Elastic rules: 3h

[metadata]
creation_date = "2022/08/29"
integration = ["system", "windows"]
maturity = "production"
updated_date = "2026/05/04"

[rule]
author = ["Elastic"]
description = """
Indicates the creation of a scheduled task using Windows event logs. Adversaries can use these to establish persistence,
move laterally, and/or escalate privileges.
"""
false_positives = ["Legitimate scheduled tasks may be created during installation of new software."]
from = "now-9m"
index = ["logs-system.security*", "logs-windows.forwarded*", "winlogbeat-*"]
language = "eql"
license = "Elastic License v2"
name = "A scheduled task was created"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating A scheduled task was created

Scheduled tasks in Windows automate routine tasks, enhancing efficiency. However, adversaries exploit this feature to maintain persistence, move laterally, or escalate privileges by creating malicious tasks. The detection rule identifies suspicious task creation by filtering out benign tasks and those initiated by system accounts, focusing on potential threats. This approach helps security analysts pinpoint unauthorized task creation indicative of malicious activity.

### Possible investigation steps

- Review the user account associated with the task creation to determine if it is a known and authorized user, ensuring it is not a system account by checking that the username does not end with a dollar sign.
- Examine the task name and path in the event data to identify if it matches any known benign tasks or if it appears suspicious or unfamiliar.
- Investigate the origin of the task creation by checking the source IP address or hostname, if available, to determine if it aligns with expected network activity.
- Check the task's scheduled actions and triggers to understand what the task is designed to execute and when, looking for any potentially harmful or unexpected actions.
- Correlate the task creation event with other security events or logs around the same time to identify any related suspicious activities or anomalies.

### False positive analysis

- Scheduled tasks created by system accounts or computer accounts are often benign. These can be excluded by filtering out user names ending with a dollar sign, which typically represent system accounts.
- Tasks associated with common software updates or maintenance, such as those from Hewlett-Packard or Microsoft Visual Studio, are generally non-threatening. These can be excluded by specifying their full task names in the exclusion list.
- OneDrive update tasks are frequently triggered and are usually safe. Exclude these by using patterns that match their task names, such as those starting with "OneDrive Standalone Update Task".
- Regularly review and update the exclusion list to include any new benign tasks that are identified over time, ensuring that the rule remains effective without generating unnecessary alerts.

### Response and remediation

- Immediately isolate the affected system from the network to prevent potential lateral movement by the adversary.
- Terminate any suspicious scheduled tasks identified by the alert to halt any ongoing malicious activity.
- Conduct a thorough review of the system's scheduled tasks to identify and remove any other unauthorized or suspicious tasks.
- Restore the system from a known good backup if any malicious activity has been confirmed and has potentially compromised system integrity.
- Update and patch the system to the latest security standards to close any vulnerabilities that may have been exploited.
- Monitor the system and network for any signs of re-infection or further unauthorized scheduled task creation.
- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if additional systems are affected."""
references = ["https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4698"]
risk_score = 21
rule_id = "92a6faf5-78ec-4e25-bea1-73bacc9b59d9"
severity = "low"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Persistence",
    "Data Source: Windows Security Event Logs",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
iam where host.os.type == "windows" and event.action == "scheduled-task-created" and

 /* excluding tasks created by the computer account */
 not user.name : "*$" and

 /* TaskContent is not parsed, exclude by full taskname noisy ones */
 not winlog.event_data.TaskName : (
              "\\CreateExplorerShellUnelevatedTask",
              "\\Hewlett-Packard\\HPDeviceCheck",
              "\\Hewlett-Packard\\HP Support Assistant\\WarrantyChecker",
              "\\Hewlett-Packard\\HP Support Assistant\\WarrantyChecker_backup",
              "\\Hewlett-Packard\\HP Web Products Detection",
              "\\Microsoft\\VisualStudio\\Updates\\BackgroundDownload",
              "\\OneDrive Standalone Update Task-S-1-5-21*",
              "\\OneDrive Standalone Update Task-S-1-12-1-*",
              "\\SoftLanding\\S-1-5-21-*\\SoftLanding*",
              "\\SoftLanding\\S-1-12-*\\SoftLanding*",
              "\\OneDrive Reporting Task-S-1-5-21-*",
              "\\OneDrive Reporting Task-S-1-12-1-*",
              "\\GoogleUserPEH\\RunPlatformExperienceHelper*",
              "\\Mozilla\\Firefox Default Browser Agent*",
              "\\Microsoft\\Office\\Office Background Push Maintenance",
              "\\Microsoft\\Windows\\GroupPolicy\\GPUpdate"
 )
'''

setup = """## Setup

Audit Other Object Access Events must be enabled to generate the events used by this rule.
Setup instructions: https://ela.st/audit-other-object-access-events
"""


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1053"
name = "Scheduled Task/Job"
reference = "https://attack.mitre.org/techniques/T1053/"
[[rule.threat.technique.subtechnique]]
id = "T1053.005"
name = "Scheduled Task"
reference = "https://attack.mitre.org/techniques/T1053/005/"



[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[rule]
description = """
Identifies access attempt to web browser's credential store data and from a memory region with suspicious properties.
Adversaries may steal credentials from web browsers by reading files specific to the target browser.
"""
id = "808395cd-fb50-4eba-846c-aabcf212c256"
license = "Elastic License v2"
name = "Access to Browser Credentials from Suspicious Memory"
os_list = ["windows"]
reference = [
    "https://www.elastic.co/security-labs/globally-distributed-stealers",
    "https://www.elastic.co/security-labs/detect-credential-access",
    "https://www.elastic.co/security-labs/upping-the-ante-detecting-in-memory-threats-with-kernel-call-stacks",
]
version = "1.0.41"

query = '''
file where event.type == "access" and process.pid != 4 and
 process.executable != null and process.name != null and event.outcome == "success" and
 process.thread.Ext.call_stack_summary != null and
  (
   file.name : ("logins.json", "cert?.db", "key?.db", "signons.sqlite", "cookies.sqlite") or
    file.path :
           ("?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\User Data\\Local State",
            "?:\\Users\\*\\AppData\\Local\\Microsoft\\Edge\\User Data\\Local State",
            "?:\\users\\*\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data",
            "?:\\Users\\*\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Login Data")
  ) and
    (
      /* Abnormal private bytes allocation for the dropped PE when loaded in memory */
      _arraysearch(process.thread.Ext.call_stack, $entry, $entry.allocation_private_bytes >= 100000) or

