Detection Rules — The Cyber Toolchain

Detection Rules dev-v3.0.0

Fri, 25 Sep 2026 21:06:52 GMT

dev-v3.0.0 ships offline ES|QL validation, XDR/SIEM taxonomy tags, ES|QL sub-query support, and a wave of new detection rules.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Replaces remote ES|QL validation with offline validation via `detection-rules-esql-py` 0.1.0, checking rules at load time against `min_stack_version` and local schemas; `DR_BYPASS_ESQL_KEEP_VALIDATION` and `DR_BYPASS_ESQL_METADATA_VALIDATION` still skip only the `KEEP` and `FROM` metadata checks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Removes the `--esql-remote-validation` flag; queries no longer need to be posted to an Elasticsearch cluster for validation. • Adds XDR/SIEM taxonomy tags (phase 1) to rules. • Adds rule profiling tags: `Recommended`, `Noise`, `Performance`, `Threat`. • Supports ES|QL sub queries in rule validation. • Adds new detection rule: Potential ClickFix Command via Windows Run Dialog. • Adds new detection rule: Linux Firewall Rule Creation or Modification. • Adds new detection rule: Potential Fileless Execution via Unusual memfd Create Call. • Adds new detection rule: Potential Fileless Execution via O_TMPFILE. • Adds new detection rules: Three Linux File-Related Web Server Rules. • Adds new detection rule: Azure AKS Pod Exec Potential Reverse Shell. • Adds new detection rule: Newly Seen Commonly Abused Network Scanner. • Adds new detection rules: RMM Installation via Internet-Originated MSI. • Adds new detection rule: First Seen Network Flow Exporter. • Adds new detection rule: Azure WireServer Abuse Related Detections. • Adds new detection rule: Potential Data Exfiltration via AzCopy or Azure Storage Explorer. • Adds new detection rule: Entra ID Windows Hello for Business Key-Borrowing Detections. • Adds new detection rule: Entra ID device-bound PRT cookie replay from unusual IP. • Adds new detection rule: AWS SES Account Email Sending Enabled. • Adds new hunting query: Java_Ghost Threat Actor Infrastructure and Identity Markers. • Adds SSH brute force detection rules for the macOS Security Events integration. • Adds Anthropic compliance audit detection rules. Breaking changes: • The `--esql-remote-validation` flag is removed; any workflow or script that passed it will now fail. ES|QL rules are validated offline at load time against local schemas and `min_stack_version`, and queries that previously loaded only because remote validation was skipped can now fail local syntax, schema, or type checks. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/detection-rules

Detection Rules dev-v2.2.0

Tue, 08 Sep 2026 12:52:29 GMT

dev-v2.2.0 adds 30+ new detection rules spanning AWS, GCP, Linux, macOS, Windows, Kubernetes, and network threats. • Adds free text support to KQL for detection rule queries. • Adds new rule: AWS Root Console Login Password Spraying. • Adds new rule: AWS S3 Bucket MFA Delete Disabled. • Adds new rule: AWS Organizations Delegated Administrator Registered. • Adds new rule: AWS Service Quota Increase Requested by Rare Identity. • Adds new rule: AWS Backup Resource Enumeration via Long-Term Access Key. • Adds new rule: AWS SES Enumeration via Long-Term Access Key. • Adds new rule: AWS SES Identity Verified Then Deleted. • Adds new rule: AWS SES Full Access Policy Attached to IAM Entity by Unusual User. • Adds new rule: AWS Bedrock AgentCore Resource Created with IAM Execution Role. • Adds new rule: AWS GetFederationToken Followed by Console Login via Federation Exchange. • Adds new rule: AWS GuardDuty Threat Intelligence Set Deleted. • Adds new rule: AWS GuardDuty Publishing Destination Deleted. • Adds new rule: AWS EKS Access Entry Created Then Deleted by Same Identity. • Adds new rule: AWS Detective Graph Deleted. • Adds new rule: GCP IAM Service Account Impersonation Role Granted. • Adds new rule: Potential Entra ID PRT Extraction via BrowserCore. • Adds new rule: Potential DNS Tunneling via Long and Unique Subdomains. • Adds new rule: Potential DNS Rebinding from Public to Private Address. • Adds new rule: Self-Signed TLS Certificate Recently Issued on External Connection. • Adds new rule: First Seen SonicWall Remote Access Login by User and Source. • Adds new rule: Suspicious Process Execution by Zoom on macOS or Linux. • Adds new rule: File Downloaded by Curl/Wget and Piped to Interpreter. • Adds new rule: Process Execution Followed by Self-Deletion. • Adds new rule: Kernel Module Loaded with Tainting Flags. • Adds new rule: PKINIT Followed by Same-Principal U2U Service Ticket. • Adds new rule: Potential CertiGhost AD CS Machine Identity Mismatch. • Adds new rule: Procfs Syscall Read and binfmt Configuration File Creation. • Adds new rule: Claude Cowork VM Boot Image Tamper. • Adds new rule: Potential Evasion via Boot Time Removal Tool. • Adds new hunting query: AKS Kubelet nodes/proxy Command Execution from an External Source IP. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/detection-rules

