* [Rule Tuning] Entra ID Suspicious Cloud Device Registration
Fixes#5682
* fixed investigation guide name
* adjusted from to 30m and interval to 15m
(cherry picked from commit dbbf71b9c2)
* [New Rule] AWS SSM Inventory Reconnaissance by Rare User
This rule detects the first time a user or role accesses AWS Systems Manager (SSM) inventory APIs or runs the AWS-GatherSoftwareInventory job. SSM Inventory provides detailed information about managed EC2 instances including installed software, patch compliance, network configurations, and command execution history. Threat actors, including Scattered Spider (LUCR-3), have been observed leveraging these APIs to enumerate targets for lateral movement while blending in with legitimate AWS operations. The rule uses a New Terms approach on cloud.account.id and user.name to identify when users access these reconnaissance APIs for the first time.
No existing rules specifically detect SSM inventory reconnaissance activity. This fills a gap in detecting cloud infrastructure discovery techniques used for target enumeration prior to lateral movement.
| API | Purpose |
|-----|---------|
| `GetInventory` | Query inventory data (installed software, OS details) |
| `GetInventorySchema` | Discover available inventory types |
| `ListInventoryEntries` | Get specific instance inventory |
| `DescribeInstancePatches` | Find patch compliance/vulnerabilities |
| `ListCommands` | View SSM command execution history |
| `CreateAssociation` | Trigger AWS-GatherSoftwareInventory job |
* Apply suggestions from code review
(cherry picked from commit e633c83b73)
* [New Rule] AWS Sensitive IAM Operations Performed via CloudShell
This rule detects sensitive AWS IAM operations performed via CloudShell based on the user agent string. CloudShell is a browser-based shell that provides command-line access to AWS resources directly from the console without requiring local tooling. When attackers gain access to a compromised console session, CloudShell enables them to perform privileged operations such as creating users, access keys, roles, or attaching policies—leaving no artifacts on their local system. This behavior is documented in the Permiso blog on LUCR-3 (Scattered Spider) and the CISA Scattered Spider advisory, where threat actors leveraged CloudShell for post-compromise credential harvesting and privilege escalation.
No existing rules specifically detect CloudShell as the origin for sensitive IAM operations. This fills a gap by identifying high-risk actions from this browser-based execution context.
* adding iam provider
* primary tactic change
* updating highlighted fields
* removed bold from IG
* Apply suggestions from code review
Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>
---------
Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>
(cherry picked from commit f10de64527)
* [New Rules] AWS IAM new identity federation provider rules
AWS IAM SAML Provider Created and AWS IAM OIDC Provider Created by Rare User detect the creation of new identity federation providers in AWS IAM. SAML and OIDC providers establish trust relationships with external identity providers, enabling federated access to AWS resources. Adversaries who gain administrative access may create rogue providers to establish persistent access that survives credential rotation, allowing them to assume roles using tokens from an IdP they control. These rules map to MITRE ATT&CK T1484.002 (Trust Modification), which is referenced in the CISA Scattered Spider advisory (AA23-320A) under the Privilege Escalation tactic.
Existing Related Coverage: We already detect `UpdateSAMLProvider` via privilege_escalation_iam_saml_provider_updated.toml. These new rules close the gap by detecting the creation of federation providers, the initial step required to establish rogue trust relationships.
* Update rules/integrations/aws/persistence_iam_oidc_provider_created.toml
Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
* Update rules/integrations/aws/persistence_iam_oidc_provider_created.toml
Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
* Apply suggestion from @imays11
---------
Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
(cherry picked from commit f62026e378)
* [Tuning] Adds host metadata to the setup requirements
Rules requiring host.ip and that are compatible with Elastic Defend integration can be impacting by windows].advanced.set_extended_host_information if set to the default value (false), host.ip won't be populated from 8.18+ (only host.name and host.os and host.id).
Related SDH https://github.com/elastic/sdh-endpoint/issues/722
* ++
* Update rules/integrations/lmd/lateral_movement_ml_high_mean_rdp_process_args.toml
Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>
* Update rules/integrations/lmd/lateral_movement_ml_high_mean_rdp_session_duration.toml
Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>
* Update rules/integrations/lmd/lateral_movement_ml_high_remote_file_size.toml
Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>
* Update rules/integrations/lmd/lateral_movement_ml_high_variance_rdp_session_duration.toml
Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>
* Update rules/integrations/lmd/lateral_movement_ml_rare_remote_file_directory.toml
Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>
* Update rules/integrations/lmd/lateral_movement_ml_unusual_time_for_an_rdp_session.toml
Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>
* Update rules/integrations/lmd/lateral_movement_ml_spike_in_connections_from_a_source_ip.toml
Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>
* Update rules/integrations/lmd/lateral_movement_ml_rare_remote_file_extension.toml
Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>
* Update rules/integrations/lmd/lateral_movement_ml_spike_in_connections_to_a_destination_ip.toml
Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>
* Update lateral_movement_ml_spike_in_rdp_processes.toml
* Apply suggestion from @Mikaayenson
Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>
---------
Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>
(cherry picked from commit 204f0b2ebc)
* [New Rule] AWS GuardDuty Member Account Manipulation
Detects attempts to manipulate GuardDuty member account relationships within AWS Organizations. This includes actions like `DisassociateFromAdministratorAccount`, `DeleteMembers`, `StopMonitoringMembers`, and `DeleteInvitations` that break centralized security visibility. These actions are often precursors to or alternatives for fully deleting GuardDuty detectors, allowing adversaries to operate undetected in member accounts. The idea for this rule was inspired by defense evasion techniques highlighted in Permiso's research on Scattered Spider, and expanded to include other relevant API calls that could be abused for the same purpose.