      process.thread.Ext.call_stack_contains_unbacked == true or

      process.thread.Ext.call_stack_summary : "*python*.dll*"
    ) and

    not (process.code_signature.status : ("trusted", "errorExpired", "errorCode_endpoint*") and
         process.executable : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*") and
         process.thread.Ext.call_stack_summary :
            ("*mscorlib.dll*", "*|clr.dll*", "*coreclr.dll*", "*mscoreei.dll*", "*mscoree.dll*", "*system.ni.dll*",
             "*mscorlib.ni.dll*", "*mscorwks.dll*", "*mscorsvc.dll*", "*system.private.corelib.dll*", "*system.data.ni.dll*")) and
    not (process.code_signature.subject_name == "Guardicore Ltd" and process.code_signature.status == "errorExpired") and
    not (process.code_signature.trusted == true and
         process.code_signature.subject_name :
                                ("Trichilia Consultants Limited", "Bitdefender SRL", "Opera Norway AS", "FireEye, Inc.",
                                 "Mozilla Corporation", "Google LLC", "Rapid7 LLC", "Cybereason, Inc", "Watchdata Technologies Pte. Ltd.", 
                                 "Cylance, Inc.", "Bromium, Inc.", "ONELAUNCH TECHNOLOGIES INC.", "philandro Software GmbH", 
                                 "Eric R. Zimmerman", "CISCO SYSTEMS CANADA CO", "Cisco Systems, Inc.", "Fiserv", "Fiserv, Inc.", 
                                 "Garmin International, Inc.", "AVG Technologies USA, LLC", "Senior Sistemas S/A", "TEAMDEV LTD.",
                                 "Spotify AB", "SIV - Service für Informationsverarbeitung AG", "Postman, Inc.",
                                 "Tencent Technology (Shenzhen) Company Limited", "Doist Inc.", "GAIJIN NETWORK LTD",
                                 "Beijing Qihu Technology Co., Ltd.", "OpenJS Foundation", "Figma, Inc.", "LogMeIn, Inc.", "Agilebits",
                                 "Canva", "AnyDesk Software GmbH", "Arduino SA", "Lenovo", "Wavesor Software (Eightpoint Technologies Ltd. SEZC)",
                                 "Sabre Glbl Inc.", "WorkingGreen B.V.", "Dedalus Italia S.P.A.", "Cisco WebEx LLC", "Shift Technologies Inc.",
                                 "Vivaldi Technologies AS", "CYNET SECURITY LTD", "Cisco Systems, Inc.", "Adobe Inc.", "Kaseya Holdings Inc",
                                 "London Jamocha Community CIC", "MUSARUBRA US LLC", "HP Inc.", "SAP SE", "JetBrains s.r.o.", "Exclaimer Ltd",
                                 "Absolute Software Corp.", "YANDEX LLC", "timeBro GmbH", "TeamDev Management*", "Zhuhai Kingsoft Office Software Co., Ltd.",
                                 "Sky International AG", "Reason Cybersecurity Inc.", "SnelStart Software B.V.", "7270356 Canada Inc.", "Andrew Ziem",
                                 "Grammarly, Inc.", "ESET, spol. s r.o.", "memtime GmbH", "Code Systems Corporation")) and
    not (process.code_signature.trusted == true and process.executable : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*")) and
    not process.executable :
                ("?:\\Program Files (x86)\\VMware\\Plug-in Service\\certutil.exe",
                 "?:\\Program Files (x86)\\Haystack Software\\Arq 5\\ArqAgent.exe",
                 "C:\\Program Files (x86)\\EDconnect8\\EDconnect8.exe",
                 "C:\\Program Files (x86)\\Sage\\Sage HRMS Client\\Abra32.exe",
                 "C:\\Program Files\\Datacard\\TruCredential\\CaptureManager\\bin\\Datacard.DCCM.CaptureManager.exe") and
    not (user.id : "S-1-5-18" and
         process.executable : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*")) and
    not process.name : "powershell.exe" and
    not (process.executable : "C:\\Windows\\Sys*\\msiexec.exe" and user.id == "S-1-5-18") and
    not process.thread.Ext.call_stack_summary : ("*mscorlib.ni.dll|Unbacked*") and
    not _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info: "Unbacked*" and
                    $entry.callsite_trailing_bytes :
                        ("48890665488b1425300000008b5268488bcb41ff542420488b064903e6eb17488bcb41ff5424384883f8087e06488b46f8eb034833c04883c420415e415c5f5e",
                         "4c8b5424500bc00f85a600000041807a02000f849700000041807a02017409418b4274e98b000000410fb74272415241ff726841ff726041ff725841ff725041")) and
    not (process.executable : "?:\\Users\\*\\AppData\\Local\\Programs\\WebSGD\\certutil.exe" and file.name : ("cert?.db", "key?.db")) and 
    not _arraysearch(process.thread.Ext.call_stack, $entry,
                     $entry.symbol_info : ("?:\\Program Files\\*.dll*",
                                           "?:\\Program Files (x86)\\*.dll*",
                                           "?:\\windows\\system32\\*\\tmmon*.dll*",
                                           "?:\\Windows\\SysWOW64\\esensordbi.dll*",
                                           "?:\\Windows\\System32\\esensordbi.dll*",
                                           "?:\\Windows\\System32\\umppc*.dll*",
                                           "?:\\Windows\\FireEye\\AppMonitorDll*.dll*",
                                           "?:\\Windows\\apppatch\\AppPatch*\\exploitblocker.dll*",
                                           "?:\\windows\\system32\\hmpalert.dll*",
                                           "\\Device\\Mup\\*",
                                           "*\\msedge.dll!argon2_encodedlen*",
                                           "?:\\Windows\\eMweb\\softokn3.dll*")) and
    not file.path :
             ("?:\\Users\\*\\AppData\\Roaming\\arduino-ide\\Local State",
              "?:\\users\\*\\ebwebview\\local state",
              "?:\\users\\*\\ebwebview\\default\\login data",
              "?:\\Users\\*\\chrome-device\\Default\\Login Data",
              "?:\\users\\*\\ebwebview\\*\\login data",
              "?:\\Users\\*_tools_chrome_device.*", 
              "?:\\Users\\*\\AppData\\Local\\Temp\\sunapsis-jxbrowser\\*\\Login Data") and
    not process.thread.Ext.call_stack_summary like
                      ("ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|hmpalert.dll|*",
                       "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|aclayers.dll|*",
                       "ntdll.dll|kernelbase.dll|userenv.dll|profsvc.dll|rpcrt4.dll|*",
                       "ntdll.dll|kernelbase.dll|mscorlib.ni.dll|Unbacked",
                       "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|libwautils.dll|libwalocal.dll|libwautils.dll|libwaapi.dll|Unbacked|coreclr.dll|Unbacked",
                       "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked|clr.dll|mscoreei.dll|mscoree.dll|ntdll.dll",
                       "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|tmmon.dll|Unbacked|kernelbase.dll|aclayers.dll|*",
                       "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked|clr.dll|kernel32.dll|ntdll.dll",
                       "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|browserdefmgr.dll|kernel32.dll|ntdll.dll",
                       "ntdll.dll|kernelbase.dll|mscorlib.ni.dll|system.management.automation.ni.dll|microsoft.powershell.commands.management.ni.dll|system.management.automation.ni.dll|Unbacked",
                       "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|browsersettings.dll|kernel32.dll|ntdll.dll",
                       "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|sophosed.dll|kernelbase.dll|Unbacked|clr.dll|kernel32.dll|ntdll.dll",
                       "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|sophosed.dll|kernelbase.dll|hmpalert.dll|rsaenh.dll|cryptsp.dll|clr.dll|mscorlib.ni.dll|system.ni.dll|Unbacked|mscorlib.ni.dll|clr.dll|Unbacked",
                       "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|sophosed.dll|kernelbase.dll|hmpalert.dll|windows.security.authentication.onlineid.dll|ntdll.dll|kernel32.dll|ntdll.dll")
'''

min_endpoint_version = "8.10.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1539"
name = "Steal Web Session Cookie"
reference = "https://attack.mitre.org/techniques/T1539/"

[[threat.technique]]
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"
[[threat.technique.subtechnique]]
id = "T1552.001"
name = "Credentials In Files"
reference = "https://attack.mitre.org/techniques/T1552/001/"


[[threat.technique]]
id = "T1555"
name = "Credentials from Password Stores"
reference = "https://attack.mitre.org/techniques/T1555/"
[[threat.technique.subtechnique]]
id = "T1555.003"
name = "Credentials from Web Browsers"
reference = "https://attack.mitre.org/techniques/T1555/003/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "8.10.0"

[metadata]
bypass_bbr_timing = true
creation_date = "2024/06/22"
integration = ["aws"]
maturity = "production"
updated_date = "2026/08/05"

[rule]
author = ["Elastic"]
building_block_type = "default"
description = """
Identifies when an AWS RDS DB Snapshot is created. This can be used to evade defenses by allowing an attacker to bypass access controls
or cover their tracks by reverting an instance to a previous state. This is a [building block
rule](https://www.elastic.co/guide/en/security/current/building-block-rule.html) and does not generate alerts on
its own. It is meant to be used for correlation with other rules to detect suspicious activity. To generate alerts, create a
rule that uses this signal as a building block.
"""
false_positives = [
    """
    Legitimate manual or automated snapshots created for backups can trigger this rule. Ensure that the snapshots are authorized and align with your organization's policies.
    """,
]
from = "now-60m"
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
interval = "10m"
language = "kuery"
license = "Elastic License v2"
name = "AWS RDS DB Snapshot Created"
risk_score = 21
rule_id = "68c5c9d1-38e5-48bb-b1b2-8b5951d39738"
severity = "low"
tags = [
    "Domain: Cloud",
    "Platform: AWS",
    "Data Source: AWS CloudTrail",
    "Service: AWS RDS",
    "Tactic: Defense Evasion",
    "Rule Type: BBR",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
event.dataset: "aws.cloudtrail" and event.provider: "rds.amazonaws.com" 
    and event.action: ("CreateDBSnapshot" or "CreateDBClusterSnapshot") and event.outcome: "success" 
    and not user_agent.original: (*Terraform* or *Pulumi*)
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1578"
name = "Modify Cloud Compute Infrastructure"
reference = "https://attack.mitre.org/techniques/T1578/"
[[rule.threat.technique.subtechnique]]
id = "T1578.001"
name = "Create Snapshot"
reference = "https://attack.mitre.org/techniques/T1578/001/"


[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[metadata]
creation_date = "2024/05/24"
integration = ["aws"]
maturity = "production"
updated_date = "2026/08/05"

[rule]
author = ["Elastic"]
description = """
An adversary with access to a set of compromised credentials may attempt to verify that the credentials are valid and
determine what account they are using. This rule looks for the first time an identity has called the
STS GetCallerIdentity API, which may be an indicator of compromised credentials.
A legitimate user would not need to perform this operation as they should know the account they are using.
"""
false_positives = [
    """
    Verify whether the user identity should be using the STS GetCallerIdentity API.
    If known behavior is causing false positives, it can be exempted from the rule.
    """,
]
from = "now-6m"
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
interval = "5m"
language = "kuery"
license = "Elastic License v2"
name = "AWS STS GetCallerIdentity API Called for the First Time"
note = """## Triage and analysis

### Investigating AWS STS GetCallerIdentity API Called for the First Time

AWS Security Token Service (AWS STS) is a service that enables you to request temporary, limited-privilege credentials for users.
The `GetCallerIdentity` API returns details about the IAM user or role owning the credentials used to perform the operation.
No permissions are required to run this operation and the same information is returned even when access is denied.
This rule looks for use of the `GetCallerIdentity` API, excluding the `AssumedRole` identity type as use of `GetCallerIdentity` after assuming a role is common practice. This is a [New Terms](https://www.elastic.co/guide/en/security/current/rules-ui-create.html#create-new-terms-rule) rule indicating the first time a specific user identity has performed this operation.

