Elastic rules: 3c

[metadata]
creation_date = "2020/07/21"
integration = ["aws"]
maturity = "production"
updated_date = "2026/04/10"

[rule]
author = ["Elastic"]
description = """
Identifies a high number of failed authentication attempts to the AWS management console for the Root user identity. An
adversary may attempt to brute force the password for the Root user identity, as it has complete access to all services
and resources for the AWS account.
"""
false_positives = [
    """
    Automated processes that attempt to authenticate using expired credentials and unbounded retries may lead to false
    positives.
    """,
]
from = "now-6m"
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
language = "kuery"
license = "Elastic License v2"
name = "AWS Management Console Brute Force of Root User Identity"
note = """## Triage and analysis

### Investigating AWS Management Console Brute Force of Root User Identity

The AWS Management Console provides a web interface for managing AWS resources. Because the root user has unrestricted privileges, repeated failed console login attempts targeting this identity represent a high-risk credential access event. Even if no login succeeded, this activity may indicate reconnaissance, password spraying, or credential stuffing attempts targeting the root user.

This rule uses a threshold rule that detects a high number of failed `ConsoleLogin` events (`event.outcom: failure` with `userIdentity.type: Root`) within a short timeframe from the same IP address or user agent.  
Threshold rules only summarize grouped field values, so analysts must use timeline to review the actual events that triggered the alert.

#### Possible investigation steps

- **Review in Timeline.**  
  Open the alert and *Investigate in timeline* to view the individual CloudTrail events contributing to the threshold alert. Review:  
  - `source.ip`, `user_agent.original`, `geo fields` and `@timestamp` for each failure.  
  - Look for patterns such as distributed sources or repeated retries at consistent intervals.  
  - Look for any corresponding successful `ConsoleLogin` events around the same timeframe from the same IP or agent.

- **Assess IP reputation and geolocation.**  
  Use IP intelligence tools to evaluate whether the source addresses belong to known cloud providers, TOR nodes, or foreign regions outside your normal operations.  
  - Correlate against `cloud.region` and `geo fields` and compare with expected login locations for your organization.

- **Check for related activity.**  
  Review CloudTrail for other API calls from the same source IP (for example, `GetSessionToken`, `AssumeRole`, or `ListUsers`) that may indicate scripted credential testing or discovery.

- **Correlate with GuardDuty findings.**  
  GuardDuty may raise complementary findings for anomalous console login behavior or brute force attempts. Review recent GuardDuty and AWS Config alerts for the same timeframe.

- **Determine business context.**  
  Confirm whether the source IPs are internal (for example, corporate VPN, IT admin network) or part of legitimate red-team or third-party testing. If uncertain, treat as suspicious.

### False positive analysis

- **Forgotten or mistyped credentials.**  
  Repeated failed logins from known internal IPs could indicate a legitimate user typing errors. Validate by checking if a successful root login followed soon after.  
- **Automation or scanners.**  
  Misconfigured monitoring tools or old browser sessions attempting to reuse cached credentials may trigger this rule.  
- **Planned penetration testing.**  
  Red-team or security testing activities can generate deliberate brute force attempts. Verify via ticketing or testing schedules.

### Response and remediation

> The AWS Incident Response Playbooks classify root login attempts as Priority-1 credential compromise events.  
> Follow these steps whether or not your organization has a formal IR team.

**Immediate containment**
- **Check for success.**  
  After pivoting to Timeline, confirm whether any `ConsoleLogin` events from the same IP or user agent show `event.oucome: success`.  
  - If a successful login occurred, immediately follow the *AWS Management Console Root Login* rule investigation guide.  
- **Rotate the root password.**  
  Use AWS’s password reset function to set a strong, unique password stored in an offline vault.  
- **Enable or verify Multi-Factor Authentication (MFA)** on the root account. If MFA was already configured, review the device registration for changes or suspicious resets.  
- **Block offending IPs or networks.**  
  Use AWS WAF, VPC network ACLs, or Security Groups to temporarily block the IPs used in the failed attempts.  
- **Alert internal teams.**  
  Notify your security operations or cloud governance teams of the brute force pattern and actions taken.

**Evidence preservation**
- Export all failed `ConsoleLogin` events visible in Timeline (±30 minutes around the alert window) to a restricted evidence bucket.  
- Preserve GuardDuty findings, AWS Config history, and CloudTrail logs for the same timeframe for further analysis.

**Scoping and investigation**
- Query CloudTrail across other AWS accounts and regions for additional failed or successful `ConsoleLogin` events from the same IPs.  
- Check IAM activity for simultaneous key creation, role modifications, or new users — signs of lateral or parallel intrusion attempts.  
- Review network telemetry (VPC Flow Logs, CloudFront, WAF) to determine whether the activity originated from a distributed or scripted attack pattern.

**Recovery and hardening**
- Confirm MFA is enabled and enforced on the root account.  
- Remove any root access keys (none should exist under normal security posture).  
- Enable organization-wide CloudTrail, GuardDuty, and Security Hub across all regions.  
- Set up real-time alerts for any future `ConsoleLogin` failures from the root user exceeding expected baselines.  
- Store root credentials offline with dual-custody and document controlled access procedures.

### Additional information

- **[AWS IR Playbooks](https://github.com/aws-samples/aws-incident-response-playbooks/tree/c151b0dc091755fffd4d662a8f29e2f6794da52c/playbooks):** See “Credential Compromise” and “Account Compromise” for investigation, containment, and escalation guidance.  
- **[AWS Customer Playbook Framework](https://github.com/aws-samples/aws-customer-playbook-framework/tree/a8c7b313636b406a375952ac00b2d68e89a991f2/docs):** Reference runbooks for failed-login response, evidence preservation, and MFA enforcement.  
- **AWS Documentation:** [Tasks that require the root user](https://docs.aws.amazon.com/general/latest/gr/root-vs-iam.html#aws_tasks-that-require-root).  
- **Security Best Practices:** [AWS Knowledge Center – Security Best Practices](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/).  
"""
references = ["https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html"]
risk_score = 73
rule_id = "4d50a94f-2844-43fa-8395-6afbd5e1c5ef"
severity = "high"
tags = [
    "Domain: Cloud",
    "Data Source: AWS",
    "Data Source: Amazon Web Services",
    "Data Source: AWS Sign-In",
    "Use Case: Identity and Access Audit",
    "Tactic: Credential Access",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "threshold"

query = '''
data_stream.dataset:aws.cloudtrail and 
event.provider:signin.amazonaws.com and 
event.action:ConsoleLogin and 
aws.cloudtrail.user_identity.type:Root and 
event.outcome:failure
'''

[rule.investigation_fields]
field_names = [
    "cloud.account.id",
]

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1110"
name = "Brute Force"
reference = "https://attack.mitre.org/techniques/T1110/"

[[rule.threat.technique.subtechnique]]
id = "T1110.001"
name = "Password Guessing"
reference = "https://attack.mitre.org/techniques/T1110/001/"

[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[rule.threshold]
field = ["cloud.account.id"]
value = 10

[metadata]
creation_date = "2025/10/13"
integration = ["azure"]
maturity = "production"
updated_date = "2026/04/10"

[rule]
author = ["Elastic"]
description = """
Identifies the deletion of Azure Restore Point Collections by a user who has not previously performed this activity.
Restore Point Collections contain recovery points for virtual machines, enabling point-in-time recovery capabilities.
Adversaries may delete these collections to prevent recovery during ransomware attacks or to cover their tracks during
malicious operations.
"""
false_positives = [
    """
    Restore Point Collection deletions may be performed by system administrators during routine cleanup or
    decommissioning activities. Verify whether the user and resource should be performing these operations. Deletions
    from unfamiliar users or targeting critical resources should be investigated. If known behavior is causing false
    positives, it can be exempted from the rule.
    """,
]
from = "now-9m"
index = ["logs-azure.activitylogs-*", "filebeat-*"]
language = "kuery"
license = "Elastic License v2"
name = "Azure Compute Restore Point Collection Deleted by Unusual User"
note = """## Triage and analysis

### Investigating Azure Compute Restore Point Collection Deleted by Unusual User

Azure Compute Restore Point Collections are critical components for disaster recovery, containing snapshots that enable point-in-time
recovery of virtual machines. Deletion of these collections can severely impact an organization's ability to recover from
incidents, making them attractive targets for adversaries conducting ransomware attacks or attempting to cover their tracks.

This rule detects when a user who has not previously deleted Restore Point Collections performs this operation, which may
indicate unauthorized activity or a compromised account.

### Possible investigation steps

- Review the `azure.activitylogs.identity.claims_initiated_by_user.name` field to identify the specific user who performed the deletion operation.
- Investigate the `azure.resource.id` or `azure.resource.name` fields to identify which Restore Point Collection was deleted and assess its criticality to business operations.
- Review the timeline of the deletion event and correlate it with other security events or user activities to identify any suspicious patterns or related activities.
- Verify whether the user account has legitimate access to perform this operation and whether this deletion was authorized through change management processes.
- Check for any other unusual activities by the same user account around the time of the deletion, such as privilege escalation attempts or access to other sensitive resources.
- Investigate whether there are any active alerts or indicators of compromise related to ransomware activity in the environment.

