Samirbous 6f80df2195 [New] Azure Run Command Correlated with Process Execution (#6169) ...

* [New] Azure Run Command Correlated with Process Execution

Correlates successful Azure Virtual Machine Run Command operations with endpoint PowerShell execution on the same host within two minutes. Adversaries abuse Run Command to run scripts remotely as SYSTEM while activity logs only record the control-plane action; Elastic Defend process telemetry reveals the on-guest payload.

* Update execution_azure_vm_run_command_powershell_unrestricted_script.toml

* Update execution_azure_vm_run_command_powershell_unrestricted_script.toml

* ++

* Update execution_azure_vm_run_command_powershell_unrestricted_script.toml

* Update rules/cross-platform/execution_azure_run_command_script_child_process.toml

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

* Update rules/cross-platform/execution_azure_run_command_script_child_process.toml

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

---------

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

(cherry picked from commit e9b167d117)

2026-06-01 13:43:55 +00:00

..

command_and_control_common_llm_endpoint.toml

[Rule Tuning] Additional GenAI context for Domains & Cred File Access (#5958)

2026-04-22 16:35:58 +00:00

command_and_control_curl_wget_spawn_via_nodejs_parent.toml

[Rule Tuning] Misc GenAI Rules (#5929)

2026-04-08 12:06:59 +00:00

command_and_control_genai_process_suspicious_tld_connection.toml

[New Rules] Add MITRE ATLAS framework support and GenAI threat detection rules (#5352)

2025-12-05 18:28:29 +00:00

command_and_control_genai_process_unusual_domain.toml

[Rule Tuning] Misc GenAI Tuning (#6006)

2026-05-01 22:48:32 +00:00

command_and_control_google_drive_malicious_file_download.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:14:12 +00:00

command_and_control_pan_elastic_defend_c2.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:14:12 +00:00

command_and_control_socks_fortigate_endpoint.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 16:29:29 +00:00

command_and_control_suricata_elastic_defend_c2.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 16:29:29 +00:00

command_and_control_tunnel_qemu.toml

[Rule Tuning] Update MDE tags to "Microsoft Defender XDR" (#5927)

2026-04-20 22:41:28 +00:00

credential_access_cookies_chromium_browsers_debugging.toml

Prep main for 9.1 (#4555)

2025-03-26 15:08:47 +00:00

credential_access_forced_authentication_pipes.toml

[Rule Tuning] Tighten Up Windows EventLog Indexes, Improve tags (#4464)

2025-02-19 12:54:31 -03:00

credential_access_genai_process_sensitive_file_access.toml

[Rule Tuning] Misc GenAI Tuning (#6006)

2026-05-01 22:48:32 +00:00

credential_access_gitleaks_execution.toml

[Rule Tuning] Update MDE tags to "Microsoft Defender XDR" (#5927)

2026-04-20 22:41:28 +00:00

credential_access_grep_recursive_credential_discovery.toml

[New] Potential Credential Discovery via Recursive Grep (#5882)

2026-03-26 11:29:01 +00:00

credential_access_multi_cloud_cli_token_harvesting.toml

[New] Multi-Cloud CLI Token and Credential Access Commands (#6012)

2026-05-01 16:37:02 +00:00

credential_access_multi_could_secrets_via_api.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 16:29:29 +00:00

credential_access_suspicious_instance_metadata_service_api_cli.toml

[New/Tuning] Suspicious Instance Metadata Service (IMDS) API Activity (#6178)

2026-05-27 10:01:54 +00:00

credential_access_suspicious_instance_metadata_service_api_request.toml

[New/Tuning] Suspicious Instance Metadata Service (IMDS) API Activity (#6178)

2026-05-27 10:01:54 +00:00

credential_access_trufflehog_execution.toml

[Rule Tuning] Update MDE tags to "Microsoft Defender XDR" (#5927)

2026-04-20 22:41:28 +00:00

defense_evasion_agent_spoofing_multiple_hosts.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:14:12 +00:00

defense_evasion_data_encrypted_via_openssl.toml

Monthly Manifest and Schema Updation (#5920)

2026-04-06 12:07:02 +00:00

defense_evasion_deleting_websvr_access_logs.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:14:12 +00:00

defense_evasion_deletion_of_bash_command_line_history.toml

[Rule Tuning] Linux DR CP Tuning (#5512)

2026-01-07 15:42:02 +00:00

defense_evasion_elastic_agent_service_terminated.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:14:12 +00:00

defense_evasion_encoding_rot13_python_script.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:14:12 +00:00

defense_evasion_genai_config_modification.toml

[Rule Tuning] Misc GenAI Rules (#5929)

2026-04-08 12:06:59 +00:00

defense_evasion_genai_process_compiling_executables.toml

[Rule Tuning] Update MDE tags to "Microsoft Defender XDR" (#5927)

