Elastic rules: 3g

[metadata]
creation_date = "2026/05/26"
integration = ["azure"]
maturity = "production"
updated_date = "2026/07/08"

[rule]
author = ["Elastic"]
description = """
Identifies a Microsoft Entra ID device registration where the recorded cloud device operating system build is
"10.0.19041.928" and the device display name follows the default "DESKTOP-" pattern. This combination is the default
device profile that ROADtools (roadtx) uses when registering a device, and it is uncommon for the OS build to match the
hardcoded value across an environment of otherwise patched hosts. Adversaries register rogue devices in Entra ID to
acquire a Primary Refresh Token (PRT), establish persistence, and obtain trusted, programmatic access to the tenant.
Because the OS build is a tool default, this is a high-fidelity but evadable indicator; baseline approved provisioning
tooling and device naming conventions before relying on it.
"""
false_positives = [
    """
    Legitimate device registrations may coincidentally use the `10.0.19041.928` build (Windows 10 20H1) with a default
    `DESKTOP-` hostname, particularly on imaged or unmanaged Windows hosts that have not been updated. Validate against
    your device inventory, expected provisioning workflows, and the registering user before escalating.
    """,
    """
    Authorized red team or penetration testing engagements that use ROADtools to register devices will match this rule.
    If this is expected, add exceptions for the specific user principal names, source IPs, or device names involved.
    """,
]
from = "now-9m"
index = ["logs-azure.auditlogs-*"]
language = "kuery"
license = "Elastic License v2"
name = "Entra ID Device Registration with ROADtools Default OS Build"
note = """## Triage and analysis

### Investigating Entra ID Device Registration with ROADtools Default OS Build

ROADtools (roadtx) registers a device in Entra ID with a default cloud device OS build of `10.0.19041.928` and a default
display name of `DESKTOP-<8 random characters>`. This OS build is the current default value roadtx uses and
differs from the OS version of legitimate hosts, making the build a useful indicator of ROADtools device registration.
Rogue device registration is typically a precursor to Primary Refresh Token (PRT) acquisition, MFA/Conditional Access
bypass, and persistent token-based access.

The matching Entra ID audit event is an `Add device` operation initiated by the `Device Registration Service`, where the
modified properties record the registered device characteristics:

- `azure.auditlogs.properties.target_resources.0.modified_properties.3` (`CloudDeviceOSVersion`) = `10.0.19041.928`
- `azure.auditlogs.properties.target_resources.0.modified_properties.4` (`CloudDisplayName`) = `DESKTOP-*`

### Possible investigation steps

- Confirm the registering identity via `azure.auditlogs.properties.initiated_by.user.userPrincipalName` and determine
whether that user is expected to register a new device.
- Review `azure.auditlogs.identity` to confirm the `Device Registration Service` initiated the request, and use
`azure.correlation_id` to pivot across the full registration flow (`Add device`, `Add registered users to device`,
`Add registered owner to device`).
- Inspect the device name in `azure.auditlogs.properties.target_resources.0.display_name`; default `DESKTOP-` names that
do not match your naming convention are suspicious.
- Pivot to `azure.signinlogs` for the same user and timeframe and look for follow-on sign-ins where the incoming token
type is a `primaryRefreshToken`, or for risky/AiTM sign-ins immediately preceding the registration.
- Review `azure.auditlogs.properties.initiated_by.user.ipAddress` and geolocation for the registration source. Flag
unexpected IPs, hosting/VPS ASNs, or impossible-travel relative to the user's normal activity.
- Correlate with the user-agent-based device registration rules (e.g., `Dsreg/*`, `DeviceRegistrationClient`,
`Microsoft.OData.Client/*`) for the same user or correlation ID to strengthen attribution to ROADtools.

### False positive analysis

- Unmanaged or imaged Windows 10 20H1 hosts may legitimately present the `10.0.19041.928` build with a default
`DESKTOP-` hostname. Validate against device inventory and known provisioning programs.
- Authorized security assessments using ROADtools will match. Document the engagement and add scoped exceptions.

### Response and remediation

- If confirmed malicious, remove the registered device from Entra ID and revoke the user's refresh tokens and primary
refresh tokens.
- Disable the account or reset credentials per policy and review for additional persistence (added owners, app
registrations, or service principal credentials).
- Conduct historical analysis using `azure.correlation_id` and the registering user to determine scope of access.
- Tighten device registration and join controls via Conditional Access (restrict who can register/join devices and
require MFA for registration).
"""
references = [
    "https://unit42.paloaltonetworks.com/roadtools-cloud-attacks/",
    "https://github.com/dirkjanm/ROADtools",
    "https://dirkjanm.io/introducing-roadtools-token-exchange-roadtx/",
]
risk_score = 73
rule_id = "db1271cd-f574-4173-b4e5-7369f3c03d44"
severity = "high"
tags = [
    "Domain: Cloud",
    "Domain: Identity",
    "Data Source: Azure",
    "Data Source: Microsoft Entra ID",
    "Data Source: Microsoft Entra ID Audit Logs",
    "Use Case: Identity and Access Audit",
    "Use Case: Threat Detection",
    "Tactic: Persistence",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset:"azure.auditlogs" and event.action:"Add device" and
    azure.auditlogs.properties.target_resources.0.modified_properties.3.new_value:*10.0.19041.928* and
    azure.auditlogs.properties.target_resources.0.modified_properties.4.new_value:*DESKTOP-*
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"
[[rule.threat.technique.subtechnique]]
id = "T1098.005"
name = "Device Registration"
reference = "https://attack.mitre.org/techniques/T1098/005/"



[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "event.action",
    "event.outcome",
    "azure.auditlogs.identity",
    "azure.auditlogs.operation_name",
    "azure.auditlogs.properties.target_resources.0.display_name",
    "azure.auditlogs.properties.target_resources.0.modified_properties.3.new_value",
    "azure.auditlogs.properties.target_resources.0.modified_properties.4.new_value",
    "azure.auditlogs.properties.initiated_by.user.userPrincipalName",
    "azure.auditlogs.properties.initiated_by.user.ipAddress",
    "azure.correlation_id",
]

[metadata]
creation_date = "2025/11/17"
integration = ["endpoint", "fortinet_fortigate"]
maturity = "production"
updated_date = "2026/04/10"

[rule]
author = ["Elastic"]
description = """
This detection correlates FortiGate's application control SOCKS events with Elastic Defend network event to identify the
source process performing SOCKS traffic. Adversaries may use a connection proxy to direct network traffic between systems
or act as an intermediary for network communications to a command and control server to avoid direct connections to their
infrastructure.
"""
from = "now-9m"
index = ["logs-endpoint.events.network-*", "logs-fortinet_fortigate.log-*"]
language = "eql"
license = "Elastic License v2"
name = "FortiGate SOCKS Traffic from an Unusual Process"
references = [
    "https://attack.mitre.org/techniques/T1090/",
    "https://www.elastic.co/docs/reference/integrations/fortinet_fortigate",
    "https://www.elastic.co/docs/reference/integrations/endpoint"
]
risk_score = 47
rule_id = "6926b708-7964-425f-bed8-6e006379df08"
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: Linux",
    "OS: Windows",
    "OS: macOS",
    "Use Case: Threat Detection",
    "Tactic: Command and Control",
    "Data Source: Elastic Defend",
    "Data Source: Fortinet",
    "Resources: Investigation Guide",
]
type = "eql"
query = '''
sequence by source.port, source.ip, destination.ip with maxspan=1m
 [network where data_stream.dataset == "fortinet_fortigate.log" and event.action == "signature" and network.application in ("SOCKS4", "SOCKS5")]
 [network where event.module == "endpoint" and event.action in ("disconnect_received", "connection_attempted")]
'''
note = """## Triage and analysis

### Investigating FortiGate SOCKS Traffic from an Unusual Process

### Possible investigation steps

- Review the process details like command_line, privileges, global relevance and reputation.
- Review the parent process execution details like command_line, global relevance and reputation.
- Examine all network connection details performed by the process during last 48h.
- Examine all localhost network connections performed by the same process to verify if there is any port forwarding with another process on the same machine.
- Correlate the alert with other security events or logs to identify any patterns or additional indicators of compromise related to the same process or network activity.

### False positive analysis

- Browser proxy extensions and Add-ons.
- Development and deployment tools.
- Third party trusted tools using SOCKS for network communication.