#### Possible investigation steps

- Identify the account and its role in the environment.
- Identify the applications or users that should use this account.
- Investigate other alerts associated with the account during the past 48 hours.
- Investigate abnormal values in the `user_agent.original` field by comparing them with the intended and authorized usage and historical data. Suspicious user agent values include non-SDK, AWS CLI, custom user agents, etc.
- Assess whether this behavior is prevalent in the environment by looking for similar occurrences involving other users.
- Contact the account owner and confirm whether they are aware of this activity.
- Considering the source IP address and geolocation of the user who issued the command:
    - Do they look normal for the calling user?
    - If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts or is the source IP from an EC2 instance that's not under your control?
- Review IAM permission policies for the user identity.
- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.

### False positive analysis

- False positives may occur due to the intended usage of the service. Tuning is needed in order to have higher confidence. Consider adding exceptions — preferably with a combination of user agent and IP address conditions.
- Automation workflows that rely on the results from this API request may also generate false-positives. We recommend adding exceptions related to the `user.id` or `aws.cloudtrail.user_identity.arn` values to ignore these.

### Response and remediation

- Initiate the incident response process based on the outcome of the triage.
- Disable or limit the account during the investigation and response.
- Identify the possible impact of the incident and prioritize accordingly; the following actions can help you gain context:
    - Identify the account role in the cloud environment.
    - Assess the criticality of affected services and servers.
    - Work with your IT team to identify and minimize the impact on users.
    - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
    - Identify any regulatory or legal ramifications related to this activity.
- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Rotate secrets or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
- Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.
- Consider enabling multi-factor authentication for users.
- Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
- Implement security best practices [outlined](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/) by AWS.
- Take the actions needed to return affected systems, data, or services to their normal operational levels.
- Identify the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
"""
references = [
    "https://docs.aws.amazon.com/STS/latest/APIReference/API_GetCallerIdentity.html",
    "https://www.secureworks.com/research/detecting-the-use-of-stolen-aws-lambda-credentials",
    "https://detectioninthe.cloud/ttps/discovery/sts_get_caller_identity",
]
risk_score = 47
rule_id = "30fbf4db-c502-4e68-a239-2e99af0f70da"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Platform: AWS",
    "Data Source: AWS CloudTrail",
    "Service: AWS STS",
    "Tactic: Discovery",
    "Rule Type: New Terms",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "new_terms"

query = '''
data_stream.dataset: "aws.cloudtrail"
    and event.provider: "sts.amazonaws.com"
    and event.action: "GetCallerIdentity"
    and event.outcome: "success"
    and not aws.cloudtrail.user_identity.type: "AssumedRole"
    and not user_agent.original: (*Terraform* or *terraform* or *Pulumi* or *eksctl*)
'''

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user_agent.original",
    "source.ip",
    "aws.cloudtrail.user_identity.arn",
    "aws.cloudtrail.user_identity.type",
    "aws.cloudtrail.user_identity.access_key_id",
    "event.action",
    "event.outcome",
    "cloud.account.id",
    "cloud.region"
]

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1033"
name = "System Owner/User Discovery"
reference = "https://attack.mitre.org/techniques/T1033/"

[[rule.threat.technique]]
id = "T1087"
name = "Account Discovery"
reference = "https://attack.mitre.org/techniques/T1087/"

[[rule.threat.technique.subtechnique]]
id = "T1087.004"
name = "Cloud Account"
reference = "https://attack.mitre.org/techniques/T1087/004/"

[rule.threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"
[rule.new_terms]
field = "new_terms_fields"
value = ["aws.cloudtrail.user_identity.arn"]
[[rule.new_terms.history_window_start]]
field = "history_window_start"
value = "now-10d"

[metadata]
creation_date = "2020/06/09"
integration = ["aws"]
maturity = "production"
updated_date = "2026/08/05"

[rule]
author = ["Elastic"]
description = """
Identifies the deletion of an AWS Web Application Firewall (WAF) rule or rule group. WAF rules and rule groups enforce
critical protections for web applications by filtering malicious HTTP requests, blocking known attack patterns, and
enforcing access controls. Deleting these rules—even briefly—can expose applications to SQL injection, cross-site
scripting, credential-stuffing bots, or targeted exploitation. Adversaries who have gained sufficient permissions may
remove WAF protections as part of a broader defense evasion or impact strategy, often preceding data theft or direct
application compromise.
"""
false_positives = [
    """
    Routine WAF maintenance, rule lifecycle updates, or temporary rule removals during application changes may trigger
    this alert. Validate whether the principal, source IP, automation role, or deployment pipeline is expected to modify
    WAF rules. Confirm that the deletion corresponds to a documented change or deployment before taking action.
    """,
]
from = "now-6m"
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
language = "kuery"
license = "Elastic License v2"
name = "AWS WAF Rule or Rule Group Deletion"
note = """## Triage and analysis

### Investigating AWS WAF Rule or Rule Group Deletion

AWS WAF rules and rule groups define the security boundary for web applications by blocking malicious inputs,
enforcing rate-based protections, and applying managed or custom signatures. Deleting a rule or rule group immediately
weakens this boundary. Adversaries who obtain sufficient permissions may delete these protections to remove detection of malicious payloads prior to exploitation or erase defenses protecting high-value APIs. 

This rule detects successful `DeleteRule` or `DeleteRuleGroup` API calls in CloudTrail.

### Possible investigation steps

**Identify the actor**
- Review `aws.cloudtrail.user_identity.arn` and `user_identity.access_key_id` to determine which principal performed the deletion.
- Determine whether the principal normally manages WAF resources or appears anomalous (new key, unused IAM role, unexpected federation source).

**Inspect the request context**
- Review `source.address`, `source.geo` fields, and `user_agent.original` to determine if the request originated from a known enterprise IP range, a CI/CD runner or automation tool, an unfamiliar network, region, or browser/CLI pattern.

**Understand what was deleted**
- Review `aws.cloudtrail.request_parameters` for `RuleId` or `RuleGroupId`, any referenced WebACLs using the rule, metadata indicating whether the deleted rule was part of production traffic control. 

**Correlate surrounding activity**
- Look for adjacent CloudTrail events:
  - modifications to WebACLs (`UpdateWebACL`)
  - creation of permissive rules (`CreateRule`, `PutRule`) after deletion  
  - IAM privilege escalation events  
  - unusual S3, API Gateway, or ALB access patterns immediately after the rule deletion  
- Determine if deletion preceded or followed exploit attempts visible in application logs.

**Establish operational context**
- Confirm whether the deletion aligns with a deployment pipeline, scheduled maintenance, rule tuning by security teams. If not, treat the event as potentially malicious.

**Engage relevant owners**
- Contact application security or platform engineering teams to verify whether the rule or rule group deletion was authorized.

### False positive analysis

- **Authorized deployment workflows**  
  Some organizations rebuild WAF rules programmatically during deployments. Validate expected CI/CD service roles and event timing.

- **Automated rule regeneration**  
  Certain WAF-as-code approaches temporarily delete and recreate rules. Confirm if the event corresponds to an expected automation cycle.

- **Security team testing**  
  Teams may temporarily disable or remove rules during testing of new signatures or rate controls. Verify scheduling and ownership.

- **Non-production environments**  
  Development or staging accounts may routinely alter WAF rules. Tune the rule by account, environment tags, or namespaces to reduce noise.