### False positive analysis

- Routine administrative activities by infrastructure teams may trigger this alert when team members rotate or new administrators are onboarded. Create exceptions for known administrative accounts after verification.
- Automated cleanup scripts or Azure policies that periodically remove old restore points may cause alerts. Identify and exclude service accounts used for these automated operations.
- Planned decommissioning activities or migration projects may involve legitimate deletion of restore point collections. Document these activities and create temporary exceptions during known maintenance windows.
- Testing and development environments may see frequent creation and deletion of resources. Consider excluding these environments from monitoring or adjusting the rule to focus on production resources only.

### Response and remediation

- Immediately verify the legitimacy of the deletion operation with the user or their manager. If the activity is unauthorized, proceed with incident response procedures.
- If unauthorized deletion is confirmed, immediately isolate the affected user account to prevent further malicious activity. Reset credentials and review account permissions.
- Check if the deleted Restore Point Collection can be recovered through Azure backup services or other recovery mechanisms.
- Review and audit all recent activities performed by the affected user account to identify other potentially malicious actions.
- Assess the impact on disaster recovery capabilities and inform relevant stakeholders about potential recovery limitations.
- Review access controls and permissions for Restore Point Collection management, implementing principle of least privilege where necessary.
- If ransomware activity is suspected, escalate to the security incident response team and implement broader containment measures, including checking for other indicators of ransomware such as deletion of Recovery Services vaults or backup fabric containers.
- Document the incident and update detection rules or procedures based on lessons learned.
"""
references = [
    "https://www.microsoft.com/en-us/security/blog/2023/07/25/storm-0501-ransomware-attacks-expanding-to-hybrid-cloud-environments/",
]
risk_score = 47
rule_id = "c1a3e2f0-8a1b-11ef-9b4a-f661ea17fbce"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Domain: Storage",
    "Data Source: Azure",
    "Data Source: Azure Activity Logs",
    "Use Case: Threat Detection",
    "Tactic: Impact",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "new_terms"

query = '''
data_stream.dataset: azure.activitylogs and
    event.action: "MICROSOFT.COMPUTE/RESTOREPOINTCOLLECTIONS/DELETE" and
    event.outcome: (Success or success)
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1490"
name = "Inhibit System Recovery"
reference = "https://attack.mitre.org/techniques/T1490/"


[rule.threat.tactic]
id = "TA0040"
name = "Impact"
reference = "https://attack.mitre.org/tactics/TA0040/"

[rule.new_terms]
field = "new_terms_fields"
value = ["azure.activitylogs.identity.claims_initiated_by_user.name", "azure.resource.group"]
[[rule.new_terms.history_window_start]]
field = "history_window_start"
value = "now-7d"

[metadata]
creation_date = "2025/10/08"
integration = ["azure"]
maturity = "production"
updated_date = "2026/04/10"

[rule]
author = ["Elastic"]
description = """
Identifies when an Azure Storage Account is deleted. Adversaries may delete storage accounts to disrupt operations,
destroy evidence, or cause denial of service. This activity could indicate an attacker attempting to cover their tracks
after data exfiltration or as part of a destructive attack. Monitoring storage account deletions is critical for
detecting potential impact on business operations and data availability.
"""
false_positives = [
    """
    Storage administrators may legitimately delete storage accounts during decommissioning, resource cleanup, or
    infrastructure optimization. Verify that the deletion was expected and follows organizational change management
    processes. Consider exceptions for approved maintenance windows.
    """,
]
from = "now-9m"
index = ["logs-azure.activitylogs-*"]
language = "kuery"
license = "Elastic License v2"
name = "Azure Storage Account Deletion by Unusual User"
note = """## Triage and analysis

### Investigating Azure Storage Account Deletion by Unusual User

Azure Storage Accounts provide scalable cloud storage for applications and services. Deletion of storage accounts is a high-impact operation that permanently removes all contained data including blobs, files, queues, and tables. Adversaries may delete storage accounts to destroy evidence of their activities, disrupt business operations, or cause denial of service as part of ransomware or destructive attacks. This detection monitors for successful storage account deletion operations to identify potential malicious activity.

### Possible investigation steps

- Review the Azure activity logs to identify the user or service principal that initiated the storage account deletion by examining the principal ID, UPN and user agent fields.
- Check the specific storage account name in `azure.resource.name` to understand which storage resources were deleted and assess the business impact.
- Investigate the timing of the event to correlate with any other suspicious activities, such as unusual login patterns, privilege escalation attempts, or other resource deletions.
- Examine the user's recent activity history to identify any other storage accounts or Azure resources that were deleted or modified by the same principal.
- Verify if the storage account deletion aligns with approved change requests or maintenance windows in your organization.
- Check if the deleted storage account contained critical data and whether backups are available for recovery.
- Review any related alerts or activities such as data exfiltration, configuration changes, or access policy modifications that occurred before the deletion.
- Investigate if the account was recently compromised by checking for suspicious authentication events or privilege escalations.

### False positive analysis

- Legitimate decommissioning of unused storage accounts may trigger this alert. Document approved storage account cleanup activities and coordinate with infrastructure teams to understand planned deletions.
- DevOps automation tools might delete temporary storage accounts as part of infrastructure lifecycle management. Identify service principals used by CI/CD pipelines and consider creating exceptions for these automated processes.
- Testing and development environments may have frequent storage account creation and deletion cycles. Consider filtering out non-production storage accounts if appropriate for your environment.
- Cost optimization initiatives may involve deleting unused or redundant storage accounts. Coordinate with finance and infrastructure teams to understand planned resource optimization activities.

### Response and remediation

- Immediately investigate whether the deletion was authorized by verifying with the account owner or relevant stakeholders.
- If the deletion was unauthorized, attempt to recover the storage account if soft-delete is enabled, or restore data from backups.
- Disable the compromised user account or service principal if unauthorized activity is confirmed and investigate how the credentials were obtained.
- Review and restrict Azure RBAC permissions to ensure only authorized users have storage account deletion capabilities (requires Contributor or Owner role).
- Implement Azure Resource Locks to prevent accidental or malicious deletion of critical storage accounts.
- Configure Azure Activity Log alerts to notify security teams immediately when storage accounts are deleted.
- Conduct a full security assessment to identify any other compromised resources or accounts and look for indicators of broader compromise.
- Document the incident and update security policies and procedures to prevent similar incidents in the future.
"""
references = [
    "https://www.microsoft.com/en-us/security/blog/2025/08/27/storm-0501s-evolving-techniques-lead-to-cloud-based-ransomware/"
]
risk_score = 47
rule_id = "a1b2c3d4-5e6f-7a8b-9c0d-1e2f3a4b5c6d"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Domain: Storage",
    "Data Source: Azure",
    "Data Source: Azure Activity Logs",
    "Use Case: Threat Detection",
    "Tactic: Impact",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "new_terms"

query = '''
data_stream.dataset: azure.activitylogs and
    azure.activitylogs.operation_name: "MICROSOFT.STORAGE/STORAGEACCOUNTS/DELETE" and
    azure.activitylogs.identity.claims_initiated_by_user.name: *
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1485"
name = "Data Destruction"
reference = "https://attack.mitre.org/techniques/T1485/"

[[rule.threat.technique]]
id = "T1489"
name = "Service Stop"
reference = "https://attack.mitre.org/techniques/T1489/"


[rule.threat.tactic]
id = "TA0040"
name = "Impact"
reference = "https://attack.mitre.org/tactics/TA0040/"

[rule.new_terms]
field = "new_terms_fields"
value = ["azure.activitylogs.identity.claims_initiated_by_user.name"]
[[rule.new_terms.history_window_start]]
field = "history_window_start"
value = "now-7d"

[rule]
description = """
Identifies when the command-line tool for managing Boot Configuration Data (BCDEdit.exe) is spawned from an untrusted
process, office application, or script interpreter and used to specify a reboot into Safe Mode.
"""
id = "6d660b32-23bf-434b-a588-1cdc91224664"
license = "Elastic License v2"
name = "BCDEdit Safe Mode Command Execution"
os_list = ["windows"]
reference = [
    "https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/",
    "https://community.spiceworks.com/how_to/94471-how-to-reboot-into-safe-mode-at-a-command-prompt",
]
version = "1.0.32"

query = '''
process where event.action == "start" and
  (process.name : "bcdedit.exe" or process.pe.original_file_name : "bcdedit.exe") and
  process.args : ("minimal", "network", "safebootalternateshell") and
    descendant of
      [process where event.action == "start" and
        (process.code_signature.trusted != true or
         process.name : ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "MSACCESS.EXE", "MSPUB.EXE",
                         "OUTLOOK.EXE", "fltldr.exe", "cscript.exe", "powershell.exe", "pwsh.exe",
                         "wscript.exe", "cmd.exe", "rundll32.exe", "regsvr32.exe", "mshta.exe",
                         "msbuild.exe"))
      ]
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.001"
name = "PowerShell"
reference = "https://attack.mitre.org/techniques/T1059/001/"

[[threat.technique.subtechnique]]
id = "T1059.003"
name = "Windows Command Shell"
reference = "https://attack.mitre.org/techniques/T1059/003/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[[threat.technique.subtechnique]]
id = "T1218.005"
name = "Mshta"
reference = "https://attack.mitre.org/techniques/T1218/005/"

[[threat.technique.subtechnique]]
id = "T1218.010"
name = "Regsvr32"
reference = "https://attack.mitre.org/techniques/T1218/010/"

