From aeca94ebf237394c04457097c0d4f07c7f72ec27 Mon Sep 17 00:00:00 2001 From: tradebot-elastic <178941316+tradebot-elastic@users.noreply.github.com> Date: Wed, 30 Sep 2026 00:48:05 +0000 Subject: [PATCH] Update latest docs --- ...ed-default-telnet-port-connection.asciidoc | 163 ++++++++++ ...vity-from-a-suspicious-user-agent.asciidoc | 224 ++++++++++++++ ...5-anthropic-admin-api-key-created.asciidoc | 113 +++++++ ...5-anthropic-admin-api-key-deleted.asciidoc | 108 +++++++ ...ropic-admin-role-assigned-to-user.asciidoc | 129 ++++++++ ...hropic-compliance-api-key-created.asciidoc | 115 +++++++ ...c-compliance-api-logging-disabled.asciidoc | 116 +++++++ ...pliance-audit-log-export-accessed.asciidoc | 107 +++++++ ...ic-excessive-chat-access-failures.asciidoc | 124 ++++++++ ...anthropic-excessive-chat-creation.asciidoc | 120 ++++++++ ...anthropic-excessive-chat-deletion.asciidoc | 122 ++++++++ ...-excessive-chat-snapshot-creation.asciidoc | 124 ++++++++ ...c-extra-usage-spend-limit-deleted.asciidoc | 111 +++++++ ...thropic-high-file-upload-activity.asciidoc | 126 ++++++++ ...magic-link-second-factor-disabled.asciidoc | 115 +++++++ ...9-35-anthropic-mcp-server-created.asciidoc | 109 +++++++ ...-multiple-authentication-failures.asciidoc | 127 ++++++++ ...organization-data-export-accessed.asciidoc | 115 +++++++ ...5-anthropic-organization-deletion.asciidoc | 113 +++++++ ...anization-domain-boundary-changed.asciidoc | 112 +++++++ ...ganization-ip-restriction-deleted.asciidoc | 115 +++++++ ...tion-member-and-group-enumeration.asciidoc | 133 ++++++++ ...pic-organization-user-invite-sent.asciidoc | 115 +++++++ ...thropic-primary-owner-transferred.asciidoc | 117 +++++++ ...ude-project-role-assigned-to-user.asciidoc | 128 ++++++++ ...so-disabled-or-connection-removed.asciidoc | 119 ++++++++ ...ecurity-service-tampering-via-cli.asciidoc | 195 ++++++++++++ ...ery-point-deleted-by-unusual-user.asciidoc | 118 ++++++++ ...function-deletion-by-unusual-user.asciidoc | 118 ++++++++ ...n-invoked-by-an-unusual-principal.asciidoc | 127 ++++++++ ...-registered-via-hybrid-activation.asciidoc | 172 +++++++++++ ...oud-offensive-framework-execution.asciidoc | 179 +++++++++++ ...ailures-via-macos-security-events.asciidoc | 165 ++++++++++ ...n-external-mqtt-broker-connection.asciidoc | 182 +++++++++++ ...ime-fortigate-administrator-login.asciidoc | 148 +++++++++ ...oud-sso-login-from-unusual-source.asciidoc | 154 ++++++++++ ...api-request-failure-burst-by-user.asciidoc | 116 +++++++ ...o-external-drive-with-app-consent.asciidoc | 175 +++++++++++ ...le-path-via-macos-security-events.asciidoc | 133 ++++++++ ...19-35-linux-user-account-creation.asciidoc | 164 ++++++++++ ...ss-process-access-via-windows-api.asciidoc | 214 +++++++++++++ ...web-removal-by-an-unusual-process.asciidoc | 179 +++++++++++ ...nder-xdr-incident-external-alerts.asciidoc | 136 +++++++++ ...ved-elastic-defend-behavior-alert.asciidoc | 128 ++++++++ ...ved-high-severity-detection-alert.asciidoc | 125 ++++++++ ...-or-post-install-script-execution.asciidoc | 162 ++++++++++ ...ilename-via-macos-security-events.asciidoc | 155 ++++++++++ ...ix-command-via-windows-run-dialog.asciidoc | 270 +++++++++++++++++ ...i-command-executed-by-genai-agent.asciidoc | 229 ++++++++++++++ ...ution-via-filefix-phishing-attack.asciidoc | 228 ++++++++++++++ ...-via-windows-explorer-address-bar.asciidoc | 285 ++++++++++++++++++ ...isoning-command-injection-attempt.asciidoc | 205 +++++++++++++ ...fix-cloudflare-lure-in-powershell.asciidoc | 157 ++++++++++ ...liance-extract-argument-injection.asciidoc | 114 +++++++ ...-procedure-call-from-the-internet.asciidoc | 168 +++++++++++ ...te-procedure-call-to-the-internet.asciidoc | 176 +++++++++++ ...haring-activity-from-the-internet.asciidoc | 179 +++++++++++ ...-sharing-activity-to-the-internet.asciidoc | 166 ++++++++++ ...mporarily-scheduled-task-creation.asciidoc | 166 ++++++++++ ...usual-azure-vm-extension-detected.asciidoc | 168 +++++++++++ ...sual-file-creation-via-web-server.asciidoc | 207 +++++++++++++ .../prebuilt-rules-8-19-35-appendix.asciidoc | 67 ++++ .../prebuilt-rules-8-19-35-summary.asciidoc | 134 ++++++++ ...ebuilt-rules-downloadable-updates.asciidoc | 5 + .../prebuilt-rules-reference.asciidoc | 142 +++++++-- .../prebuilt-rules/rule-desc-index.asciidoc | 43 ++- ...vity-from-a-suspicious-user-agent.asciidoc | 224 ++++++++++++++ .../anthropic-admin-api-key-created.asciidoc | 113 +++++++ .../anthropic-admin-api-key-deleted.asciidoc | 108 +++++++ ...ropic-admin-role-assigned-to-user.asciidoc | 129 ++++++++ ...hropic-compliance-api-key-created.asciidoc | 115 +++++++ ...c-compliance-api-logging-disabled.asciidoc | 116 +++++++ ...pliance-audit-log-export-accessed.asciidoc | 107 +++++++ ...ic-excessive-chat-access-failures.asciidoc | 124 ++++++++ ...anthropic-excessive-chat-creation.asciidoc | 120 ++++++++ ...anthropic-excessive-chat-deletion.asciidoc | 122 ++++++++ ...-excessive-chat-snapshot-creation.asciidoc | 124 ++++++++ ...c-extra-usage-spend-limit-deleted.asciidoc | 111 +++++++ ...thropic-high-file-upload-activity.asciidoc | 126 ++++++++ ...magic-link-second-factor-disabled.asciidoc | 115 +++++++ .../anthropic-mcp-server-created.asciidoc | 109 +++++++ ...-multiple-authentication-failures.asciidoc | 127 ++++++++ ...organization-data-export-accessed.asciidoc | 115 +++++++ .../anthropic-organization-deletion.asciidoc | 113 +++++++ ...anization-domain-boundary-changed.asciidoc | 112 +++++++ ...ganization-ip-restriction-deleted.asciidoc | 115 +++++++ ...tion-member-and-group-enumeration.asciidoc | 133 ++++++++ ...pic-organization-user-invite-sent.asciidoc | 115 +++++++ ...thropic-primary-owner-transferred.asciidoc | 117 +++++++ ...ude-project-role-assigned-to-user.asciidoc | 128 ++++++++ ...so-disabled-or-connection-removed.asciidoc | 119 ++++++++ ...oken-used-from-multiple-addresses.asciidoc | 2 +- ...ecurity-service-tampering-via-cli.asciidoc | 195 ++++++++++++ ...ery-point-deleted-by-unusual-user.asciidoc | 118 ++++++++ ...ation-modified-by-unusual-process.asciidoc | 130 ++++++++ ...function-deletion-by-unusual-user.asciidoc | 118 ++++++++ ...n-invoked-by-an-unusual-principal.asciidoc | 15 +- ...-registered-via-hybrid-activation.asciidoc | 172 +++++++++++ ...excessive-secret-or-key-retrieved.asciidoc | 2 +- ...oud-offensive-framework-execution.asciidoc | 179 +++++++++++ ...fend-and-email-alerts-correlation.asciidoc | 2 +- ...d-application-credential-modified.asciidoc | 7 +- ...id-mfa-totp-brute-force-attempted.asciidoc | 2 +- ...o-device-registration-service-drs.asciidoc | 2 +- ...-impersonation-to-microsoft-graph.asciidoc | 2 +- ...ute-force-attempted-microsoft-365.asciidoc | 2 +- ...ser-sign-in-brute-force-attempted.asciidoc | 2 +- ...ailures-via-macos-security-events.asciidoc | 165 ++++++++++ ...n-external-mqtt-broker-connection.asciidoc | 182 +++++++++++ ...ime-fortigate-administrator-login.asciidoc | 2 +- ...oud-sso-login-from-unusual-source.asciidoc | 4 +- ...o-external-drive-with-app-consent.asciidoc | 4 +- ...le-path-via-macos-security-events.asciidoc | 133 ++++++++ .../linux-user-account-creation.asciidoc | 7 +- ...y-microsoft-app-from-multiple-ips.asciidoc | 2 +- ...65-identity-user-account-lockouts.asciidoc | 2 +- ...entity-user-brute-force-attempted.asciidoc | 2 +- ...-sign-in-from-a-suspicious-source.asciidoc | 2 +- ...web-removal-by-an-unusual-process.asciidoc | 25 +- ...nder-xdr-incident-external-alerts.asciidoc | 2 +- ...cessive-account-lockouts-detected.asciidoc | 2 +- ...esponding-to-the-same-transaction.asciidoc | 2 +- ...ved-elastic-defend-behavior-alert.asciidoc | 4 +- ...ved-high-severity-detection-alert.asciidoc | 4 +- ...-or-post-install-script-execution.asciidoc | 4 +- ...ilename-via-macos-security-events.asciidoc | 155 ++++++++++ ...ix-command-via-windows-run-dialog.asciidoc | 270 +++++++++++++++++ ...i-command-executed-by-genai-agent.asciidoc | 229 ++++++++++++++ ...n-via-high-client-mac-cardinality.asciidoc | 2 +- ...ng-via-long-and-unique-subdomains.asciidoc | 2 +- ...ution-via-filefix-phishing-attack.asciidoc | 19 +- ...-via-windows-explorer-address-bar.asciidoc | 285 ++++++++++++++++++ ...isoning-command-injection-attempt.asciidoc | 205 +++++++++++++ ...fix-cloudflare-lure-in-powershell.asciidoc | 157 ++++++++++ ...liance-extract-argument-injection.asciidoc | 114 +++++++ ...mporarily-scheduled-task-creation.asciidoc | 23 +- ...usual-azure-vm-extension-detected.asciidoc | 8 +- ...sual-file-creation-via-web-server.asciidoc | 31 +- docs/index.asciidoc | 2 + 139 files changed, 15541 insertions(+), 90 deletions(-) create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-accepted-default-telnet-port-connection.asciidoc create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-activity-from-a-suspicious-user-agent.asciidoc create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-admin-api-key-created.asciidoc create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-admin-api-key-deleted.asciidoc create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-admin-role-assigned-to-user.asciidoc create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-compliance-api-key-created.asciidoc create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-compliance-api-logging-disabled.asciidoc create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-compliance-audit-log-export-accessed.asciidoc create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-excessive-chat-access-failures.asciidoc create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-excessive-chat-creation.asciidoc create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-excessive-chat-deletion.asciidoc create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-excessive-chat-snapshot-creation.asciidoc create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-extra-usage-spend-limit-deleted.asciidoc create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-high-file-upload-activity.asciidoc create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-magic-link-second-factor-disabled.asciidoc create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-mcp-server-created.asciidoc create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-multiple-authentication-failures.asciidoc create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-organization-data-export-accessed.asciidoc create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-organization-deletion.asciidoc create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-organization-domain-boundary-changed.asciidoc create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-organization-ip-restriction-deleted.asciidoc create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-organization-member-and-group-enumeration.asciidoc create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-organization-user-invite-sent.asciidoc create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-primary-owner-transferred.asciidoc create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-sensitive-claude-project-role-assigned-to-user.asciidoc create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-sso-disabled-or-connection-removed.asciidoc create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-aws-audit-or-security-service-tampering-via-cli.asciidoc create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-aws-backup-recovery-point-deleted-by-unusual-user.asciidoc create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-aws-lambda-function-deletion-by-unusual-user.asciidoc create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-aws-lambda-function-invoked-by-an-unusual-principal.asciidoc create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-aws-ssm-agent-registered-via-hybrid-activation.asciidoc create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-cloud-offensive-framework-execution.asciidoc create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-excessive-sudo-authentication-failures-via-macos-security-events.asciidoc create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-first-seen-external-mqtt-broker-connection.asciidoc create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-first-time-fortigate-administrator-login.asciidoc create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-fortigate-forticloud-sso-login-from-unusual-source.asciidoc create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-gke-api-request-failure-burst-by-user.asciidoc create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-google-workspace-object-copied-to-external-drive-with-app-consent.asciidoc create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-launch-item-registration-with-suspicious-executable-path-via-macos-security-events.asciidoc create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-linux-user-account-creation.asciidoc create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-lsass-process-access-via-windows-api.asciidoc create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-mark-of-the-web-removal-by-an-unusual-process.asciidoc create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-microsoft-defender-xdr-incident-external-alerts.asciidoc create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-newly-observed-elastic-defend-behavior-alert.asciidoc create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-newly-observed-high-severity-detection-alert.asciidoc create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-node-js-pre-or-post-install-script-execution.asciidoc create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-persistence-via-a-hidden-plist-filename-via-macos-security-events.asciidoc create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-potential-clickfix-command-via-windows-run-dialog.asciidoc create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-potential-destructive-aws-cli-command-executed-by-genai-agent.asciidoc create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-potential-execution-via-filefix-phishing-attack.asciidoc create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-potential-filefix-command-via-windows-explorer-address-bar.asciidoc create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-potential-netscaler-log-poisoning-command-injection-attempt.asciidoc create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-potential-terminalfix-cloudflare-lure-in-powershell.asciidoc create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-privilege-escalation-via-parallels-appliance-extract-argument-injection.asciidoc create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-rpc-remote-procedure-call-from-the-internet.asciidoc create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-rpc-remote-procedure-call-to-the-internet.asciidoc create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-smb-windows-file-sharing-activity-from-the-internet.asciidoc create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-smb-windows-file-sharing-activity-to-the-internet.asciidoc create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-temporarily-scheduled-task-creation.asciidoc create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-unusual-azure-vm-extension-detected.asciidoc create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-unusual-file-creation-via-web-server.asciidoc create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rules-8-19-35-appendix.asciidoc create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rules-8-19-35-summary.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/anthropic-activity-from-a-suspicious-user-agent.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/anthropic-admin-api-key-created.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/anthropic-admin-api-key-deleted.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/anthropic-admin-role-assigned-to-user.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/anthropic-compliance-api-key-created.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/anthropic-compliance-api-logging-disabled.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/anthropic-compliance-audit-log-export-accessed.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/anthropic-excessive-chat-access-failures.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/anthropic-excessive-chat-creation.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/anthropic-excessive-chat-deletion.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/anthropic-excessive-chat-snapshot-creation.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/anthropic-extra-usage-spend-limit-deleted.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/anthropic-high-file-upload-activity.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/anthropic-magic-link-second-factor-disabled.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/anthropic-mcp-server-created.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/anthropic-multiple-authentication-failures.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/anthropic-organization-data-export-accessed.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/anthropic-organization-deletion.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/anthropic-organization-domain-boundary-changed.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/anthropic-organization-ip-restriction-deleted.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/anthropic-organization-member-and-group-enumeration.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/anthropic-organization-user-invite-sent.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/anthropic-primary-owner-transferred.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/anthropic-sensitive-claude-project-role-assigned-to-user.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/anthropic-sso-disabled-or-connection-removed.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/aws-audit-or-security-service-tampering-via-cli.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/aws-backup-recovery-point-deleted-by-unusual-user.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/aws-cli-configuration-modified-by-unusual-process.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/aws-lambda-function-deletion-by-unusual-user.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/aws-ssm-agent-registered-via-hybrid-activation.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/cloud-offensive-framework-execution.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/excessive-sudo-authentication-failures-via-macos-security-events.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/first-seen-external-mqtt-broker-connection.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/launch-item-registration-with-suspicious-executable-path-via-macos-security-events.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/persistence-via-a-hidden-plist-filename-via-macos-security-events.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-clickfix-command-via-windows-run-dialog.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-destructive-aws-cli-command-executed-by-genai-agent.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-filefix-command-via-windows-explorer-address-bar.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-netscaler-log-poisoning-command-injection-attempt.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-terminalfix-cloudflare-lure-in-powershell.asciidoc create mode 100644 docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-parallels-appliance-extract-argument-injection.asciidoc diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-accepted-default-telnet-port-connection.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-accepted-default-telnet-port-connection.asciidoc new file mode 100644 index 0000000000..2b1135a196 --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-accepted-default-telnet-port-connection.asciidoc @@ -0,0 +1,163 @@ +[[prebuilt-rule-8-19-35-accepted-default-telnet-port-connection]] +=== Accepted Default Telnet Port Connection + +This rule detects network events that may indicate the use of Telnet traffic. Telnet is commonly used by system administrators to remotely control older or embedded systems using the command line shell. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector. As a plain-text protocol, it may also expose usernames and passwords to anyone capable of observing the traffic. + +*Rule type*: query + +*Rule indices*: + +* packetbeat-* +* auditbeat-* +* filebeat-* +* logs-network_traffic.* +* logs-panw.panos* +* logs-fortinet_fortigate.log-* +* logs-pfsense.log-* +* logs-sonicwall_firewall.log-* +* logs-suricata.* + +*Severity*: medium + +*Risk score*: 47 + +*Runs every*: 5m + +*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: None + +*Tags*: + +* Domain: Endpoint +* Use Case: Threat Detection +* Tactic: Command and Control +* Tactic: Lateral Movement +* Tactic: Initial Access +* Data Source: Fortinet +* Data Source: PAN-OS +* Data Source: pfSense +* Data Source: SonicWall +* Data Source: Suricata +* Resources: Investigation Guide +* Noise: High +* Performance: Normal +* Profile: Aggressive +* Rule Type: Custom Query (KQL) +* Domain: Network +* Data Source: Network Packet Capture +* Data Source: SonicWall Firewall Logs + +*Version*: 119 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + +> **Disclaimer**: +> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs. + + +*Investigating Accepted Default Telnet Port Connection* + + +Telnet, a protocol for remote command-line access, is often used in legacy systems. Its lack of encryption makes it vulnerable, allowing attackers to intercept credentials or use it as a backdoor. The detection rule identifies unencrypted Telnet traffic on port 23, flagging connections that bypass typical security measures, thus highlighting potential unauthorized access attempts. + + +*Possible investigation steps* + + +- Review the network traffic logs to identify the source IP address associated with the Telnet connection on port 23. Determine if the source IP is internal or external to the organization. +- Check the destination IP address to ascertain if it belongs to a critical system or a legacy device that might still use Telnet for management purposes. +- Investigate the timeline of the connection event to see if there are any patterns or repeated attempts, which could indicate a persistent threat or automated attack. +- Analyze any associated user accounts or credentials used during the Telnet session to verify if they are legitimate and authorized for remote access. +- Correlate the Telnet connection event with other security alerts or logs to identify any related suspicious activities, such as failed login attempts or unusual data transfers. +- Assess the network segment where the Telnet traffic was detected to determine if it is appropriately segmented and secured against unauthorized access. +- Consider implementing network security measures, such as disabling Telnet on devices or replacing it with secure alternatives like SSH, to prevent future unauthorized access attempts. + + +*False positive analysis* + + +- Legacy systems or devices that require Telnet for management may trigger alerts. To manage this, create exceptions for specific IP addresses or subnets known to host these systems. +- Internal network monitoring tools that use Telnet for legitimate purposes might be flagged. Identify these tools and exclude their traffic from the rule to prevent unnecessary alerts. +- Lab environments or test networks where Telnet is used for educational or testing purposes can cause false positives. Implement network segmentation and apply exceptions to these environments to reduce noise. +- Automated scripts or maintenance tasks that utilize Telnet for routine operations may be mistakenly identified. Document these tasks and whitelist their associated traffic patterns to avoid false alerts. + + +*Response and remediation* + + +- Immediately isolate the affected system from the network to prevent further unauthorized access or data exfiltration. +- Terminate any active Telnet sessions on the affected system to disrupt potential attacker activities. +- Conduct a thorough review of system logs and network traffic to identify any unauthorized access or data manipulation that may have occurred. +- Change all credentials that may have been exposed through Telnet traffic, prioritizing those with administrative privileges. +- Implement network segmentation to restrict Telnet access to only necessary internal systems, ensuring it is not exposed to the internet. +- Deploy encryption protocols such as SSH to replace Telnet for remote command-line access, enhancing security for remote management. +- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to assess the need for additional security measures. + +==== Rule query + + +[source, js] +---------------------------------- +(data_stream.dataset:(fortinet_fortigate.log or network_traffic.flow + or panw.panos or pfsense.log or sonicwall_firewall.log or suricata.eve) + or event.category:(network or network_traffic)) + and event.type:(connection and not (denied or end)) + and not event.action:(Reject or client-rst or connection-denied or + connection-end or denied or deny or flow_denied or flow_dropped or + flow_terminated or network_flow or server-rst or timeout) + and not (event.action:netflow_flow and not network.packets > 1) + and not network.application:(stretchoid-scanning or traceroute) + and not ( + data_stream.dataset:panw.panos and + network.application:("incomplete" or "insufficient-data" or "not-applicable") + ) + and destination.port:23 + and (network.protocol:(telnet or not *) or data_stream.dataset:fortinet_fortigate.log) + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Command and Control +** ID: TA0011 +** Reference URL: https://attack.mitre.org/tactics/TA0011/ +* Technique: +** Name: Application Layer Protocol +** ID: T1071 +** Reference URL: https://attack.mitre.org/techniques/T1071/ +* Tactic: +** Name: Lateral Movement +** ID: TA0008 +** Reference URL: https://attack.mitre.org/tactics/TA0008/ +* Technique: +** Name: Remote Services +** ID: T1021 +** Reference URL: https://attack.mitre.org/techniques/T1021/ +* Tactic: +** Name: Initial Access +** ID: TA0001 +** Reference URL: https://attack.mitre.org/tactics/TA0001/ +* Technique: +** Name: External Remote Services +** ID: T1133 +** Reference URL: https://attack.mitre.org/techniques/T1133/ +* Technique: +** Name: Exploit Public-Facing Application +** ID: T1190 +** Reference URL: https://attack.mitre.org/techniques/T1190/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-activity-from-a-suspicious-user-agent.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-activity-from-a-suspicious-user-agent.asciidoc new file mode 100644 index 0000000000..ebd9bdb8bd --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-activity-from-a-suspicious-user-agent.asciidoc @@ -0,0 +1,224 @@ +[[prebuilt-rule-8-19-35-anthropic-activity-from-a-suspicious-user-agent]] +=== Anthropic Activity from a Suspicious User Agent + +Detects successful Anthropic audit activity where the user agent matches scripting HTTP clients, offensive scanners, or automation libraries (for example curl, python-requests, Go-http-client, axios, nuclei). Browser and first-party Claude clients normally present recognizable browser or product user agents; raw HTTP library agents on successful control-plane or product activity often indicate scripted access, stolen-session reuse, or unauthorized automation. Known benign automation patterns (axios or Go HTTP clients on file upload/delete, trusted device enrollment, and environment creation) are excluded. + +*Rule type*: esql + +*Rule indices*: None + +*Severity*: medium + +*Risk score*: 47 + +*Runs every*: 5m + +*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://platform.claude.com/docs/en/api/compliance/activities/list + +*Tags*: + +* Domain: GenAI +* Platform: Anthropic +* Data Source: Anthropic Audit Logs +* Use Case: Threat Detection +* Resources: Investigation Guide +* Rule Type: ES|QL +* Tactic: Command and Control + +*Version*: 1 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + + +*Investigating Anthropic Activity from a Suspicious User Agent* + + +Successful Anthropic audit events normally come from browser or first-party Claude clients. This rule flags scripting +HTTP clients, scanners, or automation libraries on successful activity. UAs are spoofable — corroborate with actor, +IP, and `event.action`. + +Benign automation using axios or Go HTTP clients is already excluded for `platform_file_uploaded`, +`platform_file_deleted`, `claude_file_uploaded`, `trusted_device_enrolled`, and `environment_created`. + +Unauthorized / escalate when a normally browser-bound user suddenly uses curl/python/Go-http-client on privileged +actions (IAM, exports, SSO, keys). Close as FP for approved SDK/CI identities on expected actions. + + +*Possible investigation steps* + + +- Compare `user_agent.original` and `event.action` to the user's baseline. A shift to curl, python-requests, or + Go-http-client on admin/export actions is higher priority than the same UA on already-allowlisted file ops. +- Branch `anthropic.audit.actor.type` and check `user.email` / `source.ip` against approved automation inventory. +- Pivot the same email/IP for auth failures, impossible travel, role changes, exports, or compliance logging changes. + + +*False positive analysis* + + +- Internal GenAI SDKs (`openai*`, `anthropic-sdk*`, `langchain*`) and CI jobs match — exclude stable identities, not + entire UA families. Extend the Go/axios action allowlist only with evidence of additional benign actions. + + +*Response and remediation* + + +- On unauthorized scripting access: revoke sessions, rotate credentials/MFA, review admin/export activity around the + alert, and hunt other scripting-UA activity from the same IP or email. + + +==== Rule query + + +[source, js] +---------------------------------- +from logs-anthropic.audit-* metadata _id, _version, _index +| where + data_stream.dataset == "anthropic.audit" and + event.outcome == "success" and + source.ip is not null and + source.ip != "0.0.0.0" and + user.email is not null and + user_agent.original is not null +| eval Esql.ua_lower = to_lower(user_agent.original) +| where + ( + Esql.ua_lower like "curl*" or + Esql.ua_lower like "python*" or + Esql.ua_lower like "wget*" or + Esql.ua_lower like "go-http*" or + Esql.ua_lower like "perl*" or + Esql.ua_lower like "libwww-perl*" or + Esql.ua_lower like "java*" or + Esql.ua_lower like "node*" or + Esql.ua_lower like "php*" or + Esql.ua_lower like "guzzle*" or + Esql.ua_lower like "bun*" or + Esql.ua_lower like "axios*" or + Esql.ua_lower like "undici*" or + Esql.ua_lower like "okhttp*" or + Esql.ua_lower like "apache-httpclient*" or + Esql.ua_lower like "httpclient*" or + Esql.ua_lower like "httpie*" or + Esql.ua_lower like "ruby*" or + Esql.ua_lower like "postmanruntime*" or + Esql.ua_lower like "restsharp*" or + Esql.ua_lower like "*kali*" or + Esql.ua_lower like "*parrot*" or + Esql.ua_lower like "*pentoo*" or + Esql.ua_lower like "*backbox*" or + Esql.ua_lower like "*blackarch*" or + Esql.ua_lower like "scrapy*" or + Esql.ua_lower like "mechanize*" or + Esql.ua_lower like "aiohttp*" or + Esql.ua_lower like "httpx*" or + Esql.ua_lower like "requests*" or + Esql.ua_lower like "pycurl*" or + Esql.ua_lower like "urllib*" or + Esql.ua_lower like "got/*" or + Esql.ua_lower like "node-fetch*" or + Esql.ua_lower like "superagent*" or + Esql.ua_lower like "ky/*" or + Esql.ua_lower like "fetch*" or + Esql.ua_lower like "deno*" or + Esql.ua_lower like "powershell*" or + Esql.ua_lower like "invoke-webrequest*" or + Esql.ua_lower like "windowspowershell*" or + Esql.ua_lower like "wget2*" or + Esql.ua_lower like "aria2*" or + Esql.ua_lower like "httrack*" or + Esql.ua_lower like "nikto*" or + Esql.ua_lower like "sqlmap*" or + Esql.ua_lower like "nmap*" or + Esql.ua_lower like "masscan*" or + Esql.ua_lower like "zgrab*" or + Esql.ua_lower like "nuclei*" or + Esql.ua_lower like "dirbuster*" or + Esql.ua_lower like "gobuster*" or + Esql.ua_lower like "ffuf*" or + Esql.ua_lower like "feroxbuster*" or + Esql.ua_lower like "wfuzz*" or + Esql.ua_lower like "burpsuite*" or + Esql.ua_lower like "hydra*" or + Esql.ua_lower like "metasploit*" or + Esql.ua_lower like "*havoc*" or + Esql.ua_lower like "*sliver*" or + Esql.ua_lower like "*cobalt strike*" or + Esql.ua_lower like "dart*" or + Esql.ua_lower like "rector*" or + Esql.ua_lower like "ruby-faraday*" or + Esql.ua_lower like "httparty*" or + Esql.ua_lower like "clj-http*" or + Esql.ua_lower like "hackney*" or + Esql.ua_lower like "elixir*" or + Esql.ua_lower like "swift-nio*" or + Esql.ua_lower like "vapor*" or + Esql.ua_lower like "rust*" or + Esql.ua_lower like "reqwest*" or + Esql.ua_lower like "ureq*" or + Esql.ua_lower like "hyper/*" or + Esql.ua_lower like "cohere-go*" or + Esql.ua_lower like "openai*" or + Esql.ua_lower like "anthropic-sdk*" or + Esql.ua_lower like "langchain*" or + Esql.ua_lower like "llamaindex*" or + Esql.ua_lower like "litellm*" or + Esql.ua_lower like "dspy*" or + Esql.ua_lower like "*zgrab*" or + Esql.ua_lower like "*masscan*" or + Esql.ua_lower like "*nessus*" or + Esql.ua_lower like "*shodan*" or + Esql.ua_lower like "*censys*" or + Esql.ua_lower like "*binaryedge*" or + Esql.ua_lower like "*internetmeasurement*" or + Esql.ua_lower like "*internetcensus*" or + Esql.ua_lower like "*shadowserver*" or + Esql.ua_lower like "*stretchoid*" or + Esql.ua_lower like "*http.rb*" + ) and + not ( + event.action in ( + "platform_file_deleted", + "platform_file_uploaded", + "claude_file_uploaded", + "trusted_device_enrolled", + "environment_created" + ) and + (Esql.ua_lower like "go-http*" or Esql.ua_lower like "axios*") + ) +| keep _id, _version, _index, @timestamp, event.*, organization.*, user.*, source.*, user_agent.*, anthropic.audit.*, data_stream.*, Esql.ua_lower + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Command and Control +** ID: TA0011 +** Reference URL: https://attack.mitre.org/tactics/TA0011/ +* Technique: +** Name: Application Layer Protocol +** ID: T1071 +** Reference URL: https://attack.mitre.org/techniques/T1071/ +* Sub-technique: +** Name: Web Protocols +** ID: T1071.001 +** Reference URL: https://attack.mitre.org/techniques/T1071/001/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-admin-api-key-created.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-admin-api-key-created.asciidoc new file mode 100644 index 0000000000..25d00cc2b6 --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-admin-api-key-created.asciidoc @@ -0,0 +1,113 @@ +[[prebuilt-rule-8-19-35-anthropic-admin-api-key-created]] +=== Anthropic Admin API Key Created + +Admin API keys grant programmatic access to organization and compliance APIs outside an interactive browser session. An attacker who creates one after compromise can automate role grants, exports, and logging changes without holding a user session that would time out under SSO. The key also survives password resets and IdP lockout if defenders revoke the interactive account but miss the API credential. + +*Rule type*: esql + +*Rule indices*: None + +*Severity*: medium + +*Risk score*: 47 + +*Runs every*: 5m + +*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://platform.claude.com/docs/en/api/compliance/activities/list + +*Tags*: + +* Domain: GenAI +* Platform: Anthropic +* Data Source: Anthropic Audit Logs +* Use Case: Identity and Access Audit +* Use Case: Threat Detection +* Resources: Investigation Guide +* Rule Type: ES|QL +* Tactic: Persistence + +*Version*: 1 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + + +*Investigating Anthropic Admin API Key Created* + + +Admin API keys provide durable programmatic org/compliance access that survives interactive session revocation. +Scopes at creation determine blast radius. + +Unauthorized = key not in the approved credentials inventory, no integration/onboarding ticket, or creation by an +actor who just received admin / ownership and immediately mints a key — especially before exports or SSO changes. + + +*Possible investigation steps* + + +- Record `anthropic.audit.admin_api_key_id` and `anthropic.audit.scopes` for later revoke and correlation. +- Branch actor: `user_actor` → is `user.email` / `source.ip` / UA a known platform admin? Scripting UA is higher + priority than a normal browser admin console session. +- Check whether the actor recently gained admin or primary ownership; look ±hours for exports, SSO changes, or + compliance logging changes from the same org. +- Close as FP when inventory + ticket match. Escalate when the key is unknown or precedes control-plane abuse. + + +*False positive analysis* + + +- Fleet / SIEM onboarding and scheduled rotation routinely create admin keys — require inventory evidence. + + +*Response and remediation* + + +- On unauthorized creation: revoke the key in Anthropic admin, rotate other admin credentials, and review API activity + attributable to that `anthropic.audit.admin_api_key_id` during the exposure window. + + +==== Rule query + + +[source, js] +---------------------------------- +from logs-anthropic.audit-* metadata _id, _version, _index +| where + data_stream.dataset == "anthropic.audit" and + mv_contains(event.category, "iam") and + event.action == "admin_api_key_created" +| keep _id, _version, _index, @timestamp, event.*, organization.*, user.*, source.*, user_agent.*, anthropic.audit.*, data_stream.* + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Persistence +** ID: TA0003 +** Reference URL: https://attack.mitre.org/tactics/TA0003/ +* Technique: +** Name: Account Manipulation +** ID: T1098 +** Reference URL: https://attack.mitre.org/techniques/T1098/ +* Sub-technique: +** Name: Additional Cloud Credentials +** ID: T1098.001 +** Reference URL: https://attack.mitre.org/techniques/T1098/001/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-admin-api-key-deleted.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-admin-api-key-deleted.asciidoc new file mode 100644 index 0000000000..a298dd7315 --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-admin-api-key-deleted.asciidoc @@ -0,0 +1,108 @@ +[[prebuilt-rule-8-19-35-anthropic-admin-api-key-deleted]] +=== Anthropic Admin API Key Deleted + +Admin API keys grant programmatic access to organization and compliance APIs. An attacker can delete legitimate admin API keys to break security monitoring or integrations, or to cover tracks after creating replacement credentials they control. Deletion without a nearby rotation event points more at sabotage than routine key hygiene. + +*Rule type*: esql + +*Rule indices*: None + +*Severity*: medium + +*Risk score*: 47 + +*Runs every*: 5m + +*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://platform.claude.com/docs/en/api/compliance/activities/list + +*Tags*: + +* Domain: GenAI +* Platform: Anthropic +* Data Source: Anthropic Audit Logs +* Use Case: Identity and Access Audit +* Use Case: Threat Detection +* Resources: Investigation Guide +* Rule Type: ES|QL +* Tactic: Impact + +*Version*: 1 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + + +*Investigating Anthropic Admin API Key Deleted* + + +Deleting an admin API key can break Fleet/compliance ingestion or admin automation — or remove a defender-owned key +after an attacker creates a replacement they control. + +Unauthorized = deletion without a matching nearby `admin_api_key_created` (rotation) or decommission ticket, or +deletion by an unexpected actor paired with logging disablement / exports / SSO changes. + + +*Possible investigation steps* + + +- Note deleted `anthropic.audit.admin_api_key_id` and actor. For `user_actor`, validate admin identity (email/IP/UA). + For `admin_api_key_actor`, check whether the deleting key (`actor.admin_api_key_id`) was itself recently created. +- Distinguish rotation (create+delete same window, same actor) from standalone deletion. +- Check whether Fleet/compliance ingestion stopped after the delete; correlate with compliance logging changes, + exports, or SSO modifications. + + +*False positive analysis* + + +- Scheduled rotation pairs delete with create during maintenance — ticket + sibling create event closes as FP. + + +*Response and remediation* + + +- On unauthorized deletion: restore required integrations with new keys, verify audit ingestion, and review other + admin changes by the same actor in the exposure window. + + +==== Rule query + + +[source, js] +---------------------------------- +from logs-anthropic.audit-* metadata _id, _version, _index +| where + data_stream.dataset == "anthropic.audit" and + mv_contains(event.category, "iam") and + event.action == "admin_api_key_deleted" +| keep _id, _version, _index, @timestamp, event.*, organization.*, user.*, source.*, user_agent.*, anthropic.audit.*, data_stream.* + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Impact +** ID: TA0040 +** Reference URL: https://attack.mitre.org/tactics/TA0040/ +* Technique: +** Name: Account Access Removal +** ID: T1531 +** Reference URL: https://attack.mitre.org/techniques/T1531/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-admin-role-assigned-to-user.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-admin-role-assigned-to-user.asciidoc new file mode 100644 index 0000000000..1f1f5861c0 --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-admin-role-assigned-to-user.asciidoc @@ -0,0 +1,129 @@ +[[prebuilt-rule-8-19-35-anthropic-admin-role-assigned-to-user]] +=== Anthropic Admin Role Assigned to User + +The organization admin role controls organization settings, integrations, membership, and security configuration in Anthropic Claude for Enterprise. Membership role changes are reported as `claude_user_role_updated` with `anthropic.audit.current_role`. An attacker can promote a compromised or newly invited account to org admin to turn initial access into durable control-plane access. From admin, they can disable SSO, mint admin API keys for automation, start data exports, and weaken audit logging. Workspace-scoped `role_assignment_granted` grants (for example bare `admin` on a workspace) are out of scope for this rule. + +*Rule type*: esql + +*Rule indices*: None + +*Severity*: high + +*Risk score*: 73 + +*Runs every*: 5m + +*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://www.elastic.co/security-labs/elastic-advances-llm-security +* https://platform.claude.com/docs/en/api/compliance/activities/list + +*Tags*: + +* Domain: GenAI +* Platform: Anthropic +* Data Source: Anthropic Audit Logs +* Use Case: Identity and Access Audit +* Use Case: Threat Detection +* Resources: Investigation Guide +* Rule Type: ES|QL +* Tactic: Persistence +* Tactic: Privilege Escalation + +*Version*: 1 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + + +*Investigating Anthropic Admin Role Assigned to User* + + +Org admin can change SSO, API keys, exports, and integrations. This rule matches `claude_user_role_updated` where +`anthropic.audit.current_role` is the literal `admin` (organization membership role — not workspace +`role_assignment_granted`, not project `chat_project:*` roles, not `rbac_role_assigned`). + +Unauthorized = no IAM ticket naming the target as org admin, target recently invited from an unexpected domain, or +the promotion is followed by key creation / SSO weakening / exports by the same actor or target. + + +*Possible investigation steps* + + +- Identify target (`user.target.id`, `user.target.email`, `related.user`) and assigner (`anthropic.audit.actor.type`; + for `user_actor` check email/IP/UA). +- Compare `anthropic.audit.previous_role` → `anthropic.audit.current_role` and check whether the target was invited or + otherwise role-changed shortly before becoming admin. +- After the promotion, review ~48h of target activity and org IAM (primary owner transfer, admin keys, SSO, exports). +- Close as FP when ticket + job function match. Escalate when the change is untracked or precedes control-plane abuse. + + +*False positive analysis* + + +- Onboarding and IR staffing promotions to org admin are valid — require change request when policy demands one. + + +*Response and remediation* + + +- On unauthorized promotion: revoke org admin (downgrade membership role), rotate credentials for assigner and + target, audit admin API keys and integration changes for the organization. + + +==== Rule query + + +[source, js] +---------------------------------- +from logs-anthropic.audit-* metadata _id, _version, _index +| where + data_stream.dataset == "anthropic.audit" and + mv_contains(event.category, "iam") and + event.action == "claude_user_role_updated" and + anthropic.audit.current_role == "admin" +| keep _id, _version, _index, @timestamp, event.*, organization.*, user.*, source.*, user_agent.*, anthropic.audit.*, data_stream.* + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Persistence +** ID: TA0003 +** Reference URL: https://attack.mitre.org/tactics/TA0003/ +* Technique: +** Name: Account Manipulation +** ID: T1098 +** Reference URL: https://attack.mitre.org/techniques/T1098/ +* Sub-technique: +** Name: Additional Cloud Roles +** ID: T1098.003 +** Reference URL: https://attack.mitre.org/techniques/T1098/003/ +* Tactic: +** Name: Privilege Escalation +** ID: TA0004 +** Reference URL: https://attack.mitre.org/tactics/TA0004/ +* Technique: +** Name: Account Manipulation +** ID: T1098 +** Reference URL: https://attack.mitre.org/techniques/T1098/ +* Sub-technique: +** Name: Additional Cloud Roles +** ID: T1098.003 +** Reference URL: https://attack.mitre.org/techniques/T1098/003/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-compliance-api-key-created.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-compliance-api-key-created.asciidoc new file mode 100644 index 0000000000..f662e54101 --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-compliance-api-key-created.asciidoc @@ -0,0 +1,115 @@ +[[prebuilt-rule-8-19-35-anthropic-compliance-api-key-created]] +=== Anthropic Compliance API Key Created + +Compliance-scoped API keys read organization audit activity and compliance data. Once an attacker has administrative access, creating one gives them programmatic read of chats, files, and membership without an interactive session. This is separate from admin API key creation, which covers organization administration rather than compliance read scopes. + +*Rule type*: esql + +*Rule indices*: None + +*Severity*: high + +*Risk score*: 73 + +*Runs every*: 5m + +*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://platform.claude.com/docs/en/api/compliance/activities/list + +*Tags*: + +* Domain: GenAI +* Platform: Anthropic +* Data Source: Anthropic Audit Logs +* Use Case: Identity and Access Audit +* Use Case: Threat Detection +* Resources: Investigation Guide +* Rule Type: ES|QL +* Tactic: Persistence + +*Version*: 1 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + + +*Investigating Anthropic Compliance API Key Created* + + +A new API key was created with compliance read scopes (audit/compliance data), distinct from admin API keys used for +org administration. Review `anthropic.audit.scopes` for exact permissions. + +Unauthorized = key not in approved inventory / no Fleet or investigation ticket, or creation by an unexpected actor +followed by `compliance_api_accessed` / audit export activity. + + +*Possible investigation steps* + + +- Record `anthropic.audit.api_key_id` and scopes. Branch actor (`user_actor` vs `admin_api_key_actor`) and validate + against known platform admins or parent admin keys. +- Pivot on that `api_key_id` for later `compliance_api_accessed` (programmatic use of the new key). +- Correlate ±hours for admin role grants, logging disablement, or data exports — recon before further intrusion. + + +*False positive analysis* + + +- First Fleet onboarding key for an org is expected — require inventory / ticket evidence. + + +*Response and remediation* + + +- On unauthorized creation: revoke the key and review Compliance API / export activity during the exposure window. + + +==== Rule query + + +[source, js] +---------------------------------- +from logs-anthropic.audit-* metadata _id, _version, _index +| where + data_stream.dataset == "anthropic.audit" and + event.action == "api_key_created" and + event.outcome == "success" and + anthropic.audit.scopes is not null and + ( + mv_contains(anthropic.audit.scopes, "read:compliance_activities") or + mv_contains(anthropic.audit.scopes, "read:compliance_org_data") + ) +| keep _id, _version, _index, @timestamp, event.*, organization.*, user.*, source.*, user_agent.*, anthropic.audit.*, data_stream.* + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Persistence +** ID: TA0003 +** Reference URL: https://attack.mitre.org/tactics/TA0003/ +* Technique: +** Name: Account Manipulation +** ID: T1098 +** Reference URL: https://attack.mitre.org/techniques/T1098/ +* Sub-technique: +** Name: Additional Cloud Credentials +** ID: T1098.001 +** Reference URL: https://attack.mitre.org/techniques/T1098/001/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-compliance-api-logging-disabled.