### Response and remediation

- Immediately isolate the affected system from the network to prevent further unauthorized access or data exfiltration.
- Terminate the suspicious processes and all associated children and parents.
- Conduct a thorough review of the system's configuration files to identify unauthorized changes.
- Reset credentials for any accounts associated with the source machine.
- Implement network-level controls to block traffic via SOCKS unless authorized.
- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if additional systems are affected.
"""

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1090"
name = "Proxy"
reference = "https://attack.mitre.org/techniques/T1090/"


[rule.threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[rule]
description = """
This rule detects the execution of processes with command-line arguments that contain hexadecimal representations of an
IP addresses/domain. This behavior may indicate an attempt to obfuscate the command-line arguments, potentially for
malicious purposes.
"""
id = "00e564c5-5b7d-427a-8892-fb4238cb895f"
license = "Elastic License v2"
name = "Hexadecimal IP Command-Line Argument"
os_list = ["linux"]
reference = ["https://asec.ahnlab.com/en/57635/"]
version = "1.0.5"

query = '''
process where event.type == "start" and event.action == "exec" and process.parent.executable != null and (
  process.executable like ("./*", "/boot/*", "/dev/shm/*", "/run/*", "/var/run/*", "/tmp/*", "/var/tmp/*") or
  process.name like ("curl", "wget", ".*", "python*", "perl*", "ruby*", "php*", "lua*", "node*")
) and
process.command_line like~ ("*http://0x*", "*https://0x*") and
not (
  (
    process.executable like "/usr/bin/php*" and
    process.parent.executable == "/usr/bin/timeout" and
    process.args == "/var/tools/koalaping/bin/ping.php"
  ) or
  (
    process.executable == "/usr/local/bin/php" and
    process.parent.executable == "/usr/bin/bash" and
    process.args == "/usr/local/bin/wp"
  )
)
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1564"
name = "Hide Artifacts"
reference = "https://attack.mitre.org/techniques/T1564/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[[threat]]
framework = "MITRE ATT&CK"

[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "7.15.0"

[metadata]
creation_date = "2023/10/12"
integration = ["lmd", "endpoint"]
maturity = "production"
updated_date = "2026/07/27"
min_stack_version = "9.4.0"
min_stack_comments = "Use EA (Entity Analytics) fields"

[rule]
anomaly_threshold = 70
author = ["Elastic"]
description = """
A machine learning job has detected unusually high variance of RDP session duration. Long RDP sessions can be used to
evade detection mechanisms via session persistence, and might be used to perform tasks such as lateral movement, that
might require uninterrupted access to a compromised machine.
"""
from = "now-12h"
interval = "15m"
license = "Elastic License v2"
machine_learning_job_id = "lmd_high_var_rdp_session_duration_ea"
name = "High Variance in RDP Session Duration"
references = [
    "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html",
    "https://docs.elastic.co/en/integrations/lmd",
    "https://www.elastic.co/blog/detecting-lateral-movement-activity-a-new-kibana-integration",
    "https://www.elastic.co/blog/remote-desktop-protocol-connections-elastic-security",
]
risk_score = 21
rule_id = "a8d35ca0-ad8d-48a9-9f6c-553622dca61a"
setup = """## Setup

This rule requires the `host.ip` field to be populated.
For **Elastic Defend** events on versions **8.18 and above**, this field is **disabled by default**.

If you are using **Elastic Defend**, ensure host IP collection is enabled by following the configuration steps in the
[helper guide](https://www.elastic.co/docs/solutions/security/configure-elastic-defend/configure-data-volume-for-elastic-endpoint#host-fields).

The rule requires the Lateral Movement Detection integration assets to be installed, as well as file and Windows RDP process events collected by the Elastic Defend integration.

### Lateral Movement Detection Setup
The Lateral Movement Detection integration detects lateral movement activity by identifying abnormalities in file and Windows RDP events. Anomalies are detected using Elastic's Anomaly Detection feature.

#### Prerequisite Requirements:
- Fleet is required for Lateral Movement Detection.
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
- Windows RDP process events collected by the [Elastic Defend](https://docs.elastic.co/en/integrations/endpoint) integration.
- To install Elastic Defend, refer to the [documentation](https://www.elastic.co/guide/en/security/current/install-endpoint.html).

#### The following steps should be executed to install assets associated with the Lateral Movement Detection integration:
- Go to the Kibana homepage. Under Management, click Integrations.
- In the query bar, search for Lateral Movement Detection and select the integration to see more details about it.
- Follow the instructions under the **Installation** section.
- For this rule to work, complete the instructions through **Add preconfigured anomaly detection jobs**.
"""
severity = "low"
tags = [
    "Data Source: Elastic Defend",
    "Use Case: Lateral Movement Detection",
    "Rule Type: ML",
    "Rule Type: Machine Learning",
    "Tactic: Lateral Movement",
    "Resources: Investigation Guide",
]
type = "machine_learning"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating High Variance in RDP Session Duration

Remote Desktop Protocol (RDP) enables remote access to systems, facilitating legitimate administrative tasks. However, adversaries exploit prolonged RDP sessions to maintain persistent access, often for lateral movement within networks. The detection rule leverages machine learning to identify anomalies in session duration, flagging potential misuse by highlighting sessions with unusually high variance, which may indicate malicious activity.

### Possible investigation steps

- Review the specific RDP session details, including the start and end times, to understand the duration and identify any patterns or anomalies in session length.
- Correlate the flagged RDP session with user activity logs to determine if the session aligns with known user behavior or scheduled administrative tasks.
- Investigate the source and destination IP addresses involved in the RDP session to identify any unusual or unauthorized access points.
- Check for any concurrent alerts or logs indicating lateral movement or other suspicious activities originating from the same source or targeting the same destination.
- Analyze the user account associated with the RDP session for any signs of compromise, such as recent password changes, failed login attempts, or unusual access times.
- Review the network traffic during the RDP session for any signs of data exfiltration or communication with known malicious IP addresses.

### False positive analysis

- Long RDP sessions for legitimate administrative tasks can trigger false positives. To manage this, identify and whitelist IP addresses or user accounts associated with routine administrative activities.
- Scheduled maintenance or updates often require extended RDP sessions. Exclude these sessions by setting time-based exceptions during known maintenance windows.
- Automated scripts or tools that require prolonged RDP access for monitoring or data collection can be mistaken for anomalies. Document and exclude these processes by recognizing their unique session patterns.
- Remote support sessions from trusted third-party vendors may appear as high variance. Establish a list of trusted vendor IPs or accounts to prevent these from being flagged.
- Training or demonstration sessions that involve extended RDP use should be accounted for by creating exceptions for specific user groups or departments involved in such activities.

### Response and remediation

- Immediately isolate the affected system from the network to prevent further lateral movement and potential data exfiltration.
- Terminate the suspicious RDP session to disrupt any ongoing unauthorized activities.
- Conduct a thorough review of the affected system for signs of compromise, including checking for unauthorized user accounts, installed software, and changes to system configurations.
- Reset credentials for any accounts that were accessed during the suspicious RDP session to prevent further unauthorized access.
- Apply security patches and updates to the affected system to address any vulnerabilities that may have been exploited.
- Monitor network traffic and system logs for any signs of continued or related suspicious activity, focusing on RDP connections and lateral movement patterns.
- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if additional systems are affected."""
[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1021"
name = "Remote Services"
reference = "https://attack.mitre.org/techniques/T1021/"

[[rule.threat.technique.subtechnique]]
id = "T1021.001"
name = "Remote Desktop Protocol"
reference = "https://attack.mitre.org/techniques/T1021/001/"

[[rule.threat.technique]]
id = "T1210"
name = "Exploitation of Remote Services"
reference = "https://attack.mitre.org/techniques/T1210/"

[rule.threat.tactic]
id = "TA0008"
name = "Lateral Movement"
reference = "https://attack.mitre.org/tactics/TA0008/"

[rule]
description = """
Detects when an Osascript shell script is piped to a Python interpreter for execution followed by an immediate outbound
network connection for C2 establishment. This activity is observed when an Empire payload is executed for initial
access.
"""
id = "2aade342-d45b-4297-a0e0-4cf0962c9042"
license = "Elastic License v2"
name = "Initial Access via OSA Shell Script Piped to Python Interpreter"
os_list = ["macos"]
version = "1.0.11"

query = '''
sequence by process.parent.entity_id with maxspan=30s
[process where event.type == "start" and event.action == "exec" and 
  process.name == "osascript" and 
  process.args == "-e" and process.command_line like~ "*python*"]
[network where event.type == "start" and event.action == "connection_attempted" and
  process.name like~ "python*" and
   not cidrmatch(destination.ip, 
       "240.0.0.0/4", "233.252.0.0/24", "224.0.0.0/4", "198.19.0.0/16", "192.18.0.0/15", 
       "192.0.0.0/24", "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", 
       "192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", 
       "100.64.0.0/10", "192.175.48.0/24", "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24",
       "::1", "FE80::/10", "FF00::/8")]
'''

min_endpoint_version = "8.16.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.006"
name = "Python"
reference = "https://attack.mitre.org/techniques/T1059/006/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"

[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "8.16.0"

