Elastic rules: 3e

[rule]
description = """
Identifies Windows Native API calls with ROP gadgets and from an unusual Microsoft signed module. This may be the result
of a code injection.
"""
id = "d869a5ff-5bda-4417-90c9-c353a949d26e"
license = "Elastic License v2"
name = "API Call via Jump ROP Gadget"
os_list = ["windows"]
version = "1.0.11"

query = '''
api where process.Ext.api.behaviors == "image_rop" and
 process.Ext.api.name in ("VirtualAlloc", "VirtualProtect", "WriteProcessMemory", "SetThreadContext", "SuspendThread", "VirtualProtectEx") and
 not process.thread.Ext.call_stack_final_user_module.name in ("Kernel", "Unbacked") and 
 /* final user module trailing bytes starts with JMP or CALL REG pattern */
 (
  _arraysearch(process.thread.Ext.call_stack, $entry,
               stringcontains~($entry.symbol_info, process.thread.Ext.call_stack_final_user_module.name) and $entry.callsite_trailing_bytes regex """(([23][6e]|[45].|6[4-7]|90|f[023])?ff[12de][3-7]|([23][6e]|4.|6[4-7]|90|f[023])?5[3-7]c3).+""" and not $entry.callsite_trailing_bytes : "ff15*") or

   (process.thread.Ext.call_stack_final_user_module.name == "Undetermined" and
    process.thread.Ext.call_stack_summary in 
             ("ntdll.dll|kernelbase.dll|Unbacked", 
              "ntdll.dll|kernelbase.dll|ntdll.dll",
              "ntdll.dll|kernelbase.dll|ntdll.dll|kernel32.dll|ntdll.dll") and
    _arraysearch(process.thread.Ext.call_stack, $entry,
                $entry.symbol_info : ("*kernelbase.dll*", "*ntdll.dll*") and $entry.callsite_trailing_bytes regex """(([23][6e]|[45].|6[4-7]|90|f[023])?ff([de][3-7]|[12][367]|1424|55)|([23][6e]|4.|6[4-7]|90|f[023])?5[3-7]c3).+""" and not $entry.callsite_trailing_bytes : "ff15*")) or

    (process.Ext.api.behaviors == "proxy_call" and
     process.thread.Ext.call_stack_final_user_module.name == "Undetermined" and
     process.thread.Ext.call_stack_summary like "ntdll.dll|kernelbase.dll|*" and
     _arraysearch(process.thread.Ext.call_stack, $entry, $entry.callsite_trailing_bytes regex """(([23][6e]|[45].|6[4-7]|90|f[023])?ff([de][3-7]|[12][367]|1424|55)|([23][6e]|4.|6[4-7]|90|f[023])?5[3-7]c3).+""" and not $entry.callsite_trailing_bytes : "ff15*"))
  ) and
  not (process.thread.Ext.call_stack_final_user_module.path like
                              ("c:\\program files (x86)\\*",
                               "c:\\windows\\syswow64\\*",
                               "c:\\windows\\system32\\spool\\drivers\\x64\\3\\x2wfuv0u.dll") and
       _arraysearch(process.thread.Ext.call_stack, $entry, $entry.callsite_trailing_bytes : ("??ffd6f*", "ffd6*", "??ff15*", "??ff14*", "55c316*"))) and
  not process.thread.Ext.call_stack_final_user_module.hash.sha256 in
                                  ("5e3758ffbb23dd84717ba3193deea24d47de15de5f65dd7051fcb5ede6938340",
                                   "526104f18200c6cd055886c4d08f02278aa0325abe17b697529e4a67ac7582f8",
                                   "579ab93c5db70cd3b3b3e2372cfcba1d968336e7e88b6ffc9e85160cc7c41d93",
                                   "0d5d73d3bea132f98be91f918d13043791decb419a81d9e755979315a7cf0502",
                                   "55bc12b34f81f43fa99bbe18d4ca1f07ccdde962039c59959d212aa7eac7586d",
                                   "92090a86491251f461e1b8e6e7c6ff9f1ed0aebd63c19381850e219d2dd44708",
                                   "9ace6b6d2093f4812461a4d05c66cf3a4f838b5292deea78c31e7301feeebc82",
                                   "e093097faf851745b434c376dd48139eb0883805f130cb94d8ed5a10317dc745",
                                   "a86749e6e28a8991c0b04fd626f49731e6b1185686e52523ea51a00f10f709d9",
                                   "f7df966bb1aab2a430134148bd5fd9024cc69b0e4f22ee2db00130effc577965") and
  not (process.executable : "C:\\Program Files\\Evolution Services Manager\\FireDaemon.exe" and
       process.thread.Ext.call_stack_final_user_module.path == "c:\\program files\\evolution services manager\\licensing.dll") and 
  not process.thread.Ext.call_stack_summary like ("ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|*", "wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|webio.dll|*") and
  not _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature,
                   $entry, $entry.subject_name in ("Microsoft Windows Hardware Compatibility Publisher", "Microsoft Windows Software Compatibility Publisher") and $entry.status == "trusted") and
  process.thread.Ext.call_stack_final_user_module.path != "c:\\program files\\microsoft office\\office16\\gkexcel.dll" and
  not _arraysearch(process.thread.Ext.call_stack, $entry,
                   $entry.callsite_trailing_bytes like
                               ("f0ffe*",
                                "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
                                "48ff25da280000*", "48ff15339d0000*", "48ff1524a601000f1f4400008bf0*", "ff24bc1894320000ff24bc1894320000ff24*",
                                "48ff1594aa01000f1f4400008bf0488d84249800000048398424900000007459488d8c2490000000e8e2f4ffffeb4a488d8424a00100004883ceff48ffc66639"))
'''

min_endpoint_version = "8.10.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"

[metadata]
creation_date = "2026/06/04"
integration = ["aws"]
maturity = "production"
updated_date = "2026/06/04"

[rule]
author = ["Elastic"]
description = """
Detects deletion or modification of AWS Bedrock Automated Reasoning policies via the DeleteAutomatedReasoningPolicy,
UpdateAutomatedReasoningPolicy, or UpdateAutomatedReasoningPolicyAnnotations CloudTrail actions. Automated Reasoning
policies are a Bedrock safety and validation control that constrains model outputs against formal rules. An adversary
who deletes a policy or alters the policy definition or its annotations weakens an enforced output-validation defense,
potentially allowing unsafe or non-compliant model responses to pass unchecked. Benign build, test-workflow, and
test-case CRUD operations are intentionally excluded as they have no coherent abuse path.
"""
false_positives = [
    """
    Policy administrators, ML platform engineers, or infrastructure-as-code pipelines may legitimately update or remove
    Automated Reasoning policies during model governance changes, policy tuning, or environment teardown. Verify that
    the user identity, source IP, and user agent correspond to an approved change and that a corresponding change
    request exists. Known automation roles can be exempted if they generate recurring noise.
    """,
]
from = "now-6m"
index = ["logs-aws.cloudtrail-*"]
language = "kuery"
license = "Elastic License v2"
name = "AWS Bedrock Automated Reasoning Safety Policy Tampering"
note = """## Triage and analysis

### Investigating AWS Bedrock Automated Reasoning Safety Policy Tampering

AWS Bedrock Automated Reasoning policies enforce formal, rule-based validation of model outputs, acting as a
safety control that constrains what a model is permitted to return. Deleting a policy or modifying its
definition or annotations directly weakens this control. Adversaries who have gained access to the Bedrock
control plane may tamper with these policies to evade output-validation defenses, enabling unsafe, manipulated,
or non-compliant model behavior. This detection identifies `DeleteAutomatedReasoningPolicy`,
`UpdateAutomatedReasoningPolicy`, and `UpdateAutomatedReasoningPolicyAnnotations` calls so responders can
confirm whether the change was authorized.

#### Possible investigation steps

- **Identify the actor and context**
  - Review `aws.cloudtrail.user_identity.arn`, `aws.cloudtrail.user_identity.type`,
    `aws.cloudtrail.user_identity.access_key_id`, `source.ip`, and `user_agent.original`.
  - Determine whether the identity normally administers Bedrock safety policies and whether the action aligns
    with an approved change request.
- **Review the specific action**
  - For `DeleteAutomatedReasoningPolicy`, identify the deleted policy in
    `aws.cloudtrail.flattened.request_parameters` and confirm whether a replacement control exists.
  - For `UpdateAutomatedReasoningPolicy` / `UpdateAutomatedReasoningPolicyAnnotations`, inspect
    `aws.cloudtrail.request_parameters` and `aws.cloudtrail.response_elements` to understand what was changed
    and whether the change loosens validation constraints.
- **Correlate surrounding activity**
  - Look for other Defense Evasion or Bedrock control-plane activity from the same identity in the surrounding
    window (model invocation changes, guardrail modifications, logging changes).
  - Check `cloud.account.id` and `cloud.region` to scope blast radius across the environment.

### False positive analysis

- **Planned policy maintenance**: Governance teams may legitimately tune or retire Automated Reasoning
  policies. Validate against change tickets and standard templates.
- **Automation**: IaC or CI/CD pipelines may update policies during deployments. Confirm the actor maps to
  known automation infrastructure.