Detection Rules dev-v2.1.0

Mon, 10 Aug 2026 14:21:08 GMT

dev-v2.1.0 adds 40+ new detection rules across AWS, Azure AKS, GCP GKE, NFS, SIP, AMQP, and database protocols, plus nested KQL query support. • Adds nested KQL query support in `lib/kql` for more expressive rule authoring. • New rule: `Newly Observed RC4 Kerberos Service Ticket Request` — detects unusual RC4 Kerberos ticket requests in the environment. • New rule: `Repeated Stalled TLS Handshakes via ALPN acme-tls/1 Extension` — surfaces potential abuse of the ACME TLS-ALPN challenge protocol. • New rule: `First Time Seen RMM Signer Across the Environment` — identifies first-observed remote monitoring and management tool signers. • New rule: `Azure AKS Service Account Token Created via TokenRequest API` — detects token creation abuse in AKS. • New rule: `Potential NFS Destructive Operation Burst` — flags mass destructive NFS operations. • New rule: `Azure AKS Certificate Signing Request Created or Approved` — monitors CSR activity in AKS clusters. • New rule: `Potential EDR-Freeze via WerFaultSecure Abuse` — detects attempts to freeze EDR processes using WerFaultSecure. • New rule: `Suspicious UID Change to Root via Python` — catches privilege escalation to root through Python. • New rule: `Direct Process Execution via setsid, nohup, or disown` — detects process detachment techniques used to evade monitoring. • New rule: `Azure AKS CoreDNS or Kube-DNS Configuration Modified` — alerts on DNS config tampering in AKS. • New rule: `Azure AKS Secret get or list with Suspicious User Agent` — detects credential harvesting attempts via unusual user agents in AKS. • New rule: `NFS AUTH_SYS Root UID Access` — identifies NFS access using root UID via the AUTH_SYS authentication flavor. • New rule: `Mark-of-the-Web Removal by an Unusual Process` — detects MOTW bypass attempts by unexpected processes. • New rules: `GCP GKE Rule Conversions Part 3, 4, 5, 6` and `GCP GKE CSR Abuse Rules` — expands GKE detection coverage across multiple rule sets. • New rule: `First Time Seen Memcached Writer` — identifies first-observed write activity to Memcached instances. • New rule: `Destructive MongoDB Command` — detects potentially destructive operations against MongoDB. • New rule: `MySQL User-Defined Function Injection` — flags UDF injection attacks against MySQL. • New rule: `Postgresql COPY PROGRAM Command Execution` — detects OS command execution via PostgreSQL COPY PROGRAM. • New rule: `Cassandra JavaScript UDF Creation` — surfaces creation of JavaScript user-defined functions in Cassandra. • New rule: `Thrift RPC Method from an External Client` — detects external Thrift RPC calls that may indicate lateral movement or data access. • New rule: `Potential SIP REGISTER Brute Force` — identifies brute-force attempts against SIP REGISTER endpoints. • New rule: `Potential SIP Extension Enumeration` — detects SIP extension scanning activity. • New rule: `Successful AMQP Multi-Queue Purge Burst` — flags bulk queue purge operations over AMQP. • New rule: `Multiple SonicWall Login Failures Followed by Successful Login` — detects credential stuffing or brute-force success against SonicWall devices. • New rule: `AWS Bedrock High Risk Filesystem or Execution Tool Invocation` — detects dangerous tool use within AWS Bedrock agent sessions. • New rule: `AWS Batch Job Submitted with Container Override by Unusual Identity` — flags container override abuse in AWS Batch. • New rule: `AWS IAM Permission Boundary or Guardrail Policy Deleted by Unusual Identity` — detects privilege escalation via guardrail removal in AWS IAM. • New rule: `AWS IAM User Created Own Access Key` — identifies self-issued access key creation as a persistence technique. • New rule: `AWS SageMaker Execution Role Passed by Unusual Principal` — detects suspicious role-passing in SageMaker. • New rule: `AWS S3 Bucket ACL Modified to Allow Public Access by New Identity` — alerts on public exposure of S3 buckets by previously unseen identities. • New rule: `AWS EC2 NACL Entry Created or Replaced Allowing All Traffic by New Identity` — detects network ACL misconfigurations introduced by new identities. • New rule: `Unusual File Creation via Web Server` — surfaces unexpected file writes originating from web server processes. • New rule: `Azure AKS Kubernetes Events Deleted` — detects log-tampering via event deletion in AKS. • New rule: `Azure AKS Potential API Enumeration by User` — identifies reconnaissance activity against the AKS API server. • New rule: `Potential Tunneling via Tailscaled` — detects potential covert tunneling using the Tailscale daemon. • New rule: `Azure AKS Suspicious Self-Subject Review via Service Account` — flags self-subject access review abuse in AKS. • New rule: `Azure AKS Ephemeral Container Added to Pod` — detects ephemeral container injection into running pods. • New rule: `Azure AKS User Exec into Pod` — alerts on interactive exec sessions into AKS pods. • New rule: `PHP File Creation in WordPress Plugin Directory` — detects webshell placement or supply-chain abuse via plugin directory writes. • Adds XDR rule tag taxonomy to Copilot PR review workflow, improving automated rule classification. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/detection-rules

