deardaniel/secdata-raw huggingface dataset:
Elastic SIEM Detection Rules: defense evasion self deleted python script accessing sensitive files

# Self-Deleted Python Script Accessing Sensitive Files

---

## Metadata

- **Author:** Elastic
- **Description:** Detects access to potentially sensitive files by a Python script that deletes itself from disk. This behavior is characteristic of sophisticated malware that executes from memory and avoids leaving behind forensic artifacts. Notably used in high-profile DPRK-linked financial heists.

- **UUID:** `7ab00c3d-0ed3-4e4b-9806-b19959bf6b12`
- **Integration:** [endpoint](https://docs.elastic.co/integrations/endpoint)
- **Language:** `[EQL]`
- **Source File:** [Self-Deleted Python Script Accessing Sensitive Files](../queries/defense_evasion_self_deleted_python_script_accessing_sensitive_files.toml)

## Query

```sql
sequence by process.entity_id with maxspan=15s
  [file where event.action == "deletion" and file.extension in ("py", "pyc") and process.name like~ "python*"]
  [file where event.action == "open"]
```

## Notes

- This hunt detects Python-based scripts that self-delete and continue to access sensitive files (e.g., AWS credentials, SSH keys, keychains).
- File paths in this logic can be enriched or customized to detect access to specific secrets in your environment.
- Ideal for detecting evasive memory-resident malware and credential theft operations.

## MITRE ATT&CK Techniques

- [T1059.006](https://attack.mitre.org/techniques/T1059/006)
- [T1070.004](https://attack.mitre.org/techniques/T1070/004)
- [T1552.001](https://attack.mitre.org/techniques/T1552/001)

## References

- https://www.elastic.co/security-labs/dprk-code-of-conduct
- https://unit42.paloaltonetworks.com/slow-pisces-new-custom-malware/
- https://slowmist.medium.com/cryptocurrency-apt-intelligence-unveiling-lazarus-groups-intrusion-techniques-a1a6efda7d34
- https://x.com/safe/status/[PII_REDACTED]75649938
- https://www.sygnia.co/blog/sygnia-investigation-bybit-hack/

## License

- `Elastic License v2`
Elastic SIEM Detection Rules: execution unsigned or untrusted binary fork via python

# Unsigned or Untrusted Binary Forked by Python

---

## Metadata

- **Author:** Elastic
- **Description:** This hunt identifies unsigned or untrusted binaries executed via a fork from Python, where the binary resides in the user's home directory. This behavior may be associated with malware execution or script-based delivery mechanisms, especially those attempting to blend in with legitimate user activity.

- **UUID:** `02e50f28-d5a1-4289-ab49-48ae0e2ca196`
- **Integration:** [endpoint](https://docs.elastic.co/integrations/endpoint)
- **Language:** `[EQL]`
- **Source File:** [Unsigned or Untrusted Binary Forked by Python](../queries/execution_unsigned_or_untrusted_binary_fork_via_python.toml)

## Query

```sql
process where event.type == "start" and event.action == "fork" and process.executable like "/Users/*" and
 (process.code_signature.trusted == false or process.code_signature.exists == false) and
 process.args_count == 2 and process.args like "/Users/*" and process.args like "/Users/*" and
 process.parent.name like~ "python*"
```

## Notes

- This hunt helps identify suspicious Python-driven execution of unsigned binaries located within the /Users directory.
- Pivoting on `process.entity_id` can help identify the broader context around the execution — including parent commands and child activity.
- Can be tuned further based on specific binary paths seen in your environment.