### Response and remediation

- **Contain the incident**
  - Immediately verify whether the deletion was intentional.
  - If unauthorized, revoke active access keys or disable implicated IAM roles/sessions.

- **Reinstate protections**
  - Restore the deleted rule or rule group from infrastructure-as-code definitions, backups, or documented configuration.
  - Inspect associated WebACLs to ensure no additional rules were removed or modified.

- **Investigate follow-on activity**
  - Review application logs for suspicious requests following WAF rule removal.
  - Investigate potential exploitation attempts (SQLi, XSS, API abuse, authentication bypass).

- **Harden IAM and WAF governance**
  - Limit WAF deletion operations to tightly controlled IAM roles.
  - Enforce MFA and short session durations for privileged accounts.
  - Consider guardrails using AWS Config or SCPs to prevent deletion of production WAF rules.

- **Post-incident improvements**
  - Update runbooks to track planned WAF changes.
  - Strengthen CI/CD guardrails to prevent unauthorized rule manipulation.
  - Enhance alerting for other high-risk WAF configuration changes.

### Additional information

- **DeleteRule API (WAF Classic & Regional)**  
  https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_DeleteRule.html  
- **DeleteRuleGroup API (WAFv2)**  
  https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_DeleteRuleGroup.html   
- **[AWS IR Playbooks](https://github.com/aws-samples/aws-incident-response-playbooks/blob/c151b0dc091755fffd4d662a8f29e2f6794da52c/playbooks/)** 
- **[AWS Customer Playbook Framework](https://github.com/aws-samples/aws-customer-playbook-framework/tree/a8c7b313636b406a375952ac00b2d68e89a991f2/docs)** 
- **[AWS Knowledge Center – Security Best Practices](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/)**
"""
references = [
    "https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_DeleteRule.html",
    "https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_DeleteRuleGroup.html",
]
risk_score = 47
rule_id = "5beaebc1-cc13-4bfc-9949-776f9e0dc318"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Platform: AWS",
    "Data Source: AWS CloudTrail",
    "Service: AWS WAF",
    "Tactic: Defense Evasion",
    "Rule Type: Custom Query (KQL)",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset: aws.cloudtrail 
    and event.provider: (waf.amazonaws.com or waf-regional.amazonaws.com or wafv2.amazonaws.com) 
    and event.action: (DeleteRule or DeleteRuleGroup) 
    and event.outcome: success
    and not user_agent.original: (*Terraform* or *Pulumi*)
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[rule.threat.technique.subtechnique]]
id = "T1562.007"
name = "Disable or Modify Cloud Firewall"
reference = "https://attack.mitre.org/techniques/T1562/007/"



[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user_agent.original",
    "source.ip",
    "aws.cloudtrail.user_identity.arn",
    "aws.cloudtrail.user_identity.type",
    "aws.cloudtrail.user_identity.access_key_id",
    "event.action",
    "event.outcome",
    "cloud.account.id",
    "cloud.region",
    "aws.cloudtrail.request_parameters",
]

[metadata]
creation_date = "2021/05/06"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2026/05/04"

[rule]
author = ["Elastic", "Ivan Ninichuck", "Austin Songer"]
description = """
Identifies attempts to disable EventLog via the logman Windows utility, PowerShell, or auditpol. This is often done by
attackers in an attempt to evade detection on a system.
"""
from = "now-9m"
index = [
    "endgame-*",
    "logs-crowdstrike.fdr*",
    "logs-endpoint.events.process-*",
    "logs-m365_defender.event-*",
    "logs-sentinel_one_cloud_funnel.*",
    "logs-system.security*",
    "logs-windows.forwarded*",
    "logs-windows.sysmon_operational-*",
    "winlogbeat-*",
]
language = "eql"
license = "Elastic License v2"
name = "Disable Windows Event and Security Logs Using Built-in Tools"
note = """## Triage and analysis

### Investigating Disable Windows Event and Security Logs Using Built-in Tools

Windows event logs are a fundamental data source for security monitoring, forensics, and incident response. Adversaries can tamper, clear, and delete this data to break SIEM detections, cover their tracks, and slow down incident response.

This rule looks for the usage of different utilities to disable the EventLog service or specific event logs.

#### Possible investigation steps

- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
- Identify the user account that performed the action and whether it should perform this kind of action.
- Contact the account owner and confirm whether they are aware of this activity.
- Investigate other alerts associated with the user/host during the past 48 hours.
  - Verify if any other anti-forensics behaviors were observed.
- Investigate the event logs prior to the action for suspicious behaviors that an attacker may be trying to cover up.

### False positive analysis

- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.

### Response and remediation

- Initiate the incident response process based on the outcome of the triage.
- Isolate the involved host to prevent further post-compromise behavior.
- Re-enable affected logging components, services, and security monitoring.
- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
"""

setup = """## Setup

This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.

Setup instructions: https://ela.st/install-elastic-defend

### Additional data sources

This rule also supports the following third-party data sources. For setup instructions, refer to the links below:

- [CrowdStrike](https://ela.st/crowdstrike-integration)
- [Microsoft Defender XDR](https://ela.st/m365-defender)
- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
- [Sysmon Event ID 1 - Process Creation](https://ela.st/sysmon-event-1-setup)
- [Windows Process Creation Logs](https://ela.st/audit-process-creation)
"""

references = [
    "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/logman",
    "https://medium.com/palantir/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63",
]
risk_score = 21
rule_id = "4de76544-f0e5-486a-8f84-eae0b6063cdc"
severity = "low"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Defense Evasion",
    "Resources: Investigation Guide",
    "Data Source: Elastic Endgame",
    "Data Source: Elastic Defend",
    "Data Source: Windows Security Event Logs",
    "Data Source: Microsoft Defender XDR",
    "Data Source: Sysmon",
    "Data Source: SentinelOne",
    "Data Source: Crowdstrike",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
process where host.os.type == "windows" and event.type == "start" and
(
  (
    (process.name:"logman.exe" or ?process.pe.original_file_name == "Logman.exe") and
    process.args : "EventLog-*" and process.args : ("stop", "delete")
  ) or
  (
    (
      process.name : ("pwsh.exe", "powershell.exe", "powershell_ise.exe") or
      ?process.pe.original_file_name in ("PowerShell.EXE", "pwsh.dll", "powershell_ise.EXE")
    ) and
	  process.args : "Set-Service" and process.args: "EventLog" and process.args : "Disabled"
  )  or
  (
    (process.name:"auditpol.exe" or ?process.pe.original_file_name == "AUDITPOL.EXE") and process.args : "/success:disable"
  )
)
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1070"
name = "Indicator Removal"
reference = "https://attack.mitre.org/techniques/T1070/"
[[rule.threat.technique.subtechnique]]
id = "T1070.001"
name = "Clear Windows Event Logs"
reference = "https://attack.mitre.org/techniques/T1070/001/"


[[rule.threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[rule.threat.technique.subtechnique]]
id = "T1562.002"
name = "Disable Windows Event Logging"
reference = "https://attack.mitre.org/techniques/T1562/002/"

[[rule.threat.technique.subtechnique]]
id = "T1562.006"
name = "Indicator Blocking"
reference = "https://attack.mitre.org/techniques/T1562/006/"



[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[metadata]
creation_date = "2026/01/21"
integration = ["cloud_defend"]
maturity = "production"
min_stack_comments = "Defend for Containers integration was re-introduced in 9.3.0"
min_stack_version = "9.3.0"
updated_date = "2026/07/29"

[rule]
author = ["Elastic"]
description = """
This rule detects the execution of DNS enumeration tools inside a container. DNS enumeration tools are used to
enumerate the DNS servers and domains of the container, which can be used by an adversary to gain information about
the network configuration of the container and the services running inside it.
"""
false_positives = [
    """
    There is a potential for false positives if the DNS enumeration tools are used for legitimate purposes,
    such as debugging or troubleshooting. It is important to investigate any alerts generated by this rule to determine
    if they are indicative of malicious activity or part of legitimate container activity.
    """,
]
from = "now-6m"
index = ["logs-cloud_defend.process*"]
interval = "5m"
language = "eql"
license = "Elastic License v2"
name = "DNS Enumeration Detected via Defend for Containers"
note = """ ## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating DNS Enumeration Detected via Defend for Containers

This rule flags use of DNS utilities (nslookup, dig, host, or getent hosts) inside a Linux container that query internal Kubernetes names such as kubernetes.default or *.svc.cluster.local, signaling in-cluster service discovery. After compromising a pod, an attacker opens an interactive shell and runs nslookup kubernetes.default or dig *.svc.cluster.local to enumerate services and namespaces, map reachable endpoints, and stage lateral movement toward the API server, internal dashboards, or other pods.