### Response and remediation

- If the change is unauthorized, restore the prior policy definition or recreate the deleted policy from a
  known-good configuration.
- Revoke or rotate the credentials in `aws.cloudtrail.user_identity.access_key_id` if compromise is suspected.
- Review all Bedrock control-plane activity from the same identity in the preceding window for further
  defense-impairing actions.
- Restrict `bedrock:DeleteAutomatedReasoningPolicy` and `bedrock:UpdateAutomatedReasoningPolicy*` permissions
  to a small set of administrative roles and enforce approval workflows.
"""
references = [
    "https://docs.aws.amazon.com/bedrock/latest/userguide/automated-reasoning.html"
]
risk_score = 47
rule_id = "2d7822a5-418c-4cde-a96e-e337d77b67e7"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Domain: LLM",
    "Data Source: AWS",
    "Data Source: AWS CloudTrail",
    "Data Source: Amazon Web Services",
    "Data Source: Amazon Bedrock",
    "Use Case: Threat Detection",
    "Resources: Investigation Guide",
    "Tactic: Defense Evasion"
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset: "aws.cloudtrail" and
    event.provider: "bedrock.amazonaws.com" and
    event.action: (
        "DeleteAutomatedReasoningPolicy" or
        "UpdateAutomatedReasoningPolicy" or
        "UpdateAutomatedReasoningPolicyAnnotations"
    ) and event.outcome:success
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"

[[rule.threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user_agent.original",
    "source.ip",
    "source.as.number",
    "aws.cloudtrail.user_identity.arn",
    "aws.cloudtrail.user_identity.type",
    "aws.cloudtrail.user_identity.access_key_id",
    "event.action",
    "event.provider",
    "event.outcome",
    "cloud.account.id",
    "cloud.region",
    "aws.cloudtrail.request_parameters",
    "aws.cloudtrail.response_elements",
]

[metadata]
creation_date = "2025/06/02"
integration = ["aws"]
maturity = "production"
updated_date = "2026/08/05"

[rule]
author = ["Elastic"]
description = """
Identifies the removal of access permissions from a shared AWS EC2 EBS snapshot. EBS snapshots are essential for data
retention and disaster recovery. Adversaries may revoke or modify snapshot permissions to prevent legitimate users from
accessing backups, thereby obstructing recovery efforts after data loss or destructive actions. This tactic can also be
used to evade detection or maintain exclusive access to critical backups, ultimately increasing the impact of an attack
and complicating incident response.
"""
event_category_override = "event.type"
false_positives = ["Access removal may be a part of normal operations and should be verified before taking action."]
from = "now-6m"
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
language = "eql"
license = "Elastic License v2"
name = "AWS EC2 EBS Snapshot Access Removed"
note = """## Triage and analysis

### Investigating AWS EC2 EBS Snapshot Access Removed

This rule detects when access is removed for an AWS EC2 EBS snapshot. EBS virtual disks can be copied into snapshots, which can then be used as backups for recovery and data retention efforts. Adversaries may attempt to remove access to snapshots in order to prevent legitimate users or automated processes from accessing or restoring from snapshots following data loss, ransomware, or destructive actions. This can significantly delay or even prevent recovery, increasing the impact of the attack. Restricting snapshot access may help adversaries cover their tracks by making it harder for defenders to analyze or recover deleted or altered data. Attackers may remove permissions for all users except their own compromised account, allowing them to maintain exclusive access to backups for future use or leverage. Understanding the context and legitimacy of such changes is crucial to determine if the action is benign or malicious.

#### Possible investigation steps:

- **Identify who performed the action**: Review `aws.cloudtrail.user_identity.arn` and `aws.cloudtrail.user_identity.access_key_id` to identify who made the change. Evaluate whether the identity is authorized to manage EBS snapshot permissions (check IAM policies for `ec2:ModifySnapshotAttribute`). 

- **Analyze the source of the request**: Examine `source.ip` and `source.geo` fields to determine the geographical origin of the request. An external or unexpected location might indicate compromised credentials or unauthorized access. Review `user_agent.original` to determine if the request came from an expected administrative tool or host.

- **Examine the scope of the change**:
  - Review `aws.cloudtrail.request_parameters` to understand which accounts or entities had access removed.  
    - Look for unusual patterns such as `createVolumePermission={remove=all}` or removal of specific external or organizational accounts.  
  - Cross-check the affected `snapshotId` in the AWS console or via CLI to confirm current sharing status and determine if any copies or dependent volumes exist.  
  - Use AWS Config or AWS CLI (`describe-snapshot-attribute`) to verify whether other snapshots were modified within the same timeframe.

- **Correlate with other activities**:
  - Search CloudTrail for additional activity from the same actor or `source.ip` around the event time.  
    - Pay special attention to subsequent `DeleteSnapshot`, `DeregisterImage`, or `RevokeSnapshotAccess` events, which may signal ongoing destruction.  
    - Check for parallel IAM activity, such as policy changes that grant or revoke permissions.  
  - Correlate with GuardDuty or Security Hub findings related to data exfiltration, destructive actions, or unauthorized configuration changes.  
  - Determine if any high-value or production snapshots were affected, especially those linked to business-critical EBS volumes.

- **Evaluate timing and intent**: Compare `@timestamp` with maintenance windows or known change requests. Actions taken outside approved hours or without associated tickets may indicate compromise or sabotage. If this change coincides with other detections (for example, `EBS encryption disabled` or `root login` events), treat it as part of a coordinated impact campaign.

### False positive analysis:

- **Planned administrative maintenance**: Confirm whether this snapshot modification aligns with backup rotation, retention policy enforcement, or snapshot lifecycle automation.  
- **Automation and tooling**: Infrastructure-as-code pipelines or DevOps scripts may legitimately remove snapshot sharing to enforce compliance. Review tags, user agents, and automation identifiers.  
- **Testing or sandbox accounts**: Some non-production environments may modify snapshot access for isolation. Validate account purpose before escalating.

If the action was expected, document the change approval and reconcile against internal audit or change-control systems.

### Response and remediation:

**Containment and validation**
- Review and, if necessary, restore snapshot permissions using AWS Console or CLI (`modify-snapshot-attribute` with `add` parameters).  
- Confirm that no additional snapshots or AMIs have had access removed.  
- Restrict `ec2:ModifySnapshotAttribute` permissions to only trusted administrative roles.

**Investigate for data destruction or persistence**
- Determine if the same actor also deleted or copied snapshots (`DeleteSnapshot`, `CopySnapshot`).  
- Review subsequent volume creation or image registration events that could indicate snapshot reuse.  
- Identify whether any snapshot was shared to or copied by an external AWS account.

**Strengthen detection and monitoring**
- Enable AWS Config rules and Security Hub controls such as `ebs-snapshot-public-restorable-check`.  
- Establish continuous monitoring for `ModifySnapshotAttribute` and `DeleteSnapshot` operations.  
- Correlate future detections with user identity and source IP context to identify recurring behavior.

**Recovery and hardening**
- Verify that critical snapshots and backups are retained and encrypted.  
- Implement backup immutability with AWS Backup Vault Lock or S3 Object Lock for long-term protection.  
- Apply service control policies (SCPs) to prevent unauthorized modification of snapshot sharing attributes.  
- Conduct a post-incident review to identify the root cause and strengthen least-privilege enforcement for EBS management roles.

### Additional information

- **[AWS Incident Response Playbooks](https://github.com/aws-samples/aws-incident-response-playbooks/blob/c151b0dc091755fffd4d662a8f29e2f6794da52c/playbooks/)**: guidance for investigating unauthorized access to modify account settings.  
- **[AWS Customer Playbook Framework](https://github.com/aws-samples/aws-customer-playbook-framework/)**: Example framework for customers to create, develop, and integrate security playbooks in preparation for potential attack scenarios when using AWS services
- **AWS Documentation**  
  - [EBS Snapshot Permissions](https://docs.aws.amazon.com/ebs/latest/userguide/ebs-modifying-snapshot-permissions.html)  
  - [ModifySnapshotAttribute API Reference](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifySnapshotAttribute.html)
"""
references = [
    "https://docs.aws.amazon.com/ebs/latest/userguide/ebs-modifying-snapshot-permissions.html",
    "https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifySnapshotAttribute.html",
]
risk_score = 47
rule_id = "713e0f5f-caf7-4dc2-88a7-3561f61f262a"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Platform: AWS",
    "Data Source: AWS CloudTrail",
    "Service: AWS EC2",
    "Tactic: Impact",
    "Rule Type: Event Correlation (EQL)",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
info where data_stream.dataset == "aws.cloudtrail"  
  and event.action == "ModifySnapshotAttribute"
  and event.outcome == "success"
  and stringContains (aws.cloudtrail.request_parameters, "attributeType=CREATE_VOLUME_PERMISSION")
  and stringContains (aws.cloudtrail.request_parameters, "remove=")
  and not source.address == "backup.amazonaws.com"
  and not user_agent.original like~ ("*Terraform*", "*Pulumi*")
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1485"
name = "Data Destruction"
reference = "https://attack.mitre.org/techniques/T1485/"

[[rule.threat.technique]]
id = "T1490"
name = "Inhibit System Recovery"
reference = "https://attack.mitre.org/techniques/T1490/"

[rule.threat.tactic]
id = "TA0040"
name = "Impact"
reference = "https://attack.mitre.org/tactics/TA0040/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1578"
name = "Modify Cloud Compute Infrastructure"
reference = "https://attack.mitre.org/techniques/T1578/"

[[rule.threat.technique.subtechnique]]
id = "T1578.005"
name = "Modify Cloud Compute Configurations"
reference = "https://attack.mitre.org/techniques/T1578/005/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user_agent.original",
    "source.ip",
    "aws.cloudtrail.user_identity.arn",
    "aws.cloudtrail.user_identity.type",
    "aws.cloudtrail.user_identity.access_key_id",
    "event.action",
    "event.outcome",
    "cloud.account.id",
    "cloud.region",
    "aws.cloudtrail.request_parameters",
    "aws.cloudtrail.response_elements",
]

[metadata]
creation_date = "2026/06/18"
integration = ["aws"]
maturity = "production"
updated_date = "2026/06/18"

[rule]
author = ["Elastic"]
description = """
Identifies an AWS Lambda function invoked by a principal whose AWS account differs from the account that owns the
function (a cross-account invocation). The caller's account is parsed from the invoking principal's ARN and compared to
the function account. Adversaries who have been granted invoke permission on a function from an external account, or who
operate from a separate attacker-controlled account, can use cross-account invocation to execute functions or retrieve
the data they return. This is the data-plane counterpart to detecting the cross-account grant itself, and relies on AWS
Lambda data event logging, which is not enabled by default.
"""
false_positives = [
    """
    Multi-account architectures and partner integrations legitimately invoke functions across account boundaries. Verify
    the caller account, the principal in `aws.cloudtrail.user_identity.arn`, and the function against approved
    cross-account access, and exclude known trusted accounts or identities after validation.
    """,
]
from = "now-61m"
interval = "60m"
language = "esql"
license = "Elastic License v2"
name = "AWS Lambda Function Invoked Cross-Account"
note = """## Triage and analysis

### Investigating AWS Lambda Function Invoked Cross-Account

A Lambda function invoked by a principal from a different AWS account indicates cross-account invocation - the data-plane realization of a cross-account resource-policy grant. CloudTrail data events record the invoking principal's ARN (which contains the caller's account) and the function's owning account. When these differ, an external account executed the function. This can be a legitimate multi-account integration or an adversary using granted or attacker-controlled cross-account access.

