Potential Third-Party Cloud Storage Client Execution

MediumMicrosoft Sentinel analytics

GreyNoise TI map IP entity to Network Session Events (ASIM Network Session schema)

This rule identifies a match Network Sessions for which the source or destination IP address is a known GreyNoise IoC. This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM NetworkSession schema

T1071

Licence: MIT License
Published: Sep 29, 2026

MediumMicrosoft Sentinel analytics

GreyNoise TI Map IP Entity to SigninLogs

This query maps any GreyNoise IP indicators of compromise (IOCs) from threat intelligence (TI), by searching for matches in SigninLogs.

T1071

Licence: MIT License
Published: Sep 29, 2026

MediumMicrosoft Sentinel analytics

GreyNoise TI map IP entity to OfficeActivity

This query maps any GreyNoise IP indicators of compromise (IOCs) from threat intelligence (TI), by searching for matches in OfficeActivity.

T1071

Licence: MIT License
Published: Sep 29, 2026

MediumMicrosoft Sentinel analytics

GreyNoise TI Map IP Entity to DnsEvents

This query maps any IP indicators of compromise (IOCs) from GreyNoise Threat Intelligence (TI), by searching for matches in DnsEvents.

T1071

Licence: MIT License
Published: Sep 29, 2026

MediumMicrosoft Sentinel analytics

GreyNoise TI Map IP Entity to CommonSecurityLog

This query maps GreyNoise IP indicators of compromise (IOCs) from threat intelligence (TI), by searching for matches in CommonSecurityLog.

T1071

Licence: MIT License
Published: Sep 29, 2026

HighElastic detection rules

Potential TerminalFix Cloudflare Lure in PowerShell

Identifies PowerShell script blocks that print a fake Cloudflare verification lure. TerminalFix pages instruct the victim to paste a command into Windows Terminal or PowerShell. The script presents messages such as "Cloudflare verification", "Cloudflare ID:", or "I am not a robot" while it stages a payload. Review the full script block for download, extraction, and follow-on execution.

T1059T1059.001T1189T1204T1204.004

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Sep 29, 2026

HighElastic detection rules

Potential Execution via FileFix Phishing Attack

Identifies the execution of Windows commands or downloaded files via the browser's dialog box. Adversaries may use phishing to instruct the victim to copy and paste malicious commands for execution via crafted phishing web pages.

T1059T1059.001T1059.003T1204T1204.002+6 more

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Sep 29, 2026

HighElastic detection rules

Potential FileFix Command via Windows Explorer Address Bar

Identifies suspicious commands written to the Windows Explorer address bar history (TypedPaths). Adversaries socially engineer users to paste a command into the address bar of File Explorer or of a browser's file upload dialog, a pattern known as FileFix; the writing process is therefore explorer.exe or the browser hosting the dialog.

T1059T1059.001T1059.003T1105T1204+9 more

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Sep 29, 2026

HighElastic detection rules

Potential ClickFix Command via Windows Run Dialog

Identifies suspicious commands written to the Windows Run dialog history (RunMRU) by explorer.exe. Adversaries socially engineer users to copy and paste malicious commands for execution, a pattern commonly seen in Fake CAPTCHA (ClickFix) campaigns. Investigate the process tree for a child of explorer.exe that matches the stored command.

T1059T1059.001T1059.003T1105T1204+5 more

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Sep 29, 2026

HighElastic detection rules

Suspicious PowerShell from npm Package Install

Detects PowerShell launched with an encoded command or a download cradle whose process ancestry includes a Node.js npm package execution (`npx-cli.js` with a scoped or versioned package). Malicious npm packages and supply-chain compromises commonly run this from install or postinstall scripts to fetch and execute a second stage.

T1027T1027.010T1059T1059.001T1105+2 more

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Sep 29, 2026

HighElastic detection rules

First-Time FortiGate Administrator Login

This rule detects the first observed successful login of a user with the Administrator role to the FortiGate management interface within the last 5 days. First-time administrator logins can indicate newly provisioned accounts, misconfigurations, or unauthorized access using valid credentials and should be reviewed promptly.

T1078

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Sep 29, 2026

MediumElastic detection rules

Potential NetScaler Log Poisoning Command Injection Attempt

Detects shell syntax in NetScaler Pitboss records or in Citrix records that combine Pitboss, packet-engine, or core terminology with shell syntax. This may indicate that attacker-controlled data poisoned an appliance log consumed by a privileged script. The behavior includes CVE-2026-88771, but the detection is intended to identify similar NetScaler log-poisoning command-injection attempts without requiring a specific vulnerability, failure phrase, or command.

