RFC 0007: Elastic Security detection platform

[platform]
enabled = true
identifier = "elastic"
name = "Elastic Security"
subschema = "Elastic Security"
description = "Elastic Security detection rules via the Kibana detection engine API."
flags = []

[[tenants]]
name = "elastic-staging"
description = "Serverless Security project, staging space"
deployment = "STAGING"
[tenants.setup]
ssl = true
url = "https://soc-staging.kb.eu-west-1.aws.elastic.cloud"
elasticsearch_url = "https://soc-staging.es.eu-west-1.aws.elastic.cloud"
space = "staging"
api_key = "$ELASTIC_STAGING_API_KEY"

[[tenants]]
name = "elastic-prod"
description = "Self-managed cluster on a Basic licence, default space"
deployment = "PRODUCTION"
[tenants.setup]
ssl = true
url = "https://kibana.soc.example.internal:5601"
elasticsearch_url = "https://es.soc.example.internal:9200"
api_key = "$ELASTIC_PROD_API_KEY"
index = ["logs-*", "winlogbeat-*"]
tags = ["soc-prod"]
suppression = false

@dataclass
class Elastic(SystemConfig):
    @dataclass
    class Tenant(SystemConfig.Tenant):
        @dataclass
        class Setup(SystemConfig.Tenant.Setup):
            url: str
            elasticsearch_url: str
            api_key: str
            space: str = "default"
            index: Sequence[str] | None = None
            tags: Sequence[str] | None = None
            suppression: bool = True

        setup: Setup

    tenants: Sequence[Tenant] | None = None

Duration = str    # "<n>s|m|h|d": 90s, 5m, 1h, 14d. ISO 8601 (PT1H) is also accepted.

FieldType = Literal[                      # Elasticsearch mapping types
    "keyword", "constant_keyword", "wildcard", "text", "match_only_text",
    "long", "integer", "short", "byte", "unsigned_long",
    "double", "float", "half_float", "scaled_float",
    "date", "date_nanos", "boolean", "ip", "version", "binary",
    "geo_point", "geo_shape", "object", "flattened", "nested",
]

class ElasticConfig(PlatformConfigBase):
    __schema_identifier__: ClassVar[str] = "platform::elastic::1.0"
    type: Literal["query", "eql", "esql", "threshold", "new_terms", "threat_match", "machine_learning"]
    query: QueryText | None = None
    language: Literal["kuery", "lucene"] | None = None   # event query; absent for eql, esql, machine_learning
    index: list[str] | None = None                       # optional; a list when set; one pattern is [logs-*]
    data_view_id: str | None = None                      # one existing data view; replaces index
    filters: list[ElasticFilter] | None = None           # rule query filters, not Defend event filters
    scheduling: ElasticScheduling | None = None          # Runs every, additional look-back, max alerts
    severity: str | ElasticSeverity | None = None        # alert_severity, or {default, mapping}
    risk: int | ElasticRisk | None = None                # score 0–100, or {score, mapping}
    suppression: ElasticSuppression | None = None
    highlighted_fields: list[str] | None = None          # Custom highlighted fields
    threshold: ElasticThreshold | None = None            # iff type threshold
    new_terms: ElasticNewTerms | None = None             # iff type new_terms
    eql: ElasticEql | None = None                        # only for type eql
    threat: ElasticThreatMatch | None = None             # iff type threat_match; not the ATT&CK array
    machine_learning: ElasticMachineLearning | None = None
    integration: list[str | ElasticIntegration] | None = None
    required_fields: list[ElasticRequiredField] | None = None
    guide: ElasticGuide | None = None                    # Investigation guide and Setup guide
    false_positives: list[str] | None = None
    tags: list[str] | None = None
    exceptions: ElasticExceptions | None = None
    building_block: bool = False                         # one checkbox; false is not sent
    overrides: ElasticOverrides | None = None            # Advanced settings: rule name and timestamp
    actions: ElasticActions | None = None                # notifications, response, Timeline template

class ElasticSuppression(TideModel):
    group_by: list[str] | None = None         # 1–3 field names; absent for threshold
    duration: Duration | None = None          # required for threshold
    missing_fields_strategy: Literal["suppress", "doNotSuppress"] = "suppress"

class ElasticThreshold(TideModel):
    field: list[str] = []                     # Group by, 0–5; [] counts all matches
    value: int                                # Threshold, >= 1
    cardinality: ElasticCardinality | None = None   # Count: {field, value}

class ElasticRequiredField(TideModel):
    name: str
    type: FieldType

class ElasticIntegration(TideModel):
    package: str                              # integration named on the rule, e.g. windows, endpoint, aws
    integration: str | None = None            # policy template inside that package, e.g. cloudtrail
    version: str = "*"                        # semver range, e.g. "^2.0.0". Does not install Fleet.