[[threat.technique.subtechnique]]
id = "T1218.011"
name = "Rundll32"
reference = "https://attack.mitre.org/techniques/T1218/011/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1490"
name = "Inhibit System Recovery"
reference = "https://attack.mitre.org/techniques/T1490/"


[threat.tactic]
id = "TA0040"
name = "Impact"
reference = "https://attack.mitre.org/tactics/TA0040/"

[internal]
min_endpoint_version = "7.15.0"

[rule]
description = """
This rule detects suspicious command interpreters that are executed with an IP address as an argument. This activity may
indicate the use of a command interpreter to download additional payloads or tools from a remote server.
"""
id = "99c1bc0d-6d96-4e3c-b246-c23a65971455"
license = "Elastic License v2"
name = "Command Interpreter with IP Address Argument"
os_list = ["linux"]
version = "1.0.8"

query = '''
sequence by process.entity_id with maxspan=5s
  [process where event.type == "start" and event.action == "exec" and process.parent.executable like (
     "/bin/python*", "/usr/bin/python*", "/usr/local/bin/python*",
     "/bin/perl*", "/usr/bin/perl*", "/usr/local/bin/perl*",
     "/bin/ruby*", "/usr/bin/ruby*", "/usr/local/bin/ruby*",
     "/bin/php*", "/usr/bin/php*", "/usr/local/bin/php*",
     "/bin/lua*", "/usr/bin/lua*", "/usr/local/bin/lua*",
     "/bin/node", "/usr/bin/node", "/usr/local/bin/node"
   ) and
   process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and process.args == "-c" and
   process.command_line like~ ("*curl*http*", "*wget*http*") and
   process.command_line regex ".*[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}.*" and
   not process.command_line like~ ("*localhost*", "*127.0.0.1*")]
  [network where event.type == "start" and event.action == "connection_attempted" and process.name in ("curl", "wget") and
   not (destination.ip == null or destination.ip == "0.0.0.0" or cidrmatch(
     destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.0.0/29",
     "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
     "192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10",
     "192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1", "FE80::/10",
     "FF00::/8"
     )
   )]
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"

[[threat.technique.subtechnique]]
id = "T1059.006"
name = "Python"
reference = "https://attack.mitre.org/techniques/T1059/006/"

[[threat.technique.subtechnique]]
id = "T1059.011"
name = "Lua"
reference = "https://attack.mitre.org/techniques/T1059/011/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"
[[threat.technique.subtechnique]]
id = "T1071.001"
name = "Web Protocols"
reference = "https://attack.mitre.org/techniques/T1071/001/"


[[threat.technique]]
id = "T1105"
name = "Ingress Tool Transfer"
reference = "https://attack.mitre.org/techniques/T1105/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "7.15.0"

[rule]
description = """
Identifies a failed access attempt to web browser's credential store data. Adversaries may steal credentials from web
browsers by reading files specific to the target browser.
"""
id = "ebbb46d3-eb7f-4247-88fe-9bc5525443b3"
license = "Elastic License v2"
name = "Failed Access Attempt to Web Browser Files"
os_list = ["windows"]
reference = [
    "https://www.elastic.co/security-labs/globally-distributed-stealers",
    "https://www.elastic.co/security-labs/detect-credential-access",
]
version = "1.0.37"

query = '''
file where event.type == "access" and event.outcome == "failure" and process.pid != 4 and user.id != "S-1-5-18" and
    process.executable != null and process.thread.Ext.call_stack_summary != null and
    (
     file.name : ("logins.json", "cert?.db", "key?.db", "signons.sqlite", "cookies.sqlite") or 
     file.path : 
           ("?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\User Data\\Local State",
            "?:\\Users\\*\\AppData\\Local\\Microsoft\\Edge\\User Data\\Local State", 
            "?:\\users\\*\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", 
            "?:\\Users\\*\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Login Data")
     ) and

