diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-31/prebuilt-rule-8-19-31-entra-id-high-risk-sign-in.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-31/prebuilt-rule-8-19-31-entra-id-high-risk-sign-in.asciidoc new file mode 100644 index 0000000000..512577fae1 --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-31/prebuilt-rule-8-19-31-entra-id-high-risk-sign-in.asciidoc @@ -0,0 +1,127 @@ +[[prebuilt-rule-8-19-31-entra-id-high-risk-sign-in]] +=== Entra ID High Risk Sign-in + +Identifies high risk Microsoft Entra ID sign-ins by leveraging Microsoft's Identity Protection machine learning and heuristics. Identity Protection categorizes risk into three tiers: low, medium, and high. While Microsoft does not provide specific details about how risk is calculated, each level brings higher confidence that the user or sign-in is compromised. + +*Rule type*: query + +*Rule indices*: + +* filebeat-* +* logs-azure.signinlogs-* + +*Severity*: high + +*Risk score*: 73 + +*Runs every*: 5m + +*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-risk +* https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection +* https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-investigate-risk + +*Tags*: + +* Domain: Cloud +* Domain: Identity +* Data Source: Azure +* Data Source: Microsoft Entra ID +* Data Source: Microsoft Entra ID Sign-in Logs +* Use Case: Identity and Access Audit +* Resources: Investigation Guide +* Tactic: Initial Access + +*Version*: 113 + +*Rule authors*: + +* Elastic +* Willem D'Haese + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + + +*Investigating Entra ID High Risk Sign-in* + + +This rule detects high-risk sign-ins in Microsoft Entra ID as identified by Identity Protection. These sign-ins are flagged with a risk level of `high` during the authentication process, indicating a strong likelihood of compromise based on Microsoft's machine learning and heuristics. This alert is valuable for identifying accounts under active attack or compromise using valid credentials. + + +*Possible investigation steps* + + +- Review the `azure.signinlogs.properties.user_id` and associated identity fields to determine the impacted user. +- Inspect the `risk_level_during_signin` field and confirm it is set to `high`. If `risk_level_aggregated` is also present and high, this suggests sustained risk across multiple sign-ins. +- Check `source.ip`, `source.geo.country_name`, and `source.as.organization.name` to evaluate the origin of the sign-in attempt. Flag unexpected geolocations or ASNs (e.g., anonymizers or residential ISPs). +- Review the `device_detail` fields such as `operating_system` and `browser` for new or unrecognized devices. +- Validate the `client_app_used` (e.g., legacy protocols, desktop clients) and `app_display_name` (e.g., Office 365 Exchange Online) to assess if risky legacy methods were involved. +- Examine `applied_conditional_access_policies` to verify if MFA or blocking policies were triggered or bypassed. +- Check `authentication_details.authentication_method` to see if multi-factor authentication was satisfied (e.g., "Mobile app notification"). +- Correlate this activity with other alerts or sign-ins from the same account within the last 24–48 hours. +- Contact the user to confirm if the sign-in was expected. If not, treat the account as compromised and proceed with containment. + + +*False positive analysis* + + +- Risky sign-ins may be triggered during legitimate travel, VPN use, or remote work scenarios from unusual locations. +- In some cases, users switching devices or networks rapidly may trigger high-risk scores. +- Automated scanners or penetration tests using known credentials may mimic high-risk login behavior. +- Sign-ins already marked `risk_state` as `remediated`, `dismissed`, or `confirmedSafe` by Microsoft Identity Protection are excluded; failed attempts with no aggregated risk and no active risk state are also excluded. + + +*Response and remediation* + + +- If compromise is suspected, immediately disable the user account and revoke active sessions and tokens. +- Initiate credential reset and ensure multi-factor authentication is enforced. +- Review audit logs and sign-in history for the account to assess lateral movement or data access post sign-in. +- Inspect activity on services such as Exchange, SharePoint, or Azure resources to understand the impact. +- Determine if the attacker leveraged other accounts or escalated privileges. +- Use the incident findings to refine conditional access policies, such as enforcing MFA for high-risk sign-ins or blocking legacy protocols. +- Review and tighten policies that allow sign-ins from high-risk geographies or unknown devices. + + +==== Rule query + + +[source, js] +---------------------------------- +data_stream.dataset:azure.signinlogs and + ( + azure.signinlogs.properties.risk_level_during_signin:high or + azure.signinlogs.properties.risk_level_aggregated:high + ) and + not (event.outcome:failure and azure.signinlogs.properties.risk_level_aggregated:none and azure.signinlogs.properties.risk_state:none) and + not azure.signinlogs.properties.risk_state:(remediated or dismissed or confirmedSafe) + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Initial Access +** ID: TA0001 +** Reference URL: https://attack.mitre.org/tactics/TA0001/ +* Technique: +** Name: Valid Accounts +** ID: T1078 +** Reference URL: https://attack.mitre.org/techniques/T1078/ +* Sub-technique: +** Name: Cloud Accounts +** ID: T1078.004 +** Reference URL: https://attack.mitre.org/techniques/T1078/004/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-31/prebuilt-rule-8-19-31-gcp-iam-service-account-impersonation-role-granted.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-31/prebuilt-rule-8-19-31-gcp-iam-service-account-impersonation-role-granted.asciidoc new file mode 100644 index 0000000000..3e9bf76602 --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-31/prebuilt-rule-8-19-31-gcp-iam-service-account-impersonation-role-granted.asciidoc @@ -0,0 +1,147 @@ +[[prebuilt-rule-8-19-31-gcp-iam-service-account-impersonation-role-granted]] +=== GCP IAM Service Account Impersonation Role Granted + +Identifies when a service account impersonation role is granted on a Google Cloud Platform (GCP) service account via a SetIamPolicy operation. Roles such as "roles/iam.serviceAccountTokenCreator", "roles/iam.serviceAccountUser", and "roles/iam.serviceAccountOpenIdTokenCreator" allow a principal to mint access or identity tokens for the target service account, or to act as it when deploying resources. Adversaries who have obtained sufficient privileges may grant themselves or an attacker-controlled principal one of these roles to impersonate a higher-privileged service account, escalating privileges and establishing durable, key-less persistence that survives credential rotation. This is a New Terms rule that alerts when the granting principal has not been observed performing this action in the last weeks. + +*Rule type*: new_terms + +*Rule indices*: + +* logs-gcp.audit-* + +*Severity*: medium + +*Risk score*: 47 + +*Runs every*: 5m + +*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://securitylabs.datadoghq.com/cloud-security-atlas/attacks/backdooring-service-account/ +* https://stratus-red-team.cloud/attack-techniques/GCP/gcp.persistence.backdoor-service-account-policy/ +* https://cloud.google.com/iam/docs/service-account-impersonation +* https://cloud.google.com/iam/docs/audit-logging/examples-service-accounts + +*Tags*: + +* Domain: Cloud +* Data Source: GCP +* Data Source: GCP Audit Logs +* Data Source: Google Cloud Platform +* Use Case: Identity and Access Audit +* Use Case: Threat Detection +* Tactic: Persistence +* Tactic: Privilege Escalation +* Resources: Investigation Guide + +*Version*: 1 + +*Rule authors*: + +* Elastic +* Aryu Zaw + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + + +*Investigating GCP IAM Service Account Impersonation Role Granted* + + +Granting an impersonation role on a service account lets the bound member obtain that service account's credentials +without creating a long-lived key. `roles/iam.serviceAccountTokenCreator` and `roles/iam.serviceAccountOpenIdTokenCreator` +allow minting OAuth2 access tokens and OpenID Connect identity tokens, while `roles/iam.serviceAccountUser` allows the +member to attach (actAs) the service account to new resources. Adversaries abuse these grants to pivot to a +higher-privileged identity, escalate privileges, and persist in a way that is unaffected by key rotation or password +resets. + + +*Possible investigation steps* + + +- Identify the granting principal via `user.email` and `user.id` and confirm whether that identity is expected to modify +IAM policy on service accounts. +- Review the target service account in `gcp.audit.resource_name` and determine the permissions it holds. Impersonating a +service account with broad project or organization roles represents a significant escalation. +- Inspect the granted binding in `gcp.audit.request` / `gcp.audit.response` to identify the member that was added +(`user:`, `serviceAccount:`, `group:`, or an external domain). External or newly created members are higher risk. +- Examine `gcp.audit.request_metadata.caller_ip` and `gcp.audit.request_metadata.caller_supplied_user_agent` to assess +whether the change originated from an expected location or tool. +- Correlate with recent activity by the granting principal, such as service account key creation, custom role creation, +or `GenerateAccessToken` / `GenerateIdToken` calls that use the newly granted impersonation rights. + + +*False positive analysis* + + +- Terraform, Deployment Manager, and CI/CD service accounts commonly grant serviceAccountUser and +serviceAccountTokenCreator as part of normal provisioning. Baseline these principals and exclude them with exceptions. +- One-time grants during application onboarding or delegation may be legitimate. Validate against change management +before escalating. + + +*Response and remediation* + + +- If the grant is unauthorized, remove the impersonation binding from the service account's IAM policy. +- Revoke any access or identity tokens issued for the impacted service account and review its recent activity for abuse. +- Investigate the granting principal for compromise, rotate its credentials if necessary, and review what other IAM +changes it has made. +- Restrict who can set IAM policy on service accounts and require justification or approval for impersonation grants. + +==== Rule query + + +[source, js] +---------------------------------- +data_stream.dataset: "gcp.audit" + and event.action: google.iam.admin.v*.SetIAMPolicy + and event.outcome: "success" + and gcp.audit.service_data.policy_delta.binding_deltas:{ + action: "ADD" and + role: ( + "roles/iam.serviceAccountTokenCreator" or + "roles/iam.serviceAccountUser" or + "roles/iam.serviceAccountOpenIdTokenCreator" + ) + } + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Persistence +** ID: TA0003 +** Reference URL: https://attack.mitre.org/tactics/TA0003/ +* Technique: +** Name: Account Manipulation +** ID: T1098 +** Reference URL: https://attack.mitre.org/techniques/T1098/ +* Sub-technique: +** Name: Additional Cloud Roles +** ID: T1098.003 +** Reference URL: https://attack.mitre.org/techniques/T1098/003/ +* Tactic: +** Name: Privilege Escalation +** ID: TA0004 +** Reference URL: https://attack.mitre.org/tactics/TA0004/ +* Technique: +** Name: Account Manipulation +** ID: T1098 +** Reference URL: https://attack.mitre.org/techniques/T1098/ +* Sub-technique: +** Name: Additional Cloud Roles +** ID: T1098.003 +** Reference URL: https://attack.mitre.org/techniques/T1098/003/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-31/prebuilt-rule-8-19-31-pkinit-followed-by-same-principal-u2u-service-ticket.