### Possible investigation steps

- Correlate with Kubernetes audit logs to see if a kubectl exec/attach or ephemeral container was launched into this pod at the same time and identify the requesting user, source IP, and service account identity.
- Pull pod metadata (namespace, owner workload, node, image digest, service account) and verify whether this is a sanctioned troubleshooting/debug context by checking image baseline and change tickets.
- Examine command history and process lineage within the container around the alert to spot follow‑on actions such as reading /var/run/secrets/kubernetes.io/serviceaccount, querying the API server, installing tools, or scanning internal ranges.
- Review DNS and network telemetry from the pod (CoreDNS logs, CNI flow logs) to map the queried hostnames and any subsequent connections to internal services or the API server.
- If unauthorized activity is suspected, isolate the pod via network policy or eviction, rotate the pod’s service account token and related secrets, and redeploy from a trusted image while investigating node and registry access paths.

### False positive analysis

- An authorized operator attaches an interactive shell to a pod for in-cluster troubleshooting and runs nslookup/dig/host or getent hosts against kubernetes.default or *.svc.cluster.local, matching the rule but expected.
- A pod or initContainer configured with tty: true or stdin enabled executes startup/readiness logic that calls getent hosts or nslookup on internal service FQDNs (*.svc.cluster.local), which is benign but appears as interactive enumeration.

### Response and remediation

- Immediately isolate the affected pod by applying a deny‑egress NetworkPolicy to the CoreDNS service and cluster service CIDRs, terminate the interactive shell that ran nslookup/dig/host or getent hosts, and temporarily block kubectl exec/attach to the workload.
- Evict the pod and redeploy from a trusted image digest, removing any ephemeral containers added for debugging and uninstalling ad‑hoc packages (e.g., dnsutils, busybox) that were introduced into the container.
- Rotate credentials by deleting and reissuing the workload’s service account token and any mounted secrets or registry credentials, then verify the new pod does not perform interactive lookups of kubernetes.default or *.svc.cluster.local.
- Escalate to incident response if enumeration originates from a production namespace, a privileged service account, or is followed by reading /var/run/secrets/kubernetes.io/serviceaccount or curl/wget to https://kubernetes.default, or if similar activity is observed across multiple pods.
- Harden going forward by restricting exec/attach via RBAC, enforcing Admission Controls/Pod Security to disallow tty/stdin and unauthorized ephemeral containers, limiting egress to CoreDNS and internal services with NetworkPolicies, and using distroless/stripped images that omit nslookup/dig/host.
"""
risk_score = 21
rule_id = "74ee9a2d-5ed3-40c8-9e6c-523d2e6a17ef"
severity = "low"
tags = [
    "Data Source: Elastic Defend for Containers",
    "Domain: Container",
    "OS: Linux",
    "Use Case: Threat Detection",
    "Tactic: Discovery",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"
query = '''
process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and
container.id like "*" and 
(
  /* getent hosts is often used without a target arg */
  (process.name == "getent" and process.args == "hosts") or

  /* explicit DNS query tools */
  (
    process.name in ("nslookup", "dig", "host") or
    (
      /* Account for tools that execute utilities as a subprocess, in this case the target utility name will appear as a process arg */
      process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "busybox") and
      process.args in (
        "nslookup", "/bin/nslookup", "/usr/bin/nslookup", "/usr/local/bin/nslookup",
        "dig", "/bin/dig", "/usr/bin/dig", "/usr/local/bin/dig",
        "host", "/bin/host", "/usr/bin/host", "/usr/local/bin/host"
      ) and
      /* default exclusion list to not FP on default multi-process commands */
      not process.args in (
        "which", "/bin/which", "/usr/bin/which", "/usr/local/bin/which",
        "man", "/bin/man", "/usr/bin/man", "/usr/local/bin/man",
        "chmod", "/bin/chmod", "/usr/bin/chmod", "/usr/local/bin/chmod",
        "chown", "/bin/chown", "/usr/bin/chown", "/usr/local/bin/chown"
      )
    )
  ) and
  process.args like~ (
    "kubernetes.default",
    "kubernetes",
    "*.svc",
    "*.svc.cluster.local",
    "*.cluster.local"
  )
)
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1016"
name = "System Network Configuration Discovery"
reference = "https://attack.mitre.org/techniques/T1016/"

[[rule.threat.technique]]
id = "T1018"
name = "Remote System Discovery"
reference = "https://attack.mitre.org/techniques/T1018/"

[[rule.threat.technique]]
id = "T1046"
name = "Network Service Discovery"
reference = "https://attack.mitre.org/techniques/T1046/"

[[rule.threat.technique]]
id = "T1049"
name = "System Network Connections Discovery"
reference = "https://attack.mitre.org/techniques/T1049/"

[[rule.threat.technique]]
id = "T1613"
name = "Container and Resource Discovery"
reference = "https://attack.mitre.org/techniques/T1613/"

[rule.threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"

[metadata]
creation_date = "2026/01/30"
integration = ["endpoint"]
maturity = "production"
updated_date = "2026/03/24"

[rule]
author = ["Elastic"]
description = """
Detects when macOS Gatekeeper is overridden followed by execution of the same binary from a suspicious 
location. This behavior indicates an attempt to bypass Apple's security controls and execute potentially 
malicious software downloaded from the internet.
"""
from = "now-9m"
index = ["logs-endpoint.events.*"]
language = "eql"
license = "Elastic License v2"
name = "Gatekeeper Override and Execution"
risk_score = 73
rule_id = "8154d01d-04d1-4695-bcbb-95a1bb606355"
severity = "high"
tags = [
    "Domain: Endpoint",
    "OS: macOS",
    "Use Case: Threat Detection",
    "Tactic: Defense Evasion",
    "Data Source: Elastic Defend",
    "Resources: Investigation Guide"
]
timestamp_override = "event.ingested"
type = "eql"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Gatekeeper Override and Execution

macOS Gatekeeper uses the quarantine extended attribute (com.apple.quarantine) to track files downloaded from the internet and enforce signature verification before execution. Threat actors commonly use xattr to remove this quarantine flag before executing malicious binaries, effectively bypassing Gatekeeper protections. This detection rule identifies the suspicious pattern of quarantine removal followed by immediate execution of files from typical download or staging locations.

### Possible investigation steps

- Review the file.path field from the first event to identify which file had its quarantine attribute removed and assess whether this file is expected on the system.
- Examine the file.Ext.header_bytes to confirm the file type (Mach-O binary indicated by cffaedfe or cafebabe magic bytes) and determine if it is a legitimate application.
- Analyze the process.executable from the execution event to verify it matches the file that had quarantine removed and investigate its purpose.
- Check the process.parent.executable and process.command_line to understand how the xattr removal and execution were triggered.
- Investigate the download source by reviewing browser history, email attachments, or other delivery mechanisms that may have placed the file in the staging location.
- Calculate the hash of the executed binary and search threat intelligence databases for known malicious indicators.
- Review the user.name associated with the activity to determine if the behavior is consistent with their normal operations.

### False positive analysis

- Users may manually remove quarantine from legitimate applications downloaded from trusted sources that macOS incorrectly flags. Verify the application source and purpose before dismissing.
- Developers may bypass Gatekeeper during local testing of unsigned builds. Confirm with development teams if such activities are expected.
- Enterprise software deployment may involve removing quarantine from applications before installation. Verify if IT operations were performing expected deployments.
- Some legitimate installer packages may remove quarantine as part of their installation process. Review the installer's origin and signing status.

