Detection Rules Pro Feed

Suspicious Microsoft OAuth Flow via Auth Broker to DRS elastic-siem New rule

This rule detects a potential OAuth phishing attack in Microsoft Entra ID. It identifies scenarios where two successful sign-in events share the same user principal and session ID but originate from different IP addresses within a five-minute window. The detection logic specifically targets OAuth flows where the client application is the Microsoft Authentication Broker (MAB) and the resource is the Device Registration Service (DRS), a pattern highly indicative of an attacker using a stolen authorization code to gain access. Relevant MITRE ATT&CK tactics: TA0001, TA0006 Relevant MITRE ATT&CK techniques: T1566, T1566.002, T1528

initial-access credential-access cloud-security malicious-activity TA0001 TA0006 T1566 T1566.002 T1528

Potential Kerberos SPN Spoofing via Suspicious DNS Query elastic-siem New rule

This rule identifies DNS queries on Windows systems containing a specific Base64-encoded pattern (`*UWhRC*BAAAA*`). This pattern is indicative of a marshaled CREDENTIAL_TARGET_INFORMATION structure, which is a key component in Kerberos coercion attacks. Adversaries exploit this by creating malicious DNS records to spoof a Service Principal Name (SPN), tricking a victim system into authenticating to an attacker-controlled host. This technique facilitates credential theft, often through NTLM reflection. Relevant MITRE ATT&CK tactics: TA0006 Relevant MITRE ATT&CK techniques: T1557, T1557.001, T1187

credential-access malicious-activity endpoint-security TA0006 T1557 T1557.001 T1187

Potential Kerberos Coercion via DNS-Based SPN Spoofing elastic-siem New rule

This rule detects the creation of a DNS record containing a specific base64-encoded pattern (`UWhRCA...BAAAA`), which corresponds to a marshaled `CREDENTIAL_TARGET_INFORMATION` structure. This activity is indicative of Kerberos coercion attacks that leverage DNS-based SPN spoofing. Adversaries use this technique to force systems to authenticate to attacker-controlled hosts, enabling reflective Kerberos relay attacks to gain privileged access, potentially as `NT AUTHORITY\SYSTEM`. Relevant MITRE ATT&CK tactics: TA0006 Relevant MITRE ATT&CK techniques: T1557, T1557.001, T1187

credential-access endpoint-security malicious-activity TA0006 T1557 T1557.001 T1187

Brand Impersonation: Meta and Subsidiaries sublime-security

This rule detects email-based impersonation of Meta and its subsidiaries like Facebook and Instagram. It analyzes sender display names for variations of 'Facebook Ads', 'Meta Support', and others, and also checks sender domain names. The logic combines these indicators with advanced checks, including logo detection, Natural Language Understanding (NLU) to identify credential theft intentions, and looks for specific physical addresses like '1 Facebook Way' in the email body. The rule is designed to reduce false positives by excluding known legitimate domains and considering sender reputation. Relevant MITRE ATT&CK tactics: TA0001 Relevant MITRE ATT&CK techniques: T1566, T1566.002

malicious-activity credential-access TA0001 T1566 T1566.002

AWS IAM Assume Role Policy Update elastic-siem

This rule detects updates to an AWS IAM role's trust policy by an IAM user or Assumed Role identity. This action, identified via the 'UpdateAssumeRolePolicy' event in CloudTrail logs, can be leveraged by attackers to modify which principals can assume a role, potentially gaining its privileges. The rule employs a 'New Terms' logic, triggering only on the first observation of a unique combination of `cloud.account.id`, `user.name`, and `roleName` within a 14-day period to reduce noise from legitimate administrative activities. Relevant MITRE ATT&CK tactics: TA0004 Relevant MITRE ATT&CK techniques: T1078, T1078.004, T1098.003

privilege-escalation cloud-security malicious-activity TA0004 T1078 T1078.004 T1098.003

AWS EC2 User Data Retrieval for EC2 Instance elastic-siem

Identifies discovery request DescribeInstanceAttribute with the attribute userData and instanceId in AWS CloudTrail logs. This may indicate an attempt to retrieve user data from an EC2 instance. Adversaries may use this information to gather sensitive data from the instance such as hardcoded credentials or to identify potential vulnerabilities. This is a New Terms rule that identifies the first time an IAM user or role requests the user data for a specific EC2 instance. Relevant MITRE ATT&CK tactics: TA0007, TA0006 Relevant MITRE ATT&CK techniques: T1580, T1552, T1552.005

discovery credential-access cloud-security malicious-activity TA0007 TA0006 T1580 T1552 T1552.005