[metadata]
creation_date = "2026/03/02"
integration = ["o365"]
maturity = "production"
updated_date = "2026/04/10"

[rule]
author = ["Elastic", "Austin Songer"]
description = """
Identifies when a new SharePoint Site Administrator is added in Microsoft 365. Site Administrators
have full control over SharePoint Sites, including the ability to manage permissions, access all content, and
modify site settings. Adversaries who compromise a privileged account may add themselves or a controlled account as a
Site Administrator to maintain persistent, high-privilege access to sensitive SharePoint data. This technique
was notably observed in the 0mega ransomware campaign, where attackers elevated privileges to exfiltrate data and deploy
ransom notes across SharePoint sites.
"""
false_positives = [
    "Legitimate IT administrators adding Site admins as part of routine SharePoint site management.",
    "Automated provisioning tools or scripts that assign Site admin roles during site creation workflows.",
    "Organizational restructuring where site ownership is being transferred to new administrators.",
]
from = "now-9m"
index = ["filebeat-*", "logs-o365.audit-*"]
language = "kuery"
license = "Elastic License v2"
name = "M365 SharePoint Site Administrator Added"
note = """## Triage and Analysis

### Investigating M365 SharePoint Site Administrator Added

Site Administrators in SharePoint Online have full control over a Site, including the ability to manage permissions, access all content, and configure site-level settings. Adversaries who gain access to a privileged account may assign Site Administrator rights to maintain persistent access or facilitate data exfiltration. The `SiteCollectionAdminAdded` audit event is logged when this privilege is granted.

#### Possible Investigation Steps

- Review the `user.id` field to determine who performed the action. Assess whether this user normally manages SharePoint site permissions.
- Examine the `o365.audit.ModifiedProperties.SiteAdmin.NewValue` field to identify the account that was granted Site Administrator privileges.
- Check the `o365.audit.SiteUrl` or `url.original` to determine which Site was targeted. Assess the sensitivity of the data stored in this site.
- Review the `o365.audit.TargetUserOrGroupName` and `o365.audit.TargetUserOrGroupType` fields for additional context on the target principal.
- Pivot to sign-in logs for the acting account to look for anomalies such as logins from unfamiliar locations, devices, or IP ranges.
- Investigate whether the newly added admin account has performed subsequent actions such as file downloads, permission changes, or sharing link creation.
- Check for other recent `SiteCollectionAdminAdded` events to determine if multiple Sites were targeted in a short time frame, which may indicate bulk privilege escalation.

### False Positive Analysis

- Routine SharePoint administration tasks by IT teams may trigger this alert. Correlate with change management tickets or scheduled maintenance windows.
- Automated provisioning tools that assign Site admin roles during site creation or migration workflows may generate expected alerts.
- Organizational changes such as team transitions or restructuring may involve legitimate Site admin reassignments.

### Response and Remediation

- If the admin addition is unauthorized, immediately remove the Site Administrator role from the suspicious account.
- Reset credentials for both the account that performed the action and the account that was added, especially if compromise is suspected.
- Review recent activity on the affected Site for signs of data exfiltration, permission changes, or content modifications.
- Enable or verify enforcement of MFA for all accounts with SharePoint administrative privileges.
- Audit the list of Site Administrators across all Sites to identify any other unauthorized additions.
- Consider implementing Privileged Access Management (PAM) or Privileged Identity Management (PIM) to require just-in-time elevation for SharePoint admin roles.
"""
references = [
    "https://learn.microsoft.com/en-us/purview/audit-log-activities#site-permissions-activities",
    "https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/",
]
risk_score = 47
rule_id = "98ebd6a1-77db-4fe1-b4fd-1bd3c737b780"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Domain: SaaS",
    "Domain: Identity",
    "Data Source: Microsoft 365",
    "Data Source: Microsoft 365 Audit Logs",
    "Use Case: Identity and Access Audit",
    "Tactic: Privilege Escalation",
    "Tactic: Persistence",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset:o365.audit
    and event.provider:(SharePoint or OneDrive)
    and event.category:web
    and event.action:SiteCollectionAdminAdded
    and event.outcome:success
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"
[[rule.threat.technique.subtechnique]]
id = "T1098.003"
name = "Additional Cloud Roles"
reference = "https://attack.mitre.org/techniques/T1098/003/"


[rule.threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"
[[rule.threat.technique.subtechnique]]
id = "T1098.003"
name = "Additional Cloud Roles"
reference = "https://attack.mitre.org/techniques/T1098/003/"


[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[rule]
description = """
Identifies Node.js (OpenJS Foundation signed) recently modified on disk executing with few arguments and a command line
referencing AppData, where the target file does not use a standard Node.js script extension (.js, .mjs, .cjs). May
indicate execution of staged payloads with non-standard extensions or abuse of Node for script-based execution.
"""
id = "f2b7c9e6-4e8d-9f3b-a0c1-7d6e5f4b3a2e"
license = "Elastic License v2"
name = "Node.js Recently Dropped Executing File with Unusual Extension"
os_list = ["windows"]
reference = ["https://nodejs.org", "https://attack.mitre.org/techniques/T1059/007/"]
version = "1.0.1"

query = '''
process where event.type == "start" and
 (process.name : "node.exe" or process.pe.original_file_name == "node.exe") and
 process.code_signature.subject_name == "OpenJS Foundation" and
 process.args_count == 2 and not process.args in ("--version", "-v") and 
 process.Ext.relative_file_name_modify_time <= 10 and
 not process.args : ("*.js", "*.mjs", "*.cjs") and
 process.args : "?:\\Users\\*\\AppData\\*" and 
 not process.parent.executable : "?:\\Program Files (x86)\\SofttechLLC\\FlightVector\\bin\\FlightVector-*.exe"
'''

min_endpoint_version = "8.10.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.007"
name = "JavaScript"
reference = "https://attack.mitre.org/techniques/T1059/007/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "8.10.0"

[rule]
description = """
Identifies parent process spoofing used to thwart detection. Adversaries may spoof the parent process identifier (PPID)
of a new process to evade process-monitoring defenses or to elevate privileges.
"""
id = "816ba7e7-519a-4f85-be2a-bacd6ccde57f"
license = "Elastic License v2"
name = "Parent Process PID Spoofing"
os_list = ["windows"]
reference = [
    "https://blog.didierstevens.com/2017/03/20/",
    "https://www.elastic.co/security-labs/elastic-security-labs-steps-through-the-r77-rootkit",
]
version = "1.0.56"

query = '''
sequence with maxspan=5m
 [process where event.action == "start" and
  process.parent.executable != null and
  /* FP - AppInfo */
  not (process.executable : "*\\windows\\system32\\svchost.exe" and
       user.id == "S-1-5-18" and process.command_line : "* -k netsvcs*") and

  /* FP - Windows Errors Reporting */
  not (process.executable : "*\\windows\\system32\\svchost.exe" and
       user.id == "S-1-5-18" and process.command_line : "*WerSvcGroup*") and

   /* FP - Secondary Logon */
  not (process.executable : "*\\windows\\system32\\svchost.exe" and
       user.id == "S-1-5-18" and process.command_line : "*seclogon*") and

   /* FP - Application Brokers */
  not (process.executable : ("*\\Windows\\System32\\RuntimeBroker.exe",
                             "*\\Windows\\ImmersiveControlPanel\\SystemSettings.exe")) and

   /* FP - Third Party Programs except MS Office */
  not (process.executable : ("*\\Program Files (x86)\\*.exe", "*\\Program Files\\*.exe") and
       process.code_signature.trusted == true and
       not process.name in~ ("winword.exe",
                           "excel.exe",
                           "outlook.exe",
                           "powerpnt.exe",
                           "eqnedt32.exe",
                           "fltldr.exe",
                           "mspub.exe",
                           "msaccess.exe")) and 

  not (process.pe.original_file_name in~ ("devenv.exe", "PowerToys.exe") and process.code_signature.trusted == true and 
       process.code_signature.subject_name like "Microsoft*") and 
  not (process.executable : "?:\\Windows\\System32\\dllhost.exe" and process.args : "/Processid:{F544C724-92CF-41D5-85B7-65B02914E52D}" and
       process.parent.executable : "C:\\Windows\\System32\\svchost.exe") and
   /* FP Issue #488 - WerFaultSecure ProtectedCrash  */
  not (
       process.executable : ("*\\Windows\\System32\\WerFaultSecure.exe", "*\\WINDOWS\\SysWOW64\\WerFaultSecure.exe") and
       user.id == "S-1-5-18" and process.parent.command_line != null and
       ((process.parent.executable : "*\\Windows\\System32\\svchost.exe" and process.parent.command_line : "*WerSvcGroup*") or
         process.parent.executable : "*\\Windows\\System32\\dxgiadaptercache.exe")
       ) and