class ElasticSeverityMapping(TideModel):
    field: str
    value: str
    operator: Literal["equals"] = "equals"
    severity: Literal["low", "medium", "high", "critical"]

class ElasticRiskScoreMapping(TideModel):
    field: str
    operator: Literal["equals"] = "equals"
    value: str = ""

class ElasticThreatGroup(TideModel):
    entries: list[ElasticThreatEntry]         # entries in one group are AND; groups are OR

class ElasticThreatEntry(TideModel):
    field: str                                # event field
    value: str                                # indicator field
    type: Literal["mapping"] = "mapping"
    negate: bool | None = None                # true is the UI's DOES NOT MATCH

class ElasticScheduling(TideModel):
    interval: Duration = "5m"                 # Runs every
    lookback: Duration = "1m"                 # Additional look-back. 0m is valid. Kibana from = interval + lookback
    max_alerts: int | None = None             # Max alerts per run. Omitted leaves the detection engine's 100

class ElasticSeverity(TideModel):
    default: str                              # alert_severity vocabulary
    mapping: list[ElasticSeverityMapping] | None = None

class ElasticRisk(TideModel):
    score: int | None = None                  # 0–100; omitted uses the severity table
    mapping: list[ElasticRiskScoreMapping] | None = None

class ElasticOverrides(TideModel):
    name: str | None = None                   # Rule name override → rule_name_override
    timestamp: str | None = None              # Timestamp override → timestamp_override
    disable_fallback: bool | None = None      # "Do not use @timestamp as a fallback timestamp field"

class ElasticGuide(TideModel):
    investigation: str | None = None          # Kibana note, the Investigation guide
    setup: str | None = None                  # Kibana setup, the Setup guide. Not tenants.setup

class ElasticExceptions(TideModel):
    endpoint: bool = False                    # attach the Elastic Endpoint exception list
    lists: list[ElasticExceptionList] | None = None

class ElasticExceptionList(TideModel):
    id: str
    list_id: str
    namespace_type: Literal["single", "agnostic"]
    type: Literal["detection", "rule_default"]

class ElasticTimeline(TideModel):
    id: str | None = None
    title: str | None = None

class ElasticActions(TideModel):
    notify: list[dict[str, Any]] | None = None    # Rule actions: connector id, params, frequency
    respond: list[dict[str, Any]] | None = None   # Response actions: endpoint or osquery
    timeline: ElasticTimeline | None = None       # Timeline template attached to the rule

class ElasticFilter(TideModel):
    field: str | None = None                  # phrase shorthand, with value
    value: str | None = None
    negate: bool = False
    meta: dict[str, Any] | None = None        # raw detection-engine filter; exclusive with field/value
    query: dict[str, Any] | None = None

class ElasticEql(TideModel):
    timestamp_field: str | None = None
    event_category_override: str | None = None
    tiebreaker_field: str | None = None

class ElasticNewTerms(TideModel):
    fields: list[str]                         # 1–3; Kibana new_terms_fields
    history_window_start: Duration            # sent as now-<duration>

class ElasticThreatMatch(TideModel):
    index: list[str]                          # Kibana threat_index; always a list
    query: str                                # Kibana threat_query
    language: Literal["kuery", "lucene"] | None = None
    mapping: list[ElasticThreatGroup]         # Kibana threat_mapping
    filters: list[dict[str, Any]] | None = None
    indicator_path: str | None = None         # Indicator prefix override; default threat.indicator

class ElasticMachineLearning(TideModel):
    job_id: str | list[str]                   # Kibana machine_learning_job_id; either shape
    anomaly_threshold: int                    # 0–100