T1059T1059.004T1190

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Sep 29, 2026

MediumElastic detection rules

FortiGate FortiCloud SSO Login from Unusual Source

This rule detects the first successful FortiCloud SSO login from a previously unseen source IP address to a FortiGate device within the last 5 days. FortiCloud SSO logins from new source IPs may indicate exploitation of SAML-based authentication bypass vulnerabilities such as CVE-2026-24858, where crafted SAML assertions allow unauthorized access to FortiGate devices registered to other accounts.

T1078T1078.004T1190T1606T1606.002

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Sep 29, 2026

MediumElastic detection rules

First Seen External MQTT Broker Connection

Identifies the first MQTT relationship from an internal source to an external broker that was not observed during the previous 14 days. MQTT is commonly used by IoT and messaging applications, but malware including BambooToken, IOCONTROL, MQsTTang, and WailingCrab has used publish/subscribe traffic for command and control.

T1071T1071.005

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Sep 29, 2026

MediumElastic detection rules

Potential DNS Tunneling via NULL or Long DNS Queries

Identifies DNS query patterns associated with tunneling, including rare NULL queries, repeated TXT queries with unusually long names, and clients generating many unique, long subdomains under one registered domain within a five-minute window.

T1048T1048.003T1071T1071.004T1572

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Sep 29, 2026

HighElastic detection rules

Privilege Escalation via Parallels Appliance Extract Argument Injection

Identifies the Parallels Desktop root dispatcher (prl_disp_service) spawning tar/bsdtar with more arguments than its fixed extract command uses. The dispatcher always runs a 5-token command (tar -xf <archive> -C <dir>), so any additional arguments indicate an attacker-controlled folder name injecting extra tar flags. On macOS these flags let tar read or write attacker-chosen paths or execute an external program as root, resulting in local privilege escalation (CVE-2026-90894, Parallels

T1068T1202

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Sep 29, 2026

LowElastic detection rules

Unusual File Creation via Web Server

This rule leverages the "new_terms" rule type to detect unusual file creations originating from web server processes on Linux systems. Attackers may exploit web servers to maintain persistence on a compromised system, often resulting in atypical file creations. As file creations from web server processes are common, the "new_terms" rule type approach helps to identify deviations from normal behavior.

T1059T1059.004T1071T1190T1505+1 more

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Sep 29, 2026

LowElastic detection rules

Linux User Account Creation

Identifies attempts to create new users. Attackers may add new users to establish persistence on a system.

T1136T1136.001

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Sep 29, 2026

LowElastic detection rules

Excessive Sudo Authentication Failures via macOS Security Events

Identifies a high number of failed sudo password attempts on a macOS host within a short time window, using sudo messages collected by the Authentication data stream of the macOS Security Events integration. Repeated sudo authentication failures may indicate an adversary with access to a low-privileged account attempting to guess an administrator password to escalate privileges.

T1110T1110.001T1548T1548.003

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Sep 29, 2026

MediumElastic detection rules

Launch Item Registration with Suspicious Executable Path via macOS Security Events

Identifies the registration of a launch agent or launch daemon whose target executable resides in a temporary or user-writable location, using launch item registration messages collected by the macOS Security Events integration. An adversary may establish persistence with a launch agent or daemon that runs a program staged in a world-writable or temporary directory, which is uncommon for legitimate software.

T1543T1543.001T1543.004

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Sep 29, 2026

MediumElastic detection rules

Persistence via a Hidden Plist Filename via macOS Security Events

Identifies the registration of a launch agent or launch daemon whose property list (plist) filename begins with a dot, using launch item registration messages collected by the macOS Security Events integration. An adversary may establish persistence by installing a launch agent or daemon that executes at login or boot; plist files with filenames starting with a dot are hidden from default directory listings and are particularly suspicious.

T1543T1543.001T1543.004T1547T1547.011+2 more

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Sep 29, 2026

HighElastic detection rules

Google Workspace Object Copied from External Drive with App Consent

Detects when a Workspace user copies a document, spreadsheet, form, or script from an external Drive into their My Drive and, within minutes from the same IP, authorizes a custom web OAuth client that requests an Apps Script scope. `script.container` is the container sidebar or dialog. The check also matches any other `script.*` scope, a `*.currentonly` scope, or a scope containing `scripts` or `container`.