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-31/prebuilt-rule-8-19-31-pkinit-followed-by-same-principal-u2u-service-ticket.asciidoc new file mode 100644 index 0000000000..b264b1082a --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-31/prebuilt-rule-8-19-31-pkinit-followed-by-same-principal-u2u-service-ticket.asciidoc @@ -0,0 +1,152 @@ +[[prebuilt-rule-8-19-31-pkinit-followed-by-same-principal-u2u-service-ticket]] +=== PKINIT Followed by Same-Principal U2U Service Ticket + +Identifies a successful PKINIT ticket-granting ticket request followed within five seconds on the same domain controller and source address by a successful user-to-user service-ticket request whose service SID matches the PKINIT principal SID. This sequence is consistent with the KDC-visible ticket requests used in an UnPAC-the-Hash attack, before client-side PAC credential decryption and NT hash recovery. The certificate used for PKINIT may have been obtained through CertiGhost or another certificate-abuse path. + +*Rule type*: eql + +*Rule indices*: + +* logs-system.security* +* logs-windows.forwarded* +* winlogbeat-* + +*Severity*: medium + +*Risk score*: 47 + +*Runs every*: 5m + +*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://specterops.io/blog/2026/06/09/user-to-user-authentication-down-the-rabbit-hole-part-1/ +* https://dirkjanm.io/ntlm-relaying-to-ad-certificate-services/#obtaining-the-nt-hash-of-the-impersonated-computer-account +* https://github.com/FalconForceTeam/FalconFriday/blob/c662a6a0dc5d973beb3abb673d4e8cdc193bf469/0xFF-0299-UnPAC_the_hash-Win.md +* https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26 +* https://github.com/dirkjanm/PKINITtools/blob/0f0cfa542b0348609ad494713e84744234b2d3b0/getnthash.py + +*Tags*: + +* Domain: Identity +* Platform: Windows +* OS: Windows +* Use Case: Threat Detection +* Tactic: Credential Access +* Rule Type: Event Correlation (EQL) +* Use Case: Active Directory Monitoring +* Data Source: Active Directory +* Data Source: Windows Security Event Logs +* Resources: Investigation Guide + +*Version*: 1 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + + +*Investigating PKINIT Followed by Same-Principal U2U Service Ticket* + + +The query uses `winlog.event_data.PreAuthType` value `16` for `PA-PK-AS-REQ`, the PKINIT pre-authentication request +type. Both accepted `winlog.event_data.TicketOptions` masks include `FORWARDABLE`, `RENEWABLE`, `CANONICALIZE`, and +`ENC-TKT-IN-SKEY`; `ENC-TKT-IN-SKEY` is the option that identifies a user-to-user service-ticket request. +`0x40810018` also includes `RENEWABLE-OK`, while `0x40810008` does not. +Controlled request profiles produced both masks, so `RENEWABLE-OK` is not required. Neither mask is suspicious by +itself; the signal is the five-second same-domain-controller and source sequence with the 4768 `TargetSid` matching +the 4769 `ServiceSid`. + + +*Possible investigation steps* + + +- Did the 4769 requester match the PKINIT principal? + - Focus: `event.code`, `winlog.event_data.TargetUserName`, `winlog.event_data.TargetDomainName`, `winlog.event_data.TargetSid`, `winlog.event_data.ServiceSid`. + - Hint: Use Investigate in Timeline to review the matched 4768 and 4769 source events. Compare their `winlog.event_data.TargetUserName` values case-insensitively after removing any `@REALM` suffix, and compare `winlog.event_data.TargetDomainName`. Event 4769 exposes the requester name and domain, but not its SID; resolve ambiguous names through the directory before disposition. + - Implication: A resolved requester matching the 4768 principal supports the same-principal interpretation. Confirmed authorized UnPAC-the-Hash or PKINIT/U2U testing is a benign true positive. Keep a raw-name mismatch unresolved; if identity resolution and client or application evidence establish a different requester and unrelated events, close the alert as a false correlation. +- Does the rule-shaped pattern recur for the same domain controller and source address? + - Focus: `winlog.computer_name`, `source.ip`, `@timestamp`, `winlog.event_data.TargetSid`, `winlog.event_data.ServiceSid`. + - Hint: Reconstruct each sequence manually by checking order, the five-second interval, and the stage-local SID values. The following Timeline investigation returns 24 hours of matching PKINIT and U2U candidates for the shared domain controller and source address, not principal-specific history. !{investigate{"label":"Kerberos history for the same DC and source","providers":[[{"excluded":false,"field":"winlog.computer_name","queryType":"phrase","value":"{{winlog.computer_name}}","valueType":"string"},{"excluded":false,"field":"source.ip","queryType":"phrase","value":"{{source.ip}}","valueType":"string"},{"excluded":false,"field":"event.code","queryType":"phrase","value":"4768","valueType":"string"},{"excluded":false,"field":"winlog.event_data.PreAuthType","queryType":"phrase","value":"16","valueType":"string"},{"excluded":false,"field":"winlog.event_data.Status","queryType":"phrase","value":"0x0","valueType":"string"}],[{"excluded":false,"field":"winlog.computer_name","queryType":"phrase","value":"{{winlog.computer_name}}","valueType":"string"},{"excluded":false,"field":"source.ip","queryType":"phrase","value":"{{source.ip}}","valueType":"string"},{"excluded":false,"field":"event.code","queryType":"phrase","value":"4769","valueType":"string"},{"excluded":false,"field":"winlog.event_data.Status","queryType":"phrase","value":"0x0","valueType":"string"},{"excluded":false,"field":"winlog.event_data.TicketOptions","queryType":"phrase","value":"0x40810008","valueType":"string"}],[{"excluded":false,"field":"winlog.computer_name","queryType":"phrase","value":"{{winlog.computer_name}}","valueType":"string"},{"excluded":false,"field":"source.ip","queryType":"phrase","value":"{{source.ip}}","valueType":"string"},{"excluded":false,"field":"event.code","queryType":"phrase","value":"4769","valueType":"string"},{"excluded":false,"field":"winlog.event_data.Status","queryType":"phrase","value":"0x0","valueType":"string"},{"excluded":false,"field":"winlog.event_data.TicketOptions","queryType":"phrase","value":"0x40810018","valueType":"string"}]],"relativeFrom":"now-24h/h","relativeTo":"now"}} + - Implication: Repeated valid pairs or different principals from the same source increase confidence in credential-recovery tooling. Recurrence does not prove client-side PAC decryption or NT hash recovery. +- What related activity corroborates or expands the scope? + - Focus: `winlog.computer_name`, `source.ip`, `winlog.event_data.TargetUserName`, `winlog.event_data.TargetSid`, `winlog.event_data.ServiceSid`. + - Hint: After reviewing the matched source events, search available identity, endpoint, certificate, and alert telemetry for the source address, principal, and domain controller. Look for upstream certificate abuse, client tooling, repeated PKINIT/U2U activity, or follow-on authentication. Missing telemetry is unresolved, not benign. + - Implication: Upstream certificate abuse, relevant client execution, or follow-on credential use supports escalation and broader scoping. Their absence does not clear the matched sequence. + +Escalate unexplained or corroborated sequences with the matched source events and source/principal scope. Close as a benign true positive only for confirmed authorized UnPAC-the-Hash or PKINIT/U2U testing, or as a false positive when identity resolution and client or application evidence prove an unrelated cross-principal correlation. Preserve available evidence and escalate mixed or incomplete cases. + + +*False positive analysis* + + +No known false positives have been identified. Validate the 4769 requester against the matched 4768 principal because event 4769 does not expose the requester SID. + +Avoid exceptions based only on a domain controller or source address. EQL exceptions evaluate each sequence member independently and cannot express the cross-stage SID relationship. + + +*Response and remediation* + + +- Preserve the alert, matched 4768/4769 source events, timestamps, identities, domain controller, and source address before disruptive action. +- If the client endpoint is identified, collect relevant volatile process or memory evidence before isolation or process termination. +- For confirmed malicious activity, contain the identified client and affected account with reversible controls where possible. Revoke a certificate only when evidence binds it to the activity, and rotate affected credentials when recovery or subsequent use is confirmed or the exposure assessment warrants it. +- Document confirmed indicators, matched source-event values, and any logging gaps for the responsible detection or logging owners after scoping and containment. + + +==== Setup + + + +*Setup* + + +Audit Kerberos Authentication Service and Audit Kerberos Service Ticket Operations must be enabled to generate the +events used by this rule. + +Setup instructions: + +- https://ela.st/audit-kerberos-authentication-service[Audit Kerberos Authentication Service] +- https://ela.st/audit-kerberos-service-ticket-operations[Audit Kerberos Service Ticket Operations] + + +==== Rule query + + +[source, js] +---------------------------------- +sequence by winlog.computer_name, source.ip with maxspan=5s + [authentication where host.os.type == "windows" and + event.code == "4768" and winlog.event_data.PreAuthType == "16" and + winlog.event_data.Status == "0x0" + ] by winlog.event_data.TargetSid + [authentication where host.os.type == "windows" and + event.code == "4769" and winlog.event_data.Status == "0x0" and + winlog.event_data.TicketOptions in ("0x40810008", "0x40810018") + ] by winlog.event_data.ServiceSid + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Credential Access +** ID: TA0006 +** Reference URL: https://attack.mitre.org/tactics/TA0006/ +* Technique: +** Name: Steal or Forge Kerberos Tickets +** ID: T1558 +** Reference URL: https://attack.mitre.org/techniques/T1558/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-31/prebuilt-rule-8-19-31-potential-certighost-ad-cs-machine-identity-mismatch-cve-2026-54121.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-31/prebuilt-rule-8-19-31-potential-certighost-ad-cs-machine-identity-mismatch-cve-2026-54121.asciidoc new file mode 100644 index 0000000000..fa8b8f4bdb --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-31/prebuilt-rule-8-19-31-potential-certighost-ad-cs-machine-identity-mismatch-cve-2026-54121.asciidoc @@ -0,0 +1,217 @@ +[[prebuilt-rule-8-19-31-potential-certighost-ad-cs-machine-identity-mismatch-cve-2026-54121]] +=== Potential CertiGhost AD CS Machine Identity Mismatch (CVE-2026-54121) + +Identifies successful Active Directory Certificate Services (AD CS) certificate issuance events where a machine-account requester differs from the Remote Machine Discovery (RMD) chase target while the event's DNS subject alternative name (SAN) matches that target. This requester-to-target mismatch may indicate CertiGhost (CVE-2026-54121) or similar abuse of AD CS request-context chase processing. + +*Rule type*: esql + +*Rule indices*: None + +*Severity*: high + +*Risk score*: 73 + +*Runs every*: 5m + +*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54121 +* https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26 +* https://github.com/aniqfakhrul/CVE-2026-54121 + +*Tags*: + +* Domain: Endpoint +* Domain: Identity +* OS: Windows +* Use Case: Threat Detection +* Tactic: Credential Access +* Tactic: Privilege Escalation +* Use Case: Active Directory Monitoring +* Use Case: Vulnerability +* Data Source: Active Directory +* Data Source: Windows Security Event Logs +* Resources: Investigation Guide + +*Version*: 2 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + + +*Investigating Potential CertiGhost AD CS Machine Identity Mismatch (CVE-2026-54121)* + + + +*Possible investigation steps* + + +- Does the matched AD CS issuance record validate the identity mismatch? + - Focus: `event.code`, `winlog.event_data.RequestId`, `winlog.event_data.Requester`, `Esql.san_value`, `Esql.rmd_value` + - Hint: Reopen the Windows Security 4887 record on the same CA host and request ID. Compare the parsed SAN and RMD with the complete `winlog.event_data.Attributes` and dedicated SAN field; additional SAN values or disagreement keep the case unresolved. !