deardaniel/secdata-raw huggingface dataset:
Elastic SIEM Detection Rules: ec2 high instance deployment count attempts

# High EC2 Instance Deployment Count Attempts by Single User or Role

---

## Metadata

- **Author:** Elastic
- **Description:** This hunting query identifies when a user makes EC2 `RunInstances` API calls with a high instance deployment count within a 7-day window. The `RunInstances` API call launches one or more instances in a specified subnet. High instance deployment counts may indicate an adversary attempting to deploy a large number of instances for cryptomining or other malicious activities. This may also aid in identifying potential resource abuse or misconfigurations.

- **UUID:** `c3d24ae8-655d-11ef-a990-f661ea17fbcc`
- **Integration:** [aws.cloudtrail](https://docs.elastic.co/integrations/aws/cloudtrail)
- **Language:** `[ES|QL]`
- **Source File:** [High EC2 Instance Deployment Count Attempts by Single User or Role](../queries/ec2_high_instance_deployment_count_attempts.toml)

## Query

```sql
from logs-aws.cloudtrail-*
| where @timestamp > now() - 7 day
| where
    event.dataset == "aws.cloudtrail"
    and event.provider == "ec2.amazonaws.com"
    and event.action == "RunInstances"
    and aws.cloudtrail.request_parameters RLIKE ".*minCount.*maxCount.*"
| eval date = DATE_FORMAT("YYYY-mm-dd", @timestamp)
| dissect aws.cloudtrail.request_parameters "%{}subnetId=%{subnet_id},"
| dissect aws.cloudtrail.request_parameters "%{}minCount=%{min_count},"
| dissect aws.cloudtrail.request_parameters "%{}maxCount=%{max_count}}]},"
| dissect aws.cloudtrail.request_parameters "%{}instanceType=%{instance_type},"
| stats
    target_instance_count = sum(to_integer(max_count) - to_integer(min_count) + 1),
    user_attempts = count(*) by user.name, date, subnet_id, instance_type, event.outcome
| where target_instance_count >= 10
```

## Notes

- Use the `aws.cloudtrail.user_identity.arn` field to identify the user making the requests and their role permissions
- Review `cloud.region` to identify the regions where the `RunInstances` API calls were made
- `subnet_id` should be reviewed to identify the subnet where the instances are being deployed but can also help pivot and narrow down the scope of further queries
- `instance_type` should be reviewed to identify the type of instances being deployed. Cryptomining campaigns often deploy specific instance types to maximize mining efficiency

## MITRE ATT&CK Techniques

- [T1578.002](https://attack.mitre.org/techniques/T1578/002)

## License

- `Elastic License v2`
Elastic SIEM Detection Rules: iam user creation with administrator policy assigned

# User Creation with Administrator Policy Assigned

---

## Metadata

- **Author:** Elastic
- **Description:** This hunting query gathers data for evidence of an adversary creating a user in AWS and then assigning administrative rights to that user. The `CreateUser` API call to IAM allows the adversary to create the user and then `AttachUserPolicy` where `policy/AdministratorAccess` is identified should match attempts to assign administrative privileges.

- **UUID:** `696c3f40-5b54-11ef-b9df-f661ea17fbce`
- **Integration:** [aws.cloudtrail](https://docs.elastic.co/integrations/aws/cloudtrail)
- **Language:** `[ES|QL]`
- **Source File:** [User Creation with Administrator Policy Assigned](../queries/iam_user_creation_with_administrator_policy_assigned.toml)

## Query

```sql
from logs-aws.cloudtrail-*
| where @timestamp > now() - 7 day
| where event.dataset == "aws.cloudtrail"
    and event.provider == "iam.amazonaws.com"
    and event.outcome == "success"
    and (event.action == "CreateUser" or
        (event.action == "AttachUserPolicy" and aws.cloudtrail.request_parameters rlike ".*AdministratorAccess.*"))
| stats unique_action_count = count_distinct(event.action) by user.target.name
| where unique_action_count == 2
```

## Notes

- `aws.cloudtrail.request_parameters` contains the target user the policy is being attached to or the user being created
- `count_distinct` ensures that the user was just created, but also had the administrative policy attached within the respective time window
- There is a chance that timestamps could be out-of-order based on ingestion and event generation in AWS CloudTrail
- The target user's IAM policies should be reviewed to ensure MFA is enabled
- Reviewing the AWS ARN in the event should identify which user made these changes; this user ID should be used to pivot into potential valid account compromise

## MITRE ATT&CK Techniques

- [T1098.003](https://attack.mitre.org/techniques/T1098/003)
- [T1136.003](https://attack.mitre.org/techniques/T1136/003)

## License

- `Elastic License v2`
Elastic SIEM Detection Rules: ec2 suspicious get user password request

# EC2 Suspicious Get User Password Request

---

## Metadata

- **Author:** Elastic
- **Description:** This hunting query identifies when a user makes multiple `GetPasswordData` requests for an EC2 instance. The `GetPasswordData` API call retrieves the encrypted administrator password for an instance running Windows. This API call typically only occurs during the initial launch of an instance or when the password is reset. Multiple requests for the same instance may indicate an adversary attempting to escalate privileges or move laterally within the EC2 environment.

