\*")
   ) and

   not process.executable :
              ("?:\\Users\\Public\\CSC\\WIC\\bin\\*.exe",
               "?:\\Users\\Public\\IBM\\ClientSolutions\\Start_Programs\\*.exe") and

   /* excluding code_sign trusted, can get noisy in certain env */
   not (process.executable : "?:\\Users\\*\\AppData\\Roaming\\*" and (process.code_signature.trusted == true or process.code_signature.status : ("errorExpired"))) and

   not process.hash.sha256 :
              ("4fbcc89b12101ed24053fec6a87b13bfdd48db0ff99a2d50d7a22e34fbd08374",
               "e967350e6ef2cfae1108e5b5c4357527d7046ad39d269b038d58f4e2f27534c9",
               "5d93774785807f0ad3890d6fa283ff78f3f98a980c8c3fc7e6bed6fa7fb8fd38",
               "997f113af57788b31020247bfda16cf204a0604aac9147aebf5d9ee49a50a522",
               "0c7a6fd57afcb8903e4d1b24fdcacd4777657a1cd7a49f418e17f055bf8def42",
               "8423445ee2bd12f9c450252b2b178f6065218328dffa43e6f6ef08482cd19251",
               "4337adaa6b26ea9ad6d7bd0871d49531442ba3d8a24aecc1a5a0f26378de4f78",
               "f97caae8172e3204538e855ee9a32f04fc41be0d67ff7e54c0c903e6dc1dbc26",
               "849b4a0d01c53a4c5f9d3eef9bc5ad2f2ffa6613b763b257a7f654596a5bbc33",
               "e0fb6d51e3a8de0e8db04d0e91517cc46f4d83a55c986b313fb333dc9e5bce83",
               "422aa4268713b6c99581365985d403a62f6ccd9f0b5a23f9d963d1947dc77aee",
               "c6a75b46eee11a5bb11f5f970b51464a34c6e007583e73f717dbfc74edb84300",
               "1333bac5283998a18f761816f0fd09028e50e89d7085f39338b57a01549e5015",
               "16a7047b0ad4873e36891c30a14bd567338be163239182d9f98647440e464320",
               "085093d8bd967ef291519b31df65a8a80dd1fc9a1d4d93140b6d3bbd34b95dd2") and

   not (process.code_signature.subject_name :
                               ("Daybreak Game Company LLC", "Prusa Research a.s.", "RHUB Communications, Inc.",
                                "Bedford, Freeman & Worth Publishing Group, LLC", "RICOH COMPANY,LTD.",
                                "NortonLifeLock Inc.") and process.code_signature.trusted == true)]
 [dns where
   dns.question.name : "*.*" and
   process.executable :
         ("?:\\Users\\Public\\*",
          "?:\\Users\\*\\AppData\\Roaming\\*",
          "?:\\Windows\\System32\\Tasks\\*",
          "?:\\Windows\\Tasks\\*",
          "?:\\ProgramData\\*",
          "?:\\PerfLogs\\*",
          "?:\\Windows\\Logs\\*",
          "?:\\windows\\Help\\*",
          "?:\\Windows\\INF\\*",
          "?:\\aaAntiRansomElastic-DO-NOT-TOUCH-*") and

   not dns.question.name :
              ("*.in-addr.arpa.",
               "www.google-analytics.com",
               "fonts.googleapis.com",
               "update.googleapis.com",
               "www.google.com",
               "ocsp.*.com",
               "ocsp.*.net",
               "dl.dell.com",
               "*.symcd.com",
               "www.hpsmart.com",
               "*.liquidnet.biz",
               "stats.norton.com",
               "ctldl.windowsupdate.com",
               "datapipeline.logitech.io")]
'''

min_endpoint_version = "8.10.0"
reputation = true
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1204"
name = "User Execution"
reference = "https://attack.mitre.org/techniques/T1204/"
[[threat.technique.subtechnique]]
id = "T1204.002"
name = "Malicious File"
reference = "https://attack.mitre.org/techniques/T1204/002/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1036"
name = "Masquerading"
reference = "https://attack.mitre.org/techniques/T1036/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"