{investigate{"description":"Finds the Windows Security 4887 certificate issuance record on the same CA host and request ID.","label":"Matched certificate issuance","providers":[[{"excluded":false,"field":"event.code","queryType":"phrase","value":"4887","valueType":"string"},{"excluded":false,"field":"host.id","queryType":"phrase","value":"{{host.id}}","valueType":"string"},{"excluded":false,"field":"winlog.event_data.RequestId","queryType":"phrase","value":"{{winlog.event_data.RequestId}}","valueType":"string"}]],"relativeFrom":"now-24h","relativeTo":"now"}} + - Implication: Event 4887 proves successful issuance, and the alert establishes that the requester differs from the RMD target while the parsed SAN matches that target. This is an operational anti-pattern. Close as benign only when CA records and test records identify an authorized CertiGhost or AD CS security test matching the exact CA, request ID, requester, target, template, and time. +- What identity and authentication capability did the issued certificate receive? + - Focus: `Esql.effective_certificate_template`, `winlog.event_data.Subject`, `winlog.event_data.SubjectAlternativeName`, `winlog.event_data.SubjectKeyIdentifier` + - Hint: Retrieve the issued certificate and CA request/template configuration for the same request ID. Inspect the certificate's actual subject, SAN, EKUs or application policies, validity and revocation state, and the template's subject-name settings and enrollment permissions. + - Implication: Event 4887 and the template name alone do not establish the complete certificate contents or authentication capability. A certificate that represents the RMD target and permits authentication increases the likelihood and impact of credential abuse. Missing certificate or template configuration is unresolved, not benign. +- What other issuances by the requester appear on the same CA host? + - Focus: `host.id`, `winlog.event_data.Requester`, `winlog.event_data.RequestId`, `winlog.event_data.Attributes`, `winlog.event_data.SubjectAlternativeName` + - Hint: Recover 4887 events for the same requester on this CA host. !{investigate{"description":"Finds successful certificate issuance events for the same requester on the same CA host.","label":"Same requester issuances","providers":[[{"excluded":false,"field":"event.code","queryType":"phrase","value":"4887","valueType":"string"},{"excluded":false,"field":"host.id","queryType":"phrase","value":"{{host.id}}","valueType":"string"},{"excluded":false,"field":"winlog.event_data.Requester","queryType":"phrase","value":"{{winlog.event_data.Requester}}","valueType":"string"}]],"relativeFrom":"now-7d","relativeTo":"now"}} + - Implication: Repeated successful requests for different SAN/RMD targets expand the potential abuse scope. One isolated request does not reduce the significance of the current mismatch. +- What other CA events reference the same target identity? + - Focus: `Esql.san_value`, `Esql.rmd_value`, `winlog.event_data.Attributes`, `winlog.event_data.SubjectAlternativeName`, `winlog.event_data.Requester` + - Hint: Copy the alert's exact SAN and RMD values into a scoped Timeline or Discover search for raw 4886, 4887, and 4888 records on the same CA host. Use contains or wildcard matching against `winlog.event_data.Attributes` and `winlog.event_data.SubjectAlternativeName`; derived `Esql.*` fields exist only on the alert. + - Implication: Requests for the same target from additional unexpected accounts expand the affected scope. The absence of other matching events does not clear the current issuance. +- Did the CA connect to the CDC value during certificate processing? + - Focus: `host.id`, `Esql.cdc_value`, `destination.ip`, `destination.port`, `process.name` + - Hint: When the CDC value is an IP address, search network events from the CA host around issuance for that `destination.ip`. For a hostname, resolve it from collected DNS or asset evidence before comparing destination IPs. Review LDAP or LDAPS from `certsrv.exe` and SMB from `System` without requiring either process for all callback traffic. + - Implication: CA-host LDAP or SMB traffic to the CDC value supports request-context chase activity, but neither the CDC attribute nor a connection alone proves exploitation. Missing DNS or CA network telemetry is unresolved, not benign. +- Does surrounding activity show requester creation or target-certificate use? + - Focus: `event.code`, `winlog.event_data.Requester`, `Esql.normalized_rmd_target`, `winlog.event_data.TargetUserName`, `winlog.event_data.PreAuthType` + - Hint: After validating the issuance, inspect account-management events where `winlog.event_data.TargetUserName` matches the requester account name without its domain prefix. Inspect successful 4768 events with `winlog.event_data.PreAuthType` equal to `16`. For DNS-shaped RMD values, compare `winlog.event_data.TargetUserName` with the normalized RMD target plus `$`; for IP-shaped values, first resolve the associated computer account from AD, asset, or CA evidence. Treat later authentication as corroboration unless identity and certificate evidence establish the relationship. + - Implication: Requester creation or change followed by target PKINIT strengthens the exploitation hypothesis. Missing account-management or domain-controller authentication telemetry is unresolved, not benign. + +Escalate when the mismatch is not an authorized test, the issued certificate can authenticate as the target, or callback and follow-on evidence corroborate abuse. Close only when CA, certificate, and test records establish the exact authorized scope; preserve and escalate when evidence or visibility is mixed or incomplete. + + +*False positive analysis* + + +The detected requester-to-target relationship is an operational anti-pattern and did not appear in the self-aligned enrollment controls. Authorized CertiGhost or AD CS security testing is the only currently validated benign explanation. Treat other claimed cross-identity enrollment workflows as unresolved until the 4887 source event, CA request record, issued certificate, template configuration, requester, target, CA, and time scope align without contradictions. + +Do not close on recurrence, absence of related alerts, or the requester account name alone. ES|QL fields created by the query cannot be used in rule exceptions. If an exception is required for recurring authorized testing, combine narrowly scoped source fields such as the CA `host.id`, `winlog.event_data.Requester`, and the exact `winlog.event_data.Attributes` pattern. Avoid exceptions based only on a host, requester, or template. + + +*Response and remediation* + + +- Preserve the 4887 source record, CA request and database records, issued certificate and identifiers, template configuration, and relevant authentication and network evidence before disruptive action. +- Identify affected certification authorities and apply the Microsoft security update or mitigation for CVE-2026-54121. Review request history for the requester and target to identify additional certificates requiring action. +- If malicious activity is confirmed, revoke the affected certificate and verify that revocation information is distributed. Disable or remove an attacker-controlled requester account after preserving evidence. Rotate the target machine credentials and invalidate affected authentication material when certificate use or impersonation is established. +- Isolate an endpoint only when host evidence attributes compromise to that system. The requester account may not map to a managed endpoint, and the target identity alone does not prove that the target endpoint was compromised. +- Record confirmed certificate identifiers, affected principals, CA configuration gaps, and telemetry gaps for the responsible response, PKI, identity, and detection owners. + + +==== Setup + + + +*Setup* + + +Audit Certification Services must be enabled on enterprise certification authorities so that successful certificate +issuance generates Security event 4887. + +The Windows Security integration must retain `winlog.event_data.Attributes`, including the requested SAN and chase +attributes. The rule prefers dedicated certificate-template and subject-alternative-name fields when present and uses +`Attributes` as a fallback. Dropped, truncated, or rewritten attributes create a visibility gap and do not indicate +benign activity. + +Setup instructions: https://ela.st/audit-certification-services + + +==== Rule query + + +[source, js] +---------------------------------- +FROM logs-system.security-* METADATA _id, _index, _version +| WHERE event.code == "4887" AND + winlog.event_data.Requester LIKE "*$" AND + winlog.event_data.Attributes IS NOT NULL + +// Parse Attributes for RMD and CDC, and as a fallback when dedicated template or SAN fields are absent. +// CDC and the effective template are retained for triage purposes +| GROK winlog.event_data.Attributes + """(?im)^[ \t]*CertificateTemplate[ \t]*:[ \t]*(?[^\r\n]+)\r?$""" +| GROK winlog.event_data.Attributes + """(?im)^[ \t]*SAN[ \t]*:[ \t]*dns[ \t]*=[ \t]*(?[^\r\n]+)\r?$""" +| GROK winlog.event_data.SubjectAlternativeName + """(?im)^[ \t]*DNS[ \t]+Name[ \t]*=[ \t]*(?[^\r\n]+)\r?$""" +| GROK winlog.event_data.Attributes + """(?im)^[ \t]*cdc[ \t]*:[ \t]*(?[^\r\n]+)\r?$""" +| GROK winlog.event_data.Attributes + """(?im)^[ \t]*rmd[ \t]*:[ \t]*(?[^\r\n]+)\r?$""" +| EVAL Esql.effective_certificate_template = TRIM(COALESCE( + winlog.event_data.CertificateTemplate, + Esql.attributes_certificate_template + )), + Esql.san_value = TRIM(COALESCE(Esql.event_san_value, Esql.attributes_san_value)), + Esql.cdc_value = TRIM(Esql.cdc_value), + Esql.rmd_value = TRIM(Esql.rmd_value), + Esql.normalized_requester = TO_LOWER( + REPLACE(winlog.event_data.Requester, """^.*\\|\$$""", "") + ), + Esql.normalized_san_value = TO_LOWER( + REPLACE(Esql.san_value, """\.$""", "") + ), + Esql.normalized_rmd_value = TO_LOWER( + REPLACE(Esql.rmd_value, """\.$""", "") + ) +// Preserve IP-shaped values; shorten other SAN and RMD values to the first DNS label for machine-account comparison. +| EVAL Esql.san_is_ip_shaped = + Esql.normalized_san_value RLIKE """[0-9]{1,3}(\.[0-9]{1,3}){3}""" OR Esql.normalized_san_value LIKE "*:*", + Esql.rmd_is_ip_shaped = + Esql.normalized_rmd_value RLIKE """[0-9]{1,3}(\.[0-9]{1,3}){3}""" OR Esql.normalized_rmd_value LIKE "*:*" +| EVAL Esql.normalized_san_target = CASE( + Esql.san_is_ip_shaped, + Esql.normalized_san_value, + REPLACE(Esql.normalized_san_value, """\..*$""", "") + ), + Esql.normalized_rmd_target = CASE( + Esql.rmd_is_ip_shaped, + Esql.normalized_rmd_value, + REPLACE(Esql.normalized_rmd_value, """\..