- **UUID:** `408ba5f6-5db7-11ef-a01c-f661ea17fbce`
- **Integration:** [aws.cloudtrail](https://docs.elastic.co/integrations/aws/cloudtrail)
- **Language:** `[ES|QL]`
- **Source File:** [EC2 Suspicious Get User Password Request](../queries/ec2_suspicious_get_user_password_request.toml)

## Query

```sql
from logs-aws.cloudtrail*
| where @timestamp > now() - 7 day
| where event.provider == "ec2.amazonaws.com" and event.action == "GetPasswordData"
| dissect aws.cloudtrail.request_parameters "{%{?instance_key}=%{instance_id}}"
| stats instance_count = count_distinct(instance_id) by aws.cloudtrail.user_identity.arn
| where instance_count >= 2
```

## Notes

- Use the `instance_id` field to identify the EC2 instance for which the `GetPasswordData` requests were made
- Check for `RunInstances` API calls to determine if the instance was recently launched or if the password was reset
- `aws.cloudtrail.error_code` can provide additional context if the `GetPasswordData` request failed or was denied
- Review the `aws.cloudtrail.user_identity*` fields to identify the user making the requests and their role permissions
- If a valid account compromise is suspected, review source.* fields for the IP address and geographical location of the request and compare with the user's typical behavior

## MITRE ATT&CK Techniques

- [T1552.005](https://attack.mitre.org/techniques/T1552/005)

## License

- `Elastic License v2`
Elastic SIEM Detection Rules: persistence via driver load with low occurrence frequency

# Drivers Load with Low Occurrence Frequency

---

## Metadata

- **Author:** Elastic
- **Description:** This hunt identifies drivers loaded with low occurrence frequency on Linux systems. It monitors for the loading of kernel modules (drivers) that have only been seen once across a single host within a year. Such activity can indicate the presence of rare or potentially malicious drivers.

- **UUID:** `e1f59c9a-7a2a-4eb8-a524-97b16a041a4a`
- **Integration:** [endpoint](https://docs.elastic.co/integrations/endpoint)
- **Language:** `[ES|QL]`
- **Source File:** [Drivers Load with Low Occurrence Frequency](../queries/persistence_via_driver_load_with_low_occurrence_frequency.toml)

## Query

```sql
from logs-auditd_manager.auditd-*, logs-auditd.log-*, auditbeat-*
| keep @timestamp, host.os.type, event.category, event.action, auditd.data.syscall, auditd.data.name, process.executable, process.name, agent.id
| where @timestamp > now() - 30 day
| where host.os.type == "linux" and event.category == "driver" and event.action == "loaded-kernel-module" and auditd.data.syscall in ("init_module", "finit_module")
// Process name is different from executable in some cases
| stats agent_count = count_distinct(agent.id), total_count = count(*) by auditd.data.name, process.executable, process.name
// Alter this threshold to make sense for your environment
| where agent_count == 1 and total_count <= 3
| limit 100
| sort auditd.data.name asc
```

## Notes

- Monitors for kernel modules loaded with syscall 'init_module' or 'finit_module', indicating driver load events.
- Counts the occurrence of each driver across all hosts and identifies those seen only once on a single host within the past year.
- Such rare driver loads can indicate potentially malicious activity or the presence of uncommon drivers.

## MITRE ATT&CK Techniques

- [T1547.006](https://attack.mitre.org/techniques/T1547/006)
- [T1069.002](https://attack.mitre.org/techniques/T1069/002)

## License

- `Elastic License v2`
Elastic SIEM Detection Rules: login activity by source address

# Logon Activity by Source IP

---

## Metadata

- **Author:** Elastic
- **Description:** This hunt identifies unusual logon activity by source IP on Linux systems. It monitors authentication events, focusing on failed logon attempts from specific IP addresses. A high number of failed logon attempts combined with a low number of successful logons and multiple distinct usernames can indicate a potential brute force or credential stuffing attack.