### Response and remediation

- Immediately quarantine or remove the suspicious executable that was launched after quarantine removal.
- Block the file hash at the endpoint level to prevent re-execution across the environment.
- Conduct a comprehensive malware scan on the affected system to identify additional malicious components or persistence mechanisms.
- Investigate the delivery mechanism to understand how the malicious file reached the system and prevent similar infections.
- Review other systems for the same file hash or similar patterns of quarantine bypass.
- Educate users about the risks of bypassing Gatekeeper and removing quarantine attributes from downloaded files.
- Consider implementing additional controls such as application allowlisting to prevent execution of unauthorized binaries.
- Escalate to the incident response team if the executed binary is confirmed malicious.
"""
query = '''
configuration where host.os.type == "macos" and event.action == "gatekeeper_override" and
  file.path like ("/Volumes/*", "/Users/*/Applications/*", "/Applications/*",
                  "/tmp/*", "/private/tmp/*", "/var/tmp/*", "/private/var/tmp/*", "/Users/Shared/*",
                  "/Users/*/Downloads/*", "/Users/*/Desktop/*", "/Users/*/Documents/*")
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1553"
name = "Subvert Trust Controls"
reference = "https://attack.mitre.org/techniques/T1553/"

[[rule.threat.technique.subtechnique]]
id = "T1553.001"
name = "Gatekeeper Bypass"
reference = "https://attack.mitre.org/techniques/T1553/001/"

[[rule.threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"

[[rule.threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1204"
name = "User Execution"
reference = "https://attack.mitre.org/techniques/T1204/"

[[rule.threat.technique.subtechnique]]
id = "T1204.002"
name = "Malicious File"
reference = "https://attack.mitre.org/techniques/T1204/002/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[rule]
description = """
Identifies attempts to execute JavaScript using Deno with suspicious command line value. Adversaries may abuse this
utility to execute malicious JavaScript.
"""
id = "9c78eda8-68e7-49a8-87d2-5364381ba624"
license = "Elastic License v2"
name = "JavaScript Execution via Deno on Linux"
os_list = ["linux"]
reference = ["https://deno.com/"]
version = "1.0.0"

query = '''
process where event.type == "start" and event.action == "exec" and process.name == "deno" and
process.command_line like~ ("*base64*", "*eval(*", "*http*", "*javascript*import*") and
not process.command_line == "deno run --allow-all --quiet --no-config https://deno.land/x/wmill/main.ts completions zsh"
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.007"
name = "JavaScript"
reference = "https://attack.mitre.org/techniques/T1059/007/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "7.15.0"

[rule]
description = "Detects library load from a potentially altered call stack in order to conceal the true source of the call."
id = "c6cfc1e1-2198-4f72-a2df-cd4e13f3e1ca"
license = "Elastic License v2"
name = "Library Loaded from a Spoofed Call Stack"
os_list = ["windows"]
reference = ["https://www.zscaler.com/blogs/security-research/dodgebox-deep-dive-updated-arsenal-apt41-part-1"]
version = "1.0.6"

query = '''
library where
  dll.name : ("wininet.dll", "ws2_32.dll", "winhttp.dll", "netapi32.dll", "wmiutils.dll", "wtsapi32.dll", "psapi.dll") and
  (
   process.thread.Ext.call_stack_summary == "ntdll.dll|kernelbase.dll|kernel32.dll|ntdll.dll" or 
   
   (process.thread.Ext.call_stack_summary == "ntdll.dll|kernel32.dll|ntdll.dll" and 
    _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info: "*ntdll.dll!TpReleaseWait*") and
    _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info: "*ntdll.dll!RtlInitializeResource*") and 
    not _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info: "*ntdll.dll!LdrUnloadDl*"))
   ) and
  _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info: "*\\ntdll.dll!LdrLoadDll*") and
  not _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info: ("*\\KernelBase.dll!LoadLibrary*", "*\\kernel32.dll!LoadLibrary*")) and
  not _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info: ("*\\KernelBase.dll+0x*", "*\\kernel32.dll+0x*"))
'''

min_endpoint_version = "8.10.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1036"
name = "Masquerading"
reference = "https://attack.mitre.org/techniques/T1036/"

[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"

[metadata]
creation_date = "2026/03/27"
integration = ["endpoint"]
maturity = "production"
updated_date = "2026/03/27"

[rule]
author = ["Elastic"]
description = """
Identifies oversized command lines used by Python, PowerShell, Node.js, or Deno that contain base64 decoding or
encoded-command patterns. Adversaries may embed long inline encoded payloads in scripting interpreters to evade
inspection and execute malicious content across Windows, macOS, and Linux systems.
"""
from = "now-9m"
language = "esql"
license = "Elastic License v2"
name = "Long Base64 Encoded Command via Scripting Interpreter"
note = """## Triage and analysis

### Investigating Long Base64 Encoded Command via Scripting Interpreter

This rule detects process start events where the original `process.command_line` field was ignored at index time due to
its size, but the full command line remains available in `process.command_line.text`. Attackers commonly use very long
base64-encoded inline commands with interpreters such as Python, PowerShell, Node.js, and Deno to conceal payloads and
avoid straightforward command-line inspection.

### Possible investigation steps

- Review `process.command_line.text` to determine whether the encoded content includes shell commands, scripts, URLs, or embedded payloads.
- Inspect the parent process and execution chain to understand how the interpreter was launched and whether it originated from a browser, office application, archive utility, or remote access tool.
- Check whether the same host or user generated additional suspicious process, network, or file events around the same time.
- If the payload can be safely decoded in an isolated environment, inspect the decoded content for follow-on execution, credential access, persistence, or download behavior.

### False positive analysis

- Administrative automation, packaging workflows, or developer tooling may legitimately pass large encoded blobs to scripting interpreters.
- PowerShell remoting, software deployment frameworks, or internal bootstrap scripts can occasionally use encoded commands; validate the source, user, and expected automation context.

### Response and remediation

- Isolate the affected host if the decoded content or surrounding activity indicates malicious execution.
- Terminate the suspicious interpreter process and any spawned child processes.
- Preserve the full command line and related process tree for forensic analysis before making changes on the host.
- Reset or revoke any credentials, tokens, or secrets exposed by the decoded payload or subsequent attacker activity.
"""
risk_score = 73
rule_id = "74d31cb7-4a2c-44fe-9d1d-f375b9f3cb61"
severity = "high"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "OS: macOS",
    "OS: Linux",
    "Use Case: Threat Detection",
    "Tactic: Defense Evasion",
    "Tactic: Execution",
    "Data Source: Elastic Defend",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "esql"

query = '''
FROM logs-endpoint.events.process-* METADATA _id, _index, _version, _ignored
| MV_EXPAND _ignored
| WHERE _ignored == "process.command_line"
| WHERE event.category == "process" and event.type == "start"
| EVAL command_line = TO_LOWER(process.command_line.text), pname = TO_LOWER(process.name)
| WHERE 
(
    (
        /* Python: inline exec with base64 decode or -c flag with encoded payload */
        pname like "python*" and
        (
            command_line like "*b64decode*" or
            (command_line like "*-c*" and command_line like "*base64*")
        )
    ) or
    (
        /* PowerShell: encoded command flag — require trailing space to avoid matching
           -Encoding, -EncryptionType, -EncryptionProvider, etc. */
        (pname like "powershell*" or pname like "pwsh*") and
        (
            command_line rlike ".* -(e|en|enc|enco|encod|encode|encoded|encodedcommand) .+" or
            command_line like "*-encodedcommand*" or
            command_line like "*frombase64string*"
        )
    ) or
    (
        /* Node.js: buffer.from must be paired with base64 to avoid matching
           general Buffer usage; atob is always base64 */
        pname like "node*" and
        (
            (command_line like "*buffer.from*" and command_line like "*base64*") or
            command_line like "*atob(*"
        )
    ) or
    (
        /* Deno: eval( (not eval/evaluate/evaluation), atob, or buffer+base64 */
        pname like "deno*" and
        (
            command_line like "*atob(*" or
            (command_line like "*buffer.from*" and command_line like "*base64*") or
            command_line like "*eval(*"
        )
    )
)
| EVAL Esql.length_cmdline = LENGTH(command_line)
| WHERE Esql.length_cmdline >= 4000
| KEEP *
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1027"
name = "Obfuscated Files or Information"
reference = "https://attack.mitre.org/techniques/T1027/"

[[rule.threat.technique]]
id = "T1140"
name = "Deobfuscate/Decode Files or Information"
reference = "https://attack.mitre.org/techniques/T1140/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"

[[rule.threat.technique.subtechnique]]
id = "T1059.001"
name = "PowerShell"
reference = "https://attack.mitre.org/techniques/T1059/001/"

[[rule.threat.technique.subtechnique]]
id = "T1059.006"
name = "Python"
reference = "https://attack.mitre.org/techniques/T1059/006/"

[[rule.threat.technique.subtechnique]]
id = "T1059.007"
name = "JavaScript"
reference = "https://attack.mitre.org/techniques/T1059/007/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[metadata]
creation_date = "2026/06/30"
integration = ["m365_defender"]
maturity = "production"
promotion = true
updated_date = "2026/06/30"

[rule]
author = ["Elastic"]
description = """
Generates a detection alert for each Microsoft Defender XDR incident written to the configured indices. Microsoft
Defender emits multiple update events for the same incident as its member alerts and status evolve, all sharing a stable
incident identifier. This rule suppresses those update events so that a single, continuous Elastic alert is maintained
per Defender incident rather than a new alert per update. Enabling this rule allows you to immediately begin
investigating Microsoft Defender XDR incidents in the app.
"""
from = "now-2m"
index = ["logs-m365_defender.incident-*"]
interval = "1m"
language = "kuery"
license = "Elastic License v2"
max_signals = 1000
name = "Microsoft Defender XDR Incident External Alerts"
note = """## Triage and analysis

### Investigating Microsoft Defender XDR Incident External Alerts

Microsoft Defender XDR correlates related alerts across endpoints, identities, email, and applications into a single incident, providing the full attack story in one place. The incident data stream (`logs-m365_defender.incident-*`) carries these pre-correlated incidents. This rule promotes each Defender incident into an Elastic detection alert so analysts can investigate the correlated story without leaving the app.