   /* FP Issue #488 - File Picker UI Host is real parent of Authentication Broker AuthHost.exe */
  not (process.executable : "*\\Windows\\System32\\PickerHost.Exe" and process.parent.executable : "*\\Windows\\System32\\svchost.exe") and

   /* FP Issue #488 - Roblox Game Client */
  not (process.pe.original_file_name : "RobloxApp.exe" and
        process.code_signature.subject_name == "Roblox Corporation" and
        (process.code_signature.trusted == true or process.code_signature.status == "errorTimeStamp")) and

   /* FP OpenWith handles unknown file handlers via GUI popup */
  not (process.executable : ("*\\WINDOWS\\system32\\OpenWith.exe", "*\\WINDOWS\\syswow64\\OpenWith.exe") and process.args: "-Embedding" and
       process.parent.executable : "*\\Windows\\System32\\svchost.exe" and process.parent.args : "DcomLaunch") and

  not (process.pe.original_file_name in~ ("notification_helper.exe", "cpptools.exe") and process.code_signature.subject_name == "Microsoft Corporation" and
       process.code_signature.trusted == true) and

  not ((process.pe.original_file_name : "pmlauncher.exe" or process.executable : "C:\\Windows\\System32\\pmlauncher.exe") and 
      process.code_signature.subject_name : ("BeyondTrust Software, Inc", "BeyondTrust Software Inc") and
       process.code_signature.trusted == true) and

  not (process.executable : "*\\Windows\\SystemApps\\Microsoft*.exe" and
       process.parent.executable : "*\\Windows\\system32\\svchost.exe" and process.parent.args : "DcomLaunch") and

  not (process.pe.original_file_name == "MBSetup.exe" and process.code_signature.subject_name in ("Malwarebytes Inc.", "Malwarebytes Inc") and
       process.code_signature.trusted == true) and

  not (process.executable : "*\\Windows\\System32\\backgroundTaskHost.exe" and process.Ext.token.integrity_level_name == "low" and process.parent.name : "svchost.exe") and

  not (process.executable : "*\\Windows\\System32\\SystemSettingsBroker.exe" and process.parent.args : "DcomLaunch" and
       process.parent.executable :  "*\\Windows\\System32\\svchost.exe") and

  not (process.pe.original_file_name == "tailscale-ipn.exe" and
        process.code_signature.subject_name == "Tailscale Inc." and
        (process.code_signature.trusted == true or process.code_signature.status == "errorChaining")) and

  not process.executable : "?:\\Windows\\SoftwareDistribution\\*.exe" and

  not (process.pe.original_file_name == "FileCoAuth.exe" and process.parent.executable : "?:\\Windows\\System32\\svchost.exe" and
       process.code_signature.subject_name == "Microsoft Corporation" and process.code_signature.trusted == true) and

  not (process.name : "cpptools.exe" and process.parent.executable : "?:\\Program Files\\Microsoft VS Code\\Code.exe") and

  not (process.code_signature.trusted == true and process.code_signature.subject_name like "*Michael Maltsev*") and 

  not (process.executable : "?:\\WINDOWS\\Microsoft.NET\\Framework\\*\\RegAsm.exe" and 
       process.args : "?:\\ProgramData\\PlatformInstall\\GideCode\\rtcresofz_Mecrrcpl.dll" and 
       process.parent.executable : "?:\\Windows\\System32\\svchost.exe") and

  not (user.id == "S-1-5-18" and process.executable : "C:\\Windows\\System32\\msiexec.exe" and process.parent.executable : "C:\\Windows\\System32\\msiexec.exe") and
       
  not (process.executable : ("C:\\Windows\\System32\\sihost.exe", "C:\\Windows\\System32\\ShellHost.exe") and process.parent.executable : "C:\\Windows\\System32\\sihost.exe") and

  /* FP - Windows Update MpSigStub spawning children with spoofed PPID */
  not (process.pe.original_file_name == "MpSigStub.exe" and
       process.code_signature.subject_name == "Microsoft Corporation" and
       process.code_signature.trusted == true) and

  /* FP - Modrinth App (Rinth, Inc.) game mod launcher */
  not (process.code_signature.subject_name == "Rinth, Inc." and
       process.code_signature.trusted == true) and

  /* FP - uberAgent SetACL (vast limits GmbH) - mirrored from seq 2 */
  not (process.pe.original_file_name == "SetACL.exe" and
       process.code_signature.subject_name == "vast limits GmbH" and
       process.code_signature.trusted == true)
  ] by process.entity_id
 [process where event.action == "start" and process.parent.Ext.real.pid > 0 and 
  /* FP Issue #488 - Auth Host Broker for WindowsApps */
  not process.executable :  "*\\Windows\\system32\\AuthHost.exe" and
  not (process.parent.executable : "*\\Windows\\System32\\sihost.exe" and
        process.pe.original_file_name in~ ("chrome.exe", "msedge.exe") and process.args_count >= 2 and
        process.code_signature.subject_name : ("Google LLC", "Microsoft Corporation")) and
  not (process.executable : "*\\Windows\\System32\\fsutil.exe" and process.args : "file" and
       process.parent.executable : "*\\Users\\*\\.vscode\\extensions\\ms-vscode.cpptools-*\\bin\\cpptools.exe") and

  /* noisy with variable patterns for the parent and real parent process */
  not (process.executable : "*\\WINDOWS\\system32\\WerFaultSecure.exe" and process.Ext.token.integrity_level_name == "system") and

  /* AM_Delta_Patch Windows Update */
  not (process.executable : ("?:\\Windows\\System32\\MpSigStub.exe", "?:\\Windows\\SysWOW64\\MpSigStub.exe") and
       process.parent.name in~ ("wuauclt.exe", "wuaucltcore.exe")) and

  not process.executable : ("?:\\Windows\\SysWOW64\\WerFault.exe", "?:\\Windows\\system32\\WerFault.exe") and

  not process.hash.sha256 : 
                ("02cfaec8d3f905a7a940dc307fb1c0558eed6a80e663526f73efeb79c1808b87", 
                 "bd7ed99c8a05b3852cc4e44a34e4ba4f7ad4d4074ee60ad6a21a706897eeb714", 
                 "c5b9688aed57d6b6285a210d40c9a4bf43c3672a758d448cd99f40fdc6681415", 
                 "dee8aba745a6cca1b2404f5054dd91d4159d824c3f079fe742c6a25961d7a9f0", 
                 "0a04684ef46dcac1859a195e8c7d4bfdb2dddb7da1d4491e8b7bf794036eba3a", 
                 "217fa613c4e129f20d1b20fd2ce5c7a7efbdf88e1e6121077057d0b14fe15450", 
                 "038d7b257b98421ad371189cf51d67f32ddad2de687c443a59ea74e4027bbf04", 
                 "590f3cc02628dcdb43d3ee00ecf1a86e0bfcefd26cb0ffcb809a67194b22fda6", 
                 "ff7627eaa90ce994207d1d1d1b39ac8852b11f03a6adb86d915f4696401beca0",
                 "a0b1f604c335315b5ba5a598436bf6c8b05ce77742e2f1b102a8c7d11918408d",
                 "f074a65751beb589b99ecffa2d4cefdd9c87c3641487d2baed4c9f85e75ffbc6",
                 "5ea04862fe5e201e47e5aac29c19a1550612f82a048b402cd85435efd9d39d2a",
                 "79f7c942f9b15b857abcb838123991ad756ea3bb846045ed3378e484428f74a3",
                 "97effc20423d404cf3877cdb4af9be840a720962246408b2d7396362a9e5d613",
                 "a4af59c1f044ff1290e47e74484163243591f56b7053c8b8d3e4ae320cecbac3",
                 "941bc9193d9143d71e2c93803b0cbff511ec549f0c4f0093744cab6bedd4140a",
                 "3f9075c30f63d67693f2f876212f702ddfe51834c73289718baf6e8fb2036039",
                 "8157d5ee0336f8c9f968da4d9e0c39f70067406ef73a5b25e5d2ed90dd54985e",
                 "989e5cb0690ec99115f20fea1bc2cfdcf08d910fc468a99bd8416ccdae5b159c",
                 "adeb733bf80927e6b365fc6a03547d401d51539b1b4623e55199992d242c69ba",
                 "34e985694d5fddbe4a27ab986975e2980b0c0a2005c0779435e7ce16004f4fe8",
                 "e37d10eead5f14a3ea9d2be0e95012a2928964928e447ac7c4fac9a547f0a863",
                 "38011e713b4be8577576062754cad03e9899859488932ae4c9c83e5fbb5cb7d2",
                 "6f1be9e26e403a885cc3b1ff0e4dbecbc96c0821119d25990c3e211564f215d5",
                 "eda6b433006b571d1675c6c19f8c7fd786ac5926c063aabea947ea2db636066e") and

  not (process.args : "$execWrapper" and process.name : "powershell.exe" and process.parent.name : "cmd.exe") and

  not (process.code_signature.subject_name in ("Malwarebytes Inc.", "Malwarebytes Inc", "Proton AG", "Elaborate Bytes AG", "vast limits GmbH", "Read AI", "wespond UG (Haftungsbeschränkt)", "Reference Health") and process.code_signature.trusted == true) and

  not process.executable : ("\\Device\\HarddiskVolume?\\Windows\\System32\\*.exe", "\\Device\\HarddiskVolume?\\Windows\\SysWOW64\\*.exe") and

  not (process.parent.executable : "C:\\Windows\\explorer.exe" and process.parent.thread.Ext.call_stack_summary == "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|nsis_tauri_utils.dll") and
  not (process.executable like "C:\\Program Files\\WindowsApps\\*.exe" and process.parent.executable : "C:\\Windows\\System32\\sihost.exe") and