#### Possible investigation steps

- Review `Esql.caller_account` (the invoking principal's account) versus `Esql.function_account` (the invoked function's owning account) and confirm whether the caller account is a known, trusted account.
- Identify the principal in `aws.cloudtrail.user_identity.arn` and pivot to the raw CloudTrail events (for the same principal/time window) to identify the invoked function(s) in `aws.cloudtrail.request_parameters`.
- Determine whether a corresponding `AddPermission` cross-account grant exists for the function and whether it was expected (correlate with the cross-account resource-policy rule).
- Review `Esql.source_ips` and recent activity from the caller account for other cross-account actions.

### False positive analysis

- Cross-account invocation is common in multi-account architectures and partner integrations. Confirm the caller account is approved and exclude known trusted accounts or identities after validation.

### Response and remediation

- If the cross-account access is unauthorized, remove the function's cross-account resource-policy statement (`RemovePermission`) and review what the function accessed or returned.
- Constrain `lambda:InvokeFunction` grants to approved accounts and review the function's execution-role permissions.

### Additional information

- [Lambda resource-based policies](https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html)
- [Logging Lambda data events with CloudTrail](https://docs.aws.amazon.com/lambda/latest/dg/logging-using-cloudtrail.html)
"""
references = [
    "https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html",
    "https://docs.aws.amazon.com/lambda/latest/dg/logging-using-cloudtrail.html",
]
risk_score = 47
rule_id = "49002bbe-7aea-4146-91eb-b2b683bf5ed5"
setup = """## Setup

This rule requires AWS Lambda data events to be logged in CloudTrail and ingested via the AWS integration. Lambda
invocation (`Invoke`) is a data-plane event and is NOT logged by default; enable data event logging for Lambda functions
in the trail (optionally scoped to sensitive functions to manage volume).
"""
severity = "medium"
tags = [
    "Domain: Cloud",
    "Data Source: AWS",
    "Data Source: Amazon Web Services",
    "Data Source: AWS Lambda",
    "Use Case: Threat Detection",
    "Tactic: Execution",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "esql"

query = '''
from logs-aws.cloudtrail-*

| where
    event.provider == "lambda.amazonaws.com"
    and event.action like "Invoke*"
    and event.outcome == "success"
    and aws.cloudtrail.user_identity.arn IS NOT NULL
    and aws.cloudtrail.user_identity.invoked_by IS NULL
    and aws.cloudtrail.request_parameters IS NOT NULL

| grok aws.cloudtrail.user_identity.arn """:(?<Esql.caller_account>[0-9]{12}):"""
| grok aws.cloudtrail.request_parameters """functionName=arn:aws:lambda:[a-z0-9-]*:(?<Esql.function_account>[0-9]{12}):"""

| where Esql.caller_account IS NOT NULL and Esql.function_account IS NOT NULL and Esql.caller_account != Esql.function_account

| stats
    Esql.invocation_count = count(*),
    Esql.source_ips = values(source.ip),
    Esql.function_arns = values(aws.cloudtrail.resources.arn)
  by
    aws.cloudtrail.user_identity.arn,
    Esql.caller_account,
    Esql.function_account

| keep
    aws.cloudtrail.user_identity.arn,
    Esql.caller_account,
    Esql.function_account,
    Esql.function_arns,
    Esql.invocation_count,
    Esql.source_ips

'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1648"
name = "Serverless Execution"
reference = "https://attack.mitre.org/techniques/T1648/"


[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[rule.investigation_fields]
field_names = [
    "aws.cloudtrail.user_identity.arn",
    "Esql.caller_account",
    "Esql.function_account",
    "Esql.function_arns",
    "Esql.invocation_count",
    "Esql.source_ips",
]

[metadata]
creation_date = "2021/06/06"
integration = ["aws"]
maturity = "production"
updated_date = "2026/07/08"

[rule]
author = ["Elastic", "Austin Songer"]
description = """
Identifies the export of a DB snapshot or DB cluster data to Amazon S3. Snapshot exports can be used for analytics or
migration workflows, but adversaries may abuse them to exfiltrate sensitive data outside of RDS-managed storage.
Exporting a snapshot creates a portable copy of the database contents, which, if performed without authorization, can
indicate data theft, staging for exfiltration, or operator misconfiguration that exposes regulated information.
"""
false_positives = [
    """
    Snapshot exports may be performed by administrators, automation pipelines, or data engineering workflows. Confirm
    whether the export was expected and initiated by an authorized user, role, or automation process. Snapshot exports
    by unfamiliar principals or from unexpected networks should be investigated. If known behavior causes false
    positives, it can be exempted from the rule.
    """,
]
from = "now-6m"
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
language = "kuery"
license = "Elastic License v2"
name = "AWS RDS Snapshot Export"
note = """## Triage and analysis

### Investigating AWS RDS Snapshot Export

Exporting an RDS snapshot to Amazon S3 allows the full contents of a database to be written outside the managed
RDS service boundary. While legitimate for analytics or migration, this action can also be a mechanism for data
exfiltration. Because snapshot exports produce files that can be downloaded, shared, or accessed by other AWS principals,
unauthorized exports may indicate staging for data theft or attempts to bypass database access controls.

This rule detects successful `StartExportTask` events. Activity of this type should be validated to ensure that only
authorized database, platform engineering, or analytics workflows initiated the export.

#### Possible investigation steps

- **Identify the actor and context**
  - Review `aws.cloudtrail.user_identity.arn` and `aws.cloudtrail.user_identity.access_key_id` to determine which principal initiated the export.
  - Look at `source.ip`, `user.name`, and `user_agent.original` to understand where the export originated (console, CLI, SDK, automation).
  - Check whether the principal has historically performed snapshot exports.

- **Determine what was exported**
  - Examine `aws.cloudtrail.request_parameters`:
    - Snapshot identifier being exported.
    - S3 bucket name and path.
    - KMS key used (or absence of encryption).
  - Map the snapshot and destination bucket to:
    - Application/owner team.
    - Environment (prod/staging/dev).
    - Data classification (PII, PHI, PCI, internal).

- **Reconstruct timing and surrounding context**
  - Use `@timestamp` to correlate the export with:
    - Recent RDS modifications (`ModifyDBInstance`, `ModifyDBCluster`), snapshot deletions, or retention changes.
    - IAM role changes, access key issuance, or privilege escalation attempts.
    - Unusual authentication patterns (e.g., successful logins from new locations, failed console logins).
  - Check whether the export timing aligns with approved deployments or maintenance windows.

- **Correlate with broader CloudTrail activity**
  - Pivot on the same user, role, or access key ID to look for:
    - Prior reconnaissance (e.g., `DescribeDBSnapshots`, `DescribeDBClusters`, `ListBuckets`).
    - Permission changes (`PutRolePolicy`, `AttachUserPolicy`).
    - Public exposure (e.g., S3 bucket ACL changes).
  - Determine whether multiple snapshots were exported around the same time.

- **Validate intent with stakeholders**
  - Confirm with the database owner, analytics team, or platform engineering team whether:
    - The export was planned and authorized.
    - The target S3 bucket is approved for storing database contents.
    - Encryption and access controls meet organizational policy.

### False positive analysis

- **Authorized data analytics or ETL workflows**
  - Many organizations export snapshots for reporting, ML pipelines, or external data processing.
  - Validate that the export aligns with documented ETL or analytics processes.

- **Automated snapshot export tools**
  - Backup pipelines, cost optimization, or data replication systems may export snapshots.
  - Tune the rule by excluding known IAM roles or automation user agents.

- **CloudFormation or IaC triggers**
  - Infrastructure-as-code pipelines may trigger snapshot exports as part of stack updates.
  - Correlate with CloudFormation events to confirm legitimacy.

### Response and remediation

- **Contain potential exfiltration**
  - Review access to the destination S3 bucket and confirm that:
    - Bucket is encrypted with the expected KMS key.
    - Access is restricted to authorized principals.
    - No unusual downloads or cross-account accesses occurred.

- **Investigate scope and impact**
  - Use CloudTrail to enumerate:
    - All export tasks started by the same actor.
    - Other snapshot or data-access API calls in the same time window.
  - Validate whether sensitive or regulated data may have been included.

- **Credential and access remediation**
  - If activity appears unauthorized:
    - Revoke or rotate compromised IAM credentials.
    - Review STS session activity related to the actor.
    - Inspect IAM role policies for privilege escalation.