name: Certutil downloading a file
metadata:
  uuid: 6b2e9c14-7a31-4f58-9d0c-1e8a4b7c2d90
  schema: rule::1.0
  version: 1
  created: '2026-09-29'
  modified: '2026-09-29'
  tlp: clear
  author: Detection Engineering
description: |
  Detects certutil.exe started with -urlcache or -verifyctl. Windows uses
  those switches to pull a remote file, and intrusions use the same path
  to land a payload.
techniques:
- T1105
references:
  public:
    1: https://attack.mitre.org/techniques/T1105/
    2: https://lolbas-project.github.io/lolbas/Binaries/Certutil/
response:
  alert_severity: High
  procedure:
    analysis: |
      Confirm the certutil command line and the file it wrote.
    containment: |
      Isolate the host if the downloaded file is unsigned.
configurations:
  elastic:
    enabled: true
    schema: platform::elastic::1.0
    status: STAGING
    type: query
    language: kuery
    query: |
      event.category : "process" and event.type : "start" and
      process.name : "certutil.exe" and
      process.command_line : (*urlcache* or *verifyctl*)
    index:
    - logs-endpoint.events.process-*
    - logs-windows.sysmon_operational-*
    filters:
    - field: process.parent.name
      value: msiexec.exe
      negate: true
    scheduling:
      interval: 5m
      lookback: 1m
      max_alerts: 200
    severity:
      default: High
      mapping:
      - field: user.name
        value: SYSTEM
        severity: critical
    risk:
      score: 68
      mapping:
      - field: host.risk.calculated_score_norm
        value: ''
    suppression:
      group_by:
      - host.name
      - user.name
      duration: 1h
      missing_fields_strategy: suppress
    highlighted_fields:
    - process.command_line
    - process.parent.name
    - process.parent.command_line
    - file.path
    required_fields:
    - name: process.command_line
      type: wildcard
    - name: process.name
      type: keyword
    - name: process.parent.name
      type: keyword
    integration:
    - endpoint
    - package: windows
      integration: sysmon
      version: ^2.0.0
    guide:
      investigation: |
        Read process.command_line and the URL in -urlcache or -verifyctl.
        Hash the file certutil wrote.
      setup: |
        Requires Elastic Defend process events or Sysmon process creation
        (Event ID 1) with command-line auditing.
    false_positives:
    - Certificate enrollment and Windows installer repair launching certutil.
    - Software-distribution scripts that download vendor CRLs with certutil.
    tags:
    - Windows
    - LOLBAS
    exceptions:
      endpoint: true
      lists:
      - id: 4a8e1c20-7b55-4d19-9e30-2f6c8a1b5d74
        list_id: certutil-software-distribution
        namespace_type: single
        type: detection
    overrides:
      name: process.command_line
      timestamp: event.ingested
      disable_fallback: true
    actions:
      notify:
      - id: c4e8a1b2-6d30-4f57-9a18-3b7e5c0d2f64
        action_type_id: .slack
        group: default
        params:
          message: Certutil download on {{host.name}} by {{user.name}}
        frequency:
          summary: true
          notifyWhen: onActiveAlert
          throttle: null
      respond:
      - endpoint: isolate
        comment: Isolate the host that ran certutil -urlcache or -verifyctl.
      timeline:
        id: 3d6f8a20-1c54-4b79-8e02-5a9c7d1e4b36
        title: Windows process investigation

