diff --git a/detection_rules/etc/non-ecs-schema.json b/detection_rules/etc/non-ecs-schema.json index 55e19a65bc0..a2cc7415ab2 100644 --- a/detection_rules/etc/non-ecs-schema.json +++ b/detection_rules/etc/non-ecs-schema.json @@ -278,6 +278,7 @@ "azure.platformlogs.identity.type": "keyword", "azure.platformlogs.properties.userAgentHeader": "keyword", "azure.platformlogs.statusCode": "keyword", + "azure.resource.id": "keyword", "azure.platformlogs.properties.accountName": "keyword", "azure.platformlogs.properties.log.stage": "keyword", "azure.platformlogs.properties.log.verb": "keyword", diff --git a/rules/cross-platform/credential_access_azure_wireserver_unusual_process_connection.toml b/rules/cross-platform/credential_access_azure_wireserver_unusual_process_connection.toml new file mode 100644 index 00000000000..6e44f3c2795 --- /dev/null +++ b/rules/cross-platform/credential_access_azure_wireserver_unusual_process_connection.toml @@ -0,0 +1,169 @@ +[metadata] +creation_date = "2026/08/17" +integration = ["endpoint"] +maturity = "production" +updated_date = "2026/08/17" + +[rule] +author = ["Elastic"] +description = """ +Identifies shells, LOLBins, GTFOBins, and scripting runtimes connecting to the Azure WireServer / HostGAPlugin address +168.63.129.16 on ports 80 or 32526. The guest agent uses this fabric endpoint for GoalState, certificates, and +vmSettings. Adversaries with code execution on an Azure VM (including via Run Command) use curl, PowerShell, openssl, +bun, or similar tools to enumerate versions, pull transport certificates, and read HostGAPlugin /vmSettings. Azure +guest-agent binaries and system python used by waagent are excluded. Descendants of the guest agent are not excluded: +Run Command payloads execute in that tree. +""" +false_positives = [ + """ + Custom inventory or health scripts that call WireServer with curl or PowerShell. Validate the command line and + exclude the specific signed binary or scheduled task after review. + """, + """ + Break-glass troubleshooting by administrators using curl against 168.63.129.16. Confirm the change window and + exclude the admin host or user if the activity is authorized. + """, +] +from = "now-9m" +index = ["logs-endpoint.events.network-*"] +language = "kuery" +license = "Elastic License v2" +name = "Azure WireServer Unusual Process Connection" +note = """## Triage and analysis + +### Investigating Azure WireServer Unusual Process Connection + +`168.63.129.16` is the Azure host-only WireServer (TCP 80) and HostGAPlugin (TCP 32526) address. Elastic Defend +network events record the destination IP, port, and initiating process. They do not include the HTTP path; pair this +alert with Network Packet Capture HTTP events when available (`comp=certificates`, `/vmSettings`, `/versions`). + +Do not treat "child of waagent / WindowsAzureGuestAgent" as benign. Azure Run Command and Custom Script Extension +launch attacker scripts as descendants of those agents. Exclude only the agent binaries themselves, which this query +already omits by matching curl, PowerShell, and similar tools. + +`process.Ext.ancestry` is often empty on these network events, so EQL `descendant of` is not reliable here. + +### Possible investigation steps + +- Review `process.name`, `process.executable`, and `process.command_line` on nearby process start events. Look for + `comp=certificates`, `32526`, `vmSettings`, `LinuxTransport`, or `openssl cms -decrypt`. +- Note `destination.port`: 32526 from curl or PowerShell is uncommon for legitimate guest-agent traffic (agents use + `WaAppAgent.exe`, `WindowsAzureGuestAgent.exe`, `CollectGuestLogs.exe`, or `/usr/bin/python3.10` / waagent). +- Correlate with `169.254.169.254` IMDS access from the same process, especially `/metadata/v1/instanceinfo` (no + Metadata header) or `/metadata/identity/oauth2/token`. +- Check Azure Activity Logs for `runCommand/action` or extensions/write against this VM. +- Search StorageRead platform logs for subsequent SAS GetBlob of vmsettings or cse objects. + +### False positive analysis + +- In-house monitoring that wraps curl to WireServer. Exclude by `process.executable` or a signed parent after + validating the script contents. +- Do