2026-04-20 22:41:28 +00:00

defense_evasion_genai_process_encoding_prior_to_network_activity.toml

[Rule Tuning] Update MDE tags to "Microsoft Defender XDR" (#5927)

2026-04-20 22:41:28 +00:00

defense_evasion_long_base64_encoded_interpreter_command_line.toml

[New] Long Base64 Encoded Command via Scripting Interpreter (#5891)

2026-04-22 17:07:20 +00:00

defense_evasion_masquerading_space_after_filename.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:14:12 +00:00

defense_evasion_missing_events_after_alert.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 16:29:29 +00:00

defense_evasion_potential_http_downgrade_attack.toml

[Rule Tuning] Added Traefik Compatibility to Web Server Access Rules (#5837)

2026-03-17 16:31:46 +00:00

defense_evasion_processes_with_trailing_spaces.toml

Prep for Release 9.3 (#5548)

2026-01-12 15:38:59 +00:00

defense_evasion_timestomp_touch.toml

[Rule Tuning] Linux DR CP Tuning (#5512)

2026-01-07 15:42:02 +00:00

defense_evasion_whitespace_padding_command_line.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:14:12 +00:00

discovery_security_software_grep.toml

[New] Endpoint Rule Conversion PR (#5658)

2026-02-06 16:55:18 +00:00

discovery_virtual_machine_fingerprinting_grep.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:14:12 +00:00

execution_aws_ec2_lolbin_via_ssm.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 16:29:29 +00:00

execution_aws_ssm_sendcommand_with_command_parameters.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:14:12 +00:00

execution_aws_ssm_session_manager_child_process.toml

[Tuning] Diverse Recently Created Rules (#6191)

2026-06-01 10:09:05 +00:00

execution_azure_run_command_script_child_process.toml

[New] Azure Run Command Correlated with Process Execution (#6169)

2026-06-01 13:43:55 +00:00

execution_azure_vm_run_command_powershell_unrestricted_script.toml

[New] Azure Run Command Correlated with Process Execution (#6169)

2026-06-01 13:43:55 +00:00

execution_git_exploit_cve_2025_48384.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:14:12 +00:00

execution_nodejs_pre_or_post_install_script_execution.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:14:12 +00:00

execution_openclaw_agent_child_process.toml

[Rule Tuning] Misc GenAI Rules (#5929)

2026-04-08 12:06:59 +00:00

execution_pentest_eggshell_remote_admin_tool.toml

[Rule Tuning] Dormant & Deprecated Rule Clean-Up (#5672)

2026-02-05 12:25:47 +00:00

execution_potential_widespread_malware_infection.toml

[Rule Tuning] ESQL Query Field Dynamic Field Standardization (#4912)

2025-08-05 23:37:57 +00:00

execution_privileged_container_creation_with_host_reference.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:14:12 +00:00

execution_register_github_actions_runner.toml

[Rule Tuning] Update MDE tags to "Microsoft Defender XDR" (#5927)

2026-04-20 22:41:28 +00:00

execution_revershell_via_shell_cmd.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:14:12 +00:00

execution_sap_netweaver_jsp_webshell.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:14:12 +00:00

execution_sap_netweaver_webshell_exec.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:14:12 +00:00

execution_suspicious_java_netcon_childproc.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:14:12 +00:00

execution_suspicious_python_command_execution.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 16:29:29 +00:00

execution_via_github_actions_runner.toml

[Tuning] Execution via GitHub Actions Runner (#5892)

2026-04-22 17:17:58 +00:00

execution_via_github_runner_with_runner_tracking_id_tampering_via_env_vars.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:14:12 +00:00

exfiltration_potential_curl_data_exfiltration.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:14:12 +00:00

guided_onboarding_sample_rule.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

impact_alert_from_a_process_with_cpu_spike.toml

[Tuning] Mis Rules Tuning (#5817)

2026-03-23 10:50:54 +00:00

impact_alerts_on_host_with_cpu_spike.toml

Update impact_alerts_on_host_with_cpu_spike.toml (#5789)

2026-02-27 08:57:59 +00:00

impact_hosts_file_modified.toml

MacOS detection rules tuning (#5667)

2026-02-05 17:21:47 +00:00

impact_newly_observed_process_with_high_cpu.toml

[New] Newly Observed Process Exhibiting CPU Spike (#5635)

2026-01-28 17:40:01 +00:00

initial_access_azure_o365_with_network_alert.toml

[Rule Tuning] Fix ESQL Rules with Conflicting Lookback Windows (#6179)