    not (file.path : "?:\\Windows\\System32\\spool\\drivers\\x64\\*" and
         process.executable : "?:\\Windows\\System32\\PrintIsolationHost.exe") and
    not (process.executable : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe") and user.id : "S-1-5-18") and
    not (process.code_signature.subject_name : 
              ("Rapid7 LLC", "Mozilla Corporation", "Commvault Systems, Inc.", "Google LLC", "TPZ SOLUCOES DIGITAIS LTDA",
               "Bitdefender SRL", "Ivanti, Inc.", "McAfee, Inc.", "Fortinet Technologies*", "Zscaler, Inc.", "Bromium, Inc.", 
               "Duck Duck Go, Inc.", "Galactic Advisors, Inc.", "Kaspersky Lab JSC", "3Dconnexion SAM", "Opera Norway AS", 
               "Dashlane", "TeamDev Ltd.", "Mobatek", "Shift Technologies Inc.", "Nextron Systems GmbH",
               "Wavesor Software (Eightpoint Technologies Ltd. SEZC)", "Viber Media S.a r.l.", "Eric R. Zimmerman",
               "SAP SE", "Vivaldi Technologies AS", "ONELAUNCH TECHNOLOGIES INC.", "SentinelOne Inc.", "Brave Software, Inc.",
               "Overwolf Ltd", "YANDEX LLC", "Keeper Security Inc.", "Dashlane USA, Inc.", "Spotify AB", "Island Technology Inc.",
               "Zoom Video Communications, Inc.", "Emsisoft Ltd", "REVERSO S.A.S.", "Zoom Video Communications, Inc.",
               "TeamDev Ltd.", "TeamDev Management*", "Fabrice PARISOT", "Beijing Qihu Technology Co., Ltd.", "timeBro GmbH",
               "Lenovo", "7270356 Canada Inc.", "VS REVO GROUP OOD", "Jio Platforms Limited", "Zhuhai Kingsoft Office Software Co., Ltd.",
               "Adaware Software (7270356 CANADA INC.)", "Google Inc", "SweetLabs Inc", "Avast Software s.r.o.", "Athenahealth, Inc.",
               "Tencent Technology (Shenzhen) Company Limited", "AOMEI International Network Limited", "Lavasoft Software Canada Inc.",
               "memtime GmbH", "Grammarly, Inc.", "Sunstream Labs (Capital Intellect Inc.)", "Echo Infini Sdn. Bhd.", "Matrix42 AG",
               "Sunstream Labs (Capital Intellect Inc.)", "OneStart Technologies LLC", "Grammarly, Inc.", "Canva", "PERPLEXITY AI, INC.",
               "salesforce.com, inc.", "Matrix42 AG", "BlazerBrowser.com LLC", "BROWSERWORKS LTD", "Exclaimer Ltd", "BrowseAI LLC") and
         process.code_signature.trusted == true) and
    not (process.executable : "C:\\Users\\*\\AppData\\Local\\Microsoft\\BingSvc\\BingSvc.exe" and process.code_signature.trusted == true and
         process.code_signature.subject_name == "Microsoft Corporation") and
    not process.executable : ("?:\\Program Files (x86)\\*.exe",
                              "?:\\Program Files\\*.exe",
                              "?:\\Windows\\System32\\cleanmgr.exe",
                              "?:\\Windows\\System32\\cmimageworker.exe",
                              "?:\\Windows\\System32\\igfxext.exe",
                              "?:\\Windows\\SysWOW64\\SearchIndexer.exe",
                              "?:\\Windows\\SysWOW64\\msiexec.exe",
                              "?:\\Windows\\System32\\msiexec.exe",
                              "C:\\Windows\\System32\\RuntimeBroker.exe",
                              "C:\\Windows\\System32\\taskhostw.exe",
                              "C:\\Windows\\System32\\MoUsoCoreWorker.exe",
                              "\\Device\\Mup\\*",
                              "?:\\Windows\\explorer.exe",
                              "?:\\Windows\\CCM\\CcmExec.exe",
                              "?:\\Windows\\System32\\cmd.exe",
                              "?:\\Windows\\System32\\dllhost.exe",
                              "?:\\Windows\\System32\\svchost.exe",
                              "?:\\Windows\\System32\\Robocopy.exe",
                              "?:\\Windows\\System32\\SearchProtocolHost.exe",
                              "?:\\Users\\*e\\AppData\\Local\\Microsoft\\EdgeWebView\\Application\\*\\msedgewebview2.exe",
                              "?:\\Users\\*\\AppData\\Local\\Microsoft\\Edge SxS\\Application\\msedge.exe",
                              "?:\\Users\\*\\AppData\\Local\\Microsoft\\Edge\\Application\\msedge.exe",
                              "?:\\Users\\*\\AppData\\Local\\Carbonate\\Carbonate\\Application\\Carbonate.exe",
                              "C:\\Windows\\UUS\\Packages\\Preview\\amd64\\MoUsoCoreWorker.exe") and
    not (user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20") and process.executable : "?:\\Windows\\System32\\svchost.exe") and
    not process.executable :
                ("?:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\Platform\\*\\MsSense.exe",
                 "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe",
                 "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MpCopyAccelerator.exe") and
    not (process.name : "certutil.exe" and file.extension : "db") and 
    not file.path : "?:\\Users\\*\\AppData\\Local\\Temp\\GoogleChromePortable\\profile\\Default\\Login Data" and
    not process.thread.Ext.call_stack_summary :
                 ("ntdll.dll|kernelbase.dll|hmpalert.dll|aadtb.dll|threadpoolwinrt.dll|ntdll.dll|kernel32.dll|ntdll.dll",
                  "ntdll.dll|pghook.dll|kernelbase.dll|hmpalert.dll|pcpksp.dll|ncrypt.dll|crypt32.dll|aadtb.dll|threadpoolwinrt.dll|ntdll.dll|kernel32.dll|ntdll.dll") and
    not (process.name : "chrome.exe" and 
         file.path : ("?:\\USERS\\*\\APPDATA\\LOCAL\\TEMP\\PUPPETEER_DEV_CHROME_PROFILE-*\\DEFAULT\\LOGIN DATA", 
                      "?:\\USERS\\*\\APPDATA\\LOCAL\\TEMP\\PLAYWRIGHT_CHROMIUMDEV_PROFILE-*\\DEFAULT\\LOGIN DATA", 
                      "?:\\USERS\\*\\APPDATA\\LOCAL\\CHROMIUM\\USER DATA\\DEFAULT\\LOGIN DATA")) and
     not file.path : ("?:\\USERS\\*\\APPDATA\\ROAMING\\BURPSUITE\\PRE-WIRED-BROWSER\\DEFAULT\\LOGIN DATA",
                   "?:\\USERS\\*\\APPDATA\\LOCAL\\TEMP\\PUPPETEER_DEV_CHROME_PROFILE-*\\DEFAULT\\LOGIN DATA",
                   "?:\\USERS\\*\\APPDATA\\LOCAL\\PGADMIN4\\USER DATA\\DEFAULT\\LOGIN DATA",
                   "?:\\USERS\\*\\UNGOOGLED-CHROMIUM-PORTABLE\\DATA\\DEFAULT\\LOGIN DATA",
                   "?:\\USERS\\*\\APPDATA\\LOCAL\\TEMP\\PUPPETEER_DEV_CHROME_PROFILE-*\\DEFAULT\\LOGIN DATA",
                   "?:\\Users\\*\\chrome-device\\Default\\Login Data",
                   "?:\\Users\\*\\EBWebView\\Default\\Login Data",
                   "?:\\Users\\*\\Favorites\\BOOKMARKS\\Default\\Login Data",
                   "?:\\USERS\\*\\APPDATA\\LOCAL\\ELROND\\MAIAR\\USER DATA\\DEFAULT\\LOGIN DATA",
                   "?:\\Users\\*\\AppData\\Local\\Microsoft\\Edge\\Default BackupDD\\Login Data",
                   "?:\\Users\\*\\Favorites\\bookmarks\\Default\\Login Data",
                   "?:\\users\\*\\mayanks\\JxBrowserData\\Default\\Login Data",
                   "?:\\Users\\*\\AppData\\Local\\pc_app_store\\User Data\\Default\\*",
                   "?:\\Users\\*\\AppData\\Local\\Melvor Idle\\User Data\\Default\\*",
                   "?:\\Users\\*\\AppData\\Local\\Streaming\\User Data\\Default\\*",
                   "?:\\USERS\\*\\APPDATA\\LOCAL\\BETAFLIGHT-CONFIGURATOR\\USER DATA\\DEFAULT\\*",
                   "?:\\USERS\\*\\APPDATA\\LOCAL\\LEADING\\USER DATA\\DEFAULT\\*",
                   "?:\\USERS\\*\\APPDATA\\LOCAL\\CHROMIUM\\USER DATA\\DEFAULT\\*",
                   "?:\\Users\\*\\AppData\\Local\\Uniflash\\User Data\\Default\\*",
                   "?:\\USERS\\*\\APPDATA\\LOCAL\\PGADMIN4\\USER DATA\\DEFAULT\\*",
                   "?:\\users\\*\\appdata\\local\\Market Axess\\Data\\*\\mayanks\\JxBrowserData\\Default\\*",
                   "?:\\Users\\*\\AppData\\Local\\Temp\\flutter_tools.*\\flutter_tools_chrome_device.*\\Default\\Login Data",
                   "?:\\Users\\*\\AppData\\Local\\*\\EBWebView\\Snapshots\\*\\Default\\Login Data",
                   "?:\\USERS\\*\\APPDATA\\ROAMING\\BURPSUITE\\PRE-WIRED-BROWSER\\SNAPSHOTS\\*\\DEFAULT\\LOGIN DATA",
                   "?:\\USERS\\*\\EBWEBVIEW\\DEFAULT\\LOGIN DATA",
                   "?:\\USERS\\*\\APPDATA\\LOCAL\\TEMP\\ALS_JXBROWSER_CONTEXT_*\\LOGIN DATA",
                   "?:\\ProgramData\\Microsoft\\Windows\\Containers\\BaseImages\\*\\BaseLayer\\Files\\Users\\WDAGUtilityAccount\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Login Data") and
     not process.thread.Ext.call_stack_summary like
                             ("ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|browsersettings.dll|kernel32.dll|ntdll.dll",
                              "ntdll.dll|kernelbase.dll|hmpalert.dll|*",
                              "ntdll.dll|sophosed.dll|kernelbase.dll|hmpalert.dll|*",
                              "ntdll.dll|kernelbase.dll|shift.dll|kernel32.dll|ntdll.dll",
                              "ntdll.dll|kernelbase.dll|msedge.dll|kernel32.dll|ntdll.dll",
                              "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|hmpalert.dll|rsaenh.dll|cryptsp.dll|*",
                              "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|aclayers.dll|defaultpackoffer.dll|*",
                              "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|appvisvsubsystems32.dll|kernelbase.dll|hmpalert.dll|*",
                              "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|aclayers.dll|*",
                              "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|qipcap.dll|cmd.exe|kernel32.dll|ntdll.dll",
                              "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|acrord32.dll|*",
                              "ntdll.dll|kernelbase.dll|procexp64.exe|kernel32.dll|ntdll.dll",
                              "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|hmpalert.dll|mso20win32client.dll|mso30win32client.dll|mso20win32client.dll|kernel32.dll|ntdll.dll",
                              "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|mscorlib.ni.dll|Unbacked|mscorlib.ni.dll|clr.dll|kernel32.dll|ntdll.dll",
                              "ntdll.dll|sophosed.dll|kernelbase.dll|hmpalert.dll|windows.security.authentication.*",
                              "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|sophosed.dll|kernelbase.dll|hmpalert.dll|windows.security.authentication.*",
                              "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|sophosed.dll|appvisvsubsystems32.dll|kernelbase.dll|*",
                              "ntdll.dll|sophosed.dll|kernelbase.dll|hmpalert.dll|filesyncsessions.dll|*",
                              "ntdll.dll|sophosed.dll|kernelbase.dll|hmpalert.dll|fluencyds.dll|*",
                              "ntdll.dll|sophosed.dll|kernelbase.dll|hmpalert.dll|dsadmin.dll|dsuiext.dll|*",
                              "ntdll.dll|sophosed.dll|kernelbase.dll|hmpalert.dll|microsoft.sharepoint.dll|*",
                              "ntdll.dll|sophosed.dll|kernelbase.dll|hmpalert.dll|spark-windows-desktop-ui.dll|*",
                              "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|sophosed.dll|kernelbase.dll|hmpalert.dll|mso20win32client.dll|*")
'''

min_endpoint_version = "8.7.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1539"
name = "Steal Web Session Cookie"
reference = "https://attack.mitre.org/techniques/T1539/"

[[threat.technique]]
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"
[[threat.technique.subtechnique]]
id = "T1552.001"
name = "Credentials In Files"
reference = "https://attack.mitre.org/techniques/T1552/001/"


[[threat.technique]]
id = "T1555"
name = "Credentials from Password Stores"
reference = "https://attack.mitre.org/techniques/T1555/"
[[threat.technique.subtechnique]]
id = "T1555.003"
name = "Credentials from Web Browsers"
reference = "https://attack.mitre.org/techniques/T1555/003/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "8.7.0"

[rule]
description = """
Identifies attempts to modify the Windows Firewall Policy in order to permit an unsigned executable that was recently
introduced. Malicious software frequently employs such alterations during installation to ensure uninterrupted network
connectivity.
"""
id = "bf072c39-90bc-4b1b-9c78-1d8a9bd6f0e1"
license = "Elastic License v2"
name = "Firewall Policy Changed by a Suspicious Process"
os_list = ["windows"]
version = "1.0.7"

query = '''
sequence with maxspan=1m 
[process where event.action == "start" and 
(
 ((process.Ext.relative_file_creation_time <= 500 or process.Ext.relative_file_name_modify_time <= 500) and 
 (process.code_signature.trusted == false or process.code_signature.exists == false) and 
  not process.code_signature.status : ("errorExpired", "errorCode_endpoint*") and
  (process.executable : ("?:\\Users\\*", "?:\\ProgramData\\*", "?:\\Windows\\Temp\\*") or
   process.executable regex~ """c:\\windows\\[a-z0-9\-\_\.]+\.exe""")) or 

   process.executable : "?:\\Windows\\Microsoft.NET\\*" or 

   (process.code_signature.subject_name : "NetSupport Ltd" and process.Ext.relative_file_creation_time <= 500 and 
    not process.executable : ("?:\\Program Files\\NetSupport*.exe", "?:\\Program Files (x86)\\NetSupport*.exe"))
 ) and
 not process.hash.sha256 in ("0f418b6eda02552ef104a836a8ba812ddcfae11506dc96cae71b719046cd749c",
                             "4cdb4fd1bb7a23c802abb6b5c0a973679495154b17a2234ea19e11fd0c8a2b0a",
                             "7d766d78c07024537114c7ddaec864810cac822719caf13ff738b52c2b663c75",
                             "e3fb22644ccfe21f511848e516c172802b9b6513625af1e5877e9dd88e8fe477") and
 not (process.executable : "?:\\ProgramData\\checkmk\\agent\\bin\\cmk-agent-ctl.exe" and
      process.parent.executable : ("?:\\Program Files\\checkmk\\service\\check_mk_agent.exe",
                                   "?:\\Program Files (x86)\\checkmk\\service\\check_mk_agent.exe")) and
not (process.code_signature.subject_name : "Incredibuild Software ltd." and process.code_signature.trusted == true)
] as event0 
[registry where 
  registry.path : "HKLM\\SYSTEM\\ControlSet*\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*" and 
  registry.data.strings : "*Allow*Public|*" and stringcontains~(registry.data.strings, event0.process.executable)]
'''

min_endpoint_version = "8.4.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.4.0"