{
  "rule_id": "6b2e9c14-7a31-4f58-9d0c-1e8a4b7c2d90",
  "type": "query",
  "name": "Certutil downloading a file",
  "description": "Detects certutil.exe started with -urlcache or -verifyctl. Windows uses\nthose switches to pull a remote file, and intrusions use the same path\nto land a payload.",
  "enabled": true,
  "severity": "high",
  "risk_score": 68,
  "interval": "5m",
  "from": "now-6m",
  "to": "now",
  "language": "kuery",
  "query": "event.category : \"process\" and event.type : \"start\" and\nprocess.name : \"certutil.exe\" and\nprocess.command_line : (*urlcache* or *verifyctl*)",
  "index": [
    "logs-endpoint.events.process-*",
    "logs-windows.sysmon_operational-*"
  ],
  "filters": [
    {
      "meta": {
        "key": "process.parent.name",
        "negate": true,
        "disabled": false,
        "type": "phrase",
        "params": {
          "query": "msiexec.exe"
        }
      },
      "query": {
        "match_phrase": {
          "process.parent.name": "msiexec.exe"
        }
      }
    }
  ],
  "severity_mapping": [
    {
      "operator": "equals",
      "field": "user.name",
      "value": "SYSTEM",
      "severity": "critical"
    }
  ],
  "risk_score_mapping": [
    {
      "operator": "equals",
      "field": "host.risk.calculated_score_norm",
      "value": ""
    }
  ],
  "rule_name_override": "process.command_line",
  "timestamp_override": "event.ingested",
  "timestamp_override_fallback_disabled": true,
  "actions": [
    {
      "id": "c4e8a1b2-6d30-4f57-9a18-3b7e5c0d2f64",
      "action_type_id": ".slack",
      "group": "default",
      "params": {
        "message": "Certutil download on {{host.name}} by {{user.name}}"
      },
      "frequency": {
        "summary": true,
        "notifyWhen": "onActiveAlert",
        "throttle": null
      }
    }
  ],
  "response_actions": [
    {
      "action_type_id": ".endpoint",
      "params": {
        "command": "isolate",
        "comment": "Isolate the host that ran certutil -urlcache or -verifyctl."
      }
    }
  ],
  "timeline_id": "3d6f8a20-1c54-4b79-8e02-5a9c7d1e4b36",
  "timeline_title": "Windows process investigation",
  "max_signals": 200,
  "alert_suppression": {
    "group_by": [
      "host.name",
      "user.name"
    ],
    "duration": {
      "value": 1,
      "unit": "h"
    },
    "missing_fields_strategy": "suppress"
  },
  "investigation_fields": {
    "field_names": [
      "process.command_line",
      "process.parent.name",
      "process.parent.command_line",
      "file.path"
    ]
  },
  "required_fields": [
    {
      "name": "process.command_line",
      "type": "wildcard"
    },
    {
      "name": "process.name",
      "type": "keyword"
    },
    {
      "name": "process.parent.name",
      "type": "keyword"
    }
  ],
  "related_integrations": [
    {
      "package": "endpoint",
      "version": "*"
    },
    {
      "package": "windows",
      "integration": "sysmon",
      "version": "^2.0.0"
    }
  ],
  "setup": "Requires Elastic Defend process events or Sysmon process creation\n(Event ID 1) with command-line auditing.",
  "false_positives": [
    "Certificate enrollment and Windows installer repair launching certutil.",
    "Software-distribution scripts that download vendor CRLs with certutil."
  ],
  "exceptions_list": [
    {
      "id": "4a8e1c20-7b55-4d19-9e30-2f6c8a1b5d74",
      "list_id": "certutil-software-distribution",
      "namespace_type": "single",
      "type": "detection"
    },
    {
      "id": "endpoint_list",
      "list_id": "endpoint_list",
      "namespace_type": "agnostic",
      "type": "endpoint"
    }
  ],
  "tags": [
    "opentide",
    "Windows",
    "LOLBAS"
  ],
  "author": [
    "Detection Engineering"
  ],
  "references": [
    "https://attack.mitre.org/techniques/T1105/",
    "https://lolbas-project.github.io/lolbas/Binaries/Certutil/"
  ],
  "note": "Read process.command_line and the URL in -urlcache or -verifyctl.\nHash the file certutil wrote.",
  "threat": [
    {
      "framework": "MITRE ATT&CK",
      "tactic": {
        "id": "TA0011",
        "name": "Command and Control",
        "reference": "https://attack.mitre.org/tactics/TA0011/"
      },
      "technique": [
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "reference": "https://attack.mitre.org/techniques/T1105"
        }
      ]
    }
  ]
}

name: Word spawning cmd.exe and PowerShell
metadata:
  uuid: a4c8e1d2-5b67-4e90-8f13-2c6d9a0b4e71
  schema: rule::1.0
  version: 1
  created: '2026-09-29'
  modified: '2026-09-29'
  tlp: clear
  author: Detection Engineering
description: |
  Correlates WINWORD.EXE starting cmd.exe and that cmd.exe starting
  powershell.exe on the same host within two minutes.
techniques:
- T1566.001
- T1059.001
references:
  public:
    1: https://attack.mitre.org/techniques/T1566/001/
    2: https://attack.mitre.org/techniques/T1059/001/
response:
  alert_severity: High
  procedure:
    analysis: |
      Confirm WINWORD.EXE is the ancestor of powershell.exe and collect
      the document path.
    containment: |
      Kill the PowerShell process and quarantine the document.
configurations:
  elastic:
    enabled: true
    schema: platform::elastic::1.0
    status: STAGING
    type: eql
    query: |
      sequence by host.id with maxspan=2m
        [process where event.type == "start" and process.name == "WINWORD.EXE"]
        [process where event.type == "start" and process.parent.name == "WINWORD.EXE" and process.name == "cmd.exe"]
        [process where event.type == "start" and process.parent.name == "cmd.exe" and process.name in ("powershell.exe", "pwsh.exe")]
    index:
    - logs-endpoint.events.process-*
    filters:
    - field: host.os.type
      value: windows
    scheduling:
      interval: 5m
      lookback: 5m
      max_alerts: 100
    severity:
      default: High
      mapping:
      - field: user.name
        value: svc-mail
        severity: critical
    risk:
      score: 70
      mapping:
      - field: host.risk.calculated_score_norm
        value: ''
    suppression:
      group_by:
      - host.id
      duration: 30m
      missing_fields_strategy: suppress
    eql:
      timestamp_field: '@timestamp'
      event_category_override: event.category
      tiebreaker_field: event.sequence
    highlighted_fields:
    - process.name
    - process.parent.name
    - process.command_line
    - process.parent.executable
    required_fields:
    - name: host.id
      type: keyword
    - name: process.name
      type: keyword
    - name: process.parent.name
      type: keyword
    integration:
    - endpoint
    guide:
      investigation: |
        Confirm the three events share host.id and fall inside maxspan=2m.
      setup: |
        Requires Elastic Defend or an equivalent process data stream with
        parent process name populated.
    false_positives:
    - Office add-in installers that legitimately shell out to cmd.exe.
    tags:
    - Windows
    - Phishing
    exceptions:
      endpoint: true
      lists:
      - id: b7c2e190-4a68-4d35-8f02-1c9e6a3b5d80
        list_id: office-addin-installers
        namespace_type: single
        type: detection
    overrides:
      name: process.command_line
      timestamp: event.ingested
      disable_fallback: false
    actions:
      notify:
      - id: c4e8a1b2-6d30-4f57-9a18-3b7e5c0d2f64
        action_type_id: .slack
        group: default
        params:
          message: Word spawned PowerShell via cmd on {{host.name}}
        frequency:
          summary: true
          notifyWhen: onActiveAlert
          throttle: null
      respond:
      - endpoint: kill-process
        comment: Kill the PowerShell process started from the Word chain.
        field: process.entity_id
      timeline:
        id: 3d6f8a20-1c54-4b79-8e02-5a9c7d1e4b36
        title: Windows process investigation