[rule]
description = """
Identifies the execution of a script file written by a suspicious application. Script interpreters are often launched
during exploitation of Office applications or from documents containing malicious macros.
"""
id = "dc9c8c7c-f398-401f-804a-325570a5f167"
license = "Elastic License v2"
name = "Execution of a Windows Script File Written by a Suspicious Process"
os_list = ["windows"]
version = "1.0.34"

query = '''
sequence by user.id with maxspan=5m

 [file where event.action == "creation" and file.path : "C:\\*" and

   file.extension : ("hta", "vbs", "js", "wsf", "vbe", "jse") and not user.id : "S-1-5-18" and

   not (process.code_signature.subject_name :
            ("AUTO/MATE, INC.", "TeamViewer*", "KOBIL Systems GmbH", "Ratiborus MSFree Inc.",
             "Canon Electronics Inc.", "Johannes Schindelin", "Bomgar Corporation", "PFU LIMITED",
             "Learnpulse", "Azul Systems, Inc.") and
        process.code_signature.trusted == true) and
   not process.executable :
              ("?:\\ProgramData\\Microsoft\\VisualStudio\\Packages\\*.exe",
               "?:\\Program Files\\SWSetup\\SP100309\\Lexus FW Upgrade 0007.exe", 
               "?:\\Program Files (x86)\\Imprivata\\OneSign Agent\\x64\\ISXAgent.exe") and

   not (process.executable : "?:\\Users\\*\\AppData\\Roaming\\zozi-rpa-engine\\openjdk\\bin\\java.exe" and
        file.path : "C:\\Project\\*.vbs") and

   not file.path : "C:\\WINDOWS\\TEMP\\*.vbs" and

   not file.Ext.header_bytes :
                 ("0d0a272d2d2d2d2d2d2d2d2d2d2d2d2d", "272a2a2a2a2a2a2a2a2a2a2a2a2a2a2a",
                  "4966204e6f742049734f626a65637428", "4f6e204572726f7220526573756d6520",
                  "53657420554143203d20437265617465", "53006500740020006f0062006a004600",
                  "53006500740020005500410043002000", "4f4e204552524f5220524553554d4520",
                  "4372656174654f626a65637428225773") and

   (
     process.name : ("winword.exe", "excel.exe", "outlook.exe", "powerpnt.exe", "eqnedt32.exe", "fltldr.exe",
                     "mspub.exe", "msaccess.exe", "certutil.exe", "tar.exe", "CertReq.exe", "xcopy.exe", 
                     "cmd.exe", "powershell.exe", "mshta.exe", "curl.exe", "pwsh.exe", "rundll32.exe", 
                     "regsvr32.exe") or

     (process.code_signature.trusted == false or process.code_signature.exists == false) or

     process.executable : ("?:\\Users\\*\\AppData\\*", "?:\\ProgramData\\*", "?:\\Users\\Public\\*")
   )] as event0

 [process where event.action == "start" and
  process.name : ("wscript.exe", "mshta.exe") and
  startswith~(process.args, event0.file.path) and
  not (process.args : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*") and process.args_count <= 3) and
  not (process.name : "wscript.exe" and process.parent.name : "cmd.exe" and
       process.parent.command_line : ("*Desktop\\PROTECTAgentInstaller.bat*", "*cleanupSetup.vbs Shell_*.log*")) and
  not process.parent.executable :
                    ("?:\\Program Files (x86)\\Virus Chaser\\pcms\\patch\\_incomming_files\\KDB_Trellix_Agent_BG.sfx.exe",
                     "?:\\Program Files (x86)\\UPS\\CrossWare\\CrossWare.exe",
                     "?:\\Program Files\\UPS\\CrossWare\\CrossWare.exe",
                     "?:\\Program Files (x86)\\Common Files\\InstallShield\\Driver\\8\\Intel 32\\IDriver.exe") and
  not (process.parent.args : "-no_selfdeleter" and process.parent.args : "-IS_temp") and
  not (process.parent.args : "-removeonly" and process.parent.args : "-runfromtemp") and
  not (process.name : "wscript.exe" and process.parent.name : "cmd.exe" and
       process.parent.args : ("?:\\PROGRA~2\\Baxter\\*\\REGIST~1.BAT", "PrepStation\\registerCameraStand.bat", "?:\\Program Files (x86)\\Baxter\\*")) and
  not (process.parent.args : "http*://*:8282/dataloader/*" and process.args : "?:\\Windows\\TEMP\\Spiceworks\\spiceworks_upload.vbs") and
  not (process.parent.args : "C:\\XperCon\\_Xtra\\PDF_Rename\\pdf_rename.bat" and process.args : "C:\\XperCon\\_Xtra\\PDF_Rename\\transform.vbs") and
  not (process.parent.args : "C:\\CSM Infopath Templates\\Register CSM InfoPath Templates.exe" and process.args : "C:\\CSM Infopath Templates\\installAllTemplates.vbs") and
  not (process.parent.name : "cmd.exe" and process.parent.args : "%TEMP%\\Spiceworks\\*") and
  not (process.name : "mshta.exe" and process.parent.name : "mshta.exe"  and process.parent.args : "\\\\*\\netlogon\\ADSelfService_Enroll.hta") and
  not (process.parent.name : "JustWareSmartClient.exe" and process.executable : "C:\\Windows\\SysWOW64\\wscript.exe") and