## MITRE ATT&CK Techniques

- [T1059.006](https://attack.mitre.org/techniques/T1059/006)

## References

- https://www.elastic.co/security-labs/dprk-code-of-conduct
- https://unit42.paloaltonetworks.com/slow-pisces-new-custom-malware/
- https://slowmist.medium.com/cryptocurrency-apt-intelligence-unveiling-lazarus-groups-intrusion-techniques-a1a6efda7d34
- https://x.com/safe/status/[PII_REDACTED]75649938
- https://www.sygnia.co/blog/sygnia-investigation-bybit-hack/

## License

- `Elastic License v2`
Elastic SIEM Detection Rules: execution suspicious executable file modification via docker

# Suspicious Executable File Modification via Docker

---

## Metadata

- **Author:** Elastic
- **Description:** Detects when Docker or Docker Desktop processes modify executable files within user-accessible or temporary directories. These locations are commonly used by attackers to stage payloads or drop binaries during post-exploitation activity.

- **UUID:** `f5b1afc4-207c-11f0-aa05-f661ea17fbcd`
- **Integration:** [endpoint](https://docs.elastic.co/integrations/endpoint)
- **Language:** `[EQL]`
- **Source File:** [Suspicious Executable File Modification via Docker](../queries/execution_suspicious_executable_file_modification_via_docker.toml)

## Query

```sql
file where event.action == "modification" and
  (process.name in ("docker", "Docker Desktop") or process.name like "com.docker*") and
  file.Ext.header_bytes like~ ("cffaedfe*", "cafebabe*") and
  file.path like ("/tmp/*", "/private/tmp/*", "/Users/Shared/*", "/Users/*/Public/*", "/Users/*/Downloads/*", "/Users/*/Desktop/*", "/Users/*/Documents/*")
```

## Notes

- Executable file writes from Docker processes in user or temp directories are suspicious in most environments.
- This behavior may indicate container escape attempts, tool staging, or post-exploitation binary drops.
- The header byte patterns 'cffaedfe' (Mach-O) and 'cafebabe' (Java class files) help identify actual executables being written.

## MITRE ATT&CK Techniques

- [T1105](https://attack.mitre.org/techniques/T1105)
- [T1204.002](https://attack.mitre.org/techniques/T1204/002)

## References

- https://www.elastic.co/security-labs/dprk-code-of-conduct
- https://unit42.paloaltonetworks.com/slow-pisces-new-custom-malware/
- https://slowmist.medium.com/cryptocurrency-apt-intelligence-unveiling-lazarus-groups-intrusion-techniques-a1a6efda7d34
- https://x.com/safe/status/[PII_REDACTED]75649938
- https://www.sygnia.co/blog/sygnia-investigation-bybit-hack/

## License

- `Elastic License v2`
Elastic SIEM Detection Rules: execution suspicious file access via docker

# Sensitive File Access via Docker

---

## Metadata

- **Author:** Elastic
- **Description:** Detects Docker or Docker Desktop processes accessing potentially sensitive host files, including SSH keys, cloud provider credentials, browser data, or crypto wallet files. This behavior may indicate container escape attempts, data harvesting from the host, or misconfigured volume mounts exposing secrets.

- **UUID:** `fb136106-207c-11f0-aa05-f661ea17fbcd`
- **Integration:** [endpoint](https://docs.elastic.co/integrations/endpoint)
- **Language:** `[EQL]`
- **Source File:** [Sensitive File Access via Docker](../queries/execution_suspicious_file_access_via_docker.toml)

## Query

```sql
file where event.action == "open" and
  (process.name in ("docker", "Docker Desktop") or process.name like "com.docker*") and
  not file.name in ("System.keychain", "login.keychain-db")
```

## Notes

- Docker processes accessing sensitive host files may suggest attempts to harvest credentials from the host system.
- You may enrich this detection by adding file paths for `.aws/credentials`, `.ssh/id_rsa`, `keychain`, or `Cookies`.
- Consider filtering legitimate developer use cases or adjusting for specific containers if needed.