- **Hardening and preventive controls**
  - Restrict the ability to call `StartExportTask` using:
    - IAM least-privilege policies.
    - Service Control Policies (SCPs) in production accounts.
    - Conditional IAM (e.g., requiring MFA, restricting by VPC endpoint or IP range).
  - Enable guardrails:
    - AWS Config/Security Hub controls for monitoring snapshot policy changes.
    - Alerts for exports to buckets outside approved accounts.

### Additional information

- **[AWS IR Playbooks](https://github.com/aws-samples/aws-incident-response-playbooks/blob/c151b0dc091755fffd4d662a8f29e2f6794da52c/playbooks/)** 
- **[AWS Customer Playbook Framework](https://github.com/aws-samples/aws-customer-playbook-framework/tree/a8c7b313636b406a375952ac00b2d68e89a991f2/docs)** 
- **Security Best Practices:** [AWS Knowledge Center – Security Best Practices](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/).

"""
references = ["https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_StartExportTask.html"]
risk_score = 73
rule_id = "119c8877-8613-416d-a98a-96b6664ee73a"
severity = "high"
tags = [
    "Domain: Cloud",
    "Data Source: AWS",
    "Data Source: Amazon Web Services",
    "Use Case: Asset Visibility",
    "Tactic: Collection",
    "Tactic: Exfiltration",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset: aws.cloudtrail 
    and event.provider: rds.amazonaws.com 
    and event.action: StartExportTask 
    and event.outcome: success
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1567"
name = "Exfiltration Over Web Service"
reference = "https://attack.mitre.org/techniques/T1567/"

[[rule.threat.technique.subtechnique]]
id = "T1567.002"
name = "Exfiltration to Cloud Storage"
reference = "https://attack.mitre.org/techniques/T1567/002/"

[rule.threat.tactic]
id = "TA0010"
name = "Exfiltration"
reference = "https://attack.mitre.org/tactics/TA0010/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1213"
name = "Data from Information Repositories"
reference = "https://attack.mitre.org/techniques/T1213/"

[[rule.threat.technique.subtechnique]]
id = "T1213.006"
name = "Databases"
reference = "https://attack.mitre.org/techniques/T1213/006/"

[rule.threat.tactic]
id = "TA0009"
name = "Collection"
reference = "https://attack.mitre.org/tactics/TA0009/"
[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user_agent.original",
    "source.ip",
    "aws.cloudtrail.user_identity.arn",
    "aws.cloudtrail.user_identity.type",
    "aws.cloudtrail.user_identity.access_key_id",
    "event.action",
    "event.outcome",
    "cloud.account.id",
    "cloud.region",
    "aws.cloudtrail.request_parameters",
    "aws.cloudtrail.response_elements",
]

[metadata]
creation_date = "2024/07/12"
integration = ["aws"]
maturity = "production"
updated_date = "2026/08/05"

[rule]
author = ["Elastic"]
description = """
Identifies when object versioning is suspended for an Amazon S3 bucket. Object versioning allows for multiple versions of an object to exist in the same bucket. This allows for easy recovery of deleted or overwritten objects. When object versioning is suspended for a bucket, it could indicate an adversary's attempt to inhibit system recovery following malicious activity. Additionally, when versioning is suspended, buckets can then be deleted.
"""
event_category_override = "event.type"
false_positives = [
    """
    Administrators within an AWS Organization structure may legitimately suspend object versioning. Ensure that this behavior is not part of a legitimate operation before taking action.
    """,
]
from = "now-6m"
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
language = "eql"
license = "Elastic License v2"
name = "AWS S3 Object Versioning Suspended"
note = """## Triage and analysis

### Investigating AWS S3 Object Versioning Suspended

This rule detects when object versioning for an S3 bucket is suspended. S3 object versioning protects against data loss by maintaining prior versions of objects, allowing recovery if they are deleted or overwritten.  
Adversaries with access to a misconfigured or compromised S3 bucket may disable versioning to inhibit recovery efforts, conceal data destruction, or prepare for ransomware-like activity.  
This rule uses [EQL](https://www.elastic.co/guide/en/security/current/rules-ui-create.html#create-eql-rule) to detect use of the `PutBucketVersioning` API operation where the request parameters include `Status=Suspended`.

#### Possible investigation steps

- **Identify the Actor**  
  - Review `aws.cloudtrail.user_identity.arn` and `aws.cloudtrail.user_identity.access_key_id` to determine who performed the action.  
  - Verify whether this user or role has a legitimate operational reason to modify bucket versioning and whether such actions are common for this identity.

- **Analyze the Source and Context**  
  - Review `source.ip` and `user_agent.original` to assess the origin of the request.  
  - Check for unusual geographic locations, IP ranges, or clients that do not typically manage storage configurations.  

- **Evaluate the Affected Resource**  
  - Review `aws.cloudtrail.resources.arn` or `aws.cloudtrail.request_parameters` to identify which bucket’s versioning was modified.  
  - Determine whether this bucket contains critical or regulated data (logs, backups, audit evidence, etc.) that would be impacted by versioning suspension.

- **Correlate with Related Activity**  
  - Search for additional CloudTrail events performed by the same actor or IP address within the same timeframe, such as:  
    - `DeleteObject`, `DeleteObjects`, or `PutBucketLifecycle` events (potential data destruction).  
    - `PutBucketPolicy` or `PutBucketAcl` changes (permission manipulation).  
  - Review other detections related to S3 buckets or IAM changes to determine if this event is part of a larger sequence of destructive or unauthorized actions.

- **Validate Intent**  
  - Confirm whether this configuration change aligns with approved maintenance or automation activity (e.g., cost optimization, test environment reset).  
  - If no corresponding change request or justification exists, treat this as a potential defense evasion or impact event.

### False positive analysis

- **Legitimate Administrative Actions**  
  - Administrators or infrastructure automation tools may suspend versioning during migrations or lifecycle testing. Confirm through change management documentation.  
- **Automation and Pipelines**  
  - Verify whether Infrastructure-as-Code tools (e.g., Terraform, CloudFormation) or backup lifecycle scripts routinely modify versioning states.  
  - Exclude predictable automation identities where justified, while ensuring strong audit controls remain in place.

### Response and remediation

**Containment and Validation**  
- Re-enable versioning immediately for the affected bucket using the AWS Console or CLI (`aws s3api put-bucket-versioning --bucket my-bucket --versioning-configuration Status=Enabled`).  
- Verify the change with `get-bucket-versioning` to confirm the bucket is restored to “Enabled.”  
- Identify IAM users or roles with `s3:PutBucketVersioning` permissions and restrict access to trusted administrators only.  
- Preserve relevant CloudTrail, Config, and CloudWatch logs for the timeframe of the change to ensure integrity of investigation evidence.

**Investigation and Scoping**  
- Search CloudTrail for related actions by the same user or IP, including `DeleteObject`, `PutBucketLifecycle`, or `PutBucketPolicy`, to determine whether versioning suspension preceded object deletion or policy manipulation.  
- Review S3 access logs or Data Events for deleted, overwritten, or newly uploaded files after versioning suspension.  
- Validate if the change corresponds to an authorized change request or approved pipeline deployment.

**Recovery and Hardening**  
- If object loss or overwrites occurred, attempt recovery using cross-region replication, AWS Backup, or previous snapshot copies.  
- Enable S3 Object Lock and MFA Delete on critical buckets to prevent future tampering.  
- Configure the AWS Config rule `s3-bucket-versioning-enabled` to continuously monitor for versioning suspension and trigger automated alerts.  
- Review IAM and service control policies to ensure the principle of least privilege is enforced for all S3 management actions.  
- Document findings and update incident response procedures to include versioning protection as part of ransomware and data destruction prevention strategies.


### Additional information
- AWS Documentation: [Using Versioning in S3](https://docs.aws.amazon.com/AmazonS3/latest/userguide/Versioning.html)  
- API Reference: [PutBucketVersioning](https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketVersioning.html)  
- [AWS IR Playbooks](https://github.com/aws-samples/aws-incident-response-playbooks/blob/c151b0dc091755fffd4d662a8f29e2f6794da52c/playbooks/)
- [AWS Customer Playbook Framework](https://github.com/aws-samples/aws-customer-playbook-framework/tree/a8c7b313636b406a375952ac00b2d68e89a991f2/docs)
"""
references = [
    "https://docs.aws.amazon.com/AmazonS3/latest/userguide/Versioning.html/",
    "https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketVersioning.html/",
    "https://cloud.hacktricks.xyz/pentesting-cloud/aws-security/aws-post-exploitation/aws-s3-post-exploitation/",
    "https://www.invictus-ir.com/news/ransomware-in-the-cloud/",
    "https://rhinosecuritylabs.com/aws/s3-ransomware-part-2-prevention-and-defense/",
]
risk_score = 47
rule_id = "30b5bb96-c7db-492c-80e9-1eab00db580b"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Platform: AWS",
    "Data Source: AWS CloudTrail",
    "Service: AWS S3",
    "Tactic: Impact",
    "Rule Type: Event Correlation (EQL)",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
info where data_stream.dataset == "aws.cloudtrail"
   and event.provider == "s3.amazonaws.com"
   and event.action == "PutBucketVersioning"
   and event.outcome == "success"
   and stringContains(aws.cloudtrail.request_parameters, "Status=Suspended")
   and not user_agent.original like~ ("*Terraform*", "*Pulumi*")
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1490"
name = "Inhibit System Recovery"
reference = "https://attack.mitre.org/techniques/T1490/"


[rule.threat.tactic]
id = "TA0040"
name = "Impact"
reference = "https://attack.mitre.org/tactics/TA0040/"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user_agent.original",
    "source.ip",
    "aws.cloudtrail.user_identity.arn",
    "aws.cloudtrail.user_identity.type",
    "aws.cloudtrail.user_identity.access_key_id",
    "aws.cloudtrail.resources.arn", 
    "aws.cloudtrail.resources.type", 
    "event.action",
    "event.outcome",
    "cloud.account.id",
    "cloud.region",
    "aws.cloudtrail.request_parameters"
]