  /* FP - contentACCESS (TECH-ARROW) Outlook email archiving add-in */
  not process.args : "?:\\Users\\*\\AppData\\Local\\Temp\\contentACCESSForm\\RunAction.vbs" and

  /* FP - domain login scripts dropping uacinstall.vbs via netlogon */
  not (process.parent.name : "cmd.exe" and process.parent.args : "\\\\*\\netlogon\\*" and
       process.args : "*\\uacinstall.vbs")
  ]
'''

min_endpoint_version = "8.4.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.001"
name = "PowerShell"
reference = "https://attack.mitre.org/techniques/T1059/001/"

[[threat.technique.subtechnique]]
id = "T1059.005"
name = "Visual Basic"
reference = "https://attack.mitre.org/techniques/T1059/005/"

[[threat.technique.subtechnique]]
id = "T1059.007"
name = "JavaScript"
reference = "https://attack.mitre.org/techniques/T1059/007/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[[threat.technique.subtechnique]]
id = "T1218.005"
name = "Mshta"
reference = "https://attack.mitre.org/techniques/T1218/005/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.4.0"

[rule]
description = """
This rule detects when a process creates a (memory) file descriptor and creates, or modifies, a file. This behavior may
indicate the creation of a second stage payload, after the first fileless stage has executed.
"""
id = "8cc1c545-7cd2-42c0-964c-1e6731b26647"
license = "Elastic License v2"
name = "File Creation or Modification via (Memory) File Descriptor"
os_list = ["linux"]
reference = ["https://man7.org/linux/man-pages/man2/memfd_create.2.html"]
version = "1.0.3"

query = '''
file where event.type != "deletion" and (
  process.executable regex """/proc/(self|[0-9]{1,7})/fd/[0-9]{1,7}""" or
  process.executable like ("memfd:*", "?memfd:*")
) and
file.path like (
  "/tmp/*", "/var/tmp/*", "/dev/shm/*", "/run/user/*", "/var/run/user/*", "/boot/*",
  "/lost+found/*", "/var/mail/*", "/var/www/*", "/home/*/*", "/root/*"
) and
not (
  process.executable like ("?memfd:/sophos-subprocess-*-exec*", "memfd:/sophos-subprocess-*-exec*") or
  process.executable in (
    "memfd:spawn_worker_trampoline", "memfd:buildah-chroot-runtime", "memfd:lxc-attach",
    "memfd:teleport-sessionhelper", "memfd:buildah-chroot-exec"
  ) or
  (process.executable == "/memfd: (deleted)" and file.path like "/var/tmp/etilqs_*") or
  file.path like (
    "/tmp/tmp.*", "/tmp/syft-cataloger-*/*", "/home/*/.local/state/wireplumber/*",
    "/run/user/0/systemd/units/invocation:gpg-agent.socket", "/run/user/0/systemd/units/invocation:ssh-agent.socket"
  )
)
'''

min_endpoint_version = "9.1.4"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1106"
name = "Native API"
reference = "https://attack.mitre.org/techniques/T1106/"


[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"
[[threat.technique.subtechnique]]
id = "T1055.009"
name = "Proc Memory"
reference = "https://attack.mitre.org/techniques/T1055/009/"