- **UUID:** `95c1467d-d566-4645-b5f1-37a4b0093bb6`
- **Integration:** [endpoint](https://docs.elastic.co/integrations/endpoint)
- **Language:** `[ES|QL]`
- **Source File:** [Logon Activity by Source IP](../queries/login_activity_by_source_address.toml)

## Query

```sql
from logs-system.auth-*
| mv_expand event.category
| where @timestamp > now() - 7 day
| where host.os.type == "linux" and event.category == "authentication" and event.action in ("ssh_login", "user_login") and
  event.outcome in ("failure", "success") and source.ip is not null and
  not CIDR_MATCH(source.ip, "127.0.0.0/8", "169.254.0.0/16", "224.0.0.0/4", "::1")
| eval failed = case(event.outcome == "failure", source.ip, null), success = case(event.outcome == "success", source.ip, null)
| stats count_failed = count(failed), count_success = count(success), count_user = count_distinct(user.name) by source.ip
/* below threshold should be adjusted to your env logon patterns */
| where count_failed >= 100 and count_user >= 20
```

## Notes

- Monitors authentication events and counts failed and successful logon attempts by source IP address.
- A high number of failed logon attempts combined with a low number of successful logons and multiple distinct usernames can indicate a potential brute force or credential stuffing attack.
- The thresholds for failed attempts, successful logons, and distinct usernames should be adjusted based on the environment's normal logon patterns.

## MITRE ATT&CK Techniques

- [T1110](https://attack.mitre.org/techniques/T1110)
- [T1078](https://attack.mitre.org/techniques/T1078)

## License

- `Elastic License v2`
Elastic SIEM Detection Rules: defense evasion via multi dot process execution

# Potential Defense Evasion via Multi-Dot Process Execution

---

## Metadata

- **Author:** Elastic
- **Description:** This hunt identifies potential defense evasion techniques via multi-dot process execution on Linux systems. It looks for processes with executables that contain three or more consecutive dots in their names. Such naming conventions can be used by malicious actors to evade detection and blend in with legitimate processes.

- **UUID:** `11810497-8ce3-4960-9777-9d0e97052682`
- **Integration:** [endpoint](https://docs.elastic.co/integrations/endpoint)
- **Language:** `[ES|QL]`
- **Source File:** [Potential Defense Evasion via Multi-Dot Process Execution](../queries/defense_evasion_via_multi_dot_process_execution.toml)

## Query

```sql
from logs-endpoint.events.process-*
| where @timestamp > now() - 30 day
| where host.os.type == "linux" and event.type == "start" and event.action == "exec" and process.executable rlike """.*\.{3,}.*"""
| stats cc = count() by process.executable
// Alter this threshold to make sense for your environment
| where cc <= 10
| sort cc asc
| limit 100
```

## Notes

- This query identifies processes with executables containing three or more consecutive dots in their names.
- The process count threshold of <= 10 can be adjusted based on the environment's baseline activity.

## MITRE ATT&CK Techniques

- [T1036.004](https://attack.mitre.org/techniques/T1036/004)
- [T1070](https://attack.mitre.org/techniques/T1070)

## License

- `Elastic License v2`
Elastic SIEM Detection Rules: command and control via unusual file downloads from source addresses

# Unusual File Downloads from Source Addresses

---

## Metadata

- **Author:** Elastic
- **Description:** This hunt identifies unusual file download activities on Linux systems. It detects instances where commonly used download utilities such as curl and wget are executed with command lines that contain IP addresses, which can indicate potentially suspicious file downloads.

- **UUID:** `0d061fad-cf35-43a6-b9b7-986c348bf182`
- **Integration:** [endpoint](https://docs.elastic.co/integrations/endpoint)
- **Language:** `[ES|QL]`
- **Source File:** [Unusual File Downloads from Source Addresses](../queries/command_and_control_via_unusual_file_downloads_from_source_addresses.toml)

## Query

```sql
from logs-endpoint.events.process-*
| where @timestamp > now() - 7 day
| where host.os.type == "linux" and event.type == "start" and process.name in ("curl", "wget") and process.command_line rlike """.*[0-9]{1,3}(\.[0-9]{1,3}){3}.*"""
| stats cc = count(), host_count = count_distinct(host.id) by process.command_line, process.executable
| where cc <= 10 and host_count <= 5
| sort cc asc
| limit 100
```

## Notes

- Detects instances where download utilities like curl and wget are used with IP addresses in their command lines.
- Monitors for potentially suspicious file downloads, which are often seen in malicious activities.
- Uses process command line counting in conjunction with host counting to minimize false positives caused by legitimate downloads.
- The process command line count threshold is set to <= 10, and the host count threshold is set to <= 5 to balance detection and noise.