## MITRE ATT&CK Techniques

- [T1083](https://attack.mitre.org/techniques/T1083)
- [T1552.001](https://attack.mitre.org/techniques/T1552/001)

## References

- https://www.elastic.co/security-labs/dprk-code-of-conduct
- https://unit42.paloaltonetworks.com/slow-pisces-new-custom-malware/
- https://slowmist.medium.com/cryptocurrency-apt-intelligence-unveiling-lazarus-groups-intrusion-techniques-a1a6efda7d34
- https://x.com/safe/status/[PII_REDACTED]75649938
- https://www.sygnia.co/blog/sygnia-investigation-bybit-hack/

## License

- `Elastic License v2`
Elastic SIEM Detection Rules: excessive rdp network activity by source host and user

# Excessive RDP Network Activity by Host and User

---

## Metadata

- **Author:** Elastic
- **Description:** This hunt looks for a high occurrence of remote desktop connections from the same host and user. The number of unique destination IP addresses is compared to a defined threshold. This could be a sign of discovery or lateral movement via the Remote Desktop Protocol (RDP).

- **UUID:** `f7d2054f-b571-4cd0-b39e-a779576e9398`
- **Integration:** [endpoint](https://docs.elastic.co/integrations/endpoint), [windows](https://docs.elastic.co/integrations/windows)
- **Language:** `[ES|QL]`
- **Source File:** [Excessive RDP Network Activity by Host and User](../queries/excessive_rdp_network_activity_by_source_host_and_user.toml)

## Query

```sql
from logs-endpoint.events.network-*, logs-windows.sysmon_operational-*
| where  @timestamp > now() - 7 day
| where host.os.family == "windows" and event.category == "network" and network.direction == "egress" and
  network.transport == "tcp"and destination.port == 3389 and source.port >= 49152
| keep destination.ip, host.id, user.name
| stats count_unique_dst = count_distinct(destination.ip) by host.id, user.name
 /* threshold set to 10 but can be adjusted to reduce normal baseline in your env */
| where count_unique_dst >= 10
```

```sql
from logs-endpoint.events.network-*, logs-windows.sysmon_operational-*
| where  @timestamp > now() - 7 day
| where host.os.family == "windows" and event.category == "network" and process.name == "svchost.exe" and network.direction == "ingress" and
  network.transport == "tcp"and destination.port == 3389 and source.port >= 49152
| stats agents = count_distinct(host.id) by source.ip
| where agents >= 10
```

## Notes

- Further investigation can done pivoting by `host.id` and `user.name`.
- Depending on normal SysAdmin RDP activity, the threshold of 10 can be adjusted to reduce normal noisy activity.
- The second query uses Windows Security log event ID 4624 to summarize numbers of RDP connections by `source.ip` and `user.name` and duration.

## MITRE ATT&CK Techniques

- [T1021](https://attack.mitre.org/techniques/T1021)
- [T1021.001](https://attack.mitre.org/techniques/T1021/001)

## License

- `Elastic License v2`
Elastic SIEM Detection Rules: scheduled tasks creation for unique hosts by task command

# Scheduled Tasks Creation for Unique Hosts by Task Command

---

## Metadata

- **Author:** Elastic
- **Description:** Using aggregation and strings extraction, this hunt identifies instances where a scheduled task is created and set to run a command unique to a specific host. This could be the result of persistence as a Windows Scheduled Task.

- **UUID:** `44223fd6-8241-4c21-9d54-21201fa15b12`
- **Integration:** [system](https://docs.elastic.co/integrations/system)
- **Language:** `[ES|QL]`
- **Source File:** [Scheduled Tasks Creation for Unique Hosts by Task Command](../queries/scheduled_tasks_creation_for_unique_hosts_by_task_command.toml)