*$""", "") + ) +| WHERE Esql.normalized_requester IS NOT NULL AND + Esql.normalized_san_target IS NOT NULL AND + Esql.normalized_rmd_target IS NOT NULL +| WHERE Esql.normalized_requester != Esql.normalized_rmd_target AND + Esql.normalized_san_target == Esql.normalized_rmd_target +| KEEP @timestamp, _id, _index, _version, event.code, event.action, event.category, event.type, event.outcome, + event.created, event.ingested, data_stream.dataset, data_stream.namespace, host.id, host.name, + winlog.computer_name, winlog.record_id, winlog.event_data.RequestId, winlog.event_data.Requester, + winlog.event_data.CertificateTemplate, winlog.event_data.Subject, winlog.event_data.SubjectAlternativeName, + winlog.event_data.Attributes, winlog.event_data.Disposition, winlog.event_data.SubjectKeyIdentifier, + Esql.effective_certificate_template, Esql.san_value, Esql.cdc_value, Esql.rmd_value, + Esql.normalized_requester, Esql.normalized_san_target, Esql.normalized_rmd_target + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Credential Access +** ID: TA0006 +** Reference URL: https://attack.mitre.org/tactics/TA0006/ +* Technique: +** Name: Steal or Forge Authentication Certificates +** ID: T1649 +** Reference URL: https://attack.mitre.org/techniques/T1649/ +* Technique: +** Name: Exploitation for Credential Access +** ID: T1212 +** Reference URL: https://attack.mitre.org/techniques/T1212/ +* Tactic: +** Name: Privilege Escalation +** ID: TA0004 +** Reference URL: https://attack.mitre.org/tactics/TA0004/ +* Technique: +** Name: Exploitation for Privilege Escalation +** ID: T1068 +** Reference URL: https://attack.mitre.org/techniques/T1068/ diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-31/prebuilt-rules-8-19-31-appendix.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-31/prebuilt-rules-8-19-31-appendix.asciidoc new file mode 100644 index 0000000000..1a7f853f03 --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-31/prebuilt-rules-8-19-31-appendix.asciidoc @@ -0,0 +1,10 @@ +["appendix",role="exclude",id="prebuilt-rule-8-19-31-prebuilt-rules-8-19-31-appendix"] += Downloadable rule update v8.19.31 + +This section lists all updates associated with version 8.19.31 of the Fleet integration *Prebuilt Security Detection Rules*. + + +include::prebuilt-rule-8-19-31-gcp-iam-service-account-impersonation-role-granted.asciidoc[] +include::prebuilt-rule-8-19-31-potential-certighost-ad-cs-machine-identity-mismatch-cve-2026-54121.asciidoc[] +include::prebuilt-rule-8-19-31-pkinit-followed-by-same-principal-u2u-service-ticket.asciidoc[] +include::prebuilt-rule-8-19-31-entra-id-high-risk-sign-in.asciidoc[] diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-31/prebuilt-rules-8-19-31-summary.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-31/prebuilt-rules-8-19-31-summary.asciidoc new file mode 100644 index 0000000000..b307234632 --- /dev/null +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-31/prebuilt-rules-8-19-31-summary.asciidoc @@ -0,0 +1,20 @@ +[[prebuilt-rule-8-19-31-prebuilt-rules-8-19-31-summary]] +[role="xpack"] +== Update v8.19.31 + +This section lists all updates associated with version 8.19.31 of the Fleet integration *Prebuilt Security Detection Rules*. + + +[width="100%",options="header"] +|============================================== +|Rule |Description |Status |Version + +|<> | Identifies when a service account impersonation role is granted on a Google Cloud Platform (GCP) service account via a SetIamPolicy operation. Roles such as "roles/iam.serviceAccountTokenCreator", "roles/iam.serviceAccountUser", and "roles/iam.serviceAccountOpenIdTokenCreator" allow a principal to mint access or identity tokens for the target service account, or to act as it when deploying resources. Adversaries who have obtained sufficient privileges may grant themselves or an attacker-controlled principal one of these roles to impersonate a higher-privileged service account, escalating privileges and establishing durable, key-less persistence that survives credential rotation. This is a New Terms rule that alerts when the granting principal has not been observed performing this action in the last weeks. | new | 1 + +|<> | Identifies successful Active Directory Certificate Services (AD CS) certificate issuance events where a machine-account requester differs from the Remote Machine Discovery (RMD) chase target while the event's DNS subject alternative name (SAN) matches that target. This requester-to-target mismatch may indicate CertiGhost (CVE-2026-54121) or similar abuse of AD CS request-context chase processing. | new | 2 + +|<> | Identifies a successful PKINIT ticket-granting ticket request followed within five seconds on the same domain controller and source address by a successful user-to-user service-ticket request whose service SID matches the PKINIT principal SID. This sequence is consistent with the KDC-visible ticket requests used in an UnPAC-the-Hash attack, before client-side PAC credential decryption and NT hash recovery. The certificate used for PKINIT may have been obtained through CertiGhost or another certificate-abuse path. | new | 1 + +|<> | Identifies high risk Microsoft Entra ID sign-ins by leveraging Microsoft's Identity Protection machine learning and heuristics. Identity Protection categorizes risk into three tiers: low, medium, and high. While Microsoft does not provide specific details about how risk is calculated, each level brings higher confidence that the user or sign-in is compromised. | update | 113 + +|============================================== diff --git a/docs/detections/prebuilt-rules/prebuilt-rules-downloadable-updates.asciidoc b/docs/detections/prebuilt-rules/prebuilt-rules-downloadable-updates.asciidoc index e55e39bb4e..f7d2a50f06 100644 --- a/docs/detections/prebuilt-rules/prebuilt-rules-downloadable-updates.asciidoc +++ b/docs/detections/prebuilt-rules/prebuilt-rules-downloadable-updates.asciidoc @@ -13,6 +13,10 @@ For previous rule updates, please navigate to the https://www.elastic.co/guide/e |Update version |Date | New rules | Updated rules | Notes +|<> | 18 Aug 2026 | 3 | 1 | +This release includes new rules for Windows and GCP. New rules for Windows include detection for credential access. New rules for GCP include detection for persistence. Additionally, significant tuning for Azure, Linux, Windows, and macOS rules improves efficacy and performance. + + |<> | 11 Aug 2026 | 4 | 1 | This release includes new rules for Windows, Azure, and Network Traffic. New rules for Windows include detection for credential access and command and control. New rules for Azure include detection for credential access. New rules for Network Traffic include detection for impact. Additionally, this release fixes rule Potential Computer Account NTLM Relay Activity, which failed to load due to an unsupported EQL field length comparison. @@ -163,3 +167,4 @@ include::downloadable-packages/8-19-27/prebuilt-rules-8-19-27-summary.asciidoc[l include::downloadable-packages/8-19-28/prebuilt-rules-8-19-28-summary.asciidoc[leveloffset=+1] include::downloadable-packages/8-19-29/prebuilt-rules-8-19-29-summary.asciidoc[leveloffset=+1] include::downloadable-packages/8-19-30/prebuilt-rules-8-19-30-summary.asciidoc[leveloffset=+1] +include::downloadable-packages/8-19-31/prebuilt-rules-8-19-31-summary.asciidoc[leveloffset=+1] diff --git a/docs/detections/prebuilt-rules/prebuilt-rules-reference.asciidoc b/docs/detections/prebuilt-rules/prebuilt-rules-reference.asciidoc index 64f47cecdb..adc59ff99b 100644 --- a/docs/detections/prebuilt-rules/prebuilt-rules-reference.asciidoc +++ b/docs/detections/prebuilt-rules/prebuilt-rules-reference.asciidoc @@ -1000,7 +1000,7 @@ and their rule type is `machine_learning`. |<> |Identifies Entra ID user accounts converted from Guest to Member type via an Update user operation. A Guest-to-Member conversion grants the account full directory read access, removes external-identity Conditional Access restrictions, and makes the account indistinguishable from an internal employee. An attacker who compromises a guest account and promotes it to Member type gains persistent tenant access without triggering role assignment alerts. |[Domain: Cloud], [Domain: Identity], [Data Source: Azure], [Data Source: Microsoft Entra ID], [Data Source: Microsoft Entra ID Audit Logs], [Use Case: Identity and Access Audit], [Tactic: Persistence], [Resources: Investigation Guide] |None |1 -|<> |Identifies high risk Microsoft Entra ID sign-ins by leveraging Microsoft's Identity Protection machine learning and heuristics. Identity Protection categorizes risk into three tiers: low, medium, and high. While Microsoft does not provide specific details about how risk is calculated, each level brings higher confidence that the user or sign-in is compromised. |[Domain: Cloud], [Domain: Identity], [Data Source: Azure], [Data Source: Microsoft Entra ID], [Data Source: Microsoft Entra ID Sign-in Logs], [Use Case: Identity and Access Audit], [Resources: Investigation Guide], [Tactic: Initial Access] |None |112 +|<> |Identifies high risk Microsoft Entra ID sign-ins by leveraging Microsoft's Identity Protection machine learning and heuristics. Identity Protection categorizes risk into three tiers: low, medium, and high. While Microsoft does not provide specific details about how risk is calculated, each level brings higher confidence that the user or sign-in is compromised. |[Domain: Cloud], [Domain: Identity], [Data Source: Azure], [Data Source: Microsoft Entra ID], [Data Source: Microsoft Entra ID Sign-in Logs], [Use Case: Identity and Access Audit], [Resources: Investigation Guide], [Tactic: Initial Access] |None |113 |<> |Identifies high risk Azure Active Directory (AD) sign-ins by leveraging Microsoft Identity Protection machine learning and heuristics. |[Domain: Cloud], [Data Source: Azure], [Use Case: Identity and Access Audit], [Resources: Investigation Guide], [Tactic: Initial Access] |None |110 @@ -1308,6 +1308,8 @@ and their rule type is `machine_learning`. |<> |Identifies an Identity and Access Management (IAM) role deletion in Google Cloud Platform (GCP). A role contains a set of permissions that allows you to perform specific actions on Google Cloud resources. An adversary may delete an IAM role to inhibit access to accounts utilized by legitimate users. |[Domain: Cloud], [Data Source: GCP], [Data Source: Google Cloud Platform], [Use Case: Identity and Access Audit], [Tactic: Impact], [Resources: Investigation Guide] |None |108 +|<> |Identifies when a service account impersonation role is granted on a Google Cloud Platform (GCP) service account via a SetIamPolicy operation. Roles such as "roles/iam.serviceAccountTokenCreator", "roles/iam.serviceAccountUser", and "roles/iam.serviceAccountOpenIdTokenCreator" allow a principal to mint access or identity tokens for the target service account, or to act as it when deploying resources. Adversaries who have obtained sufficient privileges may grant themselves or an attacker-controlled principal one of these roles to impersonate a higher-privileged service account, escalating privileges and establishing durable, key-less persistence that survives credential rotation. This is a New Terms rule that alerts when the granting principal has not been observed performing this action in the last weeks. |[Domain: Cloud], [Data Source: GCP], [Data Source: GCP Audit Logs], [Data Source: Google Cloud Platform], [Use Case: Identity and Access Audit], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Privilege Escalation], [Resources: Investigation Guide] |None |1 + |<> |Identifies the deletion of an Identity and Access Management (IAM) service account key in Google Cloud Platform (GCP). Each service account is associated with two sets of public/private RSA key pairs that are used to authenticate. If a key is deleted, the application will no longer be able to access Google Cloud resources using that key. A security best practice is to rotate your service account keys regularly. |[Domain: Cloud], [Data Source: GCP], [Data Source: Google Cloud Platform], [Use Case: Identity and Access Audit], [Tactic: Persistence], [Resources: Investigation Guide] |None |109 |<> |Identifies a Logging bucket deletion in Google