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-compliance-api-logging-disabled.asciidoc new file mode 100644 index 0000000000..5408906a43 --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-compliance-api-logging-disabled.asciidoc @@ -0,0 +1,116 @@ +[[prebuilt-rule-8-19-35-anthropic-compliance-api-logging-disabled]] +=== Anthropic Compliance API Logging Disabled + +Compliance API logging feeds the anthropic.audit dataset that Anthropic audit detections run on. An attacker with administrative access can disable it so later role grants, API key creation, exports, and authentication changes stop reaching this data source. This rule detects the disable action itself. Activity that happens after logging stops may not appear in logs-anthropic.audit-*. + +*Rule type*: esql + +*Rule indices*: None + +*Severity*: high + +*Risk score*: 73 + +*Runs every*: 5m + +*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://platform.claude.com/docs/en/api/compliance/activities/list +* https://www.elastic.co/docs/reference/integrations/anthropic + +*Tags*: + +* Domain: GenAI +* Platform: Anthropic +* Data Source: Anthropic Audit Logs +* Use Case: Log Auditing +* Use Case: Threat Detection +* Resources: Investigation Guide +* Rule Type: ES|QL +* Tactic: Defense Evasion + +*Version*: 1 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + + +*Investigating Anthropic Compliance API Logging Disabled* + + +Compliance API logging feeds `logs-anthropic.audit-*`. Disabling it creates a **blind window**: later admin actions +may not appear in this data source even if other logging remains. Do not assume the timeline after disable is complete. + +Unauthorized = no platform/security ticket for Fleet/integration work, and logging was not re-enabled promptly — or +disable is paired with role grants, key creation, exports, or SSO changes. + + +*Possible investigation steps* + + +- Confirm `anthropic.audit.compliance_api_logging_enabled == false`. Do not confuse with + `compliance_api_enabled` (whether the Compliance API itself is on). +- Branch actor: `admin_api_key_actor` → which key (`anthropic.audit.actor.admin_api_key_id`); `user_actor` → + email/IP/UA vs known admins. +- Pivot the same `organization.id` for admin grants, key creation, exports, or SSO changes **before** the disable + (still visible) and note the blind window start time. +- Gate re-enable: treat the case as open until logging is back on and fresh events appear in `logs-anthropic.audit-*`. + + +*False positive analysis* + + +- Integration testing / pipeline migrations can disable logging briefly — require a ticket and verify re-enable. + + +*Response and remediation* + + +- Re-enable compliance API logging first and confirm ingestion resumes. Then reconstruct the blind window via any + prior exports, Anthropic support, or other data sources, and review configuration changes around the disable. + + +==== Rule query + + +[source, js] +---------------------------------- +from logs-anthropic.audit-* metadata _id, _version, _index +| where + data_stream.dataset == "anthropic.audit" and + mv_contains(event.category, "configuration") and + event.action == "org_compliance_api_settings_updated" and + anthropic.audit.compliance_api_logging_enabled == false +| keep _id, _version, _index, @timestamp, event.*, organization.*, user.*, source.*, user_agent.*, anthropic.audit.*, data_stream.* + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Defense Evasion +** ID: TA0005 +** Reference URL: https://attack.mitre.org/tactics/TA0005/ +* Technique: +** Name: Impair Defenses +** ID: T1562 +** Reference URL: https://attack.mitre.org/techniques/T1562/ +* Sub-technique: +** Name: Disable or Modify Cloud Logs +** ID: T1562.008 +** Reference URL: https://attack.mitre.org/techniques/T1562/008/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-compliance-audit-log-export-accessed.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-compliance-audit-log-export-accessed.asciidoc new file mode 100644 index 0000000000..3e78e1760c --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-compliance-audit-log-export-accessed.asciidoc @@ -0,0 +1,107 @@ +[[prebuilt-rule-8-19-35-anthropic-compliance-audit-log-export-accessed]] +=== Anthropic Compliance Audit Log Export Accessed + +An audit log export archive was accessed, meaning the actor downloaded exported audit activity. Attackers pull audit exports to see what defenders can observe, look for detection gaps, or remove evidence before making other control-plane changes. + +*Rule type*: esql + +*Rule indices*: None + +*Severity*: medium + +*Risk score*: 47 + +*Runs every*: 5m + +*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://platform.claude.com/docs/en/api/compliance/activities/list + +*Tags*: + +* Domain: GenAI +* Platform: Anthropic +* Data Source: Anthropic Audit Logs +* Use Case: Threat Detection +* Resources: Investigation Guide +* Rule Type: ES|QL +* Tactic: Collection + +*Version*: 1 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + + +*Investigating Anthropic Compliance Audit Log Export Accessed* + + +An audit-log export archive was downloaded. Attackers use this to see what defenders can observe or to stage before +further control-plane changes. Correlate with `audit_log_export_started` for the same org. + +Unauthorized = no security/compliance ticket, export window covering recent IAM/logging changes without investigation +context, or download followed by compliance logging disablement / SSO changes / data exports. + + +*Possible investigation steps* + + +- Use `anthropic.audit.from_date` / `to_date` to see which admin activity the actor pulled; match actor email/IP/UA to + known IR/compliance staff. +- Find preceding `audit_log_export_started`. Flag if the window covers recent IAM or logging changes the actor then + altered. +- Sequence check: download → logging disable / SSO change / org data export is a common recon-then-abuse pattern. + + +*False positive analysis* + + +- SIEM validation and regulatory requests are expected — require an approved ticket. + + +*Response and remediation* + + +- On unauthorized access: revoke actor access, determine whether export data left the org, and review whether + compliance logging was disabled or modified around the same time. + + +==== Rule query + + +[source, js] +---------------------------------- +from logs-anthropic.audit-* metadata _id, _version, _index +| where + data_stream.dataset == "anthropic.audit" and + mv_contains(event.category, "file") and + event.action == "audit_log_export_accessed" +| keep _id, _version, _index, @timestamp, event.*, organization.*, user.*, source.*, user_agent.*, anthropic.audit.*, data_stream.* + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Collection +** ID: TA0009 +** Reference URL: https://attack.mitre.org/tactics/TA0009/ +* Technique: +** Name: Data from Cloud Storage +** ID: T1530 +** Reference URL: https://attack.mitre.org/techniques/T1530/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-excessive-chat-access-failures.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-excessive-chat-access-failures.asciidoc new file mode 100644 index 0000000000..96c3147110 --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-excessive-chat-access-failures.asciidoc @@ -0,0 +1,124 @@ +[[prebuilt-rule-8-19-35-anthropic-excessive-chat-access-failures]] +=== Anthropic Excessive Chat Access Failures + +Detects a single authenticated user generating an unusually high number of denied Claude chat access attempts in a 24-hour window. That pattern fits automated chat enumeration or attempts to reach conversations outside the actor's permissions. Unauthenticated shared-link actors lack user.id and are excluded. + +*Rule type*: esql + +*Rule indices*: None + +*Severity*: medium + +*Risk score*: 47 + +*Runs every*: 1h + +*Searches indices from*: now-24h ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://platform.claude.com/docs/en/api/compliance/activities/list + +*Tags*: + +* Domain: GenAI +* Platform: Anthropic +* Data Source: Anthropic Audit Logs +* Use Case: Threat Detection +* Use Case: UEBA +* Resources: Investigation Guide +* Rule Type: ES|QL +* Tactic: Discovery + +*Version*: 1 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + + +*Investigating Anthropic Excessive Chat Access Failures* + + +Alert keys: `user.id`, `organization.id`, and `source.ip` (plus `user.email` when present). The rule aggregates ≥20 +`claude_chat_access_failed` events for one authenticated user in that org/IP over 24 hours. Unauthenticated +shared-link failures lack `user.id` and are out of scope. + +True positive: high failure-to-`claude_chat_viewed` ratio, sequential/patterned chat IDs, scripting UA. False +positive: legal/IR link review or broken bookmarks with scattered IDs and many successful views nearby. + + +*Possible investigation steps* + + +- Start from the alert keys (`user.id` / `organization.id` / `source.ip`) and the time window; pivot raw + `claude_chat_access_failed` events. +- Review chat ID lists: sequential or patterned IDs suggest enumeration; scattered IDs fit shared-link browsing. +- Compare failure volume to `claude_chat_viewed` from the same actor. High failure-to-success ratio → enumeration. +- Check UA/automation signals and whether any failed chat IDs later succeed. Correlate with IAM/SSO/compliance key + changes in the same period. + + +*False positive analysis* + + +- Large revoked-link reviews and retrying expired URLs are FP when IDs are scattered and many `claude_chat_viewed` + successes sit nearby (legal/IR ticket optional corroboration). + + +*Response and remediation* + + +- On confirmed enumeration: revoke sessions, review recently accessed chats, rotate exposed shared links if needed, + and check for data export or artifact sharing by the same user. + + +==== Rule query + + +[source, js] +---------------------------------- +from logs-anthropic.audit-* +| where + data_stream.dataset == "anthropic.audit" and + event.action == "claude_chat_access_failed" and + user.id is not null +| stats + Esql.event_count = count(*), + Esql.event_id_values = values(event.id), + Esql.anthropic_audit_claude_chat_id_values = values(anthropic.audit.claude_chat_id), + Esql.anthropic_audit_claude_project_id_values = values(anthropic.audit.claude_project_id), + Esql.source_ip_values = values(source.ip), + Esql.user_agent_original_values = values(user_agent.original), + Esql.anthropic_audit_actor_type_values = values(anthropic.audit.actor.type), + Esql.user_email_values = values(user.email), + Esql.timestamp_first_seen = min(@timestamp), + Esql.timestamp_last_seen = max(@timestamp) + by user.id, organization.id, source.ip +| where Esql.event_count >= 20 +| keep user.id, organization.id, source.ip, Esql.* + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Discovery +** ID: TA0007 +** Reference URL: https://attack.mitre.org/tactics/TA0007/ +* Technique: +** Name: Cloud Service Discovery +** ID: T1526 +** Reference URL: https://attack.mitre.org/techniques/T1526/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-excessive-chat-creation.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-excessive-chat-creation.asciidoc new file mode 100644 index 0000000000..e6be53a7de --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-excessive-chat-creation.asciidoc @@ -0,0 +1,120 @@ +[[prebuilt-rule-8-19-35-anthropic-excessive-chat-creation]] +=== Anthropic Excessive Chat Creation + +Detects an unusually high number of Claude chat creation events for the same user email within a 24-hour period. Burst chat creation can indicate automated LLM abuse, resource hijacking to burn organizational quotas, or scripted workflows used to stage many parallel conversations for data processing or prompt-injection campaigns. + +*Rule type*: esql + +*Rule indices*: None + +*Severity*: medium + +*Risk score*: 47 + +*Runs every*: 1h + +*Searches indices from*: now-24h ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://platform.claude.com/docs/en/api/compliance/activities/list + +*Tags*: + +* Domain: GenAI +* Platform: Anthropic +* Data Source: Anthropic Audit Logs +* Use Case: Threat Detection +* Use Case: UEBA +* Resources: Investigation Guide +* Rule Type: ES|QL +* Tactic: Impact + +*Version*: 1 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + + +*Investigating Anthropic Excessive Chat Creation* + + +One mailbox created a large burst of Claude chats in 24 hours — fits automation, quota burn, or scripted parallel +workflows. + +True-positive signals: scripting UA (curl/python/Go-http-client), many distinct project IDs, concurrent file uploads +or deletions, or follow-on exports. False-positive signals: known eval/load-test accounts, onboarding templates from +one admin with browser UA and no data-access follow-ons. + + +*Possible investigation steps* + + +- Prefer alerts with scripting UA and/or many distinct project IDs over browser UA confined to one known project. +- Correlate with high file uploads, chat deletions, or org data export from the same email in the same window. + + +*False positive analysis* + + +- Known eval/load-test seats and onboarding template creators with browser UA and no data-access follow-ons are FP. + + +*Response and remediation* + + +- When TP signals hold: revoke sessions, review project membership, and apply rate limits or policy changes for the + actor. + + +==== Rule query + + +[source, js] +---------------------------------- +from logs-anthropic.audit-* +| where + data_stream.dataset == "anthropic.audit" and + event.action == "claude_chat_created" and + event.outcome == "success" and + user.email is not null +| stats + Esql.event_count = count(*), + Esql.event_id_values = values(event.id), + Esql.anthropic_audit_claude_chat_id_values = values(anthropic.audit.claude_chat_id), + Esql.anthropic_audit_claude_project_id_values = values(anthropic.audit.claude_project_id), + Esql.source_ip_values = values(source.ip), + Esql.user_agent_original_values = values(user_agent.original), + Esql.anthropic_audit_actor_type_values = values(anthropic.audit.actor.type), + Esql.user_id_values = values(user.id), + Esql.timestamp_first_seen = min(@timestamp), + Esql.timestamp_last_seen = max(@timestamp) + by user.email +| where Esql.event_count >= 20 +| keep user.email, Esql.* + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Impact +** ID: TA0040 +** Reference URL: https://attack.mitre.org/tactics/TA0040/ +* Technique: +** Name: Resource Hijacking +** ID: T1496 +** Reference URL: https://attack.mitre.org/techniques/T1496/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-excessive-chat-deletion.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-excessive-chat-deletion.asciidoc new file mode 100644 index 0000000000..090bcd2d51 --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-excessive-chat-deletion.asciidoc @@ -0,0 +1,122 @@ +[[prebuilt-rule-8-19-35-anthropic-excessive-chat-deletion]] +=== Anthropic Excessive Chat Deletion + +Detects an unusually high number of Claude chat deletion events for the same user email within a single calendar day. Mass chat deletion can indicate an attempt to remove conversation history, cover tracks after misuse of Claude, or automated cleanup following data staging or prompt abuse. + +*Rule type*: esql + +*Rule indices*: None + +*Severity*: medium + +*Risk score*: 47 + +*Runs every*: 1h + +*Searches indices from*: now-24h ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://platform.claude.com/docs/en/api/compliance/activities/list + +*Tags*: + +* Domain: GenAI +* Platform: Anthropic +* Data Source: Anthropic Audit Logs +* Use Case: Threat Detection +* Use Case: UEBA +* Resources: Investigation Guide +* Rule Type: ES|QL +* Tactic: Defense Evasion + +*Version*: 1 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + + +*Investigating Anthropic Excessive Chat Deletion* + + +One mailbox deleted many chats in a UTC day bucket. Deleted content may no longer be viewable in the product UI — +preserve audit history early. + +Escalate when deletions follow uploads/exports/sharing, UA looks scripted, or compliance logging was disabled nearby. +Close as FP for scheduled retention cleanup or migration tooling with a ticket. + + +*Possible investigation steps* + + +- Capture chat/project ID values from the alert while they remain in audit history. +- Compare deletion volume to prior `claude_chat_created` / `claude_file_uploaded` from the same email — delete-after- + upload is higher priority than cleanup of empty chats. +- Inspect IP/UA for scripted patterns; correlate with logging disablement, SSO changes, or data exports. + + +*False positive analysis* + + +- Project closure cleanup and migration tooling often bulk-delete in one session. + + +*Response and remediation* + + +- On malicious deletion: preserve remaining audit exports, revoke sessions, and investigate whether sensitive content + was uploaded or shared before deletion. + + +==== Rule query + + +[source, js] +---------------------------------- +from logs-anthropic.audit-* +| where + data_stream.dataset == "anthropic.audit" and + event.action == "claude_chat_deleted" and + event.outcome == "success" and + user.email is not null +| eval Esql.time_bucket = DATE_TRUNC(1 day, @timestamp) +| stats + Esql.event_count = count(*), + Esql.event_id_values = values(event.id), + Esql.anthropic_audit_claude_chat_id_values = values(anthropic.audit.claude_chat_id), + Esql.anthropic_audit_claude_project_id_values = values(anthropic.audit.claude_project_id), + Esql.source_ip_values = values(source.ip), + Esql.user_agent_original_values = values(user_agent.original), + Esql.anthropic_audit_actor_type_values = values(anthropic.audit.actor.type), + Esql.user_id_values = values(user.id), + Esql.timestamp_first_seen = min(@timestamp), + Esql.timestamp_last_seen = max(@timestamp) + by user.email, Esql.time_bucket +| where Esql.event_count >= 30 +| keep user.email, Esql.* + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Defense Evasion +** ID: TA0005 +** Reference URL: https://attack.mitre.org/tactics/TA0005/ +* Technique: +** Name: Indicator Removal +** ID: T1070 +** Reference URL: https://attack.mitre.org/techniques/T1070/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-excessive-chat-snapshot-creation.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-excessive-chat-snapshot-creation.asciidoc new file mode 100644 index 0000000000..4782f6ccad --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-excessive-chat-snapshot-creation.asciidoc @@ -0,0 +1,124 @@ +[[prebuilt-rule-8-19-35-anthropic-excessive-chat-snapshot-creation]] +=== Anthropic Excessive Chat Snapshot Creation + +Detects an unusually high number of successful Claude chat snapshot creation events for the same user email within a rolling 24-hour window. Chat snapshots package conversation content into shareable exports; sustained creation volume can indicate staging of organizational chat data for exfiltration via Anthropic's web service or automated bulk export of sensitive prompts and responses. + +*Rule type*: esql + +*Rule indices*: None + +*Severity*: medium + +*Risk score*: 47 + +*Runs every*: 1h + +*Searches indices from*: now-24h ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://platform.claude.com/docs/en/api/compliance/activities/list + +*Tags*: + +* Domain: GenAI +* Platform: Anthropic +* Data Source: Anthropic Audit Logs +* Use Case: Threat Detection +* Use Case: UEBA +* Resources: Investigation Guide +* Rule Type: ES|QL +* Tactic: Exfiltration + +*Version*: 1 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + + +*Investigating Anthropic Excessive Chat Snapshot Creation* + + +One mailbox created many chat snapshots in 24 hours. Snapshots can package conversation content for handoff — or for +exfiltration staging. Source IP/UA are investigation fields, not grouping keys, so multi-IP bursts still accumulate. + +Escalate when scripting UA, concurrent file uploads / public artifact sharing / data exports / chat deletions appear, +or snapshots span many unrelated chats. Close as FP for documented knowledge handoffs, training packaging, or +compliance archival automation. + + +*Possible investigation steps* + + +- Review event count and snapshot/chat ID lists — many distinct chats is stronger than repeated snapshots of one chat. +- Inspect IP/UA values for automation. Correlate with uploads, public artifact sharing, exports, or deletions from + the same email. +- Note actor type and whether the same email appears across organizations (`organization_id` values). + + +*False positive analysis* + + +- Power-user archival and compliance snapshot jobs commonly exceed the threshold. + + +*Response and remediation* + + +- On unauthorized staging: revoke sessions, review snapshot destinations and shared links, and tighten chat sharing + or export policy for the actor. + + +==== Rule query + + +[source, js] +---------------------------------- +from logs-anthropic.audit-* +| where + data_stream.dataset == "anthropic.audit" and + mv_contains(event.category, "file") and + event.action == "claude_chat_snapshot_created" and + event.outcome == "success" and + user.email is not null +| stats + Esql.event_count = count(*), + Esql.event_id_values = values(event.id), + Esql.anthropic_audit_claude_chat_snapshot_id_values = values(anthropic.audit.claude_chat_snapshot_id), + Esql.anthropic_audit_claude_chat_id_values = values(anthropic.audit.claude_chat_id), + Esql.source_ip_values = values(source.ip), + Esql.user_agent_original_values = values(user_agent.original), + Esql.anthropic_audit_actor_type_values = values(anthropic.audit.actor.type), + Esql.organization_id_values = values(organization.id), + Esql.user_id_values = values(user.id), + Esql.timestamp_first_seen = min(@timestamp), + Esql.timestamp_last_seen = max(@timestamp) + by user.email +| where Esql.event_count >= 10 +| keep user.email, Esql.* + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Exfiltration +** ID: TA0010 +** Reference URL: https://attack.mitre.org/tactics/TA0010/ +* Technique: +** Name: Exfiltration Over Web Service +** ID: T1567 +** Reference URL: https://attack.mitre.org/techniques/T1567/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-extra-usage-spend-limit-deleted.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-extra-usage-spend-limit-deleted.asciidoc new file mode 100644 index 0000000000..e1ef43363c --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-extra-usage-spend-limit-deleted.asciidoc @@ -0,0 +1,111 @@ +[[prebuilt-rule-8-19-35-anthropic-extra-usage-spend-limit-deleted]] +=== Anthropic Extra Usage Spend Limit Deleted + +Extra usage spend limits cap Anthropic organizational spend beyond included usage. Deleting a spend limit removes that cap and can enable unrestricted API or Claude consumption. An attacker who already has administrative or API access can delete the limit to burn budget, run large automated workloads, or stage resource abuse without the previous guardrail. + +*Rule type*: esql + +*Rule indices*: None + +*Severity*: medium + +*Risk score*: 47 + +*Runs every*: 5m + +*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://platform.claude.com/docs/en/api/compliance/activities/list + +*Tags*: + +* Domain: GenAI +* Platform: Anthropic +* Data Source: Anthropic Audit Logs +* Use Case: Threat Detection +* Resources: Investigation Guide +* Rule Type: ES|QL +* Tactic: Impact + +*Version*: 1 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + + +*Investigating Anthropic Extra Usage Spend Limit Deleted* + + +Deleting an extra-usage spend limit removes a billing guardrail; it does not create spend by itself. Treat it as an +early signal for follow-on quota burn or automated workloads. + +Unauthorized = no finance/platform ticket to redesign billing, and no nearby `extra_usage_spend_limit_created` / +`extra_usage_spend_limit_updated` that replaces the deleted limit — especially if high chat creation or file uploads +follow. + + +*Possible investigation steps* + + +- Branch on actor: `user_actor` → `user.email` / `source.ip` / UA; `api_actor` → `anthropic.audit.actor.api_key_id` + and whether that key is in inventory. +- Check for create/update of a replacement limit within the same change window (planned redesign) vs standalone + deletion. +- After the delete, look for elevated `claude_chat_created`, file uploads, or other high-volume activity on the same + `organization.id`. +- Close as FP when a finance/platform ticket names the redesign and a replacement create/update exists. Escalate when + deletion is orphaned or usage spikes afterward. + + +*False positive analysis* + + +- Billing consolidations often delete an old limit shortly before creating a new one. + + +*Response and remediation* + + +- On unauthorized deletion: restore an appropriate spend limit, review API keys and admin sessions active during the + exposure window, and quantify extra usage accrued after the change. + + +==== Rule query + + +[source, js] +---------------------------------- +from logs-anthropic.audit-* metadata _id, _version, _index +| where + data_stream.dataset == "anthropic.audit" and + mv_contains(event.category, "configuration") and + event.action == "extra_usage_spend_limit_deleted" +| keep _id, _version, _index, @timestamp, event.*, organization.*, user.*, source.*, user_agent.*, anthropic.audit.*, data_stream.* + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Impact +** ID: TA0040 +** Reference URL: https://attack.mitre.org/tactics/TA0040/ +* Technique: +** Name: Resource Hijacking +** ID: T1496 +** Reference URL: https://attack.mitre.org/techniques/T1496/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-high-file-upload-activity.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-high-file-upload-activity.asciidoc new file mode 100644 index 0000000000..0488740ab1 --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-high-file-upload-activity.asciidoc @@ -0,0 +1,126 @@ +[[prebuilt-rule-8-19-35-anthropic-high-file-upload-activity]] +=== Anthropic High File Upload Activity + +Detects an unusually high volume of Claude file uploads from the same user email and source IP within a rolling 24-hour period. Sustained upload activity can indicate staging of sensitive documents in Claude chats for later retrieval, automated ingestion of data into LLM workflows, or abuse of organizational Claude access to move files into the cloud service. + +*Rule type*: esql + +*Rule indices*: None + +*Severity*: medium + +*Risk score*: 47 + +*Runs every*: 1h + +*Searches indices from*: now-24h ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://platform.claude.com/docs/en/api/compliance/activities/list + +*Tags*: + +* Domain: GenAI +* Platform: Anthropic +* Data Source: Anthropic Audit Logs +* Use Case: Threat Detection +* Use Case: UEBA +* Resources: Investigation Guide +* Rule Type: ES|QL +* Tactic: Exfiltration + +*Version*: 1 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + + +*Investigating Anthropic High File Upload Activity* + + +One `user.email` + `source.ip` pair uploaded a large volume of Claude files in 24 hours — possible staging for later +retrieval, automated ingestion, or abuse of org Claude access. + +Unauthorized / escalate when filenames look sensitive, uploads target shared/sensitive projects, UA looks automated +(curl/python vs browser), or artifact sharing / exports follow. Close as FP for documented migrations, RAG pilots, or +batch attach jobs with expected project IDs. + + +*Possible investigation steps* + + +- Start with `Esql.event_count`, `Esql.file_name_values`, and chat/project ID lists — sensitive names or shared + project IDs raise priority. +- Triage `user_agent` on raw uploads: browser-like vs scripting clients. Scripting UAs with many distinct file IDs + look more like automation than interactive work. +- Pivot raw `logs-anthropic.audit-*` for individual `anthropic.audit.claude_file_id` / filenames and whether + `claude_file_viewed` or chat activity matches the upload volume. +- Correlate with artifact sharing, data exports, or compliance key creation from the same user. + + +*False positive analysis* + + +- Document migrations and RAG indexing from one seat commonly exceed the threshold. + + +*Response and remediation* + + +- On unauthorized staging: revoke sessions, review uploaded names/file IDs for sensitive content, and tighten project + sharing or upload policy for the actor. + + +==== Rule query + + +[source, js] +---------------------------------- +from logs-anthropic.audit-* +| where + data_stream.dataset == "anthropic.audit" and + event.action == "claude_file_uploaded" and + event.outcome == "success" and + user.email is not null and + source.ip is not null +| stats + Esql.event_count = count(*), + Esql.event_id_values = values(event.id), + Esql.file_name_values = values(file.name), + Esql.anthropic_audit_claude_file_id_values = values(anthropic.audit.claude_file_id), + Esql.anthropic_audit_claude_chat_id_values = values(anthropic.audit.claude_chat_id), + Esql.anthropic_audit_claude_project_id_values = values(anthropic.audit.claude_project_id), + Esql.user_agent_original_values = values(user_agent.original), + Esql.anthropic_audit_actor_type_values = values(anthropic.audit.actor.type), + Esql.timestamp_first_seen = min(@timestamp), + Esql.timestamp_last_seen = max(@timestamp) + by user.email, source.ip +| where Esql.event_count >= 100 +| keep user.email, source.ip, Esql.* + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Exfiltration +** ID: TA0010 +** Reference URL: https://attack.mitre.org/tactics/TA0010/ +* Technique: +** Name: Exfiltration Over Web Service +** ID: T1567 +** Reference URL: https://attack.mitre.org/techniques/T1567/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-magic-link-second-factor-disabled.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-magic-link-second-factor-disabled.asciidoc new file mode 100644 index 0000000000..b9d723f008 --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-magic-link-second-factor-disabled.asciidoc @@ -0,0 +1,115 @@ +[[prebuilt-rule-8-19-35-anthropic-magic-link-second-factor-disabled]] +=== Anthropic Magic Link Second Factor Disabled + +Magic link second factor adds an extra authentication step to passwordless sign-in for Anthropic. An attacker with administrative access can turn it off so magic link logins no longer require the second factor, which makes stolen or attacker-controlled mailboxes usable for interactive access. This often shows up alongside SSO weakening when the attacker wants a fallback authentication path outside the corporate IdP. + +*Rule type*: esql + +*Rule indices*: None + +*Severity*: high + +*Risk score*: 73 + +*Runs every*: 5m + +*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://platform.claude.com/docs/en/api/compliance/activities/list + +*Tags*: + +* Domain: GenAI +* Domain: Identity +* Platform: Anthropic +* Data Source: Anthropic Audit Logs +* Use Case: Identity and Access Audit +* Use Case: Threat Detection +* Resources: Investigation Guide +* Rule Type: ES|QL +* Tactic: Defense Evasion + +*Version*: 1 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + + +*Investigating Anthropic Magic Link Second Factor Disabled* + + +Magic link second factor is an extra step on passwordless sign-in. Disabling it means anyone who can receive the +mailbox's magic link can authenticate without that second check — a useful fallback if an attacker also weakens SSO. + +Treat as unauthorized unless identity has a change ticket / maintenance window that names this control, or the setting +was re-enabled (or replaced with equivalent MFA) within the same change window. + + +*Possible investigation steps* + + +- Identify the actor (`anthropic.audit.actor.type`). For `user_actor`, check whether `user.email`, `source.ip`, and + `user_agent.original` match a known admin; a scripting UA or unfamiliar IP raises priority. +- In the same `organization.id` and ±hours window, look for SSO disable/deactivate/delete, admin role grants, or a + burst of `magic_link_login_succeeded` after the change. +- Close as FP when the ticket matches the actor and time, and second factor (or equivalent IdP MFA) was restored. + Escalate when there is no ticket, the actor is unexpected, or sibling auth-weakening events appear. + + +*False positive analysis* + + +- Auth migrations and troubleshooting sometimes disable this briefly; require a ticket and restoration evidence. + + +*Response and remediation* + + +- On unauthorized disable: re-enable magic link second factor, review magic-link sign-ins since the change, and + investigate concurrent SSO / admin IAM events for the same organization. + + +==== Rule query + + +[source, js] +---------------------------------- +from logs-anthropic.audit-* metadata _id, _version, _index +| where + data_stream.dataset == "anthropic.audit" and + mv_contains(event.category, "configuration") and + event.action == "org_magic_link_second_factor_toggled" and + anthropic.audit.enabled == false +| keep _id, _version, _index, @timestamp, event.*, organization.*, user.*, source.*, user_agent.*, anthropic.audit.*, data_stream.* + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Defense Evasion +** ID: TA0005 +** Reference URL: https://attack.mitre.org/tactics/TA0005/ +* Technique: +** Name: Modify Authentication Process +** ID: T1556 +** Reference URL: https://attack.mitre.org/techniques/T1556/ +* Sub-technique: +** Name: Multi-Factor Authentication +** ID: T1556.006 +** Reference URL: https://attack.mitre.org/techniques/T1556/006/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-mcp-server-created.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-mcp-server-created.asciidoc new file mode 100644 index 0000000000..9165cfa4a6 --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-mcp-server-created.asciidoc @@ -0,0 +1,109 @@ +[[prebuilt-rule-8-19-35-anthropic-mcp-server-created]] +=== Anthropic MCP Server Created + +Detects the first successful creation of a Model Context Protocol (MCP) server integration name in an Anthropic organization within the rule history window. MCP servers add external data pathways into Claude and can expose organizational data to third-party infrastructure. This is a New Terms rule keyed on `organization.id` and `anthropic.audit.mcp_server_name` so the same connector name can still alert in another tenant, while routine re-creation of an already-seen name in the same organization does not. + +*Rule type*: new_terms + +*Rule indices*: + +* logs-anthropic.audit-* + +*Severity*: medium + +*Risk score*: 47 + +*Runs every*: 5m + +*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://platform.claude.com/docs/en/api/compliance/activities/list + +*Tags*: + +* Domain: GenAI +* Platform: Anthropic +* Data Source: Anthropic Audit Logs +* Use Case: Threat Detection +* Use Case: UEBA +* Resources: Investigation Guide +* Rule Type: New Terms +* Tactic: Persistence + +*Version*: 1 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + + +*Investigating Anthropic MCP Server Created* + + +First-seen MCP server name for this `organization.id` within the rule history window. MCP connectors add external +data pathways into Claude. + +Unauthorized = server name not on approved integration inventory, actor is unexpected/contractor without a request, +or creation pairs with data export / public artifact sharing / privilege changes. Close as FP when inventory and +pilot/onboarding ticket match. + + +*Possible investigation steps* + + +- Record `anthropic.audit.mcp_server_name` / `mcp_server_id` and actor. For `user_actor`, validate email/IP/UA + against platform admins. +- Search `mcp_server_updated` / `mcp_server_deleted` for the same server ID; look for exports, artifact sharing, or + admin role grants in the same window. +- Close as FP when inventory + pilot ticket match the name; escalate unknown connector names immediately. + + +*False positive analysis* + + +- Claude pilots commonly introduce first-seen approved connector names from platform teams. + + +*Response and remediation* + + +- On unauthorized creation: remove the MCP server and review data accessed through the connector during the exposure + window. + + +==== Rule query + + +[source, js] +---------------------------------- +data_stream.dataset: "anthropic.audit" and + event.category: "configuration" and + event.action: "mcp_server_created" and + event.outcome: "success" + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Persistence +** ID: TA0003 +** Reference URL: https://attack.mitre.org/tactics/TA0003/ +* Technique: +** Name: Software Extensions +** ID: T1176 +** Reference URL: https://attack.mitre.org/techniques/T1176/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-multiple-authentication-failures.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-multiple-authentication-failures.asciidoc new file mode 100644 index 0000000000..1a4c48019d --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-multiple-authentication-failures.asciidoc @@ -0,0 +1,127 @@ +[[prebuilt-rule-8-19-35-anthropic-multiple-authentication-failures]] +=== Anthropic Multiple Authentication Failures + +Detects at least five failed Anthropic authentication events for the same user email within one hour. Failures are matched by authentication category and failure outcome (for example magic-link or SSO login failures). That pattern fits repeated guessing, stale magic link abuse, or automated login attempts against one account. + +*Rule type*: esql + +*Rule indices*: None + +*Severity*: medium + +*Risk score*: 47 + +*Runs every*: 15m + +*Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://platform.claude.com/docs/en/api/compliance/activities/list + +*Tags*: + +* Domain: GenAI +* Domain: Identity +* Platform: Anthropic +* Data Source: Anthropic Audit Logs +* Use Case: Identity and Access Audit +* Use Case: Threat Detection +* Use Case: UEBA +* Resources: Investigation Guide +* Rule Type: ES|QL +* Tactic: Credential Access + +*Version*: 1 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + + +*Investigating Anthropic Multiple Authentication Failures* + + +One mailbox produced a burst of authentication failures (magic-link, SSO, or other auth failures) within an hour. +Use IP diversity on the alert to separate focused retries from distributed automation. + +Escalate when many distinct IPs hit one email, failures precede a successful login from an unfamiliar IP, or SSO / +magic-link second-factor weakening sits nearby. Close as FP for expired magic-link retries from one IP/UA or IdP +pilot testing with a ticket. + + +*Possible investigation steps* + + +- Read `Esql.event_count`, `Esql.event_action_values`, `Esql.source_ip_values`, and + `Esql.source_ip_distinct_count`. +- Low IP diversity → one device/egress (typos, expired links, focused guessing). High diversity → distributed + automation or proxy rotation — higher priority. +- Inspect UA / actor-type values for automation. Search for successful `magic_link_login_succeeded` / + `sso_login_succeeded` for the same email or IPs in the window. +- Correlate with **Anthropic SSO Disabled or Connection Removed** or magic-link second-factor disablement when + org-scoped admin events are present. + + +*False positive analysis* + + +- Expired magic-link click storms from one IP and named IdP cutover tests are common FPs. + + +*Response and remediation* + + +- On suspected stuffing/takeover: invalidate sessions, reset credentials/MFA, and review successful logins from new + IPs. If failures precede a successful unfamiliar login, expand to data access and admin changes. + + +==== Rule query + + +[source, js] +---------------------------------- +from logs-anthropic.audit-* +| where + data_stream.dataset == "anthropic.audit" and + mv_contains(event.category, "authentication") and + event.outcome == "failure" and + user.email is not null +| stats + Esql.event_count = count(*), + Esql.event_id_values = values(event.id), + Esql.event_action_values = values(event.action), + Esql.source_ip_values = values(source.ip), + Esql.source_ip_distinct_count = count_distinct(source.ip), + Esql.user_agent_original_values = values(user_agent.original), + Esql.anthropic_audit_actor_type_values = values(anthropic.audit.actor.type), + Esql.timestamp_first_seen = min(@timestamp), + Esql.timestamp_last_seen = max(@timestamp) + by user.email +| where Esql.event_count >= 5 +| keep user.email, Esql.* + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Credential Access +** ID: TA0006 +** Reference URL: https://attack.mitre.org/tactics/TA0006/ +* Technique: +** Name: Brute Force +** ID: T1110 +** Reference URL: https://attack.mitre.org/techniques/T1110/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-organization-data-export-accessed.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-organization-data-export-accessed.asciidoc new file mode 100644 index 0000000000..9ba7e38d3c --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-organization-data-export-accessed.asciidoc @@ -0,0 +1,115 @@ +[[prebuilt-rule-8-19-35-anthropic-organization-data-export-accessed]] +=== Anthropic Organization Data Export Accessed + +Starting an organization data export only signals intent. Accessing the export archive via its signed URL means the actor actually downloaded chats, projects, user metadata, and configuration. An attacker with administrative access can use this to exfiltrate intellectual property and credentials at scale. + +*Rule type*: esql + +*Rule indices*: None + +*Severity*: high + +*Risk score*: 73 + +*Runs every*: 5m + +*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://platform.claude.com/docs/en/api/compliance/activities/list + +*Tags*: + +* Domain: GenAI +* Platform: Anthropic +* Data Source: Anthropic Audit Logs +* Use Case: Threat Detection +* Resources: Investigation Guide +* Rule Type: ES|QL +* Tactic: Collection +* Tactic: Exfiltration + +*Version*: 1 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + + +*Investigating Anthropic Organization Data Export Accessed* + + +The export archive was downloaded (not merely requested). Reconstruct lifecycle with `org_data_export_started` / +`org_data_export_completed` for the same `organization.id`. + +Unauthorized = no legal/compliance/offboarding ticket, download without a matching started event or outside the +approved window, or export preceded by sudden admin grants / key creation / logging disablement. + + +*Possible investigation steps* + + +- Identify actor (`user_actor` → email/IP/UA) and whether a started/completed export exists for the same org. +- Flag downloads lacking a matching start, or occurring far from any approved hold/migration window. +- Correlate with admin role grants, admin API key creation, compliance logging changes, or SSO modifications. +- Determine whether the archive left approved storage or corporate networks (DLP / egress if available). + + +*False positive analysis* + + +- Planned audit or offboarding exports include a download by authorized staff — ticket closes as FP. + + +*Response and remediation* + + +- On unauthorized access: revoke admin for the actor, contain any copies of the archive, and review other admin + changes in the same window. + + +==== Rule query + + +[source, js] +---------------------------------- +from logs-anthropic.audit-* metadata _id, _version, _index +| where + data_stream.dataset == "anthropic.audit" and + mv_contains(event.category, "file") and + event.action == "org_data_export_accessed" +| keep _id, _version, _index, @timestamp, event.*, organization.*, user.*, source.*, user_agent.*, anthropic.audit.*, data_stream.* + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Collection +** ID: TA0009 +** Reference URL: https://attack.mitre.org/tactics/TA0009/ +* Technique: +** Name: Data from Cloud Storage +** ID: T1530 +** Reference URL: https://attack.mitre.org/techniques/T1530/ +* Tactic: +** Name: Exfiltration +** ID: TA0010 +** Reference URL: https://attack.mitre.org/tactics/TA0010/ +* Technique: +** Name: Exfiltration Over Web Service +** ID: T1567 +** Reference URL: https://attack.mitre.org/techniques/T1567/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-organization-deletion.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-organization-deletion.asciidoc new file mode 100644 index 0000000000..0aebd1e57e --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-organization-deletion.asciidoc @@ -0,0 +1,113 @@ +[[prebuilt-rule-8-19-35-anthropic-organization-deletion]] +=== Anthropic Organization Deletion + +Organization deletion and bulk delete remove tenant data, projects, and member access in a single administrative action. An attacker can use this to break AI-assisted workflows as an impact technique, to extort the organization, or to destroy evidence after finishing a data export. Once deletion progresses, recovery options shrink and earlier exfiltration activity is harder to reconstruct from the tenant itself. + +*Rule type*: esql + +*Rule indices*: None + +*Severity*: critical + +*Risk score*: 99 + +*Runs every*: 5m + +*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://platform.claude.com/docs/en/api/compliance/activities/list + +*Tags*: + +* Domain: GenAI +* Platform: Anthropic +* Data Source: Anthropic Audit Logs +* Use Case: Threat Detection +* Resources: Investigation Guide +* Rule Type: ES|QL +* Tactic: Impact + +*Version*: 1 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + + +*Investigating Anthropic Organization Deletion* + + +Organization deletion / bulk delete removes tenant data, projects, and member access. Treat early actions as urgent — +recovery options shrink as the workflow progresses. + +Unauthorized = no offboarding / lab-teardown ticket naming this org and actor, or deletion preceded by owner transfer, +admin grants, key creation, or data exports without a matching business project. + + +*Possible investigation steps* + + +- Identify actor (`user_actor` → email/IP/UA) and `organization.id`. +- Urgency by action: + - `org_deletion_requested`: intervene immediately if unauthorized. + - `org_bulk_delete_initiated`: bulk delete started — escalate IR now. + - `org_deleted_via_bulk`: completed — prioritize evidence preservation outside the tenant. +- Look for preceding primary owner transfer, admin grants, admin API key creation, or data exports. +- Close as FP only when platform owners confirm scheduled decommission with matching ticket/time/actor. + + +*False positive analysis* + + +- Sandbox teardown and contract termination are valid — require change management or offboarding records. + + +*Response and remediation* + + +- On unauthorized activity: engage Anthropic support and internal IR immediately, preserve remaining audit logs + (including prior exports), and rotate administrative credentials for the organization. + + +==== Rule query + + +[source, js] +---------------------------------- +from logs-anthropic.audit-* metadata _id, _version, _index +| where + data_stream.dataset == "anthropic.audit" and + mv_contains(event.category, "configuration") and + event.action in ("org_deletion_requested", "org_bulk_delete_initiated", "org_deleted_via_bulk") +| keep _id, _version, _index, @timestamp, event.*, organization.*, user.*, source.*, user_agent.*, anthropic.audit.*, data_stream.* + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Impact +** ID: TA0040 +** Reference URL: https://attack.mitre.org/tactics/TA0040/ +* Technique: +** Name: Data Destruction +** ID: T1485 +** Reference URL: https://attack.mitre.org/techniques/T1485/ +* Technique: +** Name: Account Access Removal +** ID: T1531 +** Reference URL: https://attack.mitre.org/techniques/T1531/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-organization-domain-boundary-changed.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-organization-domain-boundary-changed.asciidoc new file mode 100644 index 0000000000..27b1f7fb6b --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-organization-domain-boundary-changed.asciidoc @@ -0,0 +1,112 @@ +[[prebuilt-rule-8-19-35-anthropic-organization-domain-boundary-changed]] +=== Anthropic Organization Domain Boundary Changed + +Verified organization domains control which email addresses can join or be pulled into an Anthropic tenant. Verifying, claiming, adding, or removing a domain changes the tenant boundary and can pull in attacker-controlled mailboxes or push out legitimate corporate domains. These events are infrequent and affect organization-wide membership trust. + +*Rule type*: esql + +*Rule indices*: None + +*Severity*: high + +*Risk score*: 73 + +*Runs every*: 5m + +*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://platform.claude.com/docs/en/api/compliance/activities/list + +*Tags*: + +* Domain: GenAI +* Platform: Anthropic +* Data Source: Anthropic Audit Logs +* Use Case: Identity and Access Audit +* Use Case: Threat Detection +* Resources: Investigation Guide +* Rule Type: ES|QL +* Tactic: Persistence + +*Version*: 1 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + + +*Investigating Anthropic Organization Domain Boundary Changed* + + +Verified domains control which email domains are trusted for membership. Verifying, adding, removing, or claiming a +domain changes the tenant boundary (attacker-controlled mailboxes in, or corporate domains out). + +Unauthorized = domain not on the corporate allowlist / merger plan, `domain_claim_initiated` without DNS ownership +work, or domain change paired with external invites or SSO changes. + + +*Possible investigation steps* + + +- Read `event.action` and `anthropic.audit.domain` (may be empty on `org_domain_add_initiated` / + `domain_claim_initiated` — pivot org + nearby domain events to recover the name). +- Validate actor (email/IP/UA for `user_actor`) against identity admins. +- For claims/adds, confirm DNS ownership work was planned. Look for related invites, SSO, or membership changes in + the same window. + + +*False positive analysis* + + +- New Enterprise onboarding routinely verifies corporate domains — match change management. + + +*Response and remediation* + + +- On unauthorized change: revert via Anthropic administration and review users added under the affected domain. + + +==== Rule query + + +[source, js] +---------------------------------- +from logs-anthropic.audit-* metadata _id, _version, _index +| where + data_stream.dataset == "anthropic.audit" and + mv_contains(event.category, "configuration") and + event.action in ( + "org_domain_verified", + "org_domain_removed", + "org_domain_add_initiated", + "domain_claim_initiated" + ) +| keep _id, _version, _index, @timestamp, event.*, organization.*, user.*, source.*, user_agent.*, anthropic.audit.*, data_stream.* + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Persistence +** ID: TA0003 +** Reference URL: https://attack.mitre.org/tactics/TA0003/ +* Technique: +** Name: Account Manipulation +** ID: T1098 +** Reference URL: https://attack.mitre.org/techniques/T1098/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-organization-ip-restriction-deleted.