## Query

```sql
from logs-system.security-*
| where  @timestamp > now() - 7 day
| where host.os.family == "windows" and event.code == "4698" and event.action == "scheduled-task-created"
 /* parsing unstructured data from winlog message to extract a scheduled task Exec command */
| grok message "(?<Command><Command>.+</Command>)" | eval Command = replace(Command, "(<Command>|</Command>)", "")
| where Command is not null
 /* normalise task name by removing usersid and uuid string patterns */
| eval TaskName = replace(winlog.event_data.TaskName, """((-S-1-5-.*)|\{[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}\})""", "")
 /* normalise task name by removing random patterns in a file path */
| eval Task_Command = replace(Command, """(ns[a-z][A-Z0-9]{3,4}\.tmp|DX[A-Z0-9]{3,4}\.tmp|7z[A-Z0-9]{3,5}\.tmp|[0-9\.\-\_]{3,})""", "")
 /* normalize user home profile path */
| eval Task_Command = replace(Task_Command, """[cC]:\\[uU][sS][eE][rR][sS]\\[a-zA-Z0-9\.\-\_\$~]+\\""", "C:\\\\users\\\\user\\\\")
| where Task_Command like "?*" and not starts_with(Task_Command, "C:\\Program Files") and not starts_with(Task_Command, "\"C:\\Program Files")
| stats tasks_count = count(*), hosts_count = count_distinct(host.id) by Task_Command, TaskName
| where hosts_count == 1
```

## Notes

- This hunt returns the aggregation of created tasks by task name, command to execute and number of hosts where this task is present.
- Close attention should be paid to suspicious paths like `C:\Users\Public and C:\ProgramData\` as well as LOLBins.

## MITRE ATT&CK Techniques

- [T1053](https://attack.mitre.org/techniques/T1053)
- [T1053.005](https://attack.mitre.org/techniques/T1053/005)

## License

- `Elastic License v2`
Elastic SIEM Detection Rules: execution via remote services by client address

# Execution via Remote Services by Client Address

---

## Metadata

- **Author:** Elastic
- **Description:** This hunt aggregates process execution via remote network logon by source address, account name and where the parent process is related to remote services such as WMI, WinRM, DCOM and remote PowerShell. This may indicate lateral movement via remote services.

- **UUID:** `5fd5da54-0515-4d6b-b8d7-30fd05f5be33`
- **Integration:** [endpoint](https://docs.elastic.co/integrations/endpoint)
- **Language:** `[ES|QL]`
- **Source File:** [Execution via Remote Services by Client Address](../queries/execution_via_remote_services_by_client_address.toml)

## Query

```sql
from logs-endpoint.events.process-*
| where  @timestamp > now() - 7 day and host.os.family == "windows" and
  event.category == "process" and event.action == "start" and
  /* network logon type */
  process.Ext.session_info.logon_type == "Network" and
  (process.parent.name .caseless in ("wmiprvse.exe", "wsmprovhost.exe", "winrshost.exe") or (process.parent.name == "svchost.exe" and process.parent.args == "DcomLaunch"))
| stats total = count(*), hosts = count_distinct(host.id) by process.Ext.session_info.client_address, user.name, process.parent.name
 /* sort by top source.ip and account */
| sort total desc
```

## Notes

- `process.Ext.session_info.*` is populated for Elastic Defend versions 8.6.0+.

## MITRE ATT&CK Techniques

- [T1021](https://attack.mitre.org/techniques/T1021)
- [T1021.003](https://attack.mitre.org/techniques/T1021/003)
- [T1021.006](https://attack.mitre.org/techniques/T1021/006)
- [T1047](https://attack.mitre.org/techniques/T1047)

## License

- `Elastic License v2`
Elastic SIEM Detection Rules: suspicious dns txt record lookups by process

# Suspicious DNS TXT Record Lookups by Process

---

## Metadata

- **Author:** Elastic
- **Description:** Leveraging aggregation by process executable entities, this hunt identifies identifies a high number of DNS TXT record queries from same process.
Adversaries may leverage DNS TXT queries to stage malicious content or exfiltrate data.