[metadata]
creation_date = "2022/08/28"
integration = ["endpoint", "windows", "m365_defender"]
maturity = "production"
updated_date = "2026/05/04"

[rule]
author = ["Elastic"]
description = """
Identifies the enable of the full user-mode dumps feature system-wide. This feature allows Windows Error Reporting (WER)
to collect data after an application crashes. This setting is a requirement for the LSASS Shtinkering attack, which
fakes the communication of a crash on LSASS, generating a dump of the process memory, which gives the attacker access to
the credentials present on the system without having to bring malware to the system. This setting is not enabled by
default, and applications must create their registry subkeys to hold settings that enable them to collect dumps.
"""
from = "now-9m"
index = [
    "winlogbeat-*",
    "logs-endpoint.events.registry-*",
    "logs-windows.sysmon_operational-*",
    "endgame-*",
    "logs-m365_defender.event-*",
]
language = "eql"
license = "Elastic License v2"
name = "Full User-Mode Dumps Enabled System-Wide"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Full User-Mode Dumps Enabled System-Wide

Full user-mode dumps are a diagnostic feature in Windows that captures detailed information about application crashes, aiding in troubleshooting. However, attackers can exploit this by triggering dumps of sensitive processes like LSASS to extract credentials. The detection rule identifies registry changes enabling this feature system-wide, flagging potential misuse by excluding legitimate system processes, thus alerting analysts to suspicious activity.

### Possible investigation steps

- Review the registry path HKLM\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LocalDumps\\DumpType to confirm if the value is set to "2" or "0x00000002", indicating full user-mode dumps are enabled.
- Check for any recent changes to the registry key by examining the modification timestamps and identifying the user or process responsible for the change.
- Investigate the context of the alert by reviewing recent process execution logs to identify any suspicious processes that may have triggered the dump, especially those not matching the legitimate svchost.exe process with user IDs S-1-5-18, S-1-5-19, or S-1-5-20.
- Analyze any generated dump files for sensitive information, such as credentials, and determine if they were accessed or exfiltrated by unauthorized users or processes.
- Correlate the alert with other security events or logs, such as Sysmon or Microsoft Defender XDR, to identify any related suspicious activities or patterns that could indicate a broader attack.

### False positive analysis

- Legitimate system processes like svchost.exe may trigger the rule if they are not properly excluded. Ensure that the exclusion for svchost.exe is correctly configured by verifying the process executable path and user IDs.
- Custom applications that require full user-mode dumps for legitimate debugging purposes might be flagged. Identify these applications and create specific registry subkey exclusions to prevent false positives.
- System administrators performing routine maintenance or diagnostics might enable full user-mode dumps temporarily. Document these activities and consider creating temporary exceptions during maintenance windows.
- Security tools or monitoring software that simulate crash scenarios for testing purposes could trigger the rule. Verify the legitimacy of these tools and add them to an exclusion list if they are part of regular security operations.
- Updates or patches from software vendors that modify registry settings for error reporting might be misinterpreted as suspicious. Monitor update schedules and correlate any rule triggers with known update activities to avoid unnecessary alerts.

### Response and remediation

- Immediately isolate the affected system from the network to prevent further credential access or lateral movement by the attacker.
- Terminate any unauthorized processes that are generating full user-mode dumps, especially those related to LSASS, to stop further credential dumping.
- Conduct a thorough review of the registry settings on the affected system to ensure that the full user-mode dumps feature is disabled unless explicitly required for legitimate purposes.
- Change all credentials that may have been exposed, particularly those associated with high-privilege accounts, to mitigate the risk of unauthorized access.
- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if additional systems are affected.
- Implement enhanced monitoring and alerting for similar registry changes across the network to detect and respond to future attempts promptly.
- Review and update endpoint protection configurations to ensure they are capable of detecting and blocking similar credential dumping techniques."""
references = [
    "https://docs.microsoft.com/en-us/windows/win32/wer/collecting-user-mode-dumps",
    "https://github.com/deepinstinct/Lsass-Shtinkering",
    "https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Asaf%20Gilboa%20-%20LSASS%20Shtinkering%20Abusing%20Windows%20Error%20Reporting%20to%20Dump%20LSASS.pdf",
]
risk_score = 47
rule_id = "220be143-5c67-4fdb-b6ce-dd6826d024fd"
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Credential Access",
    "Data Source: Elastic Defend",
    "Data Source: Elastic Endgame",
    "Data Source: Sysmon",
    "Data Source: Microsoft Defender XDR",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
registry where host.os.type == "windows" and
    registry.path : (
        "HKLM\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LocalDumps\\DumpType",
        "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LocalDumps\\DumpType"
    ) and
    registry.data.strings : ("2", "0x00000002") and
    not (process.executable : "?:\\Windows\\system32\\svchost.exe" and user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20"))
'''

setup = """## Setup

This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.

Setup instructions: https://ela.st/install-elastic-defend

### Additional data sources

This rule also supports the following third-party data sources. For setup instructions, refer to the links below:

- [Microsoft Defender XDR](https://ela.st/m365-defender)
- [Sysmon Registry Events](https://ela.st/sysmon-event-reg-setup)
"""


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1003"
name = "OS Credential Dumping"
reference = "https://attack.mitre.org/techniques/T1003/"
[[rule.threat.technique.subtechnique]]
id = "T1003.001"
name = "LSASS Memory"
reference = "https://attack.mitre.org/techniques/T1003/001/"



[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1112"
name = "Modify Registry"
reference = "https://attack.mitre.org/techniques/T1112/"


[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[metadata]
creation_date = "2025/01/16"
integration = ["endpoint", "crowdstrike", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2026/03/24"

[rule]
author = ["Elastic"]
description = """
This rule detects the generation of a new GRUB configuration file using built-in Linux commands. The GRUB configuration
file is used to configure the GRUB bootloader, which is responsible for loading the Linux kernel and initramfs image
during the boot process. Attackers may use these built-in utilities to generate a new GRUB configuration file that
includes malicious kernel parameters or boot options, which can be leveraged to maintain persistence on the system.
"""
from = "now-9m"
index = [
    "logs-endpoint.events.process*",
    "endgame-*",
    "logs-crowdstrike.fdr*",
    "logs-sentinel_one_cloud_funnel.*",
]
language = "eql"
license = "Elastic License v2"
name = "GRUB Configuration Generation through Built-in Utilities"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating GRUB Configuration Generation through Built-in Utilities

GRUB, the Grand Unified Bootloader, is crucial for loading the Linux kernel during system startup. It uses configuration files to determine boot parameters. Adversaries may exploit utilities like `grub-mkconfig` to alter these files, embedding malicious parameters for persistence. The detection rule identifies suspicious executions of these utilities, especially when initiated by atypical parent processes, signaling potential misuse.

### Possible investigation steps

- Review the process execution details to identify the parent process of the suspicious GRUB configuration utility execution. Check if the parent process is unusual or unexpected based on the query's exclusion list.
- Examine the command-line arguments used in the execution of the GRUB configuration utility to identify any potentially malicious kernel parameters or boot options.
- Investigate the user account associated with the process execution to determine if it has the necessary privileges and if the activity aligns with the user's typical behavior.
- Check the system's recent changes or updates, especially those related to bootloader configurations, to identify any unauthorized modifications.
- Analyze system logs for any other suspicious activities or anomalies around the time of the GRUB configuration utility execution to gather additional context.

### False positive analysis

- Routine system updates or maintenance tasks may trigger the rule when legitimate processes like package managers (e.g., pacman, dnf, yum) or system utilities (e.g., sudo) execute GRUB configuration commands. Users can mitigate this by adding these processes to the exception list in the rule configuration.
- Automated scripts or cron jobs that regularly update GRUB configurations for legitimate reasons might be flagged. To handle this, identify these scripts and add their parent process names or paths to the exclusion criteria.
- Custom administrative scripts that manage bootloader settings could also cause false positives. Review these scripts and, if verified as safe, include their parent process details in the rule's exceptions.
- Some Linux distributions may have specific utilities or services that interact with GRUB as part of their normal operation. Investigate these utilities and consider excluding them if they are confirmed to be benign and necessary for system functionality.