Cloud Platform (GCP). Log buckets are containers that store and organize log data. A deleted bucket stays in a pending state for 7 days, and Logging continues to route logs to the bucket during that time. To stop routing logs to a deleted bucket, you can delete the log sinks that have the bucket as their destination, or modify the filter for the sinks to stop it from routing logs to the deleted bucket. An adversary may delete a log bucket to evade detection. |[Domain: Cloud], [Data Source: GCP], [Data Source: Google Cloud Platform], [Use Case: Log Auditing], [Tactic: Defense Evasion], [Resources: Investigation Guide] |None |109 @@ -1450,7 +1452,7 @@ and their rule type is `machine_learning`. |<> |Detects when GenAI processes perform encoding or chunking (base64, gzip, tar, zip) followed by outbound network activity. This sequence indicates data preparation for exfiltration. Attackers encode or compress sensitive data before transmission to obfuscate contents and evade detection. Legitimate GenAI workflows rarely encode data before network communications. |[Domain: Endpoint], [OS: Linux], [OS: macOS], [OS: Windows], [Use Case: Threat Detection], [Tactic: Exfiltration], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: Microsoft Defender XDR], [Data Source: SentinelOne], [Resources: Investigation Guide], [Domain: LLM], [Mitre Atlas: T0086] |None |3 -|<> |Detects child process execution from GenAI tools or MCP (Model Context Protocol) servers. Adversaries exploit AI agents to execute system commands, exfiltrate data, or establish persistence. MCP servers provide LLMs direct access to execute shell commands, read files, and interact with external services. This building block provides visibility into AI-initiated process execution for correlation with other suspicious activity. |[Domain: Endpoint], [OS: Linux], [OS: macOS], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: Microsoft Defender XDR], [Data Source: SentinelOne], [Rule Type: BBR], [Domain: LLM], [Mitre Atlas: T0053] |None |3 +|<> |Detects child process execution from GenAI tools or MCP (Model Context Protocol) servers. Adversaries exploit AI agents to execute system commands, exfiltrate data, or establish persistence. MCP servers provide LLMs direct access to execute shell commands, read files, and interact with external services. This building block provides visibility into AI-initiated process execution for correlation with other suspicious activity. |[Domain: Endpoint], [OS: Linux], [OS: macOS], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: Microsoft Defender XDR], [Data Source: SentinelOne], [Rule Type: BBR], [Domain: LLM], [Mitre Atlas: T0053] |None |4 |<> |This rule detects child processes spawned by Git hooks. Git hooks are scripts that Git executes before or after events such as commit, push, and receive. The rule identifies child processes spawned by Git hooks that are not typically spawned by the Git process itself. This behavior may indicate an attacker attempting to hide malicious activity by leveraging the legitimate Git process to execute unauthorized commands. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Execution], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Data Source: Crowdstrike], [Data Source: SentinelOne], [Data Source: Elastic Endgame], [Resources: Investigation Guide] |None |107 @@ -2240,6 +2242,8 @@ and their rule type is `machine_learning`. |<> |Detects the creation of a PHP file in the WordPress plugin directory, which is a common technique used by attackers to establish persistence on a compromised web server. Attackers may upload a malicious PHP file and call it from a web browser to gain remote access to the server. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Initial Access], [Use Case: Vulnerability], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |2 +|<> |Identifies a successful PKINIT ticket-granting ticket request followed within five seconds on the same domain controller and source address by a successful user-to-user service-ticket request whose service SID matches the PKINIT principal SID. This sequence is consistent with the KDC-visible ticket requests used in an UnPAC-the-Hash attack, before client-side PAC credential decryption and NT hash recovery. The certificate used for PKINIT may have been obtained through CertiGhost or another certificate-abuse path. |[Domain: Identity], [Platform: Windows], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Rule Type: Event Correlation (EQL)], [Use Case: Active Directory Monitoring], [Data Source: Active Directory], [Data Source: Windows Security Event Logs], [Resources: Investigation Guide] |None |1 + |<> |A machine learning job combination has identified a parent process with one or more suspicious Windows processes that exhibit unusually high malicious probability scores. These process(es) have been classified as malicious in several ways. The process(es) were predicted to be malicious by the ProblemChild supervised ML model. If the anomaly contains a cluster of suspicious processes, each process has the same parent process name, and the aggregate score of the event cluster was calculated to be unusually high by an unsupervised ML model. Such a cluster often contains suspicious or malicious activity, possibly involving LOLbins, that may be resistant to detection using conventional search rules. |[Domain: Endpoint], [OS: Windows], [Use Case: Living off the Land Attack Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Defense Evasion], [Resources: Investigation Guide] |None |111 |<> |Identifies parent process spoofing used to thwart detection. Adversaries may spoof the parent process identifier (PPID) of a new process to evade process-monitoring defenses or to elevate privileges. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |111 @@ -2348,6 +2352,8 @@ and their rule type is `machine_learning`. |<> |Identifies Internet Explorer Diagnostics launching a helper name from a non-System32 path, which may indicate CVE-2025-33053 exploitation. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: Microsoft Defender XDR], [Data Source: SentinelOne], [Resources: Investigation Guide] |None |4 +|<> |Identifies successful Active Directory Certificate Services (AD CS) certificate issuance events where a machine-account requester differs from the Remote Machine Discovery (RMD) chase target while the event's DNS subject alternative name (SAN) matches that target. This requester-to-target mismatch may indicate CertiGhost (CVE-2026-54121) or similar abuse of AD CS request-context chase processing. |[Domain: Endpoint], [Domain: Identity], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Tactic: Privilege Escalation], [Use Case: Active Directory Monitoring], [Use Case: Vulnerability], [Data Source: Active Directory], [Data Source: Windows Security Event Logs], [Resources: Investigation Guide] |None |2 + |<> |Monitors for the execution of a file system mount followed by a chroot execution. Given enough permissions, a user within a container is capable of mounting the root file system of the host, and leveraging chroot to escape its containarized environment. This behavior pattern is very uncommon and should be investigated. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Domain: Container], [Data Source: Elastic Defend], [Data Source: SentinelOne], [Resources: Investigation Guide], [Data Source: Crowdstrike] |None |108 |<> |This rule monitors for suspicious activities that may indicate an attacker attempting to execute arbitrary code within a PostgreSQL environment. Attackers can execute code via PostgreSQL as a result of gaining unauthorized access to a public facing PostgreSQL database or exploiting vulnerabilities, such as remote command execution and SQL injection attacks, which can result in unauthorized access and malicious actions, and facilitate post-exploitation activities for unauthorized access and malicious actions. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |13 diff --git a/docs/detections/prebuilt-rules/rule-desc-index.asciidoc b/docs/detections/prebuilt-rules/rule-desc-index.asciidoc index d0c912387c..9f07ea9dbc 100644 --- a/docs/detections/prebuilt-rules/rule-desc-index.asciidoc +++ b/docs/detections/prebuilt-rules/rule-desc-index.asciidoc @@ -645,6 +645,7 @@ include::rule-details/gcp-firewall-rule-deletion.asciidoc[] include::rule-details/gcp-firewall-rule-modification.asciidoc[] include::rule-details/gcp-iam-custom-role-creation.asciidoc[] include::rule-details/gcp-iam-role-deletion.asciidoc[] +include::rule-details/gcp-iam-service-account-impersonation-role-granted.asciidoc[] include::rule-details/gcp-iam-service-account-key-deletion.asciidoc[] include::rule-details/gcp-logging-bucket-deletion.asciidoc[] include::rule-details/gcp-logging-sink-deletion.asciidoc[] @@ -1111,6 +1112,7 @@ include::rule-details/outbound-scheduled-task-activity-via-powershell.asciidoc[] include::rule-details/outlook-home-page-registry-modification.asciidoc[] include::rule-details/panw-and-elastic-defend-command-and-control-correlation.asciidoc[] include::rule-details/php-file-creation-in-wordpress-plugin-directory.asciidoc[] +include::rule-details/pkinit-followed-by-same-principal-u2u-service-ticket.asciidoc[] include::rule-details/parent-process-detected-with-suspicious-windows-process-es.asciidoc[] include::rule-details/parent-process-pid-spoofing.asciidoc[] include::rule-details/passwordless-sudo-probing.asciidoc[] @@ -1165,6 +1167,7 @@ include::rule-details/potential-buffer-overflow-attack-detected.asciidoc[] include::rule-details/potential-cve-2025-32463-nsswitch-file-creation.asciidoc[] include::rule-details/potential-cve-2025-32463-sudo-chroot-execution-attempt.asciidoc[] include::rule-details/potential-cve-2025-33053-exploitation.asciidoc[] +include::rule-details/potential-certighost-ad-cs-machine-identity-mismatch-cve-2026-54121.asciidoc[] include::rule-details/potential-chroot-container-escape-via-mount.asciidoc[] include::rule-details/potential-code-execution-via-postgresql.asciidoc[] include::rule-details/potential-command-shell-via-netcat.asciidoc[] diff --git a/docs/detections/prebuilt-rules/rule-details/entra-id-high-risk-sign-in.asciidoc b/docs/detections/prebuilt-rules/rule-details/entra-id-high-risk-sign-in.asciidoc index 2db46ab813..7e425a963b 100644 --- a/docs/detections/prebuilt-rules/rule-details/entra-id-high-risk-sign-in.asciidoc +++ b/docs/detections/prebuilt-rules/rule-details/entra-id-high-risk-sign-in.asciidoc @@ -37,7 +37,7 @@ Identifies high risk Microsoft Entra ID sign-ins by leveraging Microsoft's Ident * Resources: Investigation Guide * Tactic: Initial Access -*Version*: 112 +*Version*: 113 *Rule authors*: @@ -81,7 +81,7 @@ This rule detects high-risk sign-ins in Microsoft Entra ID as identified by Iden - Risky sign-ins may be triggered during legitimate travel, VPN use, or remote work scenarios from unusual locations. - In some cases, users switching devices or networks rapidly may trigger high-risk scores. - Automated scanners or penetration tests using known credentials may mimic high-risk login behavior. -- Confirm whether the risk was remediated automatically by Microsoft Identity Protection before proceeding with escalations. +- Sign-ins already marked `risk_state` as `remediated`, `dismissed`, or `confirmedSafe` by Microsoft Identity Protection are excluded; failed attempts with no aggregated risk and no active risk state are also excluded. *Response and remediation* @@ -107,7 +107,7 @@ data_stream.dataset:azure.signinlogs and azure.signinlogs.properties.risk_level_aggregated:high ) and not (event.outcome:failure and azure.signinlogs.properties.risk_level_aggregated:none and azure.signinlogs.properties.risk_state:none) and - not azure.signinlogs.properties.risk_state:(dismissed