not exclude all children of the guest agent; that hides Run Command abuse. + +### Response and remediation + +- Isolate the VM, rotate its managed identity and any SAS recovered from vmSettings, and review extension + protectedSettings for injected configuration. +- Remove unauthorized Run Command resources and Custom Script extensions. +- Consider Azure Metadata Security Protocol (audit/enforce) to restrict which processes may call WireServer. +""" +references = [ + "https://www.netspi.com/blog/technical-blog/cloud-pentesting/decrypting-vm-extension-settings-with-azure-wireserver/", + "https://cybercx.com.au/blog/azure-ssrf-metadata/", + "https://cloud.google.com/blog/topics/threat-intelligence/escalating-privileges-azure-kubernetes-services", + "https://learn.microsoft.com/en-us/azure/virtual-network/what-is-ip-address-168-63-129-16", +] +risk_score = 47 +rule_id = "2dba3edf-1e23-4ead-a76f-458ef2060d24" +severity = "medium" +tags = [ + "Domain: Endpoint", + "Domain: Cloud", + "OS: Linux", + "OS: Windows", + "Platform: Azure", + "Platform: Windows", + "Use Case: Threat Detection", + "Tactic: Credential Access", + "Tactic: Discovery", + "Data Source: Elastic Defend", + "Resources: Investigation Guide", +] +timestamp_override = "event.ingested" +type = "new_terms" + +query = ''' +event.category: network and host.os.type: (linux or windows) and + destination.ip: "168.63.129.16" and destination.port: (80 or 32526) and + ( + process.name: ( + bash or dash or sh or tcsh or csh or zsh or ksh or fish or mksh or busybox or + bun or bun.exe or node or node.exe or nodejs or deno or deno.exe or + java or java.exe or javaw or javaw.exe or + curl or curl.exe or wget or wget.exe or + powershell.exe or pwsh.exe or pwsh or cmd.exe or + certutil.exe or bitsadmin.exe or mshta.exe or rundll32.exe or + wscript.exe or cscript.exe or regsvr32.exe or + openssl or openssl.exe or nc or ncat or netcat or socat or + python.exe or pythonw.exe or perl or perl.exe or ruby or ruby.exe or + php or php.exe or lua or lua.exe + ) or + process.executable: ( + ./* or /tmp/* or /var/tmp/* or /dev/shm/* or /run/* or /var/run/* or + /home/*/* or /root/* or "C:\\Users\\*" or "?:\\ProgramData\\*" + ) + ) and + not process.name: ( + WaAppAgent.exe or WindowsAzureGuestAgent.exe or WaSecAgentProv.exe or + CollectGuestLogs.exe or waagent or WALinuxAgent or systemd-resolved + ) and + not process.executable: ( + /usr/sbin/waagent or /usr/bin/waagent or /usr/bin/python3* or + "?:\\WindowsAzure\\Packages\\*" or "?:\\WindowsAzure\\SecAgent\\*" + ) +''' + + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1552" +name = "Unsecured Credentials" +reference = "https://attack.mitre.org/techniques/T1552/" +[[rule.threat.technique.subtechnique]] +id = "T1552.005" +name = "Cloud Instance Metadata API" +reference = "https://attack.mitre.org/techniques/T1552/005/" + + + +[rule.threat.tactic] +id = "TA0006" +name = "Credential Access" +reference = "https://attack.mitre.org/tactics/TA0006/" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1082" +name = "System Information Discovery" +reference = "https://attack.mitre.org/techniques/T1082/" + +[[rule.threat.technique]] +id = "T1580" +name = "Cloud Infrastructure Discovery" +reference = "https://attack.mitre.org/techniques/T1580/" + + +[rule.threat.tactic] +id = "TA0007" +name = "Discovery" +reference = "https://attack.mitre.org/tactics/TA0007/" + +[rule.new_terms] +field = "new_terms_fields" +value = ["host.id", "process.executable"] +[[rule.new_terms.history_window_start]] +field = "history_window_start" +value = "now-7d" + + diff --git a/rules/integrations/azure/discovery_azure_storage_anonymous_blob_access_unusual_resource.toml b/rules/integrations/azure/discovery_azure_storage_anonymous_blob_access_unusual_resource.toml new file mode 100644 index 00000000000..c160649b566 --- /dev/null +++ b/rules/integrations/azure/discovery_azure_storage_anonymous_blob_access_unusual_resource.toml @@ -0,0 +1,135 @@ +[metadata] +creation_date = "2026/08/17" +integration = ["azure"] +maturity = "production" +updated_date = "2026/08/17" + +[rule] +author = ["Elastic"] +description = """ +Identifies the first time an Azure Storage resource receives an