name: Password spray from one source address
metadata:
  uuid: d19f3a60-2c84-4b17-a5e8-7f0c3d6b8a24
  schema: rule::1.0
  version: 1
  created: '2026-09-29'
  modified: '2026-09-29'
  tlp: clear
  author: Detection Engineering
description: |
  Alerts when one source address produces at least 20 Windows logon
  failures with status 0xC000006A across 8 or more accounts.
techniques:
- T1110.003
references:
  public:
    1: https://attack.mitre.org/techniques/T1110/003/
response:
  alert_severity: High
  procedure:
    analysis: |
      Review the source address and whether the failures are 4625 with
      substatus 0xC000006A.
    containment: |
      Block the source at the VPN or firewall if it is not a known
      identity provider.
configurations:
  elastic:
    enabled: true
    schema: platform::elastic::1.0
    status: STAGING
    type: esql
    query: |
      FROM logs-system.security-*, logs-windows.forwarded-*
      | WHERE event.code == "4625" AND winlog.event_data.SubStatus == "0xC000006A"
      | STATS failures = COUNT(*), accounts = COUNT_DISTINCT(user.name) BY source.ip
      | WHERE accounts >= 8 AND failures >= 20
    scheduling:
      interval: 15m
      lookback: 5m
      max_alerts: 50
    severity:
      default: High
      mapping:
      - field: source.ip
        value: 10.0.0.5
        severity: medium
    risk:
      score: 73
      mapping:
      - field: user.risk.calculated_score_norm
        value: ''
    suppression:
      group_by:
      - source.ip
      duration: 1h
      missing_fields_strategy: suppress
    highlighted_fields:
    - source.ip
    - accounts
    - failures
    required_fields:
    - name: event.code
      type: keyword
    - name: source.ip
      type: ip
    - name: user.name
      type: keyword
    integration:
    - package: system
      integration: security
      version: ^1.0.0
    - windows
    guide:
      investigation: |
        source.ip is the spray source. 0xC000006A is a wrong password for
        a real account.
      setup: |
        Windows Security auditing must log 4625 with SubStatus. The ES|QL
        FROM clause selects the data streams.
    false_positives:
    - A password manager retrying one stale password across a small set of accounts.
    - Terminal servers where many users fail from the same NAT address.
    tags:
    - Windows
    - Identity
    exceptions:
      endpoint: false
      lists:
      - id: e1d4a860-2c79-4b15-9a30-7f6c2b8e1d45
        list_id: known-nats-password-spray
        namespace_type: single
        type: detection
    overrides:
      name: source.ip
      timestamp: event.ingested
      disable_fallback: false
    actions:
      notify:
      - id: c4e8a1b2-6d30-4f57-9a18-3b7e5c0d2f64
        action_type_id: .slack
        group: default
        params:
          message: Password spray from {{source.ip}}
        frequency:
          summary: true
          notifyWhen: onThrottleInterval
          throttle: 1h
      respond:
      - osquery:
          query: SELECT user, host, time FROM logged_in_users;
          timeout: 60
      timeline:
        id: 9b1e4c70-2a85-4d63-b0f7-6c8a3e5d1f24
        title: Windows logon investigation