or confirmedSafe) + not azure.signinlogs.properties.risk_state:(remediated or dismissed or confirmedSafe) ---------------------------------- diff --git a/docs/detections/prebuilt-rules/rule-details/gcp-iam-service-account-impersonation-role-granted.asciidoc b/docs/detections/prebuilt-rules/rule-details/gcp-iam-service-account-impersonation-role-granted.asciidoc new file mode 100644 index 0000000000..3a6920cfe9 --- /dev/null +++ b/docs/detections/prebuilt-rules/rule-details/gcp-iam-service-account-impersonation-role-granted.asciidoc @@ -0,0 +1,147 @@ +[[gcp-iam-service-account-impersonation-role-granted]] +=== GCP IAM Service Account Impersonation Role Granted + +Identifies when a service account impersonation role is granted on a Google Cloud Platform (GCP) service account via a SetIamPolicy operation. Roles such as "roles/iam.serviceAccountTokenCreator", "roles/iam.serviceAccountUser", and "roles/iam.serviceAccountOpenIdTokenCreator" allow a principal to mint access or identity tokens for the target service account, or to act as it when deploying resources. Adversaries who have obtained sufficient privileges may grant themselves or an attacker-controlled principal one of these roles to impersonate a higher-privileged service account, escalating privileges and establishing durable, key-less persistence that survives credential rotation. This is a New Terms rule that alerts when the granting principal has not been observed performing this action in the last weeks. + +*Rule type*: new_terms + +*Rule indices*: + +* logs-gcp.audit-* + +*Severity*: medium + +*Risk score*: 47 + +*Runs every*: 5m + +*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://securitylabs.datadoghq.com/cloud-security-atlas/attacks/backdooring-service-account/ +* https://stratus-red-team.cloud/attack-techniques/GCP/gcp.persistence.backdoor-service-account-policy/ +* https://cloud.google.com/iam/docs/service-account-impersonation +* https://cloud.google.com/iam/docs/audit-logging/examples-service-accounts + +*Tags*: + +* Domain: Cloud +* Data Source: GCP +* Data Source: GCP Audit Logs +* Data Source: Google Cloud Platform +* Use Case: Identity and Access Audit +* Use Case: Threat Detection +* Tactic: Persistence +* Tactic: Privilege Escalation +* Resources: Investigation Guide + +*Version*: 1 + +*Rule authors*: + +* Elastic +* Aryu Zaw + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + + +*Investigating GCP IAM Service Account Impersonation Role Granted* + + +Granting an impersonation role on a service account lets the bound member obtain that service account's credentials +without creating a long-lived key. `roles/iam.serviceAccountTokenCreator` and `roles/iam.serviceAccountOpenIdTokenCreator` +allow minting OAuth2 access tokens and OpenID Connect identity tokens, while `roles/iam.serviceAccountUser` allows the +member to attach (actAs) the service account to new resources. Adversaries abuse these grants to pivot to a +higher-privileged identity, escalate privileges, and persist in a way that is unaffected by key rotation or password +resets. + + +*Possible investigation steps* + + +- Identify the granting principal via `user.email` and `user.id` and confirm whether that identity is expected to modify +IAM policy on service accounts. +- Review the target service account in `gcp.audit.resource_name` and determine the permissions it holds. Impersonating a +service account with broad project or organization roles represents a significant escalation. +- Inspect the granted binding in `gcp.audit.request` / `gcp.audit.response` to identify the member that was added +(`user:`, `serviceAccount:`, `group:`, or an external domain). External or newly created members are higher risk. +- Examine `gcp.audit.request_metadata.caller_ip` and `gcp.audit.request_metadata.caller_supplied_user_agent` to assess +whether the change originated from an expected location or tool. +- Correlate with recent activity by the granting principal, such as service account key creation, custom role creation, +or `GenerateAccessToken` / `GenerateIdToken` calls that use the newly granted impersonation rights. + + +*False positive analysis* + + +- Terraform, Deployment Manager, and CI/CD service accounts commonly grant serviceAccountUser and +serviceAccountTokenCreator as part of normal provisioning. Baseline these principals and exclude them with exceptions. +- One-time grants during application onboarding or delegation may be legitimate. Validate against change management +before escalating. + + +*Response and remediation* + + +- If the grant is unauthorized, remove the impersonation binding from the service account's IAM policy. +- Revoke any access or identity tokens issued for the impacted service account and review its recent activity for abuse. +- Investigate the granting principal for compromise, rotate its credentials if necessary, and review what other IAM +changes it has made. +- Restrict who can set IAM policy on service accounts and require justification or approval for impersonation grants. + +==== Rule query + + +[source, js] +---------------------------------- +data_stream.dataset: "gcp.audit" + and event.action: google.iam.admin.v*.SetIAMPolicy + and event.outcome: "success" + and gcp.audit.service_data.policy_delta.binding_deltas:{ + action: "ADD" and + role: ( + "roles/iam.serviceAccountTokenCreator" or + "roles/iam.serviceAccountUser" or + "roles/iam.serviceAccountOpenIdTokenCreator" + ) + } + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Persistence +** ID: TA0003 +** Reference URL: https://attack.mitre.org/tactics/TA0003/ +* Technique: +** Name: Account Manipulation +** ID: T1098 +** Reference URL: https://attack.mitre.org/techniques/T1098/ +* Sub-technique: +** Name: Additional Cloud Roles +** ID: T1098.003 +** Reference URL: https://attack.mitre.org/techniques/T1098/003/ +* Tactic: +** Name: Privilege Escalation +** ID: TA0004 +** Reference URL: https://attack.mitre.org/tactics/TA0004/ +* Technique: +** Name: Account Manipulation +** ID: T1098 +** Reference URL: https://attack.mitre.org/techniques/T1098/ +* Sub-technique: +** Name: Additional Cloud Roles +** ID: T1098.003 +** Reference URL: https://attack.mitre.org/techniques/T1098/003/ diff --git a/docs/detections/prebuilt-rules/rule-details/genai-or-mcp-server-child-process-execution.asciidoc b/docs/detections/prebuilt-rules/rule-details/genai-or-mcp-server-child-process-execution.asciidoc index c0441029ce..31c0f7f65f 100644 --- a/docs/detections/prebuilt-rules/rule-details/genai-or-mcp-server-child-process-execution.asciidoc +++ b/docs/detections/prebuilt-rules/rule-details/genai-or-mcp-server-child-process-execution.asciidoc @@ -40,7 +40,7 @@ Detects child process execution from GenAI tools or MCP (Model Context Protocol) * Domain: LLM * Mitre Atlas: T0053 -*Version*: 3 +*Version*: 4 *Rule authors*: @@ -112,19 +112,45 @@ process where event.type == "start" (process.parent.name in ("deno", "deno.exe") and process.name in ("deno", "deno.exe")) or (process.parent.name in ("bun", "bun.exe") and process.name in ("bun", "bun.exe")) or - // Helper process self-spawns - (process.parent.name == "Cursor" and process.name like~ "Cursor Helper*") or - (process.parent.name == "Claude" and process.name like~ "Claude Helper*") or - (process.parent.name == "Windsurf" and process.name like~ "Windsurf Helper*") or - (process.parent.name == "Code" and process.name like~ "Code Helper*") or - (process.parent.name == "Jan" and process.name like~ "Jan Helper*") or - (process.parent.name == "LM Studio" and process.name like~ "LM Studio Helper*") or - (process.parent.name == "Ollama" and process.name like~ "Ollama Helper*") or - + // Electron helper noise: app -> helper, and helper -> helper + (process.parent.name like~ ("Cursor", "Cursor.exe", "Cursor Helper*") and + process.name like~ "Cursor Helper*") or + (process.parent.name like~ ("Claude", "Claude.exe", "Claude Helper*") and + process.name like~ "Claude Helper*") or + (process.parent.name like~ ("Windsurf", "Windsurf.exe", "Windsurf Helper*") and + process.name like~ "Windsurf Helper*") or + (process.parent.name like~ ("Code", "Code.exe", "Code Helper*") and + process.name like~ "Code Helper*") or + (process.parent.name like~ ("Jan", "Jan.exe", "Jan Helper*") and + process.name like~ "Jan Helper*") or + (process.parent.name like~ ("LM Studio", "LM Studio.exe", "LM Studio Helper*") and + process.name like~ ("LM Studio", "LM Studio.exe", "LM Studio Helper*")) or + (process.parent.name like~ ("Ollama", "Ollama.exe", "Ollama Helper*") and + process.name like~ "Ollama Helper*") or + + // GenAI client same-name self-spawns (explicit pairs; no field-to-field compare) + (process.parent.name like~ ("cursor", "cursor.exe") and + process.name like~ ("cursor", "cursor.exe")) or + (process.parent.name like~ ("claude", "claude.exe") and + process.name like~ ("claude", "claude.exe")) or + (process.parent.name like~ ("windsurf", "windsurf.exe") and + process.name like~ ("windsurf", "windsurf.exe")) or + (process.parent.name like~ ("code", "code.exe") and + process.name like~ ("code", "code.exe")) or + (process.parent.name like~ ("codex", "codex.exe") and + process.name like~ ("codex", "codex.exe")) or + (process.parent.name like~ ("copilot", "copilot.exe") and + process.name like~ ("copilot", "copilot.exe")) or + (process.parent.name like~ ("jan", "jan.exe") and + process.name like~ ("jan", "jan.exe")) or + (process.parent.name like~ ("ollama", "ollama.exe") and + process.name like~ ("ollama", "ollama.exe")) or + // docker (process.name in ("docker", "docker.exe") and process.args == "context" and process.args == "ls") or - // neighbor / arp / ps / which (args tokens or full /bin/sh -c) + // env probes: ps/getconf/lsb_release by name; neighbor/arp/which by args or /bin/sh -c ( + process.name in ("ps", "getconf", "lsb_release") or process.args in ( "ip neigh show", "arp -a -n -l", diff --git a/docs/detections/prebuilt-rules/rule-details/pkinit-followed-by-same-principal-u2u-service-ticket.asciidoc b/docs/detections/prebuilt-rules/rule-details/pkinit-followed-by-same-principal-u2u-service-ticket.asciidoc new file mode 100644 index 0000000000..52151ba154 --- /dev/null +++ b/docs/detections/prebuilt-rules/rule-details/pkinit-followed-by-same-principal-u2u-service-ticket.asciidoc @@ -0,0 +1,152 @@ +[[pkinit-followed-by-same-principal-u2u-service-ticket]] +=== PKINIT Followed by Same-Principal U2U Service Ticket + +Identifies a successful PKINIT ticket-granting ticket request followed within five seconds on the same domain controller and source address by a successful user-to-user service-ticket request whose service SID matches the PKINIT principal SID. This sequence is consistent with the KDC-visible ticket requests used in an UnPAC-the-Hash attack, before client-side PAC credential decryption and NT hash recovery. The certificate used for PKINIT may have been obtained through CertiGhost or another certificate-abuse path. + +*Rule type*: eql + +*Rule indices*: + +* logs-system.security* +* logs-windows.forwarded* +* winlogbeat-* + +*Severity*: medium + +*Risk score*: 47 + +*Runs every*: 5m + +*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://specterops.io/blog/2026/06/09/user-to-user-authentication-down-the-rabbit-hole-part-1/ +* https://dirkjanm.io/ntlm-relaying-to-ad-certificate-services/#obtaining-the-nt-hash-of-the-impersonated-computer-account +* https://github.com/FalconForceTeam/FalconFriday/blob/c662a6a0dc5d973beb3abb673d4e8cdc193bf469/0xFF-0299-UnPAC_the_hash-Win.md +* https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26 +* https://github.com/dirkjanm/PKINITtools/blob/0f0cfa542b0348609ad494713e84744234b2d3b0/getnthash.py + +*Tags*: + +* Domain: Identity +* Platform: Windows +* OS: Windows +* Use