[[threat.technique]]
id = "T1620"
name = "Reflective Code Loading"
reference = "https://attack.mitre.org/techniques/T1620/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "9.1.4"

[metadata]
creation_date = "2026/01/30"
integration = ["endpoint"]
maturity = "production"
updated_date = "2026/03/24"

[rule]
author = ["Elastic"]
description = """
Detects suspicious access to the /Library/Preferences/com.apple.TimeMachine.plist file, indicating a potential 
attempt to verify or exploit Full Disk Access (FDA) permissions. This file is often checked by malware to 
confirm FDA privileges, which allow unrestricted access to sensitive user data.
"""
from = "now-9m"
index = ["logs-endpoint.events.file-*"]
language = "eql"
license = "Elastic License v2"
name = "Full Disk Access Permission Check"
note = """ ## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Full Disk Access Permission Check

This rule detects suspicious reads of the Time Machine preferences plist that adversaries use as a quick litmus test for Full Disk Access, a permission that unlocks broad visibility into user and system data. Attackers commonly launch a scriptable or unsigned helper (for example via Python or AppleScript) to open this file, confirm FDA is present, then proceed to enumerate and collect protected artifacts like browser stores, messages, or backups.

### Possible investigation steps

- Validate the opening process lineage (parent/child chain, launch method, user session) to determine whether the access originated from an interactive admin action or an unexpected background helper.  
- Review the process code-signing identity (signer, notarization, team ID) and binary provenance (download attributes, install source, first-seen time) to distinguish legitimate tooling from potentially dropped or trojanized executables.  
- Pivot to other file and directory access by the same process around the alert time to identify follow-on discovery/collection of protected user data (e.g., browser profiles, keychain-related paths, Messages, Mail, backups).  
- Check recent and concurrent macOS privacy permission changes and TCC/FDA-related events for the user and process to see if FDA was newly granted, prompted, or bypassed preceding the access.  
- Correlate with network activity from the same process or host after the check (new outbound connections, uploads, DNS to uncommon domains) to assess whether the FDA verification preceded staging or exfiltration.

### False positive analysis

- An administrator or power user running an interactive shell (Terminal, bash/sh, python) executes a local audit or troubleshooting script that reads /Library/Preferences/com.apple.TimeMachine.plist to confirm Time Machine configuration and permissions.  
- A developer or IT engineer uses a scripting runtime (osascript, node, ruby, perl, python) during endpoint diagnostics to check whether the current session/app context has Full Disk Access by attempting to open the Time Machine preference plist.

### Response and remediation

- Isolate the Mac from the network or apply host firewall blocks if the plist access comes from an unexpected/unsigned process or occurs outside an active user session to prevent follow-on collection and exfiltration.  
- Terminate the offending process and remove its persistence (LaunchAgents/LaunchDaemons, cron, login items) and any newly dropped executables or scripts found in user-writable paths that launched the plist check.  
- Revoke Full Disk Access for the suspicious app in Privacy & Security settings, reset TCC permissions if tampering is suspected, and rotate credentials/tokens exposed on the host (browser sessions, SSH keys, API keys) if protected data access is likely.  
- Collect and preserve evidence (the binary and its hash, quarantine/xattr info, parent process, relevant unified logs, and a copy of the accessed plist) before cleanup, then run a full endpoint malware scan and validate no additional sensitive files were accessed immediately after the check.  
- Restore system integrity by updating macOS and security tools, reinstalling or re-imaging if core components were modified, and confirm normal Time Machine configuration after remediation to ensure operational recovery.  
- Escalate to IR/SECOPS immediately if the process is unsigned/notarization-missing, shows persistence, or makes outbound connections after the plist read, and harden by enforcing MDM controls that restrict FDA grants and block execution of untrusted scripting runtimes where feasible.
"""
risk_score = 47
rule_id = "e26c0f76-2e80-445b-9e98-ab5532ccc46f"
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: macOS",
    "Use Case: Threat Detection",
    "Tactic: Discovery",
    "Data Source: Elastic Defend",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"
query = '''
file where host.os.type == "macos" and event.action == "open" and
  file.path == "/Library/Preferences/com.apple.TimeMachine.plist" and
  (process.name in ("osascript", "perl", "node", "ruby", "bash", "sh", "Terminal") or
   process.name like "python*" or
   process.code_signature.trusted == false or
   process.code_signature.exists == false)
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1083"
name = "File and Directory Discovery"
reference = "https://attack.mitre.org/techniques/T1083/"