### Response and remediation

- Immediately isolate the affected system from the network to prevent further malicious activity or lateral movement.
- Terminate any suspicious processes related to `grub-mkconfig`, `grub2-mkconfig`, or `update-grub` that were initiated by atypical parent processes.
- Review and restore the GRUB configuration file from a known good backup to ensure no malicious parameters are present.
- Conduct a thorough examination of the system for additional signs of compromise, focusing on persistence mechanisms and unauthorized changes to boot parameters.
- Escalate the incident to the security operations team for further analysis and to determine if additional systems are affected.
- Implement monitoring for future unauthorized executions of GRUB configuration utilities, ensuring alerts are generated for similar suspicious activities.
- Review and update access controls and permissions to restrict the execution of GRUB configuration utilities to authorized personnel only."""
risk_score = 21
rule_id = "aabdad51-51fb-4a66-9d82-3873e42accb8"
setup = """## Setup
This rule requires data coming in from Elastic Defend.
### Elastic Defend Integration Setup
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
#### Prerequisite Requirements:
- Fleet is required for Elastic Defend.
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
- Go to the Kibana home page and click "Add integrations".
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
- Click "Add Elastic Defend".
- Configure the integration name and optionally add a description.
- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
- Click "Save and Continue".
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
"""
severity = "low"
tags = [
    "Domain: Endpoint",
    "OS: Linux",
    "Use Case: Threat Detection",
    "Tactic: Persistence",
    "Data Source: Elastic Endgame",
    "Data Source: Elastic Defend",
    "Data Source: Crowdstrike",
    "Data Source: SentinelOne",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"
query = '''
process where host.os.type == "linux" and event.type == "start" and
event.action in ("exec", "exec_event", "start", "ProcessRollup2") and
process.parent.executable != null and process.name in ("grub-mkconfig", "grub2-mkconfig", "update-grub") and not (
  process.parent.name in ("run-parts", "sudo", "update-grub", "pacman", "dockerd", "dnf", "rpm", "yum") or
  process.parent.executable like (
    "/var/lib/dpkg/info/*", "/usr/lib/bootloader/grub2-efi/config", "/tmp/newroot/*", "/usr/lib/kernel/install.d/*",
    "/run/user/*/.bubblewrap/*/timeout"
  ) or
  process.parent.executable in (
    "/usr/bin/timeout", "/usr/sbin/nvidia-boot-update", "/usr/lib/oci-linux-config/misc_updates.sh",
    "/opt/puppetlabs/puppet/bin/puppet", "/usr/sbin/selinux-activate", "/usr/lib/skylight/stop-workspace",
    "/var/lib/aws-replication-agent/install_agent", "/usr/local/CTS/bin/apply_personality",
    "/opt/puppetlabs/puppet/bin/ruby"
  ) or
  (process.parent.name like ("python*", "platform-python*") and process.parent.command_line like "*ansible*")
)
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1542"
name = "Pre-OS Boot"
reference = "https://attack.mitre.org/techniques/T1542/"

[[rule.threat.technique]]
id = "T1543"
name = "Create or Modify System Process"
reference = "https://attack.mitre.org/techniques/T1543/"

[[rule.threat.technique]]
id = "T1574"
name = "Hijack Execution Flow"
reference = "https://attack.mitre.org/techniques/T1574/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1542"
name = "Pre-OS Boot"
reference = "https://attack.mitre.org/techniques/T1542/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[metadata]
creation_date = "2023/10/16"
integration = ["problemchild", "endpoint"]
maturity = "production"
updated_date = "2026/07/27"
min_stack_version = "9.4.0"
min_stack_comments = "Use EA (Entity Analytics) fields"

[rule]
anomaly_threshold = 75
author = ["Elastic"]
description = """
A machine learning job combination has identified a host with one or more suspicious Windows processes that exhibit
unusually high malicious probability scores.These process(es) have been classified as malicious in several ways. The
process(es) were predicted to be malicious by the ProblemChild supervised ML model. If the anomaly contains a cluster of
suspicious processes, each process has the same host name, and the aggregate score of the event cluster was calculated
to be unusually high by an unsupervised ML model. Such a cluster often contains suspicious or malicious activity,
possibly involving LOLbins, that may be resistant to detection using conventional search rules.
"""
from = "now-45m"
interval = "15m"
license = "Elastic License v2"
machine_learning_job_id = "problem_child_high_sum_by_host_ea"
name = "Host Detected with Suspicious Windows Process(es)"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Host Detected with Suspicious Windows Process(es)

The detection leverages machine learning to identify clusters of Windows processes with high malicious probability scores. Adversaries exploit legitimate tools, known as LOLbins, to evade detection. This rule uses both supervised and unsupervised ML models to flag unusual process clusters on a single host, indicating potential masquerading tactics for defense evasion.

### Possible investigation steps

- Review the host name associated with the suspicious process cluster to determine if it is a critical asset or has a history of similar alerts.
- Examine the specific processes flagged by the ProblemChild supervised ML model to identify any known LOLbins or unusual command-line arguments that may indicate masquerading.
- Check the timeline of the process execution to see if it coincides with any known scheduled tasks or user activity that could explain the anomaly.
- Investigate the parent-child relationship of the processes to identify any unexpected or unauthorized process spawning patterns.
- Correlate the alert with other security events or logs from the same host to identify any additional indicators of compromise or related suspicious activity.
- Assess the network activity associated with the host during the time of the alert to detect any potential data exfiltration or communication with known malicious IP addresses.

### False positive analysis

- Legitimate administrative tools like PowerShell or Windows Management Instrumentation (WMI) may be flagged as suspicious due to their dual-use nature. Users can create exceptions for these tools when used by trusted administrators or during scheduled maintenance.
- Automated scripts or scheduled tasks that perform routine system checks or updates might trigger alerts. Review these processes and whitelist them if they are verified as part of regular operations.
- Software updates or installations that involve multiple processes spawning in a short time frame can be mistaken for malicious clusters. Ensure that these activities are documented and create exceptions for known update processes.
- Development or testing environments where new or experimental software is frequently executed may generate false positives. Consider excluding these environments from monitoring or adjusting the sensitivity of the rule for these specific hosts.
- Frequent use of remote desktop or remote management tools by IT staff can appear suspicious. Implement user-based exceptions for known IT personnel to reduce unnecessary alerts.

### Response and remediation

- Isolate the affected host immediately to prevent further spread of potential malicious activity. Disconnect it from the network to contain the threat.
- Terminate the suspicious processes identified by the alert. Use task management tools or scripts to ensure all instances of the processes are stopped.
- Conduct a thorough review of the host's system logs and process history to identify any additional indicators of compromise or related malicious activity.
- Restore the host from a known good backup if available, ensuring that the backup is free from any signs of compromise.
- Update and patch the host's operating system and all installed software to close any vulnerabilities that may have been exploited.
- Implement application whitelisting to prevent unauthorized or suspicious processes from executing in the future.
- Escalate the incident to the security operations center (SOC) or incident response team for further analysis and to determine if additional hosts are affected."""
references = [
    "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html",
    "https://docs.elastic.co/en/integrations/problemchild",
    "https://www.elastic.co/security-labs/detecting-living-off-the-land-attacks-with-new-elastic-integration",
]
risk_score = 21
rule_id = "bdfebe11-e169-42e3-b344-c5d2015533d3"
setup = """## Setup

The rule requires the Living off the Land (LotL) Attack Detection integration assets to be installed, as well as Windows process events collected by integrations such as Elastic Defend or Winlogbeat.

### LotL Attack Detection Setup
The LotL Attack Detection integration detects living-off-the-land activity in Windows process events.

#### Prerequisite Requirements:
- Fleet is required for LotL Attack Detection.
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
- Windows process events collected by the [Elastic Defend](https://docs.elastic.co/en/integrations/endpoint) integration or Winlogbeat(https://www.elastic.co/guide/en/beats/winlogbeat/current/_winlogbeat_overview.html).
- To install Elastic Defend, refer to the [documentation](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
- To set up and run Winlogbeat, follow [this](https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-installation-configuration.html) guide.

#### The following steps should be executed to install assets associated with the LotL Attack Detection integration:
- Go to the Kibana homepage. Under Management, click Integrations.
- In the query bar, search for Living off the Land Attack Detection and select the integration to see more details about it.
- Follow the instructions under the **Installation** section.
- For this rule to work, complete the instructions through **Add preconfigured anomaly detection jobs**.
"""
severity = "low"
tags = [
    "Data Source: Elastic Defend",
    "Data Source: Elastic Endgame",
    "Use Case: Living off the Land Attack Detection",
    "Rule Type: ML",
    "Rule Type: Machine Learning",
    "Tactic: Defense Evasion",
    "Resources: Investigation Guide",
]
type = "machine_learning"
[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1036"
name = "Masquerading"
reference = "https://attack.mitre.org/techniques/T1036/"

[[rule.threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[metadata]
creation_date = "2026/02/04"
integration = ["kubernetes"]
maturity = "production"
updated_date = "2026/04/10"

[rule]
author = ["Elastic"]
description = """
This rule detects the creation of RoleBindings or ClusterRoleBindings that reference a ServiceAccount,
which may indicate privilege delegation or potential RBAC misconfiguration leading to elevated access.
"""
index = ["logs-kubernetes.audit_logs-*"]
language = "kuery"
license = "Elastic License v2"
name = "Kubernetes Creation of a RoleBinding Referencing a ServiceAccount"
note = """ ## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Kubernetes Creation of a RoleBinding Referencing a ServiceAccount

This rule detects creation of a RoleBinding or ClusterRoleBinding that grants permissions to a ServiceAccount, a common way to delegate access inside the cluster and a frequent precursor to stealthy privilege escalation or persistence. Attackers who gain the ability to create bindings often attach an over-privileged role (or cluster-wide role) to an existing ServiceAccount used by a workload, then use that workload’s token to operate with elevated rights without creating new user identities.