name: Many failed logons for one account
metadata:
  uuid: 2e7b5c91-8d40-4a63-b1f5-9c3e6a8d0f17
  schema: rule::1.0
  version: 1
  created: '2026-09-29'
  modified: '2026-09-29'
  tlp: clear
  author: Detection Engineering
description: |
  Alerts when one account accumulates 50 failed logons and those failures
  come from at least 8 distinct source addresses.
techniques:
- T1110
references:
  public:
    1: https://attack.mitre.org/techniques/T1110/
response:
  alert_severity: Medium
  procedure:
    analysis: |
      Identify user.name and whether the account is privileged.
    containment: |
      Reset the account if the sources are off-network.
configurations:
  elastic:
    enabled: true
    schema: platform::elastic::1.0
    status: PRODUCTION
    type: threshold
    language: lucene
    query: event.code:"4625" AND event.outcome:"failure"
    index:
    - logs-system.security-*
    filters:
    - field: winlog.channel
      value: Security
    scheduling:
      interval: 5m
      lookback: 1m
      max_alerts: 100
    severity:
      default: Medium
      mapping:
      - field: user.name
        value: Administrator
        severity: high
    risk:
      score: 40
      mapping:
      - field: user.risk.calculated_score_norm
        value: ''
    suppression:
      duration: 30m
    threshold:
      field:
      - user.name
      value: 50
      cardinality:
        field: source.ip
        value: 8
    highlighted_fields:
    - user.name
    - source.ip
    - host.name
    - winlog.event_data.SubStatus
    required_fields:
    - name: event.code
      type: keyword
    - name: source.ip
      type: ip
    - name: user.name
      type: keyword
    integration:
    - package: system
      integration: security
      version: ^1.0.0
    guide:
      investigation: |
        threshold.field groups by user.name. cardinality requires 8 distinct
        source.ip values. Suppression on a threshold rule is a duration only.
      setup: |
        Windows Security log 4625 via the System integration. user.name and
        source.ip must be aggregatable.
    false_positives:
    - A user with a stale laptop password plus a phone and a second workstation.
    tags:
    - Windows
    - Identity
    exceptions:
      endpoint: false
      lists:
      - id: 0c5e8a31-6b47-4d92-a1f0-8e3c7b2d6a59
        list_id: scanner-test-accounts
        namespace_type: single
        type: detection
    overrides:
      name: user.name
      timestamp: event.ingested
      disable_fallback: false
    actions:
      notify:
      - id: c4e8a1b2-6d30-4f57-9a18-3b7e5c0d2f64
        action_type_id: .slack
        group: default
        params:
          message: Account {{user.name}} failed logon from many source addresses.
        frequency:
          summary: true
          notifyWhen: onActiveAlert
          throttle: null
      respond:
      - osquery:
          query: SELECT user, host, time FROM logged_in_users;
          timeout: 60
      timeline:
        id: 9b1e4c70-2a85-4d63-b0f7-6c8a3e5d1f24
        title: Windows logon investigation