[rule.threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1548"
name = "Abuse Elevation Control Mechanism"
reference = "https://attack.mitre.org/techniques/T1548/"

[[rule.threat.technique.subtechnique]]
id = "T1548.006"
name = "TCC Manipulation"
reference = "https://attack.mitre.org/techniques/T1548/006/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1548"
name = "Abuse Elevation Control Mechanism"
reference = "https://attack.mitre.org/techniques/T1548/"

[[rule.threat.technique.subtechnique]]
id = "T1548.006"
name = "TCC Manipulation"
reference = "https://attack.mitre.org/techniques/T1548/006/"

[rule.threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[metadata]
creation_date = "2025/12/04"
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender"]
maturity = "production"
updated_date = "2026/08/10"

[rule]
author = ["Elastic"]
building_block_type = "default"
description = """
Detects child process execution from GenAI tools or MCP (Model Context Protocol) servers. Adversaries exploit AI agents
to execute system commands, exfiltrate data, or establish persistence. MCP servers provide LLMs direct access to execute
shell commands, read files, and interact with external services. This building block provides visibility into
AI-initiated process execution for correlation with other suspicious activity.
"""
from = "now-119m"
index = [
    "logs-endpoint.events.process-*",
    "logs-windows.sysmon_operational-*",
    "logs-m365_defender.event-*",
    "logs-sentinel_one_cloud_funnel.*",
]
interval = "60m"
language = "eql"
license = "Elastic License v2"
name = "GenAI or MCP Server Child Process Execution"
risk_score = 21
rule_id = "b2c3d4e5-f6a7-8901-bcde-f23456789012"
severity = "low"
tags = [
    "Domain: Endpoint",
    "OS: Linux",
    "OS: macOS",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Execution",
    "Data Source: Elastic Defend",
    "Data Source: Sysmon",
    "Data Source: Microsoft Defender XDR",
    "Data Source: SentinelOne",
    "Rule Type: BBR",
    "Domain: LLM",
    "Mitre Atlas: T0053",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
process where event.type == "start" 
  and (
    // GenAI clients
    process.parent.name in (
      "Cursor", "Cursor.exe", "cursor",
      "Cursor Helper", "Cursor Helper (Plugin)", "Cursor Helper (GPU)", "Cursor Helper (Renderer)",
      "Claude", "Claude.exe", "claude",
      "Claude Helper", "Claude Helper (Plugin)", "Claude Helper (GPU)", "Claude Helper (Renderer)",
      "Windsurf", "Windsurf.exe", "windsurf",
      "Windsurf Helper", "Windsurf Helper (Plugin)", "Windsurf Helper (GPU)", "Windsurf Helper (Renderer)",
      "Code", "Code.exe", "code",
      "Code Helper", "Code Helper (Plugin)", "Code Helper (GPU)", "Code Helper (Renderer)",
      "codex", "codex.exe",
      "Copilot", "Copilot.exe", "copilot",
      "Jan", "Jan.exe", "jan",
      "Jan Helper", "Jan Helper (Plugin)", "Jan Helper (GPU)", "Jan Helper (Renderer)",
      "LM Studio", "LM Studio.exe", "lmstudio",
      "Ollama", "Ollama.exe", "ollama",
      "GPT4All", "gpt4all", "gpt4all.exe",
      "textgen.exe", "textgen", "text-generation-webui.exe", "oobabooga.exe",
      "gemini-cli.exe", "gemini-cli",
      "genaiscript.exe", "genaiscript",
      "grok.exe", "grok",
      "qwen.exe", "qwen",
      "koboldcpp.exe", "koboldcpp", "KoboldCpp",
      "llama-server", "llama-cli",
      "OpenClaw", "openclaw", "openclaw.exe",
      "Moltbot", "moltbot", "moltbot.exe",
      "Clawdbot", "clawdbot", "clawdbot.exe"
    ) or
    // OpenClaw/Moltbot/Clawdbot via Node.js
    (process.parent.name in ("node", "node.exe") and
     process.parent.command_line like~ ("*openclaw*", "*moltbot*", "*clawdbot*")) or
    // Package managers running MCP servers
    (process.parent.name in ("npx", "npx.exe", "pnpm", "pnpm.exe", "yarn", "yarn.exe", "bunx", "bunx.exe") and
     process.parent.command_line like~ ("*@modelcontextprotocol/*", "*mcp-server-*", "*mcp_server*")) or
    