  /* FP - PowerToys KeyboardManager engine (Microsoft signed) */
  not (process.pe.original_file_name == "PowerToys.KeyboardManagerEngine.exe" and
       process.code_signature.subject_name like "Microsoft*" and
       process.code_signature.trusted == true) and

  /* FP - Modrinth App (Rinth, Inc.) Minecraft mod launcher */
  not (process.code_signature.subject_name == "Rinth, Inc." and
       process.code_signature.trusted == true)
  ] by process.parent.Ext.real.entity_id
'''

min_endpoint_version = "8.10.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1134"
name = "Access Token Manipulation"
reference = "https://attack.mitre.org/techniques/T1134/"
[[threat.technique.subtechnique]]
id = "T1134.004"
name = "Parent PID Spoofing"
reference = "https://attack.mitre.org/techniques/T1134/004/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"

[rule]
description = """
Detects the use of curl to upload an archived file to an internet server. Threat actors often will collect data on a
system and compress it in an archive file before exfiltrating the file back to their C2 server for review. Many threat
actors have been seen utilizing curl to upload this archive file with the collected data to do this. Use of curl in this
way while not inherently malicious should be considered highly abnormal and suspicious activity.
"""
id = "192ec591-1d00-4c16-a717-8a7481038d23"
license = "Elastic License v2"
name = "Potential Data Exfiltration via Curl"
os_list = ["macos"]
reference = [
    "https://everything.curl.dev/usingcurl/uploads",
    "https://objective-see.org/blog/blog_0x71.html#-sentinelsneak",
    "https://objective-see.org/blog/blog_0x66.html",
]
version = "1.0.40"

query = '''
sequence by process.entity_id with maxspan=15s
[process where event.type == "start" and event.action == "exec" and process.name == "curl" and 
 process.args like~ ("-F", "-T", "-d", "--data*") and 
 process.args like~ ("*@*.zip", "*@*.gz", "*@*.tgz", "b64=@*") and 
 process.args like~ "http*" and
 (process.parent.name like~ ("osascript", "python*", "node", "ruby", "bash", "sh", "zsh", "perl") or (process.parent.code_signature.trusted == false or process.parent.code_signature.exists == false)) and
 not process.args like ("Authorization*", "PRIVATE-TOKEN*") and 
 not process.parent.command_line like "/bin/bash --init-file /Applications/Visual Studio Code.app/Contents/Resources/app/out/vs/workbench/contrib/terminal/common/scripts/shellIntegration-bash.sh" and
 not process.Ext.effective_parent.executable like ("/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfDaemon.app/Contents/MacOS/JamfDaemon",
                                               "/Applications/Support.app/Contents/MacOS/Support")]
[network where event.type == "start" and not destination.domain : ("*.cloud.es.io", "*.elastic-cloud.com")]
'''

min_endpoint_version = "8.16.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1048"
name = "Exfiltration Over Alternative Protocol"
reference = "https://attack.mitre.org/techniques/T1048/"


[threat.tactic]
id = "TA0010"
name = "Exfiltration"
reference = "https://attack.mitre.org/tactics/TA0010/"

[internal]
min_endpoint_version = "8.16.0"

[metadata]
creation_date = "2026/06/03"
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender"]
maturity = "production"
updated_date = "2026/06/03"

[rule]
author = ["Aryu Zaw"]
description = """
Identifies the Windows Error Reporting Protected Process Light (PPL) binary WerFaultSecure.exe being started by a
process other than the Windows Error Reporting service, with command-line arguments used to take a secure memory dump of
a target process. Because MiniDumpWriteDump suspends all threads of the target while the dump is produced, an attacker
can suspend WerFaultSecure.exe mid-dump to leave the targeted EDR or antivirus suspended ("frozen") without ever
terminating it, a defense-evasion technique publicly known as EDR-Freeze.
"""
false_positives = [
    """
    Specialized crash-analysis, debugging, or diagnostics tooling that invokes WerFaultSecure.exe directly to capture a
    secure process dump. Validate the parent process, its code signature, and the targeted process before adding an
    exception.
    """,
]
from = "now-9m"
index = [
    "winlogbeat-*",
    "logs-endpoint.events.process-*",
    "logs-windows.sysmon_operational-*",
    "endgame-*",
    "logs-sentinel_one_cloud_funnel.*",
    "logs-m365_defender.event-*",
]
language = "eql"
license = "Elastic License v2"
name = "Potential EDR-Freeze via WerFaultSecure Abuse"
note = """## Triage and analysis

### Investigating Potential EDR-Freeze via WerFaultSecure Abuse

`WerFaultSecure.exe` is the Protected Process Light (PPL) variant of Windows Error Reporting, normally launched by the WER service hosted in `svchost.exe` to capture secure crash dumps of protected processes. Because it runs as a PPL and can read the memory of other protected processes, adversaries abuse it to dump or freeze security software.

In the EDR-Freeze technique, an attacker starts `WerFaultSecure.exe` from their own process and directs it to dump a security process (for example `MsMpEng.exe`). `MiniDumpWriteDump` suspends every thread of the target while the dump is produced; the attacker then suspends `WerFaultSecure.exe` itself at that moment, leaving the EDR or antivirus frozen in a "coma" without ever terminating it, so traditional process-termination and tamper alerts never fire.

This rule identifies `WerFaultSecure.exe` started by a parent other than the WER service with command-line arguments characteristic of a secure process memory dump (`/pid` and `/encfile`). Legitimate secure dumps are initiated by the WER service, so an abnormal parent process is the primary signal of abuse.

### Possible investigation steps

- Identify the parent process via `process.parent.name`, `process.parent.executable`, and `process.parent.command_line`. Launches from shells, scripting engines, `rundll32.exe`, or unsigned binaries in user-writable paths are highly suspicious.
- Resolve the target process from the `/pid` argument value and determine whether it corresponds to a security product (EDR or antivirus such as `MsMpEng.exe`), `lsass.exe`, or another sensitive process.
- Review the full command line for the dump-type value (the public proof of concept uses `/type 268310`, a full dump) and for the `/cancel` event handle, which together with `/encfile` indicate a full secure memory dump.
- Look for a ProcessAccess event (Sysmon Event ID 10) or an Elastic Defend API event in which `WerFaultSecure.exe` is opened with `PROCESS_SUSPEND_RESUME` (access mask `0x800` / `2048`) by a non-WER process shortly after this execution. This is the act that freezes the dumper and keeps the target suspended.
- Check whether the targeted security agent stopped reporting telemetry (a heartbeat gap) around the time of the alert.
- Examine the parent process for prevalence, code signature, on-disk location, and any preceding download, injection, or privilege-escalation activity.
- Review activity for the user and host over the preceding 24-48 hours for related defense-evasion, credential-access, or lateral-movement behavior.

### False positive analysis

- This activity is highly unusual: secure WER dumps are normally initiated by the WER service in `svchost.exe`, not by interactive or third-party processes, so benign matches are rare.
- Specialized crash-analysis, debugging, or enterprise diagnostics tooling could invoke `WerFaultSecure.exe` directly. If such a tool is confirmed and authorized, add an exception scoped to its `process.parent.executable` and code signature.

### Response and remediation

- Isolate the affected host to prevent further post-compromise activity while the EDR or antivirus may be suspended.
- Verify the state of the targeted security agent and restart or resume it, then confirm that protection and telemetry have been restored.
- Terminate the suspicious `WerFaultSecure.exe` process and its parent, preserving command lines, handles, and any dump files for analysis.
- Investigate the parent process and its origin to determine the initial access vector and scope of compromise, and search the environment for the same parent binary or behavior on other hosts.
- Reset credentials that may have been exposed while the security agent was disabled, and run a full scan once protection is restored.
- Escalate to incident response when the targeted process is a security control, as a successful freeze indicates a hands-on-keyboard defense-evasion attempt.
"""
references = [
    "https://www.zerosalarium.com/2025/09/EDR-Freeze-Puts-EDRs-Antivirus-Into-Coma.html",
    "https://binarydefense.com/resources/blog/dont-freeze-me-out-bro-arc-labs-technical-analysis-of-edr-freeze",
    "https://www.bleepingcomputer.com/news/security/new-edr-freeze-tool-uses-windows-wer-to-suspend-security-software/",
]
risk_score = 73
rule_id = "7b75c162-d439-472d-b39f-2eb0d4d2d318"
setup = """## Setup

This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.