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-organization-ip-restriction-deleted.asciidoc new file mode 100644 index 0000000000..4d4a739cf7 --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-organization-ip-restriction-deleted.asciidoc @@ -0,0 +1,115 @@ +[[prebuilt-rule-8-19-35-anthropic-organization-ip-restriction-deleted]] +=== Anthropic Organization IP Restriction Deleted + +Organization IP restrictions limit Anthropic administrative access to approved network ranges. Deleting one widens where a compromised admin session or API key can be used. The audit event does not always carry the deleted CIDR or restriction identifier, so treat this as an early signal and pivot to nearby IP restriction create or update events for the same organization. + +*Rule type*: esql + +*Rule indices*: None + +*Severity*: high + +*Risk score*: 73 + +*Runs every*: 5m + +*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://platform.claude.com/docs/en/api/compliance/activities/list + +*Tags*: + +* Domain: GenAI +* Platform: Anthropic +* Data Source: Anthropic Audit Logs +* Use Case: Identity and Access Audit +* Use Case: Threat Detection +* Resources: Investigation Guide +* Rule Type: ES|QL +* Tactic: Defense Evasion + +*Version*: 1 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + + +*Investigating Anthropic Organization IP Restriction Deleted* + + +IP allowlists limit where admin sessions and admin API keys can be used. Deleting a restriction widens that surface. +The delete event often lacks the removed CIDR — recover it from nearby create/update events. + +Unauthorized = no network/security change ticket for allowlist work, no replacement `org_ip_restriction_created` / +`org_ip_restriction_updated` in the same window, or deletion paired with admin key creation / SSO weakening. + + +*Possible investigation steps* + + +- Identify actor type. For `user_actor`, check admin identity via `user.email`, `source.ip`, and UA. For + `anthropic_actor`, pivot on `organization.id` only. +- Search the same org for `org_ip_restriction_created` / `org_ip_restriction_updated` before/after the delete to + recover ranges and see if this was a replace vs a standalone removal. +- Correlate ±hours for admin role grants, admin API key creation, SSO changes, or data exports — common follow-ons + after network controls drop. +- Close as FP when a ticket names the migration and a replacement restriction appears promptly. Escalate when deletion + stands alone or admin activity from non-corporate IPs follows. + + +*False positive analysis* + + +- Office moves and VPN redesigns often remove old ranges before new ones are applied. + + +*Response and remediation* + + +- On unauthorized deletion: restore required IP restrictions, review admin activity from non-corporate `source.ip` + during the open window, and rotate admin credentials / API keys used in that period. + + +==== Rule query + + +[source, js] +---------------------------------- +from logs-anthropic.audit-* metadata _id, _version, _index +| where + data_stream.dataset == "anthropic.audit" and + mv_contains(event.category, "configuration") and + event.action == "org_ip_restriction_deleted" +| keep _id, _version, _index, @timestamp, event.*, organization.*, user.*, source.*, user_agent.*, anthropic.audit.*, data_stream.* + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Defense Evasion +** ID: TA0005 +** Reference URL: https://attack.mitre.org/tactics/TA0005/ +* Technique: +** Name: Impair Defenses +** ID: T1562 +** Reference URL: https://attack.mitre.org/techniques/T1562/ +* Sub-technique: +** Name: Disable or Modify Cloud Firewall +** ID: T1562.007 +** Reference URL: https://attack.mitre.org/techniques/T1562/007/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-organization-member-and-group-enumeration.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-organization-member-and-group-enumeration.asciidoc new file mode 100644 index 0000000000..006ae5f5b0 --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-organization-member-and-group-enumeration.asciidoc @@ -0,0 +1,133 @@ +[[prebuilt-rule-8-19-35-anthropic-organization-member-and-group-enumeration]] +=== Anthropic Organization Member and Group Enumeration + +Detects a single user performing at least two distinct organization discovery actions within a 10-minute window: listing users, exporting members, or viewing groups. Chaining these read actions maps membership and group structure and commonly precedes targeted role grants, invites, or data collection against high-value accounts. + +*Rule type*: esql + +*Rule indices*: None + +*Severity*: medium + +*Risk score*: 47 + +*Runs every*: 10m + +*Searches indices from*: now-11m ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://platform.claude.com/docs/en/api/compliance/activities/list + +*Tags*: + +* Domain: GenAI +* Platform: Anthropic +* Data Source: Anthropic Audit Logs +* Use Case: Threat Detection +* Use Case: UEBA +* Resources: Investigation Guide +* Rule Type: ES|QL +* Tactic: Discovery + +*Version*: 1 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + + +*Investigating Anthropic Organization Member and Group Enumeration* + + +One email performed at least two distinct discovery actions among `org_users_listed`, `org_members_exported`, and +`group_list_viewed` in a short window — reconnaissance of who is in the tenant. + +Escalate when scripting UA, follow-on invites/role grants/SSO changes/exports appear, or the actor is not an identity +admin. Close as FP for scheduled access reviews or onboarding console browsing with a ticket. + + +*Possible investigation steps* + + +- Read `Esql.event_action_values` to see which discovery actions combined; all three in one window is stronger than + two. +- Inspect IP/UA/actor type for automation or unfamiliar clients. +- Pivot the same actor/org for follow-on admin or project role grants, invites, SSO changes, or data exports. +- Note: some `org_members_exported` without user email (e.g. certain `anthropic_actor` cases) are out of scope. + + +*False positive analysis* + + +- Membership exports during access reviews commonly combine two of these actions briefly. + + +*Response and remediation* + + +- On unauthorized recon: revoke sessions, review recent role and invite changes, and tighten least privilege on + identity read actions where possible. + + +==== Rule query + + +[source, js] +---------------------------------- +from logs-anthropic.audit-* +| where + data_stream.dataset == "anthropic.audit" and + event.action in ("org_members_exported", "org_users_listed", "group_list_viewed") and + user.email is not null +| stats + Esql.event_action_count_distinct = count_distinct(event.action), + Esql.event_action_values = values(event.action), + Esql.event_count = count(*), + Esql.event_id_values = values(event.id), + Esql.source_ip_values = values(source.ip), + Esql.user_agent_original_values = values(user_agent.original), + Esql.anthropic_audit_actor_type_values = values(anthropic.audit.actor.type), + Esql.user_id_values = values(user.id), + Esql.timestamp_first_seen = min(@timestamp), + Esql.timestamp_last_seen = max(@timestamp) + by user.email, organization.id +| where Esql.event_action_count_distinct >= 2 +| keep user.email, organization.id, Esql.* + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Discovery +** ID: TA0007 +** Reference URL: https://attack.mitre.org/tactics/TA0007/ +* Technique: +** Name: Permission Groups Discovery +** ID: T1069 +** Reference URL: https://attack.mitre.org/techniques/T1069/ +* Sub-technique: +** Name: Cloud Groups +** ID: T1069.003 +** Reference URL: https://attack.mitre.org/techniques/T1069/003/ +* Technique: +** Name: Account Discovery +** ID: T1087 +** Reference URL: https://attack.mitre.org/techniques/T1087/ +* Sub-technique: +** Name: Cloud Account +** ID: T1087.004 +** Reference URL: https://attack.mitre.org/techniques/T1087/004/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-organization-user-invite-sent.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-organization-user-invite-sent.asciidoc new file mode 100644 index 0000000000..3a2c262310 --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-organization-user-invite-sent.asciidoc @@ -0,0 +1,115 @@ +[[prebuilt-rule-8-19-35-anthropic-organization-user-invite-sent]] +=== Anthropic Organization User Invite Sent + +Sending an organization user invite creates a path for a new member to join the Anthropic tenant with a chosen role. An adversary who compromises an administrator or admin API key can invite a mailbox they control and accept the invite to gain durable access. Invites may target internal corporate addresses or external domains; this rule does not distinguish them because invite events do not carry verified organization domains for reliable comparison. + +*Rule type*: esql + +*Rule indices*: None + +*Severity*: medium + +*Risk score*: 47 + +*Runs every*: 5m + +*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://platform.claude.com/docs/en/api/compliance/activities/list + +*Tags*: + +* Domain: GenAI +* Platform: Anthropic +* Data Source: Anthropic Audit Logs +* Use Case: Identity and Access Audit +* Use Case: Threat Detection +* Resources: Investigation Guide +* Rule Type: ES|QL +* Tactic: Persistence + +*Version*: 1 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + + +*Investigating Anthropic Organization User Invite Sent* + + +A successful `org_user_invite_sent` creates a path for a new member. Invitee is `user.target.email` (also +`related.user`); role on accept is `anthropic.audit.invited_role` when present. Audit events do not include the org's +verified domain list — domain judgment is triage's job. + +Unauthorized / high priority: invitee domain outside known corporate domains, `invited_role` of admin (or similarly +privileged), actor is unexpected / API key, or invite followed by accept + privileged activity. Close as FP when HR/IT +ticket names the invitee and role. + + +*Possible investigation steps* + + +- Compare invitee domain to trusted corporate domains; treat unexpected external domains as higher priority. +- Branch actor: `user_actor` (email/IP/UA) vs `admin_api_key_actor` + (`anthropic.audit.actor.admin_api_key_id` in inventory?). +- Search for `org_user_invite_accepted` for the same `anthropic.audit.invite_id` or invitee email. +- Look nearby for role grants, SSO changes, or admin API key creation from the same actor. + + +*False positive analysis* + + +- Routine onboarding invites are FP when an HR/IT ticket names the invitee domain and `invited_role`. + + +*Response and remediation* + + +- On unauthorized invite: delete/revoke the pending invite (and remove the user if already accepted), review other IAM + changes by the same actor, and rotate compromised admin credentials or API keys. + + +==== Rule query + + +[source, js] +---------------------------------- +from logs-anthropic.audit-* metadata _id, _version, _index +| where + data_stream.dataset == "anthropic.audit" and + mv_contains(event.category, "iam") and + event.action == "org_user_invite_sent" and + event.outcome == "success" +| keep _id, _version, _index, @timestamp, event.*, organization.*, user.*, related.*, source.*, user_agent.*, anthropic.audit.*, data_stream.* + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Persistence +** ID: TA0003 +** Reference URL: https://attack.mitre.org/tactics/TA0003/ +* Technique: +** Name: Create Account +** ID: T1136 +** Reference URL: https://attack.mitre.org/techniques/T1136/ +* Sub-technique: +** Name: Cloud Account +** ID: T1136.003 +** Reference URL: https://attack.mitre.org/techniques/T1136/003/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-primary-owner-transferred.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-primary-owner-transferred.asciidoc new file mode 100644 index 0000000000..80a023b659 --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-primary-owner-transferred.asciidoc @@ -0,0 +1,117 @@ +[[prebuilt-rule-8-19-35-anthropic-primary-owner-transferred]] +=== Anthropic Primary Owner Transferred + +Primary ownership is the highest administrative authority in an Anthropic organization, covering billing, membership, and organization-wide settings. Transferring ownership to an attacker-controlled account can lock out the legitimate administrator from recovery paths that depend on the original owner. Attackers often do this after role escalation so defenders cannot reverse earlier privilege changes through normal administration. + +*Rule type*: esql + +*Rule indices*: None + +*Severity*: high + +*Risk score*: 73 + +*Runs every*: 5m + +*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://platform.claude.com/docs/en/api/compliance/activities/list + +*Tags*: + +* Domain: GenAI +* Platform: Anthropic +* Data Source: Anthropic Audit Logs +* Use Case: Identity and Access Audit +* Use Case: Threat Detection +* Resources: Investigation Guide +* Rule Type: ES|QL +* Tactic: Privilege Escalation + +*Version*: 1 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + + +*Investigating Anthropic Primary Owner Transferred* + + +Primary ownership is the highest Anthropic org authority (billing, membership, org-wide settings). Transfers should +be rare and ticketed. Actor fields identify who initiated the transfer — not the new owner +(`anthropic.audit.previous_owner_id` / `new_owner_id`). + +Unauthorized = no HR/IT offboarding or ownership-change ticket naming both parties, or the new owner was recently +invited / granted admin and immediately received ownership, especially with follow-on SSO/key/export changes. + + +*Possible investigation steps* + + +- Map `anthropic.audit.previous_owner_id` → `new_owner_id` and resolve initiator (`actor.type`; for `user_actor` + check email/IP/UA). +- Before the transfer: look for `claude_user_role_updated` with `anthropic.audit.current_role: admin`, invite accept, + or admin API key creation for the new owner path. +- After the transfer: look for SSO changes, exports, compliance logging disablement, or IP restriction deletes by the + new owner. +- Contact previous and new owners only after ticket/timeline triage; escalate when ticket is missing or the new owner + chain looks staged. + + +*False positive analysis* + + +- Reorgs and admin departures are valid — require matching change management / HR records. + + +*Response and remediation* + + +- On unauthorized transfer: engage Anthropic support and internal IT to recover ownership, revoke the new owner's + sessions/keys, and review every admin change made under the new owner account. + + +==== Rule query + + +[source, js] +---------------------------------- +from logs-anthropic.audit-* metadata _id, _version, _index +| where + data_stream.dataset == "anthropic.audit" and + mv_contains(event.category, "iam") and + event.action == "primary_owner_transferred" and + event.outcome == "success" +| keep _id, _version, _index, @timestamp, event.*, organization.*, user.*, source.*, user_agent.*, anthropic.audit.*, data_stream.* + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Privilege Escalation +** ID: TA0004 +** Reference URL: https://attack.mitre.org/tactics/TA0004/ +* Technique: +** Name: Account Manipulation +** ID: T1098 +** Reference URL: https://attack.mitre.org/techniques/T1098/ +* Sub-technique: +** Name: Additional Cloud Roles +** ID: T1098.003 +** Reference URL: https://attack.mitre.org/techniques/T1098/003/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-sensitive-claude-project-role-assigned-to-user.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-sensitive-claude-project-role-assigned-to-user.asciidoc new file mode 100644 index 0000000000..ac049a4901 --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-sensitive-claude-project-role-assigned-to-user.asciidoc @@ -0,0 +1,128 @@ +[[prebuilt-rule-8-19-35-anthropic-sensitive-claude-project-role-assigned-to-user]] +=== Anthropic Sensitive Claude Project Role Assigned to User + +Detects when a Claude project owner or editor role is granted through a `role_assignment_granted` event. Project owners and editors can access project chats, artifacts, and knowledge bases that may hold sensitive data. An attacker with organization access can grant these roles to persist access to high-value project content without holding organization admin privileges. + +*Rule type*: new_terms + +*Rule indices*: + +* logs-anthropic.audit-* + +*Severity*: medium + +*Risk score*: 47 + +*Runs every*: 5m + +*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://platform.claude.com/docs/en/api/compliance/activities/list + +*Tags*: + +* Domain: GenAI +* Platform: Anthropic +* Data Source: Anthropic Audit Logs +* Use Case: Identity and Access Audit +* Use Case: Threat Detection +* Use Case: UEBA +* Resources: Investigation Guide +* Rule Type: New Terms +* Tactic: Persistence +* Tactic: Privilege Escalation + +*Version*: 1 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + + +*Investigating Anthropic Sensitive Claude Project Role Assigned to User* + + +First-seen grant of `chat_project:owner` or `chat_project:editor` on a Claude project (`organization.id` + +`anthropic.audit.resource_id`). Organization membership `admin` promotions (`claude_user_role_updated`) are covered +by **Anthropic Admin Role Assigned to User**. Self-assignment at project creation is common; `user.id` may be absent +for `anthropic_actor`. + +Unauthorized = grant to an unexpected collaborator (especially external), no project onboarding ticket, or followed +by export / public artifact sharing / logging changes on the same project. Close as FP for known team staffing with +ticket or a recurring collaborator baseline on that project. + + +*Possible investigation steps* + + +- When `user_actor`, identify assigner via email/IP/UA. Review role, `anthropic.audit.resource_id`, and grantee fields + (`anthropic.audit.target_id` / `target_type` / `related.user`) when present. +- Correlate with org membership changes, exports, or artifact sharing involving the same project or users. +- Escalate when the grantee is new/external or privileged data access follows; close when ticket/baseline matches. + + +*False positive analysis* + + +- Routine project staffing and self-assignment at creation are expected — baseline recurring collaborators. + + +*Response and remediation* + + +- On unauthorized grant: revoke the project role on that `anthropic.audit.resource_id`, review other changes on the + same project/org, and audit project content access and recent exports. + + +==== Rule query + + +[source, js] +---------------------------------- +data_stream.dataset: "anthropic.audit" and + event.category: "iam" and + event.action: "role_assignment_granted" and + user.target.roles: ("chat_project:owner" or "chat_project:editor") + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Persistence +** ID: TA0003 +** Reference URL: https://attack.mitre.org/tactics/TA0003/ +* Technique: +** Name: Account Manipulation +** ID: T1098 +** Reference URL: https://attack.mitre.org/techniques/T1098/ +* Sub-technique: +** Name: Additional Cloud Roles +** ID: T1098.003 +** Reference URL: https://attack.mitre.org/techniques/T1098/003/ +* Tactic: +** Name: Privilege Escalation +** ID: TA0004 +** Reference URL: https://attack.mitre.org/tactics/TA0004/ +* Technique: +** Name: Account Manipulation +** ID: T1098 +** Reference URL: https://attack.mitre.org/techniques/T1098/ +* Sub-technique: +** Name: Additional Cloud Roles +** ID: T1098.003 +** Reference URL: https://attack.mitre.org/techniques/T1098/003/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-sso-disabled-or-connection-removed.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-sso-disabled-or-connection-removed.asciidoc new file mode 100644 index 0000000000..6e0e37f51f --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-anthropic-sso-disabled-or-connection-removed.asciidoc @@ -0,0 +1,119 @@ +[[prebuilt-rule-8-19-35-anthropic-sso-disabled-or-connection-removed]] +=== Anthropic SSO Disabled or Connection Removed + +SSO routes Anthropic authentication through the corporate identity provider. Disabling SSO, or deactivating or deleting an SSO connection, moves users onto alternate sign-in paths where IdP-enforced MFA, conditional access, and session policies no longer apply. That opens the door to password or magic-link accounts the attacker controls. + +*Rule type*: esql + +*Rule indices*: None + +*Severity*: high + +*Risk score*: 73 + +*Runs every*: 5m + +*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://platform.claude.com/docs/en/api/compliance/activities/list + +*Tags*: + +* Domain: GenAI +* Domain: Identity +* Platform: Anthropic +* Data Source: Anthropic Audit Logs +* Use Case: Identity and Access Audit +* Use Case: Threat Detection +* Resources: Investigation Guide +* Rule Type: ES|QL +* Tactic: Defense Evasion + +*Version*: 1 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + + +*Investigating Anthropic SSO Disabled or Connection Removed* + + +SSO is the primary path that enforces corporate IdP MFA and session policy. Turning SSO off, or deactivating/deleting +a connection, pushes users onto alternate sign-in (password / magic link) the attacker may control. + +Severity by action: `org_sso_connection_deleted` (must re-bind IdP) > `org_sso_connection_deactivated` > +`org_sso_toggled` with `anthropic.audit.enabled: false`. + +Unauthorized = no IdP change ticket / maintenance window for this `anthropic.audit.connection_id`, or a `user_actor` +change outside known admins, especially with sibling magic-link second-factor disablement or admin role grants. +SCIM-driven events during a documented connector sync are usually FP. + + +*Possible investigation steps* + + +- Branch on `anthropic.audit.actor.type`: + - `scim_directory_sync_actor`: check `anthropic.audit.directory_id` / `workos_event_id` / `idp_connection_type` + against IdP sync or certificate rotation windows before escalating. + - `user_actor`: compare `user.email`, `source.ip`, and `user_agent.original` to expected admins; scripting UA or + new IP is higher priority. +- Note `event.action`, `anthropic.audit.connection_id`, and `organization.id`. Check whether SSO was restored + afterward. +- Correlate ±hours for magic link second factor changes, admin role grants, invites, or admin API key creation. + + +*False positive analysis* + + +- IdP migrations often deactivate or delete a connection before the replacement is live — match ticket and restore. + + +*Response and remediation* + + +- On unauthorized change: restore or reconfigure SSO immediately, then review accounts that authenticated while SSO + was unavailable and rotate credentials for any suspicious successful logins in that window. + + +==== Rule query + + +[source, js] +---------------------------------- +from logs-anthropic.audit-* metadata _id, _version, _index +| where + data_stream.dataset == "anthropic.audit" and + mv_contains(event.category, "iam") and + ( + event.action in ("org_sso_connection_deactivated", "org_sso_connection_deleted") or + (event.action == "org_sso_toggled" and anthropic.audit.enabled == false) + ) +| keep _id, _version, _index, @timestamp, event.*, organization.*, user.*, source.*, user_agent.*, anthropic.audit.*, data_stream.* + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Defense Evasion +** ID: TA0005 +** Reference URL: https://attack.mitre.org/tactics/TA0005/ +* Technique: +** Name: Modify Authentication Process +** ID: T1556 +** Reference URL: https://attack.mitre.org/techniques/T1556/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-aws-audit-or-security-service-tampering-via-cli.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-aws-audit-or-security-service-tampering-via-cli.asciidoc new file mode 100644 index 0000000000..5fedff512d --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-aws-audit-or-security-service-tampering-via-cli.asciidoc @@ -0,0 +1,195 @@ +[[prebuilt-rule-8-19-35-aws-audit-or-security-service-tampering-via-cli]] +=== AWS Audit or Security Service Tampering via CLI + +Identifies use of the AWS CLI to disable, delete, or blind AWS audit logging and security monitoring services, including CloudTrail trails and event data stores, GuardDuty detectors, AWS Config recorders, Security Hub, Access Analyzer, Macie, and Inspector. Adversaries disable these controls early in a cloud intrusion so that subsequent credential abuse, data theft, and destruction go unrecorded. Because the endpoint sees the command as it is issued, this fires even when subsequent CloudTrail visibility is lost. + +*Rule type*: query + +*Rule indices*: + +* logs-endpoint.events.process* + +*Severity*: high + +*Risk score*: 73 + +*Runs every*: 5m + +*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://socprime.com/active-threats/aws-guardduty-detector-disabled/ +* https://securitylabs.datadoghq.com/cloud-security-atlas/attacks/stopping-cloudtrail-trail/ +* https://stratus-red-team.cloud/attack-techniques/AWS/aws.defense-evasion.cloudtrail-stop/ +* https://stratus-red-team.cloud/attack-techniques/AWS/aws.defense-evasion.cloudtrail-delete/ +* https://stratus-red-team.cloud/attack-techniques/AWS/aws.defense-evasion.cloudtrail-event-selectors/ +* https://sysdig.com/blog/cloud-breach-terraform-data-theft/ + +*Tags*: + +* Domain: Endpoint +* Domain: Cloud +* Platform: AWS +* Platform: Linux +* Platform: macOS +* Platform: Windows +* OS: Linux +* OS: macOS +* OS: Windows +* Service: AWS GuardDuty +* Use Case: Threat Detection +* Tactic: Defense Evasion +* Data Source: Elastic Defend +* Rule Type: Custom Query (KQL) +* Resources: Investigation Guide + +*Version*: 1 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + + +*Investigating AWS Audit or Security Service Tampering via CLI* + + +This rule detects use of the AWS CLI to disable, delete, or blind AWS audit logging and security monitoring services. Adversaries disable these controls early in an intrusion to prevent their subsequent actions from being recorded in CloudTrail or detected by GuardDuty and other services. Because this rule fires on the endpoint before the API call reaches AWS, it activates even when the resulting CloudTrail event is itself suppressed. + + +*Possible investigation steps* + + +- Review the full AWS CLI command to identify which specific service and operation were targeted. +- Identify the user account and session that executed the command and determine if it is an authorized administrator or an unexpected identity. +- Check AWS CloudTrail for the corresponding API call and any subsequent activity that may have benefited from disabled logging. +- Correlate with other alerts on the same host or from the same IAM identity to identify broader intrusion activity. +- Determine whether the modification was part of an approved change window. + + +*False positive analysis* + + +- Security teams running authorized cloud posture assessments or infrastructure cleanup may legitimately issue these commands. Correlate with change management windows and operator identity before escalating. +- Automated compliance tools that periodically audit and reset security service configurations may trigger this rule. + + +*Response and remediation* + + +- Initiate the incident response process based on the outcome of the triage. +- Re-enable any disabled security services and restore their previous configuration. +- Revoke the AWS credentials or session used to execute the command if compromise is confirmed. +- Review the time window during which logging was disabled for unrecorded API activity using VPC flow logs or other sources. +- Implement SCPs or permission boundaries to prevent disabling of critical security services in the future. + + +==== Setup + + + +*Setup* + + +This rule requires data coming in from Elastic Defend. + + +*Elastic Defend Integration Setup* + +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the +Elastic Agent to monitor events on your host and send data to the Elastic Security app. + + +*Prerequisite Requirements:* + +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation]. + + +*The following steps should be executed in order to add the Elastic Defend integration:* + +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can + click the "Existing hosts" tab and select an existing policy instead. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and install Elastic Agent on your hosts. +For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide]. + + +==== Rule query + + +[source, js] +---------------------------------- +event.category : "process" and event.type : "start" and event.action:(start or exec) and +process.name : (aws or aws-cli or aws.exe or aws2) and +( + process.command_line : ( + *accessanalyzer delete-analyzer* or + *cloudtrail delete-event-data-store* or + *cloudtrail delete-trail* or + *cloudtrail put-event-selectors*IncludeManagementEvents*false* or + *cloudtrail put-event-selectors*ReadWriteType*ReadOnly* or + *cloudtrail stop-logging* or + *cloudtrail update-trail*--no-include-global-service-events* or + *cloudtrail update-trail*--no-is-multi-region-trail* or + *configservice delete-configuration-recorder* or + *configservice delete-delivery-channel* or + *configservice stop-configuration-recorder* or + *detective delete-graph* or + *guardduty create-filter*ARCHIVE* or + *guardduty delete-detector* or + *guardduty delete-publishing-destination* or + *guardduty update-detector*--no-enable* or + *inspector2 disable* or + *logs delete-log-group* or + *logs delete-log-stream* or + *macie2 disable-macie* or + *s3api put-bucket-logging*--bucket-logging-status*\{\}* or + *securityhub batch-disable-standards* or + *securityhub disable-security-hub* +) or + process.args : ("put-retention-policy" and ("--retention-in-days=1" or "1")) +) and +not process.args : "help" + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Defense Evasion +** ID: TA0005 +** Reference URL: https://attack.mitre.org/tactics/TA0005/ +* Technique: +** Name: Impair Defenses +** ID: T1562 +** Reference URL: https://attack.mitre.org/techniques/T1562/ +* Sub-technique: +** Name: Disable or Modify Cloud Logs +** ID: T1562.008 +** Reference URL: https://attack.mitre.org/techniques/T1562/008/ +* Sub-technique: +** Name: Disable or Modify Tools +** ID: T1562.001 +** Reference URL: https://attack.mitre.org/techniques/T1562/001/ +* Technique: +** Name: Indicator Removal +** ID: T1070 +** Reference URL: https://attack.mitre.org/techniques/T1070/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-aws-backup-recovery-point-deleted-by-unusual-user.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-aws-backup-recovery-point-deleted-by-unusual-user.asciidoc new file mode 100644 index 0000000000..fcbfeccdba --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-aws-backup-recovery-point-deleted-by-unusual-user.asciidoc @@ -0,0 +1,118 @@ +[[prebuilt-rule-8-19-35-aws-backup-recovery-point-deleted-by-unusual-user]] +=== AWS Backup Recovery Point Deleted by Unusual User + +Identifies when an unusual user deletes an AWS Backup recovery point via DeleteRecoveryPoint. A recovery point is a stored backup of a protected resource (EBS, RDS, DynamoDB, EFS, S3, and others). Deleting recovery points removes the ability to restore the associated data and is a core anti-recovery technique used in ransomware and data-destruction attacks to ensure victims cannot recover without paying or rebuilding. Routine lifecycle expirations are performed by the AWS Backup service itself; deletion by a non-service principal is rare and should be reviewed. This is a New Terms rule that uses "cloud.account.id", "user.name", and "aws.cloudtrail.flattened.request_parameters.backupVaultName" to alert on the first time a given identity in an account successfully deletes a recovery point from a specific backup vault within the history window. + +*Rule type*: new_terms + +*Rule indices*: + +* logs-aws.cloudtrail-* + +*Severity*: high + +*Risk score*: 73 + +*Runs every*: 5m + +*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://docs.aws.amazon.com/aws-backup/latest/devguide/API_DeleteRecoveryPoint.html +* https://docs.aws.amazon.com/aws-backup/latest/devguide/vault-lock.html + +*Tags*: + +* Domain: Cloud +* Platform: AWS +* Data Source: AWS CloudTrail +* Service: AWS Backup +* Tactic: Impact +* Rule Type: New Terms +* Resources: Investigation Guide +* Noise: Low +* Performance: Fast +* Profile: Recommended +* Threat: Ransomware +* Rule Type: Custom Query (KQL) + +*Version*: 3 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + + +*Investigating AWS Backup Recovery Point Deleted by Unusual User* + + +AWS Backup recovery points are the restorable copies of protected resources. "DeleteRecoveryPoint" permanently removes a recovery point from its vault, eliminating the ability to restore that backup. Adversaries delete recovery points to inhibit recovery after data destruction or encryption, maximizing the impact of ransomware or sabotage. Because scheduled expirations are carried out by the AWS Backup service itself (excluded by this rule), a deletion by a user or role principal is uncommon and high-signal, especially when several recovery points are removed in a short window. + +This rule uses a New Terms approach to detect the first time a given identity in an account successfully deletes a recovery point from a specific backup vault. + + +*Possible investigation steps* + + +- Identify the actor in "aws.cloudtrail.user_identity.arn" and "aws.cloudtrail.user_identity.type", and review "source.ip", "source.as.organization.name", and "user_agent.original" for an unexpected origin. +- Identify the affected recovery point and vault from "aws.cloudtrail.request_parameters" and "aws.cloudtrail.flattened.request_parameters.backupVaultName", and determine which resource and data it protected. +- Determine whether multiple recovery points or vaults were affected in the same window, indicating a broader anti-recovery effort. +- Correlate with adjacent destructive or evasion activity by the same principal, such as DeleteBackupVault, Vault Lock removal, KMS key deletion, or resource deletions. + + +*False positive analysis* + + +- Retention cleanup, migration, or decommissioning may delete recovery points. Confirm the deletion is expected and exclude known administration roles on "aws.cloudtrail.user_identity.arn" after validation. + + +*Response and remediation* + + +- If the deletion is unauthorized, treat it as a potential precursor to or part of a destructive attack: preserve remaining backups, enable Vault Lock where possible, and engage incident response. +- Rotate or restrict credentials for the principal if compromise is suspected, and restrict "backup:DeleteRecoveryPoint" to a small set of trusted administrators via IAM and SCPs. + + +==== Setup + + +This rule requires AWS CloudTrail management events for AWS Backup and ingestion via the Elastic AWS CloudTrail integration. See https://docs.elastic.co/integrations/aws/cloudtrail. + +==== Rule query + + +[source, js] +---------------------------------- +data_stream.dataset: "aws.cloudtrail" + and event.provider: "backup.amazonaws.com" + and event.action: "DeleteRecoveryPoint" + and event.outcome: "success" + and user.name: * + and aws.cloudtrail.flattened.request_parameters.backupVaultName: * + and not aws.cloudtrail.user_identity.type: "AWSService" + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Impact +** ID: TA0040 +** Reference URL: https://attack.mitre.org/tactics/TA0040/ +* Technique: +** Name: Inhibit System Recovery +** ID: T1490 +** Reference URL: https://attack.mitre.org/techniques/T1490/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-aws-lambda-function-deletion-by-unusual-user.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-aws-lambda-function-deletion-by-unusual-user.asciidoc new file mode 100644 index 0000000000..05302111d3 --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-aws-lambda-function-deletion-by-unusual-user.asciidoc @@ -0,0 +1,118 @@ +[[prebuilt-rule-8-19-35-aws-lambda-function-deletion-by-unusual-user]] +=== AWS Lambda Function Deletion by Unusual User + +Identifies when an unusual user deletes an AWS Lambda function. Deleting a function removes its code, configuration, versions, and aliases. Adversaries may delete functions to disrupt business operations and automated workflows, to destroy attacker-deployed backdoors and remove evidence after achieving their objective, or to inhibit incident response. Because function deletion is destructive and often irreversible without redeployment, deletions performed by unexpected principals or outside change windows should be reviewed. This is a New Terms rule that uses "cloud.account.id", "user.name", and "aws.cloudtrail.flattened.request_parameters.functionName" to alert on the first time a given identity in an account successfully deletes a specific Lambda function within the history window. + +*Rule type*: new_terms + +*Rule indices*: + +* logs-aws.cloudtrail-* + +*Severity*: low + +*Risk score*: 21 + +*Runs every*: 5m + +*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://docs.aws.amazon.com/lambda/latest/api/API_DeleteFunction.html +* https://docs.aws.amazon.com/lambda/latest/dg/logging-using-cloudtrail.html + +*Tags*: + +* Domain: Cloud +* Data Source: AWS +* Data Source: Amazon Web Services +* Platform: AWS +* Data Source: AWS CloudTrail +* Service: AWS Lambda +* Tactic: Impact +* Rule Type: New Terms +* Resources: Investigation Guide +* Noise: Medium +* Performance: Fast + +*Version*: 4 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + + +*Investigating AWS Lambda Function Deletion by Unusual User* + + +Deleting an AWS Lambda function removes its code, configuration, published versions, and aliases. This can be a destructive action that disrupts serverless workloads and automation, or a cleanup step an adversary uses to remove a backdoor function and erase evidence after their objective is met. + +This rule uses a New Terms approach to detect the first time a given identity in an account successfully deletes a Lambda function (`DeleteFunction`). Investigate whether the principal and the deleted function are expected, and whether the deletion correlates with other suspicious activity. + + +*Possible investigation steps* + + +- Identify the actor in `aws.cloudtrail.user_identity.arn` and `aws.cloudtrail.user_identity.type`, and review `source.ip` and `user_agent.original` to determine how the deletion was performed (console, CLI, SDK, automation). +- Inspect `aws.cloudtrail.flattened.request_parameters.functionName` and map the function to its application, owner, and environment (prod, staging, dev). +- Determine whether the deletion aligns with an approved change, decommissioning, or infrastructure-as-code destroy operation by comparing `@timestamp` against deployment and change-management records. +- Correlate with recent activity by the same principal or access key, such as `CreateFunction`, `UpdateFunctionCode`, `AddPermission`, `CreateEventSourceMapping`, log-group deletions, or other destructive or evasive actions. +- Verify whether multiple functions were deleted in a short window, which may indicate broad disruption rather than a single planned change. + + +*False positive analysis* + + +- Function deletions are common during decommissioning and infrastructure-as-code apply/destroy cycles. Deletions by approved deployment roles, CI/CD pipelines, or platform automation are expected. Tune on `aws.cloudtrail.user_identity.arn`, `user_agent.original`, or known automation roles after validation. + + +*Response and remediation* + + +- If the deletion is unauthorized, restore the function from source control or an infrastructure-as-code definition and confirm its code, configuration, and execution role match a known-good state. +- Review CloudTrail for related destructive or evasive actions by the same actor and assess operational impact. +- Rotate or restrict credentials for the principal if compromise is suspected, and constrain `lambda:DeleteFunction` to a small set of trusted roles. + + +==== Rule query + + +[source, js] +---------------------------------- +data_stream.dataset: "aws.cloudtrail" + and event.provider: "lambda.amazonaws.com" + and event.action: (DeleteFunction or DeleteFunction20*) + and event.outcome: "success" + and user.name: (* and not AWSServiceRoleForLambdaReplicator) + and aws.cloudtrail.flattened.request_parameters.functionName: * + and not user_agent.original: (*Pulumi* or *Terraform*) + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Impact +** ID: TA0040 +** Reference URL: https://attack.mitre.org/tactics/TA0040/ +* Technique: +** Name: Data Destruction +** ID: T1485 +** Reference URL: https://attack.mitre.org/techniques/T1485/ +* Technique: +** Name: Service Stop +** ID: T1489 +** Reference URL: https://attack.mitre.org/techniques/T1489/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-aws-lambda-function-invoked-by-an-unusual-principal.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-aws-lambda-function-invoked-by-an-unusual-principal.asciidoc new file mode 100644 index 0000000000..929708dc43 --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-aws-lambda-function-invoked-by-an-unusual-principal.asciidoc @@ -0,0 +1,127 @@ +[[prebuilt-rule-8-19-35-aws-lambda-function-invoked-by-an-unusual-principal]] +=== AWS Lambda Function Invoked by an Unusual Principal + +Identifies the first time within the prior 14 days that a principal directly invokes an AWS Lambda function in an account, excluding invocations made on behalf of AWS services (normal event-source triggers). Adversaries who compromise credentials or move laterally may directly invoke functions to execute code, retrieve data returned by a function, or abuse an over-permissioned execution role. Direct, ad hoc invocation by a principal that does not normally call Lambda deviates from the usual event-driven invocation pattern and is worth reviewing. This rule relies on AWS Lambda data event logging, which is not enabled by default. + +*Rule type*: new_terms + +*Rule indices*: + +* logs-aws.cloudtrail-* + +*Severity*: medium + +*Risk score*: 47 + +*Runs every*: 5m + +*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://docs.aws.amazon.com/lambda/latest/api/API_Invoke.html +* https://docs.aws.amazon.com/lambda/latest/dg/logging-using-cloudtrail.html + +*Tags*: + +* Domain: Cloud +* Platform: AWS +* Data Source: AWS CloudTrail +* Service: AWS Lambda +* Tactic: Execution +* Rule Type: New Terms +* Resources: Investigation Guide +* Noise: Medium +* Performance: Normal + +*Version*: 3 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + + +*Investigating AWS Lambda Function Invoked by an Unusual Principal* + + +Most Lambda invocations are driven by event sources (S3, EventBridge, SQS, API Gateway, etc.), which CloudTrail records with `aws.cloudtrail.user_identity.invoked_by` set to the calling service. A principal invoking a function **directly** (via the SDK, CLI, or console) is comparatively rare and, when it comes from an identity that does not normally do so, can indicate lateral movement, credential abuse, or data retrieval from a function. This rule uses a new terms approach to surface the first time a given principal directly invokes a function in an account within the prior 14 days. + + +*Possible investigation steps* + + +- Review `aws.cloudtrail.user_identity.arn`, `aws.cloudtrail.user_identity.type`, and `aws.cloudtrail.user_identity.access_key_id` to identify the actor, and `source.ip` / `user_agent.original` to determine how the call was made. +- Inspect `aws.cloudtrail.request_parameters` for the `functionName` and map it to its application, owner, and sensitivity. +- Determine whether the principal is expected to invoke functions directly and whether the activity aligns with an approved operation, test, or deployment. +- Correlate with recent activity by the same principal or access key, such as credential issuance, role assumption, or other data-plane access, and check whether the credential was recently seen from an unusual source. + + +*False positive analysis* + + +- Direct invocation is a normal operational and testing activity. Confirm whether the principal is a known operator or automation identity and exclude it on `aws.cloudtrail.user_identity.arn` after validation. + + +*Response and remediation* + + +- If the invocation is unauthorized, review what the function returns and accesses, and assess data exposure. +- Rotate or restrict credentials for the principal if compromise is suspected, and constrain `lambda:InvokeFunction` to the identities and services that require it. + + +*Additional information* + + +- https://docs.aws.amazon.com/lambda/latest/api/API_Invoke.html[Invoke API] +- https://docs.aws.amazon.com/lambda/latest/dg/logging-using-cloudtrail.html[Logging Lambda data events with CloudTrail] + + +==== Setup + + + +*Setup* + + +This rule requires AWS Lambda data events to be logged in CloudTrail and ingested via the AWS integration +(`aws.cloudtrail` data stream). Lambda invocation (`Invoke`) is a data-plane event and is NOT logged by default; enable +data event logging for Lambda functions in the trail (optionally scoped to sensitive functions to manage volume). + + +==== Rule query + + +[source, js] +---------------------------------- +data_stream.dataset: "aws.cloudtrail" + and event.provider: "lambda.amazonaws.com" + and event.action: Invoke* + and event.outcome: "success" + and not aws.cloudtrail.user_identity.invoked_by: * + and aws.cloudtrail.user_identity.arn: * + and not user.name: (AWSAccelerator-* or Amazon_EventBridge_Scheduler_LAMBDA_*) + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Execution +** ID: TA0002 +** Reference URL: https://attack.mitre.org/tactics/TA0002/ +* Technique: +** Name: Serverless Execution +** ID: T1648 +** Reference URL: https://attack.mitre.org/techniques/T1648/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-aws-ssm-agent-registered-via-hybrid-activation.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-aws-ssm-agent-registered-via-hybrid-activation.asciidoc new file mode 100644 index 0000000000..3ccc4a5939 --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-aws-ssm-agent-registered-via-hybrid-activation.asciidoc @@ -0,0 +1,172 @@ +[[prebuilt-rule-8-19-35-aws-ssm-agent-registered-via-hybrid-activation]] +=== AWS SSM Agent Registered via Hybrid Activation + +Identifies the Amazon SSM Agent invoked with "-register" and a hybrid activation argument on a Linux host. Hybrid activation is how non-EC2 hosts are onboarded as managed nodes, but adversaries with local access can repurpose the pre-installed, root-privileged SSM Agent as a covert remote access trojan by registering it to an attacker-controlled AWS account, gaining a persistent command channel that blends in with legitimate management traffic. On an EC2 instance that already runs the agent under an instance profile, a hybrid registration is highly unusual. The query cannot tell which account received the registration; the investigation guide explains how to confirm it. + +*Rule type*: query + +*Rule indices*: + +* logs-endpoint.events.process* +* logs-crowdstrike.fdr* +* logs-sentinel_one_cloud_funnel.* + +*Severity*: medium + +*Risk score*: 47 + +*Runs every*: 5m + +*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://www.mitiga.io/blog/abusing-the-amazon-web-services-ssm-agent-as-a-remote-access-trojan +* https://thehackernews.com/2023/08/researchers-uncover-aws-ssm-agent.html +* https://www.paloaltonetworks.com/blog/security-operations/aws-systems-manager-attack-vectors/ + +*Tags*: + +* Domain: Endpoint +* Domain: Cloud +* Platform: AWS +* Platform: Linux +* OS: Linux +* Service: AWS SSM +* Tactic: Command and Control +* Tactic: Persistence +* Data Source: Elastic Defend +* Data Source: Crowdstrike +* Data Source: SentinelOne +* Rule Type: Custom Query (KQL) +* Resources: Investigation Guide + +*Version*: 1 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + + +*Investigating AWS SSM Agent Registered via Hybrid Activation* + + +This rule detects the Amazon SSM Agent being registered with a hybrid activation code or ID on a Linux host. On EC2 instances that already run the agent this is anomalous and may indicate an adversary hijacking the agent as a persistent command channel to an AWS account they control. On non-EC2 hosts it is the normal onboarding path and must be confirmed against provisioning records. + + +*Possible investigation steps* + + +- Review the process arguments for the activation code, activation ID, and region. These do not reveal the AWS account; use the next two steps to determine it. +- Read `/var/lib/amazon/ssm/registration` on the host. A `ManagedInstanceID` starting with `mi-` means the agent is hybrid-registered; on an EC2 instance this should be an `i-` instance ID. +- Search CloudTrail across all organization accounts for `RegisterManagedInstance` and `CreateActivation` events with that activation ID. If none of your accounts recorded it, the agent was registered to an external account. +- Investigate the parent process and user session to understand how the registration command was initiated and whether it was interactive. +- Determine if the user session that ran the command was interactive or came from an automated process. + + +*False positive analysis* + + +- Hybrid activation is a legitimate operation when onboarding on-premises or non-EC2 hosts as managed nodes for the first time. On already-registered EC2 instances this sequence is anomalous. +- Allowlist known provisioning automation identities if this fires in expected environments. + + +*Response and remediation* + + +- Initiate the incident response process based on the outcome of the triage. +- Isolate the affected host to prevent the attacker from issuing further SSM commands. +- Re-register the SSM Agent with the correct organization-owned AWS account. +- Rotate any instance credentials that may have been accessible to the attacker during the rogue registration window. +- Review SSM Session Manager history for commands executed through the rogue registration. + + +==== Setup + + + +*Setup* + + +This rule requires data coming in from Elastic Defend. + + +*Elastic Defend Integration Setup* + +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the +Elastic Agent to monitor events on your host and send data to the Elastic Security app. + + +*Prerequisite Requirements:* + +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation]. + + +*The following steps should be executed in order to add the Elastic Defend integration:* + +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can + click the "Existing hosts" tab and select an existing policy instead. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and install Elastic Agent on your hosts. +For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide]. + + +==== Rule query + + +[source, js] +---------------------------------- +event.category : process and host.os.type : linux and event.type : start and +event.action : (ProcessRollup2 or exec or exec_event or start) and +( + process.name : (amazon-ssm-agent or ssm-agent-worker or ssm-setup-cli) or + process.executable : (/snap/amazon-ssm-agent/*/amazon-ssm-agent or /usr/bin/amazon-ssm-agent or /usr/bin/ssm-setup-cli) +) and +process.args : ( + (-register or --register) and + ( + -activation-code or -activation-code=* or --activation-code or --activation-code=* or + -activation-id or -activation-id=* or --activation-id or --activation-id=* or + -code or -code=* or --code or --code=* or + -id or -id=* or --id or --id=* + ) +) + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Command and Control +** ID: TA0011 +** Reference URL: https://attack.mitre.org/tactics/TA0011/ +* Technique: +** Name: Remote Access Tools +** ID: T1219 +** Reference URL: https://attack.mitre.org/techniques/T1219/ +* Tactic: +** Name: Persistence +** ID: TA0003 +** Reference URL: https://attack.mitre.org/tactics/TA0003/ +* Technique: +** Name: External Remote Services +** ID: T1133 +** Reference URL: https://attack.mitre.org/techniques/T1133/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-cloud-offensive-framework-execution.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-cloud-offensive-framework-execution.asciidoc new file mode 100644 index 0000000000..c4deba3a77 --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-cloud-offensive-framework-execution.asciidoc @@ -0,0 +1,179 @@ +[[prebuilt-rule-8-19-35-cloud-offensive-framework-execution]] +=== Cloud Offensive Framework Execution + +Identifies execution of well-known cloud exploitation, enumeration, and attack-simulation frameworks on an endpoint. Adversaries run these after obtaining cloud credentials to map the compromised principal's effective permissions, discover privilege escalation paths, and pivot to the console. Pacu is tracked by MITRE as software S1091. Real-world use on compromised hosts is documented in the AWS customer incident catalog, where both the Unit 42 SugarCRM zero-day response and the AWS CIRT federated-user compromise record Pacu and ScoutSuite scanning from access keys found on EC2 hosts. Covered frameworks include: Pacu, CloudFox, ScoutSuite, PMapper, Stratus Red Team, WeirdAAL, enumerate-iam, Prowler, CloudMapper, CloudSplaining, cloud_enum, CloudBrute, SkyArk, Leonidas, Halberd, Barq, Cartography, Nimbostratus, AWSBucketDump, dsnap, aws_consoler, Redboto, cloudjack, s3scanner, CloudSploit, aws-enumerator, iam-vulnerable, Fog, and SmogCloud. Secret scanners such as TruffleHog and Gitleaks are intentionally excluded because they run routinely in CI and pre-commit hooks; their credential-validation use is covered by CloudTrail and GitHub user-agent rules. Authorized red team and cloud audit activity uses the same tooling, so alerts should be correlated with known assessment windows and operators. + +*Rule type*: query + +*Rule indices*: + +* logs-endpoint.events.process* + +*Severity*: medium + +*Risk score*: 47 + +*Runs every*: 5m + +*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://www.uptycs.com/blog/threat-research-report-team/threat-actor-mitigation-with-cloud-security +* https://github.com/ramimac/aws-customer-security-incidents +* https://unit42.paloaltonetworks.com/sugarcrm-cloud-incident-black-hat/ +* https://github.com/RhinoSecurityLabs/pacu +* https://github.com/BishopFox/cloudfox +* https://github.com/nccgroup/ScoutSuite +* https://github.com/nccgroup/PMapper +* https://stratus-red-team.cloud/ +* https://github.com/duo-labs/cloudmapper +* https://github.com/salesforce/cloudsplaining +* https://github.com/cyberark/SkyArk +* https://github.com/FSecureLABS/leonidas +* https://github.com/vectra-ai-research/Halberd +* https://github.com/prisma-cloud/dsnap + +*Tags*: + +* Domain: Endpoint +* Domain: Cloud +* Platform: AWS +* Platform: Linux +* Platform: macOS +* Platform: Windows +* OS: Linux +* OS: macOS +* OS: Windows +* Use Case: Threat Detection +* Tactic: Discovery +* Tactic: Execution +* Data Source: Elastic Defend +* Rule Type: Custom Query (KQL) +* Resources: Investigation Guide + +*Version*: 1 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + + +*Investigating Cloud Offensive Framework Execution* + + +This rule fires when a known cloud offensive, enumeration, or attack-simulation framework starts on an endpoint, either as a standalone binary or through a Python, Go, Node, uv, or pipx launcher whose command line references the tool. These frameworks are what an adversary reaches for immediately after obtaining cloud credentials: Pacu and CloudFox for privilege escalation paths, ScoutSuite and Prowler for account-wide enumeration, PMapper and CloudMapper for IAM graphing, Stratus Red Team, Leonidas, and Halberd for scripted attack chains. + + +*Possible investigation steps* + + +- Review `process.command_line` and `process.working_directory` to identify the framework, the modules or checks invoked, and any `--profile`, `--role`, or credential file arguments that show which cloud principal is being used. +- Identify the parent process and user. An interactive terminal under a security engineer's account differs from a launcher spawned by a web server, cron, CI runner, or a process running from `/tmp`. +- Check whether cloud credentials exist on the host (`~/.aws/credentials`, environment variables, instance metadata) and whether they were recently created or accessed. +- Pivot to CloudTrail or the equivalent cloud audit log for the same principal and time window. Pacu and ScoutSuite generate bursts of `Describe*`, `List*`, and `Get*` calls; PMapper and CloudFox add `iam:Simulate*` and `sts:GetCallerIdentity`. +- Look for follow-on activity on the host: new IAM users or keys, `aws sts assume-role`, `aws_consoler` console federation, or outbound connections from the same process tree. +- Correlate with `Potential Linux Hack Tool Launched` and with the CloudTrail rules `AWS IAM User Self Created Access Key Subsequently Used` and `Suspicious User Agent Detected in CloudTrail`. + + +*False positive analysis* + + +- Scheduled Prowler, ScoutSuite, or Cartography runs from a dedicated security or compliance host. Verify the host, user, and schedule, then add an exception scoped to that host and user rather than to the tool name. +- Red team or purple team engagements. Confirm against the engagement record and time window. +- Developers building or testing a framework from source. `go build`, `go test`, `pip install`, and `pytest` are excluded; if a build system uses other commands, exclude by parent process rather than by tool name. + + +*Response and remediation* + + +- If not authorized, isolate the host and terminate the process tree. +- Identify every cloud principal whose credentials were present on the host and rotate or revoke them. Treat any key used by the framework as compromised. +- Review CloudTrail for the principal from the first framework execution onward, looking for privilege escalation (`iam:CreateAccessKey`, `iam:AttachUserPolicy`, `iam:UpdateAssumeRolePolicy`), persistence (new users, roles, Lambda functions), and data access. +- Remove the framework, its virtual environment, and any session or credential caches it created (for example Pacu's session database). +- Escalate to the cloud incident response process if the principal had privileges beyond read-only enumeration. + + +==== Setup + + + + +==== Rule query + + +[source, js] +---------------------------------- +event.category : "process" and event.type : "start" and event.action:(start or exec) and +( + process.name : ( + pacu or pacu.exe or cloudfox or cloudfox.exe or + weirdaal or "enumerate-iam" or enumerate_iam or scoutsuite or pmapper or + prowler or prowler.exe or cloudmapper or cloudsplaining or cloud_enum or + cloudbrute or cloudbrute.exe or nimbostratus or "aws-enumerator" or "aws-enumerator.exe" or + skyark or awsbucketdump or dsnap or aaia or + aws_consoler or awsconsoler or redboto or cloudjack or s3scanner or s3scanner.exe or + cloudsploit or "iam-vulnerable" or smogcloud + ) or + (process.name : (stratus or stratus.exe) and process.args : (detonate or warmup or revert or cleanup)) or + (process.name : cartography and process.args : ("--aws-sync-all-profiles" or "--aws-requested-syncs")) or + ( + process.name : (python* or pipx or uv or uvx or go or node) and + process.command_line : ( + *cloudfox* or *enumerate_iam* or *enumerate-iam* or *weirdAAL* or *aws_consoler* or + *-m pacu* or *pacu.py* or *aws_escalate* or *scoutsuite* or *pmapper* or + *cloudmapper* or *cloudsplaining* or *nimbostratus* or *leonidas-framework* or + *cloud_enum* or *halberd* or *skyark* or *awsbucketdump* or *stratus-red-team* or + *prowler* or *cloudsploit* or *cloudbrute* or *fog-aws* or *barq* + ) + ) +) and not process.command_line : ( + *pip install* or *pip3 install* or *pipx install* or *uv pip install* or *uv tool install* or + *go get* or *go install* or *go build* or *go test* or *npm install* or *--help* or *--version* or + *git clone* or *pytest* or "*site-packages/pip*" +) and not process.parent.name : (dpkg or rpm or apt or yum or dnf or brew or pip or pip3) + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Discovery +** ID: TA0007 +** Reference URL: https://attack.mitre.org/tactics/TA0007/ +* Technique: +** Name: Cloud Infrastructure Discovery +** ID: T1580 +** Reference URL: https://attack.mitre.org/techniques/T1580/ +* Technique: +** Name: Permission Groups Discovery +** ID: T1069 +** Reference URL: https://attack.mitre.org/techniques/T1069/ +* Sub-technique: +** Name: Cloud Groups +** ID: T1069.003 +** Reference URL: https://attack.mitre.org/techniques/T1069/003/ +* Tactic: +** Name: Execution +** ID: TA0002 +** Reference URL: https://attack.mitre.org/tactics/TA0002/ +* Technique: +** Name: Command and Scripting Interpreter +** ID: T1059 +** Reference URL: https://attack.mitre.org/techniques/T1059/ +* Sub-technique: +** Name: Python +** ID: T1059.006 +** Reference URL: https://attack.mitre.org/techniques/T1059/006/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-excessive-sudo-authentication-failures-via-macos-security-events.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-excessive-sudo-authentication-failures-via-macos-security-events.asciidoc new file mode 100644 index 0000000000..2e0adc1eeb --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-excessive-sudo-authentication-failures-via-macos-security-events.asciidoc @@ -0,0 +1,165 @@ +[[prebuilt-rule-8-19-35-excessive-sudo-authentication-failures-via-macos-security-events]] +=== Excessive Sudo Authentication Failures via macOS Security Events + +Identifies a high number of failed sudo password attempts on a macOS host within a short time window, using sudo messages collected by the Authentication data stream of the macOS Security Events integration. Repeated sudo authentication failures may indicate an adversary with access to a low-privileged account attempting to guess an administrator password to escalate privileges. + +*Rule type*: esql + +*Rule indices*: None + +*Severity*: low + +*Risk score*: 21 + +*Runs every*: 5m + +*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://themittenmac.com/detecting-ssh-activity-via-process-monitoring/ + +*Tags*: + +* Domain: Endpoint +* OS: macOS +* Platform: macOS +* Use Case: Threat Detection +* Tactic: Privilege Escalation +* Tactic: Credential Access +* Data Source: macOS Security Events +* Rule Type: ESQL +* Resources: Investigation Guide + +*Version*: 1 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + +> **Disclaimer**: +> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs. + + +*Investigating Excessive Sudo Authentication Failures via macOS Security Events* + + +On macOS, `sudo` prompts for the invoking user's password and, after the configured number of incorrect attempts +(three by default), logs a message of the form ` : incorrect password attempts ; TTY= ; PWD= ; +USER= ; COMMAND=` to the unified log. This rule sums the reported attempt counts per host within the +rule window and alerts when the total reaches the threshold. The invoking user, target user, TTY, and attempted commands +are extracted from the messages and reported in the alert as `Esql.user_name_values`, `Esql.target_user_values`, +`Esql.tty_values`, and `Esql.command_values`. + + +*Possible investigation steps* + + +- Review `Esql.attempt_total`, `Esql.user_name_values`, and `Esql.command_values` in the alert to identify who was +attempting to elevate, how many times, and what they were trying to run. +- Determine whether the invoking account is expected to have sudo rights. Failures from an account that is not an +administrator suggest privilege escalation attempts rather than mistyped passwords. +- Review the attempted commands for reconnaissance, persistence, or credential access tooling (for example, `dscl`, +`launchctl`, `security`, `defaults`, shell interpreters, or scripts in user-writable locations). +- Check whether a successful sudo invocation by the same user follows the failures in `logs-macos.authentication-*`, +which would indicate the password was eventually guessed or known. +- Review how the session originated: a local console session (`ttys` with a preceding login window login) versus an SSH +session, and correlate with SSH authentication alerts on the same host. +- Correlate with other alerts or events from the same host and user during the same period. + + +*False positive analysis* + + +- Administrators who mistype their password. The default three-attempt limit per invocation and the threshold make this +unlikely from a single interactive session, but repeated invocations can approach it. +- Scripts or automation that invoke `sudo` with stale or incorrect credentials in a loop. +- Users who are not administrators habitually attempting `sudo`; consider tuning by user or excluding known cases if +this is expected behavior. + + +*Response and remediation* + + +- Identify the invoking account and its session origin; if the account is not expected to use sudo or the session is +remote and unexpected, terminate the session and disable or reset the account. +- Review the attempted commands and the host for evidence of prior compromise of the low-privileged account. +- Reset the administrator password if there is any indication it may have been guessed or exposed. +- Review sudo configuration and administrator group membership on the host; remove unnecessary admin rights. +- Escalate to the security operations team if additional hosts show similar patterns. + + +==== Setup + + + +*Setup* + + +This rule requires data from the macOS Security Events integration. +Integration setup: https://www.elastic.co/docs/reference/security/prebuilt-rules/integration/macos/macos_security_events +This rule uses the Authentication data stream (`logs-macos.authentication-*`). The sudo messages it matches are +collected by the data stream's default configuration; no predicate or log-level changes are required. + + +==== Rule query + + +[source, js] +---------------------------------- +FROM logs-macos.authentication-* +| WHERE data_stream.dataset == "macos.authentication" and + macos.process.image_path LIKE "*/sudo" and + macos.event.message.description LIKE "*incorrect password attempt*" +| GROK macos.event.message.description "%{NOTSPACE:user_name} : %{NUMBER:attempt_count:int} incorrect password attempt%{DATA} ; TTY=%{NOTSPACE:tty} ; PWD=%{DATA:pwd} ; USER=%{NOTSPACE:target_user} ; COMMAND=%{GREEDYDATA:command}" +| STATS + Esql.failure_event_count = COUNT(*), + Esql.attempt_total = SUM(attempt_count), + Esql.user_name_values = VALUES(user_name), + Esql.target_user_values = VALUES(target_user), + Esql.tty_values = VALUES(tty), + Esql.command_values = VALUES(command) + BY host.id, host.name +| WHERE Esql.attempt_total >= 10 +| KEEP host.id, host.name, Esql.failure_event_count, Esql.attempt_total, Esql.user_name_values, Esql.target_user_values, Esql.tty_values, Esql.command_values + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Privilege Escalation +** ID: TA0004 +** Reference URL: https://attack.mitre.org/tactics/TA0004/ +* Technique: +** Name: Abuse Elevation Control Mechanism +** ID: T1548 +** Reference URL: https://attack.mitre.org/techniques/T1548/ +* Sub-technique: +** Name: Sudo and Sudo Caching +** ID: T1548.003 +** Reference URL: https://attack.mitre.org/techniques/T1548/003/ +* Tactic: +** Name: Credential Access +** ID: TA0006 +** Reference URL: https://attack.mitre.org/tactics/TA0006/ +* Technique: +** Name: Brute Force +** ID: T1110 +** Reference URL: https://attack.mitre.org/techniques/T1110/ +* Sub-technique: +** Name: Password Guessing +** ID: T1110.001 +** Reference URL: https://attack.mitre.org/techniques/T1110/001/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-first-seen-external-mqtt-broker-connection.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-first-seen-external-mqtt-broker-connection.asciidoc new file mode 100644 index 0000000000..8d3053bba3 --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-first-seen-external-mqtt-broker-connection.asciidoc @@ -0,0 +1,182 @@ +[[prebuilt-rule-8-19-35-first-seen-external-mqtt-broker-connection]] +=== First Seen External MQTT Broker Connection + +Identifies the first MQTT relationship from an internal source to an external broker that was not observed during the previous 14 days. MQTT is commonly used by IoT and messaging applications, but malware including BambooToken, IOCONTROL, MQsTTang, and WailingCrab has used publish/subscribe traffic for command and control. + +*Rule type*: new_terms + +*Rule indices*: + +* logs-panw.panos* +* logs-suricata.eve-* +* logs-zeek.connection-* + +*Severity*: medium + +*Risk score*: 47 + +*Runs every*: 5m + +*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://www.lumen.com/blog/en-us/the-banana-stand-brokering-and-managing-infections-across-asia-using-mqtt +* https://docs.suricata.io/en/latest/output/eve/eve-json-format.html#event-type-mqtt +* https://www.elastic.co/docs/reference/integrations/suricata +* https://docs.zeek.org/en/current/scripts/base/protocols/mqtt/main.zeek.html +* https://www.elastic.co/docs/reference/integrations/zeek +* https://www.elastic.co/docs/reference/integrations/panw + +*Tags*: + +* Domain: Network +* Use Case: Network Security Monitoring +* Use Case: Threat Detection +* Tactic: Command and Control +* Data Source: PAN-OS Logs +* Data Source: Suricata Logs +* Data Source: Zeek +* Rule Type: New Terms +* Resources: Investigation Guide + +*Version*: 1 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + + +*Investigating First Seen External MQTT Broker Connection* + + +MQTT uses a broker to relay messages between publishers and subscribers. This architecture is useful for legitimate IoT +and application messaging, but it also allows malware to receive commands and return results without connecting directly +to an operator. This rule surfaces the first protocol-decoded or application-identified MQTT relationship between an +internal source and an external destination within the 14-day new-terms history window. + +The alert does not prove malicious command and control. Suricata and Zeek require plaintext MQTT or traffic decrypted +before inspection. PAN-OS coverage depends on App-ID identifying the traffic as `mqtt-base`; encrypted sessions may only +be identified as SSL when decryption is unavailable. + + +*Possible investigation steps* + + +- Identify the asset, owner, operating system, and expected role of `source.ip`. MQTT from servers, workstations, routers, + firewalls, build systems, and other assets that are not approved MQTT clients warrants additional scrutiny. +- Determine whether `destination.ip` belongs to an approved private or public MQTT broker. Review destination reputation, + ASN, geolocation, passive DNS, and other internal clients communicating with it. +- For Suricata events, inspect `suricata.eve.mqtt` for CONNECT client IDs, credentials, subscribed topics, published + topics, payloads, keepalive values, and broker response codes. Review equivalent protocol details in the originating + network sensor when available. +- Look for GUID- or UUID-scoped topics and BambooToken-associated suffixes such as `/Plugin`, `/removePlugin`, + `/unPlugin`, and `/LUA`. A `Global` publication containing `online` or `offline` status and a `gid` increases confidence. +- Review the connection duration, reconnect cadence, bytes transferred, and additional ports contacted on the + destination. BambooToken infrastructure has included TCP ports 1883, 2883, and 8883. +- Correlate with endpoint telemetry for unexpected MQTT-capable processes, DLL side-loading, shell execution, discovery, + file transfer, or persistence. For BambooToken, investigate `OnKeySrv.exe`, `OnKeyToken_KEB.dll`, and nearby + `OnKeySrv.dat` or `OnKeySvr.dat` files. + + +*False positive analysis* + + +- Confirm newly deployed or intermittently active IoT, telemetry, messaging, and monitoring applications with the asset + owner. +- Validate broker migrations, disaster-recovery tests, development environments, and vendor-managed services. +- Scope exceptions to an approved source asset and broker pair where possible. Avoid excluding all MQTT traffic or an + entire public broker globally. + + +*Response and remediation* + + +- Isolate the source if the process, topic structure, payload, or destination indicates command and control. +- Block unauthorized broker access and preserve MQTT transactions, flow metadata, DNS history, and endpoint process + evidence. +- Remove confirmed malware and persistence, rotate credentials available to the affected system, and search for the same + client ID, topic hierarchy, destination, and artifacts across the environment. +- Establish an inventory of approved MQTT clients, brokers, ports, and topic prefixes, and restrict outbound MQTT where + operationally feasible. + + +==== Setup + + + +*Setup* + + +This rule requires one or more of the following integrations: + +- Suricata with the MQTT application-layer parser and MQTT EVE output enabled. +- Zeek connection logs with the MQTT analyzer enabled so `network.protocol` is populated with `mqtt`. +- PAN-OS traffic logs with App-ID enabled and MQTT identified as `mqtt-base`. + +Place network sensors where they observe client-to-broker traffic before source NAT so internal client addresses remain +visible. Suricata and Zeek must observe plaintext MQTT or receive decrypted traffic. PAN-OS must identify the session with +the MQTT App-ID; without decryption, MQTT over TLS may only be identified as SSL. + + +==== Rule query + + +[source, js] +---------------------------------- +( + data_stream.dataset:suricata.eve and + suricata.eve.event_type:mqtt and + network.protocol:mqtt or + data_stream.dataset:zeek.connection and + network.protocol:mqtt or + data_stream.dataset:panw.panos and + network.application:mqtt-base +) and + network.transport:tcp and + source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or "FC00::/7") and + destination.ip:( + * and not ( + 10.0.0.0/8 or 100.64.0.0/10 or 127.0.0.0/8 or 169.254.0.0/16 or 172.16.0.0/12 or + 192.0.0.0/24 or 192.0.0.0/29 or 192.0.0.10/32 or 192.0.0.170/32 or 192.0.0.171/32 or + 192.0.0.8/32 or 192.0.0.9/32 or 192.0.2.0/24 or 192.168.0.0/16 or 192.175.48.0/24 or + 192.31.196.0/24 or 192.52.193.0/24 or 192.88.99.0/24 or 198.18.0.0/15 or + 198.51.100.0/24 or 203.0.113.0/24 or 224.0.0.0/4 or 240.0.0.0/4 or "::1" or + "FC00::/7" or "FE80::/10" or "FF00::/8" + ) + ) and + not ( + data_stream.dataset:panw.panos and ( + event.action:(flow_denied or flow_dropped) or + network.application:(incomplete or insufficient-data or not-applicable) + ) + ) + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Command and Control +** ID: TA0011 +** Reference URL: https://attack.mitre.org/tactics/TA0011/ +* Technique: +** Name: Application Layer Protocol +** ID: T1071 +** Reference URL: https://attack.mitre.org/techniques/T1071/ +* Sub-technique: +** Name: Publish/Subscribe Protocols +** ID: T1071.005 +** Reference URL: https://attack.mitre.org/techniques/T1071/005/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-first-time-fortigate-administrator-login.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-first-time-fortigate-administrator-login.asciidoc new file mode 100644 index 0000000000..e7f3b0a76a --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-first-time-fortigate-administrator-login.asciidoc @@ -0,0 +1,148 @@ +[[prebuilt-rule-8-19-35-first-time-fortigate-administrator-login]] +=== First-Time FortiGate Administrator Login + +This rule detects the first observed successful login of a user with the Administrator role to the FortiGate management interface within the last 5 days. First-time administrator logins can indicate newly provisioned accounts, misconfigurations, or unauthorized access using valid credentials and should be reviewed promptly. + +*Rule type*: esql + +*Rule indices*: None + +*Severity*: high + +*Risk score*: 73 + +*Runs every*: 5m + +*Searches indices from*: now-7205m ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://www.elastic.co/docs/reference/integrations/fortinet_fortigate +* https://www.cisa.gov/news-events/alerts/2026/01/28/fortinet-releases-guidance-address-ongoing-exploitation-authentication-bypass-vulnerability-cve-2026 + +*Tags*: + +* Use Case: Threat Detection +* Tactic: Initial Access +* Resources: Investigation Guide +* Domain: Network +* Domain: Identity +* Data Source: Fortinet +* Data Source: Fortinet FortiGate +* Noise: Low +* Performance: Normal +* Rule Type: ES|QL + +*Version*: 6 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and Analysis* + + + +*Investigating First-Time FortiGate Administrator Login* + + +This alert indicates that a user with the **Administrator** role has successfully logged in to the FortiGate management interface for the first time within the last 5 days of observed data. + +Because administrator access provides full control over network security devices, any newly observed admin login should be validated to confirm it is expected and authorized. + + +*Investigation Steps* + + +- **Identify the account** + - Review `source.user.name` and confirm whether the account is known and officially provisioned. + - Determine whether this is a newly created administrator or an existing account logging in for the first time. + +- **Validate the source** + - Review `source.ip` and confirm whether it originates from a trusted management network, VPN, or jump host. + - Investigate geolocation or ASN if the source IP is external or unusual. + +- **Review login context** + - Examine associated FortiGate log messages for details such as login method, interface, or authentication source. + - Check for additional administrative actions following the login (policy changes, user creation, configuration exports). + - Review `fortinet.firewall.profile` to identify the FortiGate Admin Profile the identity logged in under. + +- **Correlate with recent changes** + - Verify whether there were recent change requests, onboarding activities, or maintenance windows that explain the login. + - Look for other authentication attempts (failed or successful) from the same source or user. + + +*False Positive Considerations* + + +- Newly onboarded administrators or service accounts. +- First-time logins after log retention changes or data source onboarding. +- Automation, backup, or monitoring tools introduced recently. +- Lab, development, or test FortiGate devices. + + +*Response and Remediation* + + +- **If authorized** + - Document the activity and consider adding an exception if the behavior is expected. + - Ensure the account follows least-privilege and MFA best practices. + +- **If suspicious or unauthorized** + - Disable or restrict the administrator account immediately. + - Rotate credentials and review authentication sources. + - Audit recent FortiGate configuration changes. + - Review surrounding network activity for lateral movement or persistence attempts. + +==== Rule query + + +[source, js] +---------------------------------- +FROM logs-fortinet_fortigate.*, filebeat-* metadata _id + +| WHERE data_stream.dataset == "fortinet_fortigate.log" and + event.category == "authentication" and event.action == "login" and + event.outcome == "success" and source.user.roles == "Administrator" and source.user.name is not null +| stats Esql.logon_count = count(*), + Esql.first_time_seen = MIN(@timestamp), + Esql.source_ip_values = VALUES(source.ip), + Esql.message_values = VALUES(message) by source.user.name, fortinet.firewall.profile + +// first time seen is within 6m of the rule execution time and for the last 5d of events history +| eval Esql.recent = DATE_DIFF("minute", Esql.first_time_seen, now()) +| where Esql.recent <= 6 + +// move dynamic fields to ECS equivalent for rule exceptions +| eval source.ip = MV_FIRST(Esql.source_ip_values) + +| keep source.ip, + source.user.name, + fortinet.firewall.profile, + Esql.logon_count, + Esql.first_time_seen, + Esql.source_ip_values, + Esql.message_values, + Esql.recent + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Initial Access +** ID: TA0001 +** Reference URL: https://attack.mitre.org/tactics/TA0001/ +* Technique: +** Name: Valid Accounts +** ID: T1078 +** Reference URL: https://attack.mitre.org/techniques/T1078/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-fortigate-forticloud-sso-login-from-unusual-source.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-fortigate-forticloud-sso-login-from-unusual-source.asciidoc new file mode 100644 index 0000000000..f44ac1975e --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-fortigate-forticloud-sso-login-from-unusual-source.asciidoc @@ -0,0 +1,154 @@ +[[prebuilt-rule-8-19-35-fortigate-forticloud-sso-login-from-unusual-source]] +=== FortiGate FortiCloud SSO Login from Unusual Source + +This rule detects the first successful FortiCloud SSO login from a previously unseen source IP address to a FortiGate device within the last 5 days. FortiCloud SSO logins from new source IPs may indicate exploitation of SAML-based authentication bypass vulnerabilities such as CVE-2026-24858, where crafted SAML assertions allow unauthorized access to FortiGate devices registered to other accounts. Environments that regularly use FortiCloud SSO will only alert on new source IPs not seen in the lookback window. + +*Rule type*: esql + +*Rule indices*: None + +*Severity*: medium + +*Risk score*: 47 + +*Runs every*: 5m + +*Searches indices from*: now-7205m ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://www.fortiguard.com/psirt/FG-IR-26-060 +* https://www.fortinet.com/blog/psirt-blogs/analysis-of-sso-abuse-on-fortios +* https://www.elastic.co/docs/reference/integrations/fortinet_fortigate +* https://www.cisa.gov/news-events/alerts/2026/01/28/fortinet-releases-guidance-address-ongoing-exploitation-authentication-bypass-vulnerability-cve-2026 + +*Tags*: + +* Use Case: Threat Detection +* Tactic: Initial Access +* Tactic: Credential Access +* Resources: Investigation Guide +* Domain: Network +* Domain: Identity +* Data Source: Fortinet +* Data Source: Fortinet FortiGate +* Noise: Low +* Performance: Normal +* Profile: Recommended +* Threat: Vulnerability Exploit +* Rule Type: ES|QL +* Vuln: CVE-2026-24858 + +*Version*: 6 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + + +*Investigating FortiGate FortiCloud SSO Login from Unusual Source* + + +This alert indicates that a FortiCloud SSO login was observed from a source IP address not previously seen authenticating via SSO in the last 5 days. This is a high-value signal because it filters out routine SSO access from known management IPs and only fires on novel source addresses. + +CVE-2026-24858 (FG-IR-26-060) allows attackers with a FortiCloud account and a registered device to craft SAML assertions that authenticate them as administrators on other FortiGate devices when FortiCloud SSO is enabled. This vulnerability has been actively exploited in the wild. + + +*Possible investigation steps* + + +- Check `source.ip` against known corporate management networks, VPN egress points, and jump hosts. Investigate the IP's ASN and geolocation, as attacker IPs have been observed from The Constant Company LLC, BL Networks, Kaopu Cloud HK Limited, and Cloudflare-protected ranges. +- Determine whether this IP has been seen in any other authentication context across the environment. +- Check `Esql.user_values` for the SSO account name (typically an email address) and verify the account belongs to the organization. Compare against known attacker email IOCs: cloud-noc@mail.io, cloud-init@mail.io, heltaylor.12@tutamail.com, support@openmail.pro. +- Check `Esql.observer_name_values` to identify which FortiGate device was accessed and confirm whether FortiCloud SSO is intentionally enabled on the device. +- Look for local administrator account creation, configuration exports, firewall policy changes, or VPN user/group creation immediately following the SSO login. The observed attack pattern involves rogue admin creation within seconds of login. + + +*False positive analysis* + + +- Administrators connecting from a new office location, hotel, or home network for the first time may trigger this alert. +- FortiCloud SSO access after IP address changes such as ISP rotation or VPN egress changes can appear as a new source IP. +- First login after FortiCloud SSO is initially enabled on a device will fire since no historical SSO logins exist. + + +*Response and remediation* + + +- If the activity is unauthorized, disable FortiCloud SSO immediately using `config system global` > `set admin-forticloud-sso-login disable`. +- Audit all administrator accounts for unauthorized additions and review and restore configuration from a known-clean backup. +- Rotate all credentials including any LDAP/AD accounts connected to the device. +- Upgrade FortiOS to a patched version. +- If the activity is expected, document the new source IP and consider adding an exception if it represents a new management location. + +==== Rule query + + +[source, js] +---------------------------------- +FROM logs-fortinet_fortigate.* metadata _id, _version, _index + +| WHERE data_stream.dataset == "fortinet_fortigate.log" and + event.category == "authentication" and event.action == "login" and + event.outcome == "success" and + (fortinet.firewall.method == "sso" or fortinet.firewall.ui like "sso*") and + source.ip is not null +| STATS Esql.logon_count = COUNT(*), + Esql.first_time_seen = MIN(@timestamp), + Esql.user_values = VALUES(source.user.name), + Esql.observer_name_values = VALUES(observer.name), + Esql.message_values = VALUES(message) BY source.ip + +// first time seen is within 6m of the rule execution time and for the last 5d of events history +| EVAL Esql.recent = DATE_DIFF("minute", Esql.first_time_seen, now()) +| WHERE Esql.recent <= 6 + +// move dynamic fields to ECS equivalent for rule exceptions +| EVAL source.user.name = MV_FIRST(Esql.user_values) + +| KEEP source.ip, source.user.name, Esql.* + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Initial Access +** ID: TA0001 +** Reference URL: https://attack.mitre.org/tactics/TA0001/ +* Technique: +** Name: Valid Accounts +** ID: T1078 +** Reference URL: https://attack.mitre.org/techniques/T1078/ +* Sub-technique: +** Name: Cloud Accounts +** ID: T1078.004 +** Reference URL: https://attack.mitre.org/techniques/T1078/004/ +* Technique: +** Name: Exploit Public-Facing Application +** ID: T1190 +** Reference URL: https://attack.mitre.org/techniques/T1190/ +* Tactic: +** Name: Credential Access +** ID: TA0006 +** Reference URL: https://attack.mitre.org/tactics/TA0006/ +* Technique: +** Name: Forge Web Credentials +** ID: T1606 +** Reference URL: https://attack.mitre.org/techniques/T1606/ +* Sub-technique: +** Name: SAML Tokens +** ID: T1606.002 +** Reference URL: https://attack.mitre.org/techniques/T1606/002/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-gke-api-request-failure-burst-by-user.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-gke-api-request-failure-burst-by-user.asciidoc new file mode 100644 index 0000000000..599f17904a --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-gke-api-request-failure-burst-by-user.asciidoc @@ -0,0 +1,116 @@ +[[prebuilt-rule-8-19-35-gke-api-request-failure-burst-by-user]] +=== GKE API Request Failure Burst by User + +Detects bursts of failed GKE API requests from a single user identity within a five-minute window. Repeated authorization failures across multiple actions can indicate credential stuffing, RBAC probing, or reconnaissance with stolen tokens. + +*Rule type*: esql + +*Rule indices*: None + +*Severity*: medium + +*Risk score*: 47 + +*Runs every*: 5m + +*Searches indices from*: now-11m ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging +* https://attack.mitre.org/techniques/T1613/ + +*Tags*: + +* Domain: Cloud +* Domain: Kubernetes +* Data Source: GCP +* Data Source: Google Cloud Platform +* Use Case: Threat Detection +* Tactic: Discovery +* Resources: Investigation Guide +* Noise: Unknown +* Performance: Fast +* Rule Type: ES|QL +* Platform: GCP +* Domain: Containers +* Platform: Kubernetes + +*Version*: 3 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + + +*Investigating GKE API Request Failure Burst by User* + + +The rule aggregates failed Kubernetes API calls per `user.email`, source IP, and user agent in five-minute buckets and +alerts when failures reach ten or more. + + +*Investigation steps* + + +- Review `Esql.actions` and `Esql.resources` for targeted API operations. +- Validate whether the identity should exist and whether the source IP is expected. +- Hunt for later successful calls indicating privilege escalation. + + +*False positives* + + +- Misconfigured automation or CI jobs with stale credentials may generate bursts; exclude known service accounts. + +==== Setup + + +The GCP Fleet integration with GKE audit logs enabled is required to be compatible with this rule. + +==== Rule query + + +[source, js] +---------------------------------- +from logs-gcp.audit-* metadata _id, _index, _version +| eval Esql.time_interval = date_trunc(5 minutes, @timestamp) +| where data_stream.dataset == "gcp.audit" + and service.name == "k8s.io" + and event.outcome == "failure" + and not mv_contains(event.type, "allowed") + and user.email is not null + and not to_string(user.email) rlike "(system:serviceaccount:|system:gke-spiffe-controller|system:kube-scheduler|system:node:).*" +| stats + Esql.unique_actions = count_distinct(event.action), + Esql.failures_count = count(*), + Esql.actions = values(event.action), + Esql.resources = values(orchestrator.resource.name) + by user.email, source.ip, user_agent.original, data_stream.namespace, Esql.time_interval +| where Esql.failures_count >= 10 +| keep Esql.*, user.email, source.ip, user_agent.original, data_stream.namespace + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Discovery +** ID: TA0007 +** Reference URL: https://attack.mitre.org/tactics/TA0007/ +* Technique: +** Name: Container and Resource Discovery +** ID: T1613 +** Reference URL: https://attack.mitre.org/techniques/T1613/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-google-workspace-object-copied-to-external-drive-with-app-consent.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-google-workspace-object-copied-to-external-drive-with-app-consent.asciidoc new file mode 100644 index 0000000000..216f20192f --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-google-workspace-object-copied-to-external-drive-with-app-consent.asciidoc @@ -0,0 +1,175 @@ +[[prebuilt-rule-8-19-35-google-workspace-object-copied-to-external-drive-with-app-consent]] +=== Google Workspace Object Copied to External Drive with App Consent + +Detects when a user copies a Google spreadsheet, form, document or script from an external drive. Sequence logic has been added to also detect when a user grants a custom Google application permission via OAuth shortly after. An adversary may send a phishing email to the victim with a Drive object link where "copy" is included in the URI, thus copying the object to the victim's drive. If a container-bound script exists within the object, execution will require permission access via OAuth in which the user has to accept. + +*Rule type*: eql + +*Rule indices*: + +* filebeat-* +* logs-google_workspace* + +*Severity*: medium + +*Risk score*: 47 + +*Runs every*: 5m + +*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://www.elastic.co/security-labs/google-workspace-attack-surface-part-one +* https://www.elastic.co/security-labs/google-workspace-attack-surface-part-two +* https://developers.google.com/apps-script/guides/bound +* https://support.google.com/a/users/answer/13004165#share_make_a_copy_links + +*Tags*: + +* Domain: Cloud +* Data Source: Google Workspace +* Tactic: Initial Access +* Resources: Investigation Guide + +*Version*: 14 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + + +*Investigating Google Workspace Object Copied to External Drive with App Consent* + + +Google Workspace users can share access to Drive objects such as documents, sheets, and forms via email delivery or a shared link. Shared link URIs have parameters like `view` or `edit` to indicate the recipient's permissions. The `copy` parameter allows the recipient to copy the object to their own Drive, which grants the object with the same privileges as the recipient. Specific objects in Google Drive allow container-bound scripts that run on Google's Apps Script platform. Container-bound scripts can contain malicious code that executes with the recipient's privileges if in their Drive. + +This rule aims to detect when a user copies an external Drive object to their Drive storage and then grants permissions to a custom application via OAuth prompt. + + +*Possible investigation steps* + +- Identify user account(s) associated by reviewing `user.name` or `source.user.email` in the alert. +- Identify the name of the file copied by reviewing `file.name` as well as the `file.id` for triaging. +- Identify the file type by reviewing `google_workspace.drive.file.type`. +- With the information gathered so far, query across data for the file metadata to determine if this activity is isolated or widespread. +- Within the OAuth token event, identify the application name by reviewing `google_workspace.token.app_name`. + - Review the application ID as well from `google_workspace.token.client.id`. + - This metadata can be used to report the malicious application to Google for permanent blacklisting. +- Identify the permissions granted to the application by the user by reviewing `google_workspace.token.scope.data.scope_name`. + - This information will help pivot and triage into what services may have been affected. +- If a container-bound script was attached to the copied object, it will also exist in the user's drive. + - This object should be removed from all users affected and investigated for a better understanding of the malicious code. + + +*False positive analysis* + +- Communicate with the affected user to identify if these actions were intentional +- If a container-bound script exists, review code to identify if it is benign or malicious + + +*Response and remediation* + +- Initiate the incident response process based on the outcome of the triage. +- Disable or limit the account during the investigation and response. +- Identify the possible impact of the incident and prioritize accordingly; the following actions can help you gain context: + - Identify the account role in the cloud environment. + - Assess the criticality of affected services and servers. + - Work with your IT team to identify and minimize the impact on users. + - Identify if the attacker is moving laterally and compromising other accounts, servers, or services. + - Identify any regulatory or legal ramifications related to this activity. +- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions. + - Resetting passwords will revoke OAuth tokens which could have been stolen. +- Reactivate multi-factor authentication for the user. +- Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed. +- Implement security defaults https://cloud.google.com/security-command-center/docs/how-to-investigate-threats[provided by Google]. +- Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector. +- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). + + + +*Important Information Regarding Google Workspace Event Lag Times* + +- As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs. +- To reduce the risk of false negatives, consider reducing the interval that the Google Workspace (formerly G Suite) Filebeat module polls Google's reporting API for new events. +- By default, `var.interval` is set to 2 hours (2h). Consider changing this interval to a lower value, such as 10 minutes (10m). +- See the following references for further information: + - https://support.google.com/a/answer/7061566 + - https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-google_workspace.html + +==== Setup + + +The Google Workspace Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. + +==== Rule query + + +[source, js] +---------------------------------- +sequence by source.user.email with maxspan=3m +[file where data_stream.dataset == "google_workspace.drive" and event.action == "copy" and + + /* Should only match if the object lives in a Drive that is external to the user's GWS organization */ + google_workspace.drive.owner_is_team_drive == false and google_workspace.drive.copy_type == "external" and + + /* Google Script, Forms, Sheets and Document can have container-bound scripts */ + google_workspace.drive.file.type: ("script", "form", "spreadsheet", "document")] + +[any where data_stream.dataset == "google_workspace.token" and event.action == "authorize" and + + /* Ensures application ID references custom app in Google Workspace and not GCP */ + google_workspace.token.client.id : "*apps.googleusercontent.com"] + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Initial Access +** ID: TA0001 +** Reference URL: https://attack.mitre.org/tactics/TA0001/ +* Technique: +** Name: Phishing +** ID: T1566 +** Reference URL: https://attack.mitre.org/techniques/T1566/ +* Sub-technique: +** Name: Spearphishing Link +** ID: T1566.002 +** Reference URL: https://attack.mitre.org/techniques/T1566/002/ +* Tactic: +** Name: Execution +** ID: TA0002 +** Reference URL: https://attack.mitre.org/tactics/TA0002/ +* Technique: +** Name: User Execution +** ID: T1204 +** Reference URL: https://attack.mitre.org/techniques/T1204/ +* Sub-technique: +** Name: Malicious Link +** ID: T1204.001 +** Reference URL: https://attack.mitre.org/techniques/T1204/001/ +* Tactic: +** Name: Persistence +** ID: TA0003 +** Reference URL: https://attack.mitre.org/tactics/TA0003/ +* Technique: +** Name: Account Manipulation +** ID: T1098 +** Reference URL: https://attack.mitre.org/techniques/T1098/ +* Sub-technique: +** Name: Additional Cloud Credentials +** ID: T1098.001 +** Reference URL: https://attack.mitre.org/techniques/T1098/001/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-launch-item-registration-with-suspicious-executable-path-via-macos-security-events.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-launch-item-registration-with-suspicious-executable-path-via-macos-security-events.asciidoc new file mode 100644 index 0000000000..8b13cb03ae --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-launch-item-registration-with-suspicious-executable-path-via-macos-security-events.asciidoc @@ -0,0 +1,133 @@ +[[prebuilt-rule-8-19-35-launch-item-registration-with-suspicious-executable-path-via-macos-security-events]] +=== Launch Item Registration with Suspicious Executable Path via macOS Security Events + +Identifies the registration of a launch agent or launch daemon whose target executable resides in a temporary or user-writable location, using launch item registration messages collected by the macOS Security Events integration. An adversary may establish persistence with a launch agent or daemon that runs a program staged in a world-writable or temporary directory, which is uncommon for legitimate software. + +*Rule type*: esql + +*Rule indices*: None + +*Severity*: medium + +*Risk score*: 47 + +*Runs every*: 5m + +*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://www.welivesecurity.com/2022/07/19/i-see-what-you-did-there-look-cloudmensis-macos-spyware/ +* https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html + +*Tags*: + +* OS: macOS +* Use Case: Threat Detection +* Tactic: Persistence +* Data Source: macOS Security Events +* Resources: Investigation Guide +* Rule Type: ESQL +* Platform: macOS +* Domain: Endpoint + +*Version*: 1 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + +> **Disclaimer**: +> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs. + + +*Investigating Launch Item Registration with Suspicious Executable Path via macOS Security Events* + + +On macOS, launch agents and launch daemons run a program defined in their property list (plist). When a launch item is registered, the BackgroundTaskManagement subsystem logs the plist path and the target executable path to the unified log. Legitimate persistent software almost always runs an executable from a system or application directory. An executable staged in a temporary or world-writable directory (for example `/tmp`, `/private/tmp`, `/var/tmp`, `/Users/Shared`, or `/var/folders`) is a strong indicator of malicious persistence. This rule alerts on launch item registrations whose executable resides in such a location, and reports the plist path, item type, and executable. + + +*Possible investigation steps* + + +- Review `Esql.executable` and `Esql.plist_path` in the alert to identify the staged program and its launch item. +- Retrieve and analyze the executable. Determine whether it is signed, what it does, and how it arrived on the host. +- Determine how and when the plist and executable were created, and by which process, using Elastic Defend telemetry if available. +- Review other alerts and activity for the host and associated user during the same period. + + +*False positive analysis* + + +- Developer and build tooling occasionally runs helper executables from temporary or user directories. +- Verify the executable and its origin; exclude known-good paths or signing identities if the behavior is expected. + + +*Response and remediation* + + +- If the launch item is not legitimate, unload it with `launchctl bootout`, remove the plist, and remove or quarantine the executable. +- Investigate the host for the initial access vector and any activity performed by the program. +- Reset credentials for the affected user and review the host for additional compromise. +- Escalate to the security operations team if additional hosts show similar patterns. + + +==== Setup + + + +*Setup* + + +This rule requires data from the macOS Security Events integration. +Integration setup instructions: https://www.elastic.co/docs/reference/security/prebuilt-rules/integration/macos/macos_security_events[macOS Security Events] + + +==== Rule query + + +[source, js] +---------------------------------- +FROM logs-macos.process_execution_monitoring-* metadata _id, _version, _index +| WHERE data_stream.dataset == "macos.process_execution_monitoring" and + macos.event.message.description LIKE "*effectiveItemDisposition*" and + (macos.event.message.description LIKE "*url=file://*/Library/LaunchAgents/*" or + macos.event.message.description LIKE "*url=file://*/Library/LaunchDaemons/*") +| GROK macos.event.message.description "url=file://%{DATA:Esql.plist_path}, config" +| GROK macos.event.message.description "type=%{DATA:Esql.item_type}," +| GROK macos.event.message.description "BTMConfigExecutablePath = \"%{DATA:Esql.executable}\"" +| WHERE Esql.executable RLIKE "/(private/)?