Existing Related Coverage: We already detect `DeleteDetector` via defense_evasion_guardduty_detector_deletion.toml. This new rule complements that coverage by catching the manipulation of GuardDuty member relationships, actions that break org-level visibility without requiring full detector deletion.
* toml file name change
* Apply suggestions from code review
Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>
---------
Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>
(cherry picked from commit 386c8f7e7a)
* [Rule Tuning] M365 Identity Excessive SSO Login Errors Reported
<!-- This issue will be created in repo elastic/detection-rules (https://github.com/elastic/detection-rules). Changing this line has no effect. -->
Fixes#5676
* adjusted file name
* adjusted message to STS codes; removed generic SAML request andresponse codes
(cherry picked from commit 4299831b90)
* [New] Elastic Defend Alert Followed by Telemetry Loss
Detects when an Elastic Defend endpoint alert is generated on a host and is not followed by any subsequent endpoint
telemetry (process, network, registry, library, or DNS events) within a short time window. This behavior may indicate
endpoint security evasion, agent tampering, sensor disablement, service termination, system crash, or malicious interference with telemetry collection following detection.
* Update defense_evasion_missing_events_after_alert.toml
* Apply suggestion from @Mikaayenson
Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>
---------
Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>
(cherry picked from commit 60606ecd4e)
* [New Rule] AWS EC2 Serial Console Access Enabled
Detects when an adversary enables the EC2 Serial Console feature at the AWS account level. This technique was documented by Permiso in their LUCR-3 Scattered Spider research as a defense evasion method that provides out-of-band access to EC2 instances, completely bypassing network-based security monitoring, VPCs, and security groups. Enabling serial console access is extremely rare in production environments, making this a high-signal detection with minimal false positive risk. I've tested this query against alert and prod telemetry and found rare instances.
Existing Related Coverage: We already detect `SendSerialConsoleSSHPublicKey` via lateral_movement_ec2_instance_connect_ssh_public_key_uploaded.toml, which catches the usage of serial console. This new rule closes the gap by detecting the enablement of serial console access, the prerequisite step that must occur before an attacker can leverage this out-of-band channel.
* raising severity and risk score
(cherry picked from commit 793d79b063)
* [Rule Tuning] Potential AWS S3 Bucket Ransomware Note Uploaded
This rule was very loud in telemetry since it's last tuning. ~8,938 alerts in last 24 hours. All false positives due to regex pattern matches for file names like `enc` as part of /filetransfertmsadherence/ and absence/; `lock` as part of citations-blocks/.
I've reworked this rule based on more research into common ransom note file name keywords and replaced the list here with the most common keywords. For `file` (the most common) and `back`, I was still seeing false positives so decided to alert on a combination of either or these 2 words in conjunction with any of the other words from the list. I also changed the regex to be case-insensitive.
With this new query, I see only true positive results within the last year all from known testing events.
I changed the toml file name so the rule looks new but it is just tuned.
I've updated the description and investigation guide, and added the study I used as a reference: https://www.mdpi.com/2073-431X/10/11/145#computers-10-00145-f002
Test data is in our stack, script for executing is here:
Screenshot of new working query in our test stack
* Apply suggestions from code review
* removing redundany regex pattern
(cherry picked from commit 1c59a6adde)
* Updated kubernetes.audit.requestObject.spec.containers.image type of text to Keyword
* [New Rules] Misc. K8s RBAC Abuse Rules
* --
* Update non-ecs-schema
* Update to make unit tests happy
* Mitre mapping updates
* Fix query logic for service account role bindings
* Fix formatting in persistence_service_account_bound_to_clusterrole rule
(cherry picked from commit 64a08cd6af)
* Updated kubernetes.audit.requestObject.spec.containers.image type of text to Keyword
* [Bug] Fix UTF-8 Encoding for Rule File Operations
(cherry picked from commit 694376bd7a)
* Updated kubernetes.audit.requestObject.spec.containers.image type of text to Keyword
* [Rule Tuning] Dormant & Deprecated Rule Clean-Up
* [Rule Tuning] Dormant & Deprecated Rule Clean-Up
* Few more deprecations
* ++
* Update unit test syntax fix
* Update bad bytes
* ++
(cherry picked from commit 3cba3d7982)
* [Tuning] Unsigned DLL Side-Loading from a Suspicious Folder: Add Downloads path and fix subdirectory evasion
- Add Downloads folder to the suspicious paths list
- Modify directory matching logic from endswith~ to startswith~ to detect DLLs loaded from subdirectories of the executable's location
* Update rules/windows/defense_evasion_unsigned_dll_loaded_from_suspdir.toml
Swap back to "endswith" and add chrome_elf.dll coverage.
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
---------
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
(cherry picked from commit e6fafc914e)
* [New] Multiple Machine Learning Alerts by Influencer Field
This rule uses alerts data to determine when multiple different machine learning alerts involving the same influencer field are triggered. Analysts can use this to prioritize triage and response, as these entities are more likely to be more suspicious.
* Update multiple_machine_learning_jobs_by_entity.toml
* Update multiple_machine_learning_jobs_by_entity.toml
* Update non-ecs-schema.json
* Update multiple_machine_learning_jobs_by_entity.toml
* Update non-ecs-schema.json
(cherry picked from commit 362c459094)
Terrance DeJesus