- **UUID:** `7a2c8397-d219-47ad-a8e2-93562e568d08`
- **Integration:** [endpoint](https://docs.elastic.co/integrations/endpoint), [windows](https://docs.elastic.co/integrations/windows)
- **Language:** `[ES|QL]`
- **Source File:** [Suspicious DNS TXT Record Lookups by Process](../queries/suspicious_dns_txt_record_lookups_by_process.toml)

## Query

```sql
from logs-endpoint.events.network-*, logs-windows.sysmon_operational-*
| where host.os.family == "windows" and event.category == "network" and
  event.action in ("lookup_requested", "DNSEvent (DNS query)") and
  (dns.question.type == "TXT" or dns.answers.type == "TXT") and process.executable != "C:\\Windows\\system32\\svchost.exe"
| keep process.executable,  process.entity_id
| stats occurrences = count(*) by process.entity_id, process.executable
 /* threshold can be adjusted to your env */
| where occurrences >= 50
```

## Notes

- This hunt returns a list of processes unique pids and executable paths that performs a high number of DNS TXT lookups.
- Pivoting by `process.entity_id` will allow further investigation (parent process, hash, child processes, other network events etc.).

## MITRE ATT&CK Techniques

- [T1071](https://attack.mitre.org/techniques/T1071)
- [T1071.004](https://attack.mitre.org/techniques/T1071/004)

## License

- `Elastic License v2`
Elastic SIEM Detection Rules: windows command and scripting interpreter from unusual parent

# Windows Command and Scripting Interpreter from Unusual Parent Process

---

## Metadata

- **Author:** Elastic
- **Description:** This hunt looks for unusual Microsoft native processes spawning `cmd.exe`, `powershell.exe` or `conhost.exe` and limited to a unique host. This could be normal rare behavior as well as an interactive shell activity from an injected parent process to execute system commands.

- **UUID:** `aca4877f-d284-4bdb-8e18-b1414d3a7c20`
- **Integration:** [endpoint](https://docs.elastic.co/integrations/endpoint), [windows](https://docs.elastic.co/integrations/windows), [system](https://docs.elastic.co/integrations/system)
- **Language:** `[ES|QL]`
- **Source File:** [Windows Command and Scripting Interpreter from Unusual Parent Process](../queries/windows_command_and_scripting_interpreter_from_unusual_parent.toml)

## Query

```sql
from logs-endpoint.events.process-*, logs-windows.sysmon_operational-*, logs-system.security-*
| where  @timestamp > now() - 7 day
| where host.os.family == "windows" and event.category == "process" and event.action in ("start", "Process creation", "created-process") and
  to_lower(process.name) in ("cmd.exe", "powershell.exe", "conhost.exe") and
  (starts_with(to_lower(process.parent.executable), "c:\\windows\\system32") or starts_with(to_lower(process.parent.executable), "c:\\windows\\syswow64"))
| keep process.name, process.parent.name, host.id
| stats hosts = count_distinct(host.id), cc = count(*) by process.parent.name
| where cc <= 10 and hosts == 1
```

## Notes

- Further pivoting can be done via `process.parent.name`.
- Certain Microsoft binaries like LSASS, winlogon, spoolsv and others should never spawn `cmd.exe`, `powershell.exe` or `conhost.exe`, if so it's highly likely malicious.

## MITRE ATT&CK Techniques

- [T1059](https://attack.mitre.org/techniques/T1059)
- [T1059.001](https://attack.mitre.org/techniques/T1059/001)
- [T1059.003](https://attack.mitre.org/techniques/T1059/003)

## License

- `Elastic License v2`
Elastic SIEM Detection Rules: execution via windows scheduled task with low occurrence frequency

# Low Frequency of Process Execution via Windows Scheduled Task by Unique Agent

---

## Metadata

- **Author:** Elastic
- **Description:** Aggregating by paths/hash, this hunt identifies rare instances where a program executes as a child process of the Tasks Scheduler service. This could be the result of persistence as a Windows Scheduled Task.