### Possible investigation steps

- Identify the principal that created the binding (user/service account), along with the source IP, user-agent, and authentication method, to determine whether it originated from an expected controller, CI/CD system, or a suspicious client.
- Review the new RoleBinding/ClusterRoleBinding’s `roleRef` and subjects to determine what permissions were granted, and assess blast radius by inspecting the referenced Role/ClusterRole rules for high-impact verbs/resources (e.g., secrets, pods/exec, nodes, RBAC).
- Determine where the referenced ServiceAccount is used by enumerating pods/deployments in the namespace that run under it, checking whether service account tokens are mounted, and whether this SA is associated with privileged workloads or externally reachable services.
- Correlate nearby audit activity for additional RBAC or identity changes (new roles, bindings, service accounts, token requests) and for follow-on actions performed using the ServiceAccount that indicate attempted privilege escalation or persistence.
- Validate the change against approved deployment/change records and, if unauthorized or overly permissive, remove/roll back the binding and rotate or invalidate the ServiceAccount credentials while tightening RBAC to least privilege.

### False positive analysis

- A cluster administrator or GitOps-driven deployment legitimately creates or updates RoleBindings/ClusterRoleBindings to grant a workload ServiceAccount the minimal permissions required for a new release, namespace onboarding, or routine RBAC refactoring.
- Kubernetes controllers or automation running under authorized identities (e.g., internal operators, admission policies, or namespace provisioning jobs) create bindings for default or system ServiceAccounts as part of standard cluster bootstrap, reconciliation, or multi-tenant namespace setup.

### Response and remediation

- Immediately fetch and snapshot the created RoleBinding/ClusterRoleBinding manifest, its referenced Role/ClusterRole, and recent Kubernetes audit events around the creator and the ServiceAccount to preserve evidence and establish scope.  
- Contain potential misuse by deleting or scaling down workloads that use the referenced ServiceAccount and temporarily revoking the new binding (or applying an emergency deny policy via admission controls) until the change is validated.  
- Eradicate unauthorized privilege delegation by removing the binding, replacing it with a least-privilege Role/RoleBinding scoped to the required namespace/resources, and rotating credentials by recreating the ServiceAccount or forcing token/key rotation for any dependent workloads.  
- Recover safely by redeploying affected applications with the corrected RBAC, validating that required operations succeed without cluster-admin-equivalent rights, and monitoring for repeated binding creation or follow-on access to secrets, pod exec, or node-level resources.  
- Escalate to platform security/incident response immediately if the binding references a high-privilege ClusterRole (e.g., cluster-admin), targets a broadly used ServiceAccount, or is followed by suspicious actions such as secret reads, new token requests, or pod exec sessions from the same identity.  
- Harden by enforcing RBAC guardrails with admission policies that restrict who can create RoleBindings/ClusterRoleBindings and which roles may be referenced, disabling auto-mounting of service account tokens where not needed, and adopting GitOps-only RBAC changes with mandatory review.
"""
references = [
    "https://heilancoos.github.io/research/2025/12/16/kubernetes.html#overly-permissive-role-based-access-control",
]
risk_score = 47
rule_id = "fd00769d-b18d-450a-a844-7a9f9c71995e"
severity = "medium"
tags = [
    "Data Source: Kubernetes",
    "Domain: Kubernetes",
    "Use Case: Threat Detection",
    "Tactic: Persistence",
    "Tactic: Privilege Escalation",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"
query = '''
data_stream.dataset: "kubernetes.audit_logs" and kubernetes.audit.requestObject.spec.serviceAccountName:* and
kubernetes.audit.verb:"create" and kubernetes.audit.objectRef.resource:("rolebindings" or "clusterrolebindings") and
kubernetes.audit.annotations.authorization_k8s_io/decision:"allow"
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"

[[rule.threat.technique.subtechnique]]
id = "T1098.006"
name = "Additional Container Cluster Roles"
reference = "https://attack.mitre.org/techniques/T1098/006/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"

[[rule.threat.technique.subtechnique]]
id = "T1098.006"
name = "Additional Container Cluster Roles"
reference = "https://attack.mitre.org/techniques/T1098/006/"

[rule.threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[rule]
description = """
Detects when Powershell (pwsh) on Linux makes an outbound network connection attempt. Powershell usage on Linux is rare,
and leveraging Powershell to connect out to the internet may indicate malicious behavior.
"""
id = "1471cf36-7e5c-47cc-bf39-2234df0e676a"
license = "Elastic License v2"
name = "Linux Powershell Egress Network Connection"
os_list = ["linux"]
version = "1.0.14"

query = '''
sequence by process.entity_id with maxspan=5s
  [process where event.type == "start" and event.action == "exec" and process.parent.name == "pwsh" and not (
    process.name in ("kubectl", "helm", "pwsh", "yum", "dnf", "dotnet", "ansible-lint") or
    process.executable like (
      "/run/containerd/*python3", "/jenkins-data/docker/*python3", "/tmp/Download-References/DepotDownloader/DepotDownloader",
      "/home/*/.local/bin/az", "/usr/libexec/platform-python*"
    ) or
    process.parent.executable like ("/jenkins-data/docker*", "/var/run/docker/*", "/run/containerd/*") or
    process.command_line == "/usr/bin/gh auth status" or
    (process.name like "python*" and process.args == "azure.cli") or
    process.working_directory like "/opt/azurevstsagent/agent*" or
    process.args == "/bin/dnf" or
    process.args like "/home/*/.local/bin/az"
  )
  ]
  [network where event.type == "start" and event.action == "connection_attempted" and not (
     destination.ip == null or
     destination.ip == "0.0.0.0" or
     cidrmatch(
       destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.0.0/29",
       "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
       "192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10",
       "192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1", "FE80::/10",
       "FF00::/8"
     ) or
     process.name == "ssh"
   )
  ]
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.001"
name = "PowerShell"
reference = "https://attack.mitre.org/techniques/T1059/001/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"

[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[[threat]]
framework = "MITRE ATT&CK"

[threat.tactic]
id = "TA0010"
name = "Exfiltration"
reference = "https://attack.mitre.org/tactics/TA0010/"
[[threat]]
framework = "MITRE ATT&CK"

[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "7.15.0"

[metadata]
creation_date = "2023/02/13"
integration = ["endpoint", "auditd_manager", "crowdstrike", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2026/06/17"

[transform]
[[transform.osquery]]
label = "Osquery - Retrieve Information for a Specific User"
query = "SELECT * FROM users WHERE username = {{user.name}}"

[[transform.osquery]]
label = "Osquery - Investigate the Account Authentication Status"
query = "SELECT * FROM logged_in_users WHERE user = {{user.name}}"

[[transform.osquery]]
label = "Osquery - Retrieve Information for a Specific Group"
query = "SELECT * FROM groups WHERE groupname = {{group.name}}"

[[transform.osquery]]
label = "Osquery - Retrieve Running Processes by User"
query = "SELECT pid, username, name FROM processes p JOIN users u ON u.uid = p.uid ORDER BY username"

[rule]
author = ["Elastic"]
description = """
Identifies attempts to add a user to a privileged group. Attackers may add users to a privileged group in order to
establish persistence on a system.
"""
from = "now-9m"
index = [
    "auditbeat-*",
    "endgame-*",
    "logs-auditd_manager.auditd-*",
    "logs-crowdstrike.fdr*",
    "logs-endpoint.events.process*",
    "logs-sentinel_one_cloud_funnel.*",
]
language = "eql"
license = "Elastic License v2"
name = "Linux User Added to Privileged Group"
note = """## Triage and analysis

### Investigating Linux User Added to Privileged Group

The `usermod`, `adduser`, and `gpasswd` commands can be used to assign user accounts to new groups in Linux-based operating systems.

Attackers may add users to a privileged group in order to escalate privileges or establish persistence on a system or domain.

This rule identifies the usages of `usermod`, `adduser` and `gpasswd` to assign user accounts to a privileged group.

> **Note**:
> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/current/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.

#### Possible investigation steps

- Investigate whether the user was successfully added to the privileged group.
  - $osquery_0
- Investigate whether the user is currently logged in and active.
  - $osquery_1
- Retrieve information about the privileged group to which the user was added.
  - $osquery_2
- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence and whether they are located in expected locations.
  - $osquery_3
- Identify the user account that performed the action and whether it should perform this kind of action.
- Investigate other alerts associated with the user/host during the past 48 hours.

### False positive analysis

- Adding accounts to a group is a common administrative task, so there is a high chance of the activity being legitimate. Before investigating further, verify that this activity is not benign.

### Response and remediation

- Initiate the incident response process based on the outcome of the triage.
- Isolate the involved host to prevent further post-compromise behavior.
- If the triage identified malware, search the environment for additional compromised hosts.
  - Implement temporary network rules, procedures, and segmentation to contain the malware.
  - Stop suspicious processes.
  - Immediately block the identified indicators of compromise (IoCs).
  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
- Review the privileges assigned to the involved users to ensure that the least privilege principle is being followed.
- Delete the account that seems to be involved in malicious activity.
- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
"""
references = ["https://www.elastic.co/security-labs/primer-on-persistence-mechanisms"]
risk_score = 21
rule_id = "43d6ec12-2b1c-47b5-8f35-e9de65551d3b"
setup = """## Setup

This rule requires data coming in from Elastic Defend.