    // Node/Deno/Bun running MCP servers
    (process.parent.name in ("node", "node.exe", "deno", "deno.exe", "bun", "bun.exe") and
     process.parent.command_line like~ ("*@modelcontextprotocol/*", "*mcp-server-*", "*mcp_server*")) or
    
    // Python MCP servers
    (process.parent.name like~ "python*" and
     process.parent.command_line like~ ("*-m mcp_server*", "*mcp-server-*", "*mcp_server*")) or
    
    // MCP server binaries
    process.parent.name like~ ("mcp-server*", "*-mcp-server", "*_mcp_server*") or
    process.parent.name in ("mcp-server", "mcp-server-elastic-cloud", "github-mcp-server")
  )
  and process.name != null
  // Exclusions
  and not (
    // Runtime self-spawns
    (process.parent.name in ("node", "node.exe") and process.name in ("node", "node.exe")) or
    (process.parent.name like~ "python*" and process.name like~ "python*") or
    (process.parent.name in ("deno", "deno.exe") and process.name in ("deno", "deno.exe")) or
    (process.parent.name in ("bun", "bun.exe") and process.name in ("bun", "bun.exe")) or
    
    // Electron helper noise: app -> helper, and helper -> helper
    (process.parent.name like~ ("Cursor", "Cursor.exe", "Cursor Helper*") and
     process.name like~ "Cursor Helper*") or
    (process.parent.name like~ ("Claude", "Claude.exe", "Claude Helper*") and
     process.name like~ "Claude Helper*") or
    (process.parent.name like~ ("Windsurf", "Windsurf.exe", "Windsurf Helper*") and
     process.name like~ "Windsurf Helper*") or
    (process.parent.name like~ ("Code", "Code.exe", "Code Helper*") and
     process.name like~ "Code Helper*") or
    (process.parent.name like~ ("Jan", "Jan.exe", "Jan Helper*") and
     process.name like~ "Jan Helper*") or
    (process.parent.name like~ ("LM Studio", "LM Studio.exe", "LM Studio Helper*") and
     process.name like~ ("LM Studio", "LM Studio.exe", "LM Studio Helper*")) or
    (process.parent.name like~ ("Ollama", "Ollama.exe", "Ollama Helper*") and
     process.name like~ "Ollama Helper*") or

    // GenAI client same-name self-spawns (explicit pairs; no field-to-field compare)
    (process.parent.name like~ ("cursor", "cursor.exe") and
     process.name like~ ("cursor", "cursor.exe")) or
    (process.parent.name like~ ("claude", "claude.exe") and
     process.name like~ ("claude", "claude.exe")) or
    (process.parent.name like~ ("windsurf", "windsurf.exe") and
     process.name like~ ("windsurf", "windsurf.exe")) or
    (process.parent.name like~ ("code", "code.exe") and
     process.name like~ ("code", "code.exe")) or
    (process.parent.name like~ ("codex", "codex.exe") and
     process.name like~ ("codex", "codex.exe")) or
    (process.parent.name like~ ("copilot", "copilot.exe") and
     process.name like~ ("copilot", "copilot.exe")) or
    (process.parent.name like~ ("jan", "jan.exe") and
     process.name like~ ("jan", "jan.exe")) or
    (process.parent.name like~ ("ollama", "ollama.exe") and
     process.name like~ ("ollama", "ollama.exe")) or