- **UUID:** `0d960760-8a40-49c1-bbdd-4deb32c7fd67`
- **Integration:** [endpoint](https://docs.elastic.co/integrations/endpoint), [windows](https://docs.elastic.co/integrations/windows)
- **Language:** `[ES|QL]`
- **Source File:** [Low Frequency of Process Execution via Windows Scheduled Task by Unique Agent](../queries/execution_via_windows_scheduled_task_with_low_occurrence_frequency.toml)

## Query

```sql
from logs-endpoint.events.process-*, logs-windows.sysmon_operational-*
| where  @timestamp > now(-) - 7 day
| where host.os.family == "windows" and event.category == "process" and
  event.action in ("start", "Process creation") and process.code_signature.trusted != true and
  /* child process of the Tasks Schedule service */
  process.parent.name == "svchost.exe" and ends_with(process.parent.command_line, "Schedule")
| stats hosts = count_distinct(host.id) by process.hash.sha256, process.name
 /* unique hash observed in one unique agent */
| where hosts == 1
```

## Notes

- Windows security event 4688 lacks `process.parent.command_line` needed for this hunt to identify the Schedule `svchost` instance.
- Unique `process.hash.sha256` and agent is not necessarily malicious, however this helps surface signals worth further investigation.

## MITRE ATT&CK Techniques

- [T1053](https://attack.mitre.org/techniques/T1053)
- [T1053.005](https://attack.mitre.org/techniques/T1053/005)

## License

- `Elastic License v2`
Elastic SIEM Detection Rules: persistence via startup with low occurrence frequency

# Persistence via Startup with Low Occurrence Frequency by Unique Host

---

## Metadata

- **Author:** Elastic
- **Description:** Leveraging frequency based analysis and path normalization, this hunt identifies rare instances where a program adds a Startup persistence via file creation. Startup entries cause programs to run each time that a user logs on and are often abused by adversaries to maintain persistence on an endpoint.
- **UUID:** `ea950361-33e4-4045-96a5-d36ca28fbc91`
- **Integration:** [endpoint](https://docs.elastic.co/integrations/endpoint), [windows](https://docs.elastic.co/integrations/windows)
- **Language:** `[ES|QL]`
- **Source File:** [Persistence via Startup with Low Occurrence Frequency by Unique Host](../queries/persistence_via_startup_with_low_occurrence_frequency.toml)

## Query

```sql
from logs-endpoint.events.file-*, logs-windows.sysmon_operational-*
| where  @timestamp > now() - 7 day
| where host.os.family == "windows" and event.category == "file" and event.action in ("creation", "FileCreate") and
  file.path rlike """(C:\\Users\\.+\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\.+*|C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\.+)"""
| keep process.executable, host.id, file.name
 /* Paths normalization in registry.data.strings to ease aggregation */
| eval process_path = replace(process.executable, """([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}|ns[a-z][A-Z0-9]{3,4}\.tmp|DX[A-Z0-9]{3,4}\.tmp|7z[A-Z0-9]{3,5}\.tmp|[0-9\.\-\_]{3,})""", "")
| eval process_path = replace(process_path, """[cC]:\\[uU][sS][eE][rR][sS]\\[a-zA-Z0-9\.\-\_\$~ ]+\\""", "C:\\\\users\\\\user\\\\")
| stats number_hosts = count_distinct(host.id) by process_path, file.name
| where number_hosts == 1
```

## Notes

- Elastic Defend file event captures the `process.code_signature` information, this can be added to the hunt to limit to unsigned and Microsoft signed programs.
- Unique `file.name` and limited to one agent is not necessarily malicious, however helps surface ones worth further investigation.
- Suspicious `process.executable` paths and LOLBins should be reviewed further.

## MITRE ATT&CK Techniques

- [T1547](https://attack.mitre.org/techniques/T1547)
- [T1547.001](https://attack.mitre.org/techniques/T1547/001)

## License

- `Elastic License v2`