2026-05-22 18:35:25 +00:00

initial_access_execution_susp_react_serv_child.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:14:12 +00:00

initial_access_file_upload_followed_by_get_request.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 16:29:29 +00:00

initial_access_fortigate_ssl_vpn_login_followed_by_siem_alert.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 16:29:29 +00:00

initial_access_ollama_api_external_access.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:14:12 +00:00

initial_access_zoom_meeting_with_no_passcode.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 16:29:29 +00:00

lateral_movement_multi_alerts_new_srcip.toml

[Tuning] High Order Rules fine tuning (#5728)

2026-02-18 23:33:20 +00:00

lateral_movement_multi_alerts_new_userid.toml

[Tuning] High Order Rules fine tuning (#5728)

2026-02-18 23:33:20 +00:00

multiple_alerts_by_host_ip_and_source_ip.toml

[Tuning] High Order Rules fine tuning (#5728)

2026-02-18 23:33:20 +00:00

multiple_alerts_different_tactics_host.toml

Update multiple_alerts_different_tactics_host.toml (#4854)

2025-06-27 12:57:56 +00:00

multiple_alerts_edr_elastic_defend_by_host.toml

[New] Alerts in Different ATT&CK Tactics by Host (#5343)

2025-11-24 17:17:46 +00:00

multiple_alerts_edr_elastic_same_process_tree.toml

[New] Multiple Elastic Defend Alerts from Single Process Tree (#5522)

2026-01-02 15:14:53 +00:00

multiple_alerts_elastic_defend_netsecurity_by_host.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 16:29:29 +00:00

multiple_alerts_email_elastic_defend_correlation.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 16:29:29 +00:00

multiple_alerts_from_different_modules_by_dstip.toml

[Tuning] High Order Rules fine tuning (#5728)

2026-02-18 23:33:20 +00:00

multiple_alerts_from_different_modules_by_srcip.toml

[Tuning] High Order Rules fine tuning (#5728)

2026-02-18 23:33:20 +00:00

multiple_alerts_from_different_modules_by_user.toml

[Tuning] High Order Rules fine tuning (#5728)

2026-02-18 23:33:20 +00:00

multiple_alerts_involving_user.toml

[Rule Tuning] Revert Event Dataset for Security Alert Index (#5994)

2026-04-28 17:18:45 +00:00

multiple_alerts_llm_by_user_entity.toml

[Rule Tuning] Misc GenAI Rules (#5929)

2026-04-08 12:06:59 +00:00

multiple_alerts_risky_host_esql.toml

[Rule Tuning] Revert Event Dataset for Security Alert Index (#5994)

2026-04-28 17:18:45 +00:00

multiple_alerts_same_tactic_by_host.toml

[Rule Tuning] Revert Event Dataset for Security Alert Index (#5994)

2026-04-28 17:18:45 +00:00

multiple_external_edr_alerts_by_host.toml

[Rule Tuning] Revert Event Dataset for Security Alert Index (#5994)

2026-04-28 17:18:45 +00:00

multiple_machine_learning_jobs_by_entity.toml

[Tuning] High Order Rules fine tuning (#5728)

2026-02-18 23:33:20 +00:00

multiple_vulnerabilities_wiz_by_container.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 16:29:29 +00:00

newly_observed_elastic_defend_alert.toml

[Tuning] ESQL Dynamic unique value fields (#5569)

2026-01-26 16:35:43 +00:00

newly_observed_elastic_detection_rule.toml

[Rule Tuning] Revert Event Dataset for Security Alert Index (#5994)

2026-04-28 17:18:45 +00:00

newly_observed_fortigate_alert.toml

[Tuning] Newly Seen FG or Suricata alert (#5734)

2026-02-23 08:37:26 +00:00

newly_observed_panos_alert.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 16:29:29 +00:00

newly_observed_suricata_alert.toml

[Tuning] Newly Seen FG or Suricata alert (#5734)

2026-02-23 08:37:26 +00:00

persistence_shell_profile_modification.toml

[Tuning] Diverse Rules Tuning (#5482)

2025-12-18 15:31:42 +00:00

persistence_ssh_authorized_keys_modification.toml

[Rule Tuning] Linux DR CP Tuning (#5512)

2026-01-07 15:42:02 +00:00

persistence_web_server_potential_command_injection.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 16:29:29 +00:00

privilege_escalation_echo_nopasswd_sudoers.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:14:12 +00:00

privilege_escalation_setuid_setgid_bit_set_via_chmod.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:14:12 +00:00

privilege_escalation_sudo_buffer_overflow.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:14:12 +00:00

privilege_escalation_sudoers_file_mod.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:14:12 +00:00

privilege_escalation_trap_execution.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:14:12 +00:00

reconnaissance_web_server_discovery_or_fuzzing_activity.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 16:29:29 +00:00

reconnaissance_web_server_unusual_spike_in_error_logs.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 16:29:29 +00:00

reconnaissance_web_server_unusual_spike_in_error_response_codes.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 16:29:29 +00:00

reconnaissance_web_server_unusual_user_agents.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 16:29:29 +00:00