Microsoft Defender emits several update events for the same incident as member alerts are added and status, classification, and evidence evolve. Every update shares the same stable Defender incident identifier (`m365_defender.incident.id`, which the integration also copies into `event.id`). The rule groups on that identifier so subsequent updates accumulate into the existing Elastic alert rather than creating duplicates.

The member alerts that make up an incident may also arrive through the Microsoft 365 Unified Audit Log (`logs-o365.audit-*`) rather than the native integration data stream. In that case the M365 Defender Alerts Signal (UAL) building block rule (rule_id: 054853f3-2ce0-41f3-a6eb-4a4867f39cdc) generates correlation signals from that source and can be used alongside this promotion rule.

### Possible investigation steps

- Review `m365_defender.incident.display_name`, `m365_defender.incident.severity`, and `m365_defender.incident.tags` to understand the scope and priority of the incident.
- Pivot to the Defender portal using `m365_defender.incident.web_url.original` for the correlated attack story, evidence graph, and recommended actions.
- Examine the member alert fields under `m365_defender.incident.alert.*` (titles, MITRE techniques, detection sources, evidence) to scope the impacted entities and behaviors.
- Review `m365_defender.incident.status`, `m365_defender.incident.classification`, and `m365_defender.incident.determination` to see whether Defender has already resolved or classified the incident.
- Check `m365_defender.incident.redirect_incident_id` to confirm the incident has not been merged into another incident.

### False positive analysis

- Defender incidents are pre-correlated and tuned by Microsoft, so true false positives are uncommon. When they occur, confirm with the responsible team before excluding.
- Incidents driven entirely by known and trusted administrative tools, security assessments, or scheduled automation may be benign. Validate intent before adding an exception.
- Use `m365_defender.incident.classification` and `m365_defender.incident.determination` to filter out activity Defender itself has marked as a false positive.

### Response and remediation

- Isolate affected endpoints or disable affected accounts if malicious behavior is confirmed across the incident's member alerts.
- Use the Defender portal to action native response options (quarantine, automated investigation, account remediation) for the incident.
- Investigate how the threat entered the environment and close any exploited gaps.
- Reset credentials for compromised accounts or escalate to incident response.
- Document the findings and tune the upstream Defender policy or add an Elastic exception as appropriate.
"""
references = ["https://docs.elastic.co/en/integrations/m365_defender"]
risk_score = 47
rule_id = "3c99579e-6491-4562-87f4-4d10f0a822b4"
rule_name_override = "m365_defender.incident.display_name"
setup = """## Setup

### Microsoft Defender XDR Incident Integration
This rule is designed to capture incident events generated by the Microsoft Defender XDR integration and promote them as Elastic detection alerts.

To capture Microsoft Defender XDR incidents, install and configure the Microsoft Defender XDR integration to ingest incident events into the `logs-m365_defender.incident-*` index pattern.

### Alert suppression and the Defender update lifecycle

Microsoft Defender writes multiple update events per incident during its lifecycle, all sharing the same stable identifier (`m365_defender.incident.id`, copied to `event.id`). This rule suppresses on that identifier so updates accumulate into one Elastic alert. Note the following alert suppression semantics:

- Suppression applies going forward from when the suppressing alert is created; it does not retroactively merge alerts created before the rule was enabled.
- Updates are aggregated into the existing alert only while that alert is open and within the suppression window. If an analyst closes the suppressing alert, a later Defender update will open a new Elastic alert.
- The suppression window (default 1 day) is tunable. Size it to your environment's typical Defender incident lifecycle; extending it keeps a single alert open longer but delays new-alert creation for late updates.

### Avoiding duplicate alerts

To avoid double-counting, enable either this incident-level rule or the Microsoft Defender XDR Alert External Alerts rule (alert-level), not both: a Defender incident's child alerts appear in both data streams. Incident-level (this rule) produces the least noise (one Elastic alert per Defender incident) and is the recommended default; alert-level provides finer-grained, per-alert triage.

### Additional notes

For information on troubleshooting the maximum alerts warning please refer to this [guide](https://www.elastic.co/guide/en/security/current/alerts-ui-monitor.html#troubleshoot-max-alerts).
"""
severity = "medium"
tags = [
    "Data Source: Microsoft Defender XDR",
    "Use Case: Threat Detection",
    "Resources: Investigation Guide",
    "Promotion: External Alerts",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
event.kind: alert and data_stream.dataset: m365_defender.incident
'''


[[rule.risk_score_mapping]]
field = "event.severity"
operator = "equals"
value = ""

[[rule.severity_mapping]]
field = "m365_defender.incident.severity"
operator = "equals"
severity = "low"
value = "informational"

[[rule.severity_mapping]]
field = "m365_defender.incident.severity"
operator = "equals"
severity = "low"
value = "low"

[[rule.severity_mapping]]
field = "m365_defender.incident.severity"
operator = "equals"
severity = "medium"
value = "medium"

[[rule.severity_mapping]]
field = "m365_defender.incident.severity"
operator = "equals"
severity = "high"
value = "high"

[rule.alert_suppression]
group_by = ["m365_defender.incident.id", "m365_defender.incident.tenant_id"]
missing_fields_strategy = "doNotSuppress"

[rule.alert_suppression.duration]
unit = "h"
value = 24

[rule]
description = """
Identifies the load of NTDLL for the second time. This may indicate the use of direct system calls to evade endpoint
security solutions hooking Windows APIs.
"""
id = "85a716db-52f6-4424-9a5a-3ca1c548b5fc"
license = "Elastic License v2"
name = "NTDLL library loaded for a second time"
os_list = ["windows"]
reference = [
    "https://www.elastic.co/security-labs/upping-the-ante-detecting-in-memory-threats-with-kernel-call-stacks",
    "https://www.ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs",
]
version = "1.0.6"

query = '''
library where dll.name : "ntdll.dll" and
 dll.Ext.load_index >= 2 and
 process.thread.Ext.call_stack_summary != null and process.thread.Ext.call_stack_summary like "ntdll.dll|kernelbase.dll|*" and
 _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info: "C:\\Windows\\Sys*\\KernelBase.dll!MapViewOfFile*") and
 not _arraysearch(process.thread.Ext.call_stack, $entry,
                  $entry.symbol_info: ("C:\\Windows\\System32\\sysmain.dll!AgTwLoad*",
                                       "C:\\Program Files (x86)\\kingsoft\\kingsoft antivirus\\kisfdpro64.dll!GetKwsUH+*",
                                       "C:\\Program Files\\SentinelOne\\Sentinel Agent*\\InProcessClient*")) and
 not (process.executable : "C:\\Windows\\System32\\smss.exe" and process.thread.Ext.call_stack_summary == "ntdll.dll|smss.exe|ntdll.dll") and
 not process.executable : ("C:\\Program Files\\Palo Alto Networks\\Traps\\cyserver.exe",
                           "?:\\Program Files\\Genshin Impact\\Genshin Impact Game\\YuanShen.exe",
                           "?:\\Program Files\\ESET\\*\\ekrn.exe",
                           "?:\\Program Files (x86)\\ESET\\*\\ekrn.exe",
                           "?:\\Program Files (x86)\\Kaspersky Lab\\*\\avp.exe",
                           "?:\\Program Files\\Kaspersky Lab\\*\\avp.exe",
                           "?:\\Program Files (x86)\\360\\Total Security\\safemon\\QHActiveDefense.exe",
                           "?:\\Program Files (x86)\\Intel\\oneAPI\\*\\advisor-gui.exe",
                           "?:\\Program Files (x86)\\MakeMKV\\makemkvcon64.exe",
                           "?:\\Program Files (x86)\\MakeMKVII\\makemkvcon64.exe",
                           "C:\\Program Files (x86)\\CheckPoint\\Endpoint Security\\Anti-Malware\\epam_svc.exe",
                           "?:\\Program Files (x86)\\tenprotect\\TASLogin.exe",
                           "?:\\Program Files (x86)\\WeGame\\tenprotect\\TASLogin.exe") and
 not (user.id == "S-1-5-18" and process.executable : "C:\\Windows\\System32\\WindowsPowerShell\\v1.?\\powershell.exe") and
 not (process.code_signature.subject_name in ("COGNOSPHERE PTE. LTD.", "Blizzard Entertainment, Inc.", "miHoYo Co.,Ltd.",
      "深圳市脸萌科技有限公司") and process.code_signature.trusted == true) and
 not process.thread.Ext.call_stack_summary like
                           ("sysfer.dll|kernelbase.dll|sysfer.dll",
                            "ntdll.dll|kernelbase.dll|tmmon64.dll",
                            "ntdll.dll|kernelbase.dll|sysmain.dll|kernel32.dll|ntdll.dll",
                            "ntdll.dll|bdhkm64.dll|Unbacked|kernelbase.dll|sysmain.dll|kernel32.dll|ntdll.dll",
                            "ntdll.dll|umppc?????.dll|kernelbase.dll|sysmain.dll|kernel32.dll|ntdll.dll",
                            "ntdll.dll|kernelbase.dll|vsdebugeng.impl.dll|kernel32.dll|ntdll.dll")
'''

min_endpoint_version = "8.10.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"