### Elastic Defend Integration Setup
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.

#### Prerequisite Requirements:
- Fleet is required for Elastic Defend.
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).

#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
- Go to the Kibana home page and click "Add integrations".
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
- Click "Add Elastic Defend".
- Configure the integration name and optionally add a description.
- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
- Click "Save and Continue".
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
"""
severity = "low"
tags = [
    "Domain: Endpoint",
    "OS: Linux",
    "Use Case: Threat Detection",
    "Tactic: Persistence",
    "Data Source: Elastic Endgame",
    "Resources: Investigation Guide",
    "Data Source: Elastic Defend",
    "Data Source: Auditd Manager",
    "Data Source: Crowdstrike",
    "Data Source: SentinelOne",
]
timestamp_override = "event.ingested"
type = "eql"
query = '''
process where host.os.type == "linux" and event.type == "start" and
event.action in ("exec", "exec_event", "start", "ProcessRollup2", "executed", "process_started") and
process.executable != null and process.args in (
  "root", "admin", "wheel", "staff", "sudo","disk", "video", "shadow", "lxc", "lxd"
) and
(
  process.name in ("usermod", "adduser") or
  (process.name == "gpasswd" and process.args in ("-a", "--add", "-M", "--members"))
) and
not (
  ?process.parent.executable like (
    "/usr/lib/google/guest_agent/core_plugin", "/usr/libexec/platform-python*", "/usr/lib/google/guest_agent/GuestAgentCorePlugin/core_plugin",
    "/usr/bin/google_guest_agent"
  ) or
  (
    ?process.entry_leader.executable == "/usr/lib/venv-salt-minion/bin/python.original" and
    ?process.entry_leader.args == "/usr/lib/venv-salt-minion/bin/salt-minion"
  )
)
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"

[[rule.threat.technique.subtechnique]]
id = "T1098.007"
name = "Additional Local or Domain Groups"
reference = "https://attack.mitre.org/techniques/T1098/007/"

[[rule.threat.technique]]
id = "T1136"
name = "Create Account"
reference = "https://attack.mitre.org/techniques/T1136/"

[[rule.threat.technique.subtechnique]]
id = "T1136.001"
name = "Local Account"
reference = "https://attack.mitre.org/techniques/T1136/001/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"

[[rule.threat.technique.subtechnique]]
id = "T1098.007"
name = "Additional Local or Domain Groups"
reference = "https://attack.mitre.org/techniques/T1098/007/"

[rule.threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[metadata]
creation_date = "2020/11/19"
integration = ["o365"]
maturity = "production"
updated_date = "2026/04/10"

[rule]
author = ["Elastic"]
description = """
Identifies when a transport rule has been disabled or deleted in Microsoft 365. Mail flow rules (also known as transport
rules) are used to identify and take action on messages that flow through your organization. An adversary or insider
threat may modify a transport rule to exfiltrate data or evade defenses.
"""
false_positives = [
    """
    A transport rule may be modified by a system or network administrator. Verify that the configuration change was
    expected. Exceptions can be added to this rule to filter expected behavior.
    """,
]
from = "now-9m"
index = ["logs-o365.audit-*", "filebeat-*"]
language = "kuery"
license = "Elastic License v2"
name = "M365 Exchange Mail Flow Transport Rule Modified"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating M365 Exchange Mail Flow Transport Rule Modified

Microsoft 365 Exchange transport rules manage email flow by setting conditions and actions for messages. Adversaries may exploit these rules to disable or delete them, facilitating data exfiltration or bypassing security measures. The detection rule monitors audit logs for successful execution of commands that alter these rules, signaling potential misuse and enabling timely investigation.

### Possible investigation steps

- Review the audit logs for the specific event.dataset:o365.audit entries with event.provider:Exchange to confirm the occurrence of the "Remove-TransportRule" or "Disable-TransportRule" actions.
- Identify the user account associated with the event by examining the user information in the audit logs to determine if the action was performed by an authorized individual or a potential adversary.
- Check the event.category:web context to understand if the action was performed through a web interface, which might indicate a compromised account or unauthorized access.
- Investigate the event.outcome:success to ensure that the rule modification was indeed successful and not an attempted action.
- Correlate the timing of the rule modification with other security events or alerts to identify any concurrent suspicious activities that might suggest a broader attack or data exfiltration attempt.
- Assess the impact of the rule modification by reviewing the affected transport rules to determine if they were critical for security or compliance, and evaluate the potential risk to the organization.

### False positive analysis

- Routine administrative changes to transport rules by IT staff can trigger alerts. To manage this, maintain a list of authorized personnel and their expected activities, and create exceptions for these users in the monitoring system.
- Scheduled maintenance or updates to transport rules may result in false positives. Document these activities and adjust the monitoring system to temporarily exclude these events during known maintenance windows.
- Automated scripts or third-party tools that manage transport rules might cause alerts. Identify these tools and their typical behavior, then configure the monitoring system to recognize and exclude these benign actions.
- Changes made as part of compliance audits or security assessments can be mistaken for malicious activity. Coordinate with audit teams to log these activities separately and adjust the monitoring system to account for these legitimate changes.

### Response and remediation

- Immediately disable any compromised accounts identified in the audit logs to prevent further unauthorized modifications to transport rules.
- Revert any unauthorized changes to transport rules by restoring them to their previous configurations using backup data or logs.
- Conduct a thorough review of all transport rules to ensure no additional unauthorized modifications have been made, and confirm that all rules align with organizational security policies.
- Implement additional monitoring on the affected accounts and transport rules to detect any further suspicious activities or attempts to modify rules.
- Escalate the incident to the security operations team for a deeper investigation into potential data exfiltration activities and to assess the scope of the breach.
- Coordinate with legal and compliance teams to determine if any regulatory reporting is required due to potential data exfiltration.
- Enhance security measures by enabling multi-factor authentication (MFA) for all administrative accounts and reviewing access permissions to ensure the principle of least privilege is enforced.

## Setup

The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
references = [
    "https://docs.microsoft.com/en-us/powershell/module/exchange/remove-transportrule?view=exchange-ps",
    "https://docs.microsoft.com/en-us/powershell/module/exchange/disable-transportrule?view=exchange-ps",
    "https://docs.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/mail-flow-rules",
]
risk_score = 47
rule_id = "272a6484-2663-46db-a532-ef734bf9a796"
severity = "medium"
tags = ["Domain: Cloud", "Data Source: Microsoft 365", "Use Case: Configuration Audit", "Tactic: Exfiltration", "Resources: Investigation Guide"]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset:o365.audit and event.provider:Exchange and event.category:web and event.action:("Remove-TransportRule" or "Disable-TransportRule") and event.outcome:success
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1537"
name = "Transfer Data to Cloud Account"
reference = "https://attack.mitre.org/techniques/T1537/"

[rule.threat.tactic]
id = "TA0010"
name = "Exfiltration"
reference = "https://attack.mitre.org/tactics/TA0010/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"

[[rule.threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[rule]
description = """
Detects Node.js executing a JavaScript file followed by immediate deletion of that script. This anti-forensics pattern
is used to execute malicious logic and then destroy the evidence, making post-incident inspection difficult. The tight
timing window between execution and deletion distinguishes this from normal cleanup or build processes.
"""
id = "1059825f-8f64-4b69-a398-2a54003d1946"
license = "Elastic License v2"
name = "Node Script Execution and Immediate Deletion"
os_list = ["macos"]
reference = ["https://www.elastic.co/security-labs/axios-supply-chain-compromise-detections"]
version = "1.0.2"

query = '''
sequence by process.entity_id with maxspan=10s
  [process where event.type == "start" and event.action in ("exec", "start") and
    process.name in ("node", "node.exe") and process.args_count <= 2 and
    process.args like~ (
      "/tmp/*.js", "/private/tmp/*.js",
      "/var/tmp/*.js", "/private/var/tmp/*.js",
      "/Users/Shared/*.js",
      "/var/folders/*/T/*.js", "/private/var/folders/*/T/*.js",
      "/Users/*/Library/Caches/*.js",
      "/dev/shm/*.js",
      "?:\\\\Users\\\\*\\\\AppData\\\\Local\\\\Temp\\\\*.js",
      "?:\\\\Windows\\\\Temp\\\\*.js",
      "?:\\\\ProgramData\\\\Temp\\\\*.js"
    )] as event0
  [file where event.action == "deletion" and file.extension : "js" and
   stringcontains~(event0.process.command_line, file.name) and
   not (
     process.executable like "/actions-runner/externals/node24/bin/node" and
     file.path like (
       "/tmp/github-runner-*/index.js",
       "/root/setup-pnpm/node_modules/.pnpm/pnpm@*/node_modules/pnpm/dist/node_modules/env-paths/index.js"
     )
   )]
'''

min_endpoint_version = "8.16.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1070"
name = "Indicator Removal"
reference = "https://attack.mitre.org/techniques/T1070/"
[[threat.technique.subtechnique]]
id = "T1070.004"
name = "File Deletion"
reference = "https://attack.mitre.org/techniques/T1070/004/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.16.0"