Setup instructions: https://ela.st/install-elastic-defend

### Additional data sources

This rule also supports the following third-party data sources. For setup instructions, refer to the links below:

- [Microsoft Defender XDR](https://ela.st/m365-defender)
- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
- [Sysmon Event ID 1 - Process Creation](https://ela.st/sysmon-event-1-setup)
"""
severity = "high"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Defense Evasion",
    "Data Source: Elastic Endgame",
    "Data Source: Elastic Defend",
    "Data Source: Microsoft Defender XDR",
    "Data Source: Sysmon",
    "Data Source: SentinelOne",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
process where host.os.type == "windows" and event.type == "start" and
  process.executable : "?:\\Windows\\System32\\WerFaultSecure.exe" and

  /* WerFaultSecure secure dumps are normally initiated by the WER service hosted in svchost.exe */
  process.parent.executable != null and
  not process.parent.executable : ("?:\\Windows\\System32\\svchost.exe", "?:\\Windows\\System32\\wermgr.exe", "?:\\Windows\\System32\\WerFault.exe", "?:\\Windows\\System32\\WerFaultSecure.exe") and

  /* arguments used to take a secure memory dump of a target process (e.g. /pid <target> /encfile <handle> /type 268310) */
  process.args : "/pid" and process.args : "/encfile"
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[rule.threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"



[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[rule]
description = """
Identifies allocation of RWX memory region from a Nullsoft scriptable installer. Adversaries may abuse NSIS installers
to deliver malware for initial access.
"""
id = "9cffb077-cf13-4a35-a6b1-152ba499edc0"
license = "Elastic License v2"
name = "Potential Injection via NSIS Installer"
os_list = ["windows"]
reference = [
    "https://nsis.sourceforge.io/Features",
    "https://www.fortinet.com/blog/threat-research/locky-nsis-based-ransomware-is-embracing-its-new-end-of-summer-shape",
    "https://medium.com/csg-govtech/meet-the-final-boss-clearing-each-level-of-multi-stage-malware-8779c5272ec7",
]
version = "1.0.4"

query = '''
sequence by process.entity_id with maxspan=1m
 [library where dll.path : "?:\\users\\*\\appdata\\local\\temp\\ns*.tmp\\system.dll" and not process.code_signature.status : "trusted"]
 [api where 
  process.Ext.api.name : ("VirtualAlloc*", "MapViewOfFile*") and process.Ext.api.parameters.protection : "RWX" and process.Ext.api.parameters.size >= 10000 and 
  process.thread.Ext.call_stack_summary : ("*kernelbase.dll|system.dll*", "*kernelbase.dll|Unknown*", "*kernelbase.dll|Unbacked*")]
'''

min_endpoint_version = "8.8.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.8.0"

[metadata]
creation_date = "2021/01/21"
integration = ["endpoint"]
maturity = "production"
updated_date = "2026/03/24"

[rule]
author = ["Elastic"]
description = """
Identifies modifications to the Atom desktop text editor Init File. Adversaries may add malicious JavaScript code to the
init.coffee file that will be executed upon the Atom application opening.
"""
from = "now-9m"
index = ["logs-endpoint.events.*"]
language = "eql"
license = "Elastic License v2"
name = "Potential Persistence via Atom Init Script Modification"
references = [
    "https://github.com/D00MFist/PersistentJXA/blob/master/AtomPersist.js",
    "https://flight-manual.atom.io/hacking-atom/sections/the-init-file/",
]
risk_score = 21
rule_id = "b4449455-f986-4b5a-82ed-e36b129331f7"
setup = """## Setup

This rule requires data coming in from Elastic Defend.

### Elastic Defend Integration Setup
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.

#### Prerequisite Requirements:
- Fleet is required for Elastic Defend.
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).

#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
- Go to the Kibana home page and click "Add integrations".
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
- Click "Add Elastic Defend".
- Configure the integration name and optionally add a description.
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
- Click "Save and Continue".
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
"""
severity = "low"
tags = [
    "Domain: Endpoint",
    "OS: macOS",
    "Use Case: Threat Detection",
    "Tactic: Persistence",
    "Data Source: Elastic Defend",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
file where host.os.type == "macos" and event.action == "modification" and
 file.path like "/Users/*/.atom/init.coffee" and 
 not process.name like ("Atom", "xpcproxy") and 
 not user.name == "root"
'''
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Potential Persistence via Atom Init Script Modification

Atom, a popular text editor, allows customization via the `init.coffee` script, which executes JavaScript upon startup. Adversaries exploit this by embedding malicious code, ensuring persistence each time Atom launches. The detection rule identifies suspicious modifications to this script on macOS, excluding benign processes and root user actions, thus highlighting potential unauthorized persistence attempts.

### Possible investigation steps

- Review the file modification details for /Users/*/.atom/init.coffee to identify the exact changes made to the script.
- Investigate the process that modified the init.coffee file by examining the process name and user associated with the modification, ensuring it is not Atom, xpcproxy, or the root user.
- Check the user account involved in the modification for any unusual activity or recent changes, such as new software installations or privilege escalations.
- Analyze the content of the modified init.coffee file for any suspicious or unfamiliar JavaScript code that could indicate malicious intent.
- Correlate the modification event with other security alerts or logs from the same host to identify any related suspicious activities or patterns.
- If malicious code is found, isolate the affected system and conduct a deeper forensic analysis to determine the scope and impact of the potential compromise.

### False positive analysis

- Frequent legitimate updates to the init.coffee file by developers or power users can trigger alerts. To manage this, create exceptions for specific user accounts known to regularly modify this file for legitimate purposes.
- Automated scripts or tools that modify the init.coffee file as part of a legitimate configuration management process may cause false positives. Identify these processes and exclude them from the rule by adding their process names to the exception list.
- Non-malicious third-party Atom packages that require modifications to the init.coffee file for functionality can be mistaken for threats. Review and whitelist these packages if they are verified as safe and necessary for user workflows.
- System maintenance or administrative tasks performed by non-root users that involve changes to the init.coffee file might be flagged. Consider adding exceptions for these specific maintenance activities if they are routine and verified as non-threatening.

### Response and remediation

- Immediately isolate the affected system from the network to prevent further execution of potentially malicious code.
- Review the contents of the `init.coffee` file to identify and document any unauthorized or suspicious code modifications.
- Remove any malicious code found in the `init.coffee` file and restore it to a known good state, either by reverting to a backup or by manually cleaning the file.
- Conduct a thorough scan of the system using updated antivirus or endpoint detection and response (EDR) tools to identify and remove any additional malware or persistence mechanisms.
- Change the credentials of the user account associated with the modified `init.coffee` file to prevent unauthorized access.
- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if other systems may be affected.
- Implement monitoring for future unauthorized changes to the `init.coffee` file and similar persistence mechanisms, enhancing detection capabilities to quickly identify and respond to similar threats."""


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1037"
name = "Boot or Logon Initialization Scripts"
reference = "https://attack.mitre.org/techniques/T1037/"

[[rule.threat.technique]]
id = "T1546"
name = "Event Triggered Execution"
reference = "https://attack.mitre.org/techniques/T1546/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[metadata]
creation_date = "2024/09/11"
integration = ["windows"]
maturity = "production"
updated_date = "2026/02/09"

[rule]
author = ["Elastic"]
description = """
Detects PowerShell scripts that uses Set-MpPreference with parameters that disable or weaken Defender.
Attackers tamper with antivirus settings to reduce detection and enable follow-on payload execution.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-windows.powershell*"]
language = "kuery"
license = "Elastic License v2"
name = "PowerShell Script with Windows Defender Tampering Capabilities"
note = """## Triage and analysis

> **Disclaimer**:
> This guide was created by humans with the assistance of generative AI. While its contents have been manually curated to include the most valuable information, always validate assumptions and adjust procedures to match your internal runbooks and incident triage and response policies.

### Investigating PowerShell Script with Windows Defender Tampering Capabilities

This alert highlights PowerShell script block activity that attempts to change Windows Defender preferences in ways that can reduce host protections. These changes are frequently used to create a window for follow-on execution (for example, staging payloads, running tools, or maintaining access with reduced scanning and response).

Triage should focus on (1) what protections were targeted and how, (2) who initiated the change and on which host(s), (3) whether the change took effect and persisted, and (4) whether there is surrounding activity that suggests initial access or follow-on malicious actions.