Detection Rules dev-v2.0.0

Mon, 20 Jul 2026 15:23:17 GMT

Elastic Detection Rules dev-v2.0.0 adds MITRE ATT&CK v19 support and 80+ new rules across AWS, Azure, Linux, GCP, and network protocols. • Adds MITRE ATT&CK v19 threat mapping support, automatically applied on Elastic Stack >= 9.5 with dynamic tag assignment. • New AWS rules: CloudTrail management event disabling, GuardDuty suppression detection, IAM console login without MFA, IAM user login from multiple geolocations, account closure, org-leave attempts, Cognito unauthenticated identity pool credential issuance, Bedrock AgentCore execution role misuse, Bedrock prompt/completion credential detection, ECR public access grants, SageMaker suspicious lifecycle config, Lambda cross-account invocation, Lambda high-frequency invocation, Lambda event source mapping creation, Lambda layer external sharing, Lambda function URL public access, Lambda deletion, Lambda policy cross-account update, Backup vault deletion/lock removal, Backup recovery point deletion, KMS imported key material deletion, IAM inline policy added to group, IAM permissions boundary modification, IAM login profile creation/modification, and IAM account password policy deletion. • New Azure/Entra ID rules: AKS API server proxying requests to Kubelet, ROPC authentication with unknown client ID, VM extension installation and suspicious child process via CustomScript, VM configuration modification, VM Managed Run Command with unusual principal, VM Extension CRUD from unusual ASN, VM Boot Diagnostics retrieval, Serial Console connect with unusual user/ASN, Azure AD Graph access with unusual user/ASN, unusual client/user, suspicious user-agent, and 4xx error surge, Azure AD Graph potential enumeration via ROADrecon, Entra ID AiTM phishing-kit chain, device registration with phishing-kit default OS build, conditional access MFA bypass via Microsoft Graph, multiple device registrations by single user, impossible travel sign-in, ROPC auth/legacy client detection, OAuth device code sign-in to Azure AD Graph enumeration, OAuth device code phishing, TAP creation, guest-to-member promotion, and OAuth redirect URI abuse. • New GCP/GKE rules: GKE Kubernetes rule conversions (parts 1 and 2) adding coverage for GKE API and workload activity. • New Linux rules: kernel core_pattern container escape, systemd service override config file creation, Redis CONFIG SET SSH authorized key injection, potential Redis Lua activity, AMSI bypass via RPC NdrClientCall hook (PowerShell 4104), Linux LPE rule migrations from Endpoint Rules to Detection Rules (parts 1 and 2). • New network protocol detection rules: ICMP tunneling to the internet, ICMP timestamp/information request from the internet, ICMP redirect from internal host, deprecated TLS version or weak cipher negotiated externally, DHCP starvation via high client MAC cardinality, multiple DHCP servers responding to the same transaction, potential SSH reverse port forwarding, DNS tunneling via nslookup, SMB activity from the internet, and protected storage service access via SMB. • New web/application rules: PHP file creation in WordPress plugin directory, potential SQL injection against Microsoft SQL Server, web server cloud metadata SSRF request, and Java dropped-and-executed with DNS lookup. • New Windows/endpoint rules: GenAI CLI started with unsafe permission bypass, Quick Assist full control sharing mode enabled, MS Teams rogue help desk detection, and Splunk Enterprise PostgreSQL Sidecar pre-auth RCE detection. • New Google Workspace rules: impossible travel login detection. • New M365 rules: unusual device code granting detection and Microsoft Defender XDR promotion rules. • Related integrations version constraints updated from `^` (caret/compatible) to `>=` (greater-or-equal) in emitted rule output. Breaking changes: • Emitted related integrations now use `>=` instead of `^` for version constraints, which is expected to not function on Elastic stacks older than 9.5 — ensure your stack schema map and/or packages.yml match your stack version before upgrading. • MITRE ATT&CK v19 mappings are automatically applied on stack >= 9.5; to use v19 on stacks <= 9.4 you must explicitly set `DR_THREAT_MAPPING_FRAMEWORK="MITRE ATT&CK"` and `DR_THREAT_MAPPING_VERSION=1`, or add `threat_mapping_framework: "MITRE ATT&CK"` and `threat_mapping_version: "19"` to your _config.yaml. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/detection-rules