(tmp|var/tmp|var/folders)/.*|/Users/Shared/.*|/Users/[^/]+/(Downloads|Public|Library/Caches)/.*" +| KEEP _id, _version, _index, @timestamp, host.name, Esql.executable, Esql.plist_path, Esql.item_type, macos.event.message.description + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Persistence +** ID: TA0003 +** Reference URL: https://attack.mitre.org/tactics/TA0003/ +* Technique: +** Name: Create or Modify System Process +** ID: T1543 +** Reference URL: https://attack.mitre.org/techniques/T1543/ +* Sub-technique: +** Name: Launch Agent +** ID: T1543.001 +** Reference URL: https://attack.mitre.org/techniques/T1543/001/ +* Sub-technique: +** Name: Launch Daemon +** ID: T1543.004 +** Reference URL: https://attack.mitre.org/techniques/T1543/004/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-linux-user-account-creation.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-linux-user-account-creation.asciidoc new file mode 100644 index 0000000000..24cef3521b --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-linux-user-account-creation.asciidoc @@ -0,0 +1,164 @@ +[[prebuilt-rule-8-19-35-linux-user-account-creation]] +=== Linux User Account Creation + +Identifies attempts to create new users. Attackers may add new users to establish persistence on a system. + +*Rule type*: eql + +*Rule indices*: + +* filebeat-* +* logs-system.auth-* + +*Severity*: low + +*Risk score*: 21 + +*Runs every*: 5m + +*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://www.elastic.co/security-labs/primer-on-persistence-mechanisms + +*Tags*: + +* Domain: Endpoint +* OS: Linux +* Use Case: Threat Detection +* Tactic: Persistence +* Resources: Investigation Guide +* Noise: Medium +* Performance: Normal +* Rule Type: Event Correlation (EQL) +* Platform: Linux +* Resources: Osquery + +*Version*: 12 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + + +*Investigating Linux User Account Creation* + + +The `useradd` and `adduser` commands are used to create new user accounts in Linux-based operating systems. + +Attackers may create new accounts (both local and domain) to maintain access to victim systems. + +This rule identifies the usage of `useradd` and `adduser` to create new accounts. + +> **Note**: +> This investigation guide uses the https://www.elastic.co/guide/en/security/current/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide. +> This investigation guide uses https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run. + + +*Possible investigation steps* + + +- Investigate whether the user was created succesfully. + - !{osquery{"label":"Osquery - Retrieve Information for a Specific User","query":"SELECT * FROM users WHERE username = {{user.name}}"}} +- Investigate whether the user is currently logged in and active. + - !{osquery{"label":"Osquery - Investigate the Account Authentication Status","query":"SELECT * FROM logged_in_users WHERE user = {{user.name}}"}} +- Identify if the account was added to privileged groups or assigned special privileges after creation. + - !{osquery{"label":"Osquery - Retrieve Information for a Specific Group","query":"SELECT * FROM groups WHERE groupname = {{group.name}}"}} +- Identify the user account that performed the action and whether it should perform this kind of action. +- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence and whether they are located in expected locations. + - !{osquery{"label":"Osquery - Retrieve Running Processes by User","query":"SELECT pid, username, name FROM processes p JOIN users u ON u.uid = p.uid ORDER BY username"}} +- Investigate other alerts associated with the user/host during the past 48 hours. + + +*False positive analysis* + + +- Account creation is a common administrative task, so there is a high chance of the activity being legitimate. Before investigating further, verify that this activity is not benign. + + +*Response and remediation* + + +- Initiate the incident response process based on the outcome of the triage. +- Isolate the involved host to prevent further post-compromise behavior. +- If the triage identified malware, search the environment for additional compromised hosts. + - Implement temporary network rules, procedures, and segmentation to contain the malware. + - Stop suspicious processes. + - Immediately block the identified indicators of compromise (IoCs). + - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system. +- Review the privileges assigned to the involved users to ensure that the least privilege principle is being followed. +- Delete the created account. +- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services. +- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. +- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). + + +==== Setup + + + +*Setup* + + +This rule requires data coming in from Filebeat. + + +*Filebeat Setup* + +Filebeat is a lightweight shipper for forwarding and centralizing log data. Installed as an agent on your servers, Filebeat monitors the log files or locations that you specify, collects log events, and forwards them either to Elasticsearch or Logstash for indexing. + + +*The following steps should be executed in order to add the Filebeat on a Linux System:* + +- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. +- To install the APT and YUM repositories follow the setup instructions in this https://www.elastic.co/guide/en/beats/filebeat/current/setup-repositories.html[helper guide]. +- To run Filebeat on Docker follow the setup instructions in the https://www.elastic.co/guide/en/beats/filebeat/current/running-on-docker.html[helper guide]. +- To run Filebeat on Kubernetes follow the setup instructions in the https://www.elastic.co/guide/en/beats/filebeat/current/running-on-kubernetes.html[helper guide]. +- For quick start information for Filebeat refer to the https://www.elastic.co/guide/en/beats/filebeat/8.11/filebeat-installation-configuration.html[helper guide]. +- For complete "Setup and Run Filebeat" information refer to the https://www.elastic.co/guide/en/beats/filebeat/current/setting-up-and-running.html[helper guide]. + + +*Rule Specific Setup Note* + +- This rule requires the "Filebeat System Module" to be enabled. +- The system module collects and parses logs created by the system logging service of common Unix/Linux based distributions. +- To run the system module of Filebeat on Linux follow the setup instructions in the https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-system.html[helper guide]. + + +==== Rule query + + +[source, js] +---------------------------------- +iam where host.os.type == "linux" and event.type == "user" and event.type == "creation" and event.outcome == "success" +and user.name != null + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Persistence +** ID: TA0003 +** Reference URL: https://attack.mitre.org/tactics/TA0003/ +* Technique: +** Name: Create Account +** ID: T1136 +** Reference URL: https://attack.mitre.org/techniques/T1136/ +* Sub-technique: +** Name: Local Account +** ID: T1136.001 +** Reference URL: https://attack.mitre.org/techniques/T1136/001/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-lsass-process-access-via-windows-api.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-lsass-process-access-via-windows-api.asciidoc new file mode 100644 index 0000000000..627f8a544f --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-lsass-process-access-via-windows-api.asciidoc @@ -0,0 +1,214 @@ +[[prebuilt-rule-8-19-35-lsass-process-access-via-windows-api]] +=== LSASS Process Access via Windows API + +Identifies access attempts to the LSASS handle, which may indicate an attempt to dump credentials from LSASS memory. + +*Rule type*: esql + +*Rule indices*: None + +*Severity*: medium + +*Risk score*: 47 + +*Runs every*: 15m + +*Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md + +*Tags*: + +* Domain: Endpoint +* OS: Windows +* Use Case: Threat Detection +* Tactic: Credential Access +* Tactic: Execution +* Data Source: Elastic Defend +* Data Source: Microsoft Defender XDR +* Resources: Investigation Guide +* Noise: Medium +* Performance: Normal +* Rule Type: ES|QL +* Platform: Windows +* Resources: Osquery + +*Version*: 21 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + + +*Investigating LSASS Process Access via Windows API* + + +The Local Security Authority Subsystem Service (LSASS) is a critical Windows component responsible for managing user authentication and security policies. Adversaries may attempt to access the LSASS handle to dump credentials from its memory, which can be used for lateral movement and privilege escalation. + +This rule identifies attempts to access LSASS by monitoring for specific API calls (OpenProcess, OpenThread) targeting the "lsass.exe" process. + +> **Note**: +> This investigation guide uses the https://www.elastic.co/guide/en/security/current/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide. + + +*Possible investigation steps* + + +- Investigate other alerts associated with the user/host during the past 48 hours. +- Investigate the process execution chain (parent process tree) of the process that accessed the LSASS handle. + - Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures. + - Determine the first time the process executable was seen in the environment and if this behavior happened in the past. + - Validate the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations. + - Investigate any abnormal behavior by the subject process, such as network connections, DLLs loaded, registry or file modifications, and any spawned child processes. +- Assess the access rights (`process.Ext.api.parameters.desired_access`field) requested by the process. This https://learn.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights[Microsoft documentation] may be useful to help the interpretation. +- If there are traces of LSASS memory being successfully dumped, investigate potentially compromised accounts. Analysts can do this by searching for login events (e.g., 4624) to the target host. +- Examine the host for derived artifacts that indicate suspicious activities: + - Analyze the executables of the processes using a private sandboxed analysis system. + - Observe and collect information about the following activities in both the sandbox and the alert subject host: + - Attempts to contact external domains and addresses. + - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process's `process.entity_id`. + - Examine the DNS cache for suspicious or anomalous entries. + - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}} + - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree. + - Examine the host services for suspicious or anomalous entries. + - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}} + - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}} + - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}} + - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc. + + + +*False positive analysis* + + +- If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination of `process.executable`, `process.code_signature.subject_name` and `process.Ext.api.parameters.desired_access_numeric` conditions. + + +*Related Rules* + + +- Suspicious Lsass Process Access - 128468bf-cab1-4637-99ea-fdf3780a4609 +- Potential Credential Access via DuplicateHandle in LSASS - 02a4576a-7480-4284-9327-548a806b5e48 +- LSASS Memory Dump Handle Access - 208dbe77-01ed-4954-8d44-1e5751cb20de + + +*Response and Remediation* + + +- Initiate the incident response process based on the outcome of the triage. + - If malicious activity is confirmed, perform a broader investigation to identify the scope of the compromise and determine the appropriate remediation steps. +- Isolate the involved host to prevent further post-compromise behavior. +- If the triage identified malware, search the environment for additional compromised hosts. + - Implement temporary network rules, procedures, and segmentation to contain the malware. + - Stop suspicious processes. + - Immediately block the identified indicators of compromise (IoCs). + - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system. +- Remove and block malicious artifacts identified during triage. +- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services. +- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components. +- Reimage the host operating system or restore the compromised files to clean versions. +- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. +- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). + + +==== Setup + + + +*Setup* + + +This rule is designed for data generated by https://www.elastic.co/security/endpoint-security[Elastic Defend], which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules. + +Setup instructions: https://ela.st/install-elastic-defend + + +*Additional data sources* + + +This rule also supports the following third-party data sources. For setup instructions, refer to the links below: + +- https://ela.st/m365-defender[Microsoft Defender XDR] + + +==== Rule query + + +[source, js] +---------------------------------- +from logs-endpoint.events.api-*, logs-m365_defender.event-* metadata _id, _version, _index + +| where mv_contains(event.category, "api") and host.os.type == "windows" and + process.Ext.api.name in ("OpenProcess", "OpenThread", "ReadProcessMemory") and + Target.process.name == "lsass.exe" and process.executable is not null and + + // Noisy patterns + not to_lower(process.executable) like """c:\\program files\\*.exe""" and + not to_lower(process.executable) like """c:\\program files (x86)\\*.exe""" and + not to_lower(process.executable) like """c:\\programdata\\microsoft\\windows defender\\platform\\msmpeng.exe""" and + not to_lower(process.executable) like """c:\\programdata\\microsoft\\windows defender\\platform\\*\\msmpeng.exe""" + + /* normalize process paths to reduce known random patterns in process.executable */ +| eval Esql.process_path = replace(process.executable, """([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}|ns[a-z][A-Z0-9]{3,4}\.tmp|DX[A-Z0-9]{3,4}\.tmp|7z[A-Z0-9]{3,5}\.tmp|[0-9\.\-\_]{3,})""", "") + +// Group by process path +| stats Esql.access_count = count(*), + Esql.count_distinct_hosts = count_distinct(host.id), + Esql.host_id_values = VALUES(host.id), + Esql.host_name_values = VALUES(host.name), + Esql.user_name_values = VALUES(user.name), + Esql.process_pid_values = VALUES(process.entity_id), + Esql.process_executable_values = VALUES(process.executable), + Esql.data_stream_namespace.values = VALUES(data_stream.namespace), + Esql.user_name_values = VALUES(user.name) by Esql.process_path + +// Limit to rare instances limited to 1 unique host +| where Esql.count_distinct_hosts == 1 and Esql.access_count <= 3 + +// Extract the single host ID and process into their corresponding ECS fields for alerts exclusion +| eval host.id = mv_min(Esql.host_id_values), + host.name = mv_min(Esql.host_name_values), + process.executable = mv_min(Esql.process_executable_values), + user.name = mv_min(Esql.user_name_values) + +// Add the new field to the keep statement +| keep Esql.*, host.id, host.name, user.name, process.executable + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Credential Access +** ID: TA0006 +** Reference URL: https://attack.mitre.org/tactics/TA0006/ +* Technique: +** Name: OS Credential Dumping +** ID: T1003 +** Reference URL: https://attack.mitre.org/techniques/T1003/ +* Sub-technique: +** Name: LSASS Memory +** ID: T1003.001 +** Reference URL: https://attack.mitre.org/techniques/T1003/001/ +* Tactic: +** Name: Execution +** ID: TA0002 +** Reference URL: https://attack.mitre.org/tactics/TA0002/ +* Technique: +** Name: Native API +** ID: T1106 +** Reference URL: https://attack.mitre.org/techniques/T1106/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-mark-of-the-web-removal-by-an-unusual-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-mark-of-the-web-removal-by-an-unusual-process.asciidoc new file mode 100644 index 0000000000..e521169d4a --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-mark-of-the-web-removal-by-an-unusual-process.asciidoc @@ -0,0 +1,179 @@ +[[prebuilt-rule-8-19-35-mark-of-the-web-removal-by-an-unusual-process]] +=== Mark-of-the-Web Removal by an Unusual Process + +Identifies an unusual process deleting the Zone.Identifier alternate data stream from an executable or Windows Installer package. Attackers can remove this stream to bypass Mark-of-the-Web protections. + +*Rule type*: eql + +*Rule indices*: + +* logs-endpoint.events.file-* + +*Severity*: low + +*Risk score*: 21 + +*Runs every*: 5m + +*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://www.forcepoint.com/blog/x-labs/screenconnect-attack +* https://www.sonicwall.com/blog/living-off-legit-tools-stealthy-installation-of-remote-monitoring-agents-using-smartscreen-bypass +* https://any.run/cybersecurity-blog/rmm-blind-spot-for-cisos/ +* https://www.cyfirma.com/research/apt36-multi-vector-execution-malware-campaign-targeting-indian-government-entities/ + +*Tags*: + +* Domain: Endpoint +* OS: Windows +* Use Case: Threat Detection +* Tactic: Defense Evasion +* Resources: Investigation Guide +* Data Source: Elastic Defend +* Noise: High +* Performance: Normal +* Profile: Aggressive +* Rule Type: Event Correlation (EQL) +* Platform: Windows + +*Version*: 3 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + + +*Investigating Mark-of-the-Web Removal by an Unusual Process* + + + +*Possible investigation steps* + + +- Which process and account removed Mark-of-the-Web from which artifact? + - Focus: Review `file.path`, `process.executable`, `process.name`, `user.name`, and `host.name`. + - Implication: The alert establishes an attributed ADS deletion, not execution or intent. Treat a download, security, or deployment workflow as a benign candidate only when the exact remover, account, artifact, and an independent workflow record align. + +- Does the deleting-process context fit an expected unblocking workflow? + - Focus: From related process events, review `process.command_line`, `process.parent.executable`, `process.code_signature.subject_name`, and `process.code_signature.trusted`. + - Hint: When `process.entity_id` is populated, review events for the same process entity on the alert host !{investigate{"description":"","label":"Events for the deleting process on this host","providers":[[{"excluded":false,"field":"host.id","queryType":"phrase","value":"{{host.id}}","valueType":"string"},{"excluded":false,"field":"process.entity_id","queryType":"phrase","value":"{{process.entity_id}}","valueType":"string"}]],"relativeFrom":"now-24h","relativeTo":"now"}} + - Implication: PowerShell unblocking or deployment activity needs an expected parent, operator or task, command, and target artifact; a trusted signer alone is insufficient. If `process.entity_id` is absent, use `host.id`, `process.pid`, and a tight alert-time window; missing related process telemetry remains unresolved. + +- What provenance does the base executable or MSI have? + - Focus: Strip the terminal `:Zone.Identifier` or `:Zone.Identifier:$DATA` suffix, then search same-host file events for the base path and inspect `file.Ext.original.path`, `file.origin_url`, `file.origin_referrer_url`, `file.Ext.windows.zone_identifier`, and `file.hash.sha256` when populated. + - Hint: Start with the 24 hours before the deletion and widen to available retention when necessary. + - Implication: Missing download or file-origin telemetry is unresolved. Consistent source, hash, target directory, and a matching download or deployment record support the claimed workflow. + +- Was the base artifact executed or used in an installation attempt after deletion? + - Focus: For an EXE, match the base path to `process.executable`; for an MSI, find `msiexec.exe` with the exact base path in `process.args`. + - Hint: Search the same host for five minutes after the deletion, then widen when evidence warrants; review lineage and follow-on file or process activity. + - Implication: A match establishes observed execution or an installation attempt, not maliciousness or installation success. Inconsistent provenance, lineage, or follow-on behavior supports escalation; no match only limits observed impact. + +- Is the removal isolated or repeated on the host? + - Focus: Review deletions for the same ADS path !{investigate{"description":"","label":"File deletions for the same ADS path","providers":[[{"excluded":false,"field":"host.id","queryType":"phrase","value":"{{host.id}}","valueType":"string"},{"excluded":false,"field":"event.category","queryType":"phrase","value":"file","valueType":"string"},{"excluded":false,"field":"file.path","queryType":"phrase","value":"{{file.path}}","valueType":"string"},{"excluded":false,"field":"event.type","queryType":"phrase","value":"deletion","valueType":"string"}]],"relativeFrom":"now-24h","relativeTo":"now"}} + - Hint: When `user.id` is populated, review file deletions by the same user and process name, then retain only EXE or MSI `Zone.Identifier` paths !{investigate{"description":"","label":"File deletions by the same user and process name","providers":[[{"excluded":false,"field":"host.id","queryType":"phrase","value":"{{host.id}}","valueType":"string"},{"excluded":false,"field":"event.category","queryType":"phrase","value":"file","valueType":"string"},{"excluded":false,"field":"user.id","queryType":"phrase","value":"{{user.id}}","valueType":"string"},{"excluded":false,"field":"process.name","queryType":"phrase","value":"{{process.name}}","valueType":"string"},{"excluded":false,"field":"event.type","queryType":"phrase","value":"deletion","valueType":"string"}]],"relativeFrom":"now-24h","relativeTo":"now"}} + - Implication: If `user.id` is absent, use the exact-path results and a manual same-host search around the alert time. The broader transform returns all file deletions, not only MOTW removal; multiple unrelated matching artifacts support escalation, while a stable release set with the same expected workflow can support benign disposition. + +- Escalate when remover context, provenance, follow-on behavior, or repeated unrelated targets conflict with an expected workflow. Close only when alert telemetry and an independent download, deployment, or security-tool record align for the exact actor and artifact. Preserve evidence and escalate mixed or incomplete cases. + + +*False positive analysis* + + +- Browser, download-handler, security-product, administrative, and deployment workflows can remove Mark-of-the-Web legitimately. Confirm that the process identity and lineage, account and host, exact artifact, provenance, and an independent product or deployment record describe the same workflow before closing the alert. +- Add an exception only after recurring benign examples establish stable fields. Constrain it to alert fields such as the exact remover executable and signer, target path or package family, and expected account or host class; do not exclude PowerShell or all trusted processes globally. + + +*Response and remediation* + + +- For unresolved activity, preserve the alert and source events, then recover the deleting-process and artifact context. Do not isolate a host solely on this low-severity signal. +- If malicious activity or suspicious follow-on behavior is confirmed, contain affected hosts or accounts with reversible controls. Preserve volatile evidence when active or memory-resident behavior warrants it, then terminate malicious processes and quarantine artifacts or persistence after evidence review. +- For confirmed benign activity, close the alert and consider a narrow exception only after recurring examples establish stable fields. Document affected paths, scope, observed workflow evidence, and telemetry gaps. + + +==== Setup + + + +*Setup* + + +This rule is designed for data generated by https://www.elastic.co/security/endpoint-security[Elastic Defend], which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules. + +Setup instructions: https://ela.st/install-elastic-defend + + +==== Rule query + + +[source, js] +---------------------------------- +file where host.os.type == "windows" and event.type == "deletion" and + file.path : ( + "*.exe:Zone.Identifier", + "*.exe:Zone.Identifier:$DATA", + "*.msi:Zone.Identifier", + "*.msi:Zone.Identifier:$DATA" + ) and + + /* Explorer may remove MOTW after SmartScreen */ + not ( + process.executable : "?:\\Windows\\explorer.exe" and + process.code_signature.trusted == true and + process.code_signature.subject_name : "Microsoft Windows" + ) and + + /* Browsers may delete Zone.Identifier during download handling */ + not ( + process.code_signature.trusted == true and + ( + ( + process.name : "chrome.exe" and + process.code_signature.subject_name : "Google LLC" + ) or + ( + process.name : "msedge.exe" and + process.code_signature.subject_name : "Microsoft Corporation" + ) or + ( + process.name : "firefox.exe" and + process.code_signature.subject_name : "Mozilla Corporation" + ) or + ( + process.name : "brave.exe" and + process.code_signature.subject_name : "Brave Software, Inc." + ) + ) + ) + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Defense Evasion +** ID: TA0005 +** Reference URL: https://attack.mitre.org/tactics/TA0005/ +* Technique: +** Name: Subvert Trust Controls +** ID: T1553 +** Reference URL: https://attack.mitre.org/techniques/T1553/ +* Sub-technique: +** Name: Mark-of-the-Web Bypass +** ID: T1553.005 +** Reference URL: https://attack.mitre.org/techniques/T1553/005/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-microsoft-defender-xdr-incident-external-alerts.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-microsoft-defender-xdr-incident-external-alerts.asciidoc new file mode 100644 index 0000000000..2ec01cc347 --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-microsoft-defender-xdr-incident-external-alerts.asciidoc @@ -0,0 +1,136 @@ +[[prebuilt-rule-8-19-35-microsoft-defender-xdr-incident-external-alerts]] +=== Microsoft Defender XDR Incident External Alerts + +Generates a detection alert for each Microsoft Defender XDR incident written to the configured indices. Microsoft Defender emits multiple update events for the same incident as its member alerts and status evolve, all sharing a stable incident identifier. This rule suppresses those update events so that a single, continuous Elastic alert is maintained per Defender incident rather than a new alert per update. Enabling this rule allows you to immediately begin investigating Microsoft Defender XDR incidents in the app. + +*Rule type*: query + +*Rule indices*: + +* logs-m365_defender.incident-* + +*Severity*: medium + +*Risk score*: 47 + +*Runs every*: 1m + +*Searches indices from*: now-2m ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 1000 + +*References*: + +* https://docs.elastic.co/en/integrations/m365_defender + +*Tags*: + +* Data Source: Microsoft Defender XDR +* Use Case: Threat Detection +* Resources: Investigation Guide +* Promotion: External Alerts +* Rule Type: Custom Query (KQL) +* Rule Type: Higher-Order +* Domain: Endpoint +* Platform: Windows + +*Version*: 3 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + + +*Investigating Microsoft Defender XDR Incident External Alerts* + + +Microsoft Defender XDR correlates related alerts across endpoints, identities, email, and applications into a single incident, providing the full attack story in one place. The incident data stream (`logs-m365_defender.incident-*`) carries these pre-correlated incidents. This rule promotes each Defender incident into an Elastic detection alert so analysts can investigate the correlated story without leaving the app. + +Microsoft Defender emits several update events for the same incident as member alerts are added and status, classification, and evidence evolve. Every update shares the same stable Defender incident identifier (`m365_defender.incident.id`, which the integration also copies into `event.id`). The rule groups on that identifier so subsequent updates accumulate into the existing Elastic alert rather than creating duplicates. + +The member alerts that make up an incident may also arrive through the Microsoft 365 Unified Audit Log (`logs-o365.audit-*`) rather than the native integration data stream. In that case the M365 Defender Alerts Signal (UAL) building block rule (rule_id: 054853f3-2ce0-41f3-a6eb-4a4867f39cdc) generates correlation signals from that source and can be used alongside this promotion rule. + + +*Possible investigation steps* + + +- Review `m365_defender.incident.display_name`, `m365_defender.incident.severity`, and `m365_defender.incident.tags` to understand the scope and priority of the incident. +- Pivot to the Defender portal using `m365_defender.incident.web_url.original` for the correlated attack story, evidence graph, and recommended actions. +- Examine the member alert fields under `m365_defender.incident.alert.*` (titles, MITRE techniques, detection sources, evidence) to scope the impacted entities and behaviors. +- Review `m365_defender.incident.status`, `m365_defender.incident.classification`, and `m365_defender.incident.determination` to see whether Defender has already resolved or classified the incident. +- Check `m365_defender.incident.redirect_incident_id` to confirm the incident has not been merged into another incident. + + +*False positive analysis* + + +- Defender incidents are pre-correlated and tuned by Microsoft, so true false positives are uncommon. When they occur, confirm with the responsible team before excluding. +- Incidents driven entirely by known and trusted administrative tools, security assessments, or scheduled automation may be benign. Validate intent before adding an exception. +- Use `m365_defender.incident.classification` and `m365_defender.incident.determination` to filter out activity Defender itself has marked as a false positive. + + +*Response and remediation* + + +- Isolate affected endpoints or disable affected accounts if malicious behavior is confirmed across the incident's member alerts. +- Use the Defender portal to action native response options (quarantine, automated investigation, account remediation) for the incident. +- Investigate how the threat entered the environment and close any exploited gaps. +- Reset credentials for compromised accounts or escalate to incident response. +- Document the findings and tune the upstream Defender policy or add an Elastic exception as appropriate. + + +==== Setup + + + +*Setup* + + + +*Microsoft Defender XDR Incident Integration* + +This rule is designed to capture incident events generated by the Microsoft Defender XDR integration and promote them as Elastic detection alerts. + +To capture Microsoft Defender XDR incidents, install and configure the Microsoft Defender XDR integration to ingest incident events into the `logs-m365_defender.incident-*` index pattern. + + +*Alert suppression and the Defender update lifecycle* + + +Microsoft Defender writes multiple update events per incident during its lifecycle, all sharing the same stable identifier (`m365_defender.incident.id`, copied to `event.id`). This rule suppresses on that identifier so updates accumulate into one Elastic alert. Note the following alert suppression semantics: + +- Suppression applies going forward from when the suppressing alert is created; it does not retroactively merge alerts created before the rule was enabled. +- Updates are aggregated into the existing alert only while that alert is open and within the suppression window. If an analyst closes the suppressing alert, a later Defender update will open a new Elastic alert. +- The suppression window (default 1 day) is tunable. Size it to your environment's typical Defender incident lifecycle; extending it keeps a single alert open longer but delays new-alert creation for late updates. + + +*Avoiding duplicate alerts* + + +To avoid double-counting, enable either this incident-level rule or the Microsoft Defender XDR Alert External Alerts rule (alert-level), not both: a Defender incident's child alerts appear in both data streams. Incident-level (this rule) produces the least noise (one Elastic alert per Defender incident) and is the recommended default; alert-level provides finer-grained, per-alert triage. + + +*Additional notes* + + +For information on troubleshooting the maximum alerts warning please refer to this https://www.elastic.co/guide/en/security/current/alerts-ui-monitor.html#troubleshoot-max-alerts[guide]. + + +==== Rule query + + +[source, js] +---------------------------------- +event.kind: alert and data_stream.dataset: m365_defender.incident + +---------------------------------- diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-newly-observed-elastic-defend-behavior-alert.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-newly-observed-elastic-defend-behavior-alert.asciidoc new file mode 100644 index 0000000000..d0c6042b59 --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-newly-observed-elastic-defend-behavior-alert.asciidoc @@ -0,0 +1,128 @@ +[[prebuilt-rule-8-19-35-newly-observed-elastic-defend-behavior-alert]] +=== Newly Observed Elastic Defend Behavior Alert + +This rule detects Elastic Defend behavior alerts that are observed for the first time today when compared against the previous 5 days of alert history. It highlights low-volume, newly observed alerts tied to a specific detection rule, analysts can use this to prioritize triage and response. + +*Rule type*: esql + +*Rule indices*: None + +*Severity*: high + +*Risk score*: 73 + +*Runs every*: 5m + +*Searches indices from*: now-7205m ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://github.com/elastic/protections-artifacts/tree/main/behavior + +*Tags*: + +* Use Case: Threat Detection +* Rule Type: Higher-Order Rule +* Resources: Investigation Guide +* Data Source: Elastic Defend +* Noise: Medium +* Performance: Normal +* Rule Type: ES|QL +* Domain: Endpoint + +*Version*: 5 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + +> **Disclaimer**: +> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs. + + +*Investigating Newly Observed Elastic Defend Behavior Alert* + + +Elastic Defend behavior alerts indicate suspicious activity observed on an endpoint that may not yet be widespread or repeated. +This rule surfaces newly observed, low-frequency behavior alerts affecting a single agent within the current day, which can +represent early-stage malware execution, initial persistence attempts, or hands-on-keyboard activity. + +Because the alert has not been seen previously for this rule and host, it should be prioritized for validation to determine +whether it represents a true compromise or rare benign activity. + + +*Investigation Steps* + + +- Identify the affected host and review the associated Elastic Defend rule name to understand the behavior that triggered the alert. +- Review the process details, including executable path, parent process, command line, and SHA-256 hash. +- Determine whether the process is expected on the host by validating its origin, signer, and execution context. +- Examine the alert timeline to confirm that all activity occurred within a short time window and assess whether behavior escalated. +- Correlate with additional endpoint telemetry such as: + - Process creation and termination + - File modifications + - Network connections + - Registry or persistence-related activity +- Check whether the process hash, command line, or related indicators are known malicious or associated with recent campaigns. +- Validate the user context under which the activity occurred and assess whether it aligns with normal behavior for that account. + + +*False Positive Considerations* + + +- Newly deployed or updated software may introduce behavior not previously observed on the host. +- Administrative scripts or automation tools can trigger behavior-based detections when first introduced. +- Security tooling, IT management agents, or EDR integrations may generate new behavior alerts during updates or configuration changes. +- Development or testing environments may produce one-off behaviors that resemble malicious techniques. + + +*Response and Remediation* + + +- If the activity is confirmed malicious, isolate the affected host to prevent further execution or lateral movement. +- Terminate malicious processes and remove any dropped files or persistence mechanisms. +- Collect forensic artifacts to understand initial access and execution flow. +- Patch or remediate any vulnerabilities or misconfigurations that enabled the behavior. +- If benign, document the finding and consider tuning or exception handling to reduce future noise. +- Continue monitoring the host and environment for recurrence of the behavior or related alerts. + +==== Rule query + + +[source, js] +---------------------------------- +from logs-endpoint.alerts-* +| WHERE event.code == "behavior" and rule.name is not null +| STATS Esql.alerts_count = count(*), + Esql.first_time_seen = MIN(@timestamp), + Esql.last_time_seen = MAX(@timestamp), + Esql.agents_distinct_count = COUNT_DISTINCT(agent.id), + Esql.process_executable = VALUES(process.executable), + Esql.process_parent_executable = VALUES(process.parent.executable), + Esql.process_command_line = VALUES(process.command_line), + Esql.process_hash_sha256 = VALUES(process.hash.sha256), + Esql.host_id_values = VALUES(host.id), + Esql.user_name = VALUES(user.name) by rule.name +// first time seen in the last 5 days - defined in the rule schedule Additional look-back time +| eval Esql.recent = DATE_DIFF("minute", Esql.first_time_seen, now()) +// first time seen is within 10m of the rule execution time +| where Esql.recent <= 10 and Esql.agents_distinct_count == 1 and Esql.alerts_count <= 10 + +// Move single values to their corresponding ECS fields for alerts exclusion +| eval host.id = mv_min(Esql.host_id_values) + +| keep host.id, rule.name, Esql.* + +---------------------------------- diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-newly-observed-high-severity-detection-alert.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-newly-observed-high-severity-detection-alert.asciidoc new file mode 100644 index 0000000000..a55135660f --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-newly-observed-high-severity-detection-alert.asciidoc @@ -0,0 +1,125 @@ +[[prebuilt-rule-8-19-35-newly-observed-high-severity-detection-alert]] +=== Newly Observed High Severity Detection Alert + +This rule detects Elastic SIEM high severity detection alerts that are observed for the first time in the previous 5 days of alert history. It highlights low-volume, newly observed alerts tied to a specific detection rule, analysts can use this to prioritize triage and response. + +*Rule type*: esql + +*Rule indices*: None + +*Severity*: high + +*Risk score*: 73 + +*Runs every*: 5m + +*Searches indices from*: now-7205m ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://www.elastic.co/docs/solutions/security/detect-and-alert/about-detection-rules + +*Tags*: + +* Use Case: Threat Detection +* Rule Type: Higher-Order Rule +* Resources: Investigation Guide +* Noise: Low +* Performance: Normal +* Rule Type: ES|QL +* Domain: Endpoint + +*Version*: 8 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + + +*Investigating Newly Observed High Severity Detection Alert* + + +This rule surfaces newly observed, low-frequency behavior high severity alerts affecting a single agent within the current day. + +Because the alert has not been seen previously for this rule and host, it should be prioritized for validation to determine +whether it represents a true compromise or rare benign activity. + + +*Investigation Steps* + + +- Identify the affected host, user and review the associated rule name to understand the behavior that triggered the alert. +- Validate the user context under which the activity occurred and assess whether it aligns with normal behavior for that account. +- Refer to the specific rule investiguation guide for further actions. + + +*False Positive Considerations* + + +- Newly deployed or updated software may introduce behavior not previously observed on the host. +- Administrative scripts or automation tools can trigger behavior-based detections when first introduced. +- Security tooling, IT management agents, or EDR integrations may generate new behavior alerts during updates or configuration changes. +- Development or testing environments may produce one-off behaviors that resemble malicious techniques. + + +*Response and Remediation* + + +- If the activity is confirmed malicious, isolate the affected host to prevent further execution or lateral movement. +- Terminate malicious processes and remove any dropped files or persistence mechanisms. +- Collect forensic artifacts to understand initial access and execution flow. +- Patch or remediate any vulnerabilities or misconfigurations that enabled the behavior. +- If benign, document the finding and consider tuning or exception handling to reduce future noise. +- Continue monitoring the host and environment for recurrence of the behavior or related alerts. + +==== Rule query + + +[source, js] +---------------------------------- +FROM .alerts-security.* +| where kibana.alert.rule.name is not null and kibana.alert.risk_score >= 73 and + not kibana.alert.rule.type in ("threat_match", "machine_learning", "new_terms") and + not kibana.alert.rule.name like "Deprecated - *" and kibana.alert.rule.name != "My First Rule" and + // covered by 7306ce7d-5c90-4f42-aa6c-12b0dc2fe3b8 + event.dataset != "endpoint.alerts" and + not KQL("""kibana.alert.rule.tags : "Rule Type: Higher-Order Rule" """) +| STATS Esql.alerts_count = count(*), + Esql.first_time_seen = MIN(@timestamp), + Esql.last_time_seen = MAX(@timestamp), + Esql.process_executable = VALUES(process.executable), + Esql.process_command_line_values = VALUES(process.command_line), + Esql.process_parent_executable_values = VALUES(process.parent.executable), + Esql.file_path_values = VALUES(file.path), + Esql.dll_path_values = VALUES(dll.path), + Esql.user_id_values = VALUES(user.id), + Esql.user_name_values = VALUES(user.name), + Esql.agent_id_values = VALUES(agent.id), + Esql.host_id_values = VALUES(host.id), + Esql.event_module_values = VALUES(event.module), + Esql.source_ip_values = VALUES(source.ip), + Esql.kibana_alert_rule_name_values = VALUES(kibana.alert.rule.name), + Esql.agent_id_distinct_count = COUNT_DISTINCT(agent.id) by kibana.alert.rule.name +// fist time seen in the last 5 days - defined in the rule schedule Additional look-back time +| eval Esql.recent = DATE_DIFF("minute", Esql.first_time_seen, now()) +// first time seen is within 10m of the rule execution time +| where Esql.recent <= 10 and Esql.agent_id_distinct_count == 1 and Esql.alerts_count <= 10 + +// Move single values to their corresponding ECS fields for alerts exclusion +| eval host.id = mv_min(Esql.host_id_values) + +| keep host.id, kibana.alert.rule.name, Esql.* + +---------------------------------- diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-node-js-pre-or-post-install-script-execution.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-node-js-pre-or-post-install-script-execution.asciidoc new file mode 100644 index 0000000000..e2ef45a7e7 --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-node-js-pre-or-post-install-script-execution.asciidoc @@ -0,0 +1,162 @@ +[[prebuilt-rule-8-19-35-node-js-pre-or-post-install-script-execution]] +=== Node.js Pre or Post-Install Script Execution + +This rule detects the execution of Node.js pre or post-install scripts. These scripts are executed by the Node.js package manager (npm) during the installation of packages. Adversaries may abuse this technique to execute arbitrary commands on the system and establish persistence. This activity was observed in the wild as part of the Shai-Hulud worm. + +*Rule type*: eql + +*Rule indices*: + +* logs-endpoint.events.process* +* logs-crowdstrike.fdr* +* logs-sentinel_one_cloud_funnel.* + +*Severity*: medium + +*Risk score*: 47 + +*Runs every*: 5m + +*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://www.elastic.co/blog/shai-hulud-worm-npm-supply-chain-compromise +* https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack +* https://www.elastic.co/blog/shai-hulud-worm-2-0-updated-response + +*Tags*: + +* Domain: Endpoint +* OS: Linux +* OS: macOS +* Use Case: Threat Detection +* Tactic: Persistence +* Tactic: Execution +* Tactic: Defense Evasion +* Data Source: Elastic Defend +* Resources: Investigation Guide +* Data Source: Crowdstrike +* Data Source: SentinelOne +* Noise: Medium +* Performance: Normal +* Profile: Recommended +* Threat: Supply Chain +* Threat: Script-Based Execution +* Rule Type: Event Correlation (EQL) +* Platform: Linux +* Platform: macOS + +*Version*: 6 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Setup + + + +*Setup* + + +This rule requires data coming in from Elastic Defend. + + +*Elastic Defend Integration Setup* + +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + + +*Prerequisite Requirements:* + +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation]. + + +*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:* + +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide]. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide]. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide]. + + +==== Rule query + + +[source, js] +---------------------------------- +sequence by host.id with maxspan=10s + [process where host.os.type in ("linux", "macos") and event.type == "start" and event.action in ("exec", "ProcessRollup2", "start") and process.name == "node" and process.args in ("install", "ci", "i", "install-ci-test", "cit")] by process.entity_id + [process where host.os.type in ("linux", "macos") and event.type == "start" and event.action in ("exec", "ProcessRollup2", "start") and process.parent.name == "node"] by process.parent.entity_id + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Execution +** ID: TA0002 +** Reference URL: https://attack.mitre.org/tactics/TA0002/ +* Technique: +** Name: Command and Scripting Interpreter +** ID: T1059 +** Reference URL: https://attack.mitre.org/techniques/T1059/ +* Sub-technique: +** Name: Unix Shell +** ID: T1059.004 +** Reference URL: https://attack.mitre.org/techniques/T1059/004/ +* Sub-technique: +** Name: JavaScript +** ID: T1059.007 +** Reference URL: https://attack.mitre.org/techniques/T1059/007/ +* Technique: +** Name: User Execution +** ID: T1204 +** Reference URL: https://attack.mitre.org/techniques/T1204/ +* Sub-technique: +** Name: Malicious Library +** ID: T1204.005 +** Reference URL: https://attack.mitre.org/techniques/T1204/005/ +* Tactic: +** Name: Persistence +** ID: TA0003 +** Reference URL: https://attack.mitre.org/tactics/TA0003/ +* Technique: +** Name: Create or Modify System Process +** ID: T1543 +** Reference URL: https://attack.mitre.org/techniques/T1543/ +* Technique: +** Name: Hijack Execution Flow +** ID: T1574 +** Reference URL: https://attack.mitre.org/techniques/T1574/ +* Tactic: +** Name: Defense Evasion +** ID: TA0005 +** Reference URL: https://attack.mitre.org/tactics/TA0005/ +* Tactic: +** Name: Initial Access +** ID: TA0001 +** Reference URL: https://attack.mitre.org/tactics/TA0001/ +* Technique: +** Name: Supply Chain Compromise +** ID: T1195 +** Reference URL: https://attack.mitre.org/techniques/T1195/ +* Sub-technique: +** Name: Compromise Software Dependencies and Development Tools +** ID: T1195.001 +** Reference URL: https://attack.mitre.org/techniques/T1195/001/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-persistence-via-a-hidden-plist-filename-via-macos-security-events.