T1098T1098.001T1204T1204.001T1566+1 more

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Sep 29, 2026

MediumElastic detection rules

Unusual Azure VM Extension Detected

Identifies the first time a given VM extension name is created or updated on an Azure virtual machine or VM scale set within the rule's lookback window. VM extensions run with high privilege on the guest (SYSTEM on Windows, root on Linux) and are a common code-execution and persistence primitive. The extension instance name is attacker-controlled and the Azure activity log records only that name, not the publisher or type, so the control plane cannot reliably identify the extension family (for

T1037T1651

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Sep 29, 2026

LowElastic detection rules

AWS Lambda Function Deletion by Unusual User

Identifies when an unusual user deletes an AWS Lambda function. Deleting a function removes its code, configuration, versions, and aliases. Adversaries may delete functions to disrupt business operations and automated workflows, to destroy attacker-deployed backdoors and remove evidence after achieving their objective, or to inhibit incident response.

T1485T1489

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Sep 29, 2026

HighElastic detection rules

AWS Backup Recovery Point Deleted by Unusual User

Identifies when an unusual user deletes an AWS Backup recovery point via DeleteRecoveryPoint. A recovery point is a stored backup of a protected resource (EBS, RDS, DynamoDB, EFS, S3, and others). Deleting recovery points removes the ability to restore the associated data and is a core anti-recovery technique used in ransomware and data-destruction attacks to ensure victims cannot recover without paying or rebuilding.

T1490

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Sep 29, 2026

MediumElastic detection rules

AWS Lambda Function Invoked by an Unusual Principal

Identifies the first time within the prior 14 days that a principal directly invokes an AWS Lambda function in an account, excluding invocations made on behalf of AWS services (normal event-source triggers). Adversaries who compromise credentials or move laterally may directly invoke functions to execute code, retrieve data returned by a function, or abuse an over-permissioned execution role.

T1648

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Sep 29, 2026

HighElastic detection rules

Potential Destructive AWS CLI Command Executed by GenAI Agent

Identifies a cloud CLI command that destroys infrastructure or identities, such as terminating EC2 instances, removing S3 buckets, or deleting IAM users, when it is spawned by a GenAI coding agent directly or through the agent's shell wrapper. A compromised or prompt-injected agent can be steered into wiping the developer's environment and cloud account using the credentials it already holds, as seen in the malicious Amazon Q Developer for VS Code v1.84.0 release (AWS-2025-015).

T1485T1531T1562T1562.008

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Sep 29, 2026

MediumElastic detection rules

Potential Third-Party Cloud Storage Client Execution

Identifies execution of a third-party S3 or object-storage client (S3 Browser, s5cmd, s3cmd, MinIO mc, rclone, Cyberduck, s3fs, goofys, juicefs) launched by a script interpreter, a shell one-liner, or from a temporary or user-writable path. After stealing cloud credentials, adversaries switch from the AWS CLI to these clients to enumerate and drain buckets in bulk. Gating on a scripted context separates post-exploitation automation from interactive developer use.

T1530T1537T1567T1567.002

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Sep 29, 2026

MediumElastic detection rules

Node.js Pre or Post-Install Script Execution

This rule detects the execution of Node.js pre or post-install scripts. These scripts are executed by the Node.js package manager (npm) during the installation of packages. Adversaries may abuse this technique to execute arbitrary commands on the system and establish persistence. This activity was observed in the wild as part of the Shai-Hulud worm.

T1059T1059.004T1059.007T1195T1195.001+4 more

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Sep 29, 2026

MediumElastic detection rules

Cloud Offensive Framework Execution

Identifies execution of well-known cloud exploitation, enumeration, and attack-simulation frameworks on an endpoint. Adversaries run these after obtaining cloud credentials to map the compromised principal's effective permissions, discover privilege escalation paths, and pivot to the console. Pacu is tracked by MITRE as software S1091.

T1059T1059.006T1069T1069.003T1580

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Sep 29, 2026

Reference	Class	Cited by
blog.darklab.hk/2021/07/06/trouble-in-paradise/	Unclassified	Only this detection cites it
github.com/ramimac/aws-customer-security-incidents	Tool	2
unit42.paloaltonetworks.com/large-scale-cloud-extortion-operation/	Threat report	Only this detection cites it

Detection rules

Potential Third-Party Cloud Storage Client Execution

Description

Detection logic

Detection requirements

Known benign triggers

MITRE ATT&CK mappings

References

From the source

Licence

Authorship

Detection rules