Detection Engineering Rule Hub

title: Identity Provider Admin MFA Reset Followed By Session Creation
status: production
description: Detects help desk initiated reset of administrator MFA tokens in Okta/Entra ID.
logsource:
    service: okta
detection:
    selection_reset:
        eventType:
            - 'user.mfa.factor.reset'
            - 'user.mfa.factor.deactivate'
    selection_target:
        target.alternateId|endswith: '@domain.com'
    condition: selection_reset and selection_target
level: high

index=okta eventType IN ("user.mfa.factor.reset", "user.mfa.factor.deactivate")
| eval target_user = 'target{}.alternateId'
| stats count earliest(_time) as first_seen latest(_time) as last_seen by actor.alternateId, target_user, client.ipAddress
| where count > 1

SigninLogs
| where ResultType == 0
| where AuthenticationRequirement == "multiFactorAuthentication"
| summarize make_set(IPAddress), make_set(UserAgent) by UserPrincipalName, bin(TimeGenerated, 1h)
| where array_length(set_IPAddress) > 1

sequence by target.user.name with maxspan=15m
  [authentication where event.action == "user.mfa.factor.reset"]
  [authentication where event.action == "user.session.start" and user.roles == "SuperAdmin"]

eventType = /user\.mfa\.factor\.(reset|deactivate)/
| groupBy([actor.alternateId, "target{}.alternateId"], function=[count(), collect(client.ipAddress)])

title: ESXi Hypervisor Mass Virtual Machine Process Kill and Encryption
status: production
description: Detects command line kill of ESXi vmx processes and bulk file encryption.
logsource:
    category: process_creation
    product: linux
detection:
    selection_kill:
        CommandLine|contains:
            - 'esxcli vm process kill'
            - 'killall -9 vmx'
            - '/vmfs/volumes'
    condition: selection_kill
level: critical

index=syslog sourcetype="vmware:esx" (("esxcli" AND "vm" AND "process" AND "kill") OR ("killall" AND "vmx") OR (".vmdk" AND "encrypt"))
| stats count by host, process_name, command_line

Syslog
| where ProcessName in ("sh", "bash", "python")
| where SyslogMessage has_any ("esxcli vm process kill", "/vmfs/volumes", ".vmdk")
| project TimeGenerated, HostName, ProcessName, SyslogMessage

process where event.type == "start" and process.name in ("sh", "bash") and
process.command_line : ("*esxcli vm process kill*", "*killall -9 vmx*", "*vmdk*")

ProcessName in ["sh", "bash", "python"]
| CommandLine = /esxcli\s+vm\s+process\s+kill|\/vmfs\/volumes/i
| groupBy([Host, CommandLine])

title: Citrix NetScaler ADC Bleed Memory Leak Exploitation (CVE-2023-4966)
status: production
description: Identifies attempts to exploit CVE-2023-4966 on Citrix ADC gateways.
logsource:
    category: webserver
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem|startswith: '/oauth/idp/.well-known/openid-configuration'
    condition: selection
level: critical

index=web sourcetype="citrix:netscaler" uri_path="/oauth/idp/.well-known/openid-configuration"
| where bytes_out > 20000
| stats count, values(src_ip), values(http_user_agent) by dest_ip

W3CIISLog
| where csUriStem startswith "/oauth/idp/.well-known/openid-configuration"
| where scBytes > 25000
| project TimeGenerated, cIP, csUriStem, scBytes, csUserAgent

http where http.request.method == "GET" and
http.request.uri : "/oauth/idp/.well-known/openid-configuration*" and
http.response.body.bytes > 20000

csUriStem = /\/oauth\/idp\/\.well-known\/openid-configuration/
| scBytes > 20000
| groupBy([cIP, csUserAgent])

title: Common Cloud Storage Tool Exfiltration Execution
status: production
description: Detects command lines invoking Rclone, Megasync, or AWS CLI with copy parameters.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\rclone.exe'
            - '\megasync.exe'
        CommandLine|contains:
            - 'copy'
            - 'sync'
            - '--config'
    condition: selection
level: high

index=endpoint (process_name="rclone.exe" OR process_name="mega-cmd.exe" OR process_name="megasync.exe")
| stats count values(command_line) by host, user, parent_process_name

DeviceProcessEvents
| where FileName in~ ("rclone.exe", "megasync.exe", "mega-cmd.exe")
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessCommandLine

process where event.type == "start" and
process.name : ("rclone.exe", "megasync.exe", "mega-cmd.exe") and
process.args : ("copy", "sync", "--config")

FileName in ["rclone.exe", "megasync.exe", "mega-cmd.exe"]
| CommandLine = /copy|sync|--config/
| groupBy([DeviceName, AccountName, ProcessCommandLine])

title: Shadow Copies Deletion Using Operating System Utilities
status: production
description: Detects execution of vssadmin or wmic commands used to delete volume shadow copies.
logsource:
    category: process_creation
    product: windows
detection:
    selection_vss:
        CommandLine|contains|all:
            - 'vssadmin'
            - 'delete'
            - 'shadows'
    selection_wmic:
        CommandLine|contains|all:
            - 'shadowcopy'
            - 'delete'
    condition: selection_vss or selection_wmic
level: critical

index=endpoint EventCode=1 (CommandLine="*vssadmin*delete*shadows*" OR CommandLine="*wmic*shadowcopy*delete*" OR CommandLine="*bcdedit*recoveryenabled No*")
| stats count by host, user, CommandLine

DeviceProcessEvents
| where ProcessCommandLine has_all ("vssadmin", "delete", "shadows") or
        ProcessCommandLine has_all ("shadowcopy", "delete") or
        ProcessCommandLine has_all ("bcdedit", "recoveryenabled", "no")
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine

process where event.type == "start" and
(process.command_line : "*vssadmin*delete*shadows*" or
 process.command_line : "*shadowcopy*delete*" or
 process.command_line : "*bcdedit*recoveryenabled*no*")

CommandLine = /vssadmin.*delete.*shadows|shadowcopy.*delete|bcdedit.*recoveryenabled.*no/i
| groupBy([DeviceName, AccountName, CommandLine])