Case: Threat Detection +* Tactic: Credential Access +* Rule Type: Event Correlation (EQL) +* Use Case: Active Directory Monitoring +* Data Source: Active Directory +* Data Source: Windows Security Event Logs +* Resources: Investigation Guide + +*Version*: 1 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + + +*Investigating PKINIT Followed by Same-Principal U2U Service Ticket* + + +The query uses `winlog.event_data.PreAuthType` value `16` for `PA-PK-AS-REQ`, the PKINIT pre-authentication request +type. Both accepted `winlog.event_data.TicketOptions` masks include `FORWARDABLE`, `RENEWABLE`, `CANONICALIZE`, and +`ENC-TKT-IN-SKEY`; `ENC-TKT-IN-SKEY` is the option that identifies a user-to-user service-ticket request. +`0x40810018` also includes `RENEWABLE-OK`, while `0x40810008` does not. +Controlled request profiles produced both masks, so `RENEWABLE-OK` is not required. Neither mask is suspicious by +itself; the signal is the five-second same-domain-controller and source sequence with the 4768 `TargetSid` matching +the 4769 `ServiceSid`. + + +*Possible investigation steps* + + +- Did the 4769 requester match the PKINIT principal? + - Focus: `event.code`, `winlog.event_data.TargetUserName`, `winlog.event_data.TargetDomainName`, `winlog.event_data.TargetSid`, `winlog.event_data.ServiceSid`. + - Hint: Use Investigate in Timeline to review the matched 4768 and 4769 source events. Compare their `winlog.event_data.TargetUserName` values case-insensitively after removing any `@REALM` suffix, and compare `winlog.event_data.TargetDomainName`. Event 4769 exposes the requester name and domain, but not its SID; resolve ambiguous names through the directory before disposition. + - Implication: A resolved requester matching the 4768 principal supports the same-principal interpretation. Confirmed authorized UnPAC-the-Hash or PKINIT/U2U testing is a benign true positive. Keep a raw-name mismatch unresolved; if identity resolution and client or application evidence establish a different requester and unrelated events, close the alert as a false correlation. +- Does the rule-shaped pattern recur for the same domain controller and source address? + - Focus: `winlog.computer_name`, `source.ip`, `@timestamp`, `winlog.event_data.TargetSid`, `winlog.event_data.ServiceSid`. + - Hint: Reconstruct each sequence manually by checking order, the five-second interval, and the stage-local SID values. The following Timeline investigation returns 24 hours of matching PKINIT and U2U candidates for the shared domain controller and source address, not principal-specific history. !{investigate{"label":"Kerberos history for the same DC and source","providers":[[{"excluded":false,"field":"winlog.computer_name","queryType":"phrase","value":"{{winlog.computer_name}}","valueType":"string"},{"excluded":false,"field":"source.ip","queryType":"phrase","value":"{{source.ip}}","valueType":"string"},{"excluded":false,"field":"event.code","queryType":"phrase","value":"4768","valueType":"string"},{"excluded":false,"field":"winlog.event_data.PreAuthType","queryType":"phrase","value":"16","valueType":"string"},{"excluded":false,"field":"winlog.event_data.Status","queryType":"phrase","value":"0x0","valueType":"string"}],[{"excluded":false,"field":"winlog.computer_name","queryType":"phrase","value":"{{winlog.computer_name}}","valueType":"string"},{"excluded":false,"field":"source.ip","queryType":"phrase","value":"{{source.ip}}","valueType":"string"},{"excluded":false,"field":"event.code","queryType":"phrase","value":"4769","valueType":"string"},{"excluded":false,"field":"winlog.event_data.Status","queryType":"phrase","value":"0x0","valueType":"string"},{"excluded":false,"field":"winlog.event_data.TicketOptions","queryType":"phrase","value":"0x40810008","valueType":"string"}],[{"excluded":false,"field":"winlog.computer_name","queryType":"phrase","value":"{{winlog.computer_name}}","valueType":"string"},{"excluded":false,"field":"source.ip","queryType":"phrase","value":"{{source.ip}}","valueType":"string"},{"excluded":false,"field":"event.code","queryType":"phrase","value":"4769","valueType":"string"},{"excluded":false,"field":"winlog.event_data.Status","queryType":"phrase","value":"0x0","valueType":"string"},{"excluded":false,"field":"winlog.event_data.TicketOptions","queryType":"phrase","value":"0x40810018","valueType":"string"}]],"relativeFrom":"now-24h/h","relativeTo":"now"}} + - Implication: Repeated valid pairs or different principals from the same source increase confidence in credential-recovery tooling. Recurrence does not prove client-side PAC decryption or NT hash recovery. +- What related activity corroborates or expands the scope? + - Focus: `winlog.computer_name`, `source.ip`, `winlog.event_data.TargetUserName`, `winlog.event_data.TargetSid`, `winlog.event_data.ServiceSid`. + - Hint: After reviewing the matched source events, search available identity, endpoint, certificate, and alert telemetry for the source address, principal, and domain controller. Look for upstream certificate abuse, client tooling, repeated PKINIT/U2U activity, or follow-on authentication. Missing telemetry is unresolved, not benign. + - Implication: Upstream certificate abuse, relevant client execution, or follow-on credential use supports escalation and broader scoping. Their absence does not clear the matched sequence. + +Escalate unexplained or corroborated sequences with the matched source events and source/principal scope. Close as a benign true positive only for confirmed authorized UnPAC-the-Hash or PKINIT/U2U testing, or as a false positive when identity resolution and client or application evidence prove an unrelated cross-principal correlation. Preserve available evidence and escalate mixed or incomplete cases. + + +*False positive analysis* + + +No known false positives have been identified. Validate the 4769 requester against the matched 4768 principal because event 4769 does not expose the requester SID. + +Avoid exceptions based only on a domain controller or source address. EQL exceptions evaluate each sequence member independently and cannot express the cross-stage SID relationship. + + +*Response and remediation* + + +- Preserve the alert, matched 4768/4769 source events, timestamps, identities, domain controller, and source address before disruptive action. +- If the client endpoint is identified, collect relevant volatile process or memory evidence before isolation or process termination. +- For confirmed malicious activity, contain the identified client and affected account with reversible controls where possible. Revoke a certificate only when evidence binds it to the activity, and rotate affected credentials when recovery or subsequent use is confirmed or the exposure assessment warrants it. +- Document confirmed indicators, matched source-event values, and any logging gaps for the responsible detection or logging owners after scoping and containment. + + +==== Setup + + + +*Setup* + + +Audit Kerberos Authentication Service and Audit Kerberos Service Ticket Operations must be enabled to generate the +events used by this rule. + +Setup instructions: + +- https://ela.st/audit-kerberos-authentication-service[Audit Kerberos Authentication Service] +- https://ela.st/audit-kerberos-service-ticket-operations[Audit Kerberos Service Ticket Operations] + + +==== Rule query + + +[source, js] +---------------------------------- +sequence by winlog.computer_name, source.ip with maxspan=5s + [authentication where host.os.type == "windows" and + event.code == "4768" and winlog.event_data.PreAuthType == "16" and + winlog.event_data.Status == "0x0" + ] by winlog.event_data.TargetSid + [authentication where host.os.type == "windows" and + event.code == "4769" and winlog.event_data.Status == "0x0" and + winlog.event_data.TicketOptions in ("0x40810008", "0x40810018") + ] by winlog.event_data.ServiceSid + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Credential Access +** ID: TA0006 +** Reference URL: https://attack.mitre.org/tactics/TA0006/ +* Technique: +** Name: Steal or Forge Kerberos Tickets +** ID: T1558 +** Reference URL: https://attack.mitre.org/techniques/T1558/ diff --git a/docs/detections/prebuilt-rules/rule-details/potential-certighost-ad-cs-machine-identity-mismatch-cve-2026-54121.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-certighost-ad-cs-machine-identity-mismatch-cve-2026-54121.asciidoc new file mode 100644 index 0000000000..46e1d93f41 --- /dev/null +++ b/docs/detections/prebuilt-rules/rule-details/potential-certighost-ad-cs-machine-identity-mismatch-cve-2026-54121.asciidoc @@ -0,0 +1,217 @@ +[[potential-certighost-ad-cs-machine-identity-mismatch-cve-2026-54121]] +=== Potential CertiGhost AD CS Machine Identity Mismatch (CVE-2026-54121) + +Identifies successful Active Directory Certificate Services (AD CS) certificate issuance events where a machine-account requester differs from the Remote Machine Discovery (RMD) chase target while the event's DNS subject alternative name (SAN) matches that target. This requester-to-target mismatch may indicate CertiGhost (CVE-2026-54121) or similar abuse of AD CS request-context chase processing. + +*Rule type*: esql + +*Rule indices*: None + +*Severity*: high + +*Risk score*: 73 + +*Runs every*: 5m + +*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <>) + +*Maximum alerts per execution*: 100 + +*References*: + +* https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54121 +* https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26 +* https://github.com/aniqfakhrul/CVE-2026-54121 + +*Tags*: + +* Domain: Endpoint +* Domain: Identity +* OS: Windows +* Use Case: Threat Detection +* Tactic: Credential Access +* Tactic: Privilege Escalation +* Use Case: Active Directory Monitoring +* Use Case: Vulnerability +* Data Source: Active Directory +* Data Source: Windows Security Event Logs +* Resources: Investigation Guide + +*Version*: 2 + +*Rule authors*: + +* Elastic + +*Rule license*: Elastic License v2 + + +==== Investigation guide + + + +*Triage and analysis* + + + +*Investigating Potential CertiGhost AD CS Machine Identity Mismatch (CVE-2026-54121)* + + + +*Possible investigation steps* + + +- Does the matched AD CS issuance record validate the identity mismatch? + - Focus: `event.code`, `winlog.event_data.RequestId`, `winlog.event_data.Requester`, `Esql.san_value`, `Esql.rmd_value` + - Hint: Reopen the Windows Security 4887 record on the same CA host and request ID. Compare the parsed SAN and RMD with the complete `winlog.event_data.Attributes` and dedicated SAN field; additional SAN values or disagreement keep the case unresolved. !{investigate{"description":"Finds the Windows Security 4887 certificate issuance record on the same CA host and request ID.","label":"Matched certificate issuance","providers":[[{"excluded":false,"field":"event.code","queryType":"phrase","value":"4887","valueType":"string"},{"excluded":false,"field":"host.id","queryType":"phrase","value":"{{host.id}}","valueType":"string"},{"excluded":false,"field":"winlog.event_data.RequestId","queryType":"phrase","value":"{{winlog.event_data.RequestId}}","valueType":"string"}]],"relativeFrom":"now-24h","relativeTo":"now"}} + - Implication: Event 4887 proves successful issuance, and the alert establishes that the requester differs from the RMD target while the parsed SAN matches that target. This is an operational anti-pattern. Close as benign only when CA records and test records identify an authorized CertiGhost or AD CS security test matching the exact CA, request ID, requester, target, template, and time. +- What identity and authentication capability did the issued certificate receive? + - Focus: `Esql.effective_certificate_template`, `winlog.event_data.Subject`, `winlog.event_data.SubjectAlternativeName`, `winlog.event_data.SubjectKeyIdentifier` + - Hint: Retrieve the issued certificate and CA request/template configuration for the same request ID. Inspect the certificate's actual subject, SAN, EKUs or application policies, validity and revocation state, and the template's subject-name settings and enrollment permissions. + - Implication: Event 4887 and the template name alone do not establish the complete certificate contents or authentication capability. A certificate that represents the RMD target and permits authentication increases the likelihood and impact of credential abuse. Missing certificate or template configuration is unresolved, not benign. +- What other issuances by the requester appear on the same CA host? + - Focus: `host.id`, `winlog.event_data.Requester`, `winlog.event_data.RequestId`, `winlog.event_data.Attributes`, `winlog.event_data.SubjectAlternativeName` + - Hint: Recover 4887 events for the same requester on this CA host. !