name: IAM user creates an access key for the first time
metadata:
  uuid: f3a1c8e4-6d29-4b70-9e15-8a2c4f7b1d63
  schema: rule::1.0
  version: 1
  created: '2026-09-29'
  modified: '2026-09-29'
  tlp: clear
  author: Detection Engineering
description: |
  Alerts when an IAM user successfully calls CreateAccessKey in an AWS
  account, and that user plus account pair has not done so in the past
  14 days.
techniques:
- T1098.001
references:
  public:
    1: https://attack.mitre.org/techniques/T1098/001/
response:
  alert_severity: Medium
  procedure:
    analysis: |
      Confirm who called CreateAccessKey and which account it landed in.
    containment: |
      Deactivate the new access key if the caller is not break-glass automation.
configurations:
  elastic:
    enabled: true
    schema: platform::elastic::1.0
    status: STAGING
    type: new_terms
    language: kuery
    query: 'event.dataset : "aws.cloudtrail" and event.action : "CreateAccessKey" and event.outcome :
      "success"'
    index:
    - logs-aws.cloudtrail-*
    filters:
    - field: cloud.provider
      value: aws
    scheduling:
      interval: 1h
      lookback: 5m
      max_alerts: 100
    severity:
      default: Medium
      mapping:
      - field: user.name
        value: OrganizationAccountAccessRole
        severity: critical
    risk:
      score: 47
      mapping:
      - field: user.risk.calculated_score_norm
        value: ''
    suppression:
      group_by:
      - user.name
      - cloud.account.id
      duration: 1d
      missing_fields_strategy: suppress
    new_terms:
      fields:
      - user.name
      - cloud.account.id
      history_window_start: 14d
    highlighted_fields:
    - user.name
    - cloud.account.id
    - event.action
    - aws.cloudtrail.user_identity.arn
    - source.ip
    required_fields:
    - name: cloud.account.id
      type: keyword
    - name: event.action
      type: keyword
    - name: user.name
      type: keyword
    integration:
    - package: aws
      integration: cloudtrail
      version: ^2.0.0
    guide:
      investigation: |
        The new value is the pair user.name plus cloud.account.id.
        history_window_start 14d is sent as now-14d.
      setup: |
        AWS CloudTrail via the AWS integration. user.name and cloud.account.id
        must be aggregatable.
    false_positives:
    - A new engineer creating their first CLI key during onboarding.
    tags:
    - AWS
    - Identity
    exceptions:
      endpoint: false
      lists:
      - id: 7d3b6e12-9c40-4a85-b2f1-0e8a5c4d7b69
        list_id: iam-break-glass-key-creators
        namespace_type: single
        type: detection
    overrides:
      name: aws.cloudtrail.user_identity.arn
      timestamp: event.ingested
      disable_fallback: false
    actions:
      notify:
      - id: c4e8a1b2-6d30-4f57-9a18-3b7e5c0d2f64
        action_type_id: .slack
        group: default
        params:
          message: First CreateAccessKey in 14d for {{user.name}} in {{cloud.account.id}}
        frequency:
          summary: true
          notifyWhen: onActiveAlert
          throttle: null
      respond:
      - osquery:
          query: SELECT * FROM users;
          timeout: 60
      timeline:
        id: 5e2a7c90-8b14-4f36-a1d8-0c6b9e3f7a52
        title: AWS CloudTrail investigation

name: Created file matches a malware hash
metadata:
  uuid: 8c5d2f70-1a94-4e36-b8c2-5d7e9a1b3f48
  schema: rule::1.0
  version: 1
  created: '2026-09-29'
  modified: '2026-09-29'
  tlp: clear
  author: Detection Engineering
description: |
  Alerts when a created file's SHA256 matches a file indicator, or when
  its MD5 matches a file indicator and its path does not match the path
  carried on that indicator.
techniques:
- T1204.002
references:
  public:
    1: https://attack.mitre.org/techniques/T1204/002/
response:
  alert_severity: Critical
  procedure:
    analysis: |
      Open the matched indicator and the file path. Confirm the hash
      equality and whether the file was executed after it was written.
    containment: |
      Isolate the host and collect the file.
configurations:
  elastic:
    enabled: true
    schema: platform::elastic::1.0
    status: PRODUCTION
    type: threat_match
    language: kuery
    query: 'event.category : "file" and event.type : "creation"'
    index:
    - logs-endpoint.events.file-*
    filters:
    - field: event.dataset
      value: endpoint.events.file
    scheduling:
      interval: 1h
      lookback: 10m
      max_alerts: 500
    severity:
      default: Critical
      mapping:
      - field: file.extension
        value: exe
        severity: critical
    risk:
      score: 90
      mapping:
      - field: host.risk.calculated_score_norm
        value: ''
    suppression:
      group_by:
      - host.name
      - file.hash.sha256
      duration: 6h
      missing_fields_strategy: doNotSuppress
    threat:
      index:
      - logs-ti_abusech.malware-*
      - logs-ti_misp.indicator-*
      query: '@timestamp >= "now-30d/d" and threat.indicator.type : "file"'
      language: kuery
      indicator_path: threat.indicator
      filters:
      - field: threat.indicator.marking.tlp
        value: red
        negate: true
      mapping:
      - entries:
        - field: file.hash.sha256
          value: threat.indicator.file.hash.sha256
      - entries:
        - field: file.hash.md5
          value: threat.indicator.file.hash.md5
        - field: file.path
          value: threat.indicator.file.path
          negate: true
    highlighted_fields:
    - file.hash.sha256
    - file.hash.md5
    - file.path
    - file.name
    - process.name
    required_fields:
    - name: file.hash.md5
      type: keyword
    - name: file.hash.sha256
      type: keyword
    - name: file.path
      type: keyword
    integration:
    - endpoint
    - package: ti_abusech
      version: '*'
    guide:
      investigation: |
        The event query is file creation. The indicator query is under threat.
        The second mapping group is OR, and file.path DOES NOT MATCH.
      setup: |
        Elastic Defend file events plus a file-indicator index. Hashes must
        be keyword.
    false_positives:
    - A red-team hash left in the indicator index after an exercise.
    tags:
    - Windows
    - ThreatIntel
    exceptions:
      endpoint: true
      lists:
      - id: 2b9f4d60-8e13-4c57-a0b6-5d7c1e8a3f24
        list_id: approved-software-hashes
        namespace_type: single
        type: detection
    overrides:
      name: file.hash.sha256
      timestamp: event.ingested
      disable_fallback: false
    actions:
      notify:
      - id: c4e8a1b2-6d30-4f57-9a18-3b7e5c0d2f64
        action_type_id: .slack
        group: default
        params:
          message: 'Malware hash written on {{host.name}}: {{file.hash.sha256}}'
        frequency:
          summary: true
          notifyWhen: onActiveAlert
          throttle: null
      respond:
      - endpoint: isolate
        comment: Isolate the host that wrote a file matching a malware indicator.
      timeline:
        id: 6a4c1e80-3d25-4b97-9f10-7e2b8c5a1d63
        title: File hash investigation