## MITRE ATT&CK Techniques

- [T1071.001](https://attack.mitre.org/techniques/T1071/001)
- [T1071.004](https://attack.mitre.org/techniques/T1071/004)

## License

- `Elastic License v2`
Elastic SIEM Detection Rules: excessive ssh network activity unique destinations

# Excessive SSH Network Activity to Unique Destinations

---

## Metadata

- **Author:** Elastic
- **Description:** This hunt identifies excessive SSH network activity to unique destinations on Linux systems. It monitors network connections over TCP to port 22 (SSH) and counts the number of unique destination IP addresses. A high number of unique destinations could indicate suspicious activity such as discovery or lateral movement.

- **UUID:** `223f812c-a962-4d58-961d-134d8f8b15da`
- **Integration:** [endpoint](https://docs.elastic.co/integrations/endpoint)
- **Language:** `[ES|QL]`
- **Source File:** [Excessive SSH Network Activity to Unique Destinations](../queries/excessive_ssh_network_activity_unique_destinations.toml)

## Query

```sql
from logs-endpoint.events.network-*
| where @timestamp > now() - 7 day
| where host.os.type == "linux" and event.category == "network" and network.transport == "tcp" and destination.port == 22 and source.port >= 49152
| keep destination.ip, host.id, user.name
| stats count_unique_dst = count_distinct(destination.ip) by host.id, user.name
// Alter this threshold to make sense for your environment
| where count_unique_dst >= 10
| limit 100
| sort user.name asc
```

## Notes

- Monitors network connections to port 22 (SSH) and counts the number of unique destination IP addresses per host and user.
- A high number of unique destinations can indicate suspicious activity such as discovery or lateral movement.
- The threshold of 10 unique destinations can be adjusted to suit the environment's baseline activity.

## MITRE ATT&CK Techniques

- [T1021.004](https://attack.mitre.org/techniques/T1021/004)
- [T1078.003](https://attack.mitre.org/techniques/T1078/003)

## License

- `Elastic License v2`
Elastic SIEM Detection Rules: execution uncommon process execution from suspicious directory

# Uncommon Process Execution from Suspicious Directory

---

## Metadata

- **Author:** Elastic
- **Description:** This hunt identifies uncommon process executions from suspicious directories on Linux systems. It looks for processes executed from directories that are often associated with malicious activity, such as /dev/shm, /var/www, /boot, /srv, /tmp, /var/tmp, /run, and /var/run. The goal is to detect potentially malicious processes while excluding common, benign ones.

- **UUID:** `0ea47044-b161-4785-ba99-e11f46d6ac51`
- **Integration:** [endpoint](https://docs.elastic.co/integrations/endpoint)
- **Language:** `[ES|QL]`
- **Source File:** [Uncommon Process Execution from Suspicious Directory](../queries/execution_uncommon_process_execution_from_suspicious_directory.toml)

## Query

```sql
from logs-endpoint.events.process-*
| where @timestamp > now() - 7 day
| where host.os.type == "linux" and event.type == "start" and event.action == "exec" and (
// Add paths to monitor from your environment here
  process.executable like "/dev/shm/*" or
  process.executable like "/var/www/*" or
  process.executable like "/boot/*" or
  process.executable like "/srv/*" or
  process.executable rlike "/tmp/[^/]+" or
  process.executable rlike "/var/tmp/[^/]+" or
  process.executable rlike "/run/[^/]+" or
  process.executable rlike "/var/run/[^/]+"
) and not (
  // Exclude noisy (parent) processes, users or directories from your environment here
  process.parent.executable in ("/usr/sbin/dpkg-preconfigure") or
  // Exclude /tmp and /var/tmp instances starting or ending with digits (usually benign files)
  process.executable rlike "/tmp/[0-9].*" or
  process.executable rlike "/tmp/.*[0-9]/?" or
  process.executable rlike "/var/tmp/[0-9].*" or
  process.executable rlike "/var/tmp/.*[0-9]/?"
)
| stats cc = count(), host_count = count_distinct(host.name) by process.executable, process.parent.executable
// Alter this threshold to make sense for your environment
| where cc <= 3 and host_count <= 3
| sort cc asc
| limit 100
```

## Notes

- Excluded /tmp, /var/tmp, /run, /var/run subdirectories to reduce noise.
- Excluded /tmp, /var/tmp files starting or ending with digits to exclude real temporary files.
- Included a process or parent process count of <= 3, and a host count of <= 3 to eliminate common processes across different hosts.