[metadata]
creation_date = "2025/10/02"
integration = ["azure"]
maturity = "production"
updated_date = "2026/04/10"

[rule]
author = ["Elastic"]
description = """
Identifies successful GetBlob operations on Azure Storage Accounts using AzCopy user agent with SAS token
authentication. AzCopy is a command-line utility for copying data to and from Azure Storage. While legitimate for data
migration, adversaries may abuse AzCopy with compromised SAS tokens to exfiltrate data from Azure Storage Accounts. This
rule detects the first occurrence of GetBlob operations from a specific storage account using this pattern.
"""
false_positives = [
    "Legitimate data migration or backup operations using AzCopy with SAS tokens may trigger this rule.",
    "Automated scripts or processes that use AzCopy for routine data transfers from Azure Storage Accounts.",
    "DevOps or IT teams performing authorized data transfers or downloads from Azure Storage using AzCopy.",
]
from = "now-9m"
index = ["logs-azure.platformlogs-*"]
language = "kuery"
license = "Elastic License v2"
name = "Azure Storage Blob Retrieval via AzCopy"
note = """## Triage and analysis

### Investigating Azure Storage Blob Retrieval via AzCopy

Azure Storage Accounts provide cloud storage services for blobs, files, queues, and tables. Shared Access Signatures (SAS) tokens provide delegated access to resources in a storage account with specific permissions and time constraints. AzCopy is a Microsoft command-line utility designed for efficient data transfers to and from Azure Storage. While AzCopy is a legitimate tool, adversaries may abuse it with compromised SAS tokens to exfiltrate data from Azure Storage Accounts.

### Possible investigation steps
- Review the `azure.platformlogs.properties.accountName` field to identify which storage account is being accessed and assess the sensitivity of data stored in that account.
- Examine the `azure.platformlogs.properties.objectKey` field to identify the specific blob(s) being retrieved. Determine if the accessed files contain sensitive or confidential data.
- Check the `source.address` field to identify the source IP address of the request. Investigate if this IP is unusual, unexpected, or originates from an unexpected network or geographic location.
- Review the `azure.platformlogs.uri` field to examine the SAS token parameters, including:
  - `se` (expiry time): Check when the SAS token expires
  - `sp` (permissions): Verify what permissions were granted (e.g., "rl" for read and list)
  - `sv` (API version): Note the storage service version being used
- Examine the `azure.platformlogs.identity.tokenHash` field to identify the specific SAS token signature being used. Correlate this with SAS token generation logs to determine when and how the token was created.
- Check the `azure.platformlogs.properties.responseBodySize` field to assess the volume of data being downloaded. Multiple GetBlob operations with large response sizes may indicate bulk data exfiltration.
- Search for related GetBlob operations from the same `source.address` or with the same `azure.platformlogs.identity.tokenHash` to identify patterns of systematic data retrieval.
- Review Azure Activity Logs for recent SAS token generation events or storage account key access operations that may indicate how the adversary obtained the credentials.
- Correlate this activity with ListBlobs or ListContainers operations from the same source, as adversaries often enumerate storage contents before exfiltration.
- Investigate the `azure.resource.group` field to understand which resource group the storage account belongs to and check for any recent security events or configuration changes in that resource group.

### False positive analysis
- Routine data migration or backup operations using AzCopy with SAS tokens are common in enterprise environments. If this is expected behavior for the storage account, consider adding exceptions for specific accounts or IP ranges.
- DevOps pipelines or automated workflows may use AzCopy with SAS tokens for legitimate data transfers. Review the automation configuration and add exceptions if appropriate.
- Third-party services or partners may have authorized access to storage accounts using AzCopy and SAS tokens. Verify these relationships and create exceptions for known authorized sources.

### Response and remediation
- If unauthorized access is confirmed, immediately revoke the compromised SAS token to prevent further data exfiltration.
- Review and rotate any additional SAS tokens that may have been compromised through the same attack vector.
- Assess the scope of data accessed or exfiltrated during the unauthorized GetBlob operations and determine if sensitive data was compromised.
- Implement additional monitoring and alerting for the affected storage account to detect any further suspicious activity.
- Review and strengthen SAS token generation policies, including implementing shorter expiration times and more restrictive permissions.
- Consider implementing Azure Storage firewall rules or private endpoints to restrict access to storage accounts from trusted networks only.
- Investigate how the SAS token was compromised and remediate the initial access vector to prevent future incidents.
- Document the incident and update security procedures to prevent similar compromises in the future.
"""
references = [
    "https://www.microsoft.com/en-us/security/blog/2025/08/27/storm-0501s-evolving-techniques-lead-to-cloud-based-ransomware/",
    "https://learn.microsoft.com/en-us/azure/storage/common/storage-use-azcopy-v10",
    "https://learn.microsoft.com/en-us/azure/storage/common/storage-sas-overview",
]
risk_score = 47
rule_id = "a8b3c4d5-e6f7-8901-a2b3-c4d5e6f78901"
setup = """#### Required Azure Storage Diagnostic Logs

To ensure this rule functions correctly, the following diagnostic logs must be enabled for Azure Storage Accounts:
- StorageRead: This log captures all read operations performed on blobs in the storage account, including GetBlob operations. These logs should be streamed to the Event Hub used for the Azure integration configuration.
"""
severity = "medium"
tags = [
    "Domain: Cloud",
    "Domain: Storage",
    "Data Source: Azure",
    "Data Source: Azure Platform Logs",
    "Data Source: Azure Storage",
    "Use Case: Threat Detection",
    "Tactic: Exfiltration",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "new_terms"

query = '''
data_stream.dataset: azure.platformlogs and
    event.action: GetBlob and
    azure.platformlogs.identity.type: SAS and
    azure.platformlogs.properties.userAgentHeader: AzCopy* and
    azure.platformlogs.statusCode: 200
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1567"
name = "Exfiltration Over Web Service"
reference = "https://attack.mitre.org/techniques/T1567/"

[[rule.threat.technique.subtechnique]]
id = "T1567.002"
name = "Exfiltration to Cloud Storage"
reference = "https://attack.mitre.org/techniques/T1567/002/"

[rule.threat.tactic]
id = "TA0010"
name = "Exfiltration"
reference = "https://attack.mitre.org/tactics/TA0010/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1530"
name = "Data from Cloud Storage"
reference = "https://attack.mitre.org/techniques/T1530/"

[rule.threat.tactic]
id = "TA0009"
name = "Collection"
reference = "https://attack.mitre.org/tactics/TA0009/"
[rule.new_terms]
field = "new_terms_fields"
value = ["azure.platformlogs.properties.accountName"]
[[rule.new_terms.history_window_start]]
field = "history_window_start"
value = "now-7d"

[rule]
description = """
Identifies the execution of a binary Linux shared memory directories: (/dev/shm/, /run/shm/). This activity is to be
considered highly abnormal and should be investigated. Threat actors have placed executables used for persistence on
high-uptime servers in these directories as system backdoors. Binaries executed from these directories are memory
resident making them harder to detect and allowing them to remain hidden for long periods of time.
"""
id = "78ae5dbd-477b-4ce7-a7f7-8c4b5e228df2"
license = "Elastic License v2"
name = "Binary Executed from Shared Memory Directory"
os_list = ["linux"]
reference = ["https://intezer.com/blog/incident-response/orbit-new-undetected-linux-threat/"]
version = "1.0.12"

query = '''
process where event.type == "start" and event.action == "exec" and process.executable like ("/dev/shm/*", "/run/shm/*") and
not (
   (process.executable like "/dev/shm/gitlab/*" and process.pid == 0) or
   (process.executable like "/dev/shm/ansible-tmp*")
 )
'''

min_endpoint_version = "8.3.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
tree = true

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1620"
name = "Reflective Code Loading"
reference = "https://attack.mitre.org/techniques/T1620/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.3.0"

[rule]
description = """
Identifies an unelevated attempt to create a BLF file by an unusual process. This may indicate an attempt to exploit a
CLFS vulnerability for privilege escalation.
"""
id = "734e9e5c-865e-46e0-a4c1-c8fc56910bf2"
license = "Elastic License v2"
name = "BLF File Creation by an Unusual Process"
os_list = ["windows"]
reference = [
    "https://securelist.com/windows-clfs-exploits-ransomware/111560/",
    "https://www.elastic.co/security-labs/itw-windows-lpe-0days-insights-and-detection-strategies",
    "https://ti.qianxin.com/blog/articles/cve-2025-29824-0-day-vulnerability-exploitation-sample-research-en/",
]
version = "1.0.3"

query = '''
file where event.action == "creation" and user.id != "S-1-5-18" and user.id != null and process.pid != 4 and
 file.extension : "blf" and file.Ext.header_bytes == "1500010002000200000000004b824cc6" and file.path : "C:\\*.blf" and
 (process.code_signature.exists == false or process.code_signature.trusted == false) and not process.code_signature.status like "errorCode_endpoint*" and
 not file.path : ("C:\\Windows\\System32\\*.blf",
                  "C:\\Windows\\SysWOW64\\*.blf",
                  "C:\\Windows\\appcompat\\*.blf",
                  "C:\\Windows\\ServiceProfiles\\*.blf",
                  "C:\\Users\\*\\AppData\\Local\\Temp\\*\\UsrClass.dat*.blf",
                  "C:\\Users\\*\\NTUSER.DAT{*}.TM.blf",
                  "C:\\System Volume Information\\*.blf",
                  "C:\\$WINDOWS.~BT\\NewOS\\Windows\\*.blf",
                  "C:\\Users\\*\\AppData\\Local\\Temp\\Ruf*.tmp\\SYSTEM{*}.TM.blf",
                  "C:\\Users\\*\\SetupRST_RecoveryImage\\Windows\\System32\\config\\*.TM.blf") and
 not process.executable : ("C:\\Windows\\System32\\SystemSettingsAdminFlows.exe",
                           "C:\\Windows\\explorer.exe",
                           "C:\\Program Files\\*.exe",
                           "C:\\Program Files (x86)\\*.exe",
                           "C:\\Windows\\System32\\pnputil.exe",
                           "C:\\$WINDOWS.~BT\\*.exe")
'''

min_endpoint_version = "8.7.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1068"
name = "Exploitation for Privilege Escalation"
reference = "https://attack.mitre.org/techniques/T1068/"


[threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[internal]
min_endpoint_version = "8.7.0"

[metadata]
creation_date = "2026/04/22"
integration = ["auditd_manager"]
maturity = "production"
updated_date = "2026/05/11"

[rule]
author = ["Elastic"]
description = """
Detects execution of curl or wget from processes whose title aligns with **`runc init`**, a common fingerprint 
for workloads running inside **OCI/runc-backed containers** on Linux hosts instrumented with Auditd Manager. 
After breaking out of an application container or abusing a privileged workload, attackers often pull ingress tooling
(stagers, scripts, implants) or stage exfiltration with minimal HTTP clients. Those utilities are also used
benignly in images, so context matters; the `runc init` anchor narrows the signal to the container runtime boundary
where unexpected download clients are more worthy of review than the same binaries on a bare-metal admin shell.
"""
false_positives = [
    """
    Base images, entrypoints, or init wrappers may legitimately invoke curl or wget during container startup (package
    installs, health checks); baseline trusted images and exclude stable image digests or namespaces when noisy.
    """,
    """
    Developer-oriented containers and CI build pods can run curl/wget from PID 1 descendants under runc; correlate with
    build pipelines and approved registries.
    """,
]
from = "now-9m"
index = ["auditbeat-*", "logs-auditd_manager.auditd-*"]
language = "kuery"
license = "Elastic License v2"
name = "Curl or Wget Execution from Container Context"
note = """## Triage and analysis

### Investigating Curl or Wget Execution from Container Context

The rule matches Auditd-backed process events where `process.title` is `runc init` and the executed program is
curl/wget (by `process.name`) or the argument vector suggests curl or wget paths. Use it to spot ingress tool 
transfer or scripted downloads from inside a container as seen at the host audit layer.

### Possible investigation steps

- Reconstruct the full command line from `process.args` / `process.command_line` and identify URLs, output paths, and
  flags such as `-O`, `--post-file`, or TLS bypass (`-k`).
- Map the event to the container: cgroup, `container.id`, `kubernetes.pod.*`, or runtime metadata if present on the
  document; identify the image, namespace, and workload owner.
- Review egress from the host or pod network policy logs for destinations contacted shortly after the execution.
- Compare against recent image or manifest changes for the workload to rule out intentional startup scripts.

### False positive analysis

- Package managers and bootstrap scripts in official images may run curl/wget once at start; document and exclude when
  verified.
- Security scanners or health checks running in sidecars could match; validate agent type and schedule.

### Response and remediation

- If unauthorized, isolate the node or workload, revoke credentials available to the container, inspect for dropped
  binaries or cron/systemd additions, and rotate any secrets the container could reach.
"""
references = [
    "https://attack.mitre.org/techniques/T1105/",
    "https://gtfobins.github.io/gtfobins/curl/",
    "https://gtfobins.github.io/gtfobins/wget/",
]
risk_score = 47
rule_id = "e7b2c3d4-5a6b-4e8f-9c0d-1a2b3e4f5a6b"
setup = """## Setup

This rule requires data from **Auditd Manager** (or legacy Auditbeat shipping comparable ECS fields).

### Auditd Manager Integration Setup
The Auditd Manager integration receives audit events from the Linux Audit Framework. With `auditd_manager`,
administrators can define audit rules, track system events, and generate reports.

#### Steps to deploy Auditd Manager
- In Kibana, open **Add integrations**, search for **Auditd Manager**, and add it to an agent policy deployed on Linux
  hosts that should emit syscall audit data.
- For integration details, see the [Auditd Manager documentation](https://docs.elastic.co/integrations/auditd_manager).

#### Rule-specific notes
- Ensure syscall coverage includes **execve** (or equivalent) for processes inside containers so `curl`, `wget`, and
  argument lists are captured on the host.
- Confirm that **`process.title`** (or the mapped proctitle field) reflects **`runc init`** for your runtime; other
  runtimes may use different titles—tune the predicate if you standardize on `crun`, `containerd-shim`, etc.
"""
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: Linux",
    "Use Case: Threat Detection",
    "Tactic: Command and Control",
    "Tactic: Execution",
    "Domain: Containers",
    "Data Source: Auditd Manager",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"
query = '''
host.os.type:linux and 
data_stream.dataset:"auditd_manager.auditd" and
event.action:("executed" or "exec") and
process.title:"runc init" and
(
  process.name:(curl or wget) or
  process.args:(* curl* or */bin/curl* or *wget*)
) and 
not process.args :(*127.0.0.1* or *localhost* or "wget --no-verbose --tries=1 --spider --no-check-certificate http://${WEB_HOST}:${WEB_PORT}/api/ping || exit 1")
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1105"
name = "Ingress Tool Transfer"
reference = "https://attack.mitre.org/techniques/T1105/"

[rule.threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[rule]
description = """
Identifies the execution of the env or printenv commands followed by a grep command to collect environment variable
secrets. This is a common technique used by attackers to collect sensitive information from the environment.
"""
id = "4fab1a5b-18c4-4f7b-91dd-7ac8a08e5762"
license = "Elastic License v2"
name = "Environment Variable Secret Collection"
os_list = ["linux", "macos"]
reference = [
    "https://futuresearch.ai/blog/litellm-pypi-supply-chain-attack/",
    "https://www.virustotal.com/gui/file/71e35aef03099cd1f2d6446734273025a163597de93912df321ef118bf135238",
]
version = "1.0.4"

query = '''
process where event.type == "start" and event.action == "exec" and process.name in ("env", "printenv") and
process.parent.command_line like ("* env*|*grep*", "* printenv*|*grep*") and
process.parent.command_line like~ (
  "*azure*", "*kube*", "*k8s", "*aws*", "*database*", "*db_*", "*mysql*", "*postgres*", "*mongo*", "*redis*",
  "*vault*", "*password*", "*passwd*", "*pwd*", "*secret*", "*token*", "*apikey*", "*api.key*", "*access_key*",
  "*private_key*", "*client_secret*", "*credential*", "*auth*", "*gcp*", "*google*", "*kubernetes*", "*service_account*"
) and
not (
  /* Exclude unrelated Gen-AI command lines */
  length(process.parent.command_line) >= 100 or
  process.parent.args in ("env|grep -i \"^shell=\"", "env | grep ^PATH=", "env|grep -i '^shell='") or
  process.args == "/usr/local/bin/pm2"
)
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1074"
name = "Data Staged"
reference = "https://attack.mitre.org/techniques/T1074/"
[[threat.technique.subtechnique]]
id = "T1074.001"
name = "Local Data Staging"
reference = "https://attack.mitre.org/techniques/T1074/001/"


[[threat.technique]]
id = "T1119"
name = "Automated Collection"
reference = "https://attack.mitre.org/techniques/T1119/"


[threat.tactic]
id = "TA0009"
name = "Collection"
reference = "https://attack.mitre.org/tactics/TA0009/"

[internal]
min_endpoint_version = "7.15.0"

[metadata]
creation_date = "2026/02/27"
integration = ["o365"]
maturity = "production"
updated_date = "2026/05/15"

[rule]
author = ["Elastic", "Austin Songer"]
description = """
Identifies when a SharePoint or OneDrive site sharing policy is changed to weaken security controls. The
SharingPolicyChanged event fires for many routine policy modifications, but this rule targets specific high-risk
transitions where sharing restrictions are relaxed. This includes enabling guest sharing, enabling anonymous link
sharing, making a site public, or enabling guest user access. Adversaries who compromise administrative accounts may
weaken sharing policies to exfiltrate data to external accounts or create persistent external access paths.
"""
false_positives = [
    "Administrators legitimately enabling external sharing for a new collaboration site or project.",
    "Organizational policy changes that intentionally broaden sharing capabilities across sites.",
    "Migration or onboarding projects that temporarily require external sharing to be enabled.",
]
from = "now-9m"
index = ["filebeat-*", "logs-o365.audit-*"]
language = "kuery"
license = "Elastic License v2"
name = "M365 SharePoint Site Sharing Policy Weakened"
note = """## Triage and Analysis

### Investigating M365 SharePoint Site Sharing Policy Weakened

This rule detects when SharePoint or OneDrive sharing policies are modified to weaken security controls. The `SharingPolicyChanged` event captures modifications to site-level sharing settings stored in `ModifiedProperties`, where the setting name is a dynamic field key and `OldValue`/`NewValue` track the transition. This rule targets specific transitions that represent a security posture degradation. Note that Microsoft uses inconsistent keyword value formats across settings, some use `True`/`False` while others use `Enabled`/`Disabled`.