name: Anomalous network volume for a host
metadata:
  uuid: 1f6a9e23-4c80-4d57-a2b9-6e8c0d3f5a71
  schema: rule::1.0
  version: 1
  created: '2026-09-29'
  modified: '2026-09-29'
  tlp: clear
  author: Detection Engineering
description: |
  Raises an alert when the packetbeat anomaly jobs score a host at 75
  or above. The jobs already exist in the tenant; this rule only points
  at them.
techniques:
- T1071
references:
  public:
    1: https://attack.mitre.org/techniques/T1071/
response:
  alert_severity: Medium
  procedure:
    analysis: |
      Open the anomaly in the ML app for the job named on the alert.
    containment: |
      Isolate the workstation if the score stays high.
configurations:
  elastic:
    enabled: true
    schema: platform::elastic::1.0
    status: STAGING
    type: machine_learning
    scheduling:
      interval: 15m
      lookback: 1m
      max_alerts: 100
    severity:
      default: Medium
      mapping:
      - field: host.name
        value: dc01
        severity: high
    risk:
      score: 42
      mapping:
      - field: host.risk.calculated_score_norm
        value: ''
    suppression:
      group_by:
      - host.name
      duration: 3h
      missing_fields_strategy: suppress
    machine_learning:
      job_id:
      - high_count_network_events
      - high_count_network_denies
      anomaly_threshold: 75
    highlighted_fields:
    - host.name
    - source.ip
    - destination.ip
    - network.transport
    required_fields:
    - name: destination.ip
      type: ip
    - name: host.name
      type: keyword
    - name: source.ip
      type: ip
    integration:
    - packetbeat
    guide:
      investigation: |
        anomaly_threshold 75 is the Kibana anomaly score cutoff. The job's
        datafeed selects events. This block does not create the job.
      setup: |
        The named anomaly jobs must already be running in this tenant.
    false_positives:
    - Backup windows that the job has not baselined yet.
    tags:
    - Network
    - MachineLearning
    exceptions:
      endpoint: false
      lists:
      - id: a6c1e840-5b27-4d90-8f13-2e9b7c4a1d58
        list_id: backup-network-hosts
        namespace_type: single
        type: detection
    overrides:
      name: host.name
      timestamp: event.ingested
      disable_fallback: false
    actions:
      notify:
      - id: c4e8a1b2-6d30-4f57-9a18-3b7e5c0d2f64
        action_type_id: .slack
        group: default
        params:
          message: Network anomaly score >= 75 for {{host.name}}
        frequency:
          summary: true
          notifyWhen: onActiveAlert
          throttle: null
      respond:
      - osquery:
          query: SELECT pid, name, path, cmdline FROM processes;
          timeout: 60
      timeline:
        id: 2f7b9e40-5c18-4a62-8d30-1a6e4c8b0f75
        title: Network anomaly investigation

{
  "query": "FROM logs-system.security-*, logs-windows.forwarded-*\n| WHERE event.code == \"4625\" AND winlog.event_data.SubStatus == \"0xC000006A\"\n| STATS failures = COUNT(*), accounts = COUNT_DISTINCT(user.name) BY source.ip\n| WHERE accounts >= 8 AND failures >= 20\n| LIMIT 0"
}