    // docker
    (process.name in ("docker", "docker.exe") and process.args == "context" and process.args == "ls") or
    // env probes: ps/getconf/lsb_release by name; neighbor/arp/which by args or /bin/sh -c
    (
      process.name in ("ps", "getconf", "lsb_release") or
      process.args in (
        "ip neigh show",
        "arp -a -n -l",
        "ip neighbor show dev wlan0",
        "ip neighbor show dev eth0",
        "arp -a | findstr /C:---"
      ) or
      process.command_line in (
        "/bin/sh -c ip neigh show",
        "/bin/sh -c arp -a -n -l",
        "/bin/sh -c /bin/ps -ax -o pid=,ppid=,pcpu=,pmem=,command=",
        "/bin/sh -c which ps"
      )
    ) or
    // git
    (process.name in ("git", "git.exe") and (
      (process.args == "remote" and process.args == "get-url" and process.args == "origin") or
      (process.args == "symbolic-ref" and process.args == "refs/remotes/origin/HEAD" and process.args == "--short") or
      (process.args == "rev-parse" and process.args == "--abbrev-ref" and process.args == "HEAD") or
      (process.args == "status" and process.args == "-z" and process.args == "-uall") or
      (process.args == "config" and process.args == "--get" and process.args == "commit.template") or
      (process.args == "config" and process.args == "user.email") or
      (process.args == "rev-parse" and process.args == "--show-toplevel")
    )) or
    // version / help
    process.args in ("--version", "--help", "-v", "-h", "-V", "version", "help")
  )
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"


[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[metadata]
creation_date = "2026/06/25"
integration = ["network_traffic"]
maturity = "production"
updated_date = "2026/06/25"

[rule]
author = ["Elastic"]
description = """
Identifies ICMP Redirect messages (type 5 for IPv4, type 137 for IPv6) sourced from an internal IPv4 or IPv6 address.
Legitimate redirects are normally sent only by on-path routers. A workstation or server emitting redirects can indicate
route manipulation for adversary-in-the-middle activity.
"""
from = "now-9m"
index = ["logs-network_traffic.icmp-*"]
language = "kuery"
license = "Elastic License v2"
name = "ICMP Redirect Message from Internal Host"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating ICMP Redirect Message from Internal Host

ICMP Redirect instructs a host to send traffic for a destination through a different next hop. On most enterprise
segments, only infrastructure routers should emit redirects; a user workstation or server doing so is a strong
adversary-in-the-middle indicator.

### Possible investigation steps

- Identify the redirect source in `source.ip` and locate the asset on the VLAN. Confirm whether it is an authorized
  router or gateway.
- Review the redirect target and affected destination in ICMP fields and adjacent flow records to see which routes or
  resolvers were being manipulated.
- Check whether affected clients show DNS, gateway, or VPN routing changes around the alert time.
- Correlate with DHCP, ARP, or LLMNR/NBT-NS alerts on the same segment for combined MITM activity.

### False positive analysis

- Some legacy network appliances, hypervisor gateways, or misconfigured Linux hosts with IP forwarding enabled may
  emit redirects. Maintain exceptions for known router and gateway IPs after validation.
- Lab networks that intentionally test route injection should be scoped out by source subnet.

### Response and remediation

- Isolate the emitting host if it is not an authorized router.
- Disable ICMP redirect acceptance on affected clients where policy allows, and block redirect-generating hosts at the
  access layer.
- Review segment routing, default gateways, and DHCP options for unauthorized changes."""
references = [
    "https://www.rfc-editor.org/rfc/rfc792",
    "https://www.rfc-editor.org/rfc/rfc4443",
    "https://zimperium.com/blog/doubledirect-zimperium-discovers-full-duplex-icmp-redirect-attacks-in-the-wild",
]
risk_score = 73
rule_id = "2014ebd8-b847-4cc0-a827-d0d61ec88680"
setup = """## Setup

This rule requires ICMP transaction telemetry from the Elastic network_traffic integration (`network_traffic.icmp`
data stream). Flow-only exporters that do not record ICMP type/code will not satisfy this rule.
"""
severity = "high"
tags = [
    "Domain: Network",
    "Tactic: Credential Access",
    "Use Case: Threat Detection",
    "Use Case: Network Security Monitoring",
    "Data Source: Network Traffic",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset:network_traffic.icmp
  and (network_traffic.icmp.request.type:(5 or 137) or icmp.request.type:(5 or 137))
  and source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or "FC00::/7" or "FE80::/10")
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1557"
name = "Adversary-in-the-Middle"
reference = "https://attack.mitre.org/techniques/T1557/"


[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"