{investigate{"description":"Finds successful certificate issuance events for the same requester on the same CA host.","label":"Same requester issuances","providers":[[{"excluded":false,"field":"event.code","queryType":"phrase","value":"4887","valueType":"string"},{"excluded":false,"field":"host.id","queryType":"phrase","value":"{{host.id}}","valueType":"string"},{"excluded":false,"field":"winlog.event_data.Requester","queryType":"phrase","value":"{{winlog.event_data.Requester}}","valueType":"string"}]],"relativeFrom":"now-7d","relativeTo":"now"}} + - Implication: Repeated successful requests for different SAN/RMD targets expand the potential abuse scope. One isolated request does not reduce the significance of the current mismatch. +- What other CA events reference the same target identity? + - Focus: `Esql.san_value`, `Esql.rmd_value`, `winlog.event_data.Attributes`, `winlog.event_data.SubjectAlternativeName`, `winlog.event_data.Requester` + - Hint: Copy the alert's exact SAN and RMD values into a scoped Timeline or Discover search for raw 4886, 4887, and 4888 records on the same CA host. Use contains or wildcard matching against `winlog.event_data.Attributes` and `winlog.event_data.SubjectAlternativeName`; derived `Esql.*` fields exist only on the alert. + - Implication: Requests for the same target from additional unexpected accounts expand the affected scope. The absence of other matching events does not clear the current issuance. +- Did the CA connect to the CDC value during certificate processing? + - Focus: `host.id`, `Esql.cdc_value`, `destination.ip`, `destination.port`, `process.name` + - Hint: When the CDC value is an IP address, search network events from the CA host around issuance for that `destination.ip`. For a hostname, resolve it from collected DNS or asset evidence before comparing destination IPs. Review LDAP or LDAPS from `certsrv.exe` and SMB from `System` without requiring either process for all callback traffic. + - Implication: CA-host LDAP or SMB traffic to the CDC value supports request-context chase activity, but neither the CDC attribute nor a connection alone proves exploitation. Missing DNS or CA network telemetry is unresolved, not benign. +- Does surrounding activity show requester creation or target-certificate use? + - Focus: `event.code`, `winlog.event_data.Requester`, `Esql.normalized_rmd_target`, `winlog.event_data.TargetUserName`, `winlog.event_data.PreAuthType` + - Hint: After validating the issuance, inspect account-management events where `winlog.event_data.TargetUserName` matches the requester account name without its domain prefix. Inspect successful 4768 events with `winlog.event_data.PreAuthType` equal to `16`. For DNS-shaped RMD values, compare `winlog.event_data.TargetUserName` with the normalized RMD target plus `$`; for IP-shaped values, first resolve the associated computer account from AD, asset, or CA evidence. Treat later authentication as corroboration unless identity and certificate evidence establish the relationship. + - Implication: Requester creation or change followed by target PKINIT strengthens the exploitation hypothesis. Missing account-management or domain-controller authentication telemetry is unresolved, not benign. + +Escalate when the mismatch is not an authorized test, the issued certificate can authenticate as the target, or callback and follow-on evidence corroborate abuse. Close only when CA, certificate, and test records establish the exact authorized scope; preserve and escalate when evidence or visibility is mixed or incomplete. + + +*False positive analysis* + + +The detected requester-to-target relationship is an operational anti-pattern and did not appear in the self-aligned enrollment controls. Authorized CertiGhost or AD CS security testing is the only currently validated benign explanation. Treat other claimed cross-identity enrollment workflows as unresolved until the 4887 source event, CA request record, issued certificate, template configuration, requester, target, CA, and time scope align without contradictions. + +Do not close on recurrence, absence of related alerts, or the requester account name alone. ES|QL fields created by the query cannot be used in rule exceptions. If an exception is required for recurring authorized testing, combine narrowly scoped source fields such as the CA `host.id`, `winlog.event_data.Requester`, and the exact `winlog.event_data.Attributes` pattern. Avoid exceptions based only on a host, requester, or template. + + +*Response and remediation* + + +- Preserve the 4887 source record, CA request and database records, issued certificate and identifiers, template configuration, and relevant authentication and network evidence before disruptive action. +- Identify affected certification authorities and apply the Microsoft security update or mitigation for CVE-2026-54121. Review request history for the requester and target to identify additional certificates requiring action. +- If malicious activity is confirmed, revoke the affected certificate and verify that revocation information is distributed. Disable or remove an attacker-controlled requester account after preserving evidence. Rotate the target machine credentials and invalidate affected authentication material when certificate use or impersonation is established. +- Isolate an endpoint only when host evidence attributes compromise to that system. The requester account may not map to a managed endpoint, and the target identity alone does not prove that the target endpoint was compromised. +- Record confirmed certificate identifiers, affected principals, CA configuration gaps, and telemetry gaps for the responsible response, PKI, identity, and detection owners. + + +==== Setup + + + +*Setup* + + +Audit Certification Services must be enabled on enterprise certification authorities so that successful certificate +issuance generates Security event 4887. + +The Windows Security integration must retain `winlog.event_data.Attributes`, including the requested SAN and chase +attributes. The rule prefers dedicated certificate-template and subject-alternative-name fields when present and uses +`Attributes` as a fallback. Dropped, truncated, or rewritten attributes create a visibility gap and do not indicate +benign activity. + +Setup instructions: https://ela.st/audit-certification-services + + +==== Rule query + + +[source, js] +---------------------------------- +FROM logs-system.security-* METADATA _id, _index, _version +| WHERE event.code == "4887" AND + winlog.event_data.Requester LIKE "*$" AND + winlog.event_data.Attributes IS NOT NULL + +// Parse Attributes for RMD and CDC, and as a fallback when dedicated template or SAN fields are absent. +// CDC and the effective template are retained for triage purposes +| GROK winlog.event_data.Attributes + """(?im)^[ \t]*CertificateTemplate[ \t]*:[ \t]*(?[^\r\n]+)\r?$""" +| GROK winlog.event_data.Attributes + """(?im)^[ \t]*SAN[ \t]*:[ \t]*dns[ \t]*=[ \t]*(?[^\r\n]+)\r?$""" +| GROK winlog.event_data.SubjectAlternativeName + """(?im)^[ \t]*DNS[ \t]+Name[ \t]*=[ \t]*(?[^\r\n]+)\r?$""" +| GROK winlog.event_data.Attributes + """(?im)^[ \t]*cdc[ \t]*:[ \t]*(?[^\r\n]+)\r?$""" +| GROK winlog.event_data.Attributes + """(?im)^[ \t]*rmd[ \t]*:[ \t]*(?[^\r\n]+)\r?$""" +| EVAL Esql.effective_certificate_template = TRIM(COALESCE( + winlog.event_data.CertificateTemplate, + Esql.attributes_certificate_template + )), + Esql.san_value = TRIM(COALESCE(Esql.event_san_value, Esql.attributes_san_value)), + Esql.cdc_value = TRIM(Esql.cdc_value), + Esql.rmd_value = TRIM(Esql.rmd_value), + Esql.normalized_requester = TO_LOWER( + REPLACE(winlog.event_data.Requester, """^.*\\|\$$""", "") + ), + Esql.normalized_san_value = TO_LOWER( + REPLACE(Esql.san_value, """\.$""", "") + ), + Esql.normalized_rmd_value = TO_LOWER( + REPLACE(Esql.rmd_value, """\.$""", "") + ) +// Preserve IP-shaped values; shorten other SAN and RMD values to the first DNS label for machine-account comparison. +| EVAL Esql.san_is_ip_shaped = + Esql.normalized_san_value RLIKE """[0-9]{1,3}(\.[0-9]{1,3}){3}""" OR Esql.normalized_san_value LIKE "*:*", + Esql.rmd_is_ip_shaped = + Esql.normalized_rmd_value RLIKE """[0-9]{1,3}(\.[0-9]{1,3}){3}""" OR Esql.normalized_rmd_value LIKE "*:*" +| EVAL Esql.normalized_san_target = CASE( + Esql.san_is_ip_shaped, + Esql.normalized_san_value, + REPLACE(Esql.normalized_san_value, """\..*$""", "") + ), + Esql.normalized_rmd_target = CASE( + Esql.rmd_is_ip_shaped, + Esql.normalized_rmd_value, + REPLACE(Esql.normalized_rmd_value, """\..*$""", "") + ) +| WHERE Esql.normalized_requester IS NOT NULL AND + Esql.normalized_san_target IS NOT NULL AND + Esql.normalized_rmd_target IS NOT NULL +| WHERE Esql.normalized_requester != Esql.normalized_rmd_target AND + Esql.normalized_san_target == Esql.normalized_rmd_target +| KEEP @timestamp, _id, _index, _version, event.code, event.action, event.category, event.type, event.outcome, + event.created, event.ingested, data_stream.dataset, data_stream.namespace, host.id, host.name, + winlog.computer_name, winlog.record_id, winlog.event_data.RequestId, winlog.event_data.Requester, + winlog.event_data.CertificateTemplate, winlog.event_data.Subject, winlog.event_data.SubjectAlternativeName, + winlog.event_data.Attributes, winlog.event_data.Disposition, winlog.event_data.SubjectKeyIdentifier, + Esql.effective_certificate_template, Esql.san_value, Esql.cdc_value, Esql.rmd_value, + Esql.normalized_requester, Esql.normalized_san_target, Esql.normalized_rmd_target + +---------------------------------- + +*Framework*: MITRE ATT&CK^TM^ + +* Tactic: +** Name: Credential Access +** ID: TA0006 +** Reference URL: https://attack.mitre.org/tactics/TA0006/ +* Technique: +** Name: Steal or Forge Authentication Certificates +** ID: T1649 +** Reference URL: https://attack.mitre.org/techniques/T1649/ +* Technique: +** Name: Exploitation for Credential Access +** ID: T1212 +** Reference URL: https://attack.mitre.org/techniques/T1212/ +* Tactic: +** Name: Privilege Escalation +** ID: TA0004 +** Reference URL: https://attack.mitre.org/tactics/TA0004/ +* Technique: +** Name: Exploitation for Privilege Escalation +** ID: T1068 +** Reference URL: https://attack.mitre.org/techniques/T1068/ diff --git a/docs/index.asciidoc b/docs/index.asciidoc index 5cef9bee4e..d5f3bbbbf6 100644 --- a/docs/index.asciidoc +++ b/docs/index.asciidoc @@ -143,3 +143,5 @@ include::detections/prebuilt-rules/downloadable-packages/8-19-28/prebuilt-rules- include::detections/prebuilt-rules/downloadable-packages/8-19-29/prebuilt-rules-8-19-29-appendix.asciidoc[] include::detections/prebuilt-rules/downloadable-packages/8-19-30/prebuilt-rules-8-19-30-appendix.asciidoc[] + +include::detections/prebuilt-rules/downloadable-packages/8-19-31/prebuilt-rules-8-19-31-appendix.asciidoc[]