[New Rule] Azure WireServer Abuse Related Detections - #6668
Open
terrancedejesus wants to merge 9 commits into
Open
[New Rule] Azure WireServer Abuse Related Detections#6668terrancedejesus wants to merge 9 commits into
terrancedejesus wants to merge 9 commits into
Conversation
Detects the documented WireServer/HostGAPlugin scrape chain used to decrypt transport certs and replay guest-agent SAS against Azure Storage. Co-authored-by: Cursor <cursoragent@cursor.com>
terrancedejesus
added
Integration: Azure
|
⛔️ Test failed Results
|
terrancedejesus
changed the title
Clarified the context of Azure Storage SAS retrieval detection and false positives.
|
⛔️ Test failed Results
|
Customer StorageRead cannot see Microsoft fabric $system blobs, so that rule is removed. OpenSSL now matches cms and smime decrypt and excludes waagent LinuxTransport generation. Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
|
⛔️ Test failed Results
|
terrancedejesus
marked this pull request as ready for review
August 27, 2026 15:02
terrancedejesus
requested review from
Aegrah,
Samirbous,
bryans3c,
imays11 and
w0rk3r
August 27, 2026 15:03
Contributor
There was a problem hiding this comment.
Pull request overview
This PR introduces a set of new detection rules aimed at identifying Azure WireServer/HostGAPlugin abuse (GoalState/certificate/vmSettings scraping and follow-on anonymous blob access) and adds schema support for a new Azure field used by the rules.
Changes:
- Add a Network Packet Capture rule to detect WireServer/HostGAPlugin HTTP requests with unexpected user agents.
- Add Elastic Defend rules to detect unusual guest process connections to WireServer/HostGAPlugin and suspicious OpenSSL CMS decrypt / LinuxTransport certificate generation on Linux.
- Add an Azure Platform Logs new-terms rule for first-seen anonymous Azure Storage blob read activity, plus schema support for
azure.resource.id.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| rules/network/credential_access_azure_wireserver_http_request_unexpected_user_agent.toml | New EQL rule for detecting WireServer/HostGAPlugin HTTP requests with non-guest-agent user agents. |
| rules/linux/credential_access_azure_wireserver_openssl_cms_decrypt.toml | New Linux EQL rule for OpenSSL decrypt / LinuxTransport cert generation behaviors associated with WireServer abuse. |
| rules/integrations/azure/discovery_azure_storage_anonymous_blob_access_unusual_resource.toml | New Azure Platform Logs new-terms rule for first-seen anonymous blob read activity on a resource. |
| rules/cross-platform/credential_access_azure_wireserver_unusual_process_connection.toml | New cross-platform new-terms rule for unusual process-to-WireServer/HostGAPlugin connections in endpoint network telemetry. |
| detection_rules/etc/non-ecs-schema.json | Adds azure.resource.id mapping needed by the new Azure new-terms rule. |
Suppressed comments (1)
rules/cross-platform/credential_access_azure_wireserver_unusual_process_connection.toml:15
- The rule description says “system python used by waagent” is excluded, but the query actually excludes
/usr/bin/python3*broadly (and doesn’t otherwise match Linuxpython/python3by name). Consider rewording the description so it reflects the actual exclusion behavior.
bun, or similar tools to enumerate versions, pull transport certificates, and read HostGAPlugin /vmSettings. Azure
guest-agent binaries and system python used by waagent are excluded. Descendants of the guest agent are not excluded:
Run Command payloads execute in that tree.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Updated the 'updated_date' field to match the creation date.
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
|
⛔️ Test failed Results
|
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
|
⛔️ Test failed Results
|
|
⛔️ Test failed Results
|
|
⛔️ Test failed Results
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary - What I changed
Azure VMs expose WireServer at
168.63.129.16:80and HostGAPlugin at:32526. Those endpoints return GoalState, transport certificates, andvmSettings/protectedSettingsthat embed SAS URLs for Microsoft fabric blobs. CyberCX and NetSPI documented decrypting the LinuxTransport / CRP cert and reading those settings without the IMDS metadata header. From a compromised guest or via SSRF, an attacker scrapes WireServer, decrypts the transport cert, and can walk anonymously accessible blobs.:80) or HostGAPlugin (:32526)openssl cms/smime -decryptor LinuxTransport cert generation outside waagent pathsHow To Test
Validated against TRADE emulation telemetry (
wslin5b7592/wswin5b7592): StorageRead platform logs, Elastic Defend network, and NPC HTTP on ports 80 and 32526.Checklist
Rule: New