#### Key alert fields to review

- `user.name`, `user.domain`, `user.id`: Account execution context for correlation, prioritization, and scoping.
- `host.name`, `host.id`: Host execution context for correlation, prioritization, and scoping.
- `powershell.file.script_block_text`: Script block content that matched the detection logic.
- `powershell.file.script_block_id`, `powershell.sequence`, `powershell.total`: Script block metadata to pivot to other fragments or reconstruct full script content when split across multiple events.
- `file.path`, `file.directory`, `file.name`: File-origin context when the script block is sourced from an on-disk file.
- `powershell.file.script_block_length`: Script block length (size) context.

#### Possible investigation steps

- Review the script block content and determine the intended Defender impact:
  - Inspect `powershell.file.script_block_text` and enumerate each `Set-MpPreference` parameter present.
  - Capture whether the script is disabling protections (for example, real-time monitoring, script scanning, network file scanning) or changing default threat actions (low/moderate/high) to more permissive outcomes.
  - Note whether the script changes multiple settings in one execution, repeats the changes, or includes additional logic that suggests deliberate defense impairment rather than a single configuration adjustment.

- Reconstruct full script content when it is split across multiple events:
  - If `powershell.total` is greater than 1, pivot on `powershell.file.script_block_id` and order fragments by `powershell.sequence` to rebuild the full script.
  - Ensure you capture all fragments for the same `powershell.file.script_block_id` on the same `host.id` and `user.id` near the alert time; missing fragments can hide follow-on behavior embedded in later chunks.

- Establish scope across hosts and accounts:
  - Use `@timestamp`, `host.name` / `host.id`, and `user.name` / `user.domain` / `user.id` to determine whether the activity is isolated or distributed.
  - Look for the same user context making similar changes across multiple hosts in a short time window (suggesting automation or compromised credentials).
  - Look for multiple distinct user contexts making similar changes on the same host (suggesting lateral movement or multiple access paths).

- Determine the execution and origin context:
  - If `file.path` or `file.name` is populated, treat the activity as file-backed scripting and capture the location for scoping (where else this script exists, who can write to it, and when it was last introduced).
  - If the file fields are not populated, treat the activity as potentially interactive or dynamically generated content and expand the search for adjacent script blocks from the same `user.id` on the same `host.id` around `@timestamp` to identify staging, execution flow, or repeated attempts.

- Validate whether Defender settings were actually changed and whether the change persisted:
  - Using available endpoint security telemetry and configuration auditing, validate whether the targeted preferences were applied on the affected host(s) and whether they remained in the weakened state after the alert time.
  - Compare against your approved baseline for Defender settings and identify deviations that would materially reduce protection coverage.

- Correlate with adjacent activity to identify initial access and follow-on execution:
  - Correlate by `host.id` and time to nearby process activity to identify the PowerShell host process and its launching context (interactive use vs scheduled/automated execution vs another process initiating PowerShell).
  - Review file and network telemetry around the same time for indicators of payload staging or execution (new files written, unusual outbound connections, or repeated attempts after the change).
  - Check for repeated Defender preference modifications over time on the same host (suggesting persistent tampering) and for other suspicious activity tied to the same `user.id`.

### False positive analysis

Legitimate activity can modify Defender preferences, but it should be explainable, consistent, and controlled.

- Common benign drivers:
  - Approved endpoint management or administrative maintenance that adjusts scanning behavior for performance or operational compatibility.
  - Controlled troubleshooting where settings are temporarily changed and later restored.

- Validation questions to reduce uncertainty:
  - Does `user.id` map to an expected administrative or management identity for this host population?
  - Is the activity aligned with known maintenance windows, change records, and documented procedures?
  - Is `file.path` (when present) consistent with a known, maintained script location, and does the script content align with an approved baseline?

If the activity is benign, document the owner, expected scope (hosts/users), expected recurrence, and the intended steady-state protection posture.

### Response and remediation

If the activity is unauthorized or suspicious, treat it as a defense evasion attempt with potential follow-on actions.

- Contain and preserve evidence:
  - Prioritize affected endpoints identified by `host.id` / `host.name` and preserve relevant evidence, including the full reconstructed script from `powershell.file.script_block_id` and `powershell.file.script_block_text`.
  - Capture the initiating identity context (`user.name`, `user.domain`, `user.id`) for incident scoping and credential review.

- Restore protections and eliminate the change source:
  - Restore Windows Defender preferences to the approved baseline using authorized operational processes and verify protections are active.
  - If `file.path` is present, identify the responsible script and remove or disable unauthorized automation that applies the changes.
  - If the activity appears user-driven or interactive, investigate how the user obtained execution capability on the host and address the root cause.

- Address potential account compromise and lateral movement:
  - Review recent activity associated with the initiating account and affected hosts for signs of credential misuse, unexpected access patterns, or follow-on execution.
  - Apply appropriate credential remediation for impacted identities and review privileged access assignments relevant to the affected endpoints.

- Scope and monitor:
  - Hunt for the same Defender-tampering parameters within `powershell.file.script_block_text` across other hosts and users to identify additional impacted systems.
  - Continue monitoring for recurrence of similar preference changes tied to the same `user.id`, as repeated tampering may indicate persistence or an active intrusion.
"""
risk_score = 47
rule_id = "c124dc1b-cef2-4d01-8d74-ff6b0d5096b6"
setup = """## Setup

PowerShell Script Block Logging must be enabled to generate the events used by this rule (e.g., 4104).
Setup instructions: https://ela.st/powershell-logging-setup
"""
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Defense Evasion",
    "Data Source: PowerShell Logs",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
event.category: "process" and host.os.type:windows and
(
  powershell.file.script_block_text: "Set-MpPreference" and
  powershell.file.script_block_text: (
    DisableArchiveScanning or DisableBehaviorMonitoring or
    DisableIntrusionPreventionSystem or DisableIOAVProtection or
    DisableRemovableDriveScanning or DisableBlockAtFirstSeen or
    DisableScanningMappedNetworkDrivesForFullScan or
    DisableScanningNetworkFiles or DisableScriptScanning or
    DisableRealtimeMonitoring or LowThreatDefaultAction or
    ModerateThreatDefaultAction or HighThreatDefaultAction
  )
) and
not powershell.file.script_block_text : (
  ("cmdletization" and "cdxml-Help.xml") or
  ("function Set-MpPreference" and "Microsoft.PowerShell.Cmdletization.GeneratedTypes.MpPreference.SubmitSamplesConsentType")
) and
not file.directory : "C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\SenseCM" and
not user.id : "S-1-5-18"
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[rule.threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"



[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[rule.threat.technique.subtechnique]]
id = "T1059.001"
name = "PowerShell"
reference = "https://attack.mitre.org/techniques/T1059/001/"



[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user.id",
    "user.domain",
    "powershell.file.script_block_text",
    "powershell.file.script_block_id",
    "powershell.sequence",
    "powershell.total",
    "file.path",
    "file.directory",
    "file.name",
    "process.pid",
    "host.name",
    "host.id",
    "powershell.file.script_block_length"
]

[rule]
description = """
Identifies process creation with alternate credentials. Adversaries may create a new process with a different token to
escalate privileges and bypass access controls.
"""
id = "bd21aaa8-09d6-47d3-ba8d-78a8570199c5"
license = "Elastic License v2"
name = "Process Creation via Secondary Logon"
os_list = ["windows"]
reference = ["https://attack.mitre.org/techniques/T1134/002/"]
version = "1.0.3"

query = '''
sequence with maxspan=1m
[any where event.category == "authentication" and event.action == "log_on" and
 process.Ext.session_info.logon_type in ("Interactive", "NewCredentials", "NetworkCleartext") and
 user.effective.id like ("S-1-5-21*", "S-1-12-*") and user.id like ("S-1-5-21*", "S-1-12-*") and
 process.executable != null and not process.executable : "?:\\Windows\\System32\\svchost.exe" and
 cidrmatch(source.ip, "127.0.0.0/8", "::1")] by process.entity_id
[process where event.action == "start" and
 process.Ext.session_info.logon_type in ("Interactive", "NewCredentials", "NetworkCleartext") and
 process.parent.thread.Ext.call_stack_summary like "ntdll.dll|*|seclogon.dll|rpcrt4.dll|*" and
 not (process.code_signature.trusted == true and
      process.code_signature.subject_name in ("ZOHO Corporation Private Limited", "Bomgar Corporation", "ISL Online Ltd.",
      "Google LLC", "SCHNEIDER ELECTRIC USA, INC.", "N-ABLE TECHNOLOGIES LTD")) and
 not process.executable :
               ("C:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\*\\msedgewebview2.exe",
                "C:\\Program Files (x86)\\Varian\\OCS\\15.6\\VMS.Varis.Vishnu.exe") and
 not (process.name == "rundll32.exe" and
      process.args : ("C:\\WINDOWS\\System32\\SHELL32.dll,RunAsNewUser_RunDLL",
                      "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\ANCUtility.dll,removeAppxInUserContext"))
 ] by process.parent.entity_id
'''

min_endpoint_version = "8.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1134"
name = "Access Token Manipulation"
reference = "https://attack.mitre.org/techniques/T1134/"
[[threat.technique.subtechnique]]
id = "T1134.001"
name = "Token Impersonation/Theft"
reference = "https://attack.mitre.org/techniques/T1134/001/"