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-persistence-via-a-hidden-plist-filename-via-macos-security-events.asciidoc new file mode 100644 index 0000000000..d084700cc4 --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-persistence-via-a-hidden-plist-filename-via-macos-security-events.asciidoc @@ -0,0 +1,155 @@ +[[prebuilt-rule-8-19-35-persistence-via-a-hidden-plist-filename-via-macos-security-events]] +=== Persistence via a Hidden Plist Filename via macOS Security Events + +Identifies the registration of a launch agent or launch daemon whose property list (plist) filename begins with a dot, using launch item registration messages collected by the macOS Security Events integration. An adversary may establish persistence by installing a launch agent or daemon that executes at login or boot; plist files with filenames starting with a dot are hidden from default directory listings and are particularly suspicious. + +*Rule type*: esql + +*Rule indices*: None + +*Severity*: medium + +*Risk score*: 47 + +*Runs every*: 5m + +*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://www.welivesecurity.com/2022/07/19/i-see-what-you-did-there-look-cloudmensis-macos-spyware/ +* https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html + +*Tags*: + +* OS: macOS +* Use Case: Threat Detection +* Tactic: Persistence +* Tactic: Defense Evasion +* Data Source: macOS Security Events +* Resources: Investigation Guide +* Rule Type: ESQL +* Platform: macOS +* Domain: Endpoint + +*Version*: 1 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + +> **Disclaimer**: +> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs. + + +*Investigating Persistence via a Hidden Plist Filename via macOS Security Events* + + +On macOS, launch agents and launch daemons provide persistence by running a program defined in a property list (plist) file located in a LaunchAgents or LaunchDaemons directory. When a launch item is registered, the BackgroundTaskManagement subsystem logs its path, type, and target executable to the unified log. Adversaries name the plist with a leading dot (for example `.com.evil.agent.plist`) so it is hidden from default directory listings while still functioning as persistence. This rule alerts when a registered launch item's plist filename begins with a dot, and reports the plist path, item type, and target executable extracted from the message. + + +*Possible investigation steps* + + +- Review `Esql.plist_path`, `Esql.item_type`, and `Esql.executable` in the alert to identify the hidden plist, whether it is a launch agent (per-user) or launch daemon (system-wide), and what it runs. +- Retrieve and examine the plist and its target executable on the host. Determine whether the program is signed, where it is located, and what it does; executables in user-writable or temporary locations are higher risk. +- Determine how and when the plist was created, and by which process, using Elastic Defend file telemetry if available. +- Check whether the label or filename masquerades as a legitimate Apple or vendor service. +- Review other alerts and activity for the host and associated user during the same period. + + +*False positive analysis* + + +- Some legitimate software and management tooling create dot-prefixed plists as part of atomic file writes or internal bookkeeping. +- Verify the executable and signing status before escalating; recurring benign cases can be excluded by plist path or executable. + + +*Response and remediation* + + +- If the launch item is not legitimate, unload it with `launchctl bootout` and remove the plist, then remove or quarantine the target executable. +- Investigate the host for related persistence, the initial access vector, and any activity performed by the launch item's program. +- Reset credentials for the affected user and review the host for additional compromise. +- Escalate to the security operations team if additional hosts show similar patterns. + + +==== Setup + + + +*Setup* + + +This rule requires data from the macOS Security Events integration. +Integration setup instructions: https://www.elastic.co/docs/reference/security/prebuilt-rules/integration/macos/macos_security_events[macOS Security Events] + + +==== Rule query + + +[source, js] +---------------------------------- +FROM logs-macos.process_execution_monitoring-* metadata _id, _version, _index +| WHERE data_stream.dataset == "macos.process_execution_monitoring" and + macos.event.message.description LIKE "*effectiveItemDisposition*" and + (macos.event.message.description LIKE "*url=file://*/Library/LaunchAgents/.*" or + macos.event.message.description LIKE "*url=file://*/Library/LaunchDaemons/.*") +| GROK macos.event.message.description "url=file://%{DATA:Esql.plist_path}, config" +| GROK macos.event.message.description "type=%{DATA:Esql.item_type}," +| GROK macos.event.message.description "BTMConfigExecutablePath = \"%{DATA:Esql.executable}\"" +| WHERE Esql.plist_path RLIKE ".*/Library/Launch(Agents|Daemons)/\\..*\\.plist" +| KEEP _id, _version, _index, @timestamp, host.name, Esql.plist_path, Esql.item_type, Esql.executable, macos.event.message.description + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Persistence +** ID: TA0003 +** Reference URL: https://attack.mitre.org/tactics/TA0003/ +* Technique: +** Name: Boot or Logon Autostart Execution +** ID: T1547 +** Reference URL: https://attack.mitre.org/techniques/T1547/ +* Sub-technique: +** Name: Plist Modification +** ID: T1547.011 +** Reference URL: https://attack.mitre.org/techniques/T1547/011/ +* Technique: +** Name: Create or Modify System Process +** ID: T1543 +** Reference URL: https://attack.mitre.org/techniques/T1543/ +* Sub-technique: +** Name: Launch Agent +** ID: T1543.001 +** Reference URL: https://attack.mitre.org/techniques/T1543/001/ +* Sub-technique: +** Name: Launch Daemon +** ID: T1543.004 +** Reference URL: https://attack.mitre.org/techniques/T1543/004/ +* Tactic: +** Name: Defense Evasion +** ID: TA0005 +** Reference URL: https://attack.mitre.org/tactics/TA0005/ +* Technique: +** Name: Hide Artifacts +** ID: T1564 +** Reference URL: https://attack.mitre.org/techniques/T1564/ +* Sub-technique: +** Name: Hidden Files and Directories +** ID: T1564.001 +** Reference URL: https://attack.mitre.org/techniques/T1564/001/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-potential-clickfix-command-via-windows-run-dialog.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-potential-clickfix-command-via-windows-run-dialog.asciidoc new file mode 100644 index 0000000000..5a439b72df --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-potential-clickfix-command-via-windows-run-dialog.asciidoc @@ -0,0 +1,270 @@ +[[prebuilt-rule-8-19-35-potential-clickfix-command-via-windows-run-dialog]] +=== Potential ClickFix Command via Windows Run Dialog + +Identifies suspicious commands written to the Windows Run dialog history (RunMRU) by explorer.exe. Adversaries socially engineer users to copy and paste malicious commands for execution, a pattern commonly seen in Fake CAPTCHA (ClickFix) campaigns. Investigate the process tree for a child of explorer.exe that matches the stored command. + +*Rule type*: esql + +*Rule indices*: None + +*Severity*: high + +*Risk score*: 73 + +*Runs every*: 5m + +*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://www.elastic.co/security-labs/threat-command/telepuz-maas-malware-clickfix +* https://www.elastic.co/security-labs/threat-command/mimicrat-custom-rat-mimics-c2-frameworks + +*Tags*: + +* Domain: Endpoint +* OS: Windows +* Use Case: Threat Detection +* Tactic: Execution +* Tactic: Defense Evasion +* Tactic: Command and Control +* Data Source: Elastic Defend +* Data Source: Sysmon +* Data Source: Microsoft Defender XDR +* Data Source: SentinelOne +* Data Source: Crowdstrike +* Resources: Investigation Guide +* Threat: ClickFix +* Threat: Living off the Land +* Rule Type: ES|QL +* Platform: Windows + +*Version*: 1 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + + +*Investigating Potential ClickFix Command via Windows Run Dialog* + + + +*Possible investigation steps* + + +- What command was stored in the Run dialog history? + - Why: RunMRU records the command submitted through the Windows Run dialog. ClickFix and Fake CAPTCHA pages instruct the victim to paste that command. + - Focus:`registry.data.strings`. + - Implication: escalate when the string downloads content, decodes a payload, hides the window, or hands execution to PowerShell, cmd, mshta, msiexec, rundll32, certutil, curl, wget, or bitsadmin. Lower suspicion only when the same string is a bounded support or install command from a recognized workflow. + +- Did explorer.exe launch a child that matches the stored command? + - Why: the alerting process is explorer.exe writing Run dialog history. The pasted command runs as a child of that explorer instance. + - Focus: child process starts where `process.parent.entity_id` equals the alert `process.entity_id`. Compare child `process.name`, `process.executable`, and `process.command_line` with `registry.data.strings`. + - Implication: escalate when a child shell, script host, or living-off-the-land binary matches the RunMRU string. No matching child leaves execution unproven. + +- What did that child do next? + - Focus: descendants of the recovered child `process.entity_id`, plus file and network events scoped to that child. Review `process.command_line`, `file.path`, `dns.question.name`, and `destination.ip`. + - Hint: if the child entity id is absent, fall back to `host.id` plus the child `process.pid` in a tight window. Missing file or network telemetry leaves those questions unresolved. + - Implication: escalate when the child retrieves a payload, writes a script or executable under a user-writable path, spawns further shells, or contacts an unusual destination. + +- Does the user and host context fit a planned paste-and-run action? + - Focus: `user.id`, `user.name`, `host.id`, and `host.name`, plus browser, chat, or mail activity just before the RunMRU write. + - Implication: escalate when an end-user host has no change window for the command. A lab or awareness exercise is lower suspicion only when the command, user, and host all match that exercise. + +- Escalate when the RunMRU command shows download, decode, hidden execution, or living-off-the-land staging and the process tree, artifacts, destinations, or related alerts support execution. Close only when the stored command, launched child, user, and host bind to one authorized simulation or lab workflow with no contradiction. If evidence is mixed or visibility is incomplete, preserve evidence and escalate. + + +*False positive analysis* + + +- Security-awareness, phishing-simulation, red-team, and malware-analysis labs can paste these commands into the Run dialog. Confirm one workflow: the `registry.data.strings` value, the expected child `process.executable` and `process.command_line`, and a bounded `user.id` / `host.id`, with recovered children and destinations inside the exercise. +- Administrators sometimes launch a signed installer or diagnostic through the Run dialog. Close only when the stored command and child process are that exact tool, with no download cradle, encoded command, or second-stage child. +- Before an exception, require the same `registry.data.strings` fragment, `user.id`, and `host.id` across prior alerts from this rule. Avoid exceptions on `explorer.exe`, the RunMRU path, or `user.name` alone. + + +*Response and remediation* + + +- If confirmed benign, reverse temporary containment and record the command, child identity, `user.id`, and `host.id` that proved the workflow. Create an exception only when that exact workflow recurs. +- If suspicious but unconfirmed, export the registry event, `registry.data.strings`, the explorer `process.entity_id`, and the child process tree, command lines, file paths, and destinations before cleanup. Apply reversible controls first, such as temporary destination blocks, a browser-session reset, or heightened monitoring. Isolate the host when retrieval or second-stage execution makes continued connectivity risky. +- If confirmed malicious, isolate the host, then terminate the child process and suspicious descendants after recording identifiers. Remove staged scripts, archives, and payloads, and block confirmed domains, IPs, hashes, or URLs. Reset credentials only when the investigation shows account misuse. +- Post-incident hardening: retain registry and process telemetry for Run dialog triage, review browser and paste-execution controls, and record the lure wording and paste-run chain in the case notes. + + +==== Setup + + + +*Setup* + + +This rule is designed for data generated by https://www.elastic.co/security/endpoint-security[Elastic Defend], which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules. + +Setup instructions: https://ela.st/install-elastic-defend + + +*Additional data sources* + + +This rule also supports the following third-party data sources. For setup instructions, refer to the links below: + +- https://ela.st/crowdstrike-integration[CrowdStrike] +- https://ela.st/m365-defender[Microsoft Defender XDR] +- https://ela.st/sentinel-one-cloud-funnel[SentinelOne Cloud Funnel] +- https://ela.st/sysmon-event-reg-setup[Sysmon Registry Events] + + +==== Rule query + + +[source, js] +---------------------------------- +from logs-endpoint.events.registry-*, logs-windows.sysmon_operational-*, winlogbeat-*, + logs-windows.forwarded-*, logs-m365_defender.event-*, logs-sentinel_one_cloud_funnel.*, + logs-crowdstrike.fdr* metadata _id, _version, _index +| where KQL(""" host.os.type : "windows" AND event.category:"registry" AND process.name:explorer.exe AND event.type : ("creation" or "change") """) + and registry.data.strings is not null + and ( + to_lower(registry.path) like """hkey_users\\*\\software\\microsoft\\windows\\currentversion\\explorer\\runmru\\*""" + or to_lower(registry.path) like """\\registry\\user\\*\\software\\microsoft\\windows\\currentversion\\explorer\\runmru\\*""" + or to_lower(registry.path) like """hku\\*\\software\\microsoft\\windows\\currentversion\\explorer\\runmru\\*""" + or to_lower(registry.path) like """hkcu\\software\\microsoft\\windows\\currentversion\\explorer\\runmru\\*""" + or to_lower(registry.path) like """hkey_current_user\\software\\microsoft\\windows\\currentversion\\explorer\\runmru\\*""" + ) + and not to_lower(registry.path) like """*\\runmru\\mrulist""" +| eval registry_data = to_lower(mv_concat(registry.data.strings, " ")) +| where + // PowerShell / PowerShell 7 with suspicious arguments or content + ( + (registry_data like "*powershell*" or registry_data like "*pwsh*") and + ( + registry_data like "*-nop *" or + registry_data like "* -e *" or + registry_data like "* -ec *" or + registry_data like "* -en*" or + registry_data like "*irm *" or + registry_data like "*iwr *" or + registry_data like "*iex *" or + registry_data like "*iex(*" or + registry_data like "*invoke-restmethod*" or + registry_data like "*invoke-webrequest*" or + registry_data like "*invoke-expression*" or + registry_data like "*invoke-command*" or + registry_data like "*$executioncontext.invokecommand*" or + registry_data like "*webclient*" or + registry_data like "*downloadstring*" or + registry_data like "*downloadfile*" or + registry_data like "*http*" or + registry_data like "*bypass*" or + registry_data like "* -w* h*" or + registry_data like "* -w* mi*" or + registry_data like "* -w *" or + registry_data like "*start-process*" or + registry_data like "*frombase64string*" or + registry_data like "*substring*" or + registry_data like "*psitem.definition*" or + registry_data like "*+*+*+*" + ) + ) + or + // Remote content and script execution through other utilities + ( + registry_data like "*msiexec*" or + registry_data like "*mshta*" or + registry_data like "*msbuild*" or + registry_data like "*pcalua*" or + registry_data like "*regsvr32*" or + registry_data like "*rundll32*" or + registry_data like "*cmstp.exe*" or + registry_data like "*cmd*http*" or + registry_data like "*cmd*set*&set*" or + registry_data like "*conhost*" or + registry_data like "*forfiles*" or + registry_data like "*certutil*" or + registry_data like "*curl*http*" or + registry_data like "*wget*http*" or + registry_data like "*bitsadmin*" or + registry_data like "*wmic*/f*" or + registry_data like "*odbcconf*" or + registry_data like "*script*davwwwroot*" or + registry_data like "*script*@ssl*" or + registry_data like "*cmd*davwwwroot*" or + registry_data like "*cmd*@ssl*" or + registry_data like "*cmd*pushd*" or + registry_data like "*-appvscript*" or + registry_data like "*|*powershell*" or + registry_data like "*|*pwsh*" or + registry_data like "*iex*irm *" or + registry_data like "*iex*iwr *" + ) +| keep _id, _version, _index, data_stream.namespace, @timestamp, event.dataset, user.id, user.name, user.domain, host.id, host.name, agent.id, process.name, process.entity_id, process.executable, process.pid, registry.data.strings, registry.path + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Execution +** ID: TA0002 +** Reference URL: https://attack.mitre.org/tactics/TA0002/ +* Technique: +** Name: Command and Scripting Interpreter +** ID: T1059 +** Reference URL: https://attack.mitre.org/techniques/T1059/ +* Sub-technique: +** Name: PowerShell +** ID: T1059.001 +** Reference URL: https://attack.mitre.org/techniques/T1059/001/ +* Sub-technique: +** Name: Windows Command Shell +** ID: T1059.003 +** Reference URL: https://attack.mitre.org/techniques/T1059/003/ +* Technique: +** Name: User Execution +** ID: T1204 +** Reference URL: https://attack.mitre.org/techniques/T1204/ +* Sub-technique: +** Name: Malicious Copy and Paste +** ID: T1204.004 +** Reference URL: https://attack.mitre.org/techniques/T1204/004/ +* Tactic: +** Name: Defense Evasion +** ID: TA0005 +** Reference URL: https://attack.mitre.org/tactics/TA0005/ +* Technique: +** Name: System Binary Proxy Execution +** ID: T1218 +** Reference URL: https://attack.mitre.org/techniques/T1218/ +* Sub-technique: +** Name: Mshta +** ID: T1218.005 +** Reference URL: https://attack.mitre.org/techniques/T1218/005/ +* Sub-technique: +** Name: Msiexec +** ID: T1218.007 +** Reference URL: https://attack.mitre.org/techniques/T1218/007/ +* Sub-technique: +** Name: Rundll32 +** ID: T1218.011 +** Reference URL: https://attack.mitre.org/techniques/T1218/011/ +* Tactic: +** Name: Command and Control +** ID: TA0011 +** Reference URL: https://attack.mitre.org/tactics/TA0011/ +* Technique: +** Name: Ingress Tool Transfer +** ID: T1105 +** Reference URL: https://attack.mitre.org/techniques/T1105/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-potential-destructive-aws-cli-command-executed-by-genai-agent.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-potential-destructive-aws-cli-command-executed-by-genai-agent.asciidoc new file mode 100644 index 0000000000..8d491e3564 --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-potential-destructive-aws-cli-command-executed-by-genai-agent.asciidoc @@ -0,0 +1,229 @@ +[[prebuilt-rule-8-19-35-potential-destructive-aws-cli-command-executed-by-genai-agent]] +=== Potential Destructive AWS CLI Command Executed by GenAI Agent + +Identifies a cloud CLI command that destroys infrastructure or identities, such as terminating EC2 instances, removing S3 buckets, or deleting IAM users, when it is spawned by a GenAI coding agent directly or through the agent's shell wrapper. A compromised or prompt-injected agent can be steered into wiping the developer's environment and cloud account using the credentials it already holds, as seen in the malicious Amazon Q Developer for VS Code v1.84.0 release (AWS-2025-015). + +*Rule type*: query + +*Rule indices*: + +* logs-endpoint.events.process* + +*Severity*: high + +*Risk score*: 73 + +*Runs every*: 5m + +*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://aws.amazon.com/security/security-bulletins/AWS-2025-015/ +* https://github.com/aws/aws-toolkit-vscode/security/advisories/GHSA-7g7f-ff96-5gcw +* https://www.theregister.com/2025/07/24/amazon_q_ai_prompt/ +* https://www.pointguardai.com/blog/clean-to-factory-state-the-ai-prompt-that-nearly-wiped-aws-accounts + +*Tags*: + +* Domain: Endpoint +* Domain: Cloud +* Domain: GenAI +* Platform: AWS +* Platform: Linux +* Platform: macOS +* Platform: Windows +* Platform: Kubernetes +* OS: Linux +* OS: macOS +* OS: Windows +* Service: AWS EC2 +* Service: AWS S3 +* Service: AWS IAM +* Service: AWS RDS +* Service: AWS Lambda +* Tactic: Impact +* Tactic: Defense Evasion +* Data Source: Elastic Defend +* Rule Type: Custom Query (KQL) +* Resources: Investigation Guide +* Mitre Atlas: T0051 + +*Version*: 1 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + + +*Investigating Potential Destructive AWS CLI Command Executed by GenAI Agent* + + +This rule detects a GenAI coding agent spawning a cloud CLI command that destroys infrastructure or identities. A compromised or prompt-injected agent can be steered into wiping the developer's AWS account without any separate credential theft step, since the agent already holds the developer's credentials. The malicious Amazon Q Developer pull request in July 2025 (AWS-2025-015) is the canonical real-world example of this attack pattern. + + +*Possible investigation steps* + + +- Identify the GenAI agent parent process and determine whether it was running in an autonomous or interactive mode at the time of the alert. +- Review the full CLI command arguments to assess the scope of the destruction (resource IDs, `--recursive` flags, etc.). +- Check for a preceding unusual or injected prompt in the agent's context, such as content from a recently cloned repository, an opened file, or a web fetch result. +- Query AWS CloudTrail for the corresponding API call and confirm whether the destructive action was actually executed or was blocked. +- Determine if the user initiated the teardown intentionally or if it was triggered autonomously. + + +*False positive analysis* + + +- Authorized infrastructure teardown automation invoked through a GenAI interface may legitimately trigger this rule. Correlate with change management records and known deployment pipeline identities before escalating. +- Developers who explicitly instruct a GenAI agent to clean up development environments will generate alerts for legitimate use. + + +*Response and remediation* + + +- Initiate the incident response process based on the outcome of the triage. +- If the destructive command executed, immediately assess which resources were deleted and begin recovery from backups or infrastructure-as-code. +- Revoke the developer's AWS credentials and rotate them after confirming the scope of the compromise. +- Review the agent's recent conversation history and any external content it processed to identify the prompt injection source. +- Apply IAM permission boundaries on developer credentials to restrict the blast radius of future incidents. + + +==== Setup + + + +*Setup* + + +This rule requires data coming in from Elastic Defend. + + +*Elastic Defend Integration Setup* + +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the +Elastic Agent to monitor events on your host and send data to the Elastic Security app. + + +*Prerequisite Requirements:* + +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation]. + + +*The following steps should be executed in order to add the Elastic Defend integration:* + +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can + click the "Existing hosts" tab and select an existing policy instead. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and install Elastic Agent on your hosts. +For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide]. + + +==== Rule query + + +[source, js] +---------------------------------- +event.category : "process" and event.type : "start" and event.action : (start or exec) and +( + process.parent.name : ( + qterm or qterm.exe or qchat or qchat.exe or + kiro or "kiro-cli" or "kiro-cli-chat" or "kiro-cli-term" or + kiro.exe or "kiro-cli.exe" or "kiro-cli-chat.exe" or "kiro-cli-term.exe" or + claude or "claude-bin" or claude.exe or codex or codex.exe or + copilot or copilot.exe or cursor or cursor.exe or "Cursor Helper (Plugin)" or "Cursor Helper" or + "gemini-cli" or "gemini-cli.exe" or windsurf or windsurf.exe or + aider or aider.exe or cline or goose or goose.exe or opencode or opencode.exe + ) or + process.parent.executable : ( + */.local/bin/q or */usr/local/bin/q or + *\\Users\\*\\AppData\\Local\\Programs\\Amazon Q\\q.exe or + *\\Users\\*\\AppData\\Local\\Programs\\Amazon Q\\*\\q.exe or + *\\Program Files\\Amazon Q\\q.exe or + *\\Program Files\\Amazon Q\\*\\q.exe + ) or + ( + process.parent.name : (bash or zsh or sh or dash or cmd.exe or powershell.exe or pwsh or pwsh.exe) and + process.parent.command_line : ( + */.claude/shell-snapshots/* or *\\.claude\\shell-snapshots\\* or + */.codex/* or *\\.codex\\* or + */.kiro/* or *\\.kiro\\* or + */.aws/amazonq/* or *\\.aws\\amazonq\\* or + */.goose/* or */.opencode/* or */.aider* + ) + ) +) and +( + ( + process.name : (aws or aws.exe) and + process.command_line : ( + *ec2 terminate-instances* or *ec2 delete-volume* or *ec2 delete-snapshot* or + *s3 rb* or *s3 rm*--recursive* or *s3api delete-bucket* or *s3api delete-objects* or + *iam delete-user* or *iam delete-role* or *iam delete-login-profile* or *iam delete-access-key* or + *rds delete-db-instance* or *rds delete-db-cluster* or *dynamodb delete-table* or + *efs delete-file-system* or *eks delete-cluster* or *ecs delete-cluster* or + *lambda delete-function* or *kms schedule-key-deletion* or + *cloudformation delete-stack* or + *cloudtrail delete-trail* or *cloudtrail stop-logging* or + *backup delete-recovery-point* or *organizations close-account* + ) + ) or + ( + process.name : (sam or sam.exe) and process.command_line : *sam delete* + ) or + ( + process.name : (terraform or terraform.exe or tofu or tofu.exe) and + process.command_line : *destroy*-auto-approve* + ) or + ( + process.name : (kubectl or kubectl.exe) and + process.command_line : (*delete*--all* or *delete namespace* or *delete ns*) + ) +) and not process.args : ("--dry-run*" or "--help*" or "-help*" or "-h" or "help" or "--version*") + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Impact +** ID: TA0040 +** Reference URL: https://attack.mitre.org/tactics/TA0040/ +* Technique: +** Name: Data Destruction +** ID: T1485 +** Reference URL: https://attack.mitre.org/techniques/T1485/ +* Technique: +** Name: Account Access Removal +** ID: T1531 +** Reference URL: https://attack.mitre.org/techniques/T1531/ +* Tactic: +** Name: Defense Evasion +** ID: TA0005 +** Reference URL: https://attack.mitre.org/tactics/TA0005/ +* Technique: +** Name: Impair Defenses +** ID: T1562 +** Reference URL: https://attack.mitre.org/techniques/T1562/ +* Sub-technique: +** Name: Disable or Modify Cloud Logs +** ID: T1562.008 +** Reference URL: https://attack.mitre.org/techniques/T1562/008/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-potential-execution-via-filefix-phishing-attack.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-potential-execution-via-filefix-phishing-attack.asciidoc new file mode 100644 index 0000000000..b36add8856 --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-potential-execution-via-filefix-phishing-attack.asciidoc @@ -0,0 +1,228 @@ +[[prebuilt-rule-8-19-35-potential-execution-via-filefix-phishing-attack]] +=== Potential Execution via FileFix Phishing Attack + +Identifies the execution of Windows commands or downloaded files via the browser's dialog box. Adversaries may use phishing to instruct the victim to copy and paste malicious commands for execution via crafted phishing web pages. + +*Rule type*: eql + +*Rule indices*: + +* logs-endpoint.events.process-* +* logs-m365_defender.event-* +* logs-sentinel_one_cloud_funnel.* +* logs-windows.sysmon_operational-* +* winlogbeat-* + +*Severity*: high + +*Risk score*: 73 + +*Runs every*: 5m + +*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://mrd0x.com/filefix-clickfix-alternative/ + +*Tags*: + +* Domain: Endpoint +* OS: Windows +* Use Case: Threat Detection +* Tactic: Execution +* Data Source: Windows Security Event Logs +* Data Source: Elastic Defend +* Data Source: Sysmon +* Data Source: SentinelOne +* Data Source: Microsoft Defender XDR +* Resources: Investigation Guide +* Noise: Medium +* Performance: Normal +* Profile: Recommended +* Threat: ClickFix +* Threat: Living off the Land +* Rule Type: Event Correlation (EQL) +* Platform: Windows + +*Version*: 6 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + + +*Investigating Potential Execution via FileFix Phishing Attack* + + + +*Possible investigation steps* + + +- Does the alert show the FileFix browser-to-Explorer execution path? + - Focus: alert-local `process.parent.executable`, `process.parent.args`, `process.name`, `process.executable`, and `process.command_line`. + - Implication: escalate when a Chromium-style file-picker parent using "--message-loop-type-ui" and "--service-sandbox-type=none" launches PowerShell, curl, certutil, certreq, msiexec, mshta, rundll32, wscript, cscript, or a "?:\Users\*\Downloads\*" executable; lower suspicion only when the child is a signed installer or diagnostic tool and the parent/command shape matches a recognized browser-initiated support or install flow. +- Is the launched child the expected binary for that workflow? + - Focus: `process.executable`, `process.pe.original_file_name`, `process.code_signature.subject_name`, and `process.code_signature.trusted`; recover absent values from same-process events. !{investigate{"description":"","label":"Events for the launched process on this host","providers":[[{"excluded":false,"field":"process.entity_id","queryType":"phrase","value":"{{process.entity_id}}","valueType":"string"},{"excluded":false,"field":"host.id","queryType":"phrase","value":"{{host.id}}","valueType":"string"}]],"relativeFrom":"now-1h","relativeTo":"now"}} + - Implication: escalate when the path is user-writable or signer/original name mismatches the expected tool; lower identity risk when signer, original name, path, and known hash history fit, but continue command-intent checks. +- Does the command line reveal pasted-command social engineering? + - Focus: `process.command_line` and `process.name`. + - Implication: escalate when the command hides execution before a fake path or comment, invokes PowerShell or a LOLBin to retrieve/run content, or starts a "%USERPROFILE%\Downloads" payload directly; lower suspicion only when arguments open the signed installer or diagnostic tool with no hidden command, URL, or shell operator. +- Does a Downloads-path child look newly staged or renamed? + - Focus: `process.executable`, `process.Ext.relative_file_creation_time`, `process.Ext.relative_file_name_modify_time`, `process.code_signature.thumbprint_sha256`, and same-process file writes/renames; recover absent process values from same-process events. !{investigate{"description":"","label":"File events for the launched process","providers":[[{"excluded":false,"field":"event.category","queryType":"phrase","value":"file","valueType":"string"},{"excluded":false,"field":"host.id","queryType":"phrase","value":"{{host.id}}","valueType":"string"},{"excluded":false,"field":"process.entity_id","queryType":"phrase","value":"{{process.entity_id}}","valueType":"string"}],[{"excluded":false,"field":"event.category","queryType":"phrase","value":"file","valueType":"string"},{"excluded":false,"field":"host.id","queryType":"phrase","value":"{{host.id}}","valueType":"string"},{"excluded":false,"field":"process.pid","queryType":"phrase","value":"{{process.pid}}","valueType":"string"}]],"relativeFrom":"now-1h","relativeTo":"now"}} + - Hint: for the downloaded-EXE variant, process file-age is the recovery signal; absent file provenance does not make a Downloads path benign. + - Implication: escalate when a Downloads or other user-profile executable runs shortly after creation or rename, especially with weak identity; lower suspicion when file age, stable signer, and path match the same recognized update or support workflow. +- Did the launched child spawn follow-on tools? + - Focus: child process starts from `process.entity_id`, then descendant `process.executable` and `process.command_line`. !{investigate{"description":"","label":"Child process starts from the launched process","providers":[[{"excluded":false,"field":"event.category","queryType":"phrase","value":"process","valueType":"string"},{"excluded":false,"field":"event.type","queryType":"phrase","value":"start","valueType":"string"},{"excluded":false,"field":"host.id","queryType":"phrase","value":"{{host.id}}","valueType":"string"},{"excluded":false,"field":"process.parent.entity_id","queryType":"phrase","value":"{{process.entity_id}}","valueType":"string"}],[{"excluded":false,"field":"event.category","queryType":"phrase","value":"process","valueType":"string"},{"excluded":false,"field":"event.type","queryType":"phrase","value":"start","valueType":"string"},{"excluded":false,"field":"host.id","queryType":"phrase","value":"{{host.id}}","valueType":"string"},{"excluded":false,"field":"process.parent.pid","queryType":"phrase","value":"{{process.pid}}","valueType":"string"}]],"relativeFrom":"now-1h","relativeTo":"now"}} + - Hint: if entity IDs are unavailable, fall back to parent PID plus a tight alert-time window on the same host. + - Implication: escalate when the chain fans out into shells, script hosts, installers, archive tools, or task/scheduler utilities; no descendants keeps scope local but does not clear suspicious command intent or identity mismatch. +- Did the launched child contact retrieval or staging destinations? + - Focus: same-process network events for `destination.ip`, `destination.port`, and destination ownership when available. !{investigate{"description":"","label":"Network events for the launched process","providers":[[{"excluded":false,"field":"event.category","queryType":"phrase","value":"network","valueType":"string"},{"excluded":false,"field":"host.id","queryType":"phrase","value":"{{host.id}}","valueType":"string"},{"excluded":false,"field":"process.entity_id","queryType":"phrase","value":"{{process.entity_id}}","valueType":"string"}],[{"excluded":false,"field":"event.category","queryType":"phrase","value":"network","valueType":"string"},{"excluded":false,"field":"host.id","queryType":"phrase","value":"{{host.id}}","valueType":"string"},{"excluded":false,"field":"process.pid","queryType":"phrase","value":"{{process.pid}}","valueType":"string"}]],"relativeFrom":"now-1h","relativeTo":"now"}} + - Implication: escalate when PowerShell, curl, certutil, certreq, mshta, or another child reaches external staging, paste, storage, or command-and-control infrastructure; missing network telemetry is unresolved, not benign. +- If local evidence remains suspicious or unresolved, does the pattern recur for this user or host? + - Focus: related alerts and process starts for the same `user.id` and `host.id`, comparing `process.parent.args` and child `process.command_line`. + - Hint: review related user alerts with !{investigate{"description":"","label":"Alerts associated with the user","providers":[[{"excluded":false,"field":"event.kind","queryType":"phrase","value":"signal","valueType":"string"},{"excluded":false,"field":"user.id","queryType":"phrase","value":"{{user.id}}","valueType":"string"}]],"relativeFrom":"now-48h/h","relativeTo":"now"}} + - Hint: review related host alerts with !{investigate{"description":"","label":"Alerts associated with the host","providers":[[{"excluded":false,"field":"event.kind","queryType":"phrase","value":"signal","valueType":"string"},{"excluded":false,"field":"host.id","queryType":"phrase","value":"{{host.id}}","valueType":"string"}]],"relativeFrom":"now-48h/h","relativeTo":"now"}} + - Implication: broaden scope when the same browser-parented shell, LOLBin, or Downloads-path launch repeats for this user, host, or other users; keep the case local when it is isolated and the process evidence resolves cleanly. +- Escalate when ancestry, child identity, command intent, file age, descendants, network, or recurrence supports user-assisted command execution or downloaded payload launch; close only when process evidence shows a signed installer or diagnostic identity, non-hidden command shape, expected file age/path, no suspicious descendants, no suspicious network where telemetry exists, and no related spread; preserve evidence and escalate when facts conflict or remain incomplete. + + +*False positive analysis* + + +- Signed browser-initiated installer/diagnostic workflows or authorized security tests can trigger. Confirm exact alignment across parent flags, child path, signer, hash, command line, user, host, timing, and absence of suspicious descendants; do not close on a ticket or owner statement if process evidence conflicts. +- The query excludes browser file-picker launches of certutil `-hashfile`, rundll32 `cryptext.dll` certificate dialogs, Windows Photo Viewer, MSI `zzzzInvokeManagedCustomActionOutOfProc` custom actions, and `hotplug.dll` safe-removal notifications. +- Before creating an exception, require recurrence with stable `process.parent.executable`, `process.parent.args`, `process.executable`, `process.code_signature.thumbprint_sha256`, command-line shape, `user.id`, and `host.id`. Avoid exceptions on browser parentage, `process.name`, or Downloads-path execution alone. + + +*Response and remediation* + + +- If suspicious but unconfirmed, first preserve the alert event, same-process event export, descendant process timeline, command-line text, parent context, child binary copy, hash and signature details, and the affected user/host identifiers. +- Apply reversible containment only after preservation, such as restricting the affected browser session or account, blocking the exact child hash, or quarantining the downloaded child binary. Escalate to host isolation only when command intent, identity, or descendants indicate likely payload execution. +- If confirmed malicious, isolate the host when the launched child or descendants executed payloads, then terminate the child and descendants after recording identifiers. Do not reset credentials from this alert alone; use identity response only when separate evidence proves credential exposure or account misuse. +- Eradicate only the downloaded executables, scripts, task utilities, or secondary payloads identified in the process timeline, then remediate the phishing page access or browser session that enabled the user-assisted execution. +- If confirmed benign, reverse temporary containment and document the exact parent flags, child identity, command shape, user, host, and outside confirmation that proved the workflow. Create an exception only after the stable bounded pattern recurs. +- Post-incident hardening: restrict direct execution from user download locations where feasible, warn on browser-file-picker social engineering, retain process telemetry needed for the pivots above, and document the FileFix variant observed in the case record. + +==== Setup + + + +*Setup* + + +This rule is designed for data generated by https://www.elastic.co/security/endpoint-security[Elastic Defend], which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules. + +Setup instructions: https://ela.st/install-elastic-defend + + +*Additional data sources* + + +This rule also supports the following third-party data sources. For setup instructions, refer to the links below: + +- https://ela.st/m365-defender[Microsoft Defender XDR] +- https://ela.st/sentinel-one-cloud-funnel[SentinelOne Cloud Funnel] +- https://ela.st/sysmon-event-1-setup[Sysmon Event ID 1 - Process Creation] + + +==== Rule query + + +[source, js] +---------------------------------- +process where host.os.type == "windows" and event.type == "start" and + process.parent.args == "--message-loop-type-ui" and process.parent.args == "--service-sandbox-type=none" and + ( + process.name : ("pwsh.exe", "powershell.exe", "curl.exe", "msiexec.exe", "mshta.exe", "wscript.exe", "cscript.exe", "rundll32.exe", "certutil.exe", "certreq.exe") or + process.executable : "?:\\Users\\*\\Downloads\\*" + ) and +not ( + process.name : "rundll32.exe" and + process.args : ( + "ndfapi.dll,NdfRunDllDiagnoseWithAnswerFile", + "shwebsvc.dll,AddNetPlaceRunDll", + "?:\\WINDOWS\\Installer\\MSI*.tmp,zzzzInvokeManagedCustomActionOutOfProc", + "*cryptext.dll,CryptExtOpenCER", + "*cryptext.dll,CryptExtOpenCRL", + "*cryptext.dll,CryptExtOpenPKCS7", + "*cryptext.dll,CryptExtAddPFX", + "?:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll,*", + "?:\\WINDOWS\\*\\hotplug.dll,HotPlugSafeRemovalDriveNotification" + ) + ) and + not (process.name : "certutil.exe" and process.args : "-hashfile") + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Execution +** ID: TA0002 +** Reference URL: https://attack.mitre.org/tactics/TA0002/ +* Technique: +** Name: Command and Scripting Interpreter +** ID: T1059 +** Reference URL: https://attack.mitre.org/techniques/T1059/ +* Sub-technique: +** Name: PowerShell +** ID: T1059.001 +** Reference URL: https://attack.mitre.org/techniques/T1059/001/ +* Sub-technique: +** Name: Windows Command Shell +** ID: T1059.003 +** Reference URL: https://attack.mitre.org/techniques/T1059/003/ +* Technique: +** Name: User Execution +** ID: T1204 +** Reference URL: https://attack.mitre.org/techniques/T1204/ +* Sub-technique: +** Name: Malicious File +** ID: T1204.002 +** Reference URL: https://attack.mitre.org/techniques/T1204/002/ +* Sub-technique: +** Name: Malicious Copy and Paste +** ID: T1204.004 +** Reference URL: https://attack.mitre.org/techniques/T1204/004/ +* Tactic: +** Name: Defense Evasion +** ID: TA0005 +** Reference URL: https://attack.mitre.org/tactics/TA0005/ +* Technique: +** Name: System Binary Proxy Execution +** ID: T1218 +** Reference URL: https://attack.mitre.org/techniques/T1218/ +* Sub-technique: +** Name: Mshta +** ID: T1218.005 +** Reference URL: https://attack.mitre.org/techniques/T1218/005/ +* Tactic: +** Name: Initial Access +** ID: TA0001 +** Reference URL: https://attack.mitre.org/tactics/TA0001/ +* Technique: +** Name: Phishing +** ID: T1566 +** Reference URL: https://attack.mitre.org/techniques/T1566/ +* Sub-technique: +** Name: Spearphishing Attachment +** ID: T1566.001 +** Reference URL: https://attack.mitre.org/techniques/T1566/001/ +* Sub-technique: +** Name: Spearphishing Link +** ID: T1566.002 +** Reference URL: https://attack.mitre.org/techniques/T1566/002/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-potential-filefix-command-via-windows-explorer-address-bar.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-potential-filefix-command-via-windows-explorer-address-bar.asciidoc new file mode 100644 index 0000000000..996c042fe3 --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-potential-filefix-command-via-windows-explorer-address-bar.asciidoc @@ -0,0 +1,285 @@ +[[prebuilt-rule-8-19-35-potential-filefix-command-via-windows-explorer-address-bar]] +=== Potential FileFix Command via Windows Explorer Address Bar + +Identifies suspicious commands written to the Windows Explorer address bar history (TypedPaths). Adversaries socially engineer users to paste a command into the address bar of File Explorer or of a browser's file upload dialog, a pattern known as FileFix; the writing process is therefore explorer.exe or the browser hosting the dialog. Stored commands that invoke PowerShell, cmd, mshta, msiexec, rundll32, or another living-off-the-land binary are unusual for this key, which normally contains file and folder paths. Investigate the process tree for a child of the writing process that matches the stored command. + +*Rule type*: esql + +*Rule indices*: None + +*Severity*: high + +*Risk score*: 73 + +*Runs every*: 5m + +*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://mrd0x.com/filefix-clickfix-alternative/ +* https://www.elastic.co/security-labs/threat-command/telepuz-maas-malware-clickfix +* https://www.elastic.co/security-labs/threat-command/mimicrat-custom-rat-mimics-c2-frameworks + +*Tags*: + +* Domain: Endpoint +* OS: Windows +* Use Case: Threat Detection +* Tactic: Execution +* Tactic: Defense Evasion +* Tactic: Initial Access +* Tactic: Command and Control +* Data Source: Elastic Defend +* Data Source: Sysmon +* Data Source: Microsoft Defender XDR +* Data Source: SentinelOne +* Data Source: Crowdstrike +* Resources: Investigation Guide +* Threat: ClickFix +* Threat: Living off the Land +* Rule Type: ES|QL +* Platform: Windows + +*Version*: 1 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + + +*Investigating Potential FileFix Command via Windows Explorer Address Bar* + + + +*Possible investigation steps* + + +- What command was stored in the Explorer address bar history? + - Why: TypedPaths records the string submitted through the File Explorer address bar. FileFix pages instruct the victim to paste that string, often padding it so the visible end looks like a document path while the command sits at the front. + - Focus: `registry.data.strings` and `registry.path`. + - Implication: escalate when the string invokes PowerShell, pwsh, cmd, mshta, msiexec, rundll32, curl, wget, certutil, certreq, bitsadmin, wscript, cscript, conhost, or forfiles. A quiet local install such as msiexec with `/q`, `/qb`, or `/qn` against a user-profile or Downloads package is the same pattern. Lower suspicion only when the string is a real folder path from a recognized workflow and contains no command switches, URL, or shell operator. + +- Did the writing process launch a child that matches the stored command? + - Why: the alerting process is whichever process hosted the address bar: explorer.exe for File Explorer, or chrome.exe, msedge.exe, or firefox.exe for a file upload dialog. The pasted command runs as a child of that process. + - Focus: child process starts where `process.parent.entity_id` equals the alert `process.entity_id`. Compare child `process.name`, `process.executable`, and `process.command_line` with `registry.data.strings`. + - Implication: escalate when a child shell, script host, installer, or living-off-the-land binary matches the TypedPaths string. A browser as the writer is the expected FileFix shape, not an anomaly. No matching child leaves execution unproven. + +- What did that child do next? + - Focus: descendants of the recovered child `process.entity_id`, plus file and network events scoped to that child. Review `process.command_line`, `file.path`, `dns.question.name`, and `destination.ip`. + - Hint: if the child entity id is absent, fall back to `host.id` plus the child `process.pid` in a tight window. Missing file or network telemetry leaves those questions unresolved. + - Implication: escalate when the child retrieves a payload, writes a script or executable under a user-writable path, installs a package, spawns further shells, or contacts an unusual destination. + +- Does the user and host context fit a planned paste-and-run action? + - Focus: `user.id`, `user.name`, `host.id`, and `host.name`, plus browser, chat, or mail activity just before the TypedPaths write. The decoy path at the end of `registry.data.strings` is the file the page told the user to open. + - Implication: escalate when an end-user host has no change window for the command. A lab or awareness exercise is lower suspicion only when the command, user, and host all match that exercise. + +- Escalate when the TypedPaths command shows a living-off-the-land binary, a quiet installer, download, decode, or hidden execution, and the process tree, artifacts, destinations, or related alerts support execution. Close only when the stored command, launched child, user, and host bind to one authorized simulation or lab workflow with no contradiction. If evidence is mixed or visibility is incomplete, preserve evidence and escalate. + + +*False positive analysis* + + +- Security-awareness, phishing-simulation, red-team, and malware-analysis labs can paste these commands into the File Explorer address bar. Confirm one workflow: the `registry.data.strings` value, the expected child `process.executable` and `process.command_line`, and a bounded `user.id` / `host.id`, with recovered children and destinations inside the exercise. +- Administrators sometimes launch a signed installer or diagnostic through the address bar. Close only when the stored command and child process are that exact tool, with no download cradle, encoded command, hidden window, or second-stage child. +- A typed folder path can contain a tool name followed by a space, such as a directory named "powershell scripts". Close only when the full string is that directory, the user opened it, and no child process matches a command in the string. +- Before an exception, require the same `registry.data.strings` fragment, `user.id`, and `host.id` across prior alerts from this rule. Avoid exceptions on the writing process.name, the TypedPaths path, or `user.name` alone. + + +*Response and remediation* + + +- If confirmed benign, reverse temporary containment and record the command, child identity, `user.id`, and `host.id` that proved the workflow. Create an exception only when that exact workflow recurs. +- If suspicious but unconfirmed, export the registry event, `registry.data.strings`, the explorer `process.entity_id`, and the child process tree, command lines, file paths, and destinations before cleanup. Apply reversible controls first, such as temporary destination blocks, a browser-session reset, or heightened monitoring. Isolate the host when retrieval, package installation, or second-stage execution makes continued connectivity risky. +- If confirmed malicious, isolate the host, then terminate the child process and suspicious descendants after recording identifiers. Remove staged scripts, installers, archives, and payloads, and block confirmed domains, IPs, hashes, or URLs. Reset credentials only when the investigation shows account misuse. +- Post-incident hardening: retain registry and process telemetry for Explorer address bar triage, review browser and paste-execution controls, and record the lure wording and paste-run chain in the case notes. + + +==== Setup + + + +*Setup* + + +This rule is designed for data generated by https://www.elastic.co/security/endpoint-security[Elastic Defend], which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules. + +Setup instructions: https://ela.st/install-elastic-defend + + +*Additional data sources* + + +This rule also supports the following third-party data sources. For setup instructions, refer to the links below: + +- https://ela.st/crowdstrike-integration[CrowdStrike] +- https://ela.st/m365-defender[Microsoft Defender XDR] +- https://ela.st/sentinel-one-cloud-funnel[SentinelOne Cloud Funnel] +- https://ela.st/sysmon-event-reg-setup[Sysmon Registry Events] + + +==== Rule query + + +[source, js] +---------------------------------- +from logs-endpoint.events.registry-*, logs-windows.sysmon_operational-*, winlogbeat-*, + logs-windows.forwarded-*, logs-m365_defender.event-*, logs-sentinel_one_cloud_funnel.