anonymous data-plane read (GetBlob and related Get or +List operations). Anonymous requests are used to probe public containers and to test stolen blob URLs before a SAS is +appended. First-seen resource ID keeps volume down while still covering WireServer-related probes of status or extension +blobs. +""" +false_positives = [ + """ + Intentionally public containers (static websites, public datasets) generate anonymous GetBlob and ListBlobs. + Baseline those storage accounts and exclude `azure.resource.id` after review. + """, + """ + Internet-wide scanners will produce first-seen anonymous access on newly created or newly logged accounts. Confirm + whether the account is meant to be public. + """, +] +from = "now-9m" +index = ["logs-azure.platformlogs-*"] +language = "kuery" +license = "Elastic License v2" +name = "Azure Storage Anonymous Blob Access to Unusual Resource" +note = """## Triage and analysis + +### Investigating Azure Storage Anonymous Blob Access to Unusual Resource + +StorageRead platform logs record `AuthenticationType` as Anonymous when no SAS, OAuth, or account key is presented. +A first-seen `azure.resource.id` (typically the blob service +`/subscriptions/.../storageAccounts//blobServices/default`) means this resource has not had anonymous Get or +List traffic in the history window. + +WireServer SAS-replay chains often start with an anonymous GetBlob (HTTP 409/403) against the same object, then a +SAS 200. This rule does not require guest-agent path strings; those lab container names are not production +observables. + +`source.ip` is often empty. Use `source.address` (`ip:port`). + +### Possible investigation steps + +- Review `event.action`, `azure.platformlogs.statusCode`, and `azure.platformlogs.uri`. +- HTTP 200 with Anonymous means the container or blob is publicly readable. HTTP 409/403 is a probe. +- Identify the account from `azure.resource.id` / `azure.resource.name` and check whether public access is intended. +- Search for SAS-authenticated GetBlob to the same account from the same source shortly after. +- If the URI contains `/$system/` or `md-hdd-`, correlate with WireServer access on VMs in the subscription. + +### False positive analysis + +- Public blob websites and CDN origins. Exclude the `azure.resource.id` for approved public accounts. +- New accounts that enable StorageRead for the first time will alert on the first scanner hit. + +### Response and remediation + +- Disable anonymous public access on accounts that should be private. +- If a follow-on SAS read exists, revoke that SAS and review how the URL was obtained. +- Keep StorageRead diagnostic logs enabled on storage accounts of interest. +""" +references = [ + "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/storagebloblogs", + "https://learn.microsoft.com/en-us/azure/storage/blobs/anonymous-read-access-prevent", + "https://cybercx.com.au/blog/azure-ssrf-metadata/", + "https://www.netspi.com/blog/technical-blog/cloud-pentesting/decrypting-vm-extension-settings-with-azure-wireserver/", +] +risk_score = 47 +rule_id = "eabaf807-e710-4f0f-8943-8d1b436d834a" +setup = """#### Required Azure Storage Diagnostic Logs + +Enable StorageRead diagnostic logs on Azure Storage Accounts and stream them to the Event Hub used by the Azure +integration. Anonymous vs SAS is `azure.platformlogs.identity.type`. +""" +severity = "medium" +tags = [ + "Domain: Cloud", + "Data Source: Azure", + "Data Source: Azure Platform Logs", + "Platform: Azure", + "Service: Azure Storage", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Tactic: Collection", + "Resources: Investigation Guide", +] +timestamp_override = "event.ingested" +type = "new_terms" + +query = ''' +data_stream.dataset: azure.platformlogs and + azure.platformlogs.identity.type: Anonymous and + event.action: ( + GetBlob or GetBlobMetadata or GetBlobProperties or GetBlockList or + GetPageRanges or QueryBlobContents or ListBlobs or + GetContainerProperties or GetContainerMetadata or GetContainerAcl + ) +''' + + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1580" +name = "Cloud Infrastructure Discovery" +reference = "https://attack.mitre.org/techniques/T1580/" + + +[rule.threat.tactic] +id = "TA0007" +name = "Discovery" +reference = "https://attack.mitre.org/tactics/TA0007/" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1530" +name = "Data from Cloud Storage" +reference = "https://attack.mitre.org/techniques/T1530/" + + +[rule.threat.tactic] +id = "TA0009" +name = "Collection" +reference = "https://attack.mitre.org/tactics/TA0009/" + +[rule.new_terms] +field = "new_terms_fields" +value = ["azure.resource.id"] +[[rule.new_terms.history_window_start]] +field = "history_window_start" +value = "now-7d" + + diff --git a/rules/linux/credential_access_azure_wireserver_openssl_cms_decrypt.toml b/rules/linux/credential_access_azure_wireserver_openssl_cms_decrypt.toml new file mode 100644 index 00000000000..001049279a6 --- /dev/null +++ b/rules/linux/credential_access_azure_wireserver_openssl_cms_decrypt.toml @@ -0,0 +1,138 @@ +[metadata] +creation_date = "2026/08/17" +integration = ["endpoint"] +maturity = "production" +updated_date = "2026/08/17" + +[rule] +author = ["Elastic"] +description = """ +Identifies OpenSSL generating a CN=LinuxTransport certificate or decrypting CMS/PKCS7 payloads with a key that is not +the Azure Linux Agent certificate under /var/lib/waagent. Adversaries can scrape WireServer certificates, mint a +LinuxTransport identity, and decrypt extension protectedSettings with openssl cms -decrypt or smime -decrypt. +""" +false_positives = [ + """ + Custom configuration-management that decrypts CMS blobs with an organization key outside /var/lib/waagent. Confirm + the key path and exclude the specific command line after review. + """, +] +from = "now-9m" +index = ["logs-endpoint.events.process-*"] +language = "eql" +license = "Elastic License v2" +name = "Azure WireServer OpenSSL Certificate Decrypt or LinuxTransport Generation" +note = """## Triage and analysis + +### Investigating Azure WireServer OpenSSL Certificate Decrypt or LinuxTransport Generation + +CyberCX-style WireServer abuse on Linux generates `openssl req -x509 -subj /CN=LinuxTransport`, posts the public +certificate to WireServer `comp=certificates`, then runs `openssl cms -decrypt` or `openssl smime -decrypt` with +`temp.key`, `wireserver.key`, or another non-waagent key to unwrap protectedSettings. + +Benign Azure Linux Agent activity looks like: + +`openssl cms -inform DER -decrypt -recip /var/lib/waagent/.crt -inkey /var/lib/waagent/.prv` + +The Azure Linux Agent is excluded by certificate path (`/var/lib/waagent/*`) and by parent `waagent` / +`WALinuxAgent` / `/usr/sbin/waagent`. This does not exclude Python or `run-command-extension` as parents because attacker +scripts invoked via RunCommand use those parents with a non-waagent key. The agent itself also runs +`openssl req ... /CN=LinuxTransport` with output under `/var/lib/waagent/`; that path exclusion covers it. + +### Possible investigation steps + +- Review `process.command_line` and `process.args` for `LinuxTransport`, `wireserver.key`, `temp.key`, `payload.p7m`, + or `payload.pfx`. +- Inspect parent and grandparent: Run Command (`/var/lib/waagent/run-command/`) or an interactive shell is higher + risk than a one-off admin session with a ticket. +- Correlate with network events from curl to `168.63.129.16` ports 80 and 32526 on the same host. +- Search StorageRead logs for anonymous or SAS GetBlob of the same storage account after the decrypt. +- Hunt for the generated key files (`temp.key`, `wireserver.key`) on disk and in `/tmp`. + +### False positive analysis + +- The Azure Linux Agent decrypt path under `/var/lib/waagent/` and waagent parent processes are excluded. +- Legitimate certificate tooling that uses `-subj /CN=LinuxTransport` is unexpected; treat as suspicious until proven + otherwise. + +### Response and remediation + +- Isolate the VM, delete attacker-generated keys and decrypted payloads, and rotate secrets that were in + protectedSettings (SAS, connection strings, CSE script contents). +- Rotate the VM managed identity and review extension configuration. +- Revoke any SAS that was replayed from the decrypted settings. +""" +references = [ + "https://cybercx.com.au/blog/azure-ssrf-metadata/", + "https://www.netspi.com/blog/technical-blog/cloud-pentesting/decrypting-vm-extension-settings-with-azure-wireserver/", + "https://cloud.google.com/blog/topics/threat-intelligence/escalating-privileges-azure-kubernetes-services", + "https://gtfobins.github.io/gtfobins/openssl/", +] +risk_score = 47 +rule_id = "5bb27863-2da6-4d0d-879a-1efb10479c39" +severity = "medium" +tags = [ + "Domain: Endpoint", + "Domain: Cloud", + "OS: Linux", + "Use Case: Threat Detection", + "Platform: Azure", + "Platform: Linux", + "Tactic: Credential Access", + "Data Source: Elastic Defend", + "Resources: Investigation Guide", +] +timestamp_override = "event.ingested" +type = "eql" + +query = ''' +process where host.os.type == "linux" and event.type == "start" and +event.action in ("exec", "exec_event", "start") and process.name == "openssl" and +( + ( + process.args in ("cms", "smime") and process.args == "-decrypt" + ) or + ( + process.args == "req" and process.args : "*LinuxTransport*" + ) +) and +not process.args like "/var/lib/waagent/*" and +not process.parent.name in ("waagent", "WALinuxAgent") and +not process.parent.executable like ( + "/usr/sbin/waagent", + "/usr/bin/waagent", + "/var/lib/waagent/*" +) +''' + + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1552" +name = "Unsecured Credentials" +reference = "https://attack.mitre.org/techniques/T1552/" +[[rule.threat.technique.subtechnique]] +id = "T1552.005" +name = "Cloud Instance Metadata API" +reference = "https://attack.mitre.org/techniques/T1552/005/" + + + +[rule.threat.tactic] +id = "TA0006" +name = "Credential Access" +reference = "https://attack.mitre.org/tactics/TA0006/" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1140" +name = "Deobfuscate/Decode Files or Information" +reference = "https://attack.mitre.org/techniques/T1140/" + + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" + diff --git a/rules/network/credential_access_azure_wireserver_http_request_unexpected_user_agent.toml b/rules/network/credential_access_azure_wireserver_http_request_unexpected_user_agent.toml new file mode 100644 index 00000000000..5e6acbb954b --- /dev/null +++ b/rules/network/credential_access_azure_wireserver_http_request_unexpected_user_agent.toml @@ -0,0 +1,154 @@ +[metadata] +creation_date = "2026/08/17" +integration = ["network_traffic"] +maturity = "production" +updated_date = "2026/08/17" + +[rule] +author = ["Elastic"] +description = """ +Identifies HTTP requests to Azure WireServer (168.63.129.16) for GoalState, certificates, versions, or HostGAPlugin +vmSettings that do not use a known guest-agent user agent. These requests retrieve transport certificates and extension +protectedSettings, including embedded SAS URLs. Azure Linux Agent, Windows guest agent, and related platform UAs are +excluded. Requests with no user agent are also excluded; that pattern is common for the Windows guest agent. +""" +false_positives = [ + """ + Custom health checks that call HostGAPlugin /versions or /vmSettings with curl. Exclude the specific user agent or + host group after validating the script. + """, +] +from = "now-9m" +index = ["logs-network_traffic.http*"] +language = "eql" +license = "Elastic License v2" +name = "Azure WireServer HTTP Request from Unexpected User Agent" +note = """## Triage and analysis + +### Investigating Azure WireServer HTTP Request from Unexpected User Agent + +Network Packet Capture with HTTP decoding on ports 80 and 32526 shows the URI that Elastic Defend network events +lack. The match is the WireServer path or query, not a scripting-tool user-agent allowlist. + +- `url.query` contains `comp=versions` (discovery) +- `url.query` contains `comp=goalstate` (incarnation, container, extension list, statusUploadBlob pointer) +- `url.query` contains `comp=certificates` (often with request header `x-ms-guest-agent-public-x509-cert`) +- `destination.port == 32526` and `url.path` in `/versions`, `/vmSettings` + +Excluded user agents from lab guest-agent traffic: `WALinuxAgent/*`, `VMAgent/*`, `Python-urllib/*`, +`cpprestsdk/*`, `ACMS/*`, and a missing user agent (Windows guest agent). Curl and Windows PowerShell are not +excluded and will fire. + +`/vmSettings` response bodies are often dropped when they exceed keyword `ignore_above`. The URI, port, and