Browse Rules

Egress Network Connections with Total Bytes Greater than Threshold

Using aggregation and the ES|QL `SUM` function, this hunt identifies processes that performed egress connections with total bytes greater or equal to a defined maximum threshold. This may indicate exfiltration or long term command and control activity.

Unique Windows Services Creation by Service File Name

This hunt aggregates created Windows services by service file name and distribution limited to unique hosts. Using the ES|QL `Replace` command we can also further remove random patterns to reduce results to interesting events. More investigation can be conducted on instance that looks suspicious based on service file path, names and LOLBins.

Low Occurrence of Suspicious Launch Agent or Launch Daemon

This hunt looks for persistence via Launch agent or daemon where the distribution is limited to one unique host.

AWS Bedrock LLM Sensitive Content Refusals

This analytic flags multiple instances of LLM refusals to respond to sensitive prompts, helping to maintain ethical guidelines and compliance standards.

Suspicious Base64 Encoded Powershell Command

This hunt identifies base64 encoded powershell commands in process start events and filters ones with suspicious keywords like downloaders and evasion related commands.

AWS Bedrock LLM Latency Anomalies

This analytic helps identify delays in LLM responses that are outside expected performance parameters, possibly due to malicious disruptions like DDoS attacks or from operational inefficiencies.

Low Occurrence Rate of CreateRemoteThread by Source Process

This hunt attempts to identify remote process injection by aggregating Sysmon `CreateRemoteThread` events by source process and returns the ones that we observed in only one unique host.

Executable File Creation by an Unusual Microsoft Binary

This hunt identifies executable file creation by an unusual Microsoft native binary. This could be the result of code injection or some other form of exploitation for defense evasion.

SSM SendCommand API Used by EC2 Instance

An attacker with compromised EC2 instance credentials, may use those credentials to attempt remote code execution against the EC2 instance from which the credentials were compromised via SSM SendCommand API.

Rundll32 Execution Aggregated by Command Line

This hunt aggregate Rundll32 execution by normalized `process.command_line` and returns instances that are unique by frequency. Rundll32 is one of the most abused binaries to proxy execution of malicious commands and modules.

SNS Topic Created by Rare User

This hunting query gathers evidence of an SNS topic created by a user who does not typically perform this action. Adversaries may create SNS topics to stage capabilities for data exfiltration or other malicious activities.

Suspicious DNS TXT Record Lookups by Process

Leveraging aggregation by process executable entities, this hunt identifies identifies a high number of DNS TXT record queries from same process. Adversaries may leverage DNS TXT queries to stage malicious content or exfiltrate data.

Windows Logon Activity by Source IP

This hunt returns a summary of network logon activity by `source.ip` using Windows event IDs 4624 and 4625. The higher the number of failures, low success and multiple accounts the more suspicious the behavior is.

Suspicious Network Connections by Unsigned Mach-O

This hunt aggregates by process ID and destination IP by the number of connections per hour over a period of time greater than a defined threshold. This may indicate suspicious network connections by unsigned Mach-O binaries.

AWS Bedrock LLM Denial-of-Service or Resource Exhaustion

This hunting query identifies unusual spikes in token usage that may indicate malicious attempts to disrupt services. High token usage can strain system resources and degrade performance, aligning with tactics observed in DoS attacks.

Password Spraying from Repeat Source

This hunting query identifies password spraying attacks in Okta where the same source IP attempts to authenticate to multiple accounts with invalid credentials. Adversaries may attempt to use a single source IP to avoid detection and bypass account lockout policies.

Unusual File Downloads from Source Addresses

This hunt identifies unusual file download activities on Linux systems. It detects instances where commonly used download utilities such as curl and wget are executed with command lines that contain IP addresses, which can indicate potentially suspicious file downloads.

Persistence via Cron

This hunt identifies potential persistence mechanisms via cron on Linux systems. It monitors for file creation or modification events related to cron configurations and processes spawned by cron, fcron, or atd. These activities can indicate attempts to establish persistence through scheduled tasks.

Persistence via Systemd (Timers)

This hunt identifies potential persistence mechanisms via systemd (timers) on Linux systems. It monitors for file creation or modification events related to systemd service and timer configurations, as well as generators, which can indicate attempts to establish persistence through scheduled tasks.

SNS Direct-to-Phone Messaging Spike

This hunting query gathers evidence of potential abuse of the SNS service to send direct-to-phone text messages. Adversaries may use this technique to send smishing messages or deliver other types of malicious content directly to users' phones.

SNS Topic Message Published by Rare User

This hunting query gathers evidence of an SNS topic message published by a user who does not typically perform this action. Adversaries may publish messages to SNS topics to stage capabilities for data exfiltration or other malicious activities.

AWS Bedrock LLM Ignore Previous Prompt Detection

This analytic flags multiple instances where large language models (LLMs) are vulnerable to malicious user interactions designed to bypass previous prompts. This can lead to the generation of inappropriate or harmful content, resulting in direct LLM prompt injection.

Execution via Remote Services by Client Address

This hunt aggregates process execution via remote network logon by source address, account name and where the parent process is related to remote services such as WMI, WinRM, DCOM and remote PowerShell. This may indicate lateral movement via remote services.

Low Frequency of Process Execution via Windows Scheduled Task by Unique Agent

Aggregating by paths/hash, this hunt identifies rare instances where a program executes as a child process of the Tasks Scheduler service. This could be the result of persistence as a Windows Scheduled Task.

Scheduled Tasks Creation for Unique Hosts by Task Command

Using aggregation and strings extraction, this hunt identifies instances where a scheduled task is created and set to run a command unique to a specific host. This could be the result of persistence as a Windows Scheduled Task.