*, + logs-crowdstrike.fdr* metadata _id, _version, _index +| where KQL(""" host.os.type : "windows" AND event.category:"registry" AND event.type : ("creation" or "change") """) + and registry.data.strings is not null + and ( + to_lower(registry.path) like """hkey_users\\*\\software\\microsoft\\windows\\currentversion\\explorer\\typedpaths\\*""" + or to_lower(registry.path) like """\\registry\\user\\*\\software\\microsoft\\windows\\currentversion\\explorer\\typedpaths\\*""" + or to_lower(registry.path) like """hku\\*\\software\\microsoft\\windows\\currentversion\\explorer\\typedpaths\\*""" + or to_lower(registry.path) like """hkcu\\software\\microsoft\\windows\\currentversion\\explorer\\typedpaths\\*""" + or to_lower(registry.path) like """hkey_current_user\\software\\microsoft\\windows\\currentversion\\explorer\\typedpaths\\*""" + ) +| eval registry_data = to_lower(mv_concat(registry.data.strings, " ")) +| where + // Command form only. A bare path to the binary, such as ...\\powershell.exe, does not match. + // PowerShell / PowerShell 7 + registry_data like "*powershell *" or + registry_data like "*powershell.exe *" or + registry_data like "*powershell.exe\" *" or + registry_data like "*pwsh *" or + registry_data like "*pwsh.exe *" or + registry_data like "*pwsh.exe\" *" or + // Mshta + registry_data like "*mshta *" or + registry_data like "*mshta.exe *" or + registry_data like "*mshta.exe\" *" or + // Msiexec, including a quiet local package such as msiexec /i "\\users\\...\\file.msi" /qb + registry_data like "*msiexec *" or + registry_data like "*msiexec.exe *" or + registry_data like "*msiexec.exe\" *" or + // Rundll32 + registry_data like "*rundll32 *" or + registry_data like "*rundll32.exe *" or + registry_data like "*rundll32.exe\" *" or + // Cmd. Require /c, /k, cmd.exe, or comspec so a folder name containing "cmd" does not match. + registry_data like "*cmd.exe *" or + registry_data like "*cmd.exe\" *" or + registry_data like "*cmd /c *" or + registry_data like "*cmd /k *" or + registry_data like "*cmd/c *" or + registry_data like "*cmd.exe/c *" or + registry_data like "*%comspec%*" or + // Other living-off-the-land binaries used in FileFix and ClickFix paste chains + registry_data like "*curl *" or + registry_data like "*curl.exe *" or + registry_data like "*curl.exe\" *" or + registry_data like "*wget *" or + registry_data like "*wget.exe *" or + registry_data like "*wget.exe\" *" or + registry_data like "*certutil *" or + registry_data like "*certutil.exe *" or + registry_data like "*certutil.exe\" *" or + registry_data like "*certreq *" or + registry_data like "*certreq.exe *" or + registry_data like "*certreq.exe\" *" or + registry_data like "*bitsadmin *" or + registry_data like "*bitsadmin.exe *" or + registry_data like "*bitsadmin.exe\" *" or + registry_data like "*wscript *" or + registry_data like "*wscript.exe *" or + registry_data like "*wscript.exe\" *" or + registry_data like "*cscript *" or + registry_data like "*cscript.exe *" or + registry_data like "*cscript.exe\" *" or + registry_data like "*conhost *" or + registry_data like "*conhost.exe *" or + registry_data like "*conhost.exe\" *" or + registry_data like "*forfiles *" or + registry_data like "*forfiles.exe *" or + registry_data like "*forfiles.exe\" *" +| keep _id, _version, _index, data_stream.namespace, @timestamp, event.dataset, user.id, user.name, user.domain, host.id, host.name, agent.id, process.name, process.entity_id, process.executable, process.pid, registry.data.strings, registry.path, registry.value + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Execution +** ID: TA0002 +** Reference URL: https://attack.mitre.org/tactics/TA0002/ +* Technique: +** Name: Command and Scripting Interpreter +** ID: T1059 +** Reference URL: https://attack.mitre.org/techniques/T1059/ +* Sub-technique: +** Name: PowerShell +** ID: T1059.001 +** Reference URL: https://attack.mitre.org/techniques/T1059/001/ +* Sub-technique: +** Name: Windows Command Shell +** ID: T1059.003 +** Reference URL: https://attack.mitre.org/techniques/T1059/003/ +* Technique: +** Name: User Execution +** ID: T1204 +** Reference URL: https://attack.mitre.org/techniques/T1204/ +* Sub-technique: +** Name: Malicious File +** ID: T1204.002 +** Reference URL: https://attack.mitre.org/techniques/T1204/002/ +* Sub-technique: +** Name: Malicious Copy and Paste +** ID: T1204.004 +** Reference URL: https://attack.mitre.org/techniques/T1204/004/ +* Tactic: +** Name: Defense Evasion +** ID: TA0005 +** Reference URL: https://attack.mitre.org/tactics/TA0005/ +* Technique: +** Name: System Binary Proxy Execution +** ID: T1218 +** Reference URL: https://attack.mitre.org/techniques/T1218/ +* Sub-technique: +** Name: Mshta +** ID: T1218.005 +** Reference URL: https://attack.mitre.org/techniques/T1218/005/ +* Sub-technique: +** Name: Msiexec +** ID: T1218.007 +** Reference URL: https://attack.mitre.org/techniques/T1218/007/ +* Sub-technique: +** Name: Rundll32 +** ID: T1218.011 +** Reference URL: https://attack.mitre.org/techniques/T1218/011/ +* Tactic: +** Name: Initial Access +** ID: TA0001 +** Reference URL: https://attack.mitre.org/tactics/TA0001/ +* Technique: +** Name: Phishing +** ID: T1566 +** Reference URL: https://attack.mitre.org/techniques/T1566/ +* Sub-technique: +** Name: Spearphishing Attachment +** ID: T1566.001 +** Reference URL: https://attack.mitre.org/techniques/T1566/001/ +* Sub-technique: +** Name: Spearphishing Link +** ID: T1566.002 +** Reference URL: https://attack.mitre.org/techniques/T1566/002/ +* Tactic: +** Name: Command and Control +** ID: TA0011 +** Reference URL: https://attack.mitre.org/tactics/TA0011/ +* Technique: +** Name: Ingress Tool Transfer +** ID: T1105 +** Reference URL: https://attack.mitre.org/techniques/T1105/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-potential-netscaler-log-poisoning-command-injection-attempt.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-potential-netscaler-log-poisoning-command-injection-attempt.asciidoc new file mode 100644 index 0000000000..066385d440 --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-potential-netscaler-log-poisoning-command-injection-attempt.asciidoc @@ -0,0 +1,205 @@ +[[prebuilt-rule-8-19-35-potential-netscaler-log-poisoning-command-injection-attempt]] +=== Potential NetScaler Log Poisoning Command Injection Attempt + +Detects shell syntax in NetScaler Pitboss records or in Citrix records that combine Pitboss, packet-engine, or core terminology with shell syntax. This may indicate that attacker-controlled data poisoned an appliance log consumed by a privileged script. The behavior includes CVE-2026-88771, but the detection is intended to identify similar NetScaler log-poisoning command-injection attempts without requiring a specific vulnerability, failure phrase, or command. + +*Rule type*: eql + +*Rule indices*: + +* logs-citrix_adc.log-* + +*Severity*: medium + +*Risk score*: 47 + +*Runs every*: 5m + +*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://support.citrix.com/external/article/CTX697096 +* https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/ +* https://www.cisa.gov/news-events/alerts/2026/09/27/critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway +* https://www.elastic.co/docs/reference/integrations/citrix_adc + +*Tags*: + +* Domain: Network +* Platform: Citrix +* Use Case: Network Security Monitoring +* Use Case: Threat Detection +* Use Case: Vulnerability +* Tactic: Initial Access +* Tactic: Execution +* Data Source: Citrix ADC +* Resources: Investigation Guide +* Threat: Vulnerability Exploit +* Rule Type: Event Correlation (EQL) +* Vuln: CVE-2026-88771 + +*Version*: 1 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + + +*Investigating Potential NetScaler Log Poisoning Command Injection Attempt* + + +NetScaler emits Pitboss records for packet-engine process monitoring and recovery. Shell separators, command +substitution, pipes, or redirection are not expected in these records. Their presence can indicate that +attacker-controlled request or authentication data was written into an appliance log in a form that may later be +interpreted by a privileged log-processing, diagnostic, or core-handling script. + +CVE-2026-88771 is one example of this behavior. Its public exploit family forges a Pitboss/PPE failure record containing +an `NSPPE` token and shell syntax that can later be processed by the root-running `ns_monuploadd_err.pl` script. This +rule does not require that CVE's failure phrase, endpoint, parameter, filename, token ordering, or injected command. + +> **CVE-2026-88771 indicator note**: +> During triage, specifically look for `pitboss PPE` followed by `unexpectedly died` or +> `missed too many heartbeats`, a malformed `NSPPE` value, and shell syntax. Also review requests to +> `/nf/auth/doAuthentication.do`, attacker-controlled `login` values, execution by `ns_monuploadd_err.pl`, and +> suspicious `/var/core/NSPPE-*` artifacts. No single endpoint, path, or filename is sufficient to confirm exploitation. + + +*Possible investigation steps* + + +- Preserve the complete `event.original`, remote syslog records, rotated logs, NetScaler Console results, support + bundles, packet-engine cores, snapshots, and relevant flow data before patching or rebooting. +- Identify the source address and the targeted NetScaler or virtual server. In native `CONN_DELINK` records, + `destination.ip` can represent a backend service rather than the public virtual-server address; review the raw + `Vserver`, `NatIP`, and `Destination` values when present. +- Review adjacent AAA/AAAD, authentication, login, and WAF records for the submitted username or login value, selected + request headers, action, response, and request or session identifiers. The `/nf/auth/doAuthentication.do` path is + useful context but is not proof of exploitation without the forged PPE structure. +- Determine whether the value contains a shell separator (`;`, `&&`, `||`), command substitution (backticks or `$()`), + a pipe, or redirection, and repeatedly URL-decode percent-encoded values while preserving the original bytes. +- Search remote and rotated NetScaler logs for the same value and source for at least 48 hours. A match can represent + an attempt even if `ns_monuploadd_err.pl` has not processed the poisoned record yet. +- From the first poisoned-log timestamp, hunt forward at least 24–48 hours for root shell activity, unexpected + commands, file creation, configuration or startup changes, new listeners, packet-engine failure, restart, or HA + failover. +- Review DNS, proxy, firewall, NetFlow/IPFIX, and Zeek telemetry for first-seen internet egress, payload retrieval, + long-lived outbound connections, or new internal SSH, SMB, RDP, WinRM, database, or management traffic from every + appliance identity, including NSIPs, SNIPs, HA peers, and translated egress addresses. +- If the record resembles CVE-2026-88771, verify the exact NetScaler branch and build. Fixed versions include + 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, and 13.1-37.279 FIPS/NDcPP or later, subject to current Citrix upgrade + guidance. + + +*False positive analysis* + + +- Confirm whether an authorized scanner, penetration test, synthetic log fixture, or incident-response exercise + generated the record. +- Broad internet scanners and vulnerability probes can submit POST requests to `/nf/auth/doAuthentication.do` without + carrying the CVE-2026-88771 payload. Do not classify the endpoint path, request method, or source reputation alone as + exploitation. +- A legitimate packet-engine crash or Pitboss recovery event can contain `PPE`, `NSPPE`, core-file terminology, and a + failure phrase, but should not contain the shell syntax required by this rule. Do not suppress genuine crashes + broadly. +- If a benign test is confirmed, scope any exception to the controlled source and maintenance window rather than + excluding a failure phrase or shell token globally. + + +*Response and remediation* + + +- Treat a match on an unpatched appliance as a potential root-compromise precursor. Preserve evidence, then isolate or + tightly restrict the appliance while maintaining an evidence-preserving management path. +- Upgrade to a fixed build using current Citrix guidance. Patching prevents future exploitation but does not establish + that the appliance was not already compromised. +- Run current NetScaler Console IOC and file-integrity checks. A clean scan does not prove absence of compromise. +- If command execution is confirmed, rebuild from a trusted image and rotate administrative credentials, secrets, + certificates, tokens, and backend trust material stored on or transiting the appliance. +- Restrict appliance egress and management access, and retain remote logs so a compromised appliance cannot erase the + only copy of the evidence. + + +==== Setup + + + +*Setup* + + +This rule requires the Elastic Citrix ADC integration with the `citrix_adc.log` data stream enabled. Configure NetScaler +to forward native syslog records to an Elastic Agent by TCP or UDP, or collect the corresponding log files. RFC 5424 +syslog is recommended where supported. Include system/PPE and AAA/AAAD or authentication-related records so analysts +can recover the poisoned failure text and surrounding request context. + +The integration stores the parsed inner Citrix record in `citrix.detail` and unmatched Pitboss message content in +`citrix_adc.log.message`; the rule checks both because poisoned text can appear inside another Citrix event or as a +Pitboss-class record. Enable **Preserve original event** for investigation, forward logs to a remote collector, and +retain rotated records for at least 48 hours because local evidence can be altered after root compromise and +some log consumers process records asynchronously. CVE-2026-88771 command execution can be delayed by up to 24 hours. + +This rule analyzes appliance logs rather than encrypted request payloads. It can detect the poisoned record without TLS +decryption after the attacker-controlled value is logged, but it cannot prove that the vulnerable script executed the +injected command. + + +==== Rule query + + +[source, js] +---------------------------------- +any where + data_stream.dataset == "citrix_adc.log" and + ( + ( + citrix.detail regex~ """.*pitboss.*(nsppe|ppe|packet.*engine|core).*""" and + citrix.detail like~ ( + "*;*", "*`*", "*$(*", "*&&*", "*||*", + "*%3b*", "*%60*", "*%7c*", "*%24%28*", "*%26%26*", "*%3e*", "*%3c*" + ) + ) or + ( + citrix.device_event_class_id == "PITBOSS" and + citrix_adc.log.message like~ ( + "*;*", "*`*", "*$(*", "*|*", "*>*", "*<*", "*&&*", "*||*", + "*%3b*", "*%60*", "*%7c*", "*%24%28*", "*%26%26*", "*%3e*", "*%3c*" + ) + ) + ) + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Initial Access +** ID: TA0001 +** Reference URL: https://attack.mitre.org/tactics/TA0001/ +* Technique: +** Name: Exploit Public-Facing Application +** ID: T1190 +** Reference URL: https://attack.mitre.org/techniques/T1190/ +* Tactic: +** Name: Execution +** ID: TA0002 +** Reference URL: https://attack.mitre.org/tactics/TA0002/ +* Technique: +** Name: Command and Scripting Interpreter +** ID: T1059 +** Reference URL: https://attack.mitre.org/techniques/T1059/ +* Sub-technique: +** Name: Unix Shell +** ID: T1059.004 +** Reference URL: https://attack.mitre.org/techniques/T1059/004/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-potential-terminalfix-cloudflare-lure-in-powershell.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-potential-terminalfix-cloudflare-lure-in-powershell.asciidoc new file mode 100644 index 0000000000..a1e458f518 --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-potential-terminalfix-cloudflare-lure-in-powershell.asciidoc @@ -0,0 +1,157 @@ +[[prebuilt-rule-8-19-35-potential-terminalfix-cloudflare-lure-in-powershell]] +=== Potential TerminalFix Cloudflare Lure in PowerShell + +Identifies PowerShell script blocks that print a fake Cloudflare verification lure. TerminalFix pages instruct the victim to paste a command into Windows Terminal or PowerShell. The script presents messages such as "Cloudflare verification", "Cloudflare ID:", or "I am not a robot" while it stages a payload. Review the full script block for download, extraction, and follow-on execution. + +*Rule type*: query + +*Rule indices*: + +* logs-windows.powershell* +* winlogbeat-* + +*Severity*: high + +*Risk score*: 73 + +*Runs every*: 5m + +*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://www.microsoft.com/en-us/security/blog/2026/08/28/terminalfix-campaign-deploys-reverse-tunnel-through-multistage-intrusion/ + +*Tags*: + +* Domain: Endpoint +* OS: Windows +* Use Case: Threat Detection +* Tactic: Execution +* Tactic: Initial Access +* Data Source: PowerShell Logs +* Resources: Investigation Guide +* Threat: ClickFix +* Rule Type: Custom Query (KQL) +* Platform: Windows + +*Version*: 1 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + + +*Investigating Potential TerminalFix Cloudflare Lure in PowerShell* + + + +*Possible investigation steps* + + +- What lure text was executed, and what command sits around it? + - Why: TerminalFix pastes a multi-line PowerShell script that prints a fake Cloudflare check. Script block logging records that text even when the process command line only shows the host binary. + - Focus: `powershell.file.script_block_text` for "Cloudflare verification", "Cloudflare ID:", or "I am not a robot", then the surrounding download, extract, start-process, or hidden-window statements. + - Implication: escalate when the lure is paired with a download, archive extraction, encoded command, or a launch of another script, batch file, or executable. Lower suspicion only when the same text is a bounded lab reproduction with no retrieval or second stage. + +- Is this fragment the whole script? + - Why: one pasted script can be split across multiple 4104 events. + - Focus: `powershell.file.script_block_id`, `powershell.sequence`, and `powershell.total` on the same `host.id`. Order the fragments by sequence and read the reconstructed script. + - Implication: escalate when a later fragment retrieves a payload, writes under a user-writable or ProgramData path, or starts a follow-on process. A single fragment that only prints the lure leaves the rest of the script unresolved. + +- Did the script stage or launch a payload? + - Focus: paths, URLs, and executables named in the reconstructed script. On the same `host.id`, review file and process events in a tight window around the alert for archives, extracted directories, `cmd.exe`, `powershell.exe`, or an unexpected executable start. + - Hint: if `process.entity_id` is absent, fall back to `host.id` plus `process.pid`. + - Implication: escalate when a file lands outside a recognized installer path, a batch or executable starts from that location, or the script reaches an unusual domain or IP. Missing file or network telemetry leaves those questions unresolved. + +- How was this PowerShell instance started? + - Focus: the process start for this `process.pid` on `host.id`, including `process.parent.name`, `process.parent.executable`, `process.command_line`, `user.id`, and `user.name`. + - Implication: escalate when Windows Terminal, a console host, or explorer starts PowerShell for an end user just after browser activity. A scheduled admin task is lower suspicion only when the script content is that task and contains no lure-plus-payload behavior. + +- Escalate when the Cloudflare lure is paired with retrieval, staging, or a second-stage process, or when related alerts show the same paste on this user or host. Close only when the script text, user, and host bind to one authorized simulation or lab workflow with no contradiction. If evidence is mixed or visibility is incomplete, preserve evidence and escalate. + + +*False positive analysis* + + +- Security-awareness, phishing-simulation, red-team, and malware-analysis labs can paste this lure into PowerShell. Confirm one workflow: the `powershell.file.script_block_text` value, the expected parent process, and a bounded `user.id` / `host.id`, with no retrieval or second stage outside the exercise. +- Before an exception, require the same script fragment, `user.id`, and `host.id` across prior alerts from this rule. Avoid exceptions on the lure phrases, `powershell.exe`, or `user.name` alone. + + +*Response and remediation* + + +- If confirmed benign, reverse temporary containment and record the script text, parent process, `user.id`, and `host.id` that proved the workflow. Create an exception only when that exact workflow recurs. +- If suspicious but unconfirmed, export the script block events, the reconstructed script, `powershell.file.script_block_id`, and any child process, file, and destination evidence before cleanup. Apply reversible controls first, such as temporary destination blocks, a browser-session reset, or heightened monitoring. Isolate the host when retrieval or second-stage execution makes continued connectivity risky. +- If confirmed malicious, isolate the host, then terminate the PowerShell instance and suspicious descendants after recording identifiers. Remove staged archives, scripts, and payloads, and block confirmed domains, IPs, hashes, or URLs. Reset credentials only when the investigation shows account misuse. +- Post-incident hardening: keep PowerShell script block logging enabled, warn users that a real Cloudflare check never asks them to paste a command into a terminal, and record the lure wording and paste-run chain in the case notes. + + +==== Setup + + + +*Setup* + + +PowerShell Script Block Logging must be enabled to generate the events used by this rule (e.g., 4104). +Setup instructions: https://ela.st/powershell-logging-setup + + +==== Rule query + + +[source, js] +---------------------------------- +host.os.type:windows and event.category:process and +event.provider:("Microsoft-Windows-PowerShell" or "PowerShellCore") and +event.action:"Execute a Remote Command" and +powershell.file.script_block_text:( + ("Clear-Host" or "Write-Host" or "Write-Output" or "Write-Warning" or "cls;" or echo or WriteLine) and + ("Cloudflare ID:" or "Cloudflare Services respond" or "Cloudflare verification" or "I am not a robot" or "I'm not a robot") +) + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Execution +** ID: TA0002 +** Reference URL: https://attack.mitre.org/tactics/TA0002/ +* Technique: +** Name: Command and Scripting Interpreter +** ID: T1059 +** Reference URL: https://attack.mitre.org/techniques/T1059/ +* Sub-technique: +** Name: PowerShell +** ID: T1059.001 +** Reference URL: https://attack.mitre.org/techniques/T1059/001/ +* Technique: +** Name: User Execution +** ID: T1204 +** Reference URL: https://attack.mitre.org/techniques/T1204/ +* Sub-technique: +** Name: Malicious Copy and Paste +** ID: T1204.004 +** Reference URL: https://attack.mitre.org/techniques/T1204/004/ +* Tactic: +** Name: Initial Access +** ID: TA0001 +** Reference URL: https://attack.mitre.org/tactics/TA0001/ +* Technique: +** Name: Drive-by Compromise +** ID: T1189 +** Reference URL: https://attack.mitre.org/techniques/T1189/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-privilege-escalation-via-parallels-appliance-extract-argument-injection.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-privilege-escalation-via-parallels-appliance-extract-argument-injection.asciidoc new file mode 100644 index 0000000000..b80d7c9513 --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-privilege-escalation-via-parallels-appliance-extract-argument-injection.asciidoc @@ -0,0 +1,114 @@ +[[prebuilt-rule-8-19-35-privilege-escalation-via-parallels-appliance-extract-argument-injection]] +=== Privilege Escalation via Parallels Appliance Extract Argument Injection + +Identifies the Parallels Desktop root dispatcher (prl_disp_service) spawning tar/bsdtar with more arguments than its fixed extract command uses. The dispatcher always runs a 5-token command (tar -xf -C ), so any additional arguments indicate an attacker-controlled folder name injecting extra tar flags. On macOS these flags let tar read or write attacker-chosen paths or execute an external program as root, resulting in local privilege escalation (CVE-2026-90894, Parallels Desktop < 27.0.0). + +*Rule type*: esql + +*Rule indices*: None + +*Severity*: high + +*Risk score*: 73 + +*Runs every*: 5m + +*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://research.jfrog.com/vulnerabilities/parallels-desktop-is-vulnerable-to-a-local-privilege-escalation-via-appliance-extract-argument-injection-cve-2026-90894/ +* https://www.cve.org/CVERecord?id=CVE-2026-90894 + +*Tags*: + +* Domain: Endpoint +* Platform: macOS +* OS: macOS +* Rule Type: ESQL +* Use Case: Threat Detection +* Tactic: Privilege Escalation +* Tactic: Defense Evasion +* Data Source: Elastic Defend +* Vuln: CVE-2026-90894 +* Resources: Investigation Guide +* Use Case: Vulnerability + +*Version*: 1 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + + +*Investigating Privilege Escalation via Parallels Appliance Extract Argument Injection* + + +Parallels Desktop runs prl_disp_service as root and exposes a world-writable socket that any local account can +reach without admin rights. On builds before 27.0.0 the appliance-install path re-tokenizes a tar command +string, letting an attacker-controlled folder name inject additional tar flags. A --use-compress-program value +pointing at an attacker-writable path (commonly /tmp) is executed as root. + +- Review process.args for the injected flag and the program it points to; a path under /tmp, /var/tmp, or a +user-writable location is a strong signal of exploitation. +- Inspect the child process the injected program spawned (parent tar/bsdtar, running as root) and any files it +created or modified. +- Confirm the host's Parallels version; builds on the 26.x line remain affected. + + +*Response and remediation* + + +- Isolate the host and terminate the injected program and any root children it spawned. +- Upgrade Parallels Desktop to 27.0.0 or later; on hosts still on 26.x, restrict local login as an interim +control since any local account can reach the dispatcher socket. + + +==== Rule query + + +[source, js] +---------------------------------- +FROM logs-endpoint.events.process-* METADATA _id, _index, _version +| WHERE host.os.type == "macos" + AND process.parent.name == "prl_disp_service" + AND process.name IN ("tar", "bsdtar") + AND process.args_count > 5 + AND KQL("""process.args : "-xf" AND event.type : "start" """) +| EVAL process_args_joined = MV_CONCAT(process.args, " ") +| KEEP _id, _index, _version, @timestamp, data_stream.namespace, host.id, host.name, user.id, user.name, + process.entity_id, process.parent.name, process.parent.entity_id, process.name, process.executable, + process.args_count, process_args_joined + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Privilege Escalation +** ID: TA0004 +** Reference URL: https://attack.mitre.org/tactics/TA0004/ +* Technique: +** Name: Exploitation for Privilege Escalation +** ID: T1068 +** Reference URL: https://attack.mitre.org/techniques/T1068/ +* Tactic: +** Name: Defense Evasion +** ID: TA0005 +** Reference URL: https://attack.mitre.org/tactics/TA0005/ +* Technique: +** Name: Indirect Command Execution +** ID: T1202 +** Reference URL: https://attack.mitre.org/techniques/T1202/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-rpc-remote-procedure-call-from-the-internet.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-rpc-remote-procedure-call-from-the-internet.asciidoc new file mode 100644 index 0000000000..81e5041033 --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-rpc-remote-procedure-call-from-the-internet.asciidoc @@ -0,0 +1,168 @@ +[[prebuilt-rule-8-19-35-rpc-remote-procedure-call-from-the-internet]] +=== RPC (Remote Procedure Call) from the Internet + +This rule detects network events that may indicate the use of RPC traffic from the Internet. RPC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector. + +*Rule type*: query + +*Rule indices*: + +* logs-network_traffic.* +* logs-panw.panos* +* logs-fortinet_fortigate.log-* +* logs-pfsense.log-* +* logs-zeek.* +* logs-corelight.* + +*Severity*: high + +*Risk score*: 73 + +*Runs every*: 5m + +*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml + +*Tags*: + +* Tactic: Initial Access +* Domain: Endpoint +* Use Case: Threat Detection +* Data Source: Corelight +* Data Source: Fortinet +* Data Source: Network Traffic +* Data Source: PAN-OS +* Data Source: pfSense +* Data Source: Zeek +* Resources: Investigation Guide +* Noise: High +* Performance: Normal +* Profile: Aggressive +* Rule Type: Custom Query (KQL) +* Domain: Network +* Data Source: Network Packet Capture + +*Version*: 115 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + +> **Disclaimer**: +> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs. + + +*Investigating RPC (Remote Procedure Call) from the Internet* + + +RPC enables remote management and resource sharing, crucial for system administration. However, when exposed to the Internet, it becomes a target for attackers seeking initial access or backdoor entry. The detection rule identifies suspicious RPC traffic by monitoring TCP port 135 and filtering out internal IP addresses, flagging potential threats from external sources. + + +*Possible investigation steps* + + +- Review the source IP address of the alert to determine if it is from a known malicious actor or if it has been flagged in previous incidents. +- Check the destination IP address to confirm it belongs to a critical internal system that should not be exposed to the Internet. +- Analyze network traffic logs to identify any unusual patterns or volumes of traffic associated with the source IP, focusing on TCP port 135. +- Investigate any related alerts or logs from the same source IP or destination IP to identify potential patterns or repeated attempts. +- Assess the potential impact on the affected system by determining if any unauthorized access or changes have occurred. +- Consult threat intelligence sources to gather additional context on the source IP or any related indicators of compromise. + + +*False positive analysis* + + +- Internal testing or development environments may generate RPC traffic that appears to originate from external sources. To manage this, add the IP addresses of these environments to the exception list in the detection rule. +- Legitimate remote management activities by trusted third-party vendors could trigger the rule. Verify the IP addresses of these vendors and include them in the exception list if they are known and authorized. +- Misconfigured network devices or proxies might route internal RPC traffic through external IP addresses. Review network configurations to ensure proper routing and add any necessary exceptions for known devices. +- Cloud-based services or applications that use RPC for legitimate purposes might be flagged. Identify these services and adjust the rule to exclude their IP ranges if they are verified as non-threatening. + + +*Response and remediation* + + +- Immediately isolate the affected system from the network to prevent further unauthorized access or lateral movement by the attacker. +- Conduct a thorough examination of the system logs and network traffic to identify any unauthorized access or data exfiltration attempts. +- Apply the latest security patches and updates to the affected system to address any vulnerabilities that may have been exploited. +- Change all administrative and user credentials on the affected system and any other systems that may have been accessed using the same credentials. +- Implement network segmentation to limit the exposure of critical systems and services, ensuring that RPC services are not accessible from the Internet. +- Monitor the network for any signs of re-infection or further suspicious activity, focusing on traffic patterns similar to those identified in the initial alert. +- Escalate the incident to the security operations center (SOC) or relevant cybersecurity team for further investigation and to determine if additional systems are compromised. + +==== Rule query + + +[source, js] +---------------------------------- +(data_stream.dataset:(fortinet_fortigate.log or network_traffic.flow) or event.category:(network or network_traffic)) and + network.transport:tcp and (destination.port:135 or data_stream.dataset:zeek.dce_rpc) and + not (event.type: denied or event.action: flow_dropped or event.outcome: failure) and + not source.ip:( + 10.0.0.0/8 or + 127.0.0.0/8 or + 169.254.0.0/16 or + 172.16.0.0/12 or + 192.0.0.0/24 or + 192.0.0.0/29 or + 192.0.0.8/32 or + 192.0.0.9/32 or + 192.0.0.10/32 or + 192.0.0.170/32 or + 192.0.0.171/32 or + 192.0.2.0/24 or + 192.31.196.0/24 or + 192.52.193.0/24 or + 192.168.0.0/16 or + 192.88.99.0/24 or + 224.0.0.0/4 or + 100.64.0.0/10 or + 192.175.48.0/24 or + 198.18.0.0/15 or + 198.51.100.0/24 or + 203.0.113.0/24 or + 240.0.0.0/4 or + "::1" or + "FE80::/10" or + "FF00::/8" + ) and + destination.ip:( + 10.0.0.0/8 or + 172.16.0.0/12 or + 192.168.0.0/16 + ) and + not ( + data_stream.dataset:panw.panos and + network.application:("incomplete" or "insufficient-data" or "not-applicable") + ) + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Initial Access +** ID: TA0001 +** Reference URL: https://attack.mitre.org/tactics/TA0001/ +* Technique: +** Name: External Remote Services +** ID: T1133 +** Reference URL: https://attack.mitre.org/techniques/T1133/ +* Technique: +** Name: Exploit Public-Facing Application +** ID: T1190 +** Reference URL: https://attack.mitre.org/techniques/T1190/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-rpc-remote-procedure-call-to-the-internet.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-rpc-remote-procedure-call-to-the-internet.asciidoc new file mode 100644 index 0000000000..832df78c0b --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-rpc-remote-procedure-call-to-the-internet.asciidoc @@ -0,0 +1,176 @@ +[[prebuilt-rule-8-19-35-rpc-remote-procedure-call-to-the-internet]] +=== RPC (Remote Procedure Call) to the Internet + +This rule detects network events that may indicate the use of RPC traffic to the Internet. RPC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector. + +*Rule type*: query + +*Rule indices*: + +* logs-network_traffic.* +* logs-panw.panos* +* logs-fortinet_fortigate.log-* +* logs-pfsense.log-* +* logs-zeek.* +* logs-corelight.* + +*Severity*: high + +*Risk score*: 73 + +*Runs every*: 5m + +*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml + +*Tags*: + +* Tactic: Initial Access +* Tactic: Lateral Movement +* Domain: Endpoint +* Use Case: Threat Detection +* Data Source: Corelight +* Data Source: Fortinet +* Data Source: PAN-OS +* Data Source: Network Traffic +* Data Source: pfSense +* Data Source: Zeek +* Resources: Investigation Guide +* Noise: High +* Performance: Normal +* Profile: Aggressive +* Rule Type: Custom Query (KQL) +* Domain: Network +* Data Source: Network Packet Capture + +*Version*: 115 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + +> **Disclaimer**: +> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs. + + +*Investigating RPC (Remote Procedure Call) to the Internet* + + +RPC enables remote management and resource sharing across networks, crucial for system administration. However, when exposed to the Internet, it becomes a target for attackers seeking initial access or backdoor entry. The detection rule identifies suspicious RPC traffic from internal IPs to external networks, flagging potential exploitation attempts by monitoring specific ports and IP ranges. + + +*Possible investigation steps* + + +- Review the source IP address from the alert to identify the internal system initiating the RPC traffic. Check if this IP belongs to a known or authorized device within the network. +- Examine the destination IP address to determine if it is a known or suspicious external entity. Use threat intelligence sources to assess if the IP has been associated with malicious activity. +- Analyze the network traffic logs for the specific event.dataset values (network_traffic.flow or zeek.dce_rpc) to gather more context about the nature and volume of the RPC traffic. +- Investigate the destination port, specifically port 135, to confirm if the traffic is indeed RPC-related and assess if there are any legitimate reasons for this communication. +- Check for any recent changes or anomalies in the network configuration or system settings of the source IP that might explain the unexpected RPC traffic. +- Correlate this alert with other security events or logs to identify any patterns or additional indicators of compromise that might suggest a broader attack campaign. + + +*False positive analysis* + + +- Internal testing environments may generate RPC traffic to external IPs for legitimate purposes. Identify and document these environments, then create exceptions in the detection rule to prevent unnecessary alerts. +- Cloud-based services or applications that require RPC communication for integration or management might trigger false positives. Review these services and whitelist their IP addresses if they are verified as non-threatening. +- VPN or remote access solutions that use RPC for secure connections can be mistaken for suspicious activity. Ensure that the IP ranges of these solutions are excluded from the rule to avoid false alerts. +- Automated backup or synchronization tools that use RPC to communicate with external servers could be flagged. Verify these tools and add their destination IPs to an exception list if they are part of routine operations. + + +*Response and remediation* + + +- Immediately isolate the affected system from the network to prevent further unauthorized access or data exfiltration. +- Conduct a thorough analysis of the affected system to identify any unauthorized changes or installed backdoors, focusing on processes and services related to RPC. +- Revoke any compromised credentials and enforce a password reset for all accounts that may have been accessed or used during the incident. +- Apply necessary patches and updates to the affected system and any other systems with similar vulnerabilities to mitigate the risk of exploitation. +- Monitor network traffic for any signs of lateral movement or additional suspicious activity, particularly focusing on RPC-related traffic. +- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if additional systems are affected. +- Implement enhanced logging and monitoring for RPC traffic to detect and respond to similar threats more effectively in the future. + +==== Rule query + + +[source, js] +---------------------------------- +(data_stream.dataset:(fortinet_fortigate.log or network_traffic.flow) or event.category:(network or network_traffic)) and + network.transport:tcp and (destination.port:135 or data_stream.dataset:zeek.dce_rpc) and + source.ip:( + 10.0.0.0/8 or + 172.16.0.0/12 or + 192.168.0.0/16 + ) and + not destination.ip:( + 10.0.0.0/8 or + 127.0.0.0/8 or + 169.254.0.0/16 or + 172.16.0.0/12 or + 192.0.0.0/24 or + 192.0.0.0/29 or + 192.0.0.8/32 or + 192.0.0.9/32 or + 192.0.0.10/32 or + 192.0.0.170/32 or + 192.0.0.171/32 or + 192.0.2.0/24 or + 192.31.196.0/24 or + 192.52.193.0/24 or + 192.168.0.0/16 or + 192.88.99.0/24 or + 224.0.0.0/4 or + 100.64.0.0/10 or + 192.175.48.0/24 or + 198.18.0.0/15 or + 198.51.100.0/24 or + 203.0.113.0/24 or + 240.0.0.0/4 or + "::1" or + "FE80::/10" or + "FF00::/8" + ) and + not ( + data_stream.dataset:panw.panos and + network.application:("incomplete" or "insufficient-data" or "not-applicable") + ) + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Initial Access +** ID: TA0001 +** Reference URL: https://attack.mitre.org/tactics/TA0001/ +* Technique: +** Name: Exploit Public-Facing Application +** ID: T1190 +** Reference URL: https://attack.mitre.org/techniques/T1190/ +* Tactic: +** Name: Lateral Movement +** ID: TA0008 +** Reference URL: https://attack.mitre.org/tactics/TA0008/ +* Technique: +** Name: Remote Services +** ID: T1021 +** Reference URL: https://attack.mitre.org/techniques/T1021/ +* Sub-technique: +** Name: Distributed Component Object Model +** ID: T1021.003 +** Reference URL: https://attack.mitre.org/techniques/T1021/003/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-smb-windows-file-sharing-activity-from-the-internet.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-smb-windows-file-sharing-activity-from-the-internet.asciidoc new file mode 100644 index 0000000000..0fc9eedbc8 --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-smb-windows-file-sharing-activity-from-the-internet.asciidoc @@ -0,0 +1,179 @@ +[[prebuilt-rule-8-19-35-smb-windows-file-sharing-activity-from-the-internet]] +=== SMB (Windows File Sharing) Activity from the Internet + +This rule detects network events that may indicate inbound Windows file sharing (SMB or CIFS) traffic originating from the Internet. SMB should never be directly reachable from the Internet, as it is a primary target for exploitation by threat actors seeking initial access. Inbound SMB from a public IP is a direct precondition for attacks such as EternalBlue (MS17-010) and related SMB remote code execution vulnerabilities. + +*Rule type*: new_terms + +*Rule indices*: + +* logs-corelight.* +* logs-network_traffic.* +* logs-panw.panos* +* logs-fortinet_fortigate.log-* +* logs-pfsense.log-* +* logs-zeek.* + +*Severity*: high + +*Risk score*: 73 + +*Runs every*: 5m + +*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml +* https://msrc.microsoft.com/update-guide/vulnerability/CVE-2017-0144 + +*Tags*: + +* Tactic: Initial Access +* Domain: Network +* Use Case: Threat Detection +* Data Source: Corelight +* Data Source: Fortinet +* Data Source: PAN-OS +* Data Source: Network Traffic +* Data Source: pfSense +* Data Source: Zeek +* Resources: Investigation Guide +* Noise: Medium +* Performance: Normal +* Rule Type: New Terms +* Data Source: Network Packet Capture + +*Version*: 4 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + +> **Disclaimer**: +> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs. + + +*Investigating SMB (Windows File Sharing) Activity from the Internet* + + +Inbound SMB from a public IP is one of the highest-signal perimeter events observable at a network boundary. SMB (ports 139/445) should never be reachable from the Internet. When it is, it is almost always either a deliberate exposure (misconfiguration) or active exploitation, both of which warrant investigation. Classic attacks in this category include EternalBlue (MS17-010), WannaCry, NotPetya, and subsequent SMB RCE chains. + +This rule uses `new_terms` to suppress repeat scans from the same source, surfacing only the first time each external IP reaches an internal host on SMB ports. + + +*Possible investigation steps* + + +- Identify the destination IP. Determine whether this host has a legitimate reason to expose SMB to the Internet (nearly always: no). Check whether the port was reachable externally due to a misconfigured NAT rule or security group. +- Review firewall allow/deny context alongside the alert. If the session was blocked, the immediate risk is lower, but the exposure is still worth addressing. +- Check the source IP against threat intelligence. Mass-Internet SMB scanning is common and source IPs are frequently tracked in public feeds. +- Correlate with endpoint telemetry on the destination host: look for process creation events, new services, or lateral movement activity that might indicate exploitation succeeded. +- Review patch status of the destination host for MS17-010 and subsequent SMB vulnerabilities. +- Check whether this external IP has been seen targeting other internal hosts or ports in the same timeframe, which would indicate a broader scan or intrusion campaign. + + +*False positive analysis* + + +- Hosts with public IPs that explicitly expose SMB (rare, but occurs in some lab or legacy setups): this is the intended detection; the exposure is itself the finding. Add a per-host exception only after confirming the exposure is authorized and risk-accepted. +- Site-to-site VPN or MPLS setups where a remote office segment routes through a public IP and appears as an external source: confirm with network architecture and add the IP range to the exclusion list if legitimate. + + +*Response and remediation* + + +- If the destination host is reachable from the Internet on port 139 or 445, immediately close the exposure at the firewall or security group level. This is the single most impactful remediation step. +- Isolate the destination host if any signs of compromise exist (unexpected processes, new scheduled tasks, lateral movement alerts). +- Patch the host for MS17-010 and related SMB vulnerabilities if not already current. +- Audit NAT and firewall rules to ensure no other hosts have inadvertent Internet-facing SMB exposure. +- Review the pfSense / network perimeter ruleset to confirm that inbound TCP 139/445 is explicitly denied at the border. + +This rule requires network flow or firewall log data that captures inbound TCP connections with 5-tuple information (source IP, destination IP, destination port). Compatible data sources include: + +- **Elastic Network Traffic** integration (Packetbeat) +- **Corelight** integration (network and SMB telemetry) +- **Fortinet FortiGate** integration (firewall traffic logs) +- **PAN-OS** integration (Palo Alto Networks firewall logs) +- **pfSense** integration (syslog-based firewall flow logs; requires pfSense syslog forwarding enabled) +- **Zeek** integration (SMB-specific log types: `smb_cmd`, `smb_files`, `smb_mapping`) + +For pfSense, ensure the firewall logging rules are configured to log connection events and that the Elastic pfSense integration is forwarding logs to the `logs-pfsense.log-*` data stream. + +==== Setup + + +This rule requires network flow or firewall log data that captures inbound TCP connections with 5-tuple information (source IP, destination IP, destination port). Compatible data sources include: + +Elastic Network Traffic integration (Packetbeat)Corelight integration (network and SMB telemetry)Fortinet FortiGate integration (firewall traffic logs)PAN-OS integration (Palo Alto Networks firewall logs)pfSense integration (syslog-based firewall flow logs; requires pfSense syslog forwarding enabled)Zeek integration (SMB-specific log types: `smb_cmd`, `smb_files`, `smb_mapping`) +For pfSense, ensure the firewall logging rules are configured to log connection events and that the Elastic pfSense integration is forwarding logs to the `logs-pfsense.log-*` data stream. + +==== Rule query + + +[source, js] +---------------------------------- +(data_stream.dataset:(fortinet_fortigate.log or network_traffic.flow or pfsense.log or zeek.smb_cmd or zeek.smb_files or zeek.smb_mapping) or event.category:(network or network_traffic)) + and network.transport:tcp and destination.port:(139 or 445) + and destination.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) + and not source.ip:( + 10.0.0.0/8 + or 100.64.0.0/10 + or 127.0.0.0/8 + or 169.254.0.0/16 + or 172.16.0.0/12 + or 192.0.0.0/24 + or 192.0.0.0/29 + or 192.0.0.10/32 + or 192.0.0.170/32 + or 192.0.0.171/32 + or 192.0.0.8/32 + or 192.0.0.9/32 + or 192.0.2.0/24 + or 192.168.0.0/16 + or 192.175.48.0/24 + or 192.31.196.0/24 + or 192.52.193.0/24 + or 192.88.99.0/24 + or 198.18.0.0/15 + or 198.51.100.0/24 + or 203.0.113.0/24 + or 224.0.0.0/4 + or 240.0.0.0/4 + or "::1" + or "FE80::/10" + or "FF00::/8" + ) and + not ( + data_stream.dataset:panw.panos and + network.application:("incomplete" or "insufficient-data" or "not-applicable") + ) + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Initial Access +** ID: TA0001 +** Reference URL: https://attack.mitre.org/tactics/TA0001/ +* Technique: +** Name: External Remote Services +** ID: T1133 +** Reference URL: https://attack.mitre.org/techniques/T1133/ +* Technique: +** Name: Exploit Public-Facing Application +** ID: T1190 +** Reference URL: https://attack.mitre.org/techniques/T1190/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-smb-windows-file-sharing-activity-to-the-internet.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-smb-windows-file-sharing-activity-to-the-internet.asciidoc new file mode 100644 index 0000000000..b321afe857 --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-smb-windows-file-sharing-activity-to-the-internet.asciidoc @@ -0,0 +1,166 @@ +[[prebuilt-rule-8-19-35-smb-windows-file-sharing-activity-to-the-internet]] +=== SMB (Windows File Sharing) Activity to the Internet + +This rule detects network events that may indicate the use of Windows file sharing (also called SMB or CIFS) traffic to the Internet. SMB is commonly used within networks to share files, printers, and other system resources amongst trusted systems. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector or for data exfiltration. + +*Rule type*: new_terms + +*Rule indices*: + +* logs-network_traffic.* +* logs-panw.panos* +* logs-fortinet_fortigate.log-* +* logs-pfsense.log-* +* logs-zeek.* +* logs-corelight.