#### Possible Investigation Steps

- Identify the user who performed the change via `user.id` and determine if they have a legitimate administrative role.
- Check if the acting user is a service principal (e.g., `ServiceOperator`, `app@sharepoint`) or a human account. Service principal changes may indicate automated processes or compromised application credentials.
- Review which specific setting was changed by examining the `o365.audit.ModifiedProperties.*` fields:
    - ShareWithGuests: Guest/external sharing was enabled on the site. External users can now be invited to access content.
    - ShareUsingAnonymousLinks: Anonymous "Anyone" link sharing was enabled. Content can now be shared via unauthenticated links.
    - IsPublic: The site or group was changed from private to public visibility.
    - AllowGuestUser: Guest user access was enabled for the site.
    - AllowFederatedUsers: Federated (external organization) user access was enabled.
    - AllowTeamsConsumer: Teams personal account (consumer) user access was enabled.
- Identify the affected site via `o365.audit.ObjectId` (the site URL) and assess the sensitivity of its content.
- Review Azure AD / Entra ID sign-in logs for the acting account to check for authentication anomalies (unusual location, device code flow, new device).
- Look for subsequent sharing activity on the same site — `SharingSet`, `AnonymousLinkCreated`, `SharingInvitationCreated`, or file download events shortly after the policy change.
- Determine if the change was part of a planned change request or occurred outside of normal change windows.

### False Positive Analysis

- IT administrators enabling external sharing for legitimate collaboration needs. Correlate with change management tickets or Slack/Teams messages.
- Automated provisioning scripts that configure sharing settings during site creation. These typically use service principal accounts with predictable patterns.
- Microsoft service operations (`ServiceOperator`) may modify settings as part of tenant-level policy propagation.

### Response and Remediation

- If the change is unauthorized, immediately revert the sharing policy to its previous restrictive state.
- Revoke sessions and reset credentials for the compromised account.
- Review what content was accessed or shared after the policy change using `FileAccessed`, `FileDownloaded`, and sharing audit events.
- Audit all sites for similar unauthorized sharing policy changes.
- Implement Conditional Access policies to restrict administrative actions to trusted networks and compliant devices.
- Enable Privileged Identity Management (PIM) for SharePoint administrator roles to enforce just-in-time access.
"""
references = [
    "https://learn.microsoft.com/en-us/purview/audit-log-activities#site-administration-activities",
    "https://learn.microsoft.com/en-us/purview/audit-log-sharing",
    "https://learn.microsoft.com/en-us/sharepoint/turn-external-sharing-on-or-off",
]
risk_score = 47
rule_id = "632906c6-ba8f-44c0-8386-ec0bbc8518bf"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Domain: SaaS",
    "Data Source: Microsoft 365",
    "Data Source: Microsoft 365 Audit Logs",
    "Use Case: Threat Detection",
    "Tactic: Defense Evasion",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset: "o365.audit" and event.provider: ("SharePoint" or "OneDrive") and
    event.action: "SharingPolicyChanged" and event.outcome: "success" and
    (
        (o365.audit.ModifiedProperties.ShareWithGuests.NewValue: (true or "Enabled") and
            o365.audit.ModifiedProperties.ShareWithGuests.OldValue: (false or "Disabled"))
        or
        (o365.audit.ModifiedProperties.ShareUsingAnonymousLinks.NewValue: (true or "Enabled") and
            o365.audit.ModifiedProperties.ShareUsingAnonymousLinks.OldValue: (false or "Disabled"))
        or
        (o365.audit.ModifiedProperties.IsPublic.NewValue: (true or "Enabled") and
            o365.audit.ModifiedProperties.IsPublic.OldValue: (false or "Disabled"))
        or
        (o365.audit.ModifiedProperties.AllowGuestUser.NewValue: (true or "Enabled") and
            o365.audit.ModifiedProperties.AllowGuestUser.OldValue: (false or "Disabled"))
        or
        (o365.audit.ModifiedProperties.AllowFederatedUsers.NewValue: (true or "Enabled") and
            o365.audit.ModifiedProperties.AllowFederatedUsers.OldValue: (false or "Disabled"))
        or
        (o365.audit.ModifiedProperties.AllowTeamsConsumer.NewValue: (true or "Enabled") and
            o365.audit.ModifiedProperties.AllowTeamsConsumer.OldValue: (false or "Disabled"))
    )
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1484"
name = "Domain or Tenant Policy Modification"
reference = "https://attack.mitre.org/techniques/T1484/"

[[rule.threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"

[[rule.threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "host.id",
    "host.name",
    "user.id",
    "user.name",
    "user.domain",
    "source.ip",
    "source.as.number",
    "o365.audit.AppAccessContext.AADSessionId",
    "o365.audit.AppAccessContext.ClientAppName",
    "o365.audit.AppAccessContext.UniqueTokenId",
    "o365.audit.EventSource",
    "user_agent.original",
    "o365.audit.Site",
    "o365.audit.ObjectId"
]

[metadata]
creation_date = "2026/03/23"
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender", "system", "crowdstrike"]
maturity = "production"
updated_date = "2026/06/24"

[rule]
author = ["Elastic"]
description = """
Identifies a Windows host where two or more distinct remote monitoring and management (RMM) or remote-access tool
vendors are observed starting processes within the same eight-minute window. Legitimate MSP environments may run
multiple tools, but this pattern can also indicate compromise, shadow IT, or attacker staging of redundant access.
Processes are mapped to a single vendor label so multiple binaries from the same vendor do not inflate the count.
"""
from = "now-9m"
interval = "8m"
language = "esql"
license = "Elastic License v2"
name = "Multiple Remote Management Tool Vendors on Same Host"
note = """## Triage and analysis

### Investigating Multiple Remote Management Tool Vendors on Same Host

This rule aggregates process start events by `host.id` and host name within the rule's nine-minute lookback window. Data can come from Elastic Defend, Sysmon, Winlogbeat, Windows Security / forwarded events, Microsoft Defender XDR, SentinelOne, or CrowdStrike FDR—where ECS process fields are populated. Each known RMM-related process name maps to one **vendor** label (e.g. TeamViewer, AnyDesk, ScreenConnect). If **two or more different vendor labels** appear within the same lookback window, the rule signals.

### Possible investigation steps

- Open **Esql.vendors_seen** and **Esql.processes_executable_values** on the alert to see which tools fired in the window.
- Confirm whether the host is an MSP-managed jump box, helpdesk workstation, or lab where multiple RMM stacks are expected.
- For servers or standard user endpoints, treat as higher risk: review install source, code signatures, and recent logons.
- Correlate with other alerts (ingress tool transfer, suspicious scripting, new persistence) on the same `host.id`.
- Check asset inventory and change tickets for approved RMM software.

### False positive analysis

- **MSP / IT tooling**: A technician machine with two approved agents (e.g. RMM + remote support) may match. Tune with host or organizational unit exceptions, or raise the vendor threshold if your environment standardizes on a known pair.
- **Vendor rebrands or bundles**: Rare overlaps during migrations can briefly show two vendors; validate timeline and packages.

### Response and remediation

- If unauthorized or unexplained: isolate the host, inventory installed remote-access software, remove unapproved tools, and reset credentials that may have been exposed. Enforce a single approved RMM stack per asset class where possible.
"""

setup = """## Setup

This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.

Setup instructions: https://ela.st/install-elastic-defend

### Additional data sources

This rule also supports the following third-party data sources. For setup instructions, refer to the links below:

- [CrowdStrike](https://ela.st/crowdstrike-integration)
- [Microsoft Defender XDR](https://ela.st/m365-defender)
- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
- [Sysmon Event ID 1 - Process Creation](https://ela.st/sysmon-event-1-setup)
- [Windows Process Creation Logs](https://ela.st/audit-process-creation)
"""

references = [
    "https://attack.mitre.org/techniques/T1219/",
    "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-025a",
    "https://lolrmm.io/",
]
risk_score = 47
rule_id = "c3f8a1d2-4b5e-4c6f-9a8b-1e2d3f4a5b6c"
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Command and Control",
    "Resources: Investigation Guide",
    "Data Source: Elastic Defend",
    "Data Source: Sysmon",
    "Data Source: SentinelOne",
    "Data Source: Microsoft Defender XDR",
    "Data Source: Crowdstrike",
    "Data Source: Windows Security Event Logs",
    "Data Source: Winlogbeat",
]
timestamp_override = "event.ingested"
type = "esql"