[[threat.technique.subtechnique]]
id = "T1134.002"
name = "Create Process with Token"
reference = "https://attack.mitre.org/techniques/T1134/002/"



[threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[internal]
min_endpoint_version = "8.15.0"

[metadata]
creation_date = "2023/02/28"
integration = ["endpoint", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2026/03/24"

[transform]
[[transform.osquery]]
label = "Osquery - Retrieve File Information"
query = "SELECT * FROM file WHERE path = {{file.path}}"

[[transform.osquery]]
label = "Osquery - Retrieve File Listing Information"
query = "SELECT * FROM file WHERE path LIKE '/etc/update-motd.d/%'"

[[transform.osquery]]
label = "Osquery - Retrieve Additional File Listing Information"
query = """
SELECT f.path, u.username AS file_owner, g.groupname AS group_owner, datetime(f.atime, 'unixepoch') AS
file_last_access_time, datetime(f.mtime, 'unixepoch') AS file_last_modified_time, datetime(f.ctime, 'unixepoch') AS
file_last_status_change_time, datetime(f.btime, 'unixepoch') AS file_created_time, f.size AS size_bytes FROM file f LEFT
JOIN users u ON f.uid = u.uid LEFT JOIN groups g ON f.gid = g.gid WHERE path LIKE '/etc/update-motd.d/%'
"""

[[transform.osquery]]
label = "Osquery - Retrieve Running Processes by User"
query = "SELECT pid, username, name FROM processes p JOIN users u ON u.uid = p.uid ORDER BY username"

[[transform.osquery]]
label = "Osquery - Retrieve Crontab Information"
query = "SELECT * FROM crontab"

[rule]
author = ["Elastic"]
description = """
Message of the day (MOTD) is the message that is presented to the user when a user connects to a Linux server via SSH or
a serial connection. Linux systems contain several default MOTD files located in the "/etc/update-motd.d/" directory.
These scripts run as the root user every time a user connects over SSH or a serial connection. Adversaries may create
malicious MOTD files that grant them persistence onto the target every time a user connects to the system by executing a
backdoor script or command. This rule detects the execution of potentially malicious processes through the MOTD utility.
"""
from = "now-9m"
index = ["logs-endpoint.events.process*", "endgame-*", "logs-sentinel_one_cloud_funnel.*"]
language = "eql"
license = "Elastic License v2"
name = "Process Spawned from Message-of-the-Day (MOTD)"
note = """## Triage and analysis

### Investigating Process Spawned from Message-of-the-Day (MOTD)

The message-of-the-day (MOTD) is used to display a customizable system-wide message or information to users upon login in Linux.

Attackers can abuse message-of-the-day (motd) files to run scripts, commands or malicious software every time a user connects to a system over SSH or a serial connection, by creating a new file within the `/etc/update-motd.d/` directory. Files in these directories will automatically run with root privileges when they are made executable.

This rule identifies the execution of potentially malicious processes from a MOTD script, which is not likely to occur as default benign behavior. 

> **Note**:
> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/current/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.

#### Possible Investigation Steps

- Investigate the file that was created or modified from which the suspicious process was executed.
  - $osquery_0
- Investigate whether any other files in the `/etc/update-motd.d/` directory have been altered.
  - $osquery_1
  - $osquery_2
- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence and whether they are located in expected locations.
  - $osquery_3
- Investigate other alerts associated with the user/host during the past 48 hours.
- Investigate whether the altered scripts call other malicious scripts elsewhere on the file system. 
  - If scripts or executables were dropped, retrieve the files and determine if they are malicious:
    - Use a private sandboxed malware analysis system to perform analysis.
      - Observe and collect information about the following activities:
        - Attempts to contact external domains and addresses.
          - Check if the domain is newly registered or unexpected.
          - Check the reputation of the domain or IP address.
        - File access, modification, and creation activities.
        - Cron jobs, services, and other persistence mechanisms.
            - $osquery_4

### Related Rules

- Message-of-the-Day (MOTD) File Creation - 96d11d31-9a79-480f-8401-da28b194608f

### False positive analysis

- This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently malicious must be monitored by the security team.

### Response and remediation

- Initiate the incident response process based on the outcome of the triage.
- Isolate the involved host to prevent further post-compromise behavior.
- If the triage identified malware, search the environment for additional compromised hosts.
  - Implement temporary network rules, procedures, and segmentation to contain the malware.
  - Stop suspicious processes.
  - Immediately block the identified indicators of compromise (IoCs).
  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
- Delete the MOTD files or restore them to the original configuration.
- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
- Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
"""
references = [
    "https://pberba.github.io/security/2022/02/06/linux-threat-hunting-for-persistence-initialization-scripts-and-shell-configuration/#10-boot-or-logon-initialization-scripts-motd",
]
risk_score = 73
rule_id = "4ec47004-b34a-42e6-8003-376a123ea447"
setup = """## Setup

This rule requires data coming in from Elastic Defend.

### Elastic Defend Integration Setup
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.

#### Prerequisite Requirements:
- Fleet is required for Elastic Defend.
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).

#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
- Go to the Kibana home page and click "Add integrations".
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
- Click "Add Elastic Defend".
- Configure the integration name and optionally add a description.
- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
- Click "Save and Continue".
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
"""
severity = "high"
tags = [
    "Domain: Endpoint",
    "OS: Linux",
    "Use Case: Threat Detection",
    "Tactic: Persistence",
    "Data Source: Elastic Endgame",
    "Resources: Investigation Guide",
    "Data Source: Elastic Defend",
    "Data Source: SentinelOne",
]
timestamp_override = "event.ingested"
type = "eql"
query = '''
process where event.type == "start" and host.os.type == "linux" and event.action in ("exec", "exec_event", "start") and
process.parent.executable like "/etc/update-motd.d/*" and
(
  (
    process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and
    (
      process.args : ("-i", "-l") or
      (process.parent.name == "socat" and process.parent.args : "*exec*")
    )
  ) or
  (
    process.name : ("nc", "ncat", "netcat", "nc.openbsd") and process.args_count >= 3 and 
    not process.args : ("-*z*", "-*l*")
  ) or
  (
    process.name : "python*" and process.args : "-c" and process.args : (
      "*import*pty*spawn*", "*import*subprocess*call*"
    )
  ) or
  (
    process.name : "perl*" and process.args : "-e" and process.args : "*socket*" and process.args : (
      "*exec*", "*system*"
    )
  ) or
  (
    process.name : "ruby*" and process.args : ("-e", "-rsocket") and process.args : (
      "*TCPSocket.new*", "*TCPSocket.open*"
    )
  ) or
  (
    process.name : "lua*" and process.args : "-e" and process.args : "*socket.tcp*" and process.args : (
      "*io.popen*", "*os.execute*"
    )
  ) or
  (process.name : "php*" and process.args : "-r" and process.args : "*fsockopen*" and process.args : "*/bin/*sh*") or 
  (process.name : ("awk", "gawk", "mawk", "nawk") and process.args : "*/inet/tcp/*") or 
  (process.name in ("openssl", "telnet")) or
  (
    process.args : (
      "./*", "/boot/*", "/dev/shm/*", "/etc/cron.*/*", "/etc/init.d/*", "/etc/update-motd.d/*", "/run/*", "/srv/*",
      "/tmp/*", "/var/tmp/*", "/var/log/*", "/opt/*"
    ) and process.args_count == 1
  )
) and 
not (
  process.parent.args == "--force" or
  process.args in ("/usr/games/lolcat", "/usr/bin/screenfetch") or
  process.parent.name == "system-crash-notification"
)
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1037"
name = "Boot or Logon Initialization Scripts"
reference = "https://attack.mitre.org/techniques/T1037/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"

[[rule.threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"

[[rule.threat.technique.subtechnique]]
id = "T1059.006"
name = "Python"
reference = "https://attack.mitre.org/techniques/T1059/006/"

[[rule.threat.technique.subtechnique]]
id = "T1059.011"
name = "Lua"
reference = "https://attack.mitre.org/techniques/T1059/011/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1037"
name = "Boot or Logon Initialization Scripts"
reference = "https://attack.mitre.org/techniques/T1037/"

[rule.threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"