## MITRE ATT&CK Techniques

- [T1036.004](https://attack.mitre.org/techniques/T1036/004)
- [T1049](https://attack.mitre.org/techniques/T1049)
- [T1059](https://attack.mitre.org/techniques/T1059)
- [T1059.004](https://attack.mitre.org/techniques/T1059/004)

## License

- `Elastic License v2`
Elastic SIEM Detection Rules: low volume gtfobins external network connections

# Low Volume GTFOBins External Network Connections

---

## Metadata

- **Author:** Elastic
- **Description:** This hunt identifies low volume external network connections initiated by GTFOBins on Linux systems. GTFOBins are Unix binaries that can be exploited by attackers to bypass local security restrictions. The hunt focuses on network connections made by these binaries, excluding common internal IP ranges, to detect potentially malicious activity.

- **UUID:** `783d6091-b98d-45a8-a880-a07f112a8aa2`
- **Integration:** [endpoint](https://docs.elastic.co/integrations/endpoint)
- **Language:** `[ES|QL]`
- **Source File:** [Low Volume GTFOBins External Network Connections](../queries/low_volume_gtfobins_external_network_connections.toml)

## Query

```sql
from logs-endpoint.events.network-*
| where @timestamp > now() - 7 day
| where host.os.type == "linux" and event.type == "start" and process.name in (
  "ab", "aria2c", "bash", "cpan", "curl", "easy_install", "finger", "ftp",
  "gdb", "gimp", "irb", "jjs", "jrunscript", "julia", "ksh", "lua", "lwp-download",
  "nc", "nmap", "node", "openssl", "php", "pip", "python", "ruby", "rview", "rvim",
  "scp", "sftp", "smbclient", "socat", "ssh", "tar", "tftp", "view", "vim", "vimdiff",
  "wget", "whois", "yum"
) and
destination.ip IS NOT null and not CIDR_MATCH(destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10", "192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "224.0.0.0/4", "240.0.0.0/4", "::1","FE80::/10", "FF00::/8")
| keep process.name, destination.port, destination.ip, user.name, host.name
| stats cc = count(*) by destination.port, process.name
| where cc <= 5
| sort cc asc, destination.port
```

## Notes

- Monitors for external network connections initiated by known GTFOBins such as bash, curl, nc, wget, and others.
- Excludes common internal IP ranges to minimize false positives.
- Counts the occurrences of these connections by process name and limits to those seen infrequently (five or fewer connections).
- This can help identify potentially malicious activity involving the exploitation of GTFOBins.

## MITRE ATT&CK Techniques

- [T1219](https://attack.mitre.org/techniques/T1219)
- [T1071.001](https://attack.mitre.org/techniques/T1071/001)

## License

- `Elastic License v2`
Elastic SIEM Detection Rules: persistence via unusual system binary parent

# Unusual System Binary Parent (Potential System Binary Hijacking Attempt)

---

## Metadata

- **Author:** Elastic
- **Description:** This hunt identifies potential system binary hijacking attempts on Linux systems. It monitors process execution events where common system binaries such as ls, cat, mkdir, touch, mv, and cp are the parent processes. These activities can indicate attempts to hijack system binaries for malicious purposes. The hunt lists detailed information for further analysis and investigation.

- **UUID:** `d22cbe8f-c84d-4811-aa6d-f1ee00c806b2`
- **Integration:** [endpoint](https://docs.elastic.co/integrations/endpoint)
- **Language:** `[ES|QL]`
- **Source File:** [Unusual System Binary Parent (Potential System Binary Hijacking Attempt)](../queries/persistence_via_unusual_system_binary_parent.toml)

## Query

```sql
from logs-endpoint.events.process-*
| where @timestamp > now() - 30 day
| where host.os.type == "linux" and event.action == "exec" and event.type == "start" and process.parent.name in ("ls", "cat", "mkdir", "touch", "mv", "cp")
| stats cc = count(), host_count = count_distinct(host.name) by process.parent.executable, process.executable
| where host_count <= 5
| sort cc asc
| limit 100
```

## Notes

- Monitors process execution events where common system binaries such as ls, cat, mkdir, touch, mv, and cp are the parent processes.
- Focuses on identifying unusual or suspicious child processes spawned by these common system binaries.
- Uses stats to count occurrences and identify unusual activity by looking at the number of unique hosts and processes involved.
- Requires additional data analysis and investigation into results to identify malicious or unauthorized use of system binaries.

## MITRE ATT&CK Techniques

- [T1546.004](https://attack.mitre.org/techniques/T1546/004)
- [T1059.004](https://attack.mitre.org/techniques/T1059/004)

## License

- `Elastic License v2`