query = '''
from logs-endpoint.events.process-*, logs-crowdstrike.fdr*, logs-m365_defender.event-*, logs-sentinel_one_cloud_funnel.*, logs-system.security*, logs-windows.sysmon_operational-*, logs-windows.forwarded*, winlogbeat-* metadata _id, _version, _index
| where (host.os.type == "windows" or host.os.family == "windows")
    and event.category == "process"
    and event.type == "start"
    and process.name is not null
| eval Esql.rmm_vendor = case(
    process.name.caseless like "aa_v*.exe", "AnyAssist",
    process.name.caseless == "acroniscyberprotectconnectagent.exe", "Acronis",
    process.name.caseless == "aeroadmin.exe", "AeroAdmin",
    process.name.caseless == "agentmon.exe", "ConnectWiseAutomate",
    process.name.caseless == "anydesk.exe", "AnyDesk",
    process.name.caseless == "apc_admin.exe", "APC",
    process.name.caseless == "apc_host.exe", "APC",
    process.name.caseless == "ateraagent.exe", "Atera",
    process.name.caseless like "aweray_remote*.exe", "AweSun",
    process.name.caseless == "awesun.exe", "AweSun",
    process.name.caseless == "b4-service.exe", "BeyondTrust",
    process.name.caseless == "basupsrvc.exe", "BeyondTrust",
    process.name.caseless == "bomgar-scc.exe", "BeyondTrust",
    process.name.caseless == "remote support.exe", "BeyondTrust",
    process.name.caseless == "cagservice.exe", "BarracudaRMM",
    process.name.caseless == "cloudracmd.exe", "CloudRadial",
    process.name.caseless == "cloudrasd.exe", "CloudRadial",
    process.name.caseless == "cloudraservice.exe", "CloudRadial",
    process.name.caseless like "connectwisecontrol*.exe", "ScreenConnect",
    process.name.caseless == "domotzagent.exe", "Domotz",
    process.name.caseless == "domotz-windows-x64-10.exe", "Domotz",
    process.name.caseless == "dwagsvc.exe", "DWService",
    process.name.caseless == "dwrcc.exe", "DWService",
    process.name.caseless == "dwrcs.exe", "DWService",
    process.name.caseless == "dwrcst.exe", "DWService",
    process.name.caseless like "fleetdeck_commander*.exe", "FleetDeck",
    process.name.caseless == "g2aservice.exe", "GoTo",
    process.name.caseless == "getscreen.exe", "GetScreen",
    process.name.caseless == "gotoassistservice.exe", "GoTo",
    process.name.caseless == "gotohttp.exe", "GoTo",
    process.name.caseless == "gotoresolveprocesschecker.exe", "GoTo",
    process.name.caseless == "gotoresolveremotecontrol.exe", "GoTo",
    process.name.caseless == "gotoresolveservice.exe", "GoTo",
    process.name.caseless == "gotoresolveterminal.exe", "GoTo",
    process.name.caseless == "gotoresolveunattended.exe", "GoTo",
    process.name.caseless == "helpwire.exe", "HelpWire",
    process.name.caseless == "immyagent.exe", "ImmyBot",
    process.name.caseless == "immybot.agent.ephemeral.exe", "ImmyBot",
    process.name.caseless == "immyupdater.exe", "ImmyBot",
    process.name.caseless == "imperoclientsvc.exe", "Impero",
    process.name.caseless == "imperoserversvc.exe", "Impero",
    process.name.caseless == "isllight.exe", "ISLOnline",
    process.name.caseless == "isllightclient.exe", "ISLOnline",
    process.name.caseless == "jumpcloud-agent.exe", "JumpCloud",
    process.name.caseless == "komari.exe", "Komari",
    process.name.caseless == "komari-agent.exe", "Komari",
    process.name.caseless == "level.exe", "Level",
    process.name.caseless == "lmi_rescue.exe", "LogMeIn",
    process.name.caseless == "lmi_rescue_srv.exe", "LogMeIn",
    process.name.caseless == "lmiignition.exe", "LogMeIn",
    process.name.caseless == "logmein.exe", "LogMeIn",
    process.name.caseless == "ltsvc.exe", "ConnectWiseAutomate",
    process.name.caseless == "ltsvcmon.exe", "ConnectWiseAutomate",
    process.name.caseless == "lttray.exe", "ConnectWiseAutomate",
    process.name.caseless == "lunixar.exe", "Lunixar",
    process.name.caseless == "lunixarremote.exe", "Lunixar",
    process.name.caseless == "lunixarupdater.exe", "Lunixar",
    process.name.caseless == "lvagent.exe", "Level",
    process.name.caseless == "manageengine_remote_access_plus.exe", "ManageEngine",
    process.name.caseless == "meshagent.exe", "MeshCentral",
    process.name.caseless == "mikogo-service.exe", "Mikogo",
    process.name.caseless == "nezha-agent.exe", "Nezha",
    process.name.caseless == "ninjarmmagent.exe", "NinjaOne",
    process.name.caseless == "ninjarmmagentpatcher.exe", "NinjaOne",
    process.name.caseless == "ninjarmm-cli.exe", "NinjaOne",
    process.name.caseless == "parsec.exe", "Parsec",
    process.name.caseless == "pservice.exe", "Pulseway",
    process.name.caseless == "quickassist.exe", "QuickAssist",
    process.name.caseless == "r_server.exe", "Radmin",
    process.name.caseless == "radmin.exe", "Radmin",
    process.name.caseless == "radmin3.exe", "Radmin",
    process.name.caseless == "rcengmgru.exe", "Rsupport",
    process.name.caseless == "rcclient.exe", "RPCSuite",
    process.name.caseless == "rcmgrsvc.exe", "Rsupport",
    process.name.caseless == "rcservice.exe", "RPCSuite",
    process.name.caseless == "remotedesktopmanager.exe", "Devolutions",
    process.name.caseless == "remotely_agent.exe", "Remotely",
    process.name.caseless == "remotely_desktop.exe", "Remotely",
    process.name.caseless == "remotepc.exe", "RemotePC",
    process.name.caseless == "remotepcdesktop.exe", "RemotePC",
    process.name.caseless == "remotepcservice.exe", "RemotePC",
    process.name.caseless == "remoteview.exe", "Rsupport",
    process.name.caseless == "rfusclient.exe", "RemoteUtilities",
    process.name.caseless == "rmm.agent.exe", "SuperOps",
    process.name.caseless == "romserver.exe", "RealVNC",
    process.name.caseless == "romviewer.exe", "RealVNC",
    process.name.caseless == "rpcsuite.exe", "RPCSuite",
    process.name.caseless == "rserver3.exe", "Radmin",
    process.name.caseless == "rustdesk.exe", "RustDesk",
    process.name.caseless == "rutserv.exe", "RemoteUtilities",
    process.name.caseless == "rutview.exe", "RemoteUtilities",
    process.name.caseless == "rvagent.exe", "Rsupport",
    process.name.caseless == "rvagtray.exe", "Rsupport",
    process.name.caseless == "saazapsc.exe", "Kaseya",
    process.name.caseless like "screenconnect*.exe", "ScreenConnect",
    process.name.caseless == "session_win.exe", "ZohoAssist",
    process.name.caseless == "simplegatewayservice.exe", "SimpleHelp",
    process.name.caseless == "simplehelpcustomer.exe", "SimpleHelp",
    process.name.caseless == "smpcview.exe", "Splashtop",
    process.name.caseless == "spclink.exe", "Splashtop",
    process.name.caseless == "splashtop-streamer.exe", "Splashtop",
    process.name.caseless == "splashtopsos.exe", "Splashtop",
    process.name.caseless == "spsrv.exe", "Splashtop",
    process.name.caseless == "sragent.exe", "Splashtop",
    process.name.caseless == "srservice.exe", "Splashtop",
    process.name.caseless == "srmanager.exe", "Splashtop",
    process.name.caseless == "srserver.exe", "Splashtop",
    process.name.caseless == "strwinclt.exe", "Splashtop",
    process.name.caseless == "supremo.exe", "Supremo",
    process.name.caseless == "supremoservice.exe", "Supremo",
    process.name.caseless == "syncro.app.runner.exe", "Splashtop",
    process.name.caseless == "syncro.installer.exe", "Splashtop",
    process.name.caseless == "syncro.overmind.service.exe", "Splashtop",
    process.name.caseless == "syncro.service.exe", "Splashtop",
    process.name.caseless == "syncrolive.agent.exe", "Splashtop",
    process.name.caseless == "syncrolive.agent.runner.exe", "Splashtop",
    process.name.caseless == "syncrolive.service.exe", "Splashtop",
    process.name.caseless == "tacticalrmm.exe", "TacticalRMM",
    process.name.caseless == "tailscale.exe", "Tailscale",
    process.name.caseless == "tailscaled.exe", "Tailscale",
    process.name.caseless == "teamviewer.exe", "TeamViewer",
    process.name.caseless == "teamviewer_desktop.exe", "TeamViewer",
    process.name.caseless == "teamviewer_service.exe", "TeamViewer",
    process.name.caseless == "tiagent.exe", "Tiflux",
    process.name.caseless == "ticlientcore.exe", "Tiflux",
    process.name.caseless == "todesk_service.exe", "ToDesk",
    process.name.caseless == "toolsiq.exe", "ToolsIQ",
    process.name.caseless == "tsclient.exe", "Techinline",
    process.name.caseless == "tvn.exe", "TightVNC",
    process.name.caseless == "tvnserver.exe", "TightVNC",
    process.name.caseless == "tvnviewer.exe", "TightVNC",
    process.name.caseless == "twingate.exe", "Twingate",
    process.name.caseless like "ultravnc*.exe", "UltraVNC",
    process.name.caseless like "ultraviewer*.exe", "UltraViewer",
    process.name.caseless == "velociraptor.exe", "Velociraptor",
    process.name.caseless == "vncserver.exe", "RealVNC",
    process.name.caseless == "vncviewer.exe", "RealVNC",
    process.name.caseless == "winvnc.exe", "RealVNC",
    process.name.caseless == "winwvc.exe", "TightVNC",
    process.name.caseless == "za_access.exe", "ZohoAssist",
    process.name.caseless == "za_connect.exe", "ZohoAssist",
    process.name.caseless == "zaservice.exe", "ZohoAssist",
    process.name.caseless == "zmagent.exe", "ZohoAssist",
    process.name.caseless == "zohomeeting.exe", "ZohoAssist",
    process.name.caseless == "zohotray.exe", "ZohoAssist",
    process.name.caseless == "zohours.exe", "ZohoAssist",
    process.name.caseless == "zohoursservice.exe", "ZohoAssist",
    ""
  )
| where Esql.rmm_vendor != "" and Esql.rmm_vendor is not NULL
| stats Esql.vendor_count = count_distinct(Esql.rmm_vendor),
        Esql.vendors_seen = values(Esql.rmm_vendor),
        Esql.processes_executable_values = values(process.executable),
        Esql.first_seen = min(@timestamp),
        Esql.last_seen = max(@timestamp)
  by host.name, host.id
| where Esql.vendor_count >= 2
| sort Esql.vendor_count desc
| keep host.id, host.name, Esql.*
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1219"
name = "Remote Access Tools"
reference = "https://attack.mitre.org/techniques/T1219/"

[[rule.threat.technique.subtechnique]]
id = "T1219.002"
name = "Remote Desktop Software"
reference = "https://attack.mitre.org/techniques/T1219/002/"

[rule.threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"