user +agent are sufficient. Do not enable body capture to chase this rule. + +### Possible investigation steps + +- Confirm `url.path`, `url.query`, `destination.port`, and `user_agent.original`. +- GoalState (`comp=goalstate`) is reconnaissance; `comp=certificates` means the client presented a transport + certificate. Look on the host for `openssl req ... LinuxTransport` or a stolen `.crt`/`.key`. +- Correlate with endpoint network events from the same `host.name` to `168.63.129.16` and process start events for + openssl cms decrypt. +- Search StorageRead platform logs for anonymous or SAS GetBlob against the same storage account after the scrape. + +### False positive analysis + +- Administrative curl or other non-agent clients against WireServer during incident response. Exclude the specific + user agent or host after the change window. +- A new Microsoft guest-agent build with an unfamiliar user agent will fire until that UA is excluded. +- Omitting the user agent looks like the Windows guest agent and is not matched. Do not treat a missing UA as + suspicious on its own. + +### Response and remediation + +- Isolate the VM, rotate secrets recovered from vmSettings, and review extension protectedSettings. +- Enable Metadata Security Protocol in audit or enforce mode to restrict WireServer callers. +""" +references = [ + "https://cybercx.com.au/blog/azure-ssrf-metadata/", + "https://www.netspi.com/blog/technical-blog/cloud-pentesting/decrypting-vm-extension-settings-with-azure-wireserver/", + "https://cloud.google.com/blog/topics/threat-intelligence/escalating-privileges-azure-kubernetes-services", + "https://learn.microsoft.com/en-us/azure/virtual-network/what-is-ip-address-168-63-129-16", +] +risk_score = 47 +rule_id = "359b5925-a625-4803-90d2-19e44a37d98e" +setup = """## Setup + +Deploy the [Network Packet Capture](https://www.elastic.co/docs/reference/integrations/network_traffic) integration +via Fleet on Azure virtual machines. Default HTTP port lists do not include HostGAPlugin. + +Required integration settings: + +- Enable **Capture HTTP Traffic**. +- Set HTTP ports to include **80** (WireServer GoalState, versions, certificates) and **32526** (HostGAPlugin + `/versions`, `/vmSettings`). Without 32526, HostGAPlugin requests are invisible. +- Enable **Monitor Processes** so HTTP events include `process.*` when available. +- Optional: **Send all headers** to retain `x-ms-version` and `x-ms-guest-agent-public-x509-cert` for investigation. + The rule matches URI, port, and user agent, not the certificate PEM. +- Do not enable request or response body capture for this rule. `/vmSettings` bodies are large and often dropped; + other WireServer XML is not required for the match. +""" +severity = "medium" +tags = [ + "Domain: Cloud", + "Domain: Network", + "OS: Linux", + "OS: Windows", + "Platform: Azure", + "Use Case: Threat Detection", + "Tactic: Credential Access", + "Tactic: Discovery", + "Data Source: Network Packet Capture", + "Resources: Investigation Guide", +] +timestamp_override = "event.ingested" +type = "eql" + +query = ''' +network where event.module == "network_traffic" and +destination.ip == "168.63.129.16" and +user_agent.original != null and +not user_agent.original : ( + "WALinuxAgent*", + "VMAgent*", + "Python-urllib*", + "cpprestsdk*", + "ACMS/*" +) and +( + url.query : ("*comp=versions*", "*comp=goalstate*", "*comp=certificates*") or + (destination.port == 32526 and url.path : ("/versions", "/vmSettings")) +) +''' + + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1552" +name = "Unsecured Credentials" +reference = "https://attack.mitre.org/techniques/T1552/" +[[rule.threat.technique.subtechnique]] +id = "T1552.005" +name = "Cloud Instance Metadata API" +reference = "https://attack.mitre.org/techniques/T1552/005/" + + + +[rule.threat.tactic] +id = "TA0006" +name = "Credential Access" +reference = "https://attack.mitre.org/tactics/TA0006/" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1082" +name = "System Information Discovery" +reference = "https://attack.mitre.org/techniques/T1082/" + + +[rule.threat.tactic] +id = "TA0007" +name = "Discovery" +reference = "https://attack.mitre.org/tactics/TA0007/" +