Detection Rules dev-v1.6.0

Tue, 10 Mar 2026 17:43:32 GMT

New detection rules for Entra ID federation abuse, SharePoint policy weakening, M365 search access, and kernel discovery via bpftool. • `Entra ID Domain Federation Abuse` rule added • `M365 SharePoint Site Sharing Policy Weakened` rule added • `Microsoft 365 SharePoint/OneDrive Sensitive Search and File Access` rule added • `Kernel Discovery & BPF Load/Tampering via bpftool` rules added • ESQL LLM-Based Alert Triage Rules introduced • Execution via OpenClaw Agent detection rule added • Potential Persistence via Mandatory User Profile detection added • AWS GuardDuty Member Account Manipulation detection added • AWS SSM Inventory Reconnaissance by Rare User detection added • AWS Sensitive IAM Operations Performed via CloudShell detection added • AWS IAM new identity federation provider rules added • AWS EC2 Serial Console Access Enabled detection added • Okta AiTM Session Cookie Replay Detection rule added • Okta Admin Console Login Failure rule added • ConsentFix Detections added Full history on Cyber Toolchain: https://cybertoolchain.io/tools/detection-rules

Detection Rules dev-v1.5.0

Tue, 10 Mar 2026 17:24:46 GMT

dev-v1.5.0 adds ESQL query validation, SIEM package category, and numerous new detection rules for cloud and Windows threats. • `feat: ESQL query validation against Elastic cluster` allows validating ESL queries against a running cluster before deployment • Adds `SIEM` to the package category mapping for better organization of SIEM-related rules • New detection rule: Credential Access via TruffleHog Execution • New detection rule: GitHub Authentication Token Access via Node.js • New detection rule: Azure Storage Account Keys Accessed by Privileged User • New detection rule: Node.js Pre or Post-Install Script Execution • New detection rule: Potential Command Shell via NetCat • New detection rule: Entra ID Actor Token User Impersonation Abuse • New detection rule: Azure Storage Account Blob Public Access Enabled • New detection rule: Azure RBAC Built-In Administrator Roles Assigned • New detection rule: Attempt to Clear Logs via Journalctl • New detection rule: Potential Ransomware Behavior - High count of Readme files by System • New detection rule: Suspicious SeIncreaseBasePriorityPrivilege Use • New detection rule: Microsoft Entra ID Protection Alert and Device Registration • New detection rule: Curl or Wget Spawned via Node.js Full history on Cyber Toolchain: https://cybertoolchain.io/tools/detection-rules

Detection Rules dev-v1.4.0

Wed, 10 Sep 2025 18:23:26 GMT

dev-v1.4.0 adds multi-dataset sequence validation support and negate DOES NOT MATCH to IM rules. • Support for multi-dataset sequence validation in schema validation logic. • Adds `negate DOES NOT MATCH` capability to the IM rule type (requires version >=9.2). • Adds support for up to 5 group_by fields in threshold rules (requires version >=9.2). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/detection-rules