* + +*Severity*: medium + +*Risk score*: 47 + +*Runs every*: 5m + +*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml + +*Tags*: + +* Tactic: Initial Access +* Tactic: Exfiltration +* Domain: Network +* Use Case: Threat Detection +* Data Source: Corelight +* Data Source: Fortinet +* Data Source: PAN-OS +* Data Source: Network Traffic +* Data Source: pfSense +* Data Source: Zeek +* Resources: Investigation Guide +* Noise: High +* Performance: Normal +* Profile: Aggressive +* Rule Type: New Terms +* Data Source: Network Packet Capture + +*Version*: 115 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + +> **Disclaimer**: +> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs. + + +*Investigating SMB (Windows File Sharing) Activity to the Internet* + + +SMB, a protocol for sharing files and resources within trusted networks, is vulnerable when exposed to the Internet. Adversaries exploit it for unauthorized access or data theft. The detection rule identifies suspicious SMB traffic from internal IPs to external networks, flagging potential threats by monitoring specific ports and excluding known safe IP ranges. + + +*Possible investigation steps* + + +- Review the source IP address from the alert to identify the internal system initiating the SMB traffic. Check if this IP belongs to a known device or user within the organization. +- Investigate the destination IP address to determine if it is associated with any known malicious activity or if it belongs to a legitimate external service that might require SMB access. +- Analyze network logs to identify any patterns or anomalies in the SMB traffic, such as unusual data transfer volumes or repeated access attempts, which could indicate malicious activity. +- Check for any recent changes or updates on the source system that might explain the SMB traffic, such as new software installations or configuration changes. +- Correlate the alert with other security events or logs, such as authentication logs or endpoint security alerts, to gather additional context and determine if this is part of a broader attack or isolated incident. +- Consult threat intelligence sources to see if there are any known vulnerabilities or exploits related to the SMB traffic observed, which could provide insight into potential attack vectors. + + +*False positive analysis* + + +- Internal testing environments may generate SMB traffic to external IPs for legitimate reasons. Identify and whitelist these IPs to prevent false positives. +- Cloud services or remote backup solutions might use SMB for data transfer. Verify these services and add their IP ranges to the exception list if they are trusted. +- VPN connections can sometimes appear as external traffic. Ensure that VPN IP ranges are included in the list of known safe IPs to avoid misclassification. +- Misconfigured network devices might inadvertently route SMB traffic externally. Regularly audit network configurations and update the rule exceptions to include any legitimate device IPs. +- Some third-party applications may use SMB for updates or data synchronization. Confirm the legitimacy of these applications and exclude their associated IPs from the detection rule. + + +*Response and remediation* + + +- Immediately isolate the affected system from the network to prevent further unauthorized access or data exfiltration. +- Conduct a thorough review of firewall and network configurations to ensure SMB traffic is not allowed to the Internet, and block any unauthorized outbound SMB traffic on ports 139 and 445. +- Perform a comprehensive scan of the isolated system for malware or unauthorized access tools, focusing on identifying any backdoors or persistence mechanisms. +- Reset credentials and review access permissions for any accounts that may have been compromised or used in the suspicious activity. +- Notify the security operations center (SOC) and relevant stakeholders about the incident for further analysis and potential escalation. +- Implement additional monitoring and logging for SMB traffic to detect any future unauthorized attempts to access the Internet. +- Review and update security policies and procedures to prevent similar incidents, ensuring that SMB services are only accessible within trusted network segments. + +==== Rule query + + +[source, js] +---------------------------------- +(data_stream.dataset:(fortinet_fortigate.log or network_traffic.flow or zeek.smb_cmd or zeek.smb_files or zeek.smb_mapping) or event.category:(network or network_traffic)) + and network.transport:tcp and destination.port:(139 or 445) + and source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) + and not destination.ip:(10.0.0.0/8 + or 100.64.0.0/10 + or 127.0.0.0/8 + or 169.254.0.0/16 + or 172.16.0.0/12 + or 192.0.0.0/24 + or 192.0.0.0/29 + or 192.0.0.10/32 + or 192.0.0.170/32 + or 192.0.0.171/32 + or 192.0.0.8/32 + or 192.0.0.9/32 + or 192.0.2.0/24 + or 192.168.0.0/16 + or 192.175.48.0/24 + or 192.31.196.0/24 + or 192.52.193.0/24 + or 192.88.99.0/24 + or 198.18.0.0/15 + or 198.51.100.0/24 + or 203.0.113.0/24 + or 224.0.0.0/4 + or 240.0.0.0/4 + or "::1" + or "FE80::/10" + or "FF00::/8") + and not ( + data_stream.dataset:panw.panos and + network.application:("incomplete" or "insufficient-data" or "not-applicable") + ) + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Initial Access +** ID: TA0001 +** Reference URL: https://attack.mitre.org/tactics/TA0001/ +* Technique: +** Name: Exploit Public-Facing Application +** ID: T1190 +** Reference URL: https://attack.mitre.org/techniques/T1190/ +* Tactic: +** Name: Exfiltration +** ID: TA0010 +** Reference URL: https://attack.mitre.org/tactics/TA0010/ +* Technique: +** Name: Exfiltration Over Alternative Protocol +** ID: T1048 +** Reference URL: https://attack.mitre.org/techniques/T1048/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-temporarily-scheduled-task-creation.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-temporarily-scheduled-task-creation.asciidoc new file mode 100644 index 0000000000..e7332bad0d --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-temporarily-scheduled-task-creation.asciidoc @@ -0,0 +1,166 @@ +[[prebuilt-rule-8-19-35-temporarily-scheduled-task-creation]] +=== Temporarily Scheduled Task Creation + +Indicates the creation and deletion of a scheduled task within a short time interval. Adversaries can use these to proxy malicious execution via the schedule service and perform clean up. + +*Rule type*: eql + +*Rule indices*: + +* logs-system.security* +* logs-windows.forwarded* +* winlogbeat-* + +*Severity*: medium + +*Risk score*: 47 + +*Runs every*: 5m + +*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4698 + +*Tags*: + +* Domain: Endpoint +* OS: Windows +* Use Case: Threat Detection +* Tactic: Persistence +* Tactic: Execution +* Data Source: Windows Security Event Logs +* Resources: Investigation Guide +* Noise: High +* Performance: Normal +* Profile: Aggressive +* Rule Type: Event Correlation (EQL) +* Platform: Windows + +*Version*: 116 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + +> **Disclaimer**: +> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs. + + +*Investigating Temporarily Scheduled Task Creation* + + +Scheduled tasks in Windows environments automate routine tasks, but adversaries exploit them for persistence and execution by creating and quickly deleting tasks to mask malicious activity. The detection rule identifies such behavior by tracking task creation and deletion within a short timeframe, flagging potential misuse when these actions occur in rapid succession without typical user patterns. + + +*Possible investigation steps* + + +- Review the winlog.computer_name field to identify the affected system and determine if it is a critical asset or part of a sensitive network segment. +- Examine the winlog.event_data.TaskName to understand the nature of the task created and deleted, and assess if it aligns with known legitimate tasks or appears suspicious. +- Investigate the user.name associated with the task creation and deletion events to determine if the activity was performed by a legitimate user or potentially compromised account. +- Check for any related events or logs around the same timeframe on the affected system to identify any additional suspicious activities or anomalies. +- Correlate the task creation and deletion events with other security alerts or incidents to determine if this activity is part of a broader attack campaign or isolated incident. + + +*False positive analysis* + + +- Routine administrative tasks may trigger the rule if system administrators frequently create and delete scheduled tasks for maintenance purposes. To manage this, create exceptions for known administrative accounts or specific task names that are part of regular operations. +- Automated scripts or software updates that temporarily create scheduled tasks can also cause false positives. Identify these scripts or update processes and exclude their associated user accounts or task names from the detection rule. +- Some legitimate applications may use scheduled tasks for temporary operations. Review application documentation to confirm such behavior and exclude these applications by their task names or associated user accounts. +- In environments with frequent testing or development activities, developers might create and delete tasks as part of their workflow. Consider excluding developer accounts or specific task names used in testing environments to reduce noise. +- Scheduled tasks created by monitoring or security tools for short-lived operations can be mistaken for malicious activity. Verify these tools' behavior and exclude their task names or user accounts if they are known to be safe. + + +*Response and remediation* + + +- Immediately isolate the affected system from the network to prevent further malicious activity and lateral movement. +- Review the scheduled task details, including the task name and associated scripts or executables, to identify any malicious payloads or commands. +- Terminate any malicious processes or executables identified from the scheduled task analysis to stop ongoing threats. +- Restore any altered or deleted system files from a known good backup to ensure system integrity. +- Conduct a thorough scan of the affected system using updated antivirus or endpoint detection and response (EDR) tools to identify and remove any additional malware. +- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if other systems are affected. +- Implement additional monitoring and alerting for similar scheduled task activities to enhance detection and prevent recurrence of this threat. + +==== Setup + + + +*Setup* + + +Audit Other Object Access Events must be enabled to generate the events used by this rule. +Setup instructions: https://ela.st/audit-other-object-access-events + + +==== Rule query + + +[source, js] +---------------------------------- +sequence by winlog.computer_name, winlog.event_data.TaskName with maxspan=5m + [iam where host.os.type == "windows" and event.action == "scheduled-task-created" and not user.name : "*$" and + not winlog.event_data.TaskName : ( + "\\SoftLanding\\*", + "*PRTG*", + "\\MicrosoftEdgeMaintenance*", + "*\\Microsoft\\Windows\\DeviceLicensingService\\*", + "\\OneDrive Standalone Update*", + "\\PowerToys\\*", + "*Hewlett-Packard*", + "*\\HP\\HP Support Assistant\\*", + "*\\Mozilla\\*", + "\\AMDLinkUpdate", + "\\AMDInstallLauncher", + "*\\GoogleUserPEH\\*", + "\\CreateExplorerShellUnelevatedTask", + "*\\RunAADCHTestConnectivityAsSystem", + "*WaveBrowser*", + "\\CCleanerCrashReporting", + "\\TVInstallRestore" + )] + [iam where host.os.type == "windows" and event.action == "scheduled-task-deleted" and not user.name : "*$"] + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Persistence +** ID: TA0003 +** Reference URL: https://attack.mitre.org/tactics/TA0003/ +* Technique: +** Name: Scheduled Task/Job +** ID: T1053 +** Reference URL: https://attack.mitre.org/techniques/T1053/ +* Sub-technique: +** Name: Scheduled Task +** ID: T1053.005 +** Reference URL: https://attack.mitre.org/techniques/T1053/005/ +* Tactic: +** Name: Execution +** ID: TA0002 +** Reference URL: https://attack.mitre.org/tactics/TA0002/ +* Technique: +** Name: Scheduled Task/Job +** ID: T1053 +** Reference URL: https://attack.mitre.org/techniques/T1053/ +* Sub-technique: +** Name: Scheduled Task +** ID: T1053.005 +** Reference URL: https://attack.mitre.org/techniques/T1053/005/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-unusual-azure-vm-extension-detected.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-unusual-azure-vm-extension-detected.asciidoc new file mode 100644 index 0000000000..198f420bfa --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-unusual-azure-vm-extension-detected.asciidoc @@ -0,0 +1,168 @@ +[[prebuilt-rule-8-19-35-unusual-azure-vm-extension-detected]] +=== Unusual Azure VM Extension Detected + +Identifies the first time a given VM extension name is created or updated on an Azure virtual machine or VM scale set within the rule's lookback window. VM extensions run with high privilege on the guest (SYSTEM on Windows, root on Linux) and are a common code-execution and persistence primitive. The extension instance name is attacker-controlled and the Azure activity log records only that name, not the publisher or type, so the control plane cannot reliably identify the extension family (for example CustomScript). This rule therefore takes a type-agnostic ES|QL new-terms approach: it derives the host and the extension instance name from `azure.resource.name` and alerts the first time a given (host, extension name) pair is observed in the window, surfacing novel extension deployments while suppressing names a host routinely uses. + +*Rule type*: esql + +*Rule indices*: None + +*Severity*: medium + +*Risk score*: 47 + +*Runs every*: 5m + +*Searches indices from*: now-7d ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://www.netspi.com/blog/technical-blog/adversary-simulation/7-ways-to-execute-command-on-azure-virtual-machine-virtual-machine-scale-sets/ +* https://learn.microsoft.com/en-us/azure/virtual-machines/extensions/custom-script-windows +* https://learn.microsoft.com/en-us/azure/virtual-machines/extensions/overview +* https://blog.pwnedlabs.io/diving-deep-into-azure-vm-attack-vectors +* https://www.sysdig.com/blog/the-expendable-extension-name-azure-vmaccess-naming-chaos-password-resets-and-a-detection-gap + +*Tags*: + +* Domain: Cloud +* Data Source: Azure +* Data Source: Azure Activity Logs +* Use Case: Threat Detection +* Tactic: Execution +* Tactic: Persistence +* Resources: Investigation Guide +* Noise: Medium +* Performance: Fast +* Profile: Recommended +* Threat: Cloud VM Execution +* Rule Type: ES|QL +* Platform: Azure + +*Version*: 3 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + + +*Investigating Unusual Azure VM Extension Detected* + + +Identifies the first time a given VM extension name is created or updated on an Azure virtual machine or VM scale set within the +rule's lookback window. VM extensions run with high privilege on the guest (SYSTEM on Windows, root on Linux) and are a +common code-execution and persistence primitive. The extension instance name is attacker-controlled and the Azure +activity log records only that name, not the publisher or type, so the control plane cannot reliably identify the +extension family (for example CustomScript). This rule therefore takes a type-agnostic ES|QL new-terms approach: it +derives the host and the extension instance name from `azure.resource.name` and alerts the first time a given +(host, extension name) pair is observed in the window, surfacing novel extension deployments while suppressing names a +host routinely uses. + + +*Possible investigation steps* + + +- Identify the host (`Esql.vm_name`) and the full extension resource (`azure.resource.name` / `azure.resource.id`). +- Identify the acting principal: `Esql.principal_id_values`, `Esql.principal_type_values` (User vs ServicePrincipal), + `Esql.appid_values`. Service principal or managed identity deployment is more suspicious than a known admin user. +- Review the source: `Esql.source_ip_values`, `Esql.source_as_number_values`, `Esql.source_country_values`. Cloud + hosting, VPS, or anonymizing networks are more suspicious than known corporate egress. +- Was this preceded by a Run Command invocation, role assignment, or other VM operations by the same principal? +- Correlate with endpoint telemetry on the host: process activity parented by the Azure guest agent + (`WaAppAgent.exe` / `walinuxagent`) within ~120 seconds of the deployment. +- Review the principal's Entra ID sign-in logs and RBAC role assignments on the subscription, resource group, and VM. +- Retrieve the extension settings/protected settings from the VM (the activity log does not contain the script/settings + body) to assess intent. +- Pivot on the VM for credential access, new local accounts, or outbound C2 connections following the deployment. + + +*False positive analysis* + + +- This is a broad first-seen net: the first deployment of any extension name to a host alerts, so benign monitoring, + antimalware (Defender/MDE), AKS, DSC, or configuration-management extensions deployed by routine automation will + trigger. Baseline expected automation principals (`Esql.appid_values`) and extension names, and exclude verified ones. +- Automation that generates a unique extension instance name per deployment produces a new (host, name) pair every time + and will recur; if benign, exclude by the deploying principal/appid or the known naming pattern rather than per host. +- Newly provisioned VMs receiving their initial extension set are expected. Corroborate the deploying principal and + source before escalating, and treat deployments from known corporate egress by approved automation as lower confidence. + + +*Response and remediation* + + +- If unauthorized, remove the extension, isolate the VM, rotate credentials reachable from it, and review RBAC on the affected scope. +- Collect endpoint and activity log artifacts per incident procedures. + + +==== Rule query + + +[source, js] +---------------------------------- +FROM logs-azure.activitylogs-* +| WHERE event.dataset == "azure.activitylogs" + AND event.action IN ( + "MICROSOFT.COMPUTE/VIRTUALMACHINES/EXTENSIONS/WRITE", + "MICROSOFT.COMPUTE/VIRTUALMACHINESCALESETS/EXTENSIONS/WRITE" + ) + AND event.outcome IN ("success", "Success") +// azure.resource.name is "/EXTENSIONS/"; the instance name is attacker-controlled, +// so key on the host (first path element) rather than the spoofable extension name +| EVAL Esql.vm_name = MV_FIRST(SPLIT(azure.resource.name, "/")) +| EVAL Esql.extension_name = MV_LAST(SPLIT(azure.resource.name, "/")) +| STATS Esql.first_time_seen = MIN(@timestamp), + Esql.last_time_seen = MAX(@timestamp), + Esql.event_count = COUNT(*), + Esql.resource_name_values = VALUES(azure.resource.name), + Esql.resource_id_values = VALUES(azure.resource.id), + Esql.principal_id_values = VALUES(azure.activitylogs.identity.authorization.evidence.principal_id), + Esql.principal_type_values = VALUES(azure.activitylogs.identity.authorization.evidence.principal_type), + Esql.appid_values = VALUES(azure.activitylogs.identity.claims.appid), + Esql.source_ip_values = VALUES(source.ip), + Esql.source_as_number_values = VALUES(source.`as`.number), + Esql.source_country_values = VALUES(source.geo.country_name), + Esql.subscription_id_values = VALUES(azure.subscription_id) + BY Esql.vm_name, Esql.extension_name +// new terms emulation: fire when the (host, extension name) pair's first_seen falls in the +// current interval (schedule + ingest-lag buffer), i.e. it was absent from the rest of the 7-day window +| EVAL Esql.recent_minutes = DATE_DIFF("minute", Esql.first_time_seen, NOW()) +| WHERE Esql.recent_minutes <= 10 +// surface real fields for the analyst and rule exceptions +| EVAL azure.resource.name = MV_FIRST(Esql.resource_name_values), + azure.resource.id = MV_FIRST(Esql.resource_id_values), + source.ip = MV_FIRST(Esql.source_ip_values) +| KEEP azure.resource.name, azure.resource.id, source.ip, Esql.* + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Execution +** ID: TA0002 +** Reference URL: https://attack.mitre.org/tactics/TA0002/ +* Technique: +** Name: Cloud Administration Command +** ID: T1651 +** Reference URL: https://attack.mitre.org/techniques/T1651/ +* Tactic: +** Name: Persistence +** ID: TA0003 +** Reference URL: https://attack.mitre.org/tactics/TA0003/ +* Technique: +** Name: Boot or Logon Initialization Scripts +** ID: T1037 +** Reference URL: https://attack.mitre.org/techniques/T1037/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-unusual-file-creation-via-web-server.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-unusual-file-creation-via-web-server.asciidoc new file mode 100644 index 0000000000..c7ab24d727 --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rule-8-19-35-unusual-file-creation-via-web-server.asciidoc @@ -0,0 +1,207 @@ +[[prebuilt-rule-8-19-35-unusual-file-creation-via-web-server]] +=== Unusual File Creation via Web Server + +This rule leverages the "new_terms" rule type to detect unusual file creations originating from web server processes on Linux systems. Attackers may exploit web servers to maintain persistence on a compromised system, often resulting in atypical file creations. As file creations from web server processes are common, the "new_terms" rule type approach helps to identify deviations from normal behavior. + +*Rule type*: new_terms + +*Rule indices*: + +* logs-endpoint.events.file* + +*Severity*: low + +*Risk score*: 21 + +*Runs every*: 5m + +*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: None + +*Tags*: + +* Domain: Endpoint +* Domain: Web +* OS: Linux +* Use Case: Threat Detection +* Tactic: Persistence +* Tactic: Execution +* Tactic: Command and Control +* Tactic: Initial Access +* Data Source: Elastic Defend +* Resources: Investigation Guide +* Noise: High +* Performance: Slow +* Profile: Aggressive +* Threat: Web Shell +* Rule Type: New Terms +* Platform: Linux + +*Version*: 4 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + ## Triage and analysis + +> **Disclaimer**: +> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs. + + +*Investigating Unusual File Creation via Web Server* + + +This alert flags a Linux web server process creating or renaming a file in web content or application directories that it does not normally touch, which can reveal a compromised service writing attacker-controlled content. That matters because web-facing processes rarely need to drop new executable or template files outside normal deployment activity. A common pattern is an intruder exploiting a vulnerable upload handler or plugin to place a web shell, JSP, PHP, or script-backed page under the site root for persistent remote access. + + +*Possible investigation steps* + + +- Determine whether the file aligns with an approved deployment, plugin or theme update, package installation, or administrator change in the same time window by reviewing change records and system update history. +- Inspect the file contents, hash, ownership, permissions, and timestamps for signs of a web shell, dropped payload, hidden redirect, or script stager, and compare it with known-good application files from the same host or image. +- Review the web service's parent and child activity around the event for spawned shells, interpreters, archive extraction, or permission changes that would indicate exploitation followed by payload execution or persistence setup. +- Correlate nearby web access, reverse-proxy, and application log events to identify suspicious upload, template-edit, admin-panel, deserialization, or remote-code-execution requests immediately before the file appeared and any follow-up requests to the new file. +- Scope the compromise by searching the host and peer web servers for similarly named files, unexpected cron or systemd persistence, modified startup scripts, or outbound connections made by the web service account after the creation event. + + +*False positive analysis* + + +- Approved application deployment, patching, or first-run initialization can cause the web server or application server to create new files in the web root, so verify the event time against authorized change activity and confirm the file path, owner, and hash match the expected release contents. +- Legitimate web application features such as user uploads or automatic generation of images, media, attachments, or cache files can create new content under upload-facing directories, so review nearby web or application requests and confirm the file extension, location, and contents are consistent with normal business use. + + +*Response and remediation* + + +- Isolate the affected web server from the internet and internal network, remove it from the load balancer, and temporarily disable the compromised site or virtual host while keeping only secured management access for containment. +- Eradicate attacker persistence by deleting the malicious web shell or dropped script, removing any unauthorized cron jobs, systemd units, startup scripts, SSH keys, or writable symlinks created by the web service account, and disabling any backdoored application user or admin account. +- Restore the service to a known-good state by rebuilding the host from a trusted image or redeploying the application from clean source, recovering web content and configuration from a verified backup taken before the file appeared, and validating expected ownership and permissions across the web root. +- Rotate all secrets exposed to the host, including web application credentials, API tokens, database passwords, and TLS private keys, and invalidate active sessions or cookies if the malicious file could have intercepted user or administrator access. +- Escalate to incident response immediately if you find the same malicious file on multiple web servers, observe the web process spawning a shell or making outbound command-and-control connections, or confirm access to databases, payment data, or domain credentials. +- Harden the environment by patching the exploited CMS, plugin, framework, or server component, restricting the web service account to only required write paths, disabling script execution in upload directories, and adding detections for new executable or template files under the web root. + + +==== Rule query + + +[source, js] +---------------------------------- +event.category:file and host.os.type:linux and event.action:(creation or rename) and ( + process.name: ( + "nginx" or "apache2" or "httpd" or "caddy" or "lighttpd" or "httpd.worker" or "httpd-worker" or "httpd-prefork" or + "php-cgi" or "php-fcgi" or "php-cgi.cagefs" or "frankenphp" or "lshttpd" or "litespeed" or "openlitespeed" or + "fcgiwrap" or "uwsgi" or "daphne" or "uvicorn" or "hypercorn" or "granian" or "waitress-serve" or "flask" or + "puma" or "unicorn" or "unicorn_rails" or "thin" or "rackup" or "mongrel_rails" or "starman" or "plackup" or + "twiggy" or "hypnotoad" or "starlet" or "unitd" or "unitd-debug" or php-fpm* or lsphp* or gunicorn* or + "nginx3" or "apache" or *.cgi or *.fcgi + ) or + (process.name: "java" and file.extension: ("jsp" or "jspx" or "jspf" or "tag" or "tagx" or "war" or "ear")) or + (process.name: ("node" or "nodejs") and file.extension: ("js" or "mjs" or "cjs" or "ts" or "mts" or "cts")) or + (process.name: "dotnet" and file.extension: ("cshtml" or "razor")) or + (process.name: (mono* or xsp* or mod-mono-server* or fastcgi-mono-server*) and file.extension: ("asp" or "aspx" or "ashx" or "asmx" or "ascx" or "cshtml")) or + (process.name: python* and file.extension: ("wsgi" or "cgi" or "fcgi")) or + (process.name: ruby* and file.extension: ("erb" or "ru")) or + (process.name: perl* and file.extension: ("cgi" or "fcgi" or "psgi")) or + (process.name: lua* and file.extension: ("lua" or "luac")) +) and +file.path:( + /home/*/* or /var/www/* or /srv/www/* or /srv/http/* or /usr/share/nginx/* or /opt/zimbra/jetty* or + /usr/share/caddy/* or /usr/local/lsws/* or /opt/bitnami/* or */sites/*/files/* or /opt/easyengine/* or + */wp-content/* or */httpdocs/* or */httpsdocs/* or */htdocs/* or */wwwroot/* or */webroot/* or */cgi-bin/* or + */upload/* or */uploads/* or */images/* or */media/* or */userfiles/* or */attachments/* or + /usr/share/webapps/* or /usr/share/zabbix/* or /usr/share/phpmyadmin/* or /usr/share/phpMyAdmin/* or + /var/lib/roundcube/* or /usr/share/cacti/* or /usr/share/nagios* or /var/lib/tomcat* or /usr/share/tomcat* or + /usr/local/tomcat/* or /opt/tomcat* or /var/lib/jetty* or /usr/share/jetty* or + /usr/local/cpanel/* or /usr/local/psa* or /opt/psa/admin/* or /usr/share/webmin/* or + /usr/libexec/webmin/* or /usr/local/nginx/* or /usr/local/apache* or /usr/sap/* or /opt/rh/* or + */public_html/* or */private_html/* or */public/* or */private/* or */deployments/* or */autodeploy/* or + */dropins/* or */installedApps/* or /srv/caddy/* or /usr/local/openresty/* or */fileadmin/* or */custom_apps/* or + */vhost* or /opt/apache-tomcat* or /opt/jetty* or /usr/local/jetty* or */wildfly*/* or */jboss*/* or */glassfish/* or + */user_projects/domains/* or */resin*/webapps/* or */installedApps/* +) and +not ( + file.path:*/storage/framework/sessions/* or + ( + process.name:php-fpm* and + file.path:( + /mnt/WEB/*/public_html/tmp/templates/frontend/*.php or + /mnt/WEB/*/public_html/wp-content/languages/*.json + ) + ) or + (process.name:node and (user.id >= 1000 or user.id:0)) or + ( + ( + file.path:( + */.npm/* or */_cache/* or */_inventories/* or */_sessions/* or + */cache/tcpdf/* or */cachestore_file/* or */files_trashbin/* or + */localcache/* or */node_modules/* or */proxy_temp/* or + */sessions/sess_* or */storage/framework/cache/* or + */temp-write-test-* or */thumbnails/* or + */uploads/web-file-upload-* + ) or + file.extension:( + BMP or GIF or ICO or JPEG or JPG or PDF or PNG or SVG or TIFF or + WEBP or avi or bmp or cache or flv or gif or ico or jpeg or jpg or + lock or mkv or mov or mp3 or mp4 or ogg or part or pdf or png or + svg or temp or tiff or tmp or tmpfsfile or wav or webp or wmv + ) + ) and + not file.name:(*.asp* or *.cgi* or *.jsp* or *.php* or *.phtml*) + ) +) + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Persistence +** ID: TA0003 +** Reference URL: https://attack.mitre.org/tactics/TA0003/ +* Technique: +** Name: Server Software Component +** ID: T1505 +** Reference URL: https://attack.mitre.org/techniques/T1505/ +* Sub-technique: +** Name: Web Shell +** ID: T1505.003 +** Reference URL: https://attack.mitre.org/techniques/T1505/003/ +* Tactic: +** Name: Execution +** ID: TA0002 +** Reference URL: https://attack.mitre.org/tactics/TA0002/ +* Technique: +** Name: Command and Scripting Interpreter +** ID: T1059 +** Reference URL: https://attack.mitre.org/techniques/T1059/ +* Sub-technique: +** Name: Unix Shell +** ID: T1059.004 +** Reference URL: https://attack.mitre.org/techniques/T1059/004/ +* Tactic: +** Name: Command and Control +** ID: TA0011 +** Reference URL: https://attack.mitre.org/tactics/TA0011/ +* Technique: +** Name: Application Layer Protocol +** ID: T1071 +** Reference URL: https://attack.mitre.org/techniques/T1071/ +* Tactic: +** Name: Initial Access +** ID: TA0001 +** Reference URL: https://attack.mitre.org/tactics/TA0001/ +* Technique: +** Name: Exploit Public-Facing Application +** ID: T1190 +** Reference URL: https://attack.mitre.org/techniques/T1190/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rules-8-19-35-appendix.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rules-8-19-35-appendix.asciidoc new file mode 100644 index 0000000000..a8271aab60 --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rules-8-19-35-appendix.asciidoc @@ -0,0 +1,67 @@ +["appendix",role="exclude",id="prebuilt-rule-8-19-35-prebuilt-rules-8-19-35-appendix"] += Downloadable rule update v8.19.35 + +This section lists all updates associated with version 8.19.35 of the Fleet integration *Prebuilt Security Detection Rules*. + + +include::prebuilt-rule-8-19-35-aws-audit-or-security-service-tampering-via-cli.asciidoc[] +include::prebuilt-rule-8-19-35-cloud-offensive-framework-execution.asciidoc[] +include::prebuilt-rule-8-19-35-potential-destructive-aws-cli-command-executed-by-genai-agent.asciidoc[] +include::prebuilt-rule-8-19-35-anthropic-compliance-audit-log-export-accessed.asciidoc[] +include::prebuilt-rule-8-19-35-anthropic-organization-data-export-accessed.asciidoc[] +include::prebuilt-rule-8-19-35-anthropic-activity-from-a-suspicious-user-agent.asciidoc[] +include::prebuilt-rule-8-19-35-anthropic-multiple-authentication-failures.asciidoc[] +include::prebuilt-rule-8-19-35-anthropic-compliance-api-logging-disabled.asciidoc[] +include::prebuilt-rule-8-19-35-anthropic-excessive-chat-deletion.asciidoc[] +include::prebuilt-rule-8-19-35-anthropic-magic-link-second-factor-disabled.asciidoc[] +include::prebuilt-rule-8-19-35-anthropic-organization-ip-restriction-deleted.asciidoc[] +include::prebuilt-rule-8-19-35-anthropic-sso-disabled-or-connection-removed.asciidoc[] +include::prebuilt-rule-8-19-35-anthropic-excessive-chat-access-failures.asciidoc[] +include::prebuilt-rule-8-19-35-anthropic-organization-member-and-group-enumeration.asciidoc[] +include::prebuilt-rule-8-19-35-anthropic-excessive-chat-snapshot-creation.asciidoc[] +include::prebuilt-rule-8-19-35-anthropic-high-file-upload-activity.asciidoc[] +include::prebuilt-rule-8-19-35-anthropic-admin-api-key-deleted.asciidoc[] +include::prebuilt-rule-8-19-35-anthropic-excessive-chat-creation.asciidoc[] +include::prebuilt-rule-8-19-35-anthropic-extra-usage-spend-limit-deleted.asciidoc[] +include::prebuilt-rule-8-19-35-anthropic-organization-deletion.asciidoc[] +include::prebuilt-rule-8-19-35-anthropic-admin-api-key-created.asciidoc[] +include::prebuilt-rule-8-19-35-anthropic-admin-role-assigned-to-user.asciidoc[] +include::prebuilt-rule-8-19-35-anthropic-compliance-api-key-created.asciidoc[] +include::prebuilt-rule-8-19-35-anthropic-mcp-server-created.asciidoc[] +include::prebuilt-rule-8-19-35-anthropic-organization-domain-boundary-changed.asciidoc[] +include::prebuilt-rule-8-19-35-anthropic-organization-user-invite-sent.asciidoc[] +include::prebuilt-rule-8-19-35-anthropic-sensitive-claude-project-role-assigned-to-user.asciidoc[] +include::prebuilt-rule-8-19-35-anthropic-primary-owner-transferred.asciidoc[] +include::prebuilt-rule-8-19-35-persistence-via-a-hidden-plist-filename-via-macos-security-events.asciidoc[] +include::prebuilt-rule-8-19-35-launch-item-registration-with-suspicious-executable-path-via-macos-security-events.asciidoc[] +include::prebuilt-rule-8-19-35-excessive-sudo-authentication-failures-via-macos-security-events.asciidoc[] +include::prebuilt-rule-8-19-35-aws-ssm-agent-registered-via-hybrid-activation.asciidoc[] +include::prebuilt-rule-8-19-35-privilege-escalation-via-parallels-appliance-extract-argument-injection.asciidoc[] +include::prebuilt-rule-8-19-35-first-seen-external-mqtt-broker-connection.asciidoc[] +include::prebuilt-rule-8-19-35-potential-netscaler-log-poisoning-command-injection-attempt.asciidoc[] +include::prebuilt-rule-8-19-35-potential-clickfix-command-via-windows-run-dialog.asciidoc[] +include::prebuilt-rule-8-19-35-potential-filefix-command-via-windows-explorer-address-bar.asciidoc[] +include::prebuilt-rule-8-19-35-potential-terminalfix-cloudflare-lure-in-powershell.asciidoc[] +include::prebuilt-rule-8-19-35-node-js-pre-or-post-install-script-execution.asciidoc[] +include::prebuilt-rule-8-19-35-newly-observed-elastic-defend-behavior-alert.asciidoc[] +include::prebuilt-rule-8-19-35-newly-observed-high-severity-detection-alert.asciidoc[] +include::prebuilt-rule-8-19-35-aws-lambda-function-invoked-by-an-unusual-principal.asciidoc[] +include::prebuilt-rule-8-19-35-aws-backup-recovery-point-deleted-by-unusual-user.asciidoc[] +include::prebuilt-rule-8-19-35-aws-lambda-function-deletion-by-unusual-user.asciidoc[] +include::prebuilt-rule-8-19-35-unusual-azure-vm-extension-detected.asciidoc[] +include::prebuilt-rule-8-19-35-gke-api-request-failure-burst-by-user.asciidoc[] +include::prebuilt-rule-8-19-35-google-workspace-object-copied-to-external-drive-with-app-consent.asciidoc[] +include::prebuilt-rule-8-19-35-linux-user-account-creation.asciidoc[] +include::prebuilt-rule-8-19-35-unusual-file-creation-via-web-server.asciidoc[] +include::prebuilt-rule-8-19-35-accepted-default-telnet-port-connection.asciidoc[] +include::prebuilt-rule-8-19-35-fortigate-forticloud-sso-login-from-unusual-source.asciidoc[] +include::prebuilt-rule-8-19-35-first-time-fortigate-administrator-login.asciidoc[] +include::prebuilt-rule-8-19-35-rpc-remote-procedure-call-from-the-internet.asciidoc[] +include::prebuilt-rule-8-19-35-rpc-remote-procedure-call-to-the-internet.asciidoc[] +include::prebuilt-rule-8-19-35-smb-windows-file-sharing-activity-from-the-internet.asciidoc[] +include::prebuilt-rule-8-19-35-smb-windows-file-sharing-activity-to-the-internet.asciidoc[] +include::prebuilt-rule-8-19-35-microsoft-defender-xdr-incident-external-alerts.asciidoc[] +include::prebuilt-rule-8-19-35-lsass-process-access-via-windows-api.asciidoc[] +include::prebuilt-rule-8-19-35-mark-of-the-web-removal-by-an-unusual-process.asciidoc[] +include::prebuilt-rule-8-19-35-potential-execution-via-filefix-phishing-attack.asciidoc[] +include::prebuilt-rule-8-19-35-temporarily-scheduled-task-creation.asciidoc[] diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rules-8-19-35-summary.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rules-8-19-35-summary.asciidoc new file mode 100644 index 0000000000..af89f00eb8 --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-35/prebuilt-rules-8-19-35-summary.asciidoc @@ -0,0 +1,134 @@ +[[prebuilt-rule-8-19-35-prebuilt-rules-8-19-35-summary]] +[role="xpack"] +== Update v8.19.35 + +This section lists all updates associated with version 8.19.35 of the Fleet integration *Prebuilt Security Detection Rules*. + + +[width="100%",options="header"] +|============================================== +|Rule |Description |Status |Version + +|<> | Identifies use of the AWS CLI to disable, delete, or blind AWS audit logging and security monitoring services, including CloudTrail trails and event data stores, GuardDuty detectors, AWS Config recorders, Security Hub, Access Analyzer, Macie, and Inspector. Adversaries disable these controls early in a cloud intrusion so that subsequent credential abuse, data theft, and destruction go unrecorded. Because the endpoint sees the command as it is issued, this fires even when subsequent CloudTrail visibility is lost. | new | 1 + +|<> | Identifies execution of well-known cloud exploitation, enumeration, and attack-simulation frameworks on an endpoint. Adversaries run these after obtaining cloud credentials to map the compromised principal's effective permissions, discover privilege escalation paths, and pivot to the console. Pacu is tracked by MITRE as software S1091. Real-world use on compromised hosts is documented in the AWS customer incident catalog, where both the Unit 42 SugarCRM zero-day response and the AWS CIRT federated-user compromise record Pacu and ScoutSuite scanning from access keys found on EC2 hosts. Covered frameworks include: Pacu, CloudFox, ScoutSuite, PMapper, Stratus Red Team, WeirdAAL, enumerate-iam, Prowler, CloudMapper, CloudSplaining, cloud_enum, CloudBrute, SkyArk, Leonidas, Halberd, Barq, Cartography, Nimbostratus, AWSBucketDump, dsnap, aws_consoler, Redboto, cloudjack, s3scanner, CloudSploit, aws-enumerator, iam-vulnerable, Fog, and SmogCloud. Secret scanners such as TruffleHog and Gitleaks are intentionally excluded because they run routinely in CI and pre-commit hooks; their credential-validation use is covered by CloudTrail and GitHub user-agent rules. Authorized red team and cloud audit activity uses the same tooling, so alerts should be correlated with known assessment windows and operators. | new | 1 + +|<> | Identifies a cloud CLI command that destroys infrastructure or identities, such as terminating EC2 instances, removing S3 buckets, or deleting IAM users, when it is spawned by a GenAI coding agent directly or through the agent's shell wrapper. A compromised or prompt-injected agent can be steered into wiping the developer's environment and cloud account using the credentials it already holds, as seen in the malicious Amazon Q Developer for VS Code v1.84.0 release (AWS-2025-015). | new | 1 + +|<> | An audit log export archive was accessed, meaning the actor downloaded exported audit activity. Attackers pull audit exports to see what defenders can observe, look for detection gaps, or remove evidence before making other control-plane changes. | new | 1 + +|<> | Starting an organization data export only signals intent. Accessing the export archive via its signed URL means the actor actually downloaded chats, projects, user metadata, and configuration. An attacker with administrative access can use this to exfiltrate intellectual property and credentials at scale. | new | 1 + +|<> | Detects successful Anthropic audit activity where the user agent matches scripting HTTP clients, offensive scanners, or automation libraries (for example curl, python-requests, Go-http-client, axios, nuclei). Browser and first-party Claude clients normally present recognizable browser or product user agents; raw HTTP library agents on successful control-plane or product activity often indicate scripted access, stolen-session reuse, or unauthorized automation. Known benign automation patterns (axios or Go HTTP clients on file upload/delete, trusted device enrollment, and environment creation) are excluded. | new | 1 + +|<> | Detects at least five failed Anthropic authentication events for the same user email within one hour. Failures are matched by authentication category and failure outcome (for example magic-link or SSO login failures). That pattern fits repeated guessing, stale magic link abuse, or automated login attempts against one account. | new | 1 + +|<> | Compliance API logging feeds the anthropic.audit dataset that Anthropic audit detections run on. An attacker with administrative access can disable it so later role grants, API key creation, exports, and authentication changes stop reaching this data source. This rule detects the disable action itself. Activity that happens after logging stops may not appear in logs-anthropic.audit-*. | new | 1 + +|<> | Detects an unusually high number of Claude chat deletion events for the same user email within a single calendar day. Mass chat deletion can indicate an attempt to remove conversation history, cover tracks after misuse of Claude, or automated cleanup following data staging or prompt abuse. | new | 1 + +|<> | Magic link second factor adds an extra authentication step to passwordless sign-in for Anthropic. An attacker with administrative access can turn it off so magic link logins no longer require the second factor, which makes stolen or attacker-controlled mailboxes usable for interactive access. This often shows up alongside SSO weakening when the attacker wants a fallback authentication path outside the corporate IdP. | new | 1 + +|<> | Organization IP restrictions limit Anthropic administrative access to approved network ranges. Deleting one widens where a compromised admin session or API key can be used. The audit event does not always carry the deleted CIDR or restriction identifier, so treat this as an early signal and pivot to nearby IP restriction create or update events for the same organization. | new | 1 + +|<> | SSO routes Anthropic authentication through the corporate identity provider. Disabling SSO, or deactivating or deleting an SSO connection, moves users onto alternate sign-in paths where IdP-enforced MFA, conditional access, and session policies no longer apply. That opens the door to password or magic-link accounts the attacker controls. | new | 1 + +|<> | Detects a single authenticated user generating an unusually high number of denied Claude chat access attempts in a 24-hour window. That pattern fits automated chat enumeration or attempts to reach conversations outside the actor's permissions. Unauthenticated shared-link actors lack user.id and are excluded. | new | 1 + +|<> | Detects a single user performing at least two distinct organization discovery actions within a 10-minute window: listing users, exporting members, or viewing groups. Chaining these read actions maps membership and group structure and commonly precedes targeted role grants, invites, or data collection against high-value accounts. | new | 1 + +|<> | Detects an unusually high number of successful Claude chat snapshot creation events for the same user email within a rolling 24-hour window. Chat snapshots package conversation content into shareable exports; sustained creation volume can indicate staging of organizational chat data for exfiltration via Anthropic's web service or automated bulk export of sensitive prompts and responses. | new | 1 + +|<> | Detects an unusually high volume of Claude file uploads from the same user email and source IP within a rolling 24-hour period. Sustained upload activity can indicate staging of sensitive documents in Claude chats for later retrieval, automated ingestion of data into LLM workflows, or abuse of organizational Claude access to move files into the cloud service. | new | 1 + +|<> | Admin API keys grant programmatic access to organization and compliance APIs. An attacker can delete legitimate admin API keys to break security monitoring or integrations, or to cover tracks after creating replacement credentials they control. Deletion without a nearby rotation event points more at sabotage than routine key hygiene. | new | 1 + +|<> | Detects an unusually high number of Claude chat creation events for the same user email within a 24-hour period. Burst chat creation can indicate automated LLM abuse, resource hijacking to burn organizational quotas, or scripted workflows used to stage many parallel conversations for data processing or prompt-injection campaigns. | new | 1 + +|<> | Extra usage spend limits cap Anthropic organizational spend beyond included usage. Deleting a spend limit removes that cap and can enable unrestricted API or Claude consumption. An attacker who already has administrative or API access can delete the limit to burn budget, run large automated workloads, or stage resource abuse without the previous guardrail. | new | 1 + +|<> | Organization deletion and bulk delete remove tenant data, projects, and member access in a single administrative action. An attacker can use this to break AI-assisted workflows as an impact technique, to extort the organization, or to destroy evidence after finishing a data export. Once deletion progresses, recovery options shrink and earlier exfiltration activity is harder to reconstruct from the tenant itself. | new | 1 + +|<> | Admin API keys grant programmatic access to organization and compliance APIs outside an interactive browser session. An attacker who creates one after compromise can automate role grants, exports, and logging changes without holding a user session that would time out under SSO. The key also survives password resets and IdP lockout if defenders revoke the interactive account but miss the API credential. | new | 1 + +|<> | The organization admin role controls organization settings, integrations, membership, and security configuration in Anthropic Claude for Enterprise. Membership role changes are reported as `claude_user_role_updated` with `anthropic.audit.current_role`. An attacker can promote a compromised or newly invited account to org admin to turn initial access into durable control-plane access. From admin, they can disable SSO, mint admin API keys for automation, start data exports, and weaken audit logging. Workspace-scoped `role_assignment_granted` grants (for example bare `admin` on a workspace) are out of scope for this rule. | new | 1 + +|<> | Compliance-scoped API keys read organization audit activity and compliance data. Once an attacker has administrative access, creating one gives them programmatic read of chats, files, and membership without an interactive session. This is separate from admin API key creation, which covers organization administration rather than compliance read scopes. | new | 1 + +|<> | Detects the first successful creation of a Model Context Protocol (MCP) server integration name in an Anthropic organization within the rule history window. MCP servers add external data pathways into Claude and can expose organizational data to third-party infrastructure. This is a New Terms rule keyed on `organization.id` and `anthropic.audit.mcp_server_name` so the same connector name can still alert in another tenant, while routine re-creation of an already-seen name in the same organization does not. | new | 1 + +|<> | Verified organization domains control which email addresses can join or be pulled into an Anthropic tenant. Verifying, claiming, adding, or removing a domain changes the tenant boundary and can pull in attacker-controlled mailboxes or push out legitimate corporate domains. These events are infrequent and affect organization-wide membership trust. | new | 1 + +|<> | Sending an organization user invite creates a path for a new member to join the Anthropic tenant with a chosen role. An adversary who compromises an administrator or admin API key can invite a mailbox they control and accept the invite to gain durable access. Invites may target internal corporate addresses or external domains; this rule does not distinguish them because invite events do not carry verified organization domains for reliable comparison. | new | 1 + +|<> | Detects when a Claude project owner or editor role is granted through a `role_assignment_granted` event. Project owners and editors can access project chats, artifacts, and knowledge bases that may hold sensitive data. An attacker with organization access can grant these roles to persist access to high-value project content without holding organization admin privileges. | new | 1 + +|<> | Primary ownership is the highest administrative authority in an Anthropic organization, covering billing, membership, and organization-wide settings. Transferring ownership to an attacker-controlled account can lock out the legitimate administrator from recovery paths that depend on the original owner. Attackers often do this after role escalation so defenders cannot reverse earlier privilege changes through normal administration. | new | 1 + +|<