[rule]
description = """
Identifies the usage of Mimikatz using known malicious command line arguments. Mimikatz is a credential dumper capable
of obtaining plaintext Windows account logins and passwords, along with many other features that make it useful for
testing the security of networks.
"""
id = "86bf5d50-7f5d-44b4-977b-dff222379727"
license = "Elastic License v2"
name = "Potential Credential Access via Mimikatz"
os_list = ["windows"]
reference = ["https://adsecurity.org/?page_id=1821", "https://github.com/gentilkiwi/mimikatz"]
version = "1.0.28"

query = '''
process where event.action == "start" and
  process.args : (
    "privilege::debug",
    "sekurlsa::logonpasswords",
    "sekurlsa::pth",
    "lsadump::sam",
    "lsadump::dcsync",
    "vault::cred",
    "vault::list",
    "token::elevate",
    "/user:krbtgt",
    "kerberos::tgt",
    "kerberos::ptt",
    "kerberos::list",
    "misc::memssp"
  )
'''

min_endpoint_version = "7.15.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1003"
name = "OS Credential Dumping"
reference = "https://attack.mitre.org/techniques/T1003/"
[[threat.technique.subtechnique]]
id = "T1003.001"
name = "LSASS Memory"
reference = "https://attack.mitre.org/techniques/T1003/001/"

[[threat.technique.subtechnique]]
id = "T1003.002"
name = "Security Account Manager"
reference = "https://attack.mitre.org/techniques/T1003/002/"


[[threat.technique]]
id = "T1558"
name = "Steal or Forge Kerberos Tickets"
reference = "https://attack.mitre.org/techniques/T1558/"


[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "7.15.0"

[metadata]
creation_date = "2023/07/04"
integration = ["endpoint"]
maturity = "production"
updated_date = "2026/05/05"

[rule]
author = ["Elastic"]
description = """
This detection rule identifies the execution of a Linux shell process from a Java JAR application post an incoming
network connection. This behavior may indicate reverse shell activity via a Java application.
"""
from = "now-9m"
index = ["logs-endpoint.events.network*", "logs-endpoint.events.process*"]
language = "eql"
license = "Elastic License v2"
name = "Potential Reverse Shell via Java"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Potential Reverse Shell via Java

Java applications, often run on Linux systems, can be exploited by adversaries to establish reverse shells, allowing remote control over a compromised system. Attackers may execute shell commands via Java processes post-network connection. The detection rule identifies suspicious Java activity by monitoring for shell executions following network connections, excluding benign processes, to flag potential reverse shell attempts.

### Possible investigation steps

- Review the network connection details, focusing on the destination IP address to determine if it is external or potentially malicious, as the rule excludes common internal and reserved IP ranges.
- Examine the Java process that initiated the network connection, including its executable path and arguments, to identify any unusual or unauthorized JAR files being executed.
- Investigate the child shell process spawned by the Java application, checking its command-line arguments and execution context to assess if it aligns with known reverse shell patterns.
- Cross-reference the parent Java process and the child shell process with known benign applications or services, such as Jenkins or NetExtender, to rule out false positives.
- Analyze historical data for the host to identify any previous similar activities or patterns that might indicate a persistent threat or repeated exploitation attempts.

### False positive analysis

- Java-based administrative tools like Jenkins may trigger false positives when executing shell commands. Exclude known benign Java applications such as Jenkins by adding their specific JAR paths to the exception list.
- Automated scripts or maintenance tasks that use Java to execute shell commands can be mistaken for reverse shell activity. Identify and exclude these scripts by specifying their unique process arguments or executable paths.
- Development environments where Java applications frequently execute shell commands for testing purposes can generate false alerts. Consider excluding these environments by filtering based on specific host identifiers or network segments.
- Security tools that utilize Java for network operations and shell executions might be flagged. Verify and exclude these tools by adding their process names or executable paths to the exception list.

### Response and remediation

- Immediately isolate the affected host from the network to prevent further unauthorized access or data exfiltration.
- Terminate any suspicious Java processes identified in the alert to stop potential reverse shell activity.
- Conduct a thorough review of the affected system's logs to identify any additional indicators of compromise or lateral movement attempts.
- Remove any unauthorized or malicious Java JAR files and associated scripts from the system.
- Apply security patches and updates to the Java environment and any other vulnerable software on the affected host.
- Restore the system from a known good backup if any unauthorized changes or persistent threats are detected.
- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to assess the potential impact on other systems within the network."""
references = [
    "https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md",
]
risk_score = 47
rule_id = "5a3d5447-31c9-409a-aed1-72f9921594fd"
setup = """## Setup

This rule requires data coming in from Elastic Defend.

### Elastic Defend Integration Setup
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.

#### Prerequisite Requirements:
- Fleet is required for Elastic Defend.
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).

#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
- Go to the Kibana home page and click "Add integrations".
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
- Click "Add Elastic Defend".
- Configure the integration name and optionally add a description.
- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
- Click "Save and Continue".
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
"""
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: Linux",
    "Use Case: Threat Detection",
    "Tactic: Execution",
    "Data Source: Elastic Defend",
    "Resources: Investigation Guide",
]
type = "eql"
query = '''
sequence by host.id with maxspan=5s
  [network where host.os.type == "linux" and event.action in ("connection_accepted", "connection_attempted") and
   process.executable : ("/usr/bin/java", "/bin/java", "/usr/lib/jvm/*", "/usr/java/*") and
   not (destination.ip == null or destination.ip == "0.0.0.0" or cidrmatch(
     destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.0.0/29",
     "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
     "192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10",
     "192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1", "FE80::/10",
     "FF00::/8"
    )
  )] by process.entity_id
  [process where host.os.type == "linux" and event.action == "exec" and
   process.parent.executable : ("/usr/bin/java", "/bin/java", "/usr/lib/jvm/*", "/usr/java/*") and
   process.parent.args : "-jar" and process.name in ("bash", "dash", "ash", "sh", "tcsh", "csh", "zsh", "ksh", "fish")
   and not (
     process.parent.args in (
       "/usr/lib/jenkins/jenkins.war", "/etc/remote-iot/services/remoteiot.jar", "/opt/pentaho/data-integration/launcher/launcher.jar",
       "/usr/share/java/jenkins.war", "/opt/tomcat/statistics/statistics.jar", "/usr/lib64/NetExtender.jar",
       "/var/lib/jenkins/workspace/MP-QA/tc_certified_copy*/tc_certified_copy_web_ui_test/target/surefire/surefirebooter*.jar",
       "-javaagent:/opt/opentelemetry/opentelemetry-javaagent-all.jar", "./lib/pipeline-job-executor*SNAPSHOT.jar",
       "./lib/worker-launcher-agent*SNAPSHOT.jar", "/opt/Seqrite_EndPoint_Security/wildfly/jboss-modules.jar",
       "/home/data/jenkins.war", "/pro/service-modules/deployment.jar", "/application/HES/READER/*.jar", "*-SNAPSHOT.jar",
       "READER/G1A/READER_G1A.jar", "READER_G1.jar"
     ) or
    process.command_line like~ (
      "bash -c ps -eo pid,lstart,comm*",
      "bash -c df -i /application | tail -n 1",
      "/bin/sh -xe /tmp/hudson*.sh",
      "bash -c cat /application/HES/*"
    )
   )] by process.parent.entity_id
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"

[[rule.threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"

[rule.threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"