Detection Rules dev-v1.3.0

Tue, 01 Jul 2025 13:41:23 GMT

Adds Kibana rule export filtering, `check-version-lock` dev CLI subcommand, and over 60 new detection rules. • `Add Ability to Filter Rule Exports from Kibana` • Add `check-version-lock` dev command • Lock release versions for 8.14 through 9.0 Full history on Cyber Toolchain: https://cybertoolchain.io/tools/detection-rules

Detection Rules dev-v1.2.0

Fri, 02 May 2025 15:32:30 GMT

New detection rules for M365 OAuth abuse, AWS S3 and IAM activity, and MSFT Tenant phishing. • `Microsoft 365 OAuth Redirect to Device Registration` rule added • `Microsoft Entra ID Protection Anonymized IP Risk Detection` rule added • `MSFT Tenant OAuth Phishing via First-Party VSCode Client` rule added • `AWS S3 Static Site JavaScript File Uploaded` rule added • `AWS IAM or STS API Calls via Temporary Session Tokens` rule added Full history on Cyber Toolchain: https://cybertoolchain.io/tools/detection-rules

Detection Rules dev-v1.1.0

Thu, 24 Apr 2025 09:04:11 GMT

Adds CLI flags for KQL-based rule export and local date support to the Detection Rules tool. • Adds `--kql-export` flag to export rules via a KQL search on name • Adds `--local-dates` flag to enable support for local dates in output Full history on Cyber Toolchain: https://cybertoolchain.io/tools/detection-rules

Detection Rules dev-v1.0.0

Mon, 24 Mar 2025 11:32:06 GMT

Adds DR_CLI_MAX_WIDTH env var, Min Stack ML rules, and investigation guide generation to the detection-rules cli. • Adds the `DR_CLI_MAX_WIDTH` environment variable to control CLI output width • Adds new machine learning detection rules for Privileged Access Detection with Min Stack integration • Deprecates Cloud Defend rules Full history on Cyber Toolchain: https://cybertoolchain.io/tools/detection-rules

Detection Rules dev-v0.4.0

Tue, 04 Feb 2025 14:44:09 GMT

dev-v0.4.0 adds ~30 new detection rules across AWS, Azure, and Linux kernel/process auditing. • `New Rule` Adding Coverage for Self-Created Login Profile for Root Accounts in AWS • `New Rule` Adding Coverage for `Azure Entra MFA TOTP Brute Force Attempts` • `New Rule` Endpoint Security Promotion Rules for Specific Events • `New Rule` PAM Version Discovery • `New Rule` Pluggable Authentication Module Creation in Unusual Directory • `New Rule` Unusual SSHD Child Process • `New Rule` Unusual Preload Environment Variable Process Execution • `New Rule` Loadable Kernel Module Configuration File Creation • `New Rule` Simple HTTP Web Server Creation • `New Rule` Simple HTTP Web Server Connection • `New Rule` Kernel Object File Creation • `New Rule` Dynamic Linker (ld.so) Creation • `New Rule` Pluggable Authentication Module Source Download • `New Rule` SSH via Backdoored System User • `New BBR` Linux System Information Discovery via Getconf • `New Rule` Suspicious Path Invocation from Command Line • `New Rule` System Binary Path File Permission Modification • `New Rules` Kernel Seeking/Unpacking Activity • `New Rule` Process Started with Executable Stack • `New Rule` GRUB Configuration File Creation • `New Rule` GRUB Configuration Generation through Built-in Utilities • `New Rule` Adding Coverage for `AWS SQS Queue Purge` • `New Rule` Adding Coverage for `AWS EC2 Deprecated AMI Discovery` • `New Rule` Adding Coverage for `SNS Topic Message Publish by Rare User` • `New Rule` Adding Coverage for `Unusual AWS S3 Object Encryption with SSE-C` • [Deprecation] Deprecating `Potential Password Spraying of Microsoft 365 User Accounts` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/detection-rules

Detection Rules dev-v0.3.0

Tue, 04 Feb 2025 13:29:55 GMT

dev-v0.3.0 introduces new detection rules, hunting queries, and a prerelease source connector. • Adds `sentinel_one_cloud_funnel` as a prerelease version for the data source • Adds investigation guide generation capability via `[FR] Generate investigation guides` • Adds new detection rule for Execution of a downloaded windows script • Adds new detection rule for Process Backgrounded by Unusual Parent • Adds new detection rule for Suspicious Usage of bpf_probe_write_user Helper • Adds new detection rule for File with Right-to-Left Override Character Created/Executed • Adds new detection rule for Unusual D-Bus Daemon Child Process • Adds new detection rule for Adding Coverage for AWS S3 Unauthenticated Bucket Access by Rare Source • Adds new detection rule for Polkit Version Discovery • Adds new detection rule for Polkit Policy Creation • Adds new detection rule for Unusual Pkexec Execution • Adds new detection rule for NetworkManager Dispatcher Script Creation • Adds new detection rule for D-Bus Service Created • Adds new detection rule for Manual Dracut Execution • Adds new detection rule for Dracut Module Creation • Adds new detection rule for OpenSSL Password Hash Generation • Adds new detection rule for Boot File Copy • Adds new detection rule for Initramfs Unpacking via unmkinitramfs • Adds new detection rule for Initramfs Extraction via CPIO • Adds new detection rule for Systemd Shell Execution During Boot • Adds new detection rule for GRUB Configuration Generation through Built-in Utilities • Adds new detection rule for GRUB Configuration File Creation • Adds new detection rule for Process Started with Executable Stack • Adds new detection rule for Kernel Seeking/Unpacking Activity • Adds new detection rule for System Binary Path File Permission Modification • Adds new detection rule for Suspicious Path Invocation from Command Line • Adds new detection rule for Linux System Information Discovery via Getconf • Adds new detection rule for Adding Coverage for SNS Topic Message Publish by Rare User • Adds new detection rule for Adding Coverage for AWS EC2 Deprecated AMI Discovery • Adds new detection rule for Adding Coverage for AWS SQS Queue Purge • Adds new detection rule for Sensitive Audit Policy Sub-Category Disabled • Adds new detection rule for Potential Process Name Stomping with Prctl • Adds new detection rule for SSH via Backdoored System User • Adds new detection rule for Pluggable Authentication Module Source Download • Adds new detection rule for Dynamic Linker (ld.so) Creation • Adds new detection rule for Kernel Object File Creation • Adds new detection rule for Simple HTTP Web Server Connection • Adds new detection rule for Simple HTTP Web Server Creation • Adds new detection rule for Loadable Kernel Module Configuration File Creation • Adds new detection rule for Unusual Preload Environment Variable Process Execution • Adds new detection rule for Unusual SSHD Child Process • Adds new detection rule for Pluggable Authentication Module Creation in Unusual Directory • Adds new detection rule for PAM Version Discovery • Adds new detection rule for Endpoint Security Promotion Rules for Specific Events • Adds new detection rule for Adding Coverage for Azure Entra MFA TOTP Brute Force Attempts • Adds new detection rule for Adding Coverage for Self-Created Login Profile for Root Accounts in AWS • Adds new detection rule for Adding Coverage for AWS STS AssumeRoot by Rare User and Member Account • Adds new hunting query for IAM Unusual Default Aviatrix Role Activity • Adds new hunting query for Persistence via Initramfs • Adds new hunting query for Persistence via GRUB Bootloader • Adds new hunting queries for AWS IAM Unusual AWS Access Key Usage for User • Adds deprecation warnings for Experimental ML commands Full history on Cyber Toolchain: https://cybertoolchain.io/tools/detection-rules

Detection Rules dev-v0.2.0

Wed, 13 Nov 2024 15:20:55 GMT

Adds 13 new detection rules including DeviceCode auth and Hex payload execution, plus Crowdstrike FDR support. • [New] First Time Seen User Auth via DeviceCode Protocol • [New Rule] Potential Hex Payload Execution • [New Rule] Memory Swap Modification • [New Rule] Unusual Interactive Shell Launched from System User • [New Rule] Web Server Spawned via Python • [New Rule] Directory Creation in /bin directory • [New Rule] Hidden Directory Creation via Unusual Parent • [New Rule] Security File Access via Common Utilities • [New Rule] Potential Data Splitting Detected • [New Rule] Private Key Searching Activity • [New Rule] IPv4/IPv6 Forwarding Activity • [New Rule] Curl SOCKS Proxy Activity from Unusual Parent • 3rd Party EDR - Add Crowdstrike FDR support • Account for CCS '::' index pattern Full history on